From 9382970da83519164f6c2da801b64a6c221014b6 Mon Sep 17 00:00:00 2001 From: manastasova Date: Tue, 24 Mar 2026 00:05:01 +0000 Subject: [PATCH] Update import.sh; Imported s2n-bignum version: main/3bfe68deb9fbdaf23be0a927c362a87a799adc28 --- third_party/s2n-bignum/META.yml | 4 +- third_party/s2n-bignum/import.sh | 138 +- .../s2n-bignum-imported/CODE_OF_CONDUCT.md | 4 - .../s2n-bignum-imported/CONTRIBUTING.md | 59 - .../s2n-bignum/s2n-bignum-imported/README.md | 8 +- .../s2n-bignum-imported/SOUNDNESS.md | 349 + .../s2n-bignum-imported/arm/INSTRUCTION.md | 78 - .../s2n-bignum-imported/arm/Makefile | 550 - .../s2n-bignum-imported/arm/allowed_asm | 172 - .../arm/curve25519/Makefile | 77 - .../arm/curve25519/bignum_add_p25519.S | 79 - .../arm/curve25519/bignum_cmul_p25519.S | 106 - .../arm/curve25519/bignum_double_p25519.S | 76 - .../arm/curve25519/bignum_inv_p25519.S | 1260 --- .../arm/curve25519/bignum_invsqrt_p25519.S | 616 -- .../curve25519/bignum_invsqrt_p25519_alt.S | 479 - .../arm/curve25519/bignum_mod_m25519_4.S | 86 - .../arm/curve25519/bignum_mod_n25519.S | 4 +- .../arm/curve25519/bignum_mod_n25519_4.S | 109 - .../arm/curve25519/bignum_mod_p25519_4.S | 77 - .../arm/curve25519/bignum_mul_p25519.S | 339 - .../arm/curve25519/bignum_mul_p25519_alt.S | 209 - .../arm/curve25519/bignum_optneg_p25519.S | 80 - .../arm/curve25519/bignum_sqr_p25519.S | 234 - .../arm/curve25519/bignum_sqr_p25519_alt.S | 183 - .../arm/curve25519/bignum_sqrt_p25519.S | 627 -- .../arm/curve25519/bignum_sqrt_p25519_alt.S | 490 - .../arm/curve25519/bignum_sub_p25519.S | 73 - .../arm/curve25519/curve25519_ladderstep.S | 967 -- .../curve25519/curve25519_ladderstep_alt.S | 691 -- .../arm/curve25519/curve25519_pxscalarmul.S | 1001 -- .../curve25519/curve25519_pxscalarmul_alt.S | 725 -- .../arm/curve25519/curve25519_x25519.S | 2596 ----- .../arm/curve25519/curve25519_x25519_alt.S | 1702 --- .../arm/curve25519/curve25519_x25519base.S | 9591 ----------------- .../curve25519/curve25519_x25519base_alt.S | 9434 ---------------- .../arm/curve25519/edwards25519_epadd.S | 594 - .../arm/curve25519/edwards25519_epadd_alt.S | 437 - .../arm/curve25519/edwards25519_epdouble.S | 499 - .../curve25519/edwards25519_epdouble_alt.S | 362 - .../arm/curve25519/edwards25519_pdouble.S | 494 - .../arm/curve25519/edwards25519_pdouble_alt.S | 357 - .../arm/curve25519/edwards25519_pepadd.S | 568 - .../arm/curve25519/edwards25519_pepadd_alt.S | 410 - .../s2n-bignum-imported/arm/fastmul/Makefile | 47 - .../arm/fastmul/bignum_emontredc_8n.S | 1322 +-- .../arm/fastmul/bignum_emontredc_8n_cdiff.S | 662 -- .../arm/fastmul/bignum_mul_4_8.S | 257 - .../arm/fastmul/bignum_mul_4_8_alt.S | 152 - .../arm/fastmul/bignum_mul_6_12.S | 283 - .../arm/fastmul/bignum_mul_6_12_alt.S | 270 - .../arm/fastmul/bignum_mul_8_16.S | 526 - .../arm/fastmul/bignum_mul_8_16_alt.S | 412 - .../arm/fastmul/bignum_sqr_4_8.S | 149 - .../arm/fastmul/bignum_sqr_4_8_alt.S | 128 - .../arm/fastmul/bignum_sqr_6_12.S | 266 - .../arm/fastmul/bignum_sqr_6_12_alt.S | 198 - .../arm/fastmul/bignum_sqr_8_16.S | 428 - .../arm/fastmul/bignum_sqr_8_16_alt.S | 285 - .../fastmul/unopt/bignum_emontredc_8n_base.S | 380 - .../unopt/bignum_emontredc_8n_cdiff_base.S | 681 -- .../arm/fastmul/unopt/bignum_mul_8_16_base.S | 349 - .../arm/fastmul/unopt/bignum_sqr_8_16_base.S | 356 - .../s2n-bignum-imported/arm/generic/Makefile | 103 - .../arm/generic/bignum_add.S | 125 - .../arm/generic/bignum_amontifier.S | 391 - .../arm/generic/bignum_amontmul.S | 185 - .../arm/generic/bignum_amontredc.S | 180 - .../arm/generic/bignum_amontsqr.S | 185 - .../arm/generic/bignum_bitfield.S | 98 - .../arm/generic/bignum_bitsize.S | 72 - .../arm/generic/bignum_cdiv.S | 283 - .../arm/generic/bignum_cdiv_exact.S | 167 - .../arm/generic/bignum_cld.S | 57 - .../arm/generic/bignum_clz.S | 73 - .../arm/generic/bignum_cmadd.S | 118 - .../arm/generic/bignum_cmnegadd.S | 132 - .../arm/generic/bignum_cmod.S | 184 - .../arm/generic/bignum_cmul.S | 109 - .../arm/generic/bignum_coprime.S | 455 - .../arm/generic/bignum_copy.S | 67 - .../arm/generic/bignum_ctd.S | 58 - .../arm/generic/bignum_ctz.S | 78 - .../arm/generic/bignum_demont.S | 161 - .../arm/generic/bignum_digit.S | 64 - .../arm/generic/bignum_digitsize.S | 57 - .../arm/generic/bignum_divmod10.S | 84 - .../arm/generic/bignum_emontredc.S | 114 - .../arm/generic/bignum_eq.S | 87 - .../arm/generic/bignum_even.S | 36 - .../arm/generic/bignum_gt.S | 94 - .../arm/generic/bignum_iszero.S | 48 - .../arm/generic/bignum_le.S | 94 - .../arm/generic/bignum_lt.S | 94 - .../arm/generic/bignum_madd.S | 128 - .../arm/generic/bignum_modadd.S | 88 - .../arm/generic/bignum_moddouble.S | 77 - .../arm/generic/bignum_modexp.S | 567 - .../arm/generic/bignum_modifier.S | 463 - .../arm/generic/bignum_modinv.S | 613 -- .../arm/generic/bignum_modoptneg.S | 83 - .../arm/generic/bignum_modsub.S | 74 - .../arm/generic/bignum_montifier.S | 462 - .../arm/generic/bignum_montmul.S | 198 - .../arm/generic/bignum_montredc.S | 198 - .../arm/generic/bignum_montsqr.S | 197 - .../arm/generic/bignum_muladd10.S | 67 - .../arm/generic/bignum_mux.S | 55 - .../arm/generic/bignum_mux16.S | 72 - .../arm/generic/bignum_negmodinv.S | 139 - .../arm/generic/bignum_nonzero.S | 49 - .../arm/generic/bignum_normalize.S | 113 - .../arm/generic/bignum_odd.S | 35 - .../arm/generic/bignum_of_word.S | 50 - .../arm/generic/bignum_optadd.S | 76 - .../arm/generic/bignum_optneg.S | 75 - .../arm/generic/bignum_optsubadd.S | 91 - .../arm/generic/bignum_pow2.S | 65 - .../arm/generic/bignum_shl_small.S | 104 - .../arm/generic/bignum_shr_small.S | 95 - .../arm/generic/bignum_sub.S | 122 - .../arm/generic/word_bytereverse.S | 44 - .../arm/generic/word_clz.S | 30 - .../arm/generic/word_ctz.S | 42 - .../arm/generic/word_divstep59.S | 328 - .../arm/generic/word_max.S | 35 - .../arm/generic/word_min.S | 35 - .../arm/generic/word_negmodinv.S | 83 - .../arm/generic/word_popcount.S | 46 - .../arm/generic/word_recip.S | 124 - .../s2n-bignum-imported/arm/mlkem/Makefile | 39 - .../arm/mlkem/mlkem_basemul_k2.S | 218 - .../arm/mlkem/mlkem_basemul_k3.S | 272 - .../arm/mlkem/mlkem_basemul_k4.S | 326 - .../arm/mlkem/mlkem_intt.S | 421 - .../arm/mlkem/mlkem_mulcache_compute.S | 75 - .../s2n-bignum-imported/arm/mlkem/mlkem_ntt.S | 372 - .../arm/mlkem/mlkem_reduce.S | 112 - .../mlkem/mlkem_rej_uniform_VARIABLE_TIME.S | 216 - .../arm/mlkem/mlkem_tobytes.S | 124 - .../arm/mlkem/mlkem_tomont.S | 93 - .../s2n-bignum-imported/arm/p256/Makefile | 66 - .../arm/p256/bignum_add_p256.S | 78 - .../arm/p256/bignum_bigendian_4.S | 145 - .../arm/p256/bignum_cmul_p256.S | 137 - .../arm/p256/bignum_deamont_p256.S | 121 - .../arm/p256/bignum_demont_p256.S | 99 - .../arm/p256/bignum_double_p256.S | 78 - .../arm/p256/bignum_half_p256.S | 75 - .../arm/p256/bignum_inv_p256.S | 1279 --- .../arm/p256/bignum_littleendian_4.S | 142 - .../arm/p256/bignum_mod_n256.S | 181 - .../arm/p256/bignum_mod_n256_4.S | 85 - .../arm/p256/bignum_mod_p256.S | 168 - .../arm/p256/bignum_mod_p256_4.S | 75 - .../arm/p256/bignum_montmul_p256.S | 468 - .../arm/p256/bignum_montmul_p256_alt.S | 211 - .../arm/p256/bignum_montsqr_p256.S | 330 - .../arm/p256/bignum_montsqr_p256_alt.S | 188 - .../arm/p256/bignum_mux_4.S | 63 - .../arm/p256/bignum_neg_p256.S | 72 - .../arm/p256/bignum_nonzero_4.S | 49 - .../arm/p256/bignum_optneg_p256.S | 89 - .../arm/p256/bignum_sub_p256.S | 72 - .../arm/p256/bignum_tomont_p256.S | 122 - .../arm/p256/bignum_triple_p256.S | 118 - .../arm/p256/p256_montjadd.S | 3165 ------ .../arm/p256/p256_montjadd_alt.S | 555 - .../arm/p256/p256_montjdouble.S | 1555 --- .../arm/p256/p256_montjdouble_alt.S | 587 - .../arm/p256/p256_montjmixadd.S | 513 - .../arm/p256/p256_montjmixadd_alt.S | 517 - .../arm/p256/p256_scalarmul.S | 8620 --------------- .../arm/p256/p256_scalarmul_alt.S | 6235 ----------- .../arm/p256/p256_scalarmulbase.S | 3782 ------- .../arm/p256/p256_scalarmulbase_alt.S | 3057 ------ .../arm/p256/unopt/README.md | 9 - .../arm/p256/unopt/bignum_montmul_p256_base.S | 275 - .../arm/p256/unopt/bignum_montsqr_p256_base.S | 266 - .../arm/p256/unopt/p256_montjadd.S | 612 -- .../arm/p256/unopt/p256_montjdouble.S | 748 -- .../s2n-bignum-imported/arm/p384/Makefile | 62 - .../arm/p384/bignum_bigendian_6.S | 184 - .../arm/p384/bignum_cmul_p384.S | 147 - .../arm/p384/bignum_demont_p384.S | 122 - .../arm/p384/bignum_double_p384.S | 92 - .../arm/p384/bignum_half_p384.S | 86 - .../arm/p384/bignum_inv_p384.S | 1474 --- .../arm/p384/bignum_mod_n384.S | 209 - .../arm/p384/bignum_mod_n384_6.S | 93 - .../arm/p384/bignum_mod_p384.S | 182 - .../arm/p384/bignum_mod_p384_6.S | 86 - .../arm/p384/bignum_mux_6.S | 73 - .../arm/p384/bignum_optneg_p384.S | 102 - .../arm/p384/bignum_triple_p384.S | 136 - .../arm/p384/p384_montjadd.S | 6440 ----------- .../arm/p384/p384_montjadd_alt.S | 999 -- .../arm/p384/p384_montjmixadd.S | 882 -- .../arm/p384/p384_montjmixadd_alt.S | 947 -- .../arm/p384/unopt/bignum_montmul_p384_base.S | 417 - .../arm/p384/unopt/bignum_montsqr_p384_base.S | 374 - .../arm/p384/unopt/p384_montjadd.S | 1036 -- .../arm/p384/unopt/p384_montjdouble.S | 1216 --- .../s2n-bignum-imported/arm/p521/Makefile | 61 - .../arm/p521/bignum_cmul_p521.S | 154 - .../arm/p521/bignum_deamont_p521.S | 120 - .../arm/p521/bignum_demont_p521.S | 75 - .../arm/p521/bignum_double_p521.S | 72 - .../arm/p521/bignum_half_p521.S | 77 - .../arm/p521/bignum_mod_n521_9.S | 148 - .../arm/p521/bignum_mod_p521_9.S | 97 - .../arm/p521/bignum_montmul_p521.S | 1423 --- .../arm/p521/bignum_montmul_p521_alt.S | 559 - .../arm/p521/bignum_montsqr_p521.S | 1130 -- .../arm/p521/bignum_montsqr_p521_alt.S | 389 - .../arm/p521/bignum_optneg_p521.S | 92 - .../arm/p521/bignum_tomont_p521.S | 118 - .../arm/p521/bignum_triple_p521.S | 121 - .../s2n-bignum-imported/arm/p521/p521_jadd.S | 1626 --- .../arm/p521/p521_jadd_alt.S | 984 -- .../arm/p521/p521_jmixadd.S | 1363 --- .../arm/p521/p521_jmixadd_alt.S | 888 -- .../arm/p521/unopt/bignum_montmul_p521_base.S | 593 - .../arm/p521/unopt/bignum_montsqr_p521_base.S | 625 -- .../arm/p521/unopt/bignum_mul_p521_base.S | 592 - .../arm/p521/unopt/bignum_sqr_p521_base.S | 603 -- .../arm/secp256k1/Makefile | 56 - .../arm/secp256k1/bignum_add_p256k1.S | 84 - .../arm/secp256k1/bignum_cmul_p256k1.S | 101 - .../arm/secp256k1/bignum_deamont_p256k1.S | 115 - .../arm/secp256k1/bignum_demont_p256k1.S | 92 - .../arm/secp256k1/bignum_double_p256k1.S | 81 - .../arm/secp256k1/bignum_half_p256k1.S | 73 - .../arm/secp256k1/bignum_mod_n256k1_4.S | 86 - .../arm/secp256k1/bignum_mod_p256k1_4.S | 70 - .../arm/secp256k1/bignum_montmul_p256k1.S | 284 - .../arm/secp256k1/bignum_montmul_p256k1_alt.S | 239 - .../arm/secp256k1/bignum_montsqr_p256k1.S | 188 - .../arm/secp256k1/bignum_montsqr_p256k1_alt.S | 199 - .../arm/secp256k1/bignum_mul_p256k1.S | 307 - .../arm/secp256k1/bignum_mul_p256k1_alt.S | 205 - .../arm/secp256k1/bignum_neg_p256k1.S | 69 - .../arm/secp256k1/bignum_optneg_p256k1.S | 79 - .../arm/secp256k1/bignum_sqr_p256k1.S | 227 - .../arm/secp256k1/bignum_sqr_p256k1_alt.S | 179 - .../arm/secp256k1/bignum_sub_p256k1.S | 73 - .../arm/secp256k1/bignum_tomont_p256k1.S | 107 - .../arm/secp256k1/bignum_triple_p256k1.S | 109 - .../arm/secp256k1/secp256k1_jadd.S | 554 - .../arm/secp256k1/secp256k1_jadd_alt.S | 427 - .../arm/secp256k1/secp256k1_jdouble.S | 895 -- .../arm/secp256k1/secp256k1_jdouble_alt.S | 665 -- .../arm/secp256k1/secp256k1_jmixadd.S | 513 - .../arm/secp256k1/secp256k1_jmixadd_alt.S | 385 - .../s2n-bignum-imported/arm/sha3/Makefile | 36 - .../arm/sha3/sha3_keccak2_f1600_alt.S | 292 - .../arm/sha3/sha3_keccak4_f1600.S | 865 -- .../s2n-bignum-imported/arm/sm2/Makefile | 58 - .../arm/sm2/bignum_add_sm2.S | 78 - .../arm/sm2/bignum_cmul_sm2.S | 110 - .../arm/sm2/bignum_deamont_sm2.S | 114 - .../arm/sm2/bignum_demont_sm2.S | 94 - .../arm/sm2/bignum_double_sm2.S | 76 - .../arm/sm2/bignum_half_sm2.S | 76 - .../arm/sm2/bignum_inv_sm2.S | 1275 --- .../arm/sm2/bignum_mod_nsm2.S | 181 - .../arm/sm2/bignum_mod_nsm2_4.S | 85 - .../arm/sm2/bignum_mod_sm2.S | 154 - .../arm/sm2/bignum_mod_sm2_4.S | 74 - .../arm/sm2/bignum_montinv_sm2.S | 1296 --- .../arm/sm2/bignum_montmul_sm2.S | 272 - .../arm/sm2/bignum_montmul_sm2_alt.S | 210 - .../arm/sm2/bignum_montsqr_sm2.S | 273 - .../arm/sm2/bignum_montsqr_sm2_alt.S | 183 - .../arm/sm2/bignum_neg_sm2.S | 71 - .../arm/sm2/bignum_optneg_sm2.S | 88 - .../arm/sm2/bignum_sub_sm2.S | 72 - .../arm/sm2/bignum_tomont_sm2.S | 112 - .../arm/sm2/bignum_triple_sm2.S | 112 - .../arm/sm2/sm2_montjadd.S | 545 - .../arm/sm2/sm2_montjadd_alt.S | 554 - .../arm/sm2/sm2_montjdouble.S | 668 -- .../arm/sm2/sm2_montjdouble_alt.S | 582 - .../arm/sm2/sm2_montjmixadd.S | 507 - .../arm/sm2/sm2_montjmixadd_alt.S | 515 - .../arm/sm2/sm2_montjscalarmul.S | 4514 -------- .../arm/sm2/sm2_montjscalarmul_alt.S | 3421 ------ .../arm/tutorial/README.md | 23 - .../s2n-bignum-imported/arm/tutorial/bignum.S | 11 - .../arm/tutorial/bignum.ml | 159 - .../s2n-bignum-imported/arm/tutorial/branch.S | 7 - .../arm/tutorial/branch.ml | 119 - .../s2n-bignum-imported/arm/tutorial/loop.S | 10 - .../s2n-bignum-imported/arm/tutorial/loop.ml | 123 - .../s2n-bignum-imported/arm/tutorial/memory.S | 4 - .../arm/tutorial/memory.ml | 75 - .../arm/tutorial/rel_equivtac.S | 4 - .../arm/tutorial/rel_equivtac.ml | 198 - .../arm/tutorial/rel_equivtac2.S | 4 - .../arm/tutorial/rel_loop.S | 6 - .../arm/tutorial/rel_loop.ml | 151 - .../arm/tutorial/rel_loop2.S | 7 - .../arm/tutorial/rel_reordertac.S | 6 - .../arm/tutorial/rel_reordertac.ml | 187 - .../arm/tutorial/rel_reordertac2.S | 6 - .../arm/tutorial/rel_simp.S | 3 - .../arm/tutorial/rel_simp.ml | 95 - .../arm/tutorial/rel_simp2.S | 2 - .../arm/tutorial/rel_veceq.S | 28 - .../arm/tutorial/rel_veceq.ml | 148 - .../arm/tutorial/rel_veceq2.S | 26 - .../s2n-bignum-imported/arm/tutorial/rodata.S | 109 - .../arm/tutorial/rodata.ml | 469 - .../arm/tutorial/rodata_local.S | 106 - .../arm/tutorial/sequence.S | 4 - .../arm/tutorial/sequence.ml | 101 - .../s2n-bignum-imported/arm/tutorial/simple.S | 2 - .../arm/tutorial/simple.ml | 120 - .../doc/s2n_bignum_soundness.md | 1 + .../doc/s2n_bignum_soundness.svg | 65 + .../include/_internal_s2n_bignum.h | 2 +- .../include/_internal_s2n_bignum_x86.h | 5 + .../include/_internal_s2n_bignum_x86_att.h | 5 + .../include/s2n-bignum-c89.h | 1552 +-- .../s2n-bignum-imported/include/s2n-bignum.h | 43 +- .../s2n-bignum-imported/x86_att/Makefile | 345 - .../s2n-bignum-imported/x86_att/attrofy.sed | 137 - .../x86_att/curve25519/bignum_add_p25519.S | 107 - .../x86_att/curve25519/bignum_cmul_p25519.S | 117 - .../curve25519/bignum_cmul_p25519_alt.S | 131 - .../x86_att/curve25519/bignum_double_p25519.S | 105 - .../x86_att/curve25519/bignum_inv_p25519.S | 1591 --- .../curve25519/bignum_invsqrt_p25519.S | 620 -- .../curve25519/bignum_invsqrt_p25519_alt.S | 701 -- .../x86_att/curve25519/bignum_mod_m25519_4.S | 100 - .../x86_att/curve25519/bignum_mod_n25519.S | 36 +- .../x86_att/curve25519/bignum_mod_n25519_4.S | 113 - .../x86_att/curve25519/bignum_mod_p25519_4.S | 101 - .../x86_att/curve25519/bignum_mul_p25519.S | 206 - .../curve25519/bignum_mul_p25519_alt.S | 222 - .../x86_att/curve25519/bignum_optneg_p25519.S | 102 - .../x86_att/curve25519/bignum_sqr_p25519.S | 189 - .../curve25519/bignum_sqr_p25519_alt.S | 205 - .../x86_att/curve25519/bignum_sqrt_p25519.S | 621 -- .../curve25519/bignum_sqrt_p25519_alt.S | 701 -- .../x86_att/curve25519/bignum_sub_p25519.S | 89 - .../curve25519/curve25519_ladderstep.S | 747 -- .../curve25519/curve25519_ladderstep_alt.S | 913 -- .../curve25519/curve25519_pxscalarmul.S | 776 -- .../curve25519/curve25519_pxscalarmul_alt.S | 942 -- .../x86_att/curve25519/edwards25519_epadd.S | 441 - .../curve25519/edwards25519_epadd_alt.S | 517 - .../curve25519/edwards25519_epdouble.S | 379 - .../curve25519/edwards25519_epdouble_alt.S | 458 - .../x86_att/curve25519/edwards25519_pdouble.S | 374 - .../curve25519/edwards25519_pdouble_alt.S | 453 - .../x86_att/curve25519/edwards25519_pepadd.S | 424 - .../curve25519/edwards25519_pepadd_alt.S | 500 - .../x86_att/fastmul/bignum_emontredc_8n.S | 426 - .../x86_att/fastmul/bignum_kmul_16_32.S | 513 - .../x86_att/fastmul/bignum_kmul_32_64.S | 1161 -- .../x86_att/fastmul/bignum_ksqr_16_32.S | 545 - .../x86_att/fastmul/bignum_ksqr_32_64.S | 809 -- .../x86_att/fastmul/bignum_mul_4_8.S | 178 - .../x86_att/fastmul/bignum_mul_4_8_alt.S | 150 - .../x86_att/fastmul/bignum_mul_6_12.S | 214 - .../x86_att/fastmul/bignum_mul_6_12_alt.S | 190 - .../x86_att/fastmul/bignum_mul_8_16.S | 264 - .../x86_att/fastmul/bignum_mul_8_16_alt.S | 238 - .../x86_att/fastmul/bignum_sqr_4_8.S | 149 - .../x86_att/fastmul/bignum_sqr_4_8_alt.S | 138 - .../x86_att/fastmul/bignum_sqr_6_12.S | 218 - .../x86_att/fastmul/bignum_sqr_6_12_alt.S | 201 - .../x86_att/fastmul/bignum_sqr_8_16.S | 302 - .../x86_att/fastmul/bignum_sqr_8_16_alt.S | 236 - .../x86_att/generic/bignum_add.S | 162 - .../x86_att/generic/bignum_amontifier.S | 469 - .../x86_att/generic/bignum_amontmul.S | 253 - .../x86_att/generic/bignum_amontredc.S | 249 - .../x86_att/generic/bignum_amontsqr.S | 240 - .../x86_att/generic/bignum_bitfield.S | 128 - .../x86_att/generic/bignum_bitsize.S | 92 - .../x86_att/generic/bignum_cdiv.S | 340 - .../x86_att/generic/bignum_cdiv_exact.S | 197 - .../x86_att/generic/bignum_cld.S | 77 - .../x86_att/generic/bignum_clz.S | 92 - .../x86_att/generic/bignum_cmadd.S | 148 - .../x86_att/generic/bignum_cmnegadd.S | 158 - .../x86_att/generic/bignum_cmod.S | 227 - .../x86_att/generic/bignum_cmul.S | 131 - .../x86_att/generic/bignum_coprime.S | 522 - .../x86_att/generic/bignum_copy.S | 86 - .../x86_att/generic/bignum_ctd.S | 75 - .../x86_att/generic/bignum_ctz.S | 91 - .../x86_att/generic/bignum_demont.S | 208 - .../x86_att/generic/bignum_digit.S | 76 - .../x86_att/generic/bignum_digitsize.S | 74 - .../x86_att/generic/bignum_divmod10.S | 102 - .../x86_att/generic/bignum_emontredc.S | 159 - .../x86_att/generic/bignum_eq.S | 101 - .../x86_att/generic/bignum_even.S | 56 - .../x86_att/generic/bignum_ge.S | 115 - .../x86_att/generic/bignum_gt.S | 115 - .../x86_att/generic/bignum_iszero.S | 62 - .../x86_att/generic/bignum_le.S | 115 - .../x86_att/generic/bignum_lt.S | 115 - .../x86_att/generic/bignum_madd.S | 165 - .../x86_att/generic/bignum_modadd.S | 103 - .../x86_att/generic/bignum_moddouble.S | 97 - .../x86_att/generic/bignum_modexp.S | 707 -- .../x86_att/generic/bignum_modifier.S | 545 - .../x86_att/generic/bignum_modinv.S | 713 -- .../x86_att/generic/bignum_modoptneg.S | 101 - .../x86_att/generic/bignum_modsub.S | 90 - .../x86_att/generic/bignum_montifier.S | 544 - .../x86_att/generic/bignum_montmul.S | 264 - .../x86_att/generic/bignum_montredc.S | 267 - .../x86_att/generic/bignum_montsqr.S | 252 - .../x86_att/generic/bignum_mul.S | 159 - .../x86_att/generic/bignum_muladd10.S | 83 - .../x86_att/generic/bignum_mux.S | 72 - .../x86_att/generic/bignum_mux16.S | 97 - .../x86_att/generic/bignum_negmodinv.S | 189 - .../x86_att/generic/bignum_nonzero.S | 62 - .../x86_att/generic/bignum_normalize.S | 128 - .../x86_att/generic/bignum_odd.S | 56 - .../x86_att/generic/bignum_of_word.S | 73 - .../x86_att/generic/bignum_optadd.S | 96 - .../x86_att/generic/bignum_optneg.S | 93 - .../x86_att/generic/bignum_optsub.S | 96 - .../x86_att/generic/bignum_optsubadd.S | 113 - .../x86_att/generic/bignum_pow2.S | 85 - .../x86_att/generic/bignum_shl_small.S | 128 - .../x86_att/generic/bignum_shr_small.S | 118 - .../x86_att/generic/bignum_sqr.S | 189 - .../x86_att/generic/bignum_sub.S | 145 - .../x86_att/generic/word_bytereverse.S | 45 - .../x86_att/generic/word_clz.S | 53 - .../x86_att/generic/word_ctz.S | 52 - .../x86_att/generic/word_divstep59.S | 406 - .../x86_att/generic/word_max.S | 49 - .../x86_att/generic/word_min.S | 49 - .../x86_att/generic/word_negmodinv.S | 80 - .../x86_att/generic/word_popcount.S | 74 - .../x86_att/generic/word_recip.S | 148 - .../x86_att/p256/bignum_add_p256.S | 104 - .../x86_att/p256/bignum_bigendian_4.S | 96 - .../x86_att/p256/bignum_cmul_p256.S | 133 - .../x86_att/p256/bignum_cmul_p256_alt.S | 150 - .../x86_att/p256/bignum_deamont_p256.S | 149 - .../x86_att/p256/bignum_deamont_p256_alt.S | 162 - .../x86_att/p256/bignum_demont_p256.S | 116 - .../x86_att/p256/bignum_demont_p256_alt.S | 134 - .../x86_att/p256/bignum_double_p256.S | 103 - .../x86_att/p256/bignum_half_p256.S | 94 - .../x86_att/p256/bignum_inv_p256.S | 1627 --- .../x86_att/p256/bignum_littleendian_4.S | 82 - .../x86_att/p256/bignum_mod_n256.S | 209 - .../x86_att/p256/bignum_mod_n256_4.S | 103 - .../x86_att/p256/bignum_mod_n256_alt.S | 217 - .../x86_att/p256/bignum_mod_p256.S | 202 - .../x86_att/p256/bignum_mod_p256_4.S | 91 - .../x86_att/p256/bignum_mod_p256_alt.S | 206 - .../x86_att/p256/bignum_montmul_p256.S | 196 - .../x86_att/p256/bignum_montmul_p256_alt.S | 219 - .../x86_att/p256/bignum_montsqr_p256.S | 193 - .../x86_att/p256/bignum_montsqr_p256_alt.S | 216 - .../x86_att/p256/bignum_mux_4.S | 78 - .../x86_att/p256/bignum_neg_p256.S | 97 - .../x86_att/p256/bignum_nonzero_4.S | 62 - .../x86_att/p256/bignum_optneg_p256.S | 106 - .../x86_att/p256/bignum_sub_p256.S | 93 - .../x86_att/p256/bignum_tomont_p256.S | 195 - .../x86_att/p256/bignum_tomont_p256_alt.S | 203 - .../x86_att/p256/bignum_triple_p256.S | 136 - .../x86_att/p256/bignum_triple_p256_alt.S | 141 - .../x86_att/p256/p256_montjadd.S | 593 - .../x86_att/p256/p256_montjadd_alt.S | 579 - .../x86_att/p256/p256_montjdouble.S | 634 -- .../x86_att/p256/p256_montjdouble_alt.S | 747 -- .../x86_att/p256/p256_montjmixadd.S | 567 - .../x86_att/p256/p256_montjmixadd_alt.S | 552 - .../x86_att/p256/p256_scalarmul.S | 6823 ------------ .../x86_att/p256/p256_scalarmul_alt.S | 8672 --------------- .../x86_att/p256/p256_scalarmulbase.S | 3571 ------ .../x86_att/p256/p256_scalarmulbase_alt.S | 4212 -------- .../x86_att/p384/bignum_bigendian_6.S | 105 - .../x86_att/p384/bignum_cmul_p384.S | 155 - .../x86_att/p384/bignum_cmul_p384_alt.S | 180 - .../x86_att/p384/bignum_demont_p384.S | 139 - .../x86_att/p384/bignum_demont_p384_alt.S | 139 - .../x86_att/p384/bignum_double_p384.S | 131 - .../x86_att/p384/bignum_half_p384.S | 106 - .../x86_att/p384/bignum_inv_p384.S | 1815 ---- .../x86_att/p384/bignum_mod_n384.S | 231 - .../x86_att/p384/bignum_mod_n384_6.S | 118 - .../x86_att/p384/bignum_mod_n384_alt.S | 235 - .../x86_att/p384/bignum_mod_p384.S | 230 - .../x86_att/p384/bignum_mod_p384_6.S | 116 - .../x86_att/p384/bignum_mod_p384_alt.S | 234 - .../x86_att/p384/bignum_mux_6.S | 88 - .../x86_att/p384/bignum_optneg_p384.S | 120 - .../x86_att/p384/bignum_triple_p384.S | 149 - .../x86_att/p384/bignum_triple_p384_alt.S | 159 - .../x86_att/p384/p384_montjadd.S | 1045 -- .../x86_att/p384/p384_montjadd_alt.S | 971 -- .../x86_att/p384/p384_montjmixadd.S | 1010 -- .../x86_att/p384/p384_montjmixadd_alt.S | 935 -- .../x86_att/p521/bignum_cmul_p521.S | 176 - .../x86_att/p521/bignum_cmul_p521_alt.S | 210 - .../x86_att/p521/bignum_deamont_p521.S | 147 - .../x86_att/p521/bignum_demont_p521.S | 96 - .../x86_att/p521/bignum_double_p521.S | 98 - .../x86_att/p521/bignum_half_p521.S | 106 - .../x86_att/p521/bignum_mod_n521_9.S | 151 - .../x86_att/p521/bignum_mod_n521_9_alt.S | 161 - .../x86_att/p521/bignum_mod_p521_9.S | 123 - .../x86_att/p521/bignum_montmul_p521.S | 418 - .../x86_att/p521/bignum_montmul_p521_alt.S | 348 - .../x86_att/p521/bignum_montsqr_p521.S | 326 - .../x86_att/p521/bignum_montsqr_p521_alt.S | 339 - .../x86_att/p521/bignum_optneg_p521.S | 111 - .../x86_att/p521/bignum_tomont_p521.S | 142 - .../x86_att/p521/bignum_triple_p521.S | 162 - .../x86_att/p521/bignum_triple_p521_alt.S | 170 - .../x86_att/p521/p521_jadd.S | 878 -- .../x86_att/p521/p521_jadd_alt.S | 1154 -- .../x86_att/p521/p521_jmixadd.S | 873 -- .../x86_att/p521/p521_jmixadd_alt.S | 1150 -- .../x86_att/secp256k1/bignum_add_p256k1.S | 105 - .../x86_att/secp256k1/bignum_cmul_p256k1.S | 111 - .../secp256k1/bignum_cmul_p256k1_alt.S | 123 - .../x86_att/secp256k1/bignum_deamont_p256k1.S | 151 - .../x86_att/secp256k1/bignum_demont_p256k1.S | 118 - .../x86_att/secp256k1/bignum_double_p256k1.S | 100 - .../x86_att/secp256k1/bignum_half_p256k1.S | 90 - .../x86_att/secp256k1/bignum_mod_n256k1_4.S | 102 - .../x86_att/secp256k1/bignum_mod_p256k1_4.S | 87 - .../x86_att/secp256k1/bignum_montmul_p256k1.S | 240 - .../secp256k1/bignum_montmul_p256k1_alt.S | 240 - .../x86_att/secp256k1/bignum_montsqr_p256k1.S | 217 - .../secp256k1/bignum_montsqr_p256k1_alt.S | 222 - .../x86_att/secp256k1/bignum_mul_p256k1.S | 188 - .../x86_att/secp256k1/bignum_mul_p256k1_alt.S | 216 - .../x86_att/secp256k1/bignum_neg_p256k1.S | 87 - .../x86_att/secp256k1/bignum_optneg_p256k1.S | 98 - .../x86_att/secp256k1/bignum_sqr_p256k1.S | 178 - .../x86_att/secp256k1/bignum_sqr_p256k1_alt.S | 199 - .../x86_att/secp256k1/bignum_sub_p256k1.S | 91 - .../x86_att/secp256k1/bignum_tomont_p256k1.S | 109 - .../secp256k1/bignum_tomont_p256k1_alt.S | 119 - .../x86_att/secp256k1/bignum_triple_p256k1.S | 124 - .../secp256k1/bignum_triple_p256k1_alt.S | 126 - .../x86_att/secp256k1/secp256k1_jadd.S | 429 - .../x86_att/secp256k1/secp256k1_jadd_alt.S | 511 - .../x86_att/secp256k1/secp256k1_jdouble.S | 623 -- .../x86_att/secp256k1/secp256k1_jdouble_alt.S | 817 -- .../x86_att/secp256k1/secp256k1_jmixadd.S | 402 - .../x86_att/secp256k1/secp256k1_jmixadd_alt.S | 483 - .../x86_att/sm2/bignum_add_sm2.S | 104 - .../x86_att/sm2/bignum_cmul_sm2.S | 137 - .../x86_att/sm2/bignum_cmul_sm2_alt.S | 154 - .../x86_att/sm2/bignum_deamont_sm2.S | 123 - .../x86_att/sm2/bignum_demont_sm2.S | 96 - .../x86_att/sm2/bignum_double_sm2.S | 100 - .../x86_att/sm2/bignum_half_sm2.S | 92 - .../x86_att/sm2/bignum_inv_sm2.S | 1633 --- .../x86_att/sm2/bignum_mod_nsm2.S | 207 - .../x86_att/sm2/bignum_mod_nsm2_4.S | 99 - .../x86_att/sm2/bignum_mod_nsm2_alt.S | 215 - .../x86_att/sm2/bignum_mod_sm2.S | 201 - .../x86_att/sm2/bignum_mod_sm2_4.S | 87 - .../x86_att/sm2/bignum_montinv_sm2.S | 1645 --- .../x86_att/sm2/bignum_montmul_sm2.S | 216 - .../x86_att/sm2/bignum_montmul_sm2_alt.S | 219 - .../x86_att/sm2/bignum_montsqr_sm2.S | 198 - .../x86_att/sm2/bignum_montsqr_sm2_alt.S | 227 - .../x86_att/sm2/bignum_neg_sm2.S | 94 - .../x86_att/sm2/bignum_optneg_sm2.S | 104 - .../x86_att/sm2/bignum_sub_sm2.S | 93 - .../x86_att/sm2/bignum_tomont_sm2.S | 147 - .../x86_att/sm2/bignum_triple_sm2.S | 131 - .../x86_att/sm2/bignum_triple_sm2_alt.S | 135 - .../x86_att/sm2/sm2_montjadd.S | 625 -- .../x86_att/sm2/sm2_montjadd_alt.S | 564 - .../x86_att/sm2/sm2_montjdouble.S | 652 -- .../x86_att/sm2/sm2_montjdouble_alt.S | 731 -- .../x86_att/sm2/sm2_montjmixadd.S | 599 - .../x86_att/sm2/sm2_montjmixadd_alt.S | 538 - .../x86_att/sm2/sm2_montjscalarmul.S | 3883 ------- .../x86_att/sm2/sm2_montjscalarmul_alt.S | 4550 -------- 591 files changed, 2070 insertions(+), 248940 deletions(-) delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/CODE_OF_CONDUCT.md delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/CONTRIBUTING.md create mode 100644 third_party/s2n-bignum/s2n-bignum-imported/SOUNDNESS.md delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/INSTRUCTION.md delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/Makefile delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/allowed_asm delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/Makefile delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_add_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_cmul_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_double_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_inv_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_invsqrt_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_invsqrt_p25519_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_m25519_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_n25519_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_p25519_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mul_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mul_p25519_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_optneg_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqr_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqr_p25519_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqrt_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqrt_p25519_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sub_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_ladderstep.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_ladderstep_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_pxscalarmul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_pxscalarmul_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519base_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epdouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epdouble_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pdouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pdouble_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pepadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pepadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/Makefile delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_emontredc_8n_cdiff.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_4_8.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_4_8_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_6_12.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_6_12_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_8_16.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_8_16_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_4_8.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_4_8_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_6_12.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_6_12_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_8_16.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_8_16_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_emontredc_8n_base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_emontredc_8n_cdiff_base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_mul_8_16_base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_sqr_8_16_base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/Makefile delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_add.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontifier.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontmul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontredc.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontsqr.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_bitfield.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_bitsize.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cdiv.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cdiv_exact.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cld.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_clz.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmnegadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmod.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_coprime.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_copy.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_ctd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_ctz.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_demont.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_digit.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_digitsize.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_divmod10.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_emontredc.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_eq.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_even.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_gt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_iszero.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_le.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_lt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_madd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_moddouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modexp.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modifier.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modinv.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modoptneg.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modsub.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montifier.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montmul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montredc.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montsqr.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_muladd10.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_mux.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_mux16.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_negmodinv.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_nonzero.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_normalize.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_odd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_of_word.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_optadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_optneg.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_optsubadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_pow2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_shl_small.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_shr_small.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_sub.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_bytereverse.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_clz.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_ctz.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_divstep59.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_max.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_min.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_negmodinv.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_popcount.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_recip.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/Makefile delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_basemul_k2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_basemul_k3.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_basemul_k4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_intt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_mulcache_compute.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_ntt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_reduce.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_rej_uniform_VARIABLE_TIME.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_tobytes.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_tomont.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/Makefile delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_add_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_bigendian_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_cmul_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_deamont_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_demont_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_double_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_half_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_inv_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_littleendian_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_n256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_n256_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_p256_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montmul_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montmul_p256_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montsqr_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montsqr_p256_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mux_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_neg_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_nonzero_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_optneg_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_sub_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_tomont_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_triple_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjdouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjdouble_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjmixadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjmixadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmul_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmulbase.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmulbase_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/README.md delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/bignum_montmul_p256_base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/bignum_montsqr_p256_base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/p256_montjadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/p256_montjdouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/Makefile delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_bigendian_6.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_cmul_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_demont_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_double_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_half_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_inv_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_n384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_n384_6.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_p384_6.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mux_6.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_optneg_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_triple_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjmixadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjmixadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/bignum_montmul_p384_base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/bignum_montsqr_p384_base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/p384_montjadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/p384_montjdouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/Makefile delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_cmul_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_deamont_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_demont_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_double_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_half_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_mod_n521_9.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_mod_p521_9.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montmul_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montmul_p521_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montsqr_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montsqr_p521_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_optneg_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_tomont_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_triple_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jmixadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jmixadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_montmul_p521_base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_montsqr_p521_base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_mul_p521_base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_sqr_p521_base.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/Makefile delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_add_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_cmul_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_deamont_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_demont_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_double_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_half_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mod_n256k1_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mod_p256k1_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montmul_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montmul_p256k1_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montsqr_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montsqr_p256k1_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mul_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mul_p256k1_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_neg_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_optneg_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_sqr_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_sqr_p256k1_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_sub_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_tomont_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_triple_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jdouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jdouble_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jmixadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jmixadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sha3/Makefile delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sha3/sha3_keccak2_f1600_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sha3/sha3_keccak4_f1600.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/Makefile delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_add_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_cmul_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_deamont_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_demont_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_double_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_half_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_inv_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_nsm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_nsm2_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_sm2_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montinv_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montmul_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montmul_sm2_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montsqr_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montsqr_sm2_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_neg_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_optneg_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_sub_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_tomont_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_triple_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjdouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjdouble_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjmixadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjmixadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjscalarmul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjscalarmul_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/README.md delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/bignum.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/bignum.ml delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/branch.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/branch.ml delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/loop.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/loop.ml delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/memory.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/memory.ml delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_equivtac.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_equivtac.ml delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_equivtac2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_loop.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_loop.ml delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_loop2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_reordertac.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_reordertac.ml delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_reordertac2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_simp.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_simp.ml delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_simp2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_veceq.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_veceq.ml delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_veceq2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rodata.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rodata.ml delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rodata_local.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/sequence.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/sequence.ml delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/simple.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/simple.ml create mode 100644 third_party/s2n-bignum/s2n-bignum-imported/doc/s2n_bignum_soundness.md create mode 100644 third_party/s2n-bignum/s2n-bignum-imported/doc/s2n_bignum_soundness.svg delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/Makefile delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/attrofy.sed delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_add_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_cmul_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_cmul_p25519_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_double_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_inv_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_invsqrt_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_invsqrt_p25519_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_m25519_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_n25519_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_p25519_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mul_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mul_p25519_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_optneg_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqr_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqr_p25519_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqrt_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqrt_p25519_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sub_p25519.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_ladderstep.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_ladderstep_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_pxscalarmul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_pxscalarmul_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epdouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epdouble_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pdouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pdouble_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pepadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pepadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_emontredc_8n.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_kmul_16_32.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_kmul_32_64.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_ksqr_16_32.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_ksqr_32_64.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_4_8.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_4_8_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_6_12.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_6_12_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_8_16.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_8_16_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_4_8.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_4_8_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_6_12.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_6_12_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_8_16.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_8_16_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_add.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontifier.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontmul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontredc.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontsqr.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_bitfield.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_bitsize.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cdiv.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cdiv_exact.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cld.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_clz.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmnegadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmod.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_coprime.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_copy.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_ctd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_ctz.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_demont.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_digit.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_digitsize.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_divmod10.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_emontredc.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_eq.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_even.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_ge.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_gt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_iszero.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_le.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_lt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_madd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_moddouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modexp.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modifier.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modinv.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modoptneg.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modsub.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montifier.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montmul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montredc.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montsqr.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_mul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_muladd10.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_mux.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_mux16.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_negmodinv.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_nonzero.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_normalize.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_odd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_of_word.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optneg.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optsub.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optsubadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_pow2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_shl_small.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_shr_small.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_sqr.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_sub.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_bytereverse.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_clz.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_ctz.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_divstep59.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_max.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_min.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_negmodinv.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_popcount.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_recip.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_add_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_bigendian_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_cmul_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_cmul_p256_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_deamont_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_deamont_p256_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_demont_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_demont_p256_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_double_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_half_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_inv_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_littleendian_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_n256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_n256_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_n256_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_p256_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_p256_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montmul_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montmul_p256_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montsqr_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montsqr_p256_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mux_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_neg_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_nonzero_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_optneg_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_sub_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_tomont_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_tomont_p256_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_triple_p256.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_triple_p256_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjdouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjdouble_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjmixadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjmixadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmul_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmulbase.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmulbase_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_bigendian_6.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_cmul_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_cmul_p384_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_demont_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_demont_p384_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_double_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_half_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_inv_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_n384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_n384_6.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_n384_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_p384_6.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_p384_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mux_6.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_optneg_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_triple_p384.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_triple_p384_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjmixadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjmixadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_cmul_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_cmul_p521_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_deamont_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_demont_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_double_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_half_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_mod_n521_9.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_mod_n521_9_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_mod_p521_9.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montmul_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montmul_p521_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montsqr_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montsqr_p521_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_optneg_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_tomont_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_triple_p521.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_triple_p521_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jmixadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jmixadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_add_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_cmul_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_cmul_p256k1_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_deamont_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_demont_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_double_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_half_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mod_n256k1_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mod_p256k1_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montmul_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montmul_p256k1_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montsqr_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montsqr_p256k1_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mul_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mul_p256k1_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_neg_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_optneg_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_sqr_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_sqr_p256k1_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_sub_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_tomont_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_tomont_p256k1_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_triple_p256k1.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_triple_p256k1_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jdouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jdouble_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jmixadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jmixadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_add_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_cmul_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_cmul_sm2_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_deamont_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_demont_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_double_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_half_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_inv_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_nsm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_nsm2_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_nsm2_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_sm2_4.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montinv_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montmul_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montmul_sm2_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montsqr_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montsqr_sm2_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_neg_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_optneg_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_sub_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_tomont_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_triple_sm2.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_triple_sm2_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjdouble.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjdouble_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjmixadd.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjmixadd_alt.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjscalarmul.S delete mode 100644 third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjscalarmul_alt.S diff --git a/third_party/s2n-bignum/META.yml b/third_party/s2n-bignum/META.yml index 3f819742b5b..df2868642e5 100644 --- a/third_party/s2n-bignum/META.yml +++ b/third_party/s2n-bignum/META.yml @@ -1,5 +1,5 @@ name: s2n-bignum-imported source: awslabs/s2n-bignum.git -commit: 2b5350cf955a32d2f7aced172f7bd28dd85a8587 +commit: 3bfe68deb9fbdaf23be0a927c362a87a799adc28 target: main -imported-at: 2025-09-05T04:04:05+0000 +imported-at: 2026-03-24T00:00:39+0000 diff --git a/third_party/s2n-bignum/import.sh b/third_party/s2n-bignum/import.sh index 6fbd1291621..fa3fa9fd41f 100755 --- a/third_party/s2n-bignum/import.sh +++ b/third_party/s2n-bignum/import.sh @@ -54,18 +54,138 @@ GITHUB_COMMIT=$(cd ${TMP} >/dev/null; git rev-parse HEAD) echo "Cloned s2n-bignum folder" ls -la ${TMP} -echo "Remove source code from s2n-bignum that is not needed..." -code_not_needed=("benchmarks" "codebuild" "common" "tests" "tools" "x86" "arm/proofs") -for code in "${code_not_needed[@]}"; do - rm -rf ${TMP}/${code} -done - -echo "Cloned s2n-bignum folder after removing unneeded source code..." -ls -la ${TMP} +# --------------------------------------------------------------------------- +# Allowlist of files to import. +# +# Only files actually compiled by aws-lc (referenced in +# crypto/fipsmodule/CMakeLists.txt) plus headers and legal files are imported. +# --------------------------------------------------------------------------- + +# Assembly files compiled on both x86_64 (x86_att/) and aarch64 (arm/). +# Paths are relative to the architecture directory. +COMMON_ASM_FILES=( + # p256 + p256/p256_montjscalarmul.S + p256/p256_montjscalarmul_alt.S + p256/bignum_montinv_p256.S + # p384 + p384/bignum_add_p384.S + p384/bignum_sub_p384.S + p384/bignum_neg_p384.S + p384/bignum_tomont_p384.S + p384/bignum_deamont_p384.S + p384/bignum_montmul_p384.S + p384/bignum_montmul_p384_alt.S + p384/bignum_montsqr_p384.S + p384/bignum_montsqr_p384_alt.S + p384/bignum_nonzero_6.S + p384/bignum_littleendian_6.S + p384/p384_montjdouble.S + p384/p384_montjdouble_alt.S + p384/p384_montjscalarmul.S + p384/p384_montjscalarmul_alt.S + p384/bignum_montinv_p384.S + # p521 + p521/bignum_add_p521.S + p521/bignum_sub_p521.S + p521/bignum_neg_p521.S + p521/bignum_mul_p521.S + p521/bignum_mul_p521_alt.S + p521/bignum_sqr_p521.S + p521/bignum_sqr_p521_alt.S + p521/bignum_tolebytes_p521.S + p521/bignum_fromlebytes_p521.S + p521/p521_jdouble.S + p521/p521_jdouble_alt.S + p521/p521_jscalarmul.S + p521/p521_jscalarmul_alt.S + p521/bignum_inv_p521.S + # curve25519 + curve25519/bignum_mod_n25519.S + curve25519/bignum_neg_p25519.S + curve25519/bignum_madd_n25519.S + curve25519/bignum_madd_n25519_alt.S + curve25519/edwards25519_decode.S + curve25519/edwards25519_decode_alt.S + curve25519/edwards25519_encode.S + curve25519/edwards25519_scalarmulbase.S + curve25519/edwards25519_scalarmulbase_alt.S + curve25519/edwards25519_scalarmuldouble.S + curve25519/edwards25519_scalarmuldouble_alt.S + # sha3 + sha3/sha3_keccak_f1600.S +) + +# Assembly files compiled only on x86_64. +X86_ONLY_ASM_FILES=( + p384/bignum_tomont_p384_alt.S + p384/bignum_deamont_p384_alt.S + curve25519/curve25519_x25519.S + curve25519/curve25519_x25519_alt.S + curve25519/curve25519_x25519base.S + curve25519/curve25519_x25519base_alt.S +) + +# Assembly files compiled only on aarch64. +ARM_ONLY_ASM_FILES=( + curve25519/curve25519_x25519_byte.S + curve25519/curve25519_x25519_byte_alt.S + curve25519/curve25519_x25519base_byte.S + curve25519/curve25519_x25519base_byte_alt.S + fastmul/bignum_kmul_16_32.S + fastmul/bignum_kmul_32_64.S + fastmul/bignum_ksqr_16_32.S + fastmul/bignum_ksqr_32_64.S + fastmul/bignum_emontredc_8n.S + generic/bignum_ge.S + generic/bignum_mul.S + generic/bignum_optsub.S + generic/bignum_sqr.S + generic/bignum_copy_row_from_table.S + generic/bignum_copy_row_from_table_8n.S + generic/bignum_copy_row_from_table_16.S + generic/bignum_copy_row_from_table_32.S + sha3/sha3_keccak_f1600_alt.S + sha3/sha3_keccak2_f1600.S + sha3/sha3_keccak4_f1600_alt.S + sha3/sha3_keccak4_f1600_alt2.S +) echo "Copy source code ..." mkdir ${SRC} -cp -rH ${TMP}/* ${SRC} + +# Copy headers, legal files, and documentation +mkdir -p ${SRC}/include +cp -H ${TMP}/include/s2n-bignum.h ${TMP}/include/s2n-bignum-c89.h \ + ${TMP}/include/_internal_s2n_bignum.h ${TMP}/include/_internal_s2n_bignum_arm.h \ + ${TMP}/include/_internal_s2n_bignum_x86.h ${TMP}/include/_internal_s2n_bignum_x86_att.h \ + ${SRC}/include/ +cp -H ${TMP}/LICENSE ${TMP}/NOTICE ${TMP}/README.md ${TMP}/SOUNDNESS.md ${TMP}/non_ct_functions.txt ${SRC}/ +mkdir -p ${SRC}/doc +cp -H ${TMP}/doc/s2n_bignum_soundness.md ${TMP}/doc/s2n_bignum_soundness.svg ${SRC}/doc/ +mkdir -p ${SRC}/x86_att +cp -H ${TMP}/x86_att/README.md ${SRC}/x86_att/README.md + +# Copy assembly files using the allowlists above. +# Helper: copy a single .S file from TMP to SRC, creating parent dirs as needed. +copy_asm() { + local relpath="$1" + mkdir -p "${SRC}/$(dirname "${relpath}")" + cp -H "${TMP}/${relpath}" "${SRC}/${relpath}" +} + +for f in "${COMMON_ASM_FILES[@]}"; do + copy_asm "x86_att/${f}" + copy_asm "arm/${f}" +done + +for f in "${X86_ONLY_ASM_FILES[@]}"; do + copy_asm "x86_att/${f}" +done + +for f in "${ARM_ONLY_ASM_FILES[@]}"; do + copy_asm "arm/${f}" +done echo "Copied s2n-bignum source code..." ls -la ${SRC} diff --git a/third_party/s2n-bignum/s2n-bignum-imported/CODE_OF_CONDUCT.md b/third_party/s2n-bignum/s2n-bignum-imported/CODE_OF_CONDUCT.md deleted file mode 100644 index 5b627cfa60b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,4 +0,0 @@ -## Code of Conduct -This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). -For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact -opensource-codeofconduct@amazon.com with any additional questions or comments. diff --git a/third_party/s2n-bignum/s2n-bignum-imported/CONTRIBUTING.md b/third_party/s2n-bignum/s2n-bignum-imported/CONTRIBUTING.md deleted file mode 100644 index c4b6a1c5081..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/CONTRIBUTING.md +++ /dev/null @@ -1,59 +0,0 @@ -# Contributing Guidelines - -Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional -documentation, we greatly value feedback and contributions from our community. - -Please read through this document before submitting any issues or pull requests to ensure we have all the necessary -information to effectively respond to your bug report or contribution. - - -## Reporting Bugs/Feature Requests - -We welcome you to use the GitHub issue tracker to report bugs or suggest features. - -When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already -reported the issue. Please try to include as much information as you can. Details like these are incredibly useful: - -* A reproducible test case or series of steps -* The version of our code being used -* Any modifications you've made relevant to the bug -* Anything unusual about your environment or deployment - - -## Contributing via Pull Requests -Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that: - -1. You are working against the latest source on the *main* branch. -2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already. -3. You open an issue to discuss any significant work - we would hate for your time to be wasted. - -To send us a pull request, please: - -1. Fork the repository. -2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change. -3. Ensure local tests pass. -4. Commit to your fork using clear commit messages. -5. Send us a pull request, answering any default questions in the pull request interface. -6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation. - -GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and -[creating a pull request](https://help.github.com/articles/creating-a-pull-request/). - - -## Finding contributions to work on -Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start. - - -## Code of Conduct -This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). -For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact -opensource-codeofconduct@amazon.com with any additional questions or comments. - - -## Security issue notifications -If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue. - - -## Licensing - -See the [LICENSE](LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution. diff --git a/third_party/s2n-bignum/s2n-bignum-imported/README.md b/third_party/s2n-bignum/s2n-bignum-imported/README.md index d332eec874a..660d370be6d 100644 --- a/third_party/s2n-bignum/s2n-bignum-imported/README.md +++ b/third_party/s2n-bignum/s2n-bignum-imported/README.md @@ -11,9 +11,11 @@ tuned for highest performance both by hand and using automatic optimization techniques such as the [SLOTHY](https://github.com/slothy-optimizer/slothy) superoptimizer, and each function is accompanied by a machine-checked formal proof in [HOL-Light](https://hol-light.github.io/) that its mathematical -result is correct, based on a formal model of the underlying machine. Each -function is moreover written in a constant-time style to avoid timing -side-channels. +result is correct, based on a formal model of the underlying machine. +Moreover, each function is written in a constant-time style to avoid timing +side-channels. For a detailed analysis of the formal verification process, the +assumptions made, and the correspondence of formal models with reality, please +refer to the [s2n-bignum soundness review](SOUNDNESS.md). For the SHA-3 and ML-KEM code currently part of s2n-bignum, some of the comments in the main part of this README do not apply exactly. See the section diff --git a/third_party/s2n-bignum/s2n-bignum-imported/SOUNDNESS.md b/third_party/s2n-bignum/s2n-bignum-imported/SOUNDNESS.md new file mode 100644 index 00000000000..112493d98f7 --- /dev/null +++ b/third_party/s2n-bignum/s2n-bignum-imported/SOUNDNESS.md @@ -0,0 +1,349 @@ +# Soundness of s2n-bignum Formal Verification + +s2n-bignum provides machine-checked proofs that its machine code routines produce +mathematically correct results for all inputs. But no formal verification is +absolute. Every FV effort links two **formal** objects -- a specification and a +model -- each of which is *assumed* to correspond to something informal and +real. This document maps out those assumptions and the risks that arise when +they fail. + +The diagram below shows the structure. The green arrow is what the proof +establishes. The orange gaps are where assumptions live. + +![Verification gaps](doc/s2n_bignum_soundness.svg) + +**What the proof says, precisely:** For each function, HOL Light proves a Hoare +triple of the form + +> *If* the machine state satisfies a precondition (code loaded, registers and +> memory set up per the ABI, mathematical inputs in the right buffers), +> *then* execution on the formal ISA model is guaranteed eventually to reach a state satisfying a +> postcondition (return address in PC, output buffers contain the correct +> mathematical result), *and* only the listed state components may have values in the final state +> different from the values in the initial state (the frame condition). + +The byte sequence proved is checked against the actual object file +produced by the build, so compiler/assembler correctness is not a direct +assumption. + +--- + +## Summary of risks + +Mitigations in *italics* are planned future work or actions available to +motivated users. + +| # | Risk | Primary mitigation | +|---|------|--------------------| +| A1 | Wrong functional spec | Specifications written in simple mathematical style; integration and conformance tests (NIST CAVP, Wycheproof) | +| A2 | Precondition mismatch | Preconditions explicit in formal statements; signature cross-checking; *planned C-level contracts* | +| A3 | Non-constant-time code | Formal constant-time proofs for all functions currently used by AWS-LC; empirical timing tests | +| A4 | Out-of-bounds memory access | Formal memory-safety proofs for all functions currently used by AWS-LC; frame conditions; Valgrind | +| B1 | Wrong ISA model or decoder | Co-simulation testing against real hardware on every CI run | +| B2 | Buggy ELF loader | Loader errors typically cause proof failure; function-level random testing | +| B3 | Model omissions (caches, speculative execution, etc.) | Standard for sequential user-mode verification; omissions documented | +| C1 | HOL Light kernel or OCaml runtime bug | 20+ year track record; OCaml maturity; *independent proof checking (Candle, HOLTrace)* | +| D1 | Environment assumptions violated | Assumptions documented; standard for target platforms | +| D2 | C header/assembly mismatch | Signature cross-checking tool; function-level testing; *planned formal link* | +| D3 | Caller violates preconditions | Manual review at call sites; *planned C-level contracts* | + +Details for each risk follow in the sections below. + +--- + +## Gap A: Does the formal specification match actual requirements? + +This is the gap between what we *prove* and what users and applications +actually *need*. It has several facets. + +### A1. Functional specification correctness + +The mathematical formulas (e.g., `(m * n) MOD p_25519`) could +themselves be wrong: a typo in a curve constant, a subtle error in the +definition of X25519 point operations, etc. + +**Mitigations.** Specifications are deliberately written in a high-level +mathematical style that is far simpler than the implementations, making +shared-mode failures unlikely. Strong internal consistency checks exist: for +example, it would be very hard to get an elliptic-curve constant wrong while +still finding the correct group order. Integration into AWS-LC and execution +against standard conformance test suites (NIST CAVP, Wycheproof) provides +further end-to-end validation. This simplicity argument applies most strongly +to the purely arithmetic functions that still form the bulk of s2n-bignum; more +recent additions such as SHA-3 hash functions have more complex, program-like +specifications where a specification bug is harder to rule out, +making the conformance-test validation particularly important for those +functions. + +### A2. Preconditions and user expectations + +Specifications carry non-trivial preconditions that may surprise callers: + +- Aliasing restrictions: some functions forbid overlapping input/output + buffers; others require them to be either identical or fully disjoint. +- Some modular operations assume inputs are already reduced. +- Some point operations exclude points at infinity or other degenerate cases. + +All assumptions are explicit in the formal statements but may not be obvious +from the C header alone. There is currently no complete machine-checked link between +the C declarations in `s2n-bignum.h` and the formal specifications +(but see [D2](#d2-c-headerassembly-interface) below). + +### A3. Constant-time execution + +s2n-bignum functions are written using a strict constant-time discipline: +the instruction sequence and memory-access pattern depend only on nominal +sizes, never on secret data values (with the single explicit exception, +telegraphed in the function name, of `mlkem_rej_uniform_VARIABLE_TIME`). + +**Formal proofs.** Since late 2025, s2n-bignum has included formal HOL Light +proofs of the constant-time property alongside functional correctness. The +formal model introduces *microarchitectural events* that flag uses of +instructions with potentially data-dependent timing (e.g., integer division). +The safety proof then establishes that (a) the sequence of instructions +executed and all memory addresses accessed are independent of secret inputs, +and (b) no variable-timing microarchitectural events occur. All s2n-bignum functions currently used by AWS-LC -- covering +P-256, P-384, P-521, X25519, Ed25519, Montgomery operations, Karatsuba +multiplications, and ML-KEM routines on both ARM and x86 -- now have formal +constant-time proofs. The plan is to extend this to all functions in the +library. + +**Empirical testing.** In addition to the formal proofs, a benchmarking tool +generates random inputs of varying bit density and measures runtime variance +and correlation, providing a complementary empirical check. + +**Residual risks:** +- Functions not yet covered by the formal proof rely solely on the coding + discipline and empirical testing. +- The formal proof establishes that the *instruction sequence and memory + access pattern* are secret-independent. It does not and cannot guarantee + that the hardware executes those instructions in constant time. + Microarchitectural effects (variable-latency instructions, Hertzbleed-style + frequency scaling) could still leak information. Some hardware provides + opt-in guarantees for a listed set of instructions: ARM platforms with the + DIT (Data Independent Timing) bit set (Armv8.4-A onwards), and Intel + platforms with DOITM (Data Operand Independent Timing Mode) enabled (Ice + Lake onwards; earlier Intel processors are documented as behaving as if + DOITM is always enabled). AMD does not currently offer an equivalent + mechanism. Even with DIT or DOITM enabled, coverage is limited to a + specific set of instructions, and power/frequency-based side channels + remain outside scope. + +### A4. Memory safety + +The functional-correctness specifications alone do not fully guarantee memory +safety. The underlying memory model is a flat byte-addressed array with no +notion of "valid" or "allocated" addresses; reads and writes always succeed. +The frame condition constrains only what is *written* (and only by comparing +initial and final states), so in principle: + +- **Out-of-bounds reads** are not excluded by a functional correctness proof. +- **Transient writes** (writing then restoring a value) are not excluded + either. + +**Formal proofs.** The same safety proof infrastructure introduced for +constant-time (see A3) also proves memory safety: it establishes that all +memory reads and writes performed by a function fall within the bounds +declared in its specification. All functions currently used by AWS-LC now have +formal memory-safety proofs on both ARM and x86, and coverage is being +extended to the full library. + +**Residual risks.** + +- Functions not yet covered by the safety proof rely on the simplicity of + their memory-access patterns and the partial protection of the frame + condition. In addition, `mlkem_rej_uniform_VARIABLE_TIME` currently lacks a + memory-safety proof because the safety and constant-time properties are + proved together and this function is by design not constant-time. This is + not an essential limitation of the proof infrastructure, and adding a + standalone memory-safety proof for this function is planned. +- **Stack discipline.** For thread safety, code must not read or write below + the stack pointer (beyond the red zone on platforms that define one). The + formal model does track the stack pointer register, so this property could + in principle be enforced -- for example by failing memory accesses at a + negative offset from SP, analogous to the existing ARM model's rejection of + unaligned SP accesses -- but defining "negative offset" rigorously in + modular 64-bit arithmetic is somewhat ad hoc. The current memory-safety + proofs do not check this property. We rely on engineering discipline, + validated empirically with Valgrind. + +--- + +## Gap B: Does the formal model match the actual system? + +This is the gap between the formal representation of the code and machine, and +the real object code running on real hardware. + +One important aspect of the s2n-bignum approach significantly narrows this gap: +**proofs are about the actual object-code byte sequences**, which are checked +against the object files produced by the build. This eliminates any direct +dependence on the correctness of compilers or assemblers -- a class of +assumption that affects many other formal verification efforts. + +**Caveat: reassembly in downstream projects.** When s2n-bignum `.S` files are +imported into another project and assembled on a different system, there is +currently no systematic check (e.g., hash comparison or watermarking) that the +resulting object code matches the bytes the proofs were verified against. An +assembler bug or version difference could in principle produce different code. +Running the s2n-bignum proofs on the target platform would catch this, but +may be considered too time-consuming to be part of routine builds. + +### B1. ISA model fidelity + +The ISA models define both decoding from byte sequences (`decode.ml`) and +core instruction semantics (`arm.ml`/`x86.ml`); these are hand-written from +the Intel/AMD and ARM Architecture Reference Manuals. Errors in those +references, misunderstandings, or transcription mistakes could silently +invalidate proofs. + +**Mitigation: co-simulation testing.** A continuous-integration test +(`simulator.ml` + `simulator.c`) repeatedly picks random instruction +encodings and random register/flag states, decodes them, executes them both +symbolically through the formal model and natively on real hardware, and +compares results. This exercises both the ISA semantics and the decoder on +every test. It runs for 30 minutes on 8 cores per CI run and covers: + +- All register-to-register instruction forms with randomized operands. +- Memory-accessing instructions via dedicated harnesses for various + addressing modes (base+displacement, base+index*scale+displacement, + aligned and unaligned variants). + +This provides high confidence, but is inherently incomplete: it cannot cover +every possible operand combination or interact with every microarchitectural +quirk. Where instructions have genuinely underspecified behavior -- for +example, the `IMUL` instruction sets flags differently on different x86 +microarchitectures -- the s2n-bignum model reflects this nondeterminism, and +proofs are valid regardless of which behavior the hardware exhibits. + +### B2. ELF object-code loader + +An OCaml ELF loader extracts the `.text` section (and, where applicable, the +`.rodata` section) from each object file for verification. If it extracts the +wrong bytes, the proof applies to different code than what runs in production. + +**Mitigations.** (1) The proof engineer must know the exact byte sequence to +write the proof, so loader errors would typically cause proof failure rather +than a silently wrong proof. (2) Function-level random testing compares +assembly outputs against C reference implementations, catching gross +mismatches. (3) s2n-bignum functions mostly use only the `.text` section with no +relocations, minimizing the loader's responsibility. + +### B3. What the model omits + +The formal ISA model is a sequential, user-mode, single-core model. It does +not model: + +- **Caches, TLBs, or memory ordering** -- irrelevant for single-threaded + sequential code, but means the model says nothing about concurrent use. +- **Interrupts and exceptions** -- the proof assumes uninterrupted execution. + In practice, interrupts are transparent to user-mode code on both x86 and + ARM. +- **Virtual memory and page faults** -- the model uses a flat address space. + Page faults are transparent provided the OS has mapped the relevant pages. +- **Speculative execution** -- the model is non-speculative. Side-channel + risks from speculative execution (Spectre-class) are not addressed by the + current proofs. +- **System registers and privilege levels** -- the model covers user-mode + general-purpose and SIMD registers only. + +These omissions are standard for this class of verification and are not +expected to affect functional correctness of sequential user-mode code. + +**Hardware faults and errata.** The proofs reason about an idealized machine +and do not protect against physical faults (transient bit flips from cosmic +rays or voltage fluctuations, deliberate fault injection) or undocumented CPU +errata. Where the vendor documentation describes variability in instruction +behavior, the formal model already accounts for it (see B1 above). The +co-simulation testing can also detect systematic CPU errata for the +instructions and operand patterns it exercises. Transient physical faults and +deliberate fault injection are entirely out of scope; high-assurance +deployments in physically hostile environments would need additional +countermeasures at the hardware or protocol level. + +--- + +## Gap C: Is the proof infrastructure sound? + +### C1. Trusted computing base: HOL Light kernel and OCaml runtime + +HOL Light has a small trusted kernel (~400 lines of OCaml) implementing +10 primitive inference rules and 3 axioms. All theorems, no matter how +complex the proof automation used to derive them, must ultimately be +constructed through this kernel. Bugs in proof automation cannot compromise +soundness -- they can only cause proofs to fail, not to succeed spuriously. +This is a fundamental design property of the LCF architecture. No soundness +bugs in the kernel have been found since 2003. + +HOL Light runs on OCaml, so the OCaml compiler and runtime are also part of +the trusted computing base. A compiler or runtime bug could in principle allow +construction of a spurious theorem. This is mitigated by OCaml's maturity and +widespread use. Note that proof engineers are not adversarial -- an OCaml bug +would have to be triggered accidentally, not exploited deliberately. + +Several lines of work provide independent reassurance against bugs in either +the HOL Light kernel or the OCaml runtime: + +- [Candle](https://www.cl.cam.ac.uk/~mj201/candle/), a formally verified + prover for the same logic, has a kernel closely based on HOL Light's and is + verified down to machine code using CakeML. +- HOL Light sessions can be recorded as low-level proof traces that are + independently verifiable by a standalone checker, completely bypassing + both the HOL Light code and the OCaml runtime. Bernstein's + [HOLTrace](https://holtrace.cr.yp.to/) package provides tools for this, + including external checkers that replay kernel-level inferences. Earlier + work by Obua, Skalberg, Keller, and others established proof export to Coq + and Isabelle/HOL, and Hurd's + [OpenTheory](https://www.gilith.com/opentheory/) provides a common + interchange format for HOL family provers. + +--- + +## Gap D: Integration and cross-cutting concerns + +### D1. Global execution-environment assumptions + +s2n-bignum functions assume: + +- **64-bit mode.** The code and the formal model assume 64-bit x86 or AArch64. +- **Little-endian byte order** (ARM `CPSR.E = 0`). This is only relevant to + ARM, since x86 is unconditionally little-endian. All s2n-bignum ARM code is + intended to work correctly on big-endian ARM platforms, but this is not + tested at all and the formal proofs do not cover it. +- **Alignment checking disabled** (x86 `AC` flag, ARM `SCTLR.A`). If + alignment checking is enabled, unaligned pointer arguments may fault. When + calling from C via `s2n-bignum.h`, the natural alignment of `uint64_t*` + satisfies this requirement. +- **Mapped memory.** All memory buffers passed by the caller must be + readable and writable as appropriate without causing access violations. + The formal model uses a flat address space with no notion of page + permissions or unmapped memory; it is the caller's responsibility to + ensure that the relevant address ranges are backed by accessible pages. + +### D2. C header/assembly interface + +The C header `s2n-bignum.h` declares function prototypes that must match the +assembly implementations' register usage per the platform ABI. A mismatch +(e.g., wrong argument order, missing `const` qualification) could cause silent +miscompilation at the call site. + +**Mitigations.** A signature-collection tool (`tools/collect-signatures.py`) +cross-checks the formal specifications against the C header, catching common +discrepancies such as mismatched argument counts or types. This is not a full +machine-checked validation, but provides useful sanity checking. In addition, +function-level random testing exercises the actual C-to-assembly calling +convention. Planned future work will establish a more rigorous machine-checked +link between the formal specifications and C-level contracts. + +### D3. Compositional use in higher-level libraries + +When s2n-bignum is used by a higher-level library (e.g., AWS-LC, mlkem-native), +the caller must ensure: + +- Preconditions are satisfied at every call site (reduced inputs, aliasing + constraints, buffer sizes). +- The postconditions are sufficient for the caller's needs. + +For mlkem-native, a manual (non-machine-checked) bridge connects the HOL Light +assembly postconditions to the CBMC contracts used for C-level verification. +There is no end-to-end machine-checked proof from the C API through assembly +to the cryptographic specification. diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/INSTRUCTION.md b/third_party/s2n-bignum/s2n-bignum-imported/arm/INSTRUCTION.md deleted file mode 100644 index bef0603b553..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/INSTRUCTION.md +++ /dev/null @@ -1,78 +0,0 @@ -## Arm Instruction Modeling - -The s2n-bignum symbolic simulator contains models of AArch64 instructions. The instructions are modeled by need. Often when verifying new programs, new instructions need to be added to s2n-bignum. This is a tutorial for adding new AArch64 instructions. - -The instruction modeling is composed of three basic steps: instruction decoding, instruction semantics modeling and instruction cosimulation test. - -### Instruction Decoding - -[Location: arm/proofs/decode.ml](proofs/decode.ml) - -Given an instruction, which is represented as a 32-bit value (of type `int32`), the decoding step will dispatch the instruction to the corresponding semantic function. For example, the following code snippet shows how to bitmatch the SIMD vector `AND` instruction: - -``` -| [0:1; q; 0b001110001:9; Rm:5; 0b000111:6; Rn:5; Rd:5] -> - // AND - SOME (arm_AND_VEC (QREG' Rd) (QREG' Rn) (QREG' Rm) (if q then 128 else 64)) -``` -When a 32-bit value is undefined (either currently not supported or not a valid instruction), the function `decode` returns `NONE`. - -#### Registers - -In the above example, `QREG'` could be think of as a register constructor. s2n-bignum supports general-purpose registers and SIMD registers (defined in *arm/proofs/instruction.ml*). These definitions also specify the behaviour when read from or write to these registers. - -### Instruction Semantics - -[Location: arm/proofs/instruction.ml](proofs/instruction.ml) - -After the decoding step, instructions are interpreted by the semantics function. They are defined as `arm_xxx`. For example, the following function `arm_AND_VEC` is the semantic function for modeling the SIMD vector `AND` (note that `_VEC` is added to differetiate from non-SIMD `AND`). - -``` -let arm_AND_VEC = define - `arm_AND_VEC Rd Rn Rm datasize = - \s. let m = read Rm s - and n = read Rn s in - if datasize = 128 then - let d:(128)word = word_and m n in - (Rd := d) s - else - let d:(64)word = word_subword (word_and m n) (0,64) in - (Rd := word_zx d:(128)word) s`;; -``` -The semantics definition is a statement universally quantified over the *armstate* `s`. It says that forall *armstate*, executing the `arm_AND_VEC` instruction is defined as setting the `Rd` register to the result of applying `word_and` to the two values read from register `Rm` and register `Rn`. Note that the syntax -``` -(... ,, ... ,, ...) s -``` -is a way of assigning values to the state variables in *armstate* `s` to create a new state. The `,,` function called `seq` sequence a list of assignments. For more detail, check *common/relational.ml*. - -Often, one will need access to supported word functions for implementing the semantics. Usually it is enough to read the [HOL Light word library](https://github.com/jrh13/hol-light/blob/master/Library/words.ml) for this purpose. - -#### Conversions - -s2n-bignum supports generic framework for adding conversion rules or tactics for new instructions. The `ARM_OPERATION_CLAUSES` and `ARM_LOAD_STORE_CLAUSES` defintions store clauses that specify rewrite rules for instructions semantic definitions. They are used in the symbolic simulation and cosimulation testing for supporting definition expansion of these instructions. - -SIMD instructions could be a bit more involved because of the helper word functions. It essentially adds one more step to what needs to be expanded out. See `all_simd_rules` and `EXPAND_SIMD_RULE` for detail. - -More complex instructions that are defined with a deeper chain of functions will require dedicated conversion rules. Check the modeling of SHA2 and AES instructions in this case. - -### Cosimulation Test - -[Location: arm/proofs/simulator.ml](proofs/simulator.ml) - -s2n-bignum conducts cosimulation tests against real machines to ensure correctness of instruction modeling. s2n-bignum will generate randomized 32-bit instructions using patterns. For the cosimulation testing, it generates random values for PC, registers, flags, and memory in the *armstate*, run the instruction on the actual machine with state values pre-set to the randomly generated values and then compare the resulting *armstate* on the machine against the model. - -For Arm, the instructions are fixed-length, so it is easier to do random instruction generation. The file *arm/proofs/simulator_iclasses.ml* contains patterns for generating the randomized instructions. - -Note that LD/ST instructions are tested in a slightly different way. This is because load from or store to random memory locations is not permitted by the OS. As a workaround, the cosimulation testing framework allocates a 256-byte memory on the stack for testing LD/ST. Special harness functions need to be defined for pointing memory address to the right location in the 256-byte memory on stack. Check *arm/proofs/simulator.ml* for detail. - -### Examples - -Here are some examples of adding instructions: -* A simple example: [Adding instructions for SHA3](https://github.com/awslabs/s2n-bignum/pull/165) -* Adding cosimulation tests for LD/ST: [Enable memory operations in ARM cosimulator](https://github.com/awslabs/s2n-bignum/pull/186) -* Modeling complex instructions that require dedicated conversions: [Adding Cryptographic AES intrinsics for Armv8](https://github.com/awslabs/s2n-bignum/pull/171) - -### Resources - -* [The Arm A-profile A64 Instruction Set Architecture](https://developer.arm.com/documentation/ddi0602/2023-12?lang=en) -* [How to Evaluate Expression in HOL Light](https://github.com/aqjune/hol-light-materials/blob/main/EvalExpression.md) diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/Makefile b/third_party/s2n-bignum/s2n-bignum-imported/arm/Makefile deleted file mode 100644 index 875a1426a2b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/Makefile +++ /dev/null @@ -1,550 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - -OSTYPE_RESULT=$(shell uname -s) -ARCHTYPE_RESULT=$(shell uname -m) - -# Assembler directives that mark symbols as .hidden -# or .private_extern can be enabled by passing -# in the S2N_BN_HIDE_SYMBOLS parameter as: -# -# make S2N_BN_HIDE_SYMBOLS=1 -# - -ifeq ($(S2N_BN_HIDE_SYMBOLS),1) -SYMBOL_HIDING=-DS2N_BN_HIDE_SYMBOLS=1 -else -SYMBOL_HIDING= -endif - - -# Add explicit language input parameter to cpp, otherwise the use of #n for -# numeric literals in ARM code is a problem when used inside #define macros -# since normally that means stringization. -# -# Some clang-based preprocessors seem to behave differently, and get confused -# by single-quote characters in comments, so we eliminate // comments first. - -ifeq ($(OSTYPE_RESULT),Darwin) -PREPROCESS=sed -e 's/\/\/.*//' | $(CC) -E -I../include $(SYMBOL_HIDING) -xassembler-with-cpp - -else -PREPROCESS=$(CC) -E -I../include $(SYMBOL_HIDING) -xassembler-with-cpp - -endif - -# Generally GNU-type assemblers are happy with multiple instructions on -# a line, but we split them up anyway just in case. - -SPLIT=tr ';' '\n' - -# If actually on an ARM8 machine, just use the assembler (as). Otherwise -# use a cross-assembling version so that the code can still be assembled -# and the proofs checked against the object files (though you won't be able -# to run code without additional emulation infrastructure). For the clang -# version on OS X we just add the "-arch arm64" option. For the Linux/gcc -# toolchain we assume the presence of the special cross-assembler. This -# can be installed via something like: -# -# sudo apt-get install binutils-aarch64-linux-gnu - -ifeq ($(ARCHTYPE_RESULT),aarch64) -ASSEMBLE=as -march=armv8.2-a+sha3 -OBJDUMP=objdump -d -else -ifeq ($(ARCHTYPE_RESULT),arm64) -ASSEMBLE=as -march=armv8.2-a+sha3 -OBJDUMP=objdump -d -else -ifeq ($(OSTYPE_RESULT),Darwin) -ASSEMBLE=as -arch arm64 -march=armv8.2-a+sha3 -OBJDUMP=otool -tvV -else -ASSEMBLE=aarch64-linux-gnu-as -march=armv8.2-a+sha3 -OBJDUMP=aarch64-linux-gnu-objdump -d -endif -endif -endif - -# List of object files for point operations and bignum operations - -POINT_OBJ = curve25519/curve25519_ladderstep.o \ - curve25519/curve25519_ladderstep_alt.o \ - curve25519/curve25519_pxscalarmul.o \ - curve25519/curve25519_pxscalarmul_alt.o \ - curve25519/curve25519_x25519.o \ - curve25519/curve25519_x25519_alt.o \ - curve25519/curve25519_x25519_byte.o \ - curve25519/curve25519_x25519_byte_alt.o \ - curve25519/curve25519_x25519base.o \ - curve25519/curve25519_x25519base_alt.o \ - curve25519/curve25519_x25519base_byte.o \ - curve25519/curve25519_x25519base_byte_alt.o \ - curve25519/edwards25519_decode.o \ - curve25519/edwards25519_decode_alt.o \ - curve25519/edwards25519_encode.o \ - curve25519/edwards25519_epadd.o \ - curve25519/edwards25519_epadd_alt.o \ - curve25519/edwards25519_epdouble.o \ - curve25519/edwards25519_epdouble_alt.o \ - curve25519/edwards25519_pdouble.o \ - curve25519/edwards25519_pdouble_alt.o \ - curve25519/edwards25519_pepadd.o \ - curve25519/edwards25519_pepadd_alt.o \ - curve25519/edwards25519_scalarmulbase.o \ - curve25519/edwards25519_scalarmulbase_alt.o \ - curve25519/edwards25519_scalarmuldouble.o \ - curve25519/edwards25519_scalarmuldouble_alt.o \ - p256/p256_montjadd.o \ - p256/p256_montjadd_alt.o \ - p256/p256_montjdouble.o \ - p256/p256_montjdouble_alt.o \ - p256/p256_montjmixadd.o \ - p256/p256_montjmixadd_alt.o \ - p256/p256_montjscalarmul.o \ - p256/p256_montjscalarmul_alt.o \ - p256/p256_scalarmul.o \ - p256/p256_scalarmul_alt.o \ - p256/p256_scalarmulbase.o \ - p256/p256_scalarmulbase_alt.o \ - p384/p384_montjadd.o \ - p384/p384_montjadd_alt.o \ - p384/p384_montjdouble.o \ - p384/p384_montjdouble_alt.o \ - p384/p384_montjmixadd.o \ - p384/p384_montjmixadd_alt.o \ - p384/p384_montjscalarmul.o \ - p384/p384_montjscalarmul_alt.o \ - p521/p521_jadd.o \ - p521/p521_jadd_alt.o \ - p521/p521_jdouble.o \ - p521/p521_jdouble_alt.o \ - p521/p521_jmixadd.o \ - p521/p521_jmixadd_alt.o \ - p521/p521_jscalarmul.o \ - p521/p521_jscalarmul_alt.o \ - secp256k1/secp256k1_jadd.o \ - secp256k1/secp256k1_jadd_alt.o \ - secp256k1/secp256k1_jdouble.o \ - secp256k1/secp256k1_jdouble_alt.o \ - secp256k1/secp256k1_jmixadd.o \ - secp256k1/secp256k1_jmixadd_alt.o \ - sm2/sm2_montjadd.o \ - sm2/sm2_montjadd_alt.o \ - sm2/sm2_montjdouble.o \ - sm2/sm2_montjdouble_alt.o \ - sm2/sm2_montjmixadd.o \ - sm2/sm2_montjmixadd_alt.o \ - sm2/sm2_montjscalarmul.o \ - sm2/sm2_montjscalarmul_alt.o - -BIGNUM_OBJ = curve25519/bignum_add_p25519.o \ - curve25519/bignum_cmul_p25519.o \ - curve25519/bignum_double_p25519.o \ - curve25519/bignum_inv_p25519.o \ - curve25519/bignum_invsqrt_p25519.o \ - curve25519/bignum_invsqrt_p25519_alt.o \ - curve25519/bignum_madd_n25519.o \ - curve25519/bignum_madd_n25519_alt.o \ - curve25519/bignum_mod_m25519_4.o \ - curve25519/bignum_mod_n25519.o \ - curve25519/bignum_mod_n25519_4.o \ - curve25519/bignum_mod_p25519_4.o \ - curve25519/bignum_mul_p25519.o \ - curve25519/bignum_mul_p25519_alt.o \ - curve25519/bignum_neg_p25519.o \ - curve25519/bignum_optneg_p25519.o \ - curve25519/bignum_sqr_p25519.o \ - curve25519/bignum_sqr_p25519_alt.o \ - curve25519/bignum_sqrt_p25519.o \ - curve25519/bignum_sqrt_p25519_alt.o \ - curve25519/bignum_sub_p25519.o \ - fastmul/bignum_emontredc_8n.o \ - fastmul/bignum_emontredc_8n_cdiff.o \ - fastmul/bignum_kmul_16_32.o \ - fastmul/bignum_kmul_32_64.o \ - fastmul/bignum_ksqr_16_32.o \ - fastmul/bignum_ksqr_32_64.o \ - fastmul/bignum_mul_4_8.o \ - fastmul/bignum_mul_4_8_alt.o \ - fastmul/bignum_mul_6_12.o \ - fastmul/bignum_mul_6_12_alt.o \ - fastmul/bignum_mul_8_16.o \ - fastmul/bignum_mul_8_16_alt.o \ - fastmul/bignum_sqr_4_8.o \ - fastmul/bignum_sqr_4_8_alt.o \ - fastmul/bignum_sqr_6_12.o \ - fastmul/bignum_sqr_6_12_alt.o \ - fastmul/bignum_sqr_8_16.o \ - fastmul/bignum_sqr_8_16_alt.o \ - generic/bignum_add.o \ - generic/bignum_amontifier.o \ - generic/bignum_amontmul.o \ - generic/bignum_amontredc.o \ - generic/bignum_amontsqr.o \ - generic/bignum_bitfield.o \ - generic/bignum_bitsize.o \ - generic/bignum_cdiv.o \ - generic/bignum_cdiv_exact.o \ - generic/bignum_cld.o \ - generic/bignum_clz.o \ - generic/bignum_cmadd.o \ - generic/bignum_cmnegadd.o \ - generic/bignum_cmod.o \ - generic/bignum_cmul.o \ - generic/bignum_coprime.o \ - generic/bignum_copy.o \ - generic/bignum_copy_row_from_table.o \ - generic/bignum_copy_row_from_table_8n.o \ - generic/bignum_copy_row_from_table_16.o \ - generic/bignum_copy_row_from_table_32.o \ - generic/bignum_ctd.o \ - generic/bignum_ctz.o \ - generic/bignum_demont.o \ - generic/bignum_digit.o \ - generic/bignum_digitsize.o \ - generic/bignum_divmod10.o \ - generic/bignum_emontredc.o \ - generic/bignum_eq.o \ - generic/bignum_even.o \ - generic/bignum_ge.o \ - generic/bignum_gt.o \ - generic/bignum_iszero.o \ - generic/bignum_le.o \ - generic/bignum_lt.o \ - generic/bignum_madd.o \ - generic/bignum_modadd.o \ - generic/bignum_moddouble.o \ - generic/bignum_modexp.o \ - generic/bignum_modifier.o \ - generic/bignum_modinv.o \ - generic/bignum_modoptneg.o \ - generic/bignum_modsub.o \ - generic/bignum_montifier.o \ - generic/bignum_montmul.o \ - generic/bignum_montredc.o \ - generic/bignum_montsqr.o \ - generic/bignum_mul.o \ - generic/bignum_muladd10.o \ - generic/bignum_mux.o \ - generic/bignum_mux16.o \ - generic/bignum_negmodinv.o \ - generic/bignum_nonzero.o \ - generic/bignum_normalize.o \ - generic/bignum_odd.o \ - generic/bignum_of_word.o \ - generic/bignum_optadd.o \ - generic/bignum_optneg.o \ - generic/bignum_optsub.o \ - generic/bignum_optsubadd.o \ - generic/bignum_pow2.o \ - generic/bignum_shl_small.o \ - generic/bignum_shr_small.o \ - generic/bignum_sqr.o \ - generic/bignum_sub.o \ - generic/word_bytereverse.o \ - generic/word_clz.o \ - generic/word_ctz.o \ - generic/word_divstep59.o \ - generic/word_max.o \ - generic/word_min.o \ - generic/word_negmodinv.o \ - generic/word_popcount.o \ - generic/word_recip.o \ - mlkem/mlkem_basemul_k2.o \ - mlkem/mlkem_basemul_k3.o \ - mlkem/mlkem_basemul_k4.o \ - mlkem/mlkem_intt.o \ - mlkem/mlkem_mulcache_compute.o \ - mlkem/mlkem_ntt.o \ - mlkem/mlkem_reduce.o \ - mlkem/mlkem_tobytes.o \ - mlkem/mlkem_tomont.o \ - mlkem/mlkem_rej_uniform_VARIABLE_TIME.o \ - p256/bignum_add_p256.o \ - p256/bignum_bigendian_4.o \ - p256/bignum_cmul_p256.o \ - p256/bignum_deamont_p256.o \ - p256/bignum_demont_p256.o \ - p256/bignum_double_p256.o \ - p256/bignum_half_p256.o \ - p256/bignum_inv_p256.o \ - p256/bignum_littleendian_4.o \ - p256/bignum_mod_n256.o \ - p256/bignum_mod_n256_4.o \ - p256/bignum_mod_p256.o \ - p256/bignum_mod_p256_4.o \ - p256/bignum_montinv_p256.o \ - p256/bignum_montmul_p256.o \ - p256/bignum_montmul_p256_alt.o \ - p256/bignum_montsqr_p256.o \ - p256/bignum_montsqr_p256_alt.o \ - p256/bignum_mux_4.o \ - p256/bignum_neg_p256.o \ - p256/bignum_nonzero_4.o \ - p256/bignum_optneg_p256.o \ - p256/bignum_sub_p256.o \ - p256/bignum_tomont_p256.o \ - p256/bignum_triple_p256.o \ - p384/bignum_add_p384.o \ - p384/bignum_bigendian_6.o \ - p384/bignum_cmul_p384.o \ - p384/bignum_deamont_p384.o \ - p384/bignum_demont_p384.o \ - p384/bignum_double_p384.o \ - p384/bignum_half_p384.o \ - p384/bignum_inv_p384.o \ - p384/bignum_littleendian_6.o \ - p384/bignum_mod_n384.o \ - p384/bignum_mod_n384_6.o \ - p384/bignum_mod_p384.o \ - p384/bignum_mod_p384_6.o \ - p384/bignum_montinv_p384.o \ - p384/bignum_montmul_p384.o \ - p384/bignum_montmul_p384_alt.o \ - p384/bignum_montsqr_p384.o \ - p384/bignum_montsqr_p384_alt.o \ - p384/bignum_mux_6.o \ - p384/bignum_neg_p384.o \ - p384/bignum_nonzero_6.o \ - p384/bignum_optneg_p384.o \ - p384/bignum_sub_p384.o \ - p384/bignum_tomont_p384.o \ - p384/bignum_triple_p384.o \ - p521/bignum_add_p521.o \ - p521/bignum_cmul_p521.o \ - p521/bignum_deamont_p521.o \ - p521/bignum_demont_p521.o \ - p521/bignum_double_p521.o \ - p521/bignum_fromlebytes_p521.o \ - p521/bignum_half_p521.o \ - p521/bignum_inv_p521.o \ - p521/bignum_mod_n521_9.o \ - p521/bignum_mod_p521_9.o \ - p521/bignum_montmul_p521.o \ - p521/bignum_montmul_p521_alt.o \ - p521/bignum_montsqr_p521.o \ - p521/bignum_montsqr_p521_alt.o \ - p521/bignum_mul_p521.o \ - p521/bignum_mul_p521_alt.o \ - p521/bignum_neg_p521.o \ - p521/bignum_optneg_p521.o \ - p521/bignum_sqr_p521.o \ - p521/bignum_sqr_p521_alt.o \ - p521/bignum_sub_p521.o \ - p521/bignum_tolebytes_p521.o \ - p521/bignum_tomont_p521.o \ - p521/bignum_triple_p521.o \ - secp256k1/bignum_add_p256k1.o \ - secp256k1/bignum_cmul_p256k1.o \ - secp256k1/bignum_deamont_p256k1.o \ - secp256k1/bignum_demont_p256k1.o \ - secp256k1/bignum_double_p256k1.o \ - secp256k1/bignum_half_p256k1.o \ - secp256k1/bignum_mod_n256k1_4.o \ - secp256k1/bignum_mod_p256k1_4.o \ - secp256k1/bignum_montmul_p256k1.o \ - secp256k1/bignum_montmul_p256k1_alt.o \ - secp256k1/bignum_montsqr_p256k1.o \ - secp256k1/bignum_montsqr_p256k1_alt.o \ - secp256k1/bignum_mul_p256k1.o \ - secp256k1/bignum_mul_p256k1_alt.o \ - secp256k1/bignum_neg_p256k1.o \ - secp256k1/bignum_optneg_p256k1.o \ - secp256k1/bignum_sqr_p256k1.o \ - secp256k1/bignum_sqr_p256k1_alt.o \ - secp256k1/bignum_sub_p256k1.o \ - secp256k1/bignum_tomont_p256k1.o \ - secp256k1/bignum_triple_p256k1.o \ - sha3/sha3_keccak_f1600.o \ - sha3/sha3_keccak_f1600_alt.o \ - sha3/sha3_keccak2_f1600.o \ - sha3/sha3_keccak2_f1600_alt.o \ - sha3/sha3_keccak4_f1600.o \ - sha3/sha3_keccak4_f1600_alt.o \ - sha3/sha3_keccak4_f1600_alt2.o \ - sm2/bignum_add_sm2.o \ - sm2/bignum_cmul_sm2.o \ - sm2/bignum_deamont_sm2.o \ - sm2/bignum_demont_sm2.o \ - sm2/bignum_double_sm2.o \ - sm2/bignum_half_sm2.o \ - sm2/bignum_inv_sm2.o \ - sm2/bignum_mod_nsm2.o \ - sm2/bignum_mod_nsm2_4.o \ - sm2/bignum_mod_sm2.o \ - sm2/bignum_mod_sm2_4.o \ - sm2/bignum_montinv_sm2.o \ - sm2/bignum_montmul_sm2.o \ - sm2/bignum_montmul_sm2_alt.o \ - sm2/bignum_montsqr_sm2.o \ - sm2/bignum_montsqr_sm2_alt.o \ - sm2/bignum_neg_sm2.o \ - sm2/bignum_optneg_sm2.o \ - sm2/bignum_sub_sm2.o \ - sm2/bignum_tomont_sm2.o \ - sm2/bignum_triple_sm2.o - -UNOPT_OBJ = p256/unopt/bignum_montmul_p256_base.o \ - p256/unopt/bignum_montsqr_p256_base.o \ - p256/unopt/p256_montjadd.o \ - p256/unopt/p256_montjdouble.o \ - p384/unopt/bignum_montmul_p384_base.o \ - p384/unopt/bignum_montsqr_p384_base.o \ - p384/unopt/p384_montjadd.o \ - p384/unopt/p384_montjdouble.o \ - p521/unopt/bignum_montmul_p521_base.o \ - p521/unopt/bignum_montsqr_p521_base.o \ - p521/unopt/bignum_mul_p521_base.o \ - p521/unopt/bignum_sqr_p521_base.o \ - fastmul/unopt/bignum_emontredc_8n_base.o \ - fastmul/unopt/bignum_emontredc_8n_cdiff_base.o \ - fastmul/unopt/bignum_mul_8_16_base.o \ - fastmul/unopt/bignum_sqr_8_16_base.o - -OBJ = $(POINT_OBJ) $(BIGNUM_OBJ) - -# Tutorial assembly files - -TUTORIAL_PROOFS = $(wildcard tutorial/*.ml) - -TUTORIAL_OBJ = $(TUTORIAL_PROOFS:.ml=.o) tutorial/rel_loop2.o \ - tutorial/rel_simp2.o tutorial/rel_veceq2.o tutorial/rel_equivtac2.o \ - tutorial/rel_reordertac2.o tutorial/rodata_local.o - -# According to -# https://developer.apple.com/documentation/xcode/writing-arm64-code-for-apple-platforms, -# x18 should not be used for Apple platforms. Check this using grep. - -%.o : %.S - cat $< | $(PREPROCESS) | $(SPLIT) | grep -v -E '^\s+\.(quad|hword)\s+(0x|-)?[0-9a-f]+$$' | $(ASSEMBLE) -o $@ - - $(OBJDUMP) $@ | ( ( ! grep --ignore-case -E 'w18|[^0]x18' ) || ( rm $@ ; exit 1 ) ) - cat $< | $(PREPROCESS) | $(SPLIT) | $(ASSEMBLE) -o $@ - - -libs2nbignum.a: $(OBJ) ; ar -rc libs2nbignum.a $(OBJ) - -clean:; rm -f libs2nbignum.a */*.o */*/*.o */*.correct */*.native - -# Proof-related parts -# -# The proof files are all independent, though each one loads the -# same common infrastructure "base.ml". So you can potentially -# run the proofs in parallel for more speed, e.g. -# -# nohup make -j 16 proofs & -# -# If you build hol-light yourself (see https://github.com/jrh13/hol-light) -# in your home directory, and do "make" inside the subdirectory hol-light, -# then the following HOLDIR setting should be right: - -# TODO: exhaustively list all files. Do we need ocamldep-equivalent tool for HOL Light? -BASE_ML=proofs/arm.ml \ - proofs/base.ml \ - proofs/decode.ml \ - proofs/instruction.ml \ - proofs/subroutine_signatures.ml - -HOLDIR?=$(HOME)/hol-light -HOLLIGHT:=$(HOLDIR)/hol.sh - -PROOF_BINS = $(OBJ:.o=.native) -PROOF_LOGS = $(OBJ:.o=.correct) -TUTORIAL_PROOF_BINS = $(TUTORIAL_PROOFS:.ml=.native) -TUTORIAL_PROOF_LOGS = $(TUTORIAL_PROOFS:.ml=.correct) - -# Build precompiled native binaries of HOL Light proofs - -proofs/simulator.native: proofs/simulator.ml $(BASE_ML) proofs/simulator_iclasses.ml ; ../tools/build-proof.sh proofs/simulator.ml "$(HOLLIGHT)" "$@" - -# For constant-time property and memory safety, collect input/output/temporary -# buffers from function signatures in s2n-bignum.h . - -proofs/subroutine_signatures.ml: ../include/s2n-bignum.h ; cd .. && python3 tools/collect-signatures.py - -.SECONDEXPANSION: -%.native: proofs/$$(*F).ml $(BASE_ML) %.o ; ../tools/build-proof.sh "$<" "$(HOLLIGHT)" "$@" - -# Run them and print the standard output+error at *.correct - -%.correct: %.native ; ../tools/run-proof.sh "$<" "$@" - -# Cases where a proof uses other proofs for lemmas and/or subroutines - -p256/bignum_montmul_p256.native: p256/unopt/bignum_montmul_p256_base.o -p384/bignum_montmul_p384.native: p384/unopt/bignum_montmul_p384_base.o -p521/bignum_montmul_p521.native: p521/unopt/bignum_montmul_p521_base.o -p256/bignum_montsqr_p256.native: p256/unopt/bignum_montsqr_p256_base.o -p384/bignum_montsqr_p384.native: p384/unopt/bignum_montsqr_p384_base.o -p521/bignum_montsqr_p521.native: p521/unopt/bignum_montsqr_p521_base.o -p521/bignum_mul_p521.native: p521/unopt/bignum_mul_p521_base.o -p521/bignum_sqr_p521.native: p521/unopt/bignum_sqr_p521_base.o -fastmul/bignum_emontredc_8n_cdiff.native: fastmul/unopt/bignum_emontredc_8n_base.o fastmul/unopt/bignum_emontredc_8n_cdiff_base.o -fastmul/bignum_mul_8_16.native: fastmul/unopt/bignum_mul_8_16_base.o -fastmul/bignum_sqr_8_16.native: fastmul/unopt/bignum_sqr_8_16_base.o -curve25519/curve25519_x25519.native: curve25519/bignum_inv_p25519.native -curve25519/curve25519_x25519_alt.native: curve25519/bignum_inv_p25519.native -curve25519/curve25519_x25519_byte.native: curve25519/bignum_inv_p25519.native -curve25519/curve25519_x25519_byte_alt.native: curve25519/bignum_inv_p25519.native -curve25519/curve25519_x25519base.native: curve25519/bignum_inv_p25519.native -curve25519/curve25519_x25519base_alt.native: curve25519/bignum_inv_p25519.native -curve25519/curve25519_x25519base_byte.native: curve25519/bignum_inv_p25519.native -curve25519/curve25519_x25519base_byte_alt.native: curve25519/bignum_inv_p25519.native -curve25519/edwards25519_scalarmulbase.native: curve25519/bignum_inv_p25519.native -curve25519/edwards25519_scalarmulbase_alt.native: curve25519/bignum_inv_p25519.native -curve25519/edwards25519_scalarmuldouble.native: curve25519/bignum_inv_p25519.native -curve25519/edwards25519_scalarmuldouble_alt.native: curve25519/bignum_inv_p25519.native -generic/bignum_modexp.native: generic/bignum_amontifier.native generic/bignum_amontmul.native generic/bignum_demont.native generic/bignum_mux.native -p256/p256_montjadd.native: p256/unopt/p256_montjadd.o p256/bignum_montsqr_p256.native p256/bignum_montmul_p256.native p256/bignum_sub_p256.native -p256/p256_montjdouble.native: p256/unopt/p256_montjdouble.o p256/bignum_montsqr_p256.native p256/bignum_montmul_p256.native p256/bignum_sub_p256.native p256/bignum_add_p256.native -p256/p256_montjscalarmul.native: p256/p256_montjadd.native p256/p256_montjdouble.native -p256/p256_montjscalarmul_alt.native: p256/p256_montjadd_alt.native p256/p256_montjdouble_alt.native -p256/p256_scalarmul.native: p256/bignum_demont_p256.native p256/bignum_inv_p256.native p256/bignum_tomont_p256.native p256/p256_montjadd.native p256/p256_montjdouble.native p256/p256_montjmixadd.native -p256/p256_scalarmul_alt.native: p256/bignum_demont_p256.native p256/bignum_inv_p256.native p256/p256_montjadd_alt.native p256/p256_montjdouble_alt.native p256/p256_montjmixadd_alt.native -p256/p256_scalarmulbase.native: p256/bignum_demont_p256.native p256/bignum_inv_p256.native p256/p256_montjmixadd.native -p256/p256_scalarmulbase_alt.native: p256/bignum_demont_p256.native p256/bignum_inv_p256.native p256/p256_montjmixadd_alt.native -p384/p384_montjadd.native: p384/unopt/p384_montjadd.o p384/bignum_montsqr_p384.native p384/bignum_montmul_p384.native p384/bignum_sub_p384.native -p384/p384_montjdouble.native: p384/unopt/p384_montjdouble.o p384/bignum_montsqr_p384.native p384/bignum_montmul_p384.native p384/bignum_sub_p384.native p384/bignum_add_p384.native -p384/p384_montjscalarmul.native: \ - p384/p384_montjadd.native p384/p384_montjdouble.native \ - p384/bignum_sub_p384.native p384/bignum_add_p384.native -p384/p384_montjscalarmul_alt.native: p384/p384_montjadd_alt.native p384/p384_montjdouble_alt.native -p521/p521_jadd.native: p521/bignum_mul_p521.native p521/bignum_sqr_p521.native -p521/p521_jdouble.native: p521/bignum_mul_p521.native p521/bignum_sqr_p521.native -p521/p521_jscalarmul.native: p521/bignum_mod_n521_9.native p521/p521_jadd.native p521/p521_jdouble.native -p521/p521_jscalarmul_alt.native: p521/bignum_mod_n521_9.native -sm2/sm2_montjscalarmul.native: sm2/sm2_montjadd.native sm2/sm2_montjdouble.native -sm2/sm2_montjscalarmul_alt.native: sm2/sm2_montjadd_alt.native sm2/sm2_montjdouble_alt.native - -# Tutorial - -.SECONDEXPANSION: -tutorial/%.native: tutorial/%.ml tutorial/%.o ; ../tools/build-proof.sh "$<" "$(HOLLIGHT)" "$@" -# Additional dependencies on .o files -tutorial/rodata.native: tutorial/rodata_local.o -tutorial/rel_loop.native: tutorial/rel_loop2.o -tutorial/rel_simp.native: tutorial/rel_simp2.o -tutorial/rel_veceq.native: tutorial/rel_veceq2.o -tutorial/rel_equivtac.native: tutorial/rel_equivtac2.o -tutorial/rel_reordertac.native: tutorial/rel_reordertac2.o - - -unopt: $(UNOPT_OBJ) - -build_proofs: $(UNOPT_OBJ) $(PROOF_BINS) -# Conservatively check that there is no redefinition of "check_axioms" -# '-I' excludes binary files (*.native). - ! grep -RI "check_axioms" . ../common/ --exclude="Makefile" -build_tutorial: $(TUTORIAL_OBJ) $(TUTORIAL_PROOF_BINS); -run_proofs: build_proofs $(PROOF_LOGS); - -proofs: run_proofs ; ../tools/count-proofs.sh . -tutorial: build_tutorial $(TUTORIAL_PROOF_LOGS); - -# Always run sematest regardless of dependency check -FORCE: ; -# Always use max. # of cores because in Makefile one cannot get the passed number of -j. -# A portable way of getting the number of max. cores: -# https://stackoverflow.com/a/23569003/1488216 -NUM_CORES_FOR_SEMATEST = $(shell getconf _NPROCESSORS_ONLN) -sematest: FORCE $(OBJ) proofs/simulator_iclasses.ml proofs/simulator.native - ../tools/run-sematest.sh arm $(NUM_CORES_FOR_SEMATEST) diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/allowed_asm b/third_party/s2n-bignum/s2n-bignum-imported/arm/allowed_asm deleted file mode 100644 index 2c8ccb467e6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/allowed_asm +++ /dev/null @@ -1,172 +0,0 @@ -: adc$ -: adcs$ -: add$ -: adds$ -: adr$ -: adrp$ -: and$ -: and.16b$ -: ands$ -: asr$ -: b$ -: bcax$ -: bcax.16b$ -: bfi$ -: bic$ -: bic.8h$ -: bit$ -: bit.16b$ -: bl$ -: ccmn$ -: ccmp$ -: cinc$ -: cinv$ -: clz$ -: cmhi$ -: cmhi.8h$ -: cmn$ -: cmp$ -: cnt$ -: cnt.16b$ -: cneg$ -: csel$ -: cset$ -: csetm$ -: dup$ -: dup.2d$ -: eor$ -: eor3$ -: eor3.16b$ -: ext$ -: ext.16b$ -: extr$ -: fcsel$ -: fmov$ -: ld1r$ -: ld1r.2d$ -: ld3$ -: ldp$ -: ldr$ -: ldrb$ -: ldur$ -: lsl$ -: lsr$ -: madd$ -: mls$ -: mls.2s$ -: mls.8h$ -: mneg$ -: mov$ -: mov.d$ -: movi$ -: movi.2d$ -: movk$ -: msub$ -: mul$ -: mul.4s$ -: mvn$ -: neg$ -: negs$ -: ngc$ -: ngcs$ -: orr$ -: rax1$ -: rax1.2d$ -: ret$ -: rev64$ -: rev64.4s$ -: ror$ -: sbc$ -: sbcs$ -: sbfx$ -: shl$ -: shl.2d$ -: shrn$ -: shrn.2s$ -: sli$ -: sli.2d$ -: smlal$ -: smlal.2d$ -: smlal2$ -: smlal2.2d$ -: smlsl$ -: smlsl.2d$ -: smlsl2$ -: smlsl2.2d$ -: smulh$ -: smull$ -: smull.2d$ -: smull2$ -: smull2.2d$ -: sqdmulh$ -: sqdmulh.4s$ -: sqdmulh.8h$ -: sqdmulh.s$ -: sqrdmulh$ -: sqrdmulh.2s$ -: sqrdmulh.4s$ -: sqrdmulh.8h$ -: sri$ -: sri.2d$ -: sri.4h$ -: srshr$ -: srshr.2d$ -: srshr.8h$ -: sshr$ -: sshr.8h$ -: st3$ -: stp$ -: str$ -: strb$ -: stur$ -: sub$ -: subs$ -: trn1$ -: trn1.16b$ -: trn1.2d$ -: trn1.2s$ -: trn1.4s$ -: trn2$ -: trn2.2d$ -: trn2.2s$ -: trn2.4s$ -: tst$ -: uaddlp$ -: uaddlp.2d$ -: uaddlv$ -: uaddlv.8h$ -: ubfx$ -: umaddl$ -: umlal$ -: umlal.2d$ -: umlal2$ -: umlal2.2d$ -: umlsl$ -: umlsl.2d$ -: umlsl2$ -: umlsl2.2d$ -: umulh$ -: umull$ -: umull.2d$ -: umull2$ -: umull2.2d$ -: ushr$ -: ushr.2d$ -: ushr.8h$ -: usra$ -: usra.2d$ -: uzp1$ -: uzp1.4s$ -: uzp2$ -: uzp2.4s$ -: xar$ -: xar.2d$ -: xtn$ -: xtn.2s$ -: zip1$ -: zip1.2s$ -: zip1.4s$ -: zip2$ -: zip2.2s$ -: zip2.4s$ -: $ diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/Makefile b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/Makefile deleted file mode 100644 index b22696783d4..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/Makefile +++ /dev/null @@ -1,77 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - -# If actually on an ARM8 machine, just use the GNU assembler (as). Otherwise -# use a cross-assembling version so that the code can still be assembled -# and the proofs checked against the object files (though you won't be able -# to run code without additional emulation infrastructure). The aarch64 -# cross-assembling version can be installed manually by something like: -# -# sudo apt-get install binutils-aarch64-linux-gnu - -UNAME_RESULT=$(shell uname -p) - -ifeq ($(UNAME_RESULT),aarch64) -GAS=as -else -GAS=aarch64-linux-gnu-as -endif - -# List of object files - -OBJ = bignum_add_p25519.o \ - bignum_cmul_p25519.o \ - bignum_double_p25519.o \ - bignum_inv_p25519.o \ - bignum_invsqrt_p25519.o \ - bignum_invsqrt_p25519_alt.o \ - bignum_madd_n25519.o \ - bignum_madd_n25519_alt.o \ - bignum_mod_m25519_4.o \ - bignum_mod_n25519.o \ - bignum_mod_n25519_4.o \ - bignum_mod_p25519_4.o \ - bignum_mul_p25519.o \ - bignum_mul_p25519_alt.o \ - bignum_neg_p25519.o \ - bignum_optneg_p25519.o \ - bignum_sqr_p25519.o \ - bignum_sqr_p25519_alt.o \ - bignum_sqrt_p25519.o \ - bignum_sqrt_p25519_alt.o \ - bignum_sub_p25519.o \ - curve25519_ladderstep.o \ - curve25519_ladderstep_alt.o \ - curve25519_pxscalarmul.o \ - curve25519_pxscalarmul_alt.o \ - curve25519_x25519.o \ - curve25519_x25519_alt.o \ - curve25519_x25519_byte.o \ - curve25519_x25519_byte_alt.o \ - curve25519_x25519base.o \ - curve25519_x25519base_alt.o \ - curve25519_x25519base_byte.o \ - curve25519_x25519base_byte_alt.o \ - edwards25519_decode.o \ - edwards25519_decode_alt.o \ - edwards25519_encode.o \ - edwards25519_epadd.o \ - edwards25519_epadd_alt.o \ - edwards25519_epdouble.o \ - edwards25519_epdouble_alt.o \ - edwards25519_pdouble.o \ - edwards25519_pdouble_alt.o \ - edwards25519_pepadd.o \ - edwards25519_pepadd_alt.o \ - edwards25519_scalarmulbase.o \ - edwards25519_scalarmulbase_alt.o \ - edwards25519_scalarmuldouble.o \ - edwards25519_scalarmuldouble_alt.o - -%.o : %.S ; $(CC) -E -I../../include $< | $(GAS) -o $@ - - -default: $(OBJ); - -clean:; rm -f *.o *.correct diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_add_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_add_p25519.S deleted file mode 100644 index 514bad90aff..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_add_p25519.S +++ /dev/null @@ -1,79 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Add modulo p_25519, z := (x + y) mod p_25519, assuming x and y reduced -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_add_p25519(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_add_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_add_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_add_p25519) - - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 -#define c0 x7 -#define c1 x8 -#define c2 x9 -#define c3 x10 - -S2N_BN_SYMBOL(bignum_add_p25519): - CFI_START - -// Add as [d3; d2; d1; d0] = x + y; since we assume x, y < 2^255 - 19 -// this sum fits in 256 bits - - ldp d0, d1, [x] - ldp c0, c1, [y] - adds d0, d0, c0 - adcs d1, d1, c1 - ldp d2, d3, [x, #16] - ldp c0, c1, [y, #16] - adcs d2, d2, c0 - adc d3, d3, c1 - -// Now x + y >= 2^255 - 19 <=> x + y + (2^255 + 19) >= 2^256 -// Form [c3; c2; c1; c0] = (x + y) + (2^255 + 19), with CF for the comparison - - mov c3, #0x8000000000000000 - adds c0, d0, #19 - adcs c1, d1, xzr - adcs c2, d2, xzr - adcs c3, d3, c3 - -// If the comparison holds, select [c3; c2; c1; c0]. There's no need to mask -// it since in this case it is ((x + y) + (2^255 + 19)) - 2^256 because the -// top carry is lost, which is the desired (x + y) - (2^255 - 19). - - csel d0, d0, c0, cc - csel d1, d1, c1, cc - csel d2, d2, c2, cc - csel d3, d3, c3, cc - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_add_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_cmul_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_cmul_p25519.S deleted file mode 100644 index 81cb472fee7..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_cmul_p25519.S +++ /dev/null @@ -1,106 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_25519, z := (c * x) mod p_25519, assuming -// x reduced -// Inputs c, x[4]; output z[4] -// -// extern void bignum_cmul_p25519(uint64_t z[static 4], uint64_t c, -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = c, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p25519) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p25519_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p25519_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p25519_alt) - .text - .balign 4 - -#define z x0 -#define m x1 -#define x x2 - -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 - -#define a0 x7 -#define a1 x8 -#define a2 x9 -#define a3 x10 - -// Aliased to the a0,..,a3 when they are no longer needed - -#define l x7 -#define q x8 -#define c x9 -#define d4 x10 -#define h x10 - -S2N_BN_SYMBOL(bignum_cmul_p25519): -S2N_BN_SYMBOL(bignum_cmul_p25519_alt): - CFI_START - -// First do the multiply, straightforwardly to get [d4;d3;d2;d1;d0] - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - mul d0, m, a0 - mul d1, m, a1 - mul d2, m, a2 - mul d3, m, a3 - umulh a0, m, a0 - umulh a1, m, a1 - umulh a2, m, a2 - umulh d4, m, a3 - adds d1, d1, a0 - adcs d2, d2, a1 - adcs d3, d3, a2 - adcs d4, d4, xzr - -// Let 2^255 * h + l = [d4,d3,d2,d1,d0] = c * x, and use q = h + 1 -// as the initial quotient estimate, either right or 1 too big. - - add q, d4, 1 - adds xzr, d3, d3 - orr d3, d3, #0x8000000000000000 - adc q, q, d4 - mov c, #19 - mul l, q, c - umulh h, q, c - adds d0, d0, l - adcs d1, d1, h - adcs d2, d2, xzr - adcs d3, d3, xzr - -// Correct if CF = 0 by subtracting 19, either way masking to -// 255 bits, i.e. by effectively adding p_25519 to the "full" answer - - csel c, c, xzr, cc - subs d0, d0, c - sbcs d1, d1, xzr - sbcs d2, d2, xzr - sbc d3, d3, xzr - and d3, d3, #~0x8000000000000000 - -// Finally store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p25519) -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p25519_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_double_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_double_p25519.S deleted file mode 100644 index 5d8c1117878..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_double_p25519.S +++ /dev/null @@ -1,76 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo p_25519, z := (2 * x) mod p_25519, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_double_p25519(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_double_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_double_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_double_p25519) - - .text - .balign 4 - -#define z x0 -#define x x1 -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define c0 x6 -#define c1 x7 -#define c2 x8 -#define c3 x9 - -S2N_BN_SYMBOL(bignum_double_p25519): - CFI_START - -// Double by adding as [d3; d2; d1; d0] = 2 * x; since we assume -// x < 2^255 - 19 this result fits in 256 bits - - ldp d0, d1, [x] - adds d0, d0, d0 - adcs d1, d1, d1 - ldp d2, d3, [x, #16] - adcs d2, d2, d2 - adc d3, d3, d3 - -// Now 2 * x >= 2^255 - 19 <=> 2 * x + (2^255 + 19) >= 2^256 -// Form [c3; c2; c1; c0] = (2 * x) + (2^255 + 19), with CF for the comparison - - mov c3, #0x8000000000000000 - adds c0, d0, #19 - adcs c1, d1, xzr - adcs c2, d2, xzr - adcs c3, d3, c3 - -// If the comparison holds, select [c3; c2; c1; c0]. There's no need to mask -// it since in this case it is ((2 * x) + (2^255 + 19)) - 2^256 because the -// top carry is lost, which is the desired (2 * x) - (2^255 - 19). - - csel d0, d0, c0, cc - csel d1, d1, c1, cc - csel d2, d2, c2, cc - csel d3, d3, c3, cc - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_double_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_inv_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_inv_p25519.S deleted file mode 100644 index 3320938b216..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_inv_p25519.S +++ /dev/null @@ -1,1260 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Modular inverse modulo p_25519 = 2^255 - 19 -// Input x[4]; output z[4] -// -// extern void bignum_inv_p25519(uint64_t z[static 4],const uint64_t x[static 4]); -// -// Assuming the 4-digit input x is coprime to p_25519, i.e. is not divisible -// by it, returns z < p_25519 such that x * z == 1 (mod p_25519). Note that -// x does not need to be reduced modulo p_25519, but the output always is. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_inv_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_inv_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_inv_p25519) - - .text - .balign 4 - -// Size in bytes of a 64-bit word - -#define N 8 - -// Used for the return pointer - -#define res x20 - -// Loop counter and d = 2 * delta value for divstep - -#define i x21 -#define d x22 - -// Registers used for matrix element magnitudes and signs - -#define m00 x10 -#define m01 x11 -#define m10 x12 -#define m11 x13 -#define s00 x14 -#define s01 x15 -#define s10 x16 -#define s11 x17 - -// Initial carries for combinations - -#define car0 x9 -#define car1 x19 - -// Input and output, plain registers treated according to pattern - -#define reg0 x0, #0 -#define reg1 x1, #0 -#define reg2 x2, #0 -#define reg3 x3, #0 -#define reg4 x4, #0 - -#define x x1, #0 -#define z x0, #0 - -// Pointer-offset pairs for temporaries on stack - -#define f sp, #0 -#define g sp, #(4*N) -#define u sp, #(8*N) -#define v sp, #(12*N) - -// Total size to reserve on the stack - -#define NSPACE 16*N - -// Very similar to a subroutine call to the s2n-bignum word_divstep59. -// But different in register usage and returning the final matrix in -// registers as follows -// -// [ m00 m01] -// [ m10 m11] - -#define divstep59() \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x8, x4, #0x100, lsl #12 __LF \ - sbfx x8, x8, #21, #21 __LF \ - mov x11, #0x100000 __LF \ - add x11, x11, x11, lsl #21 __LF \ - add x9, x4, x11 __LF \ - asr x9, x9, #42 __LF \ - add x10, x5, #0x100, lsl #12 __LF \ - sbfx x10, x10, #21, #21 __LF \ - add x11, x5, x11 __LF \ - asr x11, x11, #42 __LF \ - mul x6, x8, x2 __LF \ - mul x7, x9, x3 __LF \ - mul x2, x10, x2 __LF \ - mul x3, x11, x3 __LF \ - add x4, x6, x7 __LF \ - add x5, x2, x3 __LF \ - asr x2, x4, #20 __LF \ - asr x3, x5, #20 __LF \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x12, x4, #0x100, lsl #12 __LF \ - sbfx x12, x12, #21, #21 __LF \ - mov x15, #0x100000 __LF \ - add x15, x15, x15, lsl #21 __LF \ - add x13, x4, x15 __LF \ - asr x13, x13, #42 __LF \ - add x14, x5, #0x100, lsl #12 __LF \ - sbfx x14, x14, #21, #21 __LF \ - add x15, x5, x15 __LF \ - asr x15, x15, #42 __LF \ - mul x6, x12, x2 __LF \ - mul x7, x13, x3 __LF \ - mul x2, x14, x2 __LF \ - mul x3, x15, x3 __LF \ - add x4, x6, x7 __LF \ - add x5, x2, x3 __LF \ - asr x2, x4, #20 __LF \ - asr x3, x5, #20 __LF \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - mul x2, x12, x8 __LF \ - mul x3, x12, x9 __LF \ - mul x6, x14, x8 __LF \ - mul x7, x14, x9 __LF \ - madd x8, x13, x10, x2 __LF \ - madd x9, x13, x11, x3 __LF \ - madd x16, x15, x10, x6 __LF \ - madd x17, x15, x11, x7 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x12, x4, #0x100, lsl #12 __LF \ - sbfx x12, x12, #22, #21 __LF \ - mov x15, #0x100000 __LF \ - add x15, x15, x15, lsl #21 __LF \ - add x13, x4, x15 __LF \ - asr x13, x13, #43 __LF \ - add x14, x5, #0x100, lsl #12 __LF \ - sbfx x14, x14, #22, #21 __LF \ - add x15, x5, x15 __LF \ - asr x15, x15, #43 __LF \ - mneg x2, x12, x8 __LF \ - mneg x3, x12, x9 __LF \ - mneg x4, x14, x8 __LF \ - mneg x5, x14, x9 __LF \ - msub m00, x13, x16, x2 __LF \ - msub m01, x13, x17, x3 __LF \ - msub m10, x15, x16, x4 __LF \ - msub m11, x15, x17, x5 - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(bignum_inv_p25519): - CFI_START - -// Save registers and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_DEC_SP(NSPACE) - -// Save the return pointer for the end so we can overwrite x0 later - - mov res, x0 - -// Copy the input and the prime into the main f and g variables. -// Make sure x is reduced so that g <= f as assumed in the bound proof. - - mov x10, #-19 - mov x11, #-1 - stp x10, x11, [f] - mov x12, #0x7FFFFFFFFFFFFFFF - stp x11, x12, [f+2*N] - - ldp x2, x3, [x1] - ldp x4, x5, [x1, #(2*N)] - mov x7, #19 - lsr x6, x5, #63 - madd x6, x7, x6, x7 - adds x2, x2, x6 - adcs x3, x3, xzr - adcs x4, x4, xzr - orr x5, x5, #0x8000000000000000 - adcs x5, x5, xzr - csel x6, x7, xzr, cc - subs x2, x2, x6 - sbcs x3, x3, xzr - sbcs x4, x4, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - stp x2, x3, [g] - stp x4, x5, [g+2*N] - -// Also maintain weakly reduced < 2*p_25519 vector [u,v] such that -// [f,g] == x * 2^{590-59*i} * [u,v] (mod p_25519) -// starting with [p_25519,x] == x * 2^{590-59*0} * [0,2^-590] (mod p_25519) - - stp xzr, xzr, [u] - stp xzr, xzr, [u+2*N] - - movbig(x10, 0xa0f9, 0x9e23, 0x7502, 0x2099) - movbig(x11, 0xa8c6, 0x8f3f, 0x1d13, 0x2595) - movbig(x12, 0x6c6c, 0x8938, 0x05ac, 0x5242) - movbig(x13, 0x2765, 0x08b2, 0x4177, 0x0615) - - stp x10, x11, [v] - stp x12, x13, [v+2*N] - -// Start of main loop. We jump into the middle so that the divstep -// portion is common to the special tenth iteration after a uniform -// first 9. - - mov i, #10 - mov d, #1 - b Lbignum_inv_p25519_midloop - -Lbignum_inv_p25519_loop: - -// Separate the matrix elements into sign-magnitude pairs - - cmp m00, xzr - csetm s00, mi - cneg m00, m00, mi - - cmp m01, xzr - csetm s01, mi - cneg m01, m01, mi - - cmp m10, xzr - csetm s10, mi - cneg m10, m10, mi - - cmp m11, xzr - csetm s11, mi - cneg m11, m11, mi - -// Adjust the initial values to allow for complement instead of negation -// This initial offset is the same for [f,g] and [u,v] compositions. -// Save it in stable registers for the [u,v] part and do [f,g] first. - - and x0, m00, s00 - and x1, m01, s01 - add car0, x0, x1 - - and x0, m10, s10 - and x1, m11, s11 - add car1, x0, x1 - -// Now the computation of the updated f and g values. This maintains a -// 2-word carry between stages so we can conveniently insert the shift -// right by 59 before storing back, and not overwrite digits we need -// again of the old f and g values. -// -// Digit 0 of [f,g] - - ldr x7, [f] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [g] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - adc x2, x2, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x5, car1, x0 - adc x3, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x5, x5, x0 - adc x3, x3, x1 - -// Digit 1 of [f,g] - - ldr x7, [f+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [g+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [f] - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [g] - -// Digit 2 of [f,g] - - ldr x7, [f+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [g+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [f+N] - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [g+N] - -// Digits 3 and 4 of [f,g] - - ldr x7, [f+3*N] - eor x1, x7, s00 - asr x3, x1, #63 - and x3, x3, m00 - neg x3, x3 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [g+3*N] - eor x1, x8, s01 - asr x0, x1, #63 - and x0, x0, m01 - sub x3, x3, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [f+2*N] - extr x5, x3, x5, #59 - str x5, [f+3*N] - - eor x1, x7, s10 - asr x5, x1, #63 - and x5, x5, m10 - neg x5, x5 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, s11 - asr x0, x1, #63 - and x0, x0, m11 - sub x5, x5, x0 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x2, x2, x0 - adc x5, x5, x1 - extr x4, x2, x4, #59 - str x4, [g+2*N] - extr x2, x5, x2, #59 - str x2, [g+3*N] - -// Now the computation of the updated u and v values and their -// modular reductions. A very similar accumulation except that -// the top words of u and v are unsigned and we don't shift. -// -// Digit 0 of [u,v] - - ldr x7, [u] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [v] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - str x4, [u] - adc x2, x2, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x5, car1, x0 - adc x3, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x5, x5, x0 - str x5, [v] - adc x3, x3, x1 - -// Digit 1 of [u,v] - - ldr x7, [u+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [v+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - str x2, [u+N] - adc x6, x6, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x3, x3, x0 - str x3, [v+N] - adc x4, x4, x1 - -// Digit 2 of [u,v] - - ldr x7, [u+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [v+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - str x6, [u+2*N] - adc x5, x5, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x4, x4, x0 - str x4, [v+2*N] - adc x2, x2, x1 - -// Digits 3 and 4 of u (top is unsigned) - - ldr x7, [u+3*N] - eor x1, x7, s00 - and x3, s00, m00 - neg x3, x3 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [v+3*N] - eor x1, x8, s01 - and x0, s01, m01 - sub x3, x3, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - -// Modular reduction of u - - extr x6, x3, x5, #63 - ldp x0, x1, [u] - add x6, x6, x3, asr #63 - mov x3, #19 - mul x4, x6, x3 - add x5, x5, x6, lsl #63 - smulh x3, x6, x3 - ldr x6, [u+2*N] - adds x0, x0, x4 - adcs x1, x1, x3 - asr x3, x3, #63 - adcs x6, x6, x3 - adc x5, x5, x3 - stp x0, x1, [u] - stp x6, x5, [u+16] - -// Digits 3 and 4 of v (top is unsigned) - - eor x1, x7, s10 - and x5, s10, m10 - neg x5, x5 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, s11 - and x0, s11, m11 - sub x5, x5, x0 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x2, x2, x0 - adc x5, x5, x1 - -// Modular reduction of v - - extr x6, x5, x2, #63 - ldp x0, x1, [v] - add x6, x6, x5, asr #63 - mov x5, #19 - mul x4, x6, x5 - add x2, x2, x6, lsl #63 - smulh x5, x6, x5 - ldr x3, [v+2*N] - adds x0, x0, x4 - adcs x1, x1, x5 - asr x5, x5, #63 - adcs x3, x3, x5 - adc x2, x2, x5 - stp x0, x1, [v] - stp x3, x2, [v+16] - -Lbignum_inv_p25519_midloop: - - mov x1, d - ldr x2, [f] - ldr x3, [g] - divstep59() - mov d, x1 - -// Next iteration - - subs i, i, #1 - bne Lbignum_inv_p25519_loop - -// The 10th and last iteration does not need anything except the -// u value and the sign of f; the latter can be obtained from the -// lowest word of f. So it's done differently from the main loop. -// Find the sign of the new f. For this we just need one digit -// since we know (for in-scope cases) that f is either +1 or -1. -// We don't explicitly shift right by 59 either, but looking at -// bit 63 (or any bit >= 60) of the unshifted result is enough -// to distinguish -1 from +1; this is then made into a mask. - - ldr x0, [f] - ldr x1, [g] - mul x0, x0, m00 - madd x1, x1, m01, x0 - asr x0, x1, #63 - -// Now separate out the matrix into sign-magnitude pairs -// and adjust each one based on the sign of f. -// -// Note that at this point we expect |f|=1 and we got its -// sign above, so then since [f,0] == x * [u,v] (mod p_25519) -// we want to flip the sign of u according to that of f. - - cmp m00, xzr - csetm s00, mi - cneg m00, m00, mi - eor s00, s00, x0 - - cmp m01, xzr - csetm s01, mi - cneg m01, m01, mi - eor s01, s01, x0 - - cmp m10, xzr - csetm s10, mi - cneg m10, m10, mi - eor s10, s10, x0 - - cmp m11, xzr - csetm s11, mi - cneg m11, m11, mi - eor s11, s11, x0 - -// Adjust the initial value to allow for complement instead of negation - - and x0, m00, s00 - and x1, m01, s01 - add car0, x0, x1 - -// Digit 0 of [u] - - ldr x7, [u] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [v] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - str x4, [u] - adc x2, x2, x1 - -// Digit 1 of [u] - - ldr x7, [u+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [v+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - str x2, [u+N] - adc x6, x6, x1 - -// Digit 2 of [u] - - ldr x7, [u+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [v+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - str x6, [u+2*N] - adc x5, x5, x1 - -// Digits 3 and 4 of u (top is unsigned) - - ldr x7, [u+3*N] - eor x1, x7, s00 - and x3, s00, m00 - neg x3, x3 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [v+3*N] - eor x1, x8, s01 - and x0, s01, m01 - sub x3, x3, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - -// Modular reduction of u, this time strictly 2^255-19. - - extr x6, x3, x5, #63 - ldp x0, x1, [u] - tst x3, x3 - cinc x6, x6, pl - mov x3, #19 - mul x4, x6, x3 - add x5, x5, x6, lsl #63 - smulh x6, x6, x3 - ldr x2, [u+2*N] - adds x0, x0, x4 - adcs x1, x1, x6 - asr x6, x6, #63 - adcs x2, x2, x6 - adcs x5, x5, x6 - csel x3, x3, xzr, mi - subs x0, x0, x3 - sbcs x1, x1, xzr - sbcs x2, x2, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - -// Store it back to the final output - - mov x4, res - stp x0, x1, [x4] - stp x2, x5, [x4, #16] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_inv_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_invsqrt_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_invsqrt_p25519.S deleted file mode 100644 index 44cc2b657eb..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_invsqrt_p25519.S +++ /dev/null @@ -1,616 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Inverse square root modulo p_25519 = 2^255 - 19 -// Input x[4]; output function return (Legendre symbol) and z[4] -// -// extern int64_t bignum_invsqrt_p25519(uint64_t z[static 4],const uint64_t x[static 4]); -// -// Given a 4-digit input x, returns a modular inverse square root mod p_25519, -// i.e. a z such that x * z^2 == 1 (mod p_25519), whenever one exists. The -// inverse square root z is chosen so that its LSB is even (note that p_25519-z -// is another possibility). The function return is the Legendre/Jacobi symbol -// (x//p_25519), which indicates whether indeed x has a modular inverse square -// root and hence whether the result is meaningful: -// -// 0: x is divisible by p_25519 so trivially there is no inverse square root -// +1: x is coprime to p_25519 and z is indeed an inverse square root -// -1: x is coprime to p_25519 but there is no (inverse or direct) square root -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_invsqrt_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_invsqrt_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_invsqrt_p25519) - - - .text - .balign 4 - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack - -#define a sp, #0 -#define b sp, #(4*N) -#define s sp, #(8*N) -#define t sp, #(12*N) - -// Other temporary variables in register - -#define res x19 - -// Total size to reserve on the stack - -#define NSPACE 16*N - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -// Macros wrapping up calls to the local subroutines - -#define mulp(dest,src1,src2) \ - add x0, dest __LF \ - add x1, src1 __LF \ - add x2, src2 __LF \ - CFI_BL(Lbignum_invsqrt_p25519_mul_p25519) - -#define nsqr(dest,n,src) \ - add x0, dest __LF \ - mov x1, n __LF \ - add x2, src __LF \ - CFI_BL(Lbignum_invsqrt_p25519_nsqr_p25519) - -S2N_BN_SYMBOL(bignum_invsqrt_p25519): - CFI_START - -// Save registers and make room for temporaries - - CFI_PUSH2(x19,x30) - CFI_DEC_SP(NSPACE) - -// Save the return pointer for the end so we can overwrite x0 later - - mov res, x0 - -// Set up reduced version of the input argument a = x mod p_25519. Then -// get the candidate inverse square root s = a^{252-3} - - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - mov x7, #19 - lsr x6, x5, #63 - madd x6, x7, x6, x7 - adds x2, x2, x6 - adcs x3, x3, xzr - adcs x4, x4, xzr - orr x5, x5, #0x8000000000000000 - adcs x5, x5, xzr - csel x6, x7, xzr, lo - subs x2, x2, x6 - sbcs x3, x3, xzr - sbcs x4, x4, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - stp x2, x3, [a] - stp x4, x5, [a+16] - - // Power 2^2 - 1 = 3 - - nsqr(t,1,a) - mulp(t,t,a) - - // Power 2^4 - 1 = 15 - - nsqr(s,2,t) - mulp(t,s,t) - - // Power 2^5 - 1 = 31 - - nsqr(s,1,t) - mulp(b,s,a) - - // Power 2^10 - 1 - - nsqr(s,5,b) - mulp(t,s,b) - - // Power 2^20 - 1 - - nsqr(s,10,t) - mulp(t,s,t) - - // Power 2^25 - 1 - - nsqr(s,5,t) - mulp(b,s,b) - - // Power 2^50 - 1 - - nsqr(s,25,b) - mulp(t,s,b) - - // Power 2^100 - 1 - nsqr(s,50,t) - mulp(t,s,t) - - // Power 2^125 - 1 - - nsqr(s,25,t) - mulp(b,s,b) - - // Power 2^250 - 1 - - nsqr(s,125,b) - mulp(b,s,b) - - // Power 2^252 - 3 - - nsqr(s,2,b) - mulp(s,s,a) - -// s = a^{2^252-3} is now one candidate inverse square root. -// Generate the other one t = s * j_25519 where j_25519 = sqrt(-1) - - movbig(x0, #0xc4ee, #0x1b27, #0x4a0e, #0xa0b0) - movbig(x1, #0x2f43, #0x1806, #0xad2f, #0xe478) - movbig(x2, #0x2b4d, #0x0099, #0x3dfb, #0xd7a7) - movbig(x3, #0x2b83, #0x2480, #0x4fc1, #0xdf0b) - stp x0, x1, [t] - stp x2, x3, [t+16] - mulp(t,s,t) - -// Now multiplex between them according to whether a * s^2 = 1 - - nsqr(b,1,s) - mulp(b,a,b) - - ldp x10, x11, [b] - eor x10, x10, #1 - ldp x12, x13, [b+16] - orr x10, x10, x11 - orr x12, x12, x13 - orr x10, x10, x12 - cmp x10, xzr - - ldp x10, x11, [s] - ldp x14, x15, [t] - csel x10, x10, x14, eq - csel x11, x11, x15, eq - ldp x12, x13, [s+16] - ldp x16, x17, [t+16] - csel x12, x12, x16, eq - csel x13, x13, x17, eq - -// For definiteness, choose "positive" (LSB=0) inverse square root - - mov x14, #-19 - subs x14, x14, x10 - mov x16, #-1 - sbcs x15, x16, x11 - mov x17, #0x7FFFFFFFFFFFFFFF - sbcs x16, x16, x12 - sbc x17, x17, x13 - - tst x10, #1 - csel x10, x10, x14, eq - csel x11, x11, x15, eq - csel x12, x12, x16, eq - csel x13, x13, x17, eq - - mov x2, res - stp x10, x11, [x2] - stp x12, x13, [x2, #16] - -// Determine if it is is indeed an inverse square root, also distinguishing -// the degenerate x * z^2 == 0 (mod p_25519) case, which is equivalent to -// x == 0 (mod p_25519). Hence return the Legendre-Jacobi symbol as required. - - add x0, b - mov x1, #1 - CFI_BL(Lbignum_invsqrt_p25519_nsqr_p25519) - mulp(b,a,b) - - ldp x10, x11, [b] - eor x14, x10, #1 - ldp x12, x13, [b+16] - orr x10, x10, x11 - orr x14, x14, x11 - orr x12, x12, x13 - orr x10, x10, x12 - orr x14, x14, x12 - - cmp x14, xzr - mov x0, #1 - cneg x0, x0, ne - - cmp x10, xzr - csel x0, x0, xzr, ne - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x30) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_invsqrt_p25519) - -// ************************************************************* -// Local z = x * y -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_invsqrt_p25519_mul_p25519) - -Lbignum_invsqrt_p25519_mul_p25519: - CFI_START - ldp x3, x4, [x1] - ldp x5, x6, [x2] - umull x7, w3, w5 - lsr x17, x3, #32 - umull x15, w17, w5 - lsr x16, x5, #32 - umull x8, w16, w17 - umull x16, w3, w16 - adds x7, x7, x15, lsl #32 - lsr x15, x15, #32 - adc x8, x8, x15 - adds x7, x7, x16, lsl #32 - lsr x16, x16, #32 - adc x8, x8, x16 - mul x9, x4, x6 - umulh x10, x4, x6 - subs x4, x4, x3 - cneg x4, x4, lo - csetm x16, lo - adds x9, x9, x8 - adc x10, x10, xzr - subs x3, x5, x6 - cneg x3, x3, lo - cinv x16, x16, lo - mul x15, x4, x3 - umulh x3, x4, x3 - adds x8, x7, x9 - adcs x9, x9, x10 - adc x10, x10, xzr - cmn x16, #1 - eor x15, x15, x16 - adcs x8, x15, x8 - eor x3, x3, x16 - adcs x9, x3, x9 - adc x10, x10, x16 - ldp x3, x4, [x1, #16] - ldp x5, x6, [x2, #16] - umull x11, w3, w5 - lsr x17, x3, #32 - umull x15, w17, w5 - lsr x16, x5, #32 - umull x12, w16, w17 - umull x16, w3, w16 - adds x11, x11, x15, lsl #32 - lsr x15, x15, #32 - adc x12, x12, x15 - adds x11, x11, x16, lsl #32 - lsr x16, x16, #32 - adc x12, x12, x16 - mul x13, x4, x6 - umulh x14, x4, x6 - subs x4, x4, x3 - cneg x4, x4, lo - csetm x16, lo - adds x13, x13, x12 - adc x14, x14, xzr - subs x3, x5, x6 - cneg x3, x3, lo - cinv x16, x16, lo - mul x15, x4, x3 - umulh x3, x4, x3 - adds x12, x11, x13 - adcs x13, x13, x14 - adc x14, x14, xzr - cmn x16, #1 - eor x15, x15, x16 - adcs x12, x15, x12 - eor x3, x3, x16 - adcs x13, x3, x13 - adc x14, x14, x16 - ldp x3, x4, [x1, #16] - ldp x15, x16, [x1] - subs x3, x3, x15 - sbcs x4, x4, x16 - csetm x16, lo - ldp x15, x17, [x2] - subs x5, x15, x5 - sbcs x6, x17, x6 - csetm x17, lo - eor x3, x3, x16 - subs x3, x3, x16 - eor x4, x4, x16 - sbc x4, x4, x16 - eor x5, x5, x17 - subs x5, x5, x17 - eor x6, x6, x17 - sbc x6, x6, x17 - eor x16, x17, x16 - adds x11, x11, x9 - adcs x12, x12, x10 - adcs x13, x13, xzr - adc x14, x14, xzr - mul x2, x3, x5 - umulh x17, x3, x5 - mul x15, x4, x6 - umulh x1, x4, x6 - subs x4, x4, x3 - cneg x4, x4, lo - csetm x9, lo - adds x15, x15, x17 - adc x1, x1, xzr - subs x6, x5, x6 - cneg x6, x6, lo - cinv x9, x9, lo - mul x5, x4, x6 - umulh x6, x4, x6 - adds x17, x2, x15 - adcs x15, x15, x1 - adc x1, x1, xzr - cmn x9, #1 - eor x5, x5, x9 - adcs x17, x5, x17 - eor x6, x6, x9 - adcs x15, x6, x15 - adc x1, x1, x9 - adds x9, x11, x7 - adcs x10, x12, x8 - adcs x11, x13, x11 - adcs x12, x14, x12 - adcs x13, x13, xzr - adc x14, x14, xzr - cmn x16, #1 - eor x2, x2, x16 - adcs x9, x2, x9 - eor x17, x17, x16 - adcs x10, x17, x10 - eor x15, x15, x16 - adcs x11, x15, x11 - eor x1, x1, x16 - adcs x12, x1, x12 - adcs x13, x13, x16 - adc x14, x14, x16 - mov x3, #38 - umull x4, w11, w3 - add x4, x4, w7, uxtw - lsr x7, x7, #32 - lsr x11, x11, #32 - umaddl x11, w11, w3, x7 - mov x7, x4 - umull x4, w12, w3 - add x4, x4, w8, uxtw - lsr x8, x8, #32 - lsr x12, x12, #32 - umaddl x12, w12, w3, x8 - mov x8, x4 - umull x4, w13, w3 - add x4, x4, w9, uxtw - lsr x9, x9, #32 - lsr x13, x13, #32 - umaddl x13, w13, w3, x9 - mov x9, x4 - umull x4, w14, w3 - add x4, x4, w10, uxtw - lsr x10, x10, #32 - lsr x14, x14, #32 - umaddl x14, w14, w3, x10 - mov x10, x4 - lsr x17, x14, #31 - mov x5, #19 - umaddl x5, w5, w17, x5 - add x7, x7, x5 - adds x7, x7, x11, lsl #32 - extr x3, x12, x11, #32 - adcs x8, x8, x3 - extr x3, x13, x12, #32 - adcs x9, x9, x3 - extr x3, x14, x13, #32 - lsl x5, x17, #63 - eor x10, x10, x5 - adc x10, x10, x3 - mov x3, #19 - tst x10, #0x8000000000000000 - csel x3, x3, xzr, pl - subs x7, x7, x3 - sbcs x8, x8, xzr - sbcs x9, x9, xzr - sbc x10, x10, xzr - and x10, x10, #0x7fffffffffffffff - stp x7, x8, [x0] - stp x9, x10, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_invsqrt_p25519_mul_p25519) - -// ************************************************************* -// Local z = 2^n * x -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_invsqrt_p25519_nsqr_p25519) - -Lbignum_invsqrt_p25519_nsqr_p25519: - CFI_START - -// Copy input argument into [x13;x12;x11;x10] - - ldp x10, x11, [x2] - ldp x12, x13, [x2, #16] - -// Main squaring loop, accumulating in [x13;x12;x11;x10] consistently and -// only ensuring the intermediates are < 2 * p_25519 = 2^256 - 38 - -Lbignum_invsqrt_p25519_loop: - umull x2, w10, w10 - lsr x14, x10, #32 - umull x3, w14, w14 - umull x14, w10, w14 - adds x2, x2, x14, lsl #33 - lsr x14, x14, #31 - adc x3, x3, x14 - umull x4, w11, w11 - lsr x14, x11, #32 - umull x5, w14, w14 - umull x14, w11, w14 - mul x15, x10, x11 - umulh x16, x10, x11 - adds x4, x4, x14, lsl #33 - lsr x14, x14, #31 - adc x5, x5, x14 - adds x15, x15, x15 - adcs x16, x16, x16 - adc x5, x5, xzr - adds x3, x3, x15 - adcs x4, x4, x16 - adc x5, x5, xzr - umull x6, w12, w12 - lsr x14, x12, #32 - umull x7, w14, w14 - umull x14, w12, w14 - adds x6, x6, x14, lsl #33 - lsr x14, x14, #31 - adc x7, x7, x14 - umull x8, w13, w13 - lsr x14, x13, #32 - umull x9, w14, w14 - umull x14, w13, w14 - mul x15, x12, x13 - umulh x16, x12, x13 - adds x8, x8, x14, lsl #33 - lsr x14, x14, #31 - adc x9, x9, x14 - adds x15, x15, x15 - adcs x16, x16, x16 - adc x9, x9, xzr - adds x7, x7, x15 - adcs x8, x8, x16 - adc x9, x9, xzr - subs x10, x10, x12 - sbcs x11, x11, x13 - csetm x16, lo - eor x10, x10, x16 - subs x10, x10, x16 - eor x11, x11, x16 - sbc x11, x11, x16 - adds x6, x6, x4 - adcs x7, x7, x5 - adcs x8, x8, xzr - adc x9, x9, xzr - umull x12, w10, w10 - lsr x5, x10, #32 - umull x13, w5, w5 - umull x5, w10, w5 - adds x12, x12, x5, lsl #33 - lsr x5, x5, #31 - adc x13, x13, x5 - umull x15, w11, w11 - lsr x5, x11, #32 - umull x14, w5, w5 - umull x5, w11, w5 - mul x4, x10, x11 - umulh x16, x10, x11 - adds x15, x15, x5, lsl #33 - lsr x5, x5, #31 - adc x14, x14, x5 - adds x4, x4, x4 - adcs x16, x16, x16 - adc x14, x14, xzr - adds x13, x13, x4 - adcs x15, x15, x16 - adc x14, x14, xzr - adds x4, x2, x6 - adcs x5, x3, x7 - adcs x6, x6, x8 - adcs x7, x7, x9 - csetm x16, lo - subs x4, x4, x12 - sbcs x5, x5, x13 - sbcs x6, x6, x15 - sbcs x7, x7, x14 - adcs x8, x8, x16 - adc x9, x9, x16 - mov x10, #38 - umull x12, w6, w10 - add x12, x12, w2, uxtw - lsr x2, x2, #32 - lsr x6, x6, #32 - umaddl x6, w6, w10, x2 - mov x2, x12 - umull x12, w7, w10 - add x12, x12, w3, uxtw - lsr x3, x3, #32 - lsr x7, x7, #32 - umaddl x7, w7, w10, x3 - mov x3, x12 - umull x12, w8, w10 - add x12, x12, w4, uxtw - lsr x4, x4, #32 - lsr x8, x8, #32 - umaddl x8, w8, w10, x4 - mov x4, x12 - umull x12, w9, w10 - add x12, x12, w5, uxtw - lsr x5, x5, #32 - lsr x9, x9, #32 - umaddl x9, w9, w10, x5 - mov x5, x12 - lsr x13, x9, #31 - mov x11, #19 - umull x11, w11, w13 - add x2, x2, x11 - adds x10, x2, x6, lsl #32 - extr x12, x7, x6, #32 - adcs x11, x3, x12 - extr x12, x8, x7, #32 - adcs x12, x4, x12 - extr x14, x9, x8, #32 - lsl x15, x13, #63 - eor x5, x5, x15 - adc x13, x5, x14 - -// Loop as applicable - - subs x1, x1, #1 - bne Lbignum_invsqrt_p25519_loop - -// We know the intermediate result x < 2^256 - 38, and now we do strict -// modular reduction mod 2^255 - 19. Note x < 2^255 - 19 <=> x + 19 < 2^255 -// which is equivalent to a "pl" condition. - - adds x6, x10, #19 - adcs x7, x11, xzr - adcs x8, x12, xzr - adcs x9, x13, xzr - - csel x10, x10, x6, pl - csel x11, x11, x7, pl - csel x12, x12, x8, pl - csel x13, x13, x9, pl - bic x13, x13, #0x8000000000000000 - -// Copy result back into destination and return - - stp x10, x11, [x0] - stp x12, x13, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_invsqrt_p25519_nsqr_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_invsqrt_p25519_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_invsqrt_p25519_alt.S deleted file mode 100644 index e57d77aa1f0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_invsqrt_p25519_alt.S +++ /dev/null @@ -1,479 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Inverse square root modulo p_25519 = 2^255 - 19 -// Input x[4]; output function return (Legendre symbol) and z[4] -// -// extern int64_t bignum_invsqrt_p25519_alt(uint64_t z[static 4],const uint64_t x[static 4]); -// -// Given a 4-digit input x, returns a modular inverse square root mod p_25519, -// i.e. a z such that x * z^2 == 1 (mod p_25519), whenever one exists. The -// inverse square root z is chosen so that its LSB is even (note that p_25519-z -// is another possibility). The function return is the Legendre/Jacobi symbol -// (x//p_25519), which indicates whether indeed x has a modular inverse square -// root and hence whether the result is meaningful: -// -// 0: x is divisible by p_25519 so trivially there is no inverse square root -// +1: x is coprime to p_25519 and z is indeed an inverse square root -// -1: x is coprime to p_25519 but there is no (inverse or direct) square root -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_invsqrt_p25519_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_invsqrt_p25519_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_invsqrt_p25519_alt) - - - .text - .balign 4 - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack - -#define a sp, #0 -#define b sp, #(4*N) -#define s sp, #(8*N) -#define t sp, #(12*N) - -// Other temporary variables in register - -#define res x19 - -// Total size to reserve on the stack - -#define NSPACE 16*N - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -// Macros wrapping up calls to the local subroutines - -#define mulp(dest,src1,src2) \ - add x0, dest __LF \ - add x1, src1 __LF \ - add x2, src2 __LF \ - CFI_BL(Lbignum_invsqrt_p25519_alt_mul_p25519) - -#define nsqr(dest,n,src) \ - add x0, dest __LF \ - mov x1, n __LF \ - add x2, src __LF \ - CFI_BL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - -S2N_BN_SYMBOL(bignum_invsqrt_p25519_alt): - CFI_START - -// Save registers and make room for temporaries - - CFI_PUSH2(x19,x30) - CFI_DEC_SP(NSPACE) - -// Save the return pointer for the end so we can overwrite x0 later - - mov res, x0 - -// Set up reduced version of the input argument a = x mod p_25519. Then -// get the candidate inverse square root s = a^{252-3} - - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - mov x7, #19 - lsr x6, x5, #63 - madd x6, x7, x6, x7 - adds x2, x2, x6 - adcs x3, x3, xzr - adcs x4, x4, xzr - orr x5, x5, #0x8000000000000000 - adcs x5, x5, xzr - csel x6, x7, xzr, lo - subs x2, x2, x6 - sbcs x3, x3, xzr - sbcs x4, x4, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - stp x2, x3, [a] - stp x4, x5, [a+16] - - // Power 2^2 - 1 = 3 - - nsqr(t,1,a) - mulp(t,t,a) - - // Power 2^4 - 1 = 15 - - nsqr(s,2,t) - mulp(t,s,t) - - // Power 2^5 - 1 = 31 - - nsqr(s,1,t) - mulp(b,s,a) - - // Power 2^10 - 1 - - nsqr(s,5,b) - mulp(t,s,b) - - // Power 2^20 - 1 - - nsqr(s,10,t) - mulp(t,s,t) - - // Power 2^25 - 1 - - nsqr(s,5,t) - mulp(b,s,b) - - // Power 2^50 - 1 - - nsqr(s,25,b) - mulp(t,s,b) - - // Power 2^100 - 1 - nsqr(s,50,t) - mulp(t,s,t) - - // Power 2^125 - 1 - - nsqr(s,25,t) - mulp(b,s,b) - - // Power 2^250 - 1 - - nsqr(s,125,b) - mulp(b,s,b) - - // Power 2^252 - 3 - - nsqr(s,2,b) - mulp(s,s,a) - -// s = a^{2^252-3} is now one candidate inverse square root. -// Generate the other one t = s * j_25519 where j_25519 = sqrt(-1) - - movbig(x0, #0xc4ee, #0x1b27, #0x4a0e, #0xa0b0) - movbig(x1, #0x2f43, #0x1806, #0xad2f, #0xe478) - movbig(x2, #0x2b4d, #0x0099, #0x3dfb, #0xd7a7) - movbig(x3, #0x2b83, #0x2480, #0x4fc1, #0xdf0b) - stp x0, x1, [t] - stp x2, x3, [t+16] - mulp(t,s,t) - -// Now multiplex between them according to whether a * s^2 = 1 - - nsqr(b,1,s) - mulp(b,a,b) - - ldp x10, x11, [b] - eor x10, x10, #1 - ldp x12, x13, [b+16] - orr x10, x10, x11 - orr x12, x12, x13 - orr x10, x10, x12 - cmp x10, xzr - - ldp x10, x11, [s] - ldp x14, x15, [t] - csel x10, x10, x14, eq - csel x11, x11, x15, eq - ldp x12, x13, [s+16] - ldp x16, x17, [t+16] - csel x12, x12, x16, eq - csel x13, x13, x17, eq - -// For definiteness, choose "positive" (LSB=0) inverse square root - - mov x14, #-19 - subs x14, x14, x10 - mov x16, #-1 - sbcs x15, x16, x11 - mov x17, #0x7FFFFFFFFFFFFFFF - sbcs x16, x16, x12 - sbc x17, x17, x13 - - tst x10, #1 - csel x10, x10, x14, eq - csel x11, x11, x15, eq - csel x12, x12, x16, eq - csel x13, x13, x17, eq - - mov x2, res - stp x10, x11, [x2] - stp x12, x13, [x2, #16] - -// Determine if it is is indeed an inverse square root, also distinguishing -// the degenerate x * z^2 == 0 (mod p_25519) case, which is equivalent to -// x == 0 (mod p_25519). Hence return the Legendre-Jacobi symbol as required. - - add x0, b - mov x1, #1 - CFI_BL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - mulp(b,a,b) - - ldp x10, x11, [b] - eor x14, x10, #1 - ldp x12, x13, [b+16] - orr x10, x10, x11 - orr x14, x14, x11 - orr x12, x12, x13 - orr x10, x10, x12 - orr x14, x14, x12 - - cmp x14, xzr - mov x0, #1 - cneg x0, x0, ne - - cmp x10, xzr - csel x0, x0, xzr, ne - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x30) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_invsqrt_p25519_alt) - -// ************************************************************* -// Local z = x * y -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_invsqrt_p25519_alt_mul_p25519) - -Lbignum_invsqrt_p25519_alt_mul_p25519: - CFI_START - ldp x3, x4, [x1] - ldp x7, x8, [x2] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x2, #16] - mul x11, x3, x9 - umulh x15, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x16, x3, x10 - adcs x15, x15, x11 - adc x16, x16, xzr - ldp x5, x6, [x1, #16] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x15, x15, x11 - mul x11, x4, x10 - adcs x16, x16, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x15, x15, x11 - umulh x11, x4, x9 - adcs x16, x16, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x15, x15, x11 - mul x11, x5, x9 - adcs x16, x16, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x15, x15, x11 - umulh x11, x5, x8 - adcs x16, x16, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x15, x15, x11 - mul x11, x6, x8 - adcs x16, x16, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x16, x16, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - mov x7, #38 - mul x11, x7, x16 - umulh x9, x7, x16 - adds x12, x12, x11 - mul x11, x7, x3 - umulh x3, x7, x3 - adcs x13, x13, x11 - mul x11, x7, x4 - umulh x4, x7, x4 - adcs x14, x14, x11 - mul x11, x7, x5 - umulh x5, x7, x5 - adcs x15, x15, x11 - cset x16, hs - adds x15, x15, x4 - adc x16, x16, x5 - cmn x15, x15 - orr x15, x15, #0x8000000000000000 - adc x8, x16, x16 - mov x7, #19 - madd x11, x7, x8, x7 - adds x12, x12, x11 - adcs x13, x13, x9 - adcs x14, x14, x3 - adcs x15, x15, xzr - csel x7, x7, xzr, lo - subs x12, x12, x7 - sbcs x13, x13, xzr - sbcs x14, x14, xzr - sbc x15, x15, xzr - and x15, x15, #0x7fffffffffffffff - stp x12, x13, [x0] - stp x14, x15, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_invsqrt_p25519_alt_mul_p25519) - -// ************************************************************* -// Local z = 2^n * x -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - -Lbignum_invsqrt_p25519_alt_nsqr_p25519: - CFI_START - -// Copy input argument into [x5;x4;x3;x2] (overwriting input pointer x20 - - ldp x6, x3, [x2] - ldp x4, x5, [x2, #16] - mov x2, x6 - -// Main squaring loop, accumulating in [x5;x4;x3;x2] consistently and -// only ensuring the intermediates are < 2 * p_25519 = 2^256 - 38 - -Lbignum_invsqrt_p25519_alt_loop: - mul x9, x2, x3 - umulh x10, x2, x3 - mul x11, x2, x5 - umulh x12, x2, x5 - mul x7, x2, x4 - umulh x6, x2, x4 - adds x10, x10, x7 - adcs x11, x11, x6 - mul x7, x3, x4 - umulh x6, x3, x4 - adc x6, x6, xzr - adds x11, x11, x7 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x6 - mul x7, x3, x5 - umulh x6, x3, x5 - adc x6, x6, xzr - adds x12, x12, x7 - adcs x13, x13, x6 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x6, hs - umulh x7, x2, x2 - mul x8, x2, x2 - adds x9, x9, x7 - mul x7, x3, x3 - adcs x10, x10, x7 - umulh x7, x3, x3 - adcs x11, x11, x7 - mul x7, x4, x4 - adcs x12, x12, x7 - umulh x7, x4, x4 - adcs x13, x13, x7 - mul x7, x5, x5 - adcs x14, x14, x7 - umulh x7, x5, x5 - adc x6, x6, x7 - mov x3, #38 - mul x7, x3, x12 - umulh x4, x3, x12 - adds x8, x8, x7 - mul x7, x3, x13 - umulh x13, x3, x13 - adcs x9, x9, x7 - mul x7, x3, x14 - umulh x14, x3, x14 - adcs x10, x10, x7 - mul x7, x3, x6 - umulh x6, x3, x6 - adcs x11, x11, x7 - cset x12, hs - adds x11, x11, x14 - adc x12, x12, x6 - cmn x11, x11 - bic x11, x11, #0x8000000000000000 - adc x2, x12, x12 - mov x3, #0x13 - mul x7, x3, x2 - adds x2, x8, x7 - adcs x3, x9, x4 - adcs x4, x10, x13 - adc x5, x11, xzr - -// Loop as applicable - - subs x1, x1, #1 - bne Lbignum_invsqrt_p25519_alt_loop - -// We know the intermediate result x < 2^256 - 38, and now we do strict -// modular reduction mod 2^255 - 19. Note x < 2^255 - 19 <=> x + 19 < 2^255 -// which is equivalent to a "pl" condition. - - adds x6, x2, #19 - adcs x7, x3, xzr - adcs x8, x4, xzr - adcs x9, x5, xzr - - csel x2, x2, x6, pl - csel x3, x3, x7, pl - csel x4, x4, x8, pl - csel x5, x5, x9, pl - bic x5, x5, #0x8000000000000000 - -// Copy result back into destination and return - - stp x2, x3, [x0] - stp x4, x5, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_m25519_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_m25519_4.S deleted file mode 100644 index 8c0886d9550..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_m25519_4.S +++ /dev/null @@ -1,86 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod m_25519 -// Input x[4]; output z[4] -// -// extern void bignum_mod_m25519_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Reduction is modulo the group order of curve25519/edwards25519. -// This is the full group order, 8 * the standard basepoint order. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_m25519_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_m25519_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_m25519_4) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define n0 x2 -#define n1 x3 -#define n2 x4 -#define n3 x5 - -#define d0 x6 -#define d1 x7 -#define d2 x8 -#define d3 x9 - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(bignum_mod_m25519_4): - CFI_START - -// Load the complicated three words of m_25519 (the other being n2 = 0) - - movbig( n0, #0xc093, #0x18d2, #0xe7ae, #0x9f68) - movbig( n1, #0xa6f7, #0xcef5, #0x17bc, #0xe6b2) - mov n3, #0x8000000000000000 - -// Load the input number - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Do the subtraction. - - subs n0, d0, n0 - sbcs n1, d1, n1 - sbcs n2, d2, xzr - sbcs n3, d3, n3 - -// Now if the carry is *clear* (inversion at work) the subtraction carried -// and hence we should have done nothing, so we reset each n_i = d_i - - csel n0, d0, n0, cc - csel n1, d1, n1, cc - csel n2, d2, n2, cc - csel n3, d3, n3, cc - -// Store the end result - - stp n0, n1, [z] - stp n2, n3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_m25519_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_n25519.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_n25519.S index 07a652b5b26..c772af17bf7 100644 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_n25519.S +++ b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_n25519.S @@ -166,8 +166,6 @@ Lbignum_mod_n25519_writeback: stp m2, m3, [z, #16] CFI_RET -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n25519) - // Short case: just copy the input with zero-padding Lbignum_mod_n25519_short: @@ -186,6 +184,8 @@ Lbignum_mod_n25519_short: ldr m2, [x, #16] b Lbignum_mod_n25519_writeback +S2N_BN_SIZE_DIRECTIVE(bignum_mod_n25519) + #if defined(__linux__) && defined(__ELF__) .section .note.GNU-stack,"",%progbits #endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_n25519_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_n25519_4.S deleted file mode 100644 index 264c7ba2084..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_n25519_4.S +++ /dev/null @@ -1,109 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo basepoint order, z := x mod n_25519 -// Input x[4]; output z[4] -// -// extern void bignum_mod_n25519_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Reduction is modulo the order of the curve25519/edwards25519 basepoint. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n25519_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n25519_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n25519_4) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define n0 x2 -#define n1 x3 - -#define d0 x4 -#define d1 x5 -#define d2 x6 -#define d3 x7 - -#define q x8 - -#define m0 x9 -#define m1 x10 -#define m2 x11 - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(bignum_mod_n25519_4): - CFI_START - -// Load the complicated three words of n_25519. -// The others are n2 = 0 and n3 = 0x1000000000000000, which -// are handled a bit differently - - movbig( n0, #0x5812, #0x631a, #0x5cf5, #0xd3ed) - movbig( n1, #0x14de, #0xf9de, #0xa2f7, #0x9cd6) - -// Load the input number - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Get the quotient estimate q = floor(x/2^252). -// Also delete it from d3, in effect doing x' = x - q * 2^252 - - lsr q, d3, #60 - and d3, d3, #0x0FFFFFFFFFFFFFFF - -// Multiply [m2;m1;m0] = q * [n1;n0] - - mul m0, n0, q - mul m1, n1, q - umulh m2, n0, q - adds m1, m1, m2 - umulh m2, n1, q - adc m2, m2, xzr - -// Subtract [d3;d2;d1;d0] = x' - q * [n1;n0] = x - q * n_25519 - - subs d0, d0, m0 - sbcs d1, d1, m1 - sbcs d2, d2, m2 - sbcs d3, d3, xzr - -// If this borrows (CF = 0 because of inversion), add back n_25519. -// The masked n3 digit exploits the fact that bit 60 of n0 is set. - - csel n0, n0, xzr, cc - csel n1, n1, xzr, cc - - adds d0, d0, n0 - adcs d1, d1, n1 - and n0, n0, #0x1000000000000000 - adcs d2, d2, xzr - adc d3, d3, n0 - -// Store the end result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n25519_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_p25519_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_p25519_4.S deleted file mode 100644 index afea7e4a0fd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mod_p25519_4.S +++ /dev/null @@ -1,77 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_25519 -// Input x[4]; output z[4] -// -// extern void bignum_mod_p25519_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p25519_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p25519_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p25519_4) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define q x6 -#define c x7 - -S2N_BN_SYMBOL(bignum_mod_p25519_4): - CFI_START - -// Load the inputs as [d3;d2;d1;d0] - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Letting x = 2^255 * h + l where h is the top bit, the provisional quotient -// is q = h + 1, which is either correct or 1 too high. - - mov c, #19 - lsr q, d3, #63 - madd q, c, q, c - -// Writing the provisional remainder as r = x - (2^255 - 19) * q we -// compute r' = (2^255 + l) + 19 * q = r + 2^256 - - adds d0, d0, q - adcs d1, d1, xzr - adcs d2, d2, xzr - orr d3, d3, #0x8000000000000000 - adcs d3, d3, xzr - -// Now r < 0 <=> r' < 2^256 <=> ~CF and in this case we correct by adding -// 2^255 - 19, or in fact subtracting 19 and masking to 255 bits. - - csel q, c, xzr, cc - subs d0, d0, q - sbcs d1, d1, xzr - sbcs d2, d2, xzr - sbc d3, d3, xzr - and d3, d3, #~0x8000000000000000 - -// Store the end result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p25519_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mul_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mul_p25519.S deleted file mode 100644 index c703d6069b3..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mul_p25519.S +++ /dev/null @@ -1,339 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply modulo p_25519, z := (x * y) mod p_25519 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_mul_p25519(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_p25519) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a0short w3 -#define a1 x4 -#define b0 x5 -#define b0short w5 -#define b1 x6 - -#define u0 x7 -#define u1 x8 -#define u2 x9 -#define u3 x10 -#define u4 x11 -#define u5 x12 -#define u6 x13 -#define u7 x14 - -#define u0short w7 -#define u1short w8 -#define u2short w9 -#define u3short w10 -#define u4short w11 -#define u5short w12 -#define u6short w13 -#define u7short w14 - -#define t x15 - -#define sgn x16 -#define ysgn x17 - -// These are aliases to registers used elsewhere including input pointers. -// By the time they are used this does not conflict with other uses. - -#define m0 y -#define m1 ysgn -#define m2 t -#define m3 x -#define u u2 - -// For the reduction stages, again aliasing other things but not the u's - -#define c x3 -#define cshort w3 -#define h x4 -#define l x5 -#define lshort w5 -#define d x6 -#define q x17 -#define qshort w17 - -S2N_BN_SYMBOL(bignum_mul_p25519): - CFI_START - -// Multiply the low halves using Karatsuba 2x2->4 to get [u3,u2,u1,u0] - - ldp a0, a1, [x] - ldp b0, b1, [y] - - umull u0, a0short, b0short - lsr x17, a0, #32 - umull x15, w17, b0short - lsr x16, b0, #32 - umull u1, w16, w17 - umull x16, a0short, w16 - adds u0, u0, x15, lsl #32 - lsr x15, x15, #32 - adc u1, u1, x15 - adds u0, u0, x16, lsl #32 - lsr x16, x16, #32 - adc u1, u1, x16 - - mul u2, a1, b1 - umulh u3, a1, b1 - - subs a1, a1, a0 - cneg a1, a1, cc - csetm sgn, cc - - adds u2, u2, u1 - adc u3, u3, xzr - - subs a0, b0, b1 - cneg a0, a0, cc - cinv sgn, sgn, cc - - mul t, a1, a0 - umulh a0, a1, a0 - - adds u1, u0, u2 - adcs u2, u2, u3 - adc u3, u3, xzr - - adds xzr, sgn, #1 - eor t, t, sgn - adcs u1, t, u1 - eor a0, a0, sgn - adcs u2, a0, u2 - adc u3, u3, sgn - -// Multiply the high halves using Karatsuba 2x2->4 to get [u7,u6,u5,u4] - - ldp a0, a1, [x, #16] - ldp b0, b1, [y, #16] - - umull u4, a0short, b0short - lsr x17, a0, #32 - umull x15, w17, b0short - lsr x16, b0, #32 - umull u5, w16, w17 - umull x16, a0short, w16 - adds u4, u4, x15, lsl #32 - lsr x15, x15, #32 - adc u5, u5, x15 - adds u4, u4, x16, lsl #32 - lsr x16, x16, #32 - adc u5, u5, x16 - - mul u6, a1, b1 - umulh u7, a1, b1 - - subs a1, a1, a0 - cneg a1, a1, cc - csetm sgn, cc - - adds u6, u6, u5 - adc u7, u7, xzr - - subs a0, b0, b1 - cneg a0, a0, cc - cinv sgn, sgn, cc - - mul t, a1, a0 - umulh a0, a1, a0 - - adds u5, u4, u6 - adcs u6, u6, u7 - adc u7, u7, xzr - - adds xzr, sgn, #1 - eor t, t, sgn - adcs u5, t, u5 - eor a0, a0, sgn - adcs u6, a0, u6 - adc u7, u7, sgn - -// Compute sgn,[a1,a0] = x_hi - x_lo -// and ysgn,[b1,b0] = y_lo - y_hi -// sign-magnitude differences - - ldp a0, a1, [x, #16] - ldp t, sgn, [x] - subs a0, a0, t - sbcs a1, a1, sgn - csetm sgn, cc - - ldp t, ysgn, [y] - subs b0, t, b0 - sbcs b1, ysgn, b1 - csetm ysgn, cc - - eor a0, a0, sgn - subs a0, a0, sgn - eor a1, a1, sgn - sbc a1, a1, sgn - - eor b0, b0, ysgn - subs b0, b0, ysgn - eor b1, b1, ysgn - sbc b1, b1, ysgn - -// Save the correct sign for the sub-product - - eor sgn, ysgn, sgn - -// Add H' = H + L_top, still in [u7,u6,u5,u4] - - adds u4, u4, u2 - adcs u5, u5, u3 - adcs u6, u6, xzr - adc u7, u7, xzr - -// Now compute the mid-product as [m3,m2,m1,m0] - - mul m0, a0, b0 - umulh m1, a0, b0 - mul m2, a1, b1 - umulh m3, a1, b1 - - subs a1, a1, a0 - cneg a1, a1, cc - csetm u, cc - - adds m2, m2, m1 - adc m3, m3, xzr - - subs b1, b0, b1 - cneg b1, b1, cc - cinv u, u, cc - - mul b0, a1, b1 - umulh b1, a1, b1 - - adds m1, m0, m2 - adcs m2, m2, m3 - adc m3, m3, xzr - - adds xzr, u, #1 - eor b0, b0, u - adcs m1, b0, m1 - eor b1, b1, u - adcs m2, b1, m2 - adc m3, m3, u - -// Accumulate the positive mid-terms as [u7,u6,u5,u4,u3,u2] - - adds u2, u4, u0 - adcs u3, u5, u1 - adcs u4, u6, u4 - adcs u5, u7, u5 - adcs u6, u6, xzr - adc u7, u7, xzr - -// Add in the sign-adjusted complex term - - adds xzr, sgn, #1 - eor m0, m0, sgn - adcs u2, m0, u2 - eor m1, m1, sgn - adcs u3, m1, u3 - eor m2, m2, sgn - adcs u4, m2, u4 - eor m3, m3, sgn - adcs u5, m3, u5 - adcs u6, u6, sgn - adc u7, u7, sgn - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [u7,u6,u5,u4] and l = [u3,u2,u1,u0] -// and this is == 38 * h + l (mod p_25519). -// We do the 38 * h + l using 32-bit multiplies avoiding umulh, -// and pre-estimate and feed in the next-level quotient -// q = h + 1 where h = an early version of the high 255 bits. -// We add 2^255 * h - 19 * (h + 1), so end up offset by 2^255. - - mov c, #38 - - umull h, u4short, cshort - add h, h, u0short, uxtw - lsr u0, u0, #32 - lsr u4, u4, #32 - umaddl u4, u4short, cshort, u0 - mov u0, h - - umull h, u5short, cshort - add h, h, u1short, uxtw - lsr u1, u1, #32 - lsr u5, u5, #32 - umaddl u5, u5short, cshort, u1 - mov u1, h - - umull h, u6short, cshort - add h, h, u2short, uxtw - lsr u2, u2, #32 - lsr u6, u6, #32 - umaddl u6, u6short, cshort, u2 - mov u2, h - - umull h, u7short, cshort - add h, h, u3short, uxtw - lsr u3, u3, #32 - lsr u7, u7, #32 - umaddl u7, u7short, cshort, u3 - mov u3, h - - lsr q, u7, #31 - - mov l, #19 - umaddl l, lshort, qshort, l - add u0, u0, l - - adds u0, u0, u4, lsl #32 - extr c, u5, u4, #32 - adcs u1, u1, c - extr c, u6, u5, #32 - adcs u2, u2, c - extr c, u7, u6, #32 - lsl l, q, #63 - eor u3, u3, l - adc u3, u3, c - -// Now we correct by a final 2^255-19 if the top bit is clear -// meaning that the "real" pre-reduced result is negative. - - mov c, #19 - tst u3, #0x8000000000000000 - csel c, c, xzr, pl - subs u0, u0, c - sbcs u1, u1, xzr - sbcs u2, u2, xzr - sbc u3, u3, xzr - and u3, u3, #~0x8000000000000000 - -// Write back result - - stp u0, u1, [x0] - stp u2, u3, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mul_p25519_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mul_p25519_alt.S deleted file mode 100644 index 0a935328083..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_mul_p25519_alt.S +++ /dev/null @@ -1,209 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply modulo p_25519, z := (x * y) mod p_25519 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_mul_p25519_alt(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_p25519_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_p25519_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_p25519_alt) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define b0 x7 -#define b1 x8 -#define b2 x9 -#define b3 x10 - -#define l x11 - -#define u0 x12 -#define u1 x13 -#define u2 x14 -#define u3 x15 -#define u4 x16 - -// These alias to the input arguments when no longer needed - -#define u5 a0 -#define u6 a1 -#define u7 a2 - -#define c b0 -#define q b1 -#define h b2 - -S2N_BN_SYMBOL(bignum_mul_p25519_alt): - CFI_START - -// Load operands and set up row 0 = [u4;...;u0] = a0 * [b3;...;b0] - - ldp a0, a1, [x] - ldp b0, b1, [y] - - mul u0, a0, b0 - umulh u1, a0, b0 - mul l, a0, b1 - umulh u2, a0, b1 - adds u1, u1, l - - ldp b2, b3, [y, #16] - - mul l, a0, b2 - umulh u3, a0, b2 - adcs u2, u2, l - - mul l, a0, b3 - umulh u4, a0, b3 - adcs u3, u3, l - adc u4, u4, xzr - - ldp a2, a3, [x, #16] - -// Row 1 = [u5;...;u0] = [a1;a0] * [b3;...;b0] - - mul l, a1, b0 - adds u1, u1, l - mul l, a1, b1 - adcs u2, u2, l - mul l, a1, b2 - adcs u3, u3, l - mul l, a1, b3 - adcs u4, u4, l - umulh u5, a1, b3 - adc u5, u5, xzr - - umulh l, a1, b0 - adds u2, u2, l - umulh l, a1, b1 - adcs u3, u3, l - umulh l, a1, b2 - adcs u4, u4, l - adc u5, u5, xzr - -// Row 2 = [u6;...;u0] = [a2;a1;a0] * [b3;...;b0] - - mul l, a2, b0 - adds u2, u2, l - mul l, a2, b1 - adcs u3, u3, l - mul l, a2, b2 - adcs u4, u4, l - mul l, a2, b3 - adcs u5, u5, l - umulh u6, a2, b3 - adc u6, u6, xzr - - umulh l, a2, b0 - adds u3, u3, l - umulh l, a2, b1 - adcs u4, u4, l - umulh l, a2, b2 - adcs u5, u5, l - adc u6, u6, xzr - -// Row 3 = [u7;...;u0] = [a3;...a0] * [b3;...;b0] - - mul l, a3, b0 - adds u3, u3, l - mul l, a3, b1 - adcs u4, u4, l - mul l, a3, b2 - adcs u5, u5, l - mul l, a3, b3 - adcs u6, u6, l - umulh u7, a3, b3 - adc u7, u7, xzr - - umulh l, a3, b0 - adds u4, u4, l - umulh l, a3, b1 - adcs u5, u5, l - umulh l, a3, b2 - adcs u6, u6, l - adc u7, u7, xzr - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [u7,u6,u5,u4] and l = [u3,u2,u1,u0] -// and this is == 38 * h + l (mod p_25519) - - mov c, #38 - - mul l, c, u4 - umulh h, c, u4 - adds u0, u0, l - - mul l, c, u5 - umulh u5, c, u5 - adcs u1, u1, l - - mul l, c, u6 - umulh u6, c, u6 - adcs u2, u2, l - - mul l, c, u7 - umulh u7, c, u7 - adcs u3, u3, l - cset u4, cs - -// Compute the top part deferring the [u5,h] addition till the following -// carry chain. This is enough to get a good quotient estimate and saves -// a couple of instructions. - - adds u3, u3, u6 - adc u4, u4, u7 - -// Now we have reduced to 5 digits, 2^255 * H + L = [u4,u3,u2,u1,u0] -// Use q = H + 1 as the initial quotient estimate, either right or 1 too big. - - adds xzr, u3, u3 - orr u3, u3, #0x8000000000000000 - adc q, u4, u4 - mov c, #19 - madd l, c, q, c - adds u0, u0, l - adcs u1, u1, h - adcs u2, u2, u5 - adcs u3, u3, xzr - -// Now the effective answer is 2^256 * (CF - 1) + [u3,u2,u1,u0] -// So we correct if CF = 0 by subtracting 19, either way masking to -// 255 bits, i.e. by effectively adding p_25519 to the "full" answer - - csel c, c, xzr, cc - subs u0, u0, c - sbcs u1, u1, xzr - sbcs u2, u2, xzr - sbc u3, u3, xzr - bic u3, u3, #0x8000000000000000 - -// Write back and return - - stp u0, u1, [x0] - stp u2, u3, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_p25519_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_optneg_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_optneg_p25519.S deleted file mode 100644 index 3dc6a2f645f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_optneg_p25519.S +++ /dev/null @@ -1,80 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo p_25519, z := (-x) mod p_25519 (if p nonzero) or -// z := x (if p zero), assuming x reduced -// Inputs p, x[4]; output z[4] -// -// extern void bignum_optneg_p25519(uint64_t z[static 4], uint64_t p, -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = p, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg_p25519) - .text - .balign 4 - -#define z x0 -#define p x1 -#define x x2 - -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 -#define n0 x7 -#define n1 x8 -#define n2 x9 -#define n3 x10 - -#define c x11 - -S2N_BN_SYMBOL(bignum_optneg_p25519): - CFI_START - -// Load the digits of x as [d3;d2;d1;d0] and compute c = the OR of those digits -// as well as its proto-negation [n3;n2;n1;n0] = (2^255 - 19) - x - - ldp d0, d1, [x] - mov n0, #-19 - orr c, d0, d1 - subs n0, n0, d0 - mov n2, #-1 - sbcs n1, n2, d1 - ldp d2, d3, [x, #16] - orr c, c, d2 - sbcs n2, n2, d2 - mov n3, #0x7FFFFFFFFFFFFFFF - orr c, c, d3 - sbc n3, n3, d3 - -// Now we return just x if p = 0 or if x = 0 (to avoid giving -0 = p, which -// is not strictly reduced even though it's correct modulo p). The conditional -// comparison uses immediate 4 which means ZF. - - cmp p, xzr - ccmp c, xzr, #4, ne - - csel d0, n0, d0, ne - csel d1, n1, d1, ne - csel d2, n2, d2, ne - csel d3, n3, d3, ne - -// Write back result and return - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqr_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqr_p25519.S deleted file mode 100644 index aaf5ca7219d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqr_p25519.S +++ /dev/null @@ -1,234 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square modulo p_25519, z := (x^2) mod p_25519 -// Input x[4]; output z[4] -// -// extern void bignum_sqr_p25519(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_p25519) - .text - .balign 4 - -#define z x0 -#define x x1 - -// Variables - -#define u0 x2 -#define u1 x3 -#define u2 x4 -#define u3 x5 -#define u4 x6 -#define u5 x7 -#define u6 x8 -#define u7 x9 - -#define u0short w2 -#define u1short w3 -#define u2short w4 -#define u3short w5 -#define u4short w6 -#define u5short w7 -#define u6short w8 -#define u7short w9 - -#define c x10 -#define cshort w10 -#define l x11 -#define lshort w11 -#define h x12 -#define hshort w12 -#define q x13 -#define qshort w13 - -#define t1 x14 -#define t1short w14 -#define t2 x15 -#define t2short w15 -#define t3 x16 -#define t3short w16 - -S2N_BN_SYMBOL(bignum_sqr_p25519): - CFI_START - -// First just a near-clone of bignum_sqr_4_8 to get the square, using -// different registers to collect full product without writeback. - - ldp c, l, [x] - ldp h, q, [x, #16] - umull u0, cshort, cshort - lsr t1, c, #32 - umull u1, t1short, t1short - umull t1, cshort, t1short - adds u0, u0, t1, lsl #33 - lsr t1, t1, #31 - adc u1, u1, t1 - umull u2, lshort, lshort - lsr t1, l, #32 - umull u3, t1short, t1short - umull t1, lshort, t1short - mul t2, c, l - umulh t3, c, l - adds u2, u2, t1, lsl #33 - lsr t1, t1, #31 - adc u3, u3, t1 - adds t2, t2, t2 - adcs t3, t3, t3 - adc u3, u3, xzr - adds u1, u1, t2 - adcs u2, u2, t3 - adc u3, u3, xzr - umull u4, hshort, hshort - lsr t1, h, #32 - umull u5, t1short, t1short - umull t1, hshort, t1short - adds u4, u4, t1, lsl #33 - lsr t1, t1, #31 - adc u5, u5, t1 - umull u6, qshort, qshort - lsr t1, q, #32 - umull u7, t1short, t1short - umull t1, qshort, t1short - mul t2, h, q - umulh t3, h, q - adds u6, u6, t1, lsl #33 - lsr t1, t1, #31 - adc u7, u7, t1 - adds t2, t2, t2 - adcs t3, t3, t3 - adc u7, u7, xzr - adds u5, u5, t2 - adcs u6, u6, t3 - adc u7, u7, xzr - subs c, c, h - sbcs l, l, q - csetm t3, cc - eor c, c, t3 - subs c, c, t3 - eor l, l, t3 - sbc l, l, t3 - adds u4, u4, u2 - adcs u5, u5, u3 - adcs u6, u6, xzr - adc u7, u7, xzr - umull h, cshort, cshort - lsr u3, c, #32 - umull q, u3short, u3short - umull u3, cshort, u3short - adds h, h, u3, lsl #33 - lsr u3, u3, #31 - adc q, q, u3 - umull t2, lshort, lshort - lsr u3, l, #32 - umull t1, u3short, u3short - umull u3, lshort, u3short - mul u2, c, l - umulh t3, c, l - adds t2, t2, u3, lsl #33 - lsr u3, u3, #31 - adc t1, t1, u3 - adds u2, u2, u2 - adcs t3, t3, t3 - adc t1, t1, xzr - adds q, q, u2 - adcs t2, t2, t3 - adc t1, t1, xzr - adds u2, u0, u4 - adcs u3, u1, u5 - adcs u4, u4, u6 - adcs u5, u5, u7 - csetm t3, cc - subs u2, u2, h - sbcs u3, u3, q - sbcs u4, u4, t2 - sbcs u5, u5, t1 - adcs u6, u6, t3 - adc u7, u7, t3 - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [u7,u6,u5,u4] and l = [u3,u2,u1,u0] -// and this is == 38 * h + l (mod p_25519). -// We do the 38 * h + l using 32-bit multiplies avoiding umulh, -// and pre-estimate and feed in the next-level quotient -// q = h + 1 where h = an early version of the high 255 bits. -// We add 2^255 * h - 19 * (h + 1), so end up offset by 2^255. - - mov c, #38 - - umull h, u4short, cshort - add h, h, u0short, uxtw - lsr u0, u0, #32 - lsr u4, u4, #32 - umaddl u4, u4short, cshort, u0 - mov u0, h - - umull h, u5short, cshort - add h, h, u1short, uxtw - lsr u1, u1, #32 - lsr u5, u5, #32 - umaddl u5, u5short, cshort, u1 - mov u1, h - - umull h, u6short, cshort - add h, h, u2short, uxtw - lsr u2, u2, #32 - lsr u6, u6, #32 - umaddl u6, u6short, cshort, u2 - mov u2, h - - umull h, u7short, cshort - add h, h, u3short, uxtw - lsr u3, u3, #32 - lsr u7, u7, #32 - umaddl u7, u7short, cshort, u3 - mov u3, h - - lsr q, u7, #31 - - mov l, #19 - umaddl l, lshort, qshort, l - add u0, u0, l - - adds u0, u0, u4, lsl #32 - extr c, u5, u4, #32 - adcs u1, u1, c - extr c, u6, u5, #32 - adcs u2, u2, c - extr c, u7, u6, #32 - lsl l, q, #63 - eor u3, u3, l - adc u3, u3, c - -// Now we correct by a final 2^255-19 if the top bit is clear -// meaning that the "real" pre-reduced result is negative. - - mov c, #19 - tst u3, #0x8000000000000000 - csel c, c, xzr, pl - subs u0, u0, c - sbcs u1, u1, xzr - sbcs u2, u2, xzr - sbc u3, u3, xzr - and u3, u3, #~0x8000000000000000 - -// Write back result - - stp u0, u1, [x0] - stp u2, u3, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqr_p25519_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqr_p25519_alt.S deleted file mode 100644 index b770bf82a0e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqr_p25519_alt.S +++ /dev/null @@ -1,183 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square modulo p_25519, z := (x^2) mod p_25519 -// Input x[4]; output z[4] -// -// extern void bignum_sqr_p25519_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_p25519_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_p25519_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_p25519_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 - -#define h x6 -#define l x7 - -#define u0 x8 -#define u1 x9 -#define u2 x10 -#define u3 x11 -#define u4 x12 -#define u5 x13 -#define u6 x14 - -// Just aliases - -#define q a0 -#define c a1 -#define t a2 -#define u7 h - -S2N_BN_SYMBOL(bignum_sqr_p25519_alt): - CFI_START - -// Load all the elements, set up an initial window [u6;...u1] = [23;03;01] -// and chain in the addition of 02 + 12 + 13 (no carry-out is possible). -// This gives all the "heterogeneous" terms of the squaring ready to double - - ldp a0, a1, [x] - - mul u1, a0, a1 - umulh u2, a0, a1 - - ldp a2, a3, [x, #16] - - mul u3, a0, a3 - umulh u4, a0, a3 - - mul l, a0, a2 - umulh h, a0, a2 - adds u2, u2, l - - adcs u3, u3, h - mul l, a1, a2 - umulh h, a1, a2 - adc h, h, xzr - adds u3, u3, l - - mul u5, a2, a3 - umulh u6, a2, a3 - - adcs u4, u4, h - mul l, a1, a3 - umulh h, a1, a3 - adc h, h, xzr - adds u4, u4, l - - adcs u5, u5, h - adc u6, u6, xzr - -// Now just double it; this simple approach seems to work better than extr - - adds u1, u1, u1 - adcs u2, u2, u2 - adcs u3, u3, u3 - adcs u4, u4, u4 - adcs u5, u5, u5 - adcs u6, u6, u6 - cset u7, cs - -// Add the homogeneous terms 00 + 11 + 22 + 33 - - umulh l, a0, a0 - mul u0, a0, a0 - adds u1, u1, l - - mul l, a1, a1 - adcs u2, u2, l - umulh l, a1, a1 - adcs u3, u3, l - - mul l, a2, a2 - adcs u4, u4, l - umulh l, a2, a2 - adcs u5, u5, l - - mul l, a3, a3 - adcs u6, u6, l - umulh l, a3, a3 - adc u7, u7, l - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [u7,u6,u5,u4] and l = [u3,u2,u1,u0] -// and this is == 38 * h + l (mod p_25519) - - mov c, #38 - - mul l, c, u4 - umulh t, c, u4 - adds u0, u0, l - - mul l, c, u5 - umulh u5, c, u5 - adcs u1, u1, l - - mul l, c, u6 - umulh u6, c, u6 - adcs u2, u2, l - - mul l, c, u7 - umulh u7, c, u7 - adcs u3, u3, l - cset u4, cs - -// Compute the top part deferring the [u5,t] addition till the following -// carry chain. This is enough to get a good quotient estimate and saves -// a couple of instructions. - - adds u3, u3, u6 - adc u4, u4, u7 - -// Now we have reduced to 5 digits, 2^255 * H + L = [u4,u3,u2,u1,u0] -// Use q = H + 1 as the initial quotient estimate, either right or 1 too big. - - adds xzr, u3, u3 - orr u3, u3, #0x8000000000000000 - adc q, u4, u4 - mov c, #19 - madd l, c, q, c - adds u0, u0, l - adcs u1, u1, t - adcs u2, u2, u5 - adcs u3, u3, xzr - -// Now the effective answer is 2^256 * (CF - 1) + [u3,u2,u1,u0] -// So we correct if CF = 0 by subtracting 19, either way masking to -// 255 bits, i.e. by effectively adding p_25519 to the "full" answer - - csel c, c, xzr, cc - subs u0, u0, c - sbcs u1, u1, xzr - sbcs u2, u2, xzr - sbc u3, u3, xzr - bic u3, u3, #0x8000000000000000 - -// Write back and return - - stp u0, u1, [x0] - stp u2, u3, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_p25519_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqrt_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqrt_p25519.S deleted file mode 100644 index 6672db5ada9..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqrt_p25519.S +++ /dev/null @@ -1,627 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square root modulo p_25519 = 2^255 - 19 -// Input x[4]; output function return (Legendre symbol) and z[4] -// -// extern int64_t bignum_sqrt_p25519(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Given a 4-digit input x, returns a modular square root mod p_25519, i.e. -// a z such that z^2 == x (mod p_25519), whenever one exists. The square -// root z is chosen so that its LSB is even (note that p_25519 - z is -// another square root). The function return is the Legendre/Jacobi symbol -// (x//p_25519), which indicates whether indeed x has a modular square root -// and hence whether the result is meaningful: -// -// 0: x is divisible by p_25519 and z is the square root 0 -// +1: x is coprime to p_25519 and z is a square root -// -1: x is coprime to p_25519 but not a quadratic residue -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqrt_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqrt_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqrt_p25519) - - - .text - .balign 4 - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack - -#define a sp, #0 -#define b sp, #(4*N) -#define s sp, #(8*N) -#define t sp, #(12*N) - -// Other temporary variables in register - -#define res x19 - -// Total size to reserve on the stack - -#define NSPACE 16*N - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -// Macros wrapping up calls to the local subroutines - -#define mulp(dest,src1,src2) \ - add x0, dest __LF \ - add x1, src1 __LF \ - add x2, src2 __LF \ - CFI_BL(Lbignum_sqrt_p25519_mul_p25519) - -#define nsqr(dest,n,src) \ - add x0, dest __LF \ - mov x1, n __LF \ - add x2, src __LF \ - CFI_BL(Lbignum_sqrt_p25519_nsqr_p25519) - -S2N_BN_SYMBOL(bignum_sqrt_p25519): - CFI_START - -// Save registers and make room for temporaries - - CFI_PUSH2(x19,x30) - CFI_DEC_SP(NSPACE) - -// Save the return pointer for the end so we can overwrite x0 later - - mov res, x0 - -// Set up reduced version of the input argument a = x mod p_25519. Then -// get the candidate square root s = a^{252-2} - - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - mov x7, #19 - lsr x6, x5, #63 - madd x6, x7, x6, x7 - adds x2, x2, x6 - adcs x3, x3, xzr - adcs x4, x4, xzr - orr x5, x5, #0x8000000000000000 - adcs x5, x5, xzr - csel x6, x7, xzr, lo - subs x2, x2, x6 - sbcs x3, x3, xzr - sbcs x4, x4, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - stp x2, x3, [a] - stp x4, x5, [a+16] - - // Power 2^2 - 1 = 3 - - nsqr(t,1,a) - mulp(t,t,a) - - // Power 2^4 - 1 = 15 - - nsqr(s,2,t) - mulp(t,s,t) - - // Power 2^5 - 1 = 31 - - nsqr(s,1,t) - mulp(b,s,a) - - // Power 2^10 - 1 - - nsqr(s,5,b) - mulp(t,s,b) - - // Power 2^20 - 1 - - nsqr(s,10,t) - mulp(t,s,t) - - // Power 2^25 - 1 - - nsqr(s,5,t) - mulp(b,s,b) - - // Power 2^50 - 1 - - nsqr(s,25,b) - mulp(t,s,b) - - // Power 2^100 - 1 - nsqr(s,50,t) - mulp(t,s,t) - - // Power 2^125 - 1 - - nsqr(s,25,t) - mulp(b,s,b) - - // Power 2^250 - 1 - - nsqr(s,125,b) - mulp(b,s,b) - - // Power 2^251 - 1 - - nsqr(s,1,b) - mulp(t,s,a) - - // Power 2^252 - 2 - - nsqr(s,1,t) - -// s is now one candidate square root. Generate the other one t = s * j_25519 - - movbig(x0, #0xc4ee, #0x1b27, #0x4a0e, #0xa0b0) - movbig(x1, #0x2f43, #0x1806, #0xad2f, #0xe478) - movbig(x2, #0x2b4d, #0x0099, #0x3dfb, #0xd7a7) - movbig(x3, #0x2b83, #0x2480, #0x4fc1, #0xdf0b) - stp x0, x1, [t] - stp x2, x3, [t+16] - mulp(t,s,t) - -// Now multiplex between them according to whether s^2 = a - - nsqr(b,1,s) - - ldp x10, x11, [a] - ldp x14, x15, [b] - eor x10, x10, x14 - eor x11, x11, x15 - orr x10, x10, x11 - ldp x12, x13, [a+16] - ldp x16, x17, [b+16] - eor x12, x12, x16 - eor x13, x13, x17 - orr x12, x12, x13 - orr x10, x10, x12 - cmp x10, xzr - - ldp x10, x11, [s] - ldp x14, x15, [t] - csel x10, x10, x14, eq - csel x11, x11, x15, eq - ldp x12, x13, [s+16] - ldp x16, x17, [t+16] - csel x12, x12, x16, eq - csel x13, x13, x17, eq - -// For definiteness, choose "positive" (LSB=0) square root - - mov x14, #-19 - subs x14, x14, x10 - mov x16, #-1 - sbcs x15, x16, x11 - mov x17, #0x7FFFFFFFFFFFFFFF - sbcs x16, x16, x12 - sbc x17, x17, x13 - - tst x10, #1 - csel x10, x10, x14, eq - csel x11, x11, x15, eq - csel x12, x12, x16, eq - csel x13, x13, x17, eq - - mov x2, res - stp x10, x11, [x2] - stp x12, x13, [x2, #16] - -// Determine if it is is indeed a square root and also if a = 0 -// Hence return the Legendre-Jacobi symbol as required. - - add x0, b - mov x1, #1 - CFI_BL(Lbignum_sqrt_p25519_nsqr_p25519) - - ldp x10, x11, [a] - ldp x14, x15, [b] - eor x14, x10, x14 - eor x15, x11, x15 - orr x14, x14, x15 - ldp x12, x13, [a+16] - ldp x16, x17, [b+16] - eor x16, x12, x16 - eor x17, x13, x17 - orr x16, x16, x17 - orr x14, x14, x16 - cmp x14, xzr - mov x0, #1 - cneg x0, x0, ne - - orr x10, x10, x11 - orr x12, x12, x13 - orr x10, x10, x12 - cmp x10, xzr - csel x0, x0, xzr, ne - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x30) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqrt_p25519) - -// ************************************************************* -// Local z = x * y -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_sqrt_p25519_mul_p25519) - -Lbignum_sqrt_p25519_mul_p25519: - CFI_START - ldp x3, x4, [x1] - ldp x5, x6, [x2] - umull x7, w3, w5 - lsr x17, x3, #32 - umull x15, w17, w5 - lsr x16, x5, #32 - umull x8, w16, w17 - umull x16, w3, w16 - adds x7, x7, x15, lsl #32 - lsr x15, x15, #32 - adc x8, x8, x15 - adds x7, x7, x16, lsl #32 - lsr x16, x16, #32 - adc x8, x8, x16 - mul x9, x4, x6 - umulh x10, x4, x6 - subs x4, x4, x3 - cneg x4, x4, lo - csetm x16, lo - adds x9, x9, x8 - adc x10, x10, xzr - subs x3, x5, x6 - cneg x3, x3, lo - cinv x16, x16, lo - mul x15, x4, x3 - umulh x3, x4, x3 - adds x8, x7, x9 - adcs x9, x9, x10 - adc x10, x10, xzr - cmn x16, #1 - eor x15, x15, x16 - adcs x8, x15, x8 - eor x3, x3, x16 - adcs x9, x3, x9 - adc x10, x10, x16 - ldp x3, x4, [x1, #16] - ldp x5, x6, [x2, #16] - umull x11, w3, w5 - lsr x17, x3, #32 - umull x15, w17, w5 - lsr x16, x5, #32 - umull x12, w16, w17 - umull x16, w3, w16 - adds x11, x11, x15, lsl #32 - lsr x15, x15, #32 - adc x12, x12, x15 - adds x11, x11, x16, lsl #32 - lsr x16, x16, #32 - adc x12, x12, x16 - mul x13, x4, x6 - umulh x14, x4, x6 - subs x4, x4, x3 - cneg x4, x4, lo - csetm x16, lo - adds x13, x13, x12 - adc x14, x14, xzr - subs x3, x5, x6 - cneg x3, x3, lo - cinv x16, x16, lo - mul x15, x4, x3 - umulh x3, x4, x3 - adds x12, x11, x13 - adcs x13, x13, x14 - adc x14, x14, xzr - cmn x16, #1 - eor x15, x15, x16 - adcs x12, x15, x12 - eor x3, x3, x16 - adcs x13, x3, x13 - adc x14, x14, x16 - ldp x3, x4, [x1, #16] - ldp x15, x16, [x1] - subs x3, x3, x15 - sbcs x4, x4, x16 - csetm x16, lo - ldp x15, x17, [x2] - subs x5, x15, x5 - sbcs x6, x17, x6 - csetm x17, lo - eor x3, x3, x16 - subs x3, x3, x16 - eor x4, x4, x16 - sbc x4, x4, x16 - eor x5, x5, x17 - subs x5, x5, x17 - eor x6, x6, x17 - sbc x6, x6, x17 - eor x16, x17, x16 - adds x11, x11, x9 - adcs x12, x12, x10 - adcs x13, x13, xzr - adc x14, x14, xzr - mul x2, x3, x5 - umulh x17, x3, x5 - mul x15, x4, x6 - umulh x1, x4, x6 - subs x4, x4, x3 - cneg x4, x4, lo - csetm x9, lo - adds x15, x15, x17 - adc x1, x1, xzr - subs x6, x5, x6 - cneg x6, x6, lo - cinv x9, x9, lo - mul x5, x4, x6 - umulh x6, x4, x6 - adds x17, x2, x15 - adcs x15, x15, x1 - adc x1, x1, xzr - cmn x9, #1 - eor x5, x5, x9 - adcs x17, x5, x17 - eor x6, x6, x9 - adcs x15, x6, x15 - adc x1, x1, x9 - adds x9, x11, x7 - adcs x10, x12, x8 - adcs x11, x13, x11 - adcs x12, x14, x12 - adcs x13, x13, xzr - adc x14, x14, xzr - cmn x16, #1 - eor x2, x2, x16 - adcs x9, x2, x9 - eor x17, x17, x16 - adcs x10, x17, x10 - eor x15, x15, x16 - adcs x11, x15, x11 - eor x1, x1, x16 - adcs x12, x1, x12 - adcs x13, x13, x16 - adc x14, x14, x16 - mov x3, #38 - umull x4, w11, w3 - add x4, x4, w7, uxtw - lsr x7, x7, #32 - lsr x11, x11, #32 - umaddl x11, w11, w3, x7 - mov x7, x4 - umull x4, w12, w3 - add x4, x4, w8, uxtw - lsr x8, x8, #32 - lsr x12, x12, #32 - umaddl x12, w12, w3, x8 - mov x8, x4 - umull x4, w13, w3 - add x4, x4, w9, uxtw - lsr x9, x9, #32 - lsr x13, x13, #32 - umaddl x13, w13, w3, x9 - mov x9, x4 - umull x4, w14, w3 - add x4, x4, w10, uxtw - lsr x10, x10, #32 - lsr x14, x14, #32 - umaddl x14, w14, w3, x10 - mov x10, x4 - lsr x17, x14, #31 - mov x5, #19 - umaddl x5, w5, w17, x5 - add x7, x7, x5 - adds x7, x7, x11, lsl #32 - extr x3, x12, x11, #32 - adcs x8, x8, x3 - extr x3, x13, x12, #32 - adcs x9, x9, x3 - extr x3, x14, x13, #32 - lsl x5, x17, #63 - eor x10, x10, x5 - adc x10, x10, x3 - mov x3, #19 - tst x10, #0x8000000000000000 - csel x3, x3, xzr, pl - subs x7, x7, x3 - sbcs x8, x8, xzr - sbcs x9, x9, xzr - sbc x10, x10, xzr - and x10, x10, #0x7fffffffffffffff - stp x7, x8, [x0] - stp x9, x10, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_sqrt_p25519_mul_p25519) - -// ************************************************************* -// Local z = 2^n * x -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_sqrt_p25519_nsqr_p25519) - -Lbignum_sqrt_p25519_nsqr_p25519: - CFI_START - -// Copy input argument into [x13;x12;x11;x10] - - ldp x10, x11, [x2] - ldp x12, x13, [x2, #16] - -// Main squaring loop, accumulating in [x13;x12;x11;x10] consistently and -// only ensuring the intermediates are < 2 * p_25519 = 2^256 - 38 - -Lbignum_sqrt_p25519_loop: - umull x2, w10, w10 - lsr x14, x10, #32 - umull x3, w14, w14 - umull x14, w10, w14 - adds x2, x2, x14, lsl #33 - lsr x14, x14, #31 - adc x3, x3, x14 - umull x4, w11, w11 - lsr x14, x11, #32 - umull x5, w14, w14 - umull x14, w11, w14 - mul x15, x10, x11 - umulh x16, x10, x11 - adds x4, x4, x14, lsl #33 - lsr x14, x14, #31 - adc x5, x5, x14 - adds x15, x15, x15 - adcs x16, x16, x16 - adc x5, x5, xzr - adds x3, x3, x15 - adcs x4, x4, x16 - adc x5, x5, xzr - umull x6, w12, w12 - lsr x14, x12, #32 - umull x7, w14, w14 - umull x14, w12, w14 - adds x6, x6, x14, lsl #33 - lsr x14, x14, #31 - adc x7, x7, x14 - umull x8, w13, w13 - lsr x14, x13, #32 - umull x9, w14, w14 - umull x14, w13, w14 - mul x15, x12, x13 - umulh x16, x12, x13 - adds x8, x8, x14, lsl #33 - lsr x14, x14, #31 - adc x9, x9, x14 - adds x15, x15, x15 - adcs x16, x16, x16 - adc x9, x9, xzr - adds x7, x7, x15 - adcs x8, x8, x16 - adc x9, x9, xzr - subs x10, x10, x12 - sbcs x11, x11, x13 - csetm x16, lo - eor x10, x10, x16 - subs x10, x10, x16 - eor x11, x11, x16 - sbc x11, x11, x16 - adds x6, x6, x4 - adcs x7, x7, x5 - adcs x8, x8, xzr - adc x9, x9, xzr - umull x12, w10, w10 - lsr x5, x10, #32 - umull x13, w5, w5 - umull x5, w10, w5 - adds x12, x12, x5, lsl #33 - lsr x5, x5, #31 - adc x13, x13, x5 - umull x15, w11, w11 - lsr x5, x11, #32 - umull x14, w5, w5 - umull x5, w11, w5 - mul x4, x10, x11 - umulh x16, x10, x11 - adds x15, x15, x5, lsl #33 - lsr x5, x5, #31 - adc x14, x14, x5 - adds x4, x4, x4 - adcs x16, x16, x16 - adc x14, x14, xzr - adds x13, x13, x4 - adcs x15, x15, x16 - adc x14, x14, xzr - adds x4, x2, x6 - adcs x5, x3, x7 - adcs x6, x6, x8 - adcs x7, x7, x9 - csetm x16, lo - subs x4, x4, x12 - sbcs x5, x5, x13 - sbcs x6, x6, x15 - sbcs x7, x7, x14 - adcs x8, x8, x16 - adc x9, x9, x16 - mov x10, #38 - umull x12, w6, w10 - add x12, x12, w2, uxtw - lsr x2, x2, #32 - lsr x6, x6, #32 - umaddl x6, w6, w10, x2 - mov x2, x12 - umull x12, w7, w10 - add x12, x12, w3, uxtw - lsr x3, x3, #32 - lsr x7, x7, #32 - umaddl x7, w7, w10, x3 - mov x3, x12 - umull x12, w8, w10 - add x12, x12, w4, uxtw - lsr x4, x4, #32 - lsr x8, x8, #32 - umaddl x8, w8, w10, x4 - mov x4, x12 - umull x12, w9, w10 - add x12, x12, w5, uxtw - lsr x5, x5, #32 - lsr x9, x9, #32 - umaddl x9, w9, w10, x5 - mov x5, x12 - lsr x13, x9, #31 - mov x11, #19 - umull x11, w11, w13 - add x2, x2, x11 - adds x10, x2, x6, lsl #32 - extr x12, x7, x6, #32 - adcs x11, x3, x12 - extr x12, x8, x7, #32 - adcs x12, x4, x12 - extr x14, x9, x8, #32 - lsl x15, x13, #63 - eor x5, x5, x15 - adc x13, x5, x14 - -// Loop as applicable - - subs x1, x1, #1 - bne Lbignum_sqrt_p25519_loop - -// We know the intermediate result x < 2^256 - 38, and now we do strict -// modular reduction mod 2^255 - 19. Note x < 2^255 - 19 <=> x + 19 < 2^255 -// which is equivalent to a "pl" condition. - - adds x6, x10, #19 - adcs x7, x11, xzr - adcs x8, x12, xzr - adcs x9, x13, xzr - - csel x10, x10, x6, pl - csel x11, x11, x7, pl - csel x12, x12, x8, pl - csel x13, x13, x9, pl - bic x13, x13, #0x8000000000000000 - -// Copy result back into destination and return - - stp x10, x11, [x0] - stp x12, x13, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_sqrt_p25519_nsqr_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqrt_p25519_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqrt_p25519_alt.S deleted file mode 100644 index 4de28e03271..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sqrt_p25519_alt.S +++ /dev/null @@ -1,490 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square root modulo p_25519 = 2^255 - 19 -// Input x[4]; output function return (Legendre symbol) and z[4] -// -// extern int64_t bignum_sqrt_p25519_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Given a 4-digit input x, returns a modular square root mod p_25519, i.e. -// a z such that z^2 == x (mod p_25519), whenever one exists. The square -// root z is chosen so that its LSB is even (note that p_25519 - z is -// another square root). The function return is the Legendre/Jacobi symbol -// (x//p_25519), which indicates whether indeed x has a modular square root -// and hence whether the result is meaningful: -// -// 0: x is divisible by p_25519 and z is the square root 0 -// +1: x is coprime to p_25519 and z is a square root -// -1: x is coprime to p_25519 but not a quadratic residue -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqrt_p25519_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqrt_p25519_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqrt_p25519_alt) - - - .text - .balign 4 - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack - -#define a sp, #0 -#define b sp, #(4*N) -#define s sp, #(8*N) -#define t sp, #(12*N) - -// Other temporary variables in register - -#define res x19 - -// Total size to reserve on the stack - -#define NSPACE 16*N - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -// Macros wrapping up calls to the local subroutines - -#define mulp(dest,src1,src2) \ - add x0, dest __LF \ - add x1, src1 __LF \ - add x2, src2 __LF \ - CFI_BL(Lbignum_sqrt_p25519_alt_mul_p25519) - -#define nsqr(dest,n,src) \ - add x0, dest __LF \ - mov x1, n __LF \ - add x2, src __LF \ - CFI_BL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - -S2N_BN_SYMBOL(bignum_sqrt_p25519_alt): - CFI_START - -// Save registers and make room for temporaries - - CFI_PUSH2(x19,x30) - CFI_DEC_SP(NSPACE) - -// Save the return pointer for the end so we can overwrite x0 later - - mov res, x0 - -// Set up reduced version of the input argument a = x mod p_25519. Then -// get the candidate square root s = a^{252-2} - - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - mov x7, #19 - lsr x6, x5, #63 - madd x6, x7, x6, x7 - adds x2, x2, x6 - adcs x3, x3, xzr - adcs x4, x4, xzr - orr x5, x5, #0x8000000000000000 - adcs x5, x5, xzr - csel x6, x7, xzr, lo - subs x2, x2, x6 - sbcs x3, x3, xzr - sbcs x4, x4, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - stp x2, x3, [a] - stp x4, x5, [a+16] - - // Power 2^2 - 1 = 3 - - nsqr(t,1,a) - mulp(t,t,a) - - // Power 2^4 - 1 = 15 - - nsqr(s,2,t) - mulp(t,s,t) - - // Power 2^5 - 1 = 31 - - nsqr(s,1,t) - mulp(b,s,a) - - // Power 2^10 - 1 - - nsqr(s,5,b) - mulp(t,s,b) - - // Power 2^20 - 1 - - nsqr(s,10,t) - mulp(t,s,t) - - // Power 2^25 - 1 - - nsqr(s,5,t) - mulp(b,s,b) - - // Power 2^50 - 1 - - nsqr(s,25,b) - mulp(t,s,b) - - // Power 2^100 - 1 - nsqr(s,50,t) - mulp(t,s,t) - - // Power 2^125 - 1 - - nsqr(s,25,t) - mulp(b,s,b) - - // Power 2^250 - 1 - - nsqr(s,125,b) - mulp(b,s,b) - - // Power 2^251 - 1 - - nsqr(s,1,b) - mulp(t,s,a) - - // Power 2^252 - 2 - - nsqr(s,1,t) - -// s is now one candidate square root. Generate the other one t = s * j_25519 - - movbig(x0, #0xc4ee, #0x1b27, #0x4a0e, #0xa0b0) - movbig(x1, #0x2f43, #0x1806, #0xad2f, #0xe478) - movbig(x2, #0x2b4d, #0x0099, #0x3dfb, #0xd7a7) - movbig(x3, #0x2b83, #0x2480, #0x4fc1, #0xdf0b) - stp x0, x1, [t] - stp x2, x3, [t+16] - mulp(t,s,t) - -// Now multiplex between them according to whether s^2 = a - - nsqr(b,1,s) - - ldp x10, x11, [a] - ldp x14, x15, [b] - eor x10, x10, x14 - eor x11, x11, x15 - orr x10, x10, x11 - ldp x12, x13, [a+16] - ldp x16, x17, [b+16] - eor x12, x12, x16 - eor x13, x13, x17 - orr x12, x12, x13 - orr x10, x10, x12 - cmp x10, xzr - - ldp x10, x11, [s] - ldp x14, x15, [t] - csel x10, x10, x14, eq - csel x11, x11, x15, eq - ldp x12, x13, [s+16] - ldp x16, x17, [t+16] - csel x12, x12, x16, eq - csel x13, x13, x17, eq - -// For definiteness, choose "positive" (LSB=0) square root - - mov x14, #-19 - subs x14, x14, x10 - mov x16, #-1 - sbcs x15, x16, x11 - mov x17, #0x7FFFFFFFFFFFFFFF - sbcs x16, x16, x12 - sbc x17, x17, x13 - - tst x10, #1 - csel x10, x10, x14, eq - csel x11, x11, x15, eq - csel x12, x12, x16, eq - csel x13, x13, x17, eq - - mov x2, res - stp x10, x11, [x2] - stp x12, x13, [x2, #16] - -// Determine if it is is indeed a square root and also if a = 0 -// Hence return the Legendre-Jacobi symbol as required. - - add x0, b - mov x1, #1 - CFI_BL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - ldp x10, x11, [a] - ldp x14, x15, [b] - eor x14, x10, x14 - eor x15, x11, x15 - orr x14, x14, x15 - ldp x12, x13, [a+16] - ldp x16, x17, [b+16] - eor x16, x12, x16 - eor x17, x13, x17 - orr x16, x16, x17 - orr x14, x14, x16 - cmp x14, xzr - mov x0, #1 - cneg x0, x0, ne - - orr x10, x10, x11 - orr x12, x12, x13 - orr x10, x10, x12 - cmp x10, xzr - csel x0, x0, xzr, ne - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x30) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqrt_p25519_alt) - -// ************************************************************* -// Local z = x * y -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_sqrt_p25519_alt_mul_p25519) - -Lbignum_sqrt_p25519_alt_mul_p25519: - CFI_START - ldp x3, x4, [x1] - ldp x7, x8, [x2] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x2, #16] - mul x11, x3, x9 - umulh x15, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x16, x3, x10 - adcs x15, x15, x11 - adc x16, x16, xzr - ldp x5, x6, [x1, #16] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x15, x15, x11 - mul x11, x4, x10 - adcs x16, x16, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x15, x15, x11 - umulh x11, x4, x9 - adcs x16, x16, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x15, x15, x11 - mul x11, x5, x9 - adcs x16, x16, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x15, x15, x11 - umulh x11, x5, x8 - adcs x16, x16, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x15, x15, x11 - mul x11, x6, x8 - adcs x16, x16, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x16, x16, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - mov x7, #38 - mul x11, x7, x16 - umulh x9, x7, x16 - adds x12, x12, x11 - mul x11, x7, x3 - umulh x3, x7, x3 - adcs x13, x13, x11 - mul x11, x7, x4 - umulh x4, x7, x4 - adcs x14, x14, x11 - mul x11, x7, x5 - umulh x5, x7, x5 - adcs x15, x15, x11 - cset x16, hs - adds x15, x15, x4 - adc x16, x16, x5 - cmn x15, x15 - orr x15, x15, #0x8000000000000000 - adc x8, x16, x16 - mov x7, #19 - madd x11, x7, x8, x7 - adds x12, x12, x11 - adcs x13, x13, x9 - adcs x14, x14, x3 - adcs x15, x15, xzr - csel x7, x7, xzr, lo - subs x12, x12, x7 - sbcs x13, x13, xzr - sbcs x14, x14, xzr - sbc x15, x15, xzr - and x15, x15, #0x7fffffffffffffff - stp x12, x13, [x0] - stp x14, x15, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_sqrt_p25519_alt_mul_p25519) - -// ************************************************************* -// Local z = 2^n * x -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_sqrt_p25519_alt_nsqr_p25519) - -Lbignum_sqrt_p25519_alt_nsqr_p25519: - CFI_START - -// Copy input argument into [x5;x4;x3;x2] (overwriting input pointer x20 - - ldp x6, x3, [x2] - ldp x4, x5, [x2, #16] - mov x2, x6 - -// Main squaring loop, accumulating in [x5;x4;x3;x2] consistently and -// only ensuring the intermediates are < 2 * p_25519 = 2^256 - 38 - -Lbignum_sqrt_p25519_alt_loop: - mul x9, x2, x3 - umulh x10, x2, x3 - mul x11, x2, x5 - umulh x12, x2, x5 - mul x7, x2, x4 - umulh x6, x2, x4 - adds x10, x10, x7 - adcs x11, x11, x6 - mul x7, x3, x4 - umulh x6, x3, x4 - adc x6, x6, xzr - adds x11, x11, x7 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x6 - mul x7, x3, x5 - umulh x6, x3, x5 - adc x6, x6, xzr - adds x12, x12, x7 - adcs x13, x13, x6 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x6, hs - umulh x7, x2, x2 - mul x8, x2, x2 - adds x9, x9, x7 - mul x7, x3, x3 - adcs x10, x10, x7 - umulh x7, x3, x3 - adcs x11, x11, x7 - mul x7, x4, x4 - adcs x12, x12, x7 - umulh x7, x4, x4 - adcs x13, x13, x7 - mul x7, x5, x5 - adcs x14, x14, x7 - umulh x7, x5, x5 - adc x6, x6, x7 - mov x3, #38 - mul x7, x3, x12 - umulh x4, x3, x12 - adds x8, x8, x7 - mul x7, x3, x13 - umulh x13, x3, x13 - adcs x9, x9, x7 - mul x7, x3, x14 - umulh x14, x3, x14 - adcs x10, x10, x7 - mul x7, x3, x6 - umulh x6, x3, x6 - adcs x11, x11, x7 - cset x12, hs - adds x11, x11, x14 - adc x12, x12, x6 - cmn x11, x11 - bic x11, x11, #0x8000000000000000 - adc x2, x12, x12 - mov x3, #0x13 - mul x7, x3, x2 - adds x2, x8, x7 - adcs x3, x9, x4 - adcs x4, x10, x13 - adc x5, x11, xzr - -// Loop as applicable - - subs x1, x1, #1 - bne Lbignum_sqrt_p25519_alt_loop - -// We know the intermediate result x < 2^256 - 38, and now we do strict -// modular reduction mod 2^255 - 19. Note x < 2^255 - 19 <=> x + 19 < 2^255 -// which is equivalent to a "pl" condition. - - adds x6, x2, #19 - adcs x7, x3, xzr - adcs x8, x4, xzr - adcs x9, x5, xzr - - csel x2, x2, x6, pl - csel x3, x3, x7, pl - csel x4, x4, x8, pl - csel x5, x5, x9, pl - bic x5, x5, #0x8000000000000000 - -// Copy result back into destination and return - - stp x2, x3, [x0] - stp x4, x5, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_sqrt_p25519_alt_nsqr_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sub_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sub_p25519.S deleted file mode 100644 index 8a2ccc19883..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/bignum_sub_p25519.S +++ /dev/null @@ -1,73 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Subtract modulo p_25519, z := (x - y) mod p_25519 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_sub_p25519(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sub_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sub_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sub_p25519) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 -#define c x3 -#define l x4 -#define d0 x5 -#define d1 x6 -#define d2 x7 -#define d3 x8 - -S2N_BN_SYMBOL(bignum_sub_p25519): - CFI_START - -// First just subtract the numbers as [d3; d2; d1; d0] = x - y, -// with the inverted carry flag meaning CF <=> x >= y. - - ldp d0, d1, [x] - ldp l, c, [y] - subs d0, d0, l - sbcs d1, d1, c - ldp d2, d3, [x, #16] - ldp l, c, [y, #16] - sbcs d2, d2, l - sbcs d3, d3, c - -// Now if x < y we want to add back p_25519, which staying within 255 bits -// means subtracting 19, since p_25519 = 2^255 - 19. -// Let c be that constant 19 when x < y, zero otherwise. - - mov l, #19 - csel c, l, xzr, cc - -// Correct by adding the optional constant and masking to 255 bits - - subs d0, d0, c - sbcs d1, d1, xzr - sbcs d2, d2, xzr - sbc d3, d3, xzr - and d3, d3, #0x7FFFFFFFFFFFFFFF - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sub_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_ladderstep.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_ladderstep.S deleted file mode 100644 index 9fd27af015b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_ladderstep.S +++ /dev/null @@ -1,967 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery ladder step on pairs of (X,Z)-projective curve25519 points -// -// extern void curve25519_ladderstep -// (uint64_t rr[16],const uint64_t point[8],const uint64_t pp[16],uint64_t b); -// -// If point = (X,1) and pp = (n * (X,1),[n+1] * (X,1)) then the output -// rr = (n' * (X,1),[n'+1] * (X,1)) where n' = 2 * n + b, with input -// b assumed to be 0 or 1; in this setting, each pair (X,Z) is assumed to -// be a projective y-free representation of an affine curve25519 point -// (X/Z,y), with the initial "differential" point having Z = 1 and X its -// affine x coordinate. In other words, the ladderstep operation is a -// combination of doubling, differential addition and optional swapping. -// -// Standard ARM ABI: X0 = rr, X1 = point, X2 = pp, X3 = b -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(curve25519_ladderstep) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(curve25519_ladderstep) - S2N_BN_SYM_PRIVACY_DIRECTIVE(curve25519_ladderstep) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define rr x17 -#define point x19 -#define pp x20 -#define b x21 - -// Pointer-offset pairs for inputs and outputs - -#define x point, #0 -#define z point, #NUMSIZE -#define xn pp, #0 -#define zn pp, #NUMSIZE -#define xm pp, #(2*NUMSIZE) -#define zm pp, #(3*NUMSIZE) -#define res0 rr, #0 -#define res1 rr, #NUMSIZE -#define res2 rr, #(2*NUMSIZE) -#define res3 rr, #(3*NUMSIZE) - -// Pointer-offset pairs for temporaries on stack - -#define sm sp, #(0*NUMSIZE) -#define sn sp, #(1*NUMSIZE) -#define dm sp, #(2*NUMSIZE) -#define dn sp, #(3*NUMSIZE) -#define dmsn sp, #(4*NUMSIZE) -#define dnsm sp, #(5*NUMSIZE) -#define s sp, #(6*NUMSIZE) -#define d sp, #(7*NUMSIZE) -#define p sp, #(8*NUMSIZE) - -// More, but aliases to above - -#define sumx sm -#define sumz sn -#define dubx dm -#define dubz dn -#define e dubz -#define spro dnsm -#define dpro sumz - -// Total size to reserve on the stack - -#define NSPACE 9*NUMSIZE - -// Macros wrapping up the basic field operations bignum_mul_p25519 -// and bignum_sqr_p25519, only trivially different from pure function -// call to those subroutines. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - umull x7, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x8, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x7, x7, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x8, x8, x15 __LF \ - adds x7, x7, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x8, x8, x16 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - umull x11, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x12, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x11, x11, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x12, x12, x15 __LF \ - adds x11, x11, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x12, x12, x16 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, cc __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, cc __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x9, cc __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, cc __LF \ - cinv x9, x9, cc __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #0x1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x3, #0x26 __LF \ - umull x4, w11, w3 __LF \ - add x4, x4, w7, uxtw __LF \ - lsr x7, x7, #32 __LF \ - lsr x11, x11, #32 __LF \ - umaddl x11, w11, w3, x7 __LF \ - mov x7, x4 __LF \ - umull x4, w12, w3 __LF \ - add x4, x4, w8, uxtw __LF \ - lsr x8, x8, #32 __LF \ - lsr x12, x12, #32 __LF \ - umaddl x12, w12, w3, x8 __LF \ - mov x8, x4 __LF \ - umull x4, w13, w3 __LF \ - add x4, x4, w9, uxtw __LF \ - lsr x9, x9, #32 __LF \ - lsr x13, x13, #32 __LF \ - umaddl x13, w13, w3, x9 __LF \ - mov x9, x4 __LF \ - umull x4, w14, w3 __LF \ - add x4, x4, w10, uxtw __LF \ - lsr x10, x10, #32 __LF \ - lsr x14, x14, #32 __LF \ - umaddl x14, w14, w3, x10 __LF \ - mov x10, x4 __LF \ - lsr x0, x14, #31 __LF \ - mov x5, #0x13 __LF \ - umaddl x5, w5, w0, x5 __LF \ - add x7, x7, x5 __LF \ - adds x7, x7, x11, lsl #32 __LF \ - extr x3, x12, x11, #32 __LF \ - adcs x8, x8, x3 __LF \ - extr x3, x13, x12, #32 __LF \ - adcs x9, x9, x3 __LF \ - extr x3, x14, x13, #32 __LF \ - lsl x5, x0, #63 __LF \ - eor x10, x10, x5 __LF \ - adc x10, x10, x3 __LF \ - mov x3, #0x13 __LF \ - tst x10, #0x8000000000000000 __LF \ - csel x3, x3, xzr, pl __LF \ - subs x7, x7, x3 __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - and x10, x10, #0x7fffffffffffffff __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -#define sqr_p25519(P0,P1) \ - ldp x10, x11, [P1] __LF \ - ldp x12, x13, [P1+16] __LF \ - umull x2, w10, w10 __LF \ - lsr x14, x10, #32 __LF \ - umull x3, w14, w14 __LF \ - umull x14, w10, w14 __LF \ - adds x2, x2, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x3, x3, x14 __LF \ - umull x4, w11, w11 __LF \ - lsr x14, x11, #32 __LF \ - umull x5, w14, w14 __LF \ - umull x14, w11, w14 __LF \ - mul x15, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x4, x4, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x5, x5, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x5, x5, xzr __LF \ - adds x3, x3, x15 __LF \ - adcs x4, x4, x16 __LF \ - adc x5, x5, xzr __LF \ - umull x6, w12, w12 __LF \ - lsr x14, x12, #32 __LF \ - umull x7, w14, w14 __LF \ - umull x14, w12, w14 __LF \ - adds x6, x6, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x7, x7, x14 __LF \ - umull x8, w13, w13 __LF \ - lsr x14, x13, #32 __LF \ - umull x9, w14, w14 __LF \ - umull x14, w13, w14 __LF \ - mul x15, x12, x13 __LF \ - umulh x16, x12, x13 __LF \ - adds x8, x8, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x9, x9, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x9, x9, xzr __LF \ - adds x7, x7, x15 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, xzr __LF \ - subs x10, x10, x12 __LF \ - sbcs x11, x11, x13 __LF \ - csetm x16, cc __LF \ - eor x10, x10, x16 __LF \ - subs x10, x10, x16 __LF \ - eor x11, x11, x16 __LF \ - sbc x11, x11, x16 __LF \ - adds x6, x6, x4 __LF \ - adcs x7, x7, x5 __LF \ - adcs x8, x8, xzr __LF \ - adc x9, x9, xzr __LF \ - umull x12, w10, w10 __LF \ - lsr x5, x10, #32 __LF \ - umull x13, w5, w5 __LF \ - umull x5, w10, w5 __LF \ - adds x12, x12, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x13, x13, x5 __LF \ - umull x15, w11, w11 __LF \ - lsr x5, x11, #32 __LF \ - umull x14, w5, w5 __LF \ - umull x5, w11, w5 __LF \ - mul x4, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x15, x15, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x14, x14, x5 __LF \ - adds x4, x4, x4 __LF \ - adcs x16, x16, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x13, x13, x4 __LF \ - adcs x15, x15, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x4, x2, x6 __LF \ - adcs x5, x3, x7 __LF \ - adcs x6, x6, x8 __LF \ - adcs x7, x7, x9 __LF \ - csetm x16, cc __LF \ - subs x4, x4, x12 __LF \ - sbcs x5, x5, x13 __LF \ - sbcs x6, x6, x15 __LF \ - sbcs x7, x7, x14 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, x16 __LF \ - mov x10, #0x26 __LF \ - umull x12, w6, w10 __LF \ - add x12, x12, w2, uxtw __LF \ - lsr x2, x2, #32 __LF \ - lsr x6, x6, #32 __LF \ - umaddl x6, w6, w10, x2 __LF \ - mov x2, x12 __LF \ - umull x12, w7, w10 __LF \ - add x12, x12, w3, uxtw __LF \ - lsr x3, x3, #32 __LF \ - lsr x7, x7, #32 __LF \ - umaddl x7, w7, w10, x3 __LF \ - mov x3, x12 __LF \ - umull x12, w8, w10 __LF \ - add x12, x12, w4, uxtw __LF \ - lsr x4, x4, #32 __LF \ - lsr x8, x8, #32 __LF \ - umaddl x8, w8, w10, x4 __LF \ - mov x4, x12 __LF \ - umull x12, w9, w10 __LF \ - add x12, x12, w5, uxtw __LF \ - lsr x5, x5, #32 __LF \ - lsr x9, x9, #32 __LF \ - umaddl x9, w9, w10, x5 __LF \ - mov x5, x12 __LF \ - lsr x13, x9, #31 __LF \ - mov x11, #0x13 __LF \ - umaddl x11, w11, w13, x11 __LF \ - add x2, x2, x11 __LF \ - adds x2, x2, x6, lsl #32 __LF \ - extr x10, x7, x6, #32 __LF \ - adcs x3, x3, x10 __LF \ - extr x10, x8, x7, #32 __LF \ - adcs x4, x4, x10 __LF \ - extr x10, x9, x8, #32 __LF \ - lsl x11, x13, #63 __LF \ - eor x5, x5, x11 __LF \ - adc x5, x5, x10 __LF \ - mov x10, #0x13 __LF \ - tst x5, #0x8000000000000000 __LF \ - csel x10, x10, xzr, pl __LF \ - subs x2, x2, x10 __LF \ - sbcs x3, x3, xzr __LF \ - sbcs x4, x4, xzr __LF \ - sbc x5, x5, xzr __LF \ - and x5, x5, #0x7fffffffffffffff __LF \ - stp x2, x3, [P0] __LF \ - stp x4, x5, [P0+16] - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - umull x7, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x8, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x7, x7, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x8, x8, x15 __LF \ - adds x7, x7, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x8, x8, x16 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - umull x11, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x12, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x11, x11, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x12, x12, x15 __LF \ - adds x11, x11, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x12, x12, x16 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, cc __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, cc __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x9, cc __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, cc __LF \ - cinv x9, x9, cc __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #0x1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x3, #0x26 __LF \ - umull x4, w11, w3 __LF \ - add x4, x4, w7, uxtw __LF \ - lsr x7, x7, #32 __LF \ - lsr x11, x11, #32 __LF \ - umaddl x11, w11, w3, x7 __LF \ - mov x7, x4 __LF \ - umull x4, w12, w3 __LF \ - add x4, x4, w8, uxtw __LF \ - lsr x8, x8, #32 __LF \ - lsr x12, x12, #32 __LF \ - umaddl x12, w12, w3, x8 __LF \ - mov x8, x4 __LF \ - umull x4, w13, w3 __LF \ - add x4, x4, w9, uxtw __LF \ - lsr x9, x9, #32 __LF \ - lsr x13, x13, #32 __LF \ - umaddl x13, w13, w3, x9 __LF \ - mov x9, x4 __LF \ - umull x4, w14, w3 __LF \ - add x4, x4, w10, uxtw __LF \ - lsr x10, x10, #32 __LF \ - lsr x14, x14, #32 __LF \ - umaddl x14, w14, w3, x10 __LF \ - mov x10, x4 __LF \ - lsr x0, x14, #31 __LF \ - mov x5, #0x13 __LF \ - umull x5, w5, w0 __LF \ - add x7, x7, x5 __LF \ - adds x7, x7, x11, lsl #32 __LF \ - extr x3, x12, x11, #32 __LF \ - adcs x8, x8, x3 __LF \ - extr x3, x13, x12, #32 __LF \ - adcs x9, x9, x3 __LF \ - extr x3, x14, x13, #32 __LF \ - lsl x5, x0, #63 __LF \ - eor x10, x10, x5 __LF \ - adc x10, x10, x3 __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - ldp x10, x11, [P1] __LF \ - ldp x12, x13, [P1+16] __LF \ - umull x2, w10, w10 __LF \ - lsr x14, x10, #32 __LF \ - umull x3, w14, w14 __LF \ - umull x14, w10, w14 __LF \ - adds x2, x2, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x3, x3, x14 __LF \ - umull x4, w11, w11 __LF \ - lsr x14, x11, #32 __LF \ - umull x5, w14, w14 __LF \ - umull x14, w11, w14 __LF \ - mul x15, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x4, x4, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x5, x5, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x5, x5, xzr __LF \ - adds x3, x3, x15 __LF \ - adcs x4, x4, x16 __LF \ - adc x5, x5, xzr __LF \ - umull x6, w12, w12 __LF \ - lsr x14, x12, #32 __LF \ - umull x7, w14, w14 __LF \ - umull x14, w12, w14 __LF \ - adds x6, x6, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x7, x7, x14 __LF \ - umull x8, w13, w13 __LF \ - lsr x14, x13, #32 __LF \ - umull x9, w14, w14 __LF \ - umull x14, w13, w14 __LF \ - mul x15, x12, x13 __LF \ - umulh x16, x12, x13 __LF \ - adds x8, x8, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x9, x9, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x9, x9, xzr __LF \ - adds x7, x7, x15 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, xzr __LF \ - subs x10, x10, x12 __LF \ - sbcs x11, x11, x13 __LF \ - csetm x16, cc __LF \ - eor x10, x10, x16 __LF \ - subs x10, x10, x16 __LF \ - eor x11, x11, x16 __LF \ - sbc x11, x11, x16 __LF \ - adds x6, x6, x4 __LF \ - adcs x7, x7, x5 __LF \ - adcs x8, x8, xzr __LF \ - adc x9, x9, xzr __LF \ - umull x12, w10, w10 __LF \ - lsr x5, x10, #32 __LF \ - umull x13, w5, w5 __LF \ - umull x5, w10, w5 __LF \ - adds x12, x12, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x13, x13, x5 __LF \ - umull x15, w11, w11 __LF \ - lsr x5, x11, #32 __LF \ - umull x14, w5, w5 __LF \ - umull x5, w11, w5 __LF \ - mul x4, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x15, x15, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x14, x14, x5 __LF \ - adds x4, x4, x4 __LF \ - adcs x16, x16, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x13, x13, x4 __LF \ - adcs x15, x15, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x4, x2, x6 __LF \ - adcs x5, x3, x7 __LF \ - adcs x6, x6, x8 __LF \ - adcs x7, x7, x9 __LF \ - csetm x16, cc __LF \ - subs x4, x4, x12 __LF \ - sbcs x5, x5, x13 __LF \ - sbcs x6, x6, x15 __LF \ - sbcs x7, x7, x14 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, x16 __LF \ - mov x10, #0x26 __LF \ - umull x12, w6, w10 __LF \ - add x12, x12, w2, uxtw __LF \ - lsr x2, x2, #32 __LF \ - lsr x6, x6, #32 __LF \ - umaddl x6, w6, w10, x2 __LF \ - mov x2, x12 __LF \ - umull x12, w7, w10 __LF \ - add x12, x12, w3, uxtw __LF \ - lsr x3, x3, #32 __LF \ - lsr x7, x7, #32 __LF \ - umaddl x7, w7, w10, x3 __LF \ - mov x3, x12 __LF \ - umull x12, w8, w10 __LF \ - add x12, x12, w4, uxtw __LF \ - lsr x4, x4, #32 __LF \ - lsr x8, x8, #32 __LF \ - umaddl x8, w8, w10, x4 __LF \ - mov x4, x12 __LF \ - umull x12, w9, w10 __LF \ - add x12, x12, w5, uxtw __LF \ - lsr x5, x5, #32 __LF \ - lsr x9, x9, #32 __LF \ - umaddl x9, w9, w10, x5 __LF \ - mov x5, x12 __LF \ - lsr x13, x9, #31 __LF \ - mov x11, #0x13 __LF \ - umull x11, w11, w13 __LF \ - add x2, x2, x11 __LF \ - adds x2, x2, x6, lsl #32 __LF \ - extr x10, x7, x6, #32 __LF \ - adcs x3, x3, x10 __LF \ - extr x10, x8, x7, #32 __LF \ - adcs x4, x4, x10 __LF \ - extr x10, x9, x8, #32 __LF \ - lsl x11, x13, #63 __LF \ - eor x5, x5, x11 __LF \ - adc x5, x5, x10 __LF \ - stp x2, x3, [P0] __LF \ - stp x4, x5, [P0+16] - -// Plain 4-digit add without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result - -#define add_4(p0,p1,p2) \ - ldp x0, x1, [p1] __LF \ - ldp x4, x5, [p2] __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - ldp x2, x3, [p1+16] __LF \ - ldp x6, x7, [p2+16] __LF \ - adcs x2, x2, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [p0] __LF \ - stp x2, x3, [p0+16] - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(p0,p1,p2) \ - ldp x5, x6, [p1] __LF \ - ldp x4, x3, [p2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [p1+16] __LF \ - ldp x4, x3, [p2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x3, #19 __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - mov x4, #0x8000000000000000 __LF \ - sbc x8, x8, x4 __LF \ - stp x5, x6, [p0] __LF \ - stp x7, x8, [p0+16] - -// Modular addition with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(p0,p1,p2) \ - ldp x5, x6, [p1] __LF \ - ldp x4, x3, [p2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [p1+16] __LF \ - ldp x4, x3, [p2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [p0] __LF \ - stp x7, x8, [p0+16] - -// Combined z = c * x + y with reduction only < 2 * p_25519 -// where c is initially in the X1 register. It is assumed -// that 19 * (c * x + y) < 2^60 * 2^256 so we don't need a -// high mul in the final part. - -#define cmadd_4(p0,p2,p3) \ - ldp x7, x8, [p2] __LF \ - ldp x9, x10, [p2+16] __LF \ - mul x3, x1, x7 __LF \ - mul x4, x1, x8 __LF \ - mul x5, x1, x9 __LF \ - mul x6, x1, x10 __LF \ - umulh x7, x1, x7 __LF \ - umulh x8, x1, x8 __LF \ - umulh x9, x1, x9 __LF \ - umulh x10, x1, x10 __LF \ - adds x4, x4, x7 __LF \ - adcs x5, x5, x8 __LF \ - adcs x6, x6, x9 __LF \ - adc x10, x10, xzr __LF \ - ldp x7, x8, [p3] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x7, x8, [p3+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - adc x10, x10, xzr __LF \ - cmn x6, x6 __LF \ - bic x6, x6, #0x8000000000000000 __LF \ - adc x8, x10, x10 __LF \ - mov x9, #19 __LF \ - mul x7, x8, x9 __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [p0] __LF \ - stp x5, x6, [p0+16] - -// Multiplex: z := if NZ then x else y - -#define mux_4(p0,p1,p2) \ - ldp x0, x1, [p1] __LF \ - ldp x2, x3, [p2] __LF \ - csel x0, x0, x2, ne __LF \ - csel x1, x1, x3, ne __LF \ - stp x0, x1, [p0] __LF \ - ldp x0, x1, [p1+16] __LF \ - ldp x2, x3, [p2+16] __LF \ - csel x0, x0, x2, ne __LF \ - csel x1, x1, x3, ne __LF \ - stp x0, x1, [p0+16] - -// Paired multiplex: (w,z) := if NZ then (y,x) else (x,y) - -#define muxpair_4(p0,p1,p2,p3) \ - ldp x0, x1, [p2] __LF \ - ldp x2, x3, [p3] __LF \ - csel x4, x0, x2, eq __LF \ - csel x6, x0, x2, ne __LF \ - csel x5, x1, x3, eq __LF \ - csel x7, x1, x3, ne __LF \ - stp x4, x5, [p0] __LF \ - stp x6, x7, [p1] __LF \ - ldp x0, x1, [p2+16] __LF \ - ldp x2, x3, [p3+16] __LF \ - csel x4, x0, x2, eq __LF \ - csel x6, x0, x2, ne __LF \ - csel x5, x1, x3, eq __LF \ - csel x7, x1, x3, ne __LF \ - stp x4, x5, [p0+16] __LF \ - stp x6, x7, [p1+16] - -S2N_BN_SYMBOL(curve25519_ladderstep): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x30) - CFI_PUSH2(x20,x21) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov rr, x0 - mov point, x1 - mov pp, x2 - mov b, x3 - -// sm = xm + zm; sn = xn + zn; dm = xm - zm; dn = xn - zn -// The adds don't need any normalization as they're fed to muls -// Just make sure the subs fit in 4 digits - - sub_4(dm, xm, zm) - add_4(sn, xn, zn) - sub_4(dn, xn, zn) - add_4(sm, xm, zm) - -// ADDING: dmsn = dm * sn; dnsm = sm * dn -// DOUBLING: mux d = xt - zt and s = xt + zt for appropriate choice of (xt,zt) - - mul_4(dmsn,dm,sn) - - cmp b, xzr - mux_4(d,dm,dn) - mux_4(s,sm,sn) - - mul_4(dnsm,sm,dn) - -// DOUBLING: d = (xt - zt)^2 normalized only to 4 digits - - sqr_4(d,d) - -// ADDING: dpro = (dmsn - dnsm)^2, spro = (dmsn + dnsm)^2 -// DOUBLING: s = (xt + zt)^2, normalized only to 4 digits - - sub_twice4(dpro,dmsn,dnsm) - sqr_4(s,s) - add_twice4(spro,dmsn,dnsm) - sqr_4(dpro,dpro) - -// DOUBLING: p = 4 * xt * zt = s - d - - sub_twice4(p,s,d) - -// ADDING: sumx = (dmsn + dnsm)^2 - - sqr_p25519(sumx,spro) - -// DOUBLING: e = 121666 * p + d - - mov x1, 0xdb42 - orr x1, x1, 0x10000 - cmadd_4(e,p,d) - -// DOUBLING: dubx = (xt + zt)^2 * (xt - zt)^2 = s * d - - mul_p25519(dubx,s,d) - -// ADDING: sumz = x * (dmsn - dnsm)^2 - - mul_p25519(sumz,dpro,x) - -// DOUBLING: dubz = (4 * xt * zt) * ((xt - zt)^2 + 121666 * (4 * xt * zt)) -// = p * (d + 121666 * p) - - mul_p25519(dubz,p,e) - -// Multiplex the outputs - - cmp b, xzr - muxpair_4(res0,res2,dubx,sumx) - muxpair_4(res1,res3,dubz,sumz) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x20,x21) - CFI_POP2(x19,x30) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(curve25519_ladderstep) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_ladderstep_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_ladderstep_alt.S deleted file mode 100644 index 8f99459f485..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_ladderstep_alt.S +++ /dev/null @@ -1,691 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery ladder step on pairs of (X,Z)-projective curve25519 points -// -// extern void curve25519_ladderstep_alt -// (uint64_t rr[16],const uint64_t point[8],const uint64_t pp[16],uint64_t b); -// -// If point = (X,1) and pp = (n * (X,1),[n+1] * (X,1)) then the output -// rr = (n' * (X,1),[n'+1] * (X,1)) where n' = 2 * n + b, with input -// b assumed to be 0 or 1; in this setting, each pair (X,Z) is assumed to -// be a projective y-free representation of an affine curve25519 point -// (X/Z,y), with the initial "differential" point having Z = 1 and X its -// affine x coordinate. In other words, the ladderstep operation is a -// combination of doubling, differential addition and optional swapping. -// -// Standard ARM ABI: X0 = rr, X1 = point, X2 = pp, X3 = b -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(curve25519_ladderstep_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(curve25519_ladderstep_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(curve25519_ladderstep_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define rr x17 -#define point x19 -#define pp x20 -#define b x21 - -// Pointer-offset pairs for inputs and outputs - -#define x point, #0 -#define z point, #NUMSIZE -#define xn pp, #0 -#define zn pp, #NUMSIZE -#define xm pp, #(2*NUMSIZE) -#define zm pp, #(3*NUMSIZE) -#define res0 rr, #0 -#define res1 rr, #NUMSIZE -#define res2 rr, #(2*NUMSIZE) -#define res3 rr, #(3*NUMSIZE) - -// Pointer-offset pairs for temporaries on stack - -#define sm sp, #(0*NUMSIZE) -#define sn sp, #(1*NUMSIZE) -#define dm sp, #(2*NUMSIZE) -#define dn sp, #(3*NUMSIZE) -#define dmsn sp, #(4*NUMSIZE) -#define dnsm sp, #(5*NUMSIZE) -#define s sp, #(6*NUMSIZE) -#define d sp, #(7*NUMSIZE) -#define p sp, #(8*NUMSIZE) - -// More, but aliases to above - -#define sumx sm -#define sumz sn -#define dubx dm -#define dubz dn -#define e dubz -#define spro dnsm -#define dpro sumz - -// Total size to reserve on the stack - -#define NSPACE 9*NUMSIZE - -// Macros wrapping up the basic field operations bignum_mul_p25519_alt -// and bignum_sqr_p25519_alt, only trivially different from pure function -// call to those subroutines. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - orr x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - madd x11, x7, x8, x7 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adcs x15, x15, xzr __LF \ - csel x7, x7, xzr, cc __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x15, x15, xzr __LF \ - and x15, x15, #0x7fffffffffffffff __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -#define sqr_p25519(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x7, x2, x4 __LF \ - umulh x6, x2, x4 __LF \ - adds x10, x10, x7 __LF \ - adcs x11, x11, x6 __LF \ - mul x7, x3, x4 __LF \ - umulh x6, x3, x4 __LF \ - adc x6, x6, xzr __LF \ - adds x11, x11, x7 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x6 __LF \ - mul x7, x3, x5 __LF \ - umulh x6, x3, x5 __LF \ - adc x6, x6, xzr __LF \ - adds x12, x12, x7 __LF \ - adcs x13, x13, x6 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x6, cs __LF \ - umulh x7, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x7 __LF \ - mul x7, x3, x3 __LF \ - adcs x10, x10, x7 __LF \ - umulh x7, x3, x3 __LF \ - adcs x11, x11, x7 __LF \ - mul x7, x4, x4 __LF \ - adcs x12, x12, x7 __LF \ - umulh x7, x4, x4 __LF \ - adcs x13, x13, x7 __LF \ - mul x7, x5, x5 __LF \ - adcs x14, x14, x7 __LF \ - umulh x7, x5, x5 __LF \ - adc x6, x6, x7 __LF \ - mov x3, #0x26 __LF \ - mul x7, x3, x12 __LF \ - umulh x4, x3, x12 __LF \ - adds x8, x8, x7 __LF \ - mul x7, x3, x13 __LF \ - umulh x13, x3, x13 __LF \ - adcs x9, x9, x7 __LF \ - mul x7, x3, x14 __LF \ - umulh x14, x3, x14 __LF \ - adcs x10, x10, x7 __LF \ - mul x7, x3, x6 __LF \ - umulh x6, x3, x6 __LF \ - adcs x11, x11, x7 __LF \ - cset x12, cs __LF \ - adds x11, x11, x14 __LF \ - adc x12, x12, x6 __LF \ - cmn x11, x11 __LF \ - orr x11, x11, #0x8000000000000000 __LF \ - adc x2, x12, x12 __LF \ - mov x3, #0x13 __LF \ - madd x7, x3, x2, x3 __LF \ - adds x8, x8, x7 __LF \ - adcs x9, x9, x4 __LF \ - adcs x10, x10, x13 __LF \ - adcs x11, x11, xzr __LF \ - csel x3, x3, xzr, cc __LF \ - subs x8, x8, x3 __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbc x11, x11, xzr __LF \ - and x11, x11, #0x7fffffffffffffff __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] __LF \ - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - bic x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - mul x11, x7, x8 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adc x15, x15, xzr __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x7, x2, x4 __LF \ - umulh x6, x2, x4 __LF \ - adds x10, x10, x7 __LF \ - adcs x11, x11, x6 __LF \ - mul x7, x3, x4 __LF \ - umulh x6, x3, x4 __LF \ - adc x6, x6, xzr __LF \ - adds x11, x11, x7 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x6 __LF \ - mul x7, x3, x5 __LF \ - umulh x6, x3, x5 __LF \ - adc x6, x6, xzr __LF \ - adds x12, x12, x7 __LF \ - adcs x13, x13, x6 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x6, cs __LF \ - umulh x7, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x7 __LF \ - mul x7, x3, x3 __LF \ - adcs x10, x10, x7 __LF \ - umulh x7, x3, x3 __LF \ - adcs x11, x11, x7 __LF \ - mul x7, x4, x4 __LF \ - adcs x12, x12, x7 __LF \ - umulh x7, x4, x4 __LF \ - adcs x13, x13, x7 __LF \ - mul x7, x5, x5 __LF \ - adcs x14, x14, x7 __LF \ - umulh x7, x5, x5 __LF \ - adc x6, x6, x7 __LF \ - mov x3, #0x26 __LF \ - mul x7, x3, x12 __LF \ - umulh x4, x3, x12 __LF \ - adds x8, x8, x7 __LF \ - mul x7, x3, x13 __LF \ - umulh x13, x3, x13 __LF \ - adcs x9, x9, x7 __LF \ - mul x7, x3, x14 __LF \ - umulh x14, x3, x14 __LF \ - adcs x10, x10, x7 __LF \ - mul x7, x3, x6 __LF \ - umulh x6, x3, x6 __LF \ - adcs x11, x11, x7 __LF \ - cset x12, cs __LF \ - adds x11, x11, x14 __LF \ - adc x12, x12, x6 __LF \ - cmn x11, x11 __LF \ - bic x11, x11, #0x8000000000000000 __LF \ - adc x2, x12, x12 __LF \ - mov x3, #0x13 __LF \ - mul x7, x3, x2 __LF \ - adds x8, x8, x7 __LF \ - adcs x9, x9, x4 __LF \ - adcs x10, x10, x13 __LF \ - adc x11, x11, xzr __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Plain 4-digit add without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result - -#define add_4(p0,p1,p2) \ - ldp x0, x1, [p1] __LF \ - ldp x4, x5, [p2] __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - ldp x2, x3, [p1+16] __LF \ - ldp x6, x7, [p2+16] __LF \ - adcs x2, x2, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [p0] __LF \ - stp x2, x3, [p0+16] - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(p0,p1,p2) \ - ldp x5, x6, [p1] __LF \ - ldp x4, x3, [p2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [p1+16] __LF \ - ldp x4, x3, [p2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x3, #19 __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - mov x4, #0x8000000000000000 __LF \ - sbc x8, x8, x4 __LF \ - stp x5, x6, [p0] __LF \ - stp x7, x8, [p0+16] - -// Modular addition with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(p0,p1,p2) \ - ldp x5, x6, [p1] __LF \ - ldp x4, x3, [p2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [p1+16] __LF \ - ldp x4, x3, [p2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [p0] __LF \ - stp x7, x8, [p0+16] - -// Combined z = c * x + y with reduction only < 2 * p_25519 -// where c is initially in the X1 register. It is assumed -// that 19 * (c * x + y) < 2^60 * 2^256 so we don't need a -// high mul in the final part. - -#define cmadd_4(p0,p2,p3) \ - ldp x7, x8, [p2] __LF \ - ldp x9, x10, [p2+16] __LF \ - mul x3, x1, x7 __LF \ - mul x4, x1, x8 __LF \ - mul x5, x1, x9 __LF \ - mul x6, x1, x10 __LF \ - umulh x7, x1, x7 __LF \ - umulh x8, x1, x8 __LF \ - umulh x9, x1, x9 __LF \ - umulh x10, x1, x10 __LF \ - adds x4, x4, x7 __LF \ - adcs x5, x5, x8 __LF \ - adcs x6, x6, x9 __LF \ - adc x10, x10, xzr __LF \ - ldp x7, x8, [p3] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x7, x8, [p3+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - adc x10, x10, xzr __LF \ - cmn x6, x6 __LF \ - bic x6, x6, #0x8000000000000000 __LF \ - adc x8, x10, x10 __LF \ - mov x9, #19 __LF \ - mul x7, x8, x9 __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [p0] __LF \ - stp x5, x6, [p0+16] - -// Multiplex: z := if NZ then x else y - -#define mux_4(p0,p1,p2) \ - ldp x0, x1, [p1] __LF \ - ldp x2, x3, [p2] __LF \ - csel x0, x0, x2, ne __LF \ - csel x1, x1, x3, ne __LF \ - stp x0, x1, [p0] __LF \ - ldp x0, x1, [p1+16] __LF \ - ldp x2, x3, [p2+16] __LF \ - csel x0, x0, x2, ne __LF \ - csel x1, x1, x3, ne __LF \ - stp x0, x1, [p0+16] - -// Paired multiplex: (w,z) := if NZ then (y,x) else (x,y) - -#define muxpair_4(p0,p1,p2,p3) \ - ldp x0, x1, [p2] __LF \ - ldp x2, x3, [p3] __LF \ - csel x4, x0, x2, eq __LF \ - csel x6, x0, x2, ne __LF \ - csel x5, x1, x3, eq __LF \ - csel x7, x1, x3, ne __LF \ - stp x4, x5, [p0] __LF \ - stp x6, x7, [p1] __LF \ - ldp x0, x1, [p2+16] __LF \ - ldp x2, x3, [p3+16] __LF \ - csel x4, x0, x2, eq __LF \ - csel x6, x0, x2, ne __LF \ - csel x5, x1, x3, eq __LF \ - csel x7, x1, x3, ne __LF \ - stp x4, x5, [p0+16] __LF \ - stp x6, x7, [p1+16] - -S2N_BN_SYMBOL(curve25519_ladderstep_alt): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x30) - CFI_PUSH2(x20,x21) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov rr, x0 - mov point, x1 - mov pp, x2 - mov b, x3 - -// sm = xm + zm; sn = xn + zn; dm = xm - zm; dn = xn - zn -// The adds don't need any normalization as they're fed to muls -// Just make sure the subs fit in 4 digits - - sub_4(dm, xm, zm) - add_4(sn, xn, zn) - sub_4(dn, xn, zn) - add_4(sm, xm, zm) - -// ADDING: dmsn = dm * sn; dnsm = sm * dn -// DOUBLING: mux d = xt - zt and s = xt + zt for appropriate choice of (xt,zt) - - mul_4(dmsn,dm,sn) - - cmp b, xzr - mux_4(d,dm,dn) - mux_4(s,sm,sn) - - mul_4(dnsm,sm,dn) - -// DOUBLING: d = (xt - zt)^2 normalized only to 4 digits - - sqr_4(d,d) - -// ADDING: dpro = (dmsn - dnsm)^2, spro = (dmsn + dnsm)^2 -// DOUBLING: s = (xt + zt)^2, normalized only to 4 digits - - sub_twice4(dpro,dmsn,dnsm) - sqr_4(s,s) - add_twice4(spro,dmsn,dnsm) - sqr_4(dpro,dpro) - -// DOUBLING: p = 4 * xt * zt = s - d - - sub_twice4(p,s,d) - -// ADDING: sumx = (dmsn + dnsm)^2 - - sqr_p25519(sumx,spro) - -// DOUBLING: e = 121666 * p + d - - mov x1, 0xdb42 - orr x1, x1, 0x10000 - cmadd_4(e,p,d) - -// DOUBLING: dubx = (xt + zt)^2 * (xt - zt)^2 = s * d - - mul_p25519(dubx,s,d) - -// ADDING: sumz = x * (dmsn - dnsm)^2 - - mul_p25519(sumz,dpro,x) - -// DOUBLING: dubz = (4 * xt * zt) * ((xt - zt)^2 + 121666 * (4 * xt * zt)) -// = p * (d + 121666 * p) - - mul_p25519(dubz,p,e) - -// Multiplex the outputs - - cmp b, xzr - muxpair_4(res0,res2,dubx,sumx) - muxpair_4(res1,res3,dubz,sumz) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x20,x21) - CFI_POP2(x19,x30) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(curve25519_ladderstep_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_pxscalarmul.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_pxscalarmul.S deleted file mode 100644 index 76a3e9ab3a1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_pxscalarmul.S +++ /dev/null @@ -1,1001 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Projective scalar multiplication, x coordinate only, for curve25519 -// Inputs scalar[4], point[4]; output res[8] -// -// extern void curve25519_pxscalarmul -// (uint64_t res[static 8],const uint64_t scalar[static 4], -// const uint64_t point[static 4]); -// -// Given the X coordinate of an input point = (X,Y) on curve25519, which -// could also be part of a projective representation (X,Y,1) of the same -// point, returns a projective representation (X,Z) = scalar * point, where -// scalar is a 256-bit number. The corresponding affine form is (X/Z,Y'), -// X/Z meaning division modulo 2^255-19, and Y' not being computed by -// this function (nor is any Y coordinate of the input point used). -// -// Standard ARM ABI: X0 = res, X1 = scalar, X2 = point -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(curve25519_pxscalarmul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(curve25519_pxscalarmul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(curve25519_pxscalarmul) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence -// and additional registers for loop counter and swap flag - -#define res x17 -#define point x19 -#define scalar x20 -#define i x21 -#define swap x22 - -// Pointers to input x coord (we don't use y or z) and output coords. - -#define x point, #0 -#define resx res, #0 -#define resz res, #NUMSIZE - -// Pointer-offset pairs for temporaries on stack with some aliasing. - -#define zm sp, #(0*NUMSIZE) -#define sm sp, #(0*NUMSIZE) -#define dpro sp, #(0*NUMSIZE) - -#define sn sp, #(1*NUMSIZE) - -#define dm sp, #(2*NUMSIZE) - -#define zn sp, #(3*NUMSIZE) -#define dn sp, #(3*NUMSIZE) -#define e sp, #(3*NUMSIZE) - -#define dmsn sp, #(4*NUMSIZE) -#define p sp, #(4*NUMSIZE) - -#define xm sp, #(5*NUMSIZE) -#define dnsm sp, #(5*NUMSIZE) -#define spro sp, #(5*NUMSIZE) - -#define xn sp, #(6*NUMSIZE) -#define s sp, #(6*NUMSIZE) - -#define d sp, #(7*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 8*NUMSIZE - -// Macros wrapping up the basic field operations bignum_mul_p25519 -// and bignum_sqr_p25519, only trivially different from pure function -// call to those subroutines. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - umull x7, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x8, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x7, x7, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x8, x8, x15 __LF \ - adds x7, x7, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x8, x8, x16 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - umull x11, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x12, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x11, x11, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x12, x12, x15 __LF \ - adds x11, x11, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x12, x12, x16 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, cc __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, cc __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x9, cc __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, cc __LF \ - cinv x9, x9, cc __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #0x1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x3, #0x26 __LF \ - umull x4, w11, w3 __LF \ - add x4, x4, w7, uxtw __LF \ - lsr x7, x7, #32 __LF \ - lsr x11, x11, #32 __LF \ - umaddl x11, w11, w3, x7 __LF \ - mov x7, x4 __LF \ - umull x4, w12, w3 __LF \ - add x4, x4, w8, uxtw __LF \ - lsr x8, x8, #32 __LF \ - lsr x12, x12, #32 __LF \ - umaddl x12, w12, w3, x8 __LF \ - mov x8, x4 __LF \ - umull x4, w13, w3 __LF \ - add x4, x4, w9, uxtw __LF \ - lsr x9, x9, #32 __LF \ - lsr x13, x13, #32 __LF \ - umaddl x13, w13, w3, x9 __LF \ - mov x9, x4 __LF \ - umull x4, w14, w3 __LF \ - add x4, x4, w10, uxtw __LF \ - lsr x10, x10, #32 __LF \ - lsr x14, x14, #32 __LF \ - umaddl x14, w14, w3, x10 __LF \ - mov x10, x4 __LF \ - lsr x0, x14, #31 __LF \ - mov x5, #0x13 __LF \ - umaddl x5, w5, w0, x5 __LF \ - add x7, x7, x5 __LF \ - adds x7, x7, x11, lsl #32 __LF \ - extr x3, x12, x11, #32 __LF \ - adcs x8, x8, x3 __LF \ - extr x3, x13, x12, #32 __LF \ - adcs x9, x9, x3 __LF \ - extr x3, x14, x13, #32 __LF \ - lsl x5, x0, #63 __LF \ - eor x10, x10, x5 __LF \ - adc x10, x10, x3 __LF \ - mov x3, #0x13 __LF \ - tst x10, #0x8000000000000000 __LF \ - csel x3, x3, xzr, pl __LF \ - subs x7, x7, x3 __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - and x10, x10, #0x7fffffffffffffff __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -#define sqr_p25519(P0,P1) \ - ldp x10, x11, [P1] __LF \ - ldp x12, x13, [P1+16] __LF \ - umull x2, w10, w10 __LF \ - lsr x14, x10, #32 __LF \ - umull x3, w14, w14 __LF \ - umull x14, w10, w14 __LF \ - adds x2, x2, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x3, x3, x14 __LF \ - umull x4, w11, w11 __LF \ - lsr x14, x11, #32 __LF \ - umull x5, w14, w14 __LF \ - umull x14, w11, w14 __LF \ - mul x15, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x4, x4, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x5, x5, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x5, x5, xzr __LF \ - adds x3, x3, x15 __LF \ - adcs x4, x4, x16 __LF \ - adc x5, x5, xzr __LF \ - umull x6, w12, w12 __LF \ - lsr x14, x12, #32 __LF \ - umull x7, w14, w14 __LF \ - umull x14, w12, w14 __LF \ - adds x6, x6, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x7, x7, x14 __LF \ - umull x8, w13, w13 __LF \ - lsr x14, x13, #32 __LF \ - umull x9, w14, w14 __LF \ - umull x14, w13, w14 __LF \ - mul x15, x12, x13 __LF \ - umulh x16, x12, x13 __LF \ - adds x8, x8, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x9, x9, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x9, x9, xzr __LF \ - adds x7, x7, x15 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, xzr __LF \ - subs x10, x10, x12 __LF \ - sbcs x11, x11, x13 __LF \ - csetm x16, cc __LF \ - eor x10, x10, x16 __LF \ - subs x10, x10, x16 __LF \ - eor x11, x11, x16 __LF \ - sbc x11, x11, x16 __LF \ - adds x6, x6, x4 __LF \ - adcs x7, x7, x5 __LF \ - adcs x8, x8, xzr __LF \ - adc x9, x9, xzr __LF \ - umull x12, w10, w10 __LF \ - lsr x5, x10, #32 __LF \ - umull x13, w5, w5 __LF \ - umull x5, w10, w5 __LF \ - adds x12, x12, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x13, x13, x5 __LF \ - umull x15, w11, w11 __LF \ - lsr x5, x11, #32 __LF \ - umull x14, w5, w5 __LF \ - umull x5, w11, w5 __LF \ - mul x4, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x15, x15, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x14, x14, x5 __LF \ - adds x4, x4, x4 __LF \ - adcs x16, x16, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x13, x13, x4 __LF \ - adcs x15, x15, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x4, x2, x6 __LF \ - adcs x5, x3, x7 __LF \ - adcs x6, x6, x8 __LF \ - adcs x7, x7, x9 __LF \ - csetm x16, cc __LF \ - subs x4, x4, x12 __LF \ - sbcs x5, x5, x13 __LF \ - sbcs x6, x6, x15 __LF \ - sbcs x7, x7, x14 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, x16 __LF \ - mov x10, #0x26 __LF \ - umull x12, w6, w10 __LF \ - add x12, x12, w2, uxtw __LF \ - lsr x2, x2, #32 __LF \ - lsr x6, x6, #32 __LF \ - umaddl x6, w6, w10, x2 __LF \ - mov x2, x12 __LF \ - umull x12, w7, w10 __LF \ - add x12, x12, w3, uxtw __LF \ - lsr x3, x3, #32 __LF \ - lsr x7, x7, #32 __LF \ - umaddl x7, w7, w10, x3 __LF \ - mov x3, x12 __LF \ - umull x12, w8, w10 __LF \ - add x12, x12, w4, uxtw __LF \ - lsr x4, x4, #32 __LF \ - lsr x8, x8, #32 __LF \ - umaddl x8, w8, w10, x4 __LF \ - mov x4, x12 __LF \ - umull x12, w9, w10 __LF \ - add x12, x12, w5, uxtw __LF \ - lsr x5, x5, #32 __LF \ - lsr x9, x9, #32 __LF \ - umaddl x9, w9, w10, x5 __LF \ - mov x5, x12 __LF \ - lsr x13, x9, #31 __LF \ - mov x11, #0x13 __LF \ - umaddl x11, w11, w13, x11 __LF \ - add x2, x2, x11 __LF \ - adds x2, x2, x6, lsl #32 __LF \ - extr x10, x7, x6, #32 __LF \ - adcs x3, x3, x10 __LF \ - extr x10, x8, x7, #32 __LF \ - adcs x4, x4, x10 __LF \ - extr x10, x9, x8, #32 __LF \ - lsl x11, x13, #63 __LF \ - eor x5, x5, x11 __LF \ - adc x5, x5, x10 __LF \ - mov x10, #0x13 __LF \ - tst x5, #0x8000000000000000 __LF \ - csel x10, x10, xzr, pl __LF \ - subs x2, x2, x10 __LF \ - sbcs x3, x3, xzr __LF \ - sbcs x4, x4, xzr __LF \ - sbc x5, x5, xzr __LF \ - and x5, x5, #0x7fffffffffffffff __LF \ - stp x2, x3, [P0] __LF \ - stp x4, x5, [P0+16] - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - umull x7, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x8, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x7, x7, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x8, x8, x15 __LF \ - adds x7, x7, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x8, x8, x16 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - umull x11, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x12, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x11, x11, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x12, x12, x15 __LF \ - adds x11, x11, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x12, x12, x16 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, cc __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, cc __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x9, cc __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, cc __LF \ - cinv x9, x9, cc __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #0x1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x3, #0x26 __LF \ - umull x4, w11, w3 __LF \ - add x4, x4, w7, uxtw __LF \ - lsr x7, x7, #32 __LF \ - lsr x11, x11, #32 __LF \ - umaddl x11, w11, w3, x7 __LF \ - mov x7, x4 __LF \ - umull x4, w12, w3 __LF \ - add x4, x4, w8, uxtw __LF \ - lsr x8, x8, #32 __LF \ - lsr x12, x12, #32 __LF \ - umaddl x12, w12, w3, x8 __LF \ - mov x8, x4 __LF \ - umull x4, w13, w3 __LF \ - add x4, x4, w9, uxtw __LF \ - lsr x9, x9, #32 __LF \ - lsr x13, x13, #32 __LF \ - umaddl x13, w13, w3, x9 __LF \ - mov x9, x4 __LF \ - umull x4, w14, w3 __LF \ - add x4, x4, w10, uxtw __LF \ - lsr x10, x10, #32 __LF \ - lsr x14, x14, #32 __LF \ - umaddl x14, w14, w3, x10 __LF \ - mov x10, x4 __LF \ - lsr x0, x14, #31 __LF \ - mov x5, #0x13 __LF \ - umull x5, w5, w0 __LF \ - add x7, x7, x5 __LF \ - adds x7, x7, x11, lsl #32 __LF \ - extr x3, x12, x11, #32 __LF \ - adcs x8, x8, x3 __LF \ - extr x3, x13, x12, #32 __LF \ - adcs x9, x9, x3 __LF \ - extr x3, x14, x13, #32 __LF \ - lsl x5, x0, #63 __LF \ - eor x10, x10, x5 __LF \ - adc x10, x10, x3 __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - ldp x10, x11, [P1] __LF \ - ldp x12, x13, [P1+16] __LF \ - umull x2, w10, w10 __LF \ - lsr x14, x10, #32 __LF \ - umull x3, w14, w14 __LF \ - umull x14, w10, w14 __LF \ - adds x2, x2, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x3, x3, x14 __LF \ - umull x4, w11, w11 __LF \ - lsr x14, x11, #32 __LF \ - umull x5, w14, w14 __LF \ - umull x14, w11, w14 __LF \ - mul x15, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x4, x4, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x5, x5, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x5, x5, xzr __LF \ - adds x3, x3, x15 __LF \ - adcs x4, x4, x16 __LF \ - adc x5, x5, xzr __LF \ - umull x6, w12, w12 __LF \ - lsr x14, x12, #32 __LF \ - umull x7, w14, w14 __LF \ - umull x14, w12, w14 __LF \ - adds x6, x6, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x7, x7, x14 __LF \ - umull x8, w13, w13 __LF \ - lsr x14, x13, #32 __LF \ - umull x9, w14, w14 __LF \ - umull x14, w13, w14 __LF \ - mul x15, x12, x13 __LF \ - umulh x16, x12, x13 __LF \ - adds x8, x8, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x9, x9, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x9, x9, xzr __LF \ - adds x7, x7, x15 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, xzr __LF \ - subs x10, x10, x12 __LF \ - sbcs x11, x11, x13 __LF \ - csetm x16, cc __LF \ - eor x10, x10, x16 __LF \ - subs x10, x10, x16 __LF \ - eor x11, x11, x16 __LF \ - sbc x11, x11, x16 __LF \ - adds x6, x6, x4 __LF \ - adcs x7, x7, x5 __LF \ - adcs x8, x8, xzr __LF \ - adc x9, x9, xzr __LF \ - umull x12, w10, w10 __LF \ - lsr x5, x10, #32 __LF \ - umull x13, w5, w5 __LF \ - umull x5, w10, w5 __LF \ - adds x12, x12, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x13, x13, x5 __LF \ - umull x15, w11, w11 __LF \ - lsr x5, x11, #32 __LF \ - umull x14, w5, w5 __LF \ - umull x5, w11, w5 __LF \ - mul x4, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x15, x15, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x14, x14, x5 __LF \ - adds x4, x4, x4 __LF \ - adcs x16, x16, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x13, x13, x4 __LF \ - adcs x15, x15, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x4, x2, x6 __LF \ - adcs x5, x3, x7 __LF \ - adcs x6, x6, x8 __LF \ - adcs x7, x7, x9 __LF \ - csetm x16, cc __LF \ - subs x4, x4, x12 __LF \ - sbcs x5, x5, x13 __LF \ - sbcs x6, x6, x15 __LF \ - sbcs x7, x7, x14 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, x16 __LF \ - mov x10, #0x26 __LF \ - umull x12, w6, w10 __LF \ - add x12, x12, w2, uxtw __LF \ - lsr x2, x2, #32 __LF \ - lsr x6, x6, #32 __LF \ - umaddl x6, w6, w10, x2 __LF \ - mov x2, x12 __LF \ - umull x12, w7, w10 __LF \ - add x12, x12, w3, uxtw __LF \ - lsr x3, x3, #32 __LF \ - lsr x7, x7, #32 __LF \ - umaddl x7, w7, w10, x3 __LF \ - mov x3, x12 __LF \ - umull x12, w8, w10 __LF \ - add x12, x12, w4, uxtw __LF \ - lsr x4, x4, #32 __LF \ - lsr x8, x8, #32 __LF \ - umaddl x8, w8, w10, x4 __LF \ - mov x4, x12 __LF \ - umull x12, w9, w10 __LF \ - add x12, x12, w5, uxtw __LF \ - lsr x5, x5, #32 __LF \ - lsr x9, x9, #32 __LF \ - umaddl x9, w9, w10, x5 __LF \ - mov x5, x12 __LF \ - lsr x13, x9, #31 __LF \ - mov x11, #0x13 __LF \ - umull x11, w11, w13 __LF \ - add x2, x2, x11 __LF \ - adds x2, x2, x6, lsl #32 __LF \ - extr x10, x7, x6, #32 __LF \ - adcs x3, x3, x10 __LF \ - extr x10, x8, x7, #32 __LF \ - adcs x4, x4, x10 __LF \ - extr x10, x9, x8, #32 __LF \ - lsl x11, x13, #63 __LF \ - eor x5, x5, x11 __LF \ - adc x5, x5, x10 __LF \ - stp x2, x3, [P0] __LF \ - stp x4, x5, [P0+16] - -// Plain 4-digit add without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result - -#define add_4(p0,p1,p2) \ - ldp x0, x1, [p1] __LF \ - ldp x4, x5, [p2] __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - ldp x2, x3, [p1+16] __LF \ - ldp x6, x7, [p2+16] __LF \ - adcs x2, x2, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [p0] __LF \ - stp x2, x3, [p0+16] - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(p0,p1,p2) \ - ldp x5, x6, [p1] __LF \ - ldp x4, x3, [p2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [p1+16] __LF \ - ldp x4, x3, [p2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x3, #19 __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - mov x4, #0x8000000000000000 __LF \ - sbc x8, x8, x4 __LF \ - stp x5, x6, [p0] __LF \ - stp x7, x8, [p0+16] - -// Modular addition with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(p0,p1,p2) \ - ldp x5, x6, [p1] __LF \ - ldp x4, x3, [p2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [p1+16] __LF \ - ldp x4, x3, [p2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [p0] __LF \ - stp x7, x8, [p0+16] - -// Combined z = c * x + y with reduction only < 2 * p_25519 -// where c is initially in the X1 register. It is assumed -// that 19 * (c * x + y) < 2^60 * 2^256 so we don't need a -// high mul in the final part. - -#define cmadd_4(p0,p2,p3) \ - ldp x7, x8, [p2] __LF \ - ldp x9, x10, [p2+16] __LF \ - mul x3, x1, x7 __LF \ - mul x4, x1, x8 __LF \ - mul x5, x1, x9 __LF \ - mul x6, x1, x10 __LF \ - umulh x7, x1, x7 __LF \ - umulh x8, x1, x8 __LF \ - umulh x9, x1, x9 __LF \ - umulh x10, x1, x10 __LF \ - adds x4, x4, x7 __LF \ - adcs x5, x5, x8 __LF \ - adcs x6, x6, x9 __LF \ - adc x10, x10, xzr __LF \ - ldp x7, x8, [p3] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x7, x8, [p3+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - adc x10, x10, xzr __LF \ - cmn x6, x6 __LF \ - bic x6, x6, #0x8000000000000000 __LF \ - adc x8, x10, x10 __LF \ - mov x9, #19 __LF \ - mul x7, x8, x9 __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [p0] __LF \ - stp x5, x6, [p0+16] - -// Multiplex: z := if NZ then x else y - -#define mux_4(p0,p1,p2) \ - ldp x0, x1, [p1] __LF \ - ldp x2, x3, [p2] __LF \ - csel x0, x0, x2, ne __LF \ - csel x1, x1, x3, ne __LF \ - stp x0, x1, [p0] __LF \ - ldp x0, x1, [p1+16] __LF \ - ldp x2, x3, [p2+16] __LF \ - csel x0, x0, x2, ne __LF \ - csel x1, x1, x3, ne __LF \ - stp x0, x1, [p0+16] - -S2N_BN_SYMBOL(curve25519_pxscalarmul): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x22) - CFI_PUSH2(x20,x21) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov res, x0 - mov scalar, x1 - mov point, x2 - -// Initialize (xn,zn) = (1,0) and (xm,zm) = (x,1) with swap = 0 - - mov x2, #1 - stp x2, xzr, [xn] - stp xzr, xzr, [xn+16] - stp xzr, xzr, [zn] - stp xzr, xzr, [zn+16] - ldp x0, x1, [x] - stp x0, x1, [xm] - ldp x0, x1, [x+16] - stp x0, x1, [xm+16] - ldp x0, x1, [x+32] - stp x2, xzr, [zm] - stp xzr, xzr, [zm+16] - mov swap, xzr - -// The outer loop from i = 255, ..., i = 0 (inclusive) - - mov i, #255 - -Lcurve25519_pxscalarmul_loop: - -// sm = xm + zm; sn = xn + zn; dm = xm - zm; dn = xn - zn -// The adds don't need any normalization as they're fed to muls -// Just make sure the subs fit in 4 digits - - sub_4(dm, xm, zm) - add_4(sn, xn, zn) - sub_4(dn, xn, zn) - add_4(sm, xm, zm) - -// ADDING: dmsn = dm * sn; dnsm = sm * dn -// DOUBLING: mux d = xt - zt and s = xt + zt for appropriate choice of (xt,zt) - - mul_4(dmsn,sn,dm) - - lsr x0, i, #6 - ldr x2, [scalar, x0, lsl #3] - lsr x2, x2, i - and x2, x2, #1 - - cmp swap, x2 - mov swap, x2 - - mux_4(d,dm,dn) - mux_4(s,sm,sn) - - mul_4(dnsm,sm,dn) - -// DOUBLING: d = (xt - zt)^2 normalized only to 4 digits - - sqr_4(d,d) - -// ADDING: dpro = (dmsn - dnsm)^2, spro = (dmsn + dnsm)^2 -// DOUBLING: s = (xt + zt)^2, normalized only to 4 digits - - sub_twice4(dpro,dmsn,dnsm) - sqr_4(s,s) - add_twice4(spro,dmsn,dnsm) - sqr_4(dpro,dpro) - -// DOUBLING: p = 4 * xt * zt = s - d - - sub_twice4(p,s,d) - -// ADDING: xm' = (dmsn + dnsm)^2 - - sqr_p25519(xm,spro) - -// DOUBLING: e = 121666 * p + d - - mov x1, 0xdb42 - orr x1, x1, 0x10000 - cmadd_4(e,p,d) - -// DOUBLING: xn' = (xt + zt)^2 * (xt - zt)^2 = s * d - - mul_p25519(xn,s,d) - -// ADDING: zm' = x * (dmsn - dnsm)^2 - - mul_p25519(zm,dpro,x) - -// DOUBLING: zn' = (4 * xt * zt) * ((xt - zt)^2 + 121666 * (4 * xt * zt)) -// = p * (d + 121666 * p) - - mul_p25519(zn,p,e) - -// Loop down as far as 0 (inclusive) - - subs i, i, #1 - bcs Lcurve25519_pxscalarmul_loop - -// The main loop does not handle the special input of the 2-torsion -// point = (0,0). In that case we may get a spurious (0,0) as output -// when we want (0,1) [for odd scalar] or (1,0) [for even scalar]. -// Test if x = 0 (this is equivalent for curve25519 to y = 0) and if -// so, patch zm = 1 [for odd multiple], xn = 1 [for even multiple]. - - ldp x0, x1, [point] - orr x0, x0, x1 - ldp x2, x3, [point, #16] - orr x2, x2, x3 - orr x0, x0, x2 - cmp x0, xzr - cset x0, eq - ldr x1, [zm] - orr x1, x1, x0 - str x1, [zm] - ldr x2, [xn] - orr x2, x2, x0 - str x2, [xn] - -// Multiplex into the final outputs - - cmp swap, xzr - - mux_4(resx,xm,xn) - mux_4(resz,zm,zn) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x20,x21) - CFI_POP2(x19,x22) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(curve25519_pxscalarmul) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_pxscalarmul_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_pxscalarmul_alt.S deleted file mode 100644 index 009278d4681..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_pxscalarmul_alt.S +++ /dev/null @@ -1,725 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Projective scalar multiplication, x coordinate only, for curve25519 -// Inputs scalar[4], point[4]; output res[8] -// -// extern void curve25519_pxscalarmul_alt -// (uint64_t res[static 8],const uint64_t scalar[static 4], -// const uint64_t point[static 4]); -// -// Given the X coordinate of an input point = (X,Y) on curve25519, which -// could also be part of a projective representation (X,Y,1) of the same -// point, returns a projective representation (X,Z) = scalar * point, where -// scalar is a 256-bit number. The corresponding affine form is (X/Z,Y'), -// X/Z meaning division modulo 2^255-19, and Y' not being computed by -// this function (nor is any Y coordinate of the input point used). -// -// Standard ARM ABI: X0 = res, X1 = scalar, X2 = point -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(curve25519_pxscalarmul_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(curve25519_pxscalarmul_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(curve25519_pxscalarmul_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence -// and additional registers for loop counter and swap flag - -#define res x17 -#define point x19 -#define scalar x20 -#define i x21 -#define swap x22 - -// Pointers to input x coord (we don't use y or z) and output coords. - -#define x point, #0 -#define resx res, #0 -#define resz res, #NUMSIZE - -// Pointer-offset pairs for temporaries on stack with some aliasing. - -#define zm sp, #(0*NUMSIZE) -#define sm sp, #(0*NUMSIZE) -#define dpro sp, #(0*NUMSIZE) - -#define sn sp, #(1*NUMSIZE) - -#define dm sp, #(2*NUMSIZE) - -#define zn sp, #(3*NUMSIZE) -#define dn sp, #(3*NUMSIZE) -#define e sp, #(3*NUMSIZE) - -#define dmsn sp, #(4*NUMSIZE) -#define p sp, #(4*NUMSIZE) - -#define xm sp, #(5*NUMSIZE) -#define dnsm sp, #(5*NUMSIZE) -#define spro sp, #(5*NUMSIZE) - -#define xn sp, #(6*NUMSIZE) -#define s sp, #(6*NUMSIZE) - -#define d sp, #(7*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 8*NUMSIZE - -// Macros wrapping up the basic field operations bignum_mul_p25519_alt -// and bignum_sqr_p25519_alt, only trivially different from pure function -// call to those subroutines. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - orr x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - madd x11, x7, x8, x7 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adcs x15, x15, xzr __LF \ - csel x7, x7, xzr, cc __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x15, x15, xzr __LF \ - and x15, x15, #0x7fffffffffffffff __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -#define sqr_p25519(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x7, x2, x4 __LF \ - umulh x6, x2, x4 __LF \ - adds x10, x10, x7 __LF \ - adcs x11, x11, x6 __LF \ - mul x7, x3, x4 __LF \ - umulh x6, x3, x4 __LF \ - adc x6, x6, xzr __LF \ - adds x11, x11, x7 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x6 __LF \ - mul x7, x3, x5 __LF \ - umulh x6, x3, x5 __LF \ - adc x6, x6, xzr __LF \ - adds x12, x12, x7 __LF \ - adcs x13, x13, x6 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x6, cs __LF \ - umulh x7, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x7 __LF \ - mul x7, x3, x3 __LF \ - adcs x10, x10, x7 __LF \ - umulh x7, x3, x3 __LF \ - adcs x11, x11, x7 __LF \ - mul x7, x4, x4 __LF \ - adcs x12, x12, x7 __LF \ - umulh x7, x4, x4 __LF \ - adcs x13, x13, x7 __LF \ - mul x7, x5, x5 __LF \ - adcs x14, x14, x7 __LF \ - umulh x7, x5, x5 __LF \ - adc x6, x6, x7 __LF \ - mov x3, #0x26 __LF \ - mul x7, x3, x12 __LF \ - umulh x4, x3, x12 __LF \ - adds x8, x8, x7 __LF \ - mul x7, x3, x13 __LF \ - umulh x13, x3, x13 __LF \ - adcs x9, x9, x7 __LF \ - mul x7, x3, x14 __LF \ - umulh x14, x3, x14 __LF \ - adcs x10, x10, x7 __LF \ - mul x7, x3, x6 __LF \ - umulh x6, x3, x6 __LF \ - adcs x11, x11, x7 __LF \ - cset x12, cs __LF \ - adds x11, x11, x14 __LF \ - adc x12, x12, x6 __LF \ - cmn x11, x11 __LF \ - orr x11, x11, #0x8000000000000000 __LF \ - adc x2, x12, x12 __LF \ - mov x3, #0x13 __LF \ - madd x7, x3, x2, x3 __LF \ - adds x8, x8, x7 __LF \ - adcs x9, x9, x4 __LF \ - adcs x10, x10, x13 __LF \ - adcs x11, x11, xzr __LF \ - csel x3, x3, xzr, cc __LF \ - subs x8, x8, x3 __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbc x11, x11, xzr __LF \ - and x11, x11, #0x7fffffffffffffff __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] __LF \ - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - bic x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - mul x11, x7, x8 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adc x15, x15, xzr __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x7, x2, x4 __LF \ - umulh x6, x2, x4 __LF \ - adds x10, x10, x7 __LF \ - adcs x11, x11, x6 __LF \ - mul x7, x3, x4 __LF \ - umulh x6, x3, x4 __LF \ - adc x6, x6, xzr __LF \ - adds x11, x11, x7 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x6 __LF \ - mul x7, x3, x5 __LF \ - umulh x6, x3, x5 __LF \ - adc x6, x6, xzr __LF \ - adds x12, x12, x7 __LF \ - adcs x13, x13, x6 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x6, cs __LF \ - umulh x7, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x7 __LF \ - mul x7, x3, x3 __LF \ - adcs x10, x10, x7 __LF \ - umulh x7, x3, x3 __LF \ - adcs x11, x11, x7 __LF \ - mul x7, x4, x4 __LF \ - adcs x12, x12, x7 __LF \ - umulh x7, x4, x4 __LF \ - adcs x13, x13, x7 __LF \ - mul x7, x5, x5 __LF \ - adcs x14, x14, x7 __LF \ - umulh x7, x5, x5 __LF \ - adc x6, x6, x7 __LF \ - mov x3, #0x26 __LF \ - mul x7, x3, x12 __LF \ - umulh x4, x3, x12 __LF \ - adds x8, x8, x7 __LF \ - mul x7, x3, x13 __LF \ - umulh x13, x3, x13 __LF \ - adcs x9, x9, x7 __LF \ - mul x7, x3, x14 __LF \ - umulh x14, x3, x14 __LF \ - adcs x10, x10, x7 __LF \ - mul x7, x3, x6 __LF \ - umulh x6, x3, x6 __LF \ - adcs x11, x11, x7 __LF \ - cset x12, cs __LF \ - adds x11, x11, x14 __LF \ - adc x12, x12, x6 __LF \ - cmn x11, x11 __LF \ - bic x11, x11, #0x8000000000000000 __LF \ - adc x2, x12, x12 __LF \ - mov x3, #0x13 __LF \ - mul x7, x3, x2 __LF \ - adds x8, x8, x7 __LF \ - adcs x9, x9, x4 __LF \ - adcs x10, x10, x13 __LF \ - adc x11, x11, xzr __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Plain 4-digit add without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result - -#define add_4(p0,p1,p2) \ - ldp x0, x1, [p1] __LF \ - ldp x4, x5, [p2] __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - ldp x2, x3, [p1+16] __LF \ - ldp x6, x7, [p2+16] __LF \ - adcs x2, x2, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [p0] __LF \ - stp x2, x3, [p0+16] - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(p0,p1,p2) \ - ldp x5, x6, [p1] __LF \ - ldp x4, x3, [p2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [p1+16] __LF \ - ldp x4, x3, [p2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x3, #19 __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - mov x4, #0x8000000000000000 __LF \ - sbc x8, x8, x4 __LF \ - stp x5, x6, [p0] __LF \ - stp x7, x8, [p0+16] - -// Modular addition with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(p0,p1,p2) \ - ldp x5, x6, [p1] __LF \ - ldp x4, x3, [p2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [p1+16] __LF \ - ldp x4, x3, [p2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [p0] __LF \ - stp x7, x8, [p0+16] - -// Combined z = c * x + y with reduction only < 2 * p_25519 -// where c is initially in the X1 register. It is assumed -// that 19 * (c * x + y) < 2^60 * 2^256 so we don't need a -// high mul in the final part. - -#define cmadd_4(p0,p2,p3) \ - ldp x7, x8, [p2] __LF \ - ldp x9, x10, [p2+16] __LF \ - mul x3, x1, x7 __LF \ - mul x4, x1, x8 __LF \ - mul x5, x1, x9 __LF \ - mul x6, x1, x10 __LF \ - umulh x7, x1, x7 __LF \ - umulh x8, x1, x8 __LF \ - umulh x9, x1, x9 __LF \ - umulh x10, x1, x10 __LF \ - adds x4, x4, x7 __LF \ - adcs x5, x5, x8 __LF \ - adcs x6, x6, x9 __LF \ - adc x10, x10, xzr __LF \ - ldp x7, x8, [p3] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x7, x8, [p3+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - adc x10, x10, xzr __LF \ - cmn x6, x6 __LF \ - bic x6, x6, #0x8000000000000000 __LF \ - adc x8, x10, x10 __LF \ - mov x9, #19 __LF \ - mul x7, x8, x9 __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [p0] __LF \ - stp x5, x6, [p0+16] - -// Multiplex: z := if NZ then x else y - -#define mux_4(p0,p1,p2) \ - ldp x0, x1, [p1] __LF \ - ldp x2, x3, [p2] __LF \ - csel x0, x0, x2, ne __LF \ - csel x1, x1, x3, ne __LF \ - stp x0, x1, [p0] __LF \ - ldp x0, x1, [p1+16] __LF \ - ldp x2, x3, [p2+16] __LF \ - csel x0, x0, x2, ne __LF \ - csel x1, x1, x3, ne __LF \ - stp x0, x1, [p0+16] - -S2N_BN_SYMBOL(curve25519_pxscalarmul_alt): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x22) - CFI_PUSH2(x20,x21) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov res, x0 - mov scalar, x1 - mov point, x2 - -// Initialize (xn,zn) = (1,0) and (xm,zm) = (x,1) with swap = 0 - - mov x2, #1 - stp x2, xzr, [xn] - stp xzr, xzr, [xn+16] - stp xzr, xzr, [zn] - stp xzr, xzr, [zn+16] - ldp x0, x1, [x] - stp x0, x1, [xm] - ldp x0, x1, [x+16] - stp x0, x1, [xm+16] - ldp x0, x1, [x+32] - stp x2, xzr, [zm] - stp xzr, xzr, [zm+16] - mov swap, xzr - -// The outer loop from i = 255, ..., i = 0 (inclusive) - - mov i, #255 - -Lcurve25519_pxscalarmul_alt_loop: - -// sm = xm + zm; sn = xn + zn; dm = xm - zm; dn = xn - zn -// The adds don't need any normalization as they're fed to muls -// Just make sure the subs fit in 4 digits - - sub_4(dm, xm, zm) - add_4(sn, xn, zn) - sub_4(dn, xn, zn) - add_4(sm, xm, zm) - -// ADDING: dmsn = dm * sn; dnsm = sm * dn -// DOUBLING: mux d = xt - zt and s = xt + zt for appropriate choice of (xt,zt) - - mul_4(dmsn,sn,dm) - - lsr x0, i, #6 - ldr x2, [scalar, x0, lsl #3] - lsr x2, x2, i - and x2, x2, #1 - - cmp swap, x2 - mov swap, x2 - - mux_4(d,dm,dn) - mux_4(s,sm,sn) - - mul_4(dnsm,sm,dn) - -// DOUBLING: d = (xt - zt)^2 normalized only to 4 digits - - sqr_4(d,d) - -// ADDING: dpro = (dmsn - dnsm)^2, spro = (dmsn + dnsm)^2 -// DOUBLING: s = (xt + zt)^2, normalized only to 4 digits - - sub_twice4(dpro,dmsn,dnsm) - sqr_4(s,s) - add_twice4(spro,dmsn,dnsm) - sqr_4(dpro,dpro) - -// DOUBLING: p = 4 * xt * zt = s - d - - sub_twice4(p,s,d) - -// ADDING: xm' = (dmsn + dnsm)^2 - - sqr_p25519(xm,spro) - -// DOUBLING: e = 121666 * p + d - - mov x1, 0xdb42 - orr x1, x1, 0x10000 - cmadd_4(e,p,d) - -// DOUBLING: xn' = (xt + zt)^2 * (xt - zt)^2 = s * d - - mul_p25519(xn,s,d) - -// ADDING: zm' = x * (dmsn - dnsm)^2 - - mul_p25519(zm,dpro,x) - -// DOUBLING: zn' = (4 * xt * zt) * ((xt - zt)^2 + 121666 * (4 * xt * zt)) -// = p * (d + 121666 * p) - - mul_p25519(zn,p,e) - -// Loop down as far as 0 (inclusive) - - subs i, i, #1 - bcs Lcurve25519_pxscalarmul_alt_loop - -// The main loop does not handle the special input of the 2-torsion -// point = (0,0). In that case we may get a spurious (0,0) as output -// when we want (0,1) [for odd scalar] or (1,0) [for even scalar]. -// Test if x = 0 (this is equivalent for curve25519 to y = 0) and if -// so, patch zm = 1 [for odd multiple], xn = 1 [for even multiple]. - - ldp x0, x1, [point] - orr x0, x0, x1 - ldp x2, x3, [point, #16] - orr x2, x2, x3 - orr x0, x0, x2 - cmp x0, xzr - cset x0, eq - ldr x1, [zm] - orr x1, x1, x0 - str x1, [zm] - ldr x2, [xn] - orr x2, x2, x0 - str x2, [xn] - -// Multiplex into the final outputs - - cmp swap, xzr - - mux_4(resx,xm,xn) - mux_4(resz,zm,zn) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x20,x21) - CFI_POP2(x19,x22) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(curve25519_pxscalarmul_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519.S deleted file mode 100644 index af71959e8a4..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519.S +++ /dev/null @@ -1,2596 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ********************************************************************** -// This code is substantially derived from Emil Lenngren's implementation -// -// https://github.com/Emill/X25519-AArch64/blob/master/X25519_AArch64.pdf -// https://github.com/Emill/X25519-AArch64 -// -// and the SLOTHY-based re-engineering of that code by Abdulrahman, Becker, -// Kannwischer and Klein: -// -// https://eprint.iacr.org/2022/1303.pdf -// https://github.com/slothy-optimizer/slothy/tree/main/paper -// ********************************************************************** - -// ---------------------------------------------------------------------------- -// The x25519 function for curve25519 -// Inputs scalar[4], point[4]; output res[4] -// -// extern void curve25519_x25519 -// (uint64_t res[static 4],const uint64_t scalar[static 4], -// const uint64_t point[static 4]); -// -// Given a scalar n and the X coordinate of an input point P = (X,Y) on -// curve25519 (Y can live in any extension field of characteristic 2^255-19), -// this returns the X coordinate of n * P = (X, Y), or 0 when n * P is the -// point at infinity. Both n and X inputs are first slightly modified/mangled -// as specified in the relevant RFC (https://www.rfc-editor.org/rfc/rfc7748); -// in particular the lower three bits of n are set to zero. Does not implement -// the zero-check specified in Section 6.1. -// -// Standard ARM ABI: X0 = res, X1 = scalar, X2 = point -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(curve25519_x25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(curve25519_x25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(curve25519_x25519) - - .text - .balign 4 - -// Pointer-offset pairs for temporaries on stack - -#define scalar sp, #0 -#define pointx sp, #32 -#define mask1 sp, #72 -#define mask2 sp, #80 -#define tmpa sp, #88 -#define tmpb sp, #128 -#define xn sp, #128 -#define zn sp, #160 - -#define res sp, #192 -#define i sp, #200 -#define swap sp, #208 - -// Total size to reserve on the stack - -#define NSPACE 224 -#define regsave sp, #NSPACE - -S2N_BN_SYMBOL(curve25519_x25519): - CFI_START - -// Save registers and make additional room #NSPACE for temporaries. -// We only need to save the low 64-bits of the Q8...Q15 registers -// according to the ABI, so we use a save of the D8...D15 forms. - - CFI_DEC_SP(NSPACE+160) - CFI_STACKSAVE2(d8,d9,NSPACE+0) - CFI_STACKSAVE2(d10,d11,NSPACE+16) - CFI_STACKSAVE2(d12,d13,NSPACE+32) - CFI_STACKSAVE2(d14,d15,NSPACE+48) - CFI_STACKSAVE2(x19,x20,NSPACE+64) - CFI_STACKSAVE2(x21,x22,NSPACE+80) - CFI_STACKSAVE2(x23,x24,NSPACE+96) - CFI_STACKSAVE2(x25,x26,NSPACE+112) - CFI_STACKSAVE2(x27,x28,NSPACE+128) - CFI_STACKSAVE2(x29,x30,NSPACE+144) - -// Move the output pointer to a stable place - - str x0, [res] - -// Copy the scalar to the corresponding local variable while -// mangling it. In principle it becomes 01xxx...xxx000 where -// the xxx are the corresponding bits of the original input -// scalar. We actually don't bother forcing the MSB to zero, -// but rather start the main loop below at 254 instead of 255. - - ldp x10, x11, [x1] - bic x10, x10, #7 - stp x10, x11, [scalar] - ldp x12, x13, [x1, #16] - orr x13, x13, #0x4000000000000000 - stp x12, x13, [scalar+16] - -// Discard the MSB of the point X coordinate (this is in -// accordance with the RFC, mod 2^255, *not* 2^255-19). -// Then recode it into the unsaturated base 25.5 form. - - ldp x0, x1, [x2] - ldp x2, x3, [x2, #16] - - lsr x12, x0, #51 - lsr x17, x2, #51 - orr x12, x12, x1, lsl #13 - orr x17, x17, x3, lsl #13 - ubfx x8, x3, #12, #26 - ubfx x9, x3, #38, #25 - ubfx x11, x0, #26, #25 - ubfx x13, x1, #13, #25 - lsr x14, x1, #38 - ubfx x16, x2, #25, #26 - and x10, x0, #0x3ffffff - and x12, x12, #0x3ffffff - and x15, x2, #0x1ffffff - and x17, x17, #0x1ffffff - orr x10, x10, x11, lsl #32 - orr x11, x12, x13, lsl #32 - orr x12, x14, x15, lsl #32 - orr x13, x16, x17, lsl #32 - orr x14, x8, x9, lsl #32 - - stp x10, x11, [pointx+0] - stp x12, x13, [pointx+16] - str x14, [pointx+32] - -// Initialize (X2,Z2) = (1,0), the identity (projective point at infinity) - - mov x1, #1 - mov v0.d[0], x1 - mov v2.d[0], xzr - mov v4.d[0], xzr - mov v6.d[0], xzr - mov v8.d[0], xzr - - mov v1.d[0], xzr - mov v3.d[0], xzr - mov v5.d[0], xzr - mov v7.d[0], xzr - mov v9.d[0], xzr - -// Initialize (X3,Z3) = (X,1), projective representation of X - - mov v10.d[0], x10 - mov v12.d[0], x11 - mov v14.d[0], x12 - mov v16.d[0], x13 - mov v18.d[0], x14 - - mov v11.d[0], x1 - mov v13.d[0], xzr - mov v15.d[0], xzr - mov v17.d[0], xzr - mov v19.d[0], xzr - -// Set up some constants used repeatedly in the main loop: -// -// Q31 = 0x1300000013 (two 32-bit copies of 19) -// Q30 = 0x3ffffff0000000003ffffff (two 64-bit copies of 2^26-1) -// Q29 = mask1 = (0x07ffffc,0x07fffffe) -// Q28 = mask2 = (0x07ffffb4,0x07fffffe) - - mov w0, #19 - add x0, x0, x0, lsl #32 - mov v31.d[0], x0 - mov v31.d[1], xzr - - mov x0, #67108863 // #(1<<26)-1 - mov v30.d[0], x0 - mov v30.d[1], x0 - - mov x0, #0x07fffffe07fffffe - sub x1, x0, #74 // #0xfe-0xb4 - sub x0, x0, #2 - - stp x0, x1, [mask1] - ldp d29, d28, [mask1] - -// The main loop over (modified) bits from i = 254, ..., i = 0 (inclusive); -// we explicitly skip bit 255 because it should be forced to zero initially. -// This is a classic Montgomery ladder using a "swap" variable. -// It's assumed x0 = i at the start of the loop, but that is volatile and -// needs to be reloaded from memory at the end of the loop. - - str xzr, [swap] - mov x0, #254 - str x0, [i] - -Lcurve25519_x25519_scalarloop: - - lsr x1, x0, #6 - ldr x2, [sp, x1, lsl #3] // Exploiting scalar = sp exactly - lsr x2, x2, x0 - and x2, x2, #1 - - ldr x0, [swap] - cmp x0, x2 - str x2, [swap] - -// The following inner loop code is derived closely following Lenngren's -// implementation available at "https://github.com/Emill/X25519-AArch64". -// In particular, the basic dataflow and the organization between integer -// and SIMD units is identical, with only a few minor changes to some -// individual instructions (for miscellaneous reasons). The scheduling -// was redone from scratch by SLOTHY starting from the un-interleaved -// form in the SLOTHY work cited above, and using the same scripts. -// -// The intermediate value annotations were added to provide data that -// is used in the formal proof, indicating which lines assign specific -// digits of the various intermediate results (mainly of field -// operations, sometimes other transformations). The names used for -// the intermediate results are similar but not identical to those in -// the abstract Algorithm 1 description in Lenngren's paper. Almost -// all equations are to be interpreted as field operations, i.e. as -// arithmetic modulo 2^255-19, not simple numeric equalities. -// -// b = x2 - z2 -// d = x3 - z3 -// a = x2 + z2 -// c = x3 + z3 -// f = if flip then c else a -// g = if flip then d else b -// aa = f^2 -// bb = g^2 -// bbalt = bb (change of representation) -// e = aa - bb -// bce = bbalt + 121666 * e -// z4 = bce * e -// bc = b * c -// ad = a * d -// t1 = ad + bc -// t2 = ad - bc -// x5 = t1^2 -// t3 = t2^2 -// x4 = aa * bb -// z5 = x * t3 -// -// Then the main variables are updated for the next iteration as -// -// (x2',z2') = (x4,z4) -// (x3',z3') = (x5,z5) - - add v22.2s, v2.2s, v3.2s // ubignum_of_qreglist 1 // INTERMEDIATE a - sub v21.2s, v28.2s, v1.2s - add v25.2s, v0.2s, v1.2s // ubignum_of_qreglist 0 // INTERMEDIATE a - sub v24.2s, v29.2s, v3.2s - add v3.2s, v18.2s, v19.2s // ubignum_of_qreglist 4 // INTERMEDIATE c - add v0.2s, v0.2s, v21.2s // ubignum_of_qreglist 0 // INTERMEDIATE b - sub v20.2s, v29.2s, v15.2s - sub v1.2s, v29.2s, v5.2s - sub v26.2s, v28.2s, v11.2s - sub v21.2s, v29.2s, v19.2s - add v19.2s, v10.2s, v11.2s // ubignum_of_qreglist 0 // INTERMEDIATE c - add v11.2s, v14.2s, v20.2s // ubignum_of_qreglist 2 // INTERMEDIATE d - add v21.2s, v18.2s, v21.2s // ubignum_of_qreglist 4 // INTERMEDIATE d - sub v20.2s, v29.2s, v17.2s - add v18.2s, v2.2s, v24.2s // ubignum_of_qreglist 1 // INTERMEDIATE b - add v14.2s, v14.2s, v15.2s // ubignum_of_qreglist 2 // INTERMEDIATE c - add v15.2s, v16.2s, v17.2s // ubignum_of_qreglist 3 // INTERMEDIATE c - add v2.2s, v16.2s, v20.2s // ubignum_of_qreglist 3 // INTERMEDIATE d - add v24.2s, v12.2s, v13.2s // ubignum_of_qreglist 1 // INTERMEDIATE c - add v26.2s, v10.2s, v26.2s // ubignum_of_qreglist 0 // INTERMEDIATE d - sub v10.2s, v29.2s, v13.2s - sub v13.2s, v29.2s, v7.2s - add v23.2s, v6.2s, v7.2s // ubignum_of_qreglist 3 // INTERMEDIATE a - sub v7.2s, v29.2s, v9.2s - add v27.2s, v12.2s, v10.2s // ubignum_of_qreglist 1 // INTERMEDIATE d - fcsel d20, d22, d24, eq // ubignum_of_qreglist 1 // INTERMEDIATE f - add v28.2s, v4.2s, v5.2s // ubignum_of_qreglist 2 // INTERMEDIATE a - fcsel d12, d23, d15, eq // ubignum_of_qreglist 3 // INTERMEDIATE f - add v7.2s, v8.2s, v7.2s // ubignum_of_qreglist 4 // INTERMEDIATE b - fcsel d16, d25, d19, eq // ubignum_of_qreglist 0 // INTERMEDIATE f - mov x0, v20.d[0] - fcsel d5, d28, d14, eq // ubignum_of_qreglist 2 // INTERMEDIATE f - mov x21, v12.d[0] - fcsel d29, d7, d21, eq // ubignum_of_qreglist 4 // INTERMEDIATE g - mov x5, v16.d[0] - lsr x26, x0, #32 - add x29, x21, x21 - umull x15, w5, w29 - add v13.2s, v6.2s, v13.2s // ubignum_of_qreglist 3 // INTERMEDIATE b - add x12, x26, x26 - mov x30, v5.d[0] - fcsel d10, d18, d27, eq // ubignum_of_qreglist 1 // INTERMEDIATE g - lsr x11, x5, #32 - lsr x10, x30, #32 - trn2 v20.2s, v21.2s, v3.2s - add v9.2s, v8.2s, v9.2s // ubignum_of_qreglist 4 // INTERMEDIATE a - add x14, x11, x11 - trn2 v6.2s, v2.2s, v15.2s - trn1 v12.2s, v25.2s, v0.2s - add v1.2s, v4.2s, v1.2s // ubignum_of_qreglist 2 // INTERMEDIATE b - trn1 v16.2s, v23.2s, v13.2s - fcsel d8, d13, d2, eq // ubignum_of_qreglist 3 // INTERMEDIATE g - trn2 v17.2s, v27.2s, v24.2s - str d29, [tmpb+32] - add x17, x10, x10 - trn2 v4.2s, v28.2s, v1.2s - trn1 v5.2s, v28.2s, v1.2s - trn1 v28.2s, v2.2s, v15.2s - trn1 v2.2s, v22.2s, v18.2s - fcsel d29, d0, d26, eq // ubignum_of_qreglist 0 // INTERMEDIATE g - trn2 v15.2s, v22.2s, v18.2s - umull v22.2d, v12.2s, v20.2s - umull x22, w30, w17 - stp d29, d10, [tmpb+0] - trn2 v10.2s, v23.2s, v13.2s - trn2 v23.2s, v11.2s, v14.2s - trn1 v13.2s, v27.2s, v24.2s - fcsel d27, d1, d11, eq // ubignum_of_qreglist 2 // INTERMEDIATE g - trn1 v14.2s, v11.2s, v14.2s - umlal v22.2d, v2.2s, v6.2s - umull x25, w30, w30 - umlal v22.2d, v5.2s, v23.2s - add x3, x30, x30 - umlal v22.2d, v16.2s, v17.2s - add w30, w21, w21, lsl #1; - stp d27, d8, [tmpb+16] - add w30, w30, w21, lsl #4 - trn1 v11.2s, v26.2s, v19.2s - trn2 v8.2s, v26.2s, v19.2s - trn2 v19.2s, v25.2s, v0.2s - mul v29.2s, v20.2s, v31.2s - ldr x20, [tmpb+24] - umull v25.2d, v19.2s, v6.2s - add x1, x0, x0 - umull v27.2d, v19.2s, v23.2s - umull x9, w5, w1 - umull v0.2d, v12.2s, v23.2s - lsr x24, x20, #32 - mul v20.2s, v23.2s, v31.2s - lsr x16, x21, #32 - umlal v25.2d, v15.2s, v23.2s - umaddl x13, w11, w14, x9 - umlal v25.2d, v4.2s, v17.2s - umaddl x9, w14, w17, x15 - umull v24.2d, v12.2s, v6.2s - add w2, w16, w16, lsl #1; - fcsel d26, d9, d3, eq // ubignum_of_qreglist 4 // INTERMEDIATE f - add w2, w2, w16, lsl #4 - trn1 v18.2s, v21.2s, v3.2s - umull v3.2d, v19.2s, v29.2s - umull x28, w5, w3 - mul v1.2s, v6.2s, v31.2s - umull x8, w5, w5 - umlal v24.2d, v2.2s, v23.2s - umaddl x13, w21, w30, x13 - mul v23.2s, v17.2s, v31.2s - umaddl x27, w14, w12, x28 - trn2 v6.2s, v9.2s, v7.2s - mov x6, v26.d[0] - umlal v3.2d, v15.2s, v1.2s - add x16, x16, x16 - umlal v3.2d, v4.2s, v20.2s - lsr x4, x6, #32 - umlal v3.2d, v10.2s, v23.2s - add x7, x6, x6 - umull v26.2d, v19.2s, v8.2s - add x23, x4, x4 - umaddl x28, w5, w23, x22 - trn1 v7.2s, v9.2s, v7.2s - umlal v27.2d, v15.2s, v17.2s - add w15, w4, w4, lsl #1; - umlal v27.2d, v4.2s, v8.2s - add w15, w15, w4, lsl #4 - add w22, w10, w10, lsl #1; - umlal v24.2d, v5.2s, v17.2s - add w22, w22, w10, lsl #4 - umaddl x10, w11, w7, x28 - umlal v25.2d, v10.2s, v8.2s - umull x21, w5, w16 - umlal v25.2d, v6.2s, v29.2s - umaddl x23, w15, w23, x25 - umlal v27.2d, v10.2s, v29.2s - umull x19, w5, w12 - umlal v27.2d, v6.2s, v1.2s - umaddl x25, w11, w29, x21 - umlal v0.2d, v2.2s, v17.2s - umaddl x28, w0, w3, x9 - shl v21.2d, v25.2d, #1 - umaddl x4, w11, w1, x19 - umaddl x21, w2, w29, x4 - mul v25.2s, v8.2s, v31.2s - umlal v24.2d, v16.2s, v8.2s - umaddl x19, w0, w17, x25 - umlal v24.2d, v7.2s, v29.2s - umull x25, w5, w17 - umlal v24.2d, v19.2s, v28.2s - umaddl x4, w0, w16, x10 - umull v9.2d, v12.2s, v8.2s - umaddl x23, w5, w7, x23 - umlal v21.2d, v12.2s, v18.2s - add w10, w6, w6, lsl #1; - shl v27.2d, v27.2d, #1 - add w10, w10, w6, lsl #4 - umaddl x28, w26, w12, x28 - umlal v26.2d, v15.2s, v29.2s - umaddl x9, w14, w16, x23 - umlal v9.2d, v2.2s, v29.2s - umaddl x22, w22, w17, x8 - umlal v21.2d, v2.2s, v28.2s - umaddl x28, w6, w10, x28 - umaddl x27, w0, w0, x27 - add x8, x14, x14 - umlal v0.2d, v5.2s, v8.2s - umull x5, w5, w14 - umlal v9.2d, v5.2s, v1.2s - umaddl x14, w0, w29, x9 - umlal v26.2d, v4.2s, v1.2s - umaddl x6, w2, w16, x27 - umlal v22.2d, v7.2s, v8.2s - umaddl x5, w30, w17, x5 - umaddl x5, w2, w3, x5 - add x23, x17, x17 - umlal v27.2d, v12.2s, v28.2s - umaddl x13, w2, w23, x13 - umlal v26.2d, v10.2s, v20.2s - add x9, x12, x12 - umlal v9.2d, v16.2s, v20.2s - umaddl x27, w10, w29, x6 - umlal v0.2d, v16.2s, v29.2s - umaddl x6, w11, w3, x25 - umlal v22.2d, v19.2s, v18.2s - umaddl x19, w26, w3, x19 - mul v18.2s, v18.2s, v31.2s - umaddl x23, w15, w23, x27 - umlal v3.2d, v6.2s, v25.2s - umaddl x0, w0, w12, x6 - umlal v0.2d, v7.2s, v1.2s - add x11, x16, x16 - umlal v9.2d, v7.2s, v23.2s - umaddl x6, w12, w17, x14 - umlal v9.2d, v19.2s, v11.2s - umaddl x25, w26, w29, x4 - umlal v9.2d, v15.2s, v18.2s - umaddl x14, w10, w3, x13 - umull v25.2d, v12.2s, v17.2s - umaddl x27, w10, w16, x0 - umlal v26.2d, v6.2s, v23.2s - add x0, x25, x6, lsr #26 - mul v23.2s, v28.2s, v31.2s - umaddl x12, w10, w12, x5 - shl v3.2d, v3.2d, #1 - add x16, x22, x0, lsr #25 - umlal v21.2d, v5.2s, v14.2s - bic x22, x0, #0x1ffffff - umlal v3.2d, v12.2s, v11.2s - add x26, x16, x22, lsr #24 - umlal v3.2d, v2.2s, v18.2s - umaddl x16, w10, w17, x21 - umlal v3.2d, v5.2s, v23.2s - add x22, x26, x22, lsr #21 - umlal v9.2d, v4.2s, v23.2s - umaddl x5, w15, w29, x27 - umull v17.2d, v19.2s, v17.2s - umaddl x17, w30, w3, x22 - umlal v25.2d, v2.2s, v8.2s - umaddl x25, w15, w3, x16 - umlal v25.2d, v5.2s, v29.2s - umaddl x26, w15, w7, x19 - umlal v0.2d, v19.2s, v14.2s - umaddl x17, w2, w9, x17 - umlal v17.2d, v15.2s, v8.2s - ldr x19, [tmpb+0] - umlal v17.2d, v4.2s, v29.2s - ldr x7, [tmpb+8] - shl v29.2d, v26.2d, #1 - umaddl x13, w10, w1, x17 - umlal v0.2d, v15.2s, v13.2s - lsr x2, x19, #32 - umlal v29.2d, v12.2s, v13.2s - umaddl x27, w15, w1, x12 - umlal v29.2d, v2.2s, v11.2s - umaddl x30, w15, w8, x13 - umlal v29.2d, v5.2s, v18.2s - add x4, x7, x7 - umlal v29.2d, v16.2s, v23.2s - umaddl x29, w15, w9, x14 - umlal v0.2d, v4.2s, v11.2s - add x17, x27, x30, lsr #26 - umlal v0.2d, v10.2s, v18.2s - umaddl x16, w15, w11, x28 - umlal v0.2d, v6.2s, v23.2s - add x1, x29, x17, lsr #25 - umlal v25.2d, v16.2s, v1.2s - umull x11, w19, w4 - ldr x8, [tmpb+32] - mul v26.2s, v14.2s, v31.2s - umlal v17.2d, v10.2s, v1.2s - ldr x15, [tmpb+16] - umlal v17.2d, v6.2s, v20.2s - and x9, x30, #0x3ffffff - bfi x9, x17, #32, #25 // ubignum_of_preglist 0 // INTERMEDIATE aa - add x17, x2, x2 - lsr x10, x15, #32 - add x27, x25, x1, lsr #26 - umlal v25.2d, v7.2s, v20.2s - add x13, x10, x10 - umlal v25.2d, v19.2s, v13.2s - add x29, x23, x27, lsr #25 - umlal v25.2d, v15.2s, v11.2s - lsr x30, x8, #32 - umlal v25.2d, v4.2s, v18.2s - add x23, x5, x29, lsr #26 - umlal v25.2d, v10.2s, v23.2s - and x14, x29, #0x3ffffff - umlal v25.2d, v6.2s, v26.2s - add x5, x16, x23, lsr #25 - shl v8.2d, v17.2d, #1 - umaddl x12, w2, w17, x11 - and x29, x5, #0x3ffffff - umull x21, w19, w19 - umlal v29.2d, v7.2s, v26.2s - add w16, w10, w10, lsl #1; - umlal v3.2d, v16.2s, v26.2s - add w16, w16, w10, lsl #4 - bfi x14, x23, #32, #25 // ubignum_of_preglist 2 // INTERMEDIATE aa - add w10, w24, w24, lsl #1; - add x22, x26, x5, lsr #26 - add w10, w10, w24, lsl #4 - umlal v8.2d, v12.2s, v14.2s - umaddl x25, w16, w13, x21 - umlal v8.2d, v2.2s, v13.2s - bfi x29, x22, #32, #25 // ubignum_of_preglist 3 // INTERMEDIATE aa - umlal v8.2d, v5.2s, v11.2s - add x26, x24, x24 - umlal v8.2d, v16.2s, v18.2s - stp x14, x29, [tmpa+16] - umlal v8.2d, v7.2s, v23.2s - add w24, w30, w30, lsl #1; - usra v25.2d, v29.2d, #26 - add w24, w24, w30, lsl #4 - umull x29, w15, w15 - umlal v27.2d, v2.2s, v14.2s - umull x3, w15, w13 - umlal v27.2d, v5.2s, v13.2s - add x21, x20, x20 - umlal v24.2d, v15.2s, v14.2s - umull x5, w19, w21 - umlal v24.2d, v4.2s, v13.2s - and x11, x1, #0x3ffffff - usra v8.2d, v25.2d, #25 - and x1, x0, #0x1ffffff - umlal v27.2d, v16.2s, v11.2s - umaddl x23, w17, w13, x5 - umlal v27.2d, v7.2s, v18.2s - add x5, x30, x30 - usra v0.2d, v8.2d, #26 - add x0, x15, x15 - umlal v24.2d, v10.2s, v11.2s - umaddl x23, w7, w0, x23 - umlal v24.2d, v6.2s, v18.2s - lsr x30, x7, #32 - usra v27.2d, v0.2d, #25 - add x16, x30, x30 - and v20.16b, v8.16b, v30.16b // ubignum_of_hreglist 4 + ubignum_of_lreglist 4 // INTERMEDIATE H|L = bc|ad - umaddl x15, w30, w16, x23 - ushr v23.2d, v30.2d, #1 - add w23, w8, w8, lsl #1; - usra v24.2d, v27.2d, #26 - add w23, w23, w8, lsl #4 - umaddl x14, w19, w5, x3 - and v8.16b, v27.16b, v30.16b // ubignum_of_hreglist 6 + ubignum_of_lreglist 6 // INTERMEDIATE H|L = bc|ad - add x28, x8, x8 - and v27.16b, v0.16b, v23.16b // ubignum_of_hreglist 5 + ubignum_of_lreglist 5 // INTERMEDIATE H|L = bc|ad - umaddl x8, w8, w23, x15 - and v5.16b, v24.16b, v23.16b // ubignum_of_hreglist 7 + ubignum_of_lreglist 7 // INTERMEDIATE H|L = bc|ad - umaddl x3, w2, w28, x14 - umlal v22.2d, v15.2s, v28.2s - bfi x11, x27, #32, #25 // ubignum_of_preglist 1 // INTERMEDIATE aa - uzp1 v5.4s, v8.4s, v5.4s - umaddl x14, w24, w5, x29 - umaddl x5, w19, w28, x14 - ldr d18, [mask1] - mov v18.d[1], v18.d[0] - umaddl x15, w7, w26, x3 - mul v12.2s, v13.2s, v31.2s - umlal v21.2d, v16.2s, v13.2s - stp x9, x11, [tmpa+0] - umlal v21.2d, v7.2s, v11.2s - umaddl x29, w17, w26, x5 - umlal v22.2d, v4.2s, v14.2s - add w14, w20, w20, lsl #1; - umlal v22.2d, v10.2s, v13.2s - add w14, w14, w20, lsl #4 - umull x3, w19, w0 - umlal v22.2d, v6.2s, v11.2s - umaddl x29, w7, w21, x29 - usra v21.2d, v24.2d, #25 - umaddl x11, w20, w14, x12 - and v0.16b, v25.16b, v23.16b - umaddl x5, w30, w21, x15 - and v14.16b, v29.16b, v30.16b - umaddl x12, w16, w13, x29 - usra v22.2d, v21.2d, #26 - umaddl x29, w17, w16, x3 - umlal v3.2d, v7.2s, v12.2s - add x9, x26, x26 - and v1.16b, v21.16b, v30.16b // ubignum_of_hreglist 8 + ubignum_of_lreglist 8 // INTERMEDIATE H|L = bc|ad - add x27, x5, x12, lsr #26 - bic v8.16b, v22.16b, v23.16b - umaddl x29, w7, w7, x29 - and v17.16b, v22.16b, v23.16b // ubignum_of_hreglist 9 + ubignum_of_lreglist 9 // INTERMEDIATE H|L = bc|ad - add x5, x25, x27, lsr #25 - usra v3.2d, v8.2d, #25 - umaddl x25, w24, w9, x8 - umlal v9.2d, v10.2s, v26.2s - add x8, x13, x13 - trn1 v22.4s, v1.4s, v17.4s - umaddl x11, w10, w8, x11 - usra v3.2d, v8.2d, #24 - umull x20, w19, w16 - add v26.2s, v22.2s, v18.2s - ldr d28, [mask2] - umlal v9.2d, v6.2s, v12.2s - umaddl x3, w23, w0, x11 - usra v3.2d, v8.2d, #21 - umaddl x29, w10, w26, x29 - uzp1 v11.4s, v20.4s, v27.4s - umaddl x20, w2, w4, x20 - umaddl x9, w10, w21, x20 - mov v17.d[0], v22.d[1] - usra v9.2d, v3.2d, #26 - umull x15, w19, w13 - and v7.16b, v3.16b, v30.16b // ubignum_of_hreglist 0 + ubignum_of_lreglist 0 // INTERMEDIATE H|L = bc|ad - add x11, x16, x16 - uzp2 v1.4s, v11.4s, v5.4s - umaddl x20, w23, w13, x9 - and v8.16b, v9.16b, v23.16b // ubignum_of_hreglist 1 + ubignum_of_lreglist 1 // INTERMEDIATE H|L = bc|ad - umaddl x9, w2, w0, x15 - usra v14.2d, v9.2d, #25 - and x6, x6, #0x3ffffff - uzp1 v7.4s, v7.4s, v8.4s - umaddl x29, w23, w21, x29 - uzp1 v27.4s, v11.4s, v5.4s - umull x15, w19, w26 - usra v0.2d, v14.2d, #26 // ubignum_of_hreglist 3 + ubignum_of_lreglist 3 // INTERMEDIATE H|L = bc|ad - add x6, x6, x22, lsr #25 - and v3.16b, v14.16b, v30.16b // ubignum_of_hreglist 2 + ubignum_of_lreglist 2 // INTERMEDIATE H|L = bc|ad - bic x22, x27, #0x1ffffff - sub v2.2s, v26.2s, v17.2s - add v9.2s, v22.2s, v17.2s - uzp1 v14.4s, v3.4s, v0.4s - umaddl x2, w2, w21, x15 - add v5.4s, v27.4s, v18.4s - add x5, x5, x22, lsr #24 - zip1 v22.2s, v2.2s, v9.2s // ubignum_of_h32reglist 8 + ubignum_of_l32reglist 8 // INTERMEDIATE H|L = t1|t2 - mov v18.b[0], v28.b[0] - uzp1 v8.4s, v7.4s, v14.4s - add x22, x5, x22, lsr #21 - uzp2 v3.4s, v7.4s, v14.4s - umaddl x5, w7, w16, x9 - add v25.4s, v8.4s, v18.4s - umaddl x15, w14, w0, x22 - add v12.4s, v27.4s, v1.4s - add x9, x17, x17 - sub v14.4s, v5.4s, v1.4s - umull x19, w19, w17 - sub v18.4s, v25.4s, v3.4s - ldr x22, [tmpa+8] - add v20.4s, v8.4s, v3.4s - umaddl x15, w10, w11, x15 - zip1 v16.4s, v14.4s, v12.4s // ubignum_of_h32reglist 4 + ubignum_of_l32reglist 4 // INTERMEDIATE H|L = t1|t2 - umaddl x14, w14, w13, x19 - zip2 v14.4s, v14.4s, v12.4s // ubignum_of_h32reglist 6 + ubignum_of_l32reglist 6 // INTERMEDIATE H|L = t1|t2 - and x17, x27, #0x1ffffff - zip2 v0.4s, v18.4s, v20.4s // ubignum_of_h32reglist 2 + ubignum_of_l32reglist 2 // INTERMEDIATE H|L = t1|t2 - umaddl x15, w23, w4, x15 - zip1 v1.4s, v18.4s, v20.4s // ubignum_of_h32reglist 0 + ubignum_of_l32reglist 0 // INTERMEDIATE H|L = t1|t2 - umaddl x10, w10, w0, x14 - zip2 v5.2s, v2.2s, v9.2s // ubignum_of_h32reglist 9 + ubignum_of_l32reglist 9 // INTERMEDIATE H|L = t1|t2 - shl v24.2s, v0.2s, #1 - mov v19.d[0], v1.d[1] // ubignum_of_h32reglist 1 + ubignum_of_l32reglist 1 // INTERMEDIATE H|L = t1|t2 - shl v26.2s, v22.2s, #1 - shl v17.2s, v16.2s, #1 - mov v15.d[0], v0.d[1] // ubignum_of_h32reglist 3 + ubignum_of_l32reglist 3 // INTERMEDIATE H|L = t1|t2 - shl v7.2s, v5.2s, #1 - shl v18.2s, v19.2s, #1 - umull v11.2d, v1.2s, v24.2s - umaddl x19, w23, w16, x10 - umull v6.2d, v1.2s, v17.2s - umaddl x10, w7, w13, x2 - mov v4.d[0], v16.d[1] // ubignum_of_h32reglist 5 + ubignum_of_l32reglist 5 // INTERMEDIATE H|L = t1|t2 - mov v10.d[0], v14.d[1] // ubignum_of_h32reglist 7 + ubignum_of_l32reglist 7 // INTERMEDIATE H|L = t1|t2 - umull v9.2d, v1.2s, v26.2s - ldr x13, [tmpa+0] - shl v28.2s, v15.2s, #1 - shl v3.2s, v10.2s, #1 - ldr x14, [tmpa+16] - mul v12.2s, v10.2s, v31.2s - umull v25.2d, v1.2s, v7.2s - ldr x2, [tmpa+24] - umlal v6.2d, v18.2s, v28.2s - umaddl x27, w30, w0, x10 - umaddl x16, w24, w0, x20 - shl v13.2s, v14.2s, #1 - umaddl x5, w23, w26, x5 - mul v2.2s, v22.2s, v31.2s - umull v21.2d, v1.2s, v13.2s - umaddl x23, w24, w8, x29 - umlal v11.2d, v18.2s, v19.2s - mov x10, #0x07fffffe07fffffe - sub x10, x10, #2 - umaddl x26, w24, w21, x5 - mul v29.2s, v14.2s, v31.2s - umlal v25.2d, v19.2s, v26.2s - add x7, x1, x6, lsr #26 - mul v20.2s, v4.2s, v31.2s - and x6, x6, #0x3ffffff - shl v8.2s, v18.2s, #1 - shl v4.2s, v4.2s, #1 - umlal v11.2d, v29.2s, v14.2s - bfi x6, x7, #32, #26 // ubignum_of_preglist 4 // INTERMEDIATE aa - umlal v25.2d, v0.2s, v3.2s - umaddl x0, w24, w4, x19 - umlal v25.2d, v15.2s, v13.2s - str x6, [tmpa+32] - umlal v21.2d, v18.2s, v4.2s - umaddl x8, w24, w11, x3 - umlal v21.2d, v0.2s, v17.2s - ldr x30, [tmpa+32] - mul v14.2s, v5.2s, v31.2s - add x2, x2, x10 - shl v5.2s, v28.2s, #1 - shl v27.2s, v4.2s, #1 - umlal v6.2d, v0.2s, v0.2s - umaddl x11, w24, w9, x15 - umlal v6.2d, v12.2s, v3.2s - add x4, x30, x10 - umlal v11.2d, v14.2s, v5.2s - add x3, x22, x10 - umlal v11.2d, v2.2s, v17.2s - add x6, x0, x11, lsr #26 - umlal v11.2d, v12.2s, v27.2s - add x14, x14, x10 - umlal v6.2d, v14.2s, v27.2s - add x8, x8, x6, lsr #25 - umlal v6.2d, v2.2s, v13.2s - movk x10, #0xffb4 - umlal v25.2d, v16.2s, v4.2s - add x29, x16, x8, lsr #26 - umull v27.2d, v1.2s, v3.2s - and x11, x11, #0x3ffffff - umlal v9.2d, v18.2s, v3.2s - add x19, x13, x10 - umlal v9.2d, v0.2s, v13.2s - and x5, x8, #0x3ffffff - umlal v9.2d, v28.2s, v4.2s - bfi x11, x6, #32, #25 // ubignum_of_preglist 0 // INTERMEDIATE bb - umlal v9.2d, v16.2s, v16.2s - umaddl x30, w24, w28, x27 - umlal v9.2d, v14.2s, v7.2s - sub x13, x19, x11 - umull v10.2d, v1.2s, v18.2s - add x7, x23, x29, lsr #25 - umlal v21.2d, v28.2s, v15.2s - lsr x16, x13, #32 // ubignum_of_wreglist 1 + ubignum_of_wreglist 0 // INTERMEDIATE e - umlal v21.2d, v2.2s, v22.2s - add x0, x26, x7, lsr #26 - usra v25.2d, v9.2d, #26 - and x20, x7, #0x3ffffff - umull v22.2d, v1.2s, v1.2s - add x8, x25, x0, lsr #25 - umull v7.2d, v1.2s, v28.2s - and x1, x29, #0x1ffffff // ubignum_of_xreglist 3 // INTERMEDIATE bbalt - bic v18.16b, v25.16b, v23.16b - and x19, x8, #0x3ffffff - and v16.16b, v9.16b, v30.16b - and x7, x12, #0x3ffffff - usra v22.2d, v18.2d, #25 - add x10, x30, x8, lsr #26 - umlal v7.2d, v19.2s, v24.2s - bfi x5, x29, #32, #25 // ubignum_of_preglist 1 // INTERMEDIATE bb - and v9.16b, v25.16b, v23.16b - add x27, x7, x10, lsr #25 - usra v22.2d, v18.2d, #24 - mov x21, #60833 - lsl x21, x21, #1 - add x15, x17, x27, lsr #26 - shl v25.2s, v3.2s, #1 - umlal v7.2d, v14.2s, v17.2s - and x29, x27, #0x3ffffff - usra v22.2d, v18.2d, #21 - bfi x29, x15, #32, #26 // ubignum_of_preglist 4 // INTERMEDIATE bb // ***SOURCE*** ubignum_of_xreglist 9 // INTERMEDIATE bbalt - umlal v10.2d, v14.2s, v24.2s - and x17, x6, #0x1ffffff // ubignum_of_xreglist 1 // INTERMEDIATE bbalt - umlal v10.2d, v2.2s, v28.2s - sub x6, x3, x5 - umlal v10.2d, v12.2s, v17.2s - umaddl x25, w16, w21, x17 - umlal v10.2d, v29.2s, v4.2s - mov w12, w5 // ubignum_of_xreglist 2 // INTERMEDIATE bbalt - umlal v22.2d, v20.2s, v4.2s - lsr x26, x6, #32 // ubignum_of_wreglist 3 + ubignum_of_wreglist 2 // INTERMEDIATE e - umlal v22.2d, v14.2s, v8.2s - and x24, x0, #0x1ffffff // ubignum_of_xreglist 5 // INTERMEDIATE bbalt - umlal v22.2d, v2.2s, v24.2s - stp x11, x5, [tmpb+0] - umlal v22.2d, v12.2s, v5.2s - bfi x20, x0, #32, #25 // ubignum_of_preglist 2 // INTERMEDIATE bb - umlal v22.2d, v29.2s, v17.2s - umaddl x12, w6, w21, x12 - umull v18.2d, v1.2s, v4.2s - bfi x19, x10, #32, #25 // ubignum_of_preglist 3 // INTERMEDIATE bb - umlal v7.2d, v2.2s, v4.2s - sub x7, x14, x20 - umlal v27.2d, v19.2s, v13.2s - mov w8, w20 // ubignum_of_xreglist 4 // INTERMEDIATE bbalt - usra v10.2d, v22.2d, #26 - lsr x14, x7, #32 // ubignum_of_wreglist 5 + ubignum_of_wreglist 4 // INTERMEDIATE e - umlal v18.2d, v19.2s, v17.2s - and x28, x10, #0x1ffffff // ubignum_of_xreglist 7 // INTERMEDIATE bbalt - umlal v7.2d, v12.2s, v13.2s - sub x5, x2, x19 - usra v11.2d, v10.2d, #25 - mov w2, w19 // ubignum_of_xreglist 6 // INTERMEDIATE bbalt - umlal v27.2d, v0.2s, v4.2s - umlal v21.2d, v14.2s, v25.2s - sub x23, x4, x29 - usra v7.2d, v11.2d, #26 - mov w0, w29 // ubignum_of_xreglist 8 // INTERMEDIATE bbalt - umlal v18.2d, v0.2s, v28.2s - lsr x22, x23, #32 // ubignum_of_wreglist 9 + ubignum_of_wreglist 8 // INTERMEDIATE e - umlal v27.2d, v15.2s, v17.2s - str x29, [tmpb+32] - usra v6.2d, v7.2d, #25 - mov w17, w11 // ubignum_of_xreglist 0 // INTERMEDIATE bbalt - and v0.16b, v22.16b, v30.16b // ubignum_of_hreglist 0 + ubignum_of_lreglist 0 // INTERMEDIATE H|L = x5|t3 - umaddl x27, w26, w21, x1 - umlal v18.2d, v14.2s, v13.2s - umaddl x30, w23, w21, x0 - umlal v18.2d, v2.2s, v3.2s - lsr x10, x5, #32 // ubignum_of_wreglist 7 + ubignum_of_wreglist 6 // INTERMEDIATE e - and v4.16b, v6.16b, v30.16b // ubignum_of_hreglist 4 + ubignum_of_lreglist 4 // INTERMEDIATE H|L = x5|t3 - and v1.16b, v10.16b, v23.16b // ubignum_of_hreglist 1 + ubignum_of_lreglist 1 // INTERMEDIATE H|L = x5|t3 - umaddl x4, w14, w21, x24 - ldr x0, [tmpa+0] - mov v0.s[1], w0 - lsr x0, x0, #32 - mov v1.s[1], w0 - umaddl x9, w7, w21, x8 - usra v18.2d, v6.2d, #26 - umaddl x24, w10, w21, x28 - and v3.16b, v7.16b, v23.16b // ubignum_of_hreglist 3 + ubignum_of_lreglist 3 // INTERMEDIATE H|L = x5|t3 - umaddl x8, w22, w21, x15 - umlal v27.2d, v14.2s, v26.2s - umaddl x15, w13, w21, x17 - usra v21.2d, v18.2d, #25 - stp x20, x19, [tmpb+16] - and v2.16b, v11.16b, v30.16b // ubignum_of_hreglist 2 + ubignum_of_lreglist 2 // INTERMEDIATE H|L = x5|t3 - lsr x29, x8, #25 - ldr x3, [tmpb+0] - mov v10.s[1], w3 - lsr x3, x3, #32 - mov v11.s[1], w3 - add x17, x15, x29 - usra v27.2d, v21.2d, #26 - add x28, x17, x29, lsl #1 - and v6.16b, v21.16b, v30.16b // ubignum_of_hreglist 6 + ubignum_of_lreglist 6 // INTERMEDIATE H|L = x5|t3 - and x20, x8, #0x1ffffff - and v5.16b, v18.16b, v23.16b // ubignum_of_hreglist 5 + ubignum_of_lreglist 5 // INTERMEDIATE H|L = x5|t3 - add x17, x28, x29, lsl #4 - and v7.16b, v27.16b, v23.16b // ubignum_of_hreglist 7 + ubignum_of_lreglist 7 // INTERMEDIATE H|L = x5|t3 - ldr x3, [tmpb+8] - mov v22.s[1], w3 - lsr x3, x3, #32 - mov v23.s[1], w3 - add x29, x25, x17, lsr #26 - ldr x15, [pointx+0] - mov v10.s[0], w15 - lsr x15, x15, #32 - mov v11.s[0], w15 - and x11, x17, #0x3ffffff // ubignum_of_xreglist 0 // INTERMEDIATE bce - usra v16.2d, v27.2d, #25 - add x8, x12, x29, lsr #25 - ldr x3, [tmpb+16] - mov v14.s[1], w3 - lsr x3, x3, #32 - mov v15.s[1], w3 - and x12, x29, #0x1ffffff // ubignum_of_xreglist 1 // INTERMEDIATE bce - ldr x15, [pointx+8] - mov v22.s[0], w15 - lsr x15, x15, #32 - mov v23.s[0], w15 - add x28, x27, x8, lsr #26 - and v8.16b, v16.16b, v30.16b // ubignum_of_hreglist 8 + ubignum_of_lreglist 8 // INTERMEDIATE H|L = x5|t3 - umull x1, w12, w10 - ldr x3, [tmpb+24] - mov v17.s[1], w3 - lsr x3, x3, #32 - mov v18.s[1], w3 - add x25, x9, x28, lsr #25 - ldr x15, [pointx+16] - mov v14.s[0], w15 - lsr x15, x15, #32 - mov v15.s[0], w15 - umaddl x19, w5, w21, x2 - usra v9.2d, v16.2d, #26 // ubignum_of_hreglist 8 + ubignum_of_lreglist 8 // INTERMEDIATE H|L = x5|t3 - add x2, x4, x25, lsr #26 - ldr x3, [tmpb+32] - mov v24.s[1], w3 - lsr x3, x3, #32 - mov v25.s[1], w3 - umull x3, w12, w23 - ldr x15, [pointx+24] - mov v17.s[0], w15 - lsr x15, x15, #32 - mov v18.s[0], w15 - add x29, x19, x2, lsr #25 - umull v26.2d, v0.2s, v23.2s - and x21, x28, #0x1ffffff // ubignum_of_xreglist 3 // INTERMEDIATE bce - ldr x0, [tmpa+8] - mov v2.s[1], w0 - lsr x0, x0, #32 - mov v3.s[1], w0 - umaddl x27, w21, w5, x3 - ldr x15, [pointx+32] - mov v24.s[0], w15 - lsr x15, x15, #32 - mov v25.s[0], w15 - add x17, x24, x29, lsr #26 - umull v29.2d, v1.2s, v18.2s - and x15, x8, #0x3ffffff // ubignum_of_xreglist 2 // INTERMEDIATE bce - umull v20.2d, v0.2s, v15.2s - add x19, x30, x17, lsr #25 - and x3, x17, #0x1ffffff // ubignum_of_xreglist 7 // INTERMEDIATE bce - mul v12.2s, v25.2s, v31.2s - ldr x0, [tmpa+16] - mov v4.s[1], w0 - lsr x0, x0, #32 - mov v5.s[1], w0 - add x4, x20, x19, lsr #26 // ubignum_of_xreglist 9 // INTERMEDIATE bce - umlal v26.2d, v2.2s, v11.2s - add w28, w3, w3, lsl #1; - umlal v20.2d, v2.2s, v23.2s - add w28, w28, w3, lsl #4 - umull x8, w12, w5 - ldr x0, [tmpa+24] - mov v6.s[1], w0 - lsr x0, x0, #32 - mov v7.s[1], w0 - and x30, x25, #0x3ffffff // ubignum_of_xreglist 4 // INTERMEDIATE bce - mul v16.2s, v18.2s, v31.2s - add w17, w4, w4, lsl #1; - umull v21.2d, v1.2s, v15.2s - add w17, w17, w4, lsl #4 - umaddl x25, w21, w7, x8 - umlal v20.2d, v4.2s, v11.2s - add w8, w21, w21, lsl #1; - ldr x0, [tmpa+32] - add w8, w8, w21, lsl #4 - mov v8.s[1], w0 - lsr x0, x0, #32 - mov v9.s[1], w0 - and x2, x2, #0x1ffffff // ubignum_of_xreglist 5 // INTERMEDIATE bce - umlal v29.2d, v3.2s, v15.2s - umaddl x24, w2, w6, x25 - umull v13.2d, v0.2s, v25.2s - umaddl x25, w2, w7, x27 - umaddl x0, w3, w6, x25 - mul v19.2s, v15.2s, v31.2s - umull v27.2d, v0.2s, v18.2s - umaddl x20, w3, w13, x24 - umlal v20.2d, v6.2s, v12.2s - umaddl x24, w21, w14, x1 - umlal v13.2d, v2.2s, v18.2s - umaddl x9, w4, w13, x0 - umull v25.2d, v0.2s, v11.2s - umaddl x20, w17, w23, x20 - umlal v27.2d, v2.2s, v15.2s - umaddl x0, w2, w26, x24 - umull v28.2d, v1.2s, v11.2s - umull x24, w17, w5 - umlal v29.2d, v5.2s, v23.2s - umaddl x9, w11, w22, x9 - umlal v13.2d, v4.2s, v15.2s - umaddl x27, w3, w16, x0 - umlal v27.2d, v4.2s, v23.2s - umull x0, w17, w14 - umlal v27.2d, v6.2s, v11.2s - umull x4, w12, w14 - umlal v27.2d, v8.2s, v12.2s - umaddl x25, w11, w10, x20 - umlal v27.2d, v1.2s, v17.2s - umaddl x0, w28, w10, x0 - umlal v13.2d, v6.2s, v23.2s - umull x3, w17, w6 - umlal v13.2d, v8.2s, v11.2s - umaddl x1, w21, w26, x4 - umlal v20.2d, v8.2s, v16.2s - umaddl x4, w2, w13, x24 - umlal v28.2d, v3.2s, v12.2s - umaddl x20, w28, w7, x3 - umlal v29.2d, v7.2s, v11.2s - and x3, x19, #0x3ffffff // ubignum_of_xreglist 9 // INTERMEDIATE bce - umlal v29.2d, v9.2s, v12.2s - umaddl x19, w17, w22, x27 - add w27, w2, w2, lsl #1; - mul v18.2s, v24.2s, v31.2s - add w27, w27, w2, lsl #4 - umlal v21.2d, v3.2s, v23.2s - umull x24, w17, w7 - umlal v13.2d, v1.2s, v24.2s - add x19, x19, x19 - shl v29.2d, v29.2d, #1 - umaddl x1, w2, w16, x1 - umull v15.2d, v1.2s, v23.2s - umaddl x0, w27, w22, x0 - umlal v29.2d, v0.2s, v24.2s - umaddl x2, w28, w5, x24 - mul v24.2s, v23.2s, v31.2s - umaddl x4, w28, w23, x4 - umlal v21.2d, v5.2s, v11.2s - umaddl x24, w27, w5, x20 - umlal v20.2d, v1.2s, v14.2s - umaddl x20, w11, w23, x19 - umlal v26.2d, v4.2s, v12.2s - umaddl x19, w27, w23, x2 - umlal v26.2d, v6.2s, v16.2s - umaddl x2, w21, w6, x4 - umlal v29.2d, v2.2s, v17.2s - umaddl x24, w8, w23, x24 - umlal v15.2d, v3.2s, v11.2s - umaddl x0, w21, w16, x0 - umaddl x4, w21, w13, x19 - mul v23.2s, v11.2s, v31.2s - umlal v20.2d, v3.2s, v22.2s - umaddl x2, w12, w7, x2 - umlal v20.2d, v5.2s, v10.2s - umaddl x19, w12, w26, x0 - umlal v29.2d, v4.2s, v14.2s - umaddl x0, w12, w13, x24 - umlal v26.2d, v8.2s, v19.2s - umaddl x20, w15, w5, x20 - umlal v26.2d, v1.2s, v22.2s - umaddl x21, w15, w10, x9 - umlal v26.2d, v3.2s, v10.2s - and x9, x29, #0x3ffffff // ubignum_of_xreglist 6 // INTERMEDIATE bce - umlal v29.2d, v6.2s, v22.2s - umaddl x20, w30, w7, x20 - umaddl x1, w28, w22, x1 - add x24, x19, x19 - umull v11.2d, v1.2s, v12.2s - add w19, w3, w3, lsl #1; - umlal v26.2d, v5.2s, v18.2s - add w19, w19, w3, lsl #4 - umaddl x20, w9, w6, x20 - umlal v29.2d, v8.2s, v10.2s - add w29, w9, w9, lsl #1; - umlal v13.2d, v3.2s, v17.2s - add w29, w29, w9, lsl #4 - umaddl x2, w19, w10, x2 - umlal v11.2d, v3.2s, v16.2s - umaddl x21, w30, w14, x21 - umlal v11.2d, v5.2s, v19.2s - umaddl x20, w3, w13, x20 - umlal v11.2d, v7.2s, v24.2s - umaddl x2, w29, w22, x2 - umlal v11.2d, v9.2s, v23.2s - umaddl x21, w9, w26, x21 - ushr v23.2d, v30.2d, #1 - umaddl x1, w17, w10, x1 - umlal v13.2d, v5.2s, v14.2s - umaddl x24, w19, w5, x24 - umlal v27.2d, v3.2s, v14.2s - umaddl x21, w3, w16, x21 - shl v11.2d, v11.2d, #1 - add w3, w30, w30, lsl #1; - umlal v28.2d, v5.2s, v16.2s - add w3, w3, w30, lsl #4 - umaddl x24, w29, w23, x24 - umlal v28.2d, v7.2s, v19.2s - add x1, x1, x1 - umlal v28.2d, v9.2s, v24.2s - umaddl x1, w11, w5, x1 - umlal v15.2d, v5.2s, v12.2s - umaddl x24, w30, w13, x24 - umlal v15.2d, v7.2s, v16.2s - umaddl x25, w15, w14, x25 - umlal v15.2d, v9.2s, v19.2s - umaddl x1, w15, w7, x1 - shl v28.2d, v28.2d, #1 - umaddl x24, w15, w6, x24 - umlal v21.2d, v7.2s, v12.2s - umaddl x2, w30, w16, x2 - umlal v21.2d, v9.2s, v16.2s - umaddl x25, w30, w26, x25 - shl v15.2d, v15.2d, #1 - umaddl x30, w30, w6, x1 - umlal v28.2d, v0.2s, v22.2s - umaddl x1, w15, w26, x2 - umlal v28.2d, v2.2s, v10.2s - umaddl x2, w9, w16, x25 - shl v21.2d, v21.2d, #1 - umaddl x24, w11, w7, x24 - umlal v15.2d, v0.2s, v14.2s - umaddl x1, w11, w14, x1 - umlal v21.2d, v0.2s, v17.2s - umaddl x25, w9, w13, x30 - umlal v28.2d, v4.2s, v18.2s - umaddl x0, w19, w26, x0 - umlal v25.2d, v2.2s, v12.2s - add x1, x1, x24, lsr #26 - umlal v25.2d, v4.2s, v16.2s - umaddl x30, w19, w22, x2 - umlal v21.2d, v2.2s, v14.2s - umaddl x4, w12, w6, x4 - mul v14.2s, v14.2s, v31.2s - umaddl x25, w19, w23, x25 - and x2, x1, #0x1ffffff - mul v16.2s, v17.2s, v31.2s - umlal v25.2d, v6.2s, v19.2s - umaddl x9, w19, w14, x4 - umlal v13.2d, v7.2s, v22.2s - add x25, x25, x1, lsr #25 - umlal v21.2d, v4.2s, v22.2s - umaddl x0, w29, w14, x0 - umlal v26.2d, v7.2s, v16.2s - add x30, x30, x25, lsr #26 - umlal v26.2d, v9.2s, v14.2s - add w1, w15, w15, lsl #1; - umlal v28.2d, v6.2s, v16.2s - add w1, w1, w15, lsl #4 - add x4, x20, x30, lsr #25 - umlal v28.2d, v8.2s, v14.2s - and x25, x25, #0x3ffffff - umlal v15.2d, v2.2s, v22.2s - add x21, x21, x4, lsr #26 - umlal v11.2d, v0.2s, v10.2s - bfi x25, x30, #32, #25 // ubignum_of_preglist 3 // INTERMEDIATE z4 - umlal v11.2d, v2.2s, v18.2s - bic x30, x21, #0x3ffffff - usra v26.2d, v28.2d, #26 - lsr x20, x30, #26 - umlal v15.2d, v4.2s, v10.2s - add x20, x20, x30, lsr #25 - umlal v15.2d, v6.2s, v18.2s - umaddl x9, w29, w10, x9 - umlal v15.2d, v8.2s, v16.2s - add x30, x20, x30, lsr #22 - umlal v27.2d, v5.2s, v22.2s - umull x20, w17, w26 - umlal v20.2d, v7.2s, v18.2s - umaddl x30, w17, w16, x30 - umlal v20.2d, v9.2s, v16.2s - umaddl x17, w3, w10, x0 - usra v15.2d, v26.2d, #25 - umaddl x0, w28, w14, x20 - umlal v27.2d, v7.2s, v10.2s - umaddl x20, w28, w26, x30 - umlal v27.2d, v9.2s, v18.2s - add w28, w12, w12, lsl #1; - usra v20.2d, v15.2d, #26 - add w28, w28, w12, lsl #4 - umaddl x30, w27, w10, x0 - and v17.16b, v15.16b, v30.16b // ubignum_of_hreglist 4 + ubignum_of_lreglist 4 // INTERMEDIATE H|L = x4|z5 - umaddl x27, w27, w14, x20 - umaddl x0, w8, w10, x27 - mul v12.2s, v22.2s, v31.2s - and v15.16b, v20.16b, v23.16b // ubignum_of_hreglist 5 + ubignum_of_lreglist 5 // INTERMEDIATE H|L = x4|z5 - umaddl x14, w3, w22, x9 - umlal v21.2d, v6.2s, v10.2s - umaddl x27, w8, w22, x30 - trn1 v15.4s, v17.4s, v15.4s // FINAL z3 - umaddl x10, w28, w22, x0 - umlal v11.2d, v4.2s, v16.2s - umaddl x30, w15, w16, x14 - and v26.16b, v26.16b, v23.16b - umaddl x28, w12, w16, x27 - umlal v21.2d, v8.2s, v18.2s - add x10, x10, x10 - umlal v25.2d, v8.2s, v24.2s - umaddl x20, w19, w6, x10 - umlal v25.2d, v1.2s, v10.2s - add x28, x28, x28 - umlal v25.2d, v3.2s, v18.2s - umaddl x28, w19, w7, x28 - usra v21.2d, v20.2d, #25 - umaddl x0, w29, w7, x20 - umlal v11.2d, v6.2s, v14.2s - umaddl x10, w11, w26, x30 - umlal v13.2d, v9.2s, v10.2s - umaddl x19, w29, w5, x28 - usra v27.2d, v21.2d, #26 - umaddl x0, w3, w5, x0 - umlal v25.2d, v5.2s, v16.2s - umaddl x20, w1, w22, x17 - and v20.16b, v28.16b, v30.16b - umaddl x29, w3, w23, x19 - usra v29.2d, v27.2d, #25 - umaddl x3, w1, w23, x0 - and v27.16b, v27.16b, v23.16b // ubignum_of_hreglist 7 + ubignum_of_lreglist 7 // INTERMEDIATE H|L = x4|z5 - umlal v11.2d, v8.2s, v12.2s - umaddl x12, w15, w13, x29 - usra v13.2d, v29.2d, #26 - umaddl x7, w11, w13, x3 - trn1 v6.4s, v6.4s, v7.4s - umaddl x17, w11, w16, x20 - umlal v25.2d, v7.2s, v14.2s - and x23, x4, #0x3ffffff - bic v19.16b, v13.16b, v23.16b - umaddl x19, w11, w6, x12 - and v28.16b, v13.16b, v23.16b // ubignum_of_hreglist 9 + ubignum_of_lreglist 9 // INTERMEDIATE H|L = x4|z5 - add x3, x17, x7, lsr #26 - usra v11.2d, v19.2d, #25 - trn1 v2.4s, v2.4s, v3.4s - add x17, x19, x3, lsr #25 - and v13.16b, v21.16b, v30.16b // ubignum_of_hreglist 6 + ubignum_of_lreglist 6 // INTERMEDIATE H|L = x4|z5 - and x5, x7, #0x3ffffff - usra v11.2d, v19.2d, #24 - add x7, x10, x17, lsr #26 - trn1 v0.4s, v0.4s, v1.4s - and x19, x24, #0x3ffffff - and v21.16b, v29.16b, v30.16b // ubignum_of_hreglist 8 + ubignum_of_lreglist 8 // INTERMEDIATE H|L = x4|z5 - add x29, x19, x7, lsr #25 - usra v11.2d, v19.2d, #21 - bfi x5, x3, #32, #25 // ubignum_of_preglist 0 // INTERMEDIATE z4 - trn1 v17.4s, v13.4s, v27.4s // FINAL z3 - add x19, x2, x29, lsr #26 - trn1 v19.4s, v21.4s, v28.4s // FINAL z3 - and x3, x29, #0x3ffffff - mov v16.d[0], v6.d[1] // FINAL x3 - mov v6.d[0], v17.d[1] // FINAL x2 - trn1 v8.4s, v8.4s, v9.4s - bfi x3, x19, #32, #26 // ubignum_of_preglist 2 // INTERMEDIATE z4 - and v21.16b, v11.16b, v30.16b // ubignum_of_hreglist 0 + ubignum_of_lreglist 0 // INTERMEDIATE H|L = x4|z5 - bfi x23, x21, #32, #26 // ubignum_of_preglist 4 // INTERMEDIATE z4 - mov v18.d[0], v8.d[1] // FINAL x3 - mov v8.d[0], v19.d[1] // FINAL x2 - umlal v25.2d, v9.2s, v12.2s - mov v9.d[0], x23 // FINAL z2 - mov v7.d[0], x25 // FINAL z2 - ldr d29, [mask1] - mov v12.d[0], v2.d[1] // FINAL x3 - trn1 v4.4s, v4.4s, v5.4s - and x17, x17, #0x3ffffff - usra v25.2d, v11.2d, #26 - mov v10.d[0], v0.d[1] // FINAL x3 - mov v14.d[0], v4.d[1] // FINAL x3 - mov v4.d[0], v15.d[1] // FINAL x2 - usra v20.2d, v25.2d, #25 - and v27.16b, v25.16b, v23.16b // ubignum_of_hreglist 1 + ubignum_of_lreglist 1 // INTERMEDIATE H|L = x4|z5 - bfi x17, x7, #32, #25 // ubignum_of_preglist 1 // INTERMEDIATE z4 - mov v5.d[0], x3 - mov v1.d[0], x5 // FINAL z2 - usra v26.2d, v20.2d, #26 // ubignum_of_hreglist 3 + ubignum_of_lreglist 3 // INTERMEDIATE H|L = x4|z5 - and v28.16b, v20.16b, v30.16b // ubignum_of_hreglist 2 + ubignum_of_lreglist 2 // INTERMEDIATE H|L = x4|z5 - trn1 v11.4s, v21.4s, v27.4s // FINAL z3 - trn1 v13.4s, v28.4s, v26.4s // FINAL z3 - mov v0.d[0], v11.d[1] // FINAL x2 - mov v3.d[0], x17 // FINAL z2 - mov v2.d[0], v13.d[1] // FINAL x2 - ldr d28, [mask2] - - ldr x0, [i] - subs x0, x0, #1 - str x0, [i] - bcs Lcurve25519_x25519_scalarloop - -// Repack X2 into the saturated representation as 256-bit value xn. -// This does not fully normalize mod 2^255-19 but stays within 256 bits. - - mov w0, v0.s[0] - mov w1, v0.s[1] - mov w2, v2.s[0] - mov w3, v2.s[1] - mov w4, v4.s[0] - mov w5, v4.s[1] - mov w6, v6.s[0] - mov w7, v6.s[1] - mov w8, v8.s[0] - mov w9, v8.s[1] - - add x0, x0, x1, lsl #26 - add x1, x2, x3, lsl #26 - add x2, x4, x5, lsl #26 - add x3, x6, x7, lsl #26 - add x4, x8, x9, lsl #26 - - adds x0, x0, x1, lsl #51 - lsr x6, x1, #13 - lsl x7, x2, #38 - adcs x1, x6, x7 - lsr x8, x2, #26 - lsl x9, x3, #25 - adcs x2, x8, x9 - lsr x10, x3, #39 - lsl x11, x4, #12 - adc x3, x10, x11 - stp x0, x1, [xn] - stp x2, x3, [xn+16] - -// Repack Z2 into the saturated representation as 256-bit value zn. -// This does not fully normalize mod 2^255-19. However since Z2, -// unlike X2, was not repacked (within the last multiplication) in -// right-to-left order, its top digit can be any 26-bit value, on -// the face of it. To make sure we don't overflow 256 bits here -// we remove b = 25th bit of the 9th digit (now scaled by 2^230 -// giving bit 25 a final weighting of 2^255) and add 19 * b to -// to the bottom of the sum here to compensate mod 2^255-19. - - mov w0, v1.s[0] - mov w1, v1.s[1] - mov w2, v3.s[0] - mov w3, v3.s[1] - mov w4, v5.s[0] - mov w5, v5.s[1] - mov w6, v7.s[0] - mov w7, v7.s[1] - mov w8, v9.s[0] - mov w9, v9.s[1] - - mov w10, #19 - add x0, x0, x1, lsl #26 - tst x9, #0x2000000 - add x1, x2, x3, lsl #26 - csel x10, x10, xzr, ne - add x2, x4, x5, lsl #26 - and x9, x9, #0x1FFFFFF - add x3, x6, x7, lsl #26 - add x0, x0, x10 - add x4, x8, x9, lsl #26 - - adds x0, x0, x1, lsl #51 - lsr x6, x1, #13 - lsl x7, x2, #38 - adcs x1, x6, x7 - lsr x8, x2, #26 - lsl x9, x3, #25 - adcs x2, x8, x9 - lsr x10, x3, #39 - lsl x11, x4, #12 - adc x3, x10, x11 - stp x0, x1, [zn] - stp x2, x3, [zn+16] - -// Because the lowest bit (indeed, the three lowest bits) of the scalar -// were forced to zero, we know that the projective result of the scalar -// multiplication was in (X2,Z2) and is now (xn,zn) in saturated form. -// Prepare to call the modular inverse function to get zn' = 1/zn. - - add x0, zn - add x1, zn - -// Inline copy of bignum_inv_p25519, identical except for stripping out -// the prologue and epilogue saving and restoring registers and making -// and reclaiming room on the stack. For more details and explanations see -// "arm/curve25519/bignum_inv_p25519.S". Note that the stack it uses for -// its own temporaries is 128 bytes, so it has no effect on variables -// that are needed in the rest of our computation here: res, xn, and zn. - - mov x20, x0 - mov x10, #0xffffffffffffffed - mov x11, #0xffffffffffffffff - stp x10, x11, [sp] - mov x12, #0x7fffffffffffffff - stp x11, x12, [sp, #16] - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - mov x7, #0x13 - lsr x6, x5, #63 - madd x6, x7, x6, x7 - adds x2, x2, x6 - adcs x3, x3, xzr - adcs x4, x4, xzr - orr x5, x5, #0x8000000000000000 - adcs x5, x5, xzr - csel x6, x7, xzr, cc - subs x2, x2, x6 - sbcs x3, x3, xzr - sbcs x4, x4, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - stp x2, x3, [sp, #32] - stp x4, x5, [sp, #48] - stp xzr, xzr, [sp, #64] - stp xzr, xzr, [sp, #80] - mov x10, #0x2099 - movk x10, #0x7502, lsl #16 - movk x10, #0x9e23, lsl #32 - movk x10, #0xa0f9, lsl #48 - mov x11, #0x2595 - movk x11, #0x1d13, lsl #16 - movk x11, #0x8f3f, lsl #32 - movk x11, #0xa8c6, lsl #48 - mov x12, #0x5242 - movk x12, #0x5ac, lsl #16 - movk x12, #0x8938, lsl #32 - movk x12, #0x6c6c, lsl #48 - mov x13, #0x615 - movk x13, #0x4177, lsl #16 - movk x13, #0x8b2, lsl #32 - movk x13, #0x2765, lsl #48 - stp x10, x11, [sp, #96] - stp x12, x13, [sp, #112] - mov x21, #0xa - mov x22, #0x1 - b Lcurve25519_x25519_invmidloop -Lcurve25519_x25519_invloop: - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - and x0, x12, x16 - and x1, x13, x17 - add x19, x0, x1 - ldr x7, [sp] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #32] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x7, [sp, #8] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #40] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [sp] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [sp, #32] - ldr x7, [sp, #16] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #48] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [sp, #8] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [sp, #40] - ldr x7, [sp, #24] - eor x1, x7, x14 - asr x3, x1, #63 - and x3, x3, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #56] - eor x1, x8, x15 - asr x0, x1, #63 - and x0, x0, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [sp, #16] - extr x5, x3, x5, #59 - str x5, [sp, #24] - eor x1, x7, x16 - asr x5, x1, #63 - and x5, x5, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - asr x0, x1, #63 - and x0, x0, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - extr x4, x2, x4, #59 - str x4, [sp, #48] - extr x2, x5, x2, #59 - str x2, [sp, #56] - ldr x7, [sp, #64] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #96] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #64] - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - str x5, [sp, #96] - adc x3, x3, x1 - ldr x7, [sp, #72] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #104] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #72] - adc x6, x6, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - str x3, [sp, #104] - adc x4, x4, x1 - ldr x7, [sp, #80] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #112] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #80] - adc x5, x5, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - str x4, [sp, #112] - adc x2, x2, x1 - ldr x7, [sp, #88] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #120] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x3, x5, #63 - ldp x0, x1, [sp, #64] - add x6, x6, x3, asr #63 - mov x3, #0x13 - mul x4, x6, x3 - add x5, x5, x6, lsl #63 - smulh x3, x6, x3 - ldr x6, [sp, #80] - adds x0, x0, x4 - adcs x1, x1, x3 - asr x3, x3, #63 - adcs x6, x6, x3 - adc x5, x5, x3 - stp x0, x1, [sp, #64] - stp x6, x5, [sp, #80] - eor x1, x7, x16 - and x5, x16, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - and x0, x17, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - extr x6, x5, x2, #63 - ldp x0, x1, [sp, #96] - add x6, x6, x5, asr #63 - mov x5, #0x13 - mul x4, x6, x5 - add x2, x2, x6, lsl #63 - smulh x5, x6, x5 - ldr x3, [sp, #112] - adds x0, x0, x4 - adcs x1, x1, x5 - asr x5, x5, #63 - adcs x3, x3, x5 - adc x2, x2, x5 - stp x0, x1, [sp, #96] - stp x3, x2, [sp, #112] -Lcurve25519_x25519_invmidloop: - mov x1, x22 - ldr x2, [sp] - ldr x3, [sp, #32] - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x8, x4, #0x100, lsl #12 - sbfx x8, x8, #21, #21 - mov x11, #0x100000 - add x11, x11, x11, lsl #21 - add x9, x4, x11 - asr x9, x9, #42 - add x10, x5, #0x100, lsl #12 - sbfx x10, x10, #21, #21 - add x11, x5, x11 - asr x11, x11, #42 - mul x6, x8, x2 - mul x7, x9, x3 - mul x2, x10, x2 - mul x3, x11, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #21, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #42 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #21, #21 - add x15, x5, x15 - asr x15, x15, #42 - mul x6, x12, x2 - mul x7, x13, x3 - mul x2, x14, x2 - mul x3, x15, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - mul x2, x12, x8 - mul x3, x12, x9 - mul x6, x14, x8 - mul x7, x14, x9 - madd x8, x13, x10, x2 - madd x9, x13, x11, x3 - madd x16, x15, x10, x6 - madd x17, x15, x11, x7 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #22, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #43 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #22, #21 - add x15, x5, x15 - asr x15, x15, #43 - mneg x2, x12, x8 - mneg x3, x12, x9 - mneg x4, x14, x8 - mneg x5, x14, x9 - msub x10, x13, x16, x2 - msub x11, x13, x17, x3 - msub x12, x15, x16, x4 - msub x13, x15, x17, x5 - mov x22, x1 - subs x21, x21, #0x1 - b.ne Lcurve25519_x25519_invloop - ldr x0, [sp] - ldr x1, [sp, #32] - mul x0, x0, x10 - madd x1, x1, x11, x0 - asr x0, x1, #63 - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - eor x14, x14, x0 - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - eor x15, x15, x0 - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - eor x16, x16, x0 - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - eor x17, x17, x0 - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - ldr x7, [sp, #64] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #96] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #64] - adc x2, x2, x1 - ldr x7, [sp, #72] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #104] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #72] - adc x6, x6, x1 - ldr x7, [sp, #80] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #112] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #80] - adc x5, x5, x1 - ldr x7, [sp, #88] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #120] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x3, x5, #63 - ldp x0, x1, [sp, #64] - tst x3, x3 - cinc x6, x6, pl - mov x3, #0x13 - mul x4, x6, x3 - add x5, x5, x6, lsl #63 - smulh x6, x6, x3 - ldr x2, [sp, #80] - adds x0, x0, x4 - adcs x1, x1, x6 - asr x6, x6, #63 - adcs x2, x2, x6 - adcs x5, x5, x6 - csel x3, x3, xzr, mi - subs x0, x0, x3 - sbcs x1, x1, xzr - sbcs x2, x2, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - mov x4, x20 - stp x0, x1, [x4] - stp x2, x5, [x4, #16] - -// Now the result is xn * (1/zn), fully reduced modulo p. -// Note that in the degenerate case zn = 0 (mod p_25519), the -// modular inverse code above will produce 1/zn = 0, giving -// the correct overall X25519 result of zero for the point at -// infinity. The multiplication below is just an inlined -// version of bignum_mul_p25519 except for the detailed -// addressing of inputs and outputs - - ldr x17, [res] - - ldp x3, x4, [xn] - ldp x5, x6, [zn] - umull x7, w3, w5 - lsr x0, x3, #32 - umull x15, w0, w5 - lsr x16, x5, #32 - umull x8, w16, w0 - umull x16, w3, w16 - adds x7, x7, x15, lsl #32 - lsr x15, x15, #32 - adc x8, x8, x15 - adds x7, x7, x16, lsl #32 - lsr x16, x16, #32 - adc x8, x8, x16 - mul x9, x4, x6 - umulh x10, x4, x6 - subs x4, x4, x3 - cneg x4, x4, cc - csetm x16, cc - adds x9, x9, x8 - adc x10, x10, xzr - subs x3, x5, x6 - cneg x3, x3, cc - cinv x16, x16, cc - mul x15, x4, x3 - umulh x3, x4, x3 - adds x8, x7, x9 - adcs x9, x9, x10 - adc x10, x10, xzr - cmn x16, #0x1 - eor x15, x15, x16 - adcs x8, x15, x8 - eor x3, x3, x16 - adcs x9, x3, x9 - adc x10, x10, x16 - ldp x3, x4, [xn+16] - ldp x5, x6, [zn+16] - umull x11, w3, w5 - lsr x0, x3, #32 - umull x15, w0, w5 - lsr x16, x5, #32 - umull x12, w16, w0 - umull x16, w3, w16 - adds x11, x11, x15, lsl #32 - lsr x15, x15, #32 - adc x12, x12, x15 - adds x11, x11, x16, lsl #32 - lsr x16, x16, #32 - adc x12, x12, x16 - mul x13, x4, x6 - umulh x14, x4, x6 - subs x4, x4, x3 - cneg x4, x4, cc - csetm x16, cc - adds x13, x13, x12 - adc x14, x14, xzr - subs x3, x5, x6 - cneg x3, x3, cc - cinv x16, x16, cc - mul x15, x4, x3 - umulh x3, x4, x3 - adds x12, x11, x13 - adcs x13, x13, x14 - adc x14, x14, xzr - cmn x16, #0x1 - eor x15, x15, x16 - adcs x12, x15, x12 - eor x3, x3, x16 - adcs x13, x3, x13 - adc x14, x14, x16 - ldp x3, x4, [xn+16] - ldp x15, x16, [xn] - subs x3, x3, x15 - sbcs x4, x4, x16 - csetm x16, cc - ldp x15, x0, [zn] - subs x5, x15, x5 - sbcs x6, x0, x6 - csetm x0, cc - eor x3, x3, x16 - subs x3, x3, x16 - eor x4, x4, x16 - sbc x4, x4, x16 - eor x5, x5, x0 - subs x5, x5, x0 - eor x6, x6, x0 - sbc x6, x6, x0 - eor x16, x0, x16 - adds x11, x11, x9 - adcs x12, x12, x10 - adcs x13, x13, xzr - adc x14, x14, xzr - mul x2, x3, x5 - umulh x0, x3, x5 - mul x15, x4, x6 - umulh x1, x4, x6 - subs x4, x4, x3 - cneg x4, x4, cc - csetm x9, cc - adds x15, x15, x0 - adc x1, x1, xzr - subs x6, x5, x6 - cneg x6, x6, cc - cinv x9, x9, cc - mul x5, x4, x6 - umulh x6, x4, x6 - adds x0, x2, x15 - adcs x15, x15, x1 - adc x1, x1, xzr - cmn x9, #0x1 - eor x5, x5, x9 - adcs x0, x5, x0 - eor x6, x6, x9 - adcs x15, x6, x15 - adc x1, x1, x9 - adds x9, x11, x7 - adcs x10, x12, x8 - adcs x11, x13, x11 - adcs x12, x14, x12 - adcs x13, x13, xzr - adc x14, x14, xzr - cmn x16, #0x1 - eor x2, x2, x16 - adcs x9, x2, x9 - eor x0, x0, x16 - adcs x10, x0, x10 - eor x15, x15, x16 - adcs x11, x15, x11 - eor x1, x1, x16 - adcs x12, x1, x12 - adcs x13, x13, x16 - adc x14, x14, x16 - mov x3, #0x26 - umull x4, w11, w3 - add x4, x4, w7, uxtw - lsr x7, x7, #32 - lsr x11, x11, #32 - umaddl x11, w11, w3, x7 - mov x7, x4 - umull x4, w12, w3 - add x4, x4, w8, uxtw - lsr x8, x8, #32 - lsr x12, x12, #32 - umaddl x12, w12, w3, x8 - mov x8, x4 - umull x4, w13, w3 - add x4, x4, w9, uxtw - lsr x9, x9, #32 - lsr x13, x13, #32 - umaddl x13, w13, w3, x9 - mov x9, x4 - umull x4, w14, w3 - add x4, x4, w10, uxtw - lsr x10, x10, #32 - lsr x14, x14, #32 - umaddl x14, w14, w3, x10 - mov x10, x4 - lsr x0, x14, #31 - mov x5, #0x13 - umaddl x5, w5, w0, x5 - add x7, x7, x5 - adds x7, x7, x11, lsl #32 - extr x3, x12, x11, #32 - adcs x8, x8, x3 - extr x3, x13, x12, #32 - adcs x9, x9, x3 - extr x3, x14, x13, #32 - lsl x5, x0, #63 - eor x10, x10, x5 - adc x10, x10, x3 - mov x3, #0x13 - tst x10, #0x8000000000000000 - csel x3, x3, xzr, pl - subs x7, x7, x3 - sbcs x8, x8, xzr - sbcs x9, x9, xzr - sbc x10, x10, xzr - and x10, x10, #0x7fffffffffffffff - stp x7, x8, [x17] - stp x9, x10, [x17, #16] - -// Restore stack and registers (this will zero the tops of Q8...Q15). - - CFI_STACKLOAD2(d8,d9,NSPACE+0) - CFI_STACKLOAD2(d10,d11,NSPACE+16) - CFI_STACKLOAD2(d12,d13,NSPACE+32) - CFI_STACKLOAD2(d14,d15,NSPACE+48) - CFI_STACKLOAD2(x19,x20,NSPACE+64) - CFI_STACKLOAD2(x21,x22,NSPACE+80) - CFI_STACKLOAD2(x23,x24,NSPACE+96) - CFI_STACKLOAD2(x25,x26,NSPACE+112) - CFI_STACKLOAD2(x27,x28,NSPACE+128) - CFI_STACKLOAD2(x29,x30,NSPACE+144) - CFI_INC_SP((NSPACE+160)) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(curve25519_x25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519_alt.S deleted file mode 100644 index a018dd05b3e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519_alt.S +++ /dev/null @@ -1,1702 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// The x25519 function for curve25519 -// Inputs scalar[4], point[4]; output res[4] -// -// extern void curve25519_x25519_alt -// (uint64_t res[static 4],const uint64_t scalar[static 4], -// const uint64_t point[static 4]); -// -// Given a scalar n and the X coordinate of an input point P = (X,Y) on -// curve25519 (Y can live in any extension field of characteristic 2^255-19), -// this returns the X coordinate of n * P = (X, Y), or 0 when n * P is the -// point at infinity. Both n and X inputs are first slightly modified/mangled -// as specified in the relevant RFC (https://www.rfc-editor.org/rfc/rfc7748); -// in particular the lower three bits of n are set to zero. Does not implement -// the zero-check specified in Section 6.1. -// -// Standard ARM ABI: X0 = res, X1 = scalar, X2 = point -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(curve25519_x25519_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(curve25519_x25519_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(curve25519_x25519_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for the input result argument during the whole body -// and other variables that are only needed prior to the modular inverse. - -#define res x23 -#define i x20 -#define swap x21 - -// Pointers to result x coord to be written - -#define resx res, #0 - -// Pointer-offset pairs for temporaries on stack with some aliasing. - -#define scalar sp, #(0*NUMSIZE) - -#define pointx sp, #(1*NUMSIZE) - -#define zm sp, #(2*NUMSIZE) -#define sm sp, #(2*NUMSIZE) -#define dpro sp, #(2*NUMSIZE) - -#define sn sp, #(3*NUMSIZE) - -#define dm sp, #(4*NUMSIZE) - -#define zn sp, #(5*NUMSIZE) -#define dn sp, #(5*NUMSIZE) -#define e sp, #(5*NUMSIZE) - -#define dmsn sp, #(6*NUMSIZE) -#define p sp, #(6*NUMSIZE) - -#define xm sp, #(7*NUMSIZE) -#define dnsm sp, #(7*NUMSIZE) -#define spro sp, #(7*NUMSIZE) - -#define d sp, #(8*NUMSIZE) - -#define xn sp, #(9*NUMSIZE) -#define s sp, #(9*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 10*NUMSIZE - -// Macro wrapping up the basic field operation bignum_mul_p25519_alt, only -// trivially different from a pure function call to that subroutine. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - orr x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - madd x11, x7, x8, x7 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adcs x15, x15, xzr __LF \ - csel x7, x7, xzr, cc __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x15, x15, xzr __LF \ - and x15, x15, #0x7fffffffffffffff __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - bic x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - mul x11, x7, x8 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adc x15, x15, xzr __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x7, x2, x4 __LF \ - umulh x6, x2, x4 __LF \ - adds x10, x10, x7 __LF \ - adcs x11, x11, x6 __LF \ - mul x7, x3, x4 __LF \ - umulh x6, x3, x4 __LF \ - adc x6, x6, xzr __LF \ - adds x11, x11, x7 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x6 __LF \ - mul x7, x3, x5 __LF \ - umulh x6, x3, x5 __LF \ - adc x6, x6, xzr __LF \ - adds x12, x12, x7 __LF \ - adcs x13, x13, x6 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x6, cs __LF \ - umulh x7, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x7 __LF \ - mul x7, x3, x3 __LF \ - adcs x10, x10, x7 __LF \ - umulh x7, x3, x3 __LF \ - adcs x11, x11, x7 __LF \ - mul x7, x4, x4 __LF \ - adcs x12, x12, x7 __LF \ - umulh x7, x4, x4 __LF \ - adcs x13, x13, x7 __LF \ - mul x7, x5, x5 __LF \ - adcs x14, x14, x7 __LF \ - umulh x7, x5, x5 __LF \ - adc x6, x6, x7 __LF \ - mov x3, #0x26 __LF \ - mul x7, x3, x12 __LF \ - umulh x4, x3, x12 __LF \ - adds x8, x8, x7 __LF \ - mul x7, x3, x13 __LF \ - umulh x13, x3, x13 __LF \ - adcs x9, x9, x7 __LF \ - mul x7, x3, x14 __LF \ - umulh x14, x3, x14 __LF \ - adcs x10, x10, x7 __LF \ - mul x7, x3, x6 __LF \ - umulh x6, x3, x6 __LF \ - adcs x11, x11, x7 __LF \ - cset x12, cs __LF \ - adds x11, x11, x14 __LF \ - adc x12, x12, x6 __LF \ - cmn x11, x11 __LF \ - bic x11, x11, #0x8000000000000000 __LF \ - adc x2, x12, x12 __LF \ - mov x3, #0x13 __LF \ - mul x7, x3, x2 __LF \ - adds x8, x8, x7 __LF \ - adcs x9, x9, x4 __LF \ - adcs x10, x10, x13 __LF \ - adc x11, x11, xzr __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Modular addition with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(p0,p1,p2) \ - ldp x5, x6, [p1] __LF \ - ldp x4, x3, [p2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [p1+16] __LF \ - ldp x4, x3, [p2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [p0] __LF \ - stp x7, x8, [p0+16] - -// Combined z = c * x + y with reduction only < 2 * p_25519 -// where c is initially in the X1 register. It is assumed -// that 19 * (c * x + y) < 2^60 * 2^256 so we don't need a -// high mul in the final part. - -#define cmadd_4(p0,p2,p3) \ - ldp x7, x8, [p2] __LF \ - ldp x9, x10, [p2+16] __LF \ - mul x3, x1, x7 __LF \ - mul x4, x1, x8 __LF \ - mul x5, x1, x9 __LF \ - mul x6, x1, x10 __LF \ - umulh x7, x1, x7 __LF \ - umulh x8, x1, x8 __LF \ - umulh x9, x1, x9 __LF \ - umulh x10, x1, x10 __LF \ - adds x4, x4, x7 __LF \ - adcs x5, x5, x8 __LF \ - adcs x6, x6, x9 __LF \ - adc x10, x10, xzr __LF \ - ldp x7, x8, [p3] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x7, x8, [p3+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - adc x10, x10, xzr __LF \ - cmn x6, x6 __LF \ - bic x6, x6, #0x8000000000000000 __LF \ - adc x8, x10, x10 __LF \ - mov x9, #19 __LF \ - mul x7, x8, x9 __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [p0] __LF \ - stp x5, x6, [p0+16] - -// Multiplex: z := if NZ then x else y - -#define mux_4(p0,p1,p2) \ - ldp x0, x1, [p1] __LF \ - ldp x2, x3, [p2] __LF \ - csel x0, x0, x2, ne __LF \ - csel x1, x1, x3, ne __LF \ - stp x0, x1, [p0] __LF \ - ldp x0, x1, [p1+16] __LF \ - ldp x2, x3, [p2+16] __LF \ - csel x0, x0, x2, ne __LF \ - csel x1, x1, x3, ne __LF \ - stp x0, x1, [p0+16] - -S2N_BN_SYMBOL(curve25519_x25519_alt): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_DEC_SP(NSPACE) - -// Move the output pointer to a stable place - - mov res, x0 - -// Copy the inputs to the local variables with minimal mangling: -// -// - The scalar is in principle turned into 01xxx...xxx000 but -// in the structure below the special handling of these bits is -// explicit in the main computation; the scalar is just copied. -// -// - The point x coord is reduced mod 2^255 by masking off the -// top bit. In the main loop we only need reduction < 2 * p_25519. - - ldp x10, x11, [x1] - stp x10, x11, [scalar] - ldp x12, x13, [x1, #16] - stp x12, x13, [scalar+16] - - ldp x10, x11, [x2] - stp x10, x11, [pointx] - ldp x12, x13, [x2, #16] - and x13, x13, #0x7fffffffffffffff - stp x12, x13, [pointx+16] - -// Initialize with explicit doubling in order to handle set bit 254. -// Set swap = 1 and (xm,zm) = (x,1) then double as (xn,zn) = 2 * (x,1). -// We use the fact that the point x coordinate is still in registers. -// Since zm = 1 we could do the doubling with an operation count of -// 2 * S + M instead of 2 * S + 2 * M, but it doesn't seem worth -// the slight complication arising from a different linear combination. - - mov swap, #1 - stp x10, x11, [xm] - stp x12, x13, [xm+16] - stp swap, xzr, [zm] - stp xzr, xzr, [zm+16] - - sub_twice4(d,xm,zm) - add_twice4(s,xm,zm) - sqr_4(d,d) - sqr_4(s,s) - sub_twice4(p,s,d) - mov x1, 0xdb42 - orr x1, x1, 0x10000 - cmadd_4(e,p,d) - mul_4(xn,s,d) - mul_4(zn,p,e) - -// The main loop over unmodified bits from i = 253, ..., i = 3 (inclusive). -// This is a classic Montgomery ladder, with the main coordinates only -// reduced mod 2 * p_25519, some intermediate results even more loosely. - - mov i, #253 - -Lcurve25519_x25519_alt_scalarloop: - -// sm = xm + zm; sn = xn + zn; dm = xm - zm; dn = xn - zn - - sub_twice4(dm,xm,zm) - add_twice4(sn,xn,zn) - sub_twice4(dn,xn,zn) - add_twice4(sm,xm,zm) - -// ADDING: dmsn = dm * sn -// DOUBLING: mux d = xt - zt and s = xt + zt for appropriate choice of (xt,zt) - - mul_4(dmsn,sn,dm) - - lsr x0, i, #6 - ldr x2, [sp, x0, lsl #3] // Exploiting scalar = sp exactly - lsr x2, x2, i - and x2, x2, #1 - - cmp swap, x2 - mov swap, x2 - - mux_4(d,dm,dn) - mux_4(s,sm,sn) - -// ADDING: dnsm = sm * dn - - mul_4(dnsm,sm,dn) - -// DOUBLING: d = (xt - zt)^2 - - sqr_4(d,d) - -// ADDING: dpro = (dmsn - dnsm)^2, spro = (dmsn + dnsm)^2 -// DOUBLING: s = (xt + zt)^2 - - sub_twice4(dpro,dmsn,dnsm) - sqr_4(s,s) - add_twice4(spro,dmsn,dnsm) - sqr_4(dpro,dpro) - -// DOUBLING: p = 4 * xt * zt = s - d - - sub_twice4(p,s,d) - -// ADDING: xm' = (dmsn + dnsm)^2 - - sqr_4(xm,spro) - -// DOUBLING: e = 121666 * p + d - - mov x1, 0xdb42 - orr x1, x1, 0x10000 - cmadd_4(e,p,d) - -// DOUBLING: xn' = (xt + zt)^2 * (xt - zt)^2 = s * d - - mul_4(xn,s,d) - -// ADDING: zm' = x * (dmsn - dnsm)^2 - - mul_4(zm,dpro,pointx) - -// DOUBLING: zn' = (4 * xt * zt) * ((xt - zt)^2 + 121666 * (4 * xt * zt)) -// = p * (d + 121666 * p) - - mul_4(zn,p,e) - -// Loop down as far as 3 (inclusive) - - sub i, i, #1 - cmp i, #3 - bcs Lcurve25519_x25519_alt_scalarloop - -// Multiplex directly into (xn,zn) then do three pure doubling steps; -// this accounts for the implicit zeroing of the three lowest bits -// of the scalar. - - cmp swap, xzr - mux_4(xn,xm,xn) - mux_4(zn,zm,zn) - - sub_twice4(d,xn,zn) - add_twice4(s,xn,zn) - sqr_4(d,d) - sqr_4(s,s) - sub_twice4(p,s,d) - mov x1, 0xdb42 - orr x1, x1, 0x10000 - cmadd_4(e,p,d) - mul_4(xn,s,d) - mul_4(zn,p,e) - - sub_twice4(d,xn,zn) - add_twice4(s,xn,zn) - sqr_4(d,d) - sqr_4(s,s) - sub_twice4(p,s,d) - mov x1, 0xdb42 - orr x1, x1, 0x10000 - cmadd_4(e,p,d) - mul_4(xn,s,d) - mul_4(zn,p,e) - - sub_twice4(d,xn,zn) - add_twice4(s,xn,zn) - sqr_4(d,d) - sqr_4(s,s) - sub_twice4(p,s,d) - mov x1, 0xdb42 - orr x1, x1, 0x10000 - cmadd_4(e,p,d) - mul_4(xn,s,d) - mul_4(zn,p,e) - -// The projective result of the scalar multiplication is now (xn,zn). -// Prepare to call the modular inverse function to get zn' = 1/zn - - add x0, zn - add x1, zn - -// Inline copy of bignum_inv_p25519, identical except for stripping out -// the prologue and epilogue saving and restoring registers and making -// and reclaiming room on the stack. For more details and explanations see -// "arm/curve25519/bignum_inv_p25519.S". Note that the stack it uses for -// its own temporaries is 128 bytes, so it has no effect on variables -// that are needed in the rest of our computation here: res, xn and zn. - - mov x20, x0 - mov x10, #0xffffffffffffffed - mov x11, #0xffffffffffffffff - stp x10, x11, [sp] - mov x12, #0x7fffffffffffffff - stp x11, x12, [sp, #16] - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - mov x7, #0x13 - lsr x6, x5, #63 - madd x6, x7, x6, x7 - adds x2, x2, x6 - adcs x3, x3, xzr - adcs x4, x4, xzr - orr x5, x5, #0x8000000000000000 - adcs x5, x5, xzr - csel x6, x7, xzr, cc - subs x2, x2, x6 - sbcs x3, x3, xzr - sbcs x4, x4, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - stp x2, x3, [sp, #32] - stp x4, x5, [sp, #48] - stp xzr, xzr, [sp, #64] - stp xzr, xzr, [sp, #80] - mov x10, #0x2099 - movk x10, #0x7502, lsl #16 - movk x10, #0x9e23, lsl #32 - movk x10, #0xa0f9, lsl #48 - mov x11, #0x2595 - movk x11, #0x1d13, lsl #16 - movk x11, #0x8f3f, lsl #32 - movk x11, #0xa8c6, lsl #48 - mov x12, #0x5242 - movk x12, #0x5ac, lsl #16 - movk x12, #0x8938, lsl #32 - movk x12, #0x6c6c, lsl #48 - mov x13, #0x615 - movk x13, #0x4177, lsl #16 - movk x13, #0x8b2, lsl #32 - movk x13, #0x2765, lsl #48 - stp x10, x11, [sp, #96] - stp x12, x13, [sp, #112] - mov x21, #0xa - mov x22, #0x1 - b Lcurve25519_x25519_alt_invmidloop -Lcurve25519_x25519_alt_invloop: - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - and x0, x12, x16 - and x1, x13, x17 - add x19, x0, x1 - ldr x7, [sp] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #32] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x7, [sp, #8] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #40] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [sp] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [sp, #32] - ldr x7, [sp, #16] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #48] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [sp, #8] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [sp, #40] - ldr x7, [sp, #24] - eor x1, x7, x14 - asr x3, x1, #63 - and x3, x3, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #56] - eor x1, x8, x15 - asr x0, x1, #63 - and x0, x0, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [sp, #16] - extr x5, x3, x5, #59 - str x5, [sp, #24] - eor x1, x7, x16 - asr x5, x1, #63 - and x5, x5, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - asr x0, x1, #63 - and x0, x0, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - extr x4, x2, x4, #59 - str x4, [sp, #48] - extr x2, x5, x2, #59 - str x2, [sp, #56] - ldr x7, [sp, #64] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #96] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #64] - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - str x5, [sp, #96] - adc x3, x3, x1 - ldr x7, [sp, #72] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #104] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #72] - adc x6, x6, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - str x3, [sp, #104] - adc x4, x4, x1 - ldr x7, [sp, #80] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #112] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #80] - adc x5, x5, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - str x4, [sp, #112] - adc x2, x2, x1 - ldr x7, [sp, #88] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #120] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x3, x5, #63 - ldp x0, x1, [sp, #64] - add x6, x6, x3, asr #63 - mov x3, #0x13 - mul x4, x6, x3 - add x5, x5, x6, lsl #63 - smulh x3, x6, x3 - ldr x6, [sp, #80] - adds x0, x0, x4 - adcs x1, x1, x3 - asr x3, x3, #63 - adcs x6, x6, x3 - adc x5, x5, x3 - stp x0, x1, [sp, #64] - stp x6, x5, [sp, #80] - eor x1, x7, x16 - and x5, x16, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - and x0, x17, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - extr x6, x5, x2, #63 - ldp x0, x1, [sp, #96] - add x6, x6, x5, asr #63 - mov x5, #0x13 - mul x4, x6, x5 - add x2, x2, x6, lsl #63 - smulh x5, x6, x5 - ldr x3, [sp, #112] - adds x0, x0, x4 - adcs x1, x1, x5 - asr x5, x5, #63 - adcs x3, x3, x5 - adc x2, x2, x5 - stp x0, x1, [sp, #96] - stp x3, x2, [sp, #112] -Lcurve25519_x25519_alt_invmidloop: - mov x1, x22 - ldr x2, [sp] - ldr x3, [sp, #32] - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x8, x4, #0x100, lsl #12 - sbfx x8, x8, #21, #21 - mov x11, #0x100000 - add x11, x11, x11, lsl #21 - add x9, x4, x11 - asr x9, x9, #42 - add x10, x5, #0x100, lsl #12 - sbfx x10, x10, #21, #21 - add x11, x5, x11 - asr x11, x11, #42 - mul x6, x8, x2 - mul x7, x9, x3 - mul x2, x10, x2 - mul x3, x11, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #21, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #42 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #21, #21 - add x15, x5, x15 - asr x15, x15, #42 - mul x6, x12, x2 - mul x7, x13, x3 - mul x2, x14, x2 - mul x3, x15, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - mul x2, x12, x8 - mul x3, x12, x9 - mul x6, x14, x8 - mul x7, x14, x9 - madd x8, x13, x10, x2 - madd x9, x13, x11, x3 - madd x16, x15, x10, x6 - madd x17, x15, x11, x7 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #22, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #43 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #22, #21 - add x15, x5, x15 - asr x15, x15, #43 - mneg x2, x12, x8 - mneg x3, x12, x9 - mneg x4, x14, x8 - mneg x5, x14, x9 - msub x10, x13, x16, x2 - msub x11, x13, x17, x3 - msub x12, x15, x16, x4 - msub x13, x15, x17, x5 - mov x22, x1 - subs x21, x21, #0x1 - b.ne Lcurve25519_x25519_alt_invloop - ldr x0, [sp] - ldr x1, [sp, #32] - mul x0, x0, x10 - madd x1, x1, x11, x0 - asr x0, x1, #63 - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - eor x14, x14, x0 - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - eor x15, x15, x0 - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - eor x16, x16, x0 - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - eor x17, x17, x0 - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - ldr x7, [sp, #64] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #96] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #64] - adc x2, x2, x1 - ldr x7, [sp, #72] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #104] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #72] - adc x6, x6, x1 - ldr x7, [sp, #80] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #112] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #80] - adc x5, x5, x1 - ldr x7, [sp, #88] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #120] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x3, x5, #63 - ldp x0, x1, [sp, #64] - tst x3, x3 - cinc x6, x6, pl - mov x3, #0x13 - mul x4, x6, x3 - add x5, x5, x6, lsl #63 - smulh x6, x6, x3 - ldr x2, [sp, #80] - adds x0, x0, x4 - adcs x1, x1, x6 - asr x6, x6, #63 - adcs x2, x2, x6 - adcs x5, x5, x6 - csel x3, x3, xzr, mi - subs x0, x0, x3 - sbcs x1, x1, xzr - sbcs x2, x2, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - mov x4, x20 - stp x0, x1, [x4] - stp x2, x5, [x4, #16] - -// Now the result is xn * (1/zn), fully reduced modulo p. -// Note that in the degenerate case zn = 0 (mod p_25519), the -// modular inverse code above will produce 1/zn = 0, giving -// the correct overall X25519 result of zero for the point at -// infinity. - - mul_p25519(resx,xn,zn) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(curve25519_x25519_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519base.S deleted file mode 100644 index 768ed0e61b1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519base.S +++ /dev/null @@ -1,9591 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// The x25519 function for curve25519 on base element 9 -// Input scalar[4]; output res[4] -// -// extern void curve25519_x25519base -// (uint64_t res[static 4],const uint64_t scalar[static 4]); -// -// Given a scalar n, returns the X coordinate of n * G where G = (9,...) is -// the standard generator. The scalar is first slightly modified/mangled -// as specified in the relevant RFC (https://www.rfc-editor.org/rfc/rfc7748). -// -// Standard ARM ABI: X0 = res, X1 = scalar -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(curve25519_x25519base) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(curve25519_x25519base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(curve25519_x25519base) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable home for the input result argument during the whole body - -#define res x23 - -// Other variables that are only needed prior to the modular inverse. - -#define tab x19 - -#define i x20 - -#define bias x21 - -#define bf x22 -#define ix x22 - -// Pointer-offset pairs for result and temporaries on stack with some aliasing. - -#define resx res, #(0*NUMSIZE) - -#define scalar sp, #(0*NUMSIZE) - -#define tabent sp, #(1*NUMSIZE) -#define ymx_2 sp, #(1*NUMSIZE) -#define xpy_2 sp, #(2*NUMSIZE) -#define kxy_2 sp, #(3*NUMSIZE) - -#define acc sp, #(4*NUMSIZE) -#define x_1 sp, #(4*NUMSIZE) -#define y_1 sp, #(5*NUMSIZE) -#define z_1 sp, #(6*NUMSIZE) -#define w_1 sp, #(7*NUMSIZE) -#define x_3 sp, #(4*NUMSIZE) -#define y_3 sp, #(5*NUMSIZE) -#define z_3 sp, #(6*NUMSIZE) -#define w_3 sp, #(7*NUMSIZE) - -#define tmpspace sp, #(8*NUMSIZE) -#define t0 sp, #(8*NUMSIZE) -#define t1 sp, #(9*NUMSIZE) -#define t2 sp, #(10*NUMSIZE) -#define t3 sp, #(11*NUMSIZE) -#define t4 sp, #(12*NUMSIZE) -#define t5 sp, #(13*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 14*NUMSIZE - -// Macro wrapping up the basic field operation bignum_mul_p25519, only -// trivially different from a pure function call to that subroutine. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - umull x7, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x8, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x7, x7, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x8, x8, x15 __LF \ - adds x7, x7, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x8, x8, x16 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - umull x11, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x12, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x11, x11, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x12, x12, x15 __LF \ - adds x11, x11, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x12, x12, x16 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, cc __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, cc __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x9, cc __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, cc __LF \ - cinv x9, x9, cc __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #0x1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x3, #0x26 __LF \ - umull x4, w11, w3 __LF \ - add x4, x4, w7, uxtw __LF \ - lsr x7, x7, #32 __LF \ - lsr x11, x11, #32 __LF \ - umaddl x11, w11, w3, x7 __LF \ - mov x7, x4 __LF \ - umull x4, w12, w3 __LF \ - add x4, x4, w8, uxtw __LF \ - lsr x8, x8, #32 __LF \ - lsr x12, x12, #32 __LF \ - umaddl x12, w12, w3, x8 __LF \ - mov x8, x4 __LF \ - umull x4, w13, w3 __LF \ - add x4, x4, w9, uxtw __LF \ - lsr x9, x9, #32 __LF \ - lsr x13, x13, #32 __LF \ - umaddl x13, w13, w3, x9 __LF \ - mov x9, x4 __LF \ - umull x4, w14, w3 __LF \ - add x4, x4, w10, uxtw __LF \ - lsr x10, x10, #32 __LF \ - lsr x14, x14, #32 __LF \ - umaddl x14, w14, w3, x10 __LF \ - mov x10, x4 __LF \ - lsr x0, x14, #31 __LF \ - mov x5, #0x13 __LF \ - umaddl x5, w5, w0, x5 __LF \ - add x7, x7, x5 __LF \ - adds x7, x7, x11, lsl #32 __LF \ - extr x3, x12, x11, #32 __LF \ - adcs x8, x8, x3 __LF \ - extr x3, x13, x12, #32 __LF \ - adcs x9, x9, x3 __LF \ - extr x3, x14, x13, #32 __LF \ - lsl x5, x0, #63 __LF \ - eor x10, x10, x5 __LF \ - adc x10, x10, x3 __LF \ - mov x3, #0x13 __LF \ - tst x10, #0x8000000000000000 __LF \ - csel x3, x3, xzr, pl __LF \ - subs x7, x7, x3 __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - and x10, x10, #0x7fffffffffffffff __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - umull x7, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x8, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x7, x7, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x8, x8, x15 __LF \ - adds x7, x7, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x8, x8, x16 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - umull x11, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x12, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x11, x11, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x12, x12, x15 __LF \ - adds x11, x11, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x12, x12, x16 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, cc __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, cc __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x9, cc __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, cc __LF \ - cinv x9, x9, cc __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #0x1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x3, #0x26 __LF \ - umull x4, w11, w3 __LF \ - add x4, x4, w7, uxtw __LF \ - lsr x7, x7, #32 __LF \ - lsr x11, x11, #32 __LF \ - umaddl x11, w11, w3, x7 __LF \ - mov x7, x4 __LF \ - umull x4, w12, w3 __LF \ - add x4, x4, w8, uxtw __LF \ - lsr x8, x8, #32 __LF \ - lsr x12, x12, #32 __LF \ - umaddl x12, w12, w3, x8 __LF \ - mov x8, x4 __LF \ - umull x4, w13, w3 __LF \ - add x4, x4, w9, uxtw __LF \ - lsr x9, x9, #32 __LF \ - lsr x13, x13, #32 __LF \ - umaddl x13, w13, w3, x9 __LF \ - mov x9, x4 __LF \ - umull x4, w14, w3 __LF \ - add x4, x4, w10, uxtw __LF \ - lsr x10, x10, #32 __LF \ - lsr x14, x14, #32 __LF \ - umaddl x14, w14, w3, x10 __LF \ - mov x10, x4 __LF \ - lsr x0, x14, #31 __LF \ - mov x5, #0x13 __LF \ - umull x5, w5, w0 __LF \ - add x7, x7, x5 __LF \ - adds x7, x7, x11, lsl #32 __LF \ - extr x3, x12, x11, #32 __LF \ - adcs x8, x8, x3 __LF \ - extr x3, x13, x12, #32 __LF \ - adcs x9, x9, x3 __LF \ - extr x3, x14, x13, #32 __LF \ - lsl x5, x0, #63 __LF \ - eor x10, x10, x5 __LF \ - adc x10, x10, x3 __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular addition and doubling with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -#define double_twice4(P0,P1) \ - ldp x3, x4, [P1] __LF \ - adds x3, x3, x3 __LF \ - adcs x4, x4, x4 __LF \ - ldp x5, x6, [P1+16] __LF \ - adcs x5, x5, x5 __LF \ - adcs x6, x6, x6 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -S2N_BN_SYMBOL(curve25519_x25519base): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_DEC_SP(NSPACE) - -// Move the output pointer to a stable place - - mov res, x0 - -// Copy the input scalar to its local variable while mangling it. -// In principle the mangling is into 01xxx...xxx000, but actually -// we only clear the top two bits so 00xxx...xxxxxx. The additional -// 2^254 * G is taken care of by the starting value for the addition -// chain below, while we never look at the three low bits at all. - - ldp x10, x11, [x1] - stp x10, x11, [scalar] - ldp x12, x13, [x1, #16] - bic x13, x13, #0xc000000000000000 - stp x12, x13, [scalar+16] - -// The main part of the computation is on the edwards25519 curve in -// extended-projective coordinates (X,Y,Z,T), representing a point -// (x,y) via x = X/Z, y = Y/Z and x * y = T/Z (so X * Y = T * Z). -// Only at the very end do we translate back to curve25519. So G -// below means the generator within edwards25519 corresponding to -// (9,...) for curve25519, via the standard isomorphism. -// -// Initialize accumulator "acc" to either (2^254 + 8) * G or just 2^254 * G -// depending on bit 3 of the scalar, the only nonzero bit of the bottom 4. -// Thus, we have effectively dealt with bits 0, 1, 2, 3, 254 and 255. - - ldr x0, [scalar] - ands xzr, x0, #8 - -#if defined(__ELF__) - adrp tab, S2N_BN_SYMBOL(curve25519_x25519base_constant) - add tab, tab, :lo12:S2N_BN_SYMBOL(curve25519_x25519base_constant) -#else - adrp tab, S2N_BN_SYMBOL(curve25519_x25519base_constant)@PAGE - add tab, tab, S2N_BN_SYMBOL(curve25519_x25519base_constant)@PAGEOFF -#endif - - ldp x0, x1, [tab] - ldp x2, x3, [tab, #96] - csel x0, x0, x2, eq - csel x1, x1, x3, eq - stp x0, x1, [acc] - - ldp x0, x1, [tab, #1*16] - ldp x2, x3, [tab, #96+1*16] - csel x0, x0, x2, eq - csel x1, x1, x3, eq - stp x0, x1, [acc+1*16] - - ldp x0, x1, [tab, #2*16] - ldp x2, x3, [tab, #96+2*16] - csel x0, x0, x2, eq - csel x1, x1, x3, eq - stp x0, x1, [acc+2*16] - - ldp x0, x1, [tab, #3*16] - ldp x2, x3, [tab, #96+3*16] - csel x0, x0, x2, eq - csel x1, x1, x3, eq - stp x0, x1, [acc+3*16] - - mov x0, #1 - stp x0, xzr, [acc+4*16] - stp xzr, xzr, [acc+5*16] - - ldp x0, x1, [tab, #4*16] - ldp x2, x3, [tab, #96+4*16] - csel x0, x0, x2, eq - csel x1, x1, x3, eq - stp x0, x1, [acc+6*16] - - ldp x0, x1, [tab, #5*16] - ldp x2, x3, [tab, #96+5*16] - csel x0, x0, x2, eq - csel x1, x1, x3, eq - stp x0, x1, [acc+7*16] - -// The counter "i" tracks the bit position for which the scalar has -// already been absorbed, starting at 4 and going up in chunks of 4. -// -// The pointer "tab" points at the current block of the table for -// multiples (2^i * j) * G at the current bit position i; 1 <= j <= 8. -// -// The bias is always either 0 and 1 and needs to be added to the -// partially processed scalar implicitly. This is used to absorb 4 bits -// of scalar per iteration from 3-bit table indexing by exploiting -// negation: (16 * h + l) * G = (16 * (h + 1) - (16 - l)) * G is used -// when l >= 9. Note that we can't have any bias left over at the -// end because of the clearing of bit 255 of the scalar, meaning the -// l >= 9 case cannot arise on the last iteration. - - mov i, 4 - add tab, tab, #192 - mov bias, xzr - -// Start of the main loop, repeated 63 times for i = 4, 8, ..., 252 - -Lcurve25519_x25519base_scalarloop: - -// Look at the next 4-bit field "bf", adding the previous bias as well. -// Choose the table index "ix" as bf when bf <= 8 and 16 - bf for bf >= 9, -// setting the bias to 1 for the next iteration in the latter case. - - lsr x0, i, #6 - ldr x2, [sp, x0, lsl #3] // Exploiting scalar = sp exactly - lsr x2, x2, i - and x2, x2, #15 - add bf, x2, bias - - cmp bf, 9 - cset bias, cs - - mov x0, 16 - sub x0, x0, bf - cmp bias, xzr - csel ix, x0, bf, ne - -// Perform constant-time lookup in the table to get element number "ix". -// The table entry for the affine point (x,y) is actually a triple -// (y - x,x + y,2 * d * x * y) to precompute parts of the addition. -// Note that "ix" can be 0, so we set up the appropriate identity first. - - mov x0, #1 - mov x1, xzr - mov x2, xzr - mov x3, xzr - mov x4, #1 - mov x5, xzr - mov x6, xzr - mov x7, xzr - mov x8, xzr - mov x9, xzr - mov x10, xzr - mov x11, xzr - - cmp ix, #1 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #2 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #3 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #4 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #5 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #6 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #7 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #8 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - -// We now have the triple from the table in registers as follows -// -// [x3;x2;x1;x0] = y - x -// [x7;x6;x5;x4] = x + y -// [x11;x10;x9;x8] = 2 * d * x * y -// -// In case bias = 1 we need to negate this. For Edwards curves -// -(x,y) = (-x,y), i.e. we need to negate the x coordinate. -// In this processed encoding, that amounts to swapping the -// first two fields and negating the third. -// -// The optional negation here also pretends bias = 0 whenever -// ix = 0 so that it doesn't need to handle the case of zero -// inputs, since no non-trivial table entries are zero. Note -// that in the zero case the whole negation is trivial, and -// so indeed is the swapping. - - cmp bias, #0 - - csel x12, x0, x4, eq - csel x13, x1, x5, eq - csel x14, x2, x6, eq - csel x15, x3, x7, eq - stp x12, x13, [tabent] - stp x14, x15, [tabent+16] - - csel x12, x0, x4, ne - csel x13, x1, x5, ne - csel x14, x2, x6, ne - csel x15, x3, x7, ne - stp x12, x13, [tabent+32] - stp x14, x15, [tabent+48] - - mov x0, #-19 - subs x0, x0, x8 - mov x2, #-1 - sbcs x1, x2, x9 - sbcs x2, x2, x10 - mov x3, #0x7FFFFFFFFFFFFFFF - sbc x3, x3, x11 - - cmp ix, xzr - ccmp bias, xzr, #4, ne - - csel x0, x0, x8, ne - csel x1, x1, x9, ne - stp x0, x1, [tabent+64] - csel x2, x2, x10, ne - csel x3, x3, x11, ne - stp x2, x3, [tabent+80] - -// Extended-projective and precomputed mixed addition. -// This is effectively the same as calling the standalone -// function edwards25519_pepadd(acc,acc,tabent), but we -// only retain slightly weaker normalization < 2 * p_25519 -// throughout the inner loop, so the computation is -// slightly different, and faster overall. - - double_twice4(t0,z_1) - sub_twice4(t1,y_1,x_1) - add_twice4(t2,y_1,x_1) - mul_4(t3,w_1,kxy_2) - mul_4(t1,t1,ymx_2) - mul_4(t2,t2,xpy_2) - sub_twice4(t4,t0,t3) - add_twice4(t0,t0,t3) - sub_twice4(t5,t2,t1) - add_twice4(t1,t2,t1) - mul_4(z_3,t4,t0) - mul_4(x_3,t5,t4) - mul_4(y_3,t0,t1) - mul_4(w_3,t5,t1) - -// End of the main loop; move on by 4 bits. - - add i, i, 4 - cmp i, 256 - bcc Lcurve25519_x25519base_scalarloop - -// Now we need to translate from Edwards curve edwards25519 back -// to the Montgomery form curve25519. The mapping in the affine -// representations is -// -// (x,y) |-> ((1 + y) / (1 - y), c * (1 + y) / ((1 - y) * x)) -// -// For x25519, we only need the x coordinate, and we compute this as -// -// (1 + y) / (1 - y) = (x + x * y) / (x - x * y) -// = (X/Z + T/Z) / (X/Z - T/Z) -// = (X + T) / (X - T) -// = (X + T) * inverse(X - T) -// -// We could equally well use (Z + Y) / (Z - Y), but the above has the -// same cost, and it more explicitly forces zero output whenever X = 0, -// regardless of how the modular inverse behaves on zero inputs. In -// the present setting (base point 9, mangled scalar) that doesn't -// really matter anyway since X = 0 never arises, but it seems a -// little bit tidier. Note that both Edwards point (0,1) which maps to -// the Montgomery point at infinity, and Edwards (0,-1) which maps to -// Montgomery (0,0) [this is the 2-torsion point] are both by definition -// mapped to 0 by the X coordinate mapping used to define curve25519. -// -// First the addition and subtraction: - - add_twice4(t1,x_3,w_3) - sub_twice4(t2,x_3,w_3) - -// Prepare to call the modular inverse function to get t0 = 1/t2 -// Note that this works for the weakly normalized z_3 equally well. -// The non-coprime case z_3 == 0 (mod p_25519) cannot arise anyway. - - add x0, t0 - add x1, t2 - -// Inline copy of bignum_inv_p25519, identical except for stripping out -// the prologue and epilogue saving and restoring registers and making -// and reclaiming room on the stack. For more details and explanations see -// "arm/curve25519/bignum_inv_p25519.S". Note that the stack it uses for -// its own temporaries is 128 bytes, so it has no effect on variables -// that are needed in the rest of our computation here: res, t0, t1, t2. - - mov x20, x0 - mov x10, #0xffffffffffffffed - mov x11, #0xffffffffffffffff - stp x10, x11, [sp] - mov x12, #0x7fffffffffffffff - stp x11, x12, [sp, #16] - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - mov x7, #0x13 - lsr x6, x5, #63 - madd x6, x7, x6, x7 - adds x2, x2, x6 - adcs x3, x3, xzr - adcs x4, x4, xzr - orr x5, x5, #0x8000000000000000 - adcs x5, x5, xzr - csel x6, x7, xzr, cc - subs x2, x2, x6 - sbcs x3, x3, xzr - sbcs x4, x4, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - stp x2, x3, [sp, #32] - stp x4, x5, [sp, #48] - stp xzr, xzr, [sp, #64] - stp xzr, xzr, [sp, #80] - mov x10, #0x2099 - movk x10, #0x7502, lsl #16 - movk x10, #0x9e23, lsl #32 - movk x10, #0xa0f9, lsl #48 - mov x11, #0x2595 - movk x11, #0x1d13, lsl #16 - movk x11, #0x8f3f, lsl #32 - movk x11, #0xa8c6, lsl #48 - mov x12, #0x5242 - movk x12, #0x5ac, lsl #16 - movk x12, #0x8938, lsl #32 - movk x12, #0x6c6c, lsl #48 - mov x13, #0x615 - movk x13, #0x4177, lsl #16 - movk x13, #0x8b2, lsl #32 - movk x13, #0x2765, lsl #48 - stp x10, x11, [sp, #96] - stp x12, x13, [sp, #112] - mov x21, #0xa - mov x22, #0x1 - b Lcurve25519_x25519base_invmidloop -Lcurve25519_x25519base_invloop: - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - and x0, x12, x16 - and x1, x13, x17 - add x19, x0, x1 - ldr x7, [sp] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #32] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x7, [sp, #8] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #40] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [sp] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [sp, #32] - ldr x7, [sp, #16] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #48] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [sp, #8] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [sp, #40] - ldr x7, [sp, #24] - eor x1, x7, x14 - asr x3, x1, #63 - and x3, x3, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #56] - eor x1, x8, x15 - asr x0, x1, #63 - and x0, x0, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [sp, #16] - extr x5, x3, x5, #59 - str x5, [sp, #24] - eor x1, x7, x16 - asr x5, x1, #63 - and x5, x5, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - asr x0, x1, #63 - and x0, x0, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - extr x4, x2, x4, #59 - str x4, [sp, #48] - extr x2, x5, x2, #59 - str x2, [sp, #56] - ldr x7, [sp, #64] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #96] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #64] - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - str x5, [sp, #96] - adc x3, x3, x1 - ldr x7, [sp, #72] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #104] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #72] - adc x6, x6, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - str x3, [sp, #104] - adc x4, x4, x1 - ldr x7, [sp, #80] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #112] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #80] - adc x5, x5, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - str x4, [sp, #112] - adc x2, x2, x1 - ldr x7, [sp, #88] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #120] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x3, x5, #63 - ldp x0, x1, [sp, #64] - add x6, x6, x3, asr #63 - mov x3, #0x13 - mul x4, x6, x3 - add x5, x5, x6, lsl #63 - smulh x3, x6, x3 - ldr x6, [sp, #80] - adds x0, x0, x4 - adcs x1, x1, x3 - asr x3, x3, #63 - adcs x6, x6, x3 - adc x5, x5, x3 - stp x0, x1, [sp, #64] - stp x6, x5, [sp, #80] - eor x1, x7, x16 - and x5, x16, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - and x0, x17, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - extr x6, x5, x2, #63 - ldp x0, x1, [sp, #96] - add x6, x6, x5, asr #63 - mov x5, #0x13 - mul x4, x6, x5 - add x2, x2, x6, lsl #63 - smulh x5, x6, x5 - ldr x3, [sp, #112] - adds x0, x0, x4 - adcs x1, x1, x5 - asr x5, x5, #63 - adcs x3, x3, x5 - adc x2, x2, x5 - stp x0, x1, [sp, #96] - stp x3, x2, [sp, #112] -Lcurve25519_x25519base_invmidloop: - mov x1, x22 - ldr x2, [sp] - ldr x3, [sp, #32] - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x8, x4, #0x100, lsl #12 - sbfx x8, x8, #21, #21 - mov x11, #0x100000 - add x11, x11, x11, lsl #21 - add x9, x4, x11 - asr x9, x9, #42 - add x10, x5, #0x100, lsl #12 - sbfx x10, x10, #21, #21 - add x11, x5, x11 - asr x11, x11, #42 - mul x6, x8, x2 - mul x7, x9, x3 - mul x2, x10, x2 - mul x3, x11, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #21, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #42 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #21, #21 - add x15, x5, x15 - asr x15, x15, #42 - mul x6, x12, x2 - mul x7, x13, x3 - mul x2, x14, x2 - mul x3, x15, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - mul x2, x12, x8 - mul x3, x12, x9 - mul x6, x14, x8 - mul x7, x14, x9 - madd x8, x13, x10, x2 - madd x9, x13, x11, x3 - madd x16, x15, x10, x6 - madd x17, x15, x11, x7 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #22, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #43 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #22, #21 - add x15, x5, x15 - asr x15, x15, #43 - mneg x2, x12, x8 - mneg x3, x12, x9 - mneg x4, x14, x8 - mneg x5, x14, x9 - msub x10, x13, x16, x2 - msub x11, x13, x17, x3 - msub x12, x15, x16, x4 - msub x13, x15, x17, x5 - mov x22, x1 - subs x21, x21, #0x1 - b.ne Lcurve25519_x25519base_invloop - ldr x0, [sp] - ldr x1, [sp, #32] - mul x0, x0, x10 - madd x1, x1, x11, x0 - asr x0, x1, #63 - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - eor x14, x14, x0 - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - eor x15, x15, x0 - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - eor x16, x16, x0 - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - eor x17, x17, x0 - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - ldr x7, [sp, #64] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #96] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #64] - adc x2, x2, x1 - ldr x7, [sp, #72] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #104] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #72] - adc x6, x6, x1 - ldr x7, [sp, #80] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #112] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #80] - adc x5, x5, x1 - ldr x7, [sp, #88] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #120] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x3, x5, #63 - ldp x0, x1, [sp, #64] - tst x3, x3 - cinc x6, x6, pl - mov x3, #0x13 - mul x4, x6, x3 - add x5, x5, x6, lsl #63 - smulh x6, x6, x3 - ldr x2, [sp, #80] - adds x0, x0, x4 - adcs x1, x1, x6 - asr x6, x6, #63 - adcs x2, x2, x6 - adcs x5, x5, x6 - csel x3, x3, xzr, mi - subs x0, x0, x3 - sbcs x1, x1, xzr - sbcs x2, x2, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - mov x4, x20 - stp x0, x1, [x4] - stp x2, x5, [x4, #16] - -// The final result is (X + T) / (X - T) -// This is the only operation in the whole computation that -// fully reduces modulo p_25519 since now we want the canonical -// answer as output. - - mul_p25519(resx,t1,t0) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(curve25519_x25519base) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif - -// **************************************************************************** -// The precomputed data (all read-only). -// **************************************************************************** - -#if defined(__ELF__) -.section .rodata -.type S2N_BN_SYMBOL(curve25519_x25519base_constant), %object -.size S2N_BN_SYMBOL(curve25519_x25519base_constant), 48576 -#elif defined(__APPLE__) -.const_data -#endif - -S2N_BN_SYMBOL(curve25519_x25519base_constant): - -// 2^254 * G and (2^254 + 8) * G in extended-projective coordinates -// but with Z = 1 assumed and hence left out, so they are (X,Y,T) only. - - .quad 0x251037f7cf4e861d - .quad 0x10ede0fb19fb128f - .quad 0x96c033b175f5e2c8 - .quad 0x055f070d6c15fb0d - .quad 0x7c52af2c97473e69 - .quad 0x022f82391bad8378 - .quad 0x9991e1b02adb476f - .quad 0x511144a03a99b855 - .quad 0x5fafc3b88ff2e4ae - .quad 0x855e4ff0de1230ff - .quad 0x72e302a348492870 - .quad 0x1253c19e53dbe1bc - - .quad 0x331d086e0d9abcaa - .quad 0x1e23c96d311a10c9 - .quad 0x96d0f95e58c13478 - .quad 0x2f72f7384fcfcc59 - .quad 0x39a6cd1cfd7d87c9 - .quad 0x9867a0abd8ae153a - .quad 0xa49d2a5f35986745 - .quad 0x57012940cdfe82e1 - .quad 0x5046a6532ec5544a - .quad 0x6d674004739ff6c9 - .quad 0x9bbaa44b234a70e3 - .quad 0x5e6d8901138cf386 - -// Precomputed table of multiples of generator for edwards25519 -// all in precomputed extended-projective (y-x,x+y,2*d*x*y) triples. - - // 2^4 * 1 * G - - .quad 0x7ec851ca553e2df3 - .quad 0xa71284cba64878b3 - .quad 0xe6b5e4193288d1e7 - .quad 0x4cf210ec5a9a8883 - .quad 0x322d04a52d9021f6 - .quad 0xb9c19f3375c6bf9c - .quad 0x587a3a4342d20b09 - .quad 0x143b1cf8aa64fe61 - .quad 0x9f867c7d968acaab - .quad 0x5f54258e27092729 - .quad 0xd0a7d34bea180975 - .quad 0x21b546a3374126e1 - - // 2^4 * 2 * G - - .quad 0xa94ff858a2888343 - .quad 0xce0ed4565313ed3c - .quad 0xf55c3dcfb5bf34fa - .quad 0x0a653ca5c9eab371 - .quad 0x490a7a45d185218f - .quad 0x9a15377846049335 - .quad 0x0060ea09cc31e1f6 - .quad 0x7e041577f86ee965 - .quad 0x66b2a496ce5b67f3 - .quad 0xff5492d8bd569796 - .quad 0x503cec294a592cd0 - .quad 0x566943650813acb2 - - // 2^4 * 3 * G - - .quad 0xb818db0c26620798 - .quad 0x5d5c31d9606e354a - .quad 0x0982fa4f00a8cdc7 - .quad 0x17e12bcd4653e2d4 - .quad 0x5672f9eb1dabb69d - .quad 0xba70b535afe853fc - .quad 0x47ac0f752796d66d - .quad 0x32a5351794117275 - .quad 0xd3a644a6df648437 - .quad 0x703b6559880fbfdd - .quad 0xcb852540ad3a1aa5 - .quad 0x0900b3f78e4c6468 - - // 2^4 * 4 * G - - .quad 0x0a851b9f679d651b - .quad 0xe108cb61033342f2 - .quad 0xd601f57fe88b30a3 - .quad 0x371f3acaed2dd714 - .quad 0xed280fbec816ad31 - .quad 0x52d9595bd8e6efe3 - .quad 0x0fe71772f6c623f5 - .quad 0x4314030b051e293c - .quad 0xd560005efbf0bcad - .quad 0x8eb70f2ed1870c5e - .quad 0x201f9033d084e6a0 - .quad 0x4c3a5ae1ce7b6670 - - // 2^4 * 5 * G - - .quad 0x4138a434dcb8fa95 - .quad 0x870cf67d6c96840b - .quad 0xde388574297be82c - .quad 0x7c814db27262a55a - .quad 0xbaf875e4c93da0dd - .quad 0xb93282a771b9294d - .quad 0x80d63fb7f4c6c460 - .quad 0x6de9c73dea66c181 - .quad 0x478904d5a04df8f2 - .quad 0xfafbae4ab10142d3 - .quad 0xf6c8ac63555d0998 - .quad 0x5aac4a412f90b104 - - // 2^4 * 6 * G - - .quad 0xc64f326b3ac92908 - .quad 0x5551b282e663e1e0 - .quad 0x476b35f54a1a4b83 - .quad 0x1b9da3fe189f68c2 - .quad 0x603a0d0abd7f5134 - .quad 0x8089c932e1d3ae46 - .quad 0xdf2591398798bd63 - .quad 0x1c145cd274ba0235 - .quad 0x32e8386475f3d743 - .quad 0x365b8baf6ae5d9ef - .quad 0x825238b6385b681e - .quad 0x234929c1167d65e1 - - // 2^4 * 7 * G - - .quad 0x984decaba077ade8 - .quad 0x383f77ad19eb389d - .quad 0xc7ec6b7e2954d794 - .quad 0x59c77b3aeb7c3a7a - .quad 0x48145cc21d099fcf - .quad 0x4535c192cc28d7e5 - .quad 0x80e7c1e548247e01 - .quad 0x4a5f28743b2973ee - .quad 0xd3add725225ccf62 - .quad 0x911a3381b2152c5d - .quad 0xd8b39fad5b08f87d - .quad 0x6f05606b4799fe3b - - // 2^4 * 8 * G - - .quad 0x9ffe9e92177ba962 - .quad 0x98aee71d0de5cae1 - .quad 0x3ff4ae942d831044 - .quad 0x714de12e58533ac8 - .quad 0x5b433149f91b6483 - .quad 0xadb5dc655a2cbf62 - .quad 0x87fa8412632827b3 - .quad 0x60895e91ab49f8d8 - .quad 0xe9ecf2ed0cf86c18 - .quad 0xb46d06120735dfd4 - .quad 0xbc9da09804b96be7 - .quad 0x73e2e62fd96dc26b - - // 2^8 * 1 * G - - .quad 0xed5b635449aa515e - .quad 0xa865c49f0bc6823a - .quad 0x850c1fe95b42d1c4 - .quad 0x30d76d6f03d315b9 - .quad 0x2eccdd0e632f9c1d - .quad 0x51d0b69676893115 - .quad 0x52dfb76ba8637a58 - .quad 0x6dd37d49a00eef39 - .quad 0x6c4444172106e4c7 - .quad 0xfb53d680928d7f69 - .quad 0xb4739ea4694d3f26 - .quad 0x10c697112e864bb0 - - // 2^8 * 2 * G - - .quad 0x6493c4277dbe5fde - .quad 0x265d4fad19ad7ea2 - .quad 0x0e00dfc846304590 - .quad 0x25e61cabed66fe09 - .quad 0x0ca62aa08358c805 - .quad 0x6a3d4ae37a204247 - .quad 0x7464d3a63b11eddc - .quad 0x03bf9baf550806ef - .quad 0x3f13e128cc586604 - .quad 0x6f5873ecb459747e - .quad 0xa0b63dedcc1268f5 - .quad 0x566d78634586e22c - - // 2^8 * 3 * G - - .quad 0x1637a49f9cc10834 - .quad 0xbc8e56d5a89bc451 - .quad 0x1cb5ec0f7f7fd2db - .quad 0x33975bca5ecc35d9 - .quad 0xa1054285c65a2fd0 - .quad 0x6c64112af31667c3 - .quad 0x680ae240731aee58 - .quad 0x14fba5f34793b22a - .quad 0x3cd746166985f7d4 - .quad 0x593e5e84c9c80057 - .quad 0x2fc3f2b67b61131e - .quad 0x14829cea83fc526c - - // 2^8 * 4 * G - - .quad 0xff437b8497dd95c2 - .quad 0x6c744e30aa4eb5a7 - .quad 0x9e0c5d613c85e88b - .quad 0x2fd9c71e5f758173 - .quad 0x21e70b2f4e71ecb8 - .quad 0xe656ddb940a477e3 - .quad 0xbf6556cece1d4f80 - .quad 0x05fc3bc4535d7b7e - .quad 0x24b8b3ae52afdedd - .quad 0x3495638ced3b30cf - .quad 0x33a4bc83a9be8195 - .quad 0x373767475c651f04 - - // 2^8 * 5 * G - - .quad 0x2fba99fd40d1add9 - .quad 0xb307166f96f4d027 - .quad 0x4363f05215f03bae - .quad 0x1fbea56c3b18f999 - .quad 0x634095cb14246590 - .quad 0xef12144016c15535 - .quad 0x9e38140c8910bc60 - .quad 0x6bf5905730907c8c - .quad 0x0fa778f1e1415b8a - .quad 0x06409ff7bac3a77e - .quad 0x6f52d7b89aa29a50 - .quad 0x02521cf67a635a56 - - // 2^8 * 6 * G - - .quad 0x513fee0b0a9d5294 - .quad 0x8f98e75c0fdf5a66 - .quad 0xd4618688bfe107ce - .quad 0x3fa00a7e71382ced - .quad 0xb1146720772f5ee4 - .quad 0xe8f894b196079ace - .quad 0x4af8224d00ac824a - .quad 0x001753d9f7cd6cc4 - .quad 0x3c69232d963ddb34 - .quad 0x1dde87dab4973858 - .quad 0xaad7d1f9a091f285 - .quad 0x12b5fe2fa048edb6 - - // 2^8 * 7 * G - - .quad 0x71f0fbc496fce34d - .quad 0x73b9826badf35bed - .quad 0xd2047261ff28c561 - .quad 0x749b76f96fb1206f - .quad 0xdf2b7c26ad6f1e92 - .quad 0x4b66d323504b8913 - .quad 0x8c409dc0751c8bc3 - .quad 0x6f7e93c20796c7b8 - .quad 0x1f5af604aea6ae05 - .quad 0xc12351f1bee49c99 - .quad 0x61a808b5eeff6b66 - .quad 0x0fcec10f01e02151 - - // 2^8 * 8 * G - - .quad 0x644d58a649fe1e44 - .quad 0x21fcaea231ad777e - .quad 0x02441c5a887fd0d2 - .quad 0x4901aa7183c511f3 - .quad 0x3df2d29dc4244e45 - .quad 0x2b020e7493d8de0a - .quad 0x6cc8067e820c214d - .quad 0x413779166feab90a - .quad 0x08b1b7548c1af8f0 - .quad 0xce0f7a7c246299b4 - .quad 0xf760b0f91e06d939 - .quad 0x41bb887b726d1213 - - // 2^12 * 1 * G - - .quad 0x9267806c567c49d8 - .quad 0x066d04ccca791e6a - .quad 0xa69f5645e3cc394b - .quad 0x5c95b686a0788cd2 - .quad 0x97d980e0aa39f7d2 - .quad 0x35d0384252c6b51c - .quad 0x7d43f49307cd55aa - .quad 0x56bd36cfb78ac362 - .quad 0x2ac519c10d14a954 - .quad 0xeaf474b494b5fa90 - .quad 0xe6af8382a9f87a5a - .quad 0x0dea6db1879be094 - - // 2^12 * 2 * G - - .quad 0xaa66bf547344e5ab - .quad 0xda1258888f1b4309 - .quad 0x5e87d2b3fd564b2f - .quad 0x5b2c78885483b1dd - .quad 0x15baeb74d6a8797a - .quad 0x7ef55cf1fac41732 - .quad 0x29001f5a3c8b05c5 - .quad 0x0ad7cc8752eaccfb - .quad 0x52151362793408cf - .quad 0xeb0f170319963d94 - .quad 0xa833b2fa883d9466 - .quad 0x093a7fa775003c78 - - // 2^12 * 3 * G - - .quad 0xe5107de63a16d7be - .quad 0xa377ffdc9af332cf - .quad 0x70d5bf18440b677f - .quad 0x6a252b19a4a31403 - .quad 0xb8e9604460a91286 - .quad 0x7f3fd8047778d3de - .quad 0x67d01e31bf8a5e2d - .quad 0x7b038a06c27b653e - .quad 0x9ed919d5d36990f3 - .quad 0x5213aebbdb4eb9f2 - .quad 0xc708ea054cb99135 - .quad 0x58ded57f72260e56 - - // 2^12 * 4 * G - - .quad 0x78e79dade9413d77 - .quad 0xf257f9d59729e67d - .quad 0x59db910ee37aa7e6 - .quad 0x6aa11b5bbb9e039c - .quad 0xda6d53265b0fd48b - .quad 0x8960823193bfa988 - .quad 0xd78ac93261d57e28 - .quad 0x79f2942d3a5c8143 - .quad 0x97da2f25b6c88de9 - .quad 0x251ba7eaacf20169 - .quad 0x09b44f87ef4eb4e4 - .quad 0x7d90ab1bbc6a7da5 - - // 2^12 * 5 * G - - .quad 0x9acca683a7016bfe - .quad 0x90505f4df2c50b6d - .quad 0x6b610d5fcce435aa - .quad 0x19a10d446198ff96 - .quad 0x1a07a3f496b3c397 - .quad 0x11ceaa188f4e2532 - .quad 0x7d9498d5a7751bf0 - .quad 0x19ed161f508dd8a0 - .quad 0x560a2cd687dce6ca - .quad 0x7f3568c48664cf4d - .quad 0x8741e95222803a38 - .quad 0x483bdab1595653fc - - // 2^12 * 6 * G - - .quad 0xfa780f148734fa49 - .quad 0x106f0b70360534e0 - .quad 0x2210776fe3e307bd - .quad 0x3286c109dde6a0fe - .quad 0xd6cf4d0ab4da80f6 - .quad 0x82483e45f8307fe0 - .quad 0x05005269ae6f9da4 - .quad 0x1c7052909cf7877a - .quad 0x32ee7de2874e98d4 - .quad 0x14c362e9b97e0c60 - .quad 0x5781dcde6a60a38a - .quad 0x217dd5eaaa7aa840 - - // 2^12 * 7 * G - - .quad 0x9db7c4d0248e1eb0 - .quad 0xe07697e14d74bf52 - .quad 0x1e6a9b173c562354 - .quad 0x7fa7c21f795a4965 - .quad 0x8bdf1fb9be8c0ec8 - .quad 0x00bae7f8e30a0282 - .quad 0x4963991dad6c4f6c - .quad 0x07058a6e5df6f60a - .quad 0xe9eb02c4db31f67f - .quad 0xed25fd8910bcfb2b - .quad 0x46c8131f5c5cddb4 - .quad 0x33b21c13a0cb9bce - - // 2^12 * 8 * G - - .quad 0x360692f8087d8e31 - .quad 0xf4dcc637d27163f7 - .quad 0x25a4e62065ea5963 - .quad 0x659bf72e5ac160d9 - .quad 0x9aafb9b05ee38c5b - .quad 0xbf9d2d4e071a13c7 - .quad 0x8eee6e6de933290a - .quad 0x1c3bab17ae109717 - .quad 0x1c9ab216c7cab7b0 - .quad 0x7d65d37407bbc3cc - .quad 0x52744750504a58d5 - .quad 0x09f2606b131a2990 - - // 2^16 * 1 * G - - .quad 0x40e87d44744346be - .quad 0x1d48dad415b52b25 - .quad 0x7c3a8a18a13b603e - .quad 0x4eb728c12fcdbdf7 - .quad 0x7e234c597c6691ae - .quad 0x64889d3d0a85b4c8 - .quad 0xdae2c90c354afae7 - .quad 0x0a871e070c6a9e1d - .quad 0x3301b5994bbc8989 - .quad 0x736bae3a5bdd4260 - .quad 0x0d61ade219d59e3c - .quad 0x3ee7300f2685d464 - - // 2^16 * 2 * G - - .quad 0xf5d255e49e7dd6b7 - .quad 0x8016115c610b1eac - .quad 0x3c99975d92e187ca - .quad 0x13815762979125c2 - .quad 0x43fa7947841e7518 - .quad 0xe5c6fa59639c46d7 - .quad 0xa1065e1de3052b74 - .quad 0x7d47c6a2cfb89030 - .quad 0x3fdad0148ef0d6e0 - .quad 0x9d3e749a91546f3c - .quad 0x71ec621026bb8157 - .quad 0x148cf58d34c9ec80 - - // 2^16 * 3 * G - - .quad 0x46a492f67934f027 - .quad 0x469984bef6840aa9 - .quad 0x5ca1bc2a89611854 - .quad 0x3ff2fa1ebd5dbbd4 - .quad 0xe2572f7d9ae4756d - .quad 0x56c345bb88f3487f - .quad 0x9fd10b6d6960a88d - .quad 0x278febad4eaea1b9 - .quad 0xb1aa681f8c933966 - .quad 0x8c21949c20290c98 - .quad 0x39115291219d3c52 - .quad 0x4104dd02fe9c677b - - // 2^16 * 4 * G - - .quad 0x72b2bf5e1124422a - .quad 0xa1fa0c3398a33ab5 - .quad 0x94cb6101fa52b666 - .quad 0x2c863b00afaf53d5 - .quad 0x81214e06db096ab8 - .quad 0x21a8b6c90ce44f35 - .quad 0x6524c12a409e2af5 - .quad 0x0165b5a48efca481 - .quad 0xf190a474a0846a76 - .quad 0x12eff984cd2f7cc0 - .quad 0x695e290658aa2b8f - .quad 0x591b67d9bffec8b8 - - // 2^16 * 5 * G - - .quad 0x312f0d1c80b49bfa - .quad 0x5979515eabf3ec8a - .quad 0x727033c09ef01c88 - .quad 0x3de02ec7ca8f7bcb - .quad 0x99b9b3719f18b55d - .quad 0xe465e5faa18c641e - .quad 0x61081136c29f05ed - .quad 0x489b4f867030128b - .quad 0xd232102d3aeb92ef - .quad 0xe16253b46116a861 - .quad 0x3d7eabe7190baa24 - .quad 0x49f5fbba496cbebf - - // 2^16 * 6 * G - - .quad 0x30949a108a5bcfd4 - .quad 0xdc40dd70bc6473eb - .quad 0x92c294c1307c0d1c - .quad 0x5604a86dcbfa6e74 - .quad 0x155d628c1e9c572e - .quad 0x8a4d86acc5884741 - .quad 0x91a352f6515763eb - .quad 0x06a1a6c28867515b - .quad 0x7288d1d47c1764b6 - .quad 0x72541140e0418b51 - .quad 0x9f031a6018acf6d1 - .quad 0x20989e89fe2742c6 - - // 2^16 * 7 * G - - .quad 0x499777fd3a2dcc7f - .quad 0x32857c2ca54fd892 - .quad 0xa279d864d207e3a0 - .quad 0x0403ed1d0ca67e29 - .quad 0x1674278b85eaec2e - .quad 0x5621dc077acb2bdf - .quad 0x640a4c1661cbf45a - .quad 0x730b9950f70595d3 - .quad 0xc94b2d35874ec552 - .quad 0xc5e6c8cf98246f8d - .quad 0xf7cb46fa16c035ce - .quad 0x5bd7454308303dcc - - // 2^16 * 8 * G - - .quad 0x7f9ad19528b24cc2 - .quad 0x7f6b54656335c181 - .quad 0x66b8b66e4fc07236 - .quad 0x133a78007380ad83 - .quad 0x85c4932115e7792a - .quad 0xc64c89a2bdcdddc9 - .quad 0x9d1e3da8ada3d762 - .quad 0x5bb7db123067f82c - .quad 0x0961f467c6ca62be - .quad 0x04ec21d6211952ee - .quad 0x182360779bd54770 - .quad 0x740dca6d58f0e0d2 - - // 2^20 * 1 * G - - .quad 0x50b70bf5d3f0af0b - .quad 0x4feaf48ae32e71f7 - .quad 0x60e84ed3a55bbd34 - .quad 0x00ed489b3f50d1ed - .quad 0x3906c72aed261ae5 - .quad 0x9ab68fd988e100f7 - .quad 0xf5e9059af3360197 - .quad 0x0e53dc78bf2b6d47 - .quad 0xb90829bf7971877a - .quad 0x5e4444636d17e631 - .quad 0x4d05c52e18276893 - .quad 0x27632d9a5a4a4af5 - - // 2^20 * 2 * G - - .quad 0xd11ff05154b260ce - .quad 0xd86dc38e72f95270 - .quad 0x601fcd0d267cc138 - .quad 0x2b67916429e90ccd - .quad 0xa98285d187eaffdb - .quad 0xa5b4fbbbd8d0a864 - .quad 0xb658f27f022663f7 - .quad 0x3bbc2b22d99ce282 - .quad 0xb917c952583c0a58 - .quad 0x653ff9b80fe4c6f3 - .quad 0x9b0da7d7bcdf3c0c - .quad 0x43a0eeb6ab54d60e - - // 2^20 * 3 * G - - .quad 0x396966a46d4a5487 - .quad 0xf811a18aac2bb3ba - .quad 0x66e4685b5628b26b - .quad 0x70a477029d929b92 - .quad 0x3ac6322357875fe8 - .quad 0xd9d4f4ecf5fbcb8f - .quad 0x8dee8493382bb620 - .quad 0x50c5eaa14c799fdc - .quad 0xdd0edc8bd6f2fb3c - .quad 0x54c63aa79cc7b7a0 - .quad 0xae0b032b2c8d9f1a - .quad 0x6f9ce107602967fb - - // 2^20 * 4 * G - - .quad 0xad1054b1cde1c22a - .quad 0xc4a8e90248eb32df - .quad 0x5f3e7b33accdc0ea - .quad 0x72364713fc79963e - .quad 0x139693063520e0b5 - .quad 0x437fcf7c88ea03fe - .quad 0xf7d4c40bd3c959bc - .quad 0x699154d1f893ded9 - .quad 0x315d5c75b4b27526 - .quad 0xcccb842d0236daa5 - .quad 0x22f0c8a3345fee8e - .quad 0x73975a617d39dbed - - // 2^20 * 5 * G - - .quad 0xe4024df96375da10 - .quad 0x78d3251a1830c870 - .quad 0x902b1948658cd91c - .quad 0x7e18b10b29b7438a - .quad 0x6f37f392f4433e46 - .quad 0x0e19b9a11f566b18 - .quad 0x220fb78a1fd1d662 - .quad 0x362a4258a381c94d - .quad 0x9071d9132b6beb2f - .quad 0x0f26e9ad28418247 - .quad 0xeab91ec9bdec925d - .quad 0x4be65bc8f48af2de - - // 2^20 * 6 * G - - .quad 0x78487feba36e7028 - .quad 0x5f3f13001dd8ce34 - .quad 0x934fb12d4b30c489 - .quad 0x056c244d397f0a2b - .quad 0x1d50fba257c26234 - .quad 0x7bd4823adeb0678b - .quad 0xc2b0dc6ea6538af5 - .quad 0x5665eec6351da73e - .quad 0xdb3ee00943bfb210 - .quad 0x4972018720800ac2 - .quad 0x26ab5d6173bd8667 - .quad 0x20b209c2ab204938 - - // 2^20 * 7 * G - - .quad 0x549e342ac07fb34b - .quad 0x02d8220821373d93 - .quad 0xbc262d70acd1f567 - .quad 0x7a92c9fdfbcac784 - .quad 0x1fcca94516bd3289 - .quad 0x448d65aa41420428 - .quad 0x59c3b7b216a55d62 - .quad 0x49992cc64e612cd8 - .quad 0x65bd1bea70f801de - .quad 0x1befb7c0fe49e28a - .quad 0xa86306cdb1b2ae4a - .quad 0x3b7ac0cd265c2a09 - - // 2^20 * 8 * G - - .quad 0x822bee438c01bcec - .quad 0x530cb525c0fbc73b - .quad 0x48519034c1953fe9 - .quad 0x265cc261e09a0f5b - .quad 0xf0d54e4f22ed39a7 - .quad 0xa2aae91e5608150a - .quad 0xf421b2e9eddae875 - .quad 0x31bc531d6b7de992 - .quad 0xdf3d134da980f971 - .quad 0x7a4fb8d1221a22a7 - .quad 0x3df7d42035aad6d8 - .quad 0x2a14edcc6a1a125e - - // 2^24 * 1 * G - - .quad 0xdf48ee0752cfce4e - .quad 0xc3fffaf306ec08b7 - .quad 0x05710b2ab95459c4 - .quad 0x161d25fa963ea38d - .quad 0x231a8c570478433c - .quad 0xb7b5270ec281439d - .quad 0xdbaa99eae3d9079f - .quad 0x2c03f5256c2b03d9 - .quad 0x790f18757b53a47d - .quad 0x307b0130cf0c5879 - .quad 0x31903d77257ef7f9 - .quad 0x699468bdbd96bbaf - - // 2^24 * 2 * G - - .quad 0xbd1f2f46f4dafecf - .quad 0x7cef0114a47fd6f7 - .quad 0xd31ffdda4a47b37f - .quad 0x525219a473905785 - .quad 0xd8dd3de66aa91948 - .quad 0x485064c22fc0d2cc - .quad 0x9b48246634fdea2f - .quad 0x293e1c4e6c4a2e3a - .quad 0x376e134b925112e1 - .quad 0x703778b5dca15da0 - .quad 0xb04589af461c3111 - .quad 0x5b605c447f032823 - - // 2^24 * 3 * G - - .quad 0xb965805920c47c89 - .quad 0xe7f0100c923b8fcc - .quad 0x0001256502e2ef77 - .quad 0x24a76dcea8aeb3ee - .quad 0x3be9fec6f0e7f04c - .quad 0x866a579e75e34962 - .quad 0x5542ef161e1de61a - .quad 0x2f12fef4cc5abdd5 - .quad 0x0a4522b2dfc0c740 - .quad 0x10d06e7f40c9a407 - .quad 0xc6cf144178cff668 - .quad 0x5e607b2518a43790 - - // 2^24 * 4 * G - - .quad 0x58b31d8f6cdf1818 - .quad 0x35cfa74fc36258a2 - .quad 0xe1b3ff4f66e61d6e - .quad 0x5067acab6ccdd5f7 - .quad 0xa02c431ca596cf14 - .quad 0xe3c42d40aed3e400 - .quad 0xd24526802e0f26db - .quad 0x201f33139e457068 - .quad 0xfd527f6b08039d51 - .quad 0x18b14964017c0006 - .quad 0xd5220eb02e25a4a8 - .quad 0x397cba8862460375 - - // 2^24 * 5 * G - - .quad 0x30c13093f05959b2 - .quad 0xe23aa18de9a97976 - .quad 0x222fd491721d5e26 - .quad 0x2339d320766e6c3a - .quad 0x7815c3fbc81379e7 - .quad 0xa6619420dde12af1 - .quad 0xffa9c0f885a8fdd5 - .quad 0x771b4022c1e1c252 - .quad 0xd87dd986513a2fa7 - .quad 0xf5ac9b71f9d4cf08 - .quad 0xd06bc31b1ea283b3 - .quad 0x331a189219971a76 - - // 2^24 * 6 * G - - .quad 0xf5166f45fb4f80c6 - .quad 0x9c36c7de61c775cf - .quad 0xe3d4e81b9041d91c - .quad 0x31167c6b83bdfe21 - .quad 0x26512f3a9d7572af - .quad 0x5bcbe28868074a9e - .quad 0x84edc1c11180f7c4 - .quad 0x1ac9619ff649a67b - .quad 0xf22b3842524b1068 - .quad 0x5068343bee9ce987 - .quad 0xfc9d71844a6250c8 - .quad 0x612436341f08b111 - - // 2^24 * 7 * G - - .quad 0xd99d41db874e898d - .quad 0x09fea5f16c07dc20 - .quad 0x793d2c67d00f9bbc - .quad 0x46ebe2309e5eff40 - .quad 0x8b6349e31a2d2638 - .quad 0x9ddfb7009bd3fd35 - .quad 0x7f8bf1b8a3a06ba4 - .quad 0x1522aa3178d90445 - .quad 0x2c382f5369614938 - .quad 0xdafe409ab72d6d10 - .quad 0xe8c83391b646f227 - .quad 0x45fe70f50524306c - - // 2^24 * 8 * G - - .quad 0xda4875a6960c0b8c - .quad 0x5b68d076ef0e2f20 - .quad 0x07fb51cf3d0b8fd4 - .quad 0x428d1623a0e392d4 - .quad 0x62f24920c8951491 - .quad 0x05f007c83f630ca2 - .quad 0x6fbb45d2f5c9d4b8 - .quad 0x16619f6db57a2245 - .quad 0x084f4a4401a308fd - .quad 0xa82219c376a5caac - .quad 0xdeb8de4643d1bc7d - .quad 0x1d81592d60bd38c6 - - // 2^28 * 1 * G - - .quad 0xd833d7beec2a4c38 - .quad 0x2c9162830acc20ed - .quad 0xe93a47aa92df7581 - .quad 0x702d67a3333c4a81 - .quad 0x3a4a369a2f89c8a1 - .quad 0x63137a1d7c8de80d - .quad 0xbcac008a78eda015 - .quad 0x2cb8b3a5b483b03f - .quad 0x36e417cbcb1b90a1 - .quad 0x33b3ddaa7f11794e - .quad 0x3f510808885bc607 - .quad 0x24141dc0e6a8020d - - // 2^28 * 2 * G - - .quad 0x59f73c773fefee9d - .quad 0xb3f1ef89c1cf989d - .quad 0xe35dfb42e02e545f - .quad 0x5766120b47a1b47c - .quad 0x91925dccbd83157d - .quad 0x3ca1205322cc8094 - .quad 0x28e57f183f90d6e4 - .quad 0x1a4714cede2e767b - .quad 0xdb20ba0fb8b6b7ff - .quad 0xb732c3b677511fa1 - .quad 0xa92b51c099f02d89 - .quad 0x4f3875ad489ca5f1 - - // 2^28 * 3 * G - - .quad 0xc7fc762f4932ab22 - .quad 0x7ac0edf72f4c3c1b - .quad 0x5f6b55aa9aa895e8 - .quad 0x3680274dad0a0081 - .quad 0x79ed13f6ee73eec0 - .quad 0xa5c6526d69110bb1 - .quad 0xe48928c38603860c - .quad 0x722a1446fd7059f5 - .quad 0xd0959fe9a8cf8819 - .quad 0xd0a995508475a99c - .quad 0x6eac173320b09cc5 - .quad 0x628ecf04331b1095 - - // 2^28 * 4 * G - - .quad 0x98bcb118a9d0ddbc - .quad 0xee449e3408b4802b - .quad 0x87089226b8a6b104 - .quad 0x685f349a45c7915d - .quad 0x9b41acf85c74ccf1 - .quad 0xb673318108265251 - .quad 0x99c92aed11adb147 - .quad 0x7a47d70d34ecb40f - .quad 0x60a0c4cbcc43a4f5 - .quad 0x775c66ca3677bea9 - .quad 0xa17aa1752ff8f5ed - .quad 0x11ded9020e01fdc0 - - // 2^28 * 5 * G - - .quad 0x890e7809caefe704 - .quad 0x8728296de30e8c6c - .quad 0x4c5cd2a392aeb1c9 - .quad 0x194263d15771531f - .quad 0x471f95b03bea93b7 - .quad 0x0552d7d43313abd3 - .quad 0xbd9370e2e17e3f7b - .quad 0x7b120f1db20e5bec - .quad 0x17d2fb3d86502d7a - .quad 0xb564d84450a69352 - .quad 0x7da962c8a60ed75d - .quad 0x00d0f85b318736aa - - // 2^28 * 6 * G - - .quad 0x978b142e777c84fd - .quad 0xf402644705a8c062 - .quad 0xa67ad51be7e612c7 - .quad 0x2f7b459698dd6a33 - .quad 0xa6753c1efd7621c1 - .quad 0x69c0b4a7445671f5 - .quad 0x971f527405b23c11 - .quad 0x387bc74851a8c7cd - .quad 0x81894b4d4a52a9a8 - .quad 0xadd93e12f6b8832f - .quad 0x184d8548b61bd638 - .quad 0x3f1c62dbd6c9f6cd - - // 2^28 * 7 * G - - .quad 0x2e8f1f0091910c1f - .quad 0xa4df4fe0bff2e12c - .quad 0x60c6560aee927438 - .quad 0x6338283facefc8fa - .quad 0x3fad3e40148f693d - .quad 0x052656e194eb9a72 - .quad 0x2f4dcbfd184f4e2f - .quad 0x406f8db1c482e18b - .quad 0x9e630d2c7f191ee4 - .quad 0x4fbf8301bc3ff670 - .quad 0x787d8e4e7afb73c4 - .quad 0x50d83d5be8f58fa5 - - // 2^28 * 8 * G - - .quad 0x85683916c11a1897 - .quad 0x2d69a4efe506d008 - .quad 0x39af1378f664bd01 - .quad 0x65942131361517c6 - .quad 0xc0accf90b4d3b66d - .quad 0xa7059de561732e60 - .quad 0x033d1f7870c6b0ba - .quad 0x584161cd26d946e4 - .quad 0xbbf2b1a072d27ca2 - .quad 0xbf393c59fbdec704 - .quad 0xe98dbbcee262b81e - .quad 0x02eebd0b3029b589 - - // 2^32 * 1 * G - - .quad 0x61368756a60dac5f - .quad 0x17e02f6aebabdc57 - .quad 0x7f193f2d4cce0f7d - .quad 0x20234a7789ecdcf0 - .quad 0x8765b69f7b85c5e8 - .quad 0x6ff0678bd168bab2 - .quad 0x3a70e77c1d330f9b - .quad 0x3a5f6d51b0af8e7c - .quad 0x76d20db67178b252 - .quad 0x071c34f9d51ed160 - .quad 0xf62a4a20b3e41170 - .quad 0x7cd682353cffe366 - - // 2^32 * 2 * G - - .quad 0x0be1a45bd887fab6 - .quad 0x2a846a32ba403b6e - .quad 0xd9921012e96e6000 - .quad 0x2838c8863bdc0943 - .quad 0xa665cd6068acf4f3 - .quad 0x42d92d183cd7e3d3 - .quad 0x5759389d336025d9 - .quad 0x3ef0253b2b2cd8ff - .quad 0xd16bb0cf4a465030 - .quad 0xfa496b4115c577ab - .quad 0x82cfae8af4ab419d - .quad 0x21dcb8a606a82812 - - // 2^32 * 3 * G - - .quad 0x5c6004468c9d9fc8 - .quad 0x2540096ed42aa3cb - .quad 0x125b4d4c12ee2f9c - .quad 0x0bc3d08194a31dab - .quad 0x9a8d00fabe7731ba - .quad 0x8203607e629e1889 - .quad 0xb2cc023743f3d97f - .quad 0x5d840dbf6c6f678b - .quad 0x706e380d309fe18b - .quad 0x6eb02da6b9e165c7 - .quad 0x57bbba997dae20ab - .quad 0x3a4276232ac196dd - - // 2^32 * 4 * G - - .quad 0x4b42432c8a7084fa - .quad 0x898a19e3dfb9e545 - .quad 0xbe9f00219c58e45d - .quad 0x1ff177cea16debd1 - .quad 0x3bf8c172db447ecb - .quad 0x5fcfc41fc6282dbd - .quad 0x80acffc075aa15fe - .quad 0x0770c9e824e1a9f9 - .quad 0xcf61d99a45b5b5fd - .quad 0x860984e91b3a7924 - .quad 0xe7300919303e3e89 - .quad 0x39f264fd41500b1e - - // 2^32 * 5 * G - - .quad 0xa7ad3417dbe7e29c - .quad 0xbd94376a2b9c139c - .quad 0xa0e91b8e93597ba9 - .quad 0x1712d73468889840 - .quad 0xd19b4aabfe097be1 - .quad 0xa46dfce1dfe01929 - .quad 0xc3c908942ca6f1ff - .quad 0x65c621272c35f14e - .quad 0xe72b89f8ce3193dd - .quad 0x4d103356a125c0bb - .quad 0x0419a93d2e1cfe83 - .quad 0x22f9800ab19ce272 - - // 2^32 * 6 * G - - .quad 0x605a368a3e9ef8cb - .quad 0xe3e9c022a5504715 - .quad 0x553d48b05f24248f - .quad 0x13f416cd647626e5 - .quad 0x42029fdd9a6efdac - .quad 0xb912cebe34a54941 - .quad 0x640f64b987bdf37b - .quad 0x4171a4d38598cab4 - .quad 0xfa2758aa99c94c8c - .quad 0x23006f6fb000b807 - .quad 0xfbd291ddadda5392 - .quad 0x508214fa574bd1ab - - // 2^32 * 7 * G - - .quad 0xc20269153ed6fe4b - .quad 0xa65a6739511d77c4 - .quad 0xcbde26462c14af94 - .quad 0x22f960ec6faba74b - .quad 0x461a15bb53d003d6 - .quad 0xb2102888bcf3c965 - .quad 0x27c576756c683a5a - .quad 0x3a7758a4c86cb447 - .quad 0x548111f693ae5076 - .quad 0x1dae21df1dfd54a6 - .quad 0x12248c90f3115e65 - .quad 0x5d9fd15f8de7f494 - - // 2^32 * 8 * G - - .quad 0x031408d36d63727f - .quad 0x6a379aefd7c7b533 - .quad 0xa9e18fc5ccaee24b - .quad 0x332f35914f8fbed3 - .quad 0x3f244d2aeed7521e - .quad 0x8e3a9028432e9615 - .quad 0xe164ba772e9c16d4 - .quad 0x3bc187fa47eb98d8 - .quad 0x6d470115ea86c20c - .quad 0x998ab7cb6c46d125 - .quad 0xd77832b53a660188 - .quad 0x450d81ce906fba03 - - // 2^36 * 1 * G - - .quad 0xf8ae4d2ad8453902 - .quad 0x7018058ee8db2d1d - .quad 0xaab3995fc7d2c11e - .quad 0x53b16d2324ccca79 - .quad 0x23264d66b2cae0b5 - .quad 0x7dbaed33ebca6576 - .quad 0x030ebed6f0d24ac8 - .quad 0x2a887f78f7635510 - .quad 0x2a23b9e75c012d4f - .quad 0x0c974651cae1f2ea - .quad 0x2fb63273675d70ca - .quad 0x0ba7250b864403f5 - - // 2^36 * 2 * G - - .quad 0xbb0d18fd029c6421 - .quad 0xbc2d142189298f02 - .quad 0x8347f8e68b250e96 - .quad 0x7b9f2fe8032d71c9 - .quad 0xdd63589386f86d9c - .quad 0x61699176e13a85a4 - .quad 0x2e5111954eaa7d57 - .quad 0x32c21b57fb60bdfb - .quad 0xd87823cd319e0780 - .quad 0xefc4cfc1897775c5 - .quad 0x4854fb129a0ab3f7 - .quad 0x12c49d417238c371 - - // 2^36 * 3 * G - - .quad 0x0950b533ffe83769 - .quad 0x21861c1d8e1d6bd1 - .quad 0xf022d8381302e510 - .quad 0x2509200c6391cab4 - .quad 0x09b3a01783799542 - .quad 0x626dd08faad5ee3f - .quad 0xba00bceeeb70149f - .quad 0x1421b246a0a444c9 - .quad 0x4aa43a8e8c24a7c7 - .quad 0x04c1f540d8f05ef5 - .quad 0xadba5e0c0b3eb9dc - .quad 0x2ab5504448a49ce3 - - // 2^36 * 4 * G - - .quad 0x2ed227266f0f5dec - .quad 0x9824ee415ed50824 - .quad 0x807bec7c9468d415 - .quad 0x7093bae1b521e23f - .quad 0xdc07ac631c5d3afa - .quad 0x58615171f9df8c6c - .quad 0x72a079d89d73e2b0 - .quad 0x7301f4ceb4eae15d - .quad 0x6409e759d6722c41 - .quad 0xa674e1cf72bf729b - .quad 0xbc0a24eb3c21e569 - .quad 0x390167d24ebacb23 - - // 2^36 * 5 * G - - .quad 0x27f58e3bba353f1c - .quad 0x4c47764dbf6a4361 - .quad 0xafbbc4e56e562650 - .quad 0x07db2ee6aae1a45d - .quad 0xd7bb054ba2f2120b - .quad 0xe2b9ceaeb10589b7 - .quad 0x3fe8bac8f3c0edbe - .quad 0x4cbd40767112cb69 - .quad 0x0b603cc029c58176 - .quad 0x5988e3825cb15d61 - .quad 0x2bb61413dcf0ad8d - .quad 0x7b8eec6c74183287 - - // 2^36 * 6 * G - - .quad 0xe4ca40782cd27cb0 - .quad 0xdaf9c323fbe967bd - .quad 0xb29bd34a8ad41e9e - .quad 0x72810497626ede4d - .quad 0x32fee570fc386b73 - .quad 0xda8b0141da3a8cc7 - .quad 0x975ffd0ac8968359 - .quad 0x6ee809a1b132a855 - .quad 0x9444bb31fcfd863a - .quad 0x2fe3690a3e4e48c5 - .quad 0xdc29c867d088fa25 - .quad 0x13bd1e38d173292e - - // 2^36 * 7 * G - - .quad 0xd32b4cd8696149b5 - .quad 0xe55937d781d8aab7 - .quad 0x0bcb2127ae122b94 - .quad 0x41e86fcfb14099b0 - .quad 0x223fb5cf1dfac521 - .quad 0x325c25316f554450 - .quad 0x030b98d7659177ac - .quad 0x1ed018b64f88a4bd - .quad 0x3630dfa1b802a6b0 - .quad 0x880f874742ad3bd5 - .quad 0x0af90d6ceec5a4d4 - .quad 0x746a247a37cdc5d9 - - // 2^36 * 8 * G - - .quad 0xd531b8bd2b7b9af6 - .quad 0x5005093537fc5b51 - .quad 0x232fcf25c593546d - .quad 0x20a365142bb40f49 - .quad 0x6eccd85278d941ed - .quad 0x2254ae83d22f7843 - .quad 0xc522d02e7bbfcdb7 - .quad 0x681e3351bff0e4e2 - .quad 0x8b64b59d83034f45 - .quad 0x2f8b71f21fa20efb - .quad 0x69249495ba6550e4 - .quad 0x539ef98e45d5472b - - // 2^40 * 1 * G - - .quad 0x6e7bb6a1a6205275 - .quad 0xaa4f21d7413c8e83 - .quad 0x6f56d155e88f5cb2 - .quad 0x2de25d4ba6345be1 - .quad 0xd074d8961cae743f - .quad 0xf86d18f5ee1c63ed - .quad 0x97bdc55be7f4ed29 - .quad 0x4cbad279663ab108 - .quad 0x80d19024a0d71fcd - .quad 0xc525c20afb288af8 - .quad 0xb1a3974b5f3a6419 - .quad 0x7d7fbcefe2007233 - - // 2^40 * 2 * G - - .quad 0xfaef1e6a266b2801 - .quad 0x866c68c4d5739f16 - .quad 0xf68a2fbc1b03762c - .quad 0x5975435e87b75a8d - .quad 0xcd7c5dc5f3c29094 - .quad 0xc781a29a2a9105ab - .quad 0x80c61d36421c3058 - .quad 0x4f9cd196dcd8d4d7 - .quad 0x199297d86a7b3768 - .quad 0xd0d058241ad17a63 - .quad 0xba029cad5c1c0c17 - .quad 0x7ccdd084387a0307 - - // 2^40 * 3 * G - - .quad 0xdca6422c6d260417 - .quad 0xae153d50948240bd - .quad 0xa9c0c1b4fb68c677 - .quad 0x428bd0ed61d0cf53 - .quad 0x9b0c84186760cc93 - .quad 0xcdae007a1ab32a99 - .quad 0xa88dec86620bda18 - .quad 0x3593ca848190ca44 - .quad 0x9213189a5e849aa7 - .quad 0xd4d8c33565d8facd - .quad 0x8c52545b53fdbbd1 - .quad 0x27398308da2d63e6 - - // 2^40 * 4 * G - - .quad 0x42c38d28435ed413 - .quad 0xbd50f3603278ccc9 - .quad 0xbb07ab1a79da03ef - .quad 0x269597aebe8c3355 - .quad 0xb9a10e4c0a702453 - .quad 0x0fa25866d57d1bde - .quad 0xffb9d9b5cd27daf7 - .quad 0x572c2945492c33fd - .quad 0xc77fc745d6cd30be - .quad 0xe4dfe8d3e3baaefb - .quad 0xa22c8830aa5dda0c - .quad 0x7f985498c05bca80 - - // 2^40 * 5 * G - - .quad 0x3849ce889f0be117 - .quad 0x8005ad1b7b54a288 - .quad 0x3da3c39f23fc921c - .quad 0x76c2ec470a31f304 - .quad 0xd35615520fbf6363 - .quad 0x08045a45cf4dfba6 - .quad 0xeec24fbc873fa0c2 - .quad 0x30f2653cd69b12e7 - .quad 0x8a08c938aac10c85 - .quad 0x46179b60db276bcb - .quad 0xa920c01e0e6fac70 - .quad 0x2f1273f1596473da - - // 2^40 * 6 * G - - .quad 0x4739fc7c8ae01e11 - .quad 0xfd5274904a6aab9f - .quad 0x41d98a8287728f2e - .quad 0x5d9e572ad85b69f2 - .quad 0x30488bd755a70bc0 - .quad 0x06d6b5a4f1d442e7 - .quad 0xead1a69ebc596162 - .quad 0x38ac1997edc5f784 - .quad 0x0666b517a751b13b - .quad 0x747d06867e9b858c - .quad 0xacacc011454dde49 - .quad 0x22dfcd9cbfe9e69c - - // 2^40 * 7 * G - - .quad 0x8ddbd2e0c30d0cd9 - .quad 0xad8e665facbb4333 - .quad 0x8f6b258c322a961f - .quad 0x6b2916c05448c1c7 - .quad 0x56ec59b4103be0a1 - .quad 0x2ee3baecd259f969 - .quad 0x797cb29413f5cd32 - .quad 0x0fe9877824cde472 - .quad 0x7edb34d10aba913b - .quad 0x4ea3cd822e6dac0e - .quad 0x66083dff6578f815 - .quad 0x4c303f307ff00a17 - - // 2^40 * 8 * G - - .quad 0xd30a3bd617b28c85 - .quad 0xc5d377b739773bea - .quad 0xc6c6e78c1e6a5cbf - .quad 0x0d61b8f78b2ab7c4 - .quad 0x29fc03580dd94500 - .quad 0xecd27aa46fbbec93 - .quad 0x130a155fc2e2a7f8 - .quad 0x416b151ab706a1d5 - .quad 0x56a8d7efe9c136b0 - .quad 0xbd07e5cd58e44b20 - .quad 0xafe62fda1b57e0ab - .quad 0x191a2af74277e8d2 - - // 2^44 * 1 * G - - .quad 0xd550095bab6f4985 - .quad 0x04f4cd5b4fbfaf1a - .quad 0x9d8e2ed12a0c7540 - .quad 0x2bc24e04b2212286 - .quad 0x09d4b60b2fe09a14 - .quad 0xc384f0afdbb1747e - .quad 0x58e2ea8978b5fd6e - .quad 0x519ef577b5e09b0a - .quad 0x1863d7d91124cca9 - .quad 0x7ac08145b88a708e - .quad 0x2bcd7309857031f5 - .quad 0x62337a6e8ab8fae5 - - // 2^44 * 2 * G - - .quad 0x4bcef17f06ffca16 - .quad 0xde06e1db692ae16a - .quad 0x0753702d614f42b0 - .quad 0x5f6041b45b9212d0 - .quad 0xd1ab324e1b3a1273 - .quad 0x18947cf181055340 - .quad 0x3b5d9567a98c196e - .quad 0x7fa00425802e1e68 - .quad 0x7d531574028c2705 - .quad 0x80317d69db0d75fe - .quad 0x30fface8ef8c8ddd - .quad 0x7e9de97bb6c3e998 - - // 2^44 * 3 * G - - .quad 0x1558967b9e6585a3 - .quad 0x97c99ce098e98b92 - .quad 0x10af149b6eb3adad - .quad 0x42181fe8f4d38cfa - .quad 0xf004be62a24d40dd - .quad 0xba0659910452d41f - .quad 0x81c45ee162a44234 - .quad 0x4cb829d8a22266ef - .quad 0x1dbcaa8407b86681 - .quad 0x081f001e8b26753b - .quad 0x3cd7ce6a84048e81 - .quad 0x78af11633f25f22c - - // 2^44 * 4 * G - - .quad 0x8416ebd40b50babc - .quad 0x1508722628208bee - .quad 0xa3148fafb9c1c36d - .quad 0x0d07daacd32d7d5d - .quad 0x3241c00e7d65318c - .quad 0xe6bee5dcd0e86de7 - .quad 0x118b2dc2fbc08c26 - .quad 0x680d04a7fc603dc3 - .quad 0xf9c2414a695aa3eb - .quad 0xdaa42c4c05a68f21 - .quad 0x7c6c23987f93963e - .quad 0x210e8cd30c3954e3 - - // 2^44 * 5 * G - - .quad 0xac4201f210a71c06 - .quad 0x6a65e0aef3bfb021 - .quad 0xbc42c35c393632f7 - .quad 0x56ea8db1865f0742 - .quad 0x2b50f16137fe6c26 - .quad 0xe102bcd856e404d8 - .quad 0x12b0f1414c561f6b - .quad 0x51b17bc8d028ec91 - .quad 0xfff5fb4bcf535119 - .quad 0xf4989d79df1108a0 - .quad 0xbdfcea659a3ba325 - .quad 0x18a11f1174d1a6f2 - - // 2^44 * 6 * G - - .quad 0x407375ab3f6bba29 - .quad 0x9ec3b6d8991e482e - .quad 0x99c80e82e55f92e9 - .quad 0x307c13b6fb0c0ae1 - .quad 0xfbd63cdad27a5f2c - .quad 0xf00fc4bc8aa106d7 - .quad 0x53fb5c1a8e64a430 - .quad 0x04eaabe50c1a2e85 - .quad 0x24751021cb8ab5e7 - .quad 0xfc2344495c5010eb - .quad 0x5f1e717b4e5610a1 - .quad 0x44da5f18c2710cd5 - - // 2^44 * 7 * G - - .quad 0x033cc55ff1b82eb5 - .quad 0xb15ae36d411cae52 - .quad 0xba40b6198ffbacd3 - .quad 0x768edce1532e861f - .quad 0x9156fe6b89d8eacc - .quad 0xe6b79451e23126a1 - .quad 0xbd7463d93944eb4e - .quad 0x726373f6767203ae - .quad 0xe305ca72eb7ef68a - .quad 0x662cf31f70eadb23 - .quad 0x18f026fdb4c45b68 - .quad 0x513b5384b5d2ecbd - - // 2^44 * 8 * G - - .quad 0x46d46280c729989e - .quad 0x4b93fbd05368a5dd - .quad 0x63df3f81d1765a89 - .quad 0x34cebd64b9a0a223 - .quad 0x5e2702878af34ceb - .quad 0x900b0409b946d6ae - .quad 0x6512ebf7dabd8512 - .quad 0x61d9b76988258f81 - .quad 0xa6c5a71349b7d94b - .quad 0xa3f3d15823eb9446 - .quad 0x0416fbd277484834 - .quad 0x69d45e6f2c70812f - - // 2^48 * 1 * G - - .quad 0xce16f74bc53c1431 - .quad 0x2b9725ce2072edde - .quad 0xb8b9c36fb5b23ee7 - .quad 0x7e2e0e450b5cc908 - .quad 0x9fe62b434f460efb - .quad 0xded303d4a63607d6 - .quad 0xf052210eb7a0da24 - .quad 0x237e7dbe00545b93 - .quad 0x013575ed6701b430 - .quad 0x231094e69f0bfd10 - .quad 0x75320f1583e47f22 - .quad 0x71afa699b11155e3 - - // 2^48 * 2 * G - - .quad 0x65ce6f9b3953b61d - .quad 0xc65839eaafa141e6 - .quad 0x0f435ffda9f759fe - .quad 0x021142e9c2b1c28e - .quad 0xea423c1c473b50d6 - .quad 0x51e87a1f3b38ef10 - .quad 0x9b84bf5fb2c9be95 - .quad 0x00731fbc78f89a1c - .quad 0xe430c71848f81880 - .quad 0xbf960c225ecec119 - .quad 0xb6dae0836bba15e3 - .quad 0x4c4d6f3347e15808 - - // 2^48 * 3 * G - - .quad 0x18f7eccfc17d1fc9 - .quad 0x6c75f5a651403c14 - .quad 0xdbde712bf7ee0cdf - .quad 0x193fddaaa7e47a22 - .quad 0x2f0cddfc988f1970 - .quad 0x6b916227b0b9f51b - .quad 0x6ec7b6c4779176be - .quad 0x38bf9500a88f9fa8 - .quad 0x1fd2c93c37e8876f - .quad 0xa2f61e5a18d1462c - .quad 0x5080f58239241276 - .quad 0x6a6fb99ebf0d4969 - - // 2^48 * 4 * G - - .quad 0x6a46c1bb560855eb - .quad 0x2416bb38f893f09d - .quad 0xd71d11378f71acc1 - .quad 0x75f76914a31896ea - .quad 0xeeb122b5b6e423c6 - .quad 0x939d7010f286ff8e - .quad 0x90a92a831dcf5d8c - .quad 0x136fda9f42c5eb10 - .quad 0xf94cdfb1a305bdd1 - .quad 0x0f364b9d9ff82c08 - .quad 0x2a87d8a5c3bb588a - .quad 0x022183510be8dcba - - // 2^48 * 5 * G - - .quad 0x4af766385ead2d14 - .quad 0xa08ed880ca7c5830 - .quad 0x0d13a6e610211e3d - .quad 0x6a071ce17b806c03 - .quad 0x9d5a710143307a7f - .quad 0xb063de9ec47da45f - .quad 0x22bbfe52be927ad3 - .quad 0x1387c441fd40426c - .quad 0xb5d3c3d187978af8 - .quad 0x722b5a3d7f0e4413 - .quad 0x0d7b4848bb477ca0 - .quad 0x3171b26aaf1edc92 - - // 2^48 * 6 * G - - .quad 0xa92f319097564ca8 - .quad 0xff7bb84c2275e119 - .quad 0x4f55fe37a4875150 - .quad 0x221fd4873cf0835a - .quad 0xa60db7d8b28a47d1 - .quad 0xa6bf14d61770a4f1 - .quad 0xd4a1f89353ddbd58 - .quad 0x6c514a63344243e9 - .quad 0x2322204f3a156341 - .quad 0xfb73e0e9ba0a032d - .quad 0xfce0dd4c410f030e - .quad 0x48daa596fb924aaa - - // 2^48 * 7 * G - - .quad 0x6eca8e665ca59cc7 - .quad 0xa847254b2e38aca0 - .quad 0x31afc708d21e17ce - .quad 0x676dd6fccad84af7 - .quad 0x14f61d5dc84c9793 - .quad 0x9941f9e3ef418206 - .quad 0xcdf5b88f346277ac - .quad 0x58c837fa0e8a79a9 - .quad 0x0cf9688596fc9058 - .quad 0x1ddcbbf37b56a01b - .quad 0xdcc2e77d4935d66a - .quad 0x1c4f73f2c6a57f0a - - // 2^48 * 8 * G - - .quad 0x0e7a4fbd305fa0bb - .quad 0x829d4ce054c663ad - .quad 0xf421c3832fe33848 - .quad 0x795ac80d1bf64c42 - .quad 0xb36e706efc7c3484 - .quad 0x73dfc9b4c3c1cf61 - .quad 0xeb1d79c9781cc7e5 - .quad 0x70459adb7daf675c - .quad 0x1b91db4991b42bb3 - .quad 0x572696234b02dcca - .quad 0x9fdf9ee51f8c78dc - .quad 0x5fe162848ce21fd3 - - // 2^52 * 1 * G - - .quad 0xe2790aae4d077c41 - .quad 0x8b938270db7469a3 - .quad 0x6eb632dc8abd16a2 - .quad 0x720814ecaa064b72 - .quad 0x315c29c795115389 - .quad 0xd7e0e507862f74ce - .quad 0x0c4a762185927432 - .quad 0x72de6c984a25a1e4 - .quad 0xae9ab553bf6aa310 - .quad 0x050a50a9806d6e1b - .quad 0x92bb7403adff5139 - .quad 0x0394d27645be618b - - // 2^52 * 2 * G - - .quad 0x4d572251857eedf4 - .quad 0xe3724edde19e93c5 - .quad 0x8a71420e0b797035 - .quad 0x3b3c833687abe743 - .quad 0xf5396425b23545a4 - .quad 0x15a7a27e98fbb296 - .quad 0xab6c52bc636fdd86 - .quad 0x79d995a8419334ee - .quad 0xcd8a8ea61195dd75 - .quad 0xa504d8a81dd9a82f - .quad 0x540dca81a35879b6 - .quad 0x60dd16a379c86a8a - - // 2^52 * 3 * G - - .quad 0x35a2c8487381e559 - .quad 0x596ffea6d78082cb - .quad 0xcb9771ebdba7b653 - .quad 0x5a08b5019b4da685 - .quad 0x3501d6f8153e47b8 - .quad 0xb7a9675414a2f60c - .quad 0x112ee8b6455d9523 - .quad 0x4e62a3c18112ea8a - .quad 0xc8d4ac04516ab786 - .quad 0x595af3215295b23d - .quad 0xd6edd234db0230c1 - .quad 0x0929efe8825b41cc - - // 2^52 * 4 * G - - .quad 0x5f0601d1cbd0f2d3 - .quad 0x736e412f6132bb7f - .quad 0x83604432238dde87 - .quad 0x1e3a5272f5c0753c - .quad 0x8b3172b7ad56651d - .quad 0x01581b7a3fabd717 - .quad 0x2dc94df6424df6e4 - .quad 0x30376e5d2c29284f - .quad 0xd2918da78159a59c - .quad 0x6bdc1cd93f0713f3 - .quad 0x565f7a934acd6590 - .quad 0x53daacec4cb4c128 - - // 2^52 * 5 * G - - .quad 0x4ca73bd79cc8a7d6 - .quad 0x4d4a738f47e9a9b2 - .quad 0xf4cbf12942f5fe00 - .quad 0x01a13ff9bdbf0752 - .quad 0x99852bc3852cfdb0 - .quad 0x2cc12e9559d6ed0b - .quad 0x70f9e2bf9b5ac27b - .quad 0x4f3b8c117959ae99 - .quad 0x55b6c9c82ff26412 - .quad 0x1ac4a8c91fb667a8 - .quad 0xd527bfcfeb778bf2 - .quad 0x303337da7012a3be - - // 2^52 * 6 * G - - .quad 0x955422228c1c9d7c - .quad 0x01fac1371a9b340f - .quad 0x7e8d9177925b48d7 - .quad 0x53f8ad5661b3e31b - .quad 0x976d3ccbfad2fdd1 - .quad 0xcb88839737a640a8 - .quad 0x2ff00c1d6734cb25 - .quad 0x269ff4dc789c2d2b - .quad 0x0c003fbdc08d678d - .quad 0x4d982fa37ead2b17 - .quad 0xc07e6bcdb2e582f1 - .quad 0x296c7291df412a44 - - // 2^52 * 7 * G - - .quad 0x7903de2b33daf397 - .quad 0xd0ff0619c9a624b3 - .quad 0x8a1d252b555b3e18 - .quad 0x2b6d581c52e0b7c0 - .quad 0xdfb23205dab8b59e - .quad 0x465aeaa0c8092250 - .quad 0xd133c1189a725d18 - .quad 0x2327370261f117d1 - .quad 0x3d0543d3623e7986 - .quad 0x679414c2c278a354 - .quad 0xae43f0cc726196f6 - .quad 0x7836c41f8245eaba - - // 2^52 * 8 * G - - .quad 0xe7a254db49e95a81 - .quad 0x5192d5d008b0ad73 - .quad 0x4d20e5b1d00afc07 - .quad 0x5d55f8012cf25f38 - .quad 0xca651e848011937c - .quad 0xc6b0c46e6ef41a28 - .quad 0xb7021ba75f3f8d52 - .quad 0x119dff99ead7b9fd - .quad 0x43eadfcbf4b31d4d - .quad 0xc6503f7411148892 - .quad 0xfeee68c5060d3b17 - .quad 0x329293b3dd4a0ac8 - - // 2^56 * 1 * G - - .quad 0x4e59214fe194961a - .quad 0x49be7dc70d71cd4f - .quad 0x9300cfd23b50f22d - .quad 0x4789d446fc917232 - .quad 0x2879852d5d7cb208 - .quad 0xb8dedd70687df2e7 - .quad 0xdc0bffab21687891 - .quad 0x2b44c043677daa35 - .quad 0x1a1c87ab074eb78e - .quad 0xfac6d18e99daf467 - .quad 0x3eacbbcd484f9067 - .quad 0x60c52eef2bb9a4e4 - - // 2^56 * 2 * G - - .quad 0x0b5d89bc3bfd8bf1 - .quad 0xb06b9237c9f3551a - .quad 0x0e4c16b0d53028f5 - .quad 0x10bc9c312ccfcaab - .quad 0x702bc5c27cae6d11 - .quad 0x44c7699b54a48cab - .quad 0xefbc4056ba492eb2 - .quad 0x70d77248d9b6676d - .quad 0xaa8ae84b3ec2a05b - .quad 0x98699ef4ed1781e0 - .quad 0x794513e4708e85d1 - .quad 0x63755bd3a976f413 - - // 2^56 * 3 * G - - .quad 0xb55fa03e2ad10853 - .quad 0x356f75909ee63569 - .quad 0x9ff9f1fdbe69b890 - .quad 0x0d8cc1c48bc16f84 - .quad 0x3dc7101897f1acb7 - .quad 0x5dda7d5ec165bbd8 - .quad 0x508e5b9c0fa1020f - .quad 0x2763751737c52a56 - .quad 0x029402d36eb419a9 - .quad 0xf0b44e7e77b460a5 - .quad 0xcfa86230d43c4956 - .quad 0x70c2dd8a7ad166e7 - - // 2^56 * 4 * G - - .quad 0x656194509f6fec0e - .quad 0xee2e7ea946c6518d - .quad 0x9733c1f367e09b5c - .quad 0x2e0fac6363948495 - .quad 0x91d4967db8ed7e13 - .quad 0x74252f0ad776817a - .quad 0xe40982e00d852564 - .quad 0x32b8613816a53ce5 - .quad 0x79e7f7bee448cd64 - .quad 0x6ac83a67087886d0 - .quad 0xf89fd4d9a0e4db2e - .quad 0x4179215c735a4f41 - - // 2^56 * 5 * G - - .quad 0x8c7094e7d7dced2a - .quad 0x97fb8ac347d39c70 - .quad 0xe13be033a906d902 - .quad 0x700344a30cd99d76 - .quad 0xe4ae33b9286bcd34 - .quad 0xb7ef7eb6559dd6dc - .quad 0x278b141fb3d38e1f - .quad 0x31fa85662241c286 - .quad 0xaf826c422e3622f4 - .quad 0xc12029879833502d - .quad 0x9bc1b7e12b389123 - .quad 0x24bb2312a9952489 - - // 2^56 * 6 * G - - .quad 0xb1a8ed1732de67c3 - .quad 0x3cb49418461b4948 - .quad 0x8ebd434376cfbcd2 - .quad 0x0fee3e871e188008 - .quad 0x41f80c2af5f85c6b - .quad 0x687284c304fa6794 - .quad 0x8945df99a3ba1bad - .quad 0x0d1d2af9ffeb5d16 - .quad 0xa9da8aa132621edf - .quad 0x30b822a159226579 - .quad 0x4004197ba79ac193 - .quad 0x16acd79718531d76 - - // 2^56 * 7 * G - - .quad 0x72df72af2d9b1d3d - .quad 0x63462a36a432245a - .quad 0x3ecea07916b39637 - .quad 0x123e0ef6b9302309 - .quad 0xc959c6c57887b6ad - .quad 0x94e19ead5f90feba - .quad 0x16e24e62a342f504 - .quad 0x164ed34b18161700 - .quad 0x487ed94c192fe69a - .quad 0x61ae2cea3a911513 - .quad 0x877bf6d3b9a4de27 - .quad 0x78da0fc61073f3eb - - // 2^56 * 8 * G - - .quad 0x5bf15d28e52bc66a - .quad 0x2c47e31870f01a8e - .quad 0x2419afbc06c28bdd - .quad 0x2d25deeb256b173a - .quad 0xa29f80f1680c3a94 - .quad 0x71f77e151ae9e7e6 - .quad 0x1100f15848017973 - .quad 0x054aa4b316b38ddd - .quad 0xdfc8468d19267cb8 - .quad 0x0b28789c66e54daf - .quad 0x2aeb1d2a666eec17 - .quad 0x134610a6ab7da760 - - // 2^60 * 1 * G - - .quad 0xcaf55ec27c59b23f - .quad 0x99aeed3e154d04f2 - .quad 0x68441d72e14141f4 - .quad 0x140345133932a0a2 - .quad 0xd91430e0dc028c3c - .quad 0x0eb955a85217c771 - .quad 0x4b09e1ed2c99a1fa - .quad 0x42881af2bd6a743c - .quad 0x7bfec69aab5cad3d - .quad 0xc23e8cd34cb2cfad - .quad 0x685dd14bfb37d6a2 - .quad 0x0ad6d64415677a18 - - // 2^60 * 2 * G - - .quad 0x781a439e417becb5 - .quad 0x4ac5938cd10e0266 - .quad 0x5da385110692ac24 - .quad 0x11b065a2ade31233 - .quad 0x7914892847927e9f - .quad 0x33dad6ef370aa877 - .quad 0x1f8f24fa11122703 - .quad 0x5265ac2f2adf9592 - .quad 0x405fdd309afcb346 - .quad 0xd9723d4428e63f54 - .quad 0x94c01df05f65aaae - .quad 0x43e4dc3ae14c0809 - - // 2^60 * 3 * G - - .quad 0xbc12c7f1a938a517 - .quad 0x473028ab3180b2e1 - .quad 0x3f78571efbcd254a - .quad 0x74e534426ff6f90f - .quad 0xea6f7ac3adc2c6a3 - .quad 0xd0e928f6e9717c94 - .quad 0xe2d379ead645eaf5 - .quad 0x46dd8785c51ffbbe - .quad 0x709801be375c8898 - .quad 0x4b06dab5e3fd8348 - .quad 0x75880ced27230714 - .quad 0x2b09468fdd2f4c42 - - // 2^60 * 4 * G - - .quad 0x97c749eeb701cb96 - .quad 0x83f438d4b6a369c3 - .quad 0x62962b8b9a402cd9 - .quad 0x6976c7509888df7b - .quad 0x5b97946582ffa02a - .quad 0xda096a51fea8f549 - .quad 0xa06351375f77af9b - .quad 0x1bcfde61201d1e76 - .quad 0x4a4a5490246a59a2 - .quad 0xd63ebddee87fdd90 - .quad 0xd9437c670d2371fa - .quad 0x69e87308d30f8ed6 - - // 2^60 * 5 * G - - .quad 0x435a8bb15656beb0 - .quad 0xf8fac9ba4f4d5bca - .quad 0xb9b278c41548c075 - .quad 0x3eb0ef76e892b622 - .quad 0x0f80bf028bc80303 - .quad 0x6aae16b37a18cefb - .quad 0xdd47ea47d72cd6a3 - .quad 0x61943588f4ed39aa - .quad 0xd26e5c3e91039f85 - .quad 0xc0e9e77df6f33aa9 - .quad 0xe8968c5570066a93 - .quad 0x3c34d1881faaaddd - - // 2^60 * 6 * G - - .quad 0x3f9d2b5ea09f9ec0 - .quad 0x1dab3b6fb623a890 - .quad 0xa09ba3ea72d926c4 - .quad 0x374193513fd8b36d - .quad 0xbd5b0b8f2fffe0d9 - .quad 0x6aa254103ed24fb9 - .quad 0x2ac7d7bcb26821c4 - .quad 0x605b394b60dca36a - .quad 0xb4e856e45a9d1ed2 - .quad 0xefe848766c97a9a2 - .quad 0xb104cf641e5eee7d - .quad 0x2f50b81c88a71c8f - - // 2^60 * 7 * G - - .quad 0x31723c61fc6811bb - .quad 0x9cb450486211800f - .quad 0x768933d347995753 - .quad 0x3491a53502752fcd - .quad 0x2b552ca0a7da522a - .quad 0x3230b336449b0250 - .quad 0xf2c4c5bca4b99fb9 - .quad 0x7b2c674958074a22 - .quad 0xd55165883ed28cdf - .quad 0x12d84fd2d362de39 - .quad 0x0a874ad3e3378e4f - .quad 0x000d2b1f7c763e74 - - // 2^60 * 8 * G - - .quad 0x3d420811d06d4a67 - .quad 0xbefc048590e0ffe3 - .quad 0xf870c6b7bd487bde - .quad 0x6e2a7316319afa28 - .quad 0x9624778c3e94a8ab - .quad 0x0ad6f3cee9a78bec - .quad 0x948ac7810d743c4f - .quad 0x76627935aaecfccc - .quad 0x56a8ac24d6d59a9f - .quad 0xc8db753e3096f006 - .quad 0x477f41e68f4c5299 - .quad 0x588d851cf6c86114 - - // 2^64 * 1 * G - - .quad 0x51138ec78df6b0fe - .quad 0x5397da89e575f51b - .quad 0x09207a1d717af1b9 - .quad 0x2102fdba2b20d650 - .quad 0xcd2a65e777d1f515 - .quad 0x548991878faa60f1 - .quad 0xb1b73bbcdabc06e5 - .quad 0x654878cba97cc9fb - .quad 0x969ee405055ce6a1 - .quad 0x36bca7681251ad29 - .quad 0x3a1af517aa7da415 - .quad 0x0ad725db29ecb2ba - - // 2^64 * 2 * G - - .quad 0xdc4267b1834e2457 - .quad 0xb67544b570ce1bc5 - .quad 0x1af07a0bf7d15ed7 - .quad 0x4aefcffb71a03650 - .quad 0xfec7bc0c9b056f85 - .quad 0x537d5268e7f5ffd7 - .quad 0x77afc6624312aefa - .quad 0x4f675f5302399fd9 - .quad 0xc32d36360415171e - .quad 0xcd2bef118998483b - .quad 0x870a6eadd0945110 - .quad 0x0bccbb72a2a86561 - - // 2^64 * 3 * G - - .quad 0x185e962feab1a9c8 - .quad 0x86e7e63565147dcd - .quad 0xb092e031bb5b6df2 - .quad 0x4024f0ab59d6b73e - .quad 0x186d5e4c50fe1296 - .quad 0xe0397b82fee89f7e - .quad 0x3bc7f6c5507031b0 - .quad 0x6678fd69108f37c2 - .quad 0x1586fa31636863c2 - .quad 0x07f68c48572d33f2 - .quad 0x4f73cc9f789eaefc - .quad 0x2d42e2108ead4701 - - // 2^64 * 4 * G - - .quad 0x97f5131594dfd29b - .quad 0x6155985d313f4c6a - .quad 0xeba13f0708455010 - .quad 0x676b2608b8d2d322 - .quad 0x21717b0d0f537593 - .quad 0x914e690b131e064c - .quad 0x1bb687ae752ae09f - .quad 0x420bf3a79b423c6e - .quad 0x8138ba651c5b2b47 - .quad 0x8671b6ec311b1b80 - .quad 0x7bff0cb1bc3135b0 - .quad 0x745d2ffa9c0cf1e0 - - // 2^64 * 5 * G - - .quad 0xbf525a1e2bc9c8bd - .quad 0xea5b260826479d81 - .quad 0xd511c70edf0155db - .quad 0x1ae23ceb960cf5d0 - .quad 0x6036df5721d34e6a - .quad 0xb1db8827997bb3d0 - .quad 0xd3c209c3c8756afa - .quad 0x06e15be54c1dc839 - .quad 0x5b725d871932994a - .quad 0x32351cb5ceb1dab0 - .quad 0x7dc41549dab7ca05 - .quad 0x58ded861278ec1f7 - - // 2^64 * 6 * G - - .quad 0xd8173793f266c55c - .quad 0xc8c976c5cc454e49 - .quad 0x5ce382f8bc26c3a8 - .quad 0x2ff39de85485f6f9 - .quad 0x2dfb5ba8b6c2c9a8 - .quad 0x48eeef8ef52c598c - .quad 0x33809107f12d1573 - .quad 0x08ba696b531d5bd8 - .quad 0x77ed3eeec3efc57a - .quad 0x04e05517d4ff4811 - .quad 0xea3d7a3ff1a671cb - .quad 0x120633b4947cfe54 - - // 2^64 * 7 * G - - .quad 0x0b94987891610042 - .quad 0x4ee7b13cecebfae8 - .quad 0x70be739594f0a4c0 - .quad 0x35d30a99b4d59185 - .quad 0x82bd31474912100a - .quad 0xde237b6d7e6fbe06 - .quad 0xe11e761911ea79c6 - .quad 0x07433be3cb393bde - .quad 0xff7944c05ce997f4 - .quad 0x575d3de4b05c51a3 - .quad 0x583381fd5a76847c - .quad 0x2d873ede7af6da9f - - // 2^64 * 8 * G - - .quad 0x157a316443373409 - .quad 0xfab8b7eef4aa81d9 - .quad 0xb093fee6f5a64806 - .quad 0x2e773654707fa7b6 - .quad 0xaa6202e14e5df981 - .quad 0xa20d59175015e1f5 - .quad 0x18a275d3bae21d6c - .quad 0x0543618a01600253 - .quad 0x0deabdf4974c23c1 - .quad 0xaa6f0a259dce4693 - .quad 0x04202cb8a29aba2c - .quad 0x4b1443362d07960d - - // 2^68 * 1 * G - - .quad 0x47b837f753242cec - .quad 0x256dc48cc04212f2 - .quad 0xe222fbfbe1d928c5 - .quad 0x48ea295bad8a2c07 - .quad 0x299b1c3f57c5715e - .quad 0x96cb929e6b686d90 - .quad 0x3004806447235ab3 - .quad 0x2c435c24a44d9fe1 - .quad 0x0607c97c80f8833f - .quad 0x0e851578ca25ec5b - .quad 0x54f7450b161ebb6f - .quad 0x7bcb4792a0def80e - - // 2^68 * 2 * G - - .quad 0x8487e3d02bc73659 - .quad 0x4baf8445059979df - .quad 0xd17c975adcad6fbf - .quad 0x57369f0bdefc96b6 - .quad 0x1cecd0a0045224c2 - .quad 0x757f1b1b69e53952 - .quad 0x775b7a925289f681 - .quad 0x1b6cc62016736148 - .quad 0xf1a9990175638698 - .quad 0x353dd1beeeaa60d3 - .quad 0x849471334c9ba488 - .quad 0x63fa6e6843ade311 - - // 2^68 * 3 * G - - .quad 0xd15c20536597c168 - .quad 0x9f73740098d28789 - .quad 0x18aee7f13257ba1f - .quad 0x3418bfda07346f14 - .quad 0x2195becdd24b5eb7 - .quad 0x5e41f18cc0cd44f9 - .quad 0xdf28074441ca9ede - .quad 0x07073b98f35b7d67 - .quad 0xd03c676c4ce530d4 - .quad 0x0b64c0473b5df9f4 - .quad 0x065cef8b19b3a31e - .quad 0x3084d661533102c9 - - // 2^68 * 4 * G - - .quad 0xe1f6b79ebf8469ad - .quad 0x15801004e2663135 - .quad 0x9a498330af74181b - .quad 0x3ba2504f049b673c - .quad 0x9a6ce876760321fd - .quad 0x7fe2b5109eb63ad8 - .quad 0x00e7d4ae8ac80592 - .quad 0x73d86b7abb6f723a - .quad 0x0b52b5606dba5ab6 - .quad 0xa9134f0fbbb1edab - .quad 0x30a9520d9b04a635 - .quad 0x6813b8f37973e5db - - // 2^68 * 5 * G - - .quad 0x9854b054334127c1 - .quad 0x105d047882fbff25 - .quad 0xdb49f7f944186f4f - .quad 0x1768e838bed0b900 - .quad 0xf194ca56f3157e29 - .quad 0x136d35705ef528a5 - .quad 0xdd4cef778b0599bc - .quad 0x7d5472af24f833ed - .quad 0xd0ef874daf33da47 - .quad 0x00d3be5db6e339f9 - .quad 0x3f2a8a2f9c9ceece - .quad 0x5d1aeb792352435a - - // 2^68 * 6 * G - - .quad 0xf59e6bb319cd63ca - .quad 0x670c159221d06839 - .quad 0xb06d565b2150cab6 - .quad 0x20fb199d104f12a3 - .quad 0x12c7bfaeb61ba775 - .quad 0xb84e621fe263bffd - .quad 0x0b47a5c35c840dcf - .quad 0x7e83be0bccaf8634 - .quad 0x61943dee6d99c120 - .quad 0x86101f2e460b9fe0 - .quad 0x6bb2f1518ee8598d - .quad 0x76b76289fcc475cc - - // 2^68 * 7 * G - - .quad 0x791b4cc1756286fa - .quad 0xdbced317d74a157c - .quad 0x7e732421ea72bde6 - .quad 0x01fe18491131c8e9 - .quad 0x4245f1a1522ec0b3 - .quad 0x558785b22a75656d - .quad 0x1d485a2548a1b3c0 - .quad 0x60959eccd58fe09f - .quad 0x3ebfeb7ba8ed7a09 - .quad 0x49fdc2bbe502789c - .quad 0x44ebce5d3c119428 - .quad 0x35e1eb55be947f4a - - // 2^68 * 8 * G - - .quad 0xdbdae701c5738dd3 - .quad 0xf9c6f635b26f1bee - .quad 0x61e96a8042f15ef4 - .quad 0x3aa1d11faf60a4d8 - .quad 0x14fd6dfa726ccc74 - .quad 0x3b084cfe2f53b965 - .quad 0xf33ae4f552a2c8b4 - .quad 0x59aab07a0d40166a - .quad 0x77bcec4c925eac25 - .quad 0x1848718460137738 - .quad 0x5b374337fea9f451 - .quad 0x1865e78ec8e6aa46 - - // 2^72 * 1 * G - - .quad 0xccc4b7c7b66e1f7a - .quad 0x44157e25f50c2f7e - .quad 0x3ef06dfc713eaf1c - .quad 0x582f446752da63f7 - .quad 0x967c54e91c529ccb - .quad 0x30f6269264c635fb - .quad 0x2747aff478121965 - .quad 0x17038418eaf66f5c - .quad 0xc6317bd320324ce4 - .quad 0xa81042e8a4488bc4 - .quad 0xb21ef18b4e5a1364 - .quad 0x0c2a1c4bcda28dc9 - - // 2^72 * 2 * G - - .quad 0xd24dc7d06f1f0447 - .quad 0xb2269e3edb87c059 - .quad 0xd15b0272fbb2d28f - .quad 0x7c558bd1c6f64877 - .quad 0xedc4814869bd6945 - .quad 0x0d6d907dbe1c8d22 - .quad 0xc63bd212d55cc5ab - .quad 0x5a6a9b30a314dc83 - .quad 0xd0ec1524d396463d - .quad 0x12bb628ac35a24f0 - .quad 0xa50c3a791cbc5fa4 - .quad 0x0404a5ca0afbafc3 - - // 2^72 * 3 * G - - .quad 0x8c1f40070aa743d6 - .quad 0xccbad0cb5b265ee8 - .quad 0x574b046b668fd2de - .quad 0x46395bfdcadd9633 - .quad 0x62bc9e1b2a416fd1 - .quad 0xb5c6f728e350598b - .quad 0x04343fd83d5d6967 - .quad 0x39527516e7f8ee98 - .quad 0x117fdb2d1a5d9a9c - .quad 0x9c7745bcd1005c2a - .quad 0xefd4bef154d56fea - .quad 0x76579a29e822d016 - - // 2^72 * 4 * G - - .quad 0x45b68e7e49c02a17 - .quad 0x23cd51a2bca9a37f - .quad 0x3ed65f11ec224c1b - .quad 0x43a384dc9e05bdb1 - .quad 0x333cb51352b434f2 - .quad 0xd832284993de80e1 - .quad 0xb5512887750d35ce - .quad 0x02c514bb2a2777c1 - .quad 0x684bd5da8bf1b645 - .quad 0xfb8bd37ef6b54b53 - .quad 0x313916d7a9b0d253 - .quad 0x1160920961548059 - - // 2^72 * 5 * G - - .quad 0xb44d166929dacfaa - .quad 0xda529f4c8413598f - .quad 0xe9ef63ca453d5559 - .quad 0x351e125bc5698e0b - .quad 0x7a385616369b4dcd - .quad 0x75c02ca7655c3563 - .quad 0x7dc21bf9d4f18021 - .quad 0x2f637d7491e6e042 - .quad 0xd4b49b461af67bbe - .quad 0xd603037ac8ab8961 - .quad 0x71dee19ff9a699fb - .quad 0x7f182d06e7ce2a9a - - // 2^72 * 6 * G - - .quad 0x7a7c8e64ab0168ec - .quad 0xcb5a4a5515edc543 - .quad 0x095519d347cd0eda - .quad 0x67d4ac8c343e93b0 - .quad 0x09454b728e217522 - .quad 0xaa58e8f4d484b8d8 - .quad 0xd358254d7f46903c - .quad 0x44acc043241c5217 - .quad 0x1c7d6bbb4f7a5777 - .quad 0x8b35fed4918313e1 - .quad 0x4adca1c6c96b4684 - .quad 0x556d1c8312ad71bd - - // 2^72 * 7 * G - - .quad 0x17ef40e30c8d3982 - .quad 0x31f7073e15a3fa34 - .quad 0x4f21f3cb0773646e - .quad 0x746c6c6d1d824eff - .quad 0x81f06756b11be821 - .quad 0x0faff82310a3f3dd - .quad 0xf8b2d0556a99465d - .quad 0x097abe38cc8c7f05 - .quad 0x0c49c9877ea52da4 - .quad 0x4c4369559bdc1d43 - .quad 0x022c3809f7ccebd2 - .quad 0x577e14a34bee84bd - - // 2^72 * 8 * G - - .quad 0xf0e268ac61a73b0a - .quad 0xf2fafa103791a5f5 - .quad 0xc1e13e826b6d00e9 - .quad 0x60fa7ee96fd78f42 - .quad 0x94fecebebd4dd72b - .quad 0xf46a4fda060f2211 - .quad 0x124a5977c0c8d1ff - .quad 0x705304b8fb009295 - .quad 0xb63d1d354d296ec6 - .quad 0xf3c3053e5fad31d8 - .quad 0x670b958cb4bd42ec - .quad 0x21398e0ca16353fd - - // 2^76 * 1 * G - - .quad 0x216ab2ca8da7d2ef - .quad 0x366ad9dd99f42827 - .quad 0xae64b9004fdd3c75 - .quad 0x403a395b53909e62 - .quad 0x86c5fc16861b7e9a - .quad 0xf6a330476a27c451 - .quad 0x01667267a1e93597 - .quad 0x05ffb9cd6082dfeb - .quad 0xa617fa9ff53f6139 - .quad 0x60f2b5e513e66cb6 - .quad 0xd7a8beefb3448aa4 - .quad 0x7a2932856f5ea192 - - // 2^76 * 2 * G - - .quad 0x0b39d761b02de888 - .quad 0x5f550e7ed2414e1f - .quad 0xa6bfa45822e1a940 - .quad 0x050a2f7dfd447b99 - .quad 0xb89c444879639302 - .quad 0x4ae4f19350c67f2c - .quad 0xf0b35da8c81af9c6 - .quad 0x39d0003546871017 - .quad 0x437c3b33a650db77 - .quad 0x6bafe81dbac52bb2 - .quad 0xfe99402d2db7d318 - .quad 0x2b5b7eec372ba6ce - - // 2^76 * 3 * G - - .quad 0xb3bc4bbd83f50eef - .quad 0x508f0c998c927866 - .quad 0x43e76587c8b7e66e - .quad 0x0f7655a3a47f98d9 - .quad 0xa694404d613ac8f4 - .quad 0x500c3c2bfa97e72c - .quad 0x874104d21fcec210 - .quad 0x1b205fb38604a8ee - .quad 0x55ecad37d24b133c - .quad 0x441e147d6038c90b - .quad 0x656683a1d62c6fee - .quad 0x0157d5dc87e0ecae - - // 2^76 * 4 * G - - .quad 0xf2a7af510354c13d - .quad 0xd7a0b145aa372b60 - .quad 0x2869b96a05a3d470 - .quad 0x6528e42d82460173 - .quad 0x95265514d71eb524 - .quad 0xe603d8815df14593 - .quad 0x147cdf410d4de6b7 - .quad 0x5293b1730437c850 - .quad 0x23d0e0814bccf226 - .quad 0x92c745cd8196fb93 - .quad 0x8b61796c59541e5b - .quad 0x40a44df0c021f978 - - // 2^76 * 5 * G - - .quad 0xdaa869894f20ea6a - .quad 0xea14a3d14c620618 - .quad 0x6001fccb090bf8be - .quad 0x35f4e822947e9cf0 - .quad 0x86c96e514bc5d095 - .quad 0xf20d4098fca6804a - .quad 0x27363d89c826ea5d - .quad 0x39ca36565719cacf - .quad 0x97506f2f6f87b75c - .quad 0xc624aea0034ae070 - .quad 0x1ec856e3aad34dd6 - .quad 0x055b0be0e440e58f - - // 2^76 * 6 * G - - .quad 0x6469a17d89735d12 - .quad 0xdb6f27d5e662b9f1 - .quad 0x9fcba3286a395681 - .quad 0x363b8004d269af25 - .quad 0x4d12a04b6ea33da2 - .quad 0x57cf4c15e36126dd - .quad 0x90ec9675ee44d967 - .quad 0x64ca348d2a985aac - .quad 0x99588e19e4c4912d - .quad 0xefcc3b4e1ca5ce6b - .quad 0x4522ea60fa5b98d5 - .quad 0x7064bbab1de4a819 - - // 2^76 * 7 * G - - .quad 0xb919e1515a770641 - .quad 0xa9a2e2c74e7f8039 - .quad 0x7527250b3df23109 - .quad 0x756a7330ac27b78b - .quad 0xa290c06142542129 - .quad 0xf2e2c2aebe8d5b90 - .quad 0xcf2458db76abfe1b - .quad 0x02157ade83d626bf - .quad 0x3e46972a1b9a038b - .quad 0x2e4ee66a7ee03fb4 - .quad 0x81a248776edbb4ca - .quad 0x1a944ee88ecd0563 - - // 2^76 * 8 * G - - .quad 0xd5a91d1151039372 - .quad 0x2ed377b799ca26de - .quad 0xa17202acfd366b6b - .quad 0x0730291bd6901995 - .quad 0xbb40a859182362d6 - .quad 0xb99f55778a4d1abb - .quad 0x8d18b427758559f6 - .quad 0x26c20fe74d26235a - .quad 0x648d1d9fe9cc22f5 - .quad 0x66bc561928dd577c - .quad 0x47d3ed21652439d1 - .quad 0x49d271acedaf8b49 - - // 2^80 * 1 * G - - .quad 0x89f5058a382b33f3 - .quad 0x5ae2ba0bad48c0b4 - .quad 0x8f93b503a53db36e - .quad 0x5aa3ed9d95a232e6 - .quad 0x2798aaf9b4b75601 - .quad 0x5eac72135c8dad72 - .quad 0xd2ceaa6161b7a023 - .quad 0x1bbfb284e98f7d4e - .quad 0x656777e9c7d96561 - .quad 0xcb2b125472c78036 - .quad 0x65053299d9506eee - .quad 0x4a07e14e5e8957cc - - // 2^80 * 2 * G - - .quad 0x4ee412cb980df999 - .quad 0xa315d76f3c6ec771 - .quad 0xbba5edde925c77fd - .quad 0x3f0bac391d313402 - .quad 0x240b58cdc477a49b - .quad 0xfd38dade6447f017 - .quad 0x19928d32a7c86aad - .quad 0x50af7aed84afa081 - .quad 0x6e4fde0115f65be5 - .quad 0x29982621216109b2 - .quad 0x780205810badd6d9 - .quad 0x1921a316baebd006 - - // 2^80 * 3 * G - - .quad 0x89422f7edfb870fc - .quad 0x2c296beb4f76b3bd - .quad 0x0738f1d436c24df7 - .quad 0x6458df41e273aeb0 - .quad 0xd75aad9ad9f3c18b - .quad 0x566a0eef60b1c19c - .quad 0x3e9a0bac255c0ed9 - .quad 0x7b049deca062c7f5 - .quad 0xdccbe37a35444483 - .quad 0x758879330fedbe93 - .quad 0x786004c312c5dd87 - .quad 0x6093dccbc2950e64 - - // 2^80 * 4 * G - - .quad 0x1ff39a8585e0706d - .quad 0x36d0a5d8b3e73933 - .quad 0x43b9f2e1718f453b - .quad 0x57d1ea084827a97c - .quad 0x6bdeeebe6084034b - .quad 0x3199c2b6780fb854 - .quad 0x973376abb62d0695 - .quad 0x6e3180c98b647d90 - .quad 0xee7ab6e7a128b071 - .quad 0xa4c1596d93a88baa - .quad 0xf7b4de82b2216130 - .quad 0x363e999ddd97bd18 - - // 2^80 * 5 * G - - .quad 0x96a843c135ee1fc4 - .quad 0x976eb35508e4c8cf - .quad 0xb42f6801b58cd330 - .quad 0x48ee9b78693a052b - .quad 0x2f1848dce24baec6 - .quad 0x769b7255babcaf60 - .quad 0x90cb3c6e3cefe931 - .quad 0x231f979bc6f9b355 - .quad 0x5c31de4bcc2af3c6 - .quad 0xb04bb030fe208d1f - .quad 0xb78d7009c14fb466 - .quad 0x079bfa9b08792413 - - // 2^80 * 6 * G - - .quad 0xe3903a51da300df4 - .quad 0x843964233da95ab0 - .quad 0xed3cf12d0b356480 - .quad 0x038c77f684817194 - .quad 0xf3c9ed80a2d54245 - .quad 0x0aa08b7877f63952 - .quad 0xd76dac63d1085475 - .quad 0x1ef4fb159470636b - .quad 0x854e5ee65b167bec - .quad 0x59590a4296d0cdc2 - .quad 0x72b2df3498102199 - .quad 0x575ee92a4a0bff56 - - // 2^80 * 7 * G - - .quad 0xd4c080908a182fcf - .quad 0x30e170c299489dbd - .quad 0x05babd5752f733de - .quad 0x43d4e7112cd3fd00 - .quad 0x5d46bc450aa4d801 - .quad 0xc3af1227a533b9d8 - .quad 0x389e3b262b8906c2 - .quad 0x200a1e7e382f581b - .quad 0x518db967eaf93ac5 - .quad 0x71bc989b056652c0 - .quad 0xfe2b85d9567197f5 - .quad 0x050eca52651e4e38 - - // 2^80 * 8 * G - - .quad 0xc3431ade453f0c9c - .quad 0xe9f5045eff703b9b - .quad 0xfcd97ac9ed847b3d - .quad 0x4b0ee6c21c58f4c6 - .quad 0x97ac397660e668ea - .quad 0x9b19bbfe153ab497 - .quad 0x4cb179b534eca79f - .quad 0x6151c09fa131ae57 - .quad 0x3af55c0dfdf05d96 - .quad 0xdd262ee02ab4ee7a - .quad 0x11b2bb8712171709 - .quad 0x1fef24fa800f030b - - // 2^84 * 1 * G - - .quad 0xb496123a6b6c6609 - .quad 0xa750fe8580ab5938 - .quad 0xf471bf39b7c27a5f - .quad 0x507903ce77ac193c - .quad 0xff91a66a90166220 - .quad 0xf22552ae5bf1e009 - .quad 0x7dff85d87f90df7c - .quad 0x4f620ffe0c736fb9 - .quad 0x62f90d65dfde3e34 - .quad 0xcf28c592b9fa5fad - .quad 0x99c86ef9c6164510 - .quad 0x25d448044a256c84 - - // 2^84 * 2 * G - - .quad 0xbd68230ec7e9b16f - .quad 0x0eb1b9c1c1c5795d - .quad 0x7943c8c495b6b1ff - .quad 0x2f9faf620bbacf5e - .quad 0x2c7c4415c9022b55 - .quad 0x56a0d241812eb1fe - .quad 0xf02ea1c9d7b65e0d - .quad 0x4180512fd5323b26 - .quad 0xa4ff3e698a48a5db - .quad 0xba6a3806bd95403b - .quad 0x9f7ce1af47d5b65d - .quad 0x15e087e55939d2fb - - // 2^84 * 3 * G - - .quad 0x12207543745c1496 - .quad 0xdaff3cfdda38610c - .quad 0xe4e797272c71c34f - .quad 0x39c07b1934bdede9 - .quad 0x8894186efb963f38 - .quad 0x48a00e80dc639bd5 - .quad 0xa4e8092be96c1c99 - .quad 0x5a097d54ca573661 - .quad 0x2d45892b17c9e755 - .quad 0xd033fd7289308df8 - .quad 0x6c2fe9d9525b8bd9 - .quad 0x2edbecf1c11cc079 - - // 2^84 * 4 * G - - .quad 0x1616a4e3c715a0d2 - .quad 0x53623cb0f8341d4d - .quad 0x96ef5329c7e899cb - .quad 0x3d4e8dbba668baa6 - .quad 0xee0f0fddd087a25f - .quad 0x9c7531555c3e34ee - .quad 0x660c572e8fab3ab5 - .quad 0x0854fc44544cd3b2 - .quad 0x61eba0c555edad19 - .quad 0x24b533fef0a83de6 - .quad 0x3b77042883baa5f8 - .quad 0x678f82b898a47e8d - - // 2^84 * 5 * G - - .quad 0xb1491d0bd6900c54 - .quad 0x3539722c9d132636 - .quad 0x4db928920b362bc9 - .quad 0x4d7cd1fea68b69df - .quad 0x1e09d94057775696 - .quad 0xeed1265c3cd951db - .quad 0xfa9dac2b20bce16f - .quad 0x0f7f76e0e8d089f4 - .quad 0x36d9ebc5d485b00c - .quad 0xa2596492e4adb365 - .quad 0xc1659480c2119ccd - .quad 0x45306349186e0d5f - - // 2^84 * 6 * G - - .quad 0x94ddd0c1a6cdff1d - .quad 0x55f6f115e84213ae - .quad 0x6c935f85992fcf6a - .quad 0x067ee0f54a37f16f - .quad 0x96a414ec2b072491 - .quad 0x1bb2218127a7b65b - .quad 0x6d2849596e8a4af0 - .quad 0x65f3b08ccd27765f - .quad 0xecb29fff199801f7 - .quad 0x9d361d1fa2a0f72f - .quad 0x25f11d2375fd2f49 - .quad 0x124cefe80fe10fe2 - - // 2^84 * 7 * G - - .quad 0x4c126cf9d18df255 - .quad 0xc1d471e9147a63b6 - .quad 0x2c6d3c73f3c93b5f - .quad 0x6be3a6a2e3ff86a2 - .quad 0x1518e85b31b16489 - .quad 0x8faadcb7db710bfb - .quad 0x39b0bdf4a14ae239 - .quad 0x05f4cbea503d20c1 - .quad 0xce040e9ec04145bc - .quad 0xc71ff4e208f6834c - .quad 0xbd546e8dab8847a3 - .quad 0x64666aa0a4d2aba5 - - // 2^84 * 8 * G - - .quad 0x6841435a7c06d912 - .quad 0xca123c21bb3f830b - .quad 0xd4b37b27b1cbe278 - .quad 0x1d753b84c76f5046 - .quad 0xb0c53bf73337e94c - .quad 0x7cb5697e11e14f15 - .quad 0x4b84abac1930c750 - .quad 0x28dd4abfe0640468 - .quad 0x7dc0b64c44cb9f44 - .quad 0x18a3e1ace3925dbf - .quad 0x7a3034862d0457c4 - .quad 0x4c498bf78a0c892e - - // 2^88 * 1 * G - - .quad 0x37d653fb1aa73196 - .quad 0x0f9495303fd76418 - .quad 0xad200b09fb3a17b2 - .quad 0x544d49292fc8613e - .quad 0x22d2aff530976b86 - .quad 0x8d90b806c2d24604 - .quad 0xdca1896c4de5bae5 - .quad 0x28005fe6c8340c17 - .quad 0x6aefba9f34528688 - .quad 0x5c1bff9425107da1 - .quad 0xf75bbbcd66d94b36 - .quad 0x72e472930f316dfa - - // 2^88 * 2 * G - - .quad 0x2695208c9781084f - .quad 0xb1502a0b23450ee1 - .quad 0xfd9daea603efde02 - .quad 0x5a9d2e8c2733a34c - .quad 0x07f3f635d32a7627 - .quad 0x7aaa4d865f6566f0 - .quad 0x3c85e79728d04450 - .quad 0x1fee7f000fe06438 - .quad 0x765305da03dbf7e5 - .quad 0xa4daf2491434cdbd - .quad 0x7b4ad5cdd24a88ec - .quad 0x00f94051ee040543 - - // 2^88 * 3 * G - - .quad 0x8d356b23c3d330b2 - .quad 0xf21c8b9bb0471b06 - .quad 0xb36c316c6e42b83c - .quad 0x07d79c7e8beab10d - .quad 0xd7ef93bb07af9753 - .quad 0x583ed0cf3db766a7 - .quad 0xce6998bf6e0b1ec5 - .quad 0x47b7ffd25dd40452 - .quad 0x87fbfb9cbc08dd12 - .quad 0x8a066b3ae1eec29b - .quad 0x0d57242bdb1fc1bf - .quad 0x1c3520a35ea64bb6 - - // 2^88 * 4 * G - - .quad 0x80d253a6bccba34a - .quad 0x3e61c3a13838219b - .quad 0x90c3b6019882e396 - .quad 0x1c3d05775d0ee66f - .quad 0xcda86f40216bc059 - .quad 0x1fbb231d12bcd87e - .quad 0xb4956a9e17c70990 - .quad 0x38750c3b66d12e55 - .quad 0x692ef1409422e51a - .quad 0xcbc0c73c2b5df671 - .quad 0x21014fe7744ce029 - .quad 0x0621e2c7d330487c - - // 2^88 * 5 * G - - .quad 0xaf9860cc8259838d - .quad 0x90ea48c1c69f9adc - .quad 0x6526483765581e30 - .quad 0x0007d6097bd3a5bc - .quad 0xb7ae1796b0dbf0f3 - .quad 0x54dfafb9e17ce196 - .quad 0x25923071e9aaa3b4 - .quad 0x5d8e589ca1002e9d - .quad 0xc0bf1d950842a94b - .quad 0xb2d3c363588f2e3e - .quad 0x0a961438bb51e2ef - .quad 0x1583d7783c1cbf86 - - // 2^88 * 6 * G - - .quad 0xeceea2ef5da27ae1 - .quad 0x597c3a1455670174 - .quad 0xc9a62a126609167a - .quad 0x252a5f2e81ed8f70 - .quad 0x90034704cc9d28c7 - .quad 0x1d1b679ef72cc58f - .quad 0x16e12b5fbe5b8726 - .quad 0x4958064e83c5580a - .quad 0x0d2894265066e80d - .quad 0xfcc3f785307c8c6b - .quad 0x1b53da780c1112fd - .quad 0x079c170bd843b388 - - // 2^88 * 7 * G - - .quad 0x0506ece464fa6fff - .quad 0xbee3431e6205e523 - .quad 0x3579422451b8ea42 - .quad 0x6dec05e34ac9fb00 - .quad 0xcdd6cd50c0d5d056 - .quad 0x9af7686dbb03573b - .quad 0x3ca6723ff3c3ef48 - .quad 0x6768c0d7317b8acc - .quad 0x94b625e5f155c1b3 - .quad 0x417bf3a7997b7b91 - .quad 0xc22cbddc6d6b2600 - .quad 0x51445e14ddcd52f4 - - // 2^88 * 8 * G - - .quad 0x57502b4b3b144951 - .quad 0x8e67ff6b444bbcb3 - .quad 0xb8bd6927166385db - .quad 0x13186f31e39295c8 - .quad 0x893147ab2bbea455 - .quad 0x8c53a24f92079129 - .quad 0x4b49f948be30f7a7 - .quad 0x12e990086e4fd43d - .quad 0xf10c96b37fdfbb2e - .quad 0x9f9a935e121ceaf9 - .quad 0xdf1136c43a5b983f - .quad 0x77b2e3f05d3e99af - - // 2^92 * 1 * G - - .quad 0xfd0d75879cf12657 - .quad 0xe82fef94e53a0e29 - .quad 0xcc34a7f05bbb4be7 - .quad 0x0b251172a50c38a2 - .quad 0x9532f48fcc5cd29b - .quad 0x2ba851bea3ce3671 - .quad 0x32dacaa051122941 - .quad 0x478d99d9350004f2 - .quad 0x1d5ad94890bb02c0 - .quad 0x50e208b10ec25115 - .quad 0xa26a22894ef21702 - .quad 0x4dc923343b524805 - - // 2^92 * 2 * G - - .quad 0xe3828c400f8086b6 - .quad 0x3f77e6f7979f0dc8 - .quad 0x7ef6de304df42cb4 - .quad 0x5265797cb6abd784 - .quad 0x3ad3e3ebf36c4975 - .quad 0xd75d25a537862125 - .quad 0xe873943da025a516 - .quad 0x6bbc7cb4c411c847 - .quad 0x3c6f9cd1d4a50d56 - .quad 0xb6244077c6feab7e - .quad 0x6ff9bf483580972e - .quad 0x00375883b332acfb - - // 2^92 * 3 * G - - .quad 0x0001b2cd28cb0940 - .quad 0x63fb51a06f1c24c9 - .quad 0xb5ad8691dcd5ca31 - .quad 0x67238dbd8c450660 - .quad 0xc98bec856c75c99c - .quad 0xe44184c000e33cf4 - .quad 0x0a676b9bba907634 - .quad 0x669e2cb571f379d7 - .quad 0xcb116b73a49bd308 - .quad 0x025aad6b2392729e - .quad 0xb4793efa3f55d9b1 - .quad 0x72a1056140678bb9 - - // 2^92 * 4 * G - - .quad 0xa2b6812b1cc9249d - .quad 0x62866eee21211f58 - .quad 0x2cb5c5b85df10ece - .quad 0x03a6b259e263ae00 - .quad 0x0d8d2909e2e505b6 - .quad 0x98ca78abc0291230 - .quad 0x77ef5569a9b12327 - .quad 0x7c77897b81439b47 - .quad 0xf1c1b5e2de331cb5 - .quad 0x5a9f5d8e15fca420 - .quad 0x9fa438f17bd932b1 - .quad 0x2a381bf01c6146e7 - - // 2^92 * 5 * G - - .quad 0xac9b9879cfc811c1 - .quad 0x8b7d29813756e567 - .quad 0x50da4e607c70edfc - .quad 0x5dbca62f884400b6 - .quad 0xf7c0be32b534166f - .quad 0x27e6ca6419cf70d4 - .quad 0x934df7d7a957a759 - .quad 0x5701461dabdec2aa - .quad 0x2c6747402c915c25 - .quad 0x1bdcd1a80b0d340a - .quad 0x5e5601bd07b43f5f - .quad 0x2555b4e05539a242 - - // 2^92 * 6 * G - - .quad 0x6fc09f5266ddd216 - .quad 0xdce560a7c8e37048 - .quad 0xec65939da2df62fd - .quad 0x7a869ae7e52ed192 - .quad 0x78409b1d87e463d4 - .quad 0xad4da95acdfb639d - .quad 0xec28773755259b9c - .quad 0x69c806e9c31230ab - .quad 0x7b48f57414bb3f22 - .quad 0x68c7cee4aedccc88 - .quad 0xed2f936179ed80be - .quad 0x25d70b885f77bc4b - - // 2^92 * 7 * G - - .quad 0x4151c3d9762bf4de - .quad 0x083f435f2745d82b - .quad 0x29775a2e0d23ddd5 - .quad 0x138e3a6269a5db24 - .quad 0x98459d29bb1ae4d4 - .quad 0x56b9c4c739f954ec - .quad 0x832743f6c29b4b3e - .quad 0x21ea8e2798b6878a - .quad 0x87bef4b46a5a7b9c - .quad 0xd2299d1b5fc1d062 - .quad 0x82409818dd321648 - .quad 0x5c5abeb1e5a2e03d - - // 2^92 * 8 * G - - .quad 0x14722af4b73c2ddb - .quad 0xbc470c5f5a05060d - .quad 0x00943eac2581b02e - .quad 0x0e434b3b1f499c8f - .quad 0x02cde6de1306a233 - .quad 0x7b5a52a2116f8ec7 - .quad 0xe1c681f4c1163b5b - .quad 0x241d350660d32643 - .quad 0x6be4404d0ebc52c7 - .quad 0xae46233bb1a791f5 - .quad 0x2aec170ed25db42b - .quad 0x1d8dfd966645d694 - - // 2^96 * 1 * G - - .quad 0x296fa9c59c2ec4de - .quad 0xbc8b61bf4f84f3cb - .quad 0x1c7706d917a8f908 - .quad 0x63b795fc7ad3255d - .quad 0xd598639c12ddb0a4 - .quad 0xa5d19f30c024866b - .quad 0xd17c2f0358fce460 - .quad 0x07a195152e095e8a - .quad 0xa8368f02389e5fc8 - .quad 0x90433b02cf8de43b - .quad 0xafa1fd5dc5412643 - .quad 0x3e8fe83d032f0137 - - // 2^96 * 2 * G - - .quad 0x2f8b15b90570a294 - .quad 0x94f2427067084549 - .quad 0xde1c5ae161bbfd84 - .quad 0x75ba3b797fac4007 - .quad 0x08704c8de8efd13c - .quad 0xdfc51a8e33e03731 - .quad 0xa59d5da51260cde3 - .quad 0x22d60899a6258c86 - .quad 0x6239dbc070cdd196 - .quad 0x60fe8a8b6c7d8a9a - .quad 0xb38847bceb401260 - .quad 0x0904d07b87779e5e - - // 2^96 * 3 * G - - .quad 0xb4ce1fd4ddba919c - .quad 0xcf31db3ec74c8daa - .quad 0x2c63cc63ad86cc51 - .quad 0x43e2143fbc1dde07 - .quad 0xf4322d6648f940b9 - .quad 0x06952f0cbd2d0c39 - .quad 0x167697ada081f931 - .quad 0x6240aacebaf72a6c - .quad 0xf834749c5ba295a0 - .quad 0xd6947c5bca37d25a - .quad 0x66f13ba7e7c9316a - .quad 0x56bdaf238db40cac - - // 2^96 * 4 * G - - .quad 0x362ab9e3f53533eb - .quad 0x338568d56eb93d40 - .quad 0x9e0e14521d5a5572 - .quad 0x1d24a86d83741318 - .quad 0x1310d36cc19d3bb2 - .quad 0x062a6bb7622386b9 - .quad 0x7c9b8591d7a14f5c - .quad 0x03aa31507e1e5754 - .quad 0xf4ec7648ffd4ce1f - .quad 0xe045eaf054ac8c1c - .quad 0x88d225821d09357c - .quad 0x43b261dc9aeb4859 - - // 2^96 * 5 * G - - .quad 0xe55b1e1988bb79bb - .quad 0xa09ed07dc17a359d - .quad 0xb02c2ee2603dea33 - .quad 0x326055cf5b276bc2 - .quad 0x19513d8b6c951364 - .quad 0x94fe7126000bf47b - .quad 0x028d10ddd54f9567 - .quad 0x02b4d5e242940964 - .quad 0xb4a155cb28d18df2 - .quad 0xeacc4646186ce508 - .quad 0xc49cf4936c824389 - .quad 0x27a6c809ae5d3410 - - // 2^96 * 6 * G - - .quad 0x8ba6ebcd1f0db188 - .quad 0x37d3d73a675a5be8 - .quad 0xf22edfa315f5585a - .quad 0x2cb67174ff60a17e - .quad 0xcd2c270ac43d6954 - .quad 0xdd4a3e576a66cab2 - .quad 0x79fa592469d7036c - .quad 0x221503603d8c2599 - .quad 0x59eecdf9390be1d0 - .quad 0xa9422044728ce3f1 - .quad 0x82891c667a94f0f4 - .quad 0x7b1df4b73890f436 - - // 2^96 * 7 * G - - .quad 0xe492f2e0b3b2a224 - .quad 0x7c6c9e062b551160 - .quad 0x15eb8fe20d7f7b0e - .quad 0x61fcef2658fc5992 - .quad 0x5f2e221807f8f58c - .quad 0xe3555c9fd49409d4 - .quad 0xb2aaa88d1fb6a630 - .quad 0x68698245d352e03d - .quad 0xdbb15d852a18187a - .quad 0xf3e4aad386ddacd7 - .quad 0x44bae2810ff6c482 - .quad 0x46cf4c473daf01cf - - // 2^96 * 8 * G - - .quad 0x426525ed9ec4e5f9 - .quad 0x0e5eda0116903303 - .quad 0x72b1a7f2cbe5cadc - .quad 0x29387bcd14eb5f40 - .quad 0x213c6ea7f1498140 - .quad 0x7c1e7ef8392b4854 - .quad 0x2488c38c5629ceba - .quad 0x1065aae50d8cc5bb - .quad 0x1c2c4525df200d57 - .quad 0x5c3b2dd6bfca674a - .quad 0x0a07e7b1e1834030 - .quad 0x69a198e64f1ce716 - - // 2^100 * 1 * G - - .quad 0x7afcd613efa9d697 - .quad 0x0cc45aa41c067959 - .quad 0xa56fe104c1fada96 - .quad 0x3a73b70472e40365 - .quad 0x7b26e56b9e2d4734 - .quad 0xc4c7132b81c61675 - .quad 0xef5c9525ec9cde7f - .quad 0x39c80b16e71743ad - .quad 0x0f196e0d1b826c68 - .quad 0xf71ff0e24960e3db - .quad 0x6113167023b7436c - .quad 0x0cf0ea5877da7282 - - // 2^100 * 2 * G - - .quad 0x196c80a4ddd4ccbd - .quad 0x22e6f55d95f2dd9d - .quad 0xc75e33c740d6c71b - .quad 0x7bb51279cb3c042f - .quad 0xe332ced43ba6945a - .quad 0xde0b1361e881c05d - .quad 0x1ad40f095e67ed3b - .quad 0x5da8acdab8c63d5d - .quad 0xc4b6664a3a70159f - .quad 0x76194f0f0a904e14 - .quad 0xa5614c39a4096c13 - .quad 0x6cd0ff50979feced - - // 2^100 * 3 * G - - .quad 0xc0e067e78f4428ac - .quad 0x14835ab0a61135e3 - .quad 0xf21d14f338062935 - .quad 0x6390a4c8df04849c - .quad 0x7fecfabdb04ba18e - .quad 0xd0fc7bfc3bddbcf7 - .quad 0xa41d486e057a131c - .quad 0x641a4391f2223a61 - .quad 0xc5c6b95aa606a8db - .quad 0x914b7f9eb06825f1 - .quad 0x2a731f6b44fc9eff - .quad 0x30ddf38562705cfc - - // 2^100 * 4 * G - - .quad 0x4e3dcbdad1bff7f9 - .quad 0xc9118e8220645717 - .quad 0xbacccebc0f189d56 - .quad 0x1b4822e9d4467668 - .quad 0x33bef2bd68bcd52c - .quad 0xc649dbb069482ef2 - .quad 0xb5b6ee0c41cb1aee - .quad 0x5c294d270212a7e5 - .quad 0xab360a7f25563781 - .quad 0x2512228a480f7958 - .quad 0xc75d05276114b4e3 - .quad 0x222d9625d976fe2a - - // 2^100 * 5 * G - - .quad 0x1c717f85b372ace1 - .quad 0x81930e694638bf18 - .quad 0x239cad056bc08b58 - .quad 0x0b34271c87f8fff4 - .quad 0x0f94be7e0a344f85 - .quad 0xeb2faa8c87f22c38 - .quad 0x9ce1e75e4ee16f0f - .quad 0x43e64e5418a08dea - .quad 0x8155e2521a35ce63 - .quad 0xbe100d4df912028e - .quad 0xbff80bf8a57ddcec - .quad 0x57342dc96d6bc6e4 - - // 2^100 * 6 * G - - .quad 0xefeef065c8ce5998 - .quad 0xbf029510b5cbeaa2 - .quad 0x8c64a10620b7c458 - .quad 0x35134fb231c24855 - .quad 0xf3c3bcb71e707bf6 - .quad 0x351d9b8c7291a762 - .quad 0x00502e6edad69a33 - .quad 0x522f521f1ec8807f - .quad 0x272c1f46f9a3902b - .quad 0xc91ba3b799657bcc - .quad 0xae614b304f8a1c0e - .quad 0x7afcaad70b99017b - - // 2^100 * 7 * G - - .quad 0xc25ded54a4b8be41 - .quad 0x902d13e11bb0e2dd - .quad 0x41f43233cde82ab2 - .quad 0x1085faa5c3aae7cb - .quad 0xa88141ecef842b6b - .quad 0x55e7b14797abe6c5 - .quad 0x8c748f9703784ffe - .quad 0x5b50a1f7afcd00b7 - .quad 0x9b840f66f1361315 - .quad 0x18462242701003e9 - .quad 0x65ed45fae4a25080 - .quad 0x0a2862393fda7320 - - // 2^100 * 8 * G - - .quad 0x46ab13c8347cbc9d - .quad 0x3849e8d499c12383 - .quad 0x4cea314087d64ac9 - .quad 0x1f354134b1a29ee7 - .quad 0x960e737b6ecb9d17 - .quad 0xfaf24948d67ceae1 - .quad 0x37e7a9b4d55e1b89 - .quad 0x5cb7173cb46c59eb - .quad 0x4a89e68b82b7abf0 - .quad 0xf41cd9279ba6b7b9 - .quad 0x16e6c210e18d876f - .quad 0x7cacdb0f7f1b09c6 - - // 2^104 * 1 * G - - .quad 0x9062b2e0d91a78bc - .quad 0x47c9889cc8509667 - .quad 0x9df54a66405070b8 - .quad 0x7369e6a92493a1bf - .quad 0xe1014434dcc5caed - .quad 0x47ed5d963c84fb33 - .quad 0x70019576ed86a0e7 - .quad 0x25b2697bd267f9e4 - .quad 0x9d673ffb13986864 - .quad 0x3ca5fbd9415dc7b8 - .quad 0xe04ecc3bdf273b5e - .quad 0x1420683db54e4cd2 - - // 2^104 * 2 * G - - .quad 0xb478bd1e249dd197 - .quad 0x620c35005e58c102 - .quad 0xfb02d32fccbaac5c - .quad 0x60b63bebf508a72d - .quad 0x34eebb6fc1cc5ad0 - .quad 0x6a1b0ce99646ac8b - .quad 0xd3b0da49a66bde53 - .quad 0x31e83b4161d081c1 - .quad 0x97e8c7129e062b4f - .quad 0x49e48f4f29320ad8 - .quad 0x5bece14b6f18683f - .quad 0x55cf1eb62d550317 - - // 2^104 * 3 * G - - .quad 0x5879101065c23d58 - .quad 0x8b9d086d5094819c - .quad 0xe2402fa912c55fa7 - .quad 0x669a6564570891d4 - .quad 0x3076b5e37df58c52 - .quad 0xd73ab9dde799cc36 - .quad 0xbd831ce34913ee20 - .quad 0x1a56fbaa62ba0133 - .quad 0x943e6b505c9dc9ec - .quad 0x302557bba77c371a - .quad 0x9873ae5641347651 - .quad 0x13c4836799c58a5c - - // 2^104 * 4 * G - - .quad 0x423a5d465ab3e1b9 - .quad 0xfc13c187c7f13f61 - .quad 0x19f83664ecb5b9b6 - .quad 0x66f80c93a637b607 - .quad 0xc4dcfb6a5d8bd080 - .quad 0xdeebc4ec571a4842 - .quad 0xd4b2e883b8e55365 - .quad 0x50bdc87dc8e5b827 - .quad 0x606d37836edfe111 - .quad 0x32353e15f011abd9 - .quad 0x64b03ac325b73b96 - .quad 0x1dd56444725fd5ae - - // 2^104 * 5 * G - - .quad 0x8fa47ff83362127d - .quad 0xbc9f6ac471cd7c15 - .quad 0x6e71454349220c8b - .quad 0x0e645912219f732e - .quad 0xc297e60008bac89a - .quad 0x7d4cea11eae1c3e0 - .quad 0xf3e38be19fe7977c - .quad 0x3a3a450f63a305cd - .quad 0x078f2f31d8394627 - .quad 0x389d3183de94a510 - .quad 0xd1e36c6d17996f80 - .quad 0x318c8d9393a9a87b - - // 2^104 * 6 * G - - .quad 0xf2745d032afffe19 - .quad 0x0c9f3c497f24db66 - .quad 0xbc98d3e3ba8598ef - .quad 0x224c7c679a1d5314 - .quad 0x5d669e29ab1dd398 - .quad 0xfc921658342d9e3b - .quad 0x55851dfdf35973cd - .quad 0x509a41c325950af6 - .quad 0xbdc06edca6f925e9 - .quad 0x793ef3f4641b1f33 - .quad 0x82ec12809d833e89 - .quad 0x05bff02328a11389 - - // 2^104 * 7 * G - - .quad 0x3632137023cae00b - .quad 0x544acf0ad1accf59 - .quad 0x96741049d21a1c88 - .quad 0x780b8cc3fa2a44a7 - .quad 0x6881a0dd0dc512e4 - .quad 0x4fe70dc844a5fafe - .quad 0x1f748e6b8f4a5240 - .quad 0x576277cdee01a3ea - .quad 0x1ef38abc234f305f - .quad 0x9a577fbd1405de08 - .quad 0x5e82a51434e62a0d - .quad 0x5ff418726271b7a1 - - // 2^104 * 8 * G - - .quad 0x398e080c1789db9d - .quad 0xa7602025f3e778f5 - .quad 0xfa98894c06bd035d - .quad 0x106a03dc25a966be - .quad 0xe5db47e813b69540 - .quad 0xf35d2a3b432610e1 - .quad 0xac1f26e938781276 - .quad 0x29d4db8ca0a0cb69 - .quad 0xd9ad0aaf333353d0 - .quad 0x38669da5acd309e5 - .quad 0x3c57658ac888f7f0 - .quad 0x4ab38a51052cbefa - - // 2^108 * 1 * G - - .quad 0xdfdacbee4324c0e9 - .quad 0x054442883f955bb7 - .quad 0xdef7aaa8ea31609f - .quad 0x68aee70642287cff - .quad 0xf68fe2e8809de054 - .quad 0xe3bc096a9c82bad1 - .quad 0x076353d40aadbf45 - .quad 0x7b9b1fb5dea1959e - .quad 0xf01cc8f17471cc0c - .quad 0x95242e37579082bb - .quad 0x27776093d3e46b5f - .quad 0x2d13d55a28bd85fb - - // 2^108 * 2 * G - - .quad 0xfac5d2065b35b8da - .quad 0xa8da8a9a85624bb7 - .quad 0xccd2ca913d21cd0f - .quad 0x6b8341ee8bf90d58 - .quad 0xbf019cce7aee7a52 - .quad 0xa8ded2b6e454ead3 - .quad 0x3c619f0b87a8bb19 - .quad 0x3619b5d7560916d8 - .quad 0x3579f26b0282c4b2 - .quad 0x64d592f24fafefae - .quad 0xb7cded7b28c8c7c0 - .quad 0x6a927b6b7173a8d7 - - // 2^108 * 3 * G - - .quad 0x1f6db24f986e4656 - .quad 0x1021c02ed1e9105b - .quad 0xf8ff3fff2cc0a375 - .quad 0x1d2a6bf8c6c82592 - .quad 0x8d7040863ece88eb - .quad 0xf0e307a980eec08c - .quad 0xac2250610d788fda - .quad 0x056d92a43a0d478d - .quad 0x1b05a196fc3da5a1 - .quad 0x77d7a8c243b59ed0 - .quad 0x06da3d6297d17918 - .quad 0x66fbb494f12353f7 - - // 2^108 * 4 * G - - .quad 0x751a50b9d85c0fb8 - .quad 0xd1afdc258bcf097b - .quad 0x2f16a6a38309a969 - .quad 0x14ddff9ee5b00659 - .quad 0xd6d70996f12309d6 - .quad 0xdbfb2385e9c3d539 - .quad 0x46d602b0f7552411 - .quad 0x270a0b0557843e0c - .quad 0x61ff0640a7862bcc - .quad 0x81cac09a5f11abfe - .quad 0x9047830455d12abb - .quad 0x19a4bde1945ae873 - - // 2^108 * 5 * G - - .quad 0x9b9f26f520a6200a - .quad 0x64804443cf13eaf8 - .quad 0x8a63673f8631edd3 - .quad 0x72bbbce11ed39dc1 - .quad 0x40c709dec076c49f - .quad 0x657bfaf27f3e53f6 - .quad 0x40662331eca042c4 - .quad 0x14b375487eb4df04 - .quad 0xae853c94ab66dc47 - .quad 0xeb62343edf762d6e - .quad 0xf08e0e186fb2f7d1 - .quad 0x4f0b1c02700ab37a - - // 2^108 * 6 * G - - .quad 0xe1706787d81951fa - .quad 0xa10a2c8eb290c77b - .quad 0xe7382fa03ed66773 - .quad 0x0a4d84710bcc4b54 - .quad 0x79fd21ccc1b2e23f - .quad 0x4ae7c281453df52a - .quad 0xc8172ec9d151486b - .quad 0x68abe9443e0a7534 - .quad 0xda12c6c407831dcb - .quad 0x0da230d74d5c510d - .quad 0x4ab1531e6bd404e1 - .quad 0x4106b166bcf440ef - - // 2^108 * 7 * G - - .quad 0x02e57a421cd23668 - .quad 0x4ad9fb5d0eaef6fd - .quad 0x954e6727b1244480 - .quad 0x7f792f9d2699f331 - .quad 0xa485ccd539e4ecf2 - .quad 0x5aa3f3ad0555bab5 - .quad 0x145e3439937df82d - .quad 0x1238b51e1214283f - .quad 0x0b886b925fd4d924 - .quad 0x60906f7a3626a80d - .quad 0xecd367b4b98abd12 - .quad 0x2876beb1def344cf - - // 2^108 * 8 * G - - .quad 0xdc84e93563144691 - .quad 0x632fe8a0d61f23f4 - .quad 0x4caa800612a9a8d5 - .quad 0x48f9dbfa0e9918d3 - .quad 0xd594b3333a8a85f8 - .quad 0x4ea37689e78d7d58 - .quad 0x73bf9f455e8e351f - .quad 0x5507d7d2bc41ebb4 - .quad 0x1ceb2903299572fc - .quad 0x7c8ccaa29502d0ee - .quad 0x91bfa43411cce67b - .quad 0x5784481964a831e7 - - // 2^112 * 1 * G - - .quad 0xda7c2b256768d593 - .quad 0x98c1c0574422ca13 - .quad 0xf1a80bd5ca0ace1d - .quad 0x29cdd1adc088a690 - .quad 0xd6cfd1ef5fddc09c - .quad 0xe82b3efdf7575dce - .quad 0x25d56b5d201634c2 - .quad 0x3041c6bb04ed2b9b - .quad 0x0ff2f2f9d956e148 - .quad 0xade797759f356b2e - .quad 0x1a4698bb5f6c025c - .quad 0x104bbd6814049a7b - - // 2^112 * 2 * G - - .quad 0x51f0fd3168f1ed67 - .quad 0x2c811dcdd86f3bc2 - .quad 0x44dc5c4304d2f2de - .quad 0x5be8cc57092a7149 - .quad 0xa95d9a5fd67ff163 - .quad 0xe92be69d4cc75681 - .quad 0xb7f8024cde20f257 - .quad 0x204f2a20fb072df5 - .quad 0xc8143b3d30ebb079 - .quad 0x7589155abd652e30 - .quad 0x653c3c318f6d5c31 - .quad 0x2570fb17c279161f - - // 2^112 * 3 * G - - .quad 0x3efa367f2cb61575 - .quad 0xf5f96f761cd6026c - .quad 0xe8c7142a65b52562 - .quad 0x3dcb65ea53030acd - .quad 0x192ea9550bb8245a - .quad 0xc8e6fba88f9050d1 - .quad 0x7986ea2d88a4c935 - .quad 0x241c5f91de018668 - .quad 0x28d8172940de6caa - .quad 0x8fbf2cf022d9733a - .quad 0x16d7fcdd235b01d1 - .quad 0x08420edd5fcdf0e5 - - // 2^112 * 4 * G - - .quad 0xcdff20ab8362fa4a - .quad 0x57e118d4e21a3e6e - .quad 0xe3179617fc39e62b - .quad 0x0d9a53efbc1769fd - .quad 0x0358c34e04f410ce - .quad 0xb6135b5a276e0685 - .quad 0x5d9670c7ebb91521 - .quad 0x04d654f321db889c - .quad 0x5e7dc116ddbdb5d5 - .quad 0x2954deb68da5dd2d - .quad 0x1cb608173334a292 - .quad 0x4a7a4f2618991ad7 - - // 2^112 * 5 * G - - .quad 0xf4a718025fb15f95 - .quad 0x3df65f346b5c1b8f - .quad 0xcdfcf08500e01112 - .quad 0x11b50c4cddd31848 - .quad 0x24c3b291af372a4b - .quad 0x93da8270718147f2 - .quad 0xdd84856486899ef2 - .quad 0x4a96314223e0ee33 - .quad 0xa6e8274408a4ffd6 - .quad 0x738e177e9c1576d9 - .quad 0x773348b63d02b3f2 - .quad 0x4f4bce4dce6bcc51 - - // 2^112 * 6 * G - - .quad 0xa71fce5ae2242584 - .quad 0x26ea725692f58a9e - .quad 0xd21a09d71cea3cf4 - .quad 0x73fcdd14b71c01e6 - .quad 0x30e2616ec49d0b6f - .quad 0xe456718fcaec2317 - .quad 0x48eb409bf26b4fa6 - .quad 0x3042cee561595f37 - .quad 0x427e7079449bac41 - .quad 0x855ae36dbce2310a - .quad 0x4cae76215f841a7c - .quad 0x389e740c9a9ce1d6 - - // 2^112 * 7 * G - - .quad 0x64fcb3ae34dcb9ce - .quad 0x97500323e348d0ad - .quad 0x45b3f07d62c6381b - .quad 0x61545379465a6788 - .quad 0xc9bd78f6570eac28 - .quad 0xe55b0b3227919ce1 - .quad 0x65fc3eaba19b91ed - .quad 0x25c425e5d6263690 - .quad 0x3f3e06a6f1d7de6e - .quad 0x3ef976278e062308 - .quad 0x8c14f6264e8a6c77 - .quad 0x6539a08915484759 - - // 2^112 * 8 * G - - .quad 0xe9d21f74c3d2f773 - .quad 0xc150544125c46845 - .quad 0x624e5ce8f9b99e33 - .quad 0x11c5e4aac5cd186c - .quad 0xddc4dbd414bb4a19 - .quad 0x19b2bc3c98424f8e - .quad 0x48a89fd736ca7169 - .quad 0x0f65320ef019bd90 - .quad 0xd486d1b1cafde0c6 - .quad 0x4f3fe6e3163b5181 - .quad 0x59a8af0dfaf2939a - .quad 0x4cabc7bdec33072a - - // 2^116 * 1 * G - - .quad 0x16faa8fb532f7428 - .quad 0xdbd42ea046a4e272 - .quad 0x5337653b8b9ea480 - .quad 0x4065947223973f03 - .quad 0xf7c0a19c1a54a044 - .quad 0x4a1c5e2477bd9fbb - .quad 0xa6e3ca115af22972 - .quad 0x1819bb953f2e9e0d - .quad 0x498fbb795e042e84 - .quad 0x7d0dd89a7698b714 - .quad 0x8bfb0ba427fe6295 - .quad 0x36ba82e721200524 - - // 2^116 * 2 * G - - .quad 0xd60ecbb74245ec41 - .quad 0xfd9be89e34348716 - .quad 0xc9240afee42284de - .quad 0x4472f648d0531db4 - .quad 0xc8d69d0a57274ed5 - .quad 0x45ba803260804b17 - .quad 0xdf3cda102255dfac - .quad 0x77d221232709b339 - .quad 0x498a6d7064ad94d8 - .quad 0xa5b5c8fd9af62263 - .quad 0x8ca8ed0545c141f4 - .quad 0x2c63bec3662d358c - - // 2^116 * 3 * G - - .quad 0x7fe60d8bea787955 - .quad 0xb9dc117eb5f401b7 - .quad 0x91c7c09a19355cce - .quad 0x22692ef59442bedf - .quad 0x9a518b3a8586f8bf - .quad 0x9ee71af6cbb196f0 - .quad 0xaa0625e6a2385cf2 - .quad 0x1deb2176ddd7c8d1 - .quad 0x8563d19a2066cf6c - .quad 0x401bfd8c4dcc7cd7 - .quad 0xd976a6becd0d8f62 - .quad 0x67cfd773a278b05e - - // 2^116 * 4 * G - - .quad 0x8dec31faef3ee475 - .quad 0x99dbff8a9e22fd92 - .quad 0x512d11594e26cab1 - .quad 0x0cde561eec4310b9 - .quad 0x2d5fa9855a4e586a - .quad 0x65f8f7a449beab7e - .quad 0xaa074dddf21d33d3 - .quad 0x185cba721bcb9dee - .quad 0x93869da3f4e3cb41 - .quad 0xbf0392f540f7977e - .quad 0x026204fcd0463b83 - .quad 0x3ec91a769eec6eed - - // 2^116 * 5 * G - - .quad 0x1e9df75bf78166ad - .quad 0x4dfda838eb0cd7af - .quad 0xba002ed8c1eaf988 - .quad 0x13fedb3e11f33cfc - .quad 0x0fad2fb7b0a3402f - .quad 0x46615ecbfb69f4a8 - .quad 0xf745bcc8c5f8eaa6 - .quad 0x7a5fa8794a94e896 - .quad 0x52958faa13cd67a1 - .quad 0x965ee0818bdbb517 - .quad 0x16e58daa2e8845b3 - .quad 0x357d397d5499da8f - - // 2^116 * 6 * G - - .quad 0x1ebfa05fb0bace6c - .quad 0xc934620c1caf9a1e - .quad 0xcc771cc41d82b61a - .quad 0x2d94a16aa5f74fec - .quad 0x481dacb4194bfbf8 - .quad 0x4d77e3f1bae58299 - .quad 0x1ef4612e7d1372a0 - .quad 0x3a8d867e70ff69e1 - .quad 0x6f58cd5d55aff958 - .quad 0xba3eaa5c75567721 - .quad 0x75c123999165227d - .quad 0x69be1343c2f2b35e - - // 2^116 * 7 * G - - .quad 0x0e091d5ee197c92a - .quad 0x4f51019f2945119f - .quad 0x143679b9f034e99c - .quad 0x7d88112e4d24c696 - .quad 0x82bbbdac684b8de3 - .quad 0xa2f4c7d03fca0718 - .quad 0x337f92fbe096aaa8 - .quad 0x200d4d8c63587376 - .quad 0x208aed4b4893b32b - .quad 0x3efbf23ebe59b964 - .quad 0xd762deb0dba5e507 - .quad 0x69607bd681bd9d94 - - // 2^116 * 8 * G - - .quad 0xf6be021068de1ce1 - .quad 0xe8d518e70edcbc1f - .quad 0xe3effdd01b5505a5 - .quad 0x35f63353d3ec3fd0 - .quad 0x3b7f3bd49323a902 - .quad 0x7c21b5566b2c6e53 - .quad 0xe5ba8ff53a7852a7 - .quad 0x28bc77a5838ece00 - .quad 0x63ba78a8e25d8036 - .quad 0x63651e0094333490 - .quad 0x48d82f20288ce532 - .quad 0x3a31abfa36b57524 - - // 2^120 * 1 * G - - .quad 0x239e9624089c0a2e - .quad 0xc748c4c03afe4738 - .quad 0x17dbed2a764fa12a - .quad 0x639b93f0321c8582 - .quad 0xc08f788f3f78d289 - .quad 0xfe30a72ca1404d9f - .quad 0xf2778bfccf65cc9d - .quad 0x7ee498165acb2021 - .quad 0x7bd508e39111a1c3 - .quad 0x2b2b90d480907489 - .quad 0xe7d2aec2ae72fd19 - .quad 0x0edf493c85b602a6 - - // 2^120 * 2 * G - - .quad 0xaecc8158599b5a68 - .quad 0xea574f0febade20e - .quad 0x4fe41d7422b67f07 - .quad 0x403b92e3019d4fb4 - .quad 0x6767c4d284764113 - .quad 0xa090403ff7f5f835 - .quad 0x1c8fcffacae6bede - .quad 0x04c00c54d1dfa369 - .quad 0x4dc22f818b465cf8 - .quad 0x71a0f35a1480eff8 - .quad 0xaee8bfad04c7d657 - .quad 0x355bb12ab26176f4 - - // 2^120 * 3 * G - - .quad 0xa71e64cc7493bbf4 - .quad 0xe5bd84d9eca3b0c3 - .quad 0x0a6bc50cfa05e785 - .quad 0x0f9b8132182ec312 - .quad 0xa301dac75a8c7318 - .quad 0xed90039db3ceaa11 - .quad 0x6f077cbf3bae3f2d - .quad 0x7518eaf8e052ad8e - .quad 0xa48859c41b7f6c32 - .quad 0x0f2d60bcf4383298 - .quad 0x1815a929c9b1d1d9 - .quad 0x47c3871bbb1755c4 - - // 2^120 * 4 * G - - .quad 0x5144539771ec4f48 - .quad 0xf805b17dc98c5d6e - .quad 0xf762c11a47c3c66b - .quad 0x00b89b85764699dc - .quad 0xfbe65d50c85066b0 - .quad 0x62ecc4b0b3a299b0 - .quad 0xe53754ea441ae8e0 - .quad 0x08fea02ce8d48d5f - .quad 0x824ddd7668deead0 - .quad 0xc86445204b685d23 - .quad 0xb514cfcd5d89d665 - .quad 0x473829a74f75d537 - - // 2^120 * 5 * G - - .quad 0x82d2da754679c418 - .quad 0xe63bd7d8b2618df0 - .quad 0x355eef24ac47eb0a - .quad 0x2078684c4833c6b4 - .quad 0x23d9533aad3902c9 - .quad 0x64c2ddceef03588f - .quad 0x15257390cfe12fb4 - .quad 0x6c668b4d44e4d390 - .quad 0x3b48cf217a78820c - .quad 0xf76a0ab281273e97 - .quad 0xa96c65a78c8eed7b - .quad 0x7411a6054f8a433f - - // 2^120 * 6 * G - - .quad 0x4d659d32b99dc86d - .quad 0x044cdc75603af115 - .quad 0xb34c712cdcc2e488 - .quad 0x7c136574fb8134ff - .quad 0x579ae53d18b175b4 - .quad 0x68713159f392a102 - .quad 0x8455ecba1eef35f5 - .quad 0x1ec9a872458c398f - .quad 0xb8e6a4d400a2509b - .quad 0x9b81d7020bc882b4 - .quad 0x57e7cc9bf1957561 - .quad 0x3add88a5c7cd6460 - - // 2^120 * 7 * G - - .quad 0xab895770b635dcf2 - .quad 0x02dfef6cf66c1fbc - .quad 0x85530268beb6d187 - .quad 0x249929fccc879e74 - .quad 0x85c298d459393046 - .quad 0x8f7e35985ff659ec - .quad 0x1d2ca22af2f66e3a - .quad 0x61ba1131a406a720 - .quad 0xa3d0a0f116959029 - .quad 0x023b6b6cba7ebd89 - .quad 0x7bf15a3e26783307 - .quad 0x5620310cbbd8ece7 - - // 2^120 * 8 * G - - .quad 0x528993434934d643 - .quad 0xb9dbf806a51222f5 - .quad 0x8f6d878fc3f41c22 - .quad 0x37676a2a4d9d9730 - .quad 0x6646b5f477e285d6 - .quad 0x40e8ff676c8f6193 - .quad 0xa6ec7311abb594dd - .quad 0x7ec846f3658cec4d - .quad 0x9b5e8f3f1da22ec7 - .quad 0x130f1d776c01cd13 - .quad 0x214c8fcfa2989fb8 - .quad 0x6daaf723399b9dd5 - - // 2^124 * 1 * G - - .quad 0x591e4a5610628564 - .quad 0x2a4bb87ca8b4df34 - .quad 0xde2a2572e7a38e43 - .quad 0x3cbdabd9fee5046e - .quad 0x81aebbdd2cd13070 - .quad 0x962e4325f85a0e9e - .quad 0xde9391aacadffecb - .quad 0x53177fda52c230e6 - .quad 0xa7bc970650b9de79 - .quad 0x3d12a7fbc301b59b - .quad 0x02652e68d36ae38c - .quad 0x79d739835a6199dc - - // 2^124 * 2 * G - - .quad 0xd9354df64131c1bd - .quad 0x758094a186ec5822 - .quad 0x4464ee12e459f3c2 - .quad 0x6c11fce4cb133282 - .quad 0x21c9d9920d591737 - .quad 0x9bea41d2e9b46cd6 - .quad 0xe20e84200d89bfca - .quad 0x79d99f946eae5ff8 - .quad 0xf17b483568673205 - .quad 0x387deae83caad96c - .quad 0x61b471fd56ffe386 - .quad 0x31741195b745a599 - - // 2^124 * 3 * G - - .quad 0xe8d10190b77a360b - .quad 0x99b983209995e702 - .quad 0xbd4fdff8fa0247aa - .quad 0x2772e344e0d36a87 - .quad 0x17f8ba683b02a047 - .quad 0x50212096feefb6c8 - .quad 0x70139be21556cbe2 - .quad 0x203e44a11d98915b - .quad 0xd6863eba37b9e39f - .quad 0x105bc169723b5a23 - .quad 0x104f6459a65c0762 - .quad 0x567951295b4d38d4 - - // 2^124 * 4 * G - - .quad 0x535fd60613037524 - .quad 0xe210adf6b0fbc26a - .quad 0xac8d0a9b23e990ae - .quad 0x47204d08d72fdbf9 - .quad 0x07242eb30d4b497f - .quad 0x1ef96306b9bccc87 - .quad 0x37950934d8116f45 - .quad 0x05468d6201405b04 - .quad 0x00f565a9f93267de - .quad 0xcecfd78dc0d58e8a - .quad 0xa215e2dcf318e28e - .quad 0x4599ee919b633352 - - // 2^124 * 5 * G - - .quad 0xd3c220ca70e0e76b - .quad 0xb12bea58ea9f3094 - .quad 0x294ddec8c3271282 - .quad 0x0c3539e1a1d1d028 - .quad 0xac746d6b861ae579 - .quad 0x31ab0650f6aea9dc - .quad 0x241d661140256d4c - .quad 0x2f485e853d21a5de - .quad 0x329744839c0833f3 - .quad 0x6fe6257fd2abc484 - .quad 0x5327d1814b358817 - .quad 0x65712585893fe9bc - - // 2^124 * 6 * G - - .quad 0x9c102fb732a61161 - .quad 0xe48e10dd34d520a8 - .quad 0x365c63546f9a9176 - .quad 0x32f6fe4c046f6006 - .quad 0x81c29f1bd708ee3f - .quad 0xddcb5a05ae6407d0 - .quad 0x97aec1d7d2a3eba7 - .quad 0x1590521a91d50831 - .quad 0x40a3a11ec7910acc - .quad 0x9013dff8f16d27ae - .quad 0x1a9720d8abb195d4 - .quad 0x1bb9fe452ea98463 - - // 2^124 * 7 * G - - .quad 0xe9d1d950b3d54f9e - .quad 0x2d5f9cbee00d33c1 - .quad 0x51c2c656a04fc6ac - .quad 0x65c091ee3c1cbcc9 - .quad 0xcf5e6c95cc36747c - .quad 0x294201536b0bc30d - .quad 0x453ac67cee797af0 - .quad 0x5eae6ab32a8bb3c9 - .quad 0x7083661114f118ea - .quad 0x2b37b87b94349cad - .quad 0x7273f51cb4e99f40 - .quad 0x78a2a95823d75698 - - // 2^124 * 8 * G - - .quad 0xa2b072e95c8c2ace - .quad 0x69cffc96651e9c4b - .quad 0x44328ef842e7b42b - .quad 0x5dd996c122aadeb3 - .quad 0xb4f23c425ef83207 - .quad 0xabf894d3c9a934b5 - .quad 0xd0708c1339fd87f7 - .quad 0x1876789117166130 - .quad 0x925b5ef0670c507c - .quad 0x819bc842b93c33bf - .quad 0x10792e9a70dd003f - .quad 0x59ad4b7a6e28dc74 - - // 2^128 * 1 * G - - .quad 0x5f3a7562eb3dbe47 - .quad 0xf7ea38548ebda0b8 - .quad 0x00c3e53145747299 - .quad 0x1304e9e71627d551 - .quad 0x583b04bfacad8ea2 - .quad 0x29b743e8148be884 - .quad 0x2b1e583b0810c5db - .quad 0x2b5449e58eb3bbaa - .quad 0x789814d26adc9cfe - .quad 0x3c1bab3f8b48dd0b - .quad 0xda0fe1fff979c60a - .quad 0x4468de2d7c2dd693 - - // 2^128 * 2 * G - - .quad 0x51bb355e9419469e - .quad 0x33e6dc4c23ddc754 - .quad 0x93a5b6d6447f9962 - .quad 0x6cce7c6ffb44bd63 - .quad 0x4b9ad8c6f86307ce - .quad 0x21113531435d0c28 - .quad 0xd4a866c5657a772c - .quad 0x5da6427e63247352 - .quad 0x1a94c688deac22ca - .quad 0xb9066ef7bbae1ff8 - .quad 0x88ad8c388d59580f - .quad 0x58f29abfe79f2ca8 - - // 2^128 * 3 * G - - .quad 0xe90ecfab8de73e68 - .quad 0x54036f9f377e76a5 - .quad 0xf0495b0bbe015982 - .quad 0x577629c4a7f41e36 - .quad 0x4b5a64bf710ecdf6 - .quad 0xb14ce538462c293c - .quad 0x3643d056d50b3ab9 - .quad 0x6af93724185b4870 - .quad 0x3220024509c6a888 - .quad 0xd2e036134b558973 - .quad 0x83e236233c33289f - .quad 0x701f25bb0caec18f - - // 2^128 * 4 * G - - .quad 0xc3a8b0f8e4616ced - .quad 0xf700660e9e25a87d - .quad 0x61e3061ff4bca59c - .quad 0x2e0c92bfbdc40be9 - .quad 0x9d18f6d97cbec113 - .quad 0x844a06e674bfdbe4 - .quad 0x20f5b522ac4e60d6 - .quad 0x720a5bc050955e51 - .quad 0x0c3f09439b805a35 - .quad 0xe84e8b376242abfc - .quad 0x691417f35c229346 - .quad 0x0e9b9cbb144ef0ec - - // 2^128 * 5 * G - - .quad 0xfbbad48ffb5720ad - .quad 0xee81916bdbf90d0e - .quad 0xd4813152635543bf - .quad 0x221104eb3f337bd8 - .quad 0x8dee9bd55db1beee - .quad 0xc9c3ab370a723fb9 - .quad 0x44a8f1bf1c68d791 - .quad 0x366d44191cfd3cde - .quad 0x9e3c1743f2bc8c14 - .quad 0x2eda26fcb5856c3b - .quad 0xccb82f0e68a7fb97 - .quad 0x4167a4e6bc593244 - - // 2^128 * 6 * G - - .quad 0x643b9d2876f62700 - .quad 0x5d1d9d400e7668eb - .quad 0x1b4b430321fc0684 - .quad 0x7938bb7e2255246a - .quad 0xc2be2665f8ce8fee - .quad 0xe967ff14e880d62c - .quad 0xf12e6e7e2f364eee - .quad 0x34b33370cb7ed2f6 - .quad 0xcdc591ee8681d6cc - .quad 0xce02109ced85a753 - .quad 0xed7485c158808883 - .quad 0x1176fc6e2dfe65e4 - - // 2^128 * 7 * G - - .quad 0xb4af6cd05b9c619b - .quad 0x2ddfc9f4b2a58480 - .quad 0x3d4fa502ebe94dc4 - .quad 0x08fc3a4c677d5f34 - .quad 0xdb90e28949770eb8 - .quad 0x98fbcc2aacf440a3 - .quad 0x21354ffeded7879b - .quad 0x1f6a3e54f26906b6 - .quad 0x60a4c199d30734ea - .quad 0x40c085b631165cd6 - .quad 0xe2333e23f7598295 - .quad 0x4f2fad0116b900d1 - - // 2^128 * 8 * G - - .quad 0x44beb24194ae4e54 - .quad 0x5f541c511857ef6c - .quad 0xa61e6b2d368d0498 - .quad 0x445484a4972ef7ab - .quad 0x962cd91db73bb638 - .quad 0xe60577aafc129c08 - .quad 0x6f619b39f3b61689 - .quad 0x3451995f2944ee81 - .quad 0x9152fcd09fea7d7c - .quad 0x4a816c94b0935cf6 - .quad 0x258e9aaa47285c40 - .quad 0x10b89ca6042893b7 - - // 2^132 * 1 * G - - .quad 0x9b2a426e3b646025 - .quad 0x32127190385ce4cf - .quad 0xa25cffc2dd6dea45 - .quad 0x06409010bea8de75 - .quad 0xd67cded679d34aa0 - .quad 0xcc0b9ec0cc4db39f - .quad 0xa535a456e35d190f - .quad 0x2e05d9eaf61f6fef - .quad 0xc447901ad61beb59 - .quad 0x661f19bce5dc880a - .quad 0x24685482b7ca6827 - .quad 0x293c778cefe07f26 - - // 2^132 * 2 * G - - .quad 0x86809e7007069096 - .quad 0xaad75b15e4e50189 - .quad 0x07f35715a21a0147 - .quad 0x0487f3f112815d5e - .quad 0x16c795d6a11ff200 - .quad 0xcb70d0e2b15815c9 - .quad 0x89f293209b5395b5 - .quad 0x50b8c2d031e47b4f - .quad 0x48350c08068a4962 - .quad 0x6ffdd05351092c9a - .quad 0x17af4f4aaf6fc8dd - .quad 0x4b0553b53cdba58b - - // 2^132 * 3 * G - - .quad 0x9c65fcbe1b32ff79 - .quad 0xeb75ea9f03b50f9b - .quad 0xfced2a6c6c07e606 - .quad 0x35106cd551717908 - .quad 0xbf05211b27c152d4 - .quad 0x5ec26849bd1af639 - .quad 0x5e0b2caa8e6fab98 - .quad 0x054c8bdd50bd0840 - .quad 0x38a0b12f1dcf073d - .quad 0x4b60a8a3b7f6a276 - .quad 0xfed5ac25d3404f9a - .quad 0x72e82d5e5505c229 - - // 2^132 * 4 * G - - .quad 0x6b0b697ff0d844c8 - .quad 0xbb12f85cd979cb49 - .quad 0xd2a541c6c1da0f1f - .quad 0x7b7c242958ce7211 - .quad 0x00d9cdfd69771d02 - .quad 0x410276cd6cfbf17e - .quad 0x4c45306c1cb12ec7 - .quad 0x2857bf1627500861 - .quad 0x9f21903f0101689e - .quad 0xd779dfd3bf861005 - .quad 0xa122ee5f3deb0f1b - .quad 0x510df84b485a00d4 - - // 2^132 * 5 * G - - .quad 0xa54133bb9277a1fa - .quad 0x74ec3b6263991237 - .quad 0x1a3c54dc35d2f15a - .quad 0x2d347144e482ba3a - .quad 0x24b3c887c70ac15e - .quad 0xb0f3a557fb81b732 - .quad 0x9b2cde2fe578cc1b - .quad 0x4cf7ed0703b54f8e - .quad 0x6bd47c6598fbee0f - .quad 0x9e4733e2ab55be2d - .quad 0x1093f624127610c5 - .quad 0x4e05e26ad0a1eaa4 - - // 2^132 * 6 * G - - .quad 0xda9b6b624b531f20 - .quad 0x429a760e77509abb - .quad 0xdbe9f522e823cb80 - .quad 0x618f1856880c8f82 - .quad 0x1833c773e18fe6c0 - .quad 0xe3c4711ad3c87265 - .quad 0x3bfd3c4f0116b283 - .quad 0x1955875eb4cd4db8 - .quad 0x6da6de8f0e399799 - .quad 0x7ad61aa440fda178 - .quad 0xb32cd8105e3563dd - .quad 0x15f6beae2ae340ae - - // 2^132 * 7 * G - - .quad 0x862bcb0c31ec3a62 - .quad 0x810e2b451138f3c2 - .quad 0x788ec4b839dac2a4 - .quad 0x28f76867ae2a9281 - .quad 0xba9a0f7b9245e215 - .quad 0xf368612dd98c0dbb - .quad 0x2e84e4cbf220b020 - .quad 0x6ba92fe962d90eda - .quad 0x3e4df9655884e2aa - .quad 0xbd62fbdbdbd465a5 - .quad 0xd7596caa0de9e524 - .quad 0x6e8042ccb2b1b3d7 - - // 2^132 * 8 * G - - .quad 0xf10d3c29ce28ca6e - .quad 0xbad34540fcb6093d - .quad 0xe7426ed7a2ea2d3f - .quad 0x08af9d4e4ff298b9 - .quad 0x1530653616521f7e - .quad 0x660d06b896203dba - .quad 0x2d3989bc545f0879 - .quad 0x4b5303af78ebd7b0 - .quad 0x72f8a6c3bebcbde8 - .quad 0x4f0fca4adc3a8e89 - .quad 0x6fa9d4e8c7bfdf7a - .quad 0x0dcf2d679b624eb7 - - // 2^136 * 1 * G - - .quad 0x3d5947499718289c - .quad 0x12ebf8c524533f26 - .quad 0x0262bfcb14c3ef15 - .quad 0x20b878d577b7518e - .quad 0x753941be5a45f06e - .quad 0xd07caeed6d9c5f65 - .quad 0x11776b9c72ff51b6 - .quad 0x17d2d1d9ef0d4da9 - .quad 0x27f2af18073f3e6a - .quad 0xfd3fe519d7521069 - .quad 0x22e3b72c3ca60022 - .quad 0x72214f63cc65c6a7 - - // 2^136 * 2 * G - - .quad 0xb4e37f405307a693 - .quad 0xaba714d72f336795 - .quad 0xd6fbd0a773761099 - .quad 0x5fdf48c58171cbc9 - .quad 0x1d9db7b9f43b29c9 - .quad 0xd605824a4f518f75 - .quad 0xf2c072bd312f9dc4 - .quad 0x1f24ac855a1545b0 - .quad 0x24d608328e9505aa - .quad 0x4748c1d10c1420ee - .quad 0xc7ffe45c06fb25a2 - .quad 0x00ba739e2ae395e6 - - // 2^136 * 3 * G - - .quad 0x592e98de5c8790d6 - .quad 0xe5bfb7d345c2a2df - .quad 0x115a3b60f9b49922 - .quad 0x03283a3e67ad78f3 - .quad 0xae4426f5ea88bb26 - .quad 0x360679d984973bfb - .quad 0x5c9f030c26694e50 - .quad 0x72297de7d518d226 - .quad 0x48241dc7be0cb939 - .quad 0x32f19b4d8b633080 - .quad 0xd3dfc90d02289308 - .quad 0x05e1296846271945 - - // 2^136 * 4 * G - - .quad 0xba82eeb32d9c495a - .quad 0xceefc8fcf12bb97c - .quad 0xb02dabae93b5d1e0 - .quad 0x39c00c9c13698d9b - .quad 0xadbfbbc8242c4550 - .quad 0xbcc80cecd03081d9 - .quad 0x843566a6f5c8df92 - .quad 0x78cf25d38258ce4c - .quad 0x15ae6b8e31489d68 - .quad 0xaa851cab9c2bf087 - .quad 0xc9a75a97f04efa05 - .quad 0x006b52076b3ff832 - - // 2^136 * 5 * G - - .quad 0x29e0cfe19d95781c - .quad 0xb681df18966310e2 - .quad 0x57df39d370516b39 - .quad 0x4d57e3443bc76122 - .quad 0xf5cb7e16b9ce082d - .quad 0x3407f14c417abc29 - .quad 0xd4b36bce2bf4a7ab - .quad 0x7de2e9561a9f75ce - .quad 0xde70d4f4b6a55ecb - .quad 0x4801527f5d85db99 - .quad 0xdbc9c440d3ee9a81 - .quad 0x6b2a90af1a6029ed - - // 2^136 * 6 * G - - .quad 0x6923f4fc9ae61e97 - .quad 0x5735281de03f5fd1 - .quad 0xa764ae43e6edd12d - .quad 0x5fd8f4e9d12d3e4a - .quad 0x77ebf3245bb2d80a - .quad 0xd8301b472fb9079b - .quad 0xc647e6f24cee7333 - .quad 0x465812c8276c2109 - .quad 0x4d43beb22a1062d9 - .quad 0x7065fb753831dc16 - .quad 0x180d4a7bde2968d7 - .quad 0x05b32c2b1cb16790 - - // 2^136 * 7 * G - - .quad 0xc8c05eccd24da8fd - .quad 0xa1cf1aac05dfef83 - .quad 0xdbbeeff27df9cd61 - .quad 0x3b5556a37b471e99 - .quad 0xf7fca42c7ad58195 - .quad 0x3214286e4333f3cc - .quad 0xb6c29d0d340b979d - .quad 0x31771a48567307e1 - .quad 0x32b0c524e14dd482 - .quad 0xedb351541a2ba4b6 - .quad 0xa3d16048282b5af3 - .quad 0x4fc079d27a7336eb - - // 2^136 * 8 * G - - .quad 0x51c938b089bf2f7f - .quad 0x2497bd6502dfe9a7 - .quad 0xffffc09c7880e453 - .quad 0x124567cecaf98e92 - .quad 0xdc348b440c86c50d - .quad 0x1337cbc9cc94e651 - .quad 0x6422f74d643e3cb9 - .quad 0x241170c2bae3cd08 - .quad 0x3ff9ab860ac473b4 - .quad 0xf0911dee0113e435 - .quad 0x4ae75060ebc6c4af - .quad 0x3f8612966c87000d - - // 2^140 * 1 * G - - .quad 0x0c9c5303f7957be4 - .quad 0xa3c31a20e085c145 - .quad 0xb0721d71d0850050 - .quad 0x0aba390eab0bf2da - .quad 0x529fdffe638c7bf3 - .quad 0xdf2b9e60388b4995 - .quad 0xe027b34f1bad0249 - .quad 0x7bc92fc9b9fa74ed - .quad 0x9f97ef2e801ad9f9 - .quad 0x83697d5479afda3a - .quad 0xe906b3ffbd596b50 - .quad 0x02672b37dd3fb8e0 - - // 2^140 * 2 * G - - .quad 0x48b2ca8b260885e4 - .quad 0xa4286bec82b34c1c - .quad 0x937e1a2617f58f74 - .quad 0x741d1fcbab2ca2a5 - .quad 0xee9ba729398ca7f5 - .quad 0xeb9ca6257a4849db - .quad 0x29eb29ce7ec544e1 - .quad 0x232ca21ef736e2c8 - .quad 0xbf61423d253fcb17 - .quad 0x08803ceafa39eb14 - .quad 0xf18602df9851c7af - .quad 0x0400f3a049e3414b - - // 2^140 * 3 * G - - .quad 0xabce0476ba61c55b - .quad 0x36a3d6d7c4d39716 - .quad 0x6eb259d5e8d82d09 - .quad 0x0c9176e984d756fb - .quad 0x2efba412a06e7b06 - .quad 0x146785452c8d2560 - .quad 0xdf9713ebd67a91c7 - .quad 0x32830ac7157eadf3 - .quad 0x0e782a7ab73769e8 - .quad 0x04a05d7875b18e2c - .quad 0x29525226ebcceae1 - .quad 0x0d794f8383eba820 - - // 2^140 * 4 * G - - .quad 0xff35f5cb9e1516f4 - .quad 0xee805bcf648aae45 - .quad 0xf0d73c2bb93a9ef3 - .quad 0x097b0bf22092a6c2 - .quad 0x7be44ce7a7a2e1ac - .quad 0x411fd93efad1b8b7 - .quad 0x1734a1d70d5f7c9b - .quad 0x0d6592233127db16 - .quad 0xc48bab1521a9d733 - .quad 0xa6c2eaead61abb25 - .quad 0x625c6c1cc6cb4305 - .quad 0x7fc90fea93eb3a67 - - // 2^140 * 5 * G - - .quad 0x0408f1fe1f5c5926 - .quad 0x1a8f2f5e3b258bf4 - .quad 0x40a951a2fdc71669 - .quad 0x6598ee93c98b577e - .quad 0xc527deb59c7cb23d - .quad 0x955391695328404e - .quad 0xd64392817ccf2c7a - .quad 0x6ce97dabf7d8fa11 - .quad 0x25b5a8e50ef7c48f - .quad 0xeb6034116f2ce532 - .quad 0xc5e75173e53de537 - .quad 0x73119fa08c12bb03 - - // 2^140 * 6 * G - - .quad 0xed30129453f1a4cb - .quad 0xbce621c9c8f53787 - .quad 0xfacb2b1338bee7b9 - .quad 0x3025798a9ea8428c - .quad 0x7845b94d21f4774d - .quad 0xbf62f16c7897b727 - .quad 0x671857c03c56522b - .quad 0x3cd6a85295621212 - .quad 0x3fecde923aeca999 - .quad 0xbdaa5b0062e8c12f - .quad 0x67b99dfc96988ade - .quad 0x3f52c02852661036 - - // 2^140 * 7 * G - - .quad 0xffeaa48e2a1351c6 - .quad 0x28624754fa7f53d7 - .quad 0x0b5ba9e57582ddf1 - .quad 0x60c0104ba696ac59 - .quad 0x9258bf99eec416c6 - .quad 0xac8a5017a9d2f671 - .quad 0x629549ab16dea4ab - .quad 0x05d0e85c99091569 - .quad 0x051de020de9cbe97 - .quad 0xfa07fc56b50bcf74 - .quad 0x378cec9f0f11df65 - .quad 0x36853c69ab96de4d - - // 2^140 * 8 * G - - .quad 0x36d9b8de78f39b2d - .quad 0x7f42ed71a847b9ec - .quad 0x241cd1d679bd3fde - .quad 0x6a704fec92fbce6b - .quad 0x4433c0b0fac5e7be - .quad 0x724bae854c08dcbe - .quad 0xf1f24cc446978f9b - .quad 0x4a0aff6d62825fc8 - .quad 0xe917fb9e61095301 - .quad 0xc102df9402a092f8 - .quad 0xbf09e2f5fa66190b - .quad 0x681109bee0dcfe37 - - // 2^144 * 1 * G - - .quad 0x559a0cc9782a0dde - .quad 0x551dcdb2ea718385 - .quad 0x7f62865b31ef238c - .quad 0x504aa7767973613d - .quad 0x9c18fcfa36048d13 - .quad 0x29159db373899ddd - .quad 0xdc9f350b9f92d0aa - .quad 0x26f57eee878a19d4 - .quad 0x0cab2cd55687efb1 - .quad 0x5180d162247af17b - .quad 0x85c15a344f5a2467 - .quad 0x4041943d9dba3069 - - // 2^144 * 2 * G - - .quad 0xc3c0eeba43ebcc96 - .quad 0x8d749c9c26ea9caf - .quad 0xd9fa95ee1c77ccc6 - .quad 0x1420a1d97684340f - .quad 0x4b217743a26caadd - .quad 0x47a6b424648ab7ce - .quad 0xcb1d4f7a03fbc9e3 - .quad 0x12d931429800d019 - .quad 0x00c67799d337594f - .quad 0x5e3c5140b23aa47b - .quad 0x44182854e35ff395 - .quad 0x1b4f92314359a012 - - // 2^144 * 3 * G - - .quad 0x3e5c109d89150951 - .quad 0x39cefa912de9696a - .quad 0x20eae43f975f3020 - .quad 0x239b572a7f132dae - .quad 0x33cf3030a49866b1 - .quad 0x251f73d2215f4859 - .quad 0xab82aa4051def4f6 - .quad 0x5ff191d56f9a23f6 - .quad 0x819ed433ac2d9068 - .quad 0x2883ab795fc98523 - .quad 0xef4572805593eb3d - .quad 0x020c526a758f36cb - - // 2^144 * 4 * G - - .quad 0x779834f89ed8dbbc - .quad 0xc8f2aaf9dc7ca46c - .quad 0xa9524cdca3e1b074 - .quad 0x02aacc4615313877 - .quad 0xe931ef59f042cc89 - .quad 0x2c589c9d8e124bb6 - .quad 0xadc8e18aaec75997 - .quad 0x452cfe0a5602c50c - .quad 0x86a0f7a0647877df - .quad 0xbbc464270e607c9f - .quad 0xab17ea25f1fb11c9 - .quad 0x4cfb7d7b304b877b - - // 2^144 * 5 * G - - .quad 0x72b43d6cb89b75fe - .quad 0x54c694d99c6adc80 - .quad 0xb8c3aa373ee34c9f - .quad 0x14b4622b39075364 - .quad 0xe28699c29789ef12 - .quad 0x2b6ecd71df57190d - .quad 0xc343c857ecc970d0 - .quad 0x5b1d4cbc434d3ac5 - .quad 0xb6fb2615cc0a9f26 - .quad 0x3a4f0e2bb88dcce5 - .quad 0x1301498b3369a705 - .quad 0x2f98f71258592dd1 - - // 2^144 * 6 * G - - .quad 0x0c94a74cb50f9e56 - .quad 0x5b1ff4a98e8e1320 - .quad 0x9a2acc2182300f67 - .quad 0x3a6ae249d806aaf9 - .quad 0x2e12ae444f54a701 - .quad 0xfcfe3ef0a9cbd7de - .quad 0xcebf890d75835de0 - .quad 0x1d8062e9e7614554 - .quad 0x657ada85a9907c5a - .quad 0x1a0ea8b591b90f62 - .quad 0x8d0e1dfbdf34b4e9 - .quad 0x298b8ce8aef25ff3 - - // 2^144 * 7 * G - - .quad 0x2a927953eff70cb2 - .quad 0x4b89c92a79157076 - .quad 0x9418457a30a7cf6a - .quad 0x34b8a8404d5ce485 - .quad 0x837a72ea0a2165de - .quad 0x3fab07b40bcf79f6 - .quad 0x521636c77738ae70 - .quad 0x6ba6271803a7d7dc - .quad 0xc26eecb583693335 - .quad 0xd5a813df63b5fefd - .quad 0xa293aa9aa4b22573 - .quad 0x71d62bdd465e1c6a - - // 2^144 * 8 * G - - .quad 0x6533cc28d378df80 - .quad 0xf6db43790a0fa4b4 - .quad 0xe3645ff9f701da5a - .quad 0x74d5f317f3172ba4 - .quad 0xcd2db5dab1f75ef5 - .quad 0xd77f95cf16b065f5 - .quad 0x14571fea3f49f085 - .quad 0x1c333621262b2b3d - .quad 0xa86fe55467d9ca81 - .quad 0x398b7c752b298c37 - .quad 0xda6d0892e3ac623b - .quad 0x4aebcc4547e9d98c - - // 2^148 * 1 * G - - .quad 0x53175a7205d21a77 - .quad 0xb0c04422d3b934d4 - .quad 0xadd9f24bdd5deadc - .quad 0x074f46e69f10ff8c - .quad 0x0de9b204a059a445 - .quad 0xe15cb4aa4b17ad0f - .quad 0xe1bbec521f79c557 - .quad 0x2633f1b9d071081b - .quad 0xc1fb4177018b9910 - .quad 0xa6ea20dc6c0fe140 - .quad 0xd661f3e74354c6ff - .quad 0x5ecb72e6f1a3407a - - // 2^148 * 2 * G - - .quad 0xa515a31b2259fb4e - .quad 0x0960f3972bcac52f - .quad 0xedb52fec8d3454cb - .quad 0x382e2720c476c019 - .quad 0xfeeae106e8e86997 - .quad 0x9863337f98d09383 - .quad 0x9470480eaa06ebef - .quad 0x038b6898d4c5c2d0 - .quad 0xf391c51d8ace50a6 - .quad 0x3142d0b9ae2d2948 - .quad 0xdb4d5a1a7f24ca80 - .quad 0x21aeba8b59250ea8 - - // 2^148 * 3 * G - - .quad 0x24f13b34cf405530 - .quad 0x3c44ea4a43088af7 - .quad 0x5dd5c5170006a482 - .quad 0x118eb8f8890b086d - .quad 0x53853600f0087f23 - .quad 0x4c461879da7d5784 - .quad 0x6af303deb41f6860 - .quad 0x0a3c16c5c27c18ed - .quad 0x17e49c17cc947f3d - .quad 0xccc6eda6aac1d27b - .quad 0xdf6092ceb0f08e56 - .quad 0x4909b3e22c67c36b - - // 2^148 * 4 * G - - .quad 0x9c9c85ea63fe2e89 - .quad 0xbe1baf910e9412ec - .quad 0x8f7baa8a86fbfe7b - .quad 0x0fb17f9fef968b6c - .quad 0x59a16676706ff64e - .quad 0x10b953dd0d86a53d - .quad 0x5848e1e6ce5c0b96 - .quad 0x2d8b78e712780c68 - .quad 0x79d5c62eafc3902b - .quad 0x773a215289e80728 - .quad 0xc38ae640e10120b9 - .quad 0x09ae23717b2b1a6d - - // 2^148 * 5 * G - - .quad 0xbb6a192a4e4d083c - .quad 0x34ace0630029e192 - .quad 0x98245a59aafabaeb - .quad 0x6d9c8a9ada97faac - .quad 0x10ab8fa1ad32b1d0 - .quad 0xe9aced1be2778b24 - .quad 0xa8856bc0373de90f - .quad 0x66f35ddddda53996 - .quad 0xd27d9afb24997323 - .quad 0x1bb7e07ef6f01d2e - .quad 0x2ba7472df52ecc7f - .quad 0x03019b4f646f9dc8 - - // 2^148 * 6 * G - - .quad 0x04a186b5565345cd - .quad 0xeee76610bcc4116a - .quad 0x689c73b478fb2a45 - .quad 0x387dcbff65697512 - .quad 0xaf09b214e6b3dc6b - .quad 0x3f7573b5ad7d2f65 - .quad 0xd019d988100a23b0 - .quad 0x392b63a58b5c35f7 - .quad 0x4093addc9c07c205 - .quad 0xc565be15f532c37e - .quad 0x63dbecfd1583402a - .quad 0x61722b4aef2e032e - - // 2^148 * 7 * G - - .quad 0x0012aafeecbd47af - .quad 0x55a266fb1cd46309 - .quad 0xf203eb680967c72c - .quad 0x39633944ca3c1429 - .quad 0xd6b07a5581cb0e3c - .quad 0x290ff006d9444969 - .quad 0x08680b6a16dcda1f - .quad 0x5568d2b75a06de59 - .quad 0x8d0cb88c1b37cfe1 - .quad 0x05b6a5a3053818f3 - .quad 0xf2e9bc04b787d959 - .quad 0x6beba1249add7f64 - - // 2^148 * 8 * G - - .quad 0x1d06005ca5b1b143 - .quad 0x6d4c6bb87fd1cda2 - .quad 0x6ef5967653fcffe7 - .quad 0x097c29e8c1ce1ea5 - .quad 0x5c3cecb943f5a53b - .quad 0x9cc9a61d06c08df2 - .quad 0xcfba639a85895447 - .quad 0x5a845ae80df09fd5 - .quad 0x4ce97dbe5deb94ca - .quad 0x38d0a4388c709c48 - .quad 0xc43eced4a169d097 - .quad 0x0a1249fff7e587c3 - - // 2^152 * 1 * G - - .quad 0x12f0071b276d01c9 - .quad 0xe7b8bac586c48c70 - .quad 0x5308129b71d6fba9 - .quad 0x5d88fbf95a3db792 - .quad 0x0b408d9e7354b610 - .quad 0x806b32535ba85b6e - .quad 0xdbe63a034a58a207 - .quad 0x173bd9ddc9a1df2c - .quad 0x2b500f1efe5872df - .quad 0x58d6582ed43918c1 - .quad 0xe6ed278ec9673ae0 - .quad 0x06e1cd13b19ea319 - - // 2^152 * 2 * G - - .quad 0x40d0ad516f166f23 - .quad 0x118e32931fab6abe - .quad 0x3fe35e14a04d088e - .quad 0x3080603526e16266 - .quad 0x472baf629e5b0353 - .quad 0x3baa0b90278d0447 - .quad 0x0c785f469643bf27 - .quad 0x7f3a6a1a8d837b13 - .quad 0xf7e644395d3d800b - .quad 0x95a8d555c901edf6 - .quad 0x68cd7830592c6339 - .quad 0x30d0fded2e51307e - - // 2^152 * 3 * G - - .quad 0xe0594d1af21233b3 - .quad 0x1bdbe78ef0cc4d9c - .quad 0x6965187f8f499a77 - .quad 0x0a9214202c099868 - .quad 0x9cb4971e68b84750 - .quad 0xa09572296664bbcf - .quad 0x5c8de72672fa412b - .quad 0x4615084351c589d9 - .quad 0xbc9019c0aeb9a02e - .quad 0x55c7110d16034cae - .quad 0x0e6df501659932ec - .quad 0x3bca0d2895ca5dfe - - // 2^152 * 4 * G - - .quad 0x40f031bc3c5d62a4 - .quad 0x19fc8b3ecff07a60 - .quad 0x98183da2130fb545 - .quad 0x5631deddae8f13cd - .quad 0x9c688eb69ecc01bf - .quad 0xf0bc83ada644896f - .quad 0xca2d955f5f7a9fe2 - .quad 0x4ea8b4038df28241 - .quad 0x2aed460af1cad202 - .quad 0x46305305a48cee83 - .quad 0x9121774549f11a5f - .quad 0x24ce0930542ca463 - - // 2^152 * 5 * G - - .quad 0x1fe890f5fd06c106 - .quad 0xb5c468355d8810f2 - .quad 0x827808fe6e8caf3e - .quad 0x41d4e3c28a06d74b - .quad 0x3fcfa155fdf30b85 - .quad 0xd2f7168e36372ea4 - .quad 0xb2e064de6492f844 - .quad 0x549928a7324f4280 - .quad 0xf26e32a763ee1a2e - .quad 0xae91e4b7d25ffdea - .quad 0xbc3bd33bd17f4d69 - .quad 0x491b66dec0dcff6a - - // 2^152 * 6 * G - - .quad 0x98f5b13dc7ea32a7 - .quad 0xe3d5f8cc7e16db98 - .quad 0xac0abf52cbf8d947 - .quad 0x08f338d0c85ee4ac - .quad 0x75f04a8ed0da64a1 - .quad 0xed222caf67e2284b - .quad 0x8234a3791f7b7ba4 - .quad 0x4cf6b8b0b7018b67 - .quad 0xc383a821991a73bd - .quad 0xab27bc01df320c7a - .quad 0xc13d331b84777063 - .quad 0x530d4a82eb078a99 - - // 2^152 * 7 * G - - .quad 0x004c3630e1f94825 - .quad 0x7e2d78268cab535a - .quad 0xc7482323cc84ff8b - .quad 0x65ea753f101770b9 - .quad 0x6d6973456c9abf9e - .quad 0x257fb2fc4900a880 - .quad 0x2bacf412c8cfb850 - .quad 0x0db3e7e00cbfbd5b - .quad 0x3d66fc3ee2096363 - .quad 0x81d62c7f61b5cb6b - .quad 0x0fbe044213443b1a - .quad 0x02a4ec1921e1a1db - - // 2^152 * 8 * G - - .quad 0x5ce6259a3b24b8a2 - .quad 0xb8577acc45afa0b8 - .quad 0xcccbe6e88ba07037 - .quad 0x3d143c51127809bf - .quad 0xf5c86162f1cf795f - .quad 0x118c861926ee57f2 - .quad 0x172124851c063578 - .quad 0x36d12b5dec067fcf - .quad 0x126d279179154557 - .quad 0xd5e48f5cfc783a0a - .quad 0x36bdb6e8df179bac - .quad 0x2ef517885ba82859 - - // 2^156 * 1 * G - - .quad 0x88bd438cd11e0d4a - .quad 0x30cb610d43ccf308 - .quad 0xe09a0e3791937bcc - .quad 0x4559135b25b1720c - .quad 0x1ea436837c6da1e9 - .quad 0xf9c189af1fb9bdbe - .quad 0x303001fcce5dd155 - .quad 0x28a7c99ebc57be52 - .quad 0xb8fd9399e8d19e9d - .quad 0x908191cb962423ff - .quad 0xb2b948d747c742a3 - .quad 0x37f33226d7fb44c4 - - // 2^156 * 2 * G - - .quad 0x0dae8767b55f6e08 - .quad 0x4a43b3b35b203a02 - .quad 0xe3725a6e80af8c79 - .quad 0x0f7a7fd1705fa7a3 - .quad 0x33912553c821b11d - .quad 0x66ed42c241e301df - .quad 0x066fcc11104222fd - .quad 0x307a3b41c192168f - .quad 0x8eeb5d076eb55ce0 - .quad 0x2fc536bfaa0d925a - .quad 0xbe81830fdcb6c6e8 - .quad 0x556c7045827baf52 - - // 2^156 * 3 * G - - .quad 0x8e2b517302e9d8b7 - .quad 0xe3e52269248714e8 - .quad 0xbd4fbd774ca960b5 - .quad 0x6f4b4199c5ecada9 - .quad 0xb94b90022bf44406 - .quad 0xabd4237eff90b534 - .quad 0x7600a960faf86d3a - .quad 0x2f45abdac2322ee3 - .quad 0x61af4912c8ef8a6a - .quad 0xe58fa4fe43fb6e5e - .quad 0xb5afcc5d6fd427cf - .quad 0x6a5393281e1e11eb - - // 2^156 * 4 * G - - .quad 0xf3da5139a5d1ee89 - .quad 0x8145457cff936988 - .quad 0x3f622fed00e188c4 - .quad 0x0f513815db8b5a3d - .quad 0x0fff04fe149443cf - .quad 0x53cac6d9865cddd7 - .quad 0x31385b03531ed1b7 - .quad 0x5846a27cacd1039d - .quad 0x4ff5cdac1eb08717 - .quad 0x67e8b29590f2e9bc - .quad 0x44093b5e237afa99 - .quad 0x0d414bed8708b8b2 - - // 2^156 * 5 * G - - .quad 0xcfb68265fd0e75f6 - .quad 0xe45b3e28bb90e707 - .quad 0x7242a8de9ff92c7a - .quad 0x685b3201933202dd - .quad 0x81886a92294ac9e8 - .quad 0x23162b45d55547be - .quad 0x94cfbc4403715983 - .quad 0x50eb8fdb134bc401 - .quad 0xc0b73ec6d6b330cd - .quad 0x84e44807132faff1 - .quad 0x732b7352c4a5dee1 - .quad 0x5d7c7cf1aa7cd2d2 - - // 2^156 * 6 * G - - .quad 0xaf3b46bf7a4aafa2 - .quad 0xb78705ec4d40d411 - .quad 0x114f0c6aca7c15e3 - .quad 0x3f364faaa9489d4d - .quad 0x33d1013e9b73a562 - .quad 0x925cef5748ec26e1 - .quad 0xa7fce614dd468058 - .quad 0x78b0fad41e9aa438 - .quad 0xbf56a431ed05b488 - .quad 0xa533e66c9c495c7e - .quad 0xe8652baf87f3651a - .quad 0x0241800059d66c33 - - // 2^156 * 7 * G - - .quad 0xceb077fea37a5be4 - .quad 0xdb642f02e5a5eeb7 - .quad 0xc2e6d0c5471270b8 - .quad 0x4771b65538e4529c - .quad 0x28350c7dcf38ea01 - .quad 0x7c6cdbc0b2917ab6 - .quad 0xace7cfbe857082f7 - .quad 0x4d2845aba2d9a1e0 - .quad 0xbb537fe0447070de - .quad 0xcba744436dd557df - .quad 0xd3b5a3473600dbcb - .quad 0x4aeabbe6f9ffd7f8 - - // 2^156 * 8 * G - - .quad 0x4630119e40d8f78c - .quad 0xa01a9bc53c710e11 - .quad 0x486d2b258910dd79 - .quad 0x1e6c47b3db0324e5 - .quad 0x6a2134bcc4a9c8f2 - .quad 0xfbf8fd1c8ace2e37 - .quad 0x000ae3049911a0ba - .quad 0x046e3a616bc89b9e - .quad 0x14e65442f03906be - .quad 0x4a019d54e362be2a - .quad 0x68ccdfec8dc230c7 - .quad 0x7cfb7e3faf6b861c - - // 2^160 * 1 * G - - .quad 0x4637974e8c58aedc - .quad 0xb9ef22fbabf041a4 - .quad 0xe185d956e980718a - .quad 0x2f1b78fab143a8a6 - .quad 0x96eebffb305b2f51 - .quad 0xd3f938ad889596b8 - .quad 0xf0f52dc746d5dd25 - .quad 0x57968290bb3a0095 - .quad 0xf71ab8430a20e101 - .quad 0xf393658d24f0ec47 - .quad 0xcf7509a86ee2eed1 - .quad 0x7dc43e35dc2aa3e1 - - // 2^160 * 2 * G - - .quad 0x85966665887dd9c3 - .quad 0xc90f9b314bb05355 - .quad 0xc6e08df8ef2079b1 - .quad 0x7ef72016758cc12f - .quad 0x5a782a5c273e9718 - .quad 0x3576c6995e4efd94 - .quad 0x0f2ed8051f237d3e - .quad 0x044fb81d82d50a99 - .quad 0xc1df18c5a907e3d9 - .quad 0x57b3371dce4c6359 - .quad 0xca704534b201bb49 - .quad 0x7f79823f9c30dd2e - - // 2^160 * 3 * G - - .quad 0x8334d239a3b513e8 - .quad 0xc13670d4b91fa8d8 - .quad 0x12b54136f590bd33 - .quad 0x0a4e0373d784d9b4 - .quad 0x6a9c1ff068f587ba - .quad 0x0827894e0050c8de - .quad 0x3cbf99557ded5be7 - .quad 0x64a9b0431c06d6f0 - .quad 0x2eb3d6a15b7d2919 - .quad 0xb0b4f6a0d53a8235 - .quad 0x7156ce4389a45d47 - .quad 0x071a7d0ace18346c - - // 2^160 * 4 * G - - .quad 0xd3072daac887ba0b - .quad 0x01262905bfa562ee - .quad 0xcf543002c0ef768b - .quad 0x2c3bcc7146ea7e9c - .quad 0xcc0c355220e14431 - .quad 0x0d65950709b15141 - .quad 0x9af5621b209d5f36 - .quad 0x7c69bcf7617755d3 - .quad 0x07f0d7eb04e8295f - .quad 0x10db18252f50f37d - .quad 0xe951a9a3171798d7 - .quad 0x6f5a9a7322aca51d - - // 2^160 * 5 * G - - .quad 0x8ba1000c2f41c6c5 - .quad 0xc49f79c10cfefb9b - .quad 0x4efa47703cc51c9f - .quad 0x494e21a2e147afca - .quad 0xe729d4eba3d944be - .quad 0x8d9e09408078af9e - .quad 0x4525567a47869c03 - .quad 0x02ab9680ee8d3b24 - .quad 0xefa48a85dde50d9a - .quad 0x219a224e0fb9a249 - .quad 0xfa091f1dd91ef6d9 - .quad 0x6b5d76cbea46bb34 - - // 2^160 * 6 * G - - .quad 0x8857556cec0cd994 - .quad 0x6472dc6f5cd01dba - .quad 0xaf0169148f42b477 - .quad 0x0ae333f685277354 - .quad 0xe0f941171e782522 - .quad 0xf1e6ae74036936d3 - .quad 0x408b3ea2d0fcc746 - .quad 0x16fb869c03dd313e - .quad 0x288e199733b60962 - .quad 0x24fc72b4d8abe133 - .quad 0x4811f7ed0991d03e - .quad 0x3f81e38b8f70d075 - - // 2^160 * 7 * G - - .quad 0x7f910fcc7ed9affe - .quad 0x545cb8a12465874b - .quad 0xa8397ed24b0c4704 - .quad 0x50510fc104f50993 - .quad 0x0adb7f355f17c824 - .quad 0x74b923c3d74299a4 - .quad 0xd57c3e8bcbf8eaf7 - .quad 0x0ad3e2d34cdedc3d - .quad 0x6f0c0fc5336e249d - .quad 0x745ede19c331cfd9 - .quad 0xf2d6fd0009eefe1c - .quad 0x127c158bf0fa1ebe - - // 2^160 * 8 * G - - .quad 0xf6197c422e9879a2 - .quad 0xa44addd452ca3647 - .quad 0x9b413fc14b4eaccb - .quad 0x354ef87d07ef4f68 - .quad 0xdea28fc4ae51b974 - .quad 0x1d9973d3744dfe96 - .quad 0x6240680b873848a8 - .quad 0x4ed82479d167df95 - .quad 0xfee3b52260c5d975 - .quad 0x50352efceb41b0b8 - .quad 0x8808ac30a9f6653c - .quad 0x302d92d20539236d - - // 2^164 * 1 * G - - .quad 0x4c59023fcb3efb7c - .quad 0x6c2fcb99c63c2a94 - .quad 0xba4190e2c3c7e084 - .quad 0x0e545daea51874d9 - .quad 0x957b8b8b0df53c30 - .quad 0x2a1c770a8e60f098 - .quad 0xbbc7a670345796de - .quad 0x22a48f9a90c99bc9 - .quad 0x6b7dc0dc8d3fac58 - .quad 0x5497cd6ce6e42bfd - .quad 0x542f7d1bf400d305 - .quad 0x4159f47f048d9136 - - // 2^164 * 2 * G - - .quad 0x20ad660839e31e32 - .quad 0xf81e1bd58405be50 - .quad 0xf8064056f4dabc69 - .quad 0x14d23dd4ce71b975 - .quad 0x748515a8bbd24839 - .quad 0x77128347afb02b55 - .quad 0x50ba2ac649a2a17f - .quad 0x060525513ad730f1 - .quad 0xf2398e098aa27f82 - .quad 0x6d7982bb89a1b024 - .quad 0xfa694084214dd24c - .quad 0x71ab966fa32301c3 - - // 2^164 * 3 * G - - .quad 0x2dcbd8e34ded02fc - .quad 0x1151f3ec596f22aa - .quad 0xbca255434e0328da - .quad 0x35768fbe92411b22 - .quad 0xb1088a0702809955 - .quad 0x43b273ea0b43c391 - .quad 0xca9b67aefe0686ed - .quad 0x605eecbf8335f4ed - .quad 0x83200a656c340431 - .quad 0x9fcd71678ee59c2f - .quad 0x75d4613f71300f8a - .quad 0x7a912faf60f542f9 - - // 2^164 * 4 * G - - .quad 0xb204585e5edc1a43 - .quad 0x9f0e16ee5897c73c - .quad 0x5b82c0ae4e70483c - .quad 0x624a170e2bddf9be - .quad 0x253f4f8dfa2d5597 - .quad 0x25e49c405477130c - .quad 0x00c052e5996b1102 - .quad 0x33cb966e33bb6c4a - .quad 0x597028047f116909 - .quad 0x828ac41c1e564467 - .quad 0x70417dbde6217387 - .quad 0x721627aefbac4384 - - // 2^164 * 5 * G - - .quad 0x97d03bc38736add5 - .quad 0x2f1422afc532b130 - .quad 0x3aa68a057101bbc4 - .quad 0x4c946cf7e74f9fa7 - .quad 0xfd3097bc410b2f22 - .quad 0xf1a05da7b5cfa844 - .quad 0x61289a1def57ca74 - .quad 0x245ea199bb821902 - .quad 0xaedca66978d477f8 - .quad 0x1898ba3c29117fe1 - .quad 0xcf73f983720cbd58 - .quad 0x67da12e6b8b56351 - - // 2^164 * 6 * G - - .quad 0x7067e187b4bd6e07 - .quad 0x6e8f0203c7d1fe74 - .quad 0x93c6aa2f38c85a30 - .quad 0x76297d1f3d75a78a - .quad 0x2b7ef3d38ec8308c - .quad 0x828fd7ec71eb94ab - .quad 0x807c3b36c5062abd - .quad 0x0cb64cb831a94141 - .quad 0x3030fc33534c6378 - .quad 0xb9635c5ce541e861 - .quad 0x15d9a9bed9b2c728 - .quad 0x49233ea3f3775dcb - - // 2^164 * 7 * G - - .quad 0x629398fa8dbffc3a - .quad 0xe12fe52dd54db455 - .quad 0xf3be11dfdaf25295 - .quad 0x628b140dce5e7b51 - .quad 0x7b3985fe1c9f249b - .quad 0x4fd6b2d5a1233293 - .quad 0xceb345941adf4d62 - .quad 0x6987ff6f542de50c - .quad 0x47e241428f83753c - .quad 0x6317bebc866af997 - .quad 0xdabb5b433d1a9829 - .quad 0x074d8d245287fb2d - - // 2^164 * 8 * G - - .quad 0x8337d9cd440bfc31 - .quad 0x729d2ca1af318fd7 - .quad 0xa040a4a4772c2070 - .quad 0x46002ef03a7349be - .quad 0x481875c6c0e31488 - .quad 0x219429b2e22034b4 - .quad 0x7223c98a31283b65 - .quad 0x3420d60b342277f9 - .quad 0xfaa23adeaffe65f7 - .quad 0x78261ed45be0764c - .quad 0x441c0a1e2f164403 - .quad 0x5aea8e567a87d395 - - // 2^168 * 1 * G - - .quad 0x7813c1a2bca4283d - .quad 0xed62f091a1863dd9 - .quad 0xaec7bcb8c268fa86 - .quad 0x10e5d3b76f1cae4c - .quad 0x2dbc6fb6e4e0f177 - .quad 0x04e1bf29a4bd6a93 - .quad 0x5e1966d4787af6e8 - .quad 0x0edc5f5eb426d060 - .quad 0x5453bfd653da8e67 - .quad 0xe9dc1eec24a9f641 - .quad 0xbf87263b03578a23 - .quad 0x45b46c51361cba72 - - // 2^168 * 2 * G - - .quad 0xa9402abf314f7fa1 - .quad 0xe257f1dc8e8cf450 - .quad 0x1dbbd54b23a8be84 - .quad 0x2177bfa36dcb713b - .quad 0xce9d4ddd8a7fe3e4 - .quad 0xab13645676620e30 - .quad 0x4b594f7bb30e9958 - .quad 0x5c1c0aef321229df - .quad 0x37081bbcfa79db8f - .quad 0x6048811ec25f59b3 - .quad 0x087a76659c832487 - .quad 0x4ae619387d8ab5bb - - // 2^168 * 3 * G - - .quad 0x8ddbf6aa5344a32e - .quad 0x7d88eab4b41b4078 - .quad 0x5eb0eb974a130d60 - .quad 0x1a00d91b17bf3e03 - .quad 0x61117e44985bfb83 - .quad 0xfce0462a71963136 - .quad 0x83ac3448d425904b - .quad 0x75685abe5ba43d64 - .quad 0x6e960933eb61f2b2 - .quad 0x543d0fa8c9ff4952 - .quad 0xdf7275107af66569 - .quad 0x135529b623b0e6aa - - // 2^168 * 4 * G - - .quad 0x18f0dbd7add1d518 - .quad 0x979f7888cfc11f11 - .quad 0x8732e1f07114759b - .quad 0x79b5b81a65ca3a01 - .quad 0xf5c716bce22e83fe - .quad 0xb42beb19e80985c1 - .quad 0xec9da63714254aae - .quad 0x5972ea051590a613 - .quad 0x0fd4ac20dc8f7811 - .quad 0x9a9ad294ac4d4fa8 - .quad 0xc01b2d64b3360434 - .quad 0x4f7e9c95905f3bdb - - // 2^168 * 5 * G - - .quad 0x62674bbc5781302e - .quad 0xd8520f3989addc0f - .quad 0x8c2999ae53fbd9c6 - .quad 0x31993ad92e638e4c - .quad 0x71c8443d355299fe - .quad 0x8bcd3b1cdbebead7 - .quad 0x8092499ef1a49466 - .quad 0x1942eec4a144adc8 - .quad 0x7dac5319ae234992 - .quad 0x2c1b3d910cea3e92 - .quad 0x553ce494253c1122 - .quad 0x2a0a65314ef9ca75 - - // 2^168 * 6 * G - - .quad 0x2db7937ff7f927c2 - .quad 0xdb741f0617d0a635 - .quad 0x5982f3a21155af76 - .quad 0x4cf6e218647c2ded - .quad 0xcf361acd3c1c793a - .quad 0x2f9ebcac5a35bc3b - .quad 0x60e860e9a8cda6ab - .quad 0x055dc39b6dea1a13 - .quad 0xb119227cc28d5bb6 - .quad 0x07e24ebc774dffab - .quad 0xa83c78cee4a32c89 - .quad 0x121a307710aa24b6 - - // 2^168 * 7 * G - - .quad 0xe4db5d5e9f034a97 - .quad 0xe153fc093034bc2d - .quad 0x460546919551d3b1 - .quad 0x333fc76c7a40e52d - .quad 0xd659713ec77483c9 - .quad 0x88bfe077b82b96af - .quad 0x289e28231097bcd3 - .quad 0x527bb94a6ced3a9b - .quad 0x563d992a995b482e - .quad 0x3405d07c6e383801 - .quad 0x485035de2f64d8e5 - .quad 0x6b89069b20a7a9f7 - - // 2^168 * 8 * G - - .quad 0x812aa0416270220d - .quad 0x995a89faf9245b4e - .quad 0xffadc4ce5072ef05 - .quad 0x23bc2103aa73eb73 - .quad 0x4082fa8cb5c7db77 - .quad 0x068686f8c734c155 - .quad 0x29e6c8d9f6e7a57e - .quad 0x0473d308a7639bcf - .quad 0xcaee792603589e05 - .quad 0x2b4b421246dcc492 - .quad 0x02a1ef74e601a94f - .quad 0x102f73bfde04341a - - // 2^172 * 1 * G - - .quad 0xb5a2d50c7ec20d3e - .quad 0xc64bdd6ea0c97263 - .quad 0x56e89052c1ff734d - .quad 0x4929c6f72b2ffaba - .quad 0x358ecba293a36247 - .quad 0xaf8f9862b268fd65 - .quad 0x412f7e9968a01c89 - .quad 0x5786f312cd754524 - .quad 0x337788ffca14032c - .quad 0xf3921028447f1ee3 - .quad 0x8b14071f231bccad - .quad 0x4c817b4bf2344783 - - // 2^172 * 2 * G - - .quad 0x0ff853852871b96e - .quad 0xe13e9fab60c3f1bb - .quad 0xeefd595325344402 - .quad 0x0a37c37075b7744b - .quad 0x413ba057a40b4484 - .quad 0xba4c2e1a4f5f6a43 - .quad 0x614ba0a5aee1d61c - .quad 0x78a1531a8b05dc53 - .quad 0x6cbdf1703ad0562b - .quad 0x8ecf4830c92521a3 - .quad 0xdaebd303fd8424e7 - .quad 0x72ad82a42e5ec56f - - // 2^172 * 3 * G - - .quad 0x3f9e8e35bafb65f6 - .quad 0x39d69ec8f27293a1 - .quad 0x6cb8cd958cf6a3d0 - .quad 0x1734778173adae6d - .quad 0xc368939167024bc3 - .quad 0x8e69d16d49502fda - .quad 0xfcf2ec3ce45f4b29 - .quad 0x065f669ea3b4cbc4 - .quad 0x8a00aec75532db4d - .quad 0xb869a4e443e31bb1 - .quad 0x4a0f8552d3a7f515 - .quad 0x19adeb7c303d7c08 - - // 2^172 * 4 * G - - .quad 0xc720cb6153ead9a3 - .quad 0x55b2c97f512b636e - .quad 0xb1e35b5fd40290b1 - .quad 0x2fd9ccf13b530ee2 - .quad 0x9d05ba7d43c31794 - .quad 0x2470c8ff93322526 - .quad 0x8323dec816197438 - .quad 0x2852709881569b53 - .quad 0x07bd475b47f796b8 - .quad 0xd2c7b013542c8f54 - .quad 0x2dbd23f43b24f87e - .quad 0x6551afd77b0901d6 - - // 2^172 * 5 * G - - .quad 0x4546baaf54aac27f - .quad 0xf6f66fecb2a45a28 - .quad 0x582d1b5b562bcfe8 - .quad 0x44b123f3920f785f - .quad 0x68a24ce3a1d5c9ac - .quad 0xbb77a33d10ff6461 - .quad 0x0f86ce4425d3166e - .quad 0x56507c0950b9623b - .quad 0x1206f0b7d1713e63 - .quad 0x353fe3d915bafc74 - .quad 0x194ceb970ad9d94d - .quad 0x62fadd7cf9d03ad3 - - // 2^172 * 6 * G - - .quad 0xc6b5967b5598a074 - .quad 0x5efe91ce8e493e25 - .quad 0xd4b72c4549280888 - .quad 0x20ef1149a26740c2 - .quad 0x3cd7bc61e7ce4594 - .quad 0xcd6b35a9b7dd267e - .quad 0xa080abc84366ef27 - .quad 0x6ec7c46f59c79711 - .quad 0x2f07ad636f09a8a2 - .quad 0x8697e6ce24205e7d - .quad 0xc0aefc05ee35a139 - .quad 0x15e80958b5f9d897 - - // 2^172 * 7 * G - - .quad 0x25a5ef7d0c3e235b - .quad 0x6c39c17fbe134ee7 - .quad 0xc774e1342dc5c327 - .quad 0x021354b892021f39 - .quad 0x4dd1ed355bb061c4 - .quad 0x42dc0cef941c0700 - .quad 0x61305dc1fd86340e - .quad 0x56b2cc930e55a443 - .quad 0x1df79da6a6bfc5a2 - .quad 0x02f3a2749fde4369 - .quad 0xb323d9f2cda390a7 - .quad 0x7be0847b8774d363 - - // 2^172 * 8 * G - - .quad 0x8c99cc5a8b3f55c3 - .quad 0x0611d7253fded2a0 - .quad 0xed2995ff36b70a36 - .quad 0x1f699a54d78a2619 - .quad 0x1466f5af5307fa11 - .quad 0x817fcc7ded6c0af2 - .quad 0x0a6de44ec3a4a3fb - .quad 0x74071475bc927d0b - .quad 0xe77292f373e7ea8a - .quad 0x296537d2cb045a31 - .quad 0x1bd0653ed3274fde - .quad 0x2f9a2c4476bd2966 - - // 2^176 * 1 * G - - .quad 0xeb18b9ab7f5745c6 - .quad 0x023a8aee5787c690 - .quad 0xb72712da2df7afa9 - .quad 0x36597d25ea5c013d - .quad 0xa2b4dae0b5511c9a - .quad 0x7ac860292bffff06 - .quad 0x981f375df5504234 - .quad 0x3f6bd725da4ea12d - .quad 0x734d8d7b106058ac - .quad 0xd940579e6fc6905f - .quad 0x6466f8f99202932d - .quad 0x7b7ecc19da60d6d0 - - // 2^176 * 2 * G - - .quad 0x78c2373c695c690d - .quad 0xdd252e660642906e - .quad 0x951d44444ae12bd2 - .quad 0x4235ad7601743956 - .quad 0x6dae4a51a77cfa9b - .quad 0x82263654e7a38650 - .quad 0x09bbffcd8f2d82db - .quad 0x03bedc661bf5caba - .quad 0x6258cb0d078975f5 - .quad 0x492942549189f298 - .quad 0xa0cab423e2e36ee4 - .quad 0x0e7ce2b0cdf066a1 - - // 2^176 * 3 * G - - .quad 0xc494643ac48c85a3 - .quad 0xfd361df43c6139ad - .quad 0x09db17dd3ae94d48 - .quad 0x666e0a5d8fb4674a - .quad 0xfea6fedfd94b70f9 - .quad 0xf130c051c1fcba2d - .quad 0x4882d47e7f2fab89 - .quad 0x615256138aeceeb5 - .quad 0x2abbf64e4870cb0d - .quad 0xcd65bcf0aa458b6b - .quad 0x9abe4eba75e8985d - .quad 0x7f0bc810d514dee4 - - // 2^176 * 4 * G - - .quad 0xb9006ba426f4136f - .quad 0x8d67369e57e03035 - .quad 0xcbc8dfd94f463c28 - .quad 0x0d1f8dbcf8eedbf5 - .quad 0x83ac9dad737213a0 - .quad 0x9ff6f8ba2ef72e98 - .quad 0x311e2edd43ec6957 - .quad 0x1d3a907ddec5ab75 - .quad 0xba1693313ed081dc - .quad 0x29329fad851b3480 - .quad 0x0128013c030321cb - .quad 0x00011b44a31bfde3 - - // 2^176 * 5 * G - - .quad 0x3fdfa06c3fc66c0c - .quad 0x5d40e38e4dd60dd2 - .quad 0x7ae38b38268e4d71 - .quad 0x3ac48d916e8357e1 - .quad 0x16561f696a0aa75c - .quad 0xc1bf725c5852bd6a - .quad 0x11a8dd7f9a7966ad - .quad 0x63d988a2d2851026 - .quad 0x00120753afbd232e - .quad 0xe92bceb8fdd8f683 - .quad 0xf81669b384e72b91 - .quad 0x33fad52b2368a066 - - // 2^176 * 6 * G - - .quad 0x540649c6c5e41e16 - .quad 0x0af86430333f7735 - .quad 0xb2acfcd2f305e746 - .quad 0x16c0f429a256dca7 - .quad 0x8d2cc8d0c422cfe8 - .quad 0x072b4f7b05a13acb - .quad 0xa3feb6e6ecf6a56f - .quad 0x3cc355ccb90a71e2 - .quad 0xe9b69443903e9131 - .quad 0xb8a494cb7a5637ce - .quad 0xc87cd1a4baba9244 - .quad 0x631eaf426bae7568 - - // 2^176 * 7 * G - - .quad 0xb3e90410da66fe9f - .quad 0x85dd4b526c16e5a6 - .quad 0xbc3d97611ef9bf83 - .quad 0x5599648b1ea919b5 - .quad 0x47d975b9a3700de8 - .quad 0x7280c5fbe2f80552 - .quad 0x53658f2732e45de1 - .quad 0x431f2c7f665f80b5 - .quad 0xd6026344858f7b19 - .quad 0x14ab352fa1ea514a - .quad 0x8900441a2090a9d7 - .quad 0x7b04715f91253b26 - - // 2^176 * 8 * G - - .quad 0x83edbd28acf6ae43 - .quad 0x86357c8b7d5c7ab4 - .quad 0xc0404769b7eb2c44 - .quad 0x59b37bf5c2f6583f - .quad 0xb376c280c4e6bac6 - .quad 0x970ed3dd6d1d9b0b - .quad 0xb09a9558450bf944 - .quad 0x48d0acfa57cde223 - .quad 0xb60f26e47dabe671 - .quad 0xf1d1a197622f3a37 - .quad 0x4208ce7ee9960394 - .quad 0x16234191336d3bdb - - // 2^180 * 1 * G - - .quad 0xf19aeac733a63aef - .quad 0x2c7fba5d4442454e - .quad 0x5da87aa04795e441 - .quad 0x413051e1a4e0b0f5 - .quad 0x852dd1fd3d578bbe - .quad 0x2b65ce72c3286108 - .quad 0x658c07f4eace2273 - .quad 0x0933f804ec38ab40 - .quad 0xa7ab69798d496476 - .quad 0x8121aadefcb5abc8 - .quad 0xa5dc12ef7b539472 - .quad 0x07fd47065e45351a - - // 2^180 * 2 * G - - .quad 0xc8583c3d258d2bcd - .quad 0x17029a4daf60b73f - .quad 0xfa0fc9d6416a3781 - .quad 0x1c1e5fba38b3fb23 - .quad 0x304211559ae8e7c3 - .quad 0xf281b229944882a5 - .quad 0x8a13ac2e378250e4 - .quad 0x014afa0954ba48f4 - .quad 0xcb3197001bb3666c - .quad 0x330060524bffecb9 - .quad 0x293711991a88233c - .quad 0x291884363d4ed364 - - // 2^180 * 3 * G - - .quad 0x033c6805dc4babfa - .quad 0x2c15bf5e5596ecc1 - .quad 0x1bc70624b59b1d3b - .quad 0x3ede9850a19f0ec5 - .quad 0xfb9d37c3bc1ab6eb - .quad 0x02be14534d57a240 - .quad 0xf4d73415f8a5e1f6 - .quad 0x5964f4300ccc8188 - .quad 0xe44a23152d096800 - .quad 0x5c08c55970866996 - .quad 0xdf2db60a46affb6e - .quad 0x579155c1f856fd89 - - // 2^180 * 4 * G - - .quad 0x96324edd12e0c9ef - .quad 0x468b878df2420297 - .quad 0x199a3776a4f573be - .quad 0x1e7fbcf18e91e92a - .quad 0xb5f16b630817e7a6 - .quad 0x808c69233c351026 - .quad 0x324a983b54cef201 - .quad 0x53c092084a485345 - .quad 0xd2d41481f1cbafbf - .quad 0x231d2db6716174e5 - .quad 0x0b7d7656e2a55c98 - .quad 0x3e955cd82aa495f6 - - // 2^180 * 5 * G - - .quad 0xe48f535e3ed15433 - .quad 0xd075692a0d7270a3 - .quad 0x40fbd21daade6387 - .quad 0x14264887cf4495f5 - .quad 0xab39f3ef61bb3a3f - .quad 0x8eb400652eb9193e - .quad 0xb5de6ecc38c11f74 - .quad 0x654d7e9626f3c49f - .quad 0xe564cfdd5c7d2ceb - .quad 0x82eeafded737ccb9 - .quad 0x6107db62d1f9b0ab - .quad 0x0b6baac3b4358dbb - - // 2^180 * 6 * G - - .quad 0x7ae62bcb8622fe98 - .quad 0x47762256ceb891af - .quad 0x1a5a92bcf2e406b4 - .quad 0x7d29401784e41501 - .quad 0x204abad63700a93b - .quad 0xbe0023d3da779373 - .quad 0xd85f0346633ab709 - .quad 0x00496dc490820412 - .quad 0x1c74b88dc27e6360 - .quad 0x074854268d14850c - .quad 0xa145fb7b3e0dcb30 - .quad 0x10843f1b43803b23 - - // 2^180 * 7 * G - - .quad 0xc5f90455376276dd - .quad 0xce59158dd7645cd9 - .quad 0x92f65d511d366b39 - .quad 0x11574b6e526996c4 - .quad 0xd56f672de324689b - .quad 0xd1da8aedb394a981 - .quad 0xdd7b58fe9168cfed - .quad 0x7ce246cd4d56c1e8 - .quad 0xb8f4308e7f80be53 - .quad 0x5f3cb8cb34a9d397 - .quad 0x18a961bd33cc2b2c - .quad 0x710045fb3a9af671 - - // 2^180 * 8 * G - - .quad 0x73f93d36101b95eb - .quad 0xfaef33794f6f4486 - .quad 0x5651735f8f15e562 - .quad 0x7fa3f19058b40da1 - .quad 0xa03fc862059d699e - .quad 0x2370cfa19a619e69 - .quad 0xc4fe3b122f823deb - .quad 0x1d1b056fa7f0844e - .quad 0x1bc64631e56bf61f - .quad 0xd379ab106e5382a3 - .quad 0x4d58c57e0540168d - .quad 0x566256628442d8e4 - - // 2^184 * 1 * G - - .quad 0xb9e499def6267ff6 - .quad 0x7772ca7b742c0843 - .quad 0x23a0153fe9a4f2b1 - .quad 0x2cdfdfecd5d05006 - .quad 0xdd499cd61ff38640 - .quad 0x29cd9bc3063625a0 - .quad 0x51e2d8023dd73dc3 - .quad 0x4a25707a203b9231 - .quad 0x2ab7668a53f6ed6a - .quad 0x304242581dd170a1 - .quad 0x4000144c3ae20161 - .quad 0x5721896d248e49fc - - // 2^184 * 2 * G - - .quad 0x0b6e5517fd181bae - .quad 0x9022629f2bb963b4 - .quad 0x5509bce932064625 - .quad 0x578edd74f63c13da - .quad 0x285d5091a1d0da4e - .quad 0x4baa6fa7b5fe3e08 - .quad 0x63e5177ce19393b3 - .quad 0x03c935afc4b030fd - .quad 0x997276c6492b0c3d - .quad 0x47ccc2c4dfe205fc - .quad 0xdcd29b84dd623a3c - .quad 0x3ec2ab590288c7a2 - - // 2^184 * 3 * G - - .quad 0xa1a0d27be4d87bb9 - .quad 0xa98b4deb61391aed - .quad 0x99a0ddd073cb9b83 - .quad 0x2dd5c25a200fcace - .quad 0xa7213a09ae32d1cb - .quad 0x0f2b87df40f5c2d5 - .quad 0x0baea4c6e81eab29 - .quad 0x0e1bf66c6adbac5e - .quad 0xe2abd5e9792c887e - .quad 0x1a020018cb926d5d - .quad 0xbfba69cdbaae5f1e - .quad 0x730548b35ae88f5f - - // 2^184 * 4 * G - - .quad 0xc43551a3cba8b8ee - .quad 0x65a26f1db2115f16 - .quad 0x760f4f52ab8c3850 - .quad 0x3043443b411db8ca - .quad 0x805b094ba1d6e334 - .quad 0xbf3ef17709353f19 - .quad 0x423f06cb0622702b - .quad 0x585a2277d87845dd - .quad 0xa18a5f8233d48962 - .quad 0x6698c4b5ec78257f - .quad 0xa78e6fa5373e41ff - .quad 0x7656278950ef981f - - // 2^184 * 5 * G - - .quad 0x38c3cf59d51fc8c0 - .quad 0x9bedd2fd0506b6f2 - .quad 0x26bf109fab570e8f - .quad 0x3f4160a8c1b846a6 - .quad 0xe17073a3ea86cf9d - .quad 0x3a8cfbb707155fdc - .quad 0x4853e7fc31838a8e - .quad 0x28bbf484b613f616 - .quad 0xf2612f5c6f136c7c - .quad 0xafead107f6dd11be - .quad 0x527e9ad213de6f33 - .quad 0x1e79cb358188f75d - - // 2^184 * 6 * G - - .quad 0x013436c3eef7e3f1 - .quad 0x828b6a7ffe9e10f8 - .quad 0x7ff908e5bcf9defc - .quad 0x65d7951b3a3b3831 - .quad 0x77e953d8f5e08181 - .quad 0x84a50c44299dded9 - .quad 0xdc6c2d0c864525e5 - .quad 0x478ab52d39d1f2f4 - .quad 0x66a6a4d39252d159 - .quad 0xe5dde1bc871ac807 - .quad 0xb82c6b40a6c1c96f - .quad 0x16d87a411a212214 - - // 2^184 * 7 * G - - .quad 0xb3bd7e5a42066215 - .quad 0x879be3cd0c5a24c1 - .quad 0x57c05db1d6f994b7 - .quad 0x28f87c8165f38ca6 - .quad 0xfba4d5e2d54e0583 - .quad 0xe21fafd72ebd99fa - .quad 0x497ac2736ee9778f - .quad 0x1f990b577a5a6dde - .quad 0xa3344ead1be8f7d6 - .quad 0x7d1e50ebacea798f - .quad 0x77c6569e520de052 - .quad 0x45882fe1534d6d3e - - // 2^184 * 8 * G - - .quad 0x6669345d757983d6 - .quad 0x62b6ed1117aa11a6 - .quad 0x7ddd1857985e128f - .quad 0x688fe5b8f626f6dd - .quad 0xd8ac9929943c6fe4 - .quad 0xb5f9f161a38392a2 - .quad 0x2699db13bec89af3 - .quad 0x7dcf843ce405f074 - .quad 0x6c90d6484a4732c0 - .quad 0xd52143fdca563299 - .quad 0xb3be28c3915dc6e1 - .quad 0x6739687e7327191b - - // 2^188 * 1 * G - - .quad 0x9f65c5ea200814cf - .quad 0x840536e169a31740 - .quad 0x8b0ed13925c8b4ad - .quad 0x0080dbafe936361d - .quad 0x8ce5aad0c9cb971f - .quad 0x1156aaa99fd54a29 - .quad 0x41f7247015af9b78 - .quad 0x1fe8cca8420f49aa - .quad 0x72a1848f3c0cc82a - .quad 0x38c560c2877c9e54 - .quad 0x5004e228ce554140 - .quad 0x042418a103429d71 - - // 2^188 * 2 * G - - .quad 0x899dea51abf3ff5f - .quad 0x9b93a8672fc2d8ba - .quad 0x2c38cb97be6ebd5c - .quad 0x114d578497263b5d - .quad 0x58e84c6f20816247 - .quad 0x8db2b2b6e36fd793 - .quad 0x977182561d484d85 - .quad 0x0822024f8632abd7 - .quad 0xb301bb7c6b1beca3 - .quad 0x55393f6dc6eb1375 - .quad 0x910d281097b6e4eb - .quad 0x1ad4548d9d479ea3 - - // 2^188 * 3 * G - - .quad 0xcd5a7da0389a48fd - .quad 0xb38fa4aa9a78371e - .quad 0xc6d9761b2cdb8e6c - .quad 0x35cf51dbc97e1443 - .quad 0xa06fe66d0fe9fed3 - .quad 0xa8733a401c587909 - .quad 0x30d14d800df98953 - .quad 0x41ce5876c7b30258 - .quad 0x59ac3bc5d670c022 - .quad 0xeae67c109b119406 - .quad 0x9798bdf0b3782fda - .quad 0x651e3201fd074092 - - // 2^188 * 4 * G - - .quad 0xd63d8483ef30c5cf - .quad 0x4cd4b4962361cc0c - .quad 0xee90e500a48426ac - .quad 0x0af51d7d18c14eeb - .quad 0xa57ba4a01efcae9e - .quad 0x769f4beedc308a94 - .quad 0xd1f10eeb3603cb2e - .quad 0x4099ce5e7e441278 - .quad 0x1ac98e4f8a5121e9 - .quad 0x7dae9544dbfa2fe0 - .quad 0x8320aa0dd6430df9 - .quad 0x667282652c4a2fb5 - - // 2^188 * 5 * G - - .quad 0x874621f4d86bc9ab - .quad 0xb54c7bbe56fe6fea - .quad 0x077a24257fadc22c - .quad 0x1ab53be419b90d39 - .quad 0xada8b6e02946db23 - .quad 0x1c0ce51a7b253ab7 - .quad 0x8448c85a66dd485b - .quad 0x7f1fc025d0675adf - .quad 0xd8ee1b18319ea6aa - .quad 0x004d88083a21f0da - .quad 0x3bd6aa1d883a4f4b - .quad 0x4db9a3a6dfd9fd14 - - // 2^188 * 6 * G - - .quad 0x8ce7b23bb99c0755 - .quad 0x35c5d6edc4f50f7a - .quad 0x7e1e2ed2ed9b50c3 - .quad 0x36305f16e8934da1 - .quad 0xd95b00bbcbb77c68 - .quad 0xddbc846a91f17849 - .quad 0x7cf700aebe28d9b3 - .quad 0x5ce1285c85d31f3e - .quad 0x31b6972d98b0bde8 - .quad 0x7d920706aca6de5b - .quad 0xe67310f8908a659f - .quad 0x50fac2a6efdf0235 - - // 2^188 * 7 * G - - .quad 0xf3d3a9f35b880f5a - .quad 0xedec050cdb03e7c2 - .quad 0xa896981ff9f0b1a2 - .quad 0x49a4ae2bac5e34a4 - .quad 0x295b1c86f6f449bc - .quad 0x51b2e84a1f0ab4dd - .quad 0xc001cb30aa8e551d - .quad 0x6a28d35944f43662 - .quad 0x28bb12ee04a740e0 - .quad 0x14313bbd9bce8174 - .quad 0x72f5b5e4e8c10c40 - .quad 0x7cbfb19936adcd5b - - // 2^188 * 8 * G - - .quad 0xa311ddc26b89792d - .quad 0x1b30b4c6da512664 - .quad 0x0ca77b4ccf150859 - .quad 0x1de443df1b009408 - .quad 0x8e793a7acc36e6e0 - .quad 0xf9fab7a37d586eed - .quad 0x3a4f9692bae1f4e4 - .quad 0x1c14b03eff5f447e - .quad 0x19647bd114a85291 - .quad 0x57b76cb21034d3af - .quad 0x6329db440f9d6dfa - .quad 0x5ef43e586a571493 - - // 2^192 * 1 * G - - .quad 0xef782014385675a6 - .quad 0xa2649f30aafda9e8 - .quad 0x4cd1eb505cdfa8cb - .quad 0x46115aba1d4dc0b3 - .quad 0xa66dcc9dc80c1ac0 - .quad 0x97a05cf41b38a436 - .quad 0xa7ebf3be95dbd7c6 - .quad 0x7da0b8f68d7e7dab - .quad 0xd40f1953c3b5da76 - .quad 0x1dac6f7321119e9b - .quad 0x03cc6021feb25960 - .quad 0x5a5f887e83674b4b - - // 2^192 * 2 * G - - .quad 0x8f6301cf70a13d11 - .quad 0xcfceb815350dd0c4 - .quad 0xf70297d4a4bca47e - .quad 0x3669b656e44d1434 - .quad 0x9e9628d3a0a643b9 - .quad 0xb5c3cb00e6c32064 - .quad 0x9b5302897c2dec32 - .quad 0x43e37ae2d5d1c70c - .quad 0x387e3f06eda6e133 - .quad 0x67301d5199a13ac0 - .quad 0xbd5ad8f836263811 - .quad 0x6a21e6cd4fd5e9be - - // 2^192 * 3 * G - - .quad 0xf1c6170a3046e65f - .quad 0x58712a2a00d23524 - .quad 0x69dbbd3c8c82b755 - .quad 0x586bf9f1a195ff57 - .quad 0xef4129126699b2e3 - .quad 0x71d30847708d1301 - .quad 0x325432d01182b0bd - .quad 0x45371b07001e8b36 - .quad 0xa6db088d5ef8790b - .quad 0x5278f0dc610937e5 - .quad 0xac0349d261a16eb8 - .quad 0x0eafb03790e52179 - - // 2^192 * 4 * G - - .quad 0x960555c13748042f - .quad 0x219a41e6820baa11 - .quad 0x1c81f73873486d0c - .quad 0x309acc675a02c661 - .quad 0x5140805e0f75ae1d - .quad 0xec02fbe32662cc30 - .quad 0x2cebdf1eea92396d - .quad 0x44ae3344c5435bb3 - .quad 0x9cf289b9bba543ee - .quad 0xf3760e9d5ac97142 - .quad 0x1d82e5c64f9360aa - .quad 0x62d5221b7f94678f - - // 2^192 * 5 * G - - .quad 0x524c299c18d0936d - .quad 0xc86bb56c8a0c1a0c - .quad 0xa375052edb4a8631 - .quad 0x5c0efde4bc754562 - .quad 0x7585d4263af77a3c - .quad 0xdfae7b11fee9144d - .quad 0xa506708059f7193d - .quad 0x14f29a5383922037 - .quad 0xdf717edc25b2d7f5 - .quad 0x21f970db99b53040 - .quad 0xda9234b7c3ed4c62 - .quad 0x5e72365c7bee093e - - // 2^192 * 6 * G - - .quad 0x575bfc074571217f - .quad 0x3779675d0694d95b - .quad 0x9a0a37bbf4191e33 - .quad 0x77f1104c47b4eabc - .quad 0x7d9339062f08b33e - .quad 0x5b9659e5df9f32be - .quad 0xacff3dad1f9ebdfd - .quad 0x70b20555cb7349b7 - .quad 0xbe5113c555112c4c - .quad 0x6688423a9a881fcd - .quad 0x446677855e503b47 - .quad 0x0e34398f4a06404a - - // 2^192 * 7 * G - - .quad 0xb67d22d93ecebde8 - .quad 0x09b3e84127822f07 - .quad 0x743fa61fb05b6d8d - .quad 0x5e5405368a362372 - .quad 0x18930b093e4b1928 - .quad 0x7de3e10e73f3f640 - .quad 0xf43217da73395d6f - .quad 0x6f8aded6ca379c3e - .quad 0xe340123dfdb7b29a - .quad 0x487b97e1a21ab291 - .quad 0xf9967d02fde6949e - .quad 0x780de72ec8d3de97 - - // 2^192 * 8 * G - - .quad 0x0ae28545089ae7bc - .quad 0x388ddecf1c7f4d06 - .quad 0x38ac15510a4811b8 - .quad 0x0eb28bf671928ce4 - .quad 0x671feaf300f42772 - .quad 0x8f72eb2a2a8c41aa - .quad 0x29a17fd797373292 - .quad 0x1defc6ad32b587a6 - .quad 0xaf5bbe1aef5195a7 - .quad 0x148c1277917b15ed - .quad 0x2991f7fb7ae5da2e - .quad 0x467d201bf8dd2867 - - // 2^196 * 1 * G - - .quad 0x7906ee72f7bd2e6b - .quad 0x05d270d6109abf4e - .quad 0x8d5cfe45b941a8a4 - .quad 0x44c218671c974287 - .quad 0x745f9d56296bc318 - .quad 0x993580d4d8152e65 - .quad 0xb0e5b13f5839e9ce - .quad 0x51fc2b28d43921c0 - .quad 0x1b8fd11795e2a98c - .quad 0x1c4e5ee12b6b6291 - .quad 0x5b30e7107424b572 - .quad 0x6e6b9de84c4f4ac6 - - // 2^196 * 2 * G - - .quad 0xdff25fce4b1de151 - .quad 0xd841c0c7e11c4025 - .quad 0x2554b3c854749c87 - .quad 0x2d292459908e0df9 - .quad 0x6b7c5f10f80cb088 - .quad 0x736b54dc56e42151 - .quad 0xc2b620a5c6ef99c4 - .quad 0x5f4c802cc3a06f42 - .quad 0x9b65c8f17d0752da - .quad 0x881ce338c77ee800 - .quad 0xc3b514f05b62f9e3 - .quad 0x66ed5dd5bec10d48 - - // 2^196 * 3 * G - - .quad 0x7d38a1c20bb2089d - .quad 0x808334e196ccd412 - .quad 0xc4a70b8c6c97d313 - .quad 0x2eacf8bc03007f20 - .quad 0xf0adf3c9cbca047d - .quad 0x81c3b2cbf4552f6b - .quad 0xcfda112d44735f93 - .quad 0x1f23a0c77e20048c - .quad 0xf235467be5bc1570 - .quad 0x03d2d9020dbab38c - .quad 0x27529aa2fcf9e09e - .quad 0x0840bef29d34bc50 - - // 2^196 * 4 * G - - .quad 0x796dfb35dc10b287 - .quad 0x27176bcd5c7ff29d - .quad 0x7f3d43e8c7b24905 - .quad 0x0304f5a191c54276 - .quad 0xcd54e06b7f37e4eb - .quad 0x8cc15f87f5e96cca - .quad 0xb8248bb0d3597dce - .quad 0x246affa06074400c - .quad 0x37d88e68fbe45321 - .quad 0x86097548c0d75032 - .quad 0x4e9b13ef894a0d35 - .quad 0x25a83cac5753d325 - - // 2^196 * 5 * G - - .quad 0x10222f48eed8165e - .quad 0x623fc1234b8bcf3a - .quad 0x1e145c09c221e8f0 - .quad 0x7ccfa59fca782630 - .quad 0x9f0f66293952b6e2 - .quad 0x33db5e0e0934267b - .quad 0xff45252bd609fedc - .quad 0x06be10f5c506e0c9 - .quad 0x1a9615a9b62a345f - .quad 0x22050c564a52fecc - .quad 0xa7a2788528bc0dfe - .quad 0x5e82770a1a1ee71d - - // 2^196 * 6 * G - - .quad 0x35425183ad896a5c - .quad 0xe8673afbe78d52f6 - .quad 0x2c66f25f92a35f64 - .quad 0x09d04f3b3b86b102 - .quad 0xe802e80a42339c74 - .quad 0x34175166a7fffae5 - .quad 0x34865d1f1c408cae - .quad 0x2cca982c605bc5ee - .quad 0xfd2d5d35197dbe6e - .quad 0x207c2eea8be4ffa3 - .quad 0x2613d8db325ae918 - .quad 0x7a325d1727741d3e - - // 2^196 * 7 * G - - .quad 0xd036b9bbd16dfde2 - .quad 0xa2055757c497a829 - .quad 0x8e6cc966a7f12667 - .quad 0x4d3b1a791239c180 - .quad 0xecd27d017e2a076a - .quad 0xd788689f1636495e - .quad 0x52a61af0919233e5 - .quad 0x2a479df17bb1ae64 - .quad 0x9e5eee8e33db2710 - .quad 0x189854ded6c43ca5 - .quad 0xa41c22c592718138 - .quad 0x27ad5538a43a5e9b - - // 2^196 * 8 * G - - .quad 0x2746dd4b15350d61 - .quad 0xd03fcbc8ee9521b7 - .quad 0xe86e365a138672ca - .quad 0x510e987f7e7d89e2 - .quad 0xcb5a7d638e47077c - .quad 0x8db7536120a1c059 - .quad 0x549e1e4d8bedfdcc - .quad 0x080153b7503b179d - .quad 0xdda69d930a3ed3e3 - .quad 0x3d386ef1cd60a722 - .quad 0xc817ad58bdaa4ee6 - .quad 0x23be8d554fe7372a - - // 2^200 * 1 * G - - .quad 0x95fe919a74ef4fad - .quad 0x3a827becf6a308a2 - .quad 0x964e01d309a47b01 - .quad 0x71c43c4f5ba3c797 - .quad 0xbc1ef4bd567ae7a9 - .quad 0x3f624cb2d64498bd - .quad 0xe41064d22c1f4ec8 - .quad 0x2ef9c5a5ba384001 - .quad 0xb6fd6df6fa9e74cd - .quad 0xf18278bce4af267a - .quad 0x8255b3d0f1ef990e - .quad 0x5a758ca390c5f293 - - // 2^200 * 2 * G - - .quad 0xa2b72710d9462495 - .quad 0x3aa8c6d2d57d5003 - .quad 0xe3d400bfa0b487ca - .quad 0x2dbae244b3eb72ec - .quad 0x8ce0918b1d61dc94 - .quad 0x8ded36469a813066 - .quad 0xd4e6a829afe8aad3 - .quad 0x0a738027f639d43f - .quad 0x980f4a2f57ffe1cc - .quad 0x00670d0de1839843 - .quad 0x105c3f4a49fb15fd - .quad 0x2698ca635126a69c - - // 2^200 * 3 * G - - .quad 0xe765318832b0ba78 - .quad 0x381831f7925cff8b - .quad 0x08a81b91a0291fcc - .quad 0x1fb43dcc49caeb07 - .quad 0x2e3d702f5e3dd90e - .quad 0x9e3f0918e4d25386 - .quad 0x5e773ef6024da96a - .quad 0x3c004b0c4afa3332 - .quad 0x9aa946ac06f4b82b - .quad 0x1ca284a5a806c4f3 - .quad 0x3ed3265fc6cd4787 - .quad 0x6b43fd01cd1fd217 - - // 2^200 * 4 * G - - .quad 0xc7a75d4b4697c544 - .quad 0x15fdf848df0fffbf - .quad 0x2868b9ebaa46785a - .quad 0x5a68d7105b52f714 - .quad 0xb5c742583e760ef3 - .quad 0x75dc52b9ee0ab990 - .quad 0xbf1427c2072b923f - .quad 0x73420b2d6ff0d9f0 - .quad 0xaf2cf6cb9e851e06 - .quad 0x8f593913c62238c4 - .quad 0xda8ab89699fbf373 - .quad 0x3db5632fea34bc9e - - // 2^200 * 5 * G - - .quad 0xf46eee2bf75dd9d8 - .quad 0x0d17b1f6396759a5 - .quad 0x1bf2d131499e7273 - .quad 0x04321adf49d75f13 - .quad 0x2e4990b1829825d5 - .quad 0xedeaeb873e9a8991 - .quad 0xeef03d394c704af8 - .quad 0x59197ea495df2b0e - .quad 0x04e16019e4e55aae - .quad 0xe77b437a7e2f92e9 - .quad 0xc7ce2dc16f159aa4 - .quad 0x45eafdc1f4d70cc0 - - // 2^200 * 6 * G - - .quad 0x698401858045d72b - .quad 0x4c22faa2cf2f0651 - .quad 0x941a36656b222dc6 - .quad 0x5a5eebc80362dade - .quad 0xb60e4624cfccb1ed - .quad 0x59dbc292bd5c0395 - .quad 0x31a09d1ddc0481c9 - .quad 0x3f73ceea5d56d940 - .quad 0xb7a7bfd10a4e8dc6 - .quad 0xbe57007e44c9b339 - .quad 0x60c1207f1557aefa - .quad 0x26058891266218db - - // 2^200 * 7 * G - - .quad 0x59f704a68360ff04 - .quad 0xc3d93fde7661e6f4 - .quad 0x831b2a7312873551 - .quad 0x54ad0c2e4e615d57 - .quad 0x4c818e3cc676e542 - .quad 0x5e422c9303ceccad - .quad 0xec07cccab4129f08 - .quad 0x0dedfa10b24443b8 - .quad 0xee3b67d5b82b522a - .quad 0x36f163469fa5c1eb - .quad 0xa5b4d2f26ec19fd3 - .quad 0x62ecb2baa77a9408 - - // 2^200 * 8 * G - - .quad 0xe5ed795261152b3d - .quad 0x4962357d0eddd7d1 - .quad 0x7482c8d0b96b4c71 - .quad 0x2e59f919a966d8be - .quad 0x92072836afb62874 - .quad 0x5fcd5e8579e104a5 - .quad 0x5aad01adc630a14a - .quad 0x61913d5075663f98 - .quad 0x0dc62d361a3231da - .quad 0xfa47583294200270 - .quad 0x02d801513f9594ce - .quad 0x3ddbc2a131c05d5c - - // 2^204 * 1 * G - - .quad 0x3f50a50a4ffb81ef - .quad 0xb1e035093bf420bf - .quad 0x9baa8e1cc6aa2cd0 - .quad 0x32239861fa237a40 - .quad 0xfb735ac2004a35d1 - .quad 0x31de0f433a6607c3 - .quad 0x7b8591bfc528d599 - .quad 0x55be9a25f5bb050c - .quad 0x0d005acd33db3dbf - .quad 0x0111b37c80ac35e2 - .quad 0x4892d66c6f88ebeb - .quad 0x770eadb16508fbcd - - // 2^204 * 2 * G - - .quad 0x8451f9e05e4e89dd - .quad 0xc06302ffbc793937 - .quad 0x5d22749556a6495c - .quad 0x09a6755ca05603fb - .quad 0xf1d3b681a05071b9 - .quad 0x2207659a3592ff3a - .quad 0x5f0169297881e40e - .quad 0x16bedd0e86ba374e - .quad 0x5ecccc4f2c2737b5 - .quad 0x43b79e0c2dccb703 - .quad 0x33e008bc4ec43df3 - .quad 0x06c1b840f07566c0 - - // 2^204 * 3 * G - - .quad 0x7688a5c6a388f877 - .quad 0x02a96c14deb2b6ac - .quad 0x64c9f3431b8c2af8 - .quad 0x3628435554a1eed6 - .quad 0x69ee9e7f9b02805c - .quad 0xcbff828a547d1640 - .quad 0x3d93a869b2430968 - .quad 0x46b7b8cd3fe26972 - .quad 0xe9812086fe7eebe0 - .quad 0x4cba6be72f515437 - .quad 0x1d04168b516efae9 - .quad 0x5ea1391043982cb9 - - // 2^204 * 4 * G - - .quad 0x49125c9cf4702ee1 - .quad 0x4520b71f8b25b32d - .quad 0x33193026501fef7e - .quad 0x656d8997c8d2eb2b - .quad 0x6f2b3be4d5d3b002 - .quad 0xafec33d96a09c880 - .quad 0x035f73a4a8bcc4cc - .quad 0x22c5b9284662198b - .quad 0xcb58c8fe433d8939 - .quad 0x89a0cb2e6a8d7e50 - .quad 0x79ca955309fbbe5a - .quad 0x0c626616cd7fc106 - - // 2^204 * 5 * G - - .quad 0x1ffeb80a4879b61f - .quad 0x6396726e4ada21ed - .quad 0x33c7b093368025ba - .quad 0x471aa0c6f3c31788 - .quad 0x8fdfc379fbf454b1 - .quad 0x45a5a970f1a4b771 - .quad 0xac921ef7bad35915 - .quad 0x42d088dca81c2192 - .quad 0x8fda0f37a0165199 - .quad 0x0adadb77c8a0e343 - .quad 0x20fbfdfcc875e820 - .quad 0x1cf2bea80c2206e7 - - // 2^204 * 6 * G - - .quad 0xc2ddf1deb36202ac - .quad 0x92a5fe09d2e27aa5 - .quad 0x7d1648f6fc09f1d3 - .quad 0x74c2cc0513bc4959 - .quad 0x982d6e1a02c0412f - .quad 0x90fa4c83db58e8fe - .quad 0x01c2f5bcdcb18bc0 - .quad 0x686e0c90216abc66 - .quad 0x1fadbadba54395a7 - .quad 0xb41a02a0ae0da66a - .quad 0xbf19f598bba37c07 - .quad 0x6a12b8acde48430d - - // 2^204 * 7 * G - - .quad 0xf8daea1f39d495d9 - .quad 0x592c190e525f1dfc - .quad 0xdb8cbd04c9991d1b - .quad 0x11f7fda3d88f0cb7 - .quad 0x793bdd801aaeeb5f - .quad 0x00a2a0aac1518871 - .quad 0xe8a373a31f2136b4 - .quad 0x48aab888fc91ef19 - .quad 0x041f7e925830f40e - .quad 0x002d6ca979661c06 - .quad 0x86dc9ff92b046a2e - .quad 0x760360928b0493d1 - - // 2^204 * 8 * G - - .quad 0x21bb41c6120cf9c6 - .quad 0xeab2aa12decda59b - .quad 0xc1a72d020aa48b34 - .quad 0x215d4d27e87d3b68 - .quad 0xb43108e5695a0b05 - .quad 0x6cb00ee8ad37a38b - .quad 0x5edad6eea3537381 - .quad 0x3f2602d4b6dc3224 - .quad 0xc8b247b65bcaf19c - .quad 0x49779dc3b1b2c652 - .quad 0x89a180bbd5ece2e2 - .quad 0x13f098a3cec8e039 - - // 2^208 * 1 * G - - .quad 0x9adc0ff9ce5ec54b - .quad 0x039c2a6b8c2f130d - .quad 0x028007c7f0f89515 - .quad 0x78968314ac04b36b - .quad 0xf3aa57a22796bb14 - .quad 0x883abab79b07da21 - .quad 0xe54be21831a0391c - .quad 0x5ee7fb38d83205f9 - .quad 0x538dfdcb41446a8e - .quad 0xa5acfda9434937f9 - .quad 0x46af908d263c8c78 - .quad 0x61d0633c9bca0d09 - - // 2^208 * 2 * G - - .quad 0x63744935ffdb2566 - .quad 0xc5bd6b89780b68bb - .quad 0x6f1b3280553eec03 - .quad 0x6e965fd847aed7f5 - .quad 0xada328bcf8fc73df - .quad 0xee84695da6f037fc - .quad 0x637fb4db38c2a909 - .quad 0x5b23ac2df8067bdc - .quad 0x9ad2b953ee80527b - .quad 0xe88f19aafade6d8d - .quad 0x0e711704150e82cf - .quad 0x79b9bbb9dd95dedc - - // 2^208 * 3 * G - - .quad 0xebb355406a3126c2 - .quad 0xd26383a868c8c393 - .quad 0x6c0c6429e5b97a82 - .quad 0x5065f158c9fd2147 - .quad 0xd1997dae8e9f7374 - .quad 0xa032a2f8cfbb0816 - .quad 0xcd6cba126d445f0a - .quad 0x1ba811460accb834 - .quad 0x708169fb0c429954 - .quad 0xe14600acd76ecf67 - .quad 0x2eaab98a70e645ba - .quad 0x3981f39e58a4faf2 - - // 2^208 * 4 * G - - .quad 0x18fb8a7559230a93 - .quad 0x1d168f6960e6f45d - .quad 0x3a85a94514a93cb5 - .quad 0x38dc083705acd0fd - .quad 0xc845dfa56de66fde - .quad 0xe152a5002c40483a - .quad 0xe9d2e163c7b4f632 - .quad 0x30f4452edcbc1b65 - .quad 0x856d2782c5759740 - .quad 0xfa134569f99cbecc - .quad 0x8844fc73c0ea4e71 - .quad 0x632d9a1a593f2469 - - // 2^208 * 5 * G - - .quad 0xf6bb6b15b807cba6 - .quad 0x1823c7dfbc54f0d7 - .quad 0xbb1d97036e29670b - .quad 0x0b24f48847ed4a57 - .quad 0xbf09fd11ed0c84a7 - .quad 0x63f071810d9f693a - .quad 0x21908c2d57cf8779 - .quad 0x3a5a7df28af64ba2 - .quad 0xdcdad4be511beac7 - .quad 0xa4538075ed26ccf2 - .quad 0xe19cff9f005f9a65 - .quad 0x34fcf74475481f63 - - // 2^208 * 6 * G - - .quad 0xc197e04c789767ca - .quad 0xb8714dcb38d9467d - .quad 0x55de888283f95fa8 - .quad 0x3d3bdc164dfa63f7 - .quad 0xa5bb1dab78cfaa98 - .quad 0x5ceda267190b72f2 - .quad 0x9309c9110a92608e - .quad 0x0119a3042fb374b0 - .quad 0x67a2d89ce8c2177d - .quad 0x669da5f66895d0c1 - .quad 0xf56598e5b282a2b0 - .quad 0x56c088f1ede20a73 - - // 2^208 * 7 * G - - .quad 0x336d3d1110a86e17 - .quad 0xd7f388320b75b2fa - .quad 0xf915337625072988 - .quad 0x09674c6b99108b87 - .quad 0x581b5fac24f38f02 - .quad 0xa90be9febae30cbd - .quad 0x9a2169028acf92f0 - .quad 0x038b7ea48359038f - .quad 0x9f4ef82199316ff8 - .quad 0x2f49d282eaa78d4f - .quad 0x0971a5ab5aef3174 - .quad 0x6e5e31025969eb65 - - // 2^208 * 8 * G - - .quad 0xb16c62f587e593fb - .quad 0x4999eddeca5d3e71 - .quad 0xb491c1e014cc3e6d - .quad 0x08f5114789a8dba8 - .quad 0x3304fb0e63066222 - .quad 0xfb35068987acba3f - .quad 0xbd1924778c1061a3 - .quad 0x3058ad43d1838620 - .quad 0x323c0ffde57663d0 - .quad 0x05c3df38a22ea610 - .quad 0xbdc78abdac994f9a - .quad 0x26549fa4efe3dc99 - - // 2^212 * 1 * G - - .quad 0x738b38d787ce8f89 - .quad 0xb62658e24179a88d - .quad 0x30738c9cf151316d - .quad 0x49128c7f727275c9 - .quad 0x04dbbc17f75396b9 - .quad 0x69e6a2d7d2f86746 - .quad 0xc6409d99f53eabc6 - .quad 0x606175f6332e25d2 - .quad 0x4021370ef540e7dd - .quad 0x0910d6f5a1f1d0a5 - .quad 0x4634aacd5b06b807 - .quad 0x6a39e6356944f235 - - // 2^212 * 2 * G - - .quad 0x96cd5640df90f3e7 - .quad 0x6c3a760edbfa25ea - .quad 0x24f3ef0959e33cc4 - .quad 0x42889e7e530d2e58 - .quad 0x1da1965774049e9d - .quad 0xfbcd6ea198fe352b - .quad 0xb1cbcd50cc5236a6 - .quad 0x1f5ec83d3f9846e2 - .quad 0x8efb23c3328ccb75 - .quad 0xaf42a207dd876ee9 - .quad 0x20fbdadc5dfae796 - .quad 0x241e246b06bf9f51 - - // 2^212 * 3 * G - - .quad 0x29e68e57ad6e98f6 - .quad 0x4c9260c80b462065 - .quad 0x3f00862ea51ebb4b - .quad 0x5bc2c77fb38d9097 - .quad 0x7eaafc9a6280bbb8 - .quad 0x22a70f12f403d809 - .quad 0x31ce40bb1bfc8d20 - .quad 0x2bc65635e8bd53ee - .quad 0xe8d5dc9fa96bad93 - .quad 0xe58fb17dde1947dc - .quad 0x681532ea65185fa3 - .quad 0x1fdd6c3b034a7830 - - // 2^212 * 4 * G - - .quad 0x0a64e28c55dc18fe - .quad 0xe3df9e993399ebdd - .quad 0x79ac432370e2e652 - .quad 0x35ff7fc33ae4cc0e - .quad 0x9c13a6a52dd8f7a9 - .quad 0x2dbb1f8c3efdcabf - .quad 0x961e32405e08f7b5 - .quad 0x48c8a121bbe6c9e5 - .quad 0xfc415a7c59646445 - .quad 0xd224b2d7c128b615 - .quad 0x6035c9c905fbb912 - .quad 0x42d7a91274429fab - - // 2^212 * 5 * G - - .quad 0x4e6213e3eaf72ed3 - .quad 0x6794981a43acd4e7 - .quad 0xff547cde6eb508cb - .quad 0x6fed19dd10fcb532 - .quad 0xa9a48947933da5bc - .quad 0x4a58920ec2e979ec - .quad 0x96d8800013e5ac4c - .quad 0x453692d74b48b147 - .quad 0xdd775d99a8559c6f - .quad 0xf42a2140df003e24 - .quad 0x5223e229da928a66 - .quad 0x063f46ba6d38f22c - - // 2^212 * 6 * G - - .quad 0xd2d242895f536694 - .quad 0xca33a2c542939b2c - .quad 0x986fada6c7ddb95c - .quad 0x5a152c042f712d5d - .quad 0x39843cb737346921 - .quad 0xa747fb0738c89447 - .quad 0xcb8d8031a245307e - .quad 0x67810f8e6d82f068 - .quad 0x3eeb8fbcd2287db4 - .quad 0x72c7d3a301a03e93 - .quad 0x5473e88cbd98265a - .quad 0x7324aa515921b403 - - // 2^212 * 7 * G - - .quad 0x857942f46c3cbe8e - .quad 0xa1d364b14730c046 - .quad 0x1c8ed914d23c41bf - .quad 0x0838e161eef6d5d2 - .quad 0xad23f6dae82354cb - .quad 0x6962502ab6571a6d - .quad 0x9b651636e38e37d1 - .quad 0x5cac5005d1a3312f - .quad 0x8cc154cce9e39904 - .quad 0x5b3a040b84de6846 - .quad 0xc4d8a61cb1be5d6e - .quad 0x40fb897bd8861f02 - - // 2^212 * 8 * G - - .quad 0x84c5aa9062de37a1 - .quad 0x421da5000d1d96e1 - .quad 0x788286306a9242d9 - .quad 0x3c5e464a690d10da - .quad 0xe57ed8475ab10761 - .quad 0x71435e206fd13746 - .quad 0x342f824ecd025632 - .quad 0x4b16281ea8791e7b - .quad 0xd1c101d50b813381 - .quad 0xdee60f1176ee6828 - .quad 0x0cb68893383f6409 - .quad 0x6183c565f6ff484a - - // 2^216 * 1 * G - - .quad 0x741d5a461e6bf9d6 - .quad 0x2305b3fc7777a581 - .quad 0xd45574a26474d3d9 - .quad 0x1926e1dc6401e0ff - .quad 0xdb468549af3f666e - .quad 0xd77fcf04f14a0ea5 - .quad 0x3df23ff7a4ba0c47 - .quad 0x3a10dfe132ce3c85 - .quad 0xe07f4e8aea17cea0 - .quad 0x2fd515463a1fc1fd - .quad 0x175322fd31f2c0f1 - .quad 0x1fa1d01d861e5d15 - - // 2^216 * 2 * G - - .quad 0xcc8055947d599832 - .quad 0x1e4656da37f15520 - .quad 0x99f6f7744e059320 - .quad 0x773563bc6a75cf33 - .quad 0x38dcac00d1df94ab - .quad 0x2e712bddd1080de9 - .quad 0x7f13e93efdd5e262 - .quad 0x73fced18ee9a01e5 - .quad 0x06b1e90863139cb3 - .quad 0xa493da67c5a03ecd - .quad 0x8d77cec8ad638932 - .quad 0x1f426b701b864f44 - - // 2^216 * 3 * G - - .quad 0xefc9264c41911c01 - .quad 0xf1a3b7b817a22c25 - .quad 0x5875da6bf30f1447 - .quad 0x4e1af5271d31b090 - .quad 0xf17e35c891a12552 - .quad 0xb76b8153575e9c76 - .quad 0xfa83406f0d9b723e - .quad 0x0b76bb1b3fa7e438 - .quad 0x08b8c1f97f92939b - .quad 0xbe6771cbd444ab6e - .quad 0x22e5646399bb8017 - .quad 0x7b6dd61eb772a955 - - // 2^216 * 4 * G - - .quad 0xb7adc1e850f33d92 - .quad 0x7998fa4f608cd5cf - .quad 0xad962dbd8dfc5bdb - .quad 0x703e9bceaf1d2f4f - .quad 0x5730abf9ab01d2c7 - .quad 0x16fb76dc40143b18 - .quad 0x866cbe65a0cbb281 - .quad 0x53fa9b659bff6afe - .quad 0x6c14c8e994885455 - .quad 0x843a5d6665aed4e5 - .quad 0x181bb73ebcd65af1 - .quad 0x398d93e5c4c61f50 - - // 2^216 * 5 * G - - .quad 0x1c4bd16733e248f3 - .quad 0xbd9e128715bf0a5f - .quad 0xd43f8cf0a10b0376 - .quad 0x53b09b5ddf191b13 - .quad 0xc3877c60d2e7e3f2 - .quad 0x3b34aaa030828bb1 - .quad 0x283e26e7739ef138 - .quad 0x699c9c9002c30577 - .quad 0xf306a7235946f1cc - .quad 0x921718b5cce5d97d - .quad 0x28cdd24781b4e975 - .quad 0x51caf30c6fcdd907 - - // 2^216 * 6 * G - - .quad 0xa60ba7427674e00a - .quad 0x630e8570a17a7bf3 - .quad 0x3758563dcf3324cc - .quad 0x5504aa292383fdaa - .quad 0x737af99a18ac54c7 - .quad 0x903378dcc51cb30f - .quad 0x2b89bc334ce10cc7 - .quad 0x12ae29c189f8e99a - .quad 0xa99ec0cb1f0d01cf - .quad 0x0dd1efcc3a34f7ae - .quad 0x55ca7521d09c4e22 - .quad 0x5fd14fe958eba5ea - - // 2^216 * 7 * G - - .quad 0xb5dc2ddf2845ab2c - .quad 0x069491b10a7fe993 - .quad 0x4daaf3d64002e346 - .quad 0x093ff26e586474d1 - .quad 0x3c42fe5ebf93cb8e - .quad 0xbedfa85136d4565f - .quad 0xe0f0859e884220e8 - .quad 0x7dd73f960725d128 - .quad 0xb10d24fe68059829 - .quad 0x75730672dbaf23e5 - .quad 0x1367253ab457ac29 - .quad 0x2f59bcbc86b470a4 - - // 2^216 * 8 * G - - .quad 0x83847d429917135f - .quad 0xad1b911f567d03d7 - .quad 0x7e7748d9be77aad1 - .quad 0x5458b42e2e51af4a - .quad 0x7041d560b691c301 - .quad 0x85201b3fadd7e71e - .quad 0x16c2e16311335585 - .quad 0x2aa55e3d010828b1 - .quad 0xed5192e60c07444f - .quad 0x42c54e2d74421d10 - .quad 0x352b4c82fdb5c864 - .quad 0x13e9004a8a768664 - - // 2^220 * 1 * G - - .quad 0xcbb5b5556c032bff - .quad 0xdf7191b729297a3a - .quad 0xc1ff7326aded81bb - .quad 0x71ade8bb68be03f5 - .quad 0x1e6284c5806b467c - .quad 0xc5f6997be75d607b - .quad 0x8b67d958b378d262 - .quad 0x3d88d66a81cd8b70 - .quad 0x8b767a93204ed789 - .quad 0x762fcacb9fa0ae2a - .quad 0x771febcc6dce4887 - .quad 0x343062158ff05fb3 - - // 2^220 * 2 * G - - .quad 0xe05da1a7e1f5bf49 - .quad 0x26457d6dd4736092 - .quad 0x77dcb07773cc32f6 - .quad 0x0a5d94969cdd5fcd - .quad 0xfce219072a7b31b4 - .quad 0x4d7adc75aa578016 - .quad 0x0ec276a687479324 - .quad 0x6d6d9d5d1fda4beb - .quad 0x22b1a58ae9b08183 - .quad 0xfd95d071c15c388b - .quad 0xa9812376850a0517 - .quad 0x33384cbabb7f335e - - // 2^220 * 3 * G - - .quad 0x3c6fa2680ca2c7b5 - .quad 0x1b5082046fb64fda - .quad 0xeb53349c5431d6de - .quad 0x5278b38f6b879c89 - .quad 0x33bc627a26218b8d - .quad 0xea80b21fc7a80c61 - .quad 0x9458b12b173e9ee6 - .quad 0x076247be0e2f3059 - .quad 0x52e105f61416375a - .quad 0xec97af3685abeba4 - .quad 0x26e6b50623a67c36 - .quad 0x5cf0e856f3d4fb01 - - // 2^220 * 4 * G - - .quad 0xf6c968731ae8cab4 - .quad 0x5e20741ecb4f92c5 - .quad 0x2da53be58ccdbc3e - .quad 0x2dddfea269970df7 - .quad 0xbeaece313db342a8 - .quad 0xcba3635b842db7ee - .quad 0xe88c6620817f13ef - .quad 0x1b9438aa4e76d5c6 - .quad 0x8a50777e166f031a - .quad 0x067b39f10fb7a328 - .quad 0x1925c9a6010fbd76 - .quad 0x6df9b575cc740905 - - // 2^220 * 5 * G - - .quad 0x42c1192927f6bdcf - .quad 0x8f91917a403d61ca - .quad 0xdc1c5a668b9e1f61 - .quad 0x1596047804ec0f8d - .quad 0xecdfc35b48cade41 - .quad 0x6a88471fb2328270 - .quad 0x740a4a2440a01b6a - .quad 0x471e5796003b5f29 - .quad 0xda96bbb3aced37ac - .quad 0x7a2423b5e9208cea - .quad 0x24cc5c3038aebae2 - .quad 0x50c356afdc5dae2f - - // 2^220 * 6 * G - - .quad 0x09dcbf4341c30318 - .quad 0xeeba061183181dce - .quad 0xc179c0cedc1e29a1 - .quad 0x1dbf7b89073f35b0 - .quad 0xcfed9cdf1b31b964 - .quad 0xf486a9858ca51af3 - .quad 0x14897265ea8c1f84 - .quad 0x784a53dd932acc00 - .quad 0x2d99f9df14fc4920 - .quad 0x76ccb60cc4499fe5 - .quad 0xa4132cbbe5cf0003 - .quad 0x3f93d82354f000ea - - // 2^220 * 7 * G - - .quad 0x8183e7689e04ce85 - .quad 0x678fb71e04465341 - .quad 0xad92058f6688edac - .quad 0x5da350d3532b099a - .quad 0xeaac12d179e14978 - .quad 0xff923ff3bbebff5e - .quad 0x4af663e40663ce27 - .quad 0x0fd381a811a5f5ff - .quad 0xf256aceca436df54 - .quad 0x108b6168ae69d6e8 - .quad 0x20d986cb6b5d036c - .quad 0x655957b9fee2af50 - - // 2^220 * 8 * G - - .quad 0xaea8b07fa902030f - .quad 0xf88c766af463d143 - .quad 0x15b083663c787a60 - .quad 0x08eab1148267a4a8 - .quad 0xbdc1409bd002d0ac - .quad 0x66660245b5ccd9a6 - .quad 0x82317dc4fade85ec - .quad 0x02fe934b6ad7df0d - .quad 0xef5cf100cfb7ea74 - .quad 0x22897633a1cb42ac - .quad 0xd4ce0c54cef285e2 - .quad 0x30408c048a146a55 - - // 2^224 * 1 * G - - .quad 0x739d8845832fcedb - .quad 0xfa38d6c9ae6bf863 - .quad 0x32bc0dcab74ffef7 - .quad 0x73937e8814bce45e - .quad 0xbb2e00c9193b877f - .quad 0xece3a890e0dc506b - .quad 0xecf3b7c036de649f - .quad 0x5f46040898de9e1a - .quad 0xb9037116297bf48d - .quad 0xa9d13b22d4f06834 - .quad 0xe19715574696bdc6 - .quad 0x2cf8a4e891d5e835 - - // 2^224 * 2 * G - - .quad 0x6d93fd8707110f67 - .quad 0xdd4c09d37c38b549 - .quad 0x7cb16a4cc2736a86 - .quad 0x2049bd6e58252a09 - .quad 0x2cb5487e17d06ba2 - .quad 0x24d2381c3950196b - .quad 0xd7659c8185978a30 - .quad 0x7a6f7f2891d6a4f6 - .quad 0x7d09fd8d6a9aef49 - .quad 0xf0ee60be5b3db90b - .quad 0x4c21b52c519ebfd4 - .quad 0x6011aadfc545941d - - // 2^224 * 3 * G - - .quad 0x5f67926dcf95f83c - .quad 0x7c7e856171289071 - .quad 0xd6a1e7f3998f7a5b - .quad 0x6fc5cc1b0b62f9e0 - .quad 0x63ded0c802cbf890 - .quad 0xfbd098ca0dff6aaa - .quad 0x624d0afdb9b6ed99 - .quad 0x69ce18b779340b1e - .quad 0xd1ef5528b29879cb - .quad 0xdd1aae3cd47e9092 - .quad 0x127e0442189f2352 - .quad 0x15596b3ae57101f1 - - // 2^224 * 4 * G - - .quad 0x462739d23f9179a2 - .quad 0xff83123197d6ddcf - .quad 0x1307deb553f2148a - .quad 0x0d2237687b5f4dda - .quad 0x09ff31167e5124ca - .quad 0x0be4158bd9c745df - .quad 0x292b7d227ef556e5 - .quad 0x3aa4e241afb6d138 - .quad 0x2cc138bf2a3305f5 - .quad 0x48583f8fa2e926c3 - .quad 0x083ab1a25549d2eb - .quad 0x32fcaa6e4687a36c - - // 2^224 * 5 * G - - .quad 0x7bc56e8dc57d9af5 - .quad 0x3e0bd2ed9df0bdf2 - .quad 0xaac014de22efe4a3 - .quad 0x4627e9cefebd6a5c - .quad 0x3207a4732787ccdf - .quad 0x17e31908f213e3f8 - .quad 0xd5b2ecd7f60d964e - .quad 0x746f6336c2600be9 - .quad 0x3f4af345ab6c971c - .quad 0xe288eb729943731f - .quad 0x33596a8a0344186d - .quad 0x7b4917007ed66293 - - // 2^224 * 6 * G - - .quad 0x2d85fb5cab84b064 - .quad 0x497810d289f3bc14 - .quad 0x476adc447b15ce0c - .quad 0x122ba376f844fd7b - .quad 0x54341b28dd53a2dd - .quad 0xaa17905bdf42fc3f - .quad 0x0ff592d94dd2f8f4 - .quad 0x1d03620fe08cd37d - .quad 0xc20232cda2b4e554 - .quad 0x9ed0fd42115d187f - .quad 0x2eabb4be7dd479d9 - .quad 0x02c70bf52b68ec4c - - // 2^224 * 7 * G - - .quad 0xa287ec4b5d0b2fbb - .quad 0x415c5790074882ca - .quad 0xe044a61ec1d0815c - .quad 0x26334f0a409ef5e0 - .quad 0xace532bf458d72e1 - .quad 0x5be768e07cb73cb5 - .quad 0x56cf7d94ee8bbde7 - .quad 0x6b0697e3feb43a03 - .quad 0xb6c8f04adf62a3c0 - .quad 0x3ef000ef076da45d - .quad 0x9c9cb95849f0d2a9 - .quad 0x1cc37f43441b2fae - - // 2^224 * 8 * G - - .quad 0x508f565a5cc7324f - .quad 0xd061c4c0e506a922 - .quad 0xfb18abdb5c45ac19 - .quad 0x6c6809c10380314a - .quad 0xd76656f1c9ceaeb9 - .quad 0x1c5b15f818e5656a - .quad 0x26e72832844c2334 - .quad 0x3a346f772f196838 - .quad 0xd2d55112e2da6ac8 - .quad 0xe9bd0331b1e851ed - .quad 0x960746dd8ec67262 - .quad 0x05911b9f6ef7c5d0 - - // 2^228 * 1 * G - - .quad 0xe9dcd756b637ff2d - .quad 0xec4c348fc987f0c4 - .quad 0xced59285f3fbc7b7 - .quad 0x3305354793e1ea87 - .quad 0x01c18980c5fe9f94 - .quad 0xcd656769716fd5c8 - .quad 0x816045c3d195a086 - .quad 0x6e2b7f3266cc7982 - .quad 0xcc802468f7c3568f - .quad 0x9de9ba8219974cb3 - .quad 0xabb7229cb5b81360 - .quad 0x44e2017a6fbeba62 - - // 2^228 * 2 * G - - .quad 0xc4c2a74354dab774 - .quad 0x8e5d4c3c4eaf031a - .quad 0xb76c23d242838f17 - .quad 0x749a098f68dce4ea - .quad 0x87f82cf3b6ca6ecd - .quad 0x580f893e18f4a0c2 - .quad 0x058930072604e557 - .quad 0x6cab6ac256d19c1d - .quad 0xdcdfe0a02cc1de60 - .quad 0x032665ff51c5575b - .quad 0x2c0c32f1073abeeb - .quad 0x6a882014cd7b8606 - - // 2^228 * 3 * G - - .quad 0xa52a92fea4747fb5 - .quad 0xdc12a4491fa5ab89 - .quad 0xd82da94bb847a4ce - .quad 0x4d77edce9512cc4e - .quad 0xd111d17caf4feb6e - .quad 0x050bba42b33aa4a3 - .quad 0x17514c3ceeb46c30 - .quad 0x54bedb8b1bc27d75 - .quad 0x77c8e14577e2189c - .quad 0xa3e46f6aff99c445 - .quad 0x3144dfc86d335343 - .quad 0x3a96559e7c4216a9 - - // 2^228 * 4 * G - - .quad 0x12550d37f42ad2ee - .quad 0x8b78e00498a1fbf5 - .quad 0x5d53078233894cb2 - .quad 0x02c84e4e3e498d0c - .quad 0x4493896880baaa52 - .quad 0x4c98afc4f285940e - .quad 0xef4aa79ba45448b6 - .quad 0x5278c510a57aae7f - .quad 0xa54dd074294c0b94 - .quad 0xf55d46b8df18ffb6 - .quad 0xf06fecc58dae8366 - .quad 0x588657668190d165 - - // 2^228 * 5 * G - - .quad 0xd47712311aef7117 - .quad 0x50343101229e92c7 - .quad 0x7a95e1849d159b97 - .quad 0x2449959b8b5d29c9 - .quad 0xbf5834f03de25cc3 - .quad 0xb887c8aed6815496 - .quad 0x5105221a9481e892 - .quad 0x6760ed19f7723f93 - .quad 0x669ba3b7ac35e160 - .quad 0x2eccf73fba842056 - .quad 0x1aec1f17c0804f07 - .quad 0x0d96bc031856f4e7 - - // 2^228 * 6 * G - - .quad 0x3318be7775c52d82 - .quad 0x4cb764b554d0aab9 - .quad 0xabcf3d27cc773d91 - .quad 0x3bf4d1848123288a - .quad 0xb1d534b0cc7505e1 - .quad 0x32cd003416c35288 - .quad 0xcb36a5800762c29d - .quad 0x5bfe69b9237a0bf8 - .quad 0x183eab7e78a151ab - .quad 0xbbe990c999093763 - .quad 0xff717d6e4ac7e335 - .quad 0x4c5cddb325f39f88 - - // 2^228 * 7 * G - - .quad 0xc0f6b74d6190a6eb - .quad 0x20ea81a42db8f4e4 - .quad 0xa8bd6f7d97315760 - .quad 0x33b1d60262ac7c21 - .quad 0x57750967e7a9f902 - .quad 0x2c37fdfc4f5b467e - .quad 0xb261663a3177ba46 - .quad 0x3a375e78dc2d532b - .quad 0x8141e72f2d4dddea - .quad 0xe6eafe9862c607c8 - .quad 0x23c28458573cafd0 - .quad 0x46b9476f4ff97346 - - // 2^228 * 8 * G - - .quad 0x0c1ffea44f901e5c - .quad 0x2b0b6fb72184b782 - .quad 0xe587ff910114db88 - .quad 0x37130f364785a142 - .quad 0x1215505c0d58359f - .quad 0x2a2013c7fc28c46b - .quad 0x24a0a1af89ea664e - .quad 0x4400b638a1130e1f - .quad 0x3a01b76496ed19c3 - .quad 0x31e00ab0ed327230 - .quad 0x520a885783ca15b1 - .quad 0x06aab9875accbec7 - - // 2^232 * 1 * G - - .quad 0xc1339983f5df0ebb - .quad 0xc0f3758f512c4cac - .quad 0x2cf1130a0bb398e1 - .quad 0x6b3cecf9aa270c62 - .quad 0x5349acf3512eeaef - .quad 0x20c141d31cc1cb49 - .quad 0x24180c07a99a688d - .quad 0x555ef9d1c64b2d17 - .quad 0x36a770ba3b73bd08 - .quad 0x624aef08a3afbf0c - .quad 0x5737ff98b40946f2 - .quad 0x675f4de13381749d - - // 2^232 * 2 * G - - .quad 0x0e2c52036b1782fc - .quad 0x64816c816cad83b4 - .quad 0xd0dcbdd96964073e - .quad 0x13d99df70164c520 - .quad 0xa12ff6d93bdab31d - .quad 0x0725d80f9d652dfe - .quad 0x019c4ff39abe9487 - .quad 0x60f450b882cd3c43 - .quad 0x014b5ec321e5c0ca - .quad 0x4fcb69c9d719bfa2 - .quad 0x4e5f1c18750023a0 - .quad 0x1c06de9e55edac80 - - // 2^232 * 3 * G - - .quad 0x990f7ad6a33ec4e2 - .quad 0x6608f938be2ee08e - .quad 0x9ca143c563284515 - .quad 0x4cf38a1fec2db60d - .quad 0xffd52b40ff6d69aa - .quad 0x34530b18dc4049bb - .quad 0x5e4a5c2fa34d9897 - .quad 0x78096f8e7d32ba2d - .quad 0xa0aaaa650dfa5ce7 - .quad 0xf9c49e2a48b5478c - .quad 0x4f09cc7d7003725b - .quad 0x373cad3a26091abe - - // 2^232 * 4 * G - - .quad 0xb294634d82c9f57c - .quad 0x1fcbfde124934536 - .quad 0x9e9c4db3418cdb5a - .quad 0x0040f3d9454419fc - .quad 0xf1bea8fb89ddbbad - .quad 0x3bcb2cbc61aeaecb - .quad 0x8f58a7bb1f9b8d9d - .quad 0x21547eda5112a686 - .quad 0xdefde939fd5986d3 - .quad 0xf4272c89510a380c - .quad 0xb72ba407bb3119b9 - .quad 0x63550a334a254df4 - - // 2^232 * 5 * G - - .quad 0x6507d6edb569cf37 - .quad 0x178429b00ca52ee1 - .quad 0xea7c0090eb6bd65d - .quad 0x3eea62c7daf78f51 - .quad 0x9bba584572547b49 - .quad 0xf305c6fae2c408e0 - .quad 0x60e8fa69c734f18d - .quad 0x39a92bafaa7d767a - .quad 0x9d24c713e693274e - .quad 0x5f63857768dbd375 - .quad 0x70525560eb8ab39a - .quad 0x68436a0665c9c4cd - - // 2^232 * 6 * G - - .quad 0xbc0235e8202f3f27 - .quad 0xc75c00e264f975b0 - .quad 0x91a4e9d5a38c2416 - .quad 0x17b6e7f68ab789f9 - .quad 0x1e56d317e820107c - .quad 0xc5266844840ae965 - .quad 0xc1e0a1c6320ffc7a - .quad 0x5373669c91611472 - .quad 0x5d2814ab9a0e5257 - .quad 0x908f2084c9cab3fc - .quad 0xafcaf5885b2d1eca - .quad 0x1cb4b5a678f87d11 - - // 2^232 * 7 * G - - .quad 0xb664c06b394afc6c - .quad 0x0c88de2498da5fb1 - .quad 0x4f8d03164bcad834 - .quad 0x330bca78de7434a2 - .quad 0x6b74aa62a2a007e7 - .quad 0xf311e0b0f071c7b1 - .quad 0x5707e438000be223 - .quad 0x2dc0fd2d82ef6eac - .quad 0x982eff841119744e - .quad 0xf9695e962b074724 - .quad 0xc58ac14fbfc953fb - .quad 0x3c31be1b369f1cf5 - - // 2^232 * 8 * G - - .quad 0xb0f4864d08948aee - .quad 0x07dc19ee91ba1c6f - .quad 0x7975cdaea6aca158 - .quad 0x330b61134262d4bb - .quad 0xc168bc93f9cb4272 - .quad 0xaeb8711fc7cedb98 - .quad 0x7f0e52aa34ac8d7a - .quad 0x41cec1097e7d55bb - .quad 0xf79619d7a26d808a - .quad 0xbb1fd49e1d9e156d - .quad 0x73d7c36cdba1df27 - .quad 0x26b44cd91f28777d - - // 2^236 * 1 * G - - .quad 0x300a9035393aa6d8 - .quad 0x2b501131a12bb1cd - .quad 0x7b1ff677f093c222 - .quad 0x4309c1f8cab82bad - .quad 0xaf44842db0285f37 - .quad 0x8753189047efc8df - .quad 0x9574e091f820979a - .quad 0x0e378d6069615579 - .quad 0xd9fa917183075a55 - .quad 0x4bdb5ad26b009fdc - .quad 0x7829ad2cd63def0e - .quad 0x078fc54975fd3877 - - // 2^236 * 2 * G - - .quad 0x87dfbd1428878f2d - .quad 0x134636dd1e9421a1 - .quad 0x4f17c951257341a3 - .quad 0x5df98d4bad296cb8 - .quad 0xe2004b5bb833a98a - .quad 0x44775dec2d4c3330 - .quad 0x3aa244067eace913 - .quad 0x272630e3d58e00a9 - .quad 0xf3678fd0ecc90b54 - .quad 0xf001459b12043599 - .quad 0x26725fbc3758b89b - .quad 0x4325e4aa73a719ae - - // 2^236 * 3 * G - - .quad 0x657dc6ef433c3493 - .quad 0x65375e9f80dbf8c3 - .quad 0x47fd2d465b372dae - .quad 0x4966ab79796e7947 - .quad 0xed24629acf69f59d - .quad 0x2a4a1ccedd5abbf4 - .quad 0x3535ca1f56b2d67b - .quad 0x5d8c68d043b1b42d - .quad 0xee332d4de3b42b0a - .quad 0xd84e5a2b16a4601c - .quad 0x78243877078ba3e4 - .quad 0x77ed1eb4184ee437 - - // 2^236 * 4 * G - - .quad 0xbfd4e13f201839a0 - .quad 0xaeefffe23e3df161 - .quad 0xb65b04f06b5d1fe3 - .quad 0x52e085fb2b62fbc0 - .quad 0x185d43f89e92ed1a - .quad 0xb04a1eeafe4719c6 - .quad 0x499fbe88a6f03f4f - .quad 0x5d8b0d2f3c859bdd - .quad 0x124079eaa54cf2ba - .quad 0xd72465eb001b26e7 - .quad 0x6843bcfdc97af7fd - .quad 0x0524b42b55eacd02 - - // 2^236 * 5 * G - - .quad 0xfd0d5dbee45447b0 - .quad 0x6cec351a092005ee - .quad 0x99a47844567579cb - .quad 0x59d242a216e7fa45 - .quad 0xbc18dcad9b829eac - .quad 0x23ae7d28b5f579d0 - .quad 0xc346122a69384233 - .quad 0x1a6110b2e7d4ac89 - .quad 0x4f833f6ae66997ac - .quad 0x6849762a361839a4 - .quad 0x6985dec1970ab525 - .quad 0x53045e89dcb1f546 - - // 2^236 * 6 * G - - .quad 0xcb8bb346d75353db - .quad 0xfcfcb24bae511e22 - .quad 0xcba48d40d50ae6ef - .quad 0x26e3bae5f4f7cb5d - .quad 0x84da3cde8d45fe12 - .quad 0xbd42c218e444e2d2 - .quad 0xa85196781f7e3598 - .quad 0x7642c93f5616e2b2 - .quad 0x2323daa74595f8e4 - .quad 0xde688c8b857abeb4 - .quad 0x3fc48e961c59326e - .quad 0x0b2e73ca15c9b8ba - - // 2^236 * 7 * G - - .quad 0xd6bb4428c17f5026 - .quad 0x9eb27223fb5a9ca7 - .quad 0xe37ba5031919c644 - .quad 0x21ce380db59a6602 - .quad 0x0e3fbfaf79c03a55 - .quad 0x3077af054cbb5acf - .quad 0xd5c55245db3de39f - .quad 0x015e68c1476a4af7 - .quad 0xc1d5285220066a38 - .quad 0x95603e523570aef3 - .quad 0x832659a7226b8a4d - .quad 0x5dd689091f8eedc9 - - // 2^236 * 8 * G - - .quad 0xcbac84debfd3c856 - .quad 0x1624c348b35ff244 - .quad 0xb7f88dca5d9cad07 - .quad 0x3b0e574da2c2ebe8 - .quad 0x1d022591a5313084 - .quad 0xca2d4aaed6270872 - .quad 0x86a12b852f0bfd20 - .quad 0x56e6c439ad7da748 - .quad 0xc704ff4942bdbae6 - .quad 0x5e21ade2b2de1f79 - .quad 0xe95db3f35652fad8 - .quad 0x0822b5378f08ebc1 - - // 2^240 * 1 * G - - .quad 0x51f048478f387475 - .quad 0xb25dbcf49cbecb3c - .quad 0x9aab1244d99f2055 - .quad 0x2c709e6c1c10a5d6 - .quad 0xe1b7f29362730383 - .quad 0x4b5279ffebca8a2c - .quad 0xdafc778abfd41314 - .quad 0x7deb10149c72610f - .quad 0xcb62af6a8766ee7a - .quad 0x66cbec045553cd0e - .quad 0x588001380f0be4b5 - .quad 0x08e68e9ff62ce2ea - - // 2^240 * 2 * G - - .quad 0x34ad500a4bc130ad - .quad 0x8d38db493d0bd49c - .quad 0xa25c3d98500a89be - .quad 0x2f1f3f87eeba3b09 - .quad 0x2f2d09d50ab8f2f9 - .quad 0xacb9218dc55923df - .quad 0x4a8f342673766cb9 - .quad 0x4cb13bd738f719f5 - .quad 0xf7848c75e515b64a - .quad 0xa59501badb4a9038 - .quad 0xc20d313f3f751b50 - .quad 0x19a1e353c0ae2ee8 - - // 2^240 * 3 * G - - .quad 0x7d1c7560bafa05c3 - .quad 0xb3e1a0a0c6e55e61 - .quad 0xe3529718c0d66473 - .quad 0x41546b11c20c3486 - .quad 0xb42172cdd596bdbd - .quad 0x93e0454398eefc40 - .quad 0x9fb15347b44109b5 - .quad 0x736bd3990266ae34 - .quad 0x85532d509334b3b4 - .quad 0x46fd114b60816573 - .quad 0xcc5f5f30425c8375 - .quad 0x412295a2b87fab5c - - // 2^240 * 4 * G - - .quad 0x19c99b88f57ed6e9 - .quad 0x5393cb266df8c825 - .quad 0x5cee3213b30ad273 - .quad 0x14e153ebb52d2e34 - .quad 0x2e655261e293eac6 - .quad 0x845a92032133acdb - .quad 0x460975cb7900996b - .quad 0x0760bb8d195add80 - .quad 0x413e1a17cde6818a - .quad 0x57156da9ed69a084 - .quad 0x2cbf268f46caccb1 - .quad 0x6b34be9bc33ac5f2 - - // 2^240 * 5 * G - - .quad 0xf3df2f643a78c0b2 - .quad 0x4c3e971ef22e027c - .quad 0xec7d1c5e49c1b5a3 - .quad 0x2012c18f0922dd2d - .quad 0x11fc69656571f2d3 - .quad 0xc6c9e845530e737a - .quad 0xe33ae7a2d4fe5035 - .quad 0x01b9c7b62e6dd30b - .quad 0x880b55e55ac89d29 - .quad 0x1483241f45a0a763 - .quad 0x3d36efdfc2e76c1f - .quad 0x08af5b784e4bade8 - - // 2^240 * 6 * G - - .quad 0x283499dc881f2533 - .quad 0x9d0525da779323b6 - .quad 0x897addfb673441f4 - .quad 0x32b79d71163a168d - .quad 0xe27314d289cc2c4b - .quad 0x4be4bd11a287178d - .quad 0x18d528d6fa3364ce - .quad 0x6423c1d5afd9826e - .quad 0xcc85f8d9edfcb36a - .quad 0x22bcc28f3746e5f9 - .quad 0xe49de338f9e5d3cd - .quad 0x480a5efbc13e2dcc - - // 2^240 * 7 * G - - .quad 0x0b51e70b01622071 - .quad 0x06b505cf8b1dafc5 - .quad 0x2c6bb061ef5aabcd - .quad 0x47aa27600cb7bf31 - .quad 0xb6614ce442ce221f - .quad 0x6e199dcc4c053928 - .quad 0x663fb4a4dc1cbe03 - .quad 0x24b31d47691c8e06 - .quad 0x2a541eedc015f8c3 - .quad 0x11a4fe7e7c693f7c - .quad 0xf0af66134ea278d6 - .quad 0x545b585d14dda094 - - // 2^240 * 8 * G - - .quad 0x67bf275ea0d43a0f - .quad 0xade68e34089beebe - .quad 0x4289134cd479e72e - .quad 0x0f62f9c332ba5454 - .quad 0x6204e4d0e3b321e1 - .quad 0x3baa637a28ff1e95 - .quad 0x0b0ccffd5b99bd9e - .quad 0x4d22dc3e64c8d071 - .quad 0xfcb46589d63b5f39 - .quad 0x5cae6a3f57cbcf61 - .quad 0xfebac2d2953afa05 - .quad 0x1c0fa01a36371436 - - // 2^244 * 1 * G - - .quad 0xe7547449bc7cd692 - .quad 0x0f9abeaae6f73ddf - .quad 0x4af01ca700837e29 - .quad 0x63ab1b5d3f1bc183 - .quad 0xc11ee5e854c53fae - .quad 0x6a0b06c12b4f3ff4 - .quad 0x33540f80e0b67a72 - .quad 0x15f18fc3cd07e3ef - .quad 0x32750763b028f48c - .quad 0x06020740556a065f - .quad 0xd53bd812c3495b58 - .quad 0x08706c9b865f508d - - // 2^244 * 2 * G - - .quad 0xf37ca2ab3d343dff - .quad 0x1a8c6a2d80abc617 - .quad 0x8e49e035d4ccffca - .quad 0x48b46beebaa1d1b9 - .quad 0xcc991b4138b41246 - .quad 0x243b9c526f9ac26b - .quad 0xb9ef494db7cbabbd - .quad 0x5fba433dd082ed00 - .quad 0x9c49e355c9941ad0 - .quad 0xb9734ade74498f84 - .quad 0x41c3fed066663e5c - .quad 0x0ecfedf8e8e710b3 - - // 2^244 * 3 * G - - .quad 0x76430f9f9cd470d9 - .quad 0xb62acc9ba42f6008 - .quad 0x1898297c59adad5e - .quad 0x7789dd2db78c5080 - .quad 0x744f7463e9403762 - .quad 0xf79a8dee8dfcc9c9 - .quad 0x163a649655e4cde3 - .quad 0x3b61788db284f435 - .quad 0xb22228190d6ef6b2 - .quad 0xa94a66b246ce4bfa - .quad 0x46c1a77a4f0b6cc7 - .quad 0x4236ccffeb7338cf - - // 2^244 * 4 * G - - .quad 0x8497404d0d55e274 - .quad 0x6c6663d9c4ad2b53 - .quad 0xec2fb0d9ada95734 - .quad 0x2617e120cdb8f73c - .quad 0x3bd82dbfda777df6 - .quad 0x71b177cc0b98369e - .quad 0x1d0e8463850c3699 - .quad 0x5a71945b48e2d1f1 - .quad 0x6f203dd5405b4b42 - .quad 0x327ec60410b24509 - .quad 0x9c347230ac2a8846 - .quad 0x77de29fc11ffeb6a - - // 2^244 * 5 * G - - .quad 0xb0ac57c983b778a8 - .quad 0x53cdcca9d7fe912c - .quad 0x61c2b854ff1f59dc - .quad 0x3a1a2cf0f0de7dac - .quad 0x835e138fecced2ca - .quad 0x8c9eaf13ea963b9a - .quad 0xc95fbfc0b2160ea6 - .quad 0x575e66f3ad877892 - .quad 0x99803a27c88fcb3a - .quad 0x345a6789275ec0b0 - .quad 0x459789d0ff6c2be5 - .quad 0x62f882651e70a8b2 - - // 2^244 * 6 * G - - .quad 0x085ae2c759ff1be4 - .quad 0x149145c93b0e40b7 - .quad 0xc467e7fa7ff27379 - .quad 0x4eeecf0ad5c73a95 - .quad 0x6d822986698a19e0 - .quad 0xdc9821e174d78a71 - .quad 0x41a85f31f6cb1f47 - .quad 0x352721c2bcda9c51 - .quad 0x48329952213fc985 - .quad 0x1087cf0d368a1746 - .quad 0x8e5261b166c15aa5 - .quad 0x2d5b2d842ed24c21 - - // 2^244 * 7 * G - - .quad 0x02cfebd9ebd3ded1 - .quad 0xd45b217739021974 - .quad 0x7576f813fe30a1b7 - .quad 0x5691b6f9a34ef6c2 - .quad 0x5eb7d13d196ac533 - .quad 0x377234ecdb80be2b - .quad 0xe144cffc7cf5ae24 - .quad 0x5226bcf9c441acec - .quad 0x79ee6c7223e5b547 - .quad 0x6f5f50768330d679 - .quad 0xed73e1e96d8adce9 - .quad 0x27c3da1e1d8ccc03 - - // 2^244 * 8 * G - - .quad 0x7eb9efb23fe24c74 - .quad 0x3e50f49f1651be01 - .quad 0x3ea732dc21858dea - .quad 0x17377bd75bb810f9 - .quad 0x28302e71630ef9f6 - .quad 0xc2d4a2032b64cee0 - .quad 0x090820304b6292be - .quad 0x5fca747aa82adf18 - .quad 0x232a03c35c258ea5 - .quad 0x86f23a2c6bcb0cf1 - .quad 0x3dad8d0d2e442166 - .quad 0x04a8933cab76862b - - // 2^248 * 1 * G - - .quad 0xd2c604b622943dff - .quad 0xbc8cbece44cfb3a0 - .quad 0x5d254ff397808678 - .quad 0x0fa3614f3b1ca6bf - .quad 0x69082b0e8c936a50 - .quad 0xf9c9a035c1dac5b6 - .quad 0x6fb73e54c4dfb634 - .quad 0x4005419b1d2bc140 - .quad 0xa003febdb9be82f0 - .quad 0x2089c1af3a44ac90 - .quad 0xf8499f911954fa8e - .quad 0x1fba218aef40ab42 - - // 2^248 * 2 * G - - .quad 0xab549448fac8f53e - .quad 0x81f6e89a7ba63741 - .quad 0x74fd6c7d6c2b5e01 - .quad 0x392e3acaa8c86e42 - .quad 0x4f3e57043e7b0194 - .quad 0xa81d3eee08daaf7f - .quad 0xc839c6ab99dcdef1 - .quad 0x6c535d13ff7761d5 - .quad 0x4cbd34e93e8a35af - .quad 0x2e0781445887e816 - .quad 0x19319c76f29ab0ab - .quad 0x25e17fe4d50ac13b - - // 2^248 * 3 * G - - .quad 0x0a289bd71e04f676 - .quad 0x208e1c52d6420f95 - .quad 0x5186d8b034691fab - .quad 0x255751442a9fb351 - .quad 0x915f7ff576f121a7 - .quad 0xc34a32272fcd87e3 - .quad 0xccba2fde4d1be526 - .quad 0x6bba828f8969899b - .quad 0xe2d1bc6690fe3901 - .quad 0x4cb54a18a0997ad5 - .quad 0x971d6914af8460d4 - .quad 0x559d504f7f6b7be4 - - // 2^248 * 4 * G - - .quad 0xa7738378b3eb54d5 - .quad 0x1d69d366a5553c7c - .quad 0x0a26cf62f92800ba - .quad 0x01ab12d5807e3217 - .quad 0x9c4891e7f6d266fd - .quad 0x0744a19b0307781b - .quad 0x88388f1d6061e23b - .quad 0x123ea6a3354bd50e - .quad 0x118d189041e32d96 - .quad 0xb9ede3c2d8315848 - .quad 0x1eab4271d83245d9 - .quad 0x4a3961e2c918a154 - - // 2^248 * 5 * G - - .quad 0x71dc3be0f8e6bba0 - .quad 0xd6cef8347effe30a - .quad 0xa992425fe13a476a - .quad 0x2cd6bce3fb1db763 - .quad 0x0327d644f3233f1e - .quad 0x499a260e34fcf016 - .quad 0x83b5a716f2dab979 - .quad 0x68aceead9bd4111f - .quad 0x38b4c90ef3d7c210 - .quad 0x308e6e24b7ad040c - .quad 0x3860d9f1b7e73e23 - .quad 0x595760d5b508f597 - - // 2^248 * 6 * G - - .quad 0x6129bfe104aa6397 - .quad 0x8f960008a4a7fccb - .quad 0x3f8bc0897d909458 - .quad 0x709fa43edcb291a9 - .quad 0x882acbebfd022790 - .quad 0x89af3305c4115760 - .quad 0x65f492e37d3473f4 - .quad 0x2cb2c5df54515a2b - .quad 0xeb0a5d8c63fd2aca - .quad 0xd22bc1662e694eff - .quad 0x2723f36ef8cbb03a - .quad 0x70f029ecf0c8131f - - // 2^248 * 7 * G - - .quad 0x461307b32eed3e33 - .quad 0xae042f33a45581e7 - .quad 0xc94449d3195f0366 - .quad 0x0b7d5d8a6c314858 - .quad 0x2a6aafaa5e10b0b9 - .quad 0x78f0a370ef041aa9 - .quad 0x773efb77aa3ad61f - .quad 0x44eca5a2a74bd9e1 - .quad 0x25d448327b95d543 - .quad 0x70d38300a3340f1d - .quad 0xde1c531c60e1c52b - .quad 0x272224512c7de9e4 - - // 2^248 * 8 * G - - .quad 0x1abc92af49c5342e - .quad 0xffeed811b2e6fad0 - .quad 0xefa28c8dfcc84e29 - .quad 0x11b5df18a44cc543 - .quad 0xbf7bbb8a42a975fc - .quad 0x8c5c397796ada358 - .quad 0xe27fc76fcdedaa48 - .quad 0x19735fd7f6bc20a6 - .quad 0xe3ab90d042c84266 - .quad 0xeb848e0f7f19547e - .quad 0x2503a1d065a497b9 - .quad 0x0fef911191df895f - - // 2^252 * 1 * G - - .quad 0xb1507ca1ab1c6eb9 - .quad 0xbd448f3e16b687b3 - .quad 0x3455fb7f2c7a91ab - .quad 0x7579229e2f2adec1 - .quad 0x6ab5dcb85b1c16b7 - .quad 0x94c0fce83c7b27a5 - .quad 0xa4b11c1a735517be - .quad 0x499238d0ba0eafaa - .quad 0xecf46e527aba8b57 - .quad 0x15a08c478bd1647b - .quad 0x7af1c6a65f706fef - .quad 0x6345fa78f03a30d5 - - // 2^252 * 2 * G - - .quad 0xdf02f95f1015e7a1 - .quad 0x790ec41da9b40263 - .quad 0x4d3a0ea133ea1107 - .quad 0x54f70be7e33af8c9 - .quad 0x93d3cbe9bdd8f0a4 - .quad 0xdb152c1bfd177302 - .quad 0x7dbddc6d7f17a875 - .quad 0x3e1a71cc8f426efe - .quad 0xc83ca3e390babd62 - .quad 0x80ede3670291c833 - .quad 0xc88038ccd37900c4 - .quad 0x2c5fc0231ec31fa1 - - // 2^252 * 3 * G - - .quad 0xfeba911717038b4f - .quad 0xe5123721c9deef81 - .quad 0x1c97e4e75d0d8834 - .quad 0x68afae7a23dc3bc6 - .quad 0xc422e4d102456e65 - .quad 0x87414ac1cad47b91 - .quad 0x1592e2bba2b6ffdd - .quad 0x75d9d2bff5c2100f - .quad 0x5bd9b4763626e81c - .quad 0x89966936bca02edd - .quad 0x0a41193d61f077b3 - .quad 0x3097a24200ce5471 - - // 2^252 * 4 * G - - .quad 0x57427734c7f8b84c - .quad 0xf141a13e01b270e9 - .quad 0x02d1adfeb4e564a6 - .quad 0x4bb23d92ce83bd48 - .quad 0xa162e7246695c486 - .quad 0x131d633435a89607 - .quad 0x30521561a0d12a37 - .quad 0x56704bada6afb363 - .quad 0xaf6c4aa752f912b9 - .quad 0x5e665f6cd86770c8 - .quad 0x4c35ac83a3c8cd58 - .quad 0x2b7a29c010a58a7e - - // 2^252 * 5 * G - - .quad 0xc4007f77d0c1cec3 - .quad 0x8d1020b6bac492f8 - .quad 0x32ec29d57e69daaf - .quad 0x599408759d95fce0 - .quad 0x33810a23bf00086e - .quad 0xafce925ee736ff7c - .quad 0x3d60e670e24922d4 - .quad 0x11ce9e714f96061b - .quad 0x219ef713d815bac1 - .quad 0xf141465d485be25c - .quad 0x6d5447cc4e513c51 - .quad 0x174926be5ef44393 - - // 2^252 * 6 * G - - .quad 0xb5deb2f9fc5bd5bb - .quad 0x92daa72ae1d810e1 - .quad 0xafc4cfdcb72a1c59 - .quad 0x497d78813fc22a24 - .quad 0x3ef5d41593ea022e - .quad 0x5cbcc1a20ed0eed6 - .quad 0x8fd24ecf07382c8c - .quad 0x6fa42ead06d8e1ad - .quad 0xe276824a1f73371f - .quad 0x7f7cf01c4f5b6736 - .quad 0x7e201fe304fa46e7 - .quad 0x785a36a357808c96 - - // 2^252 * 7 * G - - .quad 0x825fbdfd63014d2b - .quad 0xc852369c6ca7578b - .quad 0x5b2fcd285c0b5df0 - .quad 0x12ab214c58048c8f - .quad 0x070442985d517bc3 - .quad 0x6acd56c7ae653678 - .quad 0x00a27983985a7763 - .quad 0x5167effae512662b - .quad 0xbd4ea9e10f53c4b6 - .quad 0x1673dc5f8ac91a14 - .quad 0xa8f81a4e2acc1aba - .quad 0x33a92a7924332a25 - - // 2^252 * 8 * G - - .quad 0x9dd1f49927996c02 - .quad 0x0cb3b058e04d1752 - .quad 0x1f7e88967fd02c3e - .quad 0x2f964268cb8b3eb1 - .quad 0x7ba95ba0218f2ada - .quad 0xcff42287330fb9ca - .quad 0xdada496d56c6d907 - .quad 0x5380c296f4beee54 - .quad 0x9d4f270466898d0a - .quad 0x3d0987990aff3f7a - .quad 0xd09ef36267daba45 - .quad 0x7761455e7b1c669c diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519base_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519base_alt.S deleted file mode 100644 index 3c8a15b0bb3..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/curve25519_x25519base_alt.S +++ /dev/null @@ -1,9434 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// The x25519 function for curve25519 on base element 9 -// Input scalar[4]; output res[4] -// -// extern void curve25519_x25519base_alt -// (uint64_t res[static 4],const uint64_t scalar[static 4]); -// -// Given a scalar n, returns the X coordinate of n * G where G = (9,...) is -// the standard generator. The scalar is first slightly modified/mangled -// as specified in the relevant RFC (https://www.rfc-editor.org/rfc/rfc7748). -// -// Standard ARM ABI: X0 = res, X1 = scalar -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(curve25519_x25519base_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(curve25519_x25519base_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(curve25519_x25519base_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable home for the input result argument during the whole body - -#define res x23 - -// Other variables that are only needed prior to the modular inverse. - -#define tab x19 - -#define i x20 - -#define bias x21 - -#define bf x22 -#define ix x22 - -// Pointer-offset pairs for result and temporaries on stack with some aliasing. - -#define resx res, #(0*NUMSIZE) - -#define scalar sp, #(0*NUMSIZE) - -#define tabent sp, #(1*NUMSIZE) -#define ymx_2 sp, #(1*NUMSIZE) -#define xpy_2 sp, #(2*NUMSIZE) -#define kxy_2 sp, #(3*NUMSIZE) - -#define acc sp, #(4*NUMSIZE) -#define x_1 sp, #(4*NUMSIZE) -#define y_1 sp, #(5*NUMSIZE) -#define z_1 sp, #(6*NUMSIZE) -#define w_1 sp, #(7*NUMSIZE) -#define x_3 sp, #(4*NUMSIZE) -#define y_3 sp, #(5*NUMSIZE) -#define z_3 sp, #(6*NUMSIZE) -#define w_3 sp, #(7*NUMSIZE) - -#define tmpspace sp, #(8*NUMSIZE) -#define t0 sp, #(8*NUMSIZE) -#define t1 sp, #(9*NUMSIZE) -#define t2 sp, #(10*NUMSIZE) -#define t3 sp, #(11*NUMSIZE) -#define t4 sp, #(12*NUMSIZE) -#define t5 sp, #(13*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 14*NUMSIZE - -// Macro wrapping up the basic field operation bignum_mul_p25519_alt, only -// trivially different from a pure function call to that subroutine. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - orr x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - madd x11, x7, x8, x7 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adcs x15, x15, xzr __LF \ - csel x7, x7, xzr, cc __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x15, x15, xzr __LF \ - and x15, x15, #0x7fffffffffffffff __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - bic x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - mul x11, x7, x8 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adc x15, x15, xzr __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular addition and doubling with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -#define double_twice4(P0,P1) \ - ldp x3, x4, [P1] __LF \ - adds x3, x3, x3 __LF \ - adcs x4, x4, x4 __LF \ - ldp x5, x6, [P1+16] __LF \ - adcs x5, x5, x5 __LF \ - adcs x6, x6, x6 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -S2N_BN_SYMBOL(curve25519_x25519base_alt): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_DEC_SP(NSPACE) - -// Move the output pointer to a stable place - - mov res, x0 - -// Copy the input scalar to its local variable while mangling it. -// In principle the mangling is into 01xxx...xxx000, but actually -// we only clear the top two bits so 00xxx...xxxxxx. The additional -// 2^254 * G is taken care of by the starting value for the addition -// chain below, while we never look at the three low bits at all. - - ldp x10, x11, [x1] - stp x10, x11, [scalar] - ldp x12, x13, [x1, #16] - bic x13, x13, #0xc000000000000000 - stp x12, x13, [scalar+16] - -// The main part of the computation is on the edwards25519 curve in -// extended-projective coordinates (X,Y,Z,T), representing a point -// (x,y) via x = X/Z, y = Y/Z and x * y = T/Z (so X * Y = T * Z). -// Only at the very end do we translate back to curve25519. So G -// below means the generator within edwards25519 corresponding to -// (9,...) for curve25519, via the standard isomorphism. -// -// Initialize accumulator "acc" to either (2^254 + 8) * G or just 2^254 * G -// depending on bit 3 of the scalar, the only nonzero bit of the bottom 4. -// Thus, we have effectively dealt with bits 0, 1, 2, 3, 254 and 255. - - ldr x0, [scalar] - ands xzr, x0, #8 - -#if defined(__ELF__) - adrp tab, S2N_BN_SYMBOL(curve25519_x25519base_alt_constant) - add tab, tab, :lo12:S2N_BN_SYMBOL(curve25519_x25519base_alt_constant) -#else - adrp tab, S2N_BN_SYMBOL(curve25519_x25519base_alt_constant)@PAGE - add tab, tab, S2N_BN_SYMBOL(curve25519_x25519base_alt_constant)@PAGEOFF -#endif - - ldp x0, x1, [tab] - ldp x2, x3, [tab, #96] - csel x0, x0, x2, eq - csel x1, x1, x3, eq - stp x0, x1, [acc] - - ldp x0, x1, [tab, #1*16] - ldp x2, x3, [tab, #96+1*16] - csel x0, x0, x2, eq - csel x1, x1, x3, eq - stp x0, x1, [acc+1*16] - - ldp x0, x1, [tab, #2*16] - ldp x2, x3, [tab, #96+2*16] - csel x0, x0, x2, eq - csel x1, x1, x3, eq - stp x0, x1, [acc+2*16] - - ldp x0, x1, [tab, #3*16] - ldp x2, x3, [tab, #96+3*16] - csel x0, x0, x2, eq - csel x1, x1, x3, eq - stp x0, x1, [acc+3*16] - - mov x0, #1 - stp x0, xzr, [acc+4*16] - stp xzr, xzr, [acc+5*16] - - ldp x0, x1, [tab, #4*16] - ldp x2, x3, [tab, #96+4*16] - csel x0, x0, x2, eq - csel x1, x1, x3, eq - stp x0, x1, [acc+6*16] - - ldp x0, x1, [tab, #5*16] - ldp x2, x3, [tab, #96+5*16] - csel x0, x0, x2, eq - csel x1, x1, x3, eq - stp x0, x1, [acc+7*16] - -// The counter "i" tracks the bit position for which the scalar has -// already been absorbed, starting at 4 and going up in chunks of 4. -// -// The pointer "tab" points at the current block of the table for -// multiples (2^i * j) * G at the current bit position i; 1 <= j <= 8. -// -// The bias is always either 0 and 1 and needs to be added to the -// partially processed scalar implicitly. This is used to absorb 4 bits -// of scalar per iteration from 3-bit table indexing by exploiting -// negation: (16 * h + l) * G = (16 * (h + 1) - (16 - l)) * G is used -// when l >= 9. Note that we can't have any bias left over at the -// end because of the clearing of bit 255 of the scalar, meaning the -// l >= 9 case cannot arise on the last iteration. - - mov i, 4 - add tab, tab, #192 - mov bias, xzr - -// Start of the main loop, repeated 63 times for i = 4, 8, ..., 252 - -Lcurve25519_x25519base_alt_scalarloop: - -// Look at the next 4-bit field "bf", adding the previous bias as well. -// Choose the table index "ix" as bf when bf <= 8 and 16 - bf for bf >= 9, -// setting the bias to 1 for the next iteration in the latter case. - - lsr x0, i, #6 - ldr x2, [sp, x0, lsl #3] // Exploiting scalar = sp exactly - lsr x2, x2, i - and x2, x2, #15 - add bf, x2, bias - - cmp bf, 9 - cset bias, cs - - mov x0, 16 - sub x0, x0, bf - cmp bias, xzr - csel ix, x0, bf, ne - -// Perform constant-time lookup in the table to get element number "ix". -// The table entry for the affine point (x,y) is actually a triple -// (y - x,x + y,2 * d * x * y) to precompute parts of the addition. -// Note that "ix" can be 0, so we set up the appropriate identity first. - - mov x0, #1 - mov x1, xzr - mov x2, xzr - mov x3, xzr - mov x4, #1 - mov x5, xzr - mov x6, xzr - mov x7, xzr - mov x8, xzr - mov x9, xzr - mov x10, xzr - mov x11, xzr - - cmp ix, #1 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #2 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #3 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #4 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #5 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #6 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #7 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - - cmp ix, #8 - ldp x12, x13, [tab] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x12, x13, [tab, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x12, x13, [tab, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x12, x13, [tab, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x12, x13, [tab, #64] - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x12, x13, [tab, #80] - csel x10, x10, x12, ne - csel x11, x11, x13, ne - add tab, tab, #96 - -// We now have the triple from the table in registers as follows -// -// [x3;x2;x1;x0] = y - x -// [x7;x6;x5;x4] = x + y -// [x11;x10;x9;x8] = 2 * d * x * y -// -// In case bias = 1 we need to negate this. For Edwards curves -// -(x,y) = (-x,y), i.e. we need to negate the x coordinate. -// In this processed encoding, that amounts to swapping the -// first two fields and negating the third. -// -// The optional negation here also pretends bias = 0 whenever -// ix = 0 so that it doesn't need to handle the case of zero -// inputs, since no non-trivial table entries are zero. Note -// that in the zero case the whole negation is trivial, and -// so indeed is the swapping. - - cmp bias, #0 - - csel x12, x0, x4, eq - csel x13, x1, x5, eq - csel x14, x2, x6, eq - csel x15, x3, x7, eq - stp x12, x13, [tabent] - stp x14, x15, [tabent+16] - - csel x12, x0, x4, ne - csel x13, x1, x5, ne - csel x14, x2, x6, ne - csel x15, x3, x7, ne - stp x12, x13, [tabent+32] - stp x14, x15, [tabent+48] - - mov x0, #-19 - subs x0, x0, x8 - mov x2, #-1 - sbcs x1, x2, x9 - sbcs x2, x2, x10 - mov x3, #0x7FFFFFFFFFFFFFFF - sbc x3, x3, x11 - - cmp ix, xzr - ccmp bias, xzr, #4, ne - - csel x0, x0, x8, ne - csel x1, x1, x9, ne - stp x0, x1, [tabent+64] - csel x2, x2, x10, ne - csel x3, x3, x11, ne - stp x2, x3, [tabent+80] - -// Extended-projective and precomputed mixed addition. -// This is effectively the same as calling the standalone -// function edwards25519_pepadd(acc,acc,tabent), but we -// only retain slightly weaker normalization < 2 * p_25519 -// throughout the inner loop, so the computation is -// slightly different, and faster overall. - - double_twice4(t0,z_1) - sub_twice4(t1,y_1,x_1) - add_twice4(t2,y_1,x_1) - mul_4(t3,w_1,kxy_2) - mul_4(t1,t1,ymx_2) - mul_4(t2,t2,xpy_2) - sub_twice4(t4,t0,t3) - add_twice4(t0,t0,t3) - sub_twice4(t5,t2,t1) - add_twice4(t1,t2,t1) - mul_4(z_3,t4,t0) - mul_4(x_3,t5,t4) - mul_4(y_3,t0,t1) - mul_4(w_3,t5,t1) - -// End of the main loop; move on by 4 bits. - - add i, i, 4 - cmp i, 256 - bcc Lcurve25519_x25519base_alt_scalarloop - -// Now we need to translate from Edwards curve edwards25519 back -// to the Montgomery form curve25519. The mapping in the affine -// representations is -// -// (x,y) |-> ((1 + y) / (1 - y), c * (1 + y) / ((1 - y) * x)) -// -// For x25519, we only need the x coordinate, and we compute this as -// -// (1 + y) / (1 - y) = (x + x * y) / (x - x * y) -// = (X/Z + T/Z) / (X/Z - T/Z) -// = (X + T) / (X - T) -// = (X + T) * inverse(X - T) -// -// We could equally well use (Z + Y) / (Z - Y), but the above has the -// same cost, and it more explicitly forces zero output whenever X = 0, -// regardless of how the modular inverse behaves on zero inputs. In -// the present setting (base point 9, mangled scalar) that doesn't -// really matter anyway since X = 0 never arises, but it seems a -// little bit tidier. Note that both Edwards point (0,1) which maps to -// the Montgomery point at infinity, and Edwards (0,-1) which maps to -// Montgomery (0,0) [this is the 2-torsion point] are both by definition -// mapped to 0 by the X coordinate mapping used to define curve25519. -// -// First the addition and subtraction: - - add_twice4(t1,x_3,w_3) - sub_twice4(t2,x_3,w_3) - -// Prepare to call the modular inverse function to get t0 = 1/t2 -// Note that this works for the weakly normalized z_3 equally well. -// The non-coprime case z_3 == 0 (mod p_25519) cannot arise anyway. - - add x0, t0 - add x1, t2 - -// Inline copy of bignum_inv_p25519, identical except for stripping out -// the prologue and epilogue saving and restoring registers and making -// and reclaiming room on the stack. For more details and explanations see -// "arm/curve25519/bignum_inv_p25519.S". Note that the stack it uses for -// its own temporaries is 128 bytes, so it has no effect on variables -// that are needed in the rest of our computation here: res, t0, t1, t2. - - mov x20, x0 - mov x10, #0xffffffffffffffed - mov x11, #0xffffffffffffffff - stp x10, x11, [sp] - mov x12, #0x7fffffffffffffff - stp x11, x12, [sp, #16] - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - mov x7, #0x13 - lsr x6, x5, #63 - madd x6, x7, x6, x7 - adds x2, x2, x6 - adcs x3, x3, xzr - adcs x4, x4, xzr - orr x5, x5, #0x8000000000000000 - adcs x5, x5, xzr - csel x6, x7, xzr, cc - subs x2, x2, x6 - sbcs x3, x3, xzr - sbcs x4, x4, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - stp x2, x3, [sp, #32] - stp x4, x5, [sp, #48] - stp xzr, xzr, [sp, #64] - stp xzr, xzr, [sp, #80] - mov x10, #0x2099 - movk x10, #0x7502, lsl #16 - movk x10, #0x9e23, lsl #32 - movk x10, #0xa0f9, lsl #48 - mov x11, #0x2595 - movk x11, #0x1d13, lsl #16 - movk x11, #0x8f3f, lsl #32 - movk x11, #0xa8c6, lsl #48 - mov x12, #0x5242 - movk x12, #0x5ac, lsl #16 - movk x12, #0x8938, lsl #32 - movk x12, #0x6c6c, lsl #48 - mov x13, #0x615 - movk x13, #0x4177, lsl #16 - movk x13, #0x8b2, lsl #32 - movk x13, #0x2765, lsl #48 - stp x10, x11, [sp, #96] - stp x12, x13, [sp, #112] - mov x21, #0xa - mov x22, #0x1 - b Lcurve25519_x25519base_alt_invmidloop -Lcurve25519_x25519base_alt_invloop: - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - and x0, x12, x16 - and x1, x13, x17 - add x19, x0, x1 - ldr x7, [sp] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #32] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x7, [sp, #8] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #40] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [sp] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [sp, #32] - ldr x7, [sp, #16] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #48] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [sp, #8] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [sp, #40] - ldr x7, [sp, #24] - eor x1, x7, x14 - asr x3, x1, #63 - and x3, x3, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #56] - eor x1, x8, x15 - asr x0, x1, #63 - and x0, x0, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [sp, #16] - extr x5, x3, x5, #59 - str x5, [sp, #24] - eor x1, x7, x16 - asr x5, x1, #63 - and x5, x5, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - asr x0, x1, #63 - and x0, x0, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - extr x4, x2, x4, #59 - str x4, [sp, #48] - extr x2, x5, x2, #59 - str x2, [sp, #56] - ldr x7, [sp, #64] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #96] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #64] - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - str x5, [sp, #96] - adc x3, x3, x1 - ldr x7, [sp, #72] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #104] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #72] - adc x6, x6, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - str x3, [sp, #104] - adc x4, x4, x1 - ldr x7, [sp, #80] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #112] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #80] - adc x5, x5, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - str x4, [sp, #112] - adc x2, x2, x1 - ldr x7, [sp, #88] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #120] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x3, x5, #63 - ldp x0, x1, [sp, #64] - add x6, x6, x3, asr #63 - mov x3, #0x13 - mul x4, x6, x3 - add x5, x5, x6, lsl #63 - smulh x3, x6, x3 - ldr x6, [sp, #80] - adds x0, x0, x4 - adcs x1, x1, x3 - asr x3, x3, #63 - adcs x6, x6, x3 - adc x5, x5, x3 - stp x0, x1, [sp, #64] - stp x6, x5, [sp, #80] - eor x1, x7, x16 - and x5, x16, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - and x0, x17, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - extr x6, x5, x2, #63 - ldp x0, x1, [sp, #96] - add x6, x6, x5, asr #63 - mov x5, #0x13 - mul x4, x6, x5 - add x2, x2, x6, lsl #63 - smulh x5, x6, x5 - ldr x3, [sp, #112] - adds x0, x0, x4 - adcs x1, x1, x5 - asr x5, x5, #63 - adcs x3, x3, x5 - adc x2, x2, x5 - stp x0, x1, [sp, #96] - stp x3, x2, [sp, #112] -Lcurve25519_x25519base_alt_invmidloop: - mov x1, x22 - ldr x2, [sp] - ldr x3, [sp, #32] - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x8, x4, #0x100, lsl #12 - sbfx x8, x8, #21, #21 - mov x11, #0x100000 - add x11, x11, x11, lsl #21 - add x9, x4, x11 - asr x9, x9, #42 - add x10, x5, #0x100, lsl #12 - sbfx x10, x10, #21, #21 - add x11, x5, x11 - asr x11, x11, #42 - mul x6, x8, x2 - mul x7, x9, x3 - mul x2, x10, x2 - mul x3, x11, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #21, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #42 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #21, #21 - add x15, x5, x15 - asr x15, x15, #42 - mul x6, x12, x2 - mul x7, x13, x3 - mul x2, x14, x2 - mul x3, x15, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - mul x2, x12, x8 - mul x3, x12, x9 - mul x6, x14, x8 - mul x7, x14, x9 - madd x8, x13, x10, x2 - madd x9, x13, x11, x3 - madd x16, x15, x10, x6 - madd x17, x15, x11, x7 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #22, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #43 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #22, #21 - add x15, x5, x15 - asr x15, x15, #43 - mneg x2, x12, x8 - mneg x3, x12, x9 - mneg x4, x14, x8 - mneg x5, x14, x9 - msub x10, x13, x16, x2 - msub x11, x13, x17, x3 - msub x12, x15, x16, x4 - msub x13, x15, x17, x5 - mov x22, x1 - subs x21, x21, #0x1 - b.ne Lcurve25519_x25519base_alt_invloop - ldr x0, [sp] - ldr x1, [sp, #32] - mul x0, x0, x10 - madd x1, x1, x11, x0 - asr x0, x1, #63 - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - eor x14, x14, x0 - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - eor x15, x15, x0 - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - eor x16, x16, x0 - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - eor x17, x17, x0 - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - ldr x7, [sp, #64] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #96] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #64] - adc x2, x2, x1 - ldr x7, [sp, #72] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #104] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #72] - adc x6, x6, x1 - ldr x7, [sp, #80] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #112] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #80] - adc x5, x5, x1 - ldr x7, [sp, #88] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #120] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x3, x5, #63 - ldp x0, x1, [sp, #64] - tst x3, x3 - cinc x6, x6, pl - mov x3, #0x13 - mul x4, x6, x3 - add x5, x5, x6, lsl #63 - smulh x6, x6, x3 - ldr x2, [sp, #80] - adds x0, x0, x4 - adcs x1, x1, x6 - asr x6, x6, #63 - adcs x2, x2, x6 - adcs x5, x5, x6 - csel x3, x3, xzr, mi - subs x0, x0, x3 - sbcs x1, x1, xzr - sbcs x2, x2, xzr - sbc x5, x5, xzr - and x5, x5, #0x7fffffffffffffff - mov x4, x20 - stp x0, x1, [x4] - stp x2, x5, [x4, #16] - -// The final result is (X + T) / (X - T) -// This is the only operation in the whole computation that -// fully reduces modulo p_25519 since now we want the canonical -// answer as output. - - mul_p25519(resx,t1,t0) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(curve25519_x25519base_alt) - - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif - -// **************************************************************************** -// The precomputed data (all read-only). -// **************************************************************************** - -#if defined(__ELF__) -.section .rodata -.type S2N_BN_SYMBOL(curve25519_x25519base_alt_constant), %object -.size S2N_BN_SYMBOL(curve25519_x25519base_alt_constant), 48576 -#elif defined(__APPLE__) -.const_data -#endif - -S2N_BN_SYMBOL(curve25519_x25519base_alt_constant): - -// 2^254 * G and (2^254 + 8) * G in extended-projective coordinates -// but with Z = 1 assumed and hence left out, so they are (X,Y,T) only. - - .quad 0x251037f7cf4e861d - .quad 0x10ede0fb19fb128f - .quad 0x96c033b175f5e2c8 - .quad 0x055f070d6c15fb0d - .quad 0x7c52af2c97473e69 - .quad 0x022f82391bad8378 - .quad 0x9991e1b02adb476f - .quad 0x511144a03a99b855 - .quad 0x5fafc3b88ff2e4ae - .quad 0x855e4ff0de1230ff - .quad 0x72e302a348492870 - .quad 0x1253c19e53dbe1bc - - .quad 0x331d086e0d9abcaa - .quad 0x1e23c96d311a10c9 - .quad 0x96d0f95e58c13478 - .quad 0x2f72f7384fcfcc59 - .quad 0x39a6cd1cfd7d87c9 - .quad 0x9867a0abd8ae153a - .quad 0xa49d2a5f35986745 - .quad 0x57012940cdfe82e1 - .quad 0x5046a6532ec5544a - .quad 0x6d674004739ff6c9 - .quad 0x9bbaa44b234a70e3 - .quad 0x5e6d8901138cf386 - -// Precomputed table of multiples of generator for edwards25519 -// all in precomputed extended-projective (y-x,x+y,2*d*x*y) triples. - - // 2^4 * 1 * G - - .quad 0x7ec851ca553e2df3 - .quad 0xa71284cba64878b3 - .quad 0xe6b5e4193288d1e7 - .quad 0x4cf210ec5a9a8883 - .quad 0x322d04a52d9021f6 - .quad 0xb9c19f3375c6bf9c - .quad 0x587a3a4342d20b09 - .quad 0x143b1cf8aa64fe61 - .quad 0x9f867c7d968acaab - .quad 0x5f54258e27092729 - .quad 0xd0a7d34bea180975 - .quad 0x21b546a3374126e1 - - // 2^4 * 2 * G - - .quad 0xa94ff858a2888343 - .quad 0xce0ed4565313ed3c - .quad 0xf55c3dcfb5bf34fa - .quad 0x0a653ca5c9eab371 - .quad 0x490a7a45d185218f - .quad 0x9a15377846049335 - .quad 0x0060ea09cc31e1f6 - .quad 0x7e041577f86ee965 - .quad 0x66b2a496ce5b67f3 - .quad 0xff5492d8bd569796 - .quad 0x503cec294a592cd0 - .quad 0x566943650813acb2 - - // 2^4 * 3 * G - - .quad 0xb818db0c26620798 - .quad 0x5d5c31d9606e354a - .quad 0x0982fa4f00a8cdc7 - .quad 0x17e12bcd4653e2d4 - .quad 0x5672f9eb1dabb69d - .quad 0xba70b535afe853fc - .quad 0x47ac0f752796d66d - .quad 0x32a5351794117275 - .quad 0xd3a644a6df648437 - .quad 0x703b6559880fbfdd - .quad 0xcb852540ad3a1aa5 - .quad 0x0900b3f78e4c6468 - - // 2^4 * 4 * G - - .quad 0x0a851b9f679d651b - .quad 0xe108cb61033342f2 - .quad 0xd601f57fe88b30a3 - .quad 0x371f3acaed2dd714 - .quad 0xed280fbec816ad31 - .quad 0x52d9595bd8e6efe3 - .quad 0x0fe71772f6c623f5 - .quad 0x4314030b051e293c - .quad 0xd560005efbf0bcad - .quad 0x8eb70f2ed1870c5e - .quad 0x201f9033d084e6a0 - .quad 0x4c3a5ae1ce7b6670 - - // 2^4 * 5 * G - - .quad 0x4138a434dcb8fa95 - .quad 0x870cf67d6c96840b - .quad 0xde388574297be82c - .quad 0x7c814db27262a55a - .quad 0xbaf875e4c93da0dd - .quad 0xb93282a771b9294d - .quad 0x80d63fb7f4c6c460 - .quad 0x6de9c73dea66c181 - .quad 0x478904d5a04df8f2 - .quad 0xfafbae4ab10142d3 - .quad 0xf6c8ac63555d0998 - .quad 0x5aac4a412f90b104 - - // 2^4 * 6 * G - - .quad 0xc64f326b3ac92908 - .quad 0x5551b282e663e1e0 - .quad 0x476b35f54a1a4b83 - .quad 0x1b9da3fe189f68c2 - .quad 0x603a0d0abd7f5134 - .quad 0x8089c932e1d3ae46 - .quad 0xdf2591398798bd63 - .quad 0x1c145cd274ba0235 - .quad 0x32e8386475f3d743 - .quad 0x365b8baf6ae5d9ef - .quad 0x825238b6385b681e - .quad 0x234929c1167d65e1 - - // 2^4 * 7 * G - - .quad 0x984decaba077ade8 - .quad 0x383f77ad19eb389d - .quad 0xc7ec6b7e2954d794 - .quad 0x59c77b3aeb7c3a7a - .quad 0x48145cc21d099fcf - .quad 0x4535c192cc28d7e5 - .quad 0x80e7c1e548247e01 - .quad 0x4a5f28743b2973ee - .quad 0xd3add725225ccf62 - .quad 0x911a3381b2152c5d - .quad 0xd8b39fad5b08f87d - .quad 0x6f05606b4799fe3b - - // 2^4 * 8 * G - - .quad 0x9ffe9e92177ba962 - .quad 0x98aee71d0de5cae1 - .quad 0x3ff4ae942d831044 - .quad 0x714de12e58533ac8 - .quad 0x5b433149f91b6483 - .quad 0xadb5dc655a2cbf62 - .quad 0x87fa8412632827b3 - .quad 0x60895e91ab49f8d8 - .quad 0xe9ecf2ed0cf86c18 - .quad 0xb46d06120735dfd4 - .quad 0xbc9da09804b96be7 - .quad 0x73e2e62fd96dc26b - - // 2^8 * 1 * G - - .quad 0xed5b635449aa515e - .quad 0xa865c49f0bc6823a - .quad 0x850c1fe95b42d1c4 - .quad 0x30d76d6f03d315b9 - .quad 0x2eccdd0e632f9c1d - .quad 0x51d0b69676893115 - .quad 0x52dfb76ba8637a58 - .quad 0x6dd37d49a00eef39 - .quad 0x6c4444172106e4c7 - .quad 0xfb53d680928d7f69 - .quad 0xb4739ea4694d3f26 - .quad 0x10c697112e864bb0 - - // 2^8 * 2 * G - - .quad 0x6493c4277dbe5fde - .quad 0x265d4fad19ad7ea2 - .quad 0x0e00dfc846304590 - .quad 0x25e61cabed66fe09 - .quad 0x0ca62aa08358c805 - .quad 0x6a3d4ae37a204247 - .quad 0x7464d3a63b11eddc - .quad 0x03bf9baf550806ef - .quad 0x3f13e128cc586604 - .quad 0x6f5873ecb459747e - .quad 0xa0b63dedcc1268f5 - .quad 0x566d78634586e22c - - // 2^8 * 3 * G - - .quad 0x1637a49f9cc10834 - .quad 0xbc8e56d5a89bc451 - .quad 0x1cb5ec0f7f7fd2db - .quad 0x33975bca5ecc35d9 - .quad 0xa1054285c65a2fd0 - .quad 0x6c64112af31667c3 - .quad 0x680ae240731aee58 - .quad 0x14fba5f34793b22a - .quad 0x3cd746166985f7d4 - .quad 0x593e5e84c9c80057 - .quad 0x2fc3f2b67b61131e - .quad 0x14829cea83fc526c - - // 2^8 * 4 * G - - .quad 0xff437b8497dd95c2 - .quad 0x6c744e30aa4eb5a7 - .quad 0x9e0c5d613c85e88b - .quad 0x2fd9c71e5f758173 - .quad 0x21e70b2f4e71ecb8 - .quad 0xe656ddb940a477e3 - .quad 0xbf6556cece1d4f80 - .quad 0x05fc3bc4535d7b7e - .quad 0x24b8b3ae52afdedd - .quad 0x3495638ced3b30cf - .quad 0x33a4bc83a9be8195 - .quad 0x373767475c651f04 - - // 2^8 * 5 * G - - .quad 0x2fba99fd40d1add9 - .quad 0xb307166f96f4d027 - .quad 0x4363f05215f03bae - .quad 0x1fbea56c3b18f999 - .quad 0x634095cb14246590 - .quad 0xef12144016c15535 - .quad 0x9e38140c8910bc60 - .quad 0x6bf5905730907c8c - .quad 0x0fa778f1e1415b8a - .quad 0x06409ff7bac3a77e - .quad 0x6f52d7b89aa29a50 - .quad 0x02521cf67a635a56 - - // 2^8 * 6 * G - - .quad 0x513fee0b0a9d5294 - .quad 0x8f98e75c0fdf5a66 - .quad 0xd4618688bfe107ce - .quad 0x3fa00a7e71382ced - .quad 0xb1146720772f5ee4 - .quad 0xe8f894b196079ace - .quad 0x4af8224d00ac824a - .quad 0x001753d9f7cd6cc4 - .quad 0x3c69232d963ddb34 - .quad 0x1dde87dab4973858 - .quad 0xaad7d1f9a091f285 - .quad 0x12b5fe2fa048edb6 - - // 2^8 * 7 * G - - .quad 0x71f0fbc496fce34d - .quad 0x73b9826badf35bed - .quad 0xd2047261ff28c561 - .quad 0x749b76f96fb1206f - .quad 0xdf2b7c26ad6f1e92 - .quad 0x4b66d323504b8913 - .quad 0x8c409dc0751c8bc3 - .quad 0x6f7e93c20796c7b8 - .quad 0x1f5af604aea6ae05 - .quad 0xc12351f1bee49c99 - .quad 0x61a808b5eeff6b66 - .quad 0x0fcec10f01e02151 - - // 2^8 * 8 * G - - .quad 0x644d58a649fe1e44 - .quad 0x21fcaea231ad777e - .quad 0x02441c5a887fd0d2 - .quad 0x4901aa7183c511f3 - .quad 0x3df2d29dc4244e45 - .quad 0x2b020e7493d8de0a - .quad 0x6cc8067e820c214d - .quad 0x413779166feab90a - .quad 0x08b1b7548c1af8f0 - .quad 0xce0f7a7c246299b4 - .quad 0xf760b0f91e06d939 - .quad 0x41bb887b726d1213 - - // 2^12 * 1 * G - - .quad 0x9267806c567c49d8 - .quad 0x066d04ccca791e6a - .quad 0xa69f5645e3cc394b - .quad 0x5c95b686a0788cd2 - .quad 0x97d980e0aa39f7d2 - .quad 0x35d0384252c6b51c - .quad 0x7d43f49307cd55aa - .quad 0x56bd36cfb78ac362 - .quad 0x2ac519c10d14a954 - .quad 0xeaf474b494b5fa90 - .quad 0xe6af8382a9f87a5a - .quad 0x0dea6db1879be094 - - // 2^12 * 2 * G - - .quad 0xaa66bf547344e5ab - .quad 0xda1258888f1b4309 - .quad 0x5e87d2b3fd564b2f - .quad 0x5b2c78885483b1dd - .quad 0x15baeb74d6a8797a - .quad 0x7ef55cf1fac41732 - .quad 0x29001f5a3c8b05c5 - .quad 0x0ad7cc8752eaccfb - .quad 0x52151362793408cf - .quad 0xeb0f170319963d94 - .quad 0xa833b2fa883d9466 - .quad 0x093a7fa775003c78 - - // 2^12 * 3 * G - - .quad 0xe5107de63a16d7be - .quad 0xa377ffdc9af332cf - .quad 0x70d5bf18440b677f - .quad 0x6a252b19a4a31403 - .quad 0xb8e9604460a91286 - .quad 0x7f3fd8047778d3de - .quad 0x67d01e31bf8a5e2d - .quad 0x7b038a06c27b653e - .quad 0x9ed919d5d36990f3 - .quad 0x5213aebbdb4eb9f2 - .quad 0xc708ea054cb99135 - .quad 0x58ded57f72260e56 - - // 2^12 * 4 * G - - .quad 0x78e79dade9413d77 - .quad 0xf257f9d59729e67d - .quad 0x59db910ee37aa7e6 - .quad 0x6aa11b5bbb9e039c - .quad 0xda6d53265b0fd48b - .quad 0x8960823193bfa988 - .quad 0xd78ac93261d57e28 - .quad 0x79f2942d3a5c8143 - .quad 0x97da2f25b6c88de9 - .quad 0x251ba7eaacf20169 - .quad 0x09b44f87ef4eb4e4 - .quad 0x7d90ab1bbc6a7da5 - - // 2^12 * 5 * G - - .quad 0x9acca683a7016bfe - .quad 0x90505f4df2c50b6d - .quad 0x6b610d5fcce435aa - .quad 0x19a10d446198ff96 - .quad 0x1a07a3f496b3c397 - .quad 0x11ceaa188f4e2532 - .quad 0x7d9498d5a7751bf0 - .quad 0x19ed161f508dd8a0 - .quad 0x560a2cd687dce6ca - .quad 0x7f3568c48664cf4d - .quad 0x8741e95222803a38 - .quad 0x483bdab1595653fc - - // 2^12 * 6 * G - - .quad 0xfa780f148734fa49 - .quad 0x106f0b70360534e0 - .quad 0x2210776fe3e307bd - .quad 0x3286c109dde6a0fe - .quad 0xd6cf4d0ab4da80f6 - .quad 0x82483e45f8307fe0 - .quad 0x05005269ae6f9da4 - .quad 0x1c7052909cf7877a - .quad 0x32ee7de2874e98d4 - .quad 0x14c362e9b97e0c60 - .quad 0x5781dcde6a60a38a - .quad 0x217dd5eaaa7aa840 - - // 2^12 * 7 * G - - .quad 0x9db7c4d0248e1eb0 - .quad 0xe07697e14d74bf52 - .quad 0x1e6a9b173c562354 - .quad 0x7fa7c21f795a4965 - .quad 0x8bdf1fb9be8c0ec8 - .quad 0x00bae7f8e30a0282 - .quad 0x4963991dad6c4f6c - .quad 0x07058a6e5df6f60a - .quad 0xe9eb02c4db31f67f - .quad 0xed25fd8910bcfb2b - .quad 0x46c8131f5c5cddb4 - .quad 0x33b21c13a0cb9bce - - // 2^12 * 8 * G - - .quad 0x360692f8087d8e31 - .quad 0xf4dcc637d27163f7 - .quad 0x25a4e62065ea5963 - .quad 0x659bf72e5ac160d9 - .quad 0x9aafb9b05ee38c5b - .quad 0xbf9d2d4e071a13c7 - .quad 0x8eee6e6de933290a - .quad 0x1c3bab17ae109717 - .quad 0x1c9ab216c7cab7b0 - .quad 0x7d65d37407bbc3cc - .quad 0x52744750504a58d5 - .quad 0x09f2606b131a2990 - - // 2^16 * 1 * G - - .quad 0x40e87d44744346be - .quad 0x1d48dad415b52b25 - .quad 0x7c3a8a18a13b603e - .quad 0x4eb728c12fcdbdf7 - .quad 0x7e234c597c6691ae - .quad 0x64889d3d0a85b4c8 - .quad 0xdae2c90c354afae7 - .quad 0x0a871e070c6a9e1d - .quad 0x3301b5994bbc8989 - .quad 0x736bae3a5bdd4260 - .quad 0x0d61ade219d59e3c - .quad 0x3ee7300f2685d464 - - // 2^16 * 2 * G - - .quad 0xf5d255e49e7dd6b7 - .quad 0x8016115c610b1eac - .quad 0x3c99975d92e187ca - .quad 0x13815762979125c2 - .quad 0x43fa7947841e7518 - .quad 0xe5c6fa59639c46d7 - .quad 0xa1065e1de3052b74 - .quad 0x7d47c6a2cfb89030 - .quad 0x3fdad0148ef0d6e0 - .quad 0x9d3e749a91546f3c - .quad 0x71ec621026bb8157 - .quad 0x148cf58d34c9ec80 - - // 2^16 * 3 * G - - .quad 0x46a492f67934f027 - .quad 0x469984bef6840aa9 - .quad 0x5ca1bc2a89611854 - .quad 0x3ff2fa1ebd5dbbd4 - .quad 0xe2572f7d9ae4756d - .quad 0x56c345bb88f3487f - .quad 0x9fd10b6d6960a88d - .quad 0x278febad4eaea1b9 - .quad 0xb1aa681f8c933966 - .quad 0x8c21949c20290c98 - .quad 0x39115291219d3c52 - .quad 0x4104dd02fe9c677b - - // 2^16 * 4 * G - - .quad 0x72b2bf5e1124422a - .quad 0xa1fa0c3398a33ab5 - .quad 0x94cb6101fa52b666 - .quad 0x2c863b00afaf53d5 - .quad 0x81214e06db096ab8 - .quad 0x21a8b6c90ce44f35 - .quad 0x6524c12a409e2af5 - .quad 0x0165b5a48efca481 - .quad 0xf190a474a0846a76 - .quad 0x12eff984cd2f7cc0 - .quad 0x695e290658aa2b8f - .quad 0x591b67d9bffec8b8 - - // 2^16 * 5 * G - - .quad 0x312f0d1c80b49bfa - .quad 0x5979515eabf3ec8a - .quad 0x727033c09ef01c88 - .quad 0x3de02ec7ca8f7bcb - .quad 0x99b9b3719f18b55d - .quad 0xe465e5faa18c641e - .quad 0x61081136c29f05ed - .quad 0x489b4f867030128b - .quad 0xd232102d3aeb92ef - .quad 0xe16253b46116a861 - .quad 0x3d7eabe7190baa24 - .quad 0x49f5fbba496cbebf - - // 2^16 * 6 * G - - .quad 0x30949a108a5bcfd4 - .quad 0xdc40dd70bc6473eb - .quad 0x92c294c1307c0d1c - .quad 0x5604a86dcbfa6e74 - .quad 0x155d628c1e9c572e - .quad 0x8a4d86acc5884741 - .quad 0x91a352f6515763eb - .quad 0x06a1a6c28867515b - .quad 0x7288d1d47c1764b6 - .quad 0x72541140e0418b51 - .quad 0x9f031a6018acf6d1 - .quad 0x20989e89fe2742c6 - - // 2^16 * 7 * G - - .quad 0x499777fd3a2dcc7f - .quad 0x32857c2ca54fd892 - .quad 0xa279d864d207e3a0 - .quad 0x0403ed1d0ca67e29 - .quad 0x1674278b85eaec2e - .quad 0x5621dc077acb2bdf - .quad 0x640a4c1661cbf45a - .quad 0x730b9950f70595d3 - .quad 0xc94b2d35874ec552 - .quad 0xc5e6c8cf98246f8d - .quad 0xf7cb46fa16c035ce - .quad 0x5bd7454308303dcc - - // 2^16 * 8 * G - - .quad 0x7f9ad19528b24cc2 - .quad 0x7f6b54656335c181 - .quad 0x66b8b66e4fc07236 - .quad 0x133a78007380ad83 - .quad 0x85c4932115e7792a - .quad 0xc64c89a2bdcdddc9 - .quad 0x9d1e3da8ada3d762 - .quad 0x5bb7db123067f82c - .quad 0x0961f467c6ca62be - .quad 0x04ec21d6211952ee - .quad 0x182360779bd54770 - .quad 0x740dca6d58f0e0d2 - - // 2^20 * 1 * G - - .quad 0x50b70bf5d3f0af0b - .quad 0x4feaf48ae32e71f7 - .quad 0x60e84ed3a55bbd34 - .quad 0x00ed489b3f50d1ed - .quad 0x3906c72aed261ae5 - .quad 0x9ab68fd988e100f7 - .quad 0xf5e9059af3360197 - .quad 0x0e53dc78bf2b6d47 - .quad 0xb90829bf7971877a - .quad 0x5e4444636d17e631 - .quad 0x4d05c52e18276893 - .quad 0x27632d9a5a4a4af5 - - // 2^20 * 2 * G - - .quad 0xd11ff05154b260ce - .quad 0xd86dc38e72f95270 - .quad 0x601fcd0d267cc138 - .quad 0x2b67916429e90ccd - .quad 0xa98285d187eaffdb - .quad 0xa5b4fbbbd8d0a864 - .quad 0xb658f27f022663f7 - .quad 0x3bbc2b22d99ce282 - .quad 0xb917c952583c0a58 - .quad 0x653ff9b80fe4c6f3 - .quad 0x9b0da7d7bcdf3c0c - .quad 0x43a0eeb6ab54d60e - - // 2^20 * 3 * G - - .quad 0x396966a46d4a5487 - .quad 0xf811a18aac2bb3ba - .quad 0x66e4685b5628b26b - .quad 0x70a477029d929b92 - .quad 0x3ac6322357875fe8 - .quad 0xd9d4f4ecf5fbcb8f - .quad 0x8dee8493382bb620 - .quad 0x50c5eaa14c799fdc - .quad 0xdd0edc8bd6f2fb3c - .quad 0x54c63aa79cc7b7a0 - .quad 0xae0b032b2c8d9f1a - .quad 0x6f9ce107602967fb - - // 2^20 * 4 * G - - .quad 0xad1054b1cde1c22a - .quad 0xc4a8e90248eb32df - .quad 0x5f3e7b33accdc0ea - .quad 0x72364713fc79963e - .quad 0x139693063520e0b5 - .quad 0x437fcf7c88ea03fe - .quad 0xf7d4c40bd3c959bc - .quad 0x699154d1f893ded9 - .quad 0x315d5c75b4b27526 - .quad 0xcccb842d0236daa5 - .quad 0x22f0c8a3345fee8e - .quad 0x73975a617d39dbed - - // 2^20 * 5 * G - - .quad 0xe4024df96375da10 - .quad 0x78d3251a1830c870 - .quad 0x902b1948658cd91c - .quad 0x7e18b10b29b7438a - .quad 0x6f37f392f4433e46 - .quad 0x0e19b9a11f566b18 - .quad 0x220fb78a1fd1d662 - .quad 0x362a4258a381c94d - .quad 0x9071d9132b6beb2f - .quad 0x0f26e9ad28418247 - .quad 0xeab91ec9bdec925d - .quad 0x4be65bc8f48af2de - - // 2^20 * 6 * G - - .quad 0x78487feba36e7028 - .quad 0x5f3f13001dd8ce34 - .quad 0x934fb12d4b30c489 - .quad 0x056c244d397f0a2b - .quad 0x1d50fba257c26234 - .quad 0x7bd4823adeb0678b - .quad 0xc2b0dc6ea6538af5 - .quad 0x5665eec6351da73e - .quad 0xdb3ee00943bfb210 - .quad 0x4972018720800ac2 - .quad 0x26ab5d6173bd8667 - .quad 0x20b209c2ab204938 - - // 2^20 * 7 * G - - .quad 0x549e342ac07fb34b - .quad 0x02d8220821373d93 - .quad 0xbc262d70acd1f567 - .quad 0x7a92c9fdfbcac784 - .quad 0x1fcca94516bd3289 - .quad 0x448d65aa41420428 - .quad 0x59c3b7b216a55d62 - .quad 0x49992cc64e612cd8 - .quad 0x65bd1bea70f801de - .quad 0x1befb7c0fe49e28a - .quad 0xa86306cdb1b2ae4a - .quad 0x3b7ac0cd265c2a09 - - // 2^20 * 8 * G - - .quad 0x822bee438c01bcec - .quad 0x530cb525c0fbc73b - .quad 0x48519034c1953fe9 - .quad 0x265cc261e09a0f5b - .quad 0xf0d54e4f22ed39a7 - .quad 0xa2aae91e5608150a - .quad 0xf421b2e9eddae875 - .quad 0x31bc531d6b7de992 - .quad 0xdf3d134da980f971 - .quad 0x7a4fb8d1221a22a7 - .quad 0x3df7d42035aad6d8 - .quad 0x2a14edcc6a1a125e - - // 2^24 * 1 * G - - .quad 0xdf48ee0752cfce4e - .quad 0xc3fffaf306ec08b7 - .quad 0x05710b2ab95459c4 - .quad 0x161d25fa963ea38d - .quad 0x231a8c570478433c - .quad 0xb7b5270ec281439d - .quad 0xdbaa99eae3d9079f - .quad 0x2c03f5256c2b03d9 - .quad 0x790f18757b53a47d - .quad 0x307b0130cf0c5879 - .quad 0x31903d77257ef7f9 - .quad 0x699468bdbd96bbaf - - // 2^24 * 2 * G - - .quad 0xbd1f2f46f4dafecf - .quad 0x7cef0114a47fd6f7 - .quad 0xd31ffdda4a47b37f - .quad 0x525219a473905785 - .quad 0xd8dd3de66aa91948 - .quad 0x485064c22fc0d2cc - .quad 0x9b48246634fdea2f - .quad 0x293e1c4e6c4a2e3a - .quad 0x376e134b925112e1 - .quad 0x703778b5dca15da0 - .quad 0xb04589af461c3111 - .quad 0x5b605c447f032823 - - // 2^24 * 3 * G - - .quad 0xb965805920c47c89 - .quad 0xe7f0100c923b8fcc - .quad 0x0001256502e2ef77 - .quad 0x24a76dcea8aeb3ee - .quad 0x3be9fec6f0e7f04c - .quad 0x866a579e75e34962 - .quad 0x5542ef161e1de61a - .quad 0x2f12fef4cc5abdd5 - .quad 0x0a4522b2dfc0c740 - .quad 0x10d06e7f40c9a407 - .quad 0xc6cf144178cff668 - .quad 0x5e607b2518a43790 - - // 2^24 * 4 * G - - .quad 0x58b31d8f6cdf1818 - .quad 0x35cfa74fc36258a2 - .quad 0xe1b3ff4f66e61d6e - .quad 0x5067acab6ccdd5f7 - .quad 0xa02c431ca596cf14 - .quad 0xe3c42d40aed3e400 - .quad 0xd24526802e0f26db - .quad 0x201f33139e457068 - .quad 0xfd527f6b08039d51 - .quad 0x18b14964017c0006 - .quad 0xd5220eb02e25a4a8 - .quad 0x397cba8862460375 - - // 2^24 * 5 * G - - .quad 0x30c13093f05959b2 - .quad 0xe23aa18de9a97976 - .quad 0x222fd491721d5e26 - .quad 0x2339d320766e6c3a - .quad 0x7815c3fbc81379e7 - .quad 0xa6619420dde12af1 - .quad 0xffa9c0f885a8fdd5 - .quad 0x771b4022c1e1c252 - .quad 0xd87dd986513a2fa7 - .quad 0xf5ac9b71f9d4cf08 - .quad 0xd06bc31b1ea283b3 - .quad 0x331a189219971a76 - - // 2^24 * 6 * G - - .quad 0xf5166f45fb4f80c6 - .quad 0x9c36c7de61c775cf - .quad 0xe3d4e81b9041d91c - .quad 0x31167c6b83bdfe21 - .quad 0x26512f3a9d7572af - .quad 0x5bcbe28868074a9e - .quad 0x84edc1c11180f7c4 - .quad 0x1ac9619ff649a67b - .quad 0xf22b3842524b1068 - .quad 0x5068343bee9ce987 - .quad 0xfc9d71844a6250c8 - .quad 0x612436341f08b111 - - // 2^24 * 7 * G - - .quad 0xd99d41db874e898d - .quad 0x09fea5f16c07dc20 - .quad 0x793d2c67d00f9bbc - .quad 0x46ebe2309e5eff40 - .quad 0x8b6349e31a2d2638 - .quad 0x9ddfb7009bd3fd35 - .quad 0x7f8bf1b8a3a06ba4 - .quad 0x1522aa3178d90445 - .quad 0x2c382f5369614938 - .quad 0xdafe409ab72d6d10 - .quad 0xe8c83391b646f227 - .quad 0x45fe70f50524306c - - // 2^24 * 8 * G - - .quad 0xda4875a6960c0b8c - .quad 0x5b68d076ef0e2f20 - .quad 0x07fb51cf3d0b8fd4 - .quad 0x428d1623a0e392d4 - .quad 0x62f24920c8951491 - .quad 0x05f007c83f630ca2 - .quad 0x6fbb45d2f5c9d4b8 - .quad 0x16619f6db57a2245 - .quad 0x084f4a4401a308fd - .quad 0xa82219c376a5caac - .quad 0xdeb8de4643d1bc7d - .quad 0x1d81592d60bd38c6 - - // 2^28 * 1 * G - - .quad 0xd833d7beec2a4c38 - .quad 0x2c9162830acc20ed - .quad 0xe93a47aa92df7581 - .quad 0x702d67a3333c4a81 - .quad 0x3a4a369a2f89c8a1 - .quad 0x63137a1d7c8de80d - .quad 0xbcac008a78eda015 - .quad 0x2cb8b3a5b483b03f - .quad 0x36e417cbcb1b90a1 - .quad 0x33b3ddaa7f11794e - .quad 0x3f510808885bc607 - .quad 0x24141dc0e6a8020d - - // 2^28 * 2 * G - - .quad 0x59f73c773fefee9d - .quad 0xb3f1ef89c1cf989d - .quad 0xe35dfb42e02e545f - .quad 0x5766120b47a1b47c - .quad 0x91925dccbd83157d - .quad 0x3ca1205322cc8094 - .quad 0x28e57f183f90d6e4 - .quad 0x1a4714cede2e767b - .quad 0xdb20ba0fb8b6b7ff - .quad 0xb732c3b677511fa1 - .quad 0xa92b51c099f02d89 - .quad 0x4f3875ad489ca5f1 - - // 2^28 * 3 * G - - .quad 0xc7fc762f4932ab22 - .quad 0x7ac0edf72f4c3c1b - .quad 0x5f6b55aa9aa895e8 - .quad 0x3680274dad0a0081 - .quad 0x79ed13f6ee73eec0 - .quad 0xa5c6526d69110bb1 - .quad 0xe48928c38603860c - .quad 0x722a1446fd7059f5 - .quad 0xd0959fe9a8cf8819 - .quad 0xd0a995508475a99c - .quad 0x6eac173320b09cc5 - .quad 0x628ecf04331b1095 - - // 2^28 * 4 * G - - .quad 0x98bcb118a9d0ddbc - .quad 0xee449e3408b4802b - .quad 0x87089226b8a6b104 - .quad 0x685f349a45c7915d - .quad 0x9b41acf85c74ccf1 - .quad 0xb673318108265251 - .quad 0x99c92aed11adb147 - .quad 0x7a47d70d34ecb40f - .quad 0x60a0c4cbcc43a4f5 - .quad 0x775c66ca3677bea9 - .quad 0xa17aa1752ff8f5ed - .quad 0x11ded9020e01fdc0 - - // 2^28 * 5 * G - - .quad 0x890e7809caefe704 - .quad 0x8728296de30e8c6c - .quad 0x4c5cd2a392aeb1c9 - .quad 0x194263d15771531f - .quad 0x471f95b03bea93b7 - .quad 0x0552d7d43313abd3 - .quad 0xbd9370e2e17e3f7b - .quad 0x7b120f1db20e5bec - .quad 0x17d2fb3d86502d7a - .quad 0xb564d84450a69352 - .quad 0x7da962c8a60ed75d - .quad 0x00d0f85b318736aa - - // 2^28 * 6 * G - - .quad 0x978b142e777c84fd - .quad 0xf402644705a8c062 - .quad 0xa67ad51be7e612c7 - .quad 0x2f7b459698dd6a33 - .quad 0xa6753c1efd7621c1 - .quad 0x69c0b4a7445671f5 - .quad 0x971f527405b23c11 - .quad 0x387bc74851a8c7cd - .quad 0x81894b4d4a52a9a8 - .quad 0xadd93e12f6b8832f - .quad 0x184d8548b61bd638 - .quad 0x3f1c62dbd6c9f6cd - - // 2^28 * 7 * G - - .quad 0x2e8f1f0091910c1f - .quad 0xa4df4fe0bff2e12c - .quad 0x60c6560aee927438 - .quad 0x6338283facefc8fa - .quad 0x3fad3e40148f693d - .quad 0x052656e194eb9a72 - .quad 0x2f4dcbfd184f4e2f - .quad 0x406f8db1c482e18b - .quad 0x9e630d2c7f191ee4 - .quad 0x4fbf8301bc3ff670 - .quad 0x787d8e4e7afb73c4 - .quad 0x50d83d5be8f58fa5 - - // 2^28 * 8 * G - - .quad 0x85683916c11a1897 - .quad 0x2d69a4efe506d008 - .quad 0x39af1378f664bd01 - .quad 0x65942131361517c6 - .quad 0xc0accf90b4d3b66d - .quad 0xa7059de561732e60 - .quad 0x033d1f7870c6b0ba - .quad 0x584161cd26d946e4 - .quad 0xbbf2b1a072d27ca2 - .quad 0xbf393c59fbdec704 - .quad 0xe98dbbcee262b81e - .quad 0x02eebd0b3029b589 - - // 2^32 * 1 * G - - .quad 0x61368756a60dac5f - .quad 0x17e02f6aebabdc57 - .quad 0x7f193f2d4cce0f7d - .quad 0x20234a7789ecdcf0 - .quad 0x8765b69f7b85c5e8 - .quad 0x6ff0678bd168bab2 - .quad 0x3a70e77c1d330f9b - .quad 0x3a5f6d51b0af8e7c - .quad 0x76d20db67178b252 - .quad 0x071c34f9d51ed160 - .quad 0xf62a4a20b3e41170 - .quad 0x7cd682353cffe366 - - // 2^32 * 2 * G - - .quad 0x0be1a45bd887fab6 - .quad 0x2a846a32ba403b6e - .quad 0xd9921012e96e6000 - .quad 0x2838c8863bdc0943 - .quad 0xa665cd6068acf4f3 - .quad 0x42d92d183cd7e3d3 - .quad 0x5759389d336025d9 - .quad 0x3ef0253b2b2cd8ff - .quad 0xd16bb0cf4a465030 - .quad 0xfa496b4115c577ab - .quad 0x82cfae8af4ab419d - .quad 0x21dcb8a606a82812 - - // 2^32 * 3 * G - - .quad 0x5c6004468c9d9fc8 - .quad 0x2540096ed42aa3cb - .quad 0x125b4d4c12ee2f9c - .quad 0x0bc3d08194a31dab - .quad 0x9a8d00fabe7731ba - .quad 0x8203607e629e1889 - .quad 0xb2cc023743f3d97f - .quad 0x5d840dbf6c6f678b - .quad 0x706e380d309fe18b - .quad 0x6eb02da6b9e165c7 - .quad 0x57bbba997dae20ab - .quad 0x3a4276232ac196dd - - // 2^32 * 4 * G - - .quad 0x4b42432c8a7084fa - .quad 0x898a19e3dfb9e545 - .quad 0xbe9f00219c58e45d - .quad 0x1ff177cea16debd1 - .quad 0x3bf8c172db447ecb - .quad 0x5fcfc41fc6282dbd - .quad 0x80acffc075aa15fe - .quad 0x0770c9e824e1a9f9 - .quad 0xcf61d99a45b5b5fd - .quad 0x860984e91b3a7924 - .quad 0xe7300919303e3e89 - .quad 0x39f264fd41500b1e - - // 2^32 * 5 * G - - .quad 0xa7ad3417dbe7e29c - .quad 0xbd94376a2b9c139c - .quad 0xa0e91b8e93597ba9 - .quad 0x1712d73468889840 - .quad 0xd19b4aabfe097be1 - .quad 0xa46dfce1dfe01929 - .quad 0xc3c908942ca6f1ff - .quad 0x65c621272c35f14e - .quad 0xe72b89f8ce3193dd - .quad 0x4d103356a125c0bb - .quad 0x0419a93d2e1cfe83 - .quad 0x22f9800ab19ce272 - - // 2^32 * 6 * G - - .quad 0x605a368a3e9ef8cb - .quad 0xe3e9c022a5504715 - .quad 0x553d48b05f24248f - .quad 0x13f416cd647626e5 - .quad 0x42029fdd9a6efdac - .quad 0xb912cebe34a54941 - .quad 0x640f64b987bdf37b - .quad 0x4171a4d38598cab4 - .quad 0xfa2758aa99c94c8c - .quad 0x23006f6fb000b807 - .quad 0xfbd291ddadda5392 - .quad 0x508214fa574bd1ab - - // 2^32 * 7 * G - - .quad 0xc20269153ed6fe4b - .quad 0xa65a6739511d77c4 - .quad 0xcbde26462c14af94 - .quad 0x22f960ec6faba74b - .quad 0x461a15bb53d003d6 - .quad 0xb2102888bcf3c965 - .quad 0x27c576756c683a5a - .quad 0x3a7758a4c86cb447 - .quad 0x548111f693ae5076 - .quad 0x1dae21df1dfd54a6 - .quad 0x12248c90f3115e65 - .quad 0x5d9fd15f8de7f494 - - // 2^32 * 8 * G - - .quad 0x031408d36d63727f - .quad 0x6a379aefd7c7b533 - .quad 0xa9e18fc5ccaee24b - .quad 0x332f35914f8fbed3 - .quad 0x3f244d2aeed7521e - .quad 0x8e3a9028432e9615 - .quad 0xe164ba772e9c16d4 - .quad 0x3bc187fa47eb98d8 - .quad 0x6d470115ea86c20c - .quad 0x998ab7cb6c46d125 - .quad 0xd77832b53a660188 - .quad 0x450d81ce906fba03 - - // 2^36 * 1 * G - - .quad 0xf8ae4d2ad8453902 - .quad 0x7018058ee8db2d1d - .quad 0xaab3995fc7d2c11e - .quad 0x53b16d2324ccca79 - .quad 0x23264d66b2cae0b5 - .quad 0x7dbaed33ebca6576 - .quad 0x030ebed6f0d24ac8 - .quad 0x2a887f78f7635510 - .quad 0x2a23b9e75c012d4f - .quad 0x0c974651cae1f2ea - .quad 0x2fb63273675d70ca - .quad 0x0ba7250b864403f5 - - // 2^36 * 2 * G - - .quad 0xbb0d18fd029c6421 - .quad 0xbc2d142189298f02 - .quad 0x8347f8e68b250e96 - .quad 0x7b9f2fe8032d71c9 - .quad 0xdd63589386f86d9c - .quad 0x61699176e13a85a4 - .quad 0x2e5111954eaa7d57 - .quad 0x32c21b57fb60bdfb - .quad 0xd87823cd319e0780 - .quad 0xefc4cfc1897775c5 - .quad 0x4854fb129a0ab3f7 - .quad 0x12c49d417238c371 - - // 2^36 * 3 * G - - .quad 0x0950b533ffe83769 - .quad 0x21861c1d8e1d6bd1 - .quad 0xf022d8381302e510 - .quad 0x2509200c6391cab4 - .quad 0x09b3a01783799542 - .quad 0x626dd08faad5ee3f - .quad 0xba00bceeeb70149f - .quad 0x1421b246a0a444c9 - .quad 0x4aa43a8e8c24a7c7 - .quad 0x04c1f540d8f05ef5 - .quad 0xadba5e0c0b3eb9dc - .quad 0x2ab5504448a49ce3 - - // 2^36 * 4 * G - - .quad 0x2ed227266f0f5dec - .quad 0x9824ee415ed50824 - .quad 0x807bec7c9468d415 - .quad 0x7093bae1b521e23f - .quad 0xdc07ac631c5d3afa - .quad 0x58615171f9df8c6c - .quad 0x72a079d89d73e2b0 - .quad 0x7301f4ceb4eae15d - .quad 0x6409e759d6722c41 - .quad 0xa674e1cf72bf729b - .quad 0xbc0a24eb3c21e569 - .quad 0x390167d24ebacb23 - - // 2^36 * 5 * G - - .quad 0x27f58e3bba353f1c - .quad 0x4c47764dbf6a4361 - .quad 0xafbbc4e56e562650 - .quad 0x07db2ee6aae1a45d - .quad 0xd7bb054ba2f2120b - .quad 0xe2b9ceaeb10589b7 - .quad 0x3fe8bac8f3c0edbe - .quad 0x4cbd40767112cb69 - .quad 0x0b603cc029c58176 - .quad 0x5988e3825cb15d61 - .quad 0x2bb61413dcf0ad8d - .quad 0x7b8eec6c74183287 - - // 2^36 * 6 * G - - .quad 0xe4ca40782cd27cb0 - .quad 0xdaf9c323fbe967bd - .quad 0xb29bd34a8ad41e9e - .quad 0x72810497626ede4d - .quad 0x32fee570fc386b73 - .quad 0xda8b0141da3a8cc7 - .quad 0x975ffd0ac8968359 - .quad 0x6ee809a1b132a855 - .quad 0x9444bb31fcfd863a - .quad 0x2fe3690a3e4e48c5 - .quad 0xdc29c867d088fa25 - .quad 0x13bd1e38d173292e - - // 2^36 * 7 * G - - .quad 0xd32b4cd8696149b5 - .quad 0xe55937d781d8aab7 - .quad 0x0bcb2127ae122b94 - .quad 0x41e86fcfb14099b0 - .quad 0x223fb5cf1dfac521 - .quad 0x325c25316f554450 - .quad 0x030b98d7659177ac - .quad 0x1ed018b64f88a4bd - .quad 0x3630dfa1b802a6b0 - .quad 0x880f874742ad3bd5 - .quad 0x0af90d6ceec5a4d4 - .quad 0x746a247a37cdc5d9 - - // 2^36 * 8 * G - - .quad 0xd531b8bd2b7b9af6 - .quad 0x5005093537fc5b51 - .quad 0x232fcf25c593546d - .quad 0x20a365142bb40f49 - .quad 0x6eccd85278d941ed - .quad 0x2254ae83d22f7843 - .quad 0xc522d02e7bbfcdb7 - .quad 0x681e3351bff0e4e2 - .quad 0x8b64b59d83034f45 - .quad 0x2f8b71f21fa20efb - .quad 0x69249495ba6550e4 - .quad 0x539ef98e45d5472b - - // 2^40 * 1 * G - - .quad 0x6e7bb6a1a6205275 - .quad 0xaa4f21d7413c8e83 - .quad 0x6f56d155e88f5cb2 - .quad 0x2de25d4ba6345be1 - .quad 0xd074d8961cae743f - .quad 0xf86d18f5ee1c63ed - .quad 0x97bdc55be7f4ed29 - .quad 0x4cbad279663ab108 - .quad 0x80d19024a0d71fcd - .quad 0xc525c20afb288af8 - .quad 0xb1a3974b5f3a6419 - .quad 0x7d7fbcefe2007233 - - // 2^40 * 2 * G - - .quad 0xfaef1e6a266b2801 - .quad 0x866c68c4d5739f16 - .quad 0xf68a2fbc1b03762c - .quad 0x5975435e87b75a8d - .quad 0xcd7c5dc5f3c29094 - .quad 0xc781a29a2a9105ab - .quad 0x80c61d36421c3058 - .quad 0x4f9cd196dcd8d4d7 - .quad 0x199297d86a7b3768 - .quad 0xd0d058241ad17a63 - .quad 0xba029cad5c1c0c17 - .quad 0x7ccdd084387a0307 - - // 2^40 * 3 * G - - .quad 0xdca6422c6d260417 - .quad 0xae153d50948240bd - .quad 0xa9c0c1b4fb68c677 - .quad 0x428bd0ed61d0cf53 - .quad 0x9b0c84186760cc93 - .quad 0xcdae007a1ab32a99 - .quad 0xa88dec86620bda18 - .quad 0x3593ca848190ca44 - .quad 0x9213189a5e849aa7 - .quad 0xd4d8c33565d8facd - .quad 0x8c52545b53fdbbd1 - .quad 0x27398308da2d63e6 - - // 2^40 * 4 * G - - .quad 0x42c38d28435ed413 - .quad 0xbd50f3603278ccc9 - .quad 0xbb07ab1a79da03ef - .quad 0x269597aebe8c3355 - .quad 0xb9a10e4c0a702453 - .quad 0x0fa25866d57d1bde - .quad 0xffb9d9b5cd27daf7 - .quad 0x572c2945492c33fd - .quad 0xc77fc745d6cd30be - .quad 0xe4dfe8d3e3baaefb - .quad 0xa22c8830aa5dda0c - .quad 0x7f985498c05bca80 - - // 2^40 * 5 * G - - .quad 0x3849ce889f0be117 - .quad 0x8005ad1b7b54a288 - .quad 0x3da3c39f23fc921c - .quad 0x76c2ec470a31f304 - .quad 0xd35615520fbf6363 - .quad 0x08045a45cf4dfba6 - .quad 0xeec24fbc873fa0c2 - .quad 0x30f2653cd69b12e7 - .quad 0x8a08c938aac10c85 - .quad 0x46179b60db276bcb - .quad 0xa920c01e0e6fac70 - .quad 0x2f1273f1596473da - - // 2^40 * 6 * G - - .quad 0x4739fc7c8ae01e11 - .quad 0xfd5274904a6aab9f - .quad 0x41d98a8287728f2e - .quad 0x5d9e572ad85b69f2 - .quad 0x30488bd755a70bc0 - .quad 0x06d6b5a4f1d442e7 - .quad 0xead1a69ebc596162 - .quad 0x38ac1997edc5f784 - .quad 0x0666b517a751b13b - .quad 0x747d06867e9b858c - .quad 0xacacc011454dde49 - .quad 0x22dfcd9cbfe9e69c - - // 2^40 * 7 * G - - .quad 0x8ddbd2e0c30d0cd9 - .quad 0xad8e665facbb4333 - .quad 0x8f6b258c322a961f - .quad 0x6b2916c05448c1c7 - .quad 0x56ec59b4103be0a1 - .quad 0x2ee3baecd259f969 - .quad 0x797cb29413f5cd32 - .quad 0x0fe9877824cde472 - .quad 0x7edb34d10aba913b - .quad 0x4ea3cd822e6dac0e - .quad 0x66083dff6578f815 - .quad 0x4c303f307ff00a17 - - // 2^40 * 8 * G - - .quad 0xd30a3bd617b28c85 - .quad 0xc5d377b739773bea - .quad 0xc6c6e78c1e6a5cbf - .quad 0x0d61b8f78b2ab7c4 - .quad 0x29fc03580dd94500 - .quad 0xecd27aa46fbbec93 - .quad 0x130a155fc2e2a7f8 - .quad 0x416b151ab706a1d5 - .quad 0x56a8d7efe9c136b0 - .quad 0xbd07e5cd58e44b20 - .quad 0xafe62fda1b57e0ab - .quad 0x191a2af74277e8d2 - - // 2^44 * 1 * G - - .quad 0xd550095bab6f4985 - .quad 0x04f4cd5b4fbfaf1a - .quad 0x9d8e2ed12a0c7540 - .quad 0x2bc24e04b2212286 - .quad 0x09d4b60b2fe09a14 - .quad 0xc384f0afdbb1747e - .quad 0x58e2ea8978b5fd6e - .quad 0x519ef577b5e09b0a - .quad 0x1863d7d91124cca9 - .quad 0x7ac08145b88a708e - .quad 0x2bcd7309857031f5 - .quad 0x62337a6e8ab8fae5 - - // 2^44 * 2 * G - - .quad 0x4bcef17f06ffca16 - .quad 0xde06e1db692ae16a - .quad 0x0753702d614f42b0 - .quad 0x5f6041b45b9212d0 - .quad 0xd1ab324e1b3a1273 - .quad 0x18947cf181055340 - .quad 0x3b5d9567a98c196e - .quad 0x7fa00425802e1e68 - .quad 0x7d531574028c2705 - .quad 0x80317d69db0d75fe - .quad 0x30fface8ef8c8ddd - .quad 0x7e9de97bb6c3e998 - - // 2^44 * 3 * G - - .quad 0x1558967b9e6585a3 - .quad 0x97c99ce098e98b92 - .quad 0x10af149b6eb3adad - .quad 0x42181fe8f4d38cfa - .quad 0xf004be62a24d40dd - .quad 0xba0659910452d41f - .quad 0x81c45ee162a44234 - .quad 0x4cb829d8a22266ef - .quad 0x1dbcaa8407b86681 - .quad 0x081f001e8b26753b - .quad 0x3cd7ce6a84048e81 - .quad 0x78af11633f25f22c - - // 2^44 * 4 * G - - .quad 0x8416ebd40b50babc - .quad 0x1508722628208bee - .quad 0xa3148fafb9c1c36d - .quad 0x0d07daacd32d7d5d - .quad 0x3241c00e7d65318c - .quad 0xe6bee5dcd0e86de7 - .quad 0x118b2dc2fbc08c26 - .quad 0x680d04a7fc603dc3 - .quad 0xf9c2414a695aa3eb - .quad 0xdaa42c4c05a68f21 - .quad 0x7c6c23987f93963e - .quad 0x210e8cd30c3954e3 - - // 2^44 * 5 * G - - .quad 0xac4201f210a71c06 - .quad 0x6a65e0aef3bfb021 - .quad 0xbc42c35c393632f7 - .quad 0x56ea8db1865f0742 - .quad 0x2b50f16137fe6c26 - .quad 0xe102bcd856e404d8 - .quad 0x12b0f1414c561f6b - .quad 0x51b17bc8d028ec91 - .quad 0xfff5fb4bcf535119 - .quad 0xf4989d79df1108a0 - .quad 0xbdfcea659a3ba325 - .quad 0x18a11f1174d1a6f2 - - // 2^44 * 6 * G - - .quad 0x407375ab3f6bba29 - .quad 0x9ec3b6d8991e482e - .quad 0x99c80e82e55f92e9 - .quad 0x307c13b6fb0c0ae1 - .quad 0xfbd63cdad27a5f2c - .quad 0xf00fc4bc8aa106d7 - .quad 0x53fb5c1a8e64a430 - .quad 0x04eaabe50c1a2e85 - .quad 0x24751021cb8ab5e7 - .quad 0xfc2344495c5010eb - .quad 0x5f1e717b4e5610a1 - .quad 0x44da5f18c2710cd5 - - // 2^44 * 7 * G - - .quad 0x033cc55ff1b82eb5 - .quad 0xb15ae36d411cae52 - .quad 0xba40b6198ffbacd3 - .quad 0x768edce1532e861f - .quad 0x9156fe6b89d8eacc - .quad 0xe6b79451e23126a1 - .quad 0xbd7463d93944eb4e - .quad 0x726373f6767203ae - .quad 0xe305ca72eb7ef68a - .quad 0x662cf31f70eadb23 - .quad 0x18f026fdb4c45b68 - .quad 0x513b5384b5d2ecbd - - // 2^44 * 8 * G - - .quad 0x46d46280c729989e - .quad 0x4b93fbd05368a5dd - .quad 0x63df3f81d1765a89 - .quad 0x34cebd64b9a0a223 - .quad 0x5e2702878af34ceb - .quad 0x900b0409b946d6ae - .quad 0x6512ebf7dabd8512 - .quad 0x61d9b76988258f81 - .quad 0xa6c5a71349b7d94b - .quad 0xa3f3d15823eb9446 - .quad 0x0416fbd277484834 - .quad 0x69d45e6f2c70812f - - // 2^48 * 1 * G - - .quad 0xce16f74bc53c1431 - .quad 0x2b9725ce2072edde - .quad 0xb8b9c36fb5b23ee7 - .quad 0x7e2e0e450b5cc908 - .quad 0x9fe62b434f460efb - .quad 0xded303d4a63607d6 - .quad 0xf052210eb7a0da24 - .quad 0x237e7dbe00545b93 - .quad 0x013575ed6701b430 - .quad 0x231094e69f0bfd10 - .quad 0x75320f1583e47f22 - .quad 0x71afa699b11155e3 - - // 2^48 * 2 * G - - .quad 0x65ce6f9b3953b61d - .quad 0xc65839eaafa141e6 - .quad 0x0f435ffda9f759fe - .quad 0x021142e9c2b1c28e - .quad 0xea423c1c473b50d6 - .quad 0x51e87a1f3b38ef10 - .quad 0x9b84bf5fb2c9be95 - .quad 0x00731fbc78f89a1c - .quad 0xe430c71848f81880 - .quad 0xbf960c225ecec119 - .quad 0xb6dae0836bba15e3 - .quad 0x4c4d6f3347e15808 - - // 2^48 * 3 * G - - .quad 0x18f7eccfc17d1fc9 - .quad 0x6c75f5a651403c14 - .quad 0xdbde712bf7ee0cdf - .quad 0x193fddaaa7e47a22 - .quad 0x2f0cddfc988f1970 - .quad 0x6b916227b0b9f51b - .quad 0x6ec7b6c4779176be - .quad 0x38bf9500a88f9fa8 - .quad 0x1fd2c93c37e8876f - .quad 0xa2f61e5a18d1462c - .quad 0x5080f58239241276 - .quad 0x6a6fb99ebf0d4969 - - // 2^48 * 4 * G - - .quad 0x6a46c1bb560855eb - .quad 0x2416bb38f893f09d - .quad 0xd71d11378f71acc1 - .quad 0x75f76914a31896ea - .quad 0xeeb122b5b6e423c6 - .quad 0x939d7010f286ff8e - .quad 0x90a92a831dcf5d8c - .quad 0x136fda9f42c5eb10 - .quad 0xf94cdfb1a305bdd1 - .quad 0x0f364b9d9ff82c08 - .quad 0x2a87d8a5c3bb588a - .quad 0x022183510be8dcba - - // 2^48 * 5 * G - - .quad 0x4af766385ead2d14 - .quad 0xa08ed880ca7c5830 - .quad 0x0d13a6e610211e3d - .quad 0x6a071ce17b806c03 - .quad 0x9d5a710143307a7f - .quad 0xb063de9ec47da45f - .quad 0x22bbfe52be927ad3 - .quad 0x1387c441fd40426c - .quad 0xb5d3c3d187978af8 - .quad 0x722b5a3d7f0e4413 - .quad 0x0d7b4848bb477ca0 - .quad 0x3171b26aaf1edc92 - - // 2^48 * 6 * G - - .quad 0xa92f319097564ca8 - .quad 0xff7bb84c2275e119 - .quad 0x4f55fe37a4875150 - .quad 0x221fd4873cf0835a - .quad 0xa60db7d8b28a47d1 - .quad 0xa6bf14d61770a4f1 - .quad 0xd4a1f89353ddbd58 - .quad 0x6c514a63344243e9 - .quad 0x2322204f3a156341 - .quad 0xfb73e0e9ba0a032d - .quad 0xfce0dd4c410f030e - .quad 0x48daa596fb924aaa - - // 2^48 * 7 * G - - .quad 0x6eca8e665ca59cc7 - .quad 0xa847254b2e38aca0 - .quad 0x31afc708d21e17ce - .quad 0x676dd6fccad84af7 - .quad 0x14f61d5dc84c9793 - .quad 0x9941f9e3ef418206 - .quad 0xcdf5b88f346277ac - .quad 0x58c837fa0e8a79a9 - .quad 0x0cf9688596fc9058 - .quad 0x1ddcbbf37b56a01b - .quad 0xdcc2e77d4935d66a - .quad 0x1c4f73f2c6a57f0a - - // 2^48 * 8 * G - - .quad 0x0e7a4fbd305fa0bb - .quad 0x829d4ce054c663ad - .quad 0xf421c3832fe33848 - .quad 0x795ac80d1bf64c42 - .quad 0xb36e706efc7c3484 - .quad 0x73dfc9b4c3c1cf61 - .quad 0xeb1d79c9781cc7e5 - .quad 0x70459adb7daf675c - .quad 0x1b91db4991b42bb3 - .quad 0x572696234b02dcca - .quad 0x9fdf9ee51f8c78dc - .quad 0x5fe162848ce21fd3 - - // 2^52 * 1 * G - - .quad 0xe2790aae4d077c41 - .quad 0x8b938270db7469a3 - .quad 0x6eb632dc8abd16a2 - .quad 0x720814ecaa064b72 - .quad 0x315c29c795115389 - .quad 0xd7e0e507862f74ce - .quad 0x0c4a762185927432 - .quad 0x72de6c984a25a1e4 - .quad 0xae9ab553bf6aa310 - .quad 0x050a50a9806d6e1b - .quad 0x92bb7403adff5139 - .quad 0x0394d27645be618b - - // 2^52 * 2 * G - - .quad 0x4d572251857eedf4 - .quad 0xe3724edde19e93c5 - .quad 0x8a71420e0b797035 - .quad 0x3b3c833687abe743 - .quad 0xf5396425b23545a4 - .quad 0x15a7a27e98fbb296 - .quad 0xab6c52bc636fdd86 - .quad 0x79d995a8419334ee - .quad 0xcd8a8ea61195dd75 - .quad 0xa504d8a81dd9a82f - .quad 0x540dca81a35879b6 - .quad 0x60dd16a379c86a8a - - // 2^52 * 3 * G - - .quad 0x35a2c8487381e559 - .quad 0x596ffea6d78082cb - .quad 0xcb9771ebdba7b653 - .quad 0x5a08b5019b4da685 - .quad 0x3501d6f8153e47b8 - .quad 0xb7a9675414a2f60c - .quad 0x112ee8b6455d9523 - .quad 0x4e62a3c18112ea8a - .quad 0xc8d4ac04516ab786 - .quad 0x595af3215295b23d - .quad 0xd6edd234db0230c1 - .quad 0x0929efe8825b41cc - - // 2^52 * 4 * G - - .quad 0x5f0601d1cbd0f2d3 - .quad 0x736e412f6132bb7f - .quad 0x83604432238dde87 - .quad 0x1e3a5272f5c0753c - .quad 0x8b3172b7ad56651d - .quad 0x01581b7a3fabd717 - .quad 0x2dc94df6424df6e4 - .quad 0x30376e5d2c29284f - .quad 0xd2918da78159a59c - .quad 0x6bdc1cd93f0713f3 - .quad 0x565f7a934acd6590 - .quad 0x53daacec4cb4c128 - - // 2^52 * 5 * G - - .quad 0x4ca73bd79cc8a7d6 - .quad 0x4d4a738f47e9a9b2 - .quad 0xf4cbf12942f5fe00 - .quad 0x01a13ff9bdbf0752 - .quad 0x99852bc3852cfdb0 - .quad 0x2cc12e9559d6ed0b - .quad 0x70f9e2bf9b5ac27b - .quad 0x4f3b8c117959ae99 - .quad 0x55b6c9c82ff26412 - .quad 0x1ac4a8c91fb667a8 - .quad 0xd527bfcfeb778bf2 - .quad 0x303337da7012a3be - - // 2^52 * 6 * G - - .quad 0x955422228c1c9d7c - .quad 0x01fac1371a9b340f - .quad 0x7e8d9177925b48d7 - .quad 0x53f8ad5661b3e31b - .quad 0x976d3ccbfad2fdd1 - .quad 0xcb88839737a640a8 - .quad 0x2ff00c1d6734cb25 - .quad 0x269ff4dc789c2d2b - .quad 0x0c003fbdc08d678d - .quad 0x4d982fa37ead2b17 - .quad 0xc07e6bcdb2e582f1 - .quad 0x296c7291df412a44 - - // 2^52 * 7 * G - - .quad 0x7903de2b33daf397 - .quad 0xd0ff0619c9a624b3 - .quad 0x8a1d252b555b3e18 - .quad 0x2b6d581c52e0b7c0 - .quad 0xdfb23205dab8b59e - .quad 0x465aeaa0c8092250 - .quad 0xd133c1189a725d18 - .quad 0x2327370261f117d1 - .quad 0x3d0543d3623e7986 - .quad 0x679414c2c278a354 - .quad 0xae43f0cc726196f6 - .quad 0x7836c41f8245eaba - - // 2^52 * 8 * G - - .quad 0xe7a254db49e95a81 - .quad 0x5192d5d008b0ad73 - .quad 0x4d20e5b1d00afc07 - .quad 0x5d55f8012cf25f38 - .quad 0xca651e848011937c - .quad 0xc6b0c46e6ef41a28 - .quad 0xb7021ba75f3f8d52 - .quad 0x119dff99ead7b9fd - .quad 0x43eadfcbf4b31d4d - .quad 0xc6503f7411148892 - .quad 0xfeee68c5060d3b17 - .quad 0x329293b3dd4a0ac8 - - // 2^56 * 1 * G - - .quad 0x4e59214fe194961a - .quad 0x49be7dc70d71cd4f - .quad 0x9300cfd23b50f22d - .quad 0x4789d446fc917232 - .quad 0x2879852d5d7cb208 - .quad 0xb8dedd70687df2e7 - .quad 0xdc0bffab21687891 - .quad 0x2b44c043677daa35 - .quad 0x1a1c87ab074eb78e - .quad 0xfac6d18e99daf467 - .quad 0x3eacbbcd484f9067 - .quad 0x60c52eef2bb9a4e4 - - // 2^56 * 2 * G - - .quad 0x0b5d89bc3bfd8bf1 - .quad 0xb06b9237c9f3551a - .quad 0x0e4c16b0d53028f5 - .quad 0x10bc9c312ccfcaab - .quad 0x702bc5c27cae6d11 - .quad 0x44c7699b54a48cab - .quad 0xefbc4056ba492eb2 - .quad 0x70d77248d9b6676d - .quad 0xaa8ae84b3ec2a05b - .quad 0x98699ef4ed1781e0 - .quad 0x794513e4708e85d1 - .quad 0x63755bd3a976f413 - - // 2^56 * 3 * G - - .quad 0xb55fa03e2ad10853 - .quad 0x356f75909ee63569 - .quad 0x9ff9f1fdbe69b890 - .quad 0x0d8cc1c48bc16f84 - .quad 0x3dc7101897f1acb7 - .quad 0x5dda7d5ec165bbd8 - .quad 0x508e5b9c0fa1020f - .quad 0x2763751737c52a56 - .quad 0x029402d36eb419a9 - .quad 0xf0b44e7e77b460a5 - .quad 0xcfa86230d43c4956 - .quad 0x70c2dd8a7ad166e7 - - // 2^56 * 4 * G - - .quad 0x656194509f6fec0e - .quad 0xee2e7ea946c6518d - .quad 0x9733c1f367e09b5c - .quad 0x2e0fac6363948495 - .quad 0x91d4967db8ed7e13 - .quad 0x74252f0ad776817a - .quad 0xe40982e00d852564 - .quad 0x32b8613816a53ce5 - .quad 0x79e7f7bee448cd64 - .quad 0x6ac83a67087886d0 - .quad 0xf89fd4d9a0e4db2e - .quad 0x4179215c735a4f41 - - // 2^56 * 5 * G - - .quad 0x8c7094e7d7dced2a - .quad 0x97fb8ac347d39c70 - .quad 0xe13be033a906d902 - .quad 0x700344a30cd99d76 - .quad 0xe4ae33b9286bcd34 - .quad 0xb7ef7eb6559dd6dc - .quad 0x278b141fb3d38e1f - .quad 0x31fa85662241c286 - .quad 0xaf826c422e3622f4 - .quad 0xc12029879833502d - .quad 0x9bc1b7e12b389123 - .quad 0x24bb2312a9952489 - - // 2^56 * 6 * G - - .quad 0xb1a8ed1732de67c3 - .quad 0x3cb49418461b4948 - .quad 0x8ebd434376cfbcd2 - .quad 0x0fee3e871e188008 - .quad 0x41f80c2af5f85c6b - .quad 0x687284c304fa6794 - .quad 0x8945df99a3ba1bad - .quad 0x0d1d2af9ffeb5d16 - .quad 0xa9da8aa132621edf - .quad 0x30b822a159226579 - .quad 0x4004197ba79ac193 - .quad 0x16acd79718531d76 - - // 2^56 * 7 * G - - .quad 0x72df72af2d9b1d3d - .quad 0x63462a36a432245a - .quad 0x3ecea07916b39637 - .quad 0x123e0ef6b9302309 - .quad 0xc959c6c57887b6ad - .quad 0x94e19ead5f90feba - .quad 0x16e24e62a342f504 - .quad 0x164ed34b18161700 - .quad 0x487ed94c192fe69a - .quad 0x61ae2cea3a911513 - .quad 0x877bf6d3b9a4de27 - .quad 0x78da0fc61073f3eb - - // 2^56 * 8 * G - - .quad 0x5bf15d28e52bc66a - .quad 0x2c47e31870f01a8e - .quad 0x2419afbc06c28bdd - .quad 0x2d25deeb256b173a - .quad 0xa29f80f1680c3a94 - .quad 0x71f77e151ae9e7e6 - .quad 0x1100f15848017973 - .quad 0x054aa4b316b38ddd - .quad 0xdfc8468d19267cb8 - .quad 0x0b28789c66e54daf - .quad 0x2aeb1d2a666eec17 - .quad 0x134610a6ab7da760 - - // 2^60 * 1 * G - - .quad 0xcaf55ec27c59b23f - .quad 0x99aeed3e154d04f2 - .quad 0x68441d72e14141f4 - .quad 0x140345133932a0a2 - .quad 0xd91430e0dc028c3c - .quad 0x0eb955a85217c771 - .quad 0x4b09e1ed2c99a1fa - .quad 0x42881af2bd6a743c - .quad 0x7bfec69aab5cad3d - .quad 0xc23e8cd34cb2cfad - .quad 0x685dd14bfb37d6a2 - .quad 0x0ad6d64415677a18 - - // 2^60 * 2 * G - - .quad 0x781a439e417becb5 - .quad 0x4ac5938cd10e0266 - .quad 0x5da385110692ac24 - .quad 0x11b065a2ade31233 - .quad 0x7914892847927e9f - .quad 0x33dad6ef370aa877 - .quad 0x1f8f24fa11122703 - .quad 0x5265ac2f2adf9592 - .quad 0x405fdd309afcb346 - .quad 0xd9723d4428e63f54 - .quad 0x94c01df05f65aaae - .quad 0x43e4dc3ae14c0809 - - // 2^60 * 3 * G - - .quad 0xbc12c7f1a938a517 - .quad 0x473028ab3180b2e1 - .quad 0x3f78571efbcd254a - .quad 0x74e534426ff6f90f - .quad 0xea6f7ac3adc2c6a3 - .quad 0xd0e928f6e9717c94 - .quad 0xe2d379ead645eaf5 - .quad 0x46dd8785c51ffbbe - .quad 0x709801be375c8898 - .quad 0x4b06dab5e3fd8348 - .quad 0x75880ced27230714 - .quad 0x2b09468fdd2f4c42 - - // 2^60 * 4 * G - - .quad 0x97c749eeb701cb96 - .quad 0x83f438d4b6a369c3 - .quad 0x62962b8b9a402cd9 - .quad 0x6976c7509888df7b - .quad 0x5b97946582ffa02a - .quad 0xda096a51fea8f549 - .quad 0xa06351375f77af9b - .quad 0x1bcfde61201d1e76 - .quad 0x4a4a5490246a59a2 - .quad 0xd63ebddee87fdd90 - .quad 0xd9437c670d2371fa - .quad 0x69e87308d30f8ed6 - - // 2^60 * 5 * G - - .quad 0x435a8bb15656beb0 - .quad 0xf8fac9ba4f4d5bca - .quad 0xb9b278c41548c075 - .quad 0x3eb0ef76e892b622 - .quad 0x0f80bf028bc80303 - .quad 0x6aae16b37a18cefb - .quad 0xdd47ea47d72cd6a3 - .quad 0x61943588f4ed39aa - .quad 0xd26e5c3e91039f85 - .quad 0xc0e9e77df6f33aa9 - .quad 0xe8968c5570066a93 - .quad 0x3c34d1881faaaddd - - // 2^60 * 6 * G - - .quad 0x3f9d2b5ea09f9ec0 - .quad 0x1dab3b6fb623a890 - .quad 0xa09ba3ea72d926c4 - .quad 0x374193513fd8b36d - .quad 0xbd5b0b8f2fffe0d9 - .quad 0x6aa254103ed24fb9 - .quad 0x2ac7d7bcb26821c4 - .quad 0x605b394b60dca36a - .quad 0xb4e856e45a9d1ed2 - .quad 0xefe848766c97a9a2 - .quad 0xb104cf641e5eee7d - .quad 0x2f50b81c88a71c8f - - // 2^60 * 7 * G - - .quad 0x31723c61fc6811bb - .quad 0x9cb450486211800f - .quad 0x768933d347995753 - .quad 0x3491a53502752fcd - .quad 0x2b552ca0a7da522a - .quad 0x3230b336449b0250 - .quad 0xf2c4c5bca4b99fb9 - .quad 0x7b2c674958074a22 - .quad 0xd55165883ed28cdf - .quad 0x12d84fd2d362de39 - .quad 0x0a874ad3e3378e4f - .quad 0x000d2b1f7c763e74 - - // 2^60 * 8 * G - - .quad 0x3d420811d06d4a67 - .quad 0xbefc048590e0ffe3 - .quad 0xf870c6b7bd487bde - .quad 0x6e2a7316319afa28 - .quad 0x9624778c3e94a8ab - .quad 0x0ad6f3cee9a78bec - .quad 0x948ac7810d743c4f - .quad 0x76627935aaecfccc - .quad 0x56a8ac24d6d59a9f - .quad 0xc8db753e3096f006 - .quad 0x477f41e68f4c5299 - .quad 0x588d851cf6c86114 - - // 2^64 * 1 * G - - .quad 0x51138ec78df6b0fe - .quad 0x5397da89e575f51b - .quad 0x09207a1d717af1b9 - .quad 0x2102fdba2b20d650 - .quad 0xcd2a65e777d1f515 - .quad 0x548991878faa60f1 - .quad 0xb1b73bbcdabc06e5 - .quad 0x654878cba97cc9fb - .quad 0x969ee405055ce6a1 - .quad 0x36bca7681251ad29 - .quad 0x3a1af517aa7da415 - .quad 0x0ad725db29ecb2ba - - // 2^64 * 2 * G - - .quad 0xdc4267b1834e2457 - .quad 0xb67544b570ce1bc5 - .quad 0x1af07a0bf7d15ed7 - .quad 0x4aefcffb71a03650 - .quad 0xfec7bc0c9b056f85 - .quad 0x537d5268e7f5ffd7 - .quad 0x77afc6624312aefa - .quad 0x4f675f5302399fd9 - .quad 0xc32d36360415171e - .quad 0xcd2bef118998483b - .quad 0x870a6eadd0945110 - .quad 0x0bccbb72a2a86561 - - // 2^64 * 3 * G - - .quad 0x185e962feab1a9c8 - .quad 0x86e7e63565147dcd - .quad 0xb092e031bb5b6df2 - .quad 0x4024f0ab59d6b73e - .quad 0x186d5e4c50fe1296 - .quad 0xe0397b82fee89f7e - .quad 0x3bc7f6c5507031b0 - .quad 0x6678fd69108f37c2 - .quad 0x1586fa31636863c2 - .quad 0x07f68c48572d33f2 - .quad 0x4f73cc9f789eaefc - .quad 0x2d42e2108ead4701 - - // 2^64 * 4 * G - - .quad 0x97f5131594dfd29b - .quad 0x6155985d313f4c6a - .quad 0xeba13f0708455010 - .quad 0x676b2608b8d2d322 - .quad 0x21717b0d0f537593 - .quad 0x914e690b131e064c - .quad 0x1bb687ae752ae09f - .quad 0x420bf3a79b423c6e - .quad 0x8138ba651c5b2b47 - .quad 0x8671b6ec311b1b80 - .quad 0x7bff0cb1bc3135b0 - .quad 0x745d2ffa9c0cf1e0 - - // 2^64 * 5 * G - - .quad 0xbf525a1e2bc9c8bd - .quad 0xea5b260826479d81 - .quad 0xd511c70edf0155db - .quad 0x1ae23ceb960cf5d0 - .quad 0x6036df5721d34e6a - .quad 0xb1db8827997bb3d0 - .quad 0xd3c209c3c8756afa - .quad 0x06e15be54c1dc839 - .quad 0x5b725d871932994a - .quad 0x32351cb5ceb1dab0 - .quad 0x7dc41549dab7ca05 - .quad 0x58ded861278ec1f7 - - // 2^64 * 6 * G - - .quad 0xd8173793f266c55c - .quad 0xc8c976c5cc454e49 - .quad 0x5ce382f8bc26c3a8 - .quad 0x2ff39de85485f6f9 - .quad 0x2dfb5ba8b6c2c9a8 - .quad 0x48eeef8ef52c598c - .quad 0x33809107f12d1573 - .quad 0x08ba696b531d5bd8 - .quad 0x77ed3eeec3efc57a - .quad 0x04e05517d4ff4811 - .quad 0xea3d7a3ff1a671cb - .quad 0x120633b4947cfe54 - - // 2^64 * 7 * G - - .quad 0x0b94987891610042 - .quad 0x4ee7b13cecebfae8 - .quad 0x70be739594f0a4c0 - .quad 0x35d30a99b4d59185 - .quad 0x82bd31474912100a - .quad 0xde237b6d7e6fbe06 - .quad 0xe11e761911ea79c6 - .quad 0x07433be3cb393bde - .quad 0xff7944c05ce997f4 - .quad 0x575d3de4b05c51a3 - .quad 0x583381fd5a76847c - .quad 0x2d873ede7af6da9f - - // 2^64 * 8 * G - - .quad 0x157a316443373409 - .quad 0xfab8b7eef4aa81d9 - .quad 0xb093fee6f5a64806 - .quad 0x2e773654707fa7b6 - .quad 0xaa6202e14e5df981 - .quad 0xa20d59175015e1f5 - .quad 0x18a275d3bae21d6c - .quad 0x0543618a01600253 - .quad 0x0deabdf4974c23c1 - .quad 0xaa6f0a259dce4693 - .quad 0x04202cb8a29aba2c - .quad 0x4b1443362d07960d - - // 2^68 * 1 * G - - .quad 0x47b837f753242cec - .quad 0x256dc48cc04212f2 - .quad 0xe222fbfbe1d928c5 - .quad 0x48ea295bad8a2c07 - .quad 0x299b1c3f57c5715e - .quad 0x96cb929e6b686d90 - .quad 0x3004806447235ab3 - .quad 0x2c435c24a44d9fe1 - .quad 0x0607c97c80f8833f - .quad 0x0e851578ca25ec5b - .quad 0x54f7450b161ebb6f - .quad 0x7bcb4792a0def80e - - // 2^68 * 2 * G - - .quad 0x8487e3d02bc73659 - .quad 0x4baf8445059979df - .quad 0xd17c975adcad6fbf - .quad 0x57369f0bdefc96b6 - .quad 0x1cecd0a0045224c2 - .quad 0x757f1b1b69e53952 - .quad 0x775b7a925289f681 - .quad 0x1b6cc62016736148 - .quad 0xf1a9990175638698 - .quad 0x353dd1beeeaa60d3 - .quad 0x849471334c9ba488 - .quad 0x63fa6e6843ade311 - - // 2^68 * 3 * G - - .quad 0xd15c20536597c168 - .quad 0x9f73740098d28789 - .quad 0x18aee7f13257ba1f - .quad 0x3418bfda07346f14 - .quad 0x2195becdd24b5eb7 - .quad 0x5e41f18cc0cd44f9 - .quad 0xdf28074441ca9ede - .quad 0x07073b98f35b7d67 - .quad 0xd03c676c4ce530d4 - .quad 0x0b64c0473b5df9f4 - .quad 0x065cef8b19b3a31e - .quad 0x3084d661533102c9 - - // 2^68 * 4 * G - - .quad 0xe1f6b79ebf8469ad - .quad 0x15801004e2663135 - .quad 0x9a498330af74181b - .quad 0x3ba2504f049b673c - .quad 0x9a6ce876760321fd - .quad 0x7fe2b5109eb63ad8 - .quad 0x00e7d4ae8ac80592 - .quad 0x73d86b7abb6f723a - .quad 0x0b52b5606dba5ab6 - .quad 0xa9134f0fbbb1edab - .quad 0x30a9520d9b04a635 - .quad 0x6813b8f37973e5db - - // 2^68 * 5 * G - - .quad 0x9854b054334127c1 - .quad 0x105d047882fbff25 - .quad 0xdb49f7f944186f4f - .quad 0x1768e838bed0b900 - .quad 0xf194ca56f3157e29 - .quad 0x136d35705ef528a5 - .quad 0xdd4cef778b0599bc - .quad 0x7d5472af24f833ed - .quad 0xd0ef874daf33da47 - .quad 0x00d3be5db6e339f9 - .quad 0x3f2a8a2f9c9ceece - .quad 0x5d1aeb792352435a - - // 2^68 * 6 * G - - .quad 0xf59e6bb319cd63ca - .quad 0x670c159221d06839 - .quad 0xb06d565b2150cab6 - .quad 0x20fb199d104f12a3 - .quad 0x12c7bfaeb61ba775 - .quad 0xb84e621fe263bffd - .quad 0x0b47a5c35c840dcf - .quad 0x7e83be0bccaf8634 - .quad 0x61943dee6d99c120 - .quad 0x86101f2e460b9fe0 - .quad 0x6bb2f1518ee8598d - .quad 0x76b76289fcc475cc - - // 2^68 * 7 * G - - .quad 0x791b4cc1756286fa - .quad 0xdbced317d74a157c - .quad 0x7e732421ea72bde6 - .quad 0x01fe18491131c8e9 - .quad 0x4245f1a1522ec0b3 - .quad 0x558785b22a75656d - .quad 0x1d485a2548a1b3c0 - .quad 0x60959eccd58fe09f - .quad 0x3ebfeb7ba8ed7a09 - .quad 0x49fdc2bbe502789c - .quad 0x44ebce5d3c119428 - .quad 0x35e1eb55be947f4a - - // 2^68 * 8 * G - - .quad 0xdbdae701c5738dd3 - .quad 0xf9c6f635b26f1bee - .quad 0x61e96a8042f15ef4 - .quad 0x3aa1d11faf60a4d8 - .quad 0x14fd6dfa726ccc74 - .quad 0x3b084cfe2f53b965 - .quad 0xf33ae4f552a2c8b4 - .quad 0x59aab07a0d40166a - .quad 0x77bcec4c925eac25 - .quad 0x1848718460137738 - .quad 0x5b374337fea9f451 - .quad 0x1865e78ec8e6aa46 - - // 2^72 * 1 * G - - .quad 0xccc4b7c7b66e1f7a - .quad 0x44157e25f50c2f7e - .quad 0x3ef06dfc713eaf1c - .quad 0x582f446752da63f7 - .quad 0x967c54e91c529ccb - .quad 0x30f6269264c635fb - .quad 0x2747aff478121965 - .quad 0x17038418eaf66f5c - .quad 0xc6317bd320324ce4 - .quad 0xa81042e8a4488bc4 - .quad 0xb21ef18b4e5a1364 - .quad 0x0c2a1c4bcda28dc9 - - // 2^72 * 2 * G - - .quad 0xd24dc7d06f1f0447 - .quad 0xb2269e3edb87c059 - .quad 0xd15b0272fbb2d28f - .quad 0x7c558bd1c6f64877 - .quad 0xedc4814869bd6945 - .quad 0x0d6d907dbe1c8d22 - .quad 0xc63bd212d55cc5ab - .quad 0x5a6a9b30a314dc83 - .quad 0xd0ec1524d396463d - .quad 0x12bb628ac35a24f0 - .quad 0xa50c3a791cbc5fa4 - .quad 0x0404a5ca0afbafc3 - - // 2^72 * 3 * G - - .quad 0x8c1f40070aa743d6 - .quad 0xccbad0cb5b265ee8 - .quad 0x574b046b668fd2de - .quad 0x46395bfdcadd9633 - .quad 0x62bc9e1b2a416fd1 - .quad 0xb5c6f728e350598b - .quad 0x04343fd83d5d6967 - .quad 0x39527516e7f8ee98 - .quad 0x117fdb2d1a5d9a9c - .quad 0x9c7745bcd1005c2a - .quad 0xefd4bef154d56fea - .quad 0x76579a29e822d016 - - // 2^72 * 4 * G - - .quad 0x45b68e7e49c02a17 - .quad 0x23cd51a2bca9a37f - .quad 0x3ed65f11ec224c1b - .quad 0x43a384dc9e05bdb1 - .quad 0x333cb51352b434f2 - .quad 0xd832284993de80e1 - .quad 0xb5512887750d35ce - .quad 0x02c514bb2a2777c1 - .quad 0x684bd5da8bf1b645 - .quad 0xfb8bd37ef6b54b53 - .quad 0x313916d7a9b0d253 - .quad 0x1160920961548059 - - // 2^72 * 5 * G - - .quad 0xb44d166929dacfaa - .quad 0xda529f4c8413598f - .quad 0xe9ef63ca453d5559 - .quad 0x351e125bc5698e0b - .quad 0x7a385616369b4dcd - .quad 0x75c02ca7655c3563 - .quad 0x7dc21bf9d4f18021 - .quad 0x2f637d7491e6e042 - .quad 0xd4b49b461af67bbe - .quad 0xd603037ac8ab8961 - .quad 0x71dee19ff9a699fb - .quad 0x7f182d06e7ce2a9a - - // 2^72 * 6 * G - - .quad 0x7a7c8e64ab0168ec - .quad 0xcb5a4a5515edc543 - .quad 0x095519d347cd0eda - .quad 0x67d4ac8c343e93b0 - .quad 0x09454b728e217522 - .quad 0xaa58e8f4d484b8d8 - .quad 0xd358254d7f46903c - .quad 0x44acc043241c5217 - .quad 0x1c7d6bbb4f7a5777 - .quad 0x8b35fed4918313e1 - .quad 0x4adca1c6c96b4684 - .quad 0x556d1c8312ad71bd - - // 2^72 * 7 * G - - .quad 0x17ef40e30c8d3982 - .quad 0x31f7073e15a3fa34 - .quad 0x4f21f3cb0773646e - .quad 0x746c6c6d1d824eff - .quad 0x81f06756b11be821 - .quad 0x0faff82310a3f3dd - .quad 0xf8b2d0556a99465d - .quad 0x097abe38cc8c7f05 - .quad 0x0c49c9877ea52da4 - .quad 0x4c4369559bdc1d43 - .quad 0x022c3809f7ccebd2 - .quad 0x577e14a34bee84bd - - // 2^72 * 8 * G - - .quad 0xf0e268ac61a73b0a - .quad 0xf2fafa103791a5f5 - .quad 0xc1e13e826b6d00e9 - .quad 0x60fa7ee96fd78f42 - .quad 0x94fecebebd4dd72b - .quad 0xf46a4fda060f2211 - .quad 0x124a5977c0c8d1ff - .quad 0x705304b8fb009295 - .quad 0xb63d1d354d296ec6 - .quad 0xf3c3053e5fad31d8 - .quad 0x670b958cb4bd42ec - .quad 0x21398e0ca16353fd - - // 2^76 * 1 * G - - .quad 0x216ab2ca8da7d2ef - .quad 0x366ad9dd99f42827 - .quad 0xae64b9004fdd3c75 - .quad 0x403a395b53909e62 - .quad 0x86c5fc16861b7e9a - .quad 0xf6a330476a27c451 - .quad 0x01667267a1e93597 - .quad 0x05ffb9cd6082dfeb - .quad 0xa617fa9ff53f6139 - .quad 0x60f2b5e513e66cb6 - .quad 0xd7a8beefb3448aa4 - .quad 0x7a2932856f5ea192 - - // 2^76 * 2 * G - - .quad 0x0b39d761b02de888 - .quad 0x5f550e7ed2414e1f - .quad 0xa6bfa45822e1a940 - .quad 0x050a2f7dfd447b99 - .quad 0xb89c444879639302 - .quad 0x4ae4f19350c67f2c - .quad 0xf0b35da8c81af9c6 - .quad 0x39d0003546871017 - .quad 0x437c3b33a650db77 - .quad 0x6bafe81dbac52bb2 - .quad 0xfe99402d2db7d318 - .quad 0x2b5b7eec372ba6ce - - // 2^76 * 3 * G - - .quad 0xb3bc4bbd83f50eef - .quad 0x508f0c998c927866 - .quad 0x43e76587c8b7e66e - .quad 0x0f7655a3a47f98d9 - .quad 0xa694404d613ac8f4 - .quad 0x500c3c2bfa97e72c - .quad 0x874104d21fcec210 - .quad 0x1b205fb38604a8ee - .quad 0x55ecad37d24b133c - .quad 0x441e147d6038c90b - .quad 0x656683a1d62c6fee - .quad 0x0157d5dc87e0ecae - - // 2^76 * 4 * G - - .quad 0xf2a7af510354c13d - .quad 0xd7a0b145aa372b60 - .quad 0x2869b96a05a3d470 - .quad 0x6528e42d82460173 - .quad 0x95265514d71eb524 - .quad 0xe603d8815df14593 - .quad 0x147cdf410d4de6b7 - .quad 0x5293b1730437c850 - .quad 0x23d0e0814bccf226 - .quad 0x92c745cd8196fb93 - .quad 0x8b61796c59541e5b - .quad 0x40a44df0c021f978 - - // 2^76 * 5 * G - - .quad 0xdaa869894f20ea6a - .quad 0xea14a3d14c620618 - .quad 0x6001fccb090bf8be - .quad 0x35f4e822947e9cf0 - .quad 0x86c96e514bc5d095 - .quad 0xf20d4098fca6804a - .quad 0x27363d89c826ea5d - .quad 0x39ca36565719cacf - .quad 0x97506f2f6f87b75c - .quad 0xc624aea0034ae070 - .quad 0x1ec856e3aad34dd6 - .quad 0x055b0be0e440e58f - - // 2^76 * 6 * G - - .quad 0x6469a17d89735d12 - .quad 0xdb6f27d5e662b9f1 - .quad 0x9fcba3286a395681 - .quad 0x363b8004d269af25 - .quad 0x4d12a04b6ea33da2 - .quad 0x57cf4c15e36126dd - .quad 0x90ec9675ee44d967 - .quad 0x64ca348d2a985aac - .quad 0x99588e19e4c4912d - .quad 0xefcc3b4e1ca5ce6b - .quad 0x4522ea60fa5b98d5 - .quad 0x7064bbab1de4a819 - - // 2^76 * 7 * G - - .quad 0xb919e1515a770641 - .quad 0xa9a2e2c74e7f8039 - .quad 0x7527250b3df23109 - .quad 0x756a7330ac27b78b - .quad 0xa290c06142542129 - .quad 0xf2e2c2aebe8d5b90 - .quad 0xcf2458db76abfe1b - .quad 0x02157ade83d626bf - .quad 0x3e46972a1b9a038b - .quad 0x2e4ee66a7ee03fb4 - .quad 0x81a248776edbb4ca - .quad 0x1a944ee88ecd0563 - - // 2^76 * 8 * G - - .quad 0xd5a91d1151039372 - .quad 0x2ed377b799ca26de - .quad 0xa17202acfd366b6b - .quad 0x0730291bd6901995 - .quad 0xbb40a859182362d6 - .quad 0xb99f55778a4d1abb - .quad 0x8d18b427758559f6 - .quad 0x26c20fe74d26235a - .quad 0x648d1d9fe9cc22f5 - .quad 0x66bc561928dd577c - .quad 0x47d3ed21652439d1 - .quad 0x49d271acedaf8b49 - - // 2^80 * 1 * G - - .quad 0x89f5058a382b33f3 - .quad 0x5ae2ba0bad48c0b4 - .quad 0x8f93b503a53db36e - .quad 0x5aa3ed9d95a232e6 - .quad 0x2798aaf9b4b75601 - .quad 0x5eac72135c8dad72 - .quad 0xd2ceaa6161b7a023 - .quad 0x1bbfb284e98f7d4e - .quad 0x656777e9c7d96561 - .quad 0xcb2b125472c78036 - .quad 0x65053299d9506eee - .quad 0x4a07e14e5e8957cc - - // 2^80 * 2 * G - - .quad 0x4ee412cb980df999 - .quad 0xa315d76f3c6ec771 - .quad 0xbba5edde925c77fd - .quad 0x3f0bac391d313402 - .quad 0x240b58cdc477a49b - .quad 0xfd38dade6447f017 - .quad 0x19928d32a7c86aad - .quad 0x50af7aed84afa081 - .quad 0x6e4fde0115f65be5 - .quad 0x29982621216109b2 - .quad 0x780205810badd6d9 - .quad 0x1921a316baebd006 - - // 2^80 * 3 * G - - .quad 0x89422f7edfb870fc - .quad 0x2c296beb4f76b3bd - .quad 0x0738f1d436c24df7 - .quad 0x6458df41e273aeb0 - .quad 0xd75aad9ad9f3c18b - .quad 0x566a0eef60b1c19c - .quad 0x3e9a0bac255c0ed9 - .quad 0x7b049deca062c7f5 - .quad 0xdccbe37a35444483 - .quad 0x758879330fedbe93 - .quad 0x786004c312c5dd87 - .quad 0x6093dccbc2950e64 - - // 2^80 * 4 * G - - .quad 0x1ff39a8585e0706d - .quad 0x36d0a5d8b3e73933 - .quad 0x43b9f2e1718f453b - .quad 0x57d1ea084827a97c - .quad 0x6bdeeebe6084034b - .quad 0x3199c2b6780fb854 - .quad 0x973376abb62d0695 - .quad 0x6e3180c98b647d90 - .quad 0xee7ab6e7a128b071 - .quad 0xa4c1596d93a88baa - .quad 0xf7b4de82b2216130 - .quad 0x363e999ddd97bd18 - - // 2^80 * 5 * G - - .quad 0x96a843c135ee1fc4 - .quad 0x976eb35508e4c8cf - .quad 0xb42f6801b58cd330 - .quad 0x48ee9b78693a052b - .quad 0x2f1848dce24baec6 - .quad 0x769b7255babcaf60 - .quad 0x90cb3c6e3cefe931 - .quad 0x231f979bc6f9b355 - .quad 0x5c31de4bcc2af3c6 - .quad 0xb04bb030fe208d1f - .quad 0xb78d7009c14fb466 - .quad 0x079bfa9b08792413 - - // 2^80 * 6 * G - - .quad 0xe3903a51da300df4 - .quad 0x843964233da95ab0 - .quad 0xed3cf12d0b356480 - .quad 0x038c77f684817194 - .quad 0xf3c9ed80a2d54245 - .quad 0x0aa08b7877f63952 - .quad 0xd76dac63d1085475 - .quad 0x1ef4fb159470636b - .quad 0x854e5ee65b167bec - .quad 0x59590a4296d0cdc2 - .quad 0x72b2df3498102199 - .quad 0x575ee92a4a0bff56 - - // 2^80 * 7 * G - - .quad 0xd4c080908a182fcf - .quad 0x30e170c299489dbd - .quad 0x05babd5752f733de - .quad 0x43d4e7112cd3fd00 - .quad 0x5d46bc450aa4d801 - .quad 0xc3af1227a533b9d8 - .quad 0x389e3b262b8906c2 - .quad 0x200a1e7e382f581b - .quad 0x518db967eaf93ac5 - .quad 0x71bc989b056652c0 - .quad 0xfe2b85d9567197f5 - .quad 0x050eca52651e4e38 - - // 2^80 * 8 * G - - .quad 0xc3431ade453f0c9c - .quad 0xe9f5045eff703b9b - .quad 0xfcd97ac9ed847b3d - .quad 0x4b0ee6c21c58f4c6 - .quad 0x97ac397660e668ea - .quad 0x9b19bbfe153ab497 - .quad 0x4cb179b534eca79f - .quad 0x6151c09fa131ae57 - .quad 0x3af55c0dfdf05d96 - .quad 0xdd262ee02ab4ee7a - .quad 0x11b2bb8712171709 - .quad 0x1fef24fa800f030b - - // 2^84 * 1 * G - - .quad 0xb496123a6b6c6609 - .quad 0xa750fe8580ab5938 - .quad 0xf471bf39b7c27a5f - .quad 0x507903ce77ac193c - .quad 0xff91a66a90166220 - .quad 0xf22552ae5bf1e009 - .quad 0x7dff85d87f90df7c - .quad 0x4f620ffe0c736fb9 - .quad 0x62f90d65dfde3e34 - .quad 0xcf28c592b9fa5fad - .quad 0x99c86ef9c6164510 - .quad 0x25d448044a256c84 - - // 2^84 * 2 * G - - .quad 0xbd68230ec7e9b16f - .quad 0x0eb1b9c1c1c5795d - .quad 0x7943c8c495b6b1ff - .quad 0x2f9faf620bbacf5e - .quad 0x2c7c4415c9022b55 - .quad 0x56a0d241812eb1fe - .quad 0xf02ea1c9d7b65e0d - .quad 0x4180512fd5323b26 - .quad 0xa4ff3e698a48a5db - .quad 0xba6a3806bd95403b - .quad 0x9f7ce1af47d5b65d - .quad 0x15e087e55939d2fb - - // 2^84 * 3 * G - - .quad 0x12207543745c1496 - .quad 0xdaff3cfdda38610c - .quad 0xe4e797272c71c34f - .quad 0x39c07b1934bdede9 - .quad 0x8894186efb963f38 - .quad 0x48a00e80dc639bd5 - .quad 0xa4e8092be96c1c99 - .quad 0x5a097d54ca573661 - .quad 0x2d45892b17c9e755 - .quad 0xd033fd7289308df8 - .quad 0x6c2fe9d9525b8bd9 - .quad 0x2edbecf1c11cc079 - - // 2^84 * 4 * G - - .quad 0x1616a4e3c715a0d2 - .quad 0x53623cb0f8341d4d - .quad 0x96ef5329c7e899cb - .quad 0x3d4e8dbba668baa6 - .quad 0xee0f0fddd087a25f - .quad 0x9c7531555c3e34ee - .quad 0x660c572e8fab3ab5 - .quad 0x0854fc44544cd3b2 - .quad 0x61eba0c555edad19 - .quad 0x24b533fef0a83de6 - .quad 0x3b77042883baa5f8 - .quad 0x678f82b898a47e8d - - // 2^84 * 5 * G - - .quad 0xb1491d0bd6900c54 - .quad 0x3539722c9d132636 - .quad 0x4db928920b362bc9 - .quad 0x4d7cd1fea68b69df - .quad 0x1e09d94057775696 - .quad 0xeed1265c3cd951db - .quad 0xfa9dac2b20bce16f - .quad 0x0f7f76e0e8d089f4 - .quad 0x36d9ebc5d485b00c - .quad 0xa2596492e4adb365 - .quad 0xc1659480c2119ccd - .quad 0x45306349186e0d5f - - // 2^84 * 6 * G - - .quad 0x94ddd0c1a6cdff1d - .quad 0x55f6f115e84213ae - .quad 0x6c935f85992fcf6a - .quad 0x067ee0f54a37f16f - .quad 0x96a414ec2b072491 - .quad 0x1bb2218127a7b65b - .quad 0x6d2849596e8a4af0 - .quad 0x65f3b08ccd27765f - .quad 0xecb29fff199801f7 - .quad 0x9d361d1fa2a0f72f - .quad 0x25f11d2375fd2f49 - .quad 0x124cefe80fe10fe2 - - // 2^84 * 7 * G - - .quad 0x4c126cf9d18df255 - .quad 0xc1d471e9147a63b6 - .quad 0x2c6d3c73f3c93b5f - .quad 0x6be3a6a2e3ff86a2 - .quad 0x1518e85b31b16489 - .quad 0x8faadcb7db710bfb - .quad 0x39b0bdf4a14ae239 - .quad 0x05f4cbea503d20c1 - .quad 0xce040e9ec04145bc - .quad 0xc71ff4e208f6834c - .quad 0xbd546e8dab8847a3 - .quad 0x64666aa0a4d2aba5 - - // 2^84 * 8 * G - - .quad 0x6841435a7c06d912 - .quad 0xca123c21bb3f830b - .quad 0xd4b37b27b1cbe278 - .quad 0x1d753b84c76f5046 - .quad 0xb0c53bf73337e94c - .quad 0x7cb5697e11e14f15 - .quad 0x4b84abac1930c750 - .quad 0x28dd4abfe0640468 - .quad 0x7dc0b64c44cb9f44 - .quad 0x18a3e1ace3925dbf - .quad 0x7a3034862d0457c4 - .quad 0x4c498bf78a0c892e - - // 2^88 * 1 * G - - .quad 0x37d653fb1aa73196 - .quad 0x0f9495303fd76418 - .quad 0xad200b09fb3a17b2 - .quad 0x544d49292fc8613e - .quad 0x22d2aff530976b86 - .quad 0x8d90b806c2d24604 - .quad 0xdca1896c4de5bae5 - .quad 0x28005fe6c8340c17 - .quad 0x6aefba9f34528688 - .quad 0x5c1bff9425107da1 - .quad 0xf75bbbcd66d94b36 - .quad 0x72e472930f316dfa - - // 2^88 * 2 * G - - .quad 0x2695208c9781084f - .quad 0xb1502a0b23450ee1 - .quad 0xfd9daea603efde02 - .quad 0x5a9d2e8c2733a34c - .quad 0x07f3f635d32a7627 - .quad 0x7aaa4d865f6566f0 - .quad 0x3c85e79728d04450 - .quad 0x1fee7f000fe06438 - .quad 0x765305da03dbf7e5 - .quad 0xa4daf2491434cdbd - .quad 0x7b4ad5cdd24a88ec - .quad 0x00f94051ee040543 - - // 2^88 * 3 * G - - .quad 0x8d356b23c3d330b2 - .quad 0xf21c8b9bb0471b06 - .quad 0xb36c316c6e42b83c - .quad 0x07d79c7e8beab10d - .quad 0xd7ef93bb07af9753 - .quad 0x583ed0cf3db766a7 - .quad 0xce6998bf6e0b1ec5 - .quad 0x47b7ffd25dd40452 - .quad 0x87fbfb9cbc08dd12 - .quad 0x8a066b3ae1eec29b - .quad 0x0d57242bdb1fc1bf - .quad 0x1c3520a35ea64bb6 - - // 2^88 * 4 * G - - .quad 0x80d253a6bccba34a - .quad 0x3e61c3a13838219b - .quad 0x90c3b6019882e396 - .quad 0x1c3d05775d0ee66f - .quad 0xcda86f40216bc059 - .quad 0x1fbb231d12bcd87e - .quad 0xb4956a9e17c70990 - .quad 0x38750c3b66d12e55 - .quad 0x692ef1409422e51a - .quad 0xcbc0c73c2b5df671 - .quad 0x21014fe7744ce029 - .quad 0x0621e2c7d330487c - - // 2^88 * 5 * G - - .quad 0xaf9860cc8259838d - .quad 0x90ea48c1c69f9adc - .quad 0x6526483765581e30 - .quad 0x0007d6097bd3a5bc - .quad 0xb7ae1796b0dbf0f3 - .quad 0x54dfafb9e17ce196 - .quad 0x25923071e9aaa3b4 - .quad 0x5d8e589ca1002e9d - .quad 0xc0bf1d950842a94b - .quad 0xb2d3c363588f2e3e - .quad 0x0a961438bb51e2ef - .quad 0x1583d7783c1cbf86 - - // 2^88 * 6 * G - - .quad 0xeceea2ef5da27ae1 - .quad 0x597c3a1455670174 - .quad 0xc9a62a126609167a - .quad 0x252a5f2e81ed8f70 - .quad 0x90034704cc9d28c7 - .quad 0x1d1b679ef72cc58f - .quad 0x16e12b5fbe5b8726 - .quad 0x4958064e83c5580a - .quad 0x0d2894265066e80d - .quad 0xfcc3f785307c8c6b - .quad 0x1b53da780c1112fd - .quad 0x079c170bd843b388 - - // 2^88 * 7 * G - - .quad 0x0506ece464fa6fff - .quad 0xbee3431e6205e523 - .quad 0x3579422451b8ea42 - .quad 0x6dec05e34ac9fb00 - .quad 0xcdd6cd50c0d5d056 - .quad 0x9af7686dbb03573b - .quad 0x3ca6723ff3c3ef48 - .quad 0x6768c0d7317b8acc - .quad 0x94b625e5f155c1b3 - .quad 0x417bf3a7997b7b91 - .quad 0xc22cbddc6d6b2600 - .quad 0x51445e14ddcd52f4 - - // 2^88 * 8 * G - - .quad 0x57502b4b3b144951 - .quad 0x8e67ff6b444bbcb3 - .quad 0xb8bd6927166385db - .quad 0x13186f31e39295c8 - .quad 0x893147ab2bbea455 - .quad 0x8c53a24f92079129 - .quad 0x4b49f948be30f7a7 - .quad 0x12e990086e4fd43d - .quad 0xf10c96b37fdfbb2e - .quad 0x9f9a935e121ceaf9 - .quad 0xdf1136c43a5b983f - .quad 0x77b2e3f05d3e99af - - // 2^92 * 1 * G - - .quad 0xfd0d75879cf12657 - .quad 0xe82fef94e53a0e29 - .quad 0xcc34a7f05bbb4be7 - .quad 0x0b251172a50c38a2 - .quad 0x9532f48fcc5cd29b - .quad 0x2ba851bea3ce3671 - .quad 0x32dacaa051122941 - .quad 0x478d99d9350004f2 - .quad 0x1d5ad94890bb02c0 - .quad 0x50e208b10ec25115 - .quad 0xa26a22894ef21702 - .quad 0x4dc923343b524805 - - // 2^92 * 2 * G - - .quad 0xe3828c400f8086b6 - .quad 0x3f77e6f7979f0dc8 - .quad 0x7ef6de304df42cb4 - .quad 0x5265797cb6abd784 - .quad 0x3ad3e3ebf36c4975 - .quad 0xd75d25a537862125 - .quad 0xe873943da025a516 - .quad 0x6bbc7cb4c411c847 - .quad 0x3c6f9cd1d4a50d56 - .quad 0xb6244077c6feab7e - .quad 0x6ff9bf483580972e - .quad 0x00375883b332acfb - - // 2^92 * 3 * G - - .quad 0x0001b2cd28cb0940 - .quad 0x63fb51a06f1c24c9 - .quad 0xb5ad8691dcd5ca31 - .quad 0x67238dbd8c450660 - .quad 0xc98bec856c75c99c - .quad 0xe44184c000e33cf4 - .quad 0x0a676b9bba907634 - .quad 0x669e2cb571f379d7 - .quad 0xcb116b73a49bd308 - .quad 0x025aad6b2392729e - .quad 0xb4793efa3f55d9b1 - .quad 0x72a1056140678bb9 - - // 2^92 * 4 * G - - .quad 0xa2b6812b1cc9249d - .quad 0x62866eee21211f58 - .quad 0x2cb5c5b85df10ece - .quad 0x03a6b259e263ae00 - .quad 0x0d8d2909e2e505b6 - .quad 0x98ca78abc0291230 - .quad 0x77ef5569a9b12327 - .quad 0x7c77897b81439b47 - .quad 0xf1c1b5e2de331cb5 - .quad 0x5a9f5d8e15fca420 - .quad 0x9fa438f17bd932b1 - .quad 0x2a381bf01c6146e7 - - // 2^92 * 5 * G - - .quad 0xac9b9879cfc811c1 - .quad 0x8b7d29813756e567 - .quad 0x50da4e607c70edfc - .quad 0x5dbca62f884400b6 - .quad 0xf7c0be32b534166f - .quad 0x27e6ca6419cf70d4 - .quad 0x934df7d7a957a759 - .quad 0x5701461dabdec2aa - .quad 0x2c6747402c915c25 - .quad 0x1bdcd1a80b0d340a - .quad 0x5e5601bd07b43f5f - .quad 0x2555b4e05539a242 - - // 2^92 * 6 * G - - .quad 0x6fc09f5266ddd216 - .quad 0xdce560a7c8e37048 - .quad 0xec65939da2df62fd - .quad 0x7a869ae7e52ed192 - .quad 0x78409b1d87e463d4 - .quad 0xad4da95acdfb639d - .quad 0xec28773755259b9c - .quad 0x69c806e9c31230ab - .quad 0x7b48f57414bb3f22 - .quad 0x68c7cee4aedccc88 - .quad 0xed2f936179ed80be - .quad 0x25d70b885f77bc4b - - // 2^92 * 7 * G - - .quad 0x4151c3d9762bf4de - .quad 0x083f435f2745d82b - .quad 0x29775a2e0d23ddd5 - .quad 0x138e3a6269a5db24 - .quad 0x98459d29bb1ae4d4 - .quad 0x56b9c4c739f954ec - .quad 0x832743f6c29b4b3e - .quad 0x21ea8e2798b6878a - .quad 0x87bef4b46a5a7b9c - .quad 0xd2299d1b5fc1d062 - .quad 0x82409818dd321648 - .quad 0x5c5abeb1e5a2e03d - - // 2^92 * 8 * G - - .quad 0x14722af4b73c2ddb - .quad 0xbc470c5f5a05060d - .quad 0x00943eac2581b02e - .quad 0x0e434b3b1f499c8f - .quad 0x02cde6de1306a233 - .quad 0x7b5a52a2116f8ec7 - .quad 0xe1c681f4c1163b5b - .quad 0x241d350660d32643 - .quad 0x6be4404d0ebc52c7 - .quad 0xae46233bb1a791f5 - .quad 0x2aec170ed25db42b - .quad 0x1d8dfd966645d694 - - // 2^96 * 1 * G - - .quad 0x296fa9c59c2ec4de - .quad 0xbc8b61bf4f84f3cb - .quad 0x1c7706d917a8f908 - .quad 0x63b795fc7ad3255d - .quad 0xd598639c12ddb0a4 - .quad 0xa5d19f30c024866b - .quad 0xd17c2f0358fce460 - .quad 0x07a195152e095e8a - .quad 0xa8368f02389e5fc8 - .quad 0x90433b02cf8de43b - .quad 0xafa1fd5dc5412643 - .quad 0x3e8fe83d032f0137 - - // 2^96 * 2 * G - - .quad 0x2f8b15b90570a294 - .quad 0x94f2427067084549 - .quad 0xde1c5ae161bbfd84 - .quad 0x75ba3b797fac4007 - .quad 0x08704c8de8efd13c - .quad 0xdfc51a8e33e03731 - .quad 0xa59d5da51260cde3 - .quad 0x22d60899a6258c86 - .quad 0x6239dbc070cdd196 - .quad 0x60fe8a8b6c7d8a9a - .quad 0xb38847bceb401260 - .quad 0x0904d07b87779e5e - - // 2^96 * 3 * G - - .quad 0xb4ce1fd4ddba919c - .quad 0xcf31db3ec74c8daa - .quad 0x2c63cc63ad86cc51 - .quad 0x43e2143fbc1dde07 - .quad 0xf4322d6648f940b9 - .quad 0x06952f0cbd2d0c39 - .quad 0x167697ada081f931 - .quad 0x6240aacebaf72a6c - .quad 0xf834749c5ba295a0 - .quad 0xd6947c5bca37d25a - .quad 0x66f13ba7e7c9316a - .quad 0x56bdaf238db40cac - - // 2^96 * 4 * G - - .quad 0x362ab9e3f53533eb - .quad 0x338568d56eb93d40 - .quad 0x9e0e14521d5a5572 - .quad 0x1d24a86d83741318 - .quad 0x1310d36cc19d3bb2 - .quad 0x062a6bb7622386b9 - .quad 0x7c9b8591d7a14f5c - .quad 0x03aa31507e1e5754 - .quad 0xf4ec7648ffd4ce1f - .quad 0xe045eaf054ac8c1c - .quad 0x88d225821d09357c - .quad 0x43b261dc9aeb4859 - - // 2^96 * 5 * G - - .quad 0xe55b1e1988bb79bb - .quad 0xa09ed07dc17a359d - .quad 0xb02c2ee2603dea33 - .quad 0x326055cf5b276bc2 - .quad 0x19513d8b6c951364 - .quad 0x94fe7126000bf47b - .quad 0x028d10ddd54f9567 - .quad 0x02b4d5e242940964 - .quad 0xb4a155cb28d18df2 - .quad 0xeacc4646186ce508 - .quad 0xc49cf4936c824389 - .quad 0x27a6c809ae5d3410 - - // 2^96 * 6 * G - - .quad 0x8ba6ebcd1f0db188 - .quad 0x37d3d73a675a5be8 - .quad 0xf22edfa315f5585a - .quad 0x2cb67174ff60a17e - .quad 0xcd2c270ac43d6954 - .quad 0xdd4a3e576a66cab2 - .quad 0x79fa592469d7036c - .quad 0x221503603d8c2599 - .quad 0x59eecdf9390be1d0 - .quad 0xa9422044728ce3f1 - .quad 0x82891c667a94f0f4 - .quad 0x7b1df4b73890f436 - - // 2^96 * 7 * G - - .quad 0xe492f2e0b3b2a224 - .quad 0x7c6c9e062b551160 - .quad 0x15eb8fe20d7f7b0e - .quad 0x61fcef2658fc5992 - .quad 0x5f2e221807f8f58c - .quad 0xe3555c9fd49409d4 - .quad 0xb2aaa88d1fb6a630 - .quad 0x68698245d352e03d - .quad 0xdbb15d852a18187a - .quad 0xf3e4aad386ddacd7 - .quad 0x44bae2810ff6c482 - .quad 0x46cf4c473daf01cf - - // 2^96 * 8 * G - - .quad 0x426525ed9ec4e5f9 - .quad 0x0e5eda0116903303 - .quad 0x72b1a7f2cbe5cadc - .quad 0x29387bcd14eb5f40 - .quad 0x213c6ea7f1498140 - .quad 0x7c1e7ef8392b4854 - .quad 0x2488c38c5629ceba - .quad 0x1065aae50d8cc5bb - .quad 0x1c2c4525df200d57 - .quad 0x5c3b2dd6bfca674a - .quad 0x0a07e7b1e1834030 - .quad 0x69a198e64f1ce716 - - // 2^100 * 1 * G - - .quad 0x7afcd613efa9d697 - .quad 0x0cc45aa41c067959 - .quad 0xa56fe104c1fada96 - .quad 0x3a73b70472e40365 - .quad 0x7b26e56b9e2d4734 - .quad 0xc4c7132b81c61675 - .quad 0xef5c9525ec9cde7f - .quad 0x39c80b16e71743ad - .quad 0x0f196e0d1b826c68 - .quad 0xf71ff0e24960e3db - .quad 0x6113167023b7436c - .quad 0x0cf0ea5877da7282 - - // 2^100 * 2 * G - - .quad 0x196c80a4ddd4ccbd - .quad 0x22e6f55d95f2dd9d - .quad 0xc75e33c740d6c71b - .quad 0x7bb51279cb3c042f - .quad 0xe332ced43ba6945a - .quad 0xde0b1361e881c05d - .quad 0x1ad40f095e67ed3b - .quad 0x5da8acdab8c63d5d - .quad 0xc4b6664a3a70159f - .quad 0x76194f0f0a904e14 - .quad 0xa5614c39a4096c13 - .quad 0x6cd0ff50979feced - - // 2^100 * 3 * G - - .quad 0xc0e067e78f4428ac - .quad 0x14835ab0a61135e3 - .quad 0xf21d14f338062935 - .quad 0x6390a4c8df04849c - .quad 0x7fecfabdb04ba18e - .quad 0xd0fc7bfc3bddbcf7 - .quad 0xa41d486e057a131c - .quad 0x641a4391f2223a61 - .quad 0xc5c6b95aa606a8db - .quad 0x914b7f9eb06825f1 - .quad 0x2a731f6b44fc9eff - .quad 0x30ddf38562705cfc - - // 2^100 * 4 * G - - .quad 0x4e3dcbdad1bff7f9 - .quad 0xc9118e8220645717 - .quad 0xbacccebc0f189d56 - .quad 0x1b4822e9d4467668 - .quad 0x33bef2bd68bcd52c - .quad 0xc649dbb069482ef2 - .quad 0xb5b6ee0c41cb1aee - .quad 0x5c294d270212a7e5 - .quad 0xab360a7f25563781 - .quad 0x2512228a480f7958 - .quad 0xc75d05276114b4e3 - .quad 0x222d9625d976fe2a - - // 2^100 * 5 * G - - .quad 0x1c717f85b372ace1 - .quad 0x81930e694638bf18 - .quad 0x239cad056bc08b58 - .quad 0x0b34271c87f8fff4 - .quad 0x0f94be7e0a344f85 - .quad 0xeb2faa8c87f22c38 - .quad 0x9ce1e75e4ee16f0f - .quad 0x43e64e5418a08dea - .quad 0x8155e2521a35ce63 - .quad 0xbe100d4df912028e - .quad 0xbff80bf8a57ddcec - .quad 0x57342dc96d6bc6e4 - - // 2^100 * 6 * G - - .quad 0xefeef065c8ce5998 - .quad 0xbf029510b5cbeaa2 - .quad 0x8c64a10620b7c458 - .quad 0x35134fb231c24855 - .quad 0xf3c3bcb71e707bf6 - .quad 0x351d9b8c7291a762 - .quad 0x00502e6edad69a33 - .quad 0x522f521f1ec8807f - .quad 0x272c1f46f9a3902b - .quad 0xc91ba3b799657bcc - .quad 0xae614b304f8a1c0e - .quad 0x7afcaad70b99017b - - // 2^100 * 7 * G - - .quad 0xc25ded54a4b8be41 - .quad 0x902d13e11bb0e2dd - .quad 0x41f43233cde82ab2 - .quad 0x1085faa5c3aae7cb - .quad 0xa88141ecef842b6b - .quad 0x55e7b14797abe6c5 - .quad 0x8c748f9703784ffe - .quad 0x5b50a1f7afcd00b7 - .quad 0x9b840f66f1361315 - .quad 0x18462242701003e9 - .quad 0x65ed45fae4a25080 - .quad 0x0a2862393fda7320 - - // 2^100 * 8 * G - - .quad 0x46ab13c8347cbc9d - .quad 0x3849e8d499c12383 - .quad 0x4cea314087d64ac9 - .quad 0x1f354134b1a29ee7 - .quad 0x960e737b6ecb9d17 - .quad 0xfaf24948d67ceae1 - .quad 0x37e7a9b4d55e1b89 - .quad 0x5cb7173cb46c59eb - .quad 0x4a89e68b82b7abf0 - .quad 0xf41cd9279ba6b7b9 - .quad 0x16e6c210e18d876f - .quad 0x7cacdb0f7f1b09c6 - - // 2^104 * 1 * G - - .quad 0x9062b2e0d91a78bc - .quad 0x47c9889cc8509667 - .quad 0x9df54a66405070b8 - .quad 0x7369e6a92493a1bf - .quad 0xe1014434dcc5caed - .quad 0x47ed5d963c84fb33 - .quad 0x70019576ed86a0e7 - .quad 0x25b2697bd267f9e4 - .quad 0x9d673ffb13986864 - .quad 0x3ca5fbd9415dc7b8 - .quad 0xe04ecc3bdf273b5e - .quad 0x1420683db54e4cd2 - - // 2^104 * 2 * G - - .quad 0xb478bd1e249dd197 - .quad 0x620c35005e58c102 - .quad 0xfb02d32fccbaac5c - .quad 0x60b63bebf508a72d - .quad 0x34eebb6fc1cc5ad0 - .quad 0x6a1b0ce99646ac8b - .quad 0xd3b0da49a66bde53 - .quad 0x31e83b4161d081c1 - .quad 0x97e8c7129e062b4f - .quad 0x49e48f4f29320ad8 - .quad 0x5bece14b6f18683f - .quad 0x55cf1eb62d550317 - - // 2^104 * 3 * G - - .quad 0x5879101065c23d58 - .quad 0x8b9d086d5094819c - .quad 0xe2402fa912c55fa7 - .quad 0x669a6564570891d4 - .quad 0x3076b5e37df58c52 - .quad 0xd73ab9dde799cc36 - .quad 0xbd831ce34913ee20 - .quad 0x1a56fbaa62ba0133 - .quad 0x943e6b505c9dc9ec - .quad 0x302557bba77c371a - .quad 0x9873ae5641347651 - .quad 0x13c4836799c58a5c - - // 2^104 * 4 * G - - .quad 0x423a5d465ab3e1b9 - .quad 0xfc13c187c7f13f61 - .quad 0x19f83664ecb5b9b6 - .quad 0x66f80c93a637b607 - .quad 0xc4dcfb6a5d8bd080 - .quad 0xdeebc4ec571a4842 - .quad 0xd4b2e883b8e55365 - .quad 0x50bdc87dc8e5b827 - .quad 0x606d37836edfe111 - .quad 0x32353e15f011abd9 - .quad 0x64b03ac325b73b96 - .quad 0x1dd56444725fd5ae - - // 2^104 * 5 * G - - .quad 0x8fa47ff83362127d - .quad 0xbc9f6ac471cd7c15 - .quad 0x6e71454349220c8b - .quad 0x0e645912219f732e - .quad 0xc297e60008bac89a - .quad 0x7d4cea11eae1c3e0 - .quad 0xf3e38be19fe7977c - .quad 0x3a3a450f63a305cd - .quad 0x078f2f31d8394627 - .quad 0x389d3183de94a510 - .quad 0xd1e36c6d17996f80 - .quad 0x318c8d9393a9a87b - - // 2^104 * 6 * G - - .quad 0xf2745d032afffe19 - .quad 0x0c9f3c497f24db66 - .quad 0xbc98d3e3ba8598ef - .quad 0x224c7c679a1d5314 - .quad 0x5d669e29ab1dd398 - .quad 0xfc921658342d9e3b - .quad 0x55851dfdf35973cd - .quad 0x509a41c325950af6 - .quad 0xbdc06edca6f925e9 - .quad 0x793ef3f4641b1f33 - .quad 0x82ec12809d833e89 - .quad 0x05bff02328a11389 - - // 2^104 * 7 * G - - .quad 0x3632137023cae00b - .quad 0x544acf0ad1accf59 - .quad 0x96741049d21a1c88 - .quad 0x780b8cc3fa2a44a7 - .quad 0x6881a0dd0dc512e4 - .quad 0x4fe70dc844a5fafe - .quad 0x1f748e6b8f4a5240 - .quad 0x576277cdee01a3ea - .quad 0x1ef38abc234f305f - .quad 0x9a577fbd1405de08 - .quad 0x5e82a51434e62a0d - .quad 0x5ff418726271b7a1 - - // 2^104 * 8 * G - - .quad 0x398e080c1789db9d - .quad 0xa7602025f3e778f5 - .quad 0xfa98894c06bd035d - .quad 0x106a03dc25a966be - .quad 0xe5db47e813b69540 - .quad 0xf35d2a3b432610e1 - .quad 0xac1f26e938781276 - .quad 0x29d4db8ca0a0cb69 - .quad 0xd9ad0aaf333353d0 - .quad 0x38669da5acd309e5 - .quad 0x3c57658ac888f7f0 - .quad 0x4ab38a51052cbefa - - // 2^108 * 1 * G - - .quad 0xdfdacbee4324c0e9 - .quad 0x054442883f955bb7 - .quad 0xdef7aaa8ea31609f - .quad 0x68aee70642287cff - .quad 0xf68fe2e8809de054 - .quad 0xe3bc096a9c82bad1 - .quad 0x076353d40aadbf45 - .quad 0x7b9b1fb5dea1959e - .quad 0xf01cc8f17471cc0c - .quad 0x95242e37579082bb - .quad 0x27776093d3e46b5f - .quad 0x2d13d55a28bd85fb - - // 2^108 * 2 * G - - .quad 0xfac5d2065b35b8da - .quad 0xa8da8a9a85624bb7 - .quad 0xccd2ca913d21cd0f - .quad 0x6b8341ee8bf90d58 - .quad 0xbf019cce7aee7a52 - .quad 0xa8ded2b6e454ead3 - .quad 0x3c619f0b87a8bb19 - .quad 0x3619b5d7560916d8 - .quad 0x3579f26b0282c4b2 - .quad 0x64d592f24fafefae - .quad 0xb7cded7b28c8c7c0 - .quad 0x6a927b6b7173a8d7 - - // 2^108 * 3 * G - - .quad 0x1f6db24f986e4656 - .quad 0x1021c02ed1e9105b - .quad 0xf8ff3fff2cc0a375 - .quad 0x1d2a6bf8c6c82592 - .quad 0x8d7040863ece88eb - .quad 0xf0e307a980eec08c - .quad 0xac2250610d788fda - .quad 0x056d92a43a0d478d - .quad 0x1b05a196fc3da5a1 - .quad 0x77d7a8c243b59ed0 - .quad 0x06da3d6297d17918 - .quad 0x66fbb494f12353f7 - - // 2^108 * 4 * G - - .quad 0x751a50b9d85c0fb8 - .quad 0xd1afdc258bcf097b - .quad 0x2f16a6a38309a969 - .quad 0x14ddff9ee5b00659 - .quad 0xd6d70996f12309d6 - .quad 0xdbfb2385e9c3d539 - .quad 0x46d602b0f7552411 - .quad 0x270a0b0557843e0c - .quad 0x61ff0640a7862bcc - .quad 0x81cac09a5f11abfe - .quad 0x9047830455d12abb - .quad 0x19a4bde1945ae873 - - // 2^108 * 5 * G - - .quad 0x9b9f26f520a6200a - .quad 0x64804443cf13eaf8 - .quad 0x8a63673f8631edd3 - .quad 0x72bbbce11ed39dc1 - .quad 0x40c709dec076c49f - .quad 0x657bfaf27f3e53f6 - .quad 0x40662331eca042c4 - .quad 0x14b375487eb4df04 - .quad 0xae853c94ab66dc47 - .quad 0xeb62343edf762d6e - .quad 0xf08e0e186fb2f7d1 - .quad 0x4f0b1c02700ab37a - - // 2^108 * 6 * G - - .quad 0xe1706787d81951fa - .quad 0xa10a2c8eb290c77b - .quad 0xe7382fa03ed66773 - .quad 0x0a4d84710bcc4b54 - .quad 0x79fd21ccc1b2e23f - .quad 0x4ae7c281453df52a - .quad 0xc8172ec9d151486b - .quad 0x68abe9443e0a7534 - .quad 0xda12c6c407831dcb - .quad 0x0da230d74d5c510d - .quad 0x4ab1531e6bd404e1 - .quad 0x4106b166bcf440ef - - // 2^108 * 7 * G - - .quad 0x02e57a421cd23668 - .quad 0x4ad9fb5d0eaef6fd - .quad 0x954e6727b1244480 - .quad 0x7f792f9d2699f331 - .quad 0xa485ccd539e4ecf2 - .quad 0x5aa3f3ad0555bab5 - .quad 0x145e3439937df82d - .quad 0x1238b51e1214283f - .quad 0x0b886b925fd4d924 - .quad 0x60906f7a3626a80d - .quad 0xecd367b4b98abd12 - .quad 0x2876beb1def344cf - - // 2^108 * 8 * G - - .quad 0xdc84e93563144691 - .quad 0x632fe8a0d61f23f4 - .quad 0x4caa800612a9a8d5 - .quad 0x48f9dbfa0e9918d3 - .quad 0xd594b3333a8a85f8 - .quad 0x4ea37689e78d7d58 - .quad 0x73bf9f455e8e351f - .quad 0x5507d7d2bc41ebb4 - .quad 0x1ceb2903299572fc - .quad 0x7c8ccaa29502d0ee - .quad 0x91bfa43411cce67b - .quad 0x5784481964a831e7 - - // 2^112 * 1 * G - - .quad 0xda7c2b256768d593 - .quad 0x98c1c0574422ca13 - .quad 0xf1a80bd5ca0ace1d - .quad 0x29cdd1adc088a690 - .quad 0xd6cfd1ef5fddc09c - .quad 0xe82b3efdf7575dce - .quad 0x25d56b5d201634c2 - .quad 0x3041c6bb04ed2b9b - .quad 0x0ff2f2f9d956e148 - .quad 0xade797759f356b2e - .quad 0x1a4698bb5f6c025c - .quad 0x104bbd6814049a7b - - // 2^112 * 2 * G - - .quad 0x51f0fd3168f1ed67 - .quad 0x2c811dcdd86f3bc2 - .quad 0x44dc5c4304d2f2de - .quad 0x5be8cc57092a7149 - .quad 0xa95d9a5fd67ff163 - .quad 0xe92be69d4cc75681 - .quad 0xb7f8024cde20f257 - .quad 0x204f2a20fb072df5 - .quad 0xc8143b3d30ebb079 - .quad 0x7589155abd652e30 - .quad 0x653c3c318f6d5c31 - .quad 0x2570fb17c279161f - - // 2^112 * 3 * G - - .quad 0x3efa367f2cb61575 - .quad 0xf5f96f761cd6026c - .quad 0xe8c7142a65b52562 - .quad 0x3dcb65ea53030acd - .quad 0x192ea9550bb8245a - .quad 0xc8e6fba88f9050d1 - .quad 0x7986ea2d88a4c935 - .quad 0x241c5f91de018668 - .quad 0x28d8172940de6caa - .quad 0x8fbf2cf022d9733a - .quad 0x16d7fcdd235b01d1 - .quad 0x08420edd5fcdf0e5 - - // 2^112 * 4 * G - - .quad 0xcdff20ab8362fa4a - .quad 0x57e118d4e21a3e6e - .quad 0xe3179617fc39e62b - .quad 0x0d9a53efbc1769fd - .quad 0x0358c34e04f410ce - .quad 0xb6135b5a276e0685 - .quad 0x5d9670c7ebb91521 - .quad 0x04d654f321db889c - .quad 0x5e7dc116ddbdb5d5 - .quad 0x2954deb68da5dd2d - .quad 0x1cb608173334a292 - .quad 0x4a7a4f2618991ad7 - - // 2^112 * 5 * G - - .quad 0xf4a718025fb15f95 - .quad 0x3df65f346b5c1b8f - .quad 0xcdfcf08500e01112 - .quad 0x11b50c4cddd31848 - .quad 0x24c3b291af372a4b - .quad 0x93da8270718147f2 - .quad 0xdd84856486899ef2 - .quad 0x4a96314223e0ee33 - .quad 0xa6e8274408a4ffd6 - .quad 0x738e177e9c1576d9 - .quad 0x773348b63d02b3f2 - .quad 0x4f4bce4dce6bcc51 - - // 2^112 * 6 * G - - .quad 0xa71fce5ae2242584 - .quad 0x26ea725692f58a9e - .quad 0xd21a09d71cea3cf4 - .quad 0x73fcdd14b71c01e6 - .quad 0x30e2616ec49d0b6f - .quad 0xe456718fcaec2317 - .quad 0x48eb409bf26b4fa6 - .quad 0x3042cee561595f37 - .quad 0x427e7079449bac41 - .quad 0x855ae36dbce2310a - .quad 0x4cae76215f841a7c - .quad 0x389e740c9a9ce1d6 - - // 2^112 * 7 * G - - .quad 0x64fcb3ae34dcb9ce - .quad 0x97500323e348d0ad - .quad 0x45b3f07d62c6381b - .quad 0x61545379465a6788 - .quad 0xc9bd78f6570eac28 - .quad 0xe55b0b3227919ce1 - .quad 0x65fc3eaba19b91ed - .quad 0x25c425e5d6263690 - .quad 0x3f3e06a6f1d7de6e - .quad 0x3ef976278e062308 - .quad 0x8c14f6264e8a6c77 - .quad 0x6539a08915484759 - - // 2^112 * 8 * G - - .quad 0xe9d21f74c3d2f773 - .quad 0xc150544125c46845 - .quad 0x624e5ce8f9b99e33 - .quad 0x11c5e4aac5cd186c - .quad 0xddc4dbd414bb4a19 - .quad 0x19b2bc3c98424f8e - .quad 0x48a89fd736ca7169 - .quad 0x0f65320ef019bd90 - .quad 0xd486d1b1cafde0c6 - .quad 0x4f3fe6e3163b5181 - .quad 0x59a8af0dfaf2939a - .quad 0x4cabc7bdec33072a - - // 2^116 * 1 * G - - .quad 0x16faa8fb532f7428 - .quad 0xdbd42ea046a4e272 - .quad 0x5337653b8b9ea480 - .quad 0x4065947223973f03 - .quad 0xf7c0a19c1a54a044 - .quad 0x4a1c5e2477bd9fbb - .quad 0xa6e3ca115af22972 - .quad 0x1819bb953f2e9e0d - .quad 0x498fbb795e042e84 - .quad 0x7d0dd89a7698b714 - .quad 0x8bfb0ba427fe6295 - .quad 0x36ba82e721200524 - - // 2^116 * 2 * G - - .quad 0xd60ecbb74245ec41 - .quad 0xfd9be89e34348716 - .quad 0xc9240afee42284de - .quad 0x4472f648d0531db4 - .quad 0xc8d69d0a57274ed5 - .quad 0x45ba803260804b17 - .quad 0xdf3cda102255dfac - .quad 0x77d221232709b339 - .quad 0x498a6d7064ad94d8 - .quad 0xa5b5c8fd9af62263 - .quad 0x8ca8ed0545c141f4 - .quad 0x2c63bec3662d358c - - // 2^116 * 3 * G - - .quad 0x7fe60d8bea787955 - .quad 0xb9dc117eb5f401b7 - .quad 0x91c7c09a19355cce - .quad 0x22692ef59442bedf - .quad 0x9a518b3a8586f8bf - .quad 0x9ee71af6cbb196f0 - .quad 0xaa0625e6a2385cf2 - .quad 0x1deb2176ddd7c8d1 - .quad 0x8563d19a2066cf6c - .quad 0x401bfd8c4dcc7cd7 - .quad 0xd976a6becd0d8f62 - .quad 0x67cfd773a278b05e - - // 2^116 * 4 * G - - .quad 0x8dec31faef3ee475 - .quad 0x99dbff8a9e22fd92 - .quad 0x512d11594e26cab1 - .quad 0x0cde561eec4310b9 - .quad 0x2d5fa9855a4e586a - .quad 0x65f8f7a449beab7e - .quad 0xaa074dddf21d33d3 - .quad 0x185cba721bcb9dee - .quad 0x93869da3f4e3cb41 - .quad 0xbf0392f540f7977e - .quad 0x026204fcd0463b83 - .quad 0x3ec91a769eec6eed - - // 2^116 * 5 * G - - .quad 0x1e9df75bf78166ad - .quad 0x4dfda838eb0cd7af - .quad 0xba002ed8c1eaf988 - .quad 0x13fedb3e11f33cfc - .quad 0x0fad2fb7b0a3402f - .quad 0x46615ecbfb69f4a8 - .quad 0xf745bcc8c5f8eaa6 - .quad 0x7a5fa8794a94e896 - .quad 0x52958faa13cd67a1 - .quad 0x965ee0818bdbb517 - .quad 0x16e58daa2e8845b3 - .quad 0x357d397d5499da8f - - // 2^116 * 6 * G - - .quad 0x1ebfa05fb0bace6c - .quad 0xc934620c1caf9a1e - .quad 0xcc771cc41d82b61a - .quad 0x2d94a16aa5f74fec - .quad 0x481dacb4194bfbf8 - .quad 0x4d77e3f1bae58299 - .quad 0x1ef4612e7d1372a0 - .quad 0x3a8d867e70ff69e1 - .quad 0x6f58cd5d55aff958 - .quad 0xba3eaa5c75567721 - .quad 0x75c123999165227d - .quad 0x69be1343c2f2b35e - - // 2^116 * 7 * G - - .quad 0x0e091d5ee197c92a - .quad 0x4f51019f2945119f - .quad 0x143679b9f034e99c - .quad 0x7d88112e4d24c696 - .quad 0x82bbbdac684b8de3 - .quad 0xa2f4c7d03fca0718 - .quad 0x337f92fbe096aaa8 - .quad 0x200d4d8c63587376 - .quad 0x208aed4b4893b32b - .quad 0x3efbf23ebe59b964 - .quad 0xd762deb0dba5e507 - .quad 0x69607bd681bd9d94 - - // 2^116 * 8 * G - - .quad 0xf6be021068de1ce1 - .quad 0xe8d518e70edcbc1f - .quad 0xe3effdd01b5505a5 - .quad 0x35f63353d3ec3fd0 - .quad 0x3b7f3bd49323a902 - .quad 0x7c21b5566b2c6e53 - .quad 0xe5ba8ff53a7852a7 - .quad 0x28bc77a5838ece00 - .quad 0x63ba78a8e25d8036 - .quad 0x63651e0094333490 - .quad 0x48d82f20288ce532 - .quad 0x3a31abfa36b57524 - - // 2^120 * 1 * G - - .quad 0x239e9624089c0a2e - .quad 0xc748c4c03afe4738 - .quad 0x17dbed2a764fa12a - .quad 0x639b93f0321c8582 - .quad 0xc08f788f3f78d289 - .quad 0xfe30a72ca1404d9f - .quad 0xf2778bfccf65cc9d - .quad 0x7ee498165acb2021 - .quad 0x7bd508e39111a1c3 - .quad 0x2b2b90d480907489 - .quad 0xe7d2aec2ae72fd19 - .quad 0x0edf493c85b602a6 - - // 2^120 * 2 * G - - .quad 0xaecc8158599b5a68 - .quad 0xea574f0febade20e - .quad 0x4fe41d7422b67f07 - .quad 0x403b92e3019d4fb4 - .quad 0x6767c4d284764113 - .quad 0xa090403ff7f5f835 - .quad 0x1c8fcffacae6bede - .quad 0x04c00c54d1dfa369 - .quad 0x4dc22f818b465cf8 - .quad 0x71a0f35a1480eff8 - .quad 0xaee8bfad04c7d657 - .quad 0x355bb12ab26176f4 - - // 2^120 * 3 * G - - .quad 0xa71e64cc7493bbf4 - .quad 0xe5bd84d9eca3b0c3 - .quad 0x0a6bc50cfa05e785 - .quad 0x0f9b8132182ec312 - .quad 0xa301dac75a8c7318 - .quad 0xed90039db3ceaa11 - .quad 0x6f077cbf3bae3f2d - .quad 0x7518eaf8e052ad8e - .quad 0xa48859c41b7f6c32 - .quad 0x0f2d60bcf4383298 - .quad 0x1815a929c9b1d1d9 - .quad 0x47c3871bbb1755c4 - - // 2^120 * 4 * G - - .quad 0x5144539771ec4f48 - .quad 0xf805b17dc98c5d6e - .quad 0xf762c11a47c3c66b - .quad 0x00b89b85764699dc - .quad 0xfbe65d50c85066b0 - .quad 0x62ecc4b0b3a299b0 - .quad 0xe53754ea441ae8e0 - .quad 0x08fea02ce8d48d5f - .quad 0x824ddd7668deead0 - .quad 0xc86445204b685d23 - .quad 0xb514cfcd5d89d665 - .quad 0x473829a74f75d537 - - // 2^120 * 5 * G - - .quad 0x82d2da754679c418 - .quad 0xe63bd7d8b2618df0 - .quad 0x355eef24ac47eb0a - .quad 0x2078684c4833c6b4 - .quad 0x23d9533aad3902c9 - .quad 0x64c2ddceef03588f - .quad 0x15257390cfe12fb4 - .quad 0x6c668b4d44e4d390 - .quad 0x3b48cf217a78820c - .quad 0xf76a0ab281273e97 - .quad 0xa96c65a78c8eed7b - .quad 0x7411a6054f8a433f - - // 2^120 * 6 * G - - .quad 0x4d659d32b99dc86d - .quad 0x044cdc75603af115 - .quad 0xb34c712cdcc2e488 - .quad 0x7c136574fb8134ff - .quad 0x579ae53d18b175b4 - .quad 0x68713159f392a102 - .quad 0x8455ecba1eef35f5 - .quad 0x1ec9a872458c398f - .quad 0xb8e6a4d400a2509b - .quad 0x9b81d7020bc882b4 - .quad 0x57e7cc9bf1957561 - .quad 0x3add88a5c7cd6460 - - // 2^120 * 7 * G - - .quad 0xab895770b635dcf2 - .quad 0x02dfef6cf66c1fbc - .quad 0x85530268beb6d187 - .quad 0x249929fccc879e74 - .quad 0x85c298d459393046 - .quad 0x8f7e35985ff659ec - .quad 0x1d2ca22af2f66e3a - .quad 0x61ba1131a406a720 - .quad 0xa3d0a0f116959029 - .quad 0x023b6b6cba7ebd89 - .quad 0x7bf15a3e26783307 - .quad 0x5620310cbbd8ece7 - - // 2^120 * 8 * G - - .quad 0x528993434934d643 - .quad 0xb9dbf806a51222f5 - .quad 0x8f6d878fc3f41c22 - .quad 0x37676a2a4d9d9730 - .quad 0x6646b5f477e285d6 - .quad 0x40e8ff676c8f6193 - .quad 0xa6ec7311abb594dd - .quad 0x7ec846f3658cec4d - .quad 0x9b5e8f3f1da22ec7 - .quad 0x130f1d776c01cd13 - .quad 0x214c8fcfa2989fb8 - .quad 0x6daaf723399b9dd5 - - // 2^124 * 1 * G - - .quad 0x591e4a5610628564 - .quad 0x2a4bb87ca8b4df34 - .quad 0xde2a2572e7a38e43 - .quad 0x3cbdabd9fee5046e - .quad 0x81aebbdd2cd13070 - .quad 0x962e4325f85a0e9e - .quad 0xde9391aacadffecb - .quad 0x53177fda52c230e6 - .quad 0xa7bc970650b9de79 - .quad 0x3d12a7fbc301b59b - .quad 0x02652e68d36ae38c - .quad 0x79d739835a6199dc - - // 2^124 * 2 * G - - .quad 0xd9354df64131c1bd - .quad 0x758094a186ec5822 - .quad 0x4464ee12e459f3c2 - .quad 0x6c11fce4cb133282 - .quad 0x21c9d9920d591737 - .quad 0x9bea41d2e9b46cd6 - .quad 0xe20e84200d89bfca - .quad 0x79d99f946eae5ff8 - .quad 0xf17b483568673205 - .quad 0x387deae83caad96c - .quad 0x61b471fd56ffe386 - .quad 0x31741195b745a599 - - // 2^124 * 3 * G - - .quad 0xe8d10190b77a360b - .quad 0x99b983209995e702 - .quad 0xbd4fdff8fa0247aa - .quad 0x2772e344e0d36a87 - .quad 0x17f8ba683b02a047 - .quad 0x50212096feefb6c8 - .quad 0x70139be21556cbe2 - .quad 0x203e44a11d98915b - .quad 0xd6863eba37b9e39f - .quad 0x105bc169723b5a23 - .quad 0x104f6459a65c0762 - .quad 0x567951295b4d38d4 - - // 2^124 * 4 * G - - .quad 0x535fd60613037524 - .quad 0xe210adf6b0fbc26a - .quad 0xac8d0a9b23e990ae - .quad 0x47204d08d72fdbf9 - .quad 0x07242eb30d4b497f - .quad 0x1ef96306b9bccc87 - .quad 0x37950934d8116f45 - .quad 0x05468d6201405b04 - .quad 0x00f565a9f93267de - .quad 0xcecfd78dc0d58e8a - .quad 0xa215e2dcf318e28e - .quad 0x4599ee919b633352 - - // 2^124 * 5 * G - - .quad 0xd3c220ca70e0e76b - .quad 0xb12bea58ea9f3094 - .quad 0x294ddec8c3271282 - .quad 0x0c3539e1a1d1d028 - .quad 0xac746d6b861ae579 - .quad 0x31ab0650f6aea9dc - .quad 0x241d661140256d4c - .quad 0x2f485e853d21a5de - .quad 0x329744839c0833f3 - .quad 0x6fe6257fd2abc484 - .quad 0x5327d1814b358817 - .quad 0x65712585893fe9bc - - // 2^124 * 6 * G - - .quad 0x9c102fb732a61161 - .quad 0xe48e10dd34d520a8 - .quad 0x365c63546f9a9176 - .quad 0x32f6fe4c046f6006 - .quad 0x81c29f1bd708ee3f - .quad 0xddcb5a05ae6407d0 - .quad 0x97aec1d7d2a3eba7 - .quad 0x1590521a91d50831 - .quad 0x40a3a11ec7910acc - .quad 0x9013dff8f16d27ae - .quad 0x1a9720d8abb195d4 - .quad 0x1bb9fe452ea98463 - - // 2^124 * 7 * G - - .quad 0xe9d1d950b3d54f9e - .quad 0x2d5f9cbee00d33c1 - .quad 0x51c2c656a04fc6ac - .quad 0x65c091ee3c1cbcc9 - .quad 0xcf5e6c95cc36747c - .quad 0x294201536b0bc30d - .quad 0x453ac67cee797af0 - .quad 0x5eae6ab32a8bb3c9 - .quad 0x7083661114f118ea - .quad 0x2b37b87b94349cad - .quad 0x7273f51cb4e99f40 - .quad 0x78a2a95823d75698 - - // 2^124 * 8 * G - - .quad 0xa2b072e95c8c2ace - .quad 0x69cffc96651e9c4b - .quad 0x44328ef842e7b42b - .quad 0x5dd996c122aadeb3 - .quad 0xb4f23c425ef83207 - .quad 0xabf894d3c9a934b5 - .quad 0xd0708c1339fd87f7 - .quad 0x1876789117166130 - .quad 0x925b5ef0670c507c - .quad 0x819bc842b93c33bf - .quad 0x10792e9a70dd003f - .quad 0x59ad4b7a6e28dc74 - - // 2^128 * 1 * G - - .quad 0x5f3a7562eb3dbe47 - .quad 0xf7ea38548ebda0b8 - .quad 0x00c3e53145747299 - .quad 0x1304e9e71627d551 - .quad 0x583b04bfacad8ea2 - .quad 0x29b743e8148be884 - .quad 0x2b1e583b0810c5db - .quad 0x2b5449e58eb3bbaa - .quad 0x789814d26adc9cfe - .quad 0x3c1bab3f8b48dd0b - .quad 0xda0fe1fff979c60a - .quad 0x4468de2d7c2dd693 - - // 2^128 * 2 * G - - .quad 0x51bb355e9419469e - .quad 0x33e6dc4c23ddc754 - .quad 0x93a5b6d6447f9962 - .quad 0x6cce7c6ffb44bd63 - .quad 0x4b9ad8c6f86307ce - .quad 0x21113531435d0c28 - .quad 0xd4a866c5657a772c - .quad 0x5da6427e63247352 - .quad 0x1a94c688deac22ca - .quad 0xb9066ef7bbae1ff8 - .quad 0x88ad8c388d59580f - .quad 0x58f29abfe79f2ca8 - - // 2^128 * 3 * G - - .quad 0xe90ecfab8de73e68 - .quad 0x54036f9f377e76a5 - .quad 0xf0495b0bbe015982 - .quad 0x577629c4a7f41e36 - .quad 0x4b5a64bf710ecdf6 - .quad 0xb14ce538462c293c - .quad 0x3643d056d50b3ab9 - .quad 0x6af93724185b4870 - .quad 0x3220024509c6a888 - .quad 0xd2e036134b558973 - .quad 0x83e236233c33289f - .quad 0x701f25bb0caec18f - - // 2^128 * 4 * G - - .quad 0xc3a8b0f8e4616ced - .quad 0xf700660e9e25a87d - .quad 0x61e3061ff4bca59c - .quad 0x2e0c92bfbdc40be9 - .quad 0x9d18f6d97cbec113 - .quad 0x844a06e674bfdbe4 - .quad 0x20f5b522ac4e60d6 - .quad 0x720a5bc050955e51 - .quad 0x0c3f09439b805a35 - .quad 0xe84e8b376242abfc - .quad 0x691417f35c229346 - .quad 0x0e9b9cbb144ef0ec - - // 2^128 * 5 * G - - .quad 0xfbbad48ffb5720ad - .quad 0xee81916bdbf90d0e - .quad 0xd4813152635543bf - .quad 0x221104eb3f337bd8 - .quad 0x8dee9bd55db1beee - .quad 0xc9c3ab370a723fb9 - .quad 0x44a8f1bf1c68d791 - .quad 0x366d44191cfd3cde - .quad 0x9e3c1743f2bc8c14 - .quad 0x2eda26fcb5856c3b - .quad 0xccb82f0e68a7fb97 - .quad 0x4167a4e6bc593244 - - // 2^128 * 6 * G - - .quad 0x643b9d2876f62700 - .quad 0x5d1d9d400e7668eb - .quad 0x1b4b430321fc0684 - .quad 0x7938bb7e2255246a - .quad 0xc2be2665f8ce8fee - .quad 0xe967ff14e880d62c - .quad 0xf12e6e7e2f364eee - .quad 0x34b33370cb7ed2f6 - .quad 0xcdc591ee8681d6cc - .quad 0xce02109ced85a753 - .quad 0xed7485c158808883 - .quad 0x1176fc6e2dfe65e4 - - // 2^128 * 7 * G - - .quad 0xb4af6cd05b9c619b - .quad 0x2ddfc9f4b2a58480 - .quad 0x3d4fa502ebe94dc4 - .quad 0x08fc3a4c677d5f34 - .quad 0xdb90e28949770eb8 - .quad 0x98fbcc2aacf440a3 - .quad 0x21354ffeded7879b - .quad 0x1f6a3e54f26906b6 - .quad 0x60a4c199d30734ea - .quad 0x40c085b631165cd6 - .quad 0xe2333e23f7598295 - .quad 0x4f2fad0116b900d1 - - // 2^128 * 8 * G - - .quad 0x44beb24194ae4e54 - .quad 0x5f541c511857ef6c - .quad 0xa61e6b2d368d0498 - .quad 0x445484a4972ef7ab - .quad 0x962cd91db73bb638 - .quad 0xe60577aafc129c08 - .quad 0x6f619b39f3b61689 - .quad 0x3451995f2944ee81 - .quad 0x9152fcd09fea7d7c - .quad 0x4a816c94b0935cf6 - .quad 0x258e9aaa47285c40 - .quad 0x10b89ca6042893b7 - - // 2^132 * 1 * G - - .quad 0x9b2a426e3b646025 - .quad 0x32127190385ce4cf - .quad 0xa25cffc2dd6dea45 - .quad 0x06409010bea8de75 - .quad 0xd67cded679d34aa0 - .quad 0xcc0b9ec0cc4db39f - .quad 0xa535a456e35d190f - .quad 0x2e05d9eaf61f6fef - .quad 0xc447901ad61beb59 - .quad 0x661f19bce5dc880a - .quad 0x24685482b7ca6827 - .quad 0x293c778cefe07f26 - - // 2^132 * 2 * G - - .quad 0x86809e7007069096 - .quad 0xaad75b15e4e50189 - .quad 0x07f35715a21a0147 - .quad 0x0487f3f112815d5e - .quad 0x16c795d6a11ff200 - .quad 0xcb70d0e2b15815c9 - .quad 0x89f293209b5395b5 - .quad 0x50b8c2d031e47b4f - .quad 0x48350c08068a4962 - .quad 0x6ffdd05351092c9a - .quad 0x17af4f4aaf6fc8dd - .quad 0x4b0553b53cdba58b - - // 2^132 * 3 * G - - .quad 0x9c65fcbe1b32ff79 - .quad 0xeb75ea9f03b50f9b - .quad 0xfced2a6c6c07e606 - .quad 0x35106cd551717908 - .quad 0xbf05211b27c152d4 - .quad 0x5ec26849bd1af639 - .quad 0x5e0b2caa8e6fab98 - .quad 0x054c8bdd50bd0840 - .quad 0x38a0b12f1dcf073d - .quad 0x4b60a8a3b7f6a276 - .quad 0xfed5ac25d3404f9a - .quad 0x72e82d5e5505c229 - - // 2^132 * 4 * G - - .quad 0x6b0b697ff0d844c8 - .quad 0xbb12f85cd979cb49 - .quad 0xd2a541c6c1da0f1f - .quad 0x7b7c242958ce7211 - .quad 0x00d9cdfd69771d02 - .quad 0x410276cd6cfbf17e - .quad 0x4c45306c1cb12ec7 - .quad 0x2857bf1627500861 - .quad 0x9f21903f0101689e - .quad 0xd779dfd3bf861005 - .quad 0xa122ee5f3deb0f1b - .quad 0x510df84b485a00d4 - - // 2^132 * 5 * G - - .quad 0xa54133bb9277a1fa - .quad 0x74ec3b6263991237 - .quad 0x1a3c54dc35d2f15a - .quad 0x2d347144e482ba3a - .quad 0x24b3c887c70ac15e - .quad 0xb0f3a557fb81b732 - .quad 0x9b2cde2fe578cc1b - .quad 0x4cf7ed0703b54f8e - .quad 0x6bd47c6598fbee0f - .quad 0x9e4733e2ab55be2d - .quad 0x1093f624127610c5 - .quad 0x4e05e26ad0a1eaa4 - - // 2^132 * 6 * G - - .quad 0xda9b6b624b531f20 - .quad 0x429a760e77509abb - .quad 0xdbe9f522e823cb80 - .quad 0x618f1856880c8f82 - .quad 0x1833c773e18fe6c0 - .quad 0xe3c4711ad3c87265 - .quad 0x3bfd3c4f0116b283 - .quad 0x1955875eb4cd4db8 - .quad 0x6da6de8f0e399799 - .quad 0x7ad61aa440fda178 - .quad 0xb32cd8105e3563dd - .quad 0x15f6beae2ae340ae - - // 2^132 * 7 * G - - .quad 0x862bcb0c31ec3a62 - .quad 0x810e2b451138f3c2 - .quad 0x788ec4b839dac2a4 - .quad 0x28f76867ae2a9281 - .quad 0xba9a0f7b9245e215 - .quad 0xf368612dd98c0dbb - .quad 0x2e84e4cbf220b020 - .quad 0x6ba92fe962d90eda - .quad 0x3e4df9655884e2aa - .quad 0xbd62fbdbdbd465a5 - .quad 0xd7596caa0de9e524 - .quad 0x6e8042ccb2b1b3d7 - - // 2^132 * 8 * G - - .quad 0xf10d3c29ce28ca6e - .quad 0xbad34540fcb6093d - .quad 0xe7426ed7a2ea2d3f - .quad 0x08af9d4e4ff298b9 - .quad 0x1530653616521f7e - .quad 0x660d06b896203dba - .quad 0x2d3989bc545f0879 - .quad 0x4b5303af78ebd7b0 - .quad 0x72f8a6c3bebcbde8 - .quad 0x4f0fca4adc3a8e89 - .quad 0x6fa9d4e8c7bfdf7a - .quad 0x0dcf2d679b624eb7 - - // 2^136 * 1 * G - - .quad 0x3d5947499718289c - .quad 0x12ebf8c524533f26 - .quad 0x0262bfcb14c3ef15 - .quad 0x20b878d577b7518e - .quad 0x753941be5a45f06e - .quad 0xd07caeed6d9c5f65 - .quad 0x11776b9c72ff51b6 - .quad 0x17d2d1d9ef0d4da9 - .quad 0x27f2af18073f3e6a - .quad 0xfd3fe519d7521069 - .quad 0x22e3b72c3ca60022 - .quad 0x72214f63cc65c6a7 - - // 2^136 * 2 * G - - .quad 0xb4e37f405307a693 - .quad 0xaba714d72f336795 - .quad 0xd6fbd0a773761099 - .quad 0x5fdf48c58171cbc9 - .quad 0x1d9db7b9f43b29c9 - .quad 0xd605824a4f518f75 - .quad 0xf2c072bd312f9dc4 - .quad 0x1f24ac855a1545b0 - .quad 0x24d608328e9505aa - .quad 0x4748c1d10c1420ee - .quad 0xc7ffe45c06fb25a2 - .quad 0x00ba739e2ae395e6 - - // 2^136 * 3 * G - - .quad 0x592e98de5c8790d6 - .quad 0xe5bfb7d345c2a2df - .quad 0x115a3b60f9b49922 - .quad 0x03283a3e67ad78f3 - .quad 0xae4426f5ea88bb26 - .quad 0x360679d984973bfb - .quad 0x5c9f030c26694e50 - .quad 0x72297de7d518d226 - .quad 0x48241dc7be0cb939 - .quad 0x32f19b4d8b633080 - .quad 0xd3dfc90d02289308 - .quad 0x05e1296846271945 - - // 2^136 * 4 * G - - .quad 0xba82eeb32d9c495a - .quad 0xceefc8fcf12bb97c - .quad 0xb02dabae93b5d1e0 - .quad 0x39c00c9c13698d9b - .quad 0xadbfbbc8242c4550 - .quad 0xbcc80cecd03081d9 - .quad 0x843566a6f5c8df92 - .quad 0x78cf25d38258ce4c - .quad 0x15ae6b8e31489d68 - .quad 0xaa851cab9c2bf087 - .quad 0xc9a75a97f04efa05 - .quad 0x006b52076b3ff832 - - // 2^136 * 5 * G - - .quad 0x29e0cfe19d95781c - .quad 0xb681df18966310e2 - .quad 0x57df39d370516b39 - .quad 0x4d57e3443bc76122 - .quad 0xf5cb7e16b9ce082d - .quad 0x3407f14c417abc29 - .quad 0xd4b36bce2bf4a7ab - .quad 0x7de2e9561a9f75ce - .quad 0xde70d4f4b6a55ecb - .quad 0x4801527f5d85db99 - .quad 0xdbc9c440d3ee9a81 - .quad 0x6b2a90af1a6029ed - - // 2^136 * 6 * G - - .quad 0x6923f4fc9ae61e97 - .quad 0x5735281de03f5fd1 - .quad 0xa764ae43e6edd12d - .quad 0x5fd8f4e9d12d3e4a - .quad 0x77ebf3245bb2d80a - .quad 0xd8301b472fb9079b - .quad 0xc647e6f24cee7333 - .quad 0x465812c8276c2109 - .quad 0x4d43beb22a1062d9 - .quad 0x7065fb753831dc16 - .quad 0x180d4a7bde2968d7 - .quad 0x05b32c2b1cb16790 - - // 2^136 * 7 * G - - .quad 0xc8c05eccd24da8fd - .quad 0xa1cf1aac05dfef83 - .quad 0xdbbeeff27df9cd61 - .quad 0x3b5556a37b471e99 - .quad 0xf7fca42c7ad58195 - .quad 0x3214286e4333f3cc - .quad 0xb6c29d0d340b979d - .quad 0x31771a48567307e1 - .quad 0x32b0c524e14dd482 - .quad 0xedb351541a2ba4b6 - .quad 0xa3d16048282b5af3 - .quad 0x4fc079d27a7336eb - - // 2^136 * 8 * G - - .quad 0x51c938b089bf2f7f - .quad 0x2497bd6502dfe9a7 - .quad 0xffffc09c7880e453 - .quad 0x124567cecaf98e92 - .quad 0xdc348b440c86c50d - .quad 0x1337cbc9cc94e651 - .quad 0x6422f74d643e3cb9 - .quad 0x241170c2bae3cd08 - .quad 0x3ff9ab860ac473b4 - .quad 0xf0911dee0113e435 - .quad 0x4ae75060ebc6c4af - .quad 0x3f8612966c87000d - - // 2^140 * 1 * G - - .quad 0x0c9c5303f7957be4 - .quad 0xa3c31a20e085c145 - .quad 0xb0721d71d0850050 - .quad 0x0aba390eab0bf2da - .quad 0x529fdffe638c7bf3 - .quad 0xdf2b9e60388b4995 - .quad 0xe027b34f1bad0249 - .quad 0x7bc92fc9b9fa74ed - .quad 0x9f97ef2e801ad9f9 - .quad 0x83697d5479afda3a - .quad 0xe906b3ffbd596b50 - .quad 0x02672b37dd3fb8e0 - - // 2^140 * 2 * G - - .quad 0x48b2ca8b260885e4 - .quad 0xa4286bec82b34c1c - .quad 0x937e1a2617f58f74 - .quad 0x741d1fcbab2ca2a5 - .quad 0xee9ba729398ca7f5 - .quad 0xeb9ca6257a4849db - .quad 0x29eb29ce7ec544e1 - .quad 0x232ca21ef736e2c8 - .quad 0xbf61423d253fcb17 - .quad 0x08803ceafa39eb14 - .quad 0xf18602df9851c7af - .quad 0x0400f3a049e3414b - - // 2^140 * 3 * G - - .quad 0xabce0476ba61c55b - .quad 0x36a3d6d7c4d39716 - .quad 0x6eb259d5e8d82d09 - .quad 0x0c9176e984d756fb - .quad 0x2efba412a06e7b06 - .quad 0x146785452c8d2560 - .quad 0xdf9713ebd67a91c7 - .quad 0x32830ac7157eadf3 - .quad 0x0e782a7ab73769e8 - .quad 0x04a05d7875b18e2c - .quad 0x29525226ebcceae1 - .quad 0x0d794f8383eba820 - - // 2^140 * 4 * G - - .quad 0xff35f5cb9e1516f4 - .quad 0xee805bcf648aae45 - .quad 0xf0d73c2bb93a9ef3 - .quad 0x097b0bf22092a6c2 - .quad 0x7be44ce7a7a2e1ac - .quad 0x411fd93efad1b8b7 - .quad 0x1734a1d70d5f7c9b - .quad 0x0d6592233127db16 - .quad 0xc48bab1521a9d733 - .quad 0xa6c2eaead61abb25 - .quad 0x625c6c1cc6cb4305 - .quad 0x7fc90fea93eb3a67 - - // 2^140 * 5 * G - - .quad 0x0408f1fe1f5c5926 - .quad 0x1a8f2f5e3b258bf4 - .quad 0x40a951a2fdc71669 - .quad 0x6598ee93c98b577e - .quad 0xc527deb59c7cb23d - .quad 0x955391695328404e - .quad 0xd64392817ccf2c7a - .quad 0x6ce97dabf7d8fa11 - .quad 0x25b5a8e50ef7c48f - .quad 0xeb6034116f2ce532 - .quad 0xc5e75173e53de537 - .quad 0x73119fa08c12bb03 - - // 2^140 * 6 * G - - .quad 0xed30129453f1a4cb - .quad 0xbce621c9c8f53787 - .quad 0xfacb2b1338bee7b9 - .quad 0x3025798a9ea8428c - .quad 0x7845b94d21f4774d - .quad 0xbf62f16c7897b727 - .quad 0x671857c03c56522b - .quad 0x3cd6a85295621212 - .quad 0x3fecde923aeca999 - .quad 0xbdaa5b0062e8c12f - .quad 0x67b99dfc96988ade - .quad 0x3f52c02852661036 - - // 2^140 * 7 * G - - .quad 0xffeaa48e2a1351c6 - .quad 0x28624754fa7f53d7 - .quad 0x0b5ba9e57582ddf1 - .quad 0x60c0104ba696ac59 - .quad 0x9258bf99eec416c6 - .quad 0xac8a5017a9d2f671 - .quad 0x629549ab16dea4ab - .quad 0x05d0e85c99091569 - .quad 0x051de020de9cbe97 - .quad 0xfa07fc56b50bcf74 - .quad 0x378cec9f0f11df65 - .quad 0x36853c69ab96de4d - - // 2^140 * 8 * G - - .quad 0x36d9b8de78f39b2d - .quad 0x7f42ed71a847b9ec - .quad 0x241cd1d679bd3fde - .quad 0x6a704fec92fbce6b - .quad 0x4433c0b0fac5e7be - .quad 0x724bae854c08dcbe - .quad 0xf1f24cc446978f9b - .quad 0x4a0aff6d62825fc8 - .quad 0xe917fb9e61095301 - .quad 0xc102df9402a092f8 - .quad 0xbf09e2f5fa66190b - .quad 0x681109bee0dcfe37 - - // 2^144 * 1 * G - - .quad 0x559a0cc9782a0dde - .quad 0x551dcdb2ea718385 - .quad 0x7f62865b31ef238c - .quad 0x504aa7767973613d - .quad 0x9c18fcfa36048d13 - .quad 0x29159db373899ddd - .quad 0xdc9f350b9f92d0aa - .quad 0x26f57eee878a19d4 - .quad 0x0cab2cd55687efb1 - .quad 0x5180d162247af17b - .quad 0x85c15a344f5a2467 - .quad 0x4041943d9dba3069 - - // 2^144 * 2 * G - - .quad 0xc3c0eeba43ebcc96 - .quad 0x8d749c9c26ea9caf - .quad 0xd9fa95ee1c77ccc6 - .quad 0x1420a1d97684340f - .quad 0x4b217743a26caadd - .quad 0x47a6b424648ab7ce - .quad 0xcb1d4f7a03fbc9e3 - .quad 0x12d931429800d019 - .quad 0x00c67799d337594f - .quad 0x5e3c5140b23aa47b - .quad 0x44182854e35ff395 - .quad 0x1b4f92314359a012 - - // 2^144 * 3 * G - - .quad 0x3e5c109d89150951 - .quad 0x39cefa912de9696a - .quad 0x20eae43f975f3020 - .quad 0x239b572a7f132dae - .quad 0x33cf3030a49866b1 - .quad 0x251f73d2215f4859 - .quad 0xab82aa4051def4f6 - .quad 0x5ff191d56f9a23f6 - .quad 0x819ed433ac2d9068 - .quad 0x2883ab795fc98523 - .quad 0xef4572805593eb3d - .quad 0x020c526a758f36cb - - // 2^144 * 4 * G - - .quad 0x779834f89ed8dbbc - .quad 0xc8f2aaf9dc7ca46c - .quad 0xa9524cdca3e1b074 - .quad 0x02aacc4615313877 - .quad 0xe931ef59f042cc89 - .quad 0x2c589c9d8e124bb6 - .quad 0xadc8e18aaec75997 - .quad 0x452cfe0a5602c50c - .quad 0x86a0f7a0647877df - .quad 0xbbc464270e607c9f - .quad 0xab17ea25f1fb11c9 - .quad 0x4cfb7d7b304b877b - - // 2^144 * 5 * G - - .quad 0x72b43d6cb89b75fe - .quad 0x54c694d99c6adc80 - .quad 0xb8c3aa373ee34c9f - .quad 0x14b4622b39075364 - .quad 0xe28699c29789ef12 - .quad 0x2b6ecd71df57190d - .quad 0xc343c857ecc970d0 - .quad 0x5b1d4cbc434d3ac5 - .quad 0xb6fb2615cc0a9f26 - .quad 0x3a4f0e2bb88dcce5 - .quad 0x1301498b3369a705 - .quad 0x2f98f71258592dd1 - - // 2^144 * 6 * G - - .quad 0x0c94a74cb50f9e56 - .quad 0x5b1ff4a98e8e1320 - .quad 0x9a2acc2182300f67 - .quad 0x3a6ae249d806aaf9 - .quad 0x2e12ae444f54a701 - .quad 0xfcfe3ef0a9cbd7de - .quad 0xcebf890d75835de0 - .quad 0x1d8062e9e7614554 - .quad 0x657ada85a9907c5a - .quad 0x1a0ea8b591b90f62 - .quad 0x8d0e1dfbdf34b4e9 - .quad 0x298b8ce8aef25ff3 - - // 2^144 * 7 * G - - .quad 0x2a927953eff70cb2 - .quad 0x4b89c92a79157076 - .quad 0x9418457a30a7cf6a - .quad 0x34b8a8404d5ce485 - .quad 0x837a72ea0a2165de - .quad 0x3fab07b40bcf79f6 - .quad 0x521636c77738ae70 - .quad 0x6ba6271803a7d7dc - .quad 0xc26eecb583693335 - .quad 0xd5a813df63b5fefd - .quad 0xa293aa9aa4b22573 - .quad 0x71d62bdd465e1c6a - - // 2^144 * 8 * G - - .quad 0x6533cc28d378df80 - .quad 0xf6db43790a0fa4b4 - .quad 0xe3645ff9f701da5a - .quad 0x74d5f317f3172ba4 - .quad 0xcd2db5dab1f75ef5 - .quad 0xd77f95cf16b065f5 - .quad 0x14571fea3f49f085 - .quad 0x1c333621262b2b3d - .quad 0xa86fe55467d9ca81 - .quad 0x398b7c752b298c37 - .quad 0xda6d0892e3ac623b - .quad 0x4aebcc4547e9d98c - - // 2^148 * 1 * G - - .quad 0x53175a7205d21a77 - .quad 0xb0c04422d3b934d4 - .quad 0xadd9f24bdd5deadc - .quad 0x074f46e69f10ff8c - .quad 0x0de9b204a059a445 - .quad 0xe15cb4aa4b17ad0f - .quad 0xe1bbec521f79c557 - .quad 0x2633f1b9d071081b - .quad 0xc1fb4177018b9910 - .quad 0xa6ea20dc6c0fe140 - .quad 0xd661f3e74354c6ff - .quad 0x5ecb72e6f1a3407a - - // 2^148 * 2 * G - - .quad 0xa515a31b2259fb4e - .quad 0x0960f3972bcac52f - .quad 0xedb52fec8d3454cb - .quad 0x382e2720c476c019 - .quad 0xfeeae106e8e86997 - .quad 0x9863337f98d09383 - .quad 0x9470480eaa06ebef - .quad 0x038b6898d4c5c2d0 - .quad 0xf391c51d8ace50a6 - .quad 0x3142d0b9ae2d2948 - .quad 0xdb4d5a1a7f24ca80 - .quad 0x21aeba8b59250ea8 - - // 2^148 * 3 * G - - .quad 0x24f13b34cf405530 - .quad 0x3c44ea4a43088af7 - .quad 0x5dd5c5170006a482 - .quad 0x118eb8f8890b086d - .quad 0x53853600f0087f23 - .quad 0x4c461879da7d5784 - .quad 0x6af303deb41f6860 - .quad 0x0a3c16c5c27c18ed - .quad 0x17e49c17cc947f3d - .quad 0xccc6eda6aac1d27b - .quad 0xdf6092ceb0f08e56 - .quad 0x4909b3e22c67c36b - - // 2^148 * 4 * G - - .quad 0x9c9c85ea63fe2e89 - .quad 0xbe1baf910e9412ec - .quad 0x8f7baa8a86fbfe7b - .quad 0x0fb17f9fef968b6c - .quad 0x59a16676706ff64e - .quad 0x10b953dd0d86a53d - .quad 0x5848e1e6ce5c0b96 - .quad 0x2d8b78e712780c68 - .quad 0x79d5c62eafc3902b - .quad 0x773a215289e80728 - .quad 0xc38ae640e10120b9 - .quad 0x09ae23717b2b1a6d - - // 2^148 * 5 * G - - .quad 0xbb6a192a4e4d083c - .quad 0x34ace0630029e192 - .quad 0x98245a59aafabaeb - .quad 0x6d9c8a9ada97faac - .quad 0x10ab8fa1ad32b1d0 - .quad 0xe9aced1be2778b24 - .quad 0xa8856bc0373de90f - .quad 0x66f35ddddda53996 - .quad 0xd27d9afb24997323 - .quad 0x1bb7e07ef6f01d2e - .quad 0x2ba7472df52ecc7f - .quad 0x03019b4f646f9dc8 - - // 2^148 * 6 * G - - .quad 0x04a186b5565345cd - .quad 0xeee76610bcc4116a - .quad 0x689c73b478fb2a45 - .quad 0x387dcbff65697512 - .quad 0xaf09b214e6b3dc6b - .quad 0x3f7573b5ad7d2f65 - .quad 0xd019d988100a23b0 - .quad 0x392b63a58b5c35f7 - .quad 0x4093addc9c07c205 - .quad 0xc565be15f532c37e - .quad 0x63dbecfd1583402a - .quad 0x61722b4aef2e032e - - // 2^148 * 7 * G - - .quad 0x0012aafeecbd47af - .quad 0x55a266fb1cd46309 - .quad 0xf203eb680967c72c - .quad 0x39633944ca3c1429 - .quad 0xd6b07a5581cb0e3c - .quad 0x290ff006d9444969 - .quad 0x08680b6a16dcda1f - .quad 0x5568d2b75a06de59 - .quad 0x8d0cb88c1b37cfe1 - .quad 0x05b6a5a3053818f3 - .quad 0xf2e9bc04b787d959 - .quad 0x6beba1249add7f64 - - // 2^148 * 8 * G - - .quad 0x1d06005ca5b1b143 - .quad 0x6d4c6bb87fd1cda2 - .quad 0x6ef5967653fcffe7 - .quad 0x097c29e8c1ce1ea5 - .quad 0x5c3cecb943f5a53b - .quad 0x9cc9a61d06c08df2 - .quad 0xcfba639a85895447 - .quad 0x5a845ae80df09fd5 - .quad 0x4ce97dbe5deb94ca - .quad 0x38d0a4388c709c48 - .quad 0xc43eced4a169d097 - .quad 0x0a1249fff7e587c3 - - // 2^152 * 1 * G - - .quad 0x12f0071b276d01c9 - .quad 0xe7b8bac586c48c70 - .quad 0x5308129b71d6fba9 - .quad 0x5d88fbf95a3db792 - .quad 0x0b408d9e7354b610 - .quad 0x806b32535ba85b6e - .quad 0xdbe63a034a58a207 - .quad 0x173bd9ddc9a1df2c - .quad 0x2b500f1efe5872df - .quad 0x58d6582ed43918c1 - .quad 0xe6ed278ec9673ae0 - .quad 0x06e1cd13b19ea319 - - // 2^152 * 2 * G - - .quad 0x40d0ad516f166f23 - .quad 0x118e32931fab6abe - .quad 0x3fe35e14a04d088e - .quad 0x3080603526e16266 - .quad 0x472baf629e5b0353 - .quad 0x3baa0b90278d0447 - .quad 0x0c785f469643bf27 - .quad 0x7f3a6a1a8d837b13 - .quad 0xf7e644395d3d800b - .quad 0x95a8d555c901edf6 - .quad 0x68cd7830592c6339 - .quad 0x30d0fded2e51307e - - // 2^152 * 3 * G - - .quad 0xe0594d1af21233b3 - .quad 0x1bdbe78ef0cc4d9c - .quad 0x6965187f8f499a77 - .quad 0x0a9214202c099868 - .quad 0x9cb4971e68b84750 - .quad 0xa09572296664bbcf - .quad 0x5c8de72672fa412b - .quad 0x4615084351c589d9 - .quad 0xbc9019c0aeb9a02e - .quad 0x55c7110d16034cae - .quad 0x0e6df501659932ec - .quad 0x3bca0d2895ca5dfe - - // 2^152 * 4 * G - - .quad 0x40f031bc3c5d62a4 - .quad 0x19fc8b3ecff07a60 - .quad 0x98183da2130fb545 - .quad 0x5631deddae8f13cd - .quad 0x9c688eb69ecc01bf - .quad 0xf0bc83ada644896f - .quad 0xca2d955f5f7a9fe2 - .quad 0x4ea8b4038df28241 - .quad 0x2aed460af1cad202 - .quad 0x46305305a48cee83 - .quad 0x9121774549f11a5f - .quad 0x24ce0930542ca463 - - // 2^152 * 5 * G - - .quad 0x1fe890f5fd06c106 - .quad 0xb5c468355d8810f2 - .quad 0x827808fe6e8caf3e - .quad 0x41d4e3c28a06d74b - .quad 0x3fcfa155fdf30b85 - .quad 0xd2f7168e36372ea4 - .quad 0xb2e064de6492f844 - .quad 0x549928a7324f4280 - .quad 0xf26e32a763ee1a2e - .quad 0xae91e4b7d25ffdea - .quad 0xbc3bd33bd17f4d69 - .quad 0x491b66dec0dcff6a - - // 2^152 * 6 * G - - .quad 0x98f5b13dc7ea32a7 - .quad 0xe3d5f8cc7e16db98 - .quad 0xac0abf52cbf8d947 - .quad 0x08f338d0c85ee4ac - .quad 0x75f04a8ed0da64a1 - .quad 0xed222caf67e2284b - .quad 0x8234a3791f7b7ba4 - .quad 0x4cf6b8b0b7018b67 - .quad 0xc383a821991a73bd - .quad 0xab27bc01df320c7a - .quad 0xc13d331b84777063 - .quad 0x530d4a82eb078a99 - - // 2^152 * 7 * G - - .quad 0x004c3630e1f94825 - .quad 0x7e2d78268cab535a - .quad 0xc7482323cc84ff8b - .quad 0x65ea753f101770b9 - .quad 0x6d6973456c9abf9e - .quad 0x257fb2fc4900a880 - .quad 0x2bacf412c8cfb850 - .quad 0x0db3e7e00cbfbd5b - .quad 0x3d66fc3ee2096363 - .quad 0x81d62c7f61b5cb6b - .quad 0x0fbe044213443b1a - .quad 0x02a4ec1921e1a1db - - // 2^152 * 8 * G - - .quad 0x5ce6259a3b24b8a2 - .quad 0xb8577acc45afa0b8 - .quad 0xcccbe6e88ba07037 - .quad 0x3d143c51127809bf - .quad 0xf5c86162f1cf795f - .quad 0x118c861926ee57f2 - .quad 0x172124851c063578 - .quad 0x36d12b5dec067fcf - .quad 0x126d279179154557 - .quad 0xd5e48f5cfc783a0a - .quad 0x36bdb6e8df179bac - .quad 0x2ef517885ba82859 - - // 2^156 * 1 * G - - .quad 0x88bd438cd11e0d4a - .quad 0x30cb610d43ccf308 - .quad 0xe09a0e3791937bcc - .quad 0x4559135b25b1720c - .quad 0x1ea436837c6da1e9 - .quad 0xf9c189af1fb9bdbe - .quad 0x303001fcce5dd155 - .quad 0x28a7c99ebc57be52 - .quad 0xb8fd9399e8d19e9d - .quad 0x908191cb962423ff - .quad 0xb2b948d747c742a3 - .quad 0x37f33226d7fb44c4 - - // 2^156 * 2 * G - - .quad 0x0dae8767b55f6e08 - .quad 0x4a43b3b35b203a02 - .quad 0xe3725a6e80af8c79 - .quad 0x0f7a7fd1705fa7a3 - .quad 0x33912553c821b11d - .quad 0x66ed42c241e301df - .quad 0x066fcc11104222fd - .quad 0x307a3b41c192168f - .quad 0x8eeb5d076eb55ce0 - .quad 0x2fc536bfaa0d925a - .quad 0xbe81830fdcb6c6e8 - .quad 0x556c7045827baf52 - - // 2^156 * 3 * G - - .quad 0x8e2b517302e9d8b7 - .quad 0xe3e52269248714e8 - .quad 0xbd4fbd774ca960b5 - .quad 0x6f4b4199c5ecada9 - .quad 0xb94b90022bf44406 - .quad 0xabd4237eff90b534 - .quad 0x7600a960faf86d3a - .quad 0x2f45abdac2322ee3 - .quad 0x61af4912c8ef8a6a - .quad 0xe58fa4fe43fb6e5e - .quad 0xb5afcc5d6fd427cf - .quad 0x6a5393281e1e11eb - - // 2^156 * 4 * G - - .quad 0xf3da5139a5d1ee89 - .quad 0x8145457cff936988 - .quad 0x3f622fed00e188c4 - .quad 0x0f513815db8b5a3d - .quad 0x0fff04fe149443cf - .quad 0x53cac6d9865cddd7 - .quad 0x31385b03531ed1b7 - .quad 0x5846a27cacd1039d - .quad 0x4ff5cdac1eb08717 - .quad 0x67e8b29590f2e9bc - .quad 0x44093b5e237afa99 - .quad 0x0d414bed8708b8b2 - - // 2^156 * 5 * G - - .quad 0xcfb68265fd0e75f6 - .quad 0xe45b3e28bb90e707 - .quad 0x7242a8de9ff92c7a - .quad 0x685b3201933202dd - .quad 0x81886a92294ac9e8 - .quad 0x23162b45d55547be - .quad 0x94cfbc4403715983 - .quad 0x50eb8fdb134bc401 - .quad 0xc0b73ec6d6b330cd - .quad 0x84e44807132faff1 - .quad 0x732b7352c4a5dee1 - .quad 0x5d7c7cf1aa7cd2d2 - - // 2^156 * 6 * G - - .quad 0xaf3b46bf7a4aafa2 - .quad 0xb78705ec4d40d411 - .quad 0x114f0c6aca7c15e3 - .quad 0x3f364faaa9489d4d - .quad 0x33d1013e9b73a562 - .quad 0x925cef5748ec26e1 - .quad 0xa7fce614dd468058 - .quad 0x78b0fad41e9aa438 - .quad 0xbf56a431ed05b488 - .quad 0xa533e66c9c495c7e - .quad 0xe8652baf87f3651a - .quad 0x0241800059d66c33 - - // 2^156 * 7 * G - - .quad 0xceb077fea37a5be4 - .quad 0xdb642f02e5a5eeb7 - .quad 0xc2e6d0c5471270b8 - .quad 0x4771b65538e4529c - .quad 0x28350c7dcf38ea01 - .quad 0x7c6cdbc0b2917ab6 - .quad 0xace7cfbe857082f7 - .quad 0x4d2845aba2d9a1e0 - .quad 0xbb537fe0447070de - .quad 0xcba744436dd557df - .quad 0xd3b5a3473600dbcb - .quad 0x4aeabbe6f9ffd7f8 - - // 2^156 * 8 * G - - .quad 0x4630119e40d8f78c - .quad 0xa01a9bc53c710e11 - .quad 0x486d2b258910dd79 - .quad 0x1e6c47b3db0324e5 - .quad 0x6a2134bcc4a9c8f2 - .quad 0xfbf8fd1c8ace2e37 - .quad 0x000ae3049911a0ba - .quad 0x046e3a616bc89b9e - .quad 0x14e65442f03906be - .quad 0x4a019d54e362be2a - .quad 0x68ccdfec8dc230c7 - .quad 0x7cfb7e3faf6b861c - - // 2^160 * 1 * G - - .quad 0x4637974e8c58aedc - .quad 0xb9ef22fbabf041a4 - .quad 0xe185d956e980718a - .quad 0x2f1b78fab143a8a6 - .quad 0x96eebffb305b2f51 - .quad 0xd3f938ad889596b8 - .quad 0xf0f52dc746d5dd25 - .quad 0x57968290bb3a0095 - .quad 0xf71ab8430a20e101 - .quad 0xf393658d24f0ec47 - .quad 0xcf7509a86ee2eed1 - .quad 0x7dc43e35dc2aa3e1 - - // 2^160 * 2 * G - - .quad 0x85966665887dd9c3 - .quad 0xc90f9b314bb05355 - .quad 0xc6e08df8ef2079b1 - .quad 0x7ef72016758cc12f - .quad 0x5a782a5c273e9718 - .quad 0x3576c6995e4efd94 - .quad 0x0f2ed8051f237d3e - .quad 0x044fb81d82d50a99 - .quad 0xc1df18c5a907e3d9 - .quad 0x57b3371dce4c6359 - .quad 0xca704534b201bb49 - .quad 0x7f79823f9c30dd2e - - // 2^160 * 3 * G - - .quad 0x8334d239a3b513e8 - .quad 0xc13670d4b91fa8d8 - .quad 0x12b54136f590bd33 - .quad 0x0a4e0373d784d9b4 - .quad 0x6a9c1ff068f587ba - .quad 0x0827894e0050c8de - .quad 0x3cbf99557ded5be7 - .quad 0x64a9b0431c06d6f0 - .quad 0x2eb3d6a15b7d2919 - .quad 0xb0b4f6a0d53a8235 - .quad 0x7156ce4389a45d47 - .quad 0x071a7d0ace18346c - - // 2^160 * 4 * G - - .quad 0xd3072daac887ba0b - .quad 0x01262905bfa562ee - .quad 0xcf543002c0ef768b - .quad 0x2c3bcc7146ea7e9c - .quad 0xcc0c355220e14431 - .quad 0x0d65950709b15141 - .quad 0x9af5621b209d5f36 - .quad 0x7c69bcf7617755d3 - .quad 0x07f0d7eb04e8295f - .quad 0x10db18252f50f37d - .quad 0xe951a9a3171798d7 - .quad 0x6f5a9a7322aca51d - - // 2^160 * 5 * G - - .quad 0x8ba1000c2f41c6c5 - .quad 0xc49f79c10cfefb9b - .quad 0x4efa47703cc51c9f - .quad 0x494e21a2e147afca - .quad 0xe729d4eba3d944be - .quad 0x8d9e09408078af9e - .quad 0x4525567a47869c03 - .quad 0x02ab9680ee8d3b24 - .quad 0xefa48a85dde50d9a - .quad 0x219a224e0fb9a249 - .quad 0xfa091f1dd91ef6d9 - .quad 0x6b5d76cbea46bb34 - - // 2^160 * 6 * G - - .quad 0x8857556cec0cd994 - .quad 0x6472dc6f5cd01dba - .quad 0xaf0169148f42b477 - .quad 0x0ae333f685277354 - .quad 0xe0f941171e782522 - .quad 0xf1e6ae74036936d3 - .quad 0x408b3ea2d0fcc746 - .quad 0x16fb869c03dd313e - .quad 0x288e199733b60962 - .quad 0x24fc72b4d8abe133 - .quad 0x4811f7ed0991d03e - .quad 0x3f81e38b8f70d075 - - // 2^160 * 7 * G - - .quad 0x7f910fcc7ed9affe - .quad 0x545cb8a12465874b - .quad 0xa8397ed24b0c4704 - .quad 0x50510fc104f50993 - .quad 0x0adb7f355f17c824 - .quad 0x74b923c3d74299a4 - .quad 0xd57c3e8bcbf8eaf7 - .quad 0x0ad3e2d34cdedc3d - .quad 0x6f0c0fc5336e249d - .quad 0x745ede19c331cfd9 - .quad 0xf2d6fd0009eefe1c - .quad 0x127c158bf0fa1ebe - - // 2^160 * 8 * G - - .quad 0xf6197c422e9879a2 - .quad 0xa44addd452ca3647 - .quad 0x9b413fc14b4eaccb - .quad 0x354ef87d07ef4f68 - .quad 0xdea28fc4ae51b974 - .quad 0x1d9973d3744dfe96 - .quad 0x6240680b873848a8 - .quad 0x4ed82479d167df95 - .quad 0xfee3b52260c5d975 - .quad 0x50352efceb41b0b8 - .quad 0x8808ac30a9f6653c - .quad 0x302d92d20539236d - - // 2^164 * 1 * G - - .quad 0x4c59023fcb3efb7c - .quad 0x6c2fcb99c63c2a94 - .quad 0xba4190e2c3c7e084 - .quad 0x0e545daea51874d9 - .quad 0x957b8b8b0df53c30 - .quad 0x2a1c770a8e60f098 - .quad 0xbbc7a670345796de - .quad 0x22a48f9a90c99bc9 - .quad 0x6b7dc0dc8d3fac58 - .quad 0x5497cd6ce6e42bfd - .quad 0x542f7d1bf400d305 - .quad 0x4159f47f048d9136 - - // 2^164 * 2 * G - - .quad 0x20ad660839e31e32 - .quad 0xf81e1bd58405be50 - .quad 0xf8064056f4dabc69 - .quad 0x14d23dd4ce71b975 - .quad 0x748515a8bbd24839 - .quad 0x77128347afb02b55 - .quad 0x50ba2ac649a2a17f - .quad 0x060525513ad730f1 - .quad 0xf2398e098aa27f82 - .quad 0x6d7982bb89a1b024 - .quad 0xfa694084214dd24c - .quad 0x71ab966fa32301c3 - - // 2^164 * 3 * G - - .quad 0x2dcbd8e34ded02fc - .quad 0x1151f3ec596f22aa - .quad 0xbca255434e0328da - .quad 0x35768fbe92411b22 - .quad 0xb1088a0702809955 - .quad 0x43b273ea0b43c391 - .quad 0xca9b67aefe0686ed - .quad 0x605eecbf8335f4ed - .quad 0x83200a656c340431 - .quad 0x9fcd71678ee59c2f - .quad 0x75d4613f71300f8a - .quad 0x7a912faf60f542f9 - - // 2^164 * 4 * G - - .quad 0xb204585e5edc1a43 - .quad 0x9f0e16ee5897c73c - .quad 0x5b82c0ae4e70483c - .quad 0x624a170e2bddf9be - .quad 0x253f4f8dfa2d5597 - .quad 0x25e49c405477130c - .quad 0x00c052e5996b1102 - .quad 0x33cb966e33bb6c4a - .quad 0x597028047f116909 - .quad 0x828ac41c1e564467 - .quad 0x70417dbde6217387 - .quad 0x721627aefbac4384 - - // 2^164 * 5 * G - - .quad 0x97d03bc38736add5 - .quad 0x2f1422afc532b130 - .quad 0x3aa68a057101bbc4 - .quad 0x4c946cf7e74f9fa7 - .quad 0xfd3097bc410b2f22 - .quad 0xf1a05da7b5cfa844 - .quad 0x61289a1def57ca74 - .quad 0x245ea199bb821902 - .quad 0xaedca66978d477f8 - .quad 0x1898ba3c29117fe1 - .quad 0xcf73f983720cbd58 - .quad 0x67da12e6b8b56351 - - // 2^164 * 6 * G - - .quad 0x7067e187b4bd6e07 - .quad 0x6e8f0203c7d1fe74 - .quad 0x93c6aa2f38c85a30 - .quad 0x76297d1f3d75a78a - .quad 0x2b7ef3d38ec8308c - .quad 0x828fd7ec71eb94ab - .quad 0x807c3b36c5062abd - .quad 0x0cb64cb831a94141 - .quad 0x3030fc33534c6378 - .quad 0xb9635c5ce541e861 - .quad 0x15d9a9bed9b2c728 - .quad 0x49233ea3f3775dcb - - // 2^164 * 7 * G - - .quad 0x629398fa8dbffc3a - .quad 0xe12fe52dd54db455 - .quad 0xf3be11dfdaf25295 - .quad 0x628b140dce5e7b51 - .quad 0x7b3985fe1c9f249b - .quad 0x4fd6b2d5a1233293 - .quad 0xceb345941adf4d62 - .quad 0x6987ff6f542de50c - .quad 0x47e241428f83753c - .quad 0x6317bebc866af997 - .quad 0xdabb5b433d1a9829 - .quad 0x074d8d245287fb2d - - // 2^164 * 8 * G - - .quad 0x8337d9cd440bfc31 - .quad 0x729d2ca1af318fd7 - .quad 0xa040a4a4772c2070 - .quad 0x46002ef03a7349be - .quad 0x481875c6c0e31488 - .quad 0x219429b2e22034b4 - .quad 0x7223c98a31283b65 - .quad 0x3420d60b342277f9 - .quad 0xfaa23adeaffe65f7 - .quad 0x78261ed45be0764c - .quad 0x441c0a1e2f164403 - .quad 0x5aea8e567a87d395 - - // 2^168 * 1 * G - - .quad 0x7813c1a2bca4283d - .quad 0xed62f091a1863dd9 - .quad 0xaec7bcb8c268fa86 - .quad 0x10e5d3b76f1cae4c - .quad 0x2dbc6fb6e4e0f177 - .quad 0x04e1bf29a4bd6a93 - .quad 0x5e1966d4787af6e8 - .quad 0x0edc5f5eb426d060 - .quad 0x5453bfd653da8e67 - .quad 0xe9dc1eec24a9f641 - .quad 0xbf87263b03578a23 - .quad 0x45b46c51361cba72 - - // 2^168 * 2 * G - - .quad 0xa9402abf314f7fa1 - .quad 0xe257f1dc8e8cf450 - .quad 0x1dbbd54b23a8be84 - .quad 0x2177bfa36dcb713b - .quad 0xce9d4ddd8a7fe3e4 - .quad 0xab13645676620e30 - .quad 0x4b594f7bb30e9958 - .quad 0x5c1c0aef321229df - .quad 0x37081bbcfa79db8f - .quad 0x6048811ec25f59b3 - .quad 0x087a76659c832487 - .quad 0x4ae619387d8ab5bb - - // 2^168 * 3 * G - - .quad 0x8ddbf6aa5344a32e - .quad 0x7d88eab4b41b4078 - .quad 0x5eb0eb974a130d60 - .quad 0x1a00d91b17bf3e03 - .quad 0x61117e44985bfb83 - .quad 0xfce0462a71963136 - .quad 0x83ac3448d425904b - .quad 0x75685abe5ba43d64 - .quad 0x6e960933eb61f2b2 - .quad 0x543d0fa8c9ff4952 - .quad 0xdf7275107af66569 - .quad 0x135529b623b0e6aa - - // 2^168 * 4 * G - - .quad 0x18f0dbd7add1d518 - .quad 0x979f7888cfc11f11 - .quad 0x8732e1f07114759b - .quad 0x79b5b81a65ca3a01 - .quad 0xf5c716bce22e83fe - .quad 0xb42beb19e80985c1 - .quad 0xec9da63714254aae - .quad 0x5972ea051590a613 - .quad 0x0fd4ac20dc8f7811 - .quad 0x9a9ad294ac4d4fa8 - .quad 0xc01b2d64b3360434 - .quad 0x4f7e9c95905f3bdb - - // 2^168 * 5 * G - - .quad 0x62674bbc5781302e - .quad 0xd8520f3989addc0f - .quad 0x8c2999ae53fbd9c6 - .quad 0x31993ad92e638e4c - .quad 0x71c8443d355299fe - .quad 0x8bcd3b1cdbebead7 - .quad 0x8092499ef1a49466 - .quad 0x1942eec4a144adc8 - .quad 0x7dac5319ae234992 - .quad 0x2c1b3d910cea3e92 - .quad 0x553ce494253c1122 - .quad 0x2a0a65314ef9ca75 - - // 2^168 * 6 * G - - .quad 0x2db7937ff7f927c2 - .quad 0xdb741f0617d0a635 - .quad 0x5982f3a21155af76 - .quad 0x4cf6e218647c2ded - .quad 0xcf361acd3c1c793a - .quad 0x2f9ebcac5a35bc3b - .quad 0x60e860e9a8cda6ab - .quad 0x055dc39b6dea1a13 - .quad 0xb119227cc28d5bb6 - .quad 0x07e24ebc774dffab - .quad 0xa83c78cee4a32c89 - .quad 0x121a307710aa24b6 - - // 2^168 * 7 * G - - .quad 0xe4db5d5e9f034a97 - .quad 0xe153fc093034bc2d - .quad 0x460546919551d3b1 - .quad 0x333fc76c7a40e52d - .quad 0xd659713ec77483c9 - .quad 0x88bfe077b82b96af - .quad 0x289e28231097bcd3 - .quad 0x527bb94a6ced3a9b - .quad 0x563d992a995b482e - .quad 0x3405d07c6e383801 - .quad 0x485035de2f64d8e5 - .quad 0x6b89069b20a7a9f7 - - // 2^168 * 8 * G - - .quad 0x812aa0416270220d - .quad 0x995a89faf9245b4e - .quad 0xffadc4ce5072ef05 - .quad 0x23bc2103aa73eb73 - .quad 0x4082fa8cb5c7db77 - .quad 0x068686f8c734c155 - .quad 0x29e6c8d9f6e7a57e - .quad 0x0473d308a7639bcf - .quad 0xcaee792603589e05 - .quad 0x2b4b421246dcc492 - .quad 0x02a1ef74e601a94f - .quad 0x102f73bfde04341a - - // 2^172 * 1 * G - - .quad 0xb5a2d50c7ec20d3e - .quad 0xc64bdd6ea0c97263 - .quad 0x56e89052c1ff734d - .quad 0x4929c6f72b2ffaba - .quad 0x358ecba293a36247 - .quad 0xaf8f9862b268fd65 - .quad 0x412f7e9968a01c89 - .quad 0x5786f312cd754524 - .quad 0x337788ffca14032c - .quad 0xf3921028447f1ee3 - .quad 0x8b14071f231bccad - .quad 0x4c817b4bf2344783 - - // 2^172 * 2 * G - - .quad 0x0ff853852871b96e - .quad 0xe13e9fab60c3f1bb - .quad 0xeefd595325344402 - .quad 0x0a37c37075b7744b - .quad 0x413ba057a40b4484 - .quad 0xba4c2e1a4f5f6a43 - .quad 0x614ba0a5aee1d61c - .quad 0x78a1531a8b05dc53 - .quad 0x6cbdf1703ad0562b - .quad 0x8ecf4830c92521a3 - .quad 0xdaebd303fd8424e7 - .quad 0x72ad82a42e5ec56f - - // 2^172 * 3 * G - - .quad 0x3f9e8e35bafb65f6 - .quad 0x39d69ec8f27293a1 - .quad 0x6cb8cd958cf6a3d0 - .quad 0x1734778173adae6d - .quad 0xc368939167024bc3 - .quad 0x8e69d16d49502fda - .quad 0xfcf2ec3ce45f4b29 - .quad 0x065f669ea3b4cbc4 - .quad 0x8a00aec75532db4d - .quad 0xb869a4e443e31bb1 - .quad 0x4a0f8552d3a7f515 - .quad 0x19adeb7c303d7c08 - - // 2^172 * 4 * G - - .quad 0xc720cb6153ead9a3 - .quad 0x55b2c97f512b636e - .quad 0xb1e35b5fd40290b1 - .quad 0x2fd9ccf13b530ee2 - .quad 0x9d05ba7d43c31794 - .quad 0x2470c8ff93322526 - .quad 0x8323dec816197438 - .quad 0x2852709881569b53 - .quad 0x07bd475b47f796b8 - .quad 0xd2c7b013542c8f54 - .quad 0x2dbd23f43b24f87e - .quad 0x6551afd77b0901d6 - - // 2^172 * 5 * G - - .quad 0x4546baaf54aac27f - .quad 0xf6f66fecb2a45a28 - .quad 0x582d1b5b562bcfe8 - .quad 0x44b123f3920f785f - .quad 0x68a24ce3a1d5c9ac - .quad 0xbb77a33d10ff6461 - .quad 0x0f86ce4425d3166e - .quad 0x56507c0950b9623b - .quad 0x1206f0b7d1713e63 - .quad 0x353fe3d915bafc74 - .quad 0x194ceb970ad9d94d - .quad 0x62fadd7cf9d03ad3 - - // 2^172 * 6 * G - - .quad 0xc6b5967b5598a074 - .quad 0x5efe91ce8e493e25 - .quad 0xd4b72c4549280888 - .quad 0x20ef1149a26740c2 - .quad 0x3cd7bc61e7ce4594 - .quad 0xcd6b35a9b7dd267e - .quad 0xa080abc84366ef27 - .quad 0x6ec7c46f59c79711 - .quad 0x2f07ad636f09a8a2 - .quad 0x8697e6ce24205e7d - .quad 0xc0aefc05ee35a139 - .quad 0x15e80958b5f9d897 - - // 2^172 * 7 * G - - .quad 0x25a5ef7d0c3e235b - .quad 0x6c39c17fbe134ee7 - .quad 0xc774e1342dc5c327 - .quad 0x021354b892021f39 - .quad 0x4dd1ed355bb061c4 - .quad 0x42dc0cef941c0700 - .quad 0x61305dc1fd86340e - .quad 0x56b2cc930e55a443 - .quad 0x1df79da6a6bfc5a2 - .quad 0x02f3a2749fde4369 - .quad 0xb323d9f2cda390a7 - .quad 0x7be0847b8774d363 - - // 2^172 * 8 * G - - .quad 0x8c99cc5a8b3f55c3 - .quad 0x0611d7253fded2a0 - .quad 0xed2995ff36b70a36 - .quad 0x1f699a54d78a2619 - .quad 0x1466f5af5307fa11 - .quad 0x817fcc7ded6c0af2 - .quad 0x0a6de44ec3a4a3fb - .quad 0x74071475bc927d0b - .quad 0xe77292f373e7ea8a - .quad 0x296537d2cb045a31 - .quad 0x1bd0653ed3274fde - .quad 0x2f9a2c4476bd2966 - - // 2^176 * 1 * G - - .quad 0xeb18b9ab7f5745c6 - .quad 0x023a8aee5787c690 - .quad 0xb72712da2df7afa9 - .quad 0x36597d25ea5c013d - .quad 0xa2b4dae0b5511c9a - .quad 0x7ac860292bffff06 - .quad 0x981f375df5504234 - .quad 0x3f6bd725da4ea12d - .quad 0x734d8d7b106058ac - .quad 0xd940579e6fc6905f - .quad 0x6466f8f99202932d - .quad 0x7b7ecc19da60d6d0 - - // 2^176 * 2 * G - - .quad 0x78c2373c695c690d - .quad 0xdd252e660642906e - .quad 0x951d44444ae12bd2 - .quad 0x4235ad7601743956 - .quad 0x6dae4a51a77cfa9b - .quad 0x82263654e7a38650 - .quad 0x09bbffcd8f2d82db - .quad 0x03bedc661bf5caba - .quad 0x6258cb0d078975f5 - .quad 0x492942549189f298 - .quad 0xa0cab423e2e36ee4 - .quad 0x0e7ce2b0cdf066a1 - - // 2^176 * 3 * G - - .quad 0xc494643ac48c85a3 - .quad 0xfd361df43c6139ad - .quad 0x09db17dd3ae94d48 - .quad 0x666e0a5d8fb4674a - .quad 0xfea6fedfd94b70f9 - .quad 0xf130c051c1fcba2d - .quad 0x4882d47e7f2fab89 - .quad 0x615256138aeceeb5 - .quad 0x2abbf64e4870cb0d - .quad 0xcd65bcf0aa458b6b - .quad 0x9abe4eba75e8985d - .quad 0x7f0bc810d514dee4 - - // 2^176 * 4 * G - - .quad 0xb9006ba426f4136f - .quad 0x8d67369e57e03035 - .quad 0xcbc8dfd94f463c28 - .quad 0x0d1f8dbcf8eedbf5 - .quad 0x83ac9dad737213a0 - .quad 0x9ff6f8ba2ef72e98 - .quad 0x311e2edd43ec6957 - .quad 0x1d3a907ddec5ab75 - .quad 0xba1693313ed081dc - .quad 0x29329fad851b3480 - .quad 0x0128013c030321cb - .quad 0x00011b44a31bfde3 - - // 2^176 * 5 * G - - .quad 0x3fdfa06c3fc66c0c - .quad 0x5d40e38e4dd60dd2 - .quad 0x7ae38b38268e4d71 - .quad 0x3ac48d916e8357e1 - .quad 0x16561f696a0aa75c - .quad 0xc1bf725c5852bd6a - .quad 0x11a8dd7f9a7966ad - .quad 0x63d988a2d2851026 - .quad 0x00120753afbd232e - .quad 0xe92bceb8fdd8f683 - .quad 0xf81669b384e72b91 - .quad 0x33fad52b2368a066 - - // 2^176 * 6 * G - - .quad 0x540649c6c5e41e16 - .quad 0x0af86430333f7735 - .quad 0xb2acfcd2f305e746 - .quad 0x16c0f429a256dca7 - .quad 0x8d2cc8d0c422cfe8 - .quad 0x072b4f7b05a13acb - .quad 0xa3feb6e6ecf6a56f - .quad 0x3cc355ccb90a71e2 - .quad 0xe9b69443903e9131 - .quad 0xb8a494cb7a5637ce - .quad 0xc87cd1a4baba9244 - .quad 0x631eaf426bae7568 - - // 2^176 * 7 * G - - .quad 0xb3e90410da66fe9f - .quad 0x85dd4b526c16e5a6 - .quad 0xbc3d97611ef9bf83 - .quad 0x5599648b1ea919b5 - .quad 0x47d975b9a3700de8 - .quad 0x7280c5fbe2f80552 - .quad 0x53658f2732e45de1 - .quad 0x431f2c7f665f80b5 - .quad 0xd6026344858f7b19 - .quad 0x14ab352fa1ea514a - .quad 0x8900441a2090a9d7 - .quad 0x7b04715f91253b26 - - // 2^176 * 8 * G - - .quad 0x83edbd28acf6ae43 - .quad 0x86357c8b7d5c7ab4 - .quad 0xc0404769b7eb2c44 - .quad 0x59b37bf5c2f6583f - .quad 0xb376c280c4e6bac6 - .quad 0x970ed3dd6d1d9b0b - .quad 0xb09a9558450bf944 - .quad 0x48d0acfa57cde223 - .quad 0xb60f26e47dabe671 - .quad 0xf1d1a197622f3a37 - .quad 0x4208ce7ee9960394 - .quad 0x16234191336d3bdb - - // 2^180 * 1 * G - - .quad 0xf19aeac733a63aef - .quad 0x2c7fba5d4442454e - .quad 0x5da87aa04795e441 - .quad 0x413051e1a4e0b0f5 - .quad 0x852dd1fd3d578bbe - .quad 0x2b65ce72c3286108 - .quad 0x658c07f4eace2273 - .quad 0x0933f804ec38ab40 - .quad 0xa7ab69798d496476 - .quad 0x8121aadefcb5abc8 - .quad 0xa5dc12ef7b539472 - .quad 0x07fd47065e45351a - - // 2^180 * 2 * G - - .quad 0xc8583c3d258d2bcd - .quad 0x17029a4daf60b73f - .quad 0xfa0fc9d6416a3781 - .quad 0x1c1e5fba38b3fb23 - .quad 0x304211559ae8e7c3 - .quad 0xf281b229944882a5 - .quad 0x8a13ac2e378250e4 - .quad 0x014afa0954ba48f4 - .quad 0xcb3197001bb3666c - .quad 0x330060524bffecb9 - .quad 0x293711991a88233c - .quad 0x291884363d4ed364 - - // 2^180 * 3 * G - - .quad 0x033c6805dc4babfa - .quad 0x2c15bf5e5596ecc1 - .quad 0x1bc70624b59b1d3b - .quad 0x3ede9850a19f0ec5 - .quad 0xfb9d37c3bc1ab6eb - .quad 0x02be14534d57a240 - .quad 0xf4d73415f8a5e1f6 - .quad 0x5964f4300ccc8188 - .quad 0xe44a23152d096800 - .quad 0x5c08c55970866996 - .quad 0xdf2db60a46affb6e - .quad 0x579155c1f856fd89 - - // 2^180 * 4 * G - - .quad 0x96324edd12e0c9ef - .quad 0x468b878df2420297 - .quad 0x199a3776a4f573be - .quad 0x1e7fbcf18e91e92a - .quad 0xb5f16b630817e7a6 - .quad 0x808c69233c351026 - .quad 0x324a983b54cef201 - .quad 0x53c092084a485345 - .quad 0xd2d41481f1cbafbf - .quad 0x231d2db6716174e5 - .quad 0x0b7d7656e2a55c98 - .quad 0x3e955cd82aa495f6 - - // 2^180 * 5 * G - - .quad 0xe48f535e3ed15433 - .quad 0xd075692a0d7270a3 - .quad 0x40fbd21daade6387 - .quad 0x14264887cf4495f5 - .quad 0xab39f3ef61bb3a3f - .quad 0x8eb400652eb9193e - .quad 0xb5de6ecc38c11f74 - .quad 0x654d7e9626f3c49f - .quad 0xe564cfdd5c7d2ceb - .quad 0x82eeafded737ccb9 - .quad 0x6107db62d1f9b0ab - .quad 0x0b6baac3b4358dbb - - // 2^180 * 6 * G - - .quad 0x7ae62bcb8622fe98 - .quad 0x47762256ceb891af - .quad 0x1a5a92bcf2e406b4 - .quad 0x7d29401784e41501 - .quad 0x204abad63700a93b - .quad 0xbe0023d3da779373 - .quad 0xd85f0346633ab709 - .quad 0x00496dc490820412 - .quad 0x1c74b88dc27e6360 - .quad 0x074854268d14850c - .quad 0xa145fb7b3e0dcb30 - .quad 0x10843f1b43803b23 - - // 2^180 * 7 * G - - .quad 0xc5f90455376276dd - .quad 0xce59158dd7645cd9 - .quad 0x92f65d511d366b39 - .quad 0x11574b6e526996c4 - .quad 0xd56f672de324689b - .quad 0xd1da8aedb394a981 - .quad 0xdd7b58fe9168cfed - .quad 0x7ce246cd4d56c1e8 - .quad 0xb8f4308e7f80be53 - .quad 0x5f3cb8cb34a9d397 - .quad 0x18a961bd33cc2b2c - .quad 0x710045fb3a9af671 - - // 2^180 * 8 * G - - .quad 0x73f93d36101b95eb - .quad 0xfaef33794f6f4486 - .quad 0x5651735f8f15e562 - .quad 0x7fa3f19058b40da1 - .quad 0xa03fc862059d699e - .quad 0x2370cfa19a619e69 - .quad 0xc4fe3b122f823deb - .quad 0x1d1b056fa7f0844e - .quad 0x1bc64631e56bf61f - .quad 0xd379ab106e5382a3 - .quad 0x4d58c57e0540168d - .quad 0x566256628442d8e4 - - // 2^184 * 1 * G - - .quad 0xb9e499def6267ff6 - .quad 0x7772ca7b742c0843 - .quad 0x23a0153fe9a4f2b1 - .quad 0x2cdfdfecd5d05006 - .quad 0xdd499cd61ff38640 - .quad 0x29cd9bc3063625a0 - .quad 0x51e2d8023dd73dc3 - .quad 0x4a25707a203b9231 - .quad 0x2ab7668a53f6ed6a - .quad 0x304242581dd170a1 - .quad 0x4000144c3ae20161 - .quad 0x5721896d248e49fc - - // 2^184 * 2 * G - - .quad 0x0b6e5517fd181bae - .quad 0x9022629f2bb963b4 - .quad 0x5509bce932064625 - .quad 0x578edd74f63c13da - .quad 0x285d5091a1d0da4e - .quad 0x4baa6fa7b5fe3e08 - .quad 0x63e5177ce19393b3 - .quad 0x03c935afc4b030fd - .quad 0x997276c6492b0c3d - .quad 0x47ccc2c4dfe205fc - .quad 0xdcd29b84dd623a3c - .quad 0x3ec2ab590288c7a2 - - // 2^184 * 3 * G - - .quad 0xa1a0d27be4d87bb9 - .quad 0xa98b4deb61391aed - .quad 0x99a0ddd073cb9b83 - .quad 0x2dd5c25a200fcace - .quad 0xa7213a09ae32d1cb - .quad 0x0f2b87df40f5c2d5 - .quad 0x0baea4c6e81eab29 - .quad 0x0e1bf66c6adbac5e - .quad 0xe2abd5e9792c887e - .quad 0x1a020018cb926d5d - .quad 0xbfba69cdbaae5f1e - .quad 0x730548b35ae88f5f - - // 2^184 * 4 * G - - .quad 0xc43551a3cba8b8ee - .quad 0x65a26f1db2115f16 - .quad 0x760f4f52ab8c3850 - .quad 0x3043443b411db8ca - .quad 0x805b094ba1d6e334 - .quad 0xbf3ef17709353f19 - .quad 0x423f06cb0622702b - .quad 0x585a2277d87845dd - .quad 0xa18a5f8233d48962 - .quad 0x6698c4b5ec78257f - .quad 0xa78e6fa5373e41ff - .quad 0x7656278950ef981f - - // 2^184 * 5 * G - - .quad 0x38c3cf59d51fc8c0 - .quad 0x9bedd2fd0506b6f2 - .quad 0x26bf109fab570e8f - .quad 0x3f4160a8c1b846a6 - .quad 0xe17073a3ea86cf9d - .quad 0x3a8cfbb707155fdc - .quad 0x4853e7fc31838a8e - .quad 0x28bbf484b613f616 - .quad 0xf2612f5c6f136c7c - .quad 0xafead107f6dd11be - .quad 0x527e9ad213de6f33 - .quad 0x1e79cb358188f75d - - // 2^184 * 6 * G - - .quad 0x013436c3eef7e3f1 - .quad 0x828b6a7ffe9e10f8 - .quad 0x7ff908e5bcf9defc - .quad 0x65d7951b3a3b3831 - .quad 0x77e953d8f5e08181 - .quad 0x84a50c44299dded9 - .quad 0xdc6c2d0c864525e5 - .quad 0x478ab52d39d1f2f4 - .quad 0x66a6a4d39252d159 - .quad 0xe5dde1bc871ac807 - .quad 0xb82c6b40a6c1c96f - .quad 0x16d87a411a212214 - - // 2^184 * 7 * G - - .quad 0xb3bd7e5a42066215 - .quad 0x879be3cd0c5a24c1 - .quad 0x57c05db1d6f994b7 - .quad 0x28f87c8165f38ca6 - .quad 0xfba4d5e2d54e0583 - .quad 0xe21fafd72ebd99fa - .quad 0x497ac2736ee9778f - .quad 0x1f990b577a5a6dde - .quad 0xa3344ead1be8f7d6 - .quad 0x7d1e50ebacea798f - .quad 0x77c6569e520de052 - .quad 0x45882fe1534d6d3e - - // 2^184 * 8 * G - - .quad 0x6669345d757983d6 - .quad 0x62b6ed1117aa11a6 - .quad 0x7ddd1857985e128f - .quad 0x688fe5b8f626f6dd - .quad 0xd8ac9929943c6fe4 - .quad 0xb5f9f161a38392a2 - .quad 0x2699db13bec89af3 - .quad 0x7dcf843ce405f074 - .quad 0x6c90d6484a4732c0 - .quad 0xd52143fdca563299 - .quad 0xb3be28c3915dc6e1 - .quad 0x6739687e7327191b - - // 2^188 * 1 * G - - .quad 0x9f65c5ea200814cf - .quad 0x840536e169a31740 - .quad 0x8b0ed13925c8b4ad - .quad 0x0080dbafe936361d - .quad 0x8ce5aad0c9cb971f - .quad 0x1156aaa99fd54a29 - .quad 0x41f7247015af9b78 - .quad 0x1fe8cca8420f49aa - .quad 0x72a1848f3c0cc82a - .quad 0x38c560c2877c9e54 - .quad 0x5004e228ce554140 - .quad 0x042418a103429d71 - - // 2^188 * 2 * G - - .quad 0x899dea51abf3ff5f - .quad 0x9b93a8672fc2d8ba - .quad 0x2c38cb97be6ebd5c - .quad 0x114d578497263b5d - .quad 0x58e84c6f20816247 - .quad 0x8db2b2b6e36fd793 - .quad 0x977182561d484d85 - .quad 0x0822024f8632abd7 - .quad 0xb301bb7c6b1beca3 - .quad 0x55393f6dc6eb1375 - .quad 0x910d281097b6e4eb - .quad 0x1ad4548d9d479ea3 - - // 2^188 * 3 * G - - .quad 0xcd5a7da0389a48fd - .quad 0xb38fa4aa9a78371e - .quad 0xc6d9761b2cdb8e6c - .quad 0x35cf51dbc97e1443 - .quad 0xa06fe66d0fe9fed3 - .quad 0xa8733a401c587909 - .quad 0x30d14d800df98953 - .quad 0x41ce5876c7b30258 - .quad 0x59ac3bc5d670c022 - .quad 0xeae67c109b119406 - .quad 0x9798bdf0b3782fda - .quad 0x651e3201fd074092 - - // 2^188 * 4 * G - - .quad 0xd63d8483ef30c5cf - .quad 0x4cd4b4962361cc0c - .quad 0xee90e500a48426ac - .quad 0x0af51d7d18c14eeb - .quad 0xa57ba4a01efcae9e - .quad 0x769f4beedc308a94 - .quad 0xd1f10eeb3603cb2e - .quad 0x4099ce5e7e441278 - .quad 0x1ac98e4f8a5121e9 - .quad 0x7dae9544dbfa2fe0 - .quad 0x8320aa0dd6430df9 - .quad 0x667282652c4a2fb5 - - // 2^188 * 5 * G - - .quad 0x874621f4d86bc9ab - .quad 0xb54c7bbe56fe6fea - .quad 0x077a24257fadc22c - .quad 0x1ab53be419b90d39 - .quad 0xada8b6e02946db23 - .quad 0x1c0ce51a7b253ab7 - .quad 0x8448c85a66dd485b - .quad 0x7f1fc025d0675adf - .quad 0xd8ee1b18319ea6aa - .quad 0x004d88083a21f0da - .quad 0x3bd6aa1d883a4f4b - .quad 0x4db9a3a6dfd9fd14 - - // 2^188 * 6 * G - - .quad 0x8ce7b23bb99c0755 - .quad 0x35c5d6edc4f50f7a - .quad 0x7e1e2ed2ed9b50c3 - .quad 0x36305f16e8934da1 - .quad 0xd95b00bbcbb77c68 - .quad 0xddbc846a91f17849 - .quad 0x7cf700aebe28d9b3 - .quad 0x5ce1285c85d31f3e - .quad 0x31b6972d98b0bde8 - .quad 0x7d920706aca6de5b - .quad 0xe67310f8908a659f - .quad 0x50fac2a6efdf0235 - - // 2^188 * 7 * G - - .quad 0xf3d3a9f35b880f5a - .quad 0xedec050cdb03e7c2 - .quad 0xa896981ff9f0b1a2 - .quad 0x49a4ae2bac5e34a4 - .quad 0x295b1c86f6f449bc - .quad 0x51b2e84a1f0ab4dd - .quad 0xc001cb30aa8e551d - .quad 0x6a28d35944f43662 - .quad 0x28bb12ee04a740e0 - .quad 0x14313bbd9bce8174 - .quad 0x72f5b5e4e8c10c40 - .quad 0x7cbfb19936adcd5b - - // 2^188 * 8 * G - - .quad 0xa311ddc26b89792d - .quad 0x1b30b4c6da512664 - .quad 0x0ca77b4ccf150859 - .quad 0x1de443df1b009408 - .quad 0x8e793a7acc36e6e0 - .quad 0xf9fab7a37d586eed - .quad 0x3a4f9692bae1f4e4 - .quad 0x1c14b03eff5f447e - .quad 0x19647bd114a85291 - .quad 0x57b76cb21034d3af - .quad 0x6329db440f9d6dfa - .quad 0x5ef43e586a571493 - - // 2^192 * 1 * G - - .quad 0xef782014385675a6 - .quad 0xa2649f30aafda9e8 - .quad 0x4cd1eb505cdfa8cb - .quad 0x46115aba1d4dc0b3 - .quad 0xa66dcc9dc80c1ac0 - .quad 0x97a05cf41b38a436 - .quad 0xa7ebf3be95dbd7c6 - .quad 0x7da0b8f68d7e7dab - .quad 0xd40f1953c3b5da76 - .quad 0x1dac6f7321119e9b - .quad 0x03cc6021feb25960 - .quad 0x5a5f887e83674b4b - - // 2^192 * 2 * G - - .quad 0x8f6301cf70a13d11 - .quad 0xcfceb815350dd0c4 - .quad 0xf70297d4a4bca47e - .quad 0x3669b656e44d1434 - .quad 0x9e9628d3a0a643b9 - .quad 0xb5c3cb00e6c32064 - .quad 0x9b5302897c2dec32 - .quad 0x43e37ae2d5d1c70c - .quad 0x387e3f06eda6e133 - .quad 0x67301d5199a13ac0 - .quad 0xbd5ad8f836263811 - .quad 0x6a21e6cd4fd5e9be - - // 2^192 * 3 * G - - .quad 0xf1c6170a3046e65f - .quad 0x58712a2a00d23524 - .quad 0x69dbbd3c8c82b755 - .quad 0x586bf9f1a195ff57 - .quad 0xef4129126699b2e3 - .quad 0x71d30847708d1301 - .quad 0x325432d01182b0bd - .quad 0x45371b07001e8b36 - .quad 0xa6db088d5ef8790b - .quad 0x5278f0dc610937e5 - .quad 0xac0349d261a16eb8 - .quad 0x0eafb03790e52179 - - // 2^192 * 4 * G - - .quad 0x960555c13748042f - .quad 0x219a41e6820baa11 - .quad 0x1c81f73873486d0c - .quad 0x309acc675a02c661 - .quad 0x5140805e0f75ae1d - .quad 0xec02fbe32662cc30 - .quad 0x2cebdf1eea92396d - .quad 0x44ae3344c5435bb3 - .quad 0x9cf289b9bba543ee - .quad 0xf3760e9d5ac97142 - .quad 0x1d82e5c64f9360aa - .quad 0x62d5221b7f94678f - - // 2^192 * 5 * G - - .quad 0x524c299c18d0936d - .quad 0xc86bb56c8a0c1a0c - .quad 0xa375052edb4a8631 - .quad 0x5c0efde4bc754562 - .quad 0x7585d4263af77a3c - .quad 0xdfae7b11fee9144d - .quad 0xa506708059f7193d - .quad 0x14f29a5383922037 - .quad 0xdf717edc25b2d7f5 - .quad 0x21f970db99b53040 - .quad 0xda9234b7c3ed4c62 - .quad 0x5e72365c7bee093e - - // 2^192 * 6 * G - - .quad 0x575bfc074571217f - .quad 0x3779675d0694d95b - .quad 0x9a0a37bbf4191e33 - .quad 0x77f1104c47b4eabc - .quad 0x7d9339062f08b33e - .quad 0x5b9659e5df9f32be - .quad 0xacff3dad1f9ebdfd - .quad 0x70b20555cb7349b7 - .quad 0xbe5113c555112c4c - .quad 0x6688423a9a881fcd - .quad 0x446677855e503b47 - .quad 0x0e34398f4a06404a - - // 2^192 * 7 * G - - .quad 0xb67d22d93ecebde8 - .quad 0x09b3e84127822f07 - .quad 0x743fa61fb05b6d8d - .quad 0x5e5405368a362372 - .quad 0x18930b093e4b1928 - .quad 0x7de3e10e73f3f640 - .quad 0xf43217da73395d6f - .quad 0x6f8aded6ca379c3e - .quad 0xe340123dfdb7b29a - .quad 0x487b97e1a21ab291 - .quad 0xf9967d02fde6949e - .quad 0x780de72ec8d3de97 - - // 2^192 * 8 * G - - .quad 0x0ae28545089ae7bc - .quad 0x388ddecf1c7f4d06 - .quad 0x38ac15510a4811b8 - .quad 0x0eb28bf671928ce4 - .quad 0x671feaf300f42772 - .quad 0x8f72eb2a2a8c41aa - .quad 0x29a17fd797373292 - .quad 0x1defc6ad32b587a6 - .quad 0xaf5bbe1aef5195a7 - .quad 0x148c1277917b15ed - .quad 0x2991f7fb7ae5da2e - .quad 0x467d201bf8dd2867 - - // 2^196 * 1 * G - - .quad 0x7906ee72f7bd2e6b - .quad 0x05d270d6109abf4e - .quad 0x8d5cfe45b941a8a4 - .quad 0x44c218671c974287 - .quad 0x745f9d56296bc318 - .quad 0x993580d4d8152e65 - .quad 0xb0e5b13f5839e9ce - .quad 0x51fc2b28d43921c0 - .quad 0x1b8fd11795e2a98c - .quad 0x1c4e5ee12b6b6291 - .quad 0x5b30e7107424b572 - .quad 0x6e6b9de84c4f4ac6 - - // 2^196 * 2 * G - - .quad 0xdff25fce4b1de151 - .quad 0xd841c0c7e11c4025 - .quad 0x2554b3c854749c87 - .quad 0x2d292459908e0df9 - .quad 0x6b7c5f10f80cb088 - .quad 0x736b54dc56e42151 - .quad 0xc2b620a5c6ef99c4 - .quad 0x5f4c802cc3a06f42 - .quad 0x9b65c8f17d0752da - .quad 0x881ce338c77ee800 - .quad 0xc3b514f05b62f9e3 - .quad 0x66ed5dd5bec10d48 - - // 2^196 * 3 * G - - .quad 0x7d38a1c20bb2089d - .quad 0x808334e196ccd412 - .quad 0xc4a70b8c6c97d313 - .quad 0x2eacf8bc03007f20 - .quad 0xf0adf3c9cbca047d - .quad 0x81c3b2cbf4552f6b - .quad 0xcfda112d44735f93 - .quad 0x1f23a0c77e20048c - .quad 0xf235467be5bc1570 - .quad 0x03d2d9020dbab38c - .quad 0x27529aa2fcf9e09e - .quad 0x0840bef29d34bc50 - - // 2^196 * 4 * G - - .quad 0x796dfb35dc10b287 - .quad 0x27176bcd5c7ff29d - .quad 0x7f3d43e8c7b24905 - .quad 0x0304f5a191c54276 - .quad 0xcd54e06b7f37e4eb - .quad 0x8cc15f87f5e96cca - .quad 0xb8248bb0d3597dce - .quad 0x246affa06074400c - .quad 0x37d88e68fbe45321 - .quad 0x86097548c0d75032 - .quad 0x4e9b13ef894a0d35 - .quad 0x25a83cac5753d325 - - // 2^196 * 5 * G - - .quad 0x10222f48eed8165e - .quad 0x623fc1234b8bcf3a - .quad 0x1e145c09c221e8f0 - .quad 0x7ccfa59fca782630 - .quad 0x9f0f66293952b6e2 - .quad 0x33db5e0e0934267b - .quad 0xff45252bd609fedc - .quad 0x06be10f5c506e0c9 - .quad 0x1a9615a9b62a345f - .quad 0x22050c564a52fecc - .quad 0xa7a2788528bc0dfe - .quad 0x5e82770a1a1ee71d - - // 2^196 * 6 * G - - .quad 0x35425183ad896a5c - .quad 0xe8673afbe78d52f6 - .quad 0x2c66f25f92a35f64 - .quad 0x09d04f3b3b86b102 - .quad 0xe802e80a42339c74 - .quad 0x34175166a7fffae5 - .quad 0x34865d1f1c408cae - .quad 0x2cca982c605bc5ee - .quad 0xfd2d5d35197dbe6e - .quad 0x207c2eea8be4ffa3 - .quad 0x2613d8db325ae918 - .quad 0x7a325d1727741d3e - - // 2^196 * 7 * G - - .quad 0xd036b9bbd16dfde2 - .quad 0xa2055757c497a829 - .quad 0x8e6cc966a7f12667 - .quad 0x4d3b1a791239c180 - .quad 0xecd27d017e2a076a - .quad 0xd788689f1636495e - .quad 0x52a61af0919233e5 - .quad 0x2a479df17bb1ae64 - .quad 0x9e5eee8e33db2710 - .quad 0x189854ded6c43ca5 - .quad 0xa41c22c592718138 - .quad 0x27ad5538a43a5e9b - - // 2^196 * 8 * G - - .quad 0x2746dd4b15350d61 - .quad 0xd03fcbc8ee9521b7 - .quad 0xe86e365a138672ca - .quad 0x510e987f7e7d89e2 - .quad 0xcb5a7d638e47077c - .quad 0x8db7536120a1c059 - .quad 0x549e1e4d8bedfdcc - .quad 0x080153b7503b179d - .quad 0xdda69d930a3ed3e3 - .quad 0x3d386ef1cd60a722 - .quad 0xc817ad58bdaa4ee6 - .quad 0x23be8d554fe7372a - - // 2^200 * 1 * G - - .quad 0x95fe919a74ef4fad - .quad 0x3a827becf6a308a2 - .quad 0x964e01d309a47b01 - .quad 0x71c43c4f5ba3c797 - .quad 0xbc1ef4bd567ae7a9 - .quad 0x3f624cb2d64498bd - .quad 0xe41064d22c1f4ec8 - .quad 0x2ef9c5a5ba384001 - .quad 0xb6fd6df6fa9e74cd - .quad 0xf18278bce4af267a - .quad 0x8255b3d0f1ef990e - .quad 0x5a758ca390c5f293 - - // 2^200 * 2 * G - - .quad 0xa2b72710d9462495 - .quad 0x3aa8c6d2d57d5003 - .quad 0xe3d400bfa0b487ca - .quad 0x2dbae244b3eb72ec - .quad 0x8ce0918b1d61dc94 - .quad 0x8ded36469a813066 - .quad 0xd4e6a829afe8aad3 - .quad 0x0a738027f639d43f - .quad 0x980f4a2f57ffe1cc - .quad 0x00670d0de1839843 - .quad 0x105c3f4a49fb15fd - .quad 0x2698ca635126a69c - - // 2^200 * 3 * G - - .quad 0xe765318832b0ba78 - .quad 0x381831f7925cff8b - .quad 0x08a81b91a0291fcc - .quad 0x1fb43dcc49caeb07 - .quad 0x2e3d702f5e3dd90e - .quad 0x9e3f0918e4d25386 - .quad 0x5e773ef6024da96a - .quad 0x3c004b0c4afa3332 - .quad 0x9aa946ac06f4b82b - .quad 0x1ca284a5a806c4f3 - .quad 0x3ed3265fc6cd4787 - .quad 0x6b43fd01cd1fd217 - - // 2^200 * 4 * G - - .quad 0xc7a75d4b4697c544 - .quad 0x15fdf848df0fffbf - .quad 0x2868b9ebaa46785a - .quad 0x5a68d7105b52f714 - .quad 0xb5c742583e760ef3 - .quad 0x75dc52b9ee0ab990 - .quad 0xbf1427c2072b923f - .quad 0x73420b2d6ff0d9f0 - .quad 0xaf2cf6cb9e851e06 - .quad 0x8f593913c62238c4 - .quad 0xda8ab89699fbf373 - .quad 0x3db5632fea34bc9e - - // 2^200 * 5 * G - - .quad 0xf46eee2bf75dd9d8 - .quad 0x0d17b1f6396759a5 - .quad 0x1bf2d131499e7273 - .quad 0x04321adf49d75f13 - .quad 0x2e4990b1829825d5 - .quad 0xedeaeb873e9a8991 - .quad 0xeef03d394c704af8 - .quad 0x59197ea495df2b0e - .quad 0x04e16019e4e55aae - .quad 0xe77b437a7e2f92e9 - .quad 0xc7ce2dc16f159aa4 - .quad 0x45eafdc1f4d70cc0 - - // 2^200 * 6 * G - - .quad 0x698401858045d72b - .quad 0x4c22faa2cf2f0651 - .quad 0x941a36656b222dc6 - .quad 0x5a5eebc80362dade - .quad 0xb60e4624cfccb1ed - .quad 0x59dbc292bd5c0395 - .quad 0x31a09d1ddc0481c9 - .quad 0x3f73ceea5d56d940 - .quad 0xb7a7bfd10a4e8dc6 - .quad 0xbe57007e44c9b339 - .quad 0x60c1207f1557aefa - .quad 0x26058891266218db - - // 2^200 * 7 * G - - .quad 0x59f704a68360ff04 - .quad 0xc3d93fde7661e6f4 - .quad 0x831b2a7312873551 - .quad 0x54ad0c2e4e615d57 - .quad 0x4c818e3cc676e542 - .quad 0x5e422c9303ceccad - .quad 0xec07cccab4129f08 - .quad 0x0dedfa10b24443b8 - .quad 0xee3b67d5b82b522a - .quad 0x36f163469fa5c1eb - .quad 0xa5b4d2f26ec19fd3 - .quad 0x62ecb2baa77a9408 - - // 2^200 * 8 * G - - .quad 0xe5ed795261152b3d - .quad 0x4962357d0eddd7d1 - .quad 0x7482c8d0b96b4c71 - .quad 0x2e59f919a966d8be - .quad 0x92072836afb62874 - .quad 0x5fcd5e8579e104a5 - .quad 0x5aad01adc630a14a - .quad 0x61913d5075663f98 - .quad 0x0dc62d361a3231da - .quad 0xfa47583294200270 - .quad 0x02d801513f9594ce - .quad 0x3ddbc2a131c05d5c - - // 2^204 * 1 * G - - .quad 0x3f50a50a4ffb81ef - .quad 0xb1e035093bf420bf - .quad 0x9baa8e1cc6aa2cd0 - .quad 0x32239861fa237a40 - .quad 0xfb735ac2004a35d1 - .quad 0x31de0f433a6607c3 - .quad 0x7b8591bfc528d599 - .quad 0x55be9a25f5bb050c - .quad 0x0d005acd33db3dbf - .quad 0x0111b37c80ac35e2 - .quad 0x4892d66c6f88ebeb - .quad 0x770eadb16508fbcd - - // 2^204 * 2 * G - - .quad 0x8451f9e05e4e89dd - .quad 0xc06302ffbc793937 - .quad 0x5d22749556a6495c - .quad 0x09a6755ca05603fb - .quad 0xf1d3b681a05071b9 - .quad 0x2207659a3592ff3a - .quad 0x5f0169297881e40e - .quad 0x16bedd0e86ba374e - .quad 0x5ecccc4f2c2737b5 - .quad 0x43b79e0c2dccb703 - .quad 0x33e008bc4ec43df3 - .quad 0x06c1b840f07566c0 - - // 2^204 * 3 * G - - .quad 0x7688a5c6a388f877 - .quad 0x02a96c14deb2b6ac - .quad 0x64c9f3431b8c2af8 - .quad 0x3628435554a1eed6 - .quad 0x69ee9e7f9b02805c - .quad 0xcbff828a547d1640 - .quad 0x3d93a869b2430968 - .quad 0x46b7b8cd3fe26972 - .quad 0xe9812086fe7eebe0 - .quad 0x4cba6be72f515437 - .quad 0x1d04168b516efae9 - .quad 0x5ea1391043982cb9 - - // 2^204 * 4 * G - - .quad 0x49125c9cf4702ee1 - .quad 0x4520b71f8b25b32d - .quad 0x33193026501fef7e - .quad 0x656d8997c8d2eb2b - .quad 0x6f2b3be4d5d3b002 - .quad 0xafec33d96a09c880 - .quad 0x035f73a4a8bcc4cc - .quad 0x22c5b9284662198b - .quad 0xcb58c8fe433d8939 - .quad 0x89a0cb2e6a8d7e50 - .quad 0x79ca955309fbbe5a - .quad 0x0c626616cd7fc106 - - // 2^204 * 5 * G - - .quad 0x1ffeb80a4879b61f - .quad 0x6396726e4ada21ed - .quad 0x33c7b093368025ba - .quad 0x471aa0c6f3c31788 - .quad 0x8fdfc379fbf454b1 - .quad 0x45a5a970f1a4b771 - .quad 0xac921ef7bad35915 - .quad 0x42d088dca81c2192 - .quad 0x8fda0f37a0165199 - .quad 0x0adadb77c8a0e343 - .quad 0x20fbfdfcc875e820 - .quad 0x1cf2bea80c2206e7 - - // 2^204 * 6 * G - - .quad 0xc2ddf1deb36202ac - .quad 0x92a5fe09d2e27aa5 - .quad 0x7d1648f6fc09f1d3 - .quad 0x74c2cc0513bc4959 - .quad 0x982d6e1a02c0412f - .quad 0x90fa4c83db58e8fe - .quad 0x01c2f5bcdcb18bc0 - .quad 0x686e0c90216abc66 - .quad 0x1fadbadba54395a7 - .quad 0xb41a02a0ae0da66a - .quad 0xbf19f598bba37c07 - .quad 0x6a12b8acde48430d - - // 2^204 * 7 * G - - .quad 0xf8daea1f39d495d9 - .quad 0x592c190e525f1dfc - .quad 0xdb8cbd04c9991d1b - .quad 0x11f7fda3d88f0cb7 - .quad 0x793bdd801aaeeb5f - .quad 0x00a2a0aac1518871 - .quad 0xe8a373a31f2136b4 - .quad 0x48aab888fc91ef19 - .quad 0x041f7e925830f40e - .quad 0x002d6ca979661c06 - .quad 0x86dc9ff92b046a2e - .quad 0x760360928b0493d1 - - // 2^204 * 8 * G - - .quad 0x21bb41c6120cf9c6 - .quad 0xeab2aa12decda59b - .quad 0xc1a72d020aa48b34 - .quad 0x215d4d27e87d3b68 - .quad 0xb43108e5695a0b05 - .quad 0x6cb00ee8ad37a38b - .quad 0x5edad6eea3537381 - .quad 0x3f2602d4b6dc3224 - .quad 0xc8b247b65bcaf19c - .quad 0x49779dc3b1b2c652 - .quad 0x89a180bbd5ece2e2 - .quad 0x13f098a3cec8e039 - - // 2^208 * 1 * G - - .quad 0x9adc0ff9ce5ec54b - .quad 0x039c2a6b8c2f130d - .quad 0x028007c7f0f89515 - .quad 0x78968314ac04b36b - .quad 0xf3aa57a22796bb14 - .quad 0x883abab79b07da21 - .quad 0xe54be21831a0391c - .quad 0x5ee7fb38d83205f9 - .quad 0x538dfdcb41446a8e - .quad 0xa5acfda9434937f9 - .quad 0x46af908d263c8c78 - .quad 0x61d0633c9bca0d09 - - // 2^208 * 2 * G - - .quad 0x63744935ffdb2566 - .quad 0xc5bd6b89780b68bb - .quad 0x6f1b3280553eec03 - .quad 0x6e965fd847aed7f5 - .quad 0xada328bcf8fc73df - .quad 0xee84695da6f037fc - .quad 0x637fb4db38c2a909 - .quad 0x5b23ac2df8067bdc - .quad 0x9ad2b953ee80527b - .quad 0xe88f19aafade6d8d - .quad 0x0e711704150e82cf - .quad 0x79b9bbb9dd95dedc - - // 2^208 * 3 * G - - .quad 0xebb355406a3126c2 - .quad 0xd26383a868c8c393 - .quad 0x6c0c6429e5b97a82 - .quad 0x5065f158c9fd2147 - .quad 0xd1997dae8e9f7374 - .quad 0xa032a2f8cfbb0816 - .quad 0xcd6cba126d445f0a - .quad 0x1ba811460accb834 - .quad 0x708169fb0c429954 - .quad 0xe14600acd76ecf67 - .quad 0x2eaab98a70e645ba - .quad 0x3981f39e58a4faf2 - - // 2^208 * 4 * G - - .quad 0x18fb8a7559230a93 - .quad 0x1d168f6960e6f45d - .quad 0x3a85a94514a93cb5 - .quad 0x38dc083705acd0fd - .quad 0xc845dfa56de66fde - .quad 0xe152a5002c40483a - .quad 0xe9d2e163c7b4f632 - .quad 0x30f4452edcbc1b65 - .quad 0x856d2782c5759740 - .quad 0xfa134569f99cbecc - .quad 0x8844fc73c0ea4e71 - .quad 0x632d9a1a593f2469 - - // 2^208 * 5 * G - - .quad 0xf6bb6b15b807cba6 - .quad 0x1823c7dfbc54f0d7 - .quad 0xbb1d97036e29670b - .quad 0x0b24f48847ed4a57 - .quad 0xbf09fd11ed0c84a7 - .quad 0x63f071810d9f693a - .quad 0x21908c2d57cf8779 - .quad 0x3a5a7df28af64ba2 - .quad 0xdcdad4be511beac7 - .quad 0xa4538075ed26ccf2 - .quad 0xe19cff9f005f9a65 - .quad 0x34fcf74475481f63 - - // 2^208 * 6 * G - - .quad 0xc197e04c789767ca - .quad 0xb8714dcb38d9467d - .quad 0x55de888283f95fa8 - .quad 0x3d3bdc164dfa63f7 - .quad 0xa5bb1dab78cfaa98 - .quad 0x5ceda267190b72f2 - .quad 0x9309c9110a92608e - .quad 0x0119a3042fb374b0 - .quad 0x67a2d89ce8c2177d - .quad 0x669da5f66895d0c1 - .quad 0xf56598e5b282a2b0 - .quad 0x56c088f1ede20a73 - - // 2^208 * 7 * G - - .quad 0x336d3d1110a86e17 - .quad 0xd7f388320b75b2fa - .quad 0xf915337625072988 - .quad 0x09674c6b99108b87 - .quad 0x581b5fac24f38f02 - .quad 0xa90be9febae30cbd - .quad 0x9a2169028acf92f0 - .quad 0x038b7ea48359038f - .quad 0x9f4ef82199316ff8 - .quad 0x2f49d282eaa78d4f - .quad 0x0971a5ab5aef3174 - .quad 0x6e5e31025969eb65 - - // 2^208 * 8 * G - - .quad 0xb16c62f587e593fb - .quad 0x4999eddeca5d3e71 - .quad 0xb491c1e014cc3e6d - .quad 0x08f5114789a8dba8 - .quad 0x3304fb0e63066222 - .quad 0xfb35068987acba3f - .quad 0xbd1924778c1061a3 - .quad 0x3058ad43d1838620 - .quad 0x323c0ffde57663d0 - .quad 0x05c3df38a22ea610 - .quad 0xbdc78abdac994f9a - .quad 0x26549fa4efe3dc99 - - // 2^212 * 1 * G - - .quad 0x738b38d787ce8f89 - .quad 0xb62658e24179a88d - .quad 0x30738c9cf151316d - .quad 0x49128c7f727275c9 - .quad 0x04dbbc17f75396b9 - .quad 0x69e6a2d7d2f86746 - .quad 0xc6409d99f53eabc6 - .quad 0x606175f6332e25d2 - .quad 0x4021370ef540e7dd - .quad 0x0910d6f5a1f1d0a5 - .quad 0x4634aacd5b06b807 - .quad 0x6a39e6356944f235 - - // 2^212 * 2 * G - - .quad 0x96cd5640df90f3e7 - .quad 0x6c3a760edbfa25ea - .quad 0x24f3ef0959e33cc4 - .quad 0x42889e7e530d2e58 - .quad 0x1da1965774049e9d - .quad 0xfbcd6ea198fe352b - .quad 0xb1cbcd50cc5236a6 - .quad 0x1f5ec83d3f9846e2 - .quad 0x8efb23c3328ccb75 - .quad 0xaf42a207dd876ee9 - .quad 0x20fbdadc5dfae796 - .quad 0x241e246b06bf9f51 - - // 2^212 * 3 * G - - .quad 0x29e68e57ad6e98f6 - .quad 0x4c9260c80b462065 - .quad 0x3f00862ea51ebb4b - .quad 0x5bc2c77fb38d9097 - .quad 0x7eaafc9a6280bbb8 - .quad 0x22a70f12f403d809 - .quad 0x31ce40bb1bfc8d20 - .quad 0x2bc65635e8bd53ee - .quad 0xe8d5dc9fa96bad93 - .quad 0xe58fb17dde1947dc - .quad 0x681532ea65185fa3 - .quad 0x1fdd6c3b034a7830 - - // 2^212 * 4 * G - - .quad 0x0a64e28c55dc18fe - .quad 0xe3df9e993399ebdd - .quad 0x79ac432370e2e652 - .quad 0x35ff7fc33ae4cc0e - .quad 0x9c13a6a52dd8f7a9 - .quad 0x2dbb1f8c3efdcabf - .quad 0x961e32405e08f7b5 - .quad 0x48c8a121bbe6c9e5 - .quad 0xfc415a7c59646445 - .quad 0xd224b2d7c128b615 - .quad 0x6035c9c905fbb912 - .quad 0x42d7a91274429fab - - // 2^212 * 5 * G - - .quad 0x4e6213e3eaf72ed3 - .quad 0x6794981a43acd4e7 - .quad 0xff547cde6eb508cb - .quad 0x6fed19dd10fcb532 - .quad 0xa9a48947933da5bc - .quad 0x4a58920ec2e979ec - .quad 0x96d8800013e5ac4c - .quad 0x453692d74b48b147 - .quad 0xdd775d99a8559c6f - .quad 0xf42a2140df003e24 - .quad 0x5223e229da928a66 - .quad 0x063f46ba6d38f22c - - // 2^212 * 6 * G - - .quad 0xd2d242895f536694 - .quad 0xca33a2c542939b2c - .quad 0x986fada6c7ddb95c - .quad 0x5a152c042f712d5d - .quad 0x39843cb737346921 - .quad 0xa747fb0738c89447 - .quad 0xcb8d8031a245307e - .quad 0x67810f8e6d82f068 - .quad 0x3eeb8fbcd2287db4 - .quad 0x72c7d3a301a03e93 - .quad 0x5473e88cbd98265a - .quad 0x7324aa515921b403 - - // 2^212 * 7 * G - - .quad 0x857942f46c3cbe8e - .quad 0xa1d364b14730c046 - .quad 0x1c8ed914d23c41bf - .quad 0x0838e161eef6d5d2 - .quad 0xad23f6dae82354cb - .quad 0x6962502ab6571a6d - .quad 0x9b651636e38e37d1 - .quad 0x5cac5005d1a3312f - .quad 0x8cc154cce9e39904 - .quad 0x5b3a040b84de6846 - .quad 0xc4d8a61cb1be5d6e - .quad 0x40fb897bd8861f02 - - // 2^212 * 8 * G - - .quad 0x84c5aa9062de37a1 - .quad 0x421da5000d1d96e1 - .quad 0x788286306a9242d9 - .quad 0x3c5e464a690d10da - .quad 0xe57ed8475ab10761 - .quad 0x71435e206fd13746 - .quad 0x342f824ecd025632 - .quad 0x4b16281ea8791e7b - .quad 0xd1c101d50b813381 - .quad 0xdee60f1176ee6828 - .quad 0x0cb68893383f6409 - .quad 0x6183c565f6ff484a - - // 2^216 * 1 * G - - .quad 0x741d5a461e6bf9d6 - .quad 0x2305b3fc7777a581 - .quad 0xd45574a26474d3d9 - .quad 0x1926e1dc6401e0ff - .quad 0xdb468549af3f666e - .quad 0xd77fcf04f14a0ea5 - .quad 0x3df23ff7a4ba0c47 - .quad 0x3a10dfe132ce3c85 - .quad 0xe07f4e8aea17cea0 - .quad 0x2fd515463a1fc1fd - .quad 0x175322fd31f2c0f1 - .quad 0x1fa1d01d861e5d15 - - // 2^216 * 2 * G - - .quad 0xcc8055947d599832 - .quad 0x1e4656da37f15520 - .quad 0x99f6f7744e059320 - .quad 0x773563bc6a75cf33 - .quad 0x38dcac00d1df94ab - .quad 0x2e712bddd1080de9 - .quad 0x7f13e93efdd5e262 - .quad 0x73fced18ee9a01e5 - .quad 0x06b1e90863139cb3 - .quad 0xa493da67c5a03ecd - .quad 0x8d77cec8ad638932 - .quad 0x1f426b701b864f44 - - // 2^216 * 3 * G - - .quad 0xefc9264c41911c01 - .quad 0xf1a3b7b817a22c25 - .quad 0x5875da6bf30f1447 - .quad 0x4e1af5271d31b090 - .quad 0xf17e35c891a12552 - .quad 0xb76b8153575e9c76 - .quad 0xfa83406f0d9b723e - .quad 0x0b76bb1b3fa7e438 - .quad 0x08b8c1f97f92939b - .quad 0xbe6771cbd444ab6e - .quad 0x22e5646399bb8017 - .quad 0x7b6dd61eb772a955 - - // 2^216 * 4 * G - - .quad 0xb7adc1e850f33d92 - .quad 0x7998fa4f608cd5cf - .quad 0xad962dbd8dfc5bdb - .quad 0x703e9bceaf1d2f4f - .quad 0x5730abf9ab01d2c7 - .quad 0x16fb76dc40143b18 - .quad 0x866cbe65a0cbb281 - .quad 0x53fa9b659bff6afe - .quad 0x6c14c8e994885455 - .quad 0x843a5d6665aed4e5 - .quad 0x181bb73ebcd65af1 - .quad 0x398d93e5c4c61f50 - - // 2^216 * 5 * G - - .quad 0x1c4bd16733e248f3 - .quad 0xbd9e128715bf0a5f - .quad 0xd43f8cf0a10b0376 - .quad 0x53b09b5ddf191b13 - .quad 0xc3877c60d2e7e3f2 - .quad 0x3b34aaa030828bb1 - .quad 0x283e26e7739ef138 - .quad 0x699c9c9002c30577 - .quad 0xf306a7235946f1cc - .quad 0x921718b5cce5d97d - .quad 0x28cdd24781b4e975 - .quad 0x51caf30c6fcdd907 - - // 2^216 * 6 * G - - .quad 0xa60ba7427674e00a - .quad 0x630e8570a17a7bf3 - .quad 0x3758563dcf3324cc - .quad 0x5504aa292383fdaa - .quad 0x737af99a18ac54c7 - .quad 0x903378dcc51cb30f - .quad 0x2b89bc334ce10cc7 - .quad 0x12ae29c189f8e99a - .quad 0xa99ec0cb1f0d01cf - .quad 0x0dd1efcc3a34f7ae - .quad 0x55ca7521d09c4e22 - .quad 0x5fd14fe958eba5ea - - // 2^216 * 7 * G - - .quad 0xb5dc2ddf2845ab2c - .quad 0x069491b10a7fe993 - .quad 0x4daaf3d64002e346 - .quad 0x093ff26e586474d1 - .quad 0x3c42fe5ebf93cb8e - .quad 0xbedfa85136d4565f - .quad 0xe0f0859e884220e8 - .quad 0x7dd73f960725d128 - .quad 0xb10d24fe68059829 - .quad 0x75730672dbaf23e5 - .quad 0x1367253ab457ac29 - .quad 0x2f59bcbc86b470a4 - - // 2^216 * 8 * G - - .quad 0x83847d429917135f - .quad 0xad1b911f567d03d7 - .quad 0x7e7748d9be77aad1 - .quad 0x5458b42e2e51af4a - .quad 0x7041d560b691c301 - .quad 0x85201b3fadd7e71e - .quad 0x16c2e16311335585 - .quad 0x2aa55e3d010828b1 - .quad 0xed5192e60c07444f - .quad 0x42c54e2d74421d10 - .quad 0x352b4c82fdb5c864 - .quad 0x13e9004a8a768664 - - // 2^220 * 1 * G - - .quad 0xcbb5b5556c032bff - .quad 0xdf7191b729297a3a - .quad 0xc1ff7326aded81bb - .quad 0x71ade8bb68be03f5 - .quad 0x1e6284c5806b467c - .quad 0xc5f6997be75d607b - .quad 0x8b67d958b378d262 - .quad 0x3d88d66a81cd8b70 - .quad 0x8b767a93204ed789 - .quad 0x762fcacb9fa0ae2a - .quad 0x771febcc6dce4887 - .quad 0x343062158ff05fb3 - - // 2^220 * 2 * G - - .quad 0xe05da1a7e1f5bf49 - .quad 0x26457d6dd4736092 - .quad 0x77dcb07773cc32f6 - .quad 0x0a5d94969cdd5fcd - .quad 0xfce219072a7b31b4 - .quad 0x4d7adc75aa578016 - .quad 0x0ec276a687479324 - .quad 0x6d6d9d5d1fda4beb - .quad 0x22b1a58ae9b08183 - .quad 0xfd95d071c15c388b - .quad 0xa9812376850a0517 - .quad 0x33384cbabb7f335e - - // 2^220 * 3 * G - - .quad 0x3c6fa2680ca2c7b5 - .quad 0x1b5082046fb64fda - .quad 0xeb53349c5431d6de - .quad 0x5278b38f6b879c89 - .quad 0x33bc627a26218b8d - .quad 0xea80b21fc7a80c61 - .quad 0x9458b12b173e9ee6 - .quad 0x076247be0e2f3059 - .quad 0x52e105f61416375a - .quad 0xec97af3685abeba4 - .quad 0x26e6b50623a67c36 - .quad 0x5cf0e856f3d4fb01 - - // 2^220 * 4 * G - - .quad 0xf6c968731ae8cab4 - .quad 0x5e20741ecb4f92c5 - .quad 0x2da53be58ccdbc3e - .quad 0x2dddfea269970df7 - .quad 0xbeaece313db342a8 - .quad 0xcba3635b842db7ee - .quad 0xe88c6620817f13ef - .quad 0x1b9438aa4e76d5c6 - .quad 0x8a50777e166f031a - .quad 0x067b39f10fb7a328 - .quad 0x1925c9a6010fbd76 - .quad 0x6df9b575cc740905 - - // 2^220 * 5 * G - - .quad 0x42c1192927f6bdcf - .quad 0x8f91917a403d61ca - .quad 0xdc1c5a668b9e1f61 - .quad 0x1596047804ec0f8d - .quad 0xecdfc35b48cade41 - .quad 0x6a88471fb2328270 - .quad 0x740a4a2440a01b6a - .quad 0x471e5796003b5f29 - .quad 0xda96bbb3aced37ac - .quad 0x7a2423b5e9208cea - .quad 0x24cc5c3038aebae2 - .quad 0x50c356afdc5dae2f - - // 2^220 * 6 * G - - .quad 0x09dcbf4341c30318 - .quad 0xeeba061183181dce - .quad 0xc179c0cedc1e29a1 - .quad 0x1dbf7b89073f35b0 - .quad 0xcfed9cdf1b31b964 - .quad 0xf486a9858ca51af3 - .quad 0x14897265ea8c1f84 - .quad 0x784a53dd932acc00 - .quad 0x2d99f9df14fc4920 - .quad 0x76ccb60cc4499fe5 - .quad 0xa4132cbbe5cf0003 - .quad 0x3f93d82354f000ea - - // 2^220 * 7 * G - - .quad 0x8183e7689e04ce85 - .quad 0x678fb71e04465341 - .quad 0xad92058f6688edac - .quad 0x5da350d3532b099a - .quad 0xeaac12d179e14978 - .quad 0xff923ff3bbebff5e - .quad 0x4af663e40663ce27 - .quad 0x0fd381a811a5f5ff - .quad 0xf256aceca436df54 - .quad 0x108b6168ae69d6e8 - .quad 0x20d986cb6b5d036c - .quad 0x655957b9fee2af50 - - // 2^220 * 8 * G - - .quad 0xaea8b07fa902030f - .quad 0xf88c766af463d143 - .quad 0x15b083663c787a60 - .quad 0x08eab1148267a4a8 - .quad 0xbdc1409bd002d0ac - .quad 0x66660245b5ccd9a6 - .quad 0x82317dc4fade85ec - .quad 0x02fe934b6ad7df0d - .quad 0xef5cf100cfb7ea74 - .quad 0x22897633a1cb42ac - .quad 0xd4ce0c54cef285e2 - .quad 0x30408c048a146a55 - - // 2^224 * 1 * G - - .quad 0x739d8845832fcedb - .quad 0xfa38d6c9ae6bf863 - .quad 0x32bc0dcab74ffef7 - .quad 0x73937e8814bce45e - .quad 0xbb2e00c9193b877f - .quad 0xece3a890e0dc506b - .quad 0xecf3b7c036de649f - .quad 0x5f46040898de9e1a - .quad 0xb9037116297bf48d - .quad 0xa9d13b22d4f06834 - .quad 0xe19715574696bdc6 - .quad 0x2cf8a4e891d5e835 - - // 2^224 * 2 * G - - .quad 0x6d93fd8707110f67 - .quad 0xdd4c09d37c38b549 - .quad 0x7cb16a4cc2736a86 - .quad 0x2049bd6e58252a09 - .quad 0x2cb5487e17d06ba2 - .quad 0x24d2381c3950196b - .quad 0xd7659c8185978a30 - .quad 0x7a6f7f2891d6a4f6 - .quad 0x7d09fd8d6a9aef49 - .quad 0xf0ee60be5b3db90b - .quad 0x4c21b52c519ebfd4 - .quad 0x6011aadfc545941d - - // 2^224 * 3 * G - - .quad 0x5f67926dcf95f83c - .quad 0x7c7e856171289071 - .quad 0xd6a1e7f3998f7a5b - .quad 0x6fc5cc1b0b62f9e0 - .quad 0x63ded0c802cbf890 - .quad 0xfbd098ca0dff6aaa - .quad 0x624d0afdb9b6ed99 - .quad 0x69ce18b779340b1e - .quad 0xd1ef5528b29879cb - .quad 0xdd1aae3cd47e9092 - .quad 0x127e0442189f2352 - .quad 0x15596b3ae57101f1 - - // 2^224 * 4 * G - - .quad 0x462739d23f9179a2 - .quad 0xff83123197d6ddcf - .quad 0x1307deb553f2148a - .quad 0x0d2237687b5f4dda - .quad 0x09ff31167e5124ca - .quad 0x0be4158bd9c745df - .quad 0x292b7d227ef556e5 - .quad 0x3aa4e241afb6d138 - .quad 0x2cc138bf2a3305f5 - .quad 0x48583f8fa2e926c3 - .quad 0x083ab1a25549d2eb - .quad 0x32fcaa6e4687a36c - - // 2^224 * 5 * G - - .quad 0x7bc56e8dc57d9af5 - .quad 0x3e0bd2ed9df0bdf2 - .quad 0xaac014de22efe4a3 - .quad 0x4627e9cefebd6a5c - .quad 0x3207a4732787ccdf - .quad 0x17e31908f213e3f8 - .quad 0xd5b2ecd7f60d964e - .quad 0x746f6336c2600be9 - .quad 0x3f4af345ab6c971c - .quad 0xe288eb729943731f - .quad 0x33596a8a0344186d - .quad 0x7b4917007ed66293 - - // 2^224 * 6 * G - - .quad 0x2d85fb5cab84b064 - .quad 0x497810d289f3bc14 - .quad 0x476adc447b15ce0c - .quad 0x122ba376f844fd7b - .quad 0x54341b28dd53a2dd - .quad 0xaa17905bdf42fc3f - .quad 0x0ff592d94dd2f8f4 - .quad 0x1d03620fe08cd37d - .quad 0xc20232cda2b4e554 - .quad 0x9ed0fd42115d187f - .quad 0x2eabb4be7dd479d9 - .quad 0x02c70bf52b68ec4c - - // 2^224 * 7 * G - - .quad 0xa287ec4b5d0b2fbb - .quad 0x415c5790074882ca - .quad 0xe044a61ec1d0815c - .quad 0x26334f0a409ef5e0 - .quad 0xace532bf458d72e1 - .quad 0x5be768e07cb73cb5 - .quad 0x56cf7d94ee8bbde7 - .quad 0x6b0697e3feb43a03 - .quad 0xb6c8f04adf62a3c0 - .quad 0x3ef000ef076da45d - .quad 0x9c9cb95849f0d2a9 - .quad 0x1cc37f43441b2fae - - // 2^224 * 8 * G - - .quad 0x508f565a5cc7324f - .quad 0xd061c4c0e506a922 - .quad 0xfb18abdb5c45ac19 - .quad 0x6c6809c10380314a - .quad 0xd76656f1c9ceaeb9 - .quad 0x1c5b15f818e5656a - .quad 0x26e72832844c2334 - .quad 0x3a346f772f196838 - .quad 0xd2d55112e2da6ac8 - .quad 0xe9bd0331b1e851ed - .quad 0x960746dd8ec67262 - .quad 0x05911b9f6ef7c5d0 - - // 2^228 * 1 * G - - .quad 0xe9dcd756b637ff2d - .quad 0xec4c348fc987f0c4 - .quad 0xced59285f3fbc7b7 - .quad 0x3305354793e1ea87 - .quad 0x01c18980c5fe9f94 - .quad 0xcd656769716fd5c8 - .quad 0x816045c3d195a086 - .quad 0x6e2b7f3266cc7982 - .quad 0xcc802468f7c3568f - .quad 0x9de9ba8219974cb3 - .quad 0xabb7229cb5b81360 - .quad 0x44e2017a6fbeba62 - - // 2^228 * 2 * G - - .quad 0xc4c2a74354dab774 - .quad 0x8e5d4c3c4eaf031a - .quad 0xb76c23d242838f17 - .quad 0x749a098f68dce4ea - .quad 0x87f82cf3b6ca6ecd - .quad 0x580f893e18f4a0c2 - .quad 0x058930072604e557 - .quad 0x6cab6ac256d19c1d - .quad 0xdcdfe0a02cc1de60 - .quad 0x032665ff51c5575b - .quad 0x2c0c32f1073abeeb - .quad 0x6a882014cd7b8606 - - // 2^228 * 3 * G - - .quad 0xa52a92fea4747fb5 - .quad 0xdc12a4491fa5ab89 - .quad 0xd82da94bb847a4ce - .quad 0x4d77edce9512cc4e - .quad 0xd111d17caf4feb6e - .quad 0x050bba42b33aa4a3 - .quad 0x17514c3ceeb46c30 - .quad 0x54bedb8b1bc27d75 - .quad 0x77c8e14577e2189c - .quad 0xa3e46f6aff99c445 - .quad 0x3144dfc86d335343 - .quad 0x3a96559e7c4216a9 - - // 2^228 * 4 * G - - .quad 0x12550d37f42ad2ee - .quad 0x8b78e00498a1fbf5 - .quad 0x5d53078233894cb2 - .quad 0x02c84e4e3e498d0c - .quad 0x4493896880baaa52 - .quad 0x4c98afc4f285940e - .quad 0xef4aa79ba45448b6 - .quad 0x5278c510a57aae7f - .quad 0xa54dd074294c0b94 - .quad 0xf55d46b8df18ffb6 - .quad 0xf06fecc58dae8366 - .quad 0x588657668190d165 - - // 2^228 * 5 * G - - .quad 0xd47712311aef7117 - .quad 0x50343101229e92c7 - .quad 0x7a95e1849d159b97 - .quad 0x2449959b8b5d29c9 - .quad 0xbf5834f03de25cc3 - .quad 0xb887c8aed6815496 - .quad 0x5105221a9481e892 - .quad 0x6760ed19f7723f93 - .quad 0x669ba3b7ac35e160 - .quad 0x2eccf73fba842056 - .quad 0x1aec1f17c0804f07 - .quad 0x0d96bc031856f4e7 - - // 2^228 * 6 * G - - .quad 0x3318be7775c52d82 - .quad 0x4cb764b554d0aab9 - .quad 0xabcf3d27cc773d91 - .quad 0x3bf4d1848123288a - .quad 0xb1d534b0cc7505e1 - .quad 0x32cd003416c35288 - .quad 0xcb36a5800762c29d - .quad 0x5bfe69b9237a0bf8 - .quad 0x183eab7e78a151ab - .quad 0xbbe990c999093763 - .quad 0xff717d6e4ac7e335 - .quad 0x4c5cddb325f39f88 - - // 2^228 * 7 * G - - .quad 0xc0f6b74d6190a6eb - .quad 0x20ea81a42db8f4e4 - .quad 0xa8bd6f7d97315760 - .quad 0x33b1d60262ac7c21 - .quad 0x57750967e7a9f902 - .quad 0x2c37fdfc4f5b467e - .quad 0xb261663a3177ba46 - .quad 0x3a375e78dc2d532b - .quad 0x8141e72f2d4dddea - .quad 0xe6eafe9862c607c8 - .quad 0x23c28458573cafd0 - .quad 0x46b9476f4ff97346 - - // 2^228 * 8 * G - - .quad 0x0c1ffea44f901e5c - .quad 0x2b0b6fb72184b782 - .quad 0xe587ff910114db88 - .quad 0x37130f364785a142 - .quad 0x1215505c0d58359f - .quad 0x2a2013c7fc28c46b - .quad 0x24a0a1af89ea664e - .quad 0x4400b638a1130e1f - .quad 0x3a01b76496ed19c3 - .quad 0x31e00ab0ed327230 - .quad 0x520a885783ca15b1 - .quad 0x06aab9875accbec7 - - // 2^232 * 1 * G - - .quad 0xc1339983f5df0ebb - .quad 0xc0f3758f512c4cac - .quad 0x2cf1130a0bb398e1 - .quad 0x6b3cecf9aa270c62 - .quad 0x5349acf3512eeaef - .quad 0x20c141d31cc1cb49 - .quad 0x24180c07a99a688d - .quad 0x555ef9d1c64b2d17 - .quad 0x36a770ba3b73bd08 - .quad 0x624aef08a3afbf0c - .quad 0x5737ff98b40946f2 - .quad 0x675f4de13381749d - - // 2^232 * 2 * G - - .quad 0x0e2c52036b1782fc - .quad 0x64816c816cad83b4 - .quad 0xd0dcbdd96964073e - .quad 0x13d99df70164c520 - .quad 0xa12ff6d93bdab31d - .quad 0x0725d80f9d652dfe - .quad 0x019c4ff39abe9487 - .quad 0x60f450b882cd3c43 - .quad 0x014b5ec321e5c0ca - .quad 0x4fcb69c9d719bfa2 - .quad 0x4e5f1c18750023a0 - .quad 0x1c06de9e55edac80 - - // 2^232 * 3 * G - - .quad 0x990f7ad6a33ec4e2 - .quad 0x6608f938be2ee08e - .quad 0x9ca143c563284515 - .quad 0x4cf38a1fec2db60d - .quad 0xffd52b40ff6d69aa - .quad 0x34530b18dc4049bb - .quad 0x5e4a5c2fa34d9897 - .quad 0x78096f8e7d32ba2d - .quad 0xa0aaaa650dfa5ce7 - .quad 0xf9c49e2a48b5478c - .quad 0x4f09cc7d7003725b - .quad 0x373cad3a26091abe - - // 2^232 * 4 * G - - .quad 0xb294634d82c9f57c - .quad 0x1fcbfde124934536 - .quad 0x9e9c4db3418cdb5a - .quad 0x0040f3d9454419fc - .quad 0xf1bea8fb89ddbbad - .quad 0x3bcb2cbc61aeaecb - .quad 0x8f58a7bb1f9b8d9d - .quad 0x21547eda5112a686 - .quad 0xdefde939fd5986d3 - .quad 0xf4272c89510a380c - .quad 0xb72ba407bb3119b9 - .quad 0x63550a334a254df4 - - // 2^232 * 5 * G - - .quad 0x6507d6edb569cf37 - .quad 0x178429b00ca52ee1 - .quad 0xea7c0090eb6bd65d - .quad 0x3eea62c7daf78f51 - .quad 0x9bba584572547b49 - .quad 0xf305c6fae2c408e0 - .quad 0x60e8fa69c734f18d - .quad 0x39a92bafaa7d767a - .quad 0x9d24c713e693274e - .quad 0x5f63857768dbd375 - .quad 0x70525560eb8ab39a - .quad 0x68436a0665c9c4cd - - // 2^232 * 6 * G - - .quad 0xbc0235e8202f3f27 - .quad 0xc75c00e264f975b0 - .quad 0x91a4e9d5a38c2416 - .quad 0x17b6e7f68ab789f9 - .quad 0x1e56d317e820107c - .quad 0xc5266844840ae965 - .quad 0xc1e0a1c6320ffc7a - .quad 0x5373669c91611472 - .quad 0x5d2814ab9a0e5257 - .quad 0x908f2084c9cab3fc - .quad 0xafcaf5885b2d1eca - .quad 0x1cb4b5a678f87d11 - - // 2^232 * 7 * G - - .quad 0xb664c06b394afc6c - .quad 0x0c88de2498da5fb1 - .quad 0x4f8d03164bcad834 - .quad 0x330bca78de7434a2 - .quad 0x6b74aa62a2a007e7 - .quad 0xf311e0b0f071c7b1 - .quad 0x5707e438000be223 - .quad 0x2dc0fd2d82ef6eac - .quad 0x982eff841119744e - .quad 0xf9695e962b074724 - .quad 0xc58ac14fbfc953fb - .quad 0x3c31be1b369f1cf5 - - // 2^232 * 8 * G - - .quad 0xb0f4864d08948aee - .quad 0x07dc19ee91ba1c6f - .quad 0x7975cdaea6aca158 - .quad 0x330b61134262d4bb - .quad 0xc168bc93f9cb4272 - .quad 0xaeb8711fc7cedb98 - .quad 0x7f0e52aa34ac8d7a - .quad 0x41cec1097e7d55bb - .quad 0xf79619d7a26d808a - .quad 0xbb1fd49e1d9e156d - .quad 0x73d7c36cdba1df27 - .quad 0x26b44cd91f28777d - - // 2^236 * 1 * G - - .quad 0x300a9035393aa6d8 - .quad 0x2b501131a12bb1cd - .quad 0x7b1ff677f093c222 - .quad 0x4309c1f8cab82bad - .quad 0xaf44842db0285f37 - .quad 0x8753189047efc8df - .quad 0x9574e091f820979a - .quad 0x0e378d6069615579 - .quad 0xd9fa917183075a55 - .quad 0x4bdb5ad26b009fdc - .quad 0x7829ad2cd63def0e - .quad 0x078fc54975fd3877 - - // 2^236 * 2 * G - - .quad 0x87dfbd1428878f2d - .quad 0x134636dd1e9421a1 - .quad 0x4f17c951257341a3 - .quad 0x5df98d4bad296cb8 - .quad 0xe2004b5bb833a98a - .quad 0x44775dec2d4c3330 - .quad 0x3aa244067eace913 - .quad 0x272630e3d58e00a9 - .quad 0xf3678fd0ecc90b54 - .quad 0xf001459b12043599 - .quad 0x26725fbc3758b89b - .quad 0x4325e4aa73a719ae - - // 2^236 * 3 * G - - .quad 0x657dc6ef433c3493 - .quad 0x65375e9f80dbf8c3 - .quad 0x47fd2d465b372dae - .quad 0x4966ab79796e7947 - .quad 0xed24629acf69f59d - .quad 0x2a4a1ccedd5abbf4 - .quad 0x3535ca1f56b2d67b - .quad 0x5d8c68d043b1b42d - .quad 0xee332d4de3b42b0a - .quad 0xd84e5a2b16a4601c - .quad 0x78243877078ba3e4 - .quad 0x77ed1eb4184ee437 - - // 2^236 * 4 * G - - .quad 0xbfd4e13f201839a0 - .quad 0xaeefffe23e3df161 - .quad 0xb65b04f06b5d1fe3 - .quad 0x52e085fb2b62fbc0 - .quad 0x185d43f89e92ed1a - .quad 0xb04a1eeafe4719c6 - .quad 0x499fbe88a6f03f4f - .quad 0x5d8b0d2f3c859bdd - .quad 0x124079eaa54cf2ba - .quad 0xd72465eb001b26e7 - .quad 0x6843bcfdc97af7fd - .quad 0x0524b42b55eacd02 - - // 2^236 * 5 * G - - .quad 0xfd0d5dbee45447b0 - .quad 0x6cec351a092005ee - .quad 0x99a47844567579cb - .quad 0x59d242a216e7fa45 - .quad 0xbc18dcad9b829eac - .quad 0x23ae7d28b5f579d0 - .quad 0xc346122a69384233 - .quad 0x1a6110b2e7d4ac89 - .quad 0x4f833f6ae66997ac - .quad 0x6849762a361839a4 - .quad 0x6985dec1970ab525 - .quad 0x53045e89dcb1f546 - - // 2^236 * 6 * G - - .quad 0xcb8bb346d75353db - .quad 0xfcfcb24bae511e22 - .quad 0xcba48d40d50ae6ef - .quad 0x26e3bae5f4f7cb5d - .quad 0x84da3cde8d45fe12 - .quad 0xbd42c218e444e2d2 - .quad 0xa85196781f7e3598 - .quad 0x7642c93f5616e2b2 - .quad 0x2323daa74595f8e4 - .quad 0xde688c8b857abeb4 - .quad 0x3fc48e961c59326e - .quad 0x0b2e73ca15c9b8ba - - // 2^236 * 7 * G - - .quad 0xd6bb4428c17f5026 - .quad 0x9eb27223fb5a9ca7 - .quad 0xe37ba5031919c644 - .quad 0x21ce380db59a6602 - .quad 0x0e3fbfaf79c03a55 - .quad 0x3077af054cbb5acf - .quad 0xd5c55245db3de39f - .quad 0x015e68c1476a4af7 - .quad 0xc1d5285220066a38 - .quad 0x95603e523570aef3 - .quad 0x832659a7226b8a4d - .quad 0x5dd689091f8eedc9 - - // 2^236 * 8 * G - - .quad 0xcbac84debfd3c856 - .quad 0x1624c348b35ff244 - .quad 0xb7f88dca5d9cad07 - .quad 0x3b0e574da2c2ebe8 - .quad 0x1d022591a5313084 - .quad 0xca2d4aaed6270872 - .quad 0x86a12b852f0bfd20 - .quad 0x56e6c439ad7da748 - .quad 0xc704ff4942bdbae6 - .quad 0x5e21ade2b2de1f79 - .quad 0xe95db3f35652fad8 - .quad 0x0822b5378f08ebc1 - - // 2^240 * 1 * G - - .quad 0x51f048478f387475 - .quad 0xb25dbcf49cbecb3c - .quad 0x9aab1244d99f2055 - .quad 0x2c709e6c1c10a5d6 - .quad 0xe1b7f29362730383 - .quad 0x4b5279ffebca8a2c - .quad 0xdafc778abfd41314 - .quad 0x7deb10149c72610f - .quad 0xcb62af6a8766ee7a - .quad 0x66cbec045553cd0e - .quad 0x588001380f0be4b5 - .quad 0x08e68e9ff62ce2ea - - // 2^240 * 2 * G - - .quad 0x34ad500a4bc130ad - .quad 0x8d38db493d0bd49c - .quad 0xa25c3d98500a89be - .quad 0x2f1f3f87eeba3b09 - .quad 0x2f2d09d50ab8f2f9 - .quad 0xacb9218dc55923df - .quad 0x4a8f342673766cb9 - .quad 0x4cb13bd738f719f5 - .quad 0xf7848c75e515b64a - .quad 0xa59501badb4a9038 - .quad 0xc20d313f3f751b50 - .quad 0x19a1e353c0ae2ee8 - - // 2^240 * 3 * G - - .quad 0x7d1c7560bafa05c3 - .quad 0xb3e1a0a0c6e55e61 - .quad 0xe3529718c0d66473 - .quad 0x41546b11c20c3486 - .quad 0xb42172cdd596bdbd - .quad 0x93e0454398eefc40 - .quad 0x9fb15347b44109b5 - .quad 0x736bd3990266ae34 - .quad 0x85532d509334b3b4 - .quad 0x46fd114b60816573 - .quad 0xcc5f5f30425c8375 - .quad 0x412295a2b87fab5c - - // 2^240 * 4 * G - - .quad 0x19c99b88f57ed6e9 - .quad 0x5393cb266df8c825 - .quad 0x5cee3213b30ad273 - .quad 0x14e153ebb52d2e34 - .quad 0x2e655261e293eac6 - .quad 0x845a92032133acdb - .quad 0x460975cb7900996b - .quad 0x0760bb8d195add80 - .quad 0x413e1a17cde6818a - .quad 0x57156da9ed69a084 - .quad 0x2cbf268f46caccb1 - .quad 0x6b34be9bc33ac5f2 - - // 2^240 * 5 * G - - .quad 0xf3df2f643a78c0b2 - .quad 0x4c3e971ef22e027c - .quad 0xec7d1c5e49c1b5a3 - .quad 0x2012c18f0922dd2d - .quad 0x11fc69656571f2d3 - .quad 0xc6c9e845530e737a - .quad 0xe33ae7a2d4fe5035 - .quad 0x01b9c7b62e6dd30b - .quad 0x880b55e55ac89d29 - .quad 0x1483241f45a0a763 - .quad 0x3d36efdfc2e76c1f - .quad 0x08af5b784e4bade8 - - // 2^240 * 6 * G - - .quad 0x283499dc881f2533 - .quad 0x9d0525da779323b6 - .quad 0x897addfb673441f4 - .quad 0x32b79d71163a168d - .quad 0xe27314d289cc2c4b - .quad 0x4be4bd11a287178d - .quad 0x18d528d6fa3364ce - .quad 0x6423c1d5afd9826e - .quad 0xcc85f8d9edfcb36a - .quad 0x22bcc28f3746e5f9 - .quad 0xe49de338f9e5d3cd - .quad 0x480a5efbc13e2dcc - - // 2^240 * 7 * G - - .quad 0x0b51e70b01622071 - .quad 0x06b505cf8b1dafc5 - .quad 0x2c6bb061ef5aabcd - .quad 0x47aa27600cb7bf31 - .quad 0xb6614ce442ce221f - .quad 0x6e199dcc4c053928 - .quad 0x663fb4a4dc1cbe03 - .quad 0x24b31d47691c8e06 - .quad 0x2a541eedc015f8c3 - .quad 0x11a4fe7e7c693f7c - .quad 0xf0af66134ea278d6 - .quad 0x545b585d14dda094 - - // 2^240 * 8 * G - - .quad 0x67bf275ea0d43a0f - .quad 0xade68e34089beebe - .quad 0x4289134cd479e72e - .quad 0x0f62f9c332ba5454 - .quad 0x6204e4d0e3b321e1 - .quad 0x3baa637a28ff1e95 - .quad 0x0b0ccffd5b99bd9e - .quad 0x4d22dc3e64c8d071 - .quad 0xfcb46589d63b5f39 - .quad 0x5cae6a3f57cbcf61 - .quad 0xfebac2d2953afa05 - .quad 0x1c0fa01a36371436 - - // 2^244 * 1 * G - - .quad 0xe7547449bc7cd692 - .quad 0x0f9abeaae6f73ddf - .quad 0x4af01ca700837e29 - .quad 0x63ab1b5d3f1bc183 - .quad 0xc11ee5e854c53fae - .quad 0x6a0b06c12b4f3ff4 - .quad 0x33540f80e0b67a72 - .quad 0x15f18fc3cd07e3ef - .quad 0x32750763b028f48c - .quad 0x06020740556a065f - .quad 0xd53bd812c3495b58 - .quad 0x08706c9b865f508d - - // 2^244 * 2 * G - - .quad 0xf37ca2ab3d343dff - .quad 0x1a8c6a2d80abc617 - .quad 0x8e49e035d4ccffca - .quad 0x48b46beebaa1d1b9 - .quad 0xcc991b4138b41246 - .quad 0x243b9c526f9ac26b - .quad 0xb9ef494db7cbabbd - .quad 0x5fba433dd082ed00 - .quad 0x9c49e355c9941ad0 - .quad 0xb9734ade74498f84 - .quad 0x41c3fed066663e5c - .quad 0x0ecfedf8e8e710b3 - - // 2^244 * 3 * G - - .quad 0x76430f9f9cd470d9 - .quad 0xb62acc9ba42f6008 - .quad 0x1898297c59adad5e - .quad 0x7789dd2db78c5080 - .quad 0x744f7463e9403762 - .quad 0xf79a8dee8dfcc9c9 - .quad 0x163a649655e4cde3 - .quad 0x3b61788db284f435 - .quad 0xb22228190d6ef6b2 - .quad 0xa94a66b246ce4bfa - .quad 0x46c1a77a4f0b6cc7 - .quad 0x4236ccffeb7338cf - - // 2^244 * 4 * G - - .quad 0x8497404d0d55e274 - .quad 0x6c6663d9c4ad2b53 - .quad 0xec2fb0d9ada95734 - .quad 0x2617e120cdb8f73c - .quad 0x3bd82dbfda777df6 - .quad 0x71b177cc0b98369e - .quad 0x1d0e8463850c3699 - .quad 0x5a71945b48e2d1f1 - .quad 0x6f203dd5405b4b42 - .quad 0x327ec60410b24509 - .quad 0x9c347230ac2a8846 - .quad 0x77de29fc11ffeb6a - - // 2^244 * 5 * G - - .quad 0xb0ac57c983b778a8 - .quad 0x53cdcca9d7fe912c - .quad 0x61c2b854ff1f59dc - .quad 0x3a1a2cf0f0de7dac - .quad 0x835e138fecced2ca - .quad 0x8c9eaf13ea963b9a - .quad 0xc95fbfc0b2160ea6 - .quad 0x575e66f3ad877892 - .quad 0x99803a27c88fcb3a - .quad 0x345a6789275ec0b0 - .quad 0x459789d0ff6c2be5 - .quad 0x62f882651e70a8b2 - - // 2^244 * 6 * G - - .quad 0x085ae2c759ff1be4 - .quad 0x149145c93b0e40b7 - .quad 0xc467e7fa7ff27379 - .quad 0x4eeecf0ad5c73a95 - .quad 0x6d822986698a19e0 - .quad 0xdc9821e174d78a71 - .quad 0x41a85f31f6cb1f47 - .quad 0x352721c2bcda9c51 - .quad 0x48329952213fc985 - .quad 0x1087cf0d368a1746 - .quad 0x8e5261b166c15aa5 - .quad 0x2d5b2d842ed24c21 - - // 2^244 * 7 * G - - .quad 0x02cfebd9ebd3ded1 - .quad 0xd45b217739021974 - .quad 0x7576f813fe30a1b7 - .quad 0x5691b6f9a34ef6c2 - .quad 0x5eb7d13d196ac533 - .quad 0x377234ecdb80be2b - .quad 0xe144cffc7cf5ae24 - .quad 0x5226bcf9c441acec - .quad 0x79ee6c7223e5b547 - .quad 0x6f5f50768330d679 - .quad 0xed73e1e96d8adce9 - .quad 0x27c3da1e1d8ccc03 - - // 2^244 * 8 * G - - .quad 0x7eb9efb23fe24c74 - .quad 0x3e50f49f1651be01 - .quad 0x3ea732dc21858dea - .quad 0x17377bd75bb810f9 - .quad 0x28302e71630ef9f6 - .quad 0xc2d4a2032b64cee0 - .quad 0x090820304b6292be - .quad 0x5fca747aa82adf18 - .quad 0x232a03c35c258ea5 - .quad 0x86f23a2c6bcb0cf1 - .quad 0x3dad8d0d2e442166 - .quad 0x04a8933cab76862b - - // 2^248 * 1 * G - - .quad 0xd2c604b622943dff - .quad 0xbc8cbece44cfb3a0 - .quad 0x5d254ff397808678 - .quad 0x0fa3614f3b1ca6bf - .quad 0x69082b0e8c936a50 - .quad 0xf9c9a035c1dac5b6 - .quad 0x6fb73e54c4dfb634 - .quad 0x4005419b1d2bc140 - .quad 0xa003febdb9be82f0 - .quad 0x2089c1af3a44ac90 - .quad 0xf8499f911954fa8e - .quad 0x1fba218aef40ab42 - - // 2^248 * 2 * G - - .quad 0xab549448fac8f53e - .quad 0x81f6e89a7ba63741 - .quad 0x74fd6c7d6c2b5e01 - .quad 0x392e3acaa8c86e42 - .quad 0x4f3e57043e7b0194 - .quad 0xa81d3eee08daaf7f - .quad 0xc839c6ab99dcdef1 - .quad 0x6c535d13ff7761d5 - .quad 0x4cbd34e93e8a35af - .quad 0x2e0781445887e816 - .quad 0x19319c76f29ab0ab - .quad 0x25e17fe4d50ac13b - - // 2^248 * 3 * G - - .quad 0x0a289bd71e04f676 - .quad 0x208e1c52d6420f95 - .quad 0x5186d8b034691fab - .quad 0x255751442a9fb351 - .quad 0x915f7ff576f121a7 - .quad 0xc34a32272fcd87e3 - .quad 0xccba2fde4d1be526 - .quad 0x6bba828f8969899b - .quad 0xe2d1bc6690fe3901 - .quad 0x4cb54a18a0997ad5 - .quad 0x971d6914af8460d4 - .quad 0x559d504f7f6b7be4 - - // 2^248 * 4 * G - - .quad 0xa7738378b3eb54d5 - .quad 0x1d69d366a5553c7c - .quad 0x0a26cf62f92800ba - .quad 0x01ab12d5807e3217 - .quad 0x9c4891e7f6d266fd - .quad 0x0744a19b0307781b - .quad 0x88388f1d6061e23b - .quad 0x123ea6a3354bd50e - .quad 0x118d189041e32d96 - .quad 0xb9ede3c2d8315848 - .quad 0x1eab4271d83245d9 - .quad 0x4a3961e2c918a154 - - // 2^248 * 5 * G - - .quad 0x71dc3be0f8e6bba0 - .quad 0xd6cef8347effe30a - .quad 0xa992425fe13a476a - .quad 0x2cd6bce3fb1db763 - .quad 0x0327d644f3233f1e - .quad 0x499a260e34fcf016 - .quad 0x83b5a716f2dab979 - .quad 0x68aceead9bd4111f - .quad 0x38b4c90ef3d7c210 - .quad 0x308e6e24b7ad040c - .quad 0x3860d9f1b7e73e23 - .quad 0x595760d5b508f597 - - // 2^248 * 6 * G - - .quad 0x6129bfe104aa6397 - .quad 0x8f960008a4a7fccb - .quad 0x3f8bc0897d909458 - .quad 0x709fa43edcb291a9 - .quad 0x882acbebfd022790 - .quad 0x89af3305c4115760 - .quad 0x65f492e37d3473f4 - .quad 0x2cb2c5df54515a2b - .quad 0xeb0a5d8c63fd2aca - .quad 0xd22bc1662e694eff - .quad 0x2723f36ef8cbb03a - .quad 0x70f029ecf0c8131f - - // 2^248 * 7 * G - - .quad 0x461307b32eed3e33 - .quad 0xae042f33a45581e7 - .quad 0xc94449d3195f0366 - .quad 0x0b7d5d8a6c314858 - .quad 0x2a6aafaa5e10b0b9 - .quad 0x78f0a370ef041aa9 - .quad 0x773efb77aa3ad61f - .quad 0x44eca5a2a74bd9e1 - .quad 0x25d448327b95d543 - .quad 0x70d38300a3340f1d - .quad 0xde1c531c60e1c52b - .quad 0x272224512c7de9e4 - - // 2^248 * 8 * G - - .quad 0x1abc92af49c5342e - .quad 0xffeed811b2e6fad0 - .quad 0xefa28c8dfcc84e29 - .quad 0x11b5df18a44cc543 - .quad 0xbf7bbb8a42a975fc - .quad 0x8c5c397796ada358 - .quad 0xe27fc76fcdedaa48 - .quad 0x19735fd7f6bc20a6 - .quad 0xe3ab90d042c84266 - .quad 0xeb848e0f7f19547e - .quad 0x2503a1d065a497b9 - .quad 0x0fef911191df895f - - // 2^252 * 1 * G - - .quad 0xb1507ca1ab1c6eb9 - .quad 0xbd448f3e16b687b3 - .quad 0x3455fb7f2c7a91ab - .quad 0x7579229e2f2adec1 - .quad 0x6ab5dcb85b1c16b7 - .quad 0x94c0fce83c7b27a5 - .quad 0xa4b11c1a735517be - .quad 0x499238d0ba0eafaa - .quad 0xecf46e527aba8b57 - .quad 0x15a08c478bd1647b - .quad 0x7af1c6a65f706fef - .quad 0x6345fa78f03a30d5 - - // 2^252 * 2 * G - - .quad 0xdf02f95f1015e7a1 - .quad 0x790ec41da9b40263 - .quad 0x4d3a0ea133ea1107 - .quad 0x54f70be7e33af8c9 - .quad 0x93d3cbe9bdd8f0a4 - .quad 0xdb152c1bfd177302 - .quad 0x7dbddc6d7f17a875 - .quad 0x3e1a71cc8f426efe - .quad 0xc83ca3e390babd62 - .quad 0x80ede3670291c833 - .quad 0xc88038ccd37900c4 - .quad 0x2c5fc0231ec31fa1 - - // 2^252 * 3 * G - - .quad 0xfeba911717038b4f - .quad 0xe5123721c9deef81 - .quad 0x1c97e4e75d0d8834 - .quad 0x68afae7a23dc3bc6 - .quad 0xc422e4d102456e65 - .quad 0x87414ac1cad47b91 - .quad 0x1592e2bba2b6ffdd - .quad 0x75d9d2bff5c2100f - .quad 0x5bd9b4763626e81c - .quad 0x89966936bca02edd - .quad 0x0a41193d61f077b3 - .quad 0x3097a24200ce5471 - - // 2^252 * 4 * G - - .quad 0x57427734c7f8b84c - .quad 0xf141a13e01b270e9 - .quad 0x02d1adfeb4e564a6 - .quad 0x4bb23d92ce83bd48 - .quad 0xa162e7246695c486 - .quad 0x131d633435a89607 - .quad 0x30521561a0d12a37 - .quad 0x56704bada6afb363 - .quad 0xaf6c4aa752f912b9 - .quad 0x5e665f6cd86770c8 - .quad 0x4c35ac83a3c8cd58 - .quad 0x2b7a29c010a58a7e - - // 2^252 * 5 * G - - .quad 0xc4007f77d0c1cec3 - .quad 0x8d1020b6bac492f8 - .quad 0x32ec29d57e69daaf - .quad 0x599408759d95fce0 - .quad 0x33810a23bf00086e - .quad 0xafce925ee736ff7c - .quad 0x3d60e670e24922d4 - .quad 0x11ce9e714f96061b - .quad 0x219ef713d815bac1 - .quad 0xf141465d485be25c - .quad 0x6d5447cc4e513c51 - .quad 0x174926be5ef44393 - - // 2^252 * 6 * G - - .quad 0xb5deb2f9fc5bd5bb - .quad 0x92daa72ae1d810e1 - .quad 0xafc4cfdcb72a1c59 - .quad 0x497d78813fc22a24 - .quad 0x3ef5d41593ea022e - .quad 0x5cbcc1a20ed0eed6 - .quad 0x8fd24ecf07382c8c - .quad 0x6fa42ead06d8e1ad - .quad 0xe276824a1f73371f - .quad 0x7f7cf01c4f5b6736 - .quad 0x7e201fe304fa46e7 - .quad 0x785a36a357808c96 - - // 2^252 * 7 * G - - .quad 0x825fbdfd63014d2b - .quad 0xc852369c6ca7578b - .quad 0x5b2fcd285c0b5df0 - .quad 0x12ab214c58048c8f - .quad 0x070442985d517bc3 - .quad 0x6acd56c7ae653678 - .quad 0x00a27983985a7763 - .quad 0x5167effae512662b - .quad 0xbd4ea9e10f53c4b6 - .quad 0x1673dc5f8ac91a14 - .quad 0xa8f81a4e2acc1aba - .quad 0x33a92a7924332a25 - - // 2^252 * 8 * G - - .quad 0x9dd1f49927996c02 - .quad 0x0cb3b058e04d1752 - .quad 0x1f7e88967fd02c3e - .quad 0x2f964268cb8b3eb1 - .quad 0x7ba95ba0218f2ada - .quad 0xcff42287330fb9ca - .quad 0xdada496d56c6d907 - .quad 0x5380c296f4beee54 - .quad 0x9d4f270466898d0a - .quad 0x3d0987990aff3f7a - .quad 0xd09ef36267daba45 - .quad 0x7761455e7b1c669c diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epadd.S deleted file mode 100644 index e926b2f013e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epadd.S +++ /dev/null @@ -1,594 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended projective addition for edwards25519 -// Inputs p1[16], p2[16]; output p3[16] -// -// extern void edwards25519_epadd -// (uint64_t p3[static 16],const uint64_t p1[static 16], -// const uint64_t p2[static 16]); -// -// The output p3 and both inputs p1 and p2 are points (x,y) on -// edwards25519 represented in extended projective quadruples (X,Y,Z,T) -// where x = X / Z, y = Y / Z and x * y = T / Z. -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_epadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_epadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_epadd) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define p3 x17 -#define p1 x19 -#define p2 x20 - -// Pointers to input and output coordinates - -#define x_1 p1, #0 -#define y_1 p1, #NUMSIZE -#define z_1 p1, #(2*NUMSIZE) -#define w_1 p1, #(3*NUMSIZE) - -#define x_2 p2, #0 -#define y_2 p2, #NUMSIZE -#define z_2 p2, #(2*NUMSIZE) -#define w_2 p2, #(3*NUMSIZE) - -#define x_3 p3, #0 -#define y_3 p3, #NUMSIZE -#define z_3 p3, #(2*NUMSIZE) -#define w_3 p3, #(3*NUMSIZE) - -// Pointer-offset pairs for temporaries on stack - -#define t0 sp, #(0*NUMSIZE) -#define t1 sp, #(1*NUMSIZE) -#define t2 sp, #(2*NUMSIZE) -#define t3 sp, #(3*NUMSIZE) -#define t4 sp, #(4*NUMSIZE) -#define t5 sp, #(5*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 6*NUMSIZE - -// Macro wrapping up the basic field operation bignum_mul_p25519, only -// trivially different from a pure function call to that subroutine. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - umull x7, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x8, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x7, x7, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x8, x8, x15 __LF \ - adds x7, x7, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x8, x8, x16 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - umull x11, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x12, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x11, x11, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x12, x12, x15 __LF \ - adds x11, x11, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x12, x12, x16 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, cc __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, cc __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x9, cc __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, cc __LF \ - cinv x9, x9, cc __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #0x1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x3, #0x26 __LF \ - umull x4, w11, w3 __LF \ - add x4, x4, w7, uxtw __LF \ - lsr x7, x7, #32 __LF \ - lsr x11, x11, #32 __LF \ - umaddl x11, w11, w3, x7 __LF \ - mov x7, x4 __LF \ - umull x4, w12, w3 __LF \ - add x4, x4, w8, uxtw __LF \ - lsr x8, x8, #32 __LF \ - lsr x12, x12, #32 __LF \ - umaddl x12, w12, w3, x8 __LF \ - mov x8, x4 __LF \ - umull x4, w13, w3 __LF \ - add x4, x4, w9, uxtw __LF \ - lsr x9, x9, #32 __LF \ - lsr x13, x13, #32 __LF \ - umaddl x13, w13, w3, x9 __LF \ - mov x9, x4 __LF \ - umull x4, w14, w3 __LF \ - add x4, x4, w10, uxtw __LF \ - lsr x10, x10, #32 __LF \ - lsr x14, x14, #32 __LF \ - umaddl x14, w14, w3, x10 __LF \ - mov x10, x4 __LF \ - lsr x0, x14, #31 __LF \ - mov x5, #0x13 __LF \ - umaddl x5, w5, w0, x5 __LF \ - add x7, x7, x5 __LF \ - adds x7, x7, x11, lsl #32 __LF \ - extr x3, x12, x11, #32 __LF \ - adcs x8, x8, x3 __LF \ - extr x3, x13, x12, #32 __LF \ - adcs x9, x9, x3 __LF \ - extr x3, x14, x13, #32 __LF \ - lsl x5, x0, #63 __LF \ - eor x10, x10, x5 __LF \ - adc x10, x10, x3 __LF \ - mov x3, #0x13 __LF \ - tst x10, #0x8000000000000000 __LF \ - csel x3, x3, xzr, pl __LF \ - subs x7, x7, x3 __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - and x10, x10, #0x7fffffffffffffff __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - umull x7, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x8, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x7, x7, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x8, x8, x15 __LF \ - adds x7, x7, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x8, x8, x16 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - umull x11, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x12, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x11, x11, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x12, x12, x15 __LF \ - adds x11, x11, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x12, x12, x16 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, cc __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, cc __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x9, cc __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, cc __LF \ - cinv x9, x9, cc __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #0x1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x3, #0x26 __LF \ - umull x4, w11, w3 __LF \ - add x4, x4, w7, uxtw __LF \ - lsr x7, x7, #32 __LF \ - lsr x11, x11, #32 __LF \ - umaddl x11, w11, w3, x7 __LF \ - mov x7, x4 __LF \ - umull x4, w12, w3 __LF \ - add x4, x4, w8, uxtw __LF \ - lsr x8, x8, #32 __LF \ - lsr x12, x12, #32 __LF \ - umaddl x12, w12, w3, x8 __LF \ - mov x8, x4 __LF \ - umull x4, w13, w3 __LF \ - add x4, x4, w9, uxtw __LF \ - lsr x9, x9, #32 __LF \ - lsr x13, x13, #32 __LF \ - umaddl x13, w13, w3, x9 __LF \ - mov x9, x4 __LF \ - umull x4, w14, w3 __LF \ - add x4, x4, w10, uxtw __LF \ - lsr x10, x10, #32 __LF \ - lsr x14, x14, #32 __LF \ - umaddl x14, w14, w3, x10 __LF \ - mov x10, x4 __LF \ - lsr x0, x14, #31 __LF \ - mov x5, #0x13 __LF \ - umull x5, w5, w0 __LF \ - add x7, x7, x5 __LF \ - adds x7, x7, x11, lsl #32 __LF \ - extr x3, x12, x11, #32 __LF \ - adcs x8, x8, x3 __LF \ - extr x3, x13, x12, #32 __LF \ - adcs x9, x9, x3 __LF \ - extr x3, x14, x13, #32 __LF \ - lsl x5, x0, #63 __LF \ - eor x10, x10, x5 __LF \ - adc x10, x10, x3 __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// Plain 4-digit add and doubling without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - ldp x0, x1, [P1] __LF \ - ldp x4, x5, [P2] __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - ldp x2, x3, [P1+16] __LF \ - ldp x6, x7, [P2+16] __LF \ - adcs x2, x2, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -#define double_4(P0,P1) \ - ldp x0, x1, [P1] __LF \ - adds x0, x0, x0 __LF \ - adcs x1, x1, x1 __LF \ - ldp x2, x3, [P1+16] __LF \ - adcs x2, x2, x2 __LF \ - adc x3, x3, x3 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x3, #19 __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - mov x4, #0x8000000000000000 __LF \ - sbc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular addition with inputs double modulus 2 * p_25519 = 2^256 - 38 -// and in general only guaranteeing a 4-digit result, not even < 2 * p_25519. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -// Load the constant k_25519 = 2 * d_25519 using immediate operations - -#define load_k25519(P0) \ - movz x0, #0xf159 __LF \ - movz x1, #0xb156 __LF \ - movz x2, #0xd130 __LF \ - movz x3, #0xfce7 __LF \ - movk x0, #0x26b2, lsl #16 __LF \ - movk x1, #0x8283, lsl #16 __LF \ - movk x2, #0xeef3, lsl #16 __LF \ - movk x3, #0x56df, lsl #16 __LF \ - movk x0, #0x9b94, lsl #32 __LF \ - movk x1, #0x149a, lsl #32 __LF \ - movk x2, #0x80f2, lsl #32 __LF \ - movk x3, #0xd9dc, lsl #32 __LF \ - movk x0, #0xebd6, lsl #48 __LF \ - movk x1, #0x00e0, lsl #48 __LF \ - movk x2, #0x198e, lsl #48 __LF \ - movk x3, #0x2406, lsl #48 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -S2N_BN_SYMBOL(edwards25519_epadd): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov p3, x0 - mov p1, x1 - mov p2, x2 - -// Main sequence - - mul_4(t0,w_1,w_2) - - sub_4(t1,y_1,x_1) - sub_4(t2,y_2,x_2) - add_4(t3,y_1,x_1) - add_4(t4,y_2,x_2) - double_4(t5,z_2) - - mul_4(t1,t1,t2) - mul_4(t3,t3,t4) - - load_k25519(t2) - mul_4(t2,t2,t0) - - mul_4(t4,z_1,t5) - - sub_twice4(t0,t3,t1) - add_twice4(t5,t3,t1) - sub_twice4(t1,t4,t2) - add_twice4(t3,t4,t2) - - mul_p25519(w_3,t0,t5) - mul_p25519(x_3,t0,t1) - mul_p25519(y_3,t3,t5) - mul_p25519(z_3,t1,t3) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_epadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epadd_alt.S deleted file mode 100644 index 29330ff45ed..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epadd_alt.S +++ /dev/null @@ -1,437 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended projective addition for edwards25519 -// Inputs p1[16], p2[16]; output p3[16] -// -// extern void edwards25519_epadd_alt -// (uint64_t p3[static 16],const uint64_t p1[static 16], -// const uint64_t p2[static 16]); -// -// The output p3 and both inputs p1 and p2 are points (x,y) on -// edwards25519 represented in extended projective quadruples (X,Y,Z,T) -// where x = X / Z, y = Y / Z and x * y = T / Z. -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_epadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_epadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_epadd_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define p3 x17 -#define p1 x19 -#define p2 x20 - -// Pointers to input and output coordinates - -#define x_1 p1, #0 -#define y_1 p1, #NUMSIZE -#define z_1 p1, #(2*NUMSIZE) -#define w_1 p1, #(3*NUMSIZE) - -#define x_2 p2, #0 -#define y_2 p2, #NUMSIZE -#define z_2 p2, #(2*NUMSIZE) -#define w_2 p2, #(3*NUMSIZE) - -#define x_3 p3, #0 -#define y_3 p3, #NUMSIZE -#define z_3 p3, #(2*NUMSIZE) -#define w_3 p3, #(3*NUMSIZE) - -// Pointer-offset pairs for temporaries on stack - -#define t0 sp, #(0*NUMSIZE) -#define t1 sp, #(1*NUMSIZE) -#define t2 sp, #(2*NUMSIZE) -#define t3 sp, #(3*NUMSIZE) -#define t4 sp, #(4*NUMSIZE) -#define t5 sp, #(5*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 6*NUMSIZE - -// Macro wrapping up the basic field operation bignum_mul_p25519_alt, only -// trivially different from a pure function call to that subroutine. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - orr x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - madd x11, x7, x8, x7 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adcs x15, x15, xzr __LF \ - csel x7, x7, xzr, cc __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x15, x15, xzr __LF \ - and x15, x15, #0x7fffffffffffffff __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - bic x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - mul x11, x7, x8 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adc x15, x15, xzr __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -// Plain 4-digit add and doubling without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - ldp x0, x1, [P1] __LF \ - ldp x4, x5, [P2] __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - ldp x2, x3, [P1+16] __LF \ - ldp x6, x7, [P2+16] __LF \ - adcs x2, x2, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -#define double_4(P0,P1) \ - ldp x0, x1, [P1] __LF \ - adds x0, x0, x0 __LF \ - adcs x1, x1, x1 __LF \ - ldp x2, x3, [P1+16] __LF \ - adcs x2, x2, x2 __LF \ - adc x3, x3, x3 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x3, #19 __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - mov x4, #0x8000000000000000 __LF \ - sbc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular addition with inputs double modulus 2 * p_25519 = 2^256 - 38 -// and in general only guaranteeing a 4-digit result, not even < 2 * p_25519. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -// Load the constant k_25519 = 2 * d_25519 using immediate operations - -#define load_k25519(P0) \ - movz x0, #0xf159 __LF \ - movz x1, #0xb156 __LF \ - movz x2, #0xd130 __LF \ - movz x3, #0xfce7 __LF \ - movk x0, #0x26b2, lsl #16 __LF \ - movk x1, #0x8283, lsl #16 __LF \ - movk x2, #0xeef3, lsl #16 __LF \ - movk x3, #0x56df, lsl #16 __LF \ - movk x0, #0x9b94, lsl #32 __LF \ - movk x1, #0x149a, lsl #32 __LF \ - movk x2, #0x80f2, lsl #32 __LF \ - movk x3, #0xd9dc, lsl #32 __LF \ - movk x0, #0xebd6, lsl #48 __LF \ - movk x1, #0x00e0, lsl #48 __LF \ - movk x2, #0x198e, lsl #48 __LF \ - movk x3, #0x2406, lsl #48 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -S2N_BN_SYMBOL(edwards25519_epadd_alt): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov p3, x0 - mov p1, x1 - mov p2, x2 - -// Main sequence - - mul_4(t0,w_1,w_2) - - sub_4(t1,y_1,x_1) - sub_4(t2,y_2,x_2) - add_4(t3,y_1,x_1) - add_4(t4,y_2,x_2) - double_4(t5,z_2) - - mul_4(t1,t1,t2) - mul_4(t3,t3,t4) - - load_k25519(t2) - mul_4(t2,t2,t0) - - mul_4(t4,z_1,t5) - - sub_twice4(t0,t3,t1) - add_twice4(t5,t3,t1) - sub_twice4(t1,t4,t2) - add_twice4(t3,t4,t2) - - mul_p25519(w_3,t0,t5) - mul_p25519(x_3,t0,t1) - mul_p25519(y_3,t3,t5) - mul_p25519(z_3,t1,t3) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_epadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epdouble.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epdouble.S deleted file mode 100644 index 34a38fd8ee0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epdouble.S +++ /dev/null @@ -1,499 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended projective doubling for edwards25519 -// Input p1[12]; output p3[16] -// -// extern void edwards25519_epdouble -// (uint64_t p3[static 16],const uint64_t p1[static 12]); -// -// If p1 is a point on edwards25519, returns its double p3 = 2 * p1. -// The output p3 is in extended projective coordinates, representing -// affine (x,y) by a quadruple (X,Y,Z,T) where x = X / Z, y = Y / Z -// and x * y = T / Z. The input p1 may also be in the same extended -// projective representation, but the final T field is not used so -// a more basic projective triple (X,Y,Z) suffices. -// -// Standard ARM ABI: X0 = p3, X1 = p1 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_epdouble) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_epdouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_epdouble) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define p3 x17 -#define p1 x19 - -// Pointers to input and output coordinates - -#define x_1 p1, #0 -#define y_1 p1, #NUMSIZE -#define z_1 p1, #(2*NUMSIZE) - -#define x_3 p3, #0 -#define y_3 p3, #NUMSIZE -#define z_3 p3, #(2*NUMSIZE) -#define w_3 p3, #(3*NUMSIZE) - -// Pointer-offset pairs for temporaries on stack - -#define t0 sp, #(0*NUMSIZE) -#define t1 sp, #(1*NUMSIZE) -#define t2 sp, #(2*NUMSIZE) -#define t3 sp, #(3*NUMSIZE) -#define t4 sp, #(4*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 5*NUMSIZE - -// Macro wrapping up the basic field operation bignum_mul_p25519, only -// trivially different from a pure function call to that subroutine. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - umull x7, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x8, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x7, x7, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x8, x8, x15 __LF \ - adds x7, x7, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x8, x8, x16 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - umull x11, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x12, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x11, x11, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x12, x12, x15 __LF \ - adds x11, x11, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x12, x12, x16 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, cc __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, cc __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x9, cc __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, cc __LF \ - cinv x9, x9, cc __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #0x1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x3, #0x26 __LF \ - umull x4, w11, w3 __LF \ - add x4, x4, w7, uxtw __LF \ - lsr x7, x7, #32 __LF \ - lsr x11, x11, #32 __LF \ - umaddl x11, w11, w3, x7 __LF \ - mov x7, x4 __LF \ - umull x4, w12, w3 __LF \ - add x4, x4, w8, uxtw __LF \ - lsr x8, x8, #32 __LF \ - lsr x12, x12, #32 __LF \ - umaddl x12, w12, w3, x8 __LF \ - mov x8, x4 __LF \ - umull x4, w13, w3 __LF \ - add x4, x4, w9, uxtw __LF \ - lsr x9, x9, #32 __LF \ - lsr x13, x13, #32 __LF \ - umaddl x13, w13, w3, x9 __LF \ - mov x9, x4 __LF \ - umull x4, w14, w3 __LF \ - add x4, x4, w10, uxtw __LF \ - lsr x10, x10, #32 __LF \ - lsr x14, x14, #32 __LF \ - umaddl x14, w14, w3, x10 __LF \ - mov x10, x4 __LF \ - lsr x0, x14, #31 __LF \ - mov x5, #0x13 __LF \ - umaddl x5, w5, w0, x5 __LF \ - add x7, x7, x5 __LF \ - adds x7, x7, x11, lsl #32 __LF \ - extr x3, x12, x11, #32 __LF \ - adcs x8, x8, x3 __LF \ - extr x3, x13, x12, #32 __LF \ - adcs x9, x9, x3 __LF \ - extr x3, x14, x13, #32 __LF \ - lsl x5, x0, #63 __LF \ - eor x10, x10, x5 __LF \ - adc x10, x10, x3 __LF \ - mov x3, #0x13 __LF \ - tst x10, #0x8000000000000000 __LF \ - csel x3, x3, xzr, pl __LF \ - subs x7, x7, x3 __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - and x10, x10, #0x7fffffffffffffff __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - ldp x10, x11, [P1] __LF \ - ldp x12, x13, [P1+16] __LF \ - umull x2, w10, w10 __LF \ - lsr x14, x10, #32 __LF \ - umull x3, w14, w14 __LF \ - umull x14, w10, w14 __LF \ - adds x2, x2, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x3, x3, x14 __LF \ - umull x4, w11, w11 __LF \ - lsr x14, x11, #32 __LF \ - umull x5, w14, w14 __LF \ - umull x14, w11, w14 __LF \ - mul x15, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x4, x4, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x5, x5, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x5, x5, xzr __LF \ - adds x3, x3, x15 __LF \ - adcs x4, x4, x16 __LF \ - adc x5, x5, xzr __LF \ - umull x6, w12, w12 __LF \ - lsr x14, x12, #32 __LF \ - umull x7, w14, w14 __LF \ - umull x14, w12, w14 __LF \ - adds x6, x6, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x7, x7, x14 __LF \ - umull x8, w13, w13 __LF \ - lsr x14, x13, #32 __LF \ - umull x9, w14, w14 __LF \ - umull x14, w13, w14 __LF \ - mul x15, x12, x13 __LF \ - umulh x16, x12, x13 __LF \ - adds x8, x8, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x9, x9, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x9, x9, xzr __LF \ - adds x7, x7, x15 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, xzr __LF \ - subs x10, x10, x12 __LF \ - sbcs x11, x11, x13 __LF \ - csetm x16, cc __LF \ - eor x10, x10, x16 __LF \ - subs x10, x10, x16 __LF \ - eor x11, x11, x16 __LF \ - sbc x11, x11, x16 __LF \ - adds x6, x6, x4 __LF \ - adcs x7, x7, x5 __LF \ - adcs x8, x8, xzr __LF \ - adc x9, x9, xzr __LF \ - umull x12, w10, w10 __LF \ - lsr x5, x10, #32 __LF \ - umull x13, w5, w5 __LF \ - umull x5, w10, w5 __LF \ - adds x12, x12, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x13, x13, x5 __LF \ - umull x15, w11, w11 __LF \ - lsr x5, x11, #32 __LF \ - umull x14, w5, w5 __LF \ - umull x5, w11, w5 __LF \ - mul x4, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x15, x15, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x14, x14, x5 __LF \ - adds x4, x4, x4 __LF \ - adcs x16, x16, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x13, x13, x4 __LF \ - adcs x15, x15, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x4, x2, x6 __LF \ - adcs x5, x3, x7 __LF \ - adcs x6, x6, x8 __LF \ - adcs x7, x7, x9 __LF \ - csetm x16, cc __LF \ - subs x4, x4, x12 __LF \ - sbcs x5, x5, x13 __LF \ - sbcs x6, x6, x15 __LF \ - sbcs x7, x7, x14 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, x16 __LF \ - mov x10, #0x26 __LF \ - umull x12, w6, w10 __LF \ - add x12, x12, w2, uxtw __LF \ - lsr x2, x2, #32 __LF \ - lsr x6, x6, #32 __LF \ - umaddl x6, w6, w10, x2 __LF \ - mov x2, x12 __LF \ - umull x12, w7, w10 __LF \ - add x12, x12, w3, uxtw __LF \ - lsr x3, x3, #32 __LF \ - lsr x7, x7, #32 __LF \ - umaddl x7, w7, w10, x3 __LF \ - mov x3, x12 __LF \ - umull x12, w8, w10 __LF \ - add x12, x12, w4, uxtw __LF \ - lsr x4, x4, #32 __LF \ - lsr x8, x8, #32 __LF \ - umaddl x8, w8, w10, x4 __LF \ - mov x4, x12 __LF \ - umull x12, w9, w10 __LF \ - add x12, x12, w5, uxtw __LF \ - lsr x5, x5, #32 __LF \ - lsr x9, x9, #32 __LF \ - umaddl x9, w9, w10, x5 __LF \ - mov x5, x12 __LF \ - lsr x13, x9, #31 __LF \ - mov x11, #0x13 __LF \ - umull x11, w11, w13 __LF \ - add x2, x2, x11 __LF \ - adds x2, x2, x6, lsl #32 __LF \ - extr x10, x7, x6, #32 __LF \ - adcs x3, x3, x10 __LF \ - extr x10, x8, x7, #32 __LF \ - adcs x4, x4, x10 __LF \ - extr x10, x9, x8, #32 __LF \ - lsl x11, x13, #63 __LF \ - eor x5, x5, x11 __LF \ - adc x5, x5, x10 __LF \ - stp x2, x3, [P0] __LF \ - stp x4, x5, [P0+16] - -// Plain 4-digit adding without any normalization. -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - ldp x0, x1, [P1] __LF \ - ldp x4, x5, [P2] __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - ldp x2, x3, [P1+16] __LF \ - ldp x6, x7, [P2+16] __LF \ - adcs x2, x2, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular addition and doubling with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -#define double_twice4(P0,P1) \ - ldp x3, x4, [P1] __LF \ - adds x3, x3, x3 __LF \ - adcs x4, x4, x4 __LF \ - ldp x5, x6, [P1+16] __LF \ - adcs x5, x5, x5 __LF \ - adcs x6, x6, x6 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -S2N_BN_SYMBOL(edwards25519_epdouble): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov p3, x0 - mov p1, x1 - -// Main sequence - - add_4(t0,x_1,y_1) - sqr_4(t1,z_1) - sqr_4(t2,x_1) - sqr_4(t3,y_1) - double_twice4(t1,t1) - sqr_4(t0,t0) - add_twice4(t4,t2,t3) - sub_twice4(t2,t2,t3) - add_twice4(t3,t1,t2) - sub_twice4(t1,t4,t0) - mul_p25519(y_3,t2,t4) - mul_p25519(z_3,t3,t2) - mul_p25519(w_3,t1,t4) - mul_p25519(x_3,t1,t3) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_epdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epdouble_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epdouble_alt.S deleted file mode 100644 index 5ff2596ce54..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_epdouble_alt.S +++ /dev/null @@ -1,362 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended projective doubling for edwards25519 -// Input p1[12]; output p3[16] -// -// extern void edwards25519_epdouble_alt -// (uint64_t p3[static 16],const uint64_t p1[static 12]); -// -// If p1 is a point on edwards25519, returns its double p3 = 2 * p1. -// The output p3 is in extended projective coordinates, representing -// affine (x,y) by a quadruple (X,Y,Z,T) where x = X / Z, y = Y / Z -// and x * y = T / Z. The input p1 may also be in the same extended -// projective representation, but the final T field is not used so -// a more basic projective triple (X,Y,Z) suffices. -// -// Standard ARM ABI: X0 = p3, X1 = p1 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_epdouble_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_epdouble_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_epdouble_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define p3 x17 -#define p1 x19 - -// Pointers to input and output coordinates - -#define x_1 p1, #0 -#define y_1 p1, #NUMSIZE -#define z_1 p1, #(2*NUMSIZE) - -#define x_3 p3, #0 -#define y_3 p3, #NUMSIZE -#define z_3 p3, #(2*NUMSIZE) -#define w_3 p3, #(3*NUMSIZE) - -// Pointer-offset pairs for temporaries on stack - -#define t0 sp, #(0*NUMSIZE) -#define t1 sp, #(1*NUMSIZE) -#define t2 sp, #(2*NUMSIZE) -#define t3 sp, #(3*NUMSIZE) -#define t4 sp, #(4*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 5*NUMSIZE - -// Macro wrapping up the basic field operation bignum_mul_p25519_alt, only -// trivially different from a pure function call to that subroutine. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - orr x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - madd x11, x7, x8, x7 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adcs x15, x15, xzr __LF \ - csel x7, x7, xzr, cc __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x15, x15, xzr __LF \ - and x15, x15, #0x7fffffffffffffff __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x7, x2, x4 __LF \ - umulh x6, x2, x4 __LF \ - adds x10, x10, x7 __LF \ - adcs x11, x11, x6 __LF \ - mul x7, x3, x4 __LF \ - umulh x6, x3, x4 __LF \ - adc x6, x6, xzr __LF \ - adds x11, x11, x7 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x6 __LF \ - mul x7, x3, x5 __LF \ - umulh x6, x3, x5 __LF \ - adc x6, x6, xzr __LF \ - adds x12, x12, x7 __LF \ - adcs x13, x13, x6 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x6, cs __LF \ - umulh x7, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x7 __LF \ - mul x7, x3, x3 __LF \ - adcs x10, x10, x7 __LF \ - umulh x7, x3, x3 __LF \ - adcs x11, x11, x7 __LF \ - mul x7, x4, x4 __LF \ - adcs x12, x12, x7 __LF \ - umulh x7, x4, x4 __LF \ - adcs x13, x13, x7 __LF \ - mul x7, x5, x5 __LF \ - adcs x14, x14, x7 __LF \ - umulh x7, x5, x5 __LF \ - adc x6, x6, x7 __LF \ - mov x3, #0x26 __LF \ - mul x7, x3, x12 __LF \ - umulh x4, x3, x12 __LF \ - adds x8, x8, x7 __LF \ - mul x7, x3, x13 __LF \ - umulh x13, x3, x13 __LF \ - adcs x9, x9, x7 __LF \ - mul x7, x3, x14 __LF \ - umulh x14, x3, x14 __LF \ - adcs x10, x10, x7 __LF \ - mul x7, x3, x6 __LF \ - umulh x6, x3, x6 __LF \ - adcs x11, x11, x7 __LF \ - cset x12, cs __LF \ - adds x11, x11, x14 __LF \ - adc x12, x12, x6 __LF \ - cmn x11, x11 __LF \ - bic x11, x11, #0x8000000000000000 __LF \ - adc x2, x12, x12 __LF \ - mov x3, #0x13 __LF \ - mul x7, x3, x2 __LF \ - adds x8, x8, x7 __LF \ - adcs x9, x9, x4 __LF \ - adcs x10, x10, x13 __LF \ - adc x11, x11, xzr __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Plain 4-digit adding without any normalization. -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - ldp x0, x1, [P1] __LF \ - ldp x4, x5, [P2] __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - ldp x2, x3, [P1+16] __LF \ - ldp x6, x7, [P2+16] __LF \ - adcs x2, x2, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular addition and doubling with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -#define double_twice4(P0,P1) \ - ldp x3, x4, [P1] __LF \ - adds x3, x3, x3 __LF \ - adcs x4, x4, x4 __LF \ - ldp x5, x6, [P1+16] __LF \ - adcs x5, x5, x5 __LF \ - adcs x6, x6, x6 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -S2N_BN_SYMBOL(edwards25519_epdouble_alt): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov p3, x0 - mov p1, x1 - -// Main sequence - - add_4(t0,x_1,y_1) - sqr_4(t1,z_1) - sqr_4(t2,x_1) - sqr_4(t3,y_1) - double_twice4(t1,t1) - sqr_4(t0,t0) - add_twice4(t4,t2,t3) - sub_twice4(t2,t2,t3) - add_twice4(t3,t1,t2) - sub_twice4(t1,t4,t0) - mul_p25519(y_3,t2,t4) - mul_p25519(z_3,t3,t2) - mul_p25519(w_3,t1,t4) - mul_p25519(x_3,t1,t3) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_epdouble_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pdouble.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pdouble.S deleted file mode 100644 index 2d51e0d1481..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pdouble.S +++ /dev/null @@ -1,494 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Projective doubling for edwards25519 -// Input p1[12]; output p3[12] -// -// extern void edwards25519_pdouble -// (uint64_t p3[static 12],const uint64_t p1[static 12]); -// -// If p1 is a point on edwards25519, returns its double p3 = 2 * p1. -// Input and output are in pure projective coordinates, representing -// an affine (x,y) by a triple (X,Y,Z) where x = X / Z, y = Y / Z. -// -// Standard ARM ABI: X0 = p3, X1 = p1 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_pdouble) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_pdouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_pdouble) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define p3 x17 -#define p1 x19 - -// Pointers to input and output coordinates - -#define x_1 p1, #0 -#define y_1 p1, #NUMSIZE -#define z_1 p1, #(2*NUMSIZE) - -#define x_3 p3, #0 -#define y_3 p3, #NUMSIZE -#define z_3 p3, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries on stack - -#define t0 sp, #(0*NUMSIZE) -#define t1 sp, #(1*NUMSIZE) -#define t2 sp, #(2*NUMSIZE) -#define t3 sp, #(3*NUMSIZE) -#define t4 sp, #(4*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 5*NUMSIZE - -// Macro wrapping up the basic field operation bignum_mul_p25519, only -// trivially different from a pure function call to that subroutine. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - umull x7, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x8, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x7, x7, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x8, x8, x15 __LF \ - adds x7, x7, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x8, x8, x16 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - umull x11, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x12, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x11, x11, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x12, x12, x15 __LF \ - adds x11, x11, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x12, x12, x16 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, cc __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, cc __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x9, cc __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, cc __LF \ - cinv x9, x9, cc __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #0x1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x3, #0x26 __LF \ - umull x4, w11, w3 __LF \ - add x4, x4, w7, uxtw __LF \ - lsr x7, x7, #32 __LF \ - lsr x11, x11, #32 __LF \ - umaddl x11, w11, w3, x7 __LF \ - mov x7, x4 __LF \ - umull x4, w12, w3 __LF \ - add x4, x4, w8, uxtw __LF \ - lsr x8, x8, #32 __LF \ - lsr x12, x12, #32 __LF \ - umaddl x12, w12, w3, x8 __LF \ - mov x8, x4 __LF \ - umull x4, w13, w3 __LF \ - add x4, x4, w9, uxtw __LF \ - lsr x9, x9, #32 __LF \ - lsr x13, x13, #32 __LF \ - umaddl x13, w13, w3, x9 __LF \ - mov x9, x4 __LF \ - umull x4, w14, w3 __LF \ - add x4, x4, w10, uxtw __LF \ - lsr x10, x10, #32 __LF \ - lsr x14, x14, #32 __LF \ - umaddl x14, w14, w3, x10 __LF \ - mov x10, x4 __LF \ - lsr x0, x14, #31 __LF \ - mov x5, #0x13 __LF \ - umaddl x5, w5, w0, x5 __LF \ - add x7, x7, x5 __LF \ - adds x7, x7, x11, lsl #32 __LF \ - extr x3, x12, x11, #32 __LF \ - adcs x8, x8, x3 __LF \ - extr x3, x13, x12, #32 __LF \ - adcs x9, x9, x3 __LF \ - extr x3, x14, x13, #32 __LF \ - lsl x5, x0, #63 __LF \ - eor x10, x10, x5 __LF \ - adc x10, x10, x3 __LF \ - mov x3, #0x13 __LF \ - tst x10, #0x8000000000000000 __LF \ - csel x3, x3, xzr, pl __LF \ - subs x7, x7, x3 __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - and x10, x10, #0x7fffffffffffffff __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - ldp x10, x11, [P1] __LF \ - ldp x12, x13, [P1+16] __LF \ - umull x2, w10, w10 __LF \ - lsr x14, x10, #32 __LF \ - umull x3, w14, w14 __LF \ - umull x14, w10, w14 __LF \ - adds x2, x2, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x3, x3, x14 __LF \ - umull x4, w11, w11 __LF \ - lsr x14, x11, #32 __LF \ - umull x5, w14, w14 __LF \ - umull x14, w11, w14 __LF \ - mul x15, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x4, x4, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x5, x5, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x5, x5, xzr __LF \ - adds x3, x3, x15 __LF \ - adcs x4, x4, x16 __LF \ - adc x5, x5, xzr __LF \ - umull x6, w12, w12 __LF \ - lsr x14, x12, #32 __LF \ - umull x7, w14, w14 __LF \ - umull x14, w12, w14 __LF \ - adds x6, x6, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x7, x7, x14 __LF \ - umull x8, w13, w13 __LF \ - lsr x14, x13, #32 __LF \ - umull x9, w14, w14 __LF \ - umull x14, w13, w14 __LF \ - mul x15, x12, x13 __LF \ - umulh x16, x12, x13 __LF \ - adds x8, x8, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x9, x9, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x9, x9, xzr __LF \ - adds x7, x7, x15 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, xzr __LF \ - subs x10, x10, x12 __LF \ - sbcs x11, x11, x13 __LF \ - csetm x16, cc __LF \ - eor x10, x10, x16 __LF \ - subs x10, x10, x16 __LF \ - eor x11, x11, x16 __LF \ - sbc x11, x11, x16 __LF \ - adds x6, x6, x4 __LF \ - adcs x7, x7, x5 __LF \ - adcs x8, x8, xzr __LF \ - adc x9, x9, xzr __LF \ - umull x12, w10, w10 __LF \ - lsr x5, x10, #32 __LF \ - umull x13, w5, w5 __LF \ - umull x5, w10, w5 __LF \ - adds x12, x12, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x13, x13, x5 __LF \ - umull x15, w11, w11 __LF \ - lsr x5, x11, #32 __LF \ - umull x14, w5, w5 __LF \ - umull x5, w11, w5 __LF \ - mul x4, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x15, x15, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x14, x14, x5 __LF \ - adds x4, x4, x4 __LF \ - adcs x16, x16, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x13, x13, x4 __LF \ - adcs x15, x15, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x4, x2, x6 __LF \ - adcs x5, x3, x7 __LF \ - adcs x6, x6, x8 __LF \ - adcs x7, x7, x9 __LF \ - csetm x16, cc __LF \ - subs x4, x4, x12 __LF \ - sbcs x5, x5, x13 __LF \ - sbcs x6, x6, x15 __LF \ - sbcs x7, x7, x14 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, x16 __LF \ - mov x10, #0x26 __LF \ - umull x12, w6, w10 __LF \ - add x12, x12, w2, uxtw __LF \ - lsr x2, x2, #32 __LF \ - lsr x6, x6, #32 __LF \ - umaddl x6, w6, w10, x2 __LF \ - mov x2, x12 __LF \ - umull x12, w7, w10 __LF \ - add x12, x12, w3, uxtw __LF \ - lsr x3, x3, #32 __LF \ - lsr x7, x7, #32 __LF \ - umaddl x7, w7, w10, x3 __LF \ - mov x3, x12 __LF \ - umull x12, w8, w10 __LF \ - add x12, x12, w4, uxtw __LF \ - lsr x4, x4, #32 __LF \ - lsr x8, x8, #32 __LF \ - umaddl x8, w8, w10, x4 __LF \ - mov x4, x12 __LF \ - umull x12, w9, w10 __LF \ - add x12, x12, w5, uxtw __LF \ - lsr x5, x5, #32 __LF \ - lsr x9, x9, #32 __LF \ - umaddl x9, w9, w10, x5 __LF \ - mov x5, x12 __LF \ - lsr x13, x9, #31 __LF \ - mov x11, #0x13 __LF \ - umull x11, w11, w13 __LF \ - add x2, x2, x11 __LF \ - adds x2, x2, x6, lsl #32 __LF \ - extr x10, x7, x6, #32 __LF \ - adcs x3, x3, x10 __LF \ - extr x10, x8, x7, #32 __LF \ - adcs x4, x4, x10 __LF \ - extr x10, x9, x8, #32 __LF \ - lsl x11, x13, #63 __LF \ - eor x5, x5, x11 __LF \ - adc x5, x5, x10 __LF \ - stp x2, x3, [P0] __LF \ - stp x4, x5, [P0+16] - -// Plain 4-digit adding without any normalization. -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - ldp x0, x1, [P1] __LF \ - ldp x4, x5, [P2] __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - ldp x2, x3, [P1+16] __LF \ - ldp x6, x7, [P2+16] __LF \ - adcs x2, x2, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular addition and doubling with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -#define double_twice4(P0,P1) \ - ldp x3, x4, [P1] __LF \ - adds x3, x3, x3 __LF \ - adcs x4, x4, x4 __LF \ - ldp x5, x6, [P1+16] __LF \ - adcs x5, x5, x5 __LF \ - adcs x6, x6, x6 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -S2N_BN_SYMBOL(edwards25519_pdouble): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov p3, x0 - mov p1, x1 - -// Main sequence - - add_4(t0,x_1,y_1) - sqr_4(t1,z_1) - sqr_4(t2,x_1) - sqr_4(t3,y_1) - double_twice4(t1,t1) - sqr_4(t0,t0) - add_twice4(t4,t2,t3) - sub_twice4(t2,t2,t3) - add_twice4(t3,t1,t2) - sub_twice4(t1,t4,t0) - mul_p25519(y_3,t2,t4) - mul_p25519(z_3,t3,t2) - mul_p25519(x_3,t1,t3) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_pdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pdouble_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pdouble_alt.S deleted file mode 100644 index 5000a7c97cf..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pdouble_alt.S +++ /dev/null @@ -1,357 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Projective doubling for edwards25519 -// Input p1[12]; output p3[12] -// -// extern void edwards25519_pdouble_alt -// (uint64_t p3[static 12],const uint64_t p1[static 12]); -// -// If p1 is a point on edwards25519, returns its double p3 = 2 * p1. -// Input and output are in pure projective coordinates, representing -// an affine (x,y) by a triple (X,Y,Z) where x = X / Z, y = Y / Z. -// -// Standard ARM ABI: X0 = p3, X1 = p1 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_pdouble_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_pdouble_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_pdouble_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define p3 x17 -#define p1 x19 - -// Pointers to input and output coordinates - -#define x_1 p1, #0 -#define y_1 p1, #NUMSIZE -#define z_1 p1, #(2*NUMSIZE) - -#define x_3 p3, #0 -#define y_3 p3, #NUMSIZE -#define z_3 p3, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries on stack - -#define t0 sp, #(0*NUMSIZE) -#define t1 sp, #(1*NUMSIZE) -#define t2 sp, #(2*NUMSIZE) -#define t3 sp, #(3*NUMSIZE) -#define t4 sp, #(4*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 5*NUMSIZE - -// Macro wrapping up the basic field operation bignum_mul_p25519_alt, only -// trivially different from a pure function call to that subroutine. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - orr x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - madd x11, x7, x8, x7 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adcs x15, x15, xzr __LF \ - csel x7, x7, xzr, cc __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x15, x15, xzr __LF \ - and x15, x15, #0x7fffffffffffffff __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x7, x2, x4 __LF \ - umulh x6, x2, x4 __LF \ - adds x10, x10, x7 __LF \ - adcs x11, x11, x6 __LF \ - mul x7, x3, x4 __LF \ - umulh x6, x3, x4 __LF \ - adc x6, x6, xzr __LF \ - adds x11, x11, x7 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x6 __LF \ - mul x7, x3, x5 __LF \ - umulh x6, x3, x5 __LF \ - adc x6, x6, xzr __LF \ - adds x12, x12, x7 __LF \ - adcs x13, x13, x6 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x6, cs __LF \ - umulh x7, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x7 __LF \ - mul x7, x3, x3 __LF \ - adcs x10, x10, x7 __LF \ - umulh x7, x3, x3 __LF \ - adcs x11, x11, x7 __LF \ - mul x7, x4, x4 __LF \ - adcs x12, x12, x7 __LF \ - umulh x7, x4, x4 __LF \ - adcs x13, x13, x7 __LF \ - mul x7, x5, x5 __LF \ - adcs x14, x14, x7 __LF \ - umulh x7, x5, x5 __LF \ - adc x6, x6, x7 __LF \ - mov x3, #0x26 __LF \ - mul x7, x3, x12 __LF \ - umulh x4, x3, x12 __LF \ - adds x8, x8, x7 __LF \ - mul x7, x3, x13 __LF \ - umulh x13, x3, x13 __LF \ - adcs x9, x9, x7 __LF \ - mul x7, x3, x14 __LF \ - umulh x14, x3, x14 __LF \ - adcs x10, x10, x7 __LF \ - mul x7, x3, x6 __LF \ - umulh x6, x3, x6 __LF \ - adcs x11, x11, x7 __LF \ - cset x12, cs __LF \ - adds x11, x11, x14 __LF \ - adc x12, x12, x6 __LF \ - cmn x11, x11 __LF \ - bic x11, x11, #0x8000000000000000 __LF \ - adc x2, x12, x12 __LF \ - mov x3, #0x13 __LF \ - mul x7, x3, x2 __LF \ - adds x8, x8, x7 __LF \ - adcs x9, x9, x4 __LF \ - adcs x10, x10, x13 __LF \ - adc x11, x11, xzr __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Plain 4-digit adding without any normalization. -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - ldp x0, x1, [P1] __LF \ - ldp x4, x5, [P2] __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - ldp x2, x3, [P1+16] __LF \ - ldp x6, x7, [P2+16] __LF \ - adcs x2, x2, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular addition and doubling with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -#define double_twice4(P0,P1) \ - ldp x3, x4, [P1] __LF \ - adds x3, x3, x3 __LF \ - adcs x4, x4, x4 __LF \ - ldp x5, x6, [P1+16] __LF \ - adcs x5, x5, x5 __LF \ - adcs x6, x6, x6 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -S2N_BN_SYMBOL(edwards25519_pdouble_alt): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov p3, x0 - mov p1, x1 - -// Main sequence - - add_4(t0,x_1,y_1) - sqr_4(t1,z_1) - sqr_4(t2,x_1) - sqr_4(t3,y_1) - double_twice4(t1,t1) - sqr_4(t0,t0) - add_twice4(t4,t2,t3) - sub_twice4(t2,t2,t3) - add_twice4(t3,t1,t2) - sub_twice4(t1,t4,t0) - mul_p25519(y_3,t2,t4) - mul_p25519(z_3,t3,t2) - mul_p25519(x_3,t1,t3) - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_pdouble_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pepadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pepadd.S deleted file mode 100644 index f36f87a25a6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pepadd.S +++ /dev/null @@ -1,568 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended projective + precomputed mixed addition for edwards25519 -// Inputs p1[16], p2[12]; output p3[16] -// -// extern void edwards25519_pepadd -// (uint64_t p3[static 16],const uint64_t p1[static 16], -// const uint64_t p2[static 12]); -// -// The output p3 and the first input p1 are points (x,y) on edwards25519 -// represented in extended projective quadruples (X,Y,Z,T) where -// x = X / Z, y = Y / Z and x * y = T / Z. The second input p2 is a triple -// encoding its point (x,y) as (y - x,y + x,2 * d * x * y) where d is the -// usual Edwards curve parameter for edwards25519. -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_pepadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_pepadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_pepadd) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define p3 x17 -#define p1 x19 -#define p2 x20 - -// Pointers to input and output coordinates - -#define x_1 p1, #0 -#define y_1 p1, #NUMSIZE -#define z_1 p1, #(2*NUMSIZE) -#define w_1 p1, #(3*NUMSIZE) - -#define ymx_2 p2, #0 -#define xpy_2 p2, #NUMSIZE -#define kxy_2 p2, #(2*NUMSIZE) - -#define x_3 p3, #0 -#define y_3 p3, #NUMSIZE -#define z_3 p3, #(2*NUMSIZE) -#define w_3 p3, #(3*NUMSIZE) - -// Pointer-offset pairs for temporaries on stack - -#define t0 sp, #(0*NUMSIZE) -#define t1 sp, #(1*NUMSIZE) -#define t2 sp, #(2*NUMSIZE) -#define t3 sp, #(3*NUMSIZE) -#define t4 sp, #(4*NUMSIZE) -#define t5 sp, #(5*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 6*NUMSIZE - -// Macro wrapping up the basic field operation bignum_mul_p25519, only -// trivially different from a pure function call to that subroutine. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - umull x7, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x8, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x7, x7, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x8, x8, x15 __LF \ - adds x7, x7, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x8, x8, x16 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - umull x11, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x12, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x11, x11, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x12, x12, x15 __LF \ - adds x11, x11, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x12, x12, x16 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, cc __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, cc __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x9, cc __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, cc __LF \ - cinv x9, x9, cc __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #0x1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x3, #0x26 __LF \ - umull x4, w11, w3 __LF \ - add x4, x4, w7, uxtw __LF \ - lsr x7, x7, #32 __LF \ - lsr x11, x11, #32 __LF \ - umaddl x11, w11, w3, x7 __LF \ - mov x7, x4 __LF \ - umull x4, w12, w3 __LF \ - add x4, x4, w8, uxtw __LF \ - lsr x8, x8, #32 __LF \ - lsr x12, x12, #32 __LF \ - umaddl x12, w12, w3, x8 __LF \ - mov x8, x4 __LF \ - umull x4, w13, w3 __LF \ - add x4, x4, w9, uxtw __LF \ - lsr x9, x9, #32 __LF \ - lsr x13, x13, #32 __LF \ - umaddl x13, w13, w3, x9 __LF \ - mov x9, x4 __LF \ - umull x4, w14, w3 __LF \ - add x4, x4, w10, uxtw __LF \ - lsr x10, x10, #32 __LF \ - lsr x14, x14, #32 __LF \ - umaddl x14, w14, w3, x10 __LF \ - mov x10, x4 __LF \ - lsr x0, x14, #31 __LF \ - mov x5, #0x13 __LF \ - umaddl x5, w5, w0, x5 __LF \ - add x7, x7, x5 __LF \ - adds x7, x7, x11, lsl #32 __LF \ - extr x3, x12, x11, #32 __LF \ - adcs x8, x8, x3 __LF \ - extr x3, x13, x12, #32 __LF \ - adcs x9, x9, x3 __LF \ - extr x3, x14, x13, #32 __LF \ - lsl x5, x0, #63 __LF \ - eor x10, x10, x5 __LF \ - adc x10, x10, x3 __LF \ - mov x3, #0x13 __LF \ - tst x10, #0x8000000000000000 __LF \ - csel x3, x3, xzr, pl __LF \ - subs x7, x7, x3 __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - and x10, x10, #0x7fffffffffffffff __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - umull x7, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x8, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x7, x7, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x8, x8, x15 __LF \ - adds x7, x7, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x8, x8, x16 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - umull x11, w3, w5 __LF \ - lsr x0, x3, #32 __LF \ - umull x15, w0, w5 __LF \ - lsr x16, x5, #32 __LF \ - umull x12, w16, w0 __LF \ - umull x16, w3, w16 __LF \ - adds x11, x11, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x12, x12, x15 __LF \ - adds x11, x11, x16, lsl #32 __LF \ - lsr x16, x16, #32 __LF \ - adc x12, x12, x16 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x16, cc __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, cc __LF \ - cinv x16, x16, cc __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, cc __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, cc __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, cc __LF \ - csetm x9, cc __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, cc __LF \ - cinv x9, x9, cc __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #0x1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #0x1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x3, #0x26 __LF \ - umull x4, w11, w3 __LF \ - add x4, x4, w7, uxtw __LF \ - lsr x7, x7, #32 __LF \ - lsr x11, x11, #32 __LF \ - umaddl x11, w11, w3, x7 __LF \ - mov x7, x4 __LF \ - umull x4, w12, w3 __LF \ - add x4, x4, w8, uxtw __LF \ - lsr x8, x8, #32 __LF \ - lsr x12, x12, #32 __LF \ - umaddl x12, w12, w3, x8 __LF \ - mov x8, x4 __LF \ - umull x4, w13, w3 __LF \ - add x4, x4, w9, uxtw __LF \ - lsr x9, x9, #32 __LF \ - lsr x13, x13, #32 __LF \ - umaddl x13, w13, w3, x9 __LF \ - mov x9, x4 __LF \ - umull x4, w14, w3 __LF \ - add x4, x4, w10, uxtw __LF \ - lsr x10, x10, #32 __LF \ - lsr x14, x14, #32 __LF \ - umaddl x14, w14, w3, x10 __LF \ - mov x10, x4 __LF \ - lsr x0, x14, #31 __LF \ - mov x5, #0x13 __LF \ - umull x5, w5, w0 __LF \ - add x7, x7, x5 __LF \ - adds x7, x7, x11, lsl #32 __LF \ - extr x3, x12, x11, #32 __LF \ - adcs x8, x8, x3 __LF \ - extr x3, x13, x12, #32 __LF \ - adcs x9, x9, x3 __LF \ - extr x3, x14, x13, #32 __LF \ - lsl x5, x0, #63 __LF \ - eor x10, x10, x5 __LF \ - adc x10, x10, x3 __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// Plain 4-digit add and doubling without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - ldp x0, x1, [P1] __LF \ - ldp x4, x5, [P2] __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - ldp x2, x3, [P1+16] __LF \ - ldp x6, x7, [P2+16] __LF \ - adcs x2, x2, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -#define double_4(P0,P1) \ - ldp x0, x1, [P1] __LF \ - adds x0, x0, x0 __LF \ - adcs x1, x1, x1 __LF \ - ldp x2, x3, [P1+16] __LF \ - adcs x2, x2, x2 __LF \ - adc x3, x3, x3 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x3, #19 __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - mov x4, #0x8000000000000000 __LF \ - sbc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular addition with inputs double modulus 2 * p_25519 = 2^256 - 38 -// and in general only guaranteeing a 4-digit result, not even < 2 * p_25519. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -S2N_BN_SYMBOL(edwards25519_pepadd): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov p3, x0 - mov p1, x1 - mov p2, x2 - -// Main sequence - - double_4(t0,z_1); - - sub_4(t1,y_1,x_1); - add_4(t2,y_1,x_1); - - mul_4(t3,w_1,kxy_2); - - mul_4(t1,t1,ymx_2); - mul_4(t2,t2,xpy_2); - - sub_twice4(t4,t0,t3); - add_twice4(t0,t0,t3); - sub_twice4(t5,t2,t1); - add_twice4(t1,t2,t1); - - mul_p25519(z_3,t4,t0); - mul_p25519(x_3,t5,t4); - mul_p25519(y_3,t0,t1); - mul_p25519(w_3,t5,t1); - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_pepadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pepadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pepadd_alt.S deleted file mode 100644 index 8606f000c8f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/curve25519/edwards25519_pepadd_alt.S +++ /dev/null @@ -1,410 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended projective + precomputed mixed addition for edwards25519 -// Inputs p1[16], p2[12]; output p3[16] -// -// extern void edwards25519_pepadd_alt -// (uint64_t p3[static 16],const uint64_t p1[static 16], -// const uint64_t p2[static 12]); -// -// The output p3 and the first input p1 are points (x,y) on edwards25519 -// represented in extended projective quadruples (X,Y,Z,T) where -// x = X / Z, y = Y / Z and x * y = T / Z. The second input p2 is a triple -// encoding its point (x,y) as (y - x,y + x,2 * d * x * y) where d is the -// usual Edwards curve parameter for edwards25519. -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_pepadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_pepadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_pepadd_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define p3 x17 -#define p1 x19 -#define p2 x20 - -// Pointers to input and output coordinates - -#define x_1 p1, #0 -#define y_1 p1, #NUMSIZE -#define z_1 p1, #(2*NUMSIZE) -#define w_1 p1, #(3*NUMSIZE) - -#define ymx_2 p2, #0 -#define xpy_2 p2, #NUMSIZE -#define kxy_2 p2, #(2*NUMSIZE) - -#define x_3 p3, #0 -#define y_3 p3, #NUMSIZE -#define z_3 p3, #(2*NUMSIZE) -#define w_3 p3, #(3*NUMSIZE) - -// Pointer-offset pairs for temporaries on stack - -#define t0 sp, #(0*NUMSIZE) -#define t1 sp, #(1*NUMSIZE) -#define t2 sp, #(2*NUMSIZE) -#define t3 sp, #(3*NUMSIZE) -#define t4 sp, #(4*NUMSIZE) -#define t5 sp, #(5*NUMSIZE) - -// Total size to reserve on the stack - -#define NSPACE 6*NUMSIZE - -// Macro wrapping up the basic field operation bignum_mul_p25519_alt, only -// trivially different from a pure function call to that subroutine. - -#define mul_p25519(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - orr x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - madd x11, x7, x8, x7 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adcs x15, x15, xzr __LF \ - csel x7, x7, xzr, cc __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x15, x15, xzr __LF \ - and x15, x15, #0x7fffffffffffffff __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x15, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x16, x3, x10 __LF \ - adcs x15, x15, x11 __LF \ - adc x16, x16, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x16, x16, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x16, x16, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x26 __LF \ - mul x11, x7, x16 __LF \ - umulh x9, x7, x16 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x15, x15, x11 __LF \ - cset x16, cs __LF \ - adds x15, x15, x4 __LF \ - adc x16, x16, x5 __LF \ - cmn x15, x15 __LF \ - bic x15, x15, #0x8000000000000000 __LF \ - adc x8, x16, x16 __LF \ - mov x7, #0x13 __LF \ - mul x11, x7, x8 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adc x15, x15, xzr __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] - -// Plain 4-digit add and doubling without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - ldp x0, x1, [P1] __LF \ - ldp x4, x5, [P2] __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - ldp x2, x3, [P1+16] __LF \ - ldp x6, x7, [P2+16] __LF \ - adcs x2, x2, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -#define double_4(P0,P1) \ - ldp x0, x1, [P1] __LF \ - adds x0, x0, x0 __LF \ - adcs x1, x1, x1 __LF \ - ldp x2, x3, [P1+16] __LF \ - adcs x2, x2, x2 __LF \ - adc x3, x3, x3 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x3, #19 __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - mov x4, #0x8000000000000000 __LF \ - sbc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #38 __LF \ - csel x3, x4, xzr, lo __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Modular addition with inputs double modulus 2 * p_25519 = 2^256 - 38 -// and in general only guaranteeing a 4-digit result, not even < 2 * p_25519. - -#define add_twice4(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x8 __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2+16] __LF \ - adcs x5, x5, x7 __LF \ - adcs x6, x6, x8 __LF \ - mov x9, #38 __LF \ - csel x9, x9, xzr, cs __LF \ - adds x3, x3, x9 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - adc x6, x6, xzr __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -S2N_BN_SYMBOL(edwards25519_pepadd_alt): - CFI_START - -// Save regs and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov p3, x0 - mov p1, x1 - mov p2, x2 - -// Main sequence - - double_4(t0,z_1); - - sub_4(t1,y_1,x_1); - add_4(t2,y_1,x_1); - - mul_4(t3,w_1,kxy_2); - - mul_4(t1,t1,ymx_2); - mul_4(t2,t2,xpy_2); - - sub_twice4(t4,t0,t3); - add_twice4(t0,t0,t3); - sub_twice4(t5,t2,t1); - add_twice4(t1,t2,t1); - - mul_p25519(z_3,t4,t0); - mul_p25519(x_3,t5,t4); - mul_p25519(y_3,t0,t1); - mul_p25519(w_3,t5,t1); - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_pepadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/Makefile b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/Makefile deleted file mode 100644 index 10f922e94dc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/Makefile +++ /dev/null @@ -1,47 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - -# If actually on an ARM8 machine, just use the GNU assembler (as). Otherwise -# use a cross-assembling version so that the code can still be assembled -# and the proofs checked against the object files (though you won't be able -# to run code without additional emulation infrastructure). The aarch64 -# cross-assembling version can be installed manually by something like: -# -# sudo apt-get install binutils-aarch64-linux-gnu - -UNAME_RESULT=$(shell uname -p) - -ifeq ($(UNAME_RESULT),aarch64) -GAS=as -else -GAS=aarch64-linux-gnu-as -endif - -# List of object files - -OBJ = bignum_emontredc_8n.o \ - bignum_emontredc_8n_cdiff.o \ - bignum_kmul_16_32.o \ - bignum_kmul_32_64.o \ - bignum_ksqr_16_32.o \ - bignum_ksqr_32_64.o \ - bignum_mul_4_8.o \ - bignum_mul_4_8_alt.o \ - bignum_mul_6_12.o \ - bignum_mul_6_12_alt.o \ - bignum_mul_8_16.o \ - bignum_mul_8_16_alt.o \ - bignum_sqr_4_8.o \ - bignum_sqr_4_8_alt.o \ - bignum_sqr_6_12.o \ - bignum_sqr_6_12_alt.o \ - bignum_sqr_8_16.o \ - bignum_sqr_8_16_alt.o \ - -%.o : %.S ; $(CC) -E -I../../include $< | $(GAS) -o $@ - - -default: $(OBJ); - -clean:; rm -f *.o *.correct diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_emontredc_8n.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_emontredc_8n.S index 31ccb822a80..7e245a0d3aa 100644 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_emontredc_8n.S +++ b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_emontredc_8n.S @@ -27,42 +27,42 @@ S2N_BN_SYMBOL(bignum_emontredc_8n): CFI_START - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_PUSH2(x27,x28) - CFI_DEC_SP(32) - lsr x0, x0, #2 - mov x26, x0 - subs x12, x0, #1 - bcc Lbignum_emontredc_8n_end - - stp x3, xzr, [sp] - stp x26, xzr, [sp, #16] - mov x28, xzr - lsl x0, x12, #5 + CFI_PUSH2(x19,x20) + CFI_PUSH2(x21,x22) + CFI_PUSH2(x23,x24) + CFI_PUSH2(x25,x26) + CFI_PUSH2(x27,x28) + CFI_DEC_SP(32) + lsr x0, x0, #2 + mov x26, x0 + subs x12, x0, #1 + bcc Lbignum_emontredc_8n_end + + stp x3, xzr, [sp] + stp x26, xzr, [sp, #16] + mov x28, xzr + lsl x0, x12, #5 Lbignum_emontredc_8n_outerloop: - ldp x3, xzr, [sp] - ldp x17, x19, [x1] - ldp x20, x21, [x1, #16] - ldp x8, x9, [x2] - ldp x10, x11, [x2, #16] - ldr q21, [x2, #16] + ldp x3, xzr, [sp] + ldp x17, x19, [x1] + ldp x20, x21, [x1, #16] + ldp x8, x9, [x2] + ldp x10, x11, [x2, #16] + ldr q21, [x2, #16] - // Montgomery step 0 + // Montgomery step 0 - mul x4, x17, x3 + mul x4, x17, x3 // NEON: Calculate x4 * (x10, x11) that does two 64x64->128-bit multiplications. dup v0.2d, x4 uzp2 v3.4s, v21.4s, v0.4s xtn v4.2s, v0.2d xtn v5.2s, v21.2d - mul x12, x4, x8 - adds x17, x17, x12 - umulh x12, x4, x8 - mul x13, x4, x9 + mul x12, x4, x8 + adds x17, x17, x12 + umulh x12, x4, x8 + mul x13, x4, x9 rev64 v1.4s, v21.4s umull v6.2d, v4.2s, v5.2s umull v7.2d, v4.2s, v3.2s @@ -79,21 +79,21 @@ usra v1.2d, v7.2d, #32 umlal v0.2d, v4.2s, v5.2s mov x14, v0.d[0] mov x15, v0.d[1] - adcs x19, x19, x13 - umulh x13, x4, x9 - adcs x20, x20, x14 + adcs x19, x19, x13 + umulh x13, x4, x9 + adcs x20, x20, x14 usra v1.2d, v2.2d, #32 mov x14, v1.d[0] - adcs x21, x21, x15 + adcs x21, x21, x15 mov x15, v1.d[1] - adc x22, xzr, xzr - adds x19, x19, x12 - mul x5, x19, x3 // hoisted from step 1 - adcs x20, x20, x13 - adcs x21, x21, x14 - adc x22, x22, x15 + adc x22, xzr, xzr + adds x19, x19, x12 + mul x5, x19, x3 // hoisted from step 1 + adcs x20, x20, x13 + adcs x21, x21, x14 + adc x22, x22, x15 - // Montgomery step 1 + // Montgomery step 1 // NEON: Calculate x5 * (x10, x11) that does two 64x64->128-bit multiplications. dup v0.2d, x5 @@ -101,10 +101,10 @@ uzp2 v3.4s, v21.4s, v0.4s xtn v4.2s, v0.2d xtn v5.2s, v21.2d - mul x12, x5, x8 - adds x19, x19, x12 - umulh x12, x5, x8 - mul x13, x5, x9 + mul x12, x5, x8 + adds x19, x19, x12 + umulh x12, x5, x8 + mul x13, x5, x9 rev64 v1.4s, v21.4s umull v6.2d, v4.2s, v5.2s @@ -122,16 +122,16 @@ usra v1.2d, v7.2d, #32 umlal v0.2d, v4.2s, v5.2s mov x14, v0.d[0] mov x15, v0.d[1] - adcs x20, x20, x13 - umulh x13, x5, x9 - adcs x21, x21, x14 + adcs x20, x20, x13 + umulh x13, x5, x9 + adcs x21, x21, x14 usra v1.2d, v2.2d, #32 mov x14, v1.d[0] - adcs x22, x22, x15 + adcs x22, x22, x15 mov x15, v1.d[1] - adc x23, xzr, xzr - adds x20, x20, x12 - mul x6, x20, x3 // hoisted from step 2 + adc x23, xzr, xzr + adds x20, x20, x12 + mul x6, x20, x3 // hoisted from step 2 // NEON: For montgomery step 2, // calculate x6 * (x10, x11) that does two 64x64->128-bit multiplications. @@ -144,11 +144,11 @@ uzp2 v3.4s, in2.4s, in1.4s xtn v4.2s, in1.2d xtn v5.2s, in2.2d - adcs x21, x21, x13 - adcs x22, x22, x14 - adc x23, x23, x15 + adcs x21, x21, x13 + adcs x22, x22, x14 + adc x23, x23, x15 - stp x4, x5, [x1] + stp x4, x5, [x1] // hoisted from maddloop_firstitr ldr q20, [x1] @@ -194,20 +194,20 @@ usra out_hi.2d, v2.2d, #32 #undef out_lo #undef out_hi - adcs x22, x22, x14 - adcs x23, x23, x15 + adcs x22, x22, x14 + adcs x23, x23, x15 mov x14, v1.d[0] mov x15, v1.d[1] - adc x24, xzr, xzr - adds x21, x21, x12 - mul x7, x21, x3 - adcs x22, x22, x13 - adcs x23, x23, x14 - adc x24, x24, x15 + adc x24, xzr, xzr + adds x21, x21, x12 + mul x7, x21, x3 + adcs x22, x22, x13 + adcs x23, x23, x14 + adc x24, x24, x15 - stp x6, x7, [x1, #16] + stp x6, x7, [x1, #16] // hoisted from maddloop_firstitr ldr q21, [x1, #16] @@ -221,18 +221,18 @@ ldr q21, [x1, #16] uzp2 v3.4s, in2.4s, in1.4s xtn v4.2s, in1.2d - // Montgomery step 3 + // Montgomery step 3 - mul x12, x7, x8 - mul x13, x7, x9 + mul x12, x7, x8 + mul x13, x7, x9 xtn v5.2s, in2.2d rev64 v1.4s, in2.4s umull v6.2d, v4.2s, v5.2s umull v7.2d, v4.2s, v3.2s - mul x14, x7, x10 - mul x15, x7, x11 + mul x14, x7, x10 + mul x15, x7, x11 uzp2 v16.4s, in1.4s, in1.4s mul v0.4s, v1.4s, in1.4s @@ -243,10 +243,10 @@ uaddlp v0.2d, v0.4s and v2.16b, v7.16b, v2.16b umlal v2.2d, v16.2s, v5.2s - adds x21, x21, x12 - umulh x12, x7, x8 - adcs x22, x22, x13 - umulh x13, x7, x9 + adds x21, x21, x12 + umulh x12, x7, x8 + adcs x22, x22, x13 + umulh x13, x7, x9 shl out_lo.2d, v0.2d, #32 usra out_hi.2d, v7.2d, #32 @@ -257,10 +257,10 @@ usra out_hi.2d, v2.2d, #32 #undef out_lo #undef out_hi - adcs x23, x23, x14 - umulh x14, x7, x10 - adcs x24, x24, x15 - umulh x15, x7, x11 + adcs x23, x23, x14 + umulh x14, x7, x10 + adcs x24, x24, x15 + umulh x15, x7, x11 // v27++v26 = hi and lo of (x6 * x10, x7 * x11) #define in1 v21 @@ -273,19 +273,19 @@ xtn v5.2s, in2.2d rev64 v1.4s, in2.4s // hoisted from maddloop_firstitr and maddloop_x0one - ldp x8, x9, [x2, #32] - ldp x10, x11, [x2, #48] + ldp x8, x9, [x2, #32] + ldp x10, x11, [x2, #48] umull v6.2d, v4.2s, v5.2s umull v7.2d, v4.2s, v3.2s uzp2 v16.4s, in1.4s, in1.4s mul v0.4s, v1.4s, in1.4s - adc x25, xzr, xzr - adds x12, x22, x12 - adcs x13, x23, x13 - adcs x14, x24, x14 - adc x15, x25, x15 + adc x25, xzr, xzr + adds x12, x22, x12 + adcs x13, x23, x13 + adcs x14, x24, x14 + adc x15, x25, x15 movi v2.2d, #0x000000ffffffff usra v7.2d, v6.2d, #32 @@ -302,153 +302,153 @@ usra out_hi.2d, v2.2d, #32 #undef out_lo #undef out_hi - cbz x0, Lbignum_emontredc_8n_madddone - mov x27, x0 - cmp x0, #32 - bne Lbignum_emontredc_8n_maddloop_firstitr + cbz x0, Lbignum_emontredc_8n_madddone + mov x27, x0 + cmp x0, #32 + bne Lbignum_emontredc_8n_maddloop_firstitr Lbignum_emontredc_8n_maddloop_x0one: - add x2, x2, #0x20 - add x1, x1, #0x20 - mul x17, x4, x8 - mul x22, x5, x9 - mul x23, x6, x10 - mul x24, x7, x11 - umulh x16, x4, x8 - adds x22, x22, x16 - umulh x16, x5, x9 - adcs x23, x23, x16 - umulh x16, x6, x10 - adcs x24, x24, x16 - umulh x16, x7, x11 - adc x25, x16, xzr - ldp x20, x21, [x1] - adds x12, x12, x20 - adcs x13, x13, x21 - ldp x20, x21, [x1, #16] - adcs x14, x14, x20 - adcs x15, x15, x21 - adc x16, xzr, xzr - adds x19, x22, x17 - adcs x22, x23, x22 - adcs x23, x24, x23 - adcs x24, x25, x24 - adc x25, xzr, x25 - adds x20, x22, x17 - adcs x21, x23, x19 - adcs x22, x24, x22 - adcs x23, x25, x23 - adcs x24, xzr, x24 - adc x25, xzr, x25 - adds x17, x17, x12 - adcs x19, x19, x13 - adcs x20, x20, x14 - adcs x21, x21, x15 - adcs x22, x22, x16 - adcs x23, x23, xzr - adcs x24, x24, xzr - adc x25, x25, xzr - subs x15, x6, x7 - cneg x15, x15, cc // cc = lo, ul, last - csetm x12, cc // cc = lo, ul, last - subs x13, x11, x10 - cneg x13, x13, cc // cc = lo, ul, last - mul x14, x15, x13 - umulh x13, x15, x13 - cinv x12, x12, cc // cc = lo, ul, last - cmn x12, #0x1 - eor x14, x14, x12 - adcs x23, x23, x14 - eor x13, x13, x12 - adcs x24, x24, x13 - adc x25, x25, x12 - subs x15, x4, x5 - cneg x15, x15, cc // cc = lo, ul, last - csetm x12, cc // cc = lo, ul, last - subs x13, x9, x8 - cneg x13, x13, cc // cc = lo, ul, last - mul x14, x15, x13 - umulh x13, x15, x13 - cinv x12, x12, cc // cc = lo, ul, last - cmn x12, #0x1 - eor x14, x14, x12 - adcs x19, x19, x14 - eor x13, x13, x12 - adcs x20, x20, x13 - adcs x21, x21, x12 - adcs x22, x22, x12 - adcs x23, x23, x12 - adcs x24, x24, x12 - adc x25, x25, x12 - subs x15, x5, x7 - cneg x15, x15, cc // cc = lo, ul, last - csetm x12, cc // cc = lo, ul, last - subs x13, x11, x9 - cneg x13, x13, cc // cc = lo, ul, last - mul x14, x15, x13 - umulh x13, x15, x13 - cinv x12, x12, cc // cc = lo, ul, last - cmn x12, #0x1 - eor x14, x14, x12 - adcs x22, x22, x14 - eor x13, x13, x12 - adcs x23, x23, x13 - adcs x24, x24, x12 - adc x25, x25, x12 - subs x15, x4, x6 - cneg x15, x15, cc // cc = lo, ul, last - csetm x12, cc // cc = lo, ul, last - subs x13, x10, x8 - cneg x13, x13, cc // cc = lo, ul, last - mul x14, x15, x13 - umulh x13, x15, x13 - cinv x12, x12, cc // cc = lo, ul, last - cmn x12, #0x1 - eor x14, x14, x12 - adcs x20, x20, x14 - eor x13, x13, x12 - adcs x21, x21, x13 - adcs x22, x22, x12 - adcs x23, x23, x12 - adcs x24, x24, x12 - adc x25, x25, x12 - subs x15, x4, x7 - cneg x15, x15, cc // cc = lo, ul, last - csetm x12, cc // cc = lo, ul, last - subs x13, x11, x8 - cneg x13, x13, cc // cc = lo, ul, last - mul x14, x15, x13 - umulh x13, x15, x13 - cinv x12, x12, cc // cc = lo, ul, last - cmn x12, #0x1 - eor x14, x14, x12 - adcs x21, x21, x14 - eor x13, x13, x12 - adcs x22, x22, x13 - adcs x23, x23, x12 - adcs x24, x24, x12 - adc x25, x25, x12 - subs x15, x5, x6 - cneg x15, x15, cc // cc = lo, ul, last - csetm x12, cc // cc = lo, ul, last - subs x13, x10, x9 - cneg x13, x13, cc // cc = lo, ul, last - mul x14, x15, x13 - umulh x13, x15, x13 - cinv x12, x12, cc // cc = lo, ul, last - cmn x12, #0x1 - eor x14, x14, x12 - adcs x21, x21, x14 - eor x13, x13, x12 - adcs x22, x22, x13 - adcs x13, x23, x12 - adcs x14, x24, x12 - adc x15, x25, x12 - mov x12, x22 - stp x17, x19, [x1] - stp x20, x21, [x1, #16] - sub x27, x27, #0x20 - b Lbignum_emontredc_8n_madddone + add x2, x2, #0x20 + add x1, x1, #0x20 + mul x17, x4, x8 + mul x22, x5, x9 + mul x23, x6, x10 + mul x24, x7, x11 + umulh x16, x4, x8 + adds x22, x22, x16 + umulh x16, x5, x9 + adcs x23, x23, x16 + umulh x16, x6, x10 + adcs x24, x24, x16 + umulh x16, x7, x11 + adc x25, x16, xzr + ldp x20, x21, [x1] + adds x12, x12, x20 + adcs x13, x13, x21 + ldp x20, x21, [x1, #16] + adcs x14, x14, x20 + adcs x15, x15, x21 + adc x16, xzr, xzr + adds x19, x22, x17 + adcs x22, x23, x22 + adcs x23, x24, x23 + adcs x24, x25, x24 + adc x25, xzr, x25 + adds x20, x22, x17 + adcs x21, x23, x19 + adcs x22, x24, x22 + adcs x23, x25, x23 + adcs x24, xzr, x24 + adc x25, xzr, x25 + adds x17, x17, x12 + adcs x19, x19, x13 + adcs x20, x20, x14 + adcs x21, x21, x15 + adcs x22, x22, x16 + adcs x23, x23, xzr + adcs x24, x24, xzr + adc x25, x25, xzr + subs x15, x6, x7 + cneg x15, x15, cc // cc = lo, ul, last + csetm x12, cc // cc = lo, ul, last + subs x13, x11, x10 + cneg x13, x13, cc // cc = lo, ul, last + mul x14, x15, x13 + umulh x13, x15, x13 + cinv x12, x12, cc // cc = lo, ul, last + cmn x12, #0x1 + eor x14, x14, x12 + adcs x23, x23, x14 + eor x13, x13, x12 + adcs x24, x24, x13 + adc x25, x25, x12 + subs x15, x4, x5 + cneg x15, x15, cc // cc = lo, ul, last + csetm x12, cc // cc = lo, ul, last + subs x13, x9, x8 + cneg x13, x13, cc // cc = lo, ul, last + mul x14, x15, x13 + umulh x13, x15, x13 + cinv x12, x12, cc // cc = lo, ul, last + cmn x12, #0x1 + eor x14, x14, x12 + adcs x19, x19, x14 + eor x13, x13, x12 + adcs x20, x20, x13 + adcs x21, x21, x12 + adcs x22, x22, x12 + adcs x23, x23, x12 + adcs x24, x24, x12 + adc x25, x25, x12 + subs x15, x5, x7 + cneg x15, x15, cc // cc = lo, ul, last + csetm x12, cc // cc = lo, ul, last + subs x13, x11, x9 + cneg x13, x13, cc // cc = lo, ul, last + mul x14, x15, x13 + umulh x13, x15, x13 + cinv x12, x12, cc // cc = lo, ul, last + cmn x12, #0x1 + eor x14, x14, x12 + adcs x22, x22, x14 + eor x13, x13, x12 + adcs x23, x23, x13 + adcs x24, x24, x12 + adc x25, x25, x12 + subs x15, x4, x6 + cneg x15, x15, cc // cc = lo, ul, last + csetm x12, cc // cc = lo, ul, last + subs x13, x10, x8 + cneg x13, x13, cc // cc = lo, ul, last + mul x14, x15, x13 + umulh x13, x15, x13 + cinv x12, x12, cc // cc = lo, ul, last + cmn x12, #0x1 + eor x14, x14, x12 + adcs x20, x20, x14 + eor x13, x13, x12 + adcs x21, x21, x13 + adcs x22, x22, x12 + adcs x23, x23, x12 + adcs x24, x24, x12 + adc x25, x25, x12 + subs x15, x4, x7 + cneg x15, x15, cc // cc = lo, ul, last + csetm x12, cc // cc = lo, ul, last + subs x13, x11, x8 + cneg x13, x13, cc // cc = lo, ul, last + mul x14, x15, x13 + umulh x13, x15, x13 + cinv x12, x12, cc // cc = lo, ul, last + cmn x12, #0x1 + eor x14, x14, x12 + adcs x21, x21, x14 + eor x13, x13, x12 + adcs x22, x22, x13 + adcs x23, x23, x12 + adcs x24, x24, x12 + adc x25, x25, x12 + subs x15, x5, x6 + cneg x15, x15, cc // cc = lo, ul, last + csetm x12, cc // cc = lo, ul, last + subs x13, x10, x9 + cneg x13, x13, cc // cc = lo, ul, last + mul x14, x15, x13 + umulh x13, x15, x13 + cinv x12, x12, cc // cc = lo, ul, last + cmn x12, #0x1 + eor x14, x14, x12 + adcs x21, x21, x14 + eor x13, x13, x12 + adcs x22, x22, x13 + adcs x13, x23, x12 + adcs x14, x24, x12 + adc x15, x25, x12 + mov x12, x22 + stp x17, x19, [x1] + stp x20, x21, [x1, #16] + sub x27, x27, #0x20 + b Lbignum_emontredc_8n_madddone Lbignum_emontredc_8n_maddloop_firstitr: @@ -465,18 +465,18 @@ mov x24, v26.d[1] //mul x24, x7, x11 mov x3, v27.d[1] //umulh x3,x7,x11 mov x17, v24.d[0] //mul x17, x4, x8 - adds x22,x22,x16 - adcs x23,x23,x20 - adcs x24,x24,x21 - adc x25,x3,xzr + adds x22,x22,x16 + adcs x23,x23,x20 + adcs x24,x24,x21 + adc x25,x3,xzr // pre-calculate the multiplications for the next iter. // v25 ++ v24 = hi, lo of (x4 * x8, x5 * x9) ldr q22, [x2, #64] ldr q23, [x2, #80] - add x2, x2, #32 - add x1, x1, #32 + add x2, x2, #32 + add x1, x1, #32 #define in1 v20 #define in2 v22 @@ -487,40 +487,40 @@ xtn v4.2s, in1.2d xtn v5.2s, in2.2d rev64 v1.4s, in2.4s - ldp x20,x21,[x1] - adds x12,x12,x20 - adcs x13,x13,x21 - ldp x20,x21,[x1,#16] + ldp x20,x21,[x1] + adds x12,x12,x20 + adcs x13,x13,x21 + ldp x20,x21,[x1,#16] umull v6.2d, v4.2s, v5.2s umull v7.2d, v4.2s, v3.2s uzp2 v16.4s, in1.4s, in1.4s mul v0.4s, v1.4s, in1.4s - adcs x14,x14,x20 - adcs x15,x15,x21 - adc x16,xzr,xzr - adds x19,x22,x17 + adcs x14,x14,x20 + adcs x15,x15,x21 + adc x16,xzr,xzr + adds x19,x22,x17 movi v2.2d, #0x000000ffffffff usra v7.2d, v6.2d, #32 umull out_hi.2d, v16.2s, v3.2s uaddlp v0.2d, v0.4s - adcs x22,x23,x22 - adcs x23,x24,x23 - adcs x24,x25,x24 - adc x25,xzr,x25 + adcs x22,x23,x22 + adcs x23,x24,x23 + adcs x24,x25,x24 + adc x25,xzr,x25 and v2.16b, v7.16b, v2.16b umlal v2.2d, v16.2s, v5.2s shl out_lo.2d, v0.2d, #32 usra out_hi.2d, v7.2d, #32 - adds x20,x22,x17 - adcs x21,x23,x19 - adcs x22,x24,x22 - adcs x23,x25,x23 + adds x20,x22,x17 + adcs x21,x23,x19 + adcs x22,x24,x22 + adcs x23,x25,x23 umlal out_lo.2d, v4.2s, v5.2s usra out_hi.2d, v2.2d, #32 @@ -529,10 +529,10 @@ usra out_hi.2d, v2.2d, #32 #undef out_lo #undef out_hi - adcs x24,xzr,x24 - adc x25,xzr,x25 - adds x17,x17,x12 - adcs x19,x19,x13 + adcs x24,xzr,x24 + adc x25,xzr,x25 + adds x17,x17,x12 + adcs x19,x19,x13 #define in1 v21 #define in2 v23 @@ -543,40 +543,40 @@ xtn v4.2s, in1.2d xtn v5.2s, in2.2d rev64 v1.4s, in2.4s - adcs x20,x20,x14 - adcs x21,x21,x15 - adcs x22,x22,x16 - adcs x23,x23,xzr + adcs x20,x20,x14 + adcs x21,x21,x15 + adcs x22,x22,x16 + adcs x23,x23,xzr umull v6.2d, v4.2s, v5.2s umull v7.2d, v4.2s, v3.2s uzp2 v16.4s, in1.4s, in1.4s mul v0.4s, v1.4s, in1.4s - adcs x24,x24,xzr - adc x25,x25,xzr - subs x15,x6,x7 - cneg x15,x15,cc + adcs x24,x24,xzr + adc x25,x25,xzr + subs x15,x6,x7 + cneg x15,x15,cc movi v2.2d, #0x000000ffffffff usra v7.2d, v6.2d, #32 umull out_hi.2d, v16.2s, v3.2s uaddlp v0.2d, v0.4s - csetm x12,cc - subs x13,x11,x10 - cneg x13,x13,cc - mul x14,x15,x13 + csetm x12,cc + subs x13,x11,x10 + cneg x13,x13,cc + mul x14,x15,x13 and v2.16b, v7.16b, v2.16b umlal v2.2d, v16.2s, v5.2s shl out_lo.2d, v0.2d, #32 usra out_hi.2d, v7.2d, #32 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 umlal out_lo.2d, v4.2s, v5.2s usra out_hi.2d, v2.2d, #32 @@ -585,130 +585,130 @@ usra out_hi.2d, v2.2d, #32 #undef out_lo #undef out_hi - adcs x23,x23,x14 - eor x13,x13,x12 - adcs x24,x24,x13 - adc x25,x25,x12 - subs x15,x4,x5 - cneg x15,x15,cc - csetm x12,cc - subs x13,x9,x8 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x19,x19,x14 - eor x13,x13,x12 - adcs x20,x20,x13 - adcs x21,x21,x12 - adcs x22,x22,x12 - adcs x23,x23,x12 - adcs x24,x24,x12 - adc x25,x25,x12 - - stp x17,x19,[x1] + adcs x23,x23,x14 + eor x13,x13,x12 + adcs x24,x24,x13 + adc x25,x25,x12 + subs x15,x4,x5 + cneg x15,x15,cc + csetm x12,cc + subs x13,x9,x8 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x19,x19,x14 + eor x13,x13,x12 + adcs x20,x20,x13 + adcs x21,x21,x12 + adcs x22,x22,x12 + adcs x23,x23,x12 + adcs x24,x24,x12 + adc x25,x25,x12 + + stp x17,x19,[x1] mov x16, v25.d[0] // hi bits of (x4 * x8) mov x26, v27.d[0] // hi bits of (x6 * x10) mov x3, v25.d[1] // hi bits of (x5 * x9) mov x17, v27.d[1] // hi bits of (x6 * x10) - subs x15,x5,x7 - cneg x15,x15,cc - csetm x12,cc - subs x13,x11,x9 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x22,x22,x14 - eor x13,x13,x12 - adcs x23,x23,x13 - adcs x24,x24,x12 - adc x25,x25,x12 - subs x15,x4,x6 - cneg x15,x15,cc - csetm x12,cc - subs x13,x10,x8 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x20,x20,x14 - eor x13,x13,x12 - adcs x21,x21,x13 - adcs x22,x22,x12 - adcs x23,x23,x12 - adcs x24,x24,x12 - adc x25,x25,x12 - subs x15,x4,x7 - cneg x15,x15,cc - csetm x12,cc - subs x13,x11,x8 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x21,x21,x14 - eor x13,x13,x12 - adcs x22,x22,x13 - adcs x23,x23,x12 - adcs x24,x24,x12 - adc x25,x25,x12 - subs x15,x5,x6 - cneg x15,x15,cc - csetm x12,cc - subs x13,x10,x9 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x21,x21,x14 - - stp x20,x21,[x1,#16] + subs x15,x5,x7 + cneg x15,x15,cc + csetm x12,cc + subs x13,x11,x9 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x22,x22,x14 + eor x13,x13,x12 + adcs x23,x23,x13 + adcs x24,x24,x12 + adc x25,x25,x12 + subs x15,x4,x6 + cneg x15,x15,cc + csetm x12,cc + subs x13,x10,x8 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x20,x20,x14 + eor x13,x13,x12 + adcs x21,x21,x13 + adcs x22,x22,x12 + adcs x23,x23,x12 + adcs x24,x24,x12 + adc x25,x25,x12 + subs x15,x4,x7 + cneg x15,x15,cc + csetm x12,cc + subs x13,x11,x8 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x21,x21,x14 + eor x13,x13,x12 + adcs x22,x22,x13 + adcs x23,x23,x12 + adcs x24,x24,x12 + adc x25,x25,x12 + subs x15,x5,x6 + cneg x15,x15,cc + csetm x12,cc + subs x13,x10,x9 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x21,x21,x14 + + stp x20,x21,[x1,#16] mov x20, v24.d[1] // lo bits of (x5 * x9) mov x21, v26.d[0] // lo bits of (x6 * x10) - eor x13,x13,x12 - adcs x22,x22,x13 - adcs x13,x23,x12 - adcs x14,x24,x12 - adc x15,x25,x12 - mov x12,x22 + eor x13,x13,x12 + adcs x22,x22,x13 + adcs x13,x23,x12 + adcs x14,x24,x12 + adc x15,x25,x12 + mov x12,x22 mov x24, v26.d[1] // lo bits of (x7 * x11) - sub x27, x27, #32 - cmp x27, #32 - beq Lbignum_emontredc_8n_maddloop_last + sub x27, x27, #32 + cmp x27, #32 + beq Lbignum_emontredc_8n_maddloop_last Lbignum_emontredc_8n_maddloop: - ldp x8, x9, [x2, #32] - ldp x10, x11, [x2, #48] + ldp x8, x9, [x2, #32] + ldp x10, x11, [x2, #48] // pre-calculate the multiplications for the next iter. // v25 ++ v24 = hi, lo of (x4 * x8, x5 * x9) ldr q22, [x2, #64] ldr q23, [x2, #80] - add x2, x2, #32 - add x1, x1, #32 + add x2, x2, #32 + add x1, x1, #32 - adds x22,x20,x16 - adcs x23,x21,x3 - adcs x24,x24,x26 - adc x25,x17,xzr + adds x22,x20,x16 + adcs x23,x21,x3 + adcs x24,x24,x26 + adc x25,x17,xzr mov x17, v24.d[0] // lo bits of (x4 * x8) #define in1 v20 @@ -720,40 +720,40 @@ xtn v4.2s, in1.2d xtn v5.2s, in2.2d rev64 v1.4s, in2.4s - ldp x20,x21,[x1] - adds x12,x12,x20 - adcs x13,x13,x21 - ldp x20,x21,[x1,#16] + ldp x20,x21,[x1] + adds x12,x12,x20 + adcs x13,x13,x21 + ldp x20,x21,[x1,#16] umull v6.2d, v4.2s, v5.2s umull v7.2d, v4.2s, v3.2s uzp2 v16.4s, in1.4s, in1.4s mul v0.4s, v1.4s, in1.4s - adcs x14,x14,x20 - adcs x15,x15,x21 - adc x16,xzr,xzr - adds x19,x22,x17 + adcs x14,x14,x20 + adcs x15,x15,x21 + adc x16,xzr,xzr + adds x19,x22,x17 movi v2.2d, #0x000000ffffffff usra v7.2d, v6.2d, #32 umull out_hi.2d, v16.2s, v3.2s uaddlp v0.2d, v0.4s - adcs x22,x23,x22 - adcs x23,x24,x23 - adcs x24,x25,x24 - adc x25,xzr,x25 + adcs x22,x23,x22 + adcs x23,x24,x23 + adcs x24,x25,x24 + adc x25,xzr,x25 and v2.16b, v7.16b, v2.16b umlal v2.2d, v16.2s, v5.2s shl out_lo.2d, v0.2d, #32 usra out_hi.2d, v7.2d, #32 - adds x20,x22,x17 - adcs x21,x23,x19 - adcs x22,x24,x22 - adcs x23,x25,x23 + adds x20,x22,x17 + adcs x21,x23,x19 + adcs x22,x24,x22 + adcs x23,x25,x23 umlal out_lo.2d, v4.2s, v5.2s usra out_hi.2d, v2.2d, #32 @@ -762,10 +762,10 @@ usra out_hi.2d, v2.2d, #32 #undef out_lo #undef out_hi - adcs x24,xzr,x24 - adc x25,xzr,x25 - adds x17,x17,x12 - adcs x19,x19,x13 + adcs x24,xzr,x24 + adc x25,xzr,x25 + adds x17,x17,x12 + adcs x19,x19,x13 #define in1 v21 #define in2 v23 @@ -776,40 +776,40 @@ xtn v4.2s, in1.2d xtn v5.2s, in2.2d rev64 v1.4s, in2.4s - adcs x20,x20,x14 - adcs x21,x21,x15 - adcs x22,x22,x16 - adcs x23,x23,xzr + adcs x20,x20,x14 + adcs x21,x21,x15 + adcs x22,x22,x16 + adcs x23,x23,xzr umull v6.2d, v4.2s, v5.2s umull v7.2d, v4.2s, v3.2s uzp2 v16.4s, in1.4s, in1.4s mul v0.4s, v1.4s, in1.4s - adcs x24,x24,xzr - adc x25,x25,xzr - subs x15,x6,x7 - cneg x15,x15,cc + adcs x24,x24,xzr + adc x25,x25,xzr + subs x15,x6,x7 + cneg x15,x15,cc movi v2.2d, #0x000000ffffffff usra v7.2d, v6.2d, #32 umull out_hi.2d, v16.2s, v3.2s uaddlp v0.2d, v0.4s - csetm x12,cc - subs x13,x11,x10 - cneg x13,x13,cc - mul x14,x15,x13 + csetm x12,cc + subs x13,x11,x10 + cneg x13,x13,cc + mul x14,x15,x13 and v2.16b, v7.16b, v2.16b umlal v2.2d, v16.2s, v5.2s shl out_lo.2d, v0.2d, #32 usra out_hi.2d, v7.2d, #32 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 umlal out_lo.2d, v4.2s, v5.2s usra out_hi.2d, v2.2d, #32 @@ -818,283 +818,283 @@ usra out_hi.2d, v2.2d, #32 #undef out_lo #undef out_hi - adcs x23,x23,x14 - eor x13,x13,x12 - adcs x24,x24,x13 - adc x25,x25,x12 - subs x15,x4,x5 - cneg x15,x15,cc - csetm x12,cc - subs x13,x9,x8 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x19,x19,x14 - eor x13,x13,x12 - adcs x20,x20,x13 - adcs x21,x21,x12 - adcs x22,x22,x12 - adcs x23,x23,x12 - adcs x24,x24,x12 - adc x25,x25,x12 - - stp x17,x19,[x1] + adcs x23,x23,x14 + eor x13,x13,x12 + adcs x24,x24,x13 + adc x25,x25,x12 + subs x15,x4,x5 + cneg x15,x15,cc + csetm x12,cc + subs x13,x9,x8 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x19,x19,x14 + eor x13,x13,x12 + adcs x20,x20,x13 + adcs x21,x21,x12 + adcs x22,x22,x12 + adcs x23,x23,x12 + adcs x24,x24,x12 + adc x25,x25,x12 + + stp x17,x19,[x1] mov x16, v25.d[0] // hi bits of (x4 * x8) mov x26, v27.d[0] // hi bits of (x6 * x10) mov x3, v25.d[1] // hi bits of (x5 * x9) mov x17, v27.d[1] // hi bits of (x6 * x10) - subs x15,x5,x7 - cneg x15,x15,cc - csetm x12,cc - subs x13,x11,x9 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x22,x22,x14 - eor x13,x13,x12 - adcs x23,x23,x13 - adcs x24,x24,x12 - adc x25,x25,x12 - subs x15,x4,x6 - cneg x15,x15,cc - csetm x12,cc - subs x13,x10,x8 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x20,x20,x14 - eor x13,x13,x12 - adcs x21,x21,x13 - adcs x22,x22,x12 - adcs x23,x23,x12 - adcs x24,x24,x12 - adc x25,x25,x12 - subs x15,x4,x7 - cneg x15,x15,cc - csetm x12,cc - subs x13,x11,x8 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x21,x21,x14 - eor x13,x13,x12 - adcs x22,x22,x13 - adcs x23,x23,x12 - adcs x24,x24,x12 - adc x25,x25,x12 - subs x15,x5,x6 - cneg x15,x15,cc - csetm x12,cc - subs x13,x10,x9 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x21,x21,x14 - - stp x20,x21,[x1,#16] + subs x15,x5,x7 + cneg x15,x15,cc + csetm x12,cc + subs x13,x11,x9 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x22,x22,x14 + eor x13,x13,x12 + adcs x23,x23,x13 + adcs x24,x24,x12 + adc x25,x25,x12 + subs x15,x4,x6 + cneg x15,x15,cc + csetm x12,cc + subs x13,x10,x8 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x20,x20,x14 + eor x13,x13,x12 + adcs x21,x21,x13 + adcs x22,x22,x12 + adcs x23,x23,x12 + adcs x24,x24,x12 + adc x25,x25,x12 + subs x15,x4,x7 + cneg x15,x15,cc + csetm x12,cc + subs x13,x11,x8 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x21,x21,x14 + eor x13,x13,x12 + adcs x22,x22,x13 + adcs x23,x23,x12 + adcs x24,x24,x12 + adc x25,x25,x12 + subs x15,x5,x6 + cneg x15,x15,cc + csetm x12,cc + subs x13,x10,x9 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x21,x21,x14 + + stp x20,x21,[x1,#16] mov x20, v24.d[1] // lo bits of (x5 * x9) mov x21, v26.d[0] // lo bits of (x6 * x10) - eor x13,x13,x12 - adcs x22,x22,x13 - adcs x13,x23,x12 - adcs x14,x24,x12 - adc x15,x25,x12 - mov x12,x22 + eor x13,x13,x12 + adcs x22,x22,x13 + adcs x13,x23,x12 + adcs x14,x24,x12 + adc x15,x25,x12 + mov x12,x22 mov x24, v26.d[1] // lo bits of (x7 * x11) - sub x27, x27, #32 - cmp x27, #32 - bne Lbignum_emontredc_8n_maddloop + sub x27, x27, #32 + cmp x27, #32 + bne Lbignum_emontredc_8n_maddloop Lbignum_emontredc_8n_maddloop_last: - ldp x8, x9, [x2, #32] - ldp x10, x11, [x2, #48] + ldp x8, x9, [x2, #32] + ldp x10, x11, [x2, #48] - add x2, x2, #32 - add x1, x1, #32 + add x2, x2, #32 + add x1, x1, #32 - adds x22,x20,x16 - adcs x23,x21,x3 - adcs x24,x24,x26 - adc x25,x17,xzr + adds x22,x20,x16 + adcs x23,x21,x3 + adcs x24,x24,x26 + adc x25,x17,xzr mov x17, v24.d[0] // lo bits of (x4 * x8) - ldp x20,x21,[x1] - adds x12,x12,x20 - adcs x13,x13,x21 - ldp x20,x21,[x1,#16] - adcs x14,x14,x20 - adcs x15,x15,x21 - adc x16,xzr,xzr - adds x19,x22,x17 - adcs x22,x23,x22 - adcs x23,x24,x23 - adcs x24,x25,x24 - adc x25,xzr,x25 - adds x20,x22,x17 - adcs x21,x23,x19 - adcs x22,x24,x22 - adcs x23,x25,x23 - adcs x24,xzr,x24 - adc x25,xzr,x25 - adds x17,x17,x12 - adcs x19,x19,x13 - adcs x20,x20,x14 - adcs x21,x21,x15 - adcs x22,x22,x16 - adcs x23,x23,xzr - adcs x24,x24,xzr - adc x25,x25,xzr - subs x15,x6,x7 - cneg x15,x15,cc - csetm x12,cc - subs x13,x11,x10 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x23,x23,x14 - eor x13,x13,x12 - adcs x24,x24,x13 - adc x25,x25,x12 - subs x15,x4,x5 - cneg x15,x15,cc - csetm x12,cc - subs x13,x9,x8 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x19,x19,x14 - eor x13,x13,x12 - adcs x20,x20,x13 - adcs x21,x21,x12 - adcs x22,x22,x12 - adcs x23,x23,x12 - adcs x24,x24,x12 - adc x25,x25,x12 - subs x15,x5,x7 - cneg x15,x15,cc - csetm x12,cc - subs x13,x11,x9 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x22,x22,x14 - eor x13,x13,x12 - adcs x23,x23,x13 - adcs x24,x24,x12 - adc x25,x25,x12 - subs x15,x4,x6 - cneg x15,x15,cc - csetm x12,cc - subs x13,x10,x8 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x20,x20,x14 - eor x13,x13,x12 - adcs x21,x21,x13 - adcs x22,x22,x12 - adcs x23,x23,x12 - adcs x24,x24,x12 - adc x25,x25,x12 - subs x15,x4,x7 - cneg x15,x15,cc - csetm x12,cc - subs x13,x11,x8 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x21,x21,x14 - eor x13,x13,x12 - adcs x22,x22,x13 - adcs x23,x23,x12 - adcs x24,x24,x12 - adc x25,x25,x12 - subs x15,x5,x6 - cneg x15,x15,cc - csetm x12,cc - subs x13,x10,x9 - cneg x13,x13,cc - mul x14,x15,x13 - umulh x13,x15,x13 - cinv x12,x12,cc - adds xzr,x12,#1 - eor x14,x14,x12 - adcs x21,x21,x14 - eor x13,x13,x12 - adcs x22,x22,x13 - adcs x13,x23,x12 - adcs x14,x24,x12 - adc x15,x25,x12 - mov x12,x22 - stp x17,x19,[x1] - stp x20,x21,[x1,#16] - subs x27, x27, #64 + ldp x20,x21,[x1] + adds x12,x12,x20 + adcs x13,x13,x21 + ldp x20,x21,[x1,#16] + adcs x14,x14,x20 + adcs x15,x15,x21 + adc x16,xzr,xzr + adds x19,x22,x17 + adcs x22,x23,x22 + adcs x23,x24,x23 + adcs x24,x25,x24 + adc x25,xzr,x25 + adds x20,x22,x17 + adcs x21,x23,x19 + adcs x22,x24,x22 + adcs x23,x25,x23 + adcs x24,xzr,x24 + adc x25,xzr,x25 + adds x17,x17,x12 + adcs x19,x19,x13 + adcs x20,x20,x14 + adcs x21,x21,x15 + adcs x22,x22,x16 + adcs x23,x23,xzr + adcs x24,x24,xzr + adc x25,x25,xzr + subs x15,x6,x7 + cneg x15,x15,cc + csetm x12,cc + subs x13,x11,x10 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x23,x23,x14 + eor x13,x13,x12 + adcs x24,x24,x13 + adc x25,x25,x12 + subs x15,x4,x5 + cneg x15,x15,cc + csetm x12,cc + subs x13,x9,x8 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x19,x19,x14 + eor x13,x13,x12 + adcs x20,x20,x13 + adcs x21,x21,x12 + adcs x22,x22,x12 + adcs x23,x23,x12 + adcs x24,x24,x12 + adc x25,x25,x12 + subs x15,x5,x7 + cneg x15,x15,cc + csetm x12,cc + subs x13,x11,x9 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x22,x22,x14 + eor x13,x13,x12 + adcs x23,x23,x13 + adcs x24,x24,x12 + adc x25,x25,x12 + subs x15,x4,x6 + cneg x15,x15,cc + csetm x12,cc + subs x13,x10,x8 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x20,x20,x14 + eor x13,x13,x12 + adcs x21,x21,x13 + adcs x22,x22,x12 + adcs x23,x23,x12 + adcs x24,x24,x12 + adc x25,x25,x12 + subs x15,x4,x7 + cneg x15,x15,cc + csetm x12,cc + subs x13,x11,x8 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x21,x21,x14 + eor x13,x13,x12 + adcs x22,x22,x13 + adcs x23,x23,x12 + adcs x24,x24,x12 + adc x25,x25,x12 + subs x15,x5,x6 + cneg x15,x15,cc + csetm x12,cc + subs x13,x10,x9 + cneg x13,x13,cc + mul x14,x15,x13 + umulh x13,x15,x13 + cinv x12,x12,cc + adds xzr,x12,#1 + eor x14,x14,x12 + adcs x21,x21,x14 + eor x13,x13,x12 + adcs x22,x22,x13 + adcs x13,x23,x12 + adcs x14,x24,x12 + adc x15,x25,x12 + mov x12,x22 + stp x17,x19,[x1] + stp x20,x21,[x1,#16] + subs x27, x27, #64 Lbignum_emontredc_8n_madddone: - ldp x17, x19, [x1, #32] - ldp x20, x21, [x1, #48] - ldp x26, xzr, [sp, #16] - adds xzr, x28, x28 - adcs x17, x17, x12 - adcs x19, x19, x13 - adcs x20, x20, x14 - adcs x21, x21, x15 - csetm x28, cs - stp x17, x19, [x1, #32] - stp x20, x21, [x1, #48] - sub x1, x1, x0 - sub x2, x2, x0 - add x1, x1, #32 - subs x26, x26, #1 - stp x26, xzr, [sp, #16] - bne Lbignum_emontredc_8n_outerloop - neg x0, x28 + ldp x17, x19, [x1, #32] + ldp x20, x21, [x1, #48] + ldp x26, xzr, [sp, #16] + adds xzr, x28, x28 + adcs x17, x17, x12 + adcs x19, x19, x13 + adcs x20, x20, x14 + adcs x21, x21, x15 + csetm x28, cs + stp x17, x19, [x1, #32] + stp x20, x21, [x1, #48] + sub x1, x1, x0 + sub x2, x2, x0 + add x1, x1, #32 + subs x26, x26, #1 + stp x26, xzr, [sp, #16] + bne Lbignum_emontredc_8n_outerloop + neg x0, x28 Lbignum_emontredc_8n_end: - CFI_INC_SP(32) - - CFI_POP2(x27,x28) - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET + CFI_INC_SP(32) + + CFI_POP2(x27,x28) + CFI_POP2(x25,x26) + CFI_POP2(x23,x24) + CFI_POP2(x21,x22) + CFI_POP2(x19,x20) + CFI_RET S2N_BN_SIZE_DIRECTIVE(bignum_emontredc_8n) diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_emontredc_8n_cdiff.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_emontredc_8n_cdiff.S deleted file mode 100644 index 03763916db0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_emontredc_8n_cdiff.S +++ /dev/null @@ -1,662 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC - -// ---------------------------------------------------------------------------- -// Extend Montgomery reduce in 8-digit blocks, uses an extra storage to -// temporarily cache multiplied differences appearing in ADK. -// Results are stored in input-output buffer (z). -// k must be divisible by 8 and not smaller than 16. -// Inputs z[2*k], m[k], w; -// Outputs function return (extra result bit) and z[2*k] -// Temporary buffer m_precalc[12*(k/4-1)] -// -// extern uint64_t bignum_emontredc_8n_cdiff(uint64_t k, uint64_t *z, -// const uint64_t *m, uint64_t w, -// uint64_t *m_precalc); -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = m, X3 = w, X4 = m_precalc -// returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_emontredc_8n_cdiff) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_emontredc_8n_cdiff) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_emontredc_8n_cdiff) - .text - .balign 4 - -#define count x27 - -// Helper macro for the pre-computations -#define cdiff(t, c, x, y) subs t, x, y; cneg t, t, cc; csetm c, cc - -// Some immediate offsets for cached differences+carry used -// in the inner ADK multiplications -#define cache_a01 (32+0*16) -#define cache_a02 (32+1*16) -#define cache_a03 (32+2*16) -#define cache_a12 (32+3*16) -#define cache_a13 (32+4*16) -#define cache_a23 (32+5*16) -#define cache_m10 (0*16) -#define cache_m20 (1*16) -#define cache_m30 (2*16) -#define cache_m21 (3*16) -#define cache_m31 (4*16) -#define cache_m32 (5*16) - -#define a0 x4 -#define a1 x5 -#define a2 x6 -#define a3 x7 - -// Registers for precalculation -#define vpre00 v30 -#define vpre01 v28 -#define vpre02 v17 -#define vpre10 v18 -#define vpre11 v19 -#define vpre12 v20 - -#define m x2 - -S2N_BN_SYMBOL(bignum_emontredc_8n_cdiff): - CFI_START - - CFI_DEC_SP((10*16)) - CFI_STACKSAVE2(x19,x20,(9*16)) - CFI_STACKSAVE2(x21,x22,(8*16)) - CFI_STACKSAVE2(x23,x24,(7*16)) - CFI_STACKSAVE2(x25,x26,(6*16)) - CFI_STACKSAVE2(x27,x28,(5*16)) - CFI_STACKSAVE2(x29,x30,(4*16)) - CFI_STACKSAVE2(d14,d15,(3*16)) - CFI_STACKSAVE2(d12,d13,(2*16)) - CFI_STACKSAVE2(d10,d11,(1*16)) - CFI_STACKSAVE2(d8,d9,(0*16)) - - // Leave space for cached differences of words of a in inner loop - CFI_DEC_SP((6*16)) - - CFI_DEC_SP(32) - lsr x0, x0, #2 - mov x26, x0 - subs x12, x0, #1 - bcc Lbignum_emontredc_8n_cdiff_end - - // x30 = buffer holding precomputed ADK carry-differences for modulus - - // - // Start of precomputation - // - // Precompute and cache signed differences of modulus components - // used in the ADK multiplication in the inner loop. - // - - // Number of extra limbs required: - // 6 * (number of limbs / 4 - 1) * 2 = 12 * (number_of_limbs/4 - 1) - // - mov x24, x4 - mov x30, x4 - - // Save modulus pointer - mov x25, m - - mov count, x12 - -Lbignum_emontredc_8n_cdiff_precomp: - ldp a0, a1, [m, #32]! - ldp a2, a3, [m, #16] - -#define t x28 -#define c x29 - - cdiff(t, c, a1, a0) - stp t, c, [x30, #cache_m10] - cdiff(t, c, a2, a0) - stp t, c, [x30, #cache_m20] - cdiff(t, c, a3, a0) - stp t, c, [x30, #cache_m30] - cdiff(t, c, a2, a1) - stp t, c, [x30, #cache_m21] - cdiff(t, c, a3, a1) - stp t, c, [x30, #cache_m31] - cdiff(t, c, a3, a2) - stp t, c, [x30, #cache_m32] - - add x30, x30, #(6*16) - - subs count, count, #1 - cbnz count, Lbignum_emontredc_8n_cdiff_precomp - - // Set modulus pointer and buffer pointer back to its original value - mov m, x25 - mov x30, x24 - - // - // End of precomputation - // - - stp x3, x30, [sp] - stp x26, xzr, [sp, #16] - mov x28, xzr - lsl x0, x12, #5 - - movi v29.2d, #0x000000ffffffff - -Lbignum_emontredc_8n_cdiff_outerloop: - ldp x9, x13, [x1, #0] // .*.................................................................................................................................................................................................................. - ldr x3, [sp] // *................................................................................................................................................................................................................... - lsr x27, x0, #5 // ......................................................................................................................................*............................................................................. - sub x27, x27, #1 // ...................................................................................................................................................................................................................* - ldp x10, x12, [x1, #16] // ..*................................................................................................................................................................................................................. - ldp x4, x15, [x2, #0] // ...*................................................................................................................................................................................................................ - ldr q1, [x2, #16] // .....*.............................................................................................................................................................................................................. - mul x11, x9, x3 // ......*............................................................................................................................................................................................................. - uzp2 v18.4S, v1.4S, v1.4S // ........*........................................................................................................................................................................................................... - dup v27.2D, x11 // .......*............................................................................................................................................................................................................ - xtn v13.2S, v1.2D // ..........*......................................................................................................................................................................................................... - rev64 v9.4S, v1.4S // ...........*........................................................................................................................................................................................................ - mul x7, x11, x4 // ...........................*........................................................................................................................................................................................ - rev64 v2.4S, v1.4S // ....................................................................................*............................................................................................................................... - uzp2 v20.4S, v1.4S, v1.4S // .................................................................................*.................................................................................................................................. - mul v31.4S, v9.4S, v27.4S // ...............*.................................................................................................................................................................................................... - xtn v14.2S, v1.2D // ..............................................*..................................................................................................................................................................... - uzp2 v21.4S, v1.4S, v1.4S // ............................................*....................................................................................................................................................................... - umulh x22, x11, x15 // ................................*................................................................................................................................................................................... - xtn v17.2S, v27.2D // .........*.......................................................................................................................................................................................................... - adds x19, x9, x7 // ............................*....................................................................................................................................................................................... - umull v28.2D, v17.2S, v13.2S // ............*....................................................................................................................................................................................................... - umull v26.2D, v17.2S, v18.2S // .............*...................................................................................................................................................................................................... - uaddlp v8.2D, v31.4S // ..................*................................................................................................................................................................................................. - umulh x8, x11, x4 // .............................*...................................................................................................................................................................................... - shl v7.2D, v8.2D, #32 // .....................*.............................................................................................................................................................................................. - uzp2 v30.4S, v27.4S, v27.4S // ..............*..................................................................................................................................................................................................... - umlal v7.2D, v17.2S, v13.2S // .......................*............................................................................................................................................................................................ - mul x14, x11, x15 // ..............................*..................................................................................................................................................................................... - usra v26.2D, v28.2D, #32 // ................*................................................................................................................................................................................................... - umull v12.2D, v30.2S, v18.2S // .................*.................................................................................................................................................................................................. - mov x24, v7.d[0] // .........................*.......................................................................................................................................................................................... - adcs x29, x13, x14 // ...............................*.................................................................................................................................................................................... - and v4.16B, v26.16B, v29.16B // ...................*................................................................................................................................................................................................ - mov x17, v7.d[1] // ..........................*......................................................................................................................................................................................... - rev64 v27.4S, v1.4S // ...............................................*.................................................................................................................................................................... - adcs x5, x10, x24 // .................................*.................................................................................................................................................................................. - umlal v4.2D, v30.2S, v13.2S // ....................*............................................................................................................................................................................................... - usra v12.2D, v26.2D, #32 // ......................*............................................................................................................................................................................................. - adcs x14, x12, x17 // ..................................*................................................................................................................................................................................. - adc x23, xzr, xzr // .....................................*.............................................................................................................................................................................. - adds x8, x29, x8 // ......................................*............................................................................................................................................................................. - adcs x7, x5, x22 // .......................................*............................................................................................................................................................................ - mul x25, x8, x3 // ..........................................*......................................................................................................................................................................... - usra v12.2D, v4.2D, #32 // ........................*........................................................................................................................................................................................... - dup v8.2D, x25 // ...........................................*........................................................................................................................................................................ - stp x11, x25, [x1, #0] // ..............................................................................*..................................................................................................................................... - mul x22, x25, x4 // ...............................................................*.................................................................................................................................................... - mov x16, v12.d[1] // ....................................*............................................................................................................................................................................... - ldr q16, [x1, #0] // .......................................................................................................................................*............................................................................ - mov x21, v12.d[0] // ...................................*................................................................................................................................................................................ - mul v31.4S, v27.4S, v8.4S // ...................................................*................................................................................................................................................................ - adcs x20, x14, x21 // ........................................*........................................................................................................................................................................... - xtn v27.2S, v8.2D // .............................................*...................................................................................................................................................................... - adc x10, x23, x16 // .........................................*.......................................................................................................................................................................... - subs x14, x11, x25 // .........................................................................................................................................*.......................................................................... - rev64 v17.4S, v16.4S // ...................................................................................................................................................................*................................................ - cneg x17, x14, cc // ..........................................................................................................................................*......................................................................... - csetm x26, cc // ...........................................................................................................................................*........................................................................ - uaddlp v26.2D, v31.4S // ......................................................*............................................................................................................................................................. - mul x6, x25, x15 // ..................................................................*................................................................................................................................................. - stp x17, x26, [sp, #cache_a01] // ............................................................................................................................................*....................................................................... - umull v24.2D, v27.2S, v14.2S // ................................................*................................................................................................................................................................... - uzp2 v30.4S, v16.4S, v16.4S // .................................................................................................................................................................*.................................................. - shl v4.2D, v26.2D, #32 // .........................................................*.......................................................................................................................................................... - uzp2 v5.4S, v8.4S, v8.4S // ..................................................*................................................................................................................................................................. - umulh x17, x25, x4 // .................................................................*.................................................................................................................................................. - umlal v4.2D, v27.2S, v14.2S // ...........................................................*........................................................................................................................................................ - umull v8.2D, v27.2S, v21.2S // .................................................*.................................................................................................................................................................. - mov x21, v4.d[0] // .............................................................*...................................................................................................................................................... - adds x8, x8, x22 // ................................................................*................................................................................................................................................... - mov x12, v4.d[1] // ..............................................................*..................................................................................................................................................... - ldp x23, x14, [x2, #16] // ....*............................................................................................................................................................................................................... - adcs x29, x7, x6 // ...................................................................*................................................................................................................................................ - umulh x13, x25, x15 // ....................................................................*............................................................................................................................................... - usra v8.2D, v24.2D, #32 // ....................................................*............................................................................................................................................................... - ldp x8, x24, [x30, #cache_m20] // ...........................................................................................................................................................................................................*........ - adcs x9, x20, x21 // .....................................................................*.............................................................................................................................................. - ldr q9, [x2, #32]! // .......................................................................................................................................................................*............................................ - xtn v28.2S, v16.2D // ..................................................................................................................................................................*................................................. - adcs x19, x10, x12 // ......................................................................*............................................................................................................................................. - ldr q13, [x2, #16] // ........................................................................................................................................................................*........................................... - umull v18.2D, v5.2S, v21.2S // .....................................................*.............................................................................................................................................................. - adc x7, xzr, xzr // .........................................................................*.......................................................................................................................................... - adds x5, x29, x17 // ..........................................................................*......................................................................................................................................... - xtn v21.2S, v1.2D // ...................................................................................*................................................................................................................................ - mul x12, x5, x3 // ...............................................................................*.................................................................................................................................... - and v4.16B, v8.16B, v29.16B // .......................................................*............................................................................................................................................................ - adcs x21, x9, x13 // ...........................................................................*........................................................................................................................................ - uzp2 v31.4S, v9.4S, v9.4S // ...............................................................................................................................................................................*.................................... - xtn v23.2S, v9.2D // .........................................................................................................................................................................*.......................................... - usra v18.2D, v8.2D, #32 // ..........................................................*......................................................................................................................................................... - umlal v4.2D, v5.2S, v14.2S // ........................................................*........................................................................................................................................................... - dup v5.2D, x12 // ................................................................................*................................................................................................................................... - umull v16.2D, v23.2S, v30.2S // ............................................................................................................................................................................*....................................... - umull v1.2D, v23.2S, v28.2S // ..............................................................................................................................................................................*..................................... - umulh x29, x12, x15 // .........................................................................................................*.......................................................................................................... - umull v8.2D, v31.2S, v30.2S // ....................................................................................................................................................................................*............................... - xtn v24.2S, v13.2D // ..........................................................................................................................................................................*......................................... - mul v25.4S, v2.4S, v5.4S // ........................................................................................*........................................................................................................................... - usra v18.2D, v4.2D, #32 // ............................................................*....................................................................................................................................................... - xtn v3.2S, v5.2D // ..................................................................................*................................................................................................................................. - uzp2 v19.4S, v5.4S, v5.4S // .......................................................................................*............................................................................................................................ - mul x10, x12, x15 // .......................................................................................................*............................................................................................................ - umull v26.2D, v3.2S, v20.2S // ......................................................................................*............................................................................................................................. - mov x22, v18.d[0] // .......................................................................*............................................................................................................................................ - umull v10.2D, v3.2S, v21.2S // .....................................................................................*.............................................................................................................................. - uaddlp v11.2D, v25.4S // ...........................................................................................*........................................................................................................................ - mov x6, v18.d[1] // ........................................................................*........................................................................................................................................... - mul x16, x12, x4 // ....................................................................................................*............................................................................................................... - umull v4.2D, v19.2S, v20.2S // ..........................................................................................*......................................................................................................................... - usra v16.2D, v1.2D, #32 // ...................................................................................................................................................................................*................................ - adcs x13, x19, x22 // ............................................................................*....................................................................................................................................... - shl v11.2D, v11.2D, #32 // ..............................................................................................*..................................................................................................................... - adc x6, x7, x6 // .............................................................................*...................................................................................................................................... - subs x7, x11, x12 // .............................................................................................................................................*...................................................................... - usra v26.2D, v10.2D, #32 // .........................................................................................*.......................................................................................................................... - csetm x26, cc // ...............................................................................................................................................*.................................................................... - cneg x20, x7, cc // ..............................................................................................................................................*..................................................................... - subs x19, x25, x12 // .....................................................................................................................................................*.............................................................. - umlal v11.2D, v3.2S, v21.2S // ................................................................................................*................................................................................................................... - cneg x9, x19, cc // ......................................................................................................................................................*............................................................. - stp x20, x26, [sp, #cache_a02] // ................................................................................................................................................*................................................................... - umulh x7, x12, x4 // ......................................................................................................*............................................................................................................. - usra v8.2D, v16.2D, #32 // ........................................................................................................................................................................................*........................... - mul v7.4S, v17.4S, v9.4S // ................................................................................................................................................................................................*................... - csetm x26, cc // .......................................................................................................................................................*............................................................ - adds x19, x5, x16 // .....................................................................................................*.............................................................................................................. - and v1.16B, v16.16B, v29.16B // .......................................................................................................................................................................................*............................ - adcs x21, x21, x10 // ........................................................................................................*........................................................................................................... - stp x9, x26, [sp, #cache_a12] // ........................................................................................................................................................*........................................................... - ldp x17, x20, [sp, #cache_a02] // .....................................................................................................................................................................................................*.............. - usra v4.2D, v26.2D, #32 // ...............................................................................................*.................................................................................................................... - and v18.16B, v26.16B, v29.16B // ............................................................................................*....................................................................................................................... - umlal v1.2D, v31.2S, v28.2S // ..........................................................................................................................................................................................*......................... - mov x22, v11.d[0] // ..................................................................................................*................................................................................................................. - mov x16, v11.d[1] // ...................................................................................................*................................................................................................................ - umlal v18.2D, v19.2S, v21.2S // .............................................................................................*...................................................................................................................... - adcs x19, x13, x22 // ..........................................................................................................*......................................................................................................... - mul x22, x17, x8 // ...............................................................................................................................................................................................................*.... - uaddlp v5.2D, v7.4S // ..................................................................................................................................................................................................*................. - adcs x13, x6, x16 // ...........................................................................................................*........................................................................................................ - usra v8.2D, v1.2D, #32 // ..............................................................................................................................................................................................*..................... - adc x9, xzr, xzr // ..............................................................................................................*..................................................................................................... - adds x5, x21, x7 // ...............................................................................................................*.................................................................................................... - usra v4.2D, v18.2D, #32 // .................................................................................................*.................................................................................................................. - adcs x6, x19, x29 // .................................................................................................................*.................................................................................................. - mul x19, x5, x3 // ................................................................................................................*................................................................................................... - shl v15.2D, v5.2D, #32 // ......................................................................................................................................................................................................*............. - mov x3, v8.d[1] // ...................................................................................................................................................................................................*................ - umlal v15.2D, v23.2S, v28.2S // .......................................................................................................................................................................................................*............ - mov x21, v4.d[0] // ............................................................................................................*....................................................................................................... - mul x7, x19, x23 // .......................................................................................................................*............................................................................................ - stp x12, x19, [x1, #16] // ....................................................................................................................*............................................................................................... - mov x10, v4.d[1] // .............................................................................................................*...................................................................................................... - ldr q9, [x1, #16] // ........................................................................................................................................*........................................................................... - adcs x13, x13, x21 // ..................................................................................................................*................................................................................................. - mov x21, v15.d[1] // ............................................................................................................................................................................................................*....... - mul x16, x19, x4 // .....................................................................................................................*.............................................................................................. - adc x9, x9, x10 // ...................................................................................................................*................................................................................................ - subs x29, x25, x19 // .........................................................................................................................................................*.......................................................... - csetm x26, cc // ...........................................................................................................................................................*........................................................ - cneg x10, x29, cc // ..........................................................................................................................................................*......................................................... - subs x29, x12, x19 // .............................................................................................................................................................*...................................................... - stp x10, x26, [sp, #cache_a13] // ............................................................................................................................................................*....................................................... - uzp2 v18.4S, v9.4S, v9.4S // ....................................................................................................................................................................*............................................... - mul x12, x19, x15 // ......................................................................................................................*............................................................................................. - rev64 v20.4S, v9.4S // ......................................................................................................................................................................*............................................. - xtn v19.2S, v9.2D // .....................................................................................................................................................................*.............................................. - umull v25.2D, v24.2S, v18.2S // .............................................................................................................................................................................*...................................... - csetm x26, cc // ...............................................................................................................................................................*.................................................... - umull v14.2D, v24.2S, v19.2S // ................................................................................................................................................................................*................................... - cneg x29, x29, cc // ..............................................................................................................................................................*..................................................... - umulh x10, x19, x23 // ..............................................................................................................................*..................................................................................... - adds x25, x5, x16 // .........................................................................................................................*.......................................................................................... - mul v7.4S, v20.4S, v13.4S // .................................................................................................................................................................................*.................................. - adcs x12, x6, x12 // ...........................................................................................................................*........................................................................................ - ldp x6, x5, [sp, #cache_a01] // ..........................................................................................................................................................................................................*......... - mov x16, v8.d[0] // .........................................................................................................................................................................................................*.......... - adcs x25, x13, x7 // .............................................................................................................................*...................................................................................... - stp x29, x26, [sp, #cache_a23] // ................................................................................................................................................................*................................................... - usra v25.2D, v14.2D, #32 // .....................................................................................................................................................................................*.............................. - mul x29, x19, x14 // ........................................................................................................................*........................................................................................... - uzp2 v1.4S, v13.4S, v13.4S // ...........................................................................................................................................................................*........................................ - uaddlp v7.2D, v7.4S // ......................................................................................................................................................................................*............................. - umull v0.2D, v1.2S, v18.2S // ..................................................................................................................................................................................*................................. - umulh x13, x19, x4 // ..........................................................................................................................*......................................................................................... - and v10.16B, v25.16B, v29.16B // .........................................................................................................................................................................................*.......................... - shl v13.2D, v7.2D, #32 // ............................................................................................................................................................................................*....................... - adcs x4, x9, x29 // ...............................................................................................................................*.................................................................................... - umlal v10.2D, v1.2S, v19.2S // .............................................................................................................................................................................................*...................... - adc x9, xzr, xzr // .................................................................................................................................*.................................................................................. - subs x29, x11, x19 // .................................................................................................................................................*.................................................................. - usra v0.2D, v25.2D, #32 // ...........................................................................................................................................................................................*........................ - eor x11, x20, x24 // ................................................................................................................................................................................................................*... - umulh x15, x19, x15 // ............................................................................................................................*....................................................................................... - umlal v13.2D, v24.2S, v19.2S // ...............................................................................................................................................................................................*.................... - cneg x7, x29, cc // ..................................................................................................................................................*................................................................. - ldp x20, x29, [x1, #32]! // .................................................................................................................................................................................................................*.. - csetm x26, cc // ...................................................................................................................................................*................................................................ - usra v0.2D, v10.2D, #32 // .................................................................................................................................................................................................*.................. - umulh x19, x19, x14 // ................................................................................................................................*................................................................................... - mov x23, v13.d[1] // .............................................................................................................................................................................................................*...... - stp x7, x26, [sp, #cache_a03] // ....................................................................................................................................................*............................................................... - adds x12, x12, x13 // ..................................................................................................................................*................................................................................. - adcs x13, x25, x15 // ...................................................................................................................................*................................................................................ - mov x26, v0.d[0] // ....................................................................................................................................................................................................*............... - umulh x8, x17, x8 // ..................................................................................................................................................................................................................*. - adcs x14, x4, x10 // ....................................................................................................................................*............................................................................... - mov x17, v13.d[0] // ........................................................................................................................................................................................................*........... - adc x15, x9, x19 // .....................................................................................................................................*.............................................................................. - ldp x24, x10, [x30], #96 // ..............................................................................................................................................................................................................*..... - -Lbignum_emontredc_8n_cdiff_maddloop_neon: - - ldr q14, [x2, #32]! // e.................................................................................................................................................... - ldr q25, [x2, #16] // .e................................................................................................................................................... - eor x19, x5, x10 // .................................................................................*................................................................... - adds x25, x21, x16 // .....................................*............................................................................................................... - mov x16, v0.d[1] // .................................*................................................................................................................... - ldp x4, x7, [x1, #16] // .............................................*....................................................................................................... - adcs x21, x17, x3 // ......................................*.............................................................................................................. - eor x22, x22, x11 // .................................................................................................................*................................... - adcs x23, x23, x26 // .......................................*............................................................................................................. - adc x17, x16, xzr // ........................................*............................................................................................................ - adds x16, x12, x20 // ...........................................*......................................................................................................... - mul x5, x6, x24 // ..................................................................................*.................................................................. - xtn v21.2S, v14.2D // ..e.................................................................................................................................................. - xtn v31.2S, v25.2D // ................e.................................................................................................................................... - adcs x9, x13, x29 // ............................................*........................................................................................................ - uzp2 v24.4S, v25.4S, v25.4S // ...................e................................................................................................................................. - mov x29, v15.d[0] // .........................................*........................................................................................................... - adcs x4, x14, x4 // ..............................................*...................................................................................................... - ldp x10, x13, [sp, #cache_a23] // ....................................................................*................................................................................ - umull v5.2D, v21.2S, v30.2S // ....e................................................................................................................................................ - umulh x20, x6, x24 // ...................................................................................*................................................................. - adcs x24, x15, x7 // ...............................................*..................................................................................................... - ldp x12, x7, [x30, #cache_m32 - 96] // .....................................................................*............................................................................... - umull v16.2D, v31.2S, v18.2S // ..................e.................................................................................................................................. - adc x6, xzr, xzr // ................................................*.................................................................................................... - adds x14, x25, x29 // .................................................*................................................................................................... - umull v13.2D, v21.2S, v28.2S // ...e................................................................................................................................................. - uzp2 v10.4S, v14.4S, v14.4S // .....e............................................................................................................................................... - eor x15, x8, x11 // ...................................................................................................................*................................. - adcs x25, x21, x25 // ..................................................*.................................................................................................. - umull v1.2D, v31.2S, v19.2S // .................e................................................................................................................................... - adcs x8, x23, x21 // ...................................................*................................................................................................. - mul v6.4S, v20.4S, v25.4S // ....................e................................................................................................................................ - eor x7, x13, x7 // ......................................................................*.............................................................................. - adcs x23, x17, x23 // ....................................................*................................................................................................ - eor x21, x5, x19 // .....................................................................................*............................................................... - adc x13, xzr, x17 // .....................................................*............................................................................................... - adds x17, x25, x29 // ......................................................*.............................................................................................. - umull v0.2D, v24.2S, v18.2S // ......................e.............................................................................................................................. - usra v5.2D, v13.2D, #32 // .......e............................................................................................................................................. - adcs x5, x8, x14 // .......................................................*............................................................................................. - umull v2.2D, v10.2S, v30.2S // ........e............................................................................................................................................ - adcs x25, x23, x25 // ........................................................*............................................................................................ - usra v16.2D, v1.2D, #32 // .....................e............................................................................................................................... - adcs x8, x13, x8 // .........................................................*........................................................................................... - uaddlp v13.2D, v6.4S // .......................e............................................................................................................................. - adcs x23, xzr, x23 // ..........................................................*.......................................................................................... - and v7.16B, v5.16B, v29.16B // ..........e.......................................................................................................................................... - adc x13, xzr, x13 // ...........................................................*......................................................................................... - adds x29, x29, x16 // ............................................................*........................................................................................ - mul x16, x10, x12 // .......................................................................*............................................................................. - usra v2.2D, v5.2D, #32 // .............e....................................................................................................................................... - adcs x9, x14, x9 // .............................................................*....................................................................................... - and v25.16B, v16.16B, v29.16B // ........................e............................................................................................................................ - adcs x17, x17, x4 // ..............................................................*...................................................................................... - umlal v7.2D, v10.2S, v28.2S // ...........e......................................................................................................................................... - umulh x12, x10, x12 // ........................................................................*............................................................................ - adcs x10, x5, x24 // ...............................................................*..................................................................................... - usra v0.2D, v16.2D, #32 // ...........................e......................................................................................................................... - eor x5, x16, x7 // ..........................................................................*.......................................................................... - ldp x16, x14, [x30, #cache_m31 - 96] // ................................................................................................*.................................................... - adcs x6, x25, x6 // ................................................................*.................................................................................... - shl v16.2D, v13.2D, #32 // ..........................e.......................................................................................................................... - eor x24, x20, x19 // .......................................................................................*............................................................. - adcs x4, x8, xzr // .................................................................*................................................................................... - ldp x20, x25, [sp, #cache_a13] // ...............................................................................................*..................................................... - umlal v25.2D, v24.2S, v19.2S // .........................e........................................................................................................................... - adcs x23, x23, xzr // ..................................................................*.................................................................................. - usra v2.2D, v7.2D, #32 // ...............e..................................................................................................................................... - umlal v16.2D, v31.2S, v19.2S // ............................e........................................................................................................................ - adc x8, x13, xzr // ...................................................................*................................................................................. - adds xzr, x7, #1 // .........................................................................*........................................................................... - mul v7.4S, v17.4S, v14.4S // ......e.............................................................................................................................................. - adcs x4, x4, x5 // ...........................................................................*......................................................................... - eor x5, x12, x7 // ............................................................................*........................................................................ - adcs x23, x23, x5 // .............................................................................*....................................................................... - mul x12, x20, x16 // ..................................................................................................*.................................................. - adc x5, x8, x7 // ..............................................................................*...................................................................... - adds xzr, x19, #1 // ....................................................................................*................................................................ - adcs x21, x9, x21 // ......................................................................................*.............................................................. - eor x8, x25, x14 // .................................................................................................*................................................... - usra v0.2D, v25.2D, #32 // .............................e....................................................................................................................... - adcs x13, x17, x24 // ........................................................................................*............................................................ - stp x29, x21, [x1, #0] // ..............................................................................................*...................................................... - umulh x20, x20, x16 // ...................................................................................................*................................................. - uaddlp v10.2D, v7.4S // .........e........................................................................................................................................... - adcs x17, x10, x19 // .........................................................................................*........................................................... - mov x3, v2.d[1] // ................................e.................................................................................................................... - ldp x29, x24, [sp, #cache_a03] // .........................................................................................................................*........................... - adcs x25, x6, x19 // ..........................................................................................*.......................................................... - ldp x6, x21, [x30, #cache_m30 - 96] // ..........................................................................................................................*.......................... - eor x10, x12, x8 // .....................................................................................................*............................................... - adcs x9, x4, x19 // ...........................................................................................*......................................................... - mov x26, v0.d[0] // ...............................e..................................................................................................................... - ldp x4, x16, [x30, #cache_m21 - 96] // .......................................................................................................................................*............. - adcs x12, x23, x19 // ............................................................................................*........................................................ - adc x5, x5, x19 // .............................................................................................*....................................................... - adds xzr, x8, #1 // ....................................................................................................*................................................ - ldp x7, x19, [sp, #cache_a12] // ......................................................................................................................................*.............. - adcs x14, x25, x10 // ......................................................................................................*.............................................. - mul x25, x29, x6 // ............................................................................................................................*........................ - eor x20, x20, x8 // .......................................................................................................*............................................. - adcs x23, x9, x20 // ........................................................................................................*............................................ - ldp x9, x20, [sp, #cache_a02] // ...........................................................................................................e......................................... - eor x24, x24, x21 // ...........................................................................................................................*......................... - adcs x12, x12, x8 // .........................................................................................................*........................................... - adc x10, x5, x8 // ..........................................................................................................*.......................................... - adds xzr, x11, #1 // ................................................................................................................*.................................... - umulh x5, x29, x6 // .............................................................................................................................*....................... - shl v15.2D, v10.2D, #32 // ............e........................................................................................................................................ - adcs x8, x13, x22 // ..................................................................................................................*.................................. - eor x13, x25, x24 // ...............................................................................................................................*..................... - adcs x29, x17, x15 // ....................................................................................................................*................................ - umlal v15.2D, v21.2S, v28.2S // ..............e...................................................................................................................................... - adcs x22, x14, x11 // .....................................................................................................................*............................... - mov x17, v16.d[0] // ...................................e................................................................................................................. - adcs x21, x23, x11 // ......................................................................................................................*.............................. - mul x23, x7, x4 // .........................................................................................................................................*........... - adcs x14, x12, x11 // .......................................................................................................................*............................. - eor x12, x19, x16 // ........................................................................................................................................*............ - mov x16, v2.d[0] // ..............................e...................................................................................................................... - adc x15, x10, x11 // ........................................................................................................................*............................ - adds xzr, x24, #1 // ..............................................................................................................................*...................... - eor x19, x5, x24 // .................................................................................................................................*................... - adcs x11, x29, x13 // ................................................................................................................................*.................... - umulh x29, x7, x4 // ..........................................................................................................................................*.......... - adcs x13, x22, x19 // ..................................................................................................................................*.................. - ldp x6, x5, [sp, #cache_a01] // ...............................................................................e..................................................................... - ldp x7, x25, [x30, #cache_m20] // ............................................................................................................e........................................ - adcs x19, x21, x24 // ...................................................................................................................................*................. - mov x21, v15.d[1] // ..................................e.................................................................................................................. - eor x22, x23, x12 // ............................................................................................................................................*........ - adcs x14, x14, x24 // ....................................................................................................................................*................ - mov x23, v16.d[1] // ....................................e................................................................................................................ - adc x15, x15, x24 // .....................................................................................................................................*............... - adds xzr, x12, #1 // ...........................................................................................................................................*......... - ldp x24, x10, [x30], #96 // ................................................................................e.................................................................... - adcs x11, x11, x22 // .............................................................................................................................................*....... - mul x22, x9, x7 // ..............................................................................................................e...................................... - eor x4, x29, x12 // ...............................................................................................................................................*..... - adcs x4, x13, x4 // ................................................................................................................................................*.... - stp x8, x11, [x1, #16] // ..............................................................................................................................................*...... - adcs x13, x19, x12 // .................................................................................................................................................*... - eor x11, x20, x25 // .............................................................................................................e....................................... - ldp x20, x29, [x1, #32]! // ..........................................e.......................................................................................................... - adcs x14, x14, x12 // ..................................................................................................................................................*.. - adc x15, x15, x12 // ...................................................................................................................................................*. - mov x12, x4 // ....................................................................................................................................................* - umulh x8, x9, x7 // ...............................................................................................................e..................................... - - sub count, count, #1 - cbnz count, Lbignum_emontredc_8n_cdiff_maddloop_neon -Lbignum_emontredc_8n_cdiff_inner_loop_postamble: - umulh x19, x6, x24 // ..............*........................................................................................................... - ldp x7, x9, [sp, #cache_a23] // .............*............................................................................................................ - adds x4, x21, x16 // .*........................................................................................................................ - mov x25, v0.d[1] // ..*....................................................................................................................... - eor x5, x5, x10 // *......................................................................................................................... - adcs x17, x17, x3 // ....*..................................................................................................................... - ldp x16, x10, [x1, #16] // ...*...................................................................................................................... - adcs x21, x23, x26 // ......*................................................................................................................... - eor x8, x8, x11 // ...................*...................................................................................................... - adc x23, x25, xzr // .......*.................................................................................................................. - adds x20, x12, x20 // ........*................................................................................................................. - adcs x12, x13, x29 // ..........*............................................................................................................... - mov x25, v15.d[0] // ...........*.............................................................................................................. - adcs x13, x14, x16 // ............*............................................................................................................. - eor x16, x19, x5 // .........................................*................................................................................ - adcs x29, x15, x10 // ...............*.......................................................................................................... - ldp x14, x19, [x30, #cache_m32 - 96] // ................*......................................................................................................... - mul x15, x6, x24 // .........*................................................................................................................ - adc x24, xzr, xzr // .................*........................................................................................................ - adds x6, x4, x25 // ..................*....................................................................................................... - adcs x10, x17, x4 // ....................*..................................................................................................... - eor x4, x22, x11 // .....*.................................................................................................................... - adcs x17, x21, x17 // .....................*.................................................................................................... - eor x22, x9, x19 // ......................*................................................................................................... - adcs x9, x23, x21 // .......................*.................................................................................................. - adc x21, xzr, x23 // .........................*................................................................................................ - adds x23, x10, x25 // ..........................*............................................................................................... - eor x15, x15, x5 // ........................*................................................................................................. - adcs x19, x17, x6 // ...........................*.............................................................................................. - ldp x26, xzr, [sp, #16] // ...........................................................................................................*.............. - sub x2, x2, x0 // .....................................................................................................................*.... - adcs x10, x9, x10 // ............................*............................................................................................. - adcs x17, x21, x17 // .............................*............................................................................................ - adcs x9, xzr, x9 // ..............................*........................................................................................... - adc x21, xzr, x21 // ...............................*.......................................................................................... - adds x25, x25, x20 // ................................*......................................................................................... - mul x20, x7, x14 // .................................*........................................................................................ - adcs x6, x6, x12 // ..................................*....................................................................................... - adcs x23, x23, x13 // ...................................*...................................................................................... - adcs x13, x19, x29 // .....................................*.................................................................................... - umulh x19, x7, x14 // ....................................*..................................................................................... - ldp x14, x29, [x30, #cache_m31 - 96] // .......................................*.................................................................................. - adcs x10, x10, x24 // ........................................*................................................................................. - ldp x12, x7, [sp, #cache_a13] // ...........................................*.............................................................................. - adcs x17, x17, xzr // ..........................................*............................................................................... - adcs x24, x9, xzr // ............................................*............................................................................. - adc x9, x21, xzr // .............................................*............................................................................ - adds xzr, x22, #1 // ..............................................*........................................................................... - eor x21, x20, x22 // ......................................*................................................................................... - adcs x20, x17, x21 // ...............................................*.......................................................................... - eor x17, x19, x22 // ................................................*......................................................................... - mul x19, x12, x14 // ..................................................*....................................................................... - eor x29, x7, x29 // ......................................................*................................................................... - adcs x17, x24, x17 // .................................................*........................................................................ - adc x9, x9, x22 // ...................................................*...................................................................... - adds xzr, x5, #1 // ....................................................*..................................................................... - umulh x21, x12, x14 // .........................................................*................................................................ - ldp x14, x24, [sp, #cache_a03] // ...........................................................*.............................................................. - adcs x6, x6, x15 // .....................................................*.................................................................... - adcs x7, x23, x16 // .......................................................*.................................................................. - ldp x15, x12, [x30, #cache_m30 - 96] // .............................................................*............................................................ - eor x19, x19, x29 // ..............................................................*........................................................... - adcs x13, x13, x5 // ..........................................................*............................................................... - stp x25, x6, [x1, #0] // ........................................................*................................................................. - adcs x16, x10, x5 // ............................................................*............................................................. - ldp x10, x6, [x30, #cache_m21 - 96] // ................................................................*......................................................... - adcs x23, x20, x5 // ...............................................................*.......................................................... - adcs x25, x17, x5 // .................................................................*........................................................ - umulh x30, x14, x15 // .............................................................................*............................................ - ldp x17, x22, [sp, #cache_a12] // ....................................................................*..................................................... - adc x9, x9, x5 // ..................................................................*....................................................... - adds xzr, x29, #1 // ...................................................................*...................................................... - eor x21, x21, x29 // .......................................................................*.................................................. - adcs x16, x16, x19 // .....................................................................*.................................................... - adcs x5, x23, x21 // ........................................................................*................................................. - eor x23, x24, x12 // .........................................................................*................................................ - mul x12, x17, x10 // ...................................................................................*...................................... - adcs x19, x25, x29 // ..........................................................................*............................................... - adc x29, x9, x29 // ...........................................................................*.............................................. - adds xzr, x11, #1 // ............................................................................*............................................. - adcs x7, x7, x4 // ..............................................................................*........................................... - adcs x21, x13, x8 // ................................................................................*......................................... - mul x4, x14, x15 // ......................................................................*................................................... - eor x9, x30, x23 // ........................................................................................*................................. - adcs x30, x16, x11 // .................................................................................*........................................ - adcs x24, x5, x11 // ..................................................................................*....................................... - adcs x16, x19, x11 // ....................................................................................*..................................... - adc x19, x29, x11 // ......................................................................................*................................... - adds xzr, x23, #1 // .......................................................................................*.................................. - eor x8, x4, x23 // ...............................................................................*.......................................... - adcs x4, x21, x8 // .........................................................................................*................................ - umulh x21, x17, x10 // ..........................................................................................*............................... - adcs x8, x30, x9 // ...........................................................................................*.............................. - ldp x10, x30, [x1, #32] // .........................................................................................................*................ - adcs x25, x24, x23 // ............................................................................................*............................. - eor x11, x22, x6 // .....................................................................................*.................................... - adcs x22, x16, x23 // ..............................................................................................*........................... - eor x5, x12, x11 // .............................................................................................*............................ - adc x29, x19, x23 // ...............................................................................................*.......................... - adds xzr, x11, #1 // ................................................................................................*......................... - eor x14, x21, x11 // ..................................................................................................*....................... - adcs x9, x4, x5 // .................................................................................................*........................ - stp x7, x9, [x1, #16] // ....................................................................................................*..................... - adcs x9, x8, x14 // ...................................................................................................*...................... - adcs x19, x25, x11 // .....................................................................................................*.................... - ldp x8, x21, [x1, #48] // ..........................................................................................................*............... - mov x24, x9 // ........................................................................................................*................. - adcs x5, x22, x11 // ......................................................................................................*................... - adc x16, x29, x11 // .......................................................................................................*.................. - adds xzr, x28, x28 // ............................................................................................................*............. - adcs x17, x10, x24 // .............................................................................................................*............ - adcs x14, x30, x19 // ..............................................................................................................*........... - ldr x30, [sp, #8] // .........................................................................................................................* - adcs x8, x8, x5 // ...............................................................................................................*.......... - stp x17, x14, [x1, #32] // ..................................................................................................................*....... - adcs x9, x21, x16 // ................................................................................................................*......... - csetm x28, cs // .................................................................................................................*........ - stp x8, x9, [x1, #48] // ...................................................................................................................*...... - sub x26, x26, #1 // .......................................................................................................................*.. - sub x1, x1, x0 // ....................................................................................................................*..... - stp x26, xzr, [sp, #16] // ........................................................................................................................*. - add x1, x1, #32 // ......................................................................................................................*... - -Lbignum_emontredc_8n_cdiff_outer_loop_end: - - cbnz x26, Lbignum_emontredc_8n_cdiff_outerloop - neg x0, x28 - -Lbignum_emontredc_8n_cdiff_end: - CFI_INC_SP(32) - CFI_INC_SP((6*16)) - CFI_STACKLOAD2(d8,d9,(0*16)) - CFI_STACKLOAD2(d10,d11,(1*16)) - CFI_STACKLOAD2(d12,d13,(2*16)) - CFI_STACKLOAD2(d14,d15,(3*16)) - CFI_STACKLOAD2(x29,x30,(4*16)) - CFI_STACKLOAD2(x27,x28,(5*16)) - CFI_STACKLOAD2(x25,x26,(6*16)) - CFI_STACKLOAD2(x23,x24,(7*16)) - CFI_STACKLOAD2(x21,x22,(8*16)) - CFI_STACKLOAD2(x19,x20,(9*16)) - CFI_INC_SP((10*16)) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_emontredc_8n_cdiff) diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_4_8.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_4_8.S deleted file mode 100644 index da6eeb27c9b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_4_8.S +++ /dev/null @@ -1,257 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[4], y[4]; output z[8] -// -// extern void bignum_mul_4_8(uint64_t z[static 8], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_4_8) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_4_8) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_4_8) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a0short w3 -#define a1 x4 -#define b0 x5 -#define b0short w5 -#define b1 x6 - -#define u0 x7 -#define u1 x8 -#define u2 x9 -#define u3 x10 -#define u4 x11 -#define u5 x12 -#define u6 x13 -#define u7 x14 - -#define t x15 - -#define sgn x16 -#define ysgn x17 - -// These are aliases to registers used elsewhere including input pointers. -// By the time they are used this does not conflict with other uses. - -#define m0 y -#define m1 ysgn -#define m2 t -#define m3 x -#define u u2 - -S2N_BN_SYMBOL(bignum_mul_4_8): - CFI_START - -// Multiply the low halves using Karatsuba 2x2->4 to get [u3,u2,u1,u0] -// The zeroth multiplication (only) is done via 32-bit breakdowns - - ldp a0, a1, [x] - ldp b0, b1, [y] - - umull u0, a0short, b0short - lsr x17, a0, #32 - umull x15, w17, b0short - lsr x16, b0, #32 - umull u1, w16, w17 - umull x16, a0short, w16 - adds u0, u0, x15, lsl #32 - lsr x15, x15, #32 - adc u1, u1, x15 - adds u0, u0, x16, lsl #32 - lsr x16, x16, #32 - adc u1, u1, x16 - - mul u2, a1, b1 - umulh u3, a1, b1 - - subs a1, a1, a0 - cneg a1, a1, cc - csetm sgn, cc - - adds u2, u2, u1 - adc u3, u3, xzr - - subs a0, b0, b1 - cneg a0, a0, cc - cinv sgn, sgn, cc - - mul t, a1, a0 - umulh a0, a1, a0 - - adds u1, u0, u2 - adcs u2, u2, u3 - adc u3, u3, xzr - - adds xzr, sgn, #1 - eor t, t, sgn - adcs u1, t, u1 - eor a0, a0, sgn - adcs u2, a0, u2 - adc u3, u3, sgn - -// Multiply the high halves using Karatsuba 2x2->4 to get [u7,u6,u5,u4] -// Again, the zeroth multiplication (only) is done via 32-bit breakdowns - - ldp a0, a1, [x, #16] - ldp b0, b1, [y, #16] - - umull u4, a0short, b0short - lsr x17, a0, #32 - umull x15, w17, b0short - lsr x16, b0, #32 - umull u5, w16, w17 - umull x16, a0short, w16 - adds u4, u4, x15, lsl #32 - lsr x15, x15, #32 - adc u5, u5, x15 - adds u4, u4, x16, lsl #32 - lsr x16, x16, #32 - adc u5, u5, x16 - - mul u6, a1, b1 - umulh u7, a1, b1 - - subs a1, a1, a0 - cneg a1, a1, cc - csetm sgn, cc - - adds u6, u6, u5 - adc u7, u7, xzr - - subs a0, b0, b1 - cneg a0, a0, cc - cinv sgn, sgn, cc - - mul t, a1, a0 - umulh a0, a1, a0 - - adds u5, u4, u6 - adcs u6, u6, u7 - adc u7, u7, xzr - - adds xzr, sgn, #1 - eor t, t, sgn - adcs u5, t, u5 - eor a0, a0, sgn - adcs u6, a0, u6 - adc u7, u7, sgn - -// Compute sgn,[a1,a0] = x_hi - x_lo -// and ysgn,[b1,b0] = y_lo - y_hi -// sign-magnitude differences - - ldp a0, a1, [x, #16] - ldp t, sgn, [x] - subs a0, a0, t - sbcs a1, a1, sgn - csetm sgn, cc - - ldp t, ysgn, [y] - subs b0, t, b0 - sbcs b1, ysgn, b1 - csetm ysgn, cc - - eor a0, a0, sgn - subs a0, a0, sgn - eor a1, a1, sgn - sbc a1, a1, sgn - - eor b0, b0, ysgn - subs b0, b0, ysgn - eor b1, b1, ysgn - sbc b1, b1, ysgn - -// Save the correct sign for the sub-product - - eor sgn, ysgn, sgn - -// Add H' = H + L_top, still in [u7,u6,u5,u4] - - adds u4, u4, u2 - adcs u5, u5, u3 - adcs u6, u6, xzr - adc u7, u7, xzr - -// Now compute the mid-product as [m3,m2,m1,m0] - - mul m0, a0, b0 - umulh m1, a0, b0 - mul m2, a1, b1 - umulh m3, a1, b1 - - subs a1, a1, a0 - cneg a1, a1, cc - csetm u, cc - - adds m2, m2, m1 - adc m3, m3, xzr - - subs b1, b0, b1 - cneg b1, b1, cc - cinv u, u, cc - - mul b0, a1, b1 - umulh b1, a1, b1 - - adds m1, m0, m2 - adcs m2, m2, m3 - adc m3, m3, xzr - - adds xzr, u, #1 - eor b0, b0, u - adcs m1, b0, m1 - eor b1, b1, u - adcs m2, b1, m2 - adc m3, m3, u - -// Accumulate the positive mid-terms as [u7,u6,u5,u4,u3,u2] - - adds u2, u4, u0 - adcs u3, u5, u1 - adcs u4, u6, u4 - adcs u5, u7, u5 - adcs u6, u6, xzr - adc u7, u7, xzr - -// Add in the sign-adjusted complex term - - adds xzr, sgn, #1 - eor m0, m0, sgn - adcs u2, m0, u2 - eor m1, m1, sgn - adcs u3, m1, u3 - eor m2, m2, sgn - adcs u4, m2, u4 - eor m3, m3, sgn - adcs u5, m3, u5 - adcs u6, u6, sgn - adc u7, u7, sgn - -// Store back the result - - stp u0, u1, [z] - stp u2, u3, [z, #16] - stp u4, u5, [z, #32] - stp u6, u7, [z, #48] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_4_8) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_4_8_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_4_8_alt.S deleted file mode 100644 index 4d8d870f6c0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_4_8_alt.S +++ /dev/null @@ -1,152 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[4], y[4]; output z[8] -// -// extern void bignum_mul_4_8_alt(uint64_t z[static 8], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_4_8_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_4_8_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_4_8_alt) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define b0 x7 -#define b1 x8 -#define b2 x9 -#define b3 x10 - -#define t x11 - -#define u0 x12 -#define u1 x13 -#define u2 x14 -#define u3 x15 -#define u4 x16 - -// These alias to the input arguments when no longer needed - -#define u5 a0 -#define u6 a1 -#define u7 a2 - -S2N_BN_SYMBOL(bignum_mul_4_8_alt): - CFI_START - -// Load operands and set up row 0 = [u4;...;u0] = a0 * [b3;...;b0] - - ldp a0, a1, [x] - ldp b0, b1, [y] - - mul u0, a0, b0 - umulh u1, a0, b0 - mul t, a0, b1 - umulh u2, a0, b1 - adds u1, u1, t - - ldp b2, b3, [y, #16] - - mul t, a0, b2 - umulh u3, a0, b2 - adcs u2, u2, t - - mul t, a0, b3 - umulh u4, a0, b3 - adcs u3, u3, t - adc u4, u4, xzr - - ldp a2, a3, [x, #16] - -// Row 1 = [u5;...;u0] = [a1;a0] * [b3;...;b0] - - mul t, a1, b0 - adds u1, u1, t - mul t, a1, b1 - adcs u2, u2, t - mul t, a1, b2 - adcs u3, u3, t - mul t, a1, b3 - adcs u4, u4, t - umulh u5, a1, b3 - adc u5, u5, xzr - - umulh t, a1, b0 - adds u2, u2, t - umulh t, a1, b1 - adcs u3, u3, t - umulh t, a1, b2 - adcs u4, u4, t - adc u5, u5, xzr - -// Row 2 = [u6;...;u0] = [a2;a1;a0] * [b3;...;b0] - - mul t, a2, b0 - adds u2, u2, t - mul t, a2, b1 - adcs u3, u3, t - mul t, a2, b2 - adcs u4, u4, t - mul t, a2, b3 - adcs u5, u5, t - umulh u6, a2, b3 - adc u6, u6, xzr - - umulh t, a2, b0 - adds u3, u3, t - umulh t, a2, b1 - adcs u4, u4, t - umulh t, a2, b2 - adcs u5, u5, t - adc u6, u6, xzr - -// Row 3 = [u7;...;u0] = [a3;...a0] * [b3;...;b0] - - mul t, a3, b0 - adds u3, u3, t - mul t, a3, b1 - adcs u4, u4, t - mul t, a3, b2 - adcs u5, u5, t - mul t, a3, b3 - adcs u6, u6, t - umulh u7, a3, b3 - adc u7, u7, xzr - - umulh t, a3, b0 - adds u4, u4, t - umulh t, a3, b1 - adcs u5, u5, t - umulh t, a3, b2 - adcs u6, u6, t - adc u7, u7, xzr - -// Store back final result [a3;...a0] * [b3;...;b0] = a * b - - stp u0, u1, [z] - stp u2, u3, [z, #16] - stp u4, u5, [z, #32] - stp u6, u7, [z, #48] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_4_8_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_6_12.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_6_12.S deleted file mode 100644 index 5674d57b03d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_6_12.S +++ /dev/null @@ -1,283 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[6], y[6]; output z[12] -// -// extern void bignum_mul_6_12(uint64_t z[static 12], const uint64_t x[static 6], -// const uint64_t y[static 6]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_6_12) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_6_12) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_6_12) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro computing [c,b,a] := [b,a] + (x - y) * (w - z), adding with carry -// to the [b,a] components but leaving CF aligned with the c term, which is -// a sign bitmask for (x - y) * (w - z). Continued add-with-carry operations -// with [c,...,c] will continue the carry chain correctly starting from -// the c position if desired to add to a longer term of the form [...,b,a]. -// -// c,h,l,t should all be different and t,h should not overlap w,z. -// --------------------------------------------------------------------------- - -.macro muldiffnadd b,a, c,h,l,t, x,y, w,z - subs \t, \x, \y - cneg \t, \t, cc - csetm \c, cc - subs \h, \w, \z - cneg \h, \h, cc - mul \l, \t, \h - umulh \h, \t, \h - cinv \c, \c, cc - adds xzr, \c, #1 - eor \l, \l, \c - adcs \a, \a, \l - eor \h, \h, \c - adcs \b, \b, \h -.endm - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define b0 x6 -#define b1 x7 -#define b2 x8 -#define l0 x9 -#define l1 x10 -#define l2 x11 -#define h0 x12 -#define h1 x13 -#define h2 x14 - -#define s1 x15 -#define s2 x16 -#define s3 x17 -#define s4 x19 -#define s5 x9 - -#define c x10 -#define h x11 -#define l x12 -#define t x13 - -#define s0 x20 - -#define u0 x3 -#define u1 x4 -#define u2 x5 -#define u3 x6 -#define u4 x7 -#define u5 x8 - -// These alias c,h,l but it doesn't matter - -#define u6 x10 -#define u7 x11 -#define u8 x12 - -// We recycle the input pointers near the end - -#define s x1 -#define d x2 - -// --------------------------------------------------------------------------- -// Core 3x3->6 ADK multiplication macro -// Does [s5,s4,s3,s2,s1,s0] = [a2,a1,a0] * [b2,b1,b0] -// -// If the input parameter is 1, it also adds in [z+24,z+32,z+40] -// existing contents; if the parameter is 0 it just does the pure multiply -// --------------------------------------------------------------------------- - -.macro mul3 afl - mul s0, a0, b0 - mul l1, a1, b1 - mul l2, a2, b2 - umulh h0, a0, b0 - umulh h1, a1, b1 - umulh h2, a2, b2 - - adds h0, h0, l1 - adcs h1, h1, l2 - adc h2, h2, xzr - - adds s1, h0, s0 - adcs s2, h1, h0 - adcs s3, h2, h1 - adc s4, h2, xzr - - adds s2, s2, s0 - adcs s3, s3, h0 - adcs s4, s4, h1 - adc s5, h2, xzr - -// Optionally add the existing z contents - -.rep \afl - ldr l, [z,#24] - adds s0, s0, l - ldp l, h, [z,#32] - adcs s1, s1, l - adcs s2, s2, h - adcs s3, s3, xzr - adcs s4, s4, xzr - adc s5, s5, xzr -.endr - - muldiffnadd s2,s1, c,h,l, t, a0,a1, b1,b0 - adcs s3, s3, c - adcs s4, s4, c - adc s5, s5, c - - muldiffnadd s3,s2, c,h,l, t, a0,a2, b2,b0 - adcs s4, s4, c - adc s5, s5, c - - muldiffnadd s4,s3, c,h,l, t, a1,a2, b2,b1 - adc s5, s5, c -.endm - -S2N_BN_SYMBOL(bignum_mul_6_12): - CFI_START - -CFI_PUSH2(x19,x20) - -// Multiply the low halves using ADK 3x3->6 - - ldp a0, a1, [x1] - ldp b0, b1, [x2] - ldr a2, [x1, #16] - ldr b2, [x2, #16] - - mul3 0 - stp s0, s1, [x0] - stp s2, s3, [x0, #16] - stp s4, s5, [x0, #32] - -// Multiply the high halves using ADK 3x3->6 - - ldp a0, a1, [x1,#24] - ldp b0, b1, [x2,#24] - ldr a2, [x1, #40] - ldr b2, [x2, #40] - - mul3 1 - - stp s0, s1, [x0, #48] - stp s2, s3, [x0, #64] - stp s4, s5, [x0, #80] - -// Compute t,[a2,a1,a0] = x_hi - x_lo -// and s,[b2,b1,b0] = y_lo - y_hi -// sign-magnitude differences - - ldr t, [x1] - subs a0, a0, t - ldr t, [x1,#8] - sbcs a1, a1, t - ldr t, [x1,#16] - sbcs a2, a2, t - csetm t, cc - - ldr s, [x2] - subs b0, s, b0 - ldr s, [x2,#8] - sbcs b1, s, b1 - ldr s, [x2,#16] - sbcs b2, s, b2 - csetm s, cc - - eor a0, a0, t - subs a0, a0, t - eor a1, a1, t - sbcs a1, a1, t - eor a2, a2, t - sbc a2, a2, t - - eor b0, b0, s - subs b0, b0, s - eor b1, b1, s - sbcs b1, b1, s - eor b2, b2, s - sbc b2, b2, s - -// Save the correct sign for the sub-product - - eor s, s, t - -// Now yet another 3x3->6 ADK core, but not writing back, keeping s0..s5 - - mul3 0 - -// Now accumulate the positive mid-terms as [u5,u4,u3,u2,u1,u0] - - ldp u0, u1, [z] - ldp u3, u4, [z,#48] - adds u0, u0, u3 - adcs u1, u1, u4 - ldr u2, [z,#16] - ldp u5, u6, [z,#64] - adcs u2, u2, u5 - adcs u3, u3, u6 - ldp u7, u8, [z,#80] - adcs u4, u4, u7 - adcs u5, u5, u8 - -// Stop the carry here so we can reintroduce it, taking into account the -// effective addition of s from sign-extension below. Note that we get -// a duplicated word c+carry beyond the first one, so this upper part is -// of the form [d,d,t]. - - adcs t, s, xzr - adc d, s, xzr - -// Add in the sign-adjusted complex term - - adds xzr, s, #1 - eor s0, s0, s - adcs u0, s0, u0 - eor s1, s1, s - adcs u1, s1, u1 - eor s2, s2, s - adcs u2, s2, u2 - eor s3, s3, s - adcs u3, s3, u3 - eor s4, s4, s - adcs u4, s4, u4 - eor s5, s5, s - adcs u5, s5, u5 - adcs u6, u6, t - adcs u7, u7, d - adc u8, u8, d - -// Store it back - - str u0, [x0,#24] - stp u1, u2, [x0,#32] - stp u3, u4, [x0,#48] - stp u5, u6, [x0,#64] - stp u7, u8, [x0,#80] - -// Restore regs and return - - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_6_12) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_6_12_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_6_12_alt.S deleted file mode 100644 index 3929a98bba0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_6_12_alt.S +++ /dev/null @@ -1,270 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[6], y[6]; output z[12] -// -// extern void bignum_mul_6_12_alt(uint64_t z[static 12], -// const uint64_t x[static 6], -// const uint64_t y[static 6]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_6_12_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_6_12_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_6_12_alt) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 - -// These are repeated mod 2 as we load pairs of inputs - -#define a0 x3 -#define a1 x4 -#define a2 x3 -#define a3 x4 -#define a4 x3 -#define a5 x4 - -#define b0 x5 -#define b1 x6 -#define b2 x7 -#define b3 x8 -#define b4 x9 -#define b5 x10 - -#define t x11 - -// These repeat mod 8 as we write back - -#define u0 x12 -#define u1 x13 -#define u2 x14 -#define u3 x15 -#define u4 x16 -#define u5 x17 -#define u6 x19 -#define u7 x20 -#define u8 x12 -#define u9 x13 -#define u10 x14 -#define u11 x15 - -S2N_BN_SYMBOL(bignum_mul_6_12_alt): - CFI_START - -// Save more registers - - CFI_PUSH2(x19,x20) - -// Load operands and set up row 0 = [u6;...;u0] = a0 * [b5;...;b0] - - ldp a0, a1, [x] - ldp b0, b1, [y] - - mul u0, a0, b0 - umulh u1, a0, b0 - mul t, a0, b1 - umulh u2, a0, b1 - adds u1, u1, t - - ldp b2, b3, [y, #16] - - mul t, a0, b2 - umulh u3, a0, b2 - adcs u2, u2, t - - mul t, a0, b3 - umulh u4, a0, b3 - adcs u3, u3, t - - ldp b4, b5, [y, #32] - - mul t, a0, b4 - umulh u5, a0, b4 - adcs u4, u4, t - - mul t, a0, b5 - umulh u6, a0, b5 - adcs u5, u5, t - - adc u6, u6, xzr - -// Row 1 = [u7;...;u0] = [a1;a0] * [b5;...;b0] - - mul t, a1, b0 - adds u1, u1, t - mul t, a1, b1 - adcs u2, u2, t - mul t, a1, b2 - adcs u3, u3, t - mul t, a1, b3 - adcs u4, u4, t - mul t, a1, b4 - adcs u5, u5, t - mul t, a1, b5 - adcs u6, u6, t - cset u7, cs - - umulh t, a1, b0 - adds u2, u2, t - umulh t, a1, b1 - adcs u3, u3, t - umulh t, a1, b2 - adcs u4, u4, t - umulh t, a1, b3 - adcs u5, u5, t - umulh t, a1, b4 - adcs u6, u6, t - umulh t, a1, b5 - adc u7, u7, t - - stp u0, u1, [z] - -// Row 2 = [u8;...;u0] = [a2;a1;a0] * [b5;...;b0] - - ldp a2, a3, [x, #16] - - mul t, a2, b0 - adds u2, u2, t - mul t, a2, b1 - adcs u3, u3, t - mul t, a2, b2 - adcs u4, u4, t - mul t, a2, b3 - adcs u5, u5, t - mul t, a2, b4 - adcs u6, u6, t - mul t, a2, b5 - adcs u7, u7, t - cset u8, cs - - umulh t, a2, b0 - adds u3, u3, t - umulh t, a2, b1 - adcs u4, u4, t - umulh t, a2, b2 - adcs u5, u5, t - umulh t, a2, b3 - adcs u6, u6, t - umulh t, a2, b4 - adcs u7, u7, t - umulh t, a2, b5 - adc u8, u8, t - -// Row 3 = [u9;...;u0] = [a3;a2;a1;a0] * [b5;...;b0] - - mul t, a3, b0 - adds u3, u3, t - mul t, a3, b1 - adcs u4, u4, t - mul t, a3, b2 - adcs u5, u5, t - mul t, a3, b3 - adcs u6, u6, t - mul t, a3, b4 - adcs u7, u7, t - mul t, a3, b5 - adcs u8, u8, t - cset u9, cs - - umulh t, a3, b0 - adds u4, u4, t - umulh t, a3, b1 - adcs u5, u5, t - umulh t, a3, b2 - adcs u6, u6, t - umulh t, a3, b3 - adcs u7, u7, t - umulh t, a3, b4 - adcs u8, u8, t - umulh t, a3, b5 - adc u9, u9, t - - stp u2, u3, [z, #16] - -// Row 4 = [u10;...;u0] = [a4;a3;a2;a1;a0] * [b5;...;b0] - - ldp a4, a5, [x, #32] - - mul t, a4, b0 - adds u4, u4, t - mul t, a4, b1 - adcs u5, u5, t - mul t, a4, b2 - adcs u6, u6, t - mul t, a4, b3 - adcs u7, u7, t - mul t, a4, b4 - adcs u8, u8, t - mul t, a4, b5 - adcs u9, u9, t - cset u10, cs - - umulh t, a4, b0 - adds u5, u5, t - umulh t, a4, b1 - adcs u6, u6, t - umulh t, a4, b2 - adcs u7, u7, t - umulh t, a4, b3 - adcs u8, u8, t - umulh t, a4, b4 - adcs u9, u9, t - umulh t, a4, b5 - adc u10, u10, t - -// Row 5 = [u11;...;u0] = [a5;a4;a3;a2;a1;a0] * [b5;...;b0] - - mul t, a5, b0 - adds u5, u5, t - mul t, a5, b1 - adcs u6, u6, t - mul t, a5, b2 - adcs u7, u7, t - mul t, a5, b3 - adcs u8, u8, t - mul t, a5, b4 - adcs u9, u9, t - mul t, a5, b5 - adcs u10, u10, t - cset u11, cs - - umulh t, a5, b0 - adds u6, u6, t - umulh t, a5, b1 - adcs u7, u7, t - umulh t, a5, b2 - adcs u8, u8, t - umulh t, a5, b3 - adcs u9, u9, t - umulh t, a5, b4 - adcs u10, u10, t - umulh t, a5, b5 - adc u11, u11, t - - stp u4, u5, [z, #32] - -// Store back remaining digits of final result - - stp u6, u7, [z, #48] - stp u8, u9, [z, #64] - stp u10, u11, [z, #80] - -// Restore registers and return - - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_6_12_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_8_16.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_8_16.S deleted file mode 100644 index ac2ba7936c9..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_8_16.S +++ /dev/null @@ -1,526 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[8], y[8]; output z[16] -// -// extern void bignum_mul_8_16(uint64_t z[static 16], const uint64_t x[static 8], -// const uint64_t y[static 8]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_8_16) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_8_16) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_8_16) - .text - .balign 4 - -S2N_BN_SYMBOL(bignum_mul_8_16): - CFI_START - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - ldp x3, x4, [x1] - ldr q0, [x1] - ldp x7, x8, [x2] - ldr q1, [x2] - ldp x5, x6, [x1, #16] - ldr q2, [x1, #16] - ldp x9, x10, [x2, #16] - ldr q3, [x2, #16] - uzp1 v4.4s, v1.4s, v0.4s - rev64 v1.4s, v1.4s - uzp1 v5.4s, v0.4s, v0.4s - mul v0.4s, v1.4s, v0.4s - uaddlp v0.2d, v0.4s - shl v0.2d, v0.2d, #32 - umlal v0.2d, v5.2s, v4.2s - mov x11, v0.d[0] - mov x15, v0.d[1] - uzp1 v0.4s, v3.4s, v2.4s - rev64 v1.4s, v3.4s - uzp1 v3.4s, v2.4s, v2.4s - mul v1.4s, v1.4s, v2.4s - uaddlp v1.2d, v1.4s - shl v1.2d, v1.2d, #32 - umlal v1.2d, v3.2s, v0.2s - mov x16, v1.d[0] - mov x17, v1.d[1] - ldr q0, [x1, #32] - ldr q1, [x2, #32] - ldr q2, [x1, #48] - ldr q3, [x2, #48] - umulh x19, x3, x7 - adds x15, x15, x19 - umulh x19, x4, x8 - adcs x16, x16, x19 - umulh x19, x5, x9 - adcs x17, x17, x19 - umulh x19, x6, x10 - uzp1 v4.4s, v1.4s, v0.4s - rev64 v1.4s, v1.4s - uzp1 v5.4s, v0.4s, v0.4s - mul v0.4s, v1.4s, v0.4s - uaddlp v0.2d, v0.4s - shl v0.2d, v0.2d, #32 - umlal v0.2d, v5.2s, v4.2s - adc x19, x19, xzr - adds x12, x15, x11 - adcs x15, x16, x15 - adcs x16, x17, x16 - adcs x17, x19, x17 - adc x19, xzr, x19 - adds x13, x15, x11 - adcs x14, x16, x12 - adcs x15, x17, x15 - adcs x16, x19, x16 - adcs x17, xzr, x17 - adc x19, xzr, x19 - subs x24, x5, x6 - cneg x24, x24, cc - csetm x20, cc - subs x21, x10, x9 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x16, x16, x22 - eor x21, x21, x20 - adcs x17, x17, x21 - adc x19, x19, x20 - subs x24, x3, x4 - cneg x24, x24, cc - csetm x20, cc - subs x21, x8, x7 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x12, x12, x22 - eor x21, x21, x20 - adcs x13, x13, x21 - adcs x14, x14, x20 - adcs x15, x15, x20 - adcs x16, x16, x20 - adcs x17, x17, x20 - adc x19, x19, x20 - subs x24, x4, x6 - cneg x24, x24, cc - csetm x20, cc - subs x21, x10, x8 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x15, x15, x22 - eor x21, x21, x20 - adcs x16, x16, x21 - adcs x17, x17, x20 - adc x19, x19, x20 - subs x24, x3, x5 - cneg x24, x24, cc - csetm x20, cc - subs x21, x9, x7 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x13, x13, x22 - eor x21, x21, x20 - adcs x14, x14, x21 - adcs x15, x15, x20 - adcs x16, x16, x20 - adcs x17, x17, x20 - adc x19, x19, x20 - subs x24, x3, x6 - cneg x24, x24, cc - csetm x20, cc - subs x21, x10, x7 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x14, x14, x22 - eor x21, x21, x20 - adcs x15, x15, x21 - adcs x16, x16, x20 - adcs x17, x17, x20 - adc x19, x19, x20 - subs x24, x4, x5 - cneg x24, x24, cc - csetm x20, cc - subs x21, x9, x8 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x14, x14, x22 - eor x21, x21, x20 - adcs x15, x15, x21 - adcs x16, x16, x20 - adcs x17, x17, x20 - adc x19, x19, x20 - ldp x3, x4, [x1, #32] - stp x11, x12, [x0] - ldp x7, x8, [x2, #32] - stp x13, x14, [x0, #16] - ldp x5, x6, [x1, #48] - stp x15, x16, [x0, #32] - ldp x9, x10, [x2, #48] - stp x17, x19, [x0, #48] - mov x11, v0.d[0] - mov x15, v0.d[1] - uzp1 v0.4s, v3.4s, v2.4s - rev64 v1.4s, v3.4s - uzp1 v3.4s, v2.4s, v2.4s - mul v1.4s, v1.4s, v2.4s - uaddlp v1.2d, v1.4s - shl v1.2d, v1.2d, #32 - umlal v1.2d, v3.2s, v0.2s - mov x16, v1.d[0] - mov x17, v1.d[1] - umulh x19, x3, x7 - adds x15, x15, x19 - umulh x19, x4, x8 - adcs x16, x16, x19 - umulh x19, x5, x9 - adcs x17, x17, x19 - umulh x19, x6, x10 - adc x19, x19, xzr - adds x12, x15, x11 - adcs x15, x16, x15 - adcs x16, x17, x16 - adcs x17, x19, x17 - adc x19, xzr, x19 - adds x13, x15, x11 - adcs x14, x16, x12 - adcs x15, x17, x15 - adcs x16, x19, x16 - adcs x17, xzr, x17 - adc x19, xzr, x19 - ldp x22, x21, [x0, #32] - adds x11, x11, x22 - adcs x12, x12, x21 - ldp x22, x21, [x0, #48] - adcs x13, x13, x22 - adcs x14, x14, x21 - adcs x15, x15, xzr - adcs x16, x16, xzr - adcs x17, x17, xzr - adc x19, x19, xzr - subs x24, x5, x6 - cneg x24, x24, cc - csetm x20, cc - subs x21, x10, x9 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x16, x16, x22 - eor x21, x21, x20 - adcs x17, x17, x21 - adc x19, x19, x20 - subs x24, x3, x4 - cneg x24, x24, cc - csetm x20, cc - subs x21, x8, x7 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x12, x12, x22 - eor x21, x21, x20 - adcs x13, x13, x21 - adcs x14, x14, x20 - adcs x15, x15, x20 - adcs x16, x16, x20 - adcs x17, x17, x20 - adc x19, x19, x20 - subs x24, x4, x6 - cneg x24, x24, cc - csetm x20, cc - subs x21, x10, x8 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x15, x15, x22 - eor x21, x21, x20 - adcs x16, x16, x21 - adcs x17, x17, x20 - adc x19, x19, x20 - subs x24, x3, x5 - cneg x24, x24, cc - csetm x20, cc - subs x21, x9, x7 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x13, x13, x22 - eor x21, x21, x20 - adcs x14, x14, x21 - adcs x15, x15, x20 - adcs x16, x16, x20 - adcs x17, x17, x20 - adc x19, x19, x20 - subs x24, x3, x6 - cneg x24, x24, cc - csetm x20, cc - subs x21, x10, x7 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x14, x14, x22 - eor x21, x21, x20 - adcs x15, x15, x21 - adcs x16, x16, x20 - adcs x17, x17, x20 - adc x19, x19, x20 - subs x24, x4, x5 - cneg x24, x24, cc - csetm x20, cc - subs x21, x9, x8 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x14, x14, x22 - eor x21, x21, x20 - adcs x15, x15, x21 - adcs x16, x16, x20 - adcs x17, x17, x20 - adc x19, x19, x20 - ldp x22, x21, [x1] - subs x3, x3, x22 - sbcs x4, x4, x21 - ldp x22, x21, [x1, #16] - sbcs x5, x5, x22 - sbcs x6, x6, x21 - csetm x24, cc - stp x11, x12, [x0, #64] - ldp x22, x21, [x2] - subs x7, x22, x7 - sbcs x8, x21, x8 - ldp x22, x21, [x2, #16] - sbcs x9, x22, x9 - sbcs x10, x21, x10 - csetm x1, cc - stp x13, x14, [x0, #80] - eor x3, x3, x24 - subs x3, x3, x24 - eor x4, x4, x24 - sbcs x4, x4, x24 - eor x5, x5, x24 - sbcs x5, x5, x24 - eor x6, x6, x24 - sbc x6, x6, x24 - stp x15, x16, [x0, #96] - eor x7, x7, x1 - subs x7, x7, x1 - eor x8, x8, x1 - sbcs x8, x8, x1 - eor x9, x9, x1 - sbcs x9, x9, x1 - eor x10, x10, x1 - sbc x10, x10, x1 - stp x17, x19, [x0, #112] - eor x1, x1, x24 - mul x11, x3, x7 - mul x15, x4, x8 - mul x16, x5, x9 - mul x17, x6, x10 - umulh x19, x3, x7 - adds x15, x15, x19 - umulh x19, x4, x8 - adcs x16, x16, x19 - umulh x19, x5, x9 - adcs x17, x17, x19 - umulh x19, x6, x10 - adc x19, x19, xzr - adds x12, x15, x11 - adcs x15, x16, x15 - adcs x16, x17, x16 - adcs x17, x19, x17 - adc x19, xzr, x19 - adds x13, x15, x11 - adcs x14, x16, x12 - adcs x15, x17, x15 - adcs x16, x19, x16 - adcs x17, xzr, x17 - adc x19, xzr, x19 - subs x24, x5, x6 - cneg x24, x24, cc - csetm x20, cc - subs x21, x10, x9 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x16, x16, x22 - eor x21, x21, x20 - adcs x17, x17, x21 - adc x19, x19, x20 - subs x24, x3, x4 - cneg x24, x24, cc - csetm x20, cc - subs x21, x8, x7 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x12, x12, x22 - eor x21, x21, x20 - adcs x13, x13, x21 - adcs x14, x14, x20 - adcs x15, x15, x20 - adcs x16, x16, x20 - adcs x17, x17, x20 - adc x19, x19, x20 - subs x24, x4, x6 - cneg x24, x24, cc - csetm x20, cc - subs x21, x10, x8 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x15, x15, x22 - eor x21, x21, x20 - adcs x16, x16, x21 - adcs x17, x17, x20 - adc x19, x19, x20 - subs x24, x3, x5 - cneg x24, x24, cc - csetm x20, cc - subs x21, x9, x7 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x13, x13, x22 - eor x21, x21, x20 - adcs x14, x14, x21 - adcs x15, x15, x20 - adcs x16, x16, x20 - adcs x17, x17, x20 - adc x19, x19, x20 - subs x24, x3, x6 - cneg x24, x24, cc - csetm x20, cc - subs x21, x10, x7 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x14, x14, x22 - eor x21, x21, x20 - adcs x15, x15, x21 - adcs x16, x16, x20 - adcs x17, x17, x20 - adc x19, x19, x20 - subs x24, x4, x5 - cneg x24, x24, cc - csetm x20, cc - subs x21, x9, x8 - cneg x21, x21, cc - mul x22, x24, x21 - umulh x21, x24, x21 - cinv x20, x20, cc - cmn x20, #0x1 - eor x22, x22, x20 - adcs x14, x14, x22 - eor x21, x21, x20 - adcs x15, x15, x21 - adcs x16, x16, x20 - adcs x17, x17, x20 - adc x19, x19, x20 - ldp x3, x4, [x0] - ldp x7, x8, [x0, #64] - adds x3, x3, x7 - adcs x4, x4, x8 - ldp x5, x6, [x0, #16] - ldp x9, x10, [x0, #80] - adcs x5, x5, x9 - adcs x6, x6, x10 - ldp x20, x21, [x0, #96] - adcs x7, x7, x20 - adcs x8, x8, x21 - ldp x22, x23, [x0, #112] - adcs x9, x9, x22 - adcs x10, x10, x23 - adcs x24, x1, xzr - adc x2, x1, xzr - cmn x1, #0x1 - eor x11, x11, x1 - adcs x3, x11, x3 - eor x12, x12, x1 - adcs x4, x12, x4 - eor x13, x13, x1 - adcs x5, x13, x5 - eor x14, x14, x1 - adcs x6, x14, x6 - eor x15, x15, x1 - adcs x7, x15, x7 - eor x16, x16, x1 - adcs x8, x16, x8 - eor x17, x17, x1 - adcs x9, x17, x9 - eor x19, x19, x1 - adcs x10, x19, x10 - adcs x20, x20, x24 - adcs x21, x21, x2 - adcs x22, x22, x2 - adc x23, x23, x2 - stp x3, x4, [x0, #32] - stp x5, x6, [x0, #48] - stp x7, x8, [x0, #64] - stp x9, x10, [x0, #80] - stp x20, x21, [x0, #96] - stp x22, x23, [x0, #112] - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_8_16) - diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_8_16_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_8_16_alt.S deleted file mode 100644 index bcb57de4f63..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_mul_8_16_alt.S +++ /dev/null @@ -1,412 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[8], y[8]; output z[16] -// -// extern void bignum_mul_8_16_alt(uint64_t z[static 16], -// const uint64_t x[static 8], -// const uint64_t y[static 8]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_8_16_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_8_16_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_8_16_alt) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 - -// These are repeated mod 2 as we load paris of inputs - -#define a0 x3 -#define a1 x4 -#define a2 x3 -#define a3 x4 -#define a4 x3 -#define a5 x4 -#define a6 x3 -#define a7 x4 - -#define b0 x5 -#define b1 x6 -#define b2 x7 -#define b3 x8 -#define b4 x9 -#define b5 x10 -#define b6 x11 -#define b7 x12 - -#define t x13 - -// These repeat mod 10 as we write back - -#define u0 x14 -#define u1 x15 -#define u2 x16 -#define u3 x17 -#define u4 x19 -#define u5 x20 -#define u6 x21 -#define u7 x22 -#define u8 x23 -#define u9 x24 -#define u10 x14 -#define u11 x15 -#define u12 x16 -#define u13 x17 -#define u14 x19 -#define u15 x20 - -S2N_BN_SYMBOL(bignum_mul_8_16_alt): - CFI_START - -// Save more registers - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - -// Load operands and set up row 0 = [u8;...;u0] = a0 * [b7;...;b0] - - ldp a0, a1, [x] - ldp b0, b1, [y] - - mul u0, a0, b0 - umulh u1, a0, b0 - mul t, a0, b1 - umulh u2, a0, b1 - adds u1, u1, t - - ldp b2, b3, [y, #16] - - mul t, a0, b2 - umulh u3, a0, b2 - adcs u2, u2, t - - mul t, a0, b3 - umulh u4, a0, b3 - adcs u3, u3, t - - ldp b4, b5, [y, #32] - - mul t, a0, b4 - umulh u5, a0, b4 - adcs u4, u4, t - - mul t, a0, b5 - umulh u6, a0, b5 - adcs u5, u5, t - - ldp b6, b7, [y, #48] - - mul t, a0, b6 - umulh u7, a0, b6 - adcs u6, u6, t - - mul t, a0, b7 - umulh u8, a0, b7 - adcs u7, u7, t - - adc u8, u8, xzr - -// Row 1 = [u9;...;u0] = [a1;a0] * [b7;...;b0] - - mul t, a1, b0 - adds u1, u1, t - mul t, a1, b1 - adcs u2, u2, t - mul t, a1, b2 - adcs u3, u3, t - mul t, a1, b3 - adcs u4, u4, t - mul t, a1, b4 - adcs u5, u5, t - mul t, a1, b5 - adcs u6, u6, t - mul t, a1, b6 - adcs u7, u7, t - mul t, a1, b7 - adcs u8, u8, t - cset u9, cs - - umulh t, a1, b0 - adds u2, u2, t - umulh t, a1, b1 - adcs u3, u3, t - umulh t, a1, b2 - adcs u4, u4, t - umulh t, a1, b3 - adcs u5, u5, t - umulh t, a1, b4 - adcs u6, u6, t - umulh t, a1, b5 - adcs u7, u7, t - umulh t, a1, b6 - adcs u8, u8, t - umulh t, a1, b7 - adc u9, u9, t - - stp u0, u1, [z] - -// Row 2 = [u10;...;u0] = [a2;a1;a0] * [b7;...;b0] - - ldp a2, a3, [x, #16] - - mul t, a2, b0 - adds u2, u2, t - mul t, a2, b1 - adcs u3, u3, t - mul t, a2, b2 - adcs u4, u4, t - mul t, a2, b3 - adcs u5, u5, t - mul t, a2, b4 - adcs u6, u6, t - mul t, a2, b5 - adcs u7, u7, t - mul t, a2, b6 - adcs u8, u8, t - mul t, a2, b7 - adcs u9, u9, t - cset u10, cs - - umulh t, a2, b0 - adds u3, u3, t - umulh t, a2, b1 - adcs u4, u4, t - umulh t, a2, b2 - adcs u5, u5, t - umulh t, a2, b3 - adcs u6, u6, t - umulh t, a2, b4 - adcs u7, u7, t - umulh t, a2, b5 - adcs u8, u8, t - umulh t, a2, b6 - adcs u9, u9, t - umulh t, a2, b7 - adc u10, u10, t - -// Row 3 = [u11;...;u0] = [a3;a2;a1;a0] * [b7;...;b0] - - mul t, a3, b0 - adds u3, u3, t - mul t, a3, b1 - adcs u4, u4, t - mul t, a3, b2 - adcs u5, u5, t - mul t, a3, b3 - adcs u6, u6, t - mul t, a3, b4 - adcs u7, u7, t - mul t, a3, b5 - adcs u8, u8, t - mul t, a3, b6 - adcs u9, u9, t - mul t, a3, b7 - adcs u10, u10, t - cset u11, cs - - umulh t, a3, b0 - adds u4, u4, t - umulh t, a3, b1 - adcs u5, u5, t - umulh t, a3, b2 - adcs u6, u6, t - umulh t, a3, b3 - adcs u7, u7, t - umulh t, a3, b4 - adcs u8, u8, t - umulh t, a3, b5 - adcs u9, u9, t - umulh t, a3, b6 - adcs u10, u10, t - umulh t, a3, b7 - adc u11, u11, t - - stp u2, u3, [z, #16] - -// Row 4 = [u12;...;u0] = [a4;a3;a2;a1;a0] * [b7;...;b0] - - ldp a4, a5, [x, #32] - - mul t, a4, b0 - adds u4, u4, t - mul t, a4, b1 - adcs u5, u5, t - mul t, a4, b2 - adcs u6, u6, t - mul t, a4, b3 - adcs u7, u7, t - mul t, a4, b4 - adcs u8, u8, t - mul t, a4, b5 - adcs u9, u9, t - mul t, a4, b6 - adcs u10, u10, t - mul t, a4, b7 - adcs u11, u11, t - cset u12, cs - - umulh t, a4, b0 - adds u5, u5, t - umulh t, a4, b1 - adcs u6, u6, t - umulh t, a4, b2 - adcs u7, u7, t - umulh t, a4, b3 - adcs u8, u8, t - umulh t, a4, b4 - adcs u9, u9, t - umulh t, a4, b5 - adcs u10, u10, t - umulh t, a4, b6 - adcs u11, u11, t - umulh t, a4, b7 - adc u12, u12, t - -// Row 5 = [u13;...;u0] = [a5;a4;a3;a2;a1;a0] * [b7;...;b0] - - mul t, a5, b0 - adds u5, u5, t - mul t, a5, b1 - adcs u6, u6, t - mul t, a5, b2 - adcs u7, u7, t - mul t, a5, b3 - adcs u8, u8, t - mul t, a5, b4 - adcs u9, u9, t - mul t, a5, b5 - adcs u10, u10, t - mul t, a5, b6 - adcs u11, u11, t - mul t, a5, b7 - adcs u12, u12, t - cset u13, cs - - umulh t, a5, b0 - adds u6, u6, t - umulh t, a5, b1 - adcs u7, u7, t - umulh t, a5, b2 - adcs u8, u8, t - umulh t, a5, b3 - adcs u9, u9, t - umulh t, a5, b4 - adcs u10, u10, t - umulh t, a5, b5 - adcs u11, u11, t - umulh t, a5, b6 - adcs u12, u12, t - umulh t, a5, b7 - adc u13, u13, t - - stp u4, u5, [z, #32] - -// Row 6 = [u14;...;u0] = [a6;a5;a4;a3;a2;a1;a0] * [b7;...;b0] - - ldp a6, a7, [x, #48] - - mul t, a6, b0 - adds u6, u6, t - mul t, a6, b1 - adcs u7, u7, t - mul t, a6, b2 - adcs u8, u8, t - mul t, a6, b3 - adcs u9, u9, t - mul t, a6, b4 - adcs u10, u10, t - mul t, a6, b5 - adcs u11, u11, t - mul t, a6, b6 - adcs u12, u12, t - mul t, a6, b7 - adcs u13, u13, t - cset u14, cs - - umulh t, a6, b0 - adds u7, u7, t - umulh t, a6, b1 - adcs u8, u8, t - umulh t, a6, b2 - adcs u9, u9, t - umulh t, a6, b3 - adcs u10, u10, t - umulh t, a6, b4 - adcs u11, u11, t - umulh t, a6, b5 - adcs u12, u12, t - umulh t, a6, b6 - adcs u13, u13, t - umulh t, a6, b7 - adc u14, u14, t - -// Row 7 = [u15;...;u0] = [a7;a6;a5;a4;a3;a2;a1;a0] * [b7;...;b0] - - mul t, a7, b0 - adds u7, u7, t - mul t, a7, b1 - adcs u8, u8, t - mul t, a7, b2 - adcs u9, u9, t - mul t, a7, b3 - adcs u10, u10, t - mul t, a7, b4 - adcs u11, u11, t - mul t, a7, b5 - adcs u12, u12, t - mul t, a7, b6 - adcs u13, u13, t - mul t, a7, b7 - adcs u14, u14, t - cset u15, cs - - umulh t, a7, b0 - adds u8, u8, t - umulh t, a7, b1 - adcs u9, u9, t - umulh t, a7, b2 - adcs u10, u10, t - umulh t, a7, b3 - adcs u11, u11, t - umulh t, a7, b4 - adcs u12, u12, t - umulh t, a7, b5 - adcs u13, u13, t - umulh t, a7, b6 - adcs u14, u14, t - umulh t, a7, b7 - adc u15, u15, t - - stp u6, u7, [z, #48] - -// Store back remaining digits of final result - - stp u8, u9, [z, #64] - stp u10, u11, [z, #80] - stp u12, u13, [z, #96] - stp u14, u15, [z, #112] - -// Restore registers - - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_8_16_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_4_8.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_4_8.S deleted file mode 100644 index 6b31dae4233..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_4_8.S +++ /dev/null @@ -1,149 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[4]; output z[8] -// -// extern void bignum_sqr_4_8(uint64_t z[static 8], const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_4_8) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_4_8) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_4_8) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// 2x2 squaring macro: [s3;s2;s1;s0] := [a1;a0]^2 with t0,t1,t2 temporaries -// This uses 32x32->64 multiplications to reduce the number of UMULHs -// --------------------------------------------------------------------------- - -#define sqr2(s3,s2,s1,s0, a1,a1short,a0,a0short, t2,t1,t0,t0short) \ - umull s0, a0short, a0short __LF \ - lsr t0, a0, #32 __LF \ - umull s1, t0short, t0short __LF \ - umull t0, a0short, t0short __LF \ - adds s0, s0, t0, lsl #33 __LF \ - lsr t0, t0, #31 __LF \ - adc s1, s1, t0 __LF \ - umull s2, a1short, a1short __LF \ - lsr t0, a1, #32 __LF \ - umull s3, t0short, t0short __LF \ - umull t0, a1short, t0short __LF \ - mul t1, a0, a1 __LF \ - umulh t2, a0, a1 __LF \ - adds s2, s2, t0, lsl #33 __LF \ - lsr t0, t0, #31 __LF \ - adc s3, s3, t0 __LF \ - adds t1, t1, t1 __LF \ - adcs t2, t2, t2 __LF \ - adc s3, s3, xzr __LF \ - adds s1, s1, t1 __LF \ - adcs s2, s2, t2 __LF \ - adc s3, s3, xzr - -// Main code - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 - -#define s0 x6 -#define s1 x7 -#define s2 x8 -#define s3 x9 -#define s4 x10 -#define s5 x11 -#define s6 x12 -#define s7 x13 - -#define d0 x14 -#define d1 x15 -#define d2 x16 - -// Short versions - -#define a0short w2 -#define a1short w3 -#define a2short w4 -#define a3short w5 -#define d2short w16 -#define s3short w9 - -S2N_BN_SYMBOL(bignum_sqr_4_8): - CFI_START - -// Load all the elements - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - -// Compute L = [s3;s2;s1;s0] = square of lower half - - sqr2(s3,s2,s1,s0, a1,a1short,a0,a0short, d0,d1,d2,d2short) - -// Compute H = [s7;s6;s5;s4] = square of upper half - - sqr2(s7,s6,s5,s4, a3,a3short,a2,a2short, d0,d1,d2,d2short) - -// Let [a1;a0] = |[a3;a2] - [a1;a0]| be the absolute difference - - subs a0, a0, a2 - sbcs a1, a1, a3 - csetm d0, cc - eor a0, a0, d0 - subs a0, a0, d0 - eor a1, a1, d0 - sbc a1, a1, d0 - -// Form H' = H + L_hi (which fits in 4 words) - - adds s4, s4, s2 - adcs s5, s5, s3 - adcs s6, s6, xzr - adc s7, s7, xzr - -// Let M = [d2;d1;a3;a2] = ([a3;a2] - [a1;a0])^2 - - sqr2(d2,d1,a3,a2, a1,a1short,a0,a0short, d0,s2,s3,s3short) - -// Now form (2^64 + 1) * (H'::L), with a bit of carry-shortening - - adds s2, s0, s4 - adcs s3, s1, s5 - adcs s4, s4, s6 - adcs s5, s5, s7 - csetm d0, cc - -// Subtract the middle term M - - subs s2, s2, a2 - sbcs s3, s3, a3 - sbcs s4, s4, d1 - sbcs s5, s5, d2 - adcs s6, s6, d0 - adc s7, s7, d0 - -// Store back - - stp s0, s1, [z] - stp s2, s3, [z, 16] - stp s4, s5, [z, 32] - stp s6, s7, [z, 48] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_4_8) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_4_8_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_4_8_alt.S deleted file mode 100644 index d3699d3f058..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_4_8_alt.S +++ /dev/null @@ -1,128 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[4]; output z[8] -// -// extern void bignum_sqr_4_8_alt(uint64_t z[static 8], -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_4_8_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_4_8_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_4_8_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 - -#define l x6 -#define h x7 - -#define u0 x8 -#define u1 x9 -#define u2 x10 -#define u3 x11 -#define u4 x12 -#define u5 x13 -#define u6 x14 - -// This one is the same as h, which is safe with this computation sequence - -#define u7 h - -S2N_BN_SYMBOL(bignum_sqr_4_8_alt): - CFI_START - -// Load all the elements, set up an initial window [u6;...u1] = [23;03;01] -// and chain in the addition of 02 + 12 + 13 (no carry-out is possible). -// This gives all the "heterogeneous" terms of the squaring ready to double - - ldp a0, a1, [x] - - mul u1, a0, a1 - umulh u2, a0, a1 - - ldp a2, a3, [x, #16] - - mul u3, a0, a3 - umulh u4, a0, a3 - - mul l, a0, a2 - umulh h, a0, a2 - adds u2, u2, l - - adcs u3, u3, h - mul l, a1, a2 - umulh h, a1, a2 - adc h, h, xzr - adds u3, u3, l - - mul u5, a2, a3 - umulh u6, a2, a3 - - adcs u4, u4, h - mul l, a1, a3 - umulh h, a1, a3 - adc h, h, xzr - adds u4, u4, l - - adcs u5, u5, h - adc u6, u6, xzr - -// Now just double it; this simple approach seems to work better than extr - - adds u1, u1, u1 - adcs u2, u2, u2 - adcs u3, u3, u3 - adcs u4, u4, u4 - adcs u5, u5, u5 - adcs u6, u6, u6 - cset u7, cs - -// Add the homogeneous terms 00 + 11 + 22 + 33 - - umulh l, a0, a0 - mul u0, a0, a0 - adds u1, u1, l - - mul l, a1, a1 - adcs u2, u2, l - umulh l, a1, a1 - adcs u3, u3, l - - mul l, a2, a2 - adcs u4, u4, l - umulh l, a2, a2 - adcs u5, u5, l - - mul l, a3, a3 - adcs u6, u6, l - umulh l, a3, a3 - adc u7, u7, l - -// Store back final result - - stp u0, u1, [z] - stp u2, u3, [z, #16] - stp u4, u5, [z, #32] - stp u6, u7, [z, #48] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_4_8_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_6_12.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_6_12.S deleted file mode 100644 index 2676f0b83fe..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_6_12.S +++ /dev/null @@ -1,266 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[6]; output z[12] -// -// extern void bignum_sqr_6_12(uint64_t z[static 12], const uint64_t x[static 6]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_6_12) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_6_12) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_6_12) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro returning (c,h,l) = 3-word 1s complement (x - y) * (w - z) -// c,h,l,t should all be different -// t,h should not overlap w,z -// --------------------------------------------------------------------------- - -.macro muldiffn c,h,l, t, x,y, w,z - subs \t, \x, \y - cneg \t, \t, cc - csetm \c, cc - subs \h, \w, \z - cneg \h, \h, cc - mul \l, \t, \h - umulh \h, \t, \h - cinv \c, \c, cc - eor \l, \l, \c - eor \h, \h, \c -.endm - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 -#define a4 x6 -#define a5 x7 - -#define c0 x8 -#define c1 x9 -#define c2 x10 -#define c3 x11 -#define c4 x12 -#define c5 x13 -#define d1 x14 -#define d2 x15 -#define d3 x16 -#define d4 x17 - -S2N_BN_SYMBOL(bignum_sqr_6_12): - CFI_START - -// Load in all words of the input - - ldp a0, a1, [x1] - ldp a2, a3, [x1, #16] - ldp a4, a5, [x1, #32] - -// Square the low half - - mul d1, a0, a1 - mul d2, a0, a2 - mul d3, a1, a2 - mul c0, a0, a0 - str c0, [x0] - mul c2, a1, a1 - mul c4, a2, a2 - - umulh d4, a0, a1 - adds d2, d2, d4 - umulh d4, a0, a2 - adcs d3, d3, d4 - umulh d4, a1, a2 - adcs d4, d4, xzr - - umulh c1, a0, a0 - umulh c3, a1, a1 - umulh c5, a2, a2 - - adds d1, d1, d1 - adcs d2, d2, d2 - adcs d3, d3, d3 - adcs d4, d4, d4 - adc c5, c5, xzr - - adds c1, c1, d1 - str c1, [x0,#8] - adcs c2, c2, d2 - str c2, [x0,#16] - adcs c3, c3, d3 - str c3, [x0,#24] - adcs c4, c4, d4 - str c4, [x0,#32] - adc c5, c5, xzr - str c5, [x0,#40] - -// Square the high half - - mul d1, a3, a4 - mul d2, a3, a5 - mul d3, a4, a5 - mul c0, a3, a3 - str c0, [x0,#48] - mul c2, a4, a4 - mul c4, a5, a5 - - umulh d4, a3, a4 - adds d2, d2, d4 - umulh d4, a3, a5 - adcs d3, d3, d4 - umulh d4, a4, a5 - adcs d4, d4, xzr - - umulh c1, a3, a3 - umulh c3, a4, a4 - umulh c5, a5, a5 - - adds d1, d1, d1 - adcs d2, d2, d2 - adcs d3, d3, d3 - adcs d4, d4, d4 - adc c5, c5, xzr - - adds c1, c1, d1 - str c1, [x0,#56] - adcs c2, c2, d2 - str c2, [x0,#64] - adcs c3, c3, d3 - str c3, [x0,#72] - adcs c4, c4, d4 - str c4, [x0,#80] - adc c5, c5, xzr - str c5, [x0,#88] - -// Compute product of the cross-term with ADK 3x3->6 multiplier - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 -#define a4 x6 -#define a5 x7 -#define s0 x8 -#define s1 x9 -#define s2 x10 -#define s3 x11 -#define s4 x12 -#define s5 x13 - -#define l1 x14 -#define l2 x15 -#define h0 x16 -#define h1 x17 -#define h2 x13 - -#define s6 h1 -#define c l1 -#define h l2 -#define l h0 -#define t h1 - - mul s0, a0, a3 - mul l1, a1, a4 - mul l2, a2, a5 - umulh h0, a0, a3 - umulh h1, a1, a4 - umulh h2, a2, a5 - - adds h0, h0, l1 - adcs h1, h1, l2 - adc h2, h2, xzr - - adds s1, h0, s0 - adcs s2, h1, h0 - adcs s3, h2, h1 - adc s4, h2, xzr - - adds s2, s2, s0 - adcs s3, s3, h0 - adcs s4, s4, h1 - adc s5, h2, xzr - - muldiffn c,h,l, t, a0,a1, a4,a3 - adds xzr, c, #1 - adcs s1, s1, l - adcs s2, s2, h - adcs s3, s3, c - adcs s4, s4, c - adc s5, s5, c - - muldiffn c,h,l, t, a0,a2, a5,a3 - adds xzr, c, #1 - adcs s2, s2, l - adcs s3, s3, h - adcs s4, s4, c - adc s5, s5, c - - muldiffn c,h,l, t, a1,a2, a5,a4 - adds xzr, c, #1 - adcs s3, s3, l - adcs s4, s4, h - adc s5, s5, c - -// Double it, catching the carry - - adds s0, s0, s0 - adcs s1, s1, s1 - adcs s2, s2, s2 - adcs s3, s3, s3 - adcs s4, s4, s4 - adcs s5, s5, s5 - adc s6, xzr, xzr - -// Finally, add it into the term - - ldr a0, [x0, #24] - adds a0, a0, s0 - str a0, [x0, #24] - - ldr a0, [x0, #32] - adcs a0, a0, s1 - str a0, [x0, #32] - - ldr a0, [x0, #40] - adcs a0, a0, s2 - str a0, [x0, #40] - - ldr a0, [x0, #48] - adcs a0, a0, s3 - str a0, [x0, #48] - - ldr a0, [x0, #56] - adcs a0, a0, s4 - str a0, [x0, #56] - - ldr a0, [x0, #64] - adcs a0, a0, s5 - str a0, [x0, #64] - - ldr a0, [x0, #72] - adcs a0, a0, s6 - str a0, [x0, #72] - - ldr a0, [x0, #80] - adcs a0, a0, xzr - str a0, [x0, #80] - - ldr a0, [x0, #88] - adc a0, a0, xzr - str a0, [x0, #88] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_6_12) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_6_12_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_6_12_alt.S deleted file mode 100644 index ada540835dc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_6_12_alt.S +++ /dev/null @@ -1,198 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[6]; output z[12] -// -// extern void bignum_sqr_6_12_alt(uint64_t z[static 12], -// const uint64_t x[static 6]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_6_12_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_6_12_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_6_12_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 -#define a4 x6 -#define a5 x7 - -#define l x8 - -#define u0 x2 // The same as a0, which is safe -#define u1 x9 -#define u2 x10 -#define u3 x11 -#define u4 x12 -#define u5 x13 -#define u6 x14 -#define u7 x15 -#define u8 x16 -#define u9 x17 -#define u10 x19 -#define u11 x20 - -S2N_BN_SYMBOL(bignum_sqr_6_12_alt): - CFI_START - -// It's convenient to have two more registers to play with - - CFI_PUSH2(x19,x20) - -// Load all the elements as [a5;a4;a3;a2;a1;a0], set up an initial -// window [u8;u7; u6;u5; u4;u3; u2;u1] = [34;05;03;01], and then -// chain in the addition of 02 + 12 + 13 + 14 + 15 to that window -// (no carry-out possible since we add it to the top of a product). - - ldp a0, a1, [x] - - mul u1, a0, a1 - umulh u2, a0, a1 - - ldp a2, a3, [x, #16] - - mul l, a0, a2 - adds u2, u2, l - - mul u3, a0, a3 - mul l, a1, a2 - adcs u3, u3, l - - umulh u4, a0, a3 - mul l, a1, a3 - adcs u4, u4, l - - ldp a4, a5, [x, #32] - - mul u5, a0, a5 - mul l, a1, a4 - adcs u5, u5, l - - umulh u6, a0, a5 - mul l, a1, a5 - adcs u6, u6, l - - mul u7, a3, a4 - adcs u7, u7, xzr - - umulh u8, a3, a4 - adc u8, u8, xzr - - umulh l, a0, a2 - adds u3, u3, l - umulh l, a1, a2 - adcs u4, u4, l - umulh l, a1, a3 - adcs u5, u5, l - umulh l, a1, a4 - adcs u6, u6, l - umulh l, a1, a5 - adcs u7, u7, l - adc u8, u8, xzr - -// Now chain in the 04 + 23 + 24 + 25 + 35 + 45 terms - - mul l, a0, a4 - adds u4, u4, l - mul l, a2, a3 - adcs u5, u5, l - mul l, a2, a4 - adcs u6, u6, l - mul l, a2, a5 - adcs u7, u7, l - mul l, a3, a5 - adcs u8, u8, l - mul u9, a4, a5 - adcs u9, u9, xzr - umulh u10, a4, a5 - adc u10, u10, xzr - - umulh l, a0, a4 - adds u5, u5, l - umulh l, a2, a3 - adcs u6, u6, l - umulh l, a2, a4 - adcs u7, u7, l - umulh l, a2, a5 - adcs u8, u8, l - umulh l, a3, a5 - adcs u9, u9, l - adc u10, u10, xzr - -// Double that, with h holding the top carry - - adds u1, u1, u1 - adcs u2, u2, u2 - adcs u3, u3, u3 - adcs u4, u4, u4 - adcs u5, u5, u5 - adcs u6, u6, u6 - adcs u7, u7, u7 - adcs u8, u8, u8 - adcs u9, u9, u9 - adcs u10, u10, u10 - cset u11, cs - -// Add the homogeneous terms 00 + 11 + 22 + 33 + 44 + 55 - - umulh l, a0, a0 - mul u0, a0, a0 - adds u1, u1, l - - mul l, a1, a1 - adcs u2, u2, l - umulh l, a1, a1 - adcs u3, u3, l - - mul l, a2, a2 - adcs u4, u4, l - umulh l, a2, a2 - adcs u5, u5, l - - mul l, a3, a3 - adcs u6, u6, l - umulh l, a3, a3 - adcs u7, u7, l - - mul l, a4, a4 - adcs u8, u8, l - umulh l, a4, a4 - adcs u9, u9, l - - mul l, a5, a5 - adcs u10, u10, l - umulh l, a5, a5 - adc u11, u11, l - -// Store back final result - - stp u0, u1, [z] - stp u2, u3, [z, #16] - stp u4, u5, [z, #32] - stp u6, u7, [z, #48] - stp u8, u9, [z, #64] - stp u10, u11, [z, #80] - -// Restore registers and return - - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_6_12_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_8_16.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_8_16.S deleted file mode 100644 index fe8fe893377..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_8_16.S +++ /dev/null @@ -1,428 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[8]; output z[16] -// -// extern void bignum_sqr_8_16(uint64_t z[static 16], const uint64_t x[static 8]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_8_16) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_8_16) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_8_16) - .text - .balign 4 - - -S2N_BN_SYMBOL(bignum_sqr_8_16): - CFI_START - -// Save registers - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - -// Load registers. - ldp x2, x3, [x1] -ldr q20, [x1] - ldp x4, x5, [x1, #16] -ldr q21, [x1, #16] - ldp x6, x7, [x1, #32] -ldr q22, [x1, #32] - ldp x8, x9, [x1, #48] -ldr q23, [x1, #48] -movi v30.2d, #0xffffffff - - mul x17, x2, x4 - mul x14, x3, x5 - -// Scalar+NEON: square the lower half with a near-clone of bignum_sqr_4_8 -// NEON: prepare 64x64->128 squaring of two 64-bit ints (x2, x3) -ext v1.16b, v20.16b, v20.16b, #8 - umulh x20, x2, x4 -shrn v2.2s, v20.2d, #32 - subs x21, x2, x3 -zip1 v0.2s, v20.2s, v1.2s - cneg x21, x21, cc // cc = lo, ul, last -umull v5.2d, v2.2s, v2.2s - csetm x11, cc // cc = lo, ul, last -umull v6.2d, v2.2s, v0.2s - subs x12, x5, x4 -umull v3.2d, v0.2s, v0.2s - cneg x12, x12, cc // cc = lo, ul, last -mov v1.16b, v6.16b - mul x13, x21, x12 -usra v1.2d, v3.2d, #32 - umulh x12, x21, x12 -and v4.16b, v1.16b, v30.16b - cinv x11, x11, cc // cc = lo, ul, last -add v4.2d, v4.2d, v6.2d - eor x13, x13, x11 -usra v5.2d, v4.2d, #32 - eor x12, x12, x11 -sli v3.2d, v4.2d, #32 - adds x19, x17, x20 -usra v5.2d, v1.2d, #32 - adc x20, x20, xzr - // NEON: prepare 64x64->128 squaring of two 64-bit ints (x4, x5) - ext v1.16b, v21.16b, v21.16b, #8 - umulh x21, x3, x5 - shrn v2.2s, v21.2d, #32 - adds x19, x19, x14 - zip1 v0.2s, v21.2s, v1.2s - adcs x20, x20, x21 - adc x21, x21, xzr - adds x20, x20, x14 - adc x21, x21, xzr - cmn x11, #0x1 - adcs x19, x19, x13 -mov x13, v3.d[1] // mul x13, x3, x3 - adcs x20, x20, x12 -mov x14, v5.d[1] // umulh x14, x3, x3 - adc x21, x21, x11 -mov x12, v3.d[0] // mul x12, x2, x2 - adds x17, x17, x17 -mov x11, v5.d[0] // umulh x11, x2, x2 - adcs x19, x19, x19 - umull v5.2d, v2.2s, v2.2s - adcs x20, x20, x20 - umull v6.2d, v2.2s, v0.2s - adcs x21, x21, x21 - umull v3.2d, v0.2s, v0.2s - adc x10, xzr, xzr - mov v1.16b, v6.16b - - mul x15, x2, x3 - usra v1.2d, v3.2d, #32 - umulh x16, x2, x3 - and v4.16b, v1.16b, v30.16b - adds x11, x11, x15 - add v4.2d, v4.2d, v6.2d - adcs x13, x13, x16 - usra v5.2d, v4.2d, #32 - adc x14, x14, xzr - sli v3.2d, v4.2d, #32 - adds x11, x11, x15 - usra v5.2d, v1.2d, #32 - adcs x13, x13, x16 - adc x14, x14, xzr - stp x12, x11, [x0] - mov x11, v5.d[0] // umulh x11, x4, x4 - adds x17, x17, x13 - mov x13, v3.d[1] // mul x13, x5, x5 - adcs x19, x19, x14 - mov x14, v5.d[1] // umulh x14, x5, x5 - adcs x20, x20, xzr - mov x12, v3.d[0] // mul x12, x4, x4 - adcs x21, x21, xzr -// NEON: prepare muls in the upper half -ext v1.16b, v22.16b, v22.16b, #8 - adc x10, x10, xzr -shrn v2.2s, v22.2d, #32 - stp x17, x19, [x0, #16] -zip1 v0.2s, v22.2s, v1.2s - mul x15, x4, x5 -umull v5.2d, v2.2s, v2.2s - umulh x16, x4, x5 -umull v6.2d, v2.2s, v0.2s - adds x11, x11, x15 -umull v3.2d, v0.2s, v0.2s - adcs x13, x13, x16 -mov v1.16b, v6.16b - adc x14, x14, xzr -usra v1.2d, v3.2d, #32 - adds x11, x11, x15 -and v4.16b, v1.16b, v30.16b - adcs x13, x13, x16 -add v4.2d, v4.2d, v6.2d - adc x14, x14, xzr -usra v5.2d, v4.2d, #32 - adds x12, x12, x20 -sli v3.2d, v4.2d, #32 - adcs x11, x11, x21 -usra v5.2d, v1.2d, #32 - stp x12, x11, [x0, #32] - // NEON: prepare muls in the upper half - ext v1.16b, v23.16b, v23.16b, #8 - adcs x13, x13, x10 - shrn v2.2s, v23.2d, #32 - adc x14, x14, xzr - zip1 v0.2s, v23.2s, v1.2s - stp x13, x14, [x0, #48] - -// Scalar: square the upper half with a slight variant of the previous block - mul x17, x6, x8 - umull v16.2d, v2.2s, v2.2s - mul x14, x7, x9 - umull v6.2d, v2.2s, v0.2s - umulh x20, x6, x8 - umull v18.2d, v0.2s, v0.2s - subs x21, x6, x7 - cneg x21, x21, cc // cc = lo, ul, last - mov v1.16b, v6.16b - csetm x11, cc // cc = lo, ul, last - subs x12, x9, x8 - cneg x12, x12, cc // cc = lo, ul, last - usra v1.2d, v18.2d, #32 - mul x13, x21, x12 - and v4.16b, v1.16b, v30.16b - umulh x12, x21, x12 - add v4.2d, v4.2d, v6.2d - cinv x11, x11, cc // cc = lo, ul, last - eor x13, x13, x11 - eor x12, x12, x11 - usra v16.2d, v4.2d, #32 - adds x19, x17, x20 - adc x20, x20, xzr - sli v18.2d, v4.2d, #32 - umulh x21, x7, x9 - adds x19, x19, x14 - adcs x20, x20, x21 - adc x21, x21, xzr - adds x20, x20, x14 -mov x14, v5.d[1] - adc x21, x21, xzr - cmn x11, #0x1 - adcs x19, x19, x13 -mov x13, v3.d[1] - adcs x20, x20, x12 -mov x12, v3.d[0] - adc x21, x21, x11 -mov x11, v5.d[0] - adds x17, x17, x17 - adcs x19, x19, x19 - usra v16.2d, v1.2d, #32 - adcs x20, x20, x20 - adcs x21, x21, x21 - adc x10, xzr, xzr -// NEON: two mul+umulhs for the next stage -uzp2 v17.4s, v21.4s, v23.4s - mul x15, x6, x7 -xtn v4.2s, v23.2d - umulh x16, x6, x7 - mov x22, v16.d[0] - adds x11, x11, x15 - adcs x13, x13, x16 -xtn v5.2s, v21.2d - adc x14, x14, xzr - adds x11, x11, x15 -rev64 v1.4s, v21.4s - adcs x13, x13, x16 - adc x14, x14, xzr - stp x12, x11, [x0, #64] - adds x17, x17, x13 - mov x13, v18.d[1] - adcs x19, x19, x14 - mov x14, v16.d[1] - adcs x20, x20, xzr - mov x12, v18.d[0] - adcs x21, x21, xzr - adc x10, x10, xzr -umull v6.2d, v4.2s, v5.2s - stp x17, x19, [x0, #80] -umull v7.2d, v4.2s, v17.2s - mul x15, x8, x9 -uzp2 v16.4s, v23.4s, v23.4s - umulh x16, x8, x9 -mul v0.4s, v1.4s, v23.4s - adds x11, x22, x15 - adcs x13, x13, x16 -usra v7.2d, v6.2d, #32 - adc x14, x14, xzr - adds x11, x11, x15 -umull v1.2d, v16.2s, v17.2s - adcs x13, x13, x16 - adc x14, x14, xzr -uaddlp v0.2d, v0.4s - adds x12, x12, x20 - adcs x11, x11, x21 -and v2.16b, v7.16b, v30.16b -umlal v2.2d, v16.2s, v5.2s -shl v0.2d, v0.2d, #32 -usra v1.2d, v7.2d, #32 -umlal v0.2d, v4.2s, v5.2s -mov x16, v0.d[1] -mov x15, v0.d[0] -usra v1.2d, v2.2d, #32 -mov x20, v1.d[0] -mov x21, v1.d[1] - stp x12, x11, [x0, #96] - adcs x13, x13, x10 - adc x14, x14, xzr - stp x13, x14, [x0, #112] - -// Now get the cross-product in [s7,...,s0] and double it as [c,s7,...,s0] - - mul x10, x2, x6 - mul x14, x3, x7 - umulh x17, x2, x6 - adds x14, x14, x17 - umulh x17, x3, x7 - adcs x15, x15, x17 - adcs x16, x16, x20 - adc x17, x21, xzr - adds x11, x14, x10 - adcs x14, x15, x14 - adcs x15, x16, x15 - adcs x16, x17, x16 - adc x17, xzr, x17 - adds x12, x14, x10 - adcs x13, x15, x11 - adcs x14, x16, x14 - adcs x15, x17, x15 - adcs x16, xzr, x16 - adc x17, xzr, x17 - subs x22, x4, x5 - cneg x22, x22, cc // cc = lo, ul, last - csetm x19, cc // cc = lo, ul, last - subs x20, x9, x8 - cneg x20, x20, cc // cc = lo, ul, last - mul x21, x22, x20 - umulh x20, x22, x20 - cinv x19, x19, cc // cc = lo, ul, last - cmn x19, #0x1 - eor x21, x21, x19 - adcs x15, x15, x21 - eor x20, x20, x19 - adcs x16, x16, x20 - adc x17, x17, x19 - subs x22, x2, x3 - cneg x22, x22, cc // cc = lo, ul, last - csetm x19, cc // cc = lo, ul, last - subs x20, x7, x6 - cneg x20, x20, cc // cc = lo, ul, last - mul x21, x22, x20 - umulh x20, x22, x20 - cinv x19, x19, cc // cc = lo, ul, last - cmn x19, #0x1 - eor x21, x21, x19 - adcs x11, x11, x21 - eor x20, x20, x19 - adcs x12, x12, x20 - adcs x13, x13, x19 - adcs x14, x14, x19 - adcs x15, x15, x19 - adcs x16, x16, x19 - adc x17, x17, x19 - subs x22, x3, x5 - cneg x22, x22, cc // cc = lo, ul, last - csetm x19, cc // cc = lo, ul, last - subs x20, x9, x7 - cneg x20, x20, cc // cc = lo, ul, last - mul x21, x22, x20 - umulh x20, x22, x20 - cinv x19, x19, cc // cc = lo, ul, last - cmn x19, #0x1 - eor x21, x21, x19 - adcs x14, x14, x21 - eor x20, x20, x19 - adcs x15, x15, x20 - adcs x16, x16, x19 - adc x17, x17, x19 - subs x22, x2, x4 - cneg x22, x22, cc // cc = lo, ul, last - csetm x19, cc // cc = lo, ul, last - subs x20, x8, x6 - cneg x20, x20, cc // cc = lo, ul, last - mul x21, x22, x20 - umulh x20, x22, x20 - cinv x19, x19, cc // cc = lo, ul, last - cmn x19, #0x1 - eor x21, x21, x19 - adcs x12, x12, x21 - eor x20, x20, x19 - adcs x13, x13, x20 - adcs x14, x14, x19 - adcs x15, x15, x19 - adcs x16, x16, x19 - adc x17, x17, x19 - subs x22, x2, x5 - cneg x22, x22, cc // cc = lo, ul, last - csetm x19, cc // cc = lo, ul, last - subs x20, x9, x6 - cneg x20, x20, cc // cc = lo, ul, last - mul x21, x22, x20 - umulh x20, x22, x20 - cinv x19, x19, cc // cc = lo, ul, last - cmn x19, #0x1 - eor x21, x21, x19 - adcs x13, x13, x21 - eor x20, x20, x19 - adcs x14, x14, x20 - adcs x15, x15, x19 - adcs x16, x16, x19 - adc x17, x17, x19 - subs x22, x3, x4 - cneg x22, x22, cc // cc = lo, ul, last - csetm x19, cc // cc = lo, ul, last - subs x20, x8, x7 - cneg x20, x20, cc // cc = lo, ul, last - mul x21, x22, x20 - umulh x20, x22, x20 - cinv x19, x19, cc // cc = lo, ul, last - cmn x19, #0x1 - eor x21, x21, x19 - adcs x13, x13, x21 - eor x20, x20, x19 - adcs x14, x14, x20 - adcs x15, x15, x19 - adcs x16, x16, x19 - adc x17, x17, x19 - adds x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - adcs x15, x15, x15 - adcs x16, x16, x16 - adcs x17, x17, x17 - adc x19, xzr, xzr - -// Add it back to the buffer - - ldp x2, x3, [x0, #32] - adds x10, x10, x2 - adcs x11, x11, x3 - stp x10, x11, [x0, #32] - - ldp x2, x3, [x0, #48] - adcs x12, x12, x2 - adcs x13, x13, x3 - stp x12, x13, [x0, #48] - - ldp x2, x3, [x0, #64] - adcs x14, x14, x2 - adcs x15, x15, x3 - stp x14, x15, [x0, #64] - - ldp x2, x3, [x0, #80] - adcs x16, x16, x2 - adcs x17, x17, x3 - stp x16, x17, [x0, #80] - - ldp x2, x3, [x0, #96] - adcs x2, x2, x19 - adcs x3, x3, xzr - stp x2, x3, [x0, #96] - - ldp x2, x3, [x0, #112] - adcs x2, x2, xzr - adc x3, x3, xzr - stp x2, x3, [x0, #112] - - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_8_16) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif - diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_8_16_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_8_16_alt.S deleted file mode 100644 index 1b710e87fe9..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/bignum_sqr_8_16_alt.S +++ /dev/null @@ -1,285 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[8]; output z[16] -// -// extern void bignum_sqr_8_16_alt(uint64_t z[static 16], -// const uint64_t x[static 8]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_8_16_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_8_16_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_8_16_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 -#define a4 x6 -#define a5 x7 -#define a6 x8 -#define a7 x9 - -#define l x10 - -#define u0 x2 // The same as a0, which is safe -#define u1 x11 -#define u2 x12 -#define u3 x13 -#define u4 x14 -#define u5 x15 -#define u6 x16 -#define u7 x17 -#define u8 x19 -#define u9 x20 -#define u10 x21 -#define u11 x22 -#define u12 x23 -#define u13 x24 -#define u14 x25 -#define u15 x26 - -S2N_BN_SYMBOL(bignum_sqr_8_16_alt): - CFI_START - -// It's convenient to have more registers to play with - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - -// Load all the elements as [a7;a6;a5;a4;a3;a2;a1;a0], set up an initial -// window [u8;u7;u6;u5;u4;u3;u2;u1] = 10 + 20 + 30 + 40 + 50 + 60 + 70 - - ldp a0, a1, [x] - - mul u1, a0, a1 - umulh u2, a0, a1 - - ldp a2, a3, [x, #16] - - mul l, a0, a2 - umulh u3, a0, a2 - adds u2, u2, l - - ldp a4, a5, [x, #32] - - mul l, a0, a3 - umulh u4, a0, a3 - adcs u3, u3, l - - ldp a6, a7, [x, #48] - - mul l, a0, a4 - umulh u5, a0, a4 - adcs u4, u4, l - - mul l, a0, a5 - umulh u6, a0, a5 - adcs u5, u5, l - - mul l, a0, a6 - umulh u7, a0, a6 - adcs u6, u6, l - - mul l, a0, a7 - umulh u8, a0, a7 - adcs u7, u7, l - - adc u8, u8, xzr - -// Add in the next diagonal = 21 + 31 + 41 + 51 + 61 + 71 + 54 - - mul l, a1, a2 - adds u3, u3, l - mul l, a1, a3 - adcs u4, u4, l - mul l, a1, a4 - adcs u5, u5, l - mul l, a1, a5 - adcs u6, u6, l - mul l, a1, a6 - adcs u7, u7, l - mul l, a1, a7 - adcs u8, u8, l - cset u9, cs - - umulh l, a1, a2 - adds u4, u4, l - umulh l, a1, a3 - adcs u5, u5, l - umulh l, a1, a4 - adcs u6, u6, l - umulh l, a1, a5 - adcs u7, u7, l - umulh l, a1, a6 - adcs u8, u8, l - umulh l, a1, a7 - adc u9, u9, l - mul l, a4, a5 - umulh u10, a4, a5 - adds u9, u9, l - adc u10, u10, xzr - -// And the next one = 32 + 42 + 52 + 62 + 72 + 64 + 65 - - mul l, a2, a3 - adds u5, u5, l - mul l, a2, a4 - adcs u6, u6, l - mul l, a2, a5 - adcs u7, u7, l - mul l, a2, a6 - adcs u8, u8, l - mul l, a2, a7 - adcs u9, u9, l - mul l, a4, a6 - adcs u10, u10, l - cset u11, cs - - umulh l, a2, a3 - adds u6, u6, l - umulh l, a2, a4 - adcs u7, u7, l - umulh l, a2, a5 - adcs u8, u8, l - umulh l, a2, a6 - adcs u9, u9, l - umulh l, a2, a7 - adcs u10, u10, l - umulh l, a4, a6 - adc u11, u11, l - mul l, a5, a6 - umulh u12, a5, a6 - adds u11, u11, l - adc u12, u12, xzr - -// And the final one = 43 + 53 + 63 + 73 + 74 + 75 + 76 - - mul l, a3, a4 - adds u7, u7, l - mul l, a3, a5 - adcs u8, u8, l - mul l, a3, a6 - adcs u9, u9, l - mul l, a3, a7 - adcs u10, u10, l - mul l, a4, a7 - adcs u11, u11, l - mul l, a5, a7 - adcs u12, u12, l - cset u13, cs - - umulh l, a3, a4 - adds u8, u8, l - umulh l, a3, a5 - adcs u9, u9, l - umulh l, a3, a6 - adcs u10, u10, l - umulh l, a3, a7 - adcs u11, u11, l - umulh l, a4, a7 - adcs u12, u12, l - umulh l, a5, a7 - adc u13, u13, l - mul l, a6, a7 - umulh u14, a6, a7 - adds u13, u13, l - adc u14, u14, xzr - -// Double that, with u15 holding the top carry - - adds u1, u1, u1 - adcs u2, u2, u2 - adcs u3, u3, u3 - adcs u4, u4, u4 - adcs u5, u5, u5 - adcs u6, u6, u6 - adcs u7, u7, u7 - adcs u8, u8, u8 - adcs u9, u9, u9 - adcs u10, u10, u10 - adcs u11, u11, u11 - adcs u12, u12, u12 - adcs u13, u13, u13 - adcs u14, u14, u14 - cset u15, cs - -// Add the homogeneous terms 00 + 11 + 22 + 33 + 44 + 55 + 66 + 77 - - umulh l, a0, a0 - mul u0, a0, a0 - adds u1, u1, l - - mul l, a1, a1 - adcs u2, u2, l - umulh l, a1, a1 - adcs u3, u3, l - - mul l, a2, a2 - adcs u4, u4, l - umulh l, a2, a2 - adcs u5, u5, l - - mul l, a3, a3 - adcs u6, u6, l - umulh l, a3, a3 - adcs u7, u7, l - - mul l, a4, a4 - adcs u8, u8, l - umulh l, a4, a4 - adcs u9, u9, l - - mul l, a5, a5 - adcs u10, u10, l - umulh l, a5, a5 - adcs u11, u11, l - - mul l, a6, a6 - adcs u12, u12, l - umulh l, a6, a6 - adcs u13, u13, l - - mul l, a7, a7 - adcs u14, u14, l - umulh l, a7, a7 - adc u15, u15, l - -// Store back final result - - stp u0, u1, [z] - stp u2, u3, [z, #16] - stp u4, u5, [z, #32] - stp u6, u7, [z, #48] - stp u8, u9, [z, #64] - stp u10, u11, [z, #80] - stp u12, u13, [z, #96] - stp u14, u15, [z, #112] - -// Restore registers and return - - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_8_16_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_emontredc_8n_base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_emontredc_8n_base.S deleted file mode 100644 index 5d35c7df5bb..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_emontredc_8n_base.S +++ /dev/null @@ -1,380 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended Montgomery reduce in 8-digit blocks, results in input-output buffer -// Inputs z[2*k], m[k], w; outputs function return (extra result bit) and z[2*k] -// -// extern uint64_t bignum_emontredc_8n_base -// (uint64_t k, uint64_t *z, uint64_t *m, uint64_t w); -// -// Functionally equivalent to bignum_emontredc (see that file for more detail). -// But in general assumes that the input k is a multiple of 8. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = m, X3 = w, returns X0 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_emontredc_8n_base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_emontredc_8n_base) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro computing (c,h,l) = 3-word 1s complement (x - y) * (w - z) -// and adding it with carry to (b,a) so that we have CF+c in the 2 position. -// -// c,h,l,t should all be different -// t,h should not overlap w,z -// --------------------------------------------------------------------------- - -#define muldiffnadd(b,a, c,h,l,t, x,y, w,z) \ - subs t, x, y __LF\ - cneg t, t, cc __LF\ - csetm c, cc __LF\ - subs h, w, z __LF\ - cneg h, h, cc __LF\ - mul l, t, h __LF\ - umulh h, t, h __LF\ - cinv c, c, cc __LF\ - adds xzr, c, #1 __LF\ - eor l, l, c __LF\ - adcs a, a, l __LF\ - eor h, h, c __LF\ - adcs b, b, h - -// The inputs, though k gets processed so we use a different name - -#define k4m1 x0 -#define z x1 -#define m x2 -#define w x3 - -// Additional variables - -#define a0 x4 -#define a1 x5 -#define a2 x6 -#define a3 x7 - -#define b0 x8 -#define b1 x9 -#define b2 x10 -#define b3 x11 - -#define c0 x12 -#define c1 x13 -#define c2 x14 -#define c3 x15 -#define c4 x16 - -#define u0 x17 -#define u1 x19 -#define u2 x20 -#define u3 x21 -#define u4 x22 -#define u5 x23 -#define u6 x24 -#define u7 x25 - -// These temp registers are aliased to c0..c3, which is safe here - -#define c x12 -#define h x13 -#define l x14 -#define t x15 - -// Loop counters, outer and inner - -#define i x26 -#define j x27 - -// Top carry, eventually returned when aligned with top -// It's maintained as a bitmask since this seems slightly easier(?) - -#define tc x28 - -// ----------------------------------------------------------------------- -// The basic 4x4->8 multiply-add block, which does in ADK style (10 muls): -// -// [c3;c2;c1;c0;z_3;z_2;z_1;z_0] := -// [a3;a2;a1;a0] * [b3;b2;b1;b0] + [c3;c2;c1;c0] + [z_3;z_2;z_1;z_0] -// ----------------------------------------------------------------------- - -.macro madd4 - mul u0, a0, b0 - mul u4, a1, b1 - mul u5, a2, b2 - mul u6, a3, b3 - -// Accumulate the simple products as [u7,u6,u5,u4,u0] - - umulh c4, a0, b0 - adds u4, u4, c4 - umulh c4, a1, b1 - adcs u5, u5, c4 - umulh c4, a2, b2 - adcs u6, u6, c4 - umulh c4, a3, b3 - adc u7, c4, xzr - -// Add up the carry-in and the existing z contents - - ldp u2, u3, [z] - adds c0, c0, u2 - adcs c1, c1, u3 - ldp u2, u3, [z, #16] - adcs c2, c2, u2 - adcs c3, c3, u3 - adc c4, xzr, xzr - -// Multiply by B + 1 to get [u7;u6;u5;u4;u1;u0] - - adds u1, u4, u0 - adcs u4, u5, u4 - adcs u5, u6, u5 - adcs u6, u7, u6 - adc u7, xzr, u7 - -// Multiply by B^2 + 1 to get [u6;u5;u4;u3;u2;u1;u0] - - adds u2, u4, u0 - adcs u3, u5, u1 - adcs u4, u6, u4 - adcs u5, u7, u5 - adcs u6, xzr, u6 - adc u7, xzr, u7 - -// Add in the carry-in and original z contents - - adds u0, u0, c0 - adcs u1, u1, c1 - adcs u2, u2, c2 - adcs u3, u3, c3 - adcs u4, u4, c4 - adcs u5, u5, xzr - adcs u6, u6, xzr - adc u7, u7, xzr - -// Now add in all the "complicated" terms. - - muldiffnadd (u6,u5, c,h,l,t, a2,a3, b3,b2) - adc u7, u7, c - - muldiffnadd (u2,u1, c,h,l,t, a0,a1, b1,b0) - adcs u3, u3, c - adcs u4, u4, c - adcs u5, u5, c - adcs u6, u6, c - adc u7, u7, c - - muldiffnadd (u5,u4, c,h,l,t, a1,a3, b3,b1) - adcs u6, u6, c - adc u7, u7, c - - muldiffnadd (u3,u2, c,h,l,t, a0,a2, b2,b0) - adcs u4, u4, c - adcs u5, u5, c - adcs u6, u6, c - adc u7, u7, c - - muldiffnadd (u4,u3, c,h,l,t, a0,a3, b3,b0) - adcs u5, u5, c - adcs u6, u6, c - adc u7, u7, c - muldiffnadd (u4,u3, c,h,l,t, a1,a2, b2,b1) - adcs c1, u5, c - adcs c2, u6, c - adc c3, u7, c - mov c0, u4 - - stp u0, u1, [z] - stp u2, u3, [z, #16] -.endm - -// ***************************************************** -// Main code -// ***************************************************** - -S2N_BN_SYMBOL(bignum_emontredc_8n_base): - - stp x19, x20, [sp, #-16]! - stp x21, x22, [sp, #-16]! - stp x23, x24, [sp, #-16]! - stp x25, x26, [sp, #-16]! - stp x27, x28, [sp, #-16]! - -// Set up (k/4 - 1)<<5 which is used as inner count and pointer fixup -// ns i = k/4 as the outer loop count. -// At this point skip everything if k/4 = 0, returning our x0 = 0 value - - lsr k4m1, x0, #2 - mov i, k4m1 - subs c, k4m1, #1 - bcc bignum_emontredc_8n_base_end - mov tc, xzr - lsl k4m1, c, #5 - -// Outer loop, one digit of Montgomery reduction adding in word * m. -// Rather than propagating the carry to the end each time, we -// stop at the "natural" end and store top carry in tc as a bitmask. - -bignum_emontredc_8n_base_outerloop: - -// Load [u3;u2;u1;u0] = bottom 4 digits of the input at current window - - ldp u0, u1, [z] - ldp u2, u3, [z, #16] - -// Load the bottom 4 digits of m - - ldp b0, b1, [m] - ldp b2, b3, [m, #16] - -// Montgomery step 0 - - mul a0, u0, w - mul c0, a0, b0 - mul c1, a0, b1 - mul c2, a0, b2 - mul c3, a0, b3 - adds u0, u0, c0 - umulh c0, a0, b0 - adcs u1, u1, c1 - umulh c1, a0, b1 - adcs u2, u2, c2 - umulh c2, a0, b2 - adcs u3, u3, c3 - umulh c3, a0, b3 - adc u4, xzr, xzr - adds u1, u1, c0 - adcs u2, u2, c1 - adcs u3, u3, c2 - adc u4, u4, c3 - -// Montgomery step 1 - - mul a1, u1, w - mul c0, a1, b0 - mul c1, a1, b1 - mul c2, a1, b2 - mul c3, a1, b3 - adds u1, u1, c0 - umulh c0, a1, b0 - adcs u2, u2, c1 - umulh c1, a1, b1 - adcs u3, u3, c2 - umulh c2, a1, b2 - adcs u4, u4, c3 - umulh c3, a1, b3 - adc u5, xzr, xzr - adds u2, u2, c0 - adcs u3, u3, c1 - adcs u4, u4, c2 - adc u5, u5, c3 - -// Montgomery step 2 - - mul a2, u2, w - mul c0, a2, b0 - mul c1, a2, b1 - mul c2, a2, b2 - mul c3, a2, b3 - adds u2, u2, c0 - umulh c0, a2, b0 - adcs u3, u3, c1 - umulh c1, a2, b1 - adcs u4, u4, c2 - umulh c2, a2, b2 - adcs u5, u5, c3 - umulh c3, a2, b3 - adc u6, xzr, xzr - adds u3, u3, c0 - adcs u4, u4, c1 - adcs u5, u5, c2 - adc u6, u6, c3 - -// Montgomery step 3. In the last four instructions we put the top in -// the carry variables expected by the "madd" block next, which is why -// the pattern is slightly different. - - mul a3, u3, w - mul c0, a3, b0 - mul c1, a3, b1 - mul c2, a3, b2 - mul c3, a3, b3 - adds u3, u3, c0 - umulh c0, a3, b0 - adcs u4, u4, c1 - umulh c1, a3, b1 - adcs u5, u5, c2 - umulh c2, a3, b2 - adcs u6, u6, c3 - umulh c3, a3, b3 - adc u7, xzr, xzr - adds c0, u4, c0 - adcs c1, u5, c1 - adcs c2, u6, c2 - adc c3, u7, c3 - -// Stash the multipliers as expected by the bignum_emontredc interface -// We don't use these ourselves again though; they stay in [a3;a2;a1;a0] - - stp a0, a1, [z] - stp a2, a3, [z, #16] - -// Repeated multiply-add block to do the k/4-1 remaining 4-digit chunks - - mov j, k4m1 -bignum_emontredc_8n_base_maddloop: - add m, m, #32 - add z, z, #32 - - ldp b0, b1, [m] - ldp b2, b3, [m, #16] - madd4 - subs j, j, #32 - bne bignum_emontredc_8n_base_maddloop -bignum_emontredc_8n_base_madddone: - -// Add the carry out to the existing z contents, propagating the -// top carry tc up by 32 places as we move "leftwards". - - ldp u0, u1, [z, #32] - ldp u2, u3, [z, #48] - adds xzr, tc, tc - adcs u0, u0, c0 - adcs u1, u1, c1 - adcs u2, u2, c2 - adcs u3, u3, c3 - csetm tc, cs - stp u0, u1, [z, #32] - stp u2, u3, [z, #48] - -// Compensate for the repeated bumps in m and z in the inner loop - - sub z, z, k4m1 - sub m, m, k4m1 - -// Bump up z only and keep going - - add z, z, #32 - sub i, i, #1 - cbnz i, bignum_emontredc_8n_base_outerloop - -// Return the top carry as 0 or 1 (it's currently a bitmask) - - neg x0, tc - -bignum_emontredc_8n_base_end: - ldp x27, x28, [sp], #16 - ldp x25, x26, [sp], #16 - ldp x23, x24, [sp], #16 - ldp x21, x22, [sp], #16 - ldp x19, x20, [sp], #16 - - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_emontredc_8n_cdiff_base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_emontredc_8n_cdiff_base.S deleted file mode 100644 index 7ed56cfb78e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_emontredc_8n_cdiff_base.S +++ /dev/null @@ -1,681 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC - -// ---------------------------------------------------------------------------- -// Extend Montgomery reduce in 8-digit blocks, uses an extra storage to -// temporarily cache multiplied differences appearing in ADK. -// Results are stored in input-output buffer (z). -// Inputs z[2*k], m[k], w; -// Outputs function return (extra result bit) and z[2*k] -// Temporary buffer m_precalc[12*(k/4-1)] -// -// extern uint64_t bignum_emontredc_8n_cdiff -// (uint64_t k, uint64_t *z, uint64_t *m, uint64_t w, uint64_t *m_precalc); -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = m, X3 = w, X4 = m_precalc -// returns X0 -// -// This is an unoptimized version of bignum_emontredc_8n_cdiff. -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_emontredc_8n_cdiff_base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_emontredc_8n_cdiff_base) - .text - .balign 4 - - // Silly SLOTHY limitation: It needs the loop counter to have the name 'count' - count .req x27 // inner loop counter - - // Semantically transparent instruction wrapper which is used by SLOTHY - // for dependency tracking through memory. SLOTHY itself has no notion of - // memory, only registers; to still track static dependencies through memory - // (register spills), a 'hint' register type is introduced (syntax t{i}, t{i}{j}) - // that's written to in store instructions and read from in the corresponding - // load instruction. - // - // The 'slothy:no-unfold' annotation prevents SLOTHY from opening the macro, - // and instead makes it treat `stph` as an instruction specified in the - // Arch and uArch models provided to it. - .macro stph a, b, addr, imm, hint // slothy:no-unfold - stp \a\(), \b\(), [\addr, \imm] - .endm - - .macro ldph a, b, addr, imm, hint // slothy:no-unfold - ldp \a\(), \b\(), [\addr, \imm] - .endm - - .macro ldrh a, addr, imm, hint // slothy:no-unfold - ldr \a\(), [\addr, \imm] - .endm - - // Helper macro for the pre-computations - .macro cdiff t, c, x, y - subs \t, \x, \y - cneg \t, \t, cc - csetm \c, cc - .endm - - // Some immediate offsets for cached differences+carry used - // in the inner ADK multiplications - #define cache_a01 (32+0*16) - #define cache_a02 (32+1*16) - #define cache_a03 (32+2*16) - #define cache_a12 (32+3*16) - #define cache_a13 (32+4*16) - #define cache_a23 (32+5*16) - #define cache_m10 (0*16) - #define cache_m20 (1*16) - #define cache_m30 (2*16) - #define cache_m21 (3*16) - #define cache_m31 (4*16) - #define cache_m32 (5*16) - - a0 .req x4 - a1 .req x5 - a2 .req x6 - a3 .req x7 - - vpre00 .req v30 - vpre01 .req v28 - vpre02 .req v17 - vpre10 .req v18 - vpre11 .req v19 - vpre12 .req v20 - - // Computes two 64x64->128-bit multiplication a*x and a*y - // v_in0: 128-bit input vector viewed as pair (x,y) of 64-bit numbers - // x_in: 64-bit common multiplicand a - // v_out0: 128-bit output vector to hold a*x - // v_out1: 128-bit output vector to hold a*y - // - // Uses temporaries as indicated in the following defines: - #define v_in0_p v3 - #define v_in0_pp v5 - #define v_in0_ppp v28 - #define v_in1 v0 - #define vtmp0 v4 - #define vtmp1 v6 - #define vtmp2 v7 - #define vtmp3 v16 - #define vtmp4 v2 - - .macro vmul_2x_64_64_128 v_in0, x_in, v_out0, v_out1 // slothy:no-unfold - dup v_in1.2d, \x_in - uzp2 v_in0_p.4s, \v_in0\().4s, \v_in0\().4s - xtn vtmp0.2s, v_in1.2d - xtn v_in0_pp.2s, \v_in0\().2d - rev64 v_in0_ppp.4s, \v_in0\().4s - umull vtmp1.2d, vtmp0.2s, v_in0_pp.2s - umull vtmp2.2d, vtmp0.2s, v_in0_p.2s - uzp2 vtmp3.4s, v_in1.4s, v_in1.4s - mul v_in1.4s, v_in0_ppp.4s, v_in1.4s - usra vtmp2.2d, vtmp1.2d, #32 - umull \v_out1\().2d, vtmp3.2s, v_in0_p.2s - uaddlp v_in1.2d, v_in1.4s - and vtmp4.16b, vtmp2.16b, v29.16b - umlal vtmp4.2d, vtmp3.2s, v_in0_pp.2s - shl \v_out0\().2d, v_in1.2d, #32 - usra \v_out1\().2d, vtmp2.2d, #32 - umlal \v_out0\().2d, vtmp0.2s, v_in0_pp.2s - usra \v_out1\().2d, vtmp4.2d, #32 - .endm - - // SLOTHY version of the above multiplication macro, using symbolic - // registers instead of hardcoded registers. This is only used during - // SLOTHY optimization (the above macro is ignored because of - // 'slothy:no-unfold'). -#if defined(SLOTHY) - .macro vmul_2x_64_64_128 v_in0, x_in, v_out0, v_out1 - dup V.2d, \x_in - uzp2 V.4s, \v_in0\().4s, \v_in0\().4s - xtn V.2s, V.2d - xtn V.2s, \v_in0\().2d - rev64 V.4s, \v_in0\().4s - umull V.2d, V.2s, V.2s - umull V.2d, V.2s, V.2s - uzp2 V.4s, V.4s, V.4s - mul V.4s, V.4s, V.4s - usra V.2d, V.2d, #32 - umull \v_out1\().2d, V.2s, V.2s - uaddlp V.2d, V.4s - and V.16b, V.16b, v29.16b - umlal V.2d, V.2s, V.2s - shl \v_out0\().2d, V.2d, #32 - usra \v_out1\().2d, V.2d, #32 - umlal \v_out0\().2d, V.2s, V.2s - usra \v_out1\().2d, V.2d, #32 - .endm -#endif - -S2N_BN_SYMBOL(bignum_emontredc_8n_cdiff_base): - - sub sp, sp, #(6*16) - stp x19, x20, [sp, #(5*16)] - stp x21, x22, [sp, #(4*16)] - stp x23, x24, [sp, #(3*16)] - stp x25, x26, [sp, #(2*16)] - stp x27, x28, [sp, #(1*16)] - stp x29, x30, [sp, #(0*16)] - - // Leave space for cached differences in inner loop - sub sp, sp, #(6*16) - - sub sp, sp, #32 - lsr x0, x0, #2 - mov x26, x0 - subs x12, x0, #1 - bcc bignum_emontredc_8n_cdiff_base_end - - // x30 = buffer holding precomputed ADK carry-differences for modulus - mov w30, #(12*8) - mul w30, w12, w30 - sub x30, sp, x30 - - // - // Start of precomputation - // - // Precompute and cache signed differences of modulus components - // used in the ADK multiplication in the inner loop. - // - // THIS SHOULD BE HOISTED OUT - // (and until then, comment out for benchmarking to get accurate estimates) - // - - // Number of extra limbs required: - // 6 * (number of limbs / 4 - 1) * 2 = 12 * (number_of_limbs/4 - 1) - // - // For now, just put them on the stack - mov sp, x30 - - // Save modulus pointer - mov x25, x2 - - mov count, x12 -bignum_emontredc_8n_cdiff_base_precomp: - ldp a0, a1, [x2, #32]! - ldp a2, a3, [x2, #16] - - t .req x28 - c .req x29 - - cdiff t, c, a1, a0 - stp t, c, [sp, #cache_m10] - cdiff t, c, a2, a0 - stp t, c, [sp, #cache_m20] - cdiff t, c, a3, a0 - stp t, c, [sp, #cache_m30] - cdiff t, c, a2, a1 - stp t, c, [sp, #cache_m21] - cdiff t, c, a3, a1 - stp t, c, [sp, #cache_m31] - cdiff t, c, a3, a2 - stp t, c, [sp, #cache_m32] - - add sp, sp, #(6*16) - - subs count, count, #1 - cbnz count, bignum_emontredc_8n_cdiff_base_precomp - - // Set modulus pointer back to its original value - mov x2, x25 - - // - // End of precomputation - // - - stp x3, x30, [sp] - //stp x3, xzr, [sp] - stp x26, xzr, [sp, #16] - mov x28, xzr - lsl x0, x12, #5 - - movi v29.2d, #0x000000ffffffff - -bignum_emontredc_8n_cdiff_base_outerloop: - ldr x3, [sp] - ldph x17, x19, x1, #0, t0 - ldph x20, x21, x1, #16, t1 - ldp x8, x9, [x2, #0] - ldp x10, x11, [x2, #16] - ldr q21, [x2, #16] - - // Montgomery step 0 - - mul x4, x17, x3 - // NEON: Calculate x4 * (x10, x11) that does two 64x64->128-bit multiplications. - vmul_2x_64_64_128 v21, x4, v0, v1 - mov x14, v0.d[0] - mov x15, v0.d[1] - mul x12, x4, x8 - adds x17, x17, x12 - umulh x12, x4, x8 - mul x13, x4, x9 - adcs x19, x19, x13 - umulh x13, x4, x9 - adcs x20, x20, x14 - adcs x21, x21, x15 - mov x14, v1.d[0] - mov x15, v1.d[1] - adc x22, xzr, xzr - adds x19, x19, x12 - adcs x20, x20, x13 - adcs x21, x21, x14 - adc x22, x22, x15 - - // Montgomery step 1 - - mul x5, x19, x3 - // NEON: Calculate x5 * (x10, x11) that does two 64x64->128-bit multiplications. - vmul_2x_64_64_128 v21, x5, v0, v1 - mov x14, v0.d[0] - mov x15, v0.d[1] - mul x12, x5, x8 - adds x19, x19, x12 - umulh x12, x5, x8 - mul x13, x5, x9 - adcs x20, x20, x13 - umulh x13, x5, x9 - adcs x21, x21, x14 - adcs x22, x22, x15 - mov x14, v1.d[0] - mov x15, v1.d[1] - adc x23, xzr, xzr - adds x20, x20, x12 - adcs x21, x21, x13 - adcs x22, x22, x14 - adc x23, x23, x15 - stph x4, x5, x1, #0, t0 - - // Montgomery step 2 - - mul x6, x20, x3 - // NEON: Calculate x6 * (x10, x11) that does two 64x64->128-bit multiplications. - vmul_2x_64_64_128 v21, x6, v21, v1 - mov x14, v21.d[0] - mov x15, v21.d[1] - mul x12, x6, x8 - adds x20, x20, x12 - umulh x12, x6, x8 - mul x13, x6, x9 - adcs x21, x21, x13 - umulh x13, x6, x9 - adcs x22, x22, x14 - adcs x23, x23, x15 - mov x14, v1.d[0] - mov x15, v1.d[1] - adc x24, xzr, xzr - adds x21, x21, x12 - mul x7, x21, x3 - adcs x22, x22, x13 - adcs x23, x23, x14 - adc x24, x24, x15 - - stph x6, x7, x1, #16, t1 - - // Montgomery step 3 - - mul x12, x7, x8 - mul x13, x7, x9 - mul x14, x7, x10 - mul x15, x7, x11 - adds x21, x21, x12 - umulh x12, x7, x8 - adcs x22, x22, x13 - umulh x13, x7, x9 - adcs x23, x23, x14 - umulh x14, x7, x10 - adcs x24, x24, x15 - umulh x15, x7, x11 - adc x25, xzr, xzr - adds x12, x22, x12 - adcs x13, x23, x13 - adcs x14, x24, x14 - adc x15, x25, x15 - - lsr count, x0, #5 - - ldrh q20, x1, #0, t0 - ldrh q21, x1, #16, t1 - - // Precompute and cache differences required in the - // ADK multiplication conducted by the innerl oop. - // Save each difference (somewhat inefficiently) - // as a pair (t,c) of 64-bit + carry. - // - // The same caching trick is applied to the modulus, - // for which the various differences can even be hoisted - // out of the entire multiplication routine. - - // a0 - a1 with carry - cdiff x16,x26,a0,a1 - stph x16, x26, sp, #cache_a01, t01 - // a0 - a2 with carry - cdiff x16,x26,a0,a2 - stph x16, x26, sp, #cache_a02, t02 - // a0 - a3 with carry - cdiff x16,x26,a0,a3 - stph x16, x26, sp, #cache_a03, t03 - // a1 - a2 with carry - cdiff x16,x26,a1,a2 - stph x16, x26, sp, #cache_a12, t12 - // a1 - a3 with carry - cdiff x16,x26,a1,a3 - stph x16, x26, sp, #cache_a13, t13 - // a2 - a3 with carry - cdiff x16,x26,a2,a3 - stph x16, x26, sp, #cache_a23, t23 - - // Precompute and cache some precomputations for - // the Neon multiplications in the inner loop - uzp2 vpre00.4s, v20.4s, v20.4s - xtn vpre01.2s, v20.2d - rev64 vpre02.4s, v20.4s - uzp2 vpre10.4s, v21.4s, v21.4s - xtn vpre11.2s, v21.2d - rev64 vpre12.4s, v21.4s - -bignum_emontredc_8n_cdiff_base_maddloop_neon: - - ldr q22, [x2, #32]! - ldr q23, [x2, #16] - - xtn v4.2s, v22.2d - umull v6.2d, v4.2s, vpre01.2s - umull v7.2d, v4.2s, vpre00.2s - uzp2 v16.4s, v22.4s, v22.4s - mul v0.4s, vpre02.4s, v22.4s - usra v7.2d, v6.2d, #32 - umull v25.2d, v16.2s, vpre00.2s - uaddlp v0.2d, v0.4s - and v2.16b, v7.16b, v29.16b - umlal v2.2d, v16.2s, vpre01.2s - shl v24.2d, v0.2d, #32 - usra v25.2d, v7.2d, #32 - umlal v24.2d, v4.2s, vpre01.2s - usra v25.2d, v2.2d, #32 - - // Original version without caching - // uzp2 v3.4s, v22.4s, v22.4s - // xtn v4.2s, v20.2d - // xtn v5.2s, v22.2d - // rev64 v1.4s, v22.4s - // umull v6.2d, v4.2s, v5.2s - // umull v7.2d, v4.2s, v3.2s - // uzp2 v16.4s, v20.4s, v20.4s - // mul v0.4s, v1.4s, v20.4s - // usra v7.2d, v6.2d, #32 - // umull v25.2d, v16.2s, v3.2s - // uaddlp v0.2d, v0.4s - // and v2.16b, v7.16b, v29.16b - // umlal v2.2d, v16.2s, v5.2s - // shl v24.2d, v0.2d, #32 - // usra v25.2d, v7.2d, #32 - // umlal v24.2d, v4.2s, v5.2s - // usra v25.2d, v2.2d, #32 - - xtn v4.2s, v23.2d - umull v6.2d, v4.2s, vpre11.2s - umull v7.2d, v4.2s, vpre10.2s - uzp2 v16.4s, v23.4s, v23.4s - mul v0.4s, vpre12.4s, v23.4s - usra v7.2d, v6.2d, #32 - umull v27.2d, v16.2s, vpre10.2s - uaddlp v0.2d, v0.4s - and v2.16b, v7.16b, v29.16b - umlal v2.2d, v16.2s, vpre11.2s - shl v26.2d, v0.2d, #32 - usra v27.2d, v7.2d, #32 - umlal v26.2d, v4.2s, vpre11.2s - usra v27.2d, v2.2d, #32 - - // Original version without caching - // uzp2 v3.4s, v23.4s, v23.4s - // xtn v4.2s, v21.2d - // xtn v5.2s, v23.2d - // rev64 v1.4s, v23.4s - // umull v6.2d, v4.2s, v5.2s - // umull v7.2d, v4.2s, v3.2s - // uzp2 v16.4s, v21.4s, v21.4s - // mul v0.4s, v1.4s, v21.4s - // usra v7.2d, v6.2d, #32 - // umull v27.2d, v16.2s, v3.2s - // uaddlp v0.2d, v0.4s - // and v2.16b, v7.16b, v29.16b - // umlal v2.2d, v16.2s, v5.2s - // shl v26.2d, v0.2d, #32 - // usra v27.2d, v7.2d, #32 - // umlal v26.2d, v4.2s, v5.2s - // usra v27.2d, v2.2d, #32 - - mov x16, v25.d[0] // hi bits of (x4 * x8) - mov x26, v27.d[0] // hi bits of (x6 * x10) - mov x3, v25.d[1] // hi bits of (x5 * x9) - mov x17, v27.d[1] // hi bits of (x6 * x10) - - mov x20, v24.d[1] // lo bits of (x5 * x9) - mov x21, v26.d[0] // lo bits of (x6 * x10) - mov x24, v26.d[1] // lo bits of (x7 * x11) - - // Not necessary if one uses cached differences for the modulus - //ldp x8, x9, [x2, #0] - //ldp x10, x11, [x2, #16] - - adds x22, x20, x16 - adcs x23, x21, x3 - adcs x24, x24, x26 - adc x25, x17, xzr - mov x17, v24.d[0] // lo bits of (x4 * x8) - ldp x20, x21, [x1, #32]! - adds x12, x12, x20 - adcs x13, x13, x21 - ldp x20, x21, [x1, #16] - adcs x14, x14, x20 - adcs x15, x15, x21 - adc x16, xzr, xzr - adds x19, x22, x17 - adcs x22, x23, x22 - adcs x23, x24, x23 - adcs x24, x25, x24 - adc x25, xzr, x25 - adds x20, x22, x17 - adcs x21, x23, x19 - adcs x22, x24, x22 - adcs x23, x25, x23 - adcs x24, xzr, x24 - adc x25, xzr, x25 - adds x17, x17, x12 - adcs x19, x19, x13 - adcs x20, x20, x14 - adcs x21, x21, x15 - adcs x22, x22, x16 - adcs x23, x23, xzr - adcs x24, x24, xzr - adc x25, x25, xzr - - ldph x15, x12, sp, #cache_a23, t23 - // Original code without caching - //subs x15, x6, x7 - //cneg x15, x15, cc - //csetm x12, cc - - ldp x13, x14, [x30, #cache_m32] - eor x12, x12, x14 - // Original code without caching - //cdiff x13, x14, x11, x10 - //subs x13, x11, x10 - //cneg x13, x13, cc - - mul x14, x15, x13 - umulh x13, x15, x13 - adds xzr, x12, #1 - eor x14, x14, x12 - adcs x23, x23, x14 - eor x13, x13, x12 - adcs x24, x24, x13 - adc x25, x25, x12 - - ldph x15, x12, sp, #cache_a01, t01 - //subs x15, x4, x5 - //cneg x15, x15, cc - //csetm x12, cc - - ldp x13, x14, [x30, #cache_m10] - eor x12, x12, x14 - // Original code without caching - //subs x13, x9, x8 - //cneg x13, x13, cc - //cinv x12, x12, cc - - mul x14, x15, x13 - umulh x13, x15, x13 - adds xzr, x12, #1 - eor x14, x14, x12 - adcs x19, x19, x14 - eor x13, x13, x12 - adcs x20, x20, x13 - adcs x21, x21, x12 - adcs x22, x22, x12 - adcs x23, x23, x12 - adcs x24, x24, x12 - adc x25, x25, x12 - - stp x17, x19, [x1, #0] - - ldph x15, x12, sp, #cache_a13, t13 - //subs x15, x5, x7 - //cneg x15, x15, cc - //csetm x12, cc - - ldp x13, x14, [x30, #cache_m31] - eor x12, x12, x14 - // Original code without caching - //subs x13, x11, x9 - //cneg x13, x13, cc - //cinv x12, x12, cc - - mul x14, x15, x13 - umulh x13, x15, x13 - adds xzr, x12, #1 - eor x14, x14, x12 - adcs x22, x22, x14 - eor x13, x13, x12 - adcs x23, x23, x13 - adcs x24, x24, x12 - adc x25, x25, x12 - - ldph x15, x12, sp, #cache_a02, t02 - //subs x15, x4, x6 - //cneg x15, x15, cc - //csetm x12, cc - - ldp x13, x14, [x30, #cache_m20] - eor x12, x12, x14 - // Original code without caching - //subs x13, x10, x8 - //cneg x13, x13, cc - //cinv x12, x12, cc - - mul x14, x15, x13 - umulh x13, x15, x13 - adds xzr, x12, #1 - eor x14, x14, x12 - adcs x20, x20, x14 - eor x13, x13, x12 - adcs x21, x21, x13 - adcs x22, x22, x12 - adcs x23, x23, x12 - adcs x24, x24, x12 - adc x25, x25, x12 - - ldph x15, x12, sp, #cache_a03, t03 - //subs x15, x4, x7 - //cneg x15, x15, cc - //csetm x12, cc - - ldp x13, x14, [x30, #cache_m30] - eor x12, x12, x14 - // Original code without caching - //subs x13, x11, x8 - //cneg x13, x13, cc - //cinv x12, x12, cc - - mul x14, x15, x13 - umulh x13, x15, x13 - adds xzr, x12, #1 - eor x14, x14, x12 - adcs x21, x21, x14 - eor x13, x13, x12 - adcs x22, x22, x13 - adcs x23, x23, x12 - adcs x24, x24, x12 - adc x25, x25, x12 - - ldph x15, x12, sp, #cache_a12, t12 - //subs x15, x5, x6 - //cneg x15, x15, cc - //csetm x12, cc - - ldp x13, x14, [x30, #cache_m21] - eor x12, x12, x14 - // Original code without caching - //subs x13, x10, x9 - //cneg x13, x13, cc - //cinv x12, x12, cc - - mul x14, x15, x13 - umulh x13, x15, x13 - adds xzr, x12, #1 - eor x14, x14, x12 - adcs x21, x21, x14 - - stp x20, x21, [x1, #16] - eor x13, x13, x12 - adcs x22, x22, x13 - adcs x13, x23, x12 - adcs x14, x24, x12 - adc x15, x25, x12 - mov x12, x22 - - add x30, x30, #96 - - sub count, count, #1 - cbnz count, bignum_emontredc_8n_cdiff_base_maddloop_neon - - ldp x17, x19, [x1, #32] - ldp x20, x21, [x1, #48] - ldp x26, xzr, [sp, #16] - adds xzr, x28, x28 - adcs x17, x17, x12 - adcs x19, x19, x13 - adcs x20, x20, x14 - adcs x21, x21, x15 - csetm x28, cs - stp x17, x19, [x1, #32] - stp x20, x21, [x1, #48] - sub x1, x1, x0 - sub x2, x2, x0 - add x1, x1, #32 - subs x26, x26, #1 - stp x26, xzr, [sp, #16] - - // Restore buffer base for cached modulus differences - ldr x30, [sp, #8] - - bne bignum_emontredc_8n_cdiff_base_outerloop - neg x0, x28 - -bignum_emontredc_8n_cdiff_base_end: - add sp, sp, #32 - add sp, sp, #(6*16) - - ldp x29, x30, [sp, #(0*16)] - ldp x27, x28, [sp, #(1*16)] - ldp x25, x26, [sp, #(2*16)] - ldp x23, x24, [sp, #(3*16)] - ldp x21, x22, [sp, #(4*16)] - ldp x19, x20, [sp, #(5*16)] - add sp, sp, #(6*16) - - ret - diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_mul_8_16_base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_mul_8_16_base.S deleted file mode 100644 index d31c7daaec0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_mul_8_16_base.S +++ /dev/null @@ -1,349 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[8], y[8]; output z[16] -// -// extern void bignum_mul_8_16_base -// (uint64_t z[static 16], uint64_t x[static 8], uint64_t y[static 8]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_8_16_base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_8_16_base) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro computing [c,b,a] := [b,a] + (x - y) * (w - z), adding with carry -// to the [b,a] components but leaving CF aligned with the c term, which is -// a sign bitmask for (x - y) * (w - z). Continued add-with-carry operations -// with [c,...,c] will continue the carry chain correctly starting from -// the c position if desired to add to a longer term of the form [...,b,a]. -// -// c,h,l,t should all be different and t,h should not overlap w,z. -// --------------------------------------------------------------------------- - -.macro muldiffnadd b,a, c,h,l,t, x,y, w,z - subs \t, \x, \y - cneg \t, \t, cc - csetm \c, cc - subs \h, \w, \z - cneg \h, \h, cc - mul \l, \t, \h - umulh \h, \t, \h - cinv \c, \c, cc - adds xzr, \c, #1 - eor \l, \l, \c - adcs \a, \a, \l - eor \h, \h, \c - adcs \b, \b, \h -.endm - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define b0 x7 -#define b1 x8 -#define b2 x9 -#define b3 x10 - -#define s0 x11 -#define s1 x12 -#define s2 x13 -#define s3 x14 -#define s4 x15 -#define s5 x16 -#define s6 x17 -#define s7 x19 - -#define c x20 -#define h x21 -#define l x22 -#define m x23 -#define t x24 - -// These alias the ax and bx values, and are only used when they are done with - -#define u0 x3 -#define u1 x4 -#define u2 x5 -#define u3 x6 -#define u4 x7 -#define u5 x8 -#define u6 x9 -#define u7 x10 - -// These alias c,h,l,m but leave s, t and d safe, all we need - -#define u8 x20 -#define u9 x21 -#define u10 x22 -#define u11 x23 - -// We recycle the input pointers near the end - -#define s x1 -#define d x2 - -// --------------------------------------------------------------------------- -// Core 4x4->8 ADK multiplication macro -// Does [s7,s6,s5,s4,s3,s2,s1,s0] = [a3,a2,a1,a0] * [b3,b2,b1,b0] -// -// If the input parameter is 1, it also adds in [z+32,z+40,z+48,z+56] -// existing contents; if the parameter is 0 it just does the pure multiply -// --------------------------------------------------------------------------- - -.macro mul4 afl - -// First accumulate all the "simple" products as [s7,s6,s5,s4,s0] - - mul s0, a0, b0 - mul s4, a1, b1 - mul s5, a2, b2 - mul s6, a3, b3 - - umulh s7, a0, b0 - adds s4, s4, s7 - umulh s7, a1, b1 - adcs s5, s5, s7 - umulh s7, a2, b2 - adcs s6, s6, s7 - umulh s7, a3, b3 - adc s7, s7, xzr - -// Multiply by B + 1 to get [s7;s6;s5;s4;s1;s0] - - adds s1, s4, s0 - adcs s4, s5, s4 - adcs s5, s6, s5 - adcs s6, s7, s6 - adc s7, xzr, s7 - -// Multiply by B^2 + 1 to get [s7;s6;s5;s4;s3;s2;s1;s0] - - adds s2, s4, s0 - adcs s3, s5, s1 - adcs s4, s6, s4 - adcs s5, s7, s5 - adcs s6, xzr, s6 - adc s7, xzr, s7 - -// Optionally add the existing z contents - -.rep \afl - ldp l, h, [z,#32] - adds s0, s0, l - adcs s1, s1, h - ldp l, h, [z,#48] - adcs s2, s2, l - adcs s3, s3, h - adcs s4, s4, xzr - adcs s5, s5, xzr - adcs s6, s6, xzr - adc s7, s7, xzr -.endr - -// Now add in all the "complicated" terms. - - muldiffnadd s6,s5, c,h,l,t, a2,a3, b3,b2 - adc s7, s7, c - - muldiffnadd s2,s1, c,h,l,t, a0,a1, b1,b0 - adcs s3, s3, c - adcs s4, s4, c - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - - muldiffnadd s5,s4, c,h,l,t, a1,a3, b3,b1 - adcs s6, s6, c - adc s7, s7, c - - muldiffnadd s3,s2, c,h,l,t, a0,a2, b2,b0 - adcs s4, s4, c - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - - muldiffnadd s4,s3, c,h,l,t, a0,a3, b3,b0 - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - muldiffnadd s4,s3, c,h,l,t, a1,a2, b2,b1 - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c -.endm - -// --------------------------------------------------------------------------- -// The main code -// --------------------------------------------------------------------------- - -S2N_BN_SYMBOL(bignum_mul_8_16_base): - -// Save registers - - stp x19, x20, [sp, #-16]! - stp x21, x22, [sp, #-16]! - stp x23, x24, [sp, #-16]! - -// Multiply the low halves and then the high halves using ADK 4x4->8. -// For the second one add the top of the low part (Q1) already into -// the bottom of the high part (Q2) so that is already dealt with. -// -// Write back the first one but defer the second till a bit later while -// we get on with the absolute difference computations - - ldp a0, a1, [x] - ldp b0, b1, [y] - ldp a2, a3, [x, #16] - ldp b2, b3, [y, #16] - - mul4 0 - - ldp a0, a1, [x, #32] - stp s0, s1, [z] - ldp b0, b1, [y, #32] - stp s2, s3, [z, #16] - ldp a2, a3, [x, #48] - stp s4, s5, [z, #32] - ldp b2, b3, [y, #48] - stp s6, s7, [z, #48] - - mul4 1 - -// Compute t,[a3,a2,a1,a0] = x_hi - x_lo -// and s,[b3,b2,b1,b0] = y_lo - y_hi -// sign-magnitude differences, and scatter in belated high writeback - - ldp l, h, [x] - subs a0, a0, l - sbcs a1, a1, h - ldp l, h, [x, #16] - sbcs a2, a2, l - sbcs a3, a3, h - csetm t, cc - - stp s0, s1, [z, #64] - - ldp l, h, [y] - subs b0, l, b0 - sbcs b1, h, b1 - ldp l, h, [y, #16] - sbcs b2, l, b2 - sbcs b3, h, b3 - csetm s, cc - - stp s2, s3, [z, #80] - - eor a0, a0, t - subs a0, a0, t - eor a1, a1, t - sbcs a1, a1, t - eor a2, a2, t - sbcs a2, a2, t - eor a3, a3, t - sbc a3, a3, t - - stp s4, s5, [z, #96] - - eor b0, b0, s - subs b0, b0, s - eor b1, b1, s - sbcs b1, b1, s - eor b2, b2, s - sbcs b2, b2, s - eor b3, b3, s - sbc b3, b3, s - - stp s6, s7, [z, #112] - -// Save the correct sign for the sub-product - - eor s, s, t - -// Now yet another 4x4->8 ADK core, but not writing back, keeping s0..s7 - - mul4 0 - -// Now accumulate the positive mid-terms as [u7,u6,u5,u4,u3.u2,u1,u0] - - ldp u0, u1, [z] - ldp u4, u5, [z,#64] - adds u0, u0, u4 - adcs u1, u1, u5 - ldp u2, u3, [z,#16] - ldp u6, u7, [z,#80] - adcs u2, u2, u6 - adcs u3, u3, u7 - ldp u8, u9, [z,#96] - adcs u4, u4, u8 - adcs u5, u5, u9 - ldp u10, u11, [z,#112] - adcs u6, u6, u10 - adcs u7, u7, u11 - -// Stop the carry here so we can reintroduce it, taking into account the -// effective addition of s from sign-extension below. Note that we get -// a duplicated word c+carry beyond the first one, so this upper part is -// of the form [d,d,d,t]. - - adcs t, s, xzr - adc d, s, xzr - -// Add in the sign-adjusted complex term - - adds xzr, s, #1 - eor s0, s0, s - adcs u0, s0, u0 - eor s1, s1, s - adcs u1, s1, u1 - eor s2, s2, s - adcs u2, s2, u2 - eor s3, s3, s - adcs u3, s3, u3 - eor s4, s4, s - adcs u4, s4, u4 - eor s5, s5, s - adcs u5, s5, u5 - eor s6, s6, s - adcs u6, s6, u6 - eor s7, s7, s - adcs u7, s7, u7 - -// From this point on replace the sign with the suspended carry indication - - adcs u8, u8, t - adcs u9, u9, d - adcs u10, u10, d - adc u11, u11, d - -// Store it back - - stp u0, u1, [z,#32] - stp u2, u3, [z,#48] - stp u4, u5, [z,#64] - stp u6, u7, [z,#80] - stp u8, u9, [z,#96] - stp u10, u11, [z,#112] - -// Restore regs and return - - ldp x23, x24, [sp], #16 - ldp x21, x22, [sp], #16 - ldp x19, x20, [sp], #16 - - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_sqr_8_16_base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_sqr_8_16_base.S deleted file mode 100644 index ce82049c3c9..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/fastmul/unopt/bignum_sqr_8_16_base.S +++ /dev/null @@ -1,356 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[8]; output z[16] -// -// extern void bignum_sqr_8_16_base (uint64_t z[static 16], uint64_t x[static 8]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_8_16_base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_8_16_base) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro computing [c,b,a] := [b,a] + (x - y) * (w - z), adding with carry -// to the [b,a] components but leaving CF aligned with the c term, which is -// a sign bitmask for (x - y) * (w - z). Continued add-with-carry operations -// with [c,...,c] will continue the carry chain correctly starting from -// the c position if desired to add to a longer term of the form [...,b,a]. -// -// c,h,l,t should all be different and t,h should not overlap w,z. -// --------------------------------------------------------------------------- - -.macro muldiffnadd b,a, c,h,l,t, x,y, w,z - subs \t, \x, \y - cneg \t, \t, cc - csetm \c, cc - subs \h, \w, \z - cneg \h, \h, cc - mul \l, \t, \h - umulh \h, \t, \h - cinv \c, \c, cc - adds xzr, \c, #1 - eor \l, \l, \c - adcs \a, \a, \l - eor \h, \h, \c - adcs \b, \b, \h -.endm - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 -#define b0 x6 -#define b1 x7 -#define b2 x8 -#define b3 x9 - -#define s0 x10 -#define s1 x11 -#define s2 x12 -#define s3 x13 -#define s4 x14 -#define s5 x15 -#define s6 x16 -#define s7 x17 - -#define c x19 -#define h x20 -#define l x21 -#define t x22 - -// --------------------------------------------------------------------------- -// Core 4x4->8 ADK multiplication macro -// Does [s7,s6,s5,s4,s3,s2,s1,s0] = [a3,a2,a1,a0] * [b3,b2,b1,b0] -// --------------------------------------------------------------------------- - -.macro mul4 - -// First accumulate all the "simple" products as [s7,s6,s5,s4,s0] - - mul s0, a0, b0 - mul s4, a1, b1 - mul s5, a2, b2 - mul s6, a3, b3 - - umulh s7, a0, b0 - adds s4, s4, s7 - umulh s7, a1, b1 - adcs s5, s5, s7 - umulh s7, a2, b2 - adcs s6, s6, s7 - umulh s7, a3, b3 - adc s7, s7, xzr - -// Multiply by B + 1 to get [s7;s6;s5;s4;s1;s0] - - adds s1, s4, s0 - adcs s4, s5, s4 - adcs s5, s6, s5 - adcs s6, s7, s6 - adc s7, xzr, s7 - -// Multiply by B^2 + 1 to get [s7;s6;s5;s4;s3;s2;s1;s0] - - adds s2, s4, s0 - adcs s3, s5, s1 - adcs s4, s6, s4 - adcs s5, s7, s5 - adcs s6, xzr, s6 - adc s7, xzr, s7 - -// Now add in all the "complicated" terms. - - muldiffnadd s6,s5, c,h,l,t, a2,a3, b3,b2 - adc s7, s7, c - - muldiffnadd s2,s1, c,h,l,t, a0,a1, b1,b0 - adcs s3, s3, c - adcs s4, s4, c - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - - muldiffnadd s5,s4, c,h,l,t, a1,a3, b3,b1 - adcs s6, s6, c - adc s7, s7, c - - muldiffnadd s3,s2, c,h,l,t, a0,a2, b2,b0 - adcs s4, s4, c - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - - muldiffnadd s4,s3, c,h,l,t, a0,a3, b3,b0 - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - muldiffnadd s4,s3, c,h,l,t, a1,a2, b2,b1 - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c -.endm - -// --------------------------------------------------------------------------- -// The main code -// --------------------------------------------------------------------------- - -S2N_BN_SYMBOL(bignum_sqr_8_16_base): - -// Save registers - - stp x19, x20, [sp, #-16]! - stp x21, x22, [sp, #-16]! - -// Load all the inputs first - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - ldp b0, b1, [x, #32] - ldp b2, b3, [x, #48] - -// Square the lower half with a near-clone of bignum_sqr_4_8 - - mul x17, x2, x4 - mul x14, x3, x5 - umulh x20, x2, x4 - subs x21, x2, x3 - cneg x21, x21, cc - csetm x11, cc - subs x12, x5, x4 - cneg x12, x12, cc - mul x13, x21, x12 - umulh x12, x21, x12 - cinv x11, x11, cc - eor x13, x13, x11 - eor x12, x12, x11 - adds x19, x17, x20 - adc x20, x20, xzr - umulh x21, x3, x5 - adds x19, x19, x14 - adcs x20, x20, x21 - adc x21, x21, xzr - adds x20, x20, x14 - adc x21, x21, xzr - cmn x11, #0x1 - adcs x19, x19, x13 - adcs x20, x20, x12 - adc x21, x21, x11 - adds x17, x17, x17 - adcs x19, x19, x19 - adcs x20, x20, x20 - adcs x21, x21, x21 - adc x10, xzr, xzr - mul x12, x2, x2 - mul x13, x3, x3 - mul x15, x2, x3 - umulh x11, x2, x2 - umulh x14, x3, x3 - umulh x16, x2, x3 - adds x11, x11, x15 - adcs x13, x13, x16 - adc x14, x14, xzr - adds x11, x11, x15 - adcs x13, x13, x16 - adc x14, x14, xzr - stp x12, x11, [z] - adds x17, x17, x13 - adcs x19, x19, x14 - adcs x20, x20, xzr - adcs x21, x21, xzr - adc x10, x10, xzr - stp x17, x19, [z, #16] - mul x12, x4, x4 - mul x13, x5, x5 - mul x15, x4, x5 - umulh x11, x4, x4 - umulh x14, x5, x5 - umulh x16, x4, x5 - adds x11, x11, x15 - adcs x13, x13, x16 - adc x14, x14, xzr - adds x11, x11, x15 - adcs x13, x13, x16 - adc x14, x14, xzr - adds x12, x12, x20 - adcs x11, x11, x21 - stp x12, x11, [z, #32] - adcs x13, x13, x10 - adc x14, x14, xzr - stp x13, x14, [z, #48] - -// Square the upper half with a slight variant of the previous block - - mul x17, x6, x8 - mul x14, x7, x9 - umulh x20, x6, x8 - subs x21, x6, x7 - cneg x21, x21, cc - csetm x11, cc - subs x12, x9, x8 - cneg x12, x12, cc - mul x13, x21, x12 - umulh x12, x21, x12 - cinv x11, x11, cc - eor x13, x13, x11 - eor x12, x12, x11 - adds x19, x17, x20 - adc x20, x20, xzr - umulh x21, x7, x9 - adds x19, x19, x14 - adcs x20, x20, x21 - adc x21, x21, xzr - adds x20, x20, x14 - adc x21, x21, xzr - cmn x11, #0x1 - adcs x19, x19, x13 - adcs x20, x20, x12 - adc x21, x21, x11 - adds x17, x17, x17 - adcs x19, x19, x19 - adcs x20, x20, x20 - adcs x21, x21, x21 - adc x10, xzr, xzr - mul x12, x6, x6 - mul x13, x7, x7 - mul x15, x6, x7 - umulh x11, x6, x6 - umulh x14, x7, x7 - umulh x16, x6, x7 - adds x11, x11, x15 - adcs x13, x13, x16 - adc x14, x14, xzr - adds x11, x11, x15 - adcs x13, x13, x16 - adc x14, x14, xzr - stp x12, x11, [z, #64] - adds x17, x17, x13 - adcs x19, x19, x14 - adcs x20, x20, xzr - adcs x21, x21, xzr - adc x10, x10, xzr - stp x17, x19, [z, #80] - mul x12, x8, x8 - mul x13, x9, x9 - mul x15, x8, x9 - umulh x11, x8, x8 - umulh x14, x9, x9 - umulh x16, x8, x9 - adds x11, x11, x15 - adcs x13, x13, x16 - adc x14, x14, xzr - adds x11, x11, x15 - adcs x13, x13, x16 - adc x14, x14, xzr - adds x12, x12, x20 - adcs x11, x11, x21 - stp x12, x11, [z, #96] - adcs x13, x13, x10 - adc x14, x14, xzr - stp x13, x14, [z, #112] - -// Now get the cross-product in [s7,...,s0] and double it as [c,s7,...,s0] - - mul4 - - adds s0, s0, s0 - adcs s1, s1, s1 - adcs s2, s2, s2 - adcs s3, s3, s3 - adcs s4, s4, s4 - adcs s5, s5, s5 - adcs s6, s6, s6 - adcs s7, s7, s7 - adc c, xzr, xzr - -// Add it back to the buffer - - ldp a0, a1, [z, #32] - adds s0, s0, a0 - adcs s1, s1, a1 - stp s0, s1, [z, #32] - - ldp a0, a1, [z, #48] - adcs s2, s2, a0 - adcs s3, s3, a1 - stp s2, s3, [z, #48] - - ldp a0, a1, [z, #64] - adcs s4, s4, a0 - adcs s5, s5, a1 - stp s4, s5, [z, #64] - - ldp a0, a1, [z, #80] - adcs s6, s6, a0 - adcs s7, s7, a1 - stp s6, s7, [z, #80] - - ldp a0, a1, [z, #96] - adcs a0, a0, c - adcs a1, a1, xzr - stp a0, a1, [z, #96] - - ldp a0, a1, [z, #112] - adcs a0, a0, xzr - adc a1, a1, xzr - stp a0, a1, [z, #112] - -// Restore regs and return - - ldp x21, x22, [sp], #16 - ldp x19, x20, [sp], #16 - - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/Makefile b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/Makefile deleted file mode 100644 index c81b9239471..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/Makefile +++ /dev/null @@ -1,103 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - -# If actually on an ARM8 machine, just use the GNU assembler (as). Otherwise -# use a cross-assembling version so that the code can still be assembled -# and the proofs checked against the object files (though you won't be able -# to run code without additional emulation infrastructure). The aarch64 -# cross-assembling version can be installed manually by something like: -# -# sudo apt-get install binutils-aarch64-linux-gnu - -UNAME_RESULT=$(shell uname -p) - -ifeq ($(UNAME_RESULT),aarch64) -GAS=as -else -GAS=aarch64-linux-gnu-as -endif - -# List of object files - -OBJ = bignum_add.o \ - bignum_amontifier.o \ - bignum_amontmul.o \ - bignum_amontredc.o \ - bignum_amontsqr.o \ - bignum_bitfield.o \ - bignum_bitsize.o \ - bignum_cdiv.o \ - bignum_cdiv_exact.o \ - bignum_cld.o \ - bignum_clz.o \ - bignum_cmadd.o \ - bignum_cmnegadd.o \ - bignum_cmod.o \ - bignum_cmul.o \ - bignum_coprime.o \ - bignum_copy.o \ - bignum_copy_row_from_table.o \ - bignum_copy_row_from_table_8n.o \ - bignum_copy_row_from_table_16.o \ - bignum_copy_row_from_table_32.o \ - bignum_ctd.o \ - bignum_ctz.o \ - bignum_demont.o \ - bignum_digit.o \ - bignum_digitsize.o \ - bignum_divmod10.o \ - bignum_emontredc.o \ - bignum_eq.o \ - bignum_even.o \ - bignum_ge.o \ - bignum_gt.o \ - bignum_iszero.o \ - bignum_le.o \ - bignum_lt.o \ - bignum_madd.o \ - bignum_modadd.o \ - bignum_moddouble.o \ - bignum_modexp.o \ - bignum_modifier.o \ - bignum_modinv.o \ - bignum_modoptneg.o \ - bignum_modsub.o \ - bignum_montifier.o \ - bignum_montmul.o \ - bignum_montredc.o \ - bignum_montsqr.o \ - bignum_mul.o \ - bignum_muladd10.o \ - bignum_mux.o \ - bignum_mux16.o \ - bignum_negmodinv.o \ - bignum_nonzero.o \ - bignum_normalize.o \ - bignum_odd.o \ - bignum_of_word.o \ - bignum_optadd.o \ - bignum_optneg.o \ - bignum_optsub.o \ - bignum_optsubadd.o \ - bignum_pow2.o \ - bignum_shl_small.o \ - bignum_shr_small.o \ - bignum_sqr.o \ - bignum_sub.o \ - word_bytereverse.o \ - word_clz.o \ - word_ctz.o \ - word_divstep59.o \ - word_max.o \ - word_min.o \ - word_negmodinv.o \ - word_popcount.o \ - word_recip.o - -%.o : %.S ; $(CC) -E -I../../include $< | $(GAS) -o $@ - - -default: $(OBJ); - -clean:; rm -f *.o *.correct diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_add.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_add.S deleted file mode 100644 index 55710864c4d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_add.S +++ /dev/null @@ -1,125 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Add, z := x + y -// Inputs x[m], y[n]; outputs function return (carry-out) and z[p] -// -// extern uint64_t bignum_add(uint64_t p, uint64_t *z, uint64_t m, -// const uint64_t *x, uint64_t n, const uint64_t *y); -// -// Does the z := x + y operation, truncating modulo p words in general and -// returning a top carry (0 or 1) in the p'th place, only adding the input -// words below p (as well as m and n respectively) to get the sum and carry. -// -// Standard ARM ABI: X0 = p, X1 = z, X2 = m, X3 = x, X4 = n, X5 = y, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_add) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_add) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_add) - .text - .balign 4 - -#define p x0 -#define z x1 -#define m x2 -#define x x3 -#define n x4 -#define y x5 -#define i x6 -#define a x7 -#define d x8 - - -S2N_BN_SYMBOL(bignum_add): - CFI_START - -// First clamp the two input sizes m := min(p,m) and n := min(p,n) since -// we'll never need words past the p'th. Can now assume m <= p and n <= p. -// Then compare the modified m and n and branch accordingly - - cmp m, p - csel m, p, m, cs - cmp n, p - csel n, p, n, cs - cmp m, n - bcc Lbignum_add_ylonger - -// The case where x is longer or of the same size (p >= m >= n) - - sub p, p, m - sub m, m, n - ands i, xzr, xzr - cbz n, Lbignum_add_xmainskip -Lbignum_add_xmainloop: - ldr a, [x, i, lsl #3] - ldr d, [y, i, lsl #3] - adcs a, a, d - str a, [z, i, lsl #3] - add i, i, #1 - sub n, n, #1 - cbnz n, Lbignum_add_xmainloop -Lbignum_add_xmainskip: - cbz m, Lbignum_add_xtopskip -Lbignum_add_xtoploop: - ldr a, [x, i, lsl #3] - adcs a, a, xzr - str a, [z, i, lsl #3] - add i, i, #1 - sub m, m, #1 - cbnz m, Lbignum_add_xtoploop -Lbignum_add_xtopskip: - cbnz p, Lbignum_add_tails - cset x0, cs - ret - -// The case where y is longer (p >= n > m) - -Lbignum_add_ylonger: - sub p, p, n - sub n, n, m - ands i, xzr, xzr - cbz m, Lbignum_add_ytoploop -Lbignum_add_ymainloop: - ldr a, [x, i, lsl #3] - ldr d, [y, i, lsl #3] - adcs a, a, d - str a, [z, i, lsl #3] - add i, i, #1 - sub m, m, #1 - cbnz m, Lbignum_add_ymainloop -Lbignum_add_ytoploop: - ldr a, [y, i, lsl #3] - adcs a, xzr, a - str a, [z, i, lsl #3] - add i, i, #1 - sub n, n, #1 - cbnz n, Lbignum_add_ytoploop -Lbignum_add_ytopskip: - cbnz p, Lbignum_add_tails - cset x0, cs - ret - -// Adding a non-trivial tail, when p > max(m,n) - -Lbignum_add_tails: - cset a, cs - str a, [z, i, lsl #3] - b Lbignum_add_tail -Lbignum_add_tailloop: - str xzr, [z, i, lsl #3] -Lbignum_add_tail: - add i, i, #1 - sub p, p, #1 - cbnz p, Lbignum_add_tailloop - mov x0, xzr - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_add) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontifier.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontifier.S deleted file mode 100644 index 8b0a2f769e4..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontifier.S +++ /dev/null @@ -1,391 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compute "amontification" constant z :== 2^{128k} (congruent mod m) -// Input m[k]; output z[k]; temporary buffer t[>=k] -// -// extern void bignum_amontifier(uint64_t k, uint64_t *z, const uint64_t *m, -// uint64_t *t); -// -// This is called "amontifier" because any other value x can now be mapped into -// the almost-Montgomery domain with an almost-Montgomery multiplication by z. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = m, X3 = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_amontifier) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_amontifier) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_amontifier) - .text - .balign 4 - -#define k x0 -#define z x1 -#define m x2 -#define t x3 - -// Some variables - -#define i x4 -#define j x5 -#define h x6 -#define a x7 -#define l x8 -#define c x9 -#define b x10 -#define d x11 - -// Some aliases for the values b and d - -#define r x10 -#define q x11 - - -S2N_BN_SYMBOL(bignum_amontifier): - CFI_START - -// If k = 0 the whole operation is trivial - - cbz k, Lbignum_amontifier_end - -// Copy the input m into the temporary buffer t. The temporary register -// c matters since we want it to hold the highest digit, ready for the -// normalization phase. - - mov i, xzr -Lbignum_amontifier_copyinloop: - ldr c, [m, i, lsl #3] - str c, [t, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_amontifier_copyinloop - -// Do a rather stupid but constant-time digit normalization, conditionally -// shifting left (k-1) times based on whether the top word is zero. -// With careful binary striding this could be O(k*log(k)) instead of O(k^2) -// while still retaining the constant-time style. -// The "cmp c, xzr" sets the zeroness predicate (ZF) for the entire inner loop - - subs i, k, #1 - beq Lbignum_amontifier_normalized -Lbignum_amontifier_normloop: - mov j, xzr - cmp c, xzr - mov a, xzr -Lbignum_amontifier_shufloop: - mov c, a - ldr a, [t, j, lsl #3] - csel c, c, a, eq - str c, [t, j, lsl #3] - add j, j, #1 - sub d, j, k - cbnz d, Lbignum_amontifier_shufloop - subs i, i, #1 - bne Lbignum_amontifier_normloop - -// We now have the top digit nonzero, assuming the input was nonzero, -// and as per the invariant of the loop above, c holds that digit. So -// now just count c's leading zeros and shift t bitwise that many bits. - -Lbignum_amontifier_normalized: - clz c, c - - mov b, xzr - mov i, xzr - ands xzr, c, #63 - csetm l, ne - neg d, c -Lbignum_amontifier_bitloop: - ldr j, [t, i, lsl #3] - lsl a, j, c - orr a, a, b - lsr b, j, d - and b, b, l - str a, [t, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_amontifier_bitloop - -// Let h be the high word of n, which in all the in-scope cases is >= 2^63. -// Now successively form q = 2^i div h and r = 2^i mod h as i goes from -// 64 to 126. We avoid just using division out of constant-time concerns -// (at the least we would need to fix up h = 0 for out-of-scope inputs) and -// don't bother with Newton-Raphson, since this stupid simple loop doesn't -// contribute much of the overall runtime at typical sizes. - - sub h, k, #1 - ldr h, [t, h, lsl #3] - mov q, #1 - neg r, h - mov i, #62 -Lbignum_amontifier_estloop: - add q, q, q - mov a, h - sub a, a, r - cmp r, a // CF <=> r >= h - r <=> 2 * r >= h - csetm a, cs - sub q, q, a - add r, r, r - and a, a, h - sub r, r, a - subs i, i, #1 - bne Lbignum_amontifier_estloop - -// Strictly speaking the above loop doesn't quite give the true remainder -// and quotient in the special case r = h = 2^63, so fix it up. We get -// q = 2^63 - 1 and r = 2^63 and really want q = 2^63 and r = 0. This is -// supererogatory, because the main property of q used below still holds -// in this case unless the initial m = 1, and then anyway the overall -// specification (congruence modulo m) holds degenerately. But it seems -// nicer to get a "true" quotient and remainder. - - cmp r, h - csinc q, q, q, ne - -// So now we have q and r with 2^126 = q * h + r (imagining r = 0 in the -// fixed-up case above: note that we never actually use the computed -// value of r below and so didn't adjust it). And we can assume the ranges -// q <= 2^63 and r < h < 2^64. -// -// The idea is to use q as a first quotient estimate for a remainder -// of 2^{p+62} mod n, where p = 64 * k. We have, splitting n into the -// high and low parts h and l: -// -// 2^{p+62} - q * n = 2^{p+62} - q * (2^{p-64} * h + l) -// = 2^{p+62} - (2^{p-64} * (q * h) + q * l) -// = 2^{p+62} - 2^{p-64} * (2^126 - r) - q * l -// = 2^{p-64} * r - q * l -// -// Note that 2^{p-64} * r < 2^{p-64} * h <= n -// and also q * l < 2^63 * 2^{p-64} = 2^{p-1} <= n -// so |diff| = |2^{p-64} * r - q * l| < n. -// -// If in fact diff >= 0 then it is already 2^{p+62} mod n. -// otherwise diff + n is the right answer. -// -// To (maybe?) make the computation slightly easier we actually flip -// the sign and compute d = q * n - 2^{p+62}. Then the answer is either -// -d (when negative) or n - d; in either case we effectively negate d. -// This negating tweak in fact spoils the result for cases where -// 2^{p+62} mod n = 0, when we get n instead. However the only case -// where this can happen is m = 1, when the whole spec holds trivially, -// and actually the remainder of the logic below works anyway since -// the latter part of the code only needs a congruence for the k-digit -// result, not strict modular reduction (the doublings will maintain -// the non-strict inequality). - - mov c, xzr - adds i, xzr, xzr -Lbignum_amontifier_mulloop: - ldr a, [t, i, lsl #3] - mul l, q, a - adcs l, l, c - umulh c, q, a - str l, [z, i, lsl #3] - add i, i, #1 - sub a, i, k - cbnz a, Lbignum_amontifier_mulloop - - adc c, c, xzr - mov a, #0x4000000000000000 - subs c, c, a - csetm q, cs - -// Now do [c] * n - d for our final answer - - subs i, xzr, xzr -Lbignum_amontifier_remloop: - ldr a, [t, i, lsl #3] - ldr b, [z, i, lsl #3] - and a, a, q - sbcs a, a, b - str a, [z, i, lsl #3] - add i, i, #1 - sub a, i, k - cbnz a, Lbignum_amontifier_remloop - -// Now still need to do a couple of modular doublings to get us all the -// way up to 2^{p+64} == r from the initial 2^{p+62} == r (mod n). - - mov c, xzr - subs j, xzr, xzr -Lbignum_amontifier_dubloop1: - ldr a, [z, j, lsl #3] - extr c, a, c, #63 - ldr b, [t, j, lsl #3] - sbcs c, c, b - str c, [z, j, lsl #3] - mov c, a - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_amontifier_dubloop1 - lsr c, c, #63 - sbc c, c, xzr - adds j, xzr, xzr -Lbignum_amontifier_corrloop1: - ldr a, [z, j, lsl #3] - ldr b, [t, j, lsl #3] - and b, b, c - adcs a, a, b - str a, [z, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_amontifier_corrloop1 - -// This is not exactly the same: we also copy output to t giving the -// initialization t_1 = r == 2^{p+64} mod n for the main loop next. - - mov c, xzr - subs j, xzr, xzr -Lbignum_amontifier_dubloop2: - ldr a, [z, j, lsl #3] - extr c, a, c, #63 - ldr b, [t, j, lsl #3] - sbcs c, c, b - str c, [z, j, lsl #3] - mov c, a - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_amontifier_dubloop2 - lsr c, c, #63 - sbc c, c, xzr - adds j, xzr, xzr -Lbignum_amontifier_corrloop2: - ldr a, [z, j, lsl #3] - ldr b, [t, j, lsl #3] - and b, b, c - adcs a, a, b - str a, [z, j, lsl #3] - str a, [t, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_amontifier_corrloop2 - -// We then successively generate (k+1)-digit values satisfying -// t_i == 2^{p+64*i} mod n, each of which is stored in h::t. Finish -// initialization by zeroing h initially - - mov h, xzr - -// Then if t_i = 2^{p} * h + l -// we have t_{i+1} == 2^64 * t_i -// = (2^{p+64} * h) + (2^64 * l) -// == r * h + l<<64 -// Do this k more times so we end up == 2^{128*k+64}, one more than we want -// -// Writing B = 2^{64k}, the possible correction of adding r, which for -// a (k+1)-digit result is equivalent to subtracting q = 2^{64*(k+1)} - r -// would give the overall worst-case value minus q of -// [ B * (B^k - 1) + (B - 1) * r ] - [B^{k+1} - r] -// = B * (r - 1) < B^{k+1} so we keep inside k+1 digits as required. -// -// This implementation makes the shift implicit by starting b with the -// "previous" digit (initially 0) to offset things by 1. - - mov i, k -Lbignum_amontifier_modloop: - mov j, xzr - mov b, xzr - adds c, xzr, xzr -Lbignum_amontifier_cmaloop: - ldr a, [z, j, lsl #3] - mul l, h, a - adcs b, b, c - umulh c, h, a - adc c, c, xzr - adds l, b, l - ldr b, [t, j, lsl #3] - str l, [t, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_amontifier_cmaloop - - adcs h, b, c - - csetm l, cs - - adds j, xzr, xzr -Lbignum_amontifier_oaloop: - ldr a, [t, j, lsl #3] - ldr b, [z, j, lsl #3] - and b, b, l - adcs a, a, b - str a, [t, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_amontifier_oaloop - adc h, h, xzr - - subs i, i, #1 - bne Lbignum_amontifier_modloop - -// Now do one almost-Montgomery reduction w.r.t. the original m -// which lops off one 2^64 from the congruence and, with the usual -// almost-Montgomery correction, gets us back inside k digits for -// the end result. - - ldr a, [m] - lsl d, a, #2 - sub d, a, d - eor d, d, #2 - mov l, #1 - madd c, a, d, l - mul b, c, c - madd d, c, d, d - mul c, b, b - madd d, b, d, d - mul b, c, c - madd d, c, d, d - madd d, b, d, d - - ldr b, [t] - mul d, b, d - - mul l, d, a - umulh c, d, a - mov j, #1 - sub a, k, #1 - adds xzr, b, l - cbz a, Lbignum_amontifier_montend - -Lbignum_amontifier_montloop: - ldr a, [m, j, lsl #3] - ldr b, [t, j, lsl #3] - mul l, d, a - adcs b, b, c - umulh c, d, a - adc c, c, xzr - adds b, b, l - sub a, j, #1 - str b, [t, a, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_amontifier_montloop -Lbignum_amontifier_montend: - adcs h, h, c - csetm l, cs - sub a, k, #1 - str h, [t, a, lsl #3] - - subs j, xzr, xzr -Lbignum_amontifier_osloop: - ldr a, [t, j, lsl #3] - ldr b, [m, j, lsl #3] - and b, b, l - sbcs a, a, b - str a, [z, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_amontifier_osloop - -Lbignum_amontifier_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_amontifier) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontmul.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontmul.S deleted file mode 100644 index e04b61b9609..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontmul.S +++ /dev/null @@ -1,185 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Almost-Montgomery multiply, z :== (x * y / 2^{64k}) (congruent mod m) -// Inputs x[k], y[k], m[k]; output z[k] -// -// extern void bignum_amontmul(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *y, const uint64_t *m); -// -// Does z :== (x * y / 2^{64k}) mod m, meaning that the result, in the native -// size k, is congruent modulo m, but might not be fully reduced mod m. This -// is why it is called *almost* Montgomery multiplication. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = x, X3 = y, X4 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_amontmul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_amontmul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_amontmul) - .text - .balign 4 - -#define k x0 -#define z x1 -#define x x2 -#define y x3 -#define m x4 - -// Negated modular inverse -#define w x5 -// Top carry for k'th position -#define c0 x6 -// Additional top carry for (k+1)'th position -#define c1 x7 -// Outer loop counter -#define i x8 -// Home for i'th digit or Montgomery multiplier -#define d x9 -// Inner loop counter -#define j x10 -#define h x11 -#define e x12 -#define l x13 -#define a x14 - -// This is just a short-term temporary used in zero-test subtraction. -// It's aliased to the same register as "a" which is always safe here. - -#define t x14 - -// Some more intuitive names for temp regs in initial word-level negmodinv. -// These just use c0 and c1 again, which aren't initialized early on. - -#define one x6 -#define e1 x6 -#define e2 x7 -#define e4 x6 -#define e8 x7 - - -S2N_BN_SYMBOL(bignum_amontmul): - CFI_START - -// If k = 0 the whole operation is trivial - - cbz k, Lbignum_amontmul_end - -// Compute word-level negated modular inverse w for m == m[0]. -// This is essentially the same as word_negmodinv. - - ldr a, [m] - lsl w, a, #2 - sub w, a, w - eor w, w, #2 - mov one, #1 - madd e1, a, w, one - mul e2, e1, e1 - madd w, e1, w, w - mul e4, e2, e2 - madd w, e2, w, w - mul e8, e4, e4 - madd w, e4, w, w - madd w, e8, w, w - -// Initialize the output c0::z to zero so we can then consistently add rows. -// It would be a bit more efficient to special-case the zeroth row, but -// this keeps the code slightly simpler. - - mov i, xzr -Lbignum_amontmul_zoop: - str xzr, [z, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_amontmul_zoop - mov c0, xzr - -// Outer loop pulling down digits d=x[i], multiplying by y and reducing - - mov i, xzr -Lbignum_amontmul_outerloop: - -// Multiply-add loop where we always have CF + previous high part h to add in -// Note that in general we do need yet one more carry in this phase and hence -// initialize c1 with the top carry. - - ldr d, [x, i, lsl #3] - mov j, xzr - adds h, xzr, xzr -Lbignum_amontmul_maddloop: - ldr a, [y, j, lsl #3] - ldr e, [z, j, lsl #3] - mul l, d, a - adcs e, e, h - umulh h, d, a - adc h, h, xzr - adds e, e, l - str e, [z, j, lsl #3] - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_amontmul_maddloop - adcs c0, c0, h - adc c1, xzr, xzr - -// Montgomery reduction loop, similar but offsetting writebacks - - ldr e, [z] - mul d, e, w - ldr a, [m] - mul l, d, a - umulh h, d, a - adds e, e, l // Will be zero but want the carry - mov j, #1 - sub t, k, #1 - cbz t, Lbignum_amontmul_montend -Lbignum_amontmul_montloop: - ldr a, [m, j, lsl #3] - ldr e, [z, j, lsl #3] - mul l, d, a - adcs e, e, h - umulh h, d, a - adc h, h, xzr - adds e, e, l - sub l, j, #1 - str e, [z, l, lsl #3] - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_amontmul_montloop -Lbignum_amontmul_montend: - adcs h, c0, h - adc c0, c1, xzr - sub l, j, #1 - str h, [z, l, lsl #3] - -// End of outer loop - - add i, i, #1 - cmp i, k - bcc Lbignum_amontmul_outerloop - -// Now convert carry word, which is always in {0,1}, into a mask -// and do a masked subtraction of m for the final almost-Montgomery result. - - neg c0, c0 - subs j, xzr, xzr -Lbignum_amontmul_corrloop: - ldr a, [z, j, lsl #3] - ldr e, [m, j, lsl #3] - and e, e, c0 - sbcs a, a, e - str a, [z, j, lsl #3] - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_amontmul_corrloop - -Lbignum_amontmul_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_amontmul) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontredc.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontredc.S deleted file mode 100644 index aa1f1f56244..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontredc.S +++ /dev/null @@ -1,180 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Almost-Montgomery reduce, z :== (x' / 2^{64p}) (congruent mod m) -// Inputs x[n], m[k], p; output z[k] -// -// extern void bignum_amontredc(uint64_t k, uint64_t *z, uint64_t n, -// const uint64_t *x, const uint64_t *m, uint64_t p); -// -// Does a :== (x' / 2^{64p}) mod m where x' = x if n <= p + k and in general -// is the lowest (p+k) digits of x. That is, p-fold almost-Montgomery reduction -// w.r.t. a k-digit modulus m giving a k-digit answer. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = n, X3 = x, X4 = m, X5 = p -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_amontredc) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_amontredc) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_amontredc) - .text - .balign 4 - -#define k x0 -#define z x1 -#define n x2 -#define x x3 -#define m x4 -#define p x5 - -// Negated modular inverse -#define w x6 -// Outer loop counter -#define i x7 -// Inner loop counter -#define j x8 -// Home for Montgomery multiplier -#define d x9 -// Top carry for current window -#define c x14 - -#define h x10 -#define e x11 -#define l x12 -#define a x13 - -// Some more intuitive names for temp regs in initial word-level negmodinv. -// These just use i and j again, which aren't used early on. - -#define one x7 -#define e1 x7 -#define e2 x8 -#define e4 x7 -#define e8 x8 - - -S2N_BN_SYMBOL(bignum_amontredc): - CFI_START - -// If k = 0 the whole operation is trivial - - cbz k, Lbignum_amontredc_end - -// Compute word-level negated modular inverse w for m == m[0]. -// This is essentially the same as word_negmodinv. - - ldr a, [m] - lsl w, a, #2 - sub w, a, w - eor w, w, #2 - mov one, #1 - madd e1, a, w, one - mul e2, e1, e1 - madd w, e1, w, w - mul e4, e2, e2 - madd w, e2, w, w - mul e8, e4, e4 - madd w, e4, w, w - madd w, e8, w, w - -// Initialize z to the lowest k digits of the input, zero-padding if n < k. - - cmp n, k - csel j, k, n, cs - mov i, xzr - cbz j, Lbignum_amontredc_padloop -Lbignum_amontredc_copyloop: - ldr a, [x, i, lsl #3] - str a, [z, i, lsl #3] - add i, i, #1 - cmp i, j - bcc Lbignum_amontredc_copyloop - - cmp i, k - bcs Lbignum_amontredc_initialized - -Lbignum_amontredc_padloop: - str xzr, [z, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_amontredc_padloop - -Lbignum_amontredc_initialized: - mov c, xzr - -// Now if p = 0 that's the end of the operation - - cbz p, Lbignum_amontredc_end - -// Outer loop, just doing a standard Montgomery reduction on z - - mov i, xzr -Lbignum_amontredc_outerloop: - - ldr e, [z] - mul d, e, w - ldr a, [m] - mul l, d, a - umulh h, d, a - adds e, e, l // Will be zero but want the carry - mov j, #1 - sub a, k, #1 - cbz a, Lbignum_amontredc_montend -Lbignum_amontredc_montloop: - ldr a, [m, j, lsl #3] - ldr e, [z, j, lsl #3] - mul l, d, a - adcs e, e, h - umulh h, d, a - adc h, h, xzr - adds e, e, l - sub l, j, #1 - str e, [z, l, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_amontredc_montloop -Lbignum_amontredc_montend: - adcs h, h, c - adc c, xzr, xzr - add j, j, i - cmp j, n - bcs Lbignum_amontredc_offtheend - ldr a, [x, j, lsl #3] - adds h, h, a - adc c, c, xzr -Lbignum_amontredc_offtheend: - sub j, k, #1 - str h, [z, j, lsl #3] - -// End of outer loop - - add i, i, #1 - cmp i, p - bcc Lbignum_amontredc_outerloop - -// Now convert carry word, which is always in {0,1}, into a mask -// and do a masked subtraction of m for the final almost-Montgomery result. - - neg c, c - subs j, xzr, xzr -Lbignum_amontredc_corrloop: - ldr a, [z, j, lsl #3] - ldr e, [m, j, lsl #3] - and e, e, c - sbcs a, a, e - str a, [z, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_amontredc_corrloop - -Lbignum_amontredc_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_amontredc) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontsqr.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontsqr.S deleted file mode 100644 index c88c47b62b7..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_amontsqr.S +++ /dev/null @@ -1,185 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Almost-Montgomery square, z :== (x^2 / 2^{64k}) (congruent mod m) -// Inputs x[k], m[k]; output z[k] -// -// extern void bignum_amontsqr(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *m); -// -// Does z :== (x^2 / 2^{64k}) mod m, meaning that the result, in the native -// size k, is congruent modulo m, but might not be fully reduced mod m. This -// is why it is called *almost* Montgomery squaring. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = x, X3 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_amontsqr) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_amontsqr) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_amontsqr) - .text - .balign 4 - -#define k x0 -#define z x1 -#define x x2 -#define m x3 - -// Negated modular inverse -#define w x4 -// Top carry for k'th position -#define c0 x5 -// Additional top carry for (k+1)'th position -#define c1 x6 -// Outer loop counter -#define i x7 -// Home for i'th digit or Montgomery multiplier -#define d x8 -// Inner loop counter -#define j x9 - -#define h x10 -#define e x11 -#define l x12 -#define a x13 - -// This is just a short-term temporary used in zero-test subtraction. -// It's aliased to the same register as "a" which is always safe here. - -#define t x13 - -// Some more intuitive names for temp regs in initial word-level negmodinv. -// These just use c0 and c1 again, which aren't initialized early on. - -#define one x5 -#define e1 x5 -#define e2 x6 -#define e4 x5 -#define e8 x6 - - -S2N_BN_SYMBOL(bignum_amontsqr): - CFI_START - -// If k = 0 the whole operation is trivial - - cbz k, Lbignum_amontsqr_end - -// Compute word-level negated modular inverse w for m == m[0]. -// This is essentially the same as word_negmodinv. - - ldr a, [m] - lsl w, a, #2 - sub w, a, w - eor w, w, #2 - mov one, #1 - madd e1, a, w, one - mul e2, e1, e1 - madd w, e1, w, w - mul e4, e2, e2 - madd w, e2, w, w - mul e8, e4, e4 - madd w, e4, w, w - madd w, e8, w, w - -// Initialize the output c0::z to zero so we can then consistently add rows. -// It would be a bit more efficient to special-case the zeroth row, but -// this keeps the code slightly simpler. - - mov i, xzr -Lbignum_amontsqr_zoop: - str xzr, [z, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_amontsqr_zoop - mov c0, xzr - -// Outer loop pulling down digits d=x[i], multiplying by x and reducing - - mov i, xzr -Lbignum_amontsqr_outerloop: - -// Multiply-add loop where we always have CF + previous high part h to add in -// Note that in general we do need yet one more carry in this phase and hence -// initialize c1 with the top carry. - - ldr d, [x, i, lsl #3] - mov j, xzr - adds h, xzr, xzr -Lbignum_amontsqr_maddloop: - ldr a, [x, j, lsl #3] - ldr e, [z, j, lsl #3] - mul l, d, a - adcs e, e, h - umulh h, d, a - adc h, h, xzr - adds e, e, l - str e, [z, j, lsl #3] - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_amontsqr_maddloop - adcs c0, c0, h - adc c1, xzr, xzr - -// Montgomery reduction loop, similar but offsetting writebacks - - ldr e, [z] - mul d, e, w - ldr a, [m] - mul l, d, a - umulh h, d, a - adds e, e, l // Will be zero but want the carry - mov j, #1 - sub t, k, #1 - cbz t, Lbignum_amontsqr_montend -Lbignum_amontsqr_montloop: - ldr a, [m, j, lsl #3] - ldr e, [z, j, lsl #3] - mul l, d, a - adcs e, e, h - umulh h, d, a - adc h, h, xzr - adds e, e, l - sub l, j, #1 - str e, [z, l, lsl #3] - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_amontsqr_montloop -Lbignum_amontsqr_montend: - adcs h, c0, h - adc c0, c1, xzr - sub l, j, #1 - str h, [z, l, lsl #3] - -// End of outer loop - - add i, i, #1 - cmp i, k - bcc Lbignum_amontsqr_outerloop - -// Now convert carry word, which is always in {0,1}, into a mask -// and do a masked subtraction of m for the final almost-Montgomery result. - - neg c0, c0 - subs j, xzr, xzr -Lbignum_amontsqr_corrloop: - ldr a, [z, j, lsl #3] - ldr e, [m, j, lsl #3] - and e, e, c0 - sbcs a, a, e - str a, [z, j, lsl #3] - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_amontsqr_corrloop - -Lbignum_amontsqr_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_amontsqr) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_bitfield.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_bitfield.S deleted file mode 100644 index 8aa74209c21..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_bitfield.S +++ /dev/null @@ -1,98 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Select bitfield starting at bit n with length l <= 64 -// Inputs x[k], n, l; output function return -// -// extern uint64_t bignum_bitfield(uint64_t k, const uint64_t *x, uint64_t n, -// uint64_t l); -// -// One-word bitfield from a k-digit (digit=64 bits) bignum, in constant-time -// style. Bitfield starts at bit n and has length l, indexing from 0 (=LSB). -// Digits above the top are treated uniformly as zero, as usual. Since the -// result is returned in a single word, effectively we use l' = min(64,l) -// for the length. -// -// Standard ARM ABI: X0 = k, X1 = x, X2 = n, X3 = l, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_bitfield) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_bitfield) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_bitfield) - .text - .balign 4 - -#define k x0 -#define x x1 -#define n x2 -#define l x3 - -#define d x4 -#define e x5 -#define i x6 -#define a x7 -#define m x8 - - -S2N_BN_SYMBOL(bignum_bitfield): - CFI_START - -// For length zero finish immediately (the return value in x0 is 0) - - cbz k, Lbignum_bitfield_end - -// Decompose the index into n = 64 * n + m, then increment n for next part - - and m, n, #63 - lsr n, n, #6 - add n, n, #1 - -// Run over the digits setting d = n'th and e = (n+1)'th - - mov i, xzr - mov e, xzr -Lbignum_bitfield_loop: - ldr a, [x, i, lsl #3] - cmp i, n - csel d, a, d, cc - csel e, a, e, eq - add i, i, #1 - cmp i, k - bcc Lbignum_bitfield_loop - -// Override d with 0 if we ran off the end (e will retain original 0). - - cmp i, n - csel d, xzr, d, cc - -// Override e if we have m = 0 (i.e. original n was divisible by 64) -// This is because then we want to shift it right by 64 below. - - cmp m, xzr - csel e, xzr, e, eq - -// Combine shifted digits to get the bitfield(n,64) - - lsr d, d, m - neg m, m - lsl e, e, m - orr a, d, e - -// Now mask it down to get bitfield (n,l) - - cmp l, #64 - cset m, cc - lsl m, m, l - sub m, m, #1 - and x0, a, m -Lbignum_bitfield_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_bitfield) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_bitsize.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_bitsize.S deleted file mode 100644 index 96635026119..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_bitsize.S +++ /dev/null @@ -1,72 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Return size of bignum in bits -// Input x[k]; output function return -// -// extern uint64_t bignum_bitsize(uint64_t k, const uint64_t *x); -// -// In the case of a zero bignum as input the result is 0 -// -// In principle this has a precondition k < 2^58, but obviously that -// is always true in practice because of address space limitations. -// -// Standard ARM ABI: X0 = k, X1 = x, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_bitsize) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_bitsize) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_bitsize) - .text - .balign 4 - -#define k x0 -#define x x1 -#define i x2 -#define w x3 -#define a x4 -#define j x5 - - -S2N_BN_SYMBOL(bignum_bitsize): - CFI_START - -// If the bignum is zero-length, x0 is already the right answer of 0 - - cbz k, Lbignum_bitsize_end - -// Use w = a[i-1] to store nonzero words in a bottom-up sweep -// Set the initial default to be as if we had a 11...11 word directly below - - mov i, xzr - mov w, #-1 - mov j, xzr -Lbignum_bitsize_loop: - ldr a, [x, j, lsl #3] - add j, j, #1 - cmp a, #0 - csel i, j, i, ne - csel w, a, w, ne - cmp j, k - bne Lbignum_bitsize_loop - -// Now w = a[i-1] is the highest nonzero word, or in the zero case the -// default of the "extra" 11...11 = a[0-1]. We now want 64* i - clz(w). -// Note that this code does not rely on the behavior of the clz instruction -// for zero inputs, though the ARM manual does in fact guarantee clz(0) = 64. - - lsl i, i, #6 - clz a, w - sub x0, i, a - -Lbignum_bitsize_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_bitsize) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cdiv.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cdiv.S deleted file mode 100644 index 6c3f127e521..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cdiv.S +++ /dev/null @@ -1,283 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Divide by a single (nonzero) word, z := x / m and return x mod m -// Inputs x[n], m; outputs function return (remainder) and z[k] -// -// extern uint64_t bignum_cdiv(uint64_t k, uint64_t *z, uint64_t n, -// const uint64_t *x, uint64_t m); -// -// Does the "z := x / m" operation where x is n digits, result z is k. -// Truncates the quotient in general, but always (for nonzero m) returns -// the true remainder x mod m. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = n, X3 = x, X4 = m, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cdiv) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cdiv) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cdiv) - .text - .balign 4 - -#define k x0 -#define z x1 -#define n x2 -#define x x3 -#define m x4 - -// Main variables - -#define w x5 -#define i x6 -#define a x7 -#define c x8 -#define d x9 -#define e x10 -#define f x11 -#define l x12 - -// These two are the same - -#define h x13 -#define q x13 - -// Variables for the negmodinv - -#define one x6 -#define e1 x6 -#define e2 x7 -#define e4 x6 -#define e8 x7 - -// Variable to hold the remainder - -#define r x14 - -S2N_BN_SYMBOL(bignum_cdiv): - CFI_START - -// Effectively the same dataflow as bignum_cmod, with some basic -// variable changes (using n for the size not k, returning r, etc.) -// and using the i counter instead of modifying the size as a loop -// counter. - - mov r, xzr - cbz n, Lbignum_cdiv_nomodulus - - clz e, m - lsl f, m, e - - lsr a, f, #16 - eor w, a, #0x1ffffffffffff - add a, a, #0x1 - lsr w, w, #32 - mneg r, a, w - lsr d, r, #49 - mul d, d, d - lsr r, r, #34 - add r, d, r - orr d, d, #0x40000000 - mul d, r, d - lsr d, d, #30 - lsl r, w, #30 - madd w, w, d, r - lsr w, w, #30 - mneg r, a, w - lsr r, r, #24 - mul r, r, w - lsl w, w, #16 - lsr r, r, #24 - add w, w, r - mneg r, a, w - lsr r, r, #32 - mul r, r, w - lsl w, w, #31 - lsr r, r, #17 - add w, w, r - mul d, f, w - umulh r, f, w - extr d, r, d, #60 - lsr r, w, #33 - mvn d, d - mul d, r, d - lsl w, w, #1 - lsr d, d, #33 - add w, w, d - adds d, w, #0x1 - cinv d, d, eq - umulh r, f, d - adds xzr, r, f - csel w, w, d, cs - - mneg r, w, f - - mov h, xzr - mov l, xzr - mov i, n -Lbignum_cdiv_modloop: - sub i, i, #1 - ldr d, [x, i, lsl #3] - mul a, r, h - umulh h, r, h - adds a, a, d - adcs h, h, l - csel l, r, xzr, cs - adds l, l, a - adc h, h, xzr - cbnz i, Lbignum_cdiv_modloop - - umulh c, w, h - adds c, c, h - csel r, f, xzr, cs - - mul a, c, f - umulh d, c, f - add d, d, r - subs l, l, a - sbcs h, h, d - - csel a, f, xzr, ne - subs l, l, a - sbcs h, h, xzr - - csel a, f, xzr, ne - sub l, l, a - - umulh c, w, l - adds c, c, l - cset r, cs - extr c, r, c, #1 - - eor e, e, #63 - lsr c, c, e - - mul a, c, m - sub l, l, a - - subs r, l, m - csel r, r, l, cs - -Lbignum_cdiv_nomodulus: - -// If k = 0 then there's no more to be done - - cbz k, Lbignum_cdiv_end - -// Let e be the number of trailing zeros in m. This implementation uses -// 63 - clz(-m & m) which is a bit slicker than the main word_ctz function -// but fails for m = 0. We don't have to worry about that case here. - - neg e, m - and e, e, m - clz e, e - eor e, e, #63 - -// Also generate a corresponding bitmask f for selecting bottom 64 - e bits. - - mov f, #-1 - lsr f, f, e - -// Now just shift m right by e bits. So hereafter we can assume m is odd -// but we first need to shift the input right by e bits then divide by m. - - lsr m, m, e - -// Compute the negated modular inverse w with w * m + 1 == 0 (mod 2^64) -// This is essentially the same as word_negmodinv. - - sub w, m, m, lsl #2 - eor w, w, #2 - mov one, #1 - madd e1, m, w, one - mul e2, e1, e1 - madd w, e1, w, w - mul e4, e2, e2 - madd w, e2, w, w - mul e8, e4, e4 - madd w, e4, w, w - madd w, e8, w, w - -// We have the remainder r, so now x = m * y + r for some quotient y -// to be computed. Consider x' = x + (m - r) = m * (y + 1) and do a -// Montgomery reduction, keeping the cofactor z. This gives us -// x' + m * z = 2^{64k} * c where c <= m. Thus since x' = m * (y + 1) -// we have -// -// m * (y + z + 1) = 2^{64k} * c -// -// This means m * (y + z + 1) == 0 (mod 2^{64k}), even when we truncate -// x to k digits (if in fact k < n). Since m is odd, it's coprime to -// 2^{64k} so we can cancel and get y + z + 1 == 0 (mod 2^{64k}), and -// hence using logical complement y == ~z (mod 2^{64k}). Thus we can -// write back the logical complements of the cofactor as the answer. -// Start with carry word c = m - r/2^e to make the initial tweak -// x' = x + (m - r); since we've shifted everything initially by e -// we need to shift the remainder too before subtracting from the -// shifted m. - - lsr c, r, e - sub c, m, c - mov i, xzr - -// Unless n = 0, preload the zeroth digit shifted right e places and bump -// up the x pointer by 8 and n down by 1, to ease indexing and comparison -// using the same variable i in the main loop. When n = 0 we leave it alone, -// as the comparison i < n will always fail and the x pointer is unused. - - mov d, xzr - cbz n, Lbignum_cdiv_loop - ldr d, [x], #8 - lsr d, d, e - sub n, n, 1 - -Lbignum_cdiv_loop: - -// Load the next digit up to get [l,d] then shift right e places, -// eventually setting d back to the other part of the newly loaded digit -// ready for the next time round the loop. - - mov l, xzr - cmp i, n - bcs Lbignum_cdiv_noload - ldr l, [x, i, lsl #3] -Lbignum_cdiv_noload: - rorv l, l, e - bic a, l, f - orr a, d, a - and d, l, f - -// Now a is the next digit after shifting right by e places, c the carry-in. -// Do the main Montgomery step with the (odd) m, writing back ~q. - - adds a, a, c - mul q, a, w - cset c, cs - mvn l, q - str l, [z, i, lsl #3] - - mul l, q, m - umulh h, q, m - - adds l, l, a - adc c, h, c - - add i, i, #1 - cmp i, k - bcc Lbignum_cdiv_loop - -// And return the remainder - -Lbignum_cdiv_end: - - mov x0, r - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cdiv) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cdiv_exact.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cdiv_exact.S deleted file mode 100644 index 2435ef0d723..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cdiv_exact.S +++ /dev/null @@ -1,167 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Divide by a single word, z := x / m *when known to be exact* -// Inputs x[n], m; output z[k] -// -// extern void bignum_cdiv_exact(uint64_t k, uint64_t *z, uint64_t n, -// const uint64_t *x, uint64_t m); -// -// Does the "z := x / m" operation where x is n digits and result z is k, -// *assuming* that m is nonzero and that the input x is in fact an -// exact multiple of m. (If this isn't known, use the general bignum_cdiv -// function instead.) In general the result is truncated to k digits. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = n, X3 = x, X4 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cdiv_exact) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cdiv_exact) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cdiv_exact) - .text - .balign 4 - -#define k x0 -#define z x1 -#define n x2 -#define x x3 -#define m x4 - -// Main variables - -#define w x5 -#define i x6 -#define a x7 -#define c x8 -#define d x9 -#define e x10 -#define f x11 -#define l x12 - -// These two are the same - -#define h x13 -#define q x13 - -// Variables for the negmodinv - -#define one x6 -#define e1 x6 -#define e2 x7 -#define e4 x6 -#define e8 x7 - -S2N_BN_SYMBOL(bignum_cdiv_exact): - CFI_START - -// If k = 0 then there's nothing to be done - - cbz k, Lbignum_cdiv_exact_end - -// Let e be the number of trailing zeros in m. This implementation uses -// 63 - clz(-m & m) which is a bit slicker than the main word_ctz function -// but fails for m = 0. We don't have to worry about that case here. - - neg e, m - and e, e, m - clz e, e - eor e, e, #63 - -// Also generate a corresponding bitmask f for selecting bottom 64 - e bits. - - mov f, #-1 - lsr f, f, e - -// Now just shift m right by e bits. So hereafter we can assume m is odd -// but we first need to shift the input right by e bits then divide by m. - - lsr m, m, e - -// Compute the negated modular inverse w with w * m + 1 == 0 (mod 2^64) -// This is essentially the same as word_negmodinv. - - sub w, m, m, lsl #2 - eor w, w, #2 - mov one, #1 - madd e1, m, w, one - mul e2, e1, e1 - madd w, e1, w, w - mul e4, e2, e2 - madd w, e2, w, w - mul e8, e4, e4 - madd w, e4, w, w - madd w, e8, w, w - -// Consider x' = x + m and do a Montgomery reduction, keeping the cofactor z. -// This gives us x' + m * z = 2^{64k} * c where c <= m. Assuming x = m * y -// we then have m * y + m + m * z = 2^{64k} * c, i.e. -// -// m * (y + z + 1) = 2^{64k} * c -// -// This means m * (y + z + 1) == 0 (mod 2^{64k}), even when we truncate -// x to k digits (if in fact k < n). Since m is odd, it's coprime to -// 2^{64k} so we can cancel and get y + z + 1 == 0 (mod 2^{64k}), and -// hence using logical complement y == ~z (mod 2^{64k}). Thus we can -// write back the logical complements of the cofactor as the answer. -// Start with carry word c = m to make the initial tweak x' = x + m. - - mov c, m - mov i, xzr - -// Unless n = 0, preload the zeroth digit shifted right e places and bump -// up the x pointer by 8 and n down by 1, to ease indexing and comparison -// using the same variable i in the main loop. When n = 0 we leave it alone, -// as the comparison i < n will always fail and the x pointer is unused. - - mov d, xzr - cbz n, Lbignum_cdiv_exact_loop - ldr d, [x], #8 - lsr d, d, e - sub n, n, 1 - -Lbignum_cdiv_exact_loop: - -// Load the next digit up to get [l,d] then shift right e places, -// eventually setting d back to the other part of the newly loaded digit -// ready for the next time round the loop. - - mov l, xzr - cmp i, n - bcs Lbignum_cdiv_exact_noload - ldr l, [x, i, lsl #3] -Lbignum_cdiv_exact_noload: - rorv l, l, e - bic a, l, f - orr a, d, a - and d, l, f - -// Now a is the next digit after shifting right by e places, c the carry-in. -// Do the main Montgomery step with the (odd) m, writing back ~q. - - adds a, a, c - mul q, a, w - cset c, cs - mvn l, q - str l, [z, i, lsl #3] - - mul l, q, m - umulh h, q, m - - adds l, l, a - adc c, h, c - - add i, i, #1 - cmp i, k - bcc Lbignum_cdiv_exact_loop - -Lbignum_cdiv_exact_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cdiv_exact) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cld.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cld.S deleted file mode 100644 index 5e49198a097..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cld.S +++ /dev/null @@ -1,57 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count leading zero digits (64-bit words) -// Input x[k]; output function return -// -// extern uint64_t bignum_cld(uint64_t k, const uint64_t *x); -// -// In the case of a zero bignum as input the result is k -// -// Standard ARM ABI: X0 = k, X1 = x, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cld) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cld) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cld) - .text - .balign 4 - -#define k x0 -#define x x1 -#define i x2 -#define a x3 -#define j x4 - - -S2N_BN_SYMBOL(bignum_cld): - CFI_START - -// If the bignum is zero-length, x0 is already the right answer of k = 0 - - cbz k, Lbignum_cld_end - -// Run over the words j = 0..i-1, and set i := j + 1 when hitting nonzero a[j] - - mov i, xzr - mov j, xzr -Lbignum_cld_loop: - ldr a, [x, j, lsl #3] - add j, j, #1 - cmp a, #0 - csel i, j, i, ne - cmp j, k - bne Lbignum_cld_loop - - sub x0, x0, i -Lbignum_cld_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cld) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_clz.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_clz.S deleted file mode 100644 index f67bdbbead1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_clz.S +++ /dev/null @@ -1,73 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count leading zero bits -// Input x[k]; output function return -// -// extern uint64_t bignum_clz(uint64_t k, const uint64_t *x); -// -// In the case of a zero bignum as input the result is 64 * k -// -// In principle this has a precondition k < 2^58, but obviously that -// is always true in practice because of address space limitations -// -// Standard ARM ABI: X0 = k, X1 = x, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_clz) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_clz) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_clz) - .text - .balign 4 - -#define k x0 -#define x x1 -#define i x2 -#define w x3 -#define a x4 -#define j x5 - - -S2N_BN_SYMBOL(bignum_clz): - CFI_START - -// If the bignum is zero-length, x0 is already the right answer of 0 - - cbz k, Lbignum_clz_end - -// Use w = a[i-1] to store nonzero words in a bottom-up sweep -// Set the initial default to be as if we had a 11...11 word directly below - - mov i, xzr - mov w, #-1 - mov j, xzr -Lbignum_clz_loop: - ldr a, [x, j, lsl #3] - add j, j, #1 - cmp a, #0 - csel i, j, i, ne - csel w, a, w, ne - cmp j, k - bne Lbignum_clz_loop - -// Now w = a[i-1] is the highest nonzero word, or in the zero case the -// default of the "extra" 11...11 = a[0-1]. We now want 64*(k - i) + clz(w). -// Note that this code does not rely on the behavior of the clz instruction -// for zero inputs, though the ARM manual does in fact guarantee clz(0) = 64. - - sub k, k, i - lsl k, k, #6 - clz a, w - add x0, k, a - -Lbignum_clz_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_clz) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmadd.S deleted file mode 100644 index fec3d5ad11c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmadd.S +++ /dev/null @@ -1,118 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply-add with single-word multiplier, z := z + c * y -// Inputs c, y[n]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_cmadd(uint64_t k, uint64_t *z, uint64_t c, uint64_t n, -// const uint64_t *y); -// -// Does the "z := z + c * y" operation where y is n digits, result z is p. -// Truncates the result in general. -// -// The return value is a high/carry word that is meaningful when p = n + 1, or -// more generally when n <= p and the result fits in p + 1 digits. In these -// cases it gives the top digit of the (p + 1)-digit result. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = c, X3 = n, X4 = y, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmadd) - .text - .balign 4 - -#define p x0 -#define z x1 -#define c x2 -#define n x3 -#define x x4 - -#define i x5 -#define h x6 -#define l x7 -#define a x8 - -#define b x9 - - -S2N_BN_SYMBOL(bignum_cmadd): - CFI_START - -// First clamp the input size n := min(p,n) since we can never need to read -// past the p'th term of the input to generate p-digit output. -// Subtract p := p - min(n,p) so it holds the size of the extra tail needed - - cmp n, p - csel n, p, n, cs - sub p, p, n - -// Initialize high part h = 0; if n = 0 do nothing but return that zero - - adds h, xzr, xzr - cbz n, Lbignum_cmadd_end - -// Initialization of the loop: 2^64 * CF + [h,z_0'] = z_0 + c * x_0 - - ldr a, [x] - mul l, c, a - umulh h, c, a - ldr b, [z] - adds b, b, l - str b, [z] - mov i, #8 - sub n, n, #1 - cbz n, Lbignum_cmadd_tail - -// Main loop, where we always have CF + previous high part h to add in - -Lbignum_cmadd_loop: - ldr a, [x, i] - ldr b, [z, i] - mul l, c, a - adcs b, b, h - umulh h, c, a - adc h, h, xzr - adds b, b, l - str b, [z, i] - add i, i, #8 - sub n, n, #1 - cbnz n, Lbignum_cmadd_loop - -// Propagate the carry all the way to the end with h as extra carry word - -Lbignum_cmadd_tail: - cbz p, Lbignum_cmadd_end - ldr b, [z, i] - adcs b, b, h - str b, [z, i] - mov h, xzr - sub p, p, #1 - cbz p, Lbignum_cmadd_end - -Lbignum_cmadd_tloop: - add i, i, #8 - ldr b, [z, i] - adcs b, b, xzr - str b, [z, i] - sub p, p, #1 - cbnz p, Lbignum_cmadd_tloop - -// Return the high/carry word. This gives the top word of the result provided -// n <= p and the result fits in p + 1 digits. More generally, indeed, the -// 2^64 * CF + return = the top part of the result whenever n <= p, though this -// is not very exploitable from a C call. - -Lbignum_cmadd_end: - adcs x0, h, xzr - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmnegadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmnegadd.S deleted file mode 100644 index c6af6d9c7e0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmnegadd.S +++ /dev/null @@ -1,132 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Negated multiply-add with single-word multiplier, z := z - c * y -// Inputs c, y[n]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_cmnegadd(uint64_t k, uint64_t *z, uint64_t c, uint64_t n, -// const uint64_t *y); -// -// Does the "z := z - c * y" operation where y is n digits, result z is p. -// Truncates the result in general. -// -// The return value is a high/carry word that is meaningful when n <= p. -// It is interpreted negatively as z' - 2^{64k} * return = z - c * y. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = c, X3 = n, X4 = y, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmnegadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmnegadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmnegadd) - .text - .balign 4 - -#define p x0 -#define z x1 -#define c x2 -#define n x3 -#define x x4 - -#define i x5 -#define h x6 -#define l x7 -#define a x8 - -#define b x9 - - -S2N_BN_SYMBOL(bignum_cmnegadd): - CFI_START - -// First clamp the input size n := min(p,n) since we can never need to read -// past the p'th term of the input to generate p-digit output. -// Subtract p := p - min(n,p) so it holds the size of the extra tail needed - - cmp n, p - csel n, p, n, cs - sub p, p, n - -// Initialize high part h = 0; if n = 0 do nothing but return that zero - - mov h, xzr - cbz n, Lbignum_cmnegadd_end - -// Initialization of the loop: 2^64 * CF + [h,z_0'] = z_0 + c * ~x_0 + c - - ldr a, [x] - mvn a, a - mul l, c, a - umulh h, c, a - adds l, l, c - adc h, h, xzr - ldr b, [z] - adds b, b, l - str b, [z] - mov i, #8 - sub n, n, #1 - cbz n, Lbignum_cmnegadd_tail - -// Main loop, where we always have CF + previous high part h to add in - -Lbignum_cmnegadd_loop: - ldr a, [x, i] - ldr b, [z, i] - mvn a, a - mul l, c, a - adcs b, b, h - umulh h, c, a - adc h, h, xzr - adds b, b, l - str b, [z, i] - add i, i, #8 - sub n, n, #1 - cbnz n, Lbignum_cmnegadd_loop - -// At this point we have 2^{64n} * (h + CF) + z' = z + c * (2^{64n} - x) -// so z' - 2^{64n} * (c - (h + CF)) = z - c * x. -// Since z - c * x < 2^{64n} we must have c - (h + CF) >= 0. -// Accumulate the negative carry in h for consistency with trivial cases. - -Lbignum_cmnegadd_tail: - adc h, h, xzr - sub h, c, h - -// Propagate the carry all the way to the end with h as extra carry word - - cbz p, Lbignum_cmnegadd_end - ldr b, [z, i] - subs b, b, h - str b, [z, i] - mov h, xzr - sub p, p, #1 - cbz p, Lbignum_cmnegadd_highend - -Lbignum_cmnegadd_tloop: - add i, i, #8 - ldr b, [z, i] - sbcs b, b, xzr - str b, [z, i] - sub p, p, #1 - cbnz p, Lbignum_cmnegadd_tloop - -// Adjust the high word with the inverted carry h := h + (1 - CF) - -Lbignum_cmnegadd_highend: - cset x0, cc - add h, h, x0 - -// Now copy h into the function return - -Lbignum_cmnegadd_end: - mov x0, h - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmnegadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmod.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmod.S deleted file mode 100644 index b52d0afce2c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmod.S +++ /dev/null @@ -1,184 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Find bignum modulo a single word -// Input x[k], m; output function return -// -// extern uint64_t bignum_cmod(uint64_t k, const uint64_t *x, uint64_t m); -// -// Returns x mod m, assuming m is nonzero. -// -// Standard ARM ABI: X0 = k, X1 = x, X2 = m, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmod) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmod) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmod) - .text - .balign 4 - -#define k x0 -#define x x1 -#define m x2 - -#define e x3 -#define n x4 -#define w x5 - -#define r x6 -#define h x7 -#define l x8 -#define a x9 -#define d x10 - -// We re-use the k argument for a quotient estimate when it is no longer -// needed for traversal (x0 is modified for the return value anyway). - -#define q x0 - -S2N_BN_SYMBOL(bignum_cmod): - CFI_START - -// If the bignum is zero-length, x0 is already the right answer of 0 - - cbz k, Lbignum_cmod_end - -// Find number of leading zeros of m and let n = 2^e m so that for an -// in-scope (nonzero) input m we have n >= 2^63, e <= 63. - - clz e, m - lsl n, m, e - -// A near-clone of word_recip so 2^64 + w = ceil(2^128 / n) - 1 - - lsr a, n, #16 - eor w, a, #0x1ffffffffffff - add a, a, #0x1 - lsr w, w, #32 - mneg r, a, w - lsr d, r, #49 - mul d, d, d - lsr r, r, #34 - add r, d, r - orr d, d, #0x40000000 - mul d, r, d - lsr d, d, #30 - lsl r, w, #30 - madd w, w, d, r - lsr w, w, #30 - mneg r, a, w - lsr r, r, #24 - mul r, r, w - lsl w, w, #16 - lsr r, r, #24 - add w, w, r - mneg r, a, w - lsr r, r, #32 - mul r, r, w - lsl w, w, #31 - lsr r, r, #17 - add w, w, r - mul d, n, w - umulh r, n, w - extr d, r, d, #60 - lsr r, w, #33 - mvn d, d - mul d, r, d - lsl w, w, #1 - lsr d, d, #33 - add w, w, d - adds d, w, #0x1 - cinv d, d, eq - umulh r, n, d - adds xzr, r, n - csel w, w, d, cs - -// Take the residue r = 2^128 - (2^64 + w) * n, which by the above bound -// we know fits in 64 bits. We know 2^128 == r (mod n) and hence (mod m). - - mneg r, w, n - -// Now just go down through the digits accumulating [h;l] == x (mod n) -// by 2^64 * [h;l] + d = 2^128 * h + [l;d] == r * h + [l; d]. That addition -// may overflow with a carry, say 2^128 + [h';l'] = r * h + [l; d], in -// which case we subtract 2^128 - r (which is divisible by m and keeping -// things in 128 bits we just add r). Thus the overall bound when we initially -// overflow is r * h + [l; d] - (2^128 - r) = r * (h + 1) + [l; d] - 2^128 -// < 2^128 so we stay inside 2 words - - mov h, xzr - mov l, xzr -Lbignum_cmod_loop: - sub k, k, #1 - ldr d, [x, k, lsl #3] - mul a, r, h - umulh h, r, h - adds a, a, d - adcs h, h, l - csel l, r, xzr, cs - adds l, l, a - adc h, h, xzr - cbnz k, Lbignum_cmod_loop - -// Now do reciprocal multiplication to reduce the 2-word modular equivalent -// [h;l] to the single word l. If we assume the truncations are as follows -// 2^64 + w = 2^128 / n - epsilon (0 <= epsilon <= 1) -// q = (w * h / 2^64) - delta (0 <= delta <= 1) -// the net remainder is l + (h/2^64 * epsilon + delta) * n < l + 2 * n. -// In general this needs two rounds of comparison to guarantee getting -// into a single word (though one more mul could be used instead). -// Also, the quotient estimate can overflow so we use r as extra addend -// 2^64 * n when the initial addition overflows. The overall multiple -// of n can't itself overflow, since we know it's an underestimate of -// the initial residue. - - umulh q, w, h - adds q, q, h - csel r, n, xzr, cs - - mul a, q, n - umulh d, q, n - add d, d, r - subs l, l, a - sbcs h, h, d - - csel a, n, xzr, ne - subs l, l, a - sbcs h, h, xzr - - csel a, n, xzr, ne - sub l, l, a - -// One more reciprocal multiplication to do a modular reduction, but now in -// one word and in terms of the original m. For the quotient estimate we want -// q = ((2^64 + w) * l) / 2^{128-e} = ((2^64 + w) * l) / 2^65 / 2^{63-e}. - - umulh q, w, l - adds q, q, l - cset r, cs - extr q, r, q, #1 - - eor e, e, #63 - lsr q, q, e - - mul a, q, m - sub l, l, a - -// Note that since there is no neglected "low" part of the single word, -// one round of correction suffices; in the analog of the above l = 0 -// and hence the residue so far is already < 2 * m. - - subs x0, l, m - csel x0, x0, l, cs - -Lbignum_cmod_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmod) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmul.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmul.S deleted file mode 100644 index f12beb04012..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_cmul.S +++ /dev/null @@ -1,109 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word, z := c * y -// Inputs c, y[n]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_cmul(uint64_t k, uint64_t *z, uint64_t c, uint64_t n, -// const uint64_t *y); -// -// Does the "z := c * y" operation where y is n digits, result z is p. -// Truncates the result in general unless p >= n + 1. -// -// The return value is a high/carry word that is meaningful when p >= n as -// giving the high part of the result. Since this is always zero if p > n, -// it is mainly of interest in the special case p = n, i.e. where the source -// and destination have the same nominal size, when it gives the extra word -// of the full result. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = c, X3 = n, X4 = y, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul) - .text - .balign 4 - -#define p x0 -#define z x1 -#define c x2 -#define n x3 -#define x x4 - -#define i x5 -#define h x6 -#define l x7 -#define a x8 - - -S2N_BN_SYMBOL(bignum_cmul): - CFI_START - -// First clamp the input size n := min(p,n) since we can never need to read -// past the p'th term of the input to generate p-digit output. -// Subtract p := p - min(n,p) so it holds the size of the extra tail needed - - cmp n, p - csel n, p, n, cs - sub p, p, n - -// Initialize current input/output pointer offset i and high part h. -// But then if n = 0 skip the multiplication and go to the tail part - - mov h, xzr - mov i, xzr - cbz n, Lbignum_cmul_tail - -// Initialization of the loop: [h,l] = c * x_0 - - ldr a, [x] - mul l, c, a - umulh h, c, a - str l, [z] - add i, i, #8 - subs n, n, #1 - beq Lbignum_cmul_tail - -// Main loop (force CF = 0 at the beginning) - - adds xzr, xzr, xzr -Lbignum_cmul_loop: - ldr a, [x, i] - mul l, c, a - adcs l, l, h - umulh h, c, a - str l, [z, i] - add i, i, #8 - sub n, n, #1 - cbnz n, Lbignum_cmul_loop - - adc h, h, xzr - -Lbignum_cmul_tail: - cbz p, Lbignum_cmul_end - str h, [z, i] - mov h, xzr - subs p, p, #1 - beq Lbignum_cmul_end - -Lbignum_cmul_tloop: - add i, i, #8 - str xzr, [z, i] - sub p, p, #1 - cbnz p, Lbignum_cmul_tloop - -// Return the high/carry word - -Lbignum_cmul_end: - mov x0, h - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_coprime.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_coprime.S deleted file mode 100644 index b8780f5ff7e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_coprime.S +++ /dev/null @@ -1,455 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Test bignums for coprimality, gcd(x,y) = 1 -// Inputs x[m], y[n]; output function return; temporary buffer t[>=2*max(m,n)] -// -// extern uint64_t bignum_coprime(uint64_t m, const uint64_t *x, uint64_t n, -// const uint64_t *y, uint64_t *t); -// -// Test for whether two bignums are coprime (no common factor besides 1). -// This is equivalent to testing if their gcd is 1, but a bit faster than -// doing those two computations separately. -// -// Here bignum x is m digits long, y is n digits long and the temporary -// buffer t needs to be 2 * max(m,n) digits long. The return value is -// 1 if coprime(x,y) and 0 otherwise. -// -// Standard ARM ABI: X0 = m, X1 = x, X2 = n, X3 = y, X4 = t, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_coprime) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_coprime) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_coprime) - .text - .balign 4 - -#define CHUNKSIZE 58 - -// Pervasive variables - -#define k x9 -#define m x4 -#define n x5 - -// Used via parameters in copy-in loop, then re-used as outer loop -// counter t and adaptive precision digit size l, which becomes a -// reduced version of k in later iterations but starts at l = k - -#define x x1 -#define y x3 - -#define t x2 -#define l x3 - -// The matrix of update factors to apply to m and n -// Also used a couple of additional temporary variables for the swapping loop -// Also used as an extra down-counter in corrective negation loops - -#define m_m x6 -#define m_n x7 -#define n_m x8 -#define n_n x1 - -#define t3 x6 -#define t4 x7 - -#define j x6 - -// General temporary variables and loop counters - -#define i x10 -#define t1 x11 -#define t2 x12 - -// High and low proxies for the inner loop -// Then re-used for high and carry words during actual cross-multiplications - -#define m_hi x13 -#define n_hi x14 -#define m_lo x15 -#define n_lo x16 - -#define h1 x13 -#define h2 x14 -#define l1 x15 -#define l2 x16 - -#define c1 x17 -#define c2 x19 -#define tt x20 - - -S2N_BN_SYMBOL(bignum_coprime): - CFI_START - -// We make use of just a couple of additional registers - - CFI_PUSH2(x19,x20) - -// Compute k = max(m,n), and if this is zero skip to the end. Note that -// in this case x0 = m = 0 so we return the right answer of "false" - - cmp x0, x2 - csel k, x2, x0, cc - cbz k, Lbignum_coprime_end - -// Set up inside w two size-k buffers m and n - - lsl i, k, #3 - add n, m, i - -// Copy the input x into the buffer m, padding with zeros as needed - - mov i, xzr - cbz x0, Lbignum_coprime_xpadloop -Lbignum_coprime_xloop: - ldr t1, [x1, i, lsl #3] - str t1, [m, i, lsl #3] - add i, i, #1 - cmp i, x0 - bcc Lbignum_coprime_xloop - cmp i, k - bcs Lbignum_coprime_xskip -Lbignum_coprime_xpadloop: - str xzr, [m, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_coprime_xpadloop -Lbignum_coprime_xskip: - -// Copy the input y into the buffer n, padding with zeros as needed - - mov i, xzr - cbz x2, Lbignum_coprime_ypadloop -Lbignum_coprime_yloop: - ldr t1, [x3, i, lsl #3] - str t1, [n, i, lsl #3] - add i, i, #1 - cmp i, x2 - bcc Lbignum_coprime_yloop - cmp i, k - bcs Lbignum_coprime_yskip -Lbignum_coprime_ypadloop: - str xzr, [n, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_coprime_ypadloop -Lbignum_coprime_yskip: - -// Set up the outer loop count of 64 * sum of input sizes. -// The invariant is that m * n < 2^t at all times. - - add t, x0, x2 - lsl t, t, #6 - -// Record for the very end the OR of the lowest words. -// If the bottom bit is zero we know both are even so the answer is false. -// But since this is constant-time code we still execute all the main part. - - ldr x0, [m] - ldr t3, [n] - orr x0, x0, t3 - -// Now if n is even trigger a swap of m and n. This ensures that if -// one or other of m and n is odd then we make sure now that n is, -// as expected by our invariant later on. - - and t3, t3, #1 - sub t3, t3, #1 - - mov i, xzr -Lbignum_coprime_swaploop: - ldr t1, [m, i, lsl #3] - ldr t2, [n, i, lsl #3] - eor t4, t1, t2 - and t4, t4, t3 - eor t1, t1, t4 - eor t2, t2, t4 - str t1, [m, i, lsl #3] - str t2, [n, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_coprime_swaploop - -// Start of the main outer loop iterated t / CHUNKSIZE times - -Lbignum_coprime_outerloop: - -// We need only bother with sharper l = min k (ceil(t/64)) digits -// Either both m and n fit in l digits, or m has become zero and so -// nothing happens in the loop anyway and this makes no difference. - - add i, t, #63 - lsr l, i, #6 - cmp l, k - csel l, k, l, cs - -// Select upper and lower proxies for both m and n to drive the inner -// loop. The lower proxies are simply the lowest digits themselves, -// m_lo = m[0] and n_lo = n[0], while the upper proxies are bitfields -// of the two inputs selected so their top bit (63) aligns with the -// most significant bit of *either* of the two inputs. - - mov h1, xzr // Previous high and low for m - mov l1, xzr - mov h2, xzr // Previous high and low for n - mov l2, xzr - mov c2, xzr // Mask flag: previous word of one was nonzero - // and in this case h1 and h2 are those words - - mov i, xzr -Lbignum_coprime_toploop: - ldr t1, [m, i, lsl #3] - ldr t2, [n, i, lsl #3] - orr c1, t1, t2 - cmp c1, xzr - and c1, c2, h1 - csel l1, c1, l1, ne - and c1, c2, h2 - csel l2, c1, l2, ne - csel h1, t1, h1, ne - csel h2, t2, h2, ne - csetm c2, ne - add i, i, #1 - cmp i, l - bcc Lbignum_coprime_toploop - - orr t1, h1, h2 - clz t2, t1 - negs c1, t2 - lsl h1, h1, t2 - csel l1, l1, xzr, ne - lsl h2, h2, t2 - csel l2, l2, xzr, ne - lsr l1, l1, c1 - lsr l2, l2, c1 - orr m_hi, h1, l1 - orr n_hi, h2, l2 - - ldr m_lo, [m] - ldr n_lo, [n] - -// Now the inner loop, with i as loop counter from CHUNKSIZE down. -// This records a matrix of updates to apply to the initial -// values of m and n with, at stage j: -// -// sgn * m' = (m_m * m - m_n * n) / 2^j -// -sgn * n' = (n_m * m - n_n * n) / 2^j -// -// where "sgn" is either +1 or -1, and we lose track of which except -// that both instance above are the same. This throwing away the sign -// costs nothing (since we have to correct in general anyway because -// of the proxied comparison) and makes things a bit simpler. But it -// is simply the parity of the number of times the first condition, -// used as the swapping criterion, fires in this loop. - - mov m_m, #1 - mov m_n, xzr - mov n_m, xzr - mov n_n, #1 - - mov i, #CHUNKSIZE - -// Conceptually in the inner loop we follow these steps: -// -// * If m_lo is odd and m_hi < n_hi, then swap the four pairs -// (m_hi,n_hi); (m_lo,n_lo); (m_m,n_m); (m_n,n_n) -// -// * Now, if m_lo is odd (old or new, doesn't matter as initial n_lo is odd) -// m_hi := m_hi - n_hi, m_lo := m_lo - n_lo -// m_m := m_m + n_m, m_n := m_n + n_n -// -// * Halve and double them -// m_hi := m_hi / 2, m_lo := m_lo / 2 -// n_m := n_m * 2, n_n := n_n * 2 -// -// The actual computation computes updates before actually swapping and -// then corrects as needed. It also maintains the invariant ~ZF <=> odd(m_lo), -// since it seems to reduce the dependent latency. Set that up first. - - ands xzr, m_lo, #1 - -Lbignum_coprime_innerloop: - -// At the start of the loop ~ZF <=> m_lo is odd; mask values accordingly -// Set the flags for m_hi - [~ZF] * n_hi so we know to flip things. - - csel t1, n_hi, xzr, ne - csel t2, n_lo, xzr, ne - csel c1, n_m, xzr, ne - csel c2, n_n, xzr, ne - ccmp m_hi, n_hi, #0x2, ne - -// Compute subtractive updates, trivial in the case ZF <=> even(m_lo). - - sub t1, m_hi, t1 - sub t2, m_lo, t2 - -// If the subtraction borrows, swap things appropriately, negating where -// we've already subtracted so things are as if we actually swapped first. - - csel n_hi, n_hi, m_hi, cs - cneg t1, t1, cc - csel n_lo, n_lo, m_lo, cs - cneg m_lo, t2, cc - csel n_m, n_m, m_m, cs - csel n_n, n_n, m_n, cs - -// Update and shift while setting oddness flag for next iteration -// We look at bit 1 of t2 (m_lo before possible negation), which is -// safe because it is even. - - ands xzr, t2, #2 - add m_m, m_m, c1 - add m_n, m_n, c2 - lsr m_hi, t1, #1 - lsr m_lo, m_lo, #1 - add n_m, n_m, n_m - add n_n, n_n, n_n - -// Next iteration; don't disturb the flags since they are used at entry - - sub i, i, #1 - cbnz i, Lbignum_coprime_innerloop - -// Now actually compute the updates to m and n corresponding to that matrix, -// and correct the signs if they have gone negative. First we compute the -// (k+1)-sized updates -// -// c1::h1::m = m_m * m - m_n * n -// c2::h2::n = n_m * m - n_n * n -// -// then for each one, sign-correct and shift by CHUNKSIZE - - mov h1, xzr - mov h2, xzr - mov c1, xzr - mov c2, xzr - mov i, xzr -Lbignum_coprime_crossloop: - ldr t1, [m, i, lsl #3] - ldr t2, [n, i, lsl #3] - - mul l1, m_m, t1 - mul l2, m_n, t2 - adds l1, l1, h1 - umulh h1, m_m, t1 - adc h1, h1, xzr - umulh tt, m_n, t2 - sub c1, tt, c1 - subs l1, l1, l2 - str l1, [m, i, lsl #3] - sbcs h1, h1, c1 - csetm c1, cc - - mul l1, n_m, t1 - mul l2, n_n, t2 - adds l1, l1, h2 - umulh h2, n_m, t1 - adc h2, h2, xzr - umulh tt, n_n, t2 - sub c2, tt, c2 - subs l1, l1, l2 - str l1, [n, i, lsl #3] - sbcs h2, h2, c2 - csetm c2, cc - - add i, i, #1 - cmp i, l - bcc Lbignum_coprime_crossloop - -// Write back m optionally negated and shifted right CHUNKSIZE bits - - adds xzr, c1, c1 - - ldr l1, [m] - mov i, xzr - sub j, l, #1 - cbz j, Lbignum_coprime_negskip1 - -Lbignum_coprime_negloop1: - add t1, i, #8 - ldr t2, [m, t1] - extr l1, t2, l1, #CHUNKSIZE - eor l1, l1, c1 - adcs l1, l1, xzr - str l1, [m, i] - mov l1, t2 - add i, i, #8 - sub j, j, #1 - cbnz j, Lbignum_coprime_negloop1 -Lbignum_coprime_negskip1: - extr l1, h1, l1, #CHUNKSIZE - eor l1, l1, c1 - adcs l1, l1, xzr - str l1, [m, i] - -// Write back n optionally negated and shifted right CHUNKSIZE bits - - adds xzr, c2, c2 - - ldr l1, [n] - mov i, xzr - sub j, l, #1 - cbz j, Lbignum_coprime_negskip2 -Lbignum_coprime_negloop2: - add t1, i, #8 - ldr t2, [n, t1] - extr l1, t2, l1, #CHUNKSIZE - eor l1, l1, c2 - adcs l1, l1, xzr - str l1, [n, i] - mov l1, t2 - add i, i, #8 - sub j, j, #1 - cbnz j, Lbignum_coprime_negloop2 -Lbignum_coprime_negskip2: - extr l1, h2, l1, #CHUNKSIZE - eor l1, l1, c2 - adcs l1, l1, xzr - str l1, [n, i] - -// End of main loop. We can stop if t' <= 0 since then m * n < 2^0, which -// since n is odd (in the main cases where we had one or other input odd) -// means that m = 0 and n is the final gcd. Moreover we do in fact need to -// maintain strictly t > 0 in the main loop, or the computation of the -// optimized digit bound l could collapse to 0. - - subs t, t, #CHUNKSIZE - bhi Lbignum_coprime_outerloop - -// Now compare n with 1 (OR of the XORs in t1) - - ldr t1, [n] - eor t1, t1, #1 - cmp k, #1 - beq Lbignum_coprime_finalcomb - mov i, #1 -Lbignum_coprime_compareloop: - ldr t2, [n, i, lsl #3] - orr t1, t1, t2 - add i, i, #1 - cmp i, k - bcc Lbignum_coprime_compareloop - -// Now combine that with original oddness flag, which is still in x0 - -Lbignum_coprime_finalcomb: - cmp t1, xzr - cset t1, eq - and x0, x0, t1 - -Lbignum_coprime_end: - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_coprime) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_copy.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_copy.S deleted file mode 100644 index 51315243ba0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_copy.S +++ /dev/null @@ -1,67 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Copy bignum with zero-extension or truncation, z := x -// Input x[n]; output z[k] -// -// extern void bignum_copy(uint64_t k, uint64_t *z, uint64_t n, const uint64_t *x); -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = n, X3 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_copy) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_copy) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_copy) - .text - .balign 4 - -#define k x0 -#define z x1 -#define n x2 -#define x x3 - -#define i x4 -#define a x5 - - -S2N_BN_SYMBOL(bignum_copy): - CFI_START - -// Replace n with min(k,n) so we are definitely safe copying those -// Initialize the element counter to 0 - - cmp k, n - csel n, k, n, cc - mov i, #0 - -// If min(k,n) = 0 jump to the padding stage - - cbz n, Lbignum_copy_padding - -Lbignum_copy_copyloop: - ldr a, [x, i, lsl #3] - str a, [z, i, lsl #3] - add i, i, #1 - cmp i, n - bcc Lbignum_copy_copyloop - -Lbignum_copy_padding: - cmp i, k - bcs Lbignum_copy_end -Lbignum_copy_padloop: - str xzr, [z, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_copy_padloop - -Lbignum_copy_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_copy) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_ctd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_ctd.S deleted file mode 100644 index e294ab041a3..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_ctd.S +++ /dev/null @@ -1,58 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count trailing zero digits (64-bit words) -// Input x[k]; output function return -// -// extern uint64_t bignum_ctd(uint64_t k, const uint64_t *x); -// -// In the case of a zero bignum as input the result is k -// -// Standard ARM ABI: X0 = k, X1 = x, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_ctd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_ctd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_ctd) - .text - .balign 4 - -#define k x0 -#define x x1 -#define i x2 -#define a x3 - - -S2N_BN_SYMBOL(bignum_ctd): - CFI_START - -// If the bignum is zero-length, x0 is already the right answer of 0 - - cbz k, Lbignum_ctd_end - -// Record in i that the lowest nonzero word is i, where i = k means -// that the bignum was entirely zero - - mov i, k -Lbignum_ctd_loop: - sub k, k, #1 - ldr a, [x, k, lsl #3] - cmp a, #0 - csel i, k, i, ne - cbnz k, Lbignum_ctd_loop - -// Now return i - - mov x0, i - -Lbignum_ctd_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_ctd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_ctz.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_ctz.S deleted file mode 100644 index def35e85db8..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_ctz.S +++ /dev/null @@ -1,78 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count trailing zero bits -// Input x[k]; output function return -// -// extern uint64_t bignum_ctz(uint64_t k, const uint64_t *x); -// -// -// In the case of a zero bignum as input the result is 64 * k -// -// In principle this has a precondition k < 2^58, but obviously that -// is always true in practice because of address space limitations -// -// Standard ARM ABI: X0 = k, X1 = x, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_ctz) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_ctz) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_ctz) - .text - .balign 4 - -#define k x0 -#define x x1 -#define i x2 -#define w x3 -#define a x4 - - -S2N_BN_SYMBOL(bignum_ctz): - CFI_START - -// If the bignum is zero-length, x0 is already the right answer of 0 - - cbz k, Lbignum_ctz_end - -// Use w = a[i] to store nonzero words in a top-down sweep -// Set the initial default to be as if we had a 1 word directly above - - mov i, k - mov w, #1 - -Lbignum_ctz_loop: - sub k, k, #1 - ldr a, [x, k, lsl #3] - cmp a, #0 - csel i, k, i, ne - csel w, a, w, ne - cbnz k, Lbignum_ctz_loop - -// Now w = a[i] is the lowest nonzero word, or in the zero case the -// default of the "extra" 1 = a[k]. We now want 64*i + ctz(w). -// -// ARM doesn't have a direct word ctz instruction, so we emulate it via -// ctz(w) = 64 - clz(~w & (w-1)). This is depending, for cases of the form -// ctz(....1), on the behavior clz(0) = 64, which is guaranteed according -// to the ARM manual. - - mvn a, w - sub w, w, #1 - add i, i, #1 - and w, w, a - lsl i, i, #6 - clz a, w - sub x0, i, a - -Lbignum_ctz_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_ctz) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_demont.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_demont.S deleted file mode 100644 index 0a434f32ab9..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_demont.S +++ /dev/null @@ -1,161 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from (almost-)Montgomery form z := (x / 2^{64k}) mod m -// Inputs x[k], m[k]; output z[k] -// -// extern void bignum_demont(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *m); -// -// Does z := (x / 2^{64k}) mod m, hence mapping out of Montgomery domain. -// In other words, this is a k-fold Montgomery reduction with same-size input. -// This can handle almost-Montgomery inputs, i.e. any k-digit bignum. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = x, X3 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont) - .text - .balign 4 - -#define k x0 -#define z x1 -#define x x2 -#define m x3 - -// Negated modular inverse -#define w x4 -// Outer loop counter -#define i x5 -// Inner loop counter -#define j x6 -// Home for Montgomery multiplier -#define d x7 - -#define h x8 -#define e x9 -#define l x10 -#define a x11 - -// Some more intuitive names for temp regs in initial word-level negmodinv. -// These just use i and j again, which aren't used early on. - -#define one x5 -#define e1 x5 -#define e2 x6 -#define e4 x5 -#define e8 x6 - - -S2N_BN_SYMBOL(bignum_demont): - CFI_START - -// If k = 0 the whole operation is trivial - - cbz k, Lbignum_demont_end - -// Compute word-level negated modular inverse w for m == m[0]. -// This is essentially the same as word_negmodinv. - - ldr a, [m] - lsl w, a, #2 - sub w, a, w - eor w, w, #2 - mov one, #1 - madd e1, a, w, one - mul e2, e1, e1 - madd w, e1, w, w - mul e4, e2, e2 - madd w, e2, w, w - mul e8, e4, e4 - madd w, e4, w, w - madd w, e8, w, w - -// Initially just copy the input to the output. It would be a little more -// efficient but somewhat fiddlier to tweak the zeroth iteration below instead. - - mov i, xzr -Lbignum_demont_iloop: - ldr a, [x, i, lsl #3] - str a, [z, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_demont_iloop - -// Outer loop, just doing a standard Montgomery reduction on z - - mov i, xzr -Lbignum_demont_outerloop: - - ldr e, [z] - mul d, e, w - ldr a, [m] - mul l, d, a - umulh h, d, a - adds e, e, l // Will be zero but want the carry - mov j, #1 - sub a, k, #1 - cbz a, Lbignum_demont_montend -Lbignum_demont_montloop: - ldr a, [m, j, lsl #3] - ldr e, [z, j, lsl #3] - mul l, d, a - adcs e, e, h - umulh h, d, a - adc h, h, xzr - adds e, e, l - sub l, j, #1 - str e, [z, l, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_demont_montloop -Lbignum_demont_montend: - adc h, xzr, h - sub l, j, #1 - str h, [z, l, lsl #3] - -// End of outer loop - - add i, i, #1 - cmp i, k - bcc Lbignum_demont_outerloop - -// Now do a comparison of z with m to set a final correction mask -// indicating that z >= m and so we need to subtract m. - - subs j, xzr, xzr -Lbignum_demont_cmploop: - ldr a, [z, j, lsl #3] - ldr e, [m, j, lsl #3] - sbcs xzr, a, e - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_demont_cmploop - csetm h, cs - -// Now do a masked subtraction of m for the final reduced result. - - subs j, xzr, xzr -Lbignum_demont_corrloop: - ldr a, [z, j, lsl #3] - ldr e, [m, j, lsl #3] - and e, e, h - sbcs a, a, e - str a, [z, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_demont_corrloop - -Lbignum_demont_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_digit.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_digit.S deleted file mode 100644 index 7e0d782ae8d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_digit.S +++ /dev/null @@ -1,64 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Select digit x[n] -// Inputs x[k], n; output function return -// -// extern uint64_t bignum_digit(uint64_t k, const uint64_t *x, uint64_t n); -// -// n'th digit of a k-digit (digit=64 bits) bignum, in constant-time style. -// Indexing starts at 0, which is the least significant digit (little-endian). -// Returns zero if n >= k, i.e. we read a digit off the end of the bignum. -// -// Standard ARM ABI: X0 = k, X1 = x, X2 = n, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_digit) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_digit) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_digit) - .text - .balign 4 - -#define k x0 -#define x x1 -#define n x2 - -#define d x3 -#define i x4 -#define a x5 - - -S2N_BN_SYMBOL(bignum_digit): - CFI_START - -// For length zero finish immediately (the return value in x0 is 0) - - cbz k, Lbignum_digit_end - -// Set default of zero, run over all the digits and take note of the n'th one - - mov d, xzr - mov i, xzr -Lbignum_digit_loop: - ldr a, [x, i, lsl #3] - cmp i, n - csel d, a, d, eq - add i, i, #1 - cmp i, k - bcc Lbignum_digit_loop - -// Return - - mov x0, d - -Lbignum_digit_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_digit) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_digitsize.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_digitsize.S deleted file mode 100644 index 003ee549508..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_digitsize.S +++ /dev/null @@ -1,57 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Return size of bignum in digits (64-bit word) -// Input x[k]; output function return -// -// extern uint64_t bignum_digitsize(uint64_t k, const uint64_t *x); -// -// In the case of a zero bignum as input the result is 0 -// -// Standard ARM ABI: X0 = k, X1 = x, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_digitsize) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_digitsize) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_digitsize) - .text - .balign 4 - -#define k x0 -#define x x1 -#define i x2 -#define a x3 -#define j x4 - - -S2N_BN_SYMBOL(bignum_digitsize): - CFI_START - -// If the bignum is zero-length, x0 is already the right answer of 0 - - cbz k, Lbignum_digitsize_end - -// Run over the words j = 0..i-1, and set i := j + 1 when hitting nonzero a[j] - - mov i, xzr - mov j, xzr -Lbignum_digitsize_loop: - ldr a, [x, j, lsl #3] - add j, j, #1 - cmp a, #0 - csel i, j, i, ne - cmp j, k - bne Lbignum_digitsize_loop - - mov x0, i -Lbignum_digitsize_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_digitsize) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_divmod10.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_divmod10.S deleted file mode 100644 index 3178ab9587f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_divmod10.S +++ /dev/null @@ -1,84 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Divide bignum by 10, returning remainder: z' := z div 10, return = z mod 10 -// Inputs z[k]; outputs function return (remainder) and z[k] -// -// extern uint64_t bignum_divmod10(uint64_t k, uint64_t *z); -// -// Standard ARM ABI: X0 = k, X1 = z, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_divmod10) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_divmod10) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_divmod10) - .text - .balign 4 - -#define k x0 -#define z x1 - -#define d x2 - -#define h x3 -#define q x3 - -#define l x4 -#define r x4 - -#define w x5 -#define s x6 - -S2N_BN_SYMBOL(bignum_divmod10): - CFI_START - -// If k = 0 then return; the return in x0 is indeed 0 mod 10 = 0 - - cbz k, Lbignum_divmod10_end - -// Straightforward top-down loop doing 10 * q + r' := 2^64 * r + d - - mov r, xzr - mov w, 0x3333333333333333 - add s, w, 1 - and w, w, 0xfffffff -Lbignum_divmod10_divloop: - sub k, k, 1 - ldr d, [z, k, lsl #3] - -// First re-split and shift so 2^28 * h + l = (2^64 * r + d) / 2 -// Then (2^64 * r + d) / 10 = [(2^28 - 1) / 5] * h + (h + l) / 5 - - extr h, r, d, 29 - ubfx l, d, 1, 28 - - add l, h, l - - mul h, h, w - umulh l, l, s - add q, h, l - str q, [z, k, lsl #3] - -// Generate the new remainder r = d - 10 * q -// Since r <= 9 we only need the low part computation ignoring carries - - add q, q, q, lsl #2 - sub r, d, q, lsl #1 - - cbnz k, Lbignum_divmod10_divloop - -// Return the final remainder - - mov x0, r - -Lbignum_divmod10_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_divmod10) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_emontredc.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_emontredc.S deleted file mode 100644 index d1715d97387..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_emontredc.S +++ /dev/null @@ -1,114 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended Montgomery reduce, returning results in input-output buffer -// Inputs z[2*k], m[k], w; outputs function return (extra result bit) and z[2*k] -// -// extern uint64_t bignum_emontredc(uint64_t k, uint64_t *z, const uint64_t *m, -// uint64_t w); -// -// Assumes that z initially holds a 2k-digit bignum z_0, m is a k-digit odd -// bignum and m * w == -1 (mod 2^64). This function also uses z for the output -// as well as returning a carry c of 0 or 1. This encodes two numbers: in the -// lower half of the z buffer we have q = z[0..k-1], while the upper half -// together with the carry gives r = 2^{64k}*c + z[k..2k-1]. These values -// satisfy z_0 + q * m = 2^{64k} * r, i.e. r gives a raw (unreduced) Montgomery -// reduction while q gives the multiplier that was used. Another way of -// thinking of it is that if z' is the output z with the lower half replaced -// with zeros, then z_0 + q * m = 2^{128k} * c + z'. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = m, X3 = w, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_emontredc) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_emontredc) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_emontredc) - .text - .balign 4 - -#define k x0 -#define z x1 -#define m x2 -#define w x3 - -// Outer loop counter -#define i x4 -// Inner loop counter -#define j x5 -// Home for Montgomery multiplier -#define d x6 - -// Top carry for current window -#define c x7 - -#define h x8 -#define e x9 -#define l x10 -#define a x11 - - -S2N_BN_SYMBOL(bignum_emontredc): - CFI_START - -// If k = 0 the whole operation is trivial; note we also get a return of c = 0 - - cbz k, Lbignum_emontredc_end - -// Initialize top carry to zero, and launch into the outer loop - - mov c, xzr - mov i, xzr -Lbignum_emontredc_outerloop: - - ldr e, [z] - mul d, e, w - ldr a, [m] - mul l, d, a - umulh h, d, a - str d, [z] - adds xzr, e, l // Will be zero but want the carry - mov j, #1 - sub a, k, #1 - cbz a, Lbignum_emontredc_montend -Lbignum_emontredc_montloop: - ldr a, [m, j, lsl #3] - ldr e, [z, j, lsl #3] - mul l, d, a - adcs e, e, h - umulh h, d, a - adc h, h, xzr - adds e, e, l - str e, [z, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_emontredc_montloop -Lbignum_emontredc_montend: - adcs h, h, c - adc c, xzr, xzr - ldr a, [z, k, lsl #3] - adds h, h, a - adc c, c, xzr - str h, [z, k, lsl #3] - -// End of outer loop - - add z, z, #8 // For simple indexing, z pointer moves - add i, i, #1 - cmp i, k - bcc Lbignum_emontredc_outerloop - -// Return c in X0 - - mov x0, c - -Lbignum_emontredc_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_emontredc) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_eq.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_eq.S deleted file mode 100644 index d82d22a5a6d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_eq.S +++ /dev/null @@ -1,87 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Test bignums for equality, x = y -// Inputs x[m], y[n]; output function return -// -// extern uint64_t bignum_eq(uint64_t m, const uint64_t *x, uint64_t n, -// const uint64_t *y); -// -// Standard ARM ABI: X0 = m, X1 = x, X2 = n, X3 = y, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_eq) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_eq) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_eq) - .text - .balign 4 - -#define m x0 -#define x x1 -#define n x2 -#define y x3 -#define a x4 -#define c x5 -// We can re-use n for this, not needed when d appears -#define d x2 - - -S2N_BN_SYMBOL(bignum_eq): - CFI_START - -// Initialize the accumulated OR of differences to zero - - mov c, xzr - -// If m >= n jump into the m > n loop at the final equality test -// This will drop through for m = n - - cmp m, n - bcs Lbignum_eq_mtest - -// Toploop for the case n > m - -Lbignum_eq_nloop: - sub n, n, #1 - ldr a, [y, n, lsl #3] - orr c, c, a - cmp m, n - bne Lbignum_eq_nloop - b Lbignum_eq_mmain - -// Toploop for the case m > n (or n = m which enters at "mtest") - -Lbignum_eq_mloop: - sub m, m, #1 - ldr a, [x, m, lsl #3] - orr c, c, a - cmp m, n -Lbignum_eq_mtest: - bne Lbignum_eq_mloop - -// Combined main loop for the min(m,n) lower words - -Lbignum_eq_mmain: - cbz m, Lbignum_eq_end - -Lbignum_eq_loop: - sub m, m, #1 - ldr a, [x, m, lsl #3] - ldr d, [y, m, lsl #3] - eor a, a, d - orr c, c, a - cbnz m, Lbignum_eq_loop - -Lbignum_eq_end: - cmp c, xzr - cset x0, eq - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_eq) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_even.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_even.S deleted file mode 100644 index 5bf44adfffe..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_even.S +++ /dev/null @@ -1,36 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Test bignum for even-ness -// Input x[k]; output function return -// -// extern uint64_t bignum_even(uint64_t k, const uint64_t *x); -// -// Standard ARM ABI: X0 = k, X1 = x, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_even) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_even) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_even) - .text - .balign 4 - -S2N_BN_SYMBOL(bignum_even): - CFI_START - -cbz x0, Lbignum_even_end // if k = 0, that's the return! - ldr x0, [x1] - and x0, x0, #1 - -Lbignum_even_end: - eor x0, x0, #1 - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_even) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_gt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_gt.S deleted file mode 100644 index d9be7defa32..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_gt.S +++ /dev/null @@ -1,94 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compare bignums, x > y -// Inputs x[m], y[n]; output function return -// -// extern uint64_t bignum_gt(uint64_t m, const uint64_t *x, uint64_t n, -// const uint64_t *y); -// -// Standard ARM ABI: X0 = m, X1 = x, X2 = n, X3 = y, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_gt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_gt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_gt) - .text - .balign 4 - -#define m x0 -#define x x1 -#define n x2 -#define y x3 -#define i x4 -#define a x5 -#define d x6 - - -S2N_BN_SYMBOL(bignum_gt): - CFI_START - -// Zero the main index counter for both branches - - mov i, xzr - -// Speculatively form n := n - m and do case split - - subs n, n, m - bcc Lbignum_gt_ylonger - -// The case where y is longer or of the same size (n >= m) -// Note that CF=1 initially by the fact that we reach this point - - cbz m, Lbignum_gt_xtest -Lbignum_gt_xmainloop: - ldr a, [y, i, lsl #3] - ldr d, [x, i, lsl #3] - sbcs xzr, a, d - add i, i, #1 - sub m, m, #1 - cbnz m, Lbignum_gt_xmainloop -Lbignum_gt_xtest: - cbz n, Lbignum_gt_xskip -Lbignum_gt_xtoploop: - ldr a, [y, i, lsl #3] - sbcs xzr, a, xzr - add i, i, #1 - sub n, n, #1 - cbnz n, Lbignum_gt_xtoploop -Lbignum_gt_xskip: - cset x0, cc - ret - -// The case where x is longer (m > n) -// The first "adds" also makes sure CF=1 initially in this branch - -Lbignum_gt_ylonger: - adds n, n, m - cbz n, Lbignum_gt_ytoploop - sub m, m, n -Lbignum_gt_ymainloop: - ldr a, [y, i, lsl #3] - ldr d, [x, i, lsl #3] - sbcs xzr, a, d - add i, i, #1 - sub n, n, #1 - cbnz n, Lbignum_gt_ymainloop -Lbignum_gt_ytoploop: - ldr a, [x, i, lsl #3] - sbcs xzr, xzr, a - add i, i, #1 - sub m, m, #1 - cbnz m, Lbignum_gt_ytoploop - - cset x0, cc - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_gt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_iszero.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_iszero.S deleted file mode 100644 index 7d33581566c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_iszero.S +++ /dev/null @@ -1,48 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Test bignum for zero-ness, x = 0 -// Input x[k]; output function return -// -// extern uint64_t bignum_iszero(uint64_t k, const uint64_t *x); -// -// Standard ARM ABI: X0 = k, X1 = x, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_iszero) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_iszero) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_iszero) - .text - .balign 4 - -#define k x0 -#define x x1 -#define a x2 -#define c x3 - - -S2N_BN_SYMBOL(bignum_iszero): - CFI_START - -mov c, xzr // c will be or of the digits - cbz k, Lbignum_iszero_end // if k = 0 skip the Lbignum_iszero_loop - -Lbignum_iszero_loop: - sub k, k, #1 - ldr a, [x, k, lsl #3] - orr c, c, a - cbnz k, Lbignum_iszero_loop - -Lbignum_iszero_end: - cmp c, xzr - cset x0, eq - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_iszero) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_le.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_le.S deleted file mode 100644 index 1913fb3229f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_le.S +++ /dev/null @@ -1,94 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compare bignums, x <= y -// Inputs x[m], y[n]; output function return -// -// extern uint64_t bignum_le(uint64_t m, const uint64_t *x, uint64_t n, -// const uint64_t *y); -// -// Standard ARM ABI: X0 = m, X1 = x, X2 = n, X3 = y, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_le) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_le) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_le) - .text - .balign 4 - -#define m x0 -#define x x1 -#define n x2 -#define y x3 -#define i x4 -#define a x5 -#define d x6 - - -S2N_BN_SYMBOL(bignum_le): - CFI_START - -// Zero the main index counter for both branches - - mov i, xzr - -// Speculatively form n := n - m and do case split - - subs n, n, m - bcc Lbignum_le_ylonger - -// The case where y is longer or of the same size (n >= m) -// Note that CF=1 initially by the fact that we reach this point - - cbz m, Lbignum_le_xtest -Lbignum_le_xmainloop: - ldr a, [y, i, lsl #3] - ldr d, [x, i, lsl #3] - sbcs xzr, a, d - add i, i, #1 - sub m, m, #1 - cbnz m, Lbignum_le_xmainloop -Lbignum_le_xtest: - cbz n, Lbignum_le_xskip -Lbignum_le_xtoploop: - ldr a, [y, i, lsl #3] - sbcs xzr, a, xzr - add i, i, #1 - sub n, n, #1 - cbnz n, Lbignum_le_xtoploop -Lbignum_le_xskip: - cset x0, cs - ret - -// The case where x is longer (m > n) -// The first "adds" also makes sure CF=1 initially in this branch - -Lbignum_le_ylonger: - adds n, n, m - cbz n, Lbignum_le_ytoploop - sub m, m, n -Lbignum_le_ymainloop: - ldr a, [y, i, lsl #3] - ldr d, [x, i, lsl #3] - sbcs xzr, a, d - add i, i, #1 - sub n, n, #1 - cbnz n, Lbignum_le_ymainloop -Lbignum_le_ytoploop: - ldr a, [x, i, lsl #3] - sbcs xzr, xzr, a - add i, i, #1 - sub m, m, #1 - cbnz m, Lbignum_le_ytoploop - - cset x0, cs - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_le) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_lt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_lt.S deleted file mode 100644 index 2e153ad680b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_lt.S +++ /dev/null @@ -1,94 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compare bignums, x < y -// Inputs x[m], y[n]; output function return -// -// extern uint64_t bignum_lt(uint64_t m, const uint64_t *x, uint64_t n, -// const uint64_t *y); -// -// Standard ARM ABI: X0 = m, X1 = x, X2 = n, X3 = y, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_lt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_lt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_lt) - .text - .balign 4 - -#define m x0 -#define x x1 -#define n x2 -#define y x3 -#define i x4 -#define a x5 -#define d x6 - - -S2N_BN_SYMBOL(bignum_lt): - CFI_START - -// Zero the main index counter for both branches - - mov i, xzr - -// Speculatively form m := m - n and do case split - - subs m, m, n - bcc Lbignum_lt_ylonger - -// The case where x is longer or of the same size (m >= n) -// Note that CF=1 initially by the fact that we reach this point - - cbz n, Lbignum_lt_xtest -Lbignum_lt_xmainloop: - ldr a, [x, i, lsl #3] - ldr d, [y, i, lsl #3] - sbcs xzr, a, d - add i, i, #1 - sub n, n, #1 - cbnz n, Lbignum_lt_xmainloop -Lbignum_lt_xtest: - cbz m, Lbignum_lt_xskip -Lbignum_lt_xtoploop: - ldr a, [x, i, lsl #3] - sbcs xzr, a, xzr - add i, i, #1 - sub m, m, #1 - cbnz m, Lbignum_lt_xtoploop -Lbignum_lt_xskip: - cset x0, cc - ret - -// The case where y is longer (n > m) -// The first "adds" also makes sure CF=1 initially in this branch - -Lbignum_lt_ylonger: - adds m, m, n - cbz m, Lbignum_lt_ytoploop - sub n, n, m -Lbignum_lt_ymainloop: - ldr a, [x, i, lsl #3] - ldr d, [y, i, lsl #3] - sbcs xzr, a, d - add i, i, #1 - sub m, m, #1 - cbnz m, Lbignum_lt_ymainloop -Lbignum_lt_ytoploop: - ldr a, [y, i, lsl #3] - sbcs xzr, xzr, a - add i, i, #1 - sub n, n, #1 - cbnz n, Lbignum_lt_ytoploop - - cset x0, cc - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_lt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_madd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_madd.S deleted file mode 100644 index 3ba49d40f86..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_madd.S +++ /dev/null @@ -1,128 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply-add, z := z + x * y -// Inputs x[m], y[n]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_madd(uint64_t k, uint64_t *z, uint64_t m, -// const uint64_t *x, uint64_t n, const uint64_t *y); -// -// Does the "z := x * y + z" operation, while also returning a "next" or -// "carry" word. In the case where m + n <= p (i.e. the pure product would -// fit in the destination) this is the remainder for the exact result. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = m, X3 = x, X4 = n, X5 = y, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_madd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_madd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_madd) - .text - .balign 4 - -#define p x0 -#define z x1 -#define m x2 -#define x x3 -#define n x4 -#define y x5 -#define l x6 -#define h x7 -#define c x8 -#define k x9 -#define i x10 -#define a x11 -#define b x12 -#define d x13 -#define xx x14 -#define yy x15 - - -S2N_BN_SYMBOL(bignum_madd): - CFI_START - -// If p = 0 the result is trivial and nothing needs doing -// Note that fortuitously our "carry/remainder" term is still right! -// As it's a multiply-add, could also do this if either argument is trivial - - cbz p, Lbignum_madd_end - -// initialize (h,l) = 0, saving c = 0 for inside the loop - - mov l, xzr - mov h, xzr - -// Iterate outer loop from k = 0 ... k = p - 1 producing result digits - - mov k, xzr -Lbignum_madd_outerloop: - -// Add the existing z[k] and (h,l) to get initial (c,h,l) combination - - ldr c, [z, k, lsl #3] - adds l, l, c - adcs h, h, xzr - adc c, xzr, xzr - -// First let a = MAX 0 (k + 1 - n) and b = MIN (k + 1) m -// We want to accumulate all x[i] * y[k - i] for a <= i < b - - add a, k, #1 - cmp a, m - csel b, a, m, cc - subs a, a, n - csel a, a, xzr, cs - -// Set loop count i = b - a, and skip everything if it's <= 0 - - subs i, b, a - bls Lbignum_madd_innerend - -// Use temporary pointers xx = x + 8 * a and yy = y + 8 * (k - b) -// Increment xx per iteration but just use loop counter with yy -// So we start with [xx] = x[a] and [yy] = y[(k - b) + (b - a)] = y[k - a] - - lsl xx, a, #3 - add xx, xx, x - - sub yy, k, b - lsl yy, yy, #3 - add yy, yy, y - -// And index using the loop counter i = b - a, ..., i = 1 - -Lbignum_madd_innerloop: - ldr a, [xx], #8 - ldr b, [yy, i, lsl #3] - mul d, a, b - umulh a, a, b - adds l, l, d - adcs h, h, a - adc c, c, xzr - subs i, i, #1 - bne Lbignum_madd_innerloop - -Lbignum_madd_innerend: - str l, [z, k, lsl #3] - mov l, h - mov h, c - - add k, k, #1 - cmp k, p - bcc Lbignum_madd_outerloop // Inverted carry flag! - -// Return the "carry/remainder" term - - mov x0, l - -Lbignum_madd_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_madd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modadd.S deleted file mode 100644 index 6e052620838..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modadd.S +++ /dev/null @@ -1,88 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Add modulo m, z := (x + y) mod m, assuming x and y reduced -// Inputs x[k], y[k], m[k]; output z[k] -// -// extern void bignum_modadd(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *y, const uint64_t *m); -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = x, X3 = y, X4 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_modadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_modadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_modadd) - .text - .balign 4 - -#define k x0 -#define z x1 -#define x x2 -#define y x3 -#define m x4 -#define i x5 -#define j x6 -#define a x7 -#define b x8 -#define c x9 - - -S2N_BN_SYMBOL(bignum_modadd): - CFI_START - -adds j, k, xzr // j = k and ZF = (k = 0) - beq Lbignum_modadd_end // if k = 0 do nothing - adds i, xzr, xzr // i = 0 and CF = 0 - -// First just add (c::z) := x + y - -Lbignum_modadd_addloop: - ldr a, [x, i] - ldr b, [y, i] - adcs a, a, b - str a, [z, i] - add i, i, #8 - sub j, j, #1 - cbnz j, Lbignum_modadd_addloop - cset c, cs - -// Now do a comparison subtraction (c::z) - m, recording mask for (c::z) >= m - - mov j, k - subs i, xzr, xzr -Lbignum_modadd_cmploop: - ldr a, [z, i] - ldr b, [m, i] - sbcs xzr, a, b - add i, i, #8 - sub j, j, #1 - cbnz j, Lbignum_modadd_cmploop - sbcs c, c, xzr - mvn c, c - -// Now do a masked subtraction z := z - [c] * m - - mov j, k - subs i, xzr, xzr -Lbignum_modadd_subloop: - ldr a, [z, i] - ldr b, [m, i] - and b, b, c - sbcs a, a, b - str a, [z, i] - add i, i, #8 - sub j, j, #1 - cbnz j, Lbignum_modadd_subloop - -Lbignum_modadd_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_modadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_moddouble.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_moddouble.S deleted file mode 100644 index 5d219e8d97e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_moddouble.S +++ /dev/null @@ -1,77 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo m, z := (2 * x) mod m, assuming x reduced -// Inputs x[k], m[k]; output z[k] -// -// extern void bignum_moddouble(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *m); -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = x, X3 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_moddouble) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_moddouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_moddouble) - .text - .balign 4 - -#define k x0 -#define z x1 -#define x x2 -#define m x3 -#define i x4 -#define j x5 -#define a x6 -#define b x7 -#define c x8 - - -S2N_BN_SYMBOL(bignum_moddouble): - CFI_START - -adds j, k, xzr // j = k and ZF = (k = 0) - beq Lbignum_moddouble_end // if k = 0 do nothing - -// Do (_::z) = 2 * x - m and generate a mask in c for 2 * x < m - - mov c, xzr - subs i, xzr, xzr // i = 0 and CF = 1 -Lbignum_moddouble_dubloop: - ldr a, [x, i] - extr c, a, c, #63 - ldr b, [m, i] - sbcs c, c, b - str c, [z, i] - mov c, a - add i, i, #8 - sub j, j, #1 - cbnz j, Lbignum_moddouble_dubloop - lsr c, c, #63 - sbc c, c, xzr - -// Now do a corrective masked addition z := z + [c] * m - - mov j, k - adds i, xzr, xzr -Lbignum_moddouble_corrloop: - ldr a, [z, i] - ldr b, [m, i] - and b, b, c - adcs a, a, b - str a, [z, i] - add i, i, #8 - sub j, j, #1 - cbnz j, Lbignum_moddouble_corrloop - -Lbignum_moddouble_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_moddouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modexp.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modexp.S deleted file mode 100644 index b98137abd9d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modexp.S +++ /dev/null @@ -1,567 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Modular exponentiation for arbitrary odd modulus -// Inputs a[k], p[k], m[k]; output z[k], temporary buffer t[>=3*k] -// -// extern void bignum_modexp -// (uint64_t k,uint64_t *z, const uint64_t *a,const uint64_t *p, -// const uint64_t *m,uint64_t *t); -// -// Does z := (a^p) mod m where all numbers are k-digit and m is odd -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = a, X3 = p, X4 = m, X5 = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_modexp) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_modexp) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_modexp) - - .text - .balign 4 - -// Local variables, all held in extra registers - -#define k x19 -#define res x20 -#define a x21 -#define p x22 -#define m x23 -#define x x24 -#define i x25 -#define y x, k, lsl #3 -#define z x, k, lsl #4 - -S2N_BN_SYMBOL(bignum_modexp): - CFI_START - -// Save some registers including link register - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x30) - -// If size is zero (which falsifies the oddness condition) do nothing - - cbz x0, Lbignum_modexp_end - -// Move parameters into permanent homes - - mov k, x0 - mov res, x1 - mov a, x2 - mov p, x3 - mov m, x4 - mov x, x5 - -// Let x == 2^64k * a (mod m) and initialize z == 2^64k * 1 (mod m) - - mov x0, k - add x1, z - mov x2, m - add x3, y - CFI_BL(Lbignum_modexp_local_amontifier) - - mov x0, k - mov x1, x - add x2, z - mov x3, a - mov x4, m - CFI_BL(Lbignum_modexp_local_amontmul) - - mov x0, k - add x1, z - add x2, z - mov x3, m - CFI_BL(Lbignum_modexp_local_demont) - -// Main loop with z == 2^64k * a^(p >> 2^i) (mod m) - - lsl i, k, #6 - -Lbignum_modexp_loop: - sub i, i, #1 - - mov x0, k - add x1, y - add x2, z - add x3, z - mov x4, m - CFI_BL(Lbignum_modexp_local_amontmul) - - mov x0, k - add x1, z - mov x2, x - add x3, y - mov x4, m - CFI_BL(Lbignum_modexp_local_amontmul) - - lsr x0, i, #6 - ldr x0, [p, x0, lsl #3] - lsr x0, x0, i - and x0, x0, #1 - - mov x1, k - add x2, z - add x3, z - add x4, y - CFI_BL(Lbignum_modexp_local_mux) - - cbnz i, Lbignum_modexp_loop - -// Convert back from Montgomery representation and copy the result -// (via a degenerate case of multiplexing) into the output buffer - - mov x0, k - add x1, z - add x2, z - mov x3, m - CFI_BL(Lbignum_modexp_local_demont) - - mov x0, xzr - mov x1, k - mov x2, res - add x3, z - add x4, z - CFI_BL(Lbignum_modexp_local_mux) - -// Restore registers and return - -Lbignum_modexp_end: - - CFI_POP2(x25,x30) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_modexp) - -// Local copy of bignum_amontifier - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_modexp_local_amontifier) - -Lbignum_modexp_local_amontifier: - CFI_START - cbz x0, Lbignum_modexp_amontifend - mov x4, xzr -Lbignum_modexp_copyinloop: - ldr x9, [x2, x4, lsl #3] - str x9, [x3, x4, lsl #3] - add x4, x4, #0x1 - cmp x4, x0 - b.cc Lbignum_modexp_copyinloop - subs x4, x0, #0x1 - b.eq Lbignum_modexp_normalized -Lbignum_modexp_normloop: - mov x5, xzr - cmp x9, xzr - mov x7, xzr -Lbignum_modexp_shufloop: - mov x9, x7 - ldr x7, [x3, x5, lsl #3] - csel x9, x9, x7, eq - str x9, [x3, x5, lsl #3] - add x5, x5, #0x1 - sub x11, x5, x0 - cbnz x11, Lbignum_modexp_shufloop - subs x4, x4, #0x1 - b.ne Lbignum_modexp_normloop -Lbignum_modexp_normalized: - clz x9, x9 - mov x10, xzr - mov x4, xzr - tst x9, #0x3f - csetm x8, ne - neg x11, x9 -Lbignum_modexp_bitloop: - ldr x5, [x3, x4, lsl #3] - lsl x7, x5, x9 - orr x7, x7, x10 - lsr x10, x5, x11 - and x10, x10, x8 - str x7, [x3, x4, lsl #3] - add x4, x4, #0x1 - cmp x4, x0 - b.cc Lbignum_modexp_bitloop - sub x6, x0, #0x1 - ldr x6, [x3, x6, lsl #3] - mov x11, #0x1 - neg x10, x6 - mov x4, #0x3e -Lbignum_modexp_estloop: - add x11, x11, x11 - mov x7, x6 - sub x7, x7, x10 - cmp x10, x7 - csetm x7, cs - sub x11, x11, x7 - add x10, x10, x10 - and x7, x7, x6 - sub x10, x10, x7 - subs x4, x4, #0x1 - b.ne Lbignum_modexp_estloop - cmp x10, x6 - cinc x11, x11, eq - mov x9, xzr - adds x4, xzr, xzr -Lbignum_modexp_mulloop: - ldr x7, [x3, x4, lsl #3] - mul x8, x11, x7 - adcs x8, x8, x9 - umulh x9, x11, x7 - str x8, [x1, x4, lsl #3] - add x4, x4, #0x1 - sub x7, x4, x0 - cbnz x7, Lbignum_modexp_mulloop - adc x9, x9, xzr - mov x7, #0x4000000000000000 - subs x9, x9, x7 - csetm x11, cs - negs x4, xzr -Lbignum_modexp_remloop: - ldr x7, [x3, x4, lsl #3] - ldr x10, [x1, x4, lsl #3] - and x7, x7, x11 - sbcs x7, x7, x10 - str x7, [x1, x4, lsl #3] - add x4, x4, #0x1 - sub x7, x4, x0 - cbnz x7, Lbignum_modexp_remloop - mov x9, xzr - negs x5, xzr -Lbignum_modexp_dubloop1: - ldr x7, [x1, x5, lsl #3] - extr x9, x7, x9, #63 - ldr x10, [x3, x5, lsl #3] - sbcs x9, x9, x10 - str x9, [x1, x5, lsl #3] - mov x9, x7 - add x5, x5, #0x1 - sub x7, x5, x0 - cbnz x7, Lbignum_modexp_dubloop1 - lsr x9, x9, #63 - sbc x9, x9, xzr - adds x5, xzr, xzr -Lbignum_modexp_corrloop1: - ldr x7, [x1, x5, lsl #3] - ldr x10, [x3, x5, lsl #3] - and x10, x10, x9 - adcs x7, x7, x10 - str x7, [x1, x5, lsl #3] - add x5, x5, #0x1 - sub x7, x5, x0 - cbnz x7, Lbignum_modexp_corrloop1 - mov x9, xzr - negs x5, xzr -Lbignum_modexp_dubloop2: - ldr x7, [x1, x5, lsl #3] - extr x9, x7, x9, #63 - ldr x10, [x3, x5, lsl #3] - sbcs x9, x9, x10 - str x9, [x1, x5, lsl #3] - mov x9, x7 - add x5, x5, #0x1 - sub x7, x5, x0 - cbnz x7, Lbignum_modexp_dubloop2 - lsr x9, x9, #63 - sbc x9, x9, xzr - adds x5, xzr, xzr -Lbignum_modexp_corrloop2: - ldr x7, [x1, x5, lsl #3] - ldr x10, [x3, x5, lsl #3] - and x10, x10, x9 - adcs x7, x7, x10 - str x7, [x1, x5, lsl #3] - str x7, [x3, x5, lsl #3] - add x5, x5, #0x1 - sub x7, x5, x0 - cbnz x7, Lbignum_modexp_corrloop2 - mov x6, xzr - mov x4, x0 -Lbignum_modexp_modloop: - mov x5, xzr - mov x10, xzr - adds x9, xzr, xzr -Lbignum_modexp_cmaloop: - ldr x7, [x1, x5, lsl #3] - mul x8, x6, x7 - adcs x10, x10, x9 - umulh x9, x6, x7 - adc x9, x9, xzr - adds x8, x10, x8 - ldr x10, [x3, x5, lsl #3] - str x8, [x3, x5, lsl #3] - add x5, x5, #0x1 - sub x7, x5, x0 - cbnz x7, Lbignum_modexp_cmaloop - adcs x6, x10, x9 - csetm x8, cs - adds x5, xzr, xzr -Lbignum_modexp_oaloop: - ldr x7, [x3, x5, lsl #3] - ldr x10, [x1, x5, lsl #3] - and x10, x10, x8 - adcs x7, x7, x10 - str x7, [x3, x5, lsl #3] - add x5, x5, #0x1 - sub x7, x5, x0 - cbnz x7, Lbignum_modexp_oaloop - adc x6, x6, xzr - subs x4, x4, #0x1 - b.ne Lbignum_modexp_modloop - ldr x7, [x2] - lsl x11, x7, #2 - sub x11, x7, x11 - eor x11, x11, #0x2 - mov x8, #0x1 - madd x9, x7, x11, x8 - mul x10, x9, x9 - madd x11, x9, x11, x11 - mul x9, x10, x10 - madd x11, x10, x11, x11 - mul x10, x9, x9 - madd x11, x9, x11, x11 - madd x11, x10, x11, x11 - ldr x10, [x3] - mul x11, x10, x11 - mul x8, x11, x7 - umulh x9, x11, x7 - mov x5, #0x1 - sub x7, x0, #0x1 - cmn x10, x8 - cbz x7, Lbignum_modexp_montifend -Lbignum_modexp_montifloop: - ldr x7, [x2, x5, lsl #3] - ldr x10, [x3, x5, lsl #3] - mul x8, x11, x7 - adcs x10, x10, x9 - umulh x9, x11, x7 - adc x9, x9, xzr - adds x10, x10, x8 - sub x7, x5, #0x1 - str x10, [x3, x7, lsl #3] - add x5, x5, #0x1 - sub x7, x5, x0 - cbnz x7, Lbignum_modexp_montifloop -Lbignum_modexp_montifend: - adcs x6, x6, x9 - csetm x8, cs - sub x7, x0, #0x1 - str x6, [x3, x7, lsl #3] - negs x5, xzr -Lbignum_modexp_osloop: - ldr x7, [x3, x5, lsl #3] - ldr x10, [x2, x5, lsl #3] - and x10, x10, x8 - sbcs x7, x7, x10 - str x7, [x1, x5, lsl #3] - add x5, x5, #0x1 - sub x7, x5, x0 - cbnz x7, Lbignum_modexp_osloop -Lbignum_modexp_amontifend: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_modexp_local_amontifier) - -// Local copy of bignum_amontmul - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_modexp_local_amontmul) - -Lbignum_modexp_local_amontmul: - CFI_START - cbz x0, Lbignum_modexp_amomend - ldr x14, [x4] - lsl x5, x14, #2 - sub x5, x14, x5 - eor x5, x5, #0x2 - mov x6, #0x1 - madd x6, x14, x5, x6 - mul x7, x6, x6 - madd x5, x6, x5, x5 - mul x6, x7, x7 - madd x5, x7, x5, x5 - mul x7, x6, x6 - madd x5, x6, x5, x5 - madd x5, x7, x5, x5 - mov x8, xzr -Lbignum_modexp_zoop: - str xzr, [x1, x8, lsl #3] - add x8, x8, #0x1 - cmp x8, x0 - b.cc Lbignum_modexp_zoop - mov x6, xzr - mov x8, xzr -Lbignum_modexp_outerloop: - ldr x9, [x2, x8, lsl #3] - mov x10, xzr - adds x11, xzr, xzr -Lbignum_modexp_maddloop: - ldr x14, [x3, x10, lsl #3] - ldr x12, [x1, x10, lsl #3] - mul x13, x9, x14 - adcs x12, x12, x11 - umulh x11, x9, x14 - adc x11, x11, xzr - adds x12, x12, x13 - str x12, [x1, x10, lsl #3] - add x10, x10, #0x1 - sub x14, x10, x0 - cbnz x14, Lbignum_modexp_maddloop - adcs x6, x6, x11 - adc x7, xzr, xzr - ldr x12, [x1] - mul x9, x12, x5 - ldr x14, [x4] - mul x13, x9, x14 - umulh x11, x9, x14 - adds x12, x12, x13 - mov x10, #0x1 - sub x14, x0, #0x1 - cbz x14, Lbignum_modexp_montend -Lbignum_modexp_montloop: - ldr x14, [x4, x10, lsl #3] - ldr x12, [x1, x10, lsl #3] - mul x13, x9, x14 - adcs x12, x12, x11 - umulh x11, x9, x14 - adc x11, x11, xzr - adds x12, x12, x13 - sub x13, x10, #0x1 - str x12, [x1, x13, lsl #3] - add x10, x10, #0x1 - sub x14, x10, x0 - cbnz x14, Lbignum_modexp_montloop -Lbignum_modexp_montend: - adcs x11, x6, x11 - adc x6, x7, xzr - sub x13, x10, #0x1 - str x11, [x1, x13, lsl #3] - add x8, x8, #0x1 - cmp x8, x0 - b.cc Lbignum_modexp_outerloop - neg x6, x6 - negs x10, xzr -Lbignum_modexp_corrloop3: - ldr x14, [x1, x10, lsl #3] - ldr x12, [x4, x10, lsl #3] - and x12, x12, x6 - sbcs x14, x14, x12 - str x14, [x1, x10, lsl #3] - add x10, x10, #0x1 - sub x14, x10, x0 - cbnz x14, Lbignum_modexp_corrloop3 -Lbignum_modexp_amomend: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_modexp_local_amontmul) - -// Local copy of bignum_demont - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_modexp_local_demont) - -Lbignum_modexp_local_demont: - CFI_START - cbz x0, Lbignum_modexp_demontend - ldr x11, [x3] - lsl x4, x11, #2 - sub x4, x11, x4 - eor x4, x4, #0x2 - mov x5, #0x1 - madd x5, x11, x4, x5 - mul x6, x5, x5 - madd x4, x5, x4, x4 - mul x5, x6, x6 - madd x4, x6, x4, x4 - mul x6, x5, x5 - madd x4, x5, x4, x4 - madd x4, x6, x4, x4 - mov x5, xzr -Lbignum_modexp_iloop: - ldr x11, [x2, x5, lsl #3] - str x11, [x1, x5, lsl #3] - add x5, x5, #0x1 - cmp x5, x0 - b.cc Lbignum_modexp_iloop - mov x5, xzr -Lbignum_modexp_douterloop: - ldr x9, [x1] - mul x7, x9, x4 - ldr x11, [x3] - mul x10, x7, x11 - umulh x8, x7, x11 - adds x9, x9, x10 - mov x6, #0x1 - sub x11, x0, #0x1 - cbz x11, Lbignum_modexp_dmontend -Lbignum_modexp_dmontloop: - ldr x11, [x3, x6, lsl #3] - ldr x9, [x1, x6, lsl #3] - mul x10, x7, x11 - adcs x9, x9, x8 - umulh x8, x7, x11 - adc x8, x8, xzr - adds x9, x9, x10 - sub x10, x6, #0x1 - str x9, [x1, x10, lsl #3] - add x6, x6, #0x1 - sub x11, x6, x0 - cbnz x11, Lbignum_modexp_dmontloop -Lbignum_modexp_dmontend: - adc x8, xzr, x8 - sub x10, x6, #0x1 - str x8, [x1, x10, lsl #3] - add x5, x5, #0x1 - cmp x5, x0 - b.cc Lbignum_modexp_douterloop - negs x6, xzr -Lbignum_modexp_cmploop: - ldr x11, [x1, x6, lsl #3] - ldr x9, [x3, x6, lsl #3] - sbcs xzr, x11, x9 - add x6, x6, #0x1 - sub x11, x6, x0 - cbnz x11, Lbignum_modexp_cmploop - csetm x8, cs - negs x6, xzr -Lbignum_modexp_corrloop: - ldr x11, [x1, x6, lsl #3] - ldr x9, [x3, x6, lsl #3] - and x9, x9, x8 - sbcs x11, x11, x9 - str x11, [x1, x6, lsl #3] - add x6, x6, #0x1 - sub x11, x6, x0 - cbnz x11, Lbignum_modexp_corrloop -Lbignum_modexp_demontend: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_modexp_local_demont) - -// Local copy of bignum_mux - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_modexp_local_mux) - -Lbignum_modexp_local_mux: - CFI_START - cbz x1, Lbignum_modexp_muxend - cmp x0, #0x0 -Lbignum_modexp_muxloop: - sub x1, x1, #0x1 - ldr x5, [x3, x1, lsl #3] - ldr x0, [x4, x1, lsl #3] - csel x5, x5, x0, ne - str x5, [x2, x1, lsl #3] - cbnz x1, Lbignum_modexp_muxloop -Lbignum_modexp_muxend: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_modexp_local_mux) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modifier.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modifier.S deleted file mode 100644 index 702225a8411..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modifier.S +++ /dev/null @@ -1,463 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compute "modification" constant z := 2^{64k} mod m -// Input m[k]; output z[k]; temporary buffer t[>=k] -// -// extern void bignum_modifier(uint64_t k, uint64_t *z, const uint64_t *m, -// uint64_t *t); -// -// The last argument points to a temporary buffer t that should have size >= k. -// This is called "mod-ifier" because given any other k-digit number x we can -// get x MOD m simply and reasonably efficiently just by Montgomery -// multiplication of x and z. But one can also consider it the identity for -// Montgomery multiplication, assuming you have a reduced multiplier already. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = m, X3 = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_modifier) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_modifier) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_modifier) - .text - .balign 4 - -#define k x0 -#define z x1 -#define m x2 -#define t x3 - -// Some variables -// Modular inverse w is aliased to i, but we never use them together - -#define i x4 -#define w x4 -#define j x5 -#define h x6 -#define a x7 -#define l x8 -#define c x9 -#define b x10 -#define d x11 - -// Some aliases for the values b and d - -#define r x10 -#define q x11 - - -S2N_BN_SYMBOL(bignum_modifier): - CFI_START - -// If k = 0 the whole operation is trivial - - cbz k, Lbignum_modifier_end - -// Copy the input m into the temporary buffer t. The temporary register -// c matters since we want it to hold the highest digit, ready for the -// normalization phase. - - mov i, xzr -Lbignum_modifier_copyinloop: - ldr c, [m, i, lsl #3] - str c, [t, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_modifier_copyinloop - -// Do a rather stupid but constant-time digit normalization, conditionally -// shifting left (k-1) times based on whether the top word is zero. -// With careful binary striding this could be O(k*log(k)) instead of O(k^2) -// while still retaining the constant-time style. -// The "cmp c, xzr" sets the zeroness predicate (ZF) for the entire inner loop - - subs i, k, #1 - beq Lbignum_modifier_normalized -Lbignum_modifier_normloop: - mov j, xzr - cmp c, xzr - mov a, xzr -Lbignum_modifier_shufloop: - mov c, a - ldr a, [t, j, lsl #3] - csel c, c, a, eq - str c, [t, j, lsl #3] - add j, j, #1 - sub d, j, k - cbnz d, Lbignum_modifier_shufloop - subs i, i, #1 - bne Lbignum_modifier_normloop - -// We now have the top digit nonzero, assuming the input was nonzero, -// and as per the invariant of the loop above, c holds that digit. So -// now just count c's leading zeros and shift t bitwise that many bits. - -Lbignum_modifier_normalized: - clz c, c - - mov b, xzr - mov i, xzr - ands xzr, c, #63 - csetm l, ne - neg d, c -Lbignum_modifier_bitloop: - ldr j, [t, i, lsl #3] - lsl a, j, c - orr a, a, b - lsr b, j, d - and b, b, l - str a, [t, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_modifier_bitloop - -// Let h be the high word of n, which in all the in-scope cases is >= 2^63. -// Now successively form q = 2^i div h and r = 2^i mod h as i goes from -// 64 to 126. We avoid just using division out of constant-time concerns -// (at the least we would need to fix up h = 0 for out-of-scope inputs) and -// don't bother with Newton-Raphson, since this stupid simple loop doesn't -// contribute much of the overall runtime at typical sizes. - - sub h, k, #1 - ldr h, [t, h, lsl #3] - mov q, #1 - neg r, h - mov i, #62 -Lbignum_modifier_estloop: - add q, q, q - mov a, h - sub a, a, r - cmp r, a // CF <=> r >= h - r <=> 2 * r >= h - csetm a, cs - sub q, q, a - add r, r, r - and a, a, h - sub r, r, a - subs i, i, #1 - bne Lbignum_modifier_estloop - -// Strictly speaking the above loop doesn't quite give the true remainder -// and quotient in the special case r = h = 2^63, so fix it up. We get -// q = 2^63 - 1 and r = 2^63 and really want q = 2^63 and r = 0. This is -// supererogatory, because the main property of q used below still holds -// in this case unless the initial m = 1, and then anyway the overall -// specification (congruence modulo m) holds degenerately. But it seems -// nicer to get a "true" quotient and remainder. - - cmp r, h - csinc q, q, q, ne - -// So now we have q and r with 2^126 = q * h + r (imagining r = 0 in the -// fixed-up case above: note that we never actually use the computed -// value of r below and so didn't adjust it). And we can assume the ranges -// q <= 2^63 and r < h < 2^64. -// -// The idea is to use q as a first quotient estimate for a remainder -// of 2^{p+62} mod n, where p = 64 * k. We have, splitting n into the -// high and low parts h and l: -// -// 2^{p+62} - q * n = 2^{p+62} - q * (2^{p-64} * h + l) -// = 2^{p+62} - (2^{p-64} * (q * h) + q * l) -// = 2^{p+62} - 2^{p-64} * (2^126 - r) - q * l -// = 2^{p-64} * r - q * l -// -// Note that 2^{p-64} * r < 2^{p-64} * h <= n -// and also q * l < 2^63 * 2^{p-64} = 2^{p-1} <= n -// so |diff| = |2^{p-64} * r - q * l| < n. -// -// If in fact diff >= 0 then it is already 2^{p+62} mod n. -// otherwise diff + n is the right answer. -// -// To (maybe?) make the computation slightly easier we actually flip -// the sign and compute d = q * n - 2^{p+62}. Then the answer is either -// -d (when negative) or n - d; in either case we effectively negate d. -// This negating tweak in fact spoils the result for cases where -// 2^{p+62} mod n = 0, when we get n instead. However the only case -// where this can happen is m = 1, when the whole spec holds trivially, -// and actually the remainder of the logic below works anyway since -// the latter part of the code only needs a congruence for the k-digit -// result, not strict modular reduction (the doublings will maintain -// the non-strict inequality). - - mov c, xzr - adds i, xzr, xzr -Lbignum_modifier_mulloop: - ldr a, [t, i, lsl #3] - mul l, q, a - adcs l, l, c - umulh c, q, a - str l, [z, i, lsl #3] - add i, i, #1 - sub a, i, k - cbnz a, Lbignum_modifier_mulloop - - adc c, c, xzr - mov a, #0x4000000000000000 - subs c, c, a - csetm q, cs - -// Now do [c] * n - d for our final answer - - subs i, xzr, xzr -Lbignum_modifier_remloop: - ldr a, [t, i, lsl #3] - ldr b, [z, i, lsl #3] - and a, a, q - sbcs a, a, b - str a, [z, i, lsl #3] - add i, i, #1 - sub a, i, k - cbnz a, Lbignum_modifier_remloop - -// Now still need to do a couple of modular doublings to get us all the -// way up to 2^{p+64} == r from the initial 2^{p+62} == r (mod n). - - mov c, xzr - subs j, xzr, xzr -Lbignum_modifier_dubloop1: - ldr a, [z, j, lsl #3] - extr c, a, c, #63 - ldr b, [t, j, lsl #3] - sbcs c, c, b - str c, [z, j, lsl #3] - mov c, a - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_modifier_dubloop1 - lsr c, c, #63 - sbc c, c, xzr - adds j, xzr, xzr -Lbignum_modifier_corrloop1: - ldr a, [z, j, lsl #3] - ldr b, [t, j, lsl #3] - and b, b, c - adcs a, a, b - str a, [z, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_modifier_corrloop1 - -// This is not exactly the same: we also copy output to t giving the -// initialization t_1 = r == 2^{p+64} mod n for the main loop next. - - mov c, xzr - subs j, xzr, xzr -Lbignum_modifier_dubloop2: - ldr a, [z, j, lsl #3] - extr c, a, c, #63 - ldr b, [t, j, lsl #3] - sbcs c, c, b - str c, [z, j, lsl #3] - mov c, a - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_modifier_dubloop2 - lsr c, c, #63 - sbc c, c, xzr - adds j, xzr, xzr -Lbignum_modifier_corrloop2: - ldr a, [z, j, lsl #3] - ldr b, [t, j, lsl #3] - and b, b, c - adcs a, a, b - str a, [z, j, lsl #3] - str a, [t, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_modifier_corrloop2 - -// We then successively generate (k+1)-digit values satisfying -// t_i == 2^{p+64*i} mod n, each of which is stored in h::t. Finish -// initialization by zeroing h initially - - mov h, xzr - -// Then if t_i = 2^{p} * h + l -// we have t_{i+1} == 2^64 * t_i -// = (2^{p+64} * h) + (2^64 * l) -// == r * h + l<<64 -// Do this k more times so we end up == 2^{128*k+64}, one more than we want -// -// Writing B = 2^{64k}, the possible correction of adding r, which for -// a (k+1)-digit result is equivalent to subtracting q = 2^{64*(k+1)} - r -// would give the overall worst-case value minus q of -// [ B * (B^k - 1) + (B - 1) * r ] - [B^{k+1} - r] -// = B * (r - 1) < B^{k+1} so we keep inside k+1 digits as required. -// -// This implementation makes the shift implicit by starting b with the -// "previous" digit (initially 0) to offset things by 1. - - mov i, k -Lbignum_modifier_modloop: - mov j, xzr - mov b, xzr - adds c, xzr, xzr -Lbignum_modifier_cmaloop: - ldr a, [z, j, lsl #3] - mul l, h, a - adcs b, b, c - umulh c, h, a - adc c, c, xzr - adds l, b, l - ldr b, [t, j, lsl #3] - str l, [t, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_modifier_cmaloop - - adcs h, b, c - - csetm l, cs - - adds j, xzr, xzr -Lbignum_modifier_oaloop: - ldr a, [t, j, lsl #3] - ldr b, [z, j, lsl #3] - and b, b, l - adcs a, a, b - str a, [t, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_modifier_oaloop - adc h, h, xzr - - subs i, i, #1 - bne Lbignum_modifier_modloop - -// Compute the negated modular inverse w (same register as i, not used again). - - ldr a, [m] - lsl w, a, #2 - sub w, a, w - eor w, w, #2 - mov l, #1 - madd c, a, w, l - mul b, c, c - madd w, c, w, w - mul c, b, b - madd w, b, w, w - mul b, c, c - madd w, c, w, w - madd w, b, w, w - -// Now do one almost-Montgomery reduction w.r.t. the original m -// which lops off one 2^64 from the congruence and, with the usual -// almost-Montgomery correction, gets us back inside k digits for -// the end result. - - ldr b, [t] - mul d, b, w - - mul l, d, a - umulh c, d, a - mov j, #1 - sub a, k, #1 - adds xzr, b, l - cbz a, Lbignum_modifier_amontend - -Lbignum_modifier_amontloop: - ldr a, [m, j, lsl #3] - ldr b, [t, j, lsl #3] - mul l, d, a - adcs b, b, c - umulh c, d, a - adc c, c, xzr - adds b, b, l - sub a, j, #1 - str b, [t, a, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_modifier_amontloop -Lbignum_modifier_amontend: - adcs h, h, c - csetm l, cs - sub a, k, #1 - str h, [t, a, lsl #3] - - subs j, xzr, xzr -Lbignum_modifier_osloop: - ldr a, [t, j, lsl #3] - ldr b, [m, j, lsl #3] - and b, b, l - sbcs a, a, b - str a, [z, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_modifier_osloop - -// So far, the code (basically the same as bignum_amontifier) has produced -// a k-digit value z == 2^{128k} (mod m), not necessarily fully reduced mod m. -// We now do a short Montgomery reduction (similar to bignum_demont) so that -// we achieve full reduction mod m while lopping 2^{64k} off the congruence. -// We recycle h as the somewhat strangely-named outer loop counter. - - mov h, k - -Lbignum_modifier_montouterloop: - ldr b, [z] - mul d, b, w - ldr a, [m] - mul l, d, a - umulh c, d, a - mov j, #1 - sub a, k, #1 - adds xzr, b, l - cbz a, Lbignum_modifier_montend -Lbignum_modifier_montloop: - ldr a, [m, j, lsl #3] - ldr b, [z, j, lsl #3] - mul l, d, a - adcs b, b, c - umulh c, d, a - adc c, c, xzr - adds b, b, l - sub a, j, #1 - str b, [z, a, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_modifier_montloop -Lbignum_modifier_montend: - adc c, c, xzr - sub a, k, #1 - str c, [z, a, lsl #3] - - subs h, h, #1 - bne Lbignum_modifier_montouterloop - -// Now do a comparison of z with m to set a final correction mask -// indicating that z >= m and so we need to subtract m. - - subs j, xzr, xzr -Lbignum_modifier_cmploop: - ldr a, [z, j, lsl #3] - ldr b, [m, j, lsl #3] - sbcs xzr, a, b - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_modifier_cmploop - csetm h, cs - -// Now do a masked subtraction of m for the final reduced result. - - subs j, xzr, xzr -Lbignum_modifier_corrloop: - ldr a, [z, j, lsl #3] - ldr b, [m, j, lsl #3] - and b, b, h - sbcs a, a, b - str a, [z, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_modifier_corrloop - -Lbignum_modifier_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_modifier) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modinv.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modinv.S deleted file mode 100644 index 7b9e54f08ae..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modinv.S +++ /dev/null @@ -1,613 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Invert modulo m, z = (1/a) mod b, assuming b is an odd number > 1, coprime a -// Inputs a[k], b[k]; output z[k]; temporary buffer t[>=3*k] -// -// extern void bignum_modinv(uint64_t k, uint64_t *z, const uint64_t *a, -// const uint64_t *b, uint64_t *t); -// -// k-digit (digit=64 bits) "z := a^-1 mod b" (modular inverse of a modulo b) -// using t as a temporary buffer (t at least 3*k words = 24*k bytes), and -// assuming that a and b are coprime *and* that b is an odd number > 1. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = a, X3 = b, X4 = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_modinv) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_modinv) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_modinv) - .text - .balign 4 - -// We get CHUNKSIZE bits per outer iteration, 64 minus a few for proxy errors - -#define CHUNKSIZE 58 - -// Pervasive variables - -#define k x0 -#define z x1 -#define b x3 -#define w x4 - -// This one is recycled after initial copying in of a as outer loop counter - -#define a x2 -#define t x2 - -// Additional variables; later ones are currently rather high regs - -#define l x5 - -#define m x21 -#define n x22 - -// The matrix of update factors to apply to m and n -// Also used a couple of additional temporary variables for the swapping loop -// Also used as an extra down-counter in corrective negation loops - -#define m_m x6 -#define m_n x7 -#define n_m x8 -#define n_n x9 - -#define j x6 - -// General temporary variables and loop counters - -#define i x10 -#define t1 x11 -#define t2 x12 - -// High and low proxies for the inner loop -// Then re-used for high and carry words during actual cross-multiplications - -#define m_hi x13 -#define n_hi x14 -#define m_lo x15 -#define n_lo x16 - -#define h1 x13 -#define h2 x14 -#define l1 x15 -#define l2 x16 - -#define c1 x17 -#define c2 x19 - -// Negated modular inverse for Montgomery - -#define v x20 - -// Some more intuitive names for temp regs in initial word-level negmodinv. -// These just use t1 and t2 again, though carefully since t1 = initial b[0] - -#define one t2 -#define e1 t2 -#define e2 t1 -#define e4 t2 -#define e8 t1 - -S2N_BN_SYMBOL(bignum_modinv): - CFI_START - -// We make use of registers beyond the modifiable - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - -// If k = 0 then do nothing (this is out of scope anyway) - - cbz k, Lbignum_modinv_end - -// Set up the additional two buffers m and n beyond w in temp space - - lsl i, k, #3 - add m, w, i - add n, m, i - -// Initialize the main buffers with their starting values: -// m = a, n = b, w = b (to be tweaked to b - 1) and z = 0 - - mov i, xzr -Lbignum_modinv_copyloop: - ldr t1, [a, i, lsl #3] - ldr t2, [b, i, lsl #3] - str t1, [m, i, lsl #3] - str t2, [n, i, lsl #3] - str t2, [w, i, lsl #3] - str xzr, [z, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_modinv_copyloop - -// Tweak down w to b - 1 (this crude approach is safe as b needs to be odd -// for it to be in scope). We have then established the congruence invariant: -// -// a * w == -m (mod b) -// a * z == n (mod b) -// -// This, with the bound w <= b and z <= b, is maintained round the outer loop - - ldr t1, [w] - sub t2, t1, #1 - str t2, [w] - -// Compute v = negated modular inverse of b mod 2^64, reusing t1 from above -// This is used for Montgomery reduction operations each time round the loop - - lsl v, t1, #2 - sub v, t1, v - eor v, v, #2 - mov one, #1 - madd e1, t1, v, one - mul e2, e1, e1 - madd v, e1, v, v - mul e4, e2, e2 - madd v, e2, v, v - mul e8, e4, e4 - madd v, e4, v, v - madd v, e8, v, v - -// Set up the outer loop count of 128 * k -// The invariant is that m * n < 2^t at all times. - - lsl t, k, #7 - -// Start of the main outer loop iterated t / CHUNKSIZE times - -Lbignum_modinv_outerloop: - -// We need only bother with sharper l = min k (ceil(t/64)) digits -// for the computations on m and n (but we still need k for w and z). -// Either both m and n fit in l digits, or m has become zero and so -// nothing happens in the loop anyway and this makes no difference. - - add i, t, #63 - lsr l, i, #6 - cmp l, k - csel l, k, l, cs - -// Select upper and lower proxies for both m and n to drive the inner -// loop. The lower proxies are simply the lowest digits themselves, -// m_lo = m[0] and n_lo = n[0], while the upper proxies are bitfields -// of the two inputs selected so their top bit (63) aligns with the -// most significant bit of *either* of the two inputs. - - mov h1, xzr // Previous high and low for m - mov l1, xzr - mov h2, xzr // Previous high and low for n - mov l2, xzr - mov c2, xzr // Mask flag: previous word of one was nonzero - // and in this case h1 and h2 are those words - mov i, xzr -Lbignum_modinv_toploop: - ldr t1, [m, i, lsl #3] - ldr t2, [n, i, lsl #3] - orr c1, t1, t2 - cmp c1, xzr - and c1, c2, h1 - csel l1, c1, l1, ne - and c1, c2, h2 - csel l2, c1, l2, ne - csel h1, t1, h1, ne - csel h2, t2, h2, ne - csetm c2, ne - add i, i, #1 - cmp i, l - bcc Lbignum_modinv_toploop - - orr t1, h1, h2 - clz t2, t1 - negs c1, t2 - lsl h1, h1, t2 - csel l1, l1, xzr, ne - lsl h2, h2, t2 - csel l2, l2, xzr, ne - lsr l1, l1, c1 - lsr l2, l2, c1 - orr m_hi, h1, l1 - orr n_hi, h2, l2 - - ldr m_lo, [m] - ldr n_lo, [n] - -// Now the inner loop, with i as loop counter from CHUNKSIZE down. -// This records a matrix of updates to apply to the initial -// values of m and n with, at stage j: -// -// sgn * m' = (m_m * m - m_n * n) / 2^j -// -sgn * n' = (n_m * m - n_n * n) / 2^j -// -// where "sgn" is either +1 or -1, and we lose track of which except -// that both instance above are the same. This throwing away the sign -// costs nothing (since we have to correct in general anyway because -// of the proxied comparison) and makes things a bit simpler. But it -// is simply the parity of the number of times the first condition, -// used as the swapping criterion, fires in this loop. - - mov m_m, #1 - mov m_n, xzr - mov n_m, xzr - mov n_n, #1 - - mov i, #CHUNKSIZE - -// Conceptually in the inner loop we follow these steps: -// -// * If m_lo is odd and m_hi < n_hi, then swap the four pairs -// (m_hi,n_hi); (m_lo,n_lo); (m_m,n_m); (m_n,n_n) -// -// * Now, if m_lo is odd (old or new, doesn't matter as initial n_lo is odd) -// m_hi := m_hi - n_hi, m_lo := m_lo - n_lo -// m_m := m_m + n_m, m_n := m_n + n_n -// -// * Halve and double them -// m_hi := m_hi / 2, m_lo := m_lo / 2 -// n_m := n_m * 2, n_n := n_n * 2 -// -// The actual computation computes updates before actually swapping and -// then corrects as needed. It also maintains the invariant ~ZF <=> odd(m_lo), -// since it seems to reduce the dependent latency. Set that up first. - - ands xzr, m_lo, #1 - -Lbignum_modinv_innerloop: - -// At the start of the loop ~ZF <=> m_lo is odd; mask values accordingly -// Set the flags for m_hi - [~ZF] * n_hi so we know to flip things. - - csel t1, n_hi, xzr, ne - csel t2, n_lo, xzr, ne - csel c1, n_m, xzr, ne - csel c2, n_n, xzr, ne - ccmp m_hi, n_hi, #0x2, ne - -// Compute subtractive updates, trivial in the case ZF <=> even(m_lo). - - sub t1, m_hi, t1 - sub t2, m_lo, t2 - -// If the subtraction borrows, swap things appropriately, negating where -// we've already subtracted so things are as if we actually swapped first. - - csel n_hi, n_hi, m_hi, cs - cneg t1, t1, cc - csel n_lo, n_lo, m_lo, cs - cneg m_lo, t2, cc - csel n_m, n_m, m_m, cs - csel n_n, n_n, m_n, cs - -// Update and shift while setting oddness flag for next iteration -// We look at bit 1 of t2 (m_lo before possible negation), which is -// safe because it is even. - - ands xzr, t2, #2 - add m_m, m_m, c1 - add m_n, m_n, c2 - lsr m_hi, t1, #1 - lsr m_lo, m_lo, #1 - add n_m, n_m, n_m - add n_n, n_n, n_n - -// Next iteration; don't disturb the flags since they are used at entry - - sub i, i, #1 - cbnz i, Lbignum_modinv_innerloop - -// Apply the update to w and z, using addition in this case, and also take -// the chance to shift an additional 6 = 64-CHUNKSIZE bits to be ready for a -// Montgomery multiplication. Because we know that m_m + m_n <= 2^58 and -// w, z <= b < 2^{64k}, we know that both of these fit in k+1 words. -// We do this before the m-n update to allow us to play with c1 and c2 here. -// -// h1::w = 2^6 * (m_m * w + m_n * z) -// h2::z = 2^6 * (n_m * w + n_n * z) -// -// with c1 and c2 recording previous words for the shifting part - - mov h1, xzr - mov h2, xzr - mov c1, xzr - mov c2, xzr - - mov i, xzr -Lbignum_modinv_congloop: - ldr t1, [w, i, lsl #3] - ldr t2, [z, i, lsl #3] - - mul l1, m_m, t1 - mul l2, m_n, t2 - adds l1, l1, h1 - umulh h1, m_m, t1 - adc h1, h1, xzr - adds l1, l1, l2 - extr c1, l1, c1, #CHUNKSIZE - str c1, [w, i, lsl #3] - mov c1, l1 - umulh l1, m_n, t2 - adc h1, h1, l1 - - mul l1, n_m, t1 - mul l2, n_n, t2 - adds l1, l1, h2 - umulh h2, n_m, t1 - adc h2, h2, xzr - adds l1, l1, l2 - extr c2, l1, c2, #CHUNKSIZE - str c2, [z, i, lsl #3] - mov c2, l1 - umulh l1, n_n, t2 - adc h2, h2, l1 - - add i, i, #1 - cmp i, k - bcc Lbignum_modinv_congloop - - extr h1, h1, c1, #CHUNKSIZE - extr h2, h2, c2, #CHUNKSIZE - -// Do a Montgomery reduction of h1::w - - ldr t1, [w] - mul c1, t1, v - ldr t2, [b] - mul l1, c1, t2 - umulh l2, c1, t2 - adds t1, t1, l1 // Will be zero but want the carry - - mov i, #1 - sub t1, k, #1 - cbz t1, Lbignum_modinv_wmontend -Lbignum_modinv_wmontloop: - ldr t1, [b, i, lsl #3] - ldr t2, [w, i, lsl #3] - mul l1, c1, t1 - adcs t2, t2, l2 - umulh l2, c1, t1 - adc l2, l2, xzr - adds t2, t2, l1 - sub l1, i, #1 - str t2, [w, l1, lsl #3] - add i, i, #1 - sub t1, i, k - cbnz t1, Lbignum_modinv_wmontloop -Lbignum_modinv_wmontend: - adcs l2, l2, h1 - adc h1, xzr, xzr - sub l1, i, #1 - str l2, [w, l1, lsl #3] - - subs i, xzr, xzr -Lbignum_modinv_wcmploop: - ldr t1, [w, i, lsl #3] - ldr t2, [b, i, lsl #3] - sbcs xzr, t1, t2 - add i, i, #1 - sub t1, i, k - cbnz t1, Lbignum_modinv_wcmploop - - sbcs xzr, h1, xzr - csetm h1, cs - - subs i, xzr, xzr -Lbignum_modinv_wcorrloop: - ldr t1, [w, i, lsl #3] - ldr t2, [b, i, lsl #3] - and t2, t2, h1 - sbcs t1, t1, t2 - str t1, [w, i, lsl #3] - add i, i, #1 - sub t1, i, k - cbnz t1, Lbignum_modinv_wcorrloop - -// Do a Montgomery reduction of h2::z - - ldr t1, [z] - mul c1, t1, v - ldr t2, [b] - mul l1, c1, t2 - umulh l2, c1, t2 - adds t1, t1, l1 // Will be zero but want the carry - - mov i, #1 - sub t1, k, #1 - cbz t1, Lbignum_modinv_zmontend -Lbignum_modinv_zmontloop: - ldr t1, [b, i, lsl #3] - ldr t2, [z, i, lsl #3] - mul l1, c1, t1 - adcs t2, t2, l2 - umulh l2, c1, t1 - adc l2, l2, xzr - adds t2, t2, l1 - sub l1, i, #1 - str t2, [z, l1, lsl #3] - add i, i, #1 - sub t1, i, k - cbnz t1, Lbignum_modinv_zmontloop -Lbignum_modinv_zmontend: - adcs l2, l2, h2 - adc h2, xzr, xzr - sub l1, i, #1 - str l2, [z, l1, lsl #3] - - subs i, xzr, xzr -Lbignum_modinv_zcmploop: - ldr t1, [z, i, lsl #3] - ldr t2, [b, i, lsl #3] - sbcs xzr, t1, t2 - add i, i, #1 - sub t1, i, k - cbnz t1, Lbignum_modinv_zcmploop - - sbcs xzr, h2, xzr - csetm h2, cs - - subs i, xzr, xzr -Lbignum_modinv_zcorrloop: - ldr t1, [z, i, lsl #3] - ldr t2, [b, i, lsl #3] - and t2, t2, h2 - sbcs t1, t1, t2 - str t1, [z, i, lsl #3] - add i, i, #1 - sub t1, i, k - cbnz t1, Lbignum_modinv_zcorrloop - -// Now actually compute the updates to m and n corresponding to the matrix, -// and correct the signs if they have gone negative. First we compute the -// (k+1)-sized updates with the following invariant (here c1 and c2 are in -// fact carry bitmasks, either 0 or -1): -// -// c1::h1::m = m_m * m - m_n * n -// c2::h2::n = n_m * m - n_n * n - - mov h1, xzr - mov h2, xzr - mov c1, xzr - mov c2, xzr - mov i, xzr -Lbignum_modinv_crossloop: - ldr t1, [m, i, lsl #3] - ldr t2, [n, i, lsl #3] - - mul l1, m_m, t1 - mul l2, m_n, t2 - adds l1, l1, h1 - umulh h1, m_m, t1 - adc h1, h1, xzr - subs l1, l1, l2 - str l1, [m, i, lsl #3] - umulh l1, m_n, t2 - sub c1, l1, c1 - sbcs h1, h1, c1 - csetm c1, cc - - mul l1, n_m, t1 - mul l2, n_n, t2 - adds l1, l1, h2 - umulh h2, n_m, t1 - adc h2, h2, xzr - subs l1, l1, l2 - str l1, [n, i, lsl #3] - umulh l1, n_n, t2 - sub c2, l1, c2 - sbcs h2, h2, c2 - csetm c2, cc - - add i, i, #1 - cmp i, l - bcc Lbignum_modinv_crossloop - -// Write back m optionally negated and shifted right CHUNKSIZE bits - - adds xzr, c1, c1 - - ldr l1, [m] - mov i, xzr - sub j, l, #1 - cbz j, Lbignum_modinv_negskip1 - -Lbignum_modinv_negloop1: - add t1, i, #8 - ldr t2, [m, t1] - extr l1, t2, l1, #CHUNKSIZE - eor l1, l1, c1 - adcs l1, l1, xzr - str l1, [m, i] - mov l1, t2 - add i, i, #8 - sub j, j, #1 - cbnz j, Lbignum_modinv_negloop1 -Lbignum_modinv_negskip1: - extr l1, h1, l1, #CHUNKSIZE - eor l1, l1, c1 - adcs l1, l1, xzr - str l1, [m, i] - -// Write back n optionally negated and shifted right CHUNKSIZE bits - - adds xzr, c2, c2 - - ldr l1, [n] - mov i, xzr - sub j, l, #1 - cbz j, Lbignum_modinv_negskip2 -Lbignum_modinv_negloop2: - add t1, i, #8 - ldr t2, [n, t1] - extr l1, t2, l1, #CHUNKSIZE - eor l1, l1, c2 - adcs l1, l1, xzr - str l1, [n, i] - mov l1, t2 - add i, i, #8 - sub j, j, #1 - cbnz j, Lbignum_modinv_negloop2 -Lbignum_modinv_negskip2: - extr l1, h2, l1, #CHUNKSIZE - eor l1, l1, c2 - adcs l1, l1, xzr - str l1, [n, i] - -// Finally, use the signs c1 and c2 to do optional modular negations of -// w and z respectively, flipping c2 to make signs work. We don't make -// any checks for zero values, but we certainly retain w <= b and z <= b. -// This is enough for the Montgomery step in the next iteration to give -// strict reduction w < b amd z < b, and anyway when we terminate we -// could not have z = b since it violates the coprimality assumption for -// in-scope cases. - - mov i, xzr - adds xzr, c1, c1 -Lbignum_modinv_wfliploop: - ldr t1, [b, i, lsl #3] - ldr t2, [w, i, lsl #3] - and t1, t1, c1 - eor t2, t2, c1 - adcs t1, t1, t2 - str t1, [w, i, lsl #3] - add i, i, #1 - sub t1, i, k - cbnz t1, Lbignum_modinv_wfliploop - - mvn c2, c2 - - mov i, xzr - adds xzr, c2, c2 -Lbignum_modinv_zfliploop: - ldr t1, [b, i, lsl #3] - ldr t2, [z, i, lsl #3] - and t1, t1, c2 - eor t2, t2, c2 - adcs t1, t1, t2 - str t1, [z, i, lsl #3] - add i, i, #1 - sub t1, i, k - cbnz t1, Lbignum_modinv_zfliploop - -// End of main loop. We can stop if t' <= 0 since then m * n < 2^0, which -// since n is odd and m and n are coprime (in the in-scope cases) means -// m = 0, n = 1 and hence from the congruence invariant a * z == 1 (mod b). -// Moreover we do in fact need to maintain strictly t > 0 in the main loop, -// or the computation of the optimized digit bound l could collapse to 0. - - subs t, t, #CHUNKSIZE - bhi Lbignum_modinv_outerloop - -Lbignum_modinv_end: - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_modinv) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modoptneg.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modoptneg.S deleted file mode 100644 index 5c7f1328578..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modoptneg.S +++ /dev/null @@ -1,83 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo m, z := (-x) mod m (if p nonzero) or z := x -// (if p zero), assuming x reduced -// Inputs p, x[k], m[k]; output z[k] -// -// extern void bignum_modoptneg(uint64_t k, uint64_t *z, uint64_t p, -// const uint64_t *x, const uint64_t *m); -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = p, X3 = x, X4 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_modoptneg) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_modoptneg) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_modoptneg) - .text - .balign 4 - -#define k x0 -#define z x1 -#define p x2 -#define x x3 -#define m x4 -#define i x5 -#define a x6 -#define b x7 - - -S2N_BN_SYMBOL(bignum_modoptneg): - CFI_START - -// Do nothing if k = 0 - - cbz k, Lbignum_modoptneg_end - -// Make an additional check for zero input, and force p to zero in this case. -// This can be skipped if the input is known not to be zero a priori. - - mov i, xzr - mov a, xzr -Lbignum_modoptneg_cmploop: - ldr b, [x, i, lsl #3] - orr a, a, b - add i, i, #1 - cmp i, k - bcc Lbignum_modoptneg_cmploop - - cmp a, xzr - csel p, p, xzr, ne - -// Turn the input p into a strict bitmask - - cmp p, xzr - csetm p, ne - -// Main loop - - mov i, xzr - adds xzr, p, p -Lbignum_modoptneg_mainloop: - - ldr a, [m, i, lsl #3] - ldr b, [x, i, lsl #3] - and a, a, p - eor b, b, p - adcs a, a, b - str a, [z, i, lsl #3] - add i, i, #1 - sub a, i, k - cbnz a, Lbignum_modoptneg_mainloop - -Lbignum_modoptneg_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_modoptneg) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modsub.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modsub.S deleted file mode 100644 index 8dafb6ce54a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_modsub.S +++ /dev/null @@ -1,74 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Subtract modulo m, z := (x - y) mod m, assuming x and y reduced -// Inputs x[k], y[k], m[k]; output z[k] -// -// extern void bignum_modsub(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *y, const uint64_t *m); -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = x, X3 = y, X4 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_modsub) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_modsub) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_modsub) - .text - .balign 4 - -#define k x0 -#define z x1 -#define x x2 -#define y x3 -#define m x4 -#define i x5 -#define j x6 -#define a x7 -#define b x8 -#define c x9 - - -S2N_BN_SYMBOL(bignum_modsub): - CFI_START - -adds j, k, xzr // j = k and ZF = (k = 0) - beq Lbignum_modsub_end // if k = 0 do nothing - subs i, xzr, xzr // i = 0 and CF = 1 - -// Subtract z := x - y and record a mask for the carry x - y < 0 - -Lbignum_modsub_subloop: - ldr a, [x, i] - ldr b, [y, i] - sbcs a, a, b - str a, [z, i] - add i, i, #8 - sub j, j, #1 - cbnz j, Lbignum_modsub_subloop - csetm c, cc - -// Now do a masked addition z := z + [c] * m - - mov j, k - adds i, xzr, xzr -Lbignum_modsub_addloop: - ldr a, [z, i] - ldr b, [m, i] - and b, b, c - adcs a, a, b - str a, [z, i] - add i, i, #8 - sub j, j, #1 - cbnz j, Lbignum_modsub_addloop - -Lbignum_modsub_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_modsub) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montifier.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montifier.S deleted file mode 100644 index 81abb538e81..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montifier.S +++ /dev/null @@ -1,462 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compute "montification" constant z := 2^{128k} mod m -// Input m[k]; output z[k]; temporary buffer t[>=k] -// -// extern void bignum_montifier(uint64_t k, uint64_t *z, const uint64_t *m, -// uint64_t *t); -// -// The last argument points to a temporary buffer t that should have size >= k. -// This is called "montifier" because given any other k-digit number x, -// whether or not it's reduced modulo m, it can be mapped to its Montgomery -// representation (2^{64k} * x) mod m just by Montgomery multiplication by z. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = m, X3 = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montifier) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montifier) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montifier) - .text - .balign 4 - -#define k x0 -#define z x1 -#define m x2 -#define t x3 - -// Some variables -// Modular inverse w is aliased to i, but we never use them together - -#define i x4 -#define w x4 -#define j x5 -#define h x6 -#define a x7 -#define l x8 -#define c x9 -#define b x10 -#define d x11 - -// Some aliases for the values b and d - -#define r x10 -#define q x11 - - -S2N_BN_SYMBOL(bignum_montifier): - CFI_START - -// If k = 0 the whole operation is trivial - - cbz k, Lbignum_montifier_end - -// Copy the input m into the temporary buffer t. The temporary register -// c matters since we want it to hold the highest digit, ready for the -// normalization phase. - - mov i, xzr -Lbignum_montifier_copyinloop: - ldr c, [m, i, lsl #3] - str c, [t, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_montifier_copyinloop - -// Do a rather stupid but constant-time digit normalization, conditionally -// shifting left (k-1) times based on whether the top word is zero. -// With careful binary striding this could be O(k*log(k)) instead of O(k^2) -// while still retaining the constant-time style. -// The "cmp c, xzr" sets the zeroness predicate (ZF) for the entire inner loop - - subs i, k, #1 - beq Lbignum_montifier_normalized -Lbignum_montifier_normloop: - mov j, xzr - cmp c, xzr - mov a, xzr -Lbignum_montifier_shufloop: - mov c, a - ldr a, [t, j, lsl #3] - csel c, c, a, eq - str c, [t, j, lsl #3] - add j, j, #1 - sub d, j, k - cbnz d, Lbignum_montifier_shufloop - subs i, i, #1 - bne Lbignum_montifier_normloop - -// We now have the top digit nonzero, assuming the input was nonzero, -// and as per the invariant of the loop above, c holds that digit. So -// now just count c's leading zeros and shift t bitwise that many bits. - -Lbignum_montifier_normalized: - clz c, c - - mov b, xzr - mov i, xzr - ands xzr, c, #63 - csetm l, ne - neg d, c -Lbignum_montifier_bitloop: - ldr j, [t, i, lsl #3] - lsl a, j, c - orr a, a, b - lsr b, j, d - and b, b, l - str a, [t, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_montifier_bitloop - -// Let h be the high word of n, which in all the in-scope cases is >= 2^63. -// Now successively form q = 2^i div h and r = 2^i mod h as i goes from -// 64 to 126. We avoid just using division out of constant-time concerns -// (at the least we would need to fix up h = 0 for out-of-scope inputs) and -// don't bother with Newton-Raphson, since this stupid simple loop doesn't -// contribute much of the overall runtime at typical sizes. - - sub h, k, #1 - ldr h, [t, h, lsl #3] - mov q, #1 - neg r, h - mov i, #62 -Lbignum_montifier_estloop: - add q, q, q - mov a, h - sub a, a, r - cmp r, a // CF <=> r >= h - r <=> 2 * r >= h - csetm a, cs - sub q, q, a - add r, r, r - and a, a, h - sub r, r, a - subs i, i, #1 - bne Lbignum_montifier_estloop - -// Strictly speaking the above loop doesn't quite give the true remainder -// and quotient in the special case r = h = 2^63, so fix it up. We get -// q = 2^63 - 1 and r = 2^63 and really want q = 2^63 and r = 0. This is -// supererogatory, because the main property of q used below still holds -// in this case unless the initial m = 1, and then anyway the overall -// specification (congruence modulo m) holds degenerately. But it seems -// nicer to get a "true" quotient and remainder. - - cmp r, h - csinc q, q, q, ne - -// So now we have q and r with 2^126 = q * h + r (imagining r = 0 in the -// fixed-up case above: note that we never actually use the computed -// value of r below and so didn't adjust it). And we can assume the ranges -// q <= 2^63 and r < h < 2^64. -// -// The idea is to use q as a first quotient estimate for a remainder -// of 2^{p+62} mod n, where p = 64 * k. We have, splitting n into the -// high and low parts h and l: -// -// 2^{p+62} - q * n = 2^{p+62} - q * (2^{p-64} * h + l) -// = 2^{p+62} - (2^{p-64} * (q * h) + q * l) -// = 2^{p+62} - 2^{p-64} * (2^126 - r) - q * l -// = 2^{p-64} * r - q * l -// -// Note that 2^{p-64} * r < 2^{p-64} * h <= n -// and also q * l < 2^63 * 2^{p-64} = 2^{p-1} <= n -// so |diff| = |2^{p-64} * r - q * l| < n. -// -// If in fact diff >= 0 then it is already 2^{p+62} mod n. -// otherwise diff + n is the right answer. -// -// To (maybe?) make the computation slightly easier we actually flip -// the sign and compute d = q * n - 2^{p+62}. Then the answer is either -// -d (when negative) or n - d; in either case we effectively negate d. -// This negating tweak in fact spoils the result for cases where -// 2^{p+62} mod n = 0, when we get n instead. However the only case -// where this can happen is m = 1, when the whole spec holds trivially, -// and actually the remainder of the logic below works anyway since -// the latter part of the code only needs a congruence for the k-digit -// result, not strict modular reduction (the doublings will maintain -// the non-strict inequality). - - mov c, xzr - adds i, xzr, xzr -Lbignum_montifier_mulloop: - ldr a, [t, i, lsl #3] - mul l, q, a - adcs l, l, c - umulh c, q, a - str l, [z, i, lsl #3] - add i, i, #1 - sub a, i, k - cbnz a, Lbignum_montifier_mulloop - - adc c, c, xzr - mov a, #0x4000000000000000 - subs c, c, a - csetm q, cs - -// Now do [c] * n - d for our final answer - - subs i, xzr, xzr -Lbignum_montifier_remloop: - ldr a, [t, i, lsl #3] - ldr b, [z, i, lsl #3] - and a, a, q - sbcs a, a, b - str a, [z, i, lsl #3] - add i, i, #1 - sub a, i, k - cbnz a, Lbignum_montifier_remloop - -// Now still need to do a couple of modular doublings to get us all the -// way up to 2^{p+64} == r from the initial 2^{p+62} == r (mod n). - - mov c, xzr - subs j, xzr, xzr -Lbignum_montifier_dubloop1: - ldr a, [z, j, lsl #3] - extr c, a, c, #63 - ldr b, [t, j, lsl #3] - sbcs c, c, b - str c, [z, j, lsl #3] - mov c, a - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montifier_dubloop1 - lsr c, c, #63 - sbc c, c, xzr - adds j, xzr, xzr -Lbignum_montifier_corrloop1: - ldr a, [z, j, lsl #3] - ldr b, [t, j, lsl #3] - and b, b, c - adcs a, a, b - str a, [z, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montifier_corrloop1 - -// This is not exactly the same: we also copy output to t giving the -// initialization t_1 = r == 2^{p+64} mod n for the main loop next. - - mov c, xzr - subs j, xzr, xzr -Lbignum_montifier_dubloop2: - ldr a, [z, j, lsl #3] - extr c, a, c, #63 - ldr b, [t, j, lsl #3] - sbcs c, c, b - str c, [z, j, lsl #3] - mov c, a - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montifier_dubloop2 - lsr c, c, #63 - sbc c, c, xzr - adds j, xzr, xzr -Lbignum_montifier_corrloop2: - ldr a, [z, j, lsl #3] - ldr b, [t, j, lsl #3] - and b, b, c - adcs a, a, b - str a, [z, j, lsl #3] - str a, [t, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montifier_corrloop2 - -// We then successively generate (k+1)-digit values satisfying -// t_i == 2^{p+64*i} mod n, each of which is stored in h::t. Finish -// initialization by zeroing h initially - - mov h, xzr - -// Then if t_i = 2^{p} * h + l -// we have t_{i+1} == 2^64 * t_i -// = (2^{p+64} * h) + (2^64 * l) -// == r * h + l<<64 -// Do this 2*k more times so we end up == 2^{192*k+64}, one more than we want -// -// Writing B = 2^{64k}, the possible correction of adding r, which for -// a (k+1)-digit result is equivalent to subtracting q = 2^{64*(k+1)} - r -// would give the overall worst-case value minus q of -// [ B * (B^k - 1) + (B - 1) * r ] - [B^{k+1} - r] -// = B * (r - 1) < B^{k+1} so we keep inside k+1 digits as required. -// -// This implementation makes the shift implicit by starting b with the -// "previous" digit (initially 0) to offset things by 1. - - add i, k, k -Lbignum_montifier_modloop: - mov j, xzr - mov b, xzr - adds c, xzr, xzr -Lbignum_montifier_cmaloop: - ldr a, [z, j, lsl #3] - mul l, h, a - adcs b, b, c - umulh c, h, a - adc c, c, xzr - adds l, b, l - ldr b, [t, j, lsl #3] - str l, [t, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montifier_cmaloop - - adcs h, b, c - - csetm l, cs - - adds j, xzr, xzr -Lbignum_montifier_oaloop: - ldr a, [t, j, lsl #3] - ldr b, [z, j, lsl #3] - and b, b, l - adcs a, a, b - str a, [t, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montifier_oaloop - adc h, h, xzr - - subs i, i, #1 - bne Lbignum_montifier_modloop - -// Compute the negated modular inverse w (same register as i, not used again). - - ldr a, [m] - lsl w, a, #2 - sub w, a, w - eor w, w, #2 - mov l, #1 - madd c, a, w, l - mul b, c, c - madd w, c, w, w - mul c, b, b - madd w, b, w, w - mul b, c, c - madd w, c, w, w - madd w, b, w, w - -// Now do one almost-Montgomery reduction w.r.t. the original m -// which lops off one 2^64 from the congruence and, with the usual -// almost-Montgomery correction, gets us back inside k digits for -// the end result. - - ldr b, [t] - mul d, b, w - - mul l, d, a - umulh c, d, a - mov j, #1 - sub a, k, #1 - adds xzr, b, l - cbz a, Lbignum_montifier_amontend - -Lbignum_montifier_amontloop: - ldr a, [m, j, lsl #3] - ldr b, [t, j, lsl #3] - mul l, d, a - adcs b, b, c - umulh c, d, a - adc c, c, xzr - adds b, b, l - sub a, j, #1 - str b, [t, a, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montifier_amontloop -Lbignum_montifier_amontend: - adcs h, h, c - csetm l, cs - sub a, k, #1 - str h, [t, a, lsl #3] - - subs j, xzr, xzr -Lbignum_montifier_osloop: - ldr a, [t, j, lsl #3] - ldr b, [m, j, lsl #3] - and b, b, l - sbcs a, a, b - str a, [z, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montifier_osloop - -// So far, the code(basically a variant of bignum_amontifier) has produced -// a k-digit value z == 2^{192k} (mod m), not necessarily fully reduced mod m. -// We now do a short Montgomery reduction (similar to bignum_demont) so that -// we achieve full reduction mod m while lopping 2^{64k} off the congruence. -// We recycle h as the somewhat strangely-named outer loop counter. - - mov h, k - -Lbignum_montifier_montouterloop: - ldr b, [z] - mul d, b, w - ldr a, [m] - mul l, d, a - umulh c, d, a - mov j, #1 - sub a, k, #1 - adds xzr, b, l - cbz a, Lbignum_montifier_montend -Lbignum_montifier_montloop: - ldr a, [m, j, lsl #3] - ldr b, [z, j, lsl #3] - mul l, d, a - adcs b, b, c - umulh c, d, a - adc c, c, xzr - adds b, b, l - sub a, j, #1 - str b, [z, a, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montifier_montloop -Lbignum_montifier_montend: - adc c, c, xzr - sub a, k, #1 - str c, [z, a, lsl #3] - - subs h, h, #1 - bne Lbignum_montifier_montouterloop - -// Now do a comparison of z with m to set a final correction mask -// indicating that z >= m and so we need to subtract m. - - subs j, xzr, xzr -Lbignum_montifier_cmploop: - ldr a, [z, j, lsl #3] - ldr b, [m, j, lsl #3] - sbcs xzr, a, b - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montifier_cmploop - csetm h, cs - -// Now do a masked subtraction of m for the final reduced result. - - subs j, xzr, xzr -Lbignum_montifier_corrloop: - ldr a, [z, j, lsl #3] - ldr b, [m, j, lsl #3] - and b, b, h - sbcs a, a, b - str a, [z, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montifier_corrloop - -Lbignum_montifier_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montifier) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montmul.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montmul.S deleted file mode 100644 index 666cec96eac..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montmul.S +++ /dev/null @@ -1,198 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^{64k}) mod m -// Inputs x[k], y[k], m[k]; output z[k] -// -// extern void bignum_montmul(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *y, const uint64_t *m); -// -// Does z := (x * y / 2^{64k}) mod m, assuming x * y <= 2^{64k} * m, which is -// guaranteed in particular if x < m, y < m initially (the "intended" case). -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = x, X3 = y, X4 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul) - .text - .balign 4 - -#define k x0 -#define z x1 -#define x x2 -#define y x3 -#define m x4 - -// Negated modular inverse -#define w x5 -// Top carry for k'th position -#define c0 x6 -// Additional top carry for (k+1)'th position -#define c1 x7 -// Outer loop counter -#define i x8 -// Home for i'th digit or Montgomery multiplier -#define d x9 -// Inner loop counter -#define j x10 - -#define h x11 -#define e x12 -#define l x13 -#define a x14 - -// This is just a short-term temporary used in zero-test subtraction. -// It's aliased to the same register as "a" which is always safe here. - -#define t x14 - -// Some more intuitive names for temp regs in initial word-level negmodinv. -// These just use c0 and c1 again, which aren't initialized early on. - -#define one x6 -#define e1 x6 -#define e2 x7 -#define e4 x6 -#define e8 x7 - - -S2N_BN_SYMBOL(bignum_montmul): - CFI_START - -// If k = 0 the whole operation is trivial - - cbz k, Lbignum_montmul_end - -// Compute word-level negated modular inverse w for m == m[0]. -// This is essentially the same as word_negmodinv. - - ldr a, [m] - lsl w, a, #2 - sub w, a, w - eor w, w, #2 - mov one, #1 - madd e1, a, w, one - mul e2, e1, e1 - madd w, e1, w, w - mul e4, e2, e2 - madd w, e2, w, w - mul e8, e4, e4 - madd w, e4, w, w - madd w, e8, w, w - -// Initialize the output c0::z to zero so we can then consistently add rows. -// It would be a bit more efficient to special-case the zeroth row, but -// this keeps the code slightly simpler. - - mov i, xzr -Lbignum_montmul_zoop: - str xzr, [z, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_montmul_zoop - mov c0, xzr - -// Outer loop pulling down digits d=x[i], multiplying by y and reducing - - mov i, xzr -Lbignum_montmul_outerloop: - -// Multiply-add loop where we always have CF + previous high part h to add in -// Note that in general we do need yet one more carry in this phase and hence -// initialize c1 with the top carry. - - ldr d, [x, i, lsl #3] - mov j, xzr - adds h, xzr, xzr -Lbignum_montmul_maddloop: - ldr a, [y, j, lsl #3] - ldr e, [z, j, lsl #3] - mul l, d, a - adcs e, e, h - umulh h, d, a - adc h, h, xzr - adds e, e, l - str e, [z, j, lsl #3] - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_montmul_maddloop - adcs c0, c0, h - adc c1, xzr, xzr - -// Montgomery reduction loop, similar but offsetting writebacks - - ldr e, [z] - mul d, e, w - ldr a, [m] - mul l, d, a - umulh h, d, a - adds e, e, l // Will be zero but want the carry - mov j, #1 - sub t, k, #1 - cbz t, Lbignum_montmul_montend -Lbignum_montmul_montloop: - ldr a, [m, j, lsl #3] - ldr e, [z, j, lsl #3] - mul l, d, a - adcs e, e, h - umulh h, d, a - adc h, h, xzr - adds e, e, l - sub l, j, #1 - str e, [z, l, lsl #3] - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_montmul_montloop -Lbignum_montmul_montend: - adcs h, c0, h - adc c0, c1, xzr - sub l, j, #1 - str h, [z, l, lsl #3] - -// End of outer loop - - add i, i, #1 - cmp i, k - bcc Lbignum_montmul_outerloop - -// Now do a comparison of (c0::z) with (0::m) to set a final correction mask -// indicating that (c0::z) >= m and so we need to subtract m. - - subs j, xzr, xzr -Lbignum_montmul_cmploop: - ldr a, [z, j, lsl #3] - ldr e, [m, j, lsl #3] - sbcs xzr, a, e - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_montmul_cmploop - - sbcs xzr, c0, xzr - csetm c0, cs - -// Now do a masked subtraction of m for the final reduced result. - - subs j, xzr, xzr -Lbignum_montmul_corrloop: - ldr a, [z, j, lsl #3] - ldr e, [m, j, lsl #3] - and e, e, c0 - sbcs a, a, e - str a, [z, j, lsl #3] - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_montmul_corrloop - -Lbignum_montmul_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montredc.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montredc.S deleted file mode 100644 index ec76f919779..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montredc.S +++ /dev/null @@ -1,198 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery reduce, z := (x' / 2^{64p}) MOD m -// Inputs x[n], m[k], p; output z[k] -// -// extern void bignum_montredc(uint64_t k, uint64_t *z, uint64_t n, -// const uint64_t *x, const uint64_t *m, uint64_t p); -// -// Does a := (x' / 2^{64p}) mod m where x' = x if n <= p + k and in general -// is the lowest (p+k) digits of x, assuming x' <= 2^{64p} * m. That is, -// p-fold Montgomery reduction w.r.t. a k-digit modulus m giving a k-digit -// answer. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = n, X3 = x, X4 = m, X5 = p -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montredc) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montredc) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montredc) - .text - .balign 4 - -#define k x0 -#define z x1 -#define n x2 -#define x x3 -#define m x4 -#define p x5 - -// Negated modular inverse -#define w x6 -// Outer loop counter -#define i x7 -// Inner loop counter -#define j x8 -// Home for Montgomery multiplier -#define d x9 -// Top carry for current window -#define c x14 - -#define h x10 -#define e x11 -#define l x12 -#define a x13 - -// Some more intuitive names for temp regs in initial word-level negmodinv. -// These just use i and j again, which aren't used early on. - -#define one x7 -#define e1 x7 -#define e2 x8 -#define e4 x7 -#define e8 x8 - - -S2N_BN_SYMBOL(bignum_montredc): - CFI_START - -// If k = 0 the whole operation is trivial - - cbz k, Lbignum_montredc_end - -// Compute word-level negated modular inverse w for m == m[0]. -// This is essentially the same as word_negmodinv. - - ldr a, [m] - lsl w, a, #2 - sub w, a, w - eor w, w, #2 - mov one, #1 - madd e1, a, w, one - mul e2, e1, e1 - madd w, e1, w, w - mul e4, e2, e2 - madd w, e2, w, w - mul e8, e4, e4 - madd w, e4, w, w - madd w, e8, w, w - -// Initialize z to the lowest k digits of the input, zero-padding if n < k. - - cmp n, k - csel j, k, n, cs - mov i, xzr - cbz j, Lbignum_montredc_padloop -Lbignum_montredc_copyloop: - ldr a, [x, i, lsl #3] - str a, [z, i, lsl #3] - add i, i, #1 - cmp i, j - bcc Lbignum_montredc_copyloop - - cmp i, k - bcs Lbignum_montredc_initialized - -Lbignum_montredc_padloop: - str xzr, [z, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_montredc_padloop - -Lbignum_montredc_initialized: - mov c, xzr - -// Now if p = 0 we just need the corrective tail, and even that is -// only needed for the case when the input is exactly the modulus, -// to maintain the <= 2^64p * n precondition - - cbz p, Lbignum_montredc_corrective - -// Outer loop, just doing a standard Montgomery reduction on z - - mov i, xzr -Lbignum_montredc_outerloop: - - ldr e, [z] - mul d, e, w - ldr a, [m] - mul l, d, a - umulh h, d, a - adds e, e, l // Will be zero but want the carry - mov j, #1 - sub a, k, #1 - cbz a, Lbignum_montredc_montend -Lbignum_montredc_montloop: - ldr a, [m, j, lsl #3] - ldr e, [z, j, lsl #3] - mul l, d, a - adcs e, e, h - umulh h, d, a - adc h, h, xzr - adds e, e, l - sub l, j, #1 - str e, [z, l, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montredc_montloop -Lbignum_montredc_montend: - adcs h, h, c - adc c, xzr, xzr - add j, j, i - cmp j, n - bcs Lbignum_montredc_offtheend - ldr a, [x, j, lsl #3] - adds h, h, a - adc c, c, xzr -Lbignum_montredc_offtheend: - sub j, k, #1 - str h, [z, j, lsl #3] - -// End of outer loop - - add i, i, #1 - cmp i, p - bcc Lbignum_montredc_outerloop - -// Now do a comparison of (c::z) with (0::m) to set a final correction mask -// indicating that (c::z) >= m and so we need to subtract m. - -Lbignum_montredc_corrective: - - subs j, xzr, xzr -Lbignum_montredc_cmploop: - ldr a, [z, j, lsl #3] - ldr e, [m, j, lsl #3] - sbcs xzr, a, e - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montredc_cmploop - - sbcs xzr, c, xzr - csetm c, cs - -// Now do a masked subtraction of m for the final reduced result. - - subs j, xzr, xzr -Lbignum_montredc_corrloop: - ldr a, [z, j, lsl #3] - ldr e, [m, j, lsl #3] - and e, e, c - sbcs a, a, e - str a, [z, j, lsl #3] - add j, j, #1 - sub a, j, k - cbnz a, Lbignum_montredc_corrloop - -Lbignum_montredc_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montredc) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montsqr.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montsqr.S deleted file mode 100644 index 34b75de096c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_montsqr.S +++ /dev/null @@ -1,197 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^{64k}) mod m -// Inputs x[k], m[k]; output z[k] -// -// extern void bignum_montsqr(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *m); -// -// Does z := (x^2 / 2^{64k}) mod m, assuming x^2 <= 2^{64k} * m, which is -// guaranteed in particular if x < m initially (the "intended" case). -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = x, X3 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr) - .text - .balign 4 - -#define k x0 -#define z x1 -#define x x2 -#define m x3 - -// Negated modular inverse -#define w x4 -// Top carry for k'th position -#define c0 x5 -// Additional top carry for (k+1)'th position -#define c1 x6 -// Outer loop counter -#define i x7 -// Home for i'th digit or Montgomery multiplier -#define d x8 -// Inner loop counter -#define j x9 - -#define h x10 -#define e x11 -#define l x12 -#define a x13 - -// This is just a short-term temporary used in zero-test subtraction. -// It's aliased to the same register as "a" which is always safe here. - -#define t x13 - -// Some more intuitive names for temp regs in initial word-level negmodinv. -// These just use c0 and c1 again, which aren't initialized early on. - -#define one x5 -#define e1 x5 -#define e2 x6 -#define e4 x5 -#define e8 x6 - - -S2N_BN_SYMBOL(bignum_montsqr): - CFI_START - -// If k = 0 the whole operation is trivial - - cbz k, Lbignum_montsqr_end - -// Compute word-level negated modular inverse w for m == m[0]. -// This is essentially the same as word_negmodinv. - - ldr a, [m] - lsl w, a, #2 - sub w, a, w - eor w, w, #2 - mov one, #1 - madd e1, a, w, one - mul e2, e1, e1 - madd w, e1, w, w - mul e4, e2, e2 - madd w, e2, w, w - mul e8, e4, e4 - madd w, e4, w, w - madd w, e8, w, w - -// Initialize the output c0::z to zero so we can then consistently add rows. -// It would be a bit more efficient to special-case the zeroth row, but -// this keeps the code slightly simpler. - - mov i, xzr -Lbignum_montsqr_zoop: - str xzr, [z, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_montsqr_zoop - mov c0, xzr - -// Outer loop pulling down digits d=x[i], multiplying by x and reducing - - mov i, xzr -Lbignum_montsqr_outerloop: - -// Multiply-add loop where we always have CF + previous high part h to add in -// Note that in general we do need yet one more carry in this phase and hence -// initialize c1 with the top carry. - - ldr d, [x, i, lsl #3] - mov j, xzr - adds h, xzr, xzr -Lbignum_montsqr_maddloop: - ldr a, [x, j, lsl #3] - ldr e, [z, j, lsl #3] - mul l, d, a - adcs e, e, h - umulh h, d, a - adc h, h, xzr - adds e, e, l - str e, [z, j, lsl #3] - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_montsqr_maddloop - adcs c0, c0, h - adc c1, xzr, xzr - -// Montgomery reduction loop, similar but offsetting writebacks - - ldr e, [z] - mul d, e, w - ldr a, [m] - mul l, d, a - umulh h, d, a - adds e, e, l // Will be zero but want the carry - mov j, #1 - sub t, k, #1 - cbz t, Lbignum_montsqr_montend -Lbignum_montsqr_montloop: - ldr a, [m, j, lsl #3] - ldr e, [z, j, lsl #3] - mul l, d, a - adcs e, e, h - umulh h, d, a - adc h, h, xzr - adds e, e, l - sub l, j, #1 - str e, [z, l, lsl #3] - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_montsqr_montloop -Lbignum_montsqr_montend: - adcs h, c0, h - adc c0, c1, xzr - sub l, j, #1 - str h, [z, l, lsl #3] - -// End of outer loop - - add i, i, #1 - cmp i, k - bcc Lbignum_montsqr_outerloop - -// Now do a comparison of (c0::z) with (0::m) to set a final correction mask -// indicating that (c0::z) >= m and so we need to subtract m. - - subs j, xzr, xzr -Lbignum_montsqr_cmploop: - ldr a, [z, j, lsl #3] - ldr e, [m, j, lsl #3] - sbcs xzr, a, e - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_montsqr_cmploop - - sbcs xzr, c0, xzr - csetm c0, cs - -// Now do a masked subtraction of m for the final reduced result. - - subs j, xzr, xzr -Lbignum_montsqr_corrloop: - ldr a, [z, j, lsl #3] - ldr e, [m, j, lsl #3] - and e, e, c0 - sbcs a, a, e - str a, [z, j, lsl #3] - add j, j, #1 - sub t, j, k - cbnz t, Lbignum_montsqr_corrloop - -Lbignum_montsqr_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_muladd10.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_muladd10.S deleted file mode 100644 index d1d35288132..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_muladd10.S +++ /dev/null @@ -1,67 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply bignum by 10 and add word: z := 10 * z + d -// Inputs z[k], d; outputs function return (carry) and z[k] -// -// extern uint64_t bignum_muladd10(uint64_t k, uint64_t *z, uint64_t d); -// -// Although typically the input d < 10, this is not actually required. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = d, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_muladd10) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_muladd10) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_muladd10) - .text - .balign 4 - -#define k x0 -#define z x1 -#define d x2 - -#define i x3 -#define h x4 - -#define a x5 -#define l x5 - -S2N_BN_SYMBOL(bignum_muladd10): - CFI_START - -// If k = 0 just return the input d as the carry (out of zero digits) - - cbz k, Lbignum_muladd10_end - -// Simple loop - - mov i, xzr -Lbignum_muladd10_loop: - ldr a, [z, i, lsl #3] - lsr h, a, #61 - add l, a, a - add h, h, h, lsr #2 - adds l, l, l, lsl #2 - adc h, h, xzr - adds a, l, d - str a, [z, i, lsl #3] - adc d, h, xzr - add i, i, 1 - cmp i, k - bcc Lbignum_muladd10_loop - -// Return the final carry - -Lbignum_muladd10_end: - mov x0, d - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_muladd10) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_mux.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_mux.S deleted file mode 100644 index 766640e302c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_mux.S +++ /dev/null @@ -1,55 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiplex/select z := x (if p nonzero) or z := y (if p zero) -// Inputs p, x[k], y[k]; output z[k] -// -// extern void bignum_mux(uint64_t p, uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *y); -// -// It is assumed that all numbers x, y and z have the same size k digits. -// -// Standard ARM ABI: X0 = p, X1 = k, X2 = z, X3 = x, X4 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mux) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mux) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mux) - .text - .balign 4 - -#define b x0 -#define k x1 -#define z x2 -#define x x3 -#define y x4 -#define a x5 - - -S2N_BN_SYMBOL(bignum_mux): - CFI_START - -cbz k, Lbignum_mux_end // if k = 0 skip the Lbignum_mux_loop - cmp b, #0 // Set condition codes b = 0 - -// We've set cc's from b once and for all and can now re-use "b" as a temporary - -Lbignum_mux_loop: - sub k, k, #1 - ldr a, [x, k, lsl #3] - ldr b, [y, k, lsl #3] - csel a, a, b, ne - str a, [z, k, lsl #3] - cbnz k, Lbignum_mux_loop - -Lbignum_mux_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mux) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_mux16.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_mux16.S deleted file mode 100644 index b9ca9ceeb89..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_mux16.S +++ /dev/null @@ -1,72 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Select element from 16-element table, z := xs[k*i] -// Inputs xs[16*k], i; output z[k] -// -// extern void bignum_mux16(uint64_t k, uint64_t *z, const uint64_t *xs, -// uint64_t i); -// -// It is assumed that all numbers xs[16] and the target z have the same size k -// The pointer xs is to a contiguous array of size 16, elements size-k bignums -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = xs, X3 = i -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mux16) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mux16) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mux16) - .text - .balign 4 - -#define k x0 -#define z x1 -#define x x2 -#define i x3 - -#define a x4 -#define b x5 -#define j x6 -#define n x7 - - -S2N_BN_SYMBOL(bignum_mux16): - CFI_START - -// Copy size into decrementable counter, skip everything if k = 0 - - adds n, k, xzr - beq Lbignum_mux16_end - -// Multiply i by k so we can compare pointer offsets directly with it - - mul i, i, k - -Lbignum_mux16_loop: - - ldr a, [x] - mov j, k - .rep 15 - ldr b, [x, j, lsl #3] - cmp j, i - csel a, b, a, eq - add j, j, k - .endr - str a, [z] - - add z, z, #8 - add x, x, #8 - subs n, n, #1 - bne Lbignum_mux16_loop - -Lbignum_mux16_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mux16) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_negmodinv.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_negmodinv.S deleted file mode 100644 index 22a4e5e55ef..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_negmodinv.S +++ /dev/null @@ -1,139 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Negated modular inverse, z := (-1/x) mod 2^{64k} -// Input x[k]; output z[k] -// -// extern void bignum_negmodinv(uint64_t k, uint64_t *z, const uint64_t *x); -// -// Assuming x is odd (otherwise nothing makes sense) the result satisfies -// -// x * z + 1 == 0 (mod 2^{64 * k}) -// -// but is not necessarily reduced mod x. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_negmodinv) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_negmodinv) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_negmodinv) - .text - .balign 4 - -#define k x0 -#define z x1 -#define x x2 - -#define w x3 -#define a x4 -#define m x5 -#define h x6 -#define l x7 -#define e x8 -#define i x9 - - - -S2N_BN_SYMBOL(bignum_negmodinv): - CFI_START - -// If k = 0 do nothing - - cbz k, Lbignum_negmodinv_end - -// Compute word-level negated modular inverse w for x[0]. - - ldr a, [x] - lsl w, a, #2 - sub w, a, w - eor w, w, #2 - mov h, #1 - madd h, a, w, h - mul l, h, h - madd w, h, w, w - mul h, l, l - madd w, l, w, w - mul l, h, h - madd w, h, w, w - madd w, l, w, w - -// Write that as lowest word of the output, then if k = 1 we're finished - - str w, [z] - cmp k, #1 - beq Lbignum_negmodinv_end - -// Otherwise compute and write the other digits (1..k-1) of w * x + 1. -// Note that at this point CF was set by the comparison (subtraction) "k - 1". -// Since k >= 2 if we got here, this subtraction didn't carry; allowing -// for the inverted carry on ARM that means that CF is guaranteed to be set. -// This allows us to ignore the nominal "a * w + 1" from adding the low -// part of the product, since its only contribution is to set the carry -// flag. Thus, we only calculate the high part of a * w explicitly. - - umulh h, a, w - mov i, #1 -Lbignum_negmodinv_initloop: - ldr a, [x, i, lsl #3] - mul l, a, w - adcs l, l, h - umulh h, a, w - str l, [z, i, lsl #3] - add i, i, #1 - sub a, k, i - cbnz a, Lbignum_negmodinv_initloop - -// For simpler indexing, z := z + 8 and k := k - 1 per outer iteration -// Then we can use the same index for x and for z and effective size k. -// -// But we also offset k by 1 so the "real" size is k + 1, which is why the -// test at the end of the inner loop is i < k <=> i' = i + 1 < k + 1. -// This lets us avoid some special cases inside the loop at the cost -// of needing the additional "finale" tail for the final iteration -// since we do one outer loop iteration too few. - - subs k, k, #2 - beq Lbignum_negmodinv_finale - -Lbignum_negmodinv_outerloop: - add z, z, #8 - ldr e, [z] - mul m, e, w - str m, [z] - ldr a, [x] - umulh h, a, m - subs xzr, e, #1 // Effective carry from a * m + e - mov i, #1 -Lbignum_negmodinv_innerloop: - ldr a, [x, i, lsl #3] - ldr e, [z, i, lsl #3] - mul l, a, m - adcs e, e, h - umulh h, a, m - adc h, h, xzr - adds e, e, l - str e, [z, i, lsl #3] - sub a, i, k - add i, i, #1 - cbnz a, Lbignum_negmodinv_innerloop - - subs k, k, #1 - bne Lbignum_negmodinv_outerloop - -Lbignum_negmodinv_finale: - ldr e, [z, #8] - mul m, e, w - str m, [z, #8] - -Lbignum_negmodinv_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_negmodinv) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_nonzero.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_nonzero.S deleted file mode 100644 index dfb06943d0b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_nonzero.S +++ /dev/null @@ -1,49 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Test bignum for nonzero-ness x =/= 0 -// Input x[k]; output function return -// -// extern uint64_t bignum_nonzero(uint64_t k, const uint64_t *x); -// -// Standard ARM ABI: X0 = k, X1 = x, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_nonzero) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_nonzero) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_nonzero) - .text - .balign 4 - -#define k x0 -#define x x1 -#define a x2 -#define c x3 - - -S2N_BN_SYMBOL(bignum_nonzero): - CFI_START - -mov c, xzr // c will be or of the digits - cbz k, Lbignum_nonzero_end // if k = 0 skip the Lbignum_nonzero_loop - -Lbignum_nonzero_loop: - sub k, k, #1 - ldr a, [x, k, lsl #3] - orr c, c, a - cbnz k, Lbignum_nonzero_loop - - cmp c, xzr - cset x0, ne - -Lbignum_nonzero_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_nonzero) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_normalize.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_normalize.S deleted file mode 100644 index bdf03eb8573..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_normalize.S +++ /dev/null @@ -1,113 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Normalize bignum in-place by shifting left till top bit is 1 -// Input z[k]; outputs function return (bits shifted left) and z[k] -// -// extern uint64_t bignum_normalize(uint64_t k, uint64_t *z); -// -// Given a k-digit bignum z, this function shifts it left by its number of -// leading zero bits, to give result with top bit 1, unless the input number -// was 0. The return is the same as the output of bignum_clz, i.e. the number -// of bits shifted (nominally 64 * k in the case of zero input). -// -// Standard ARM ABI: X0 = k, X1 = z, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_normalize) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_normalize) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_normalize) - .text - .balign 4 - -#define k x0 -#define z x1 - -// This is the return value we accumulate - -#define r x2 - -// Other variables - -#define a x3 -#define b x4 -#define c x5 -#define d x6 -#define i x7 -#define j x8 -#define l x9 - - -S2N_BN_SYMBOL(bignum_normalize): - CFI_START - -// If k = 0 the whole operation is trivial. Otherwise initialize -// shift count r and top digit c, but then if k = 1 skip the digitwise part - - subs i, k, #1 - bcc Lbignum_normalize_end - ldr c, [z, i, lsl #3] - mov r, xzr - beq Lbignum_normalize_bitpart - -// Do a rather stupid but constant-time digit normalization, conditionally -// shifting left (k-1) times based on whether the top word is zero. -// With careful binary striding this could be O(k*log(k)) instead of O(k^2) -// while still retaining the constant-time style. - -Lbignum_normalize_normloop: - mov j, xzr - cmp c, xzr - cinc r, r, eq - mov a, xzr -Lbignum_normalize_shufloop: - mov c, a - ldr a, [z, j, lsl #3] - csel c, c, a, eq - str c, [z, j, lsl #3] - add j, j, #1 - sub d, j, k - cbnz d, Lbignum_normalize_shufloop - subs i, i, #1 - bne Lbignum_normalize_normloop - -// We now have the top digit nonzero, assuming the input was nonzero, -// and as per the invariant of the loop above, c holds that digit. So -// now just count c's leading zeros and shift z bitwise that many bits. - -Lbignum_normalize_bitpart: - lsl r, r, #6 - clz c, c - add r, r, c - - mov b, xzr - mov i, xzr - ands xzr, c, #63 - csetm l, ne - neg d, c -Lbignum_normalize_bitloop: - ldr j, [z, i, lsl #3] - lsl a, j, c - orr a, a, b - lsr b, j, d - and b, b, l - str a, [z, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_normalize_bitloop - -// Return the final shift count - - mov x0, r - -Lbignum_normalize_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_normalize) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_odd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_odd.S deleted file mode 100644 index 6a868e07bd5..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_odd.S +++ /dev/null @@ -1,35 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Test bignum for odd-ness -// Input x[k]; output function return -// -// extern uint64_t bignum_odd(uint64_t k, const uint64_t *x); -// -// Standard ARM ABI: X0 = k, X1 = x, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_odd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_odd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_odd) - .text - .balign 4 - -S2N_BN_SYMBOL(bignum_odd): - CFI_START - -cbz x0, Lbignum_odd_end // if k = 0, that's the return! - ldr x0, [x1] - and x0, x0, #1 - -Lbignum_odd_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_odd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_of_word.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_of_word.S deleted file mode 100644 index e5de523a6a0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_of_word.S +++ /dev/null @@ -1,50 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert single digit to bignum, z := n -// Input n; output z[k] -// -// extern void bignum_of_word(uint64_t k, uint64_t *z, uint64_t n); -// -// Create a k-digit (digit=64 bits) bignum at z with value n (mod 2^k) -// where n is a word. The "mod 2^k" only matters in the degenerate k = 0 case. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = n -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_of_word) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_of_word) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_of_word) - .text - .balign 4 - -#define k x0 -#define z x1 -#define n x2 - - -S2N_BN_SYMBOL(bignum_of_word): - CFI_START - -cbz k, Lbignum_of_word_end // if k = 0 do nothing - - str n, [z] // Set zeroth word to n - subs k, k, #1 // k := k - 1 - beq Lbignum_of_word_end // and if that's 0, finish - -Lbignum_of_word_loop: - str xzr, [z, k, lsl #3] - subs k, k, #1 - bne Lbignum_of_word_loop - -Lbignum_of_word_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_of_word) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_optadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_optadd.S deleted file mode 100644 index 463706064ad..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_optadd.S +++ /dev/null @@ -1,76 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally add, z := x + y (if p nonzero) or z := x (if p zero) -// Inputs x[k], p, y[k]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_optadd(uint64_t k, uint64_t *z, const uint64_t *x, -// uint64_t p, const uint64_t *y); -// -// It is assumed that all numbers x, y and z have the same size k digits. -// Returns carry-out as per usual addition, always 0 if p was zero. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = x, X3 = p, X4 = y, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optadd) - .text - .balign 4 - -#define k x0 -#define z x1 -#define x x2 -#define p x3 -#define y x4 - -#define m x3 -#define a x5 -#define b x6 -#define i x7 - - -S2N_BN_SYMBOL(bignum_optadd): - CFI_START - -// if k = 0 do nothing. This is also the right top carry in X0 - - cbz k, Lbignum_optadd_end - -// Convert p into a strict bitmask (same register in fact) - - cmp p, xzr - csetm m, ne - -// Set i = 0 *and* make sure initial CF = 0 - - adds i, xzr, xzr - -// Main loop - -Lbignum_optadd_loop: - ldr a, [x, i] - ldr b, [y, i] - and b, b, m - adcs a, a, b - str a, [z, i] - add i, i, #8 - sub k, k, #1 - cbnz k, Lbignum_optadd_loop - -// Return carry flag - - adc x0, xzr, xzr - -Lbignum_optadd_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_optneg.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_optneg.S deleted file mode 100644 index 06673661dc2..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_optneg.S +++ /dev/null @@ -1,75 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate, z := -x (if p nonzero) or z := x (if p zero) -// Inputs p, x[k]; outputs function return (nonzero input) and z[k] -// -// extern uint64_t bignum_optneg(uint64_t k, uint64_t *z, uint64_t p, -// const uint64_t *x); -// -// It is assumed that both numbers x and z have the same size k digits. -// Returns a carry, which is equivalent to "x is nonzero". -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = p, X3 = x, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg) - .text - .balign 4 - -#define k x0 -#define z x1 -#define p x2 -#define x x3 - -#define a x4 -#define i x5 - - -S2N_BN_SYMBOL(bignum_optneg): - CFI_START - -// if k = 0 do nothing. This also has the right top carry zero in x0 - - cbz k, Lbignum_optneg_end - -// Convert p into a strict bitmask - - cmp p, xzr - csetm p, ne - -// Generate an initial carry-in for the negating case only to add 1; this -// is because we are actually going to do complements of the words of x - - adds xzr, p, p - -// Main loop - mov i, xzr -Lbignum_optneg_loop: - ldr a, [x, i] - eor a, a, p - adcs a, a, xzr - str a, [z, i] - add i, i, #8 - sub k, k, #1 - cbnz k, Lbignum_optneg_loop - -// Return carry flag, fixing up inversion for negative case - - adc x0, xzr, xzr - neg p, p - eor x0, x0, p - -Lbignum_optneg_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_optsubadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_optsubadd.S deleted file mode 100644 index c2b3270f016..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_optsubadd.S +++ /dev/null @@ -1,91 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally subtract or add, z := x + sgn(p) * y interpreting p as signed -// Inputs x[k], p, y[k]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_optsubadd(uint64_t k, uint64_t *z, const uint64_t *x, -// uint64_t p, const uint64_t *y); -// -// If p has top bit set (i.e. is negative as a signed int) return z := x - y -// Else if p is nonzero (i.e. is positive as a signed int) return z := x + y -// Otherwise (i.e. p is zero) return z := x -// -// Return in X0 = the top carry, which will be 0 or 1, and appropriate for -// addition or subtraction respectively (and always zero for p = 0) -// -// 2^{64*k} * -carryout + z = x - y [for subtraction] -// 2^{64*k} * carryout + z = x + y [for addition] -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = x, X3 = p, X4 = y, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optsubadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optsubadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optsubadd) - .text - .balign 4 - -#define k x0 -#define z x1 -#define x x2 -#define p x3 -#define y x4 - -#define m x3 -#define q x5 -#define a x6 -#define b x7 -#define i x8 - - -S2N_BN_SYMBOL(bignum_optsubadd): - CFI_START - -// if k = 0 do nothing. This is also the right top carry in X0 - - cbz k, Lbignum_optsubadd_end - -// Turn the input p into two bitmasks, m indicating to use the y input at -// all (same register as p) and q indicating a sign-flip - - cmp p, xzr - csetm m, ne - csetm q, mi - -// Generate an initial carry-in for the negating case only to add 1; this -// is because we are actually going to do complements of the words of y - - adds xzr, q, q - -// Main loop - - mov i, xzr -Lbignum_optsubadd_loop: - ldr b, [y, i] - eor b, b, q - ldr a, [x, i] - and b, b, m - adcs a, a, b - str a, [z, i] - add i, i, #8 - sub k, k, #1 - cbnz k, Lbignum_optsubadd_loop - -// Return carry flag, fixing up inversion for negative case - - adc x0, xzr, xzr - neg q, q - eor x0, x0, q - -Lbignum_optsubadd_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optsubadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_pow2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_pow2.S deleted file mode 100644 index 383146003b0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_pow2.S +++ /dev/null @@ -1,65 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Return bignum of power of 2, z := 2^n -// Input n; output z[k] -// -// extern void bignum_pow2(uint64_t k, uint64_t *z, uint64_t n); -// -// The result is as usual mod 2^{64*k}, so will be zero if n >= 64*k. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = n -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_pow2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_pow2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_pow2) - .text - .balign 4 - -#define k x0 -#define z x1 -#define n x2 - -#define w x3 -#define i x4 -#define a x5 - - -S2N_BN_SYMBOL(bignum_pow2): - CFI_START - -// If k = 0 the result is trivially zero - - cbz k, Lbignum_pow2_end - -// Create the index n at which to write the nonzero word and the word w itself -// Note that the ARM manual explicitly says that shift counts are taken modulo -// the datasize, so we don't need to mask the lower 6 bits of n ourselves. - - mov w, #1 - lsl w, w, n - lsr n, n, #6 - -// Now in a constant-time fashion set the n'th word to w and others to zero - - mov i, xzr -Lbignum_pow2_loop: - cmp i, n - csel a, w, xzr, eq - str a, [z, i, lsl #3] - add i, i, #1 - cmp i, k - bcc Lbignum_pow2_loop - -Lbignum_pow2_end: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_pow2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_shl_small.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_shl_small.S deleted file mode 100644 index e7089c922b5..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_shl_small.S +++ /dev/null @@ -1,104 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Shift bignum left by c < 64 bits z := x * 2^c -// Inputs x[n], c; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_shl_small(uint64_t k, uint64_t *z, uint64_t n, -// const uint64_t *x, uint64_t c); -// -// Does the "z := x << c" operation where x is n digits, result z is p. -// The shift count c is masked to 6 bits so it actually uses c' = c mod 64. -// The return value is the "next word" of a p+1 bit result, if n <= p. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = n, X3 = x, X4 = c, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_shl_small) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_shl_small) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_shl_small) - .text - .balign 4 - -#define p x0 -#define z x1 -#define n x2 -#define x x3 -#define c x4 - -#define d x5 -#define a x6 -#define b x7 -#define m x8 -#define t x9 -#define i x10 - - -S2N_BN_SYMBOL(bignum_shl_small): - CFI_START - -// First clamp the input size n := min(p,n) since we can never need to read -// past the p'th term of the input to generate p-digit output. - - cmp n, p - csel n, p, n, cs - -// Initialize counter i and "previous word" carry b to zero -// and skip main loop if n = 0 - - mov b, xzr - mov i, xzr - cbz n, Lbignum_shl_small_tail - -// Set up a mask for nonzero shift and a negated version of the shift. -// Note that all basic word-level shifts are predictably masked to 6 bits. - - ands xzr, c, #63 - csetm m, ne - neg d, c - -// Now the main loop -Lbignum_shl_small_loop: - ldr t, [x, i, lsl #3] - lsl a, t, c - orr a, a, b - lsr b, t, d - and b, b, m - str a, [z, i, lsl #3] - add i, i, #1 - cmp i, n - bcc Lbignum_shl_small_loop - -// If we are at the end, finish, otherwise write carry word then zeros - -Lbignum_shl_small_tail: - - cmp i, p - bcs Lbignum_shl_small_end - str b, [z, i, lsl #3] - mov b, xzr - add i, i, #1 - cmp i, p - bcs Lbignum_shl_small_end - -Lbignum_shl_small_tloop: - str xzr, [z, i, lsl #3] - add i, i, #1 - cmp i, p - bcc Lbignum_shl_small_tloop - -// Return top word - -Lbignum_shl_small_end: - - mov x0, b - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_shl_small) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_shr_small.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_shr_small.S deleted file mode 100644 index 73da04cec3f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_shr_small.S +++ /dev/null @@ -1,95 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Shift bignum right by c < 64 bits z := floor(x / 2^c) -// Inputs x[n], c; outputs function return (bits shifted out) and z[k] -// -// extern uint64_t bignum_shr_small(uint64_t k, uint64_t *z, uint64_t n, -// const uint64_t *x, uint64_t c); -// -// Does the "z := x >> c" operation where x is n digits, result z is p. -// The shift count c is masked to 6 bits so it actually uses c' = c mod 64. -// The return value is the inout mod 2^c'. -// -// Standard ARM ABI: X0 = k, X1 = z, X2 = n, X3 = x, X4 = c, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_shr_small) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_shr_small) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_shr_small) - .text - .balign 4 - -#define p x0 -#define z x1 -#define n x2 -#define x x3 -#define c x4 - -#define d x5 -#define a x6 -#define b x7 -#define m x8 -#define t x9 - - -S2N_BN_SYMBOL(bignum_shr_small): - CFI_START - -// Set default carry-in word to 0 - - mov b, xzr - -// First, if p > n then pad output on the left with p-n zeros - - cmp n, p - bcs Lbignum_shr_small_nopad -Lbignum_shr_small_padloop: - sub p, p, #1 - str xzr, [z, p, lsl #3] - cmp n, p - bcc Lbignum_shr_small_padloop - -// We now know that p <= n. If in fact p < n let carry word = x[p] instead of 0 - -Lbignum_shr_small_nopad: - beq Lbignum_shr_small_shiftstart - ldr b, [x, p, lsl #3] -Lbignum_shr_small_shiftstart: - -// Set up negated version of the shift and shift b in preparation. -// Use a mask for nonzero shift to fake 64-bit left shift in zero case - - neg d, c - lsl b, b, d - ands xzr, c, #63 - csetm m, ne - and b, b, m - -// Now the main loop - - cbz p, Lbignum_shr_small_end -Lbignum_shr_small_loop: - sub p, p, #1 - ldr t, [x, p, lsl #3] - lsr a, t, c - orr a, a, b - lsl b, t, d - and b, b, m - str a, [z, p, lsl #3] - cbnz p, Lbignum_shr_small_loop - -// Return top word, shifted back to be a modulus - -Lbignum_shr_small_end: - lsr x0, b, d - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_shr_small) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_sub.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_sub.S deleted file mode 100644 index b3ed1eb3ecf..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/bignum_sub.S +++ /dev/null @@ -1,122 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Subtract, z := x - y -// Inputs x[m], y[n]; outputs function return (carry-out) and z[p] -// -// extern uint64_t bignum_sub(uint64_t p, uint64_t *z, uint64_t m, -// const uint64_t *x, uint64_t n, const uint64_t *y); -// -// Does the z := x - y operation, truncating modulo p words in general and -// returning a top borrow (0 or 1) in the p'th place, only subtracting input -// words below p (as well as m and n respectively) to get the diff and borrow. -// -// Standard ARM ABI: X0 = p, X1 = z, X2 = m, X3 = x, X4 = n, X5 = y, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sub) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sub) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sub) - .text - .balign 4 - -#define p x0 -#define z x1 -#define m x2 -#define x x3 -#define n x4 -#define y x5 -#define i x6 -#define a x7 -#define d x8 - - -S2N_BN_SYMBOL(bignum_sub): - CFI_START - -// First clamp the two input sizes m := min(p,m) and n := min(p,n) since -// we'll never need words past the p'th. Can now assume m <= p and n <= p. -// Then compare the modified m and n and branch accordingly - - cmp m, p - csel m, p, m, cs - cmp n, p - csel n, p, n, cs - cmp m, n - bcc Lbignum_sub_ylonger - -// The case where x is longer or of the same size (p >= m >= n) - - sub p, p, m - sub m, m, n - subs i, xzr, xzr - cbz n, Lbignum_sub_xmainskip -Lbignum_sub_xmainloop: - ldr a, [x, i, lsl #3] - ldr d, [y, i, lsl #3] - sbcs a, a, d - str a, [z, i, lsl #3] - add i, i, #1 - sub n, n, #1 - cbnz n, Lbignum_sub_xmainloop -Lbignum_sub_xmainskip: - cbz m, Lbignum_sub_xtopskip -Lbignum_sub_xtoploop: - ldr a, [x, i, lsl #3] - sbcs a, a, xzr - str a, [z, i, lsl #3] - add i, i, #1 - sub m, m, #1 - cbnz m, Lbignum_sub_xtoploop -Lbignum_sub_xtopskip: - cbnz p, Lbignum_sub_tails - cset x0, cc - ret - -// The case where y is longer (p >= n > m) - -Lbignum_sub_ylonger: - sub p, p, n - sub n, n, m - subs i, xzr, xzr - cbz m, Lbignum_sub_ytoploop -Lbignum_sub_ymainloop: - ldr a, [x, i, lsl #3] - ldr d, [y, i, lsl #3] - sbcs a, a, d - str a, [z, i, lsl #3] - add i, i, #1 - sub m, m, #1 - cbnz m, Lbignum_sub_ymainloop -Lbignum_sub_ytoploop: - ldr a, [y, i, lsl #3] - sbcs a, xzr, a - str a, [z, i, lsl #3] - add i, i, #1 - sub n, n, #1 - cbnz n, Lbignum_sub_ytoploop -Lbignum_sub_ytopskip: - cbnz p, Lbignum_sub_tails - cset x0, cc - ret - -// Adding a non-trivial tail, when p > max(m,n) - -Lbignum_sub_tails: - csetm a, cc -Lbignum_sub_tailloop: - str a, [z, i, lsl #3] - add i, i, #1 - subs p, p, #1 - bne Lbignum_sub_tailloop - neg x0, a - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sub) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_bytereverse.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_bytereverse.S deleted file mode 100644 index d135832d6eb..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_bytereverse.S +++ /dev/null @@ -1,44 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reverse the order of bytes in a 64-bit word -// -// extern uint64_t word_bytereverse(uint64_t a); -// -// Standard ARM ABI: X0 = a, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_bytereverse) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_bytereverse) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_bytereverse) - .text - .balign 4 - -S2N_BN_SYMBOL(word_bytereverse): - CFI_START - - mov x1, #0xFFFF0000FFFF0000 - mov x2, #0x0000FFFF0000FFFF - and x1, x1, x0 - and x2, x2, x0 - ror x1, x1, #32 - orr x0, x1, x2 - - mov x1, #0xFF00FF00FF00FF00 - mov x2, #0x00FF00FF00FF00FF - and x1, x1, x0 - and x2, x2, x0 - ror x1, x1, #24 - ror x2, x2, #8 - orr x0, x1, x2 - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_bytereverse) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_clz.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_clz.S deleted file mode 100644 index 06951cb2e47..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_clz.S +++ /dev/null @@ -1,30 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count leading zero bits in a single word -// Input a; output function return -// -// extern uint64_t word_clz(uint64_t a); -// -// Standard ARM ABI: X0 = a, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_clz) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_clz) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_clz) - .text - .balign 4 - -S2N_BN_SYMBOL(word_clz): - CFI_START - clz x0, x0 - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_clz) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_ctz.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_ctz.S deleted file mode 100644 index c21bab4f270..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_ctz.S +++ /dev/null @@ -1,42 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count trailing zero bits in a single word -// Input a; output function return -// -// extern uint64_t word_ctz(uint64_t a); -// -// Standard ARM ABI: X0 = a, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_ctz) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_ctz) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_ctz) - .text - .balign 4 - -S2N_BN_SYMBOL(word_ctz): - CFI_START - -// ARM doesn't have a direct word ctz instruction, so we emulate it via -// ctz(w) = 64 - clz(~w & (w-1)). This is depending, for cases of the form -// ctz(....1), on the behavior clz(0) = 64, which is guaranteed according -// to the ARM manual. - - mvn x1, x0 - sub x0, x0, #1 - and x0, x0, x1 - clz x1, x0 - mov x0, #64 - sub x0, x0, x1 - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_ctz) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_divstep59.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_divstep59.S deleted file mode 100644 index c08eb088bb2..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_divstep59.S +++ /dev/null @@ -1,328 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Perform 59 "divstep" iterations and return signed matrix of updates -// Inputs d, f, g; output m[2][2] and function return (updated d) -// -// extern int64_t word_divstep59 -// (int64_t m[2][2],int64_t d,uint64_t f,uint64_t g); -// -// Standard ARM ABI: X0 = m, X1 = d, X2 = f, X3 = g, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_divstep59) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_divstep59) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_divstep59) - .text - .balign 4 - -#define m x0 -#define d x1 -#define f x2 -#define g x3 - -#define fuv x4 -#define grs x5 -#define t x6 -#define n x7 - -#define m00 x8 -#define m01 x9 -#define m10 x10 -#define m11 x11 - -#define n00 x12 -#define n01 x13 -#define n10 x14 -#define n11 x15 - -S2N_BN_SYMBOL(word_divstep59): - CFI_START - -// Pack f and g into single registers with (negated) update matrices, -// initially the identity matrix. The f_lo and g_lo are initially -// the 20 lowest bits of f and g. -// -// fuv = f_lo - 2^41 * 1 - 2^62 * 0 -// grs = g_lo - 2^41 * 0 - 2^62 * 1 - - and fuv, f, #0xFFFFF - orr fuv, fuv, 0xFFFFFE0000000000 - - and grs, g, #0xFFFFF - orr grs, grs, 0xc000000000000000 - - tst grs, #1 - -// Now do 20 divsteps on that packed format. -// -// At the i'th iteration (starting at i = 0, ending at i = 20) -// the intermediate packed values are of the form -// -// fuv = f_lo - 2^{41-i} * m00 - 2^{62-i} * m01 -// grs = g_lo - 2^{41-i} * m10 - 2^{62-i} * m11 -// -// where the following matrix indicates the updates to apply -// to the original (full-sized) f and g for those iterations. -// -// [m00 m01] * [f_0] = [f_i] -// [m10 m11] [g_0] [g_i] - -.set i, 0 -.rep 20 - - csel t, fuv, xzr, ne - ccmp d, xzr, #8, ne - - cneg d, d, ge - cneg t, t, ge - csel fuv, grs, fuv, ge - - add grs, grs, t - add d, d, #2 - -.if (i< 19) - tst grs, #2 -.endif - asr grs, grs, #1 - -.set i, (i+1) -.endr - -// Extract the matrix entries, but keep them in negated form. - - add m00, fuv, #1048576 - sbfx m00, m00, #21, #21 - - mov m11, #1048576 - add m11, m11, m11, lsl #21 - add m01, fuv, m11 - asr m01, m01, #42 - - add m10, grs, #1048576 - sbfx m10, m10, #21, #21 - - add m11, grs, m11 - asr m11, m11, #42 - -// Compute updated f and g using the negated matrix entries; -// this flips the signs of f and g but it doesn't matter. -// -// f = (m00 * f + m01 * g) / 2^20 -// g = (m10 * f + m11 * g) / 2^20 -// -// Since we only need another 40 bits, we can do all of that -// computation naively using (implicitly signed) 64-bit words. - - mul t, m00, f - mul n, m01, g - mul f, m10, f - mul g, m11, g - - add fuv, t, n - add grs, f, g - - asr f, fuv, #20 - asr g, grs, #20 - -// Re-pack for 20 more rounds - - and fuv, f, #0xFFFFF - orr fuv, fuv, 0xFFFFFE0000000000 - - and grs, g, #0xFFFFF - orr grs, grs, 0xc000000000000000 - - tst grs, #1 - -// Second block of 20 divsteps in the same style - -.set i, 0 -.rep 20 - - csel t, fuv, xzr, ne - ccmp d, xzr, #8, ne - - cneg d, d, ge - cneg t, t, ge - csel fuv, grs, fuv, ge - - add grs, grs, t - add d, d, #2 - -.if (i< 19) - tst grs, #2 -.endif - asr grs, grs, #1 - -.set i, (i+1) -.endr - -// Extract the next matrix entries, in negated form again - - add n00, fuv, #1048576 - sbfx n00, n00, #21, #21 - - mov n11, #1048576 - add n11, n11, n11, lsl #21 - add n01, fuv, n11 - asr n01, n01, #42 - - add n10, grs, #1048576 - sbfx n10, n10, #21, #21 - - add n11, grs, n11 - asr n11, n11, #42 - -// Compute updated f and g using the negated matrix entries, -// and so again flipping (thus actually restoring) the signs. -// -// f = (n00 * f + n01 * g) / 2^20 -// g = (n10 * f + n11 * g) / 2^20 - - mul t, n00, f - mul n, n01, g - mul f, n10, f - mul g, n11, g - - add fuv, t, n - add grs, f, g - - asr f, fuv, #20 - asr g, grs, #20 - -// Re-pack for 19 more rounds - - and fuv, f, #0xFFFFF - orr fuv, fuv, 0xFFFFFE0000000000 - - and grs, g, #0xFFFFF - orr grs, grs, 0xc000000000000000 - - tst grs, #1 - -// Split the last divsteps into two blocks of 10 and 9 to insert the matrix -// multiplication in between them. The first ten iterations: - -.set i, 0 -.rep 10 - - csel t, fuv, xzr, ne - ccmp d, xzr, #8, ne - - cneg d, d, ge - cneg t, t, ge - csel fuv, grs, fuv, ge - - add grs, grs, t - add d, d, #2 - - tst grs, #2 - asr grs, grs, #1 - -.set i, (i+1) -.endr - -// Multiply the first two matrices. -// -// [m00 m01] = [n00 n01] * [m00 m01] -// [m10 m11] [n10 n11] [m10 m11] -// -// The resulting matrix entries are: -// -// m00' = n00 * m00 + n01 * m10 -// m01' = n00 * m01 + n01 * m11 -// m10' = n10 * m00 + n11 * m10 -// m11' = n10 * m01 + n11 * m11 - - mul f, n00, m00 - mul g, n00, m01 - mul t, n10, m00 - mul n, n10, m01 - - madd m00, n01, m10, f - madd m01, n01, m11, g - madd m10, n11, m10, t - madd m11, n11, m11, n - -// Now the final 9 divsteps - -.rep 9 - - csel t, fuv, xzr, ne - ccmp d, xzr, #8, ne - - cneg d, d, ge - cneg t, t, ge - csel fuv, grs, fuv, ge - - add grs, grs, t - add d, d, #2 - -.if (i< 18) - tst grs, #2 -.endif - asr grs, grs, #1 - -.set i, (i+1) -.endr - -// Extract the matrix entries from the final 19 divsteps - - add n00, fuv, #1048576 - sbfx n00, n00, #22, #21 - - mov n11, #1048576 - add n11, n11, n11, lsl #21 - add n01, fuv, n11 - asr n01, n01, #43 - - add n10, grs, #1048576 - sbfx n10, n10, #22, #21 - - add n11, grs, n11 - asr n11, n11, #43 - -// Multiply by this new matrix -// -// [m00 m01] = [n00 n01] * [m00 m01] -// [m10 m11] [n10 n11] [m10 m11] -// -// The resulting matrix entries are: -// -// m00' = n00 * m00 + n01 * m10 -// m01' = n00 * m01 + n01 * m11 -// m10' = n10 * m00 + n11 * m10 -// m11' = n10 * m01 + n11 * m11 -// -// Since we didn't negate the n matrix, all products are negated -// here using "mneg" and "msub" in place of "mul" and "madd", so -// we have the correct sign for the returned composite matrix. - - mneg f, n00, m00 - mneg g, n00, m01 - mneg fuv, n10, m00 - mneg grs, n10, m01 - - msub m00, n01, m10, f - msub m01, n01, m11, g - msub m10, n11, m10, fuv - msub m11, n11, m11, grs - -// Finally store back and return final d. - - stp m00, m01, [m] - stp m10, m11, [m, #16] - - mov x0, d - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_divstep59) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_max.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_max.S deleted file mode 100644 index e09d32c9925..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_max.S +++ /dev/null @@ -1,35 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Return maximum of two unsigned 64-bit words -// Inputs a, b; output function return -// -// extern uint64_t word_max(uint64_t a, uint64_t b); -// -// Standard ARM ABI: X0 = a, X1 = b, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_max) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_max) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_max) - .text - .balign 4 - -#define a x0 -#define b x1 - -S2N_BN_SYMBOL(word_max): - CFI_START - - cmp a, b - csel x0, a, b, cs - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_max) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_min.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_min.S deleted file mode 100644 index 70d3e806e15..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_min.S +++ /dev/null @@ -1,35 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Return minimum of two unsigned 64-bit words -// Inputs a, b; output function return -// -// extern uint64_t word_min(uint64_t a, uint64_t b); -// -// Standard ARM ABI: X0 = a, X1 = b, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_min) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_min) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_min) - .text - .balign 4 - -#define a x0 -#define b x1 - -S2N_BN_SYMBOL(word_min): - CFI_START - - cmp a, b - csel x0, a, b, cc - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_min) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_negmodinv.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_negmodinv.S deleted file mode 100644 index 0c8e30b3ed3..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_negmodinv.S +++ /dev/null @@ -1,83 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Single-word negated modular inverse (-1/a) mod 2^64 -// Input a; output function return -// -// extern uint64_t word_negmodinv(uint64_t a); -// -// A 64-bit function that returns a negated multiplicative inverse mod 2^64 -// of its input, assuming that input is odd. Given odd input a, the result z -// will satisfy a * z + 1 == 0 (mod 2^64), i.e. a 64-bit word multiplication -// a * z will give -1. -// -// Standard ARM ABI: X0 = a, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_negmodinv) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_negmodinv) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_negmodinv) - .text - .balign 4 - -// Use some more intuitive variable names but these in general are aliased -// to each other so need care when interpreting. Overall we only use the -// registers x0, x1 and x2. -// -// There does seem a slight efficiency advantage in putting e' = e^2 -// before the x' = x (1 + e) each time. That's the only reason for not -// reversing those and hence being able to alias all the e values to the -// same register. - -#define a x0 -#define x x1 -#define one x2 - -#define e1 x2 -#define e2 x0 -#define e4 x2 -#define e8 x0 - -S2N_BN_SYMBOL(word_negmodinv): - CFI_START - -// Initial magical 5-bit approximation x = (a - a<<2) xor 2 - - lsl x, a, #2 - sub x, a, x - eor x, x, #2 - -// Get error e = a * x + 1 for subsequent correction steps - - mov one, #1 - madd e1, a, x, one - -// e2 = e^2, x' = x (1 + e) is good to 10 bits - - mul e2, e1, e1 - madd x, e1, x, x - -// e4 = e^4, x' = x (1 + e^2) is good to 20 bits - - mul e4, e2, e2 - madd x, e2, x, x - -// e8 = e^8, x' = x (1 + e^4) is good to 40 bits - - mul e8, e4, e4 - madd x, e4, x, x - -// Final x' = x (1 + e^8) is good to the 64-bit word size - - madd x0, e8, x, x - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_negmodinv) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_popcount.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_popcount.S deleted file mode 100644 index e7a507f13c6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_popcount.S +++ /dev/null @@ -1,46 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count number of set bits in a single 64-bit word (population count) -// Input a; output function return -// -// extern uint64_t word_popcount(uint64_t a); -// -// Standard ARM ABI: X0 = a, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_popcount) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_popcount) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_popcount) - .text - .balign 4 - -// Very similar to the traditional algorithm, e.g. Hacker's Delight 5-2 - -S2N_BN_SYMBOL(word_popcount): - CFI_START - - and x1, x0, #0xAAAAAAAAAAAAAAAA - sub x0, x0, x1, lsr #1 - - bic x1, x0, #0x3333333333333333 - and x0, x0, #0x3333333333333333 - add x0, x0, x1, lsr #2 - - add x0, x0, x0, lsr #4 - and x0, x0, #0x0F0F0F0F0F0F0F0F - - mov x1, #0x101010101010101 - mul x0, x0, x1 - lsr x0, x0, #56 - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_popcount) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_recip.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_recip.S deleted file mode 100644 index 94401fd8533..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/generic/word_recip.S +++ /dev/null @@ -1,124 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Single-word reciprocal, underestimate of floor(2^128 / a) - 2^64 -// Input a; output function return -// -// extern uint64_t word_recip(uint64_t a); -// -// Given an input word "a" with its top bit set (i.e. 2^63 <= a < 2^64), the -// result "x" is implicitly augmented with a leading 1 giving x' = 2^64 + x. -// The result is x' = ceil(2^128 / a) - 1, which except for the single -// special case a = 2^63 is the same thing as x' = floor(2^128 / a). -// -// Standard ARM ABI: X0 = a, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_recip) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_recip) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_recip) - .text - .balign 4 - -#define a x0 -#define x x1 - -// Some of these are aliased for clarity - -#define b x2 - -#define t x3 -#define l x3 - -#define d x4 -#define h x4 - -S2N_BN_SYMBOL(word_recip): - CFI_START - -// Scale the input down: b overestimates a/2^16 with b <= 2^48 and -// x underestimates 2^64/b with b * x =~= 2^64, accurate to ~2 bits. - - lsr b, a, #16 - eor x, b, #0x1FFFFFFFFFFFF - add b, b, #1 - lsr x, x, #32 - -// Suppose x = 2^64/b * (1 - e). and get scaled error d = 2^64 * e - - msub d, b, x, xzr - -// Rescale to give c = 2^15 * e (so c <= 2^13) and compute -// e + e^2 + e^3 + e^4 = (1 + e^2) (e + e^2) -// = (2^30 + c^2) * (2^15 * c + c^2) / 2^60 -// and then x * (1 + e + e^2 + e^3 + e^4) -// = (2^30 * x + x * (2^30 + c^2) * (2^30 * c + c^2) / 2^30) / 2^30 - - lsr t, d, #49 - mul t, t, t - lsr d, d, #34 - add d, t, d - orr t, t, #0x40000000 - mul t, d, t - lsr t, t, #30 - lsl d, x, #30 - madd x, x, t, d - lsr x, x, #30 - -// Now b * x =~= 2^64, accurate to ~10 bits. -// Do a 64-bit Newton step, scaling up x by 16 bits in the process. - - msub d, b, x, xzr - lsr d, d, #24 - mul d, d, x - lsl x, x, #16 - lsr d, d, #24 - add x, x, d - -// Now b * x =~= 2^80, accurate to ~20 bits. -// Do a 64-bit Newton step, scaling up x by 31 bits in the process - - msub d, b, x, xzr - lsr d, d, #32 - mul d, d, x - lsl x, x, #31 - lsr d, d, #17 - add x, x, d - -// Now a * x =~= 2^127, accurate to ~40 bits. Do a Newton step at full size. -// Instead of literally negating the product (h,l) we complement bits in -// the extracted bitfield, which is close enough and a bit faster. -// At the end we also shift x one more bit left, losing the known-1 top bit -// so that a * (2^64 + x) =~= 2^128. - - mul l, a, x - umulh h, a, x - extr l, h, l, #60 - lsr h, x, #33 - mvn l, l - mul l, h, l - lsl x, x, #1 - lsr l, l, #33 - add x, x, l - -// Test if (x' + 1) * a < 2^128 where x' = 2^64 + x, catching the special -// case where x + 1 would wrap, corresponding to input a = 2^63. - - adds t, x, #1 - cinv t, t, eq - umulh h, a, t - adds h, h, a - -// Select either x or x + 1 accordingly as the final answer - - csel x0, x, t, cs - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_recip) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/Makefile b/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/Makefile deleted file mode 100644 index 14106283de0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/Makefile +++ /dev/null @@ -1,39 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - -# If actually on an ARM8 machine, just use the GNU assembler (as). Otherwise -# use a cross-assembling version so that the code can still be assembled -# and the proofs checked against the object files (though you won't be able -# to run code without additional emulation infrastructure). The aarch64 -# cross-assembling version can be installed manually by something like: -# -# sudo apt-get install binutils-aarch64-linux-gnu - -UNAME_RESULT=$(shell uname -p) - -ifeq ($(UNAME_RESULT),aarch64) -GAS=as -else -GAS=aarch64-linux-gnu-as -endif - -# List of object files - -OBJ = mlkem_basemul_k2.o \ - mlkem_basemul_k3.o \ - mlkem_basemul_k4.o \ - mlkem_intt.o \ - mlkem_mulcache_compute.o \ - mlkem_ntt.o \ - mlkem_reduce.o \ - mlkem_tobytes.o \ - mlkem_tomont.o \ - mlkem_rej_uniform_VARIABLE_TIME.o - -%.o : %.S ; $(CC) -E -I../../include $< | $(GAS) -o $@ - - -default: $(OBJ); - -clean:; rm -f *.o *.correct unopt/*.o diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_basemul_k2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_basemul_k2.S deleted file mode 100644 index a4245d7e3fd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_basemul_k2.S +++ /dev/null @@ -1,218 +0,0 @@ -// Copyright (c) 2024 The mlkem-native project authors -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT - -// ---------------------------------------------------------------------------- -// Scalar product of 2-element polynomial vectors in NTT domain, with mulcache -// Inputs a[512], b[512], bt[256] (signed 16-bit words); output r[256] (signed 16-bit words) -// -// The inputs a and b are considered as 2-element vectors of linear -// polynomials in the NTT domain (in Montgomery form), and the bt -// argument an analogous 2-element vector of mulcaches for the bi: -// -// a0 = a[0..255], a1 = a[256..511] -// b0 = b[0..255], b1 = b[256..511] -// bt0 = bt[0..127], bt1 = bt[128..255] -// -// Scalar multiplication of those 2-element vectors is performed, -// with base multiplication in Fq[X]/(X^2-zeta^i'), with zeta^i' -// being a power of zeta = 17, with i bit-reversed as used for NTTs, -// making use of the mulcache for optimization. -// -// All input elements are assumed <= 2^12 and the bts are -// assumed to be as computed by mlkem_mulcache_compute. -// -// extern void mlkem_basemul_k2 -// (int16_t r[static 256],const int16_t a[static 512], -// const int16_t b[static 512], const int16_t bt[static 256]); -// -// Standard ARM ABI: X0 = r, X1 = a, X2 = b, X3 = bt -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(mlkem_basemul_k2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(mlkem_basemul_k2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(mlkem_basemul_k2) - .text - .balign 4 - -S2N_BN_SYMBOL(mlkem_basemul_k2): - CFI_START - -// This matches the code in the mlkem-native repository -// https://github.com/pq-code-package/mlkem-native/blob/main/mlkem/native/aarch64/src/polyvec_basemul_acc_montgomery_cached_asm_k2.S - - CFI_DEC_SP(64) - CFI_STACKSAVE2(d8,d9,0) - CFI_STACKSAVE2(d10,d11,0x10) - CFI_STACKSAVE2(d12,d13,0x20) - CFI_STACKSAVE2(d14,d15,0x30) - mov w14, #0xd01 - dup v0.8h, w14 - mov w14, #0xcff - dup v2.8h, w14 - add x4, x1, #0x200 - add x5, x2, #0x200 - add x6, x3, #0x100 - mov x13, #0x10 - ldr q9, [x4], #0x20 - ldur q5, [x4, #-0x10] - ldr q11, [x5], #0x20 - uzp1 v23.8h, v9.8h, v5.8h - uzp2 v9.8h, v9.8h, v5.8h - ldr q5, [x2], #0x20 - ldur q7, [x5, #-0x10] - ldur q21, [x2, #-0x10] - uzp2 v10.8h, v11.8h, v7.8h - uzp1 v11.8h, v11.8h, v7.8h - uzp1 v7.8h, v5.8h, v21.8h - uzp2 v5.8h, v5.8h, v21.8h - ldr q21, [x1], #0x20 - ldur q25, [x1, #-0x10] - ld1 { v6.8h }, [x3], #16 - uzp1 v26.8h, v21.8h, v25.8h - uzp2 v21.8h, v21.8h, v25.8h - smull v25.4s, v26.4h, v5.4h - smull2 v5.4s, v26.8h, v5.8h - smull v19.4s, v26.4h, v7.4h - smull2 v26.4s, v26.8h, v7.8h - smlal v25.4s, v21.4h, v7.4h - smlal2 v5.4s, v21.8h, v7.8h - smlal v19.4s, v21.4h, v6.4h - smlal2 v26.4s, v21.8h, v6.8h - smlal v25.4s, v23.4h, v10.4h - smlal2 v5.4s, v23.8h, v10.8h - smlal v19.4s, v23.4h, v11.4h - smlal2 v26.4s, v23.8h, v11.8h - ld1 { v23.8h }, [x6], #16 - smlal v25.4s, v9.4h, v11.4h - smlal2 v5.4s, v9.8h, v11.8h - smlal2 v26.4s, v9.8h, v23.8h - smlal v19.4s, v9.4h, v23.4h - ldr q9, [x4], #0x20 - uzp1 v11.8h, v25.8h, v5.8h - uzp1 v23.8h, v19.8h, v26.8h - mul v11.8h, v11.8h, v2.8h - mul v23.8h, v23.8h, v2.8h - ldr q7, [x5], #0x20 - smlal2 v5.4s, v11.8h, v0.8h - smlal v25.4s, v11.4h, v0.4h - ldr q11, [x2], #0x20 - ldur q21, [x2, #-0x10] - ldur q6, [x4, #-0x10] - uzp1 v17.8h, v11.8h, v21.8h - ldr q10, [x1], #0x20 - ldur q29, [x1, #-0x10] - uzp2 v11.8h, v11.8h, v21.8h - uzp1 v13.8h, v9.8h, v6.8h - uzp1 v3.8h, v10.8h, v29.8h - uzp2 v10.8h, v10.8h, v29.8h - smull v12.4s, v3.4h, v11.4h - smull2 v11.4s, v3.8h, v11.8h - ldur q21, [x5, #-0x10] - smlal v12.4s, v10.4h, v17.4h - smlal2 v11.4s, v10.8h, v17.8h - uzp2 v29.8h, v7.8h, v21.8h - uzp1 v15.8h, v7.8h, v21.8h - smlal v12.4s, v13.4h, v29.4h - smlal2 v11.4s, v13.8h, v29.8h - uzp2 v28.8h, v9.8h, v6.8h - smlal2 v26.4s, v23.8h, v0.8h - smlal v12.4s, v28.4h, v15.4h - smlal2 v11.4s, v28.8h, v15.8h - smlal v19.4s, v23.4h, v0.4h - uzp2 v27.8h, v25.8h, v5.8h - smull v23.4s, v3.4h, v17.4h - uzp1 v9.8h, v12.8h, v11.8h - uzp2 v19.8h, v19.8h, v26.8h - mul v14.8h, v9.8h, v2.8h - ld1 { v22.8h }, [x6], #16 - zip2 v9.8h, v19.8h, v27.8h - smlal2 v11.4s, v14.8h, v0.8h - ld1 { v4.8h }, [x3], #16 - sub x13, x13, #0x2 - -Lmlkem_basemul_k2_loop: - smull2 v20.4s, v3.8h, v17.8h - ldr q18, [x4], #0x20 - ldr q30, [x5], #0x20 - smlal2 v20.4s, v10.8h, v4.8h - smlal v12.4s, v14.4h, v0.4h - smlal v23.4s, v10.4h, v4.4h - str q9, [x0, #0x10] - smlal2 v20.4s, v13.8h, v15.8h - ldr q8, [x2], #0x20 - smlal v23.4s, v13.4h, v15.4h - smlal2 v20.4s, v28.8h, v22.8h - zip1 v26.8h, v19.8h, v27.8h - ldur q9, [x2, #-0x10] - smlal v23.4s, v28.4h, v22.4h - uzp2 v27.8h, v12.8h, v11.8h - uzp1 v17.8h, v8.8h, v9.8h - uzp2 v4.8h, v8.8h, v9.8h - uzp1 v5.8h, v23.8h, v20.8h - str q26, [x0], #0x20 - mul v31.8h, v5.8h, v2.8h - ldur q19, [x4, #-0x10] - ldr q29, [x1], #0x20 - ldur q12, [x1, #-0x10] - smlal2 v20.4s, v31.8h, v0.8h - uzp1 v13.8h, v18.8h, v19.8h - uzp1 v3.8h, v29.8h, v12.8h - uzp2 v10.8h, v29.8h, v12.8h - smull v12.4s, v3.4h, v4.4h - smull2 v11.4s, v3.8h, v4.8h - ldur q5, [x5, #-0x10] - smlal v12.4s, v10.4h, v17.4h - smlal2 v11.4s, v10.8h, v17.8h - uzp2 v14.8h, v30.8h, v5.8h - uzp1 v15.8h, v30.8h, v5.8h - smlal v12.4s, v13.4h, v14.4h - smlal2 v11.4s, v13.8h, v14.8h - uzp2 v28.8h, v18.8h, v19.8h - smlal v23.4s, v31.4h, v0.4h - smlal v12.4s, v28.4h, v15.4h - smlal2 v11.4s, v28.8h, v15.8h - ld1 { v22.8h }, [x6], #16 - uzp2 v19.8h, v23.8h, v20.8h - uzp1 v1.8h, v12.8h, v11.8h - smull v23.4s, v3.4h, v17.4h - mul v14.8h, v1.8h, v2.8h - zip2 v9.8h, v19.8h, v27.8h - ld1 { v4.8h }, [x3], #16 - smlal2 v11.4s, v14.8h, v0.8h - sub x13, x13, #0x1 - cbnz x13, Lmlkem_basemul_k2_loop - smull2 v5.4s, v3.8h, v17.8h - smlal v12.4s, v14.4h, v0.4h - smlal v23.4s, v10.4h, v4.4h - str q9, [x0, #0x10] - smlal2 v5.4s, v10.8h, v4.8h - uzp2 v11.8h, v12.8h, v11.8h - zip1 v9.8h, v19.8h, v27.8h - smlal v23.4s, v13.4h, v15.4h - smlal2 v5.4s, v13.8h, v15.8h - str q9, [x0], #0x20 - smlal v23.4s, v28.4h, v22.4h - smlal2 v5.4s, v28.8h, v22.8h - uzp1 v9.8h, v23.8h, v5.8h - mul v9.8h, v9.8h, v2.8h - smlal2 v5.4s, v9.8h, v0.8h - smlal v23.4s, v9.4h, v0.4h - uzp2 v9.8h, v23.8h, v5.8h - zip2 v5.8h, v9.8h, v11.8h - zip1 v9.8h, v9.8h, v11.8h - str q5, [x0, #0x10] - str q9, [x0], #0x20 - CFI_STACKLOAD2(d8,d9,0) - CFI_STACKLOAD2(d10,d11,0x10) - CFI_STACKLOAD2(d12,d13,0x20) - CFI_STACKLOAD2(d14,d15,0x30) - CFI_INC_SP(64) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(mlkem_basemul_k2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_basemul_k3.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_basemul_k3.S deleted file mode 100644 index 400b5a414e8..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_basemul_k3.S +++ /dev/null @@ -1,272 +0,0 @@ -// Copyright (c) 2024 The mlkem-native project authors -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT - -// ---------------------------------------------------------------------------- -// Scalar product of 3-element polynomial vectors in NTT domain, with mulcache -// Inputs a[768], b[768], bt[384] (signed 16-bit words); output r[256] (signed 16-bit words) -// -// The inputs a and b are considered as 3-element vectors of linear -// polynomials in the NTT domain (in Montgomery form), and the bt -// argument an analogous 3-element vector of mulcaches for the bi: -// -// a0 = a[0..255], a1 = a[256..511], a2 = a[512..767] -// b0 = b[0..255], b1 = b[256..511], b2 = b[512..767], -// bt0 = bt[0..127], bt1 = bt[128..255], bt2 = bt[256..383] -// -// Scalar multiplication of those 3-element vectors is performed, -// with base multiplication in Fq[X]/(X^2-zeta^i'), with zeta^i' -// being a power of zeta = 17, with i bit-reversed as used for NTTs, -// making use of the mulcache for optimization. -// -// All input elements are assumed <= 2^12 and the bts are -// assumed to be as computed by mlkem_mulcache_compute. -// -// extern void mlkem_basemul_k3 -// (int16_t r[static 256],const int16_t a[static 768], -// const int16_t b[static 768], const int16_t bt[static 384]); -// -// Standard ARM ABI: X0 = r, X1 = a, X2 = b, X3 = bt -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(mlkem_basemul_k3) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(mlkem_basemul_k3) - S2N_BN_SYM_PRIVACY_DIRECTIVE(mlkem_basemul_k3) - .text - .balign 4 - -S2N_BN_SYMBOL(mlkem_basemul_k3): - CFI_START - -// This matches the code in the mlkem-native repository -// https://github.com/pq-code-package/mlkem-native/blob/main/mlkem/native/aarch64/src/polyvec_basemul_acc_montgomery_cached_asm_k3.S - - CFI_DEC_SP(64) - CFI_STACKSAVE2(d8,d9,0) - CFI_STACKSAVE2(d10,d11,0x10) - CFI_STACKSAVE2(d12,d13,0x20) - CFI_STACKSAVE2(d14,d15,0x30) - mov w14, #0xd01 - dup v0.8h, w14 - mov w14, #0xcff - dup v2.8h, w14 - add x4, x1, #0x200 - add x5, x2, #0x200 - add x6, x3, #0x100 - add x7, x1, #0x400 - add x8, x2, #0x400 - add x9, x3, #0x200 - mov x13, #0x10 - ldr q7, [x2, #0x10] - ldr q20, [x2], #0x20 - ldr q15, [x1, #0x10] - uzp1 v8.8h, v20.8h, v7.8h - uzp2 v7.8h, v20.8h, v7.8h - ld1 { v20.8h }, [x3], #16 - ldr q30, [x1], #0x20 - ldr q11, [x4], #0x20 - uzp1 v16.8h, v30.8h, v15.8h - uzp2 v15.8h, v30.8h, v15.8h - smull v30.4s, v16.4h, v7.4h - smull2 v7.4s, v16.8h, v7.8h - smull v9.4s, v16.4h, v8.4h - smull2 v16.4s, v16.8h, v8.8h - smlal v30.4s, v15.4h, v8.4h - smlal2 v7.4s, v15.8h, v8.8h - smlal v9.4s, v15.4h, v20.4h - smlal2 v16.4s, v15.8h, v20.8h - ldur q20, [x4, #-0x10] - ldr q15, [x5], #0x20 - uzp1 v8.8h, v11.8h, v20.8h - uzp2 v20.8h, v11.8h, v20.8h - ldur q11, [x5, #-0x10] - ld1 { v27.8h }, [x6], #16 - uzp1 v10.8h, v15.8h, v11.8h - uzp2 v15.8h, v15.8h, v11.8h - smlal v9.4s, v8.4h, v10.4h - smlal2 v16.4s, v8.8h, v10.8h - smlal v30.4s, v8.4h, v15.4h - smlal2 v7.4s, v8.8h, v15.8h - smlal v9.4s, v20.4h, v27.4h - smlal2 v16.4s, v20.8h, v27.8h - smlal v30.4s, v20.4h, v10.4h - smlal2 v7.4s, v20.8h, v10.8h - ldr q20, [x7], #0x20 - ldur q15, [x7, #-0x10] - ldr q8, [x8], #0x20 - uzp1 v11.8h, v20.8h, v15.8h - uzp2 v20.8h, v20.8h, v15.8h - ldur q15, [x8, #-0x10] - ld1 { v27.8h }, [x9], #16 - uzp1 v10.8h, v8.8h, v15.8h - uzp2 v15.8h, v8.8h, v15.8h - smlal v9.4s, v11.4h, v10.4h - smlal2 v16.4s, v11.8h, v10.8h - smlal v30.4s, v11.4h, v15.4h - smlal2 v7.4s, v11.8h, v15.8h - smlal v9.4s, v20.4h, v27.4h - smlal2 v16.4s, v20.8h, v27.8h - smlal v30.4s, v20.4h, v10.4h - smlal2 v7.4s, v20.8h, v10.8h - ldr q15, [x2], #0x20 - uzp1 v20.8h, v9.8h, v16.8h - uzp1 v8.8h, v30.8h, v7.8h - mul v20.8h, v20.8h, v2.8h - mul v8.8h, v8.8h, v2.8h - ldr q21, [x4], #0x20 - smlal v9.4s, v20.4h, v0.4h - smlal2 v16.4s, v20.8h, v0.8h - smlal v30.4s, v8.4h, v0.4h - smlal2 v7.4s, v8.8h, v0.8h - ldur q6, [x4, #-0x10] - uzp2 v27.8h, v9.8h, v16.8h - uzp2 v10.8h, v30.8h, v7.8h - ldur q16, [x2, #-0x10] - ldr q30, [x1, #0x10] - ld1 { v9.8h }, [x3], #16 - ldr q1, [x5], #0x20 - ldur q12, [x5, #-0x10] - ld1 { v24.8h }, [x6], #16 - ldr q19, [x7], #0x20 - ldur q31, [x7, #-0x10] - ldr q17, [x8], #0x20 - ldur q18, [x8, #-0x10] - ld1 { v25.8h }, [x9], #16 - sub x13, x13, #0x2 - -Lmlkem_basemul_k3_loop: - ldr q20, [x1], #0x20 - uzp1 v7.8h, v15.8h, v16.8h - uzp2 v15.8h, v15.8h, v16.8h - uzp1 v8.8h, v20.8h, v30.8h - uzp2 v20.8h, v20.8h, v30.8h - smull v30.4s, v8.4h, v15.4h - smull2 v15.4s, v8.8h, v15.8h - smull v11.4s, v8.4h, v7.4h - smull2 v8.4s, v8.8h, v7.8h - smlal v30.4s, v20.4h, v7.4h - smlal2 v15.4s, v20.8h, v7.8h - smlal v11.4s, v20.4h, v9.4h - smlal2 v8.4s, v20.8h, v9.8h - uzp1 v7.8h, v21.8h, v6.8h - uzp2 v20.8h, v21.8h, v6.8h - uzp1 v16.8h, v1.8h, v12.8h - uzp2 v9.8h, v1.8h, v12.8h - smlal v11.4s, v7.4h, v16.4h - smlal2 v8.4s, v7.8h, v16.8h - smlal v30.4s, v7.4h, v9.4h - smlal2 v15.4s, v7.8h, v9.8h - smlal v11.4s, v20.4h, v24.4h - smlal2 v8.4s, v20.8h, v24.8h - smlal v30.4s, v20.4h, v16.4h - smlal2 v15.4s, v20.8h, v16.8h - uzp1 v7.8h, v19.8h, v31.8h - uzp2 v20.8h, v19.8h, v31.8h - uzp1 v16.8h, v17.8h, v18.8h - uzp2 v9.8h, v17.8h, v18.8h - smlal v11.4s, v7.4h, v16.4h - smlal2 v8.4s, v7.8h, v16.8h - smlal v30.4s, v7.4h, v9.4h - smlal2 v15.4s, v7.8h, v9.8h - smlal v11.4s, v20.4h, v25.4h - smlal2 v8.4s, v20.8h, v25.8h - smlal v30.4s, v20.4h, v16.4h - smlal2 v15.4s, v20.8h, v16.8h - ldr q16, [x2, #0x10] - uzp1 v7.8h, v11.8h, v8.8h - uzp1 v20.8h, v30.8h, v15.8h - mul v7.8h, v7.8h, v2.8h - mul v20.8h, v20.8h, v2.8h - zip2 v9.8h, v27.8h, v10.8h - zip1 v27.8h, v27.8h, v10.8h - smlal v11.4s, v7.4h, v0.4h - smlal2 v8.4s, v7.8h, v0.8h - smlal v30.4s, v20.4h, v0.4h - smlal2 v15.4s, v20.8h, v0.8h - str q27, [x0], #0x20 - uzp2 v27.8h, v11.8h, v8.8h - stur q9, [x0, #-0x10] - uzp2 v10.8h, v30.8h, v15.8h - ldr q30, [x1, #0x10] - ldr q15, [x2], #0x20 - ld1 { v9.8h }, [x3], #16 - ldr q21, [x4], #0x20 - ldur q6, [x4, #-0x10] - ldr q1, [x5], #0x20 - ldur q12, [x5, #-0x10] - ld1 { v24.8h }, [x6], #16 - ldr q19, [x7], #0x20 - ldur q31, [x7, #-0x10] - ldr q17, [x8], #0x20 - ldur q18, [x8, #-0x10] - ld1 { v25.8h }, [x9], #16 - sub x13, x13, #0x1 - cbnz x13, Lmlkem_basemul_k3_loop - ldr q7, [x1], #0x20 - uzp1 v20.8h, v15.8h, v16.8h - uzp2 v15.8h, v15.8h, v16.8h - uzp1 v23.8h, v7.8h, v30.8h - uzp2 v11.8h, v7.8h, v30.8h - smull2 v8.4s, v23.8h, v20.8h - smull v5.4s, v23.4h, v20.4h - smull2 v30.4s, v23.8h, v15.8h - uzp1 v28.8h, v1.8h, v12.8h - smlal2 v8.4s, v11.8h, v9.8h - smlal v5.4s, v11.4h, v9.4h - uzp1 v3.8h, v21.8h, v6.8h - smull v16.4s, v23.4h, v15.4h - smlal2 v8.4s, v3.8h, v28.8h - smlal v5.4s, v3.4h, v28.4h - uzp2 v29.8h, v21.8h, v6.8h - uzp1 v7.8h, v17.8h, v18.8h - smlal2 v8.4s, v29.8h, v24.8h - uzp1 v14.8h, v19.8h, v31.8h - smlal v16.4s, v11.4h, v20.4h - smlal2 v30.4s, v11.8h, v20.8h - smlal2 v8.4s, v14.8h, v7.8h - uzp2 v20.8h, v1.8h, v12.8h - uzp2 v21.8h, v19.8h, v31.8h - smlal2 v30.4s, v3.8h, v20.8h - smlal v16.4s, v3.4h, v20.4h - smlal v5.4s, v29.4h, v24.4h - uzp2 v9.8h, v17.8h, v18.8h - smlal2 v30.4s, v29.8h, v28.8h - smlal v16.4s, v29.4h, v28.4h - smlal v5.4s, v14.4h, v7.4h - smlal2 v8.4s, v21.8h, v25.8h - smlal2 v30.4s, v14.8h, v9.8h - smlal v16.4s, v14.4h, v9.4h - smlal v5.4s, v21.4h, v25.4h - zip1 v20.8h, v27.8h, v10.8h - smlal2 v30.4s, v21.8h, v7.8h - smlal v16.4s, v21.4h, v7.4h - uzp1 v7.8h, v5.8h, v8.8h - str q20, [x0], #0x20 - mul v15.8h, v7.8h, v2.8h - uzp1 v7.8h, v16.8h, v30.8h - zip2 v31.8h, v27.8h, v10.8h - mul v20.8h, v7.8h, v2.8h - smlal v5.4s, v15.4h, v0.4h - smlal2 v8.4s, v15.8h, v0.8h - stur q31, [x0, #-0x10] - smlal2 v30.4s, v20.8h, v0.8h - smlal v16.4s, v20.4h, v0.4h - uzp2 v15.8h, v5.8h, v8.8h - uzp2 v20.8h, v16.8h, v30.8h - zip1 v7.8h, v15.8h, v20.8h - zip2 v20.8h, v15.8h, v20.8h - str q7, [x0], #0x20 - stur q20, [x0, #-0x10] - CFI_STACKLOAD2(d8,d9,0) - CFI_STACKLOAD2(d10,d11,0x10) - CFI_STACKLOAD2(d12,d13,0x20) - CFI_STACKLOAD2(d14,d15,0x30) - CFI_INC_SP(64) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(mlkem_basemul_k3) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_basemul_k4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_basemul_k4.S deleted file mode 100644 index 8cc5ad475d6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_basemul_k4.S +++ /dev/null @@ -1,326 +0,0 @@ -// Copyright (c) 2024 The mlkem-native project authors -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT - -// ---------------------------------------------------------------------------- -// Scalar product of 4-element polynomial vectors in NTT domain, with mulcache -// Inputs a[1024], b[1024], bt[512] (signed 16-bit words); output r[256] (signed 16-bit words) -// -// The inputs a and b are considered as 4-element vectors of linear -// polynomials in the NTT domain (in Montgomery form), and the bt -// argument an analogous 4-element vector of mulcaches for the bi: -// -// a0 = a[0..255], a1 = a[256..511], a2 = a[512..767], a3 = a[768..1023] -// b0 = b[0..255], b1 = b[256..511], b2 = b[512..767], b3 = b[768..1023] -// bt0 = bt[0..127], bt1 = bt[128..255], bt2 = bt[256..383], bt3 = bt[384..511] -// -// Scalar multiplication of those 4-element vectors is performed, -// with base multiplication in Fq[X]/(X^2-zeta^i'), with zeta^i' -// being a power of zeta = 17, with i bit-reversed as used for NTTs, -// making use of the mulcache for optimization. -// -// All input elements are assumed <= 2^12 and the bts are -// assumed to be as computed by mlkem_mulcache_compute. -// -// extern void mlkem_basemul_k4 -// (int16_t r[static 256],const int16_t a[static 1024], -// const int16_t b[static 1024], const int16_t bt[static 512]); -// -// Standard ARM ABI: X0 = r, X1 = a, X2 = b, X3 = bt -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(mlkem_basemul_k4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(mlkem_basemul_k4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(mlkem_basemul_k4) - .text - .balign 4 - -S2N_BN_SYMBOL(mlkem_basemul_k4): - CFI_START - -// This matches the code in the mlkem-native repository -// https://github.com/pq-code-package/mlkem-native/blob/main/mlkem/native/aarch64/src/polyvec_basemul_acc_montgomery_cached_asm_k4.S - - CFI_DEC_SP(64) - CFI_STACKSAVE2(d8,d9,0) - CFI_STACKSAVE2(d10,d11,0x10) - CFI_STACKSAVE2(d12,d13,0x20) - CFI_STACKSAVE2(d14,d15,0x30) - mov w14, #0xd01 - dup v0.8h, w14 - mov w14, #0xcff - dup v2.8h, w14 - add x4, x1, #0x200 - add x5, x2, #0x200 - add x6, x3, #0x100 - add x7, x1, #0x400 - add x8, x2, #0x400 - add x9, x3, #0x200 - add x10, x1, #0x600 - add x11, x2, #0x600 - add x12, x3, #0x300 - mov x13, #0x10 - ldr q23, [x2, #0x10] - ldr q19, [x2], #0x20 - ldr q17, [x5], #0x20 - uzp2 v13.8h, v19.8h, v23.8h - uzp1 v19.8h, v19.8h, v23.8h - ldur q23, [x5, #-0x10] - ldr q30, [x1, #0x10] - uzp2 v9.8h, v17.8h, v23.8h - uzp1 v23.8h, v17.8h, v23.8h - ldr q17, [x1], #0x20 - ldr q10, [x7, #0x10] - uzp1 v12.8h, v17.8h, v30.8h - uzp2 v17.8h, v17.8h, v30.8h - smull2 v30.4s, v12.8h, v13.8h - smull v13.4s, v12.4h, v13.4h - smull2 v22.4s, v12.8h, v19.8h - smull v12.4s, v12.4h, v19.4h - smlal2 v30.4s, v17.8h, v19.8h - smlal v13.4s, v17.4h, v19.4h - ldr q19, [x4], #0x20 - ldur q16, [x4, #-0x10] - ld1 { v8.8h }, [x3], #16 - uzp1 v26.8h, v19.8h, v16.8h - uzp2 v19.8h, v19.8h, v16.8h - smlal2 v30.4s, v26.8h, v9.8h - smlal v13.4s, v26.4h, v9.4h - smlal2 v22.4s, v17.8h, v8.8h - smlal v12.4s, v17.4h, v8.4h - smlal2 v30.4s, v19.8h, v23.8h - smlal v13.4s, v19.4h, v23.4h - smlal2 v22.4s, v26.8h, v23.8h - smlal v12.4s, v26.4h, v23.4h - ldr q23, [x7], #0x20 - ldr q17, [x8, #0x10] - uzp1 v9.8h, v23.8h, v10.8h - uzp2 v23.8h, v23.8h, v10.8h - ldr q10, [x10], #0x20 - ldur q16, [x10, #-0x10] - ld1 { v8.8h }, [x12], #16 - uzp1 v26.8h, v10.8h, v16.8h - uzp2 v10.8h, v10.8h, v16.8h - ld1 { v16.8h }, [x6], #16 - ldr q3, [x11, #0x10] - smlal2 v22.4s, v19.8h, v16.8h - smlal v12.4s, v19.4h, v16.4h - ldr q19, [x11], #0x20 - ld1 { v16.8h }, [x9], #16 - uzp1 v4.8h, v19.8h, v3.8h - uzp2 v19.8h, v19.8h, v3.8h - ldr q3, [x8], #0x20 - ldr q31, [x2], #0x20 - uzp1 v6.8h, v3.8h, v17.8h - uzp2 v17.8h, v3.8h, v17.8h - smlal2 v22.4s, v9.8h, v6.8h - smlal2 v30.4s, v9.8h, v17.8h - smlal v13.4s, v9.4h, v17.4h - smlal v12.4s, v9.4h, v6.4h - smlal2 v22.4s, v23.8h, v16.8h - smlal2 v30.4s, v23.8h, v6.8h - smlal v13.4s, v23.4h, v6.4h - smlal v12.4s, v23.4h, v16.4h - smlal2 v22.4s, v26.8h, v4.8h - smlal2 v30.4s, v26.8h, v19.8h - smlal v13.4s, v26.4h, v19.4h - smlal v12.4s, v26.4h, v4.4h - smlal2 v22.4s, v10.8h, v8.8h - smlal2 v30.4s, v10.8h, v4.8h - smlal v13.4s, v10.4h, v4.4h - smlal v12.4s, v10.4h, v8.4h - ldur q19, [x2, #-0x10] - uzp1 v23.8h, v13.8h, v30.8h - uzp1 v17.8h, v12.8h, v22.8h - mul v23.8h, v23.8h, v2.8h - uzp2 v21.8h, v31.8h, v19.8h - uzp1 v19.8h, v31.8h, v19.8h - mul v17.8h, v17.8h, v2.8h - smlal v13.4s, v23.4h, v0.4h - smlal2 v30.4s, v23.8h, v0.8h - ldr q23, [x5], #0x20 - smlal2 v22.4s, v17.8h, v0.8h - uzp2 v15.8h, v13.8h, v30.8h - smlal v12.4s, v17.4h, v0.4h - ldur q17, [x5, #-0x10] - ldr q13, [x1, #0x10] - uzp2 v27.8h, v23.8h, v17.8h - uzp1 v28.8h, v23.8h, v17.8h - uzp2 v7.8h, v12.8h, v22.8h - ldr q23, [x1], #0x20 - zip1 v5.8h, v7.8h, v15.8h - ldr q3, [x7, #0x10] - uzp1 v31.8h, v23.8h, v13.8h - uzp2 v16.8h, v23.8h, v13.8h - smull2 v24.4s, v31.8h, v21.8h - ldr q6, [x8, #0x10] - ldr q23, [x10], #0x20 - smlal2 v24.4s, v16.8h, v19.8h - ldur q17, [x10, #-0x10] - ld1 { v22.8h }, [x12], #16 - uzp1 v30.8h, v23.8h, v17.8h - uzp2 v11.8h, v23.8h, v17.8h - ldr q23, [x4], #0x20 - ldur q17, [x4, #-0x10] - ldr q4, [x7], #0x20 - uzp1 v20.8h, v23.8h, v17.8h - uzp2 v26.8h, v23.8h, v17.8h - uzp1 v9.8h, v4.8h, v3.8h - smlal2 v24.4s, v20.8h, v27.8h - ld1 { v8.8h }, [x6], #16 - ldr q25, [x11, #0x10] - ldr q29, [x11], #0x20 - ld1 { v12.8h }, [x9], #16 - uzp1 v10.8h, v29.8h, v25.8h - ldr q14, [x8], #0x20 - ld1 { v23.8h }, [x3], #16 - sub x13, x13, #0x2 - -Lmlkem_basemul_k4_loop: - smlal2 v24.4s, v26.8h, v28.8h - uzp2 v4.8h, v4.8h, v3.8h - smull2 v13.4s, v31.8h, v19.8h - ldr q3, [x2], #0x20 - uzp2 v1.8h, v29.8h, v25.8h - smlal2 v13.4s, v16.8h, v23.8h - ldur q17, [x2, #-0x10] - smull v18.4s, v31.4h, v19.4h - smlal2 v13.4s, v20.8h, v28.8h - smull v29.4s, v31.4h, v21.4h - ldr q21, [x5], #0x20 - smlal2 v13.4s, v26.8h, v8.8h - smlal v29.4s, v16.4h, v19.4h - ldur q19, [x5, #-0x10] - smlal v18.4s, v16.4h, v23.4h - smlal v29.4s, v20.4h, v27.4h - uzp1 v31.8h, v14.8h, v6.8h - uzp2 v27.8h, v21.8h, v19.8h - smlal v18.4s, v20.4h, v28.4h - ldr q25, [x1, #0x10] - smlal v29.4s, v26.4h, v28.4h - smlal v18.4s, v26.4h, v8.4h - uzp2 v26.8h, v14.8h, v6.8h - smlal2 v13.4s, v9.8h, v31.8h - smlal2 v24.4s, v9.8h, v26.8h - smlal v29.4s, v9.4h, v26.4h - smlal v18.4s, v9.4h, v31.4h - smlal2 v13.4s, v4.8h, v12.8h - smlal2 v24.4s, v4.8h, v31.8h - smlal v29.4s, v4.4h, v31.4h - smlal v18.4s, v4.4h, v12.4h - smlal2 v13.4s, v30.8h, v10.8h - smlal2 v24.4s, v30.8h, v1.8h - smlal v29.4s, v30.4h, v1.4h - smlal v18.4s, v30.4h, v10.4h - smlal2 v13.4s, v11.8h, v22.8h - smlal2 v24.4s, v11.8h, v10.8h - smlal v29.4s, v11.4h, v10.4h - smlal v18.4s, v11.4h, v22.4h - ldr q22, [x1], #0x20 - uzp1 v31.8h, v29.8h, v24.8h - uzp1 v28.8h, v21.8h, v19.8h - mul v19.8h, v31.8h, v2.8h - uzp1 v31.8h, v22.8h, v25.8h - uzp2 v16.8h, v22.8h, v25.8h - uzp2 v21.8h, v3.8h, v17.8h - smlal v29.4s, v19.4h, v0.4h - smlal2 v24.4s, v19.8h, v0.8h - uzp1 v19.8h, v3.8h, v17.8h - uzp1 v26.8h, v18.8h, v13.8h - zip2 v14.8h, v7.8h, v15.8h - mul v23.8h, v26.8h, v2.8h - uzp2 v15.8h, v29.8h, v24.8h - smull2 v24.4s, v31.8h, v21.8h - str q14, [x0, #0x10] - ldr q3, [x7, #0x10] - ldr q6, [x8, #0x10] - ldr q8, [x10], #0x20 - ldur q26, [x10, #-0x10] - ld1 { v22.8h }, [x12], #16 - uzp1 v30.8h, v8.8h, v26.8h - uzp2 v11.8h, v8.8h, v26.8h - ldr q8, [x4], #0x20 - ldur q26, [x4, #-0x10] - ldr q4, [x7], #0x20 - uzp1 v20.8h, v8.8h, v26.8h - uzp2 v26.8h, v8.8h, v26.8h - ld1 { v8.8h }, [x6], #16 - uzp1 v9.8h, v4.8h, v3.8h - ldr q25, [x11, #0x10] - ldr q29, [x11], #0x20 - ld1 { v12.8h }, [x9], #16 - ldr q14, [x8], #0x20 - smlal2 v24.4s, v16.8h, v19.8h - smlal2 v13.4s, v23.8h, v0.8h - smlal v18.4s, v23.4h, v0.4h - ld1 { v23.8h }, [x3], #16 - smlal2 v24.4s, v20.8h, v27.8h - uzp2 v7.8h, v18.8h, v13.8h - uzp1 v10.8h, v29.8h, v25.8h - str q5, [x0], #0x20 - zip1 v5.8h, v7.8h, v15.8h - sub x13, x13, #0x1 - cbnz x13, Lmlkem_basemul_k4_loop - smull2 v17.4s, v31.8h, v19.8h - uzp2 v1.8h, v14.8h, v6.8h - smull v18.4s, v31.4h, v21.4h - smlal2 v24.4s, v26.8h, v28.8h - smlal2 v17.4s, v16.8h, v23.8h - smull v21.4s, v31.4h, v19.4h - smlal v18.4s, v16.4h, v19.4h - uzp2 v31.8h, v4.8h, v3.8h - uzp1 v3.8h, v14.8h, v6.8h - smlal v21.4s, v16.4h, v23.4h - smlal v18.4s, v20.4h, v27.4h - uzp2 v14.8h, v29.8h, v25.8h - smlal2 v17.4s, v20.8h, v28.8h - smlal v21.4s, v20.4h, v28.4h - smlal v18.4s, v26.4h, v28.4h - smlal2 v24.4s, v9.8h, v1.8h - smlal2 v17.4s, v26.8h, v8.8h - smlal v21.4s, v26.4h, v8.4h - smlal v18.4s, v9.4h, v1.4h - smlal2 v24.4s, v31.8h, v3.8h - smlal2 v17.4s, v9.8h, v3.8h - smlal v21.4s, v9.4h, v3.4h - smlal v18.4s, v31.4h, v3.4h - smlal2 v24.4s, v30.8h, v14.8h - smlal2 v17.4s, v31.8h, v12.8h - smlal v21.4s, v31.4h, v12.4h - smlal v18.4s, v30.4h, v14.4h - smlal2 v24.4s, v11.8h, v10.8h - smlal2 v17.4s, v30.8h, v10.8h - smlal v21.4s, v30.4h, v10.4h - smlal v18.4s, v11.4h, v10.4h - zip2 v19.8h, v7.8h, v15.8h - smlal2 v17.4s, v11.8h, v22.8h - smlal v21.4s, v11.4h, v22.4h - uzp1 v23.8h, v18.8h, v24.8h - str q19, [x0, #0x10] - mul v19.8h, v23.8h, v2.8h - uzp1 v23.8h, v21.8h, v17.8h - str q5, [x0], #0x20 - mul v26.8h, v23.8h, v2.8h - smlal v18.4s, v19.4h, v0.4h - smlal2 v24.4s, v19.8h, v0.8h - smlal v21.4s, v26.4h, v0.4h - smlal2 v17.4s, v26.8h, v0.8h - uzp2 v13.8h, v18.8h, v24.8h - uzp2 v19.8h, v21.8h, v17.8h - zip1 v23.8h, v19.8h, v13.8h - zip2 v19.8h, v19.8h, v13.8h - str q23, [x0], #0x20 - stur q19, [x0, #-0x10] - CFI_STACKLOAD2(d8,d9,0) - CFI_STACKLOAD2(d10,d11,0x10) - CFI_STACKLOAD2(d12,d13,0x20) - CFI_STACKLOAD2(d14,d15,0x30) - CFI_INC_SP(64) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(mlkem_basemul_k4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_intt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_intt.S deleted file mode 100644 index c0b45173af7..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_intt.S +++ /dev/null @@ -1,421 +0,0 @@ -// Copyright (c) 2022 Arm Limited -// Copyright (c) 2022 Hanno Becker -// Copyright (c) 2023 Amin Abdulrahman, Matthias Kannwischer -// Copyright (c) 2024 The mlkem-native project authors -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT - -// ---------------------------------------------------------------------------- -// Inverse number-theoretic transform from ML-KEM -// Input a[256], z_01234[80], z_56[384] (all signed 16-bit words); output a[256] (signed 16-bit words). -// -// The transform is in-place with input and output a[256], with the input in -// bitreversed order and the output mapped into the Montgomery domain via -// x |-> (2^16 * x) mod 3329. The two other parameters are expected to point to -// tables of constants whose definitions can be found in the mlkem-native -// repo (mlkem/native/aarch64/src/aarch64_zetas.c) or our "tests/test.c". -// -// extern void mlkem_intt(int16_t a[static 256],const int16_t z_01234[static 80], -// const int16_t z_56[static 384]); -// -// Standard ARM ABI: X0 = a, X1 = z_01234, X2 = z_56 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(mlkem_intt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(mlkem_intt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(mlkem_intt) - .text - .balign 4 - -S2N_BN_SYMBOL(mlkem_intt): - CFI_START - -// This implementation is generated by SLOTHY, set up to optimize for -// the Neoverse N1 microarchitecture, starting from the clean version -// -// https://github.com/pq-code-package/mlkem-native/blob/main/mlkem/native/aarch64/intt_clean.S -// -// in the mlkem-native repository. - - CFI_DEC_SP(64) - CFI_STACKSAVE2(d8,d9,0) - CFI_STACKSAVE2(d10,d11,16) - CFI_STACKSAVE2(d12,d13,32) - CFI_STACKSAVE2(d14,d15,48) - mov w5, #0xd01 - mov v7.h[0], w5 - mov w5, #0x4ebf - mov v7.h[1], w5 - mov w5, #0x200 - dup v29.8h, w5 - mov w5, #0x13b0 - dup v30.8h, w5 - mov x3, x0 - mov x4, #0x8 - -Lmlkem_intt_scale_start: - ldr q8, [x3] - ldr q9, [x3, #16] - ldr q10, [x3, #32] - ldr q11, [x3, #48] - sqrdmulh v27.8h, v8.8h, v30.8h - mul v8.8h, v8.8h, v29.8h - mls v8.8h, v27.8h, v7.h[0] - sqrdmulh v27.8h, v9.8h, v30.8h - mul v9.8h, v9.8h, v29.8h - mls v9.8h, v27.8h, v7.h[0] - sqrdmulh v27.8h, v10.8h, v30.8h - mul v10.8h, v10.8h, v29.8h - mls v10.8h, v27.8h, v7.h[0] - sqrdmulh v27.8h, v11.8h, v30.8h - mul v11.8h, v11.8h, v29.8h - mls v11.8h, v27.8h, v7.h[0] - str q8, [x3], #64 - stur q9, [x3, #-48] - stur q10, [x3, #-32] - stur q11, [x3, #-16] - subs x4, x4, #0x1 - cbnz x4, Lmlkem_intt_scale_start - - mov x3, x0 - mov x4, #0x8 - ldr q1, [x3, #32] - ldr q18, [x3, #48] - ldr q15, [x3] - ldr q21, [x3, #16] - ldr q3, [x2], #96 - ldur q16, [x2, #-48] - ldr q4, [x1], #16 - ldur q30, [x2, #-32] - trn1 v11.4s, v1.4s, v18.4s - trn2 v18.4s, v1.4s, v18.4s - trn1 v20.4s, v15.4s, v21.4s - trn2 v1.4s, v15.4s, v21.4s - ldur q0, [x2, #-16] - ldur q22, [x2, #-80] - trn1 v8.2d, v20.2d, v11.2d - trn1 v6.2d, v1.2d, v18.2d - trn2 v1.2d, v1.2d, v18.2d - trn2 v21.2d, v20.2d, v11.2d - sub v11.8h, v8.8h, v6.8h - add v20.8h, v8.8h, v6.8h - add v14.8h, v21.8h, v1.8h - sub v15.8h, v21.8h, v1.8h - sqrdmulh v16.8h, v11.8h, v16.8h - ldur q6, [x2, #-64] - sub v18.8h, v20.8h, v14.8h - add v21.8h, v20.8h, v14.8h - sqrdmulh v0.8h, v15.8h, v0.8h - mul v11.8h, v11.8h, v6.8h - mul v1.8h, v15.8h, v30.8h - mls v11.8h, v16.8h, v7.h[0] - mls v1.8h, v0.8h, v7.h[0] - sqrdmulh v0.8h, v18.8h, v22.8h - mul v16.8h, v18.8h, v3.8h - sub v18.8h, v11.8h, v1.8h - add v13.8h, v11.8h, v1.8h - sqrdmulh v11.8h, v18.8h, v22.8h - trn1 v20.4s, v21.4s, v13.4s - trn2 v1.4s, v21.4s, v13.4s - mls v16.8h, v0.8h, v7.h[0] - mul v3.8h, v18.8h, v3.8h - mls v3.8h, v11.8h, v7.h[0] - trn2 v11.4s, v16.4s, v3.4s - trn1 v16.4s, v16.4s, v3.4s - trn2 v21.2d, v1.2d, v11.2d - trn2 v0.2d, v20.2d, v16.2d - trn1 v1.2d, v1.2d, v11.2d - trn1 v11.2d, v20.2d, v16.2d - sub v13.8h, v0.8h, v21.8h - add v29.8h, v0.8h, v21.8h - add v9.8h, v11.8h, v1.8h - sub v23.8h, v11.8h, v1.8h - sqdmulh v1.8h, v29.8h, v7.h[1] - sqdmulh v27.8h, v9.8h, v7.h[1] - sqrdmulh v16.8h, v13.8h, v4.h[5] - srshr v14.8h, v1.8h, #11 - sub x4, x4, #0x1 - -Lmlkem_intt_layer3456_start: - mls v29.8h, v14.8h, v7.h[0] - ldr q3, [x3, #96] - ldr q30, [x3, #112] - ldr q20, [x2, #32] - mul v6.8h, v23.8h, v4.h[2] - ldr q24, [x2, #16] - ldr q0, [x3, #64] - ldr q14, [x3, #80] - srshr v25.8h, v27.8h, #11 - mul v15.8h, v13.8h, v4.h[4] - trn1 v18.4s, v3.4s, v30.4s - ldr q28, [x2], #96 - trn2 v5.4s, v3.4s, v30.4s - sqrdmulh v19.8h, v23.8h, v4.h[3] - trn2 v26.4s, v0.4s, v14.4s - trn1 v11.4s, v0.4s, v14.4s - mls v9.8h, v25.8h, v7.h[0] - trn2 v0.2d, v26.2d, v5.2d - ldur q17, [x2, #-16] - mls v15.8h, v16.8h, v7.h[0] - trn2 v23.2d, v11.2d, v18.2d - trn1 v30.2d, v26.2d, v5.2d - ldur q1, [x2, #-32] - mls v6.8h, v19.8h, v7.h[0] - sub v14.8h, v23.8h, v0.8h - trn1 v19.2d, v11.2d, v18.2d - ldur q10, [x2, #-48] - add v31.8h, v23.8h, v0.8h - sqrdmulh v27.8h, v14.8h, v17.8h - add v18.8h, v19.8h, v30.8h - mul v13.8h, v14.8h, v1.8h - sub v22.8h, v19.8h, v30.8h - sub v26.8h, v18.8h, v31.8h - sqrdmulh v10.8h, v22.8h, v10.8h - sub v25.8h, v9.8h, v29.8h - add v9.8h, v9.8h, v29.8h - mls v13.8h, v27.8h, v7.h[0] - add v2.8h, v18.8h, v31.8h - str q9, [x3], #64 - sub v23.8h, v6.8h, v15.8h - add v21.8h, v6.8h, v15.8h - mul v3.8h, v22.8h, v20.8h - mls v3.8h, v10.8h, v7.h[0] - sqrdmulh v20.8h, v26.8h, v24.8h - mul v22.8h, v26.8h, v28.8h - add v12.8h, v3.8h, v13.8h - sub v15.8h, v3.8h, v13.8h - sqrdmulh v13.8h, v23.8h, v4.h[1] - sqrdmulh v0.8h, v15.8h, v24.8h - mul v27.8h, v15.8h, v28.8h - mls v22.8h, v20.8h, v7.h[0] - mls v27.8h, v0.8h, v7.h[0] - sqdmulh v19.8h, v21.8h, v7.h[1] - trn1 v26.4s, v2.4s, v12.4s - mul v10.8h, v23.8h, v4.h[0] - trn2 v2.4s, v2.4s, v12.4s - trn2 v12.4s, v22.4s, v27.4s - trn1 v8.4s, v22.4s, v27.4s - mul v31.8h, v25.8h, v4.h[0] - trn2 v3.2d, v2.2d, v12.2d - sqrdmulh v11.8h, v25.8h, v4.h[1] - trn2 v0.2d, v26.2d, v8.2d - srshr v16.8h, v19.8h, #11 - ldr q4, [x1], #16 - mls v10.8h, v13.8h, v7.h[0] - add v29.8h, v0.8h, v3.8h - trn1 v18.2d, v26.2d, v8.2d - trn1 v20.2d, v2.2d, v12.2d - sqdmulh v15.8h, v29.8h, v7.h[1] - sub v13.8h, v0.8h, v3.8h - mls v21.8h, v16.8h, v7.h[0] - add v9.8h, v18.8h, v20.8h - stur q10, [x3, #-16] - sub v23.8h, v18.8h, v20.8h - mls v31.8h, v11.8h, v7.h[0] - srshr v14.8h, v15.8h, #11 - sqrdmulh v16.8h, v13.8h, v4.h[5] - stur q21, [x3, #-48] - sqdmulh v27.8h, v9.8h, v7.h[1] - stur q31, [x3, #-32] - sub x4, x4, #0x1 - cbnz x4, Lmlkem_intt_layer3456_start - - mls v29.8h, v14.8h, v7.h[0] - srshr v1.8h, v27.8h, #11 - mul v11.8h, v13.8h, v4.h[4] - mls v9.8h, v1.8h, v7.h[0] - sqrdmulh v1.8h, v23.8h, v4.h[3] - mul v20.8h, v23.8h, v4.h[2] - sub v21.8h, v9.8h, v29.8h - add v0.8h, v9.8h, v29.8h - mls v11.8h, v16.8h, v7.h[0] - mls v20.8h, v1.8h, v7.h[0] - str q0, [x3], #64 - mul v1.8h, v21.8h, v4.h[0] - sqrdmulh v16.8h, v21.8h, v4.h[1] - add v21.8h, v20.8h, v11.8h - sub v11.8h, v20.8h, v11.8h - sqdmulh v20.8h, v21.8h, v7.h[1] - sqrdmulh v0.8h, v11.8h, v4.h[1] - mul v11.8h, v11.8h, v4.h[0] - srshr v20.8h, v20.8h, #11 - mls v1.8h, v16.8h, v7.h[0] - mls v11.8h, v0.8h, v7.h[0] - mls v21.8h, v20.8h, v7.h[0] - stur q1, [x3, #-32] - stur q11, [x3, #-16] - stur q21, [x3, #-48] - mov x4, #0x4 - ldr q0, [x1], #32 - ldur q1, [x1, #-16] - ldr q6, [x0, #64] - ldr q16, [x0] - ldr q18, [x0, #192] - ldr q27, [x0, #128] - ldr q26, [x0, #320] - ldr q5, [x0, #256] - ldr q4, [x0, #448] - ldr q2, [x0, #384] - add v12.8h, v16.8h, v6.8h - sub v11.8h, v16.8h, v6.8h - add v3.8h, v27.8h, v18.8h - sub v21.8h, v27.8h, v18.8h - sub v18.8h, v5.8h, v26.8h - mul v10.8h, v11.8h, v0.h[6] - add v24.8h, v5.8h, v26.8h - sqrdmulh v27.8h, v18.8h, v1.h[3] - sub v19.8h, v12.8h, v3.8h - add v29.8h, v12.8h, v3.8h - mul v14.8h, v18.8h, v1.h[2] - sub v13.8h, v2.8h, v4.8h - sqrdmulh v31.8h, v21.8h, v1.h[1] - sqrdmulh v26.8h, v11.8h, v0.h[7] - mul v21.8h, v21.8h, v1.h[0] - sub x4, x4, #0x1 - -Lmlkem_intt_layer102_start: - mls v14.8h, v27.8h, v7.h[0] - ldr q15, [x0, #16] - ldr q9, [x0, #208] - add v18.8h, v2.8h, v4.8h - mul v17.8h, v13.8h, v1.h[4] - ldr q20, [x0, #80] - ldr q2, [x0, #400] - ldr q5, [x0, #272] - sub v11.8h, v24.8h, v18.8h - sqrdmulh v8.8h, v13.8h, v1.h[5] - ldr q23, [x0, #336] - sqrdmulh v16.8h, v11.8h, v0.h[5] - sub v12.8h, v15.8h, v20.8h - ldr q3, [x0, #144] - add v28.8h, v15.8h, v20.8h - add v4.8h, v24.8h, v18.8h - mul v30.8h, v11.8h, v0.h[4] - sub v20.8h, v5.8h, v23.8h - add v24.8h, v5.8h, v23.8h - mls v17.8h, v8.8h, v7.h[0] - sub v11.8h, v29.8h, v4.8h - mls v30.8h, v16.8h, v7.h[0] - sqrdmulh v27.8h, v20.8h, v1.h[3] - add v16.8h, v14.8h, v17.8h - sub v13.8h, v14.8h, v17.8h - sqrdmulh v23.8h, v19.8h, v0.h[3] - sub v25.8h, v3.8h, v9.8h - add v5.8h, v3.8h, v9.8h - mul v6.8h, v19.8h, v0.h[2] - mul v8.8h, v11.8h, v0.h[0] - mls v10.8h, v26.8h, v7.h[0] - sqrdmulh v26.8h, v12.8h, v0.h[7] - mul v14.8h, v20.8h, v1.h[2] - mul v22.8h, v13.8h, v0.h[4] - mls v21.8h, v31.8h, v7.h[0] - sqrdmulh v9.8h, v11.8h, v0.h[1] - sqrdmulh v20.8h, v13.8h, v0.h[5] - sub v13.8h, v10.8h, v21.8h - add v15.8h, v10.8h, v21.8h - sqrdmulh v31.8h, v25.8h, v1.h[1] - sqrdmulh v21.8h, v13.8h, v0.h[3] - sub v18.8h, v15.8h, v16.8h - add v3.8h, v15.8h, v16.8h - add v4.8h, v29.8h, v4.8h - mls v22.8h, v20.8h, v7.h[0] - sub v19.8h, v28.8h, v5.8h - mls v6.8h, v23.8h, v7.h[0] - str q4, [x0], #16 - mul v29.8h, v13.8h, v0.h[2] - mls v29.8h, v21.8h, v7.h[0] - add v11.8h, v6.8h, v30.8h - mls v8.8h, v9.8h, v7.h[0] - str q11, [x0, #112] - sub v11.8h, v6.8h, v30.8h - sqrdmulh v21.8h, v18.8h, v0.h[1] - sqrdmulh v4.8h, v11.8h, v0.h[1] - str q8, [x0, #240] - sub v16.8h, v29.8h, v22.8h - str q3, [x0, #48] - mul v20.8h, v11.8h, v0.h[0] - sqrdmulh v11.8h, v16.8h, v0.h[1] - mls v20.8h, v4.8h, v7.h[0] - mul v23.8h, v16.8h, v0.h[0] - mls v23.8h, v11.8h, v7.h[0] - str q20, [x0, #368] - mul v11.8h, v18.8h, v0.h[0] - mls v11.8h, v21.8h, v7.h[0] - str q23, [x0, #432] - ldr q4, [x0, #448] - mul v10.8h, v12.8h, v0.h[6] - add v12.8h, v29.8h, v22.8h - add v29.8h, v28.8h, v5.8h - mul v21.8h, v25.8h, v1.h[0] - str q12, [x0, #176] - str q11, [x0, #304] - sub v13.8h, v2.8h, v4.8h - sub x4, x4, #0x1 - cbnz x4, Lmlkem_intt_layer102_start - - mls v21.8h, v31.8h, v7.h[0] - add v22.8h, v2.8h, v4.8h - sqrdmulh v15.8h, v13.8h, v1.h[5] - add v8.8h, v24.8h, v22.8h - sub v17.8h, v29.8h, v8.8h - mul v28.8h, v13.8h, v1.h[4] - add v29.8h, v29.8h, v8.8h - sub v13.8h, v24.8h, v22.8h - sqrdmulh v25.8h, v17.8h, v0.h[1] - str q29, [x0], #16 - mls v28.8h, v15.8h, v7.h[0] - mls v10.8h, v26.8h, v7.h[0] - mul v29.8h, v17.8h, v0.h[0] - mls v29.8h, v25.8h, v7.h[0] - mls v14.8h, v27.8h, v7.h[0] - sqrdmulh v20.8h, v13.8h, v0.h[5] - str q29, [x0, #240] - mul v4.8h, v13.8h, v0.h[4] - add v12.8h, v10.8h, v21.8h - add v22.8h, v14.8h, v28.8h - sub v8.8h, v10.8h, v21.8h - sqrdmulh v11.8h, v19.8h, v0.h[3] - add v6.8h, v12.8h, v22.8h - sub v3.8h, v14.8h, v28.8h - mls v4.8h, v20.8h, v7.h[0] - str q6, [x0, #48] - sub v16.8h, v12.8h, v22.8h - mul v12.8h, v19.8h, v0.h[2] - mul v14.8h, v3.8h, v0.h[4] - sqrdmulh v22.8h, v3.8h, v0.h[5] - mls v12.8h, v11.8h, v7.h[0] - mul v20.8h, v8.8h, v0.h[2] - mls v14.8h, v22.8h, v7.h[0] - add v5.8h, v12.8h, v4.8h - sub v21.8h, v12.8h, v4.8h - sqrdmulh v4.8h, v8.8h, v0.h[3] - str q5, [x0, #112] - sqrdmulh v9.8h, v21.8h, v0.h[1] - mul v19.8h, v21.8h, v0.h[0] - mls v20.8h, v4.8h, v7.h[0] - mls v19.8h, v9.8h, v7.h[0] - sqrdmulh v9.8h, v16.8h, v0.h[1] - sub v5.8h, v20.8h, v14.8h - add v4.8h, v20.8h, v14.8h - mul v20.8h, v16.8h, v0.h[0] - str q4, [x0, #176] - sqrdmulh v18.8h, v5.8h, v0.h[1] - str q19, [x0, #368] - mul v23.8h, v5.8h, v0.h[0] - mls v20.8h, v9.8h, v7.h[0] - mls v23.8h, v18.8h, v7.h[0] - str q20, [x0, #304] - str q23, [x0, #432] - CFI_STACKLOAD2(d8,d9,0) - CFI_STACKLOAD2(d10,d11,16) - CFI_STACKLOAD2(d12,d13,32) - CFI_STACKLOAD2(d14,d15,48) - CFI_INC_SP(64) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(mlkem_intt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_mulcache_compute.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_mulcache_compute.S deleted file mode 100644 index d194bd8f3ae..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_mulcache_compute.S +++ /dev/null @@ -1,75 +0,0 @@ -// Copyright (c) 2024 The mlkem-native project authors -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT - -// ---------------------------------------------------------------------------- -// Precompute the mulcache data for a polynomial in the NTT domain -// Inputs a[256], z[128] and t[128] (signed 16-bit words); output x[128] (signed 16-bit words) -// -// The input array a is assumed to represent 128 linear polynomials -// in the NTT domain, p_i = a[2i] + a[2i+1] * X where each p_i is in -// Fq[X]/(X^2-zeta^i'), with zeta^i' being a power of zeta = 17, with i -// bit-reversed as used for NTTs. For each such polynomial, the mulcache -// value is a[2i+1] * zeta^i' (modulo 3329 as usual), a value useful to -// perform base multiplication of polynomials efficiently. The two other -// table arguments z = zetas and t = twisted zetas are expected to point -// to tables of zeta-related constants whose definitions can be found in -// the mlkem-native repo (mlkem/native/aarch64/src/aarch64_zetas.c) or -// our "tests/test.c", as "mulcache_zetas" and "mulcache_zetas_twisted" -// -// extern void mlkem_mulcache_compute -// (int16_t x[static 128],const int16_t a[static 256], -// const int16_t z[static 128],const int16_t t[static 128]); -// -// Standard ARM ABI: X0 = x, X1 = a, X2 = z, X3 = t -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(mlkem_mulcache_compute) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(mlkem_mulcache_compute) - S2N_BN_SYM_PRIVACY_DIRECTIVE(mlkem_mulcache_compute) - .text - .balign 4 - -S2N_BN_SYMBOL(mlkem_mulcache_compute): - CFI_START - -// This matches the code in the mlkem-native repository -// https://github.com/pq-code-package/mlkem-native/blob/main/mlkem/native/aarch64/src/poly_mulcache_compute_asm.S - - mov w5, #0xd01 - dup v6.8h, w5 - mov w5, #0x4ebf - dup v7.8h, w5 - mov x4, #0x10 - ldr q1, [x1, #0x10] - ldr q27, [x1], #0x20 - ldr q23, [x2], #0x10 - uzp2 v27.8h, v27.8h, v1.8h - ldr q1, [x3], #0x10 - mul v2.8h, v27.8h, v23.8h - sqrdmulh v27.8h, v27.8h, v1.8h - sub x4, x4, #0x1 - -mlkem_mulcache_compute_loop: - ldr q29, [x1, #0x10] - ldr q21, [x2], #0x10 - mls v2.8h, v27.8h, v6.h[0] - ldr q27, [x1], #0x20 - ldr q7, [x3], #0x10 - uzp2 v28.8h, v27.8h, v29.8h - str q2, [x0], #0x10 - mul v2.8h, v28.8h, v21.8h - sqrdmulh v27.8h, v28.8h, v7.8h - sub x4, x4, #0x1 - cbnz x4, mlkem_mulcache_compute_loop - - mls v2.8h, v27.8h, v6.h[0] - str q2, [x0], #0x10 - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(mlkem_mulcache_compute) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_ntt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_ntt.S deleted file mode 100644 index c6c305212ee..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_ntt.S +++ /dev/null @@ -1,372 +0,0 @@ -// Copyright (c) 2022 Arm Limited -// Copyright (c) 2022 Hanno Becker -// Copyright (c) 2023 Amin Abdulrahman, Matthias Kannwischer -// Copyright (c) 2024 The mlkem-native project authors -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT - -// ---------------------------------------------------------------------------- -// Forward number-theoretic transform from ML-KEM -// Input a[256], z_01234[80], z_56[384] (all signed 16-bit words); output a[256] (signed 16-bit words). -// -// The transform is in-place with input and output a[256], with the output -// in bitreversed order. The two other parameters are expected to point to -// tables of constants whose definitions can be found in the mlkem-native -// repo (mlkem/native/aarch64/src/aarch64_zetas.c) or our "tests/test.c". -// -// extern void mlkem_ntt(int16_t a[static 256],const int16_t z_01234[static 80], -// const int16_t z_56[static 384]); -// -// Standard ARM ABI: X0 = a, X1 = z_01234, X2 = z_56 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(mlkem_ntt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(mlkem_ntt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(mlkem_ntt) - .text - .balign 4 - -S2N_BN_SYMBOL(mlkem_ntt): - CFI_START - -// This implementation is generated by SLOTHY, set up to optimize for -// the Neoverse N1 microarchitecture, starting from the clean version -// -// https://github.com/pq-code-package/mlkem-native/blob/main/mlkem/native/aarch64/src/ntt_clean.S -// -// in the mlkem-native repository. - - CFI_DEC_SP(64) - CFI_STACKSAVE2(d8,d9,0) - CFI_STACKSAVE2(d10,d11,16) - CFI_STACKSAVE2(d12,d13,32) - CFI_STACKSAVE2(d14,d15,48) - mov w5, #0xd01 - mov v7.h[0], w5 - mov w5, #0x4ebf - mov v7.h[1], w5 - mov x3, x0 - mov x4, #0x4 - ldr q0, [x1], #32 - ldur q1, [x1, #-16] - ldr q26, [x0, #384] - ldr q14, [x0, #256] - ldr q12, [x0, #64] - ldr q4, [x0, #192] - ldr q11, [x0] - ldr q22, [x0, #320] - ldr q10, [x0, #448] - ldr q28, [x0, #128] - sqrdmulh v23.8h, v26.8h, v0.h[1] - mul v26.8h, v26.8h, v0.h[0] - sqrdmulh v24.8h, v14.8h, v0.h[1] - mul v9.8h, v14.8h, v0.h[0] - sqrdmulh v14.8h, v22.8h, v0.h[1] - mul v22.8h, v22.8h, v0.h[0] - sqrdmulh v29.8h, v10.8h, v0.h[1] - mls v22.8h, v14.8h, v7.h[0] - mls v26.8h, v23.8h, v7.h[0] - mul v14.8h, v10.8h, v0.h[0] - add v10.8h, v12.8h, v22.8h - sub v12.8h, v12.8h, v22.8h - mls v14.8h, v29.8h, v7.h[0] - sub v22.8h, v28.8h, v26.8h - add v23.8h, v28.8h, v26.8h - mls v9.8h, v24.8h, v7.h[0] - sqrdmulh v26.8h, v22.8h, v0.h[5] - sub v28.8h, v4.8h, v14.8h - add v14.8h, v4.8h, v14.8h - mul v13.8h, v22.8h, v0.h[4] - sub v18.8h, v11.8h, v9.8h - sqrdmulh v4.8h, v28.8h, v0.h[5] - sqrdmulh v22.8h, v14.8h, v0.h[3] - mul v28.8h, v28.8h, v0.h[4] - mls v28.8h, v4.8h, v7.h[0] - mul v14.8h, v14.8h, v0.h[2] - mls v14.8h, v22.8h, v7.h[0] - add v4.8h, v12.8h, v28.8h - sub v12.8h, v12.8h, v28.8h - mls v13.8h, v26.8h, v7.h[0] - sqrdmulh v26.8h, v4.8h, v1.h[3] - sub v22.8h, v10.8h, v14.8h - add v19.8h, v10.8h, v14.8h - mul v3.8h, v4.8h, v1.h[2] - sqrdmulh v14.8h, v22.8h, v1.h[1] - mul v28.8h, v22.8h, v1.h[0] - mls v3.8h, v26.8h, v7.h[0] - mls v28.8h, v14.8h, v7.h[0] - sqrdmulh v14.8h, v12.8h, v1.h[5] - mul v26.8h, v12.8h, v1.h[4] - sqrdmulh v21.8h, v19.8h, v0.h[7] - mls v26.8h, v14.8h, v7.h[0] - sub x4, x4, #0x1 - -Lmlkem_ntt_layer123_start: - ldr q17, [x0, #400] - mul v22.8h, v19.8h, v0.h[6] - ldr q24, [x0, #272] - add v19.8h, v18.8h, v13.8h - mls v22.8h, v21.8h, v7.h[0] - sub v21.8h, v18.8h, v13.8h - ldr q13, [x0, #208] - ldr q18, [x0, #80] - sqrdmulh v14.8h, v17.8h, v0.h[1] - ldr q30, [x0, #336] - ldr q4, [x0, #464] - add v2.8h, v11.8h, v9.8h - sqrdmulh v27.8h, v23.8h, v0.h[3] - ldr q11, [x0, #16] - sub v16.8h, v21.8h, v26.8h - ldr q6, [x0, #144] - sub v29.8h, v19.8h, v3.8h - mul v15.8h, v23.8h, v0.h[2] - add v12.8h, v21.8h, v26.8h - sqrdmulh v26.8h, v30.8h, v0.h[1] - add v3.8h, v19.8h, v3.8h - str q29, [x0, #320] - mls v15.8h, v27.8h, v7.h[0] - str q3, [x0, #256] - str q12, [x0, #384] - mul v10.8h, v17.8h, v0.h[0] - str q16, [x0, #448] - mls v10.8h, v14.8h, v7.h[0] - sub v17.8h, v2.8h, v15.8h - mul v12.8h, v30.8h, v0.h[0] - sub v16.8h, v17.8h, v28.8h - mls v12.8h, v26.8h, v7.h[0] - sub v25.8h, v6.8h, v10.8h - str q16, [x0, #192] - sqrdmulh v8.8h, v24.8h, v0.h[1] - add v23.8h, v6.8h, v10.8h - sqrdmulh v14.8h, v4.8h, v0.h[1] - add v16.8h, v18.8h, v12.8h - mul v9.8h, v24.8h, v0.h[0] - sub v5.8h, v18.8h, v12.8h - add v26.8h, v17.8h, v28.8h - mul v21.8h, v4.8h, v0.h[0] - add v27.8h, v2.8h, v15.8h - str q26, [x0, #128] - mls v21.8h, v14.8h, v7.h[0] - sub v12.8h, v27.8h, v22.8h - add v29.8h, v27.8h, v22.8h - mls v9.8h, v8.8h, v7.h[0] - str q12, [x0, #64] - str q29, [x0], #16 - sqrdmulh v18.8h, v25.8h, v0.h[5] - sub v26.8h, v13.8h, v21.8h - add v21.8h, v13.8h, v21.8h - mul v13.8h, v25.8h, v0.h[4] - sqrdmulh v28.8h, v26.8h, v0.h[5] - sqrdmulh v15.8h, v21.8h, v0.h[3] - mul v31.8h, v26.8h, v0.h[4] - mls v31.8h, v28.8h, v7.h[0] - mul v27.8h, v21.8h, v0.h[2] - mls v27.8h, v15.8h, v7.h[0] - add v10.8h, v5.8h, v31.8h - mls v13.8h, v18.8h, v7.h[0] - sub v18.8h, v11.8h, v9.8h - sub v14.8h, v5.8h, v31.8h - sqrdmulh v25.8h, v10.8h, v1.h[3] - sub v26.8h, v16.8h, v27.8h - add v19.8h, v16.8h, v27.8h - mul v3.8h, v10.8h, v1.h[2] - sqrdmulh v29.8h, v26.8h, v1.h[1] - mul v28.8h, v26.8h, v1.h[0] - mls v3.8h, v25.8h, v7.h[0] - mls v28.8h, v29.8h, v7.h[0] - sqrdmulh v4.8h, v14.8h, v1.h[5] - mul v26.8h, v14.8h, v1.h[4] - sqrdmulh v21.8h, v19.8h, v0.h[7] - mls v26.8h, v4.8h, v7.h[0] - sub x4, x4, #0x1 - cbnz x4, Lmlkem_ntt_layer123_start - - add v20.8h, v18.8h, v13.8h - sqrdmulh v16.8h, v23.8h, v0.h[3] - sub v8.8h, v18.8h, v13.8h - sub v5.8h, v20.8h, v3.8h - mul v27.8h, v23.8h, v0.h[2] - add v31.8h, v11.8h, v9.8h - add v14.8h, v8.8h, v26.8h - sub v26.8h, v8.8h, v26.8h - str q5, [x0, #320] - mls v27.8h, v16.8h, v7.h[0] - str q14, [x0, #384] - mul v25.8h, v19.8h, v0.h[6] - str q26, [x0, #448] - mls v25.8h, v21.8h, v7.h[0] - sub v26.8h, v31.8h, v27.8h - add v15.8h, v20.8h, v3.8h - add v29.8h, v31.8h, v27.8h - sub v22.8h, v26.8h, v28.8h - str q15, [x0, #256] - add v26.8h, v26.8h, v28.8h - sub v27.8h, v29.8h, v25.8h - add v20.8h, v29.8h, v25.8h - str q26, [x0, #128] - str q22, [x0, #192] - str q27, [x0, #64] - str q20, [x0], #16 - mov x0, x3 - mov x4, #0x8 - ldr q11, [x1], #16 - ldr q9, [x0, #48] - ldr q30, [x0, #32] - ldr q12, [x2], #96 - ldur q5, [x2, #-64] - sqrdmulh v23.8h, v9.8h, v11.h[1] - ldr q15, [x0] - mul v6.8h, v9.8h, v11.h[0] - ldr q28, [x0, #16] - sqrdmulh v10.8h, v30.8h, v11.h[1] - mls v6.8h, v23.8h, v7.h[0] - mul v0.8h, v30.8h, v11.h[0] - mls v0.8h, v10.8h, v7.h[0] - ldur q21, [x2, #-48] - add v27.8h, v28.8h, v6.8h - sub v25.8h, v28.8h, v6.8h - mul v6.8h, v27.8h, v11.h[2] - sqrdmulh v17.8h, v27.8h, v11.h[3] - sqrdmulh v19.8h, v25.8h, v11.h[5] - ldur q18, [x2, #-80] - mul v22.8h, v25.8h, v11.h[4] - mls v6.8h, v17.8h, v7.h[0] - mls v22.8h, v19.8h, v7.h[0] - sub x4, x4, #0x1 - -Lmlkem_ntt_layer4567_start: - ldr q27, [x0, #112] - ldr q4, [x1], #16 - sub v1.8h, v15.8h, v0.8h - ldr q30, [x0, #96] - add v23.8h, v15.8h, v0.8h - add v11.8h, v1.8h, v22.8h - ldur q10, [x2, #-16] - sub v24.8h, v23.8h, v6.8h - sqrdmulh v25.8h, v27.8h, v4.h[1] - add v9.8h, v23.8h, v6.8h - sub v16.8h, v1.8h, v22.8h - mul v31.8h, v27.8h, v4.h[0] - trn2 v14.4s, v9.4s, v24.4s - sqrdmulh v1.8h, v30.8h, v4.h[1] - trn2 v8.4s, v11.4s, v16.4s - trn1 v11.4s, v11.4s, v16.4s - trn2 v19.2d, v14.2d, v8.2d - mls v31.8h, v25.8h, v7.h[0] - ldr q15, [x0, #80] - trn1 v2.4s, v9.4s, v24.4s - sqrdmulh v17.8h, v19.8h, v18.8h - trn1 v9.2d, v14.2d, v8.2d - mul v29.8h, v19.8h, v12.8h - trn2 v27.2d, v2.2d, v11.2d - add v0.8h, v15.8h, v31.8h - sub v16.8h, v15.8h, v31.8h - sqrdmulh v13.8h, v27.8h, v18.8h - mls v29.8h, v17.8h, v7.h[0] - ldur q17, [x2, #-32] - ldr q15, [x0, #64] - mul v24.8h, v27.8h, v12.8h - trn1 v19.2d, v2.2d, v11.2d - ldr q18, [x2, #16] - mul v6.8h, v0.8h, v4.h[2] - ldr q12, [x2], #96 - add v25.8h, v9.8h, v29.8h - mls v24.8h, v13.8h, v7.h[0] - sub v20.8h, v9.8h, v29.8h - sqrdmulh v23.8h, v25.8h, v21.8h - mul v3.8h, v25.8h, v5.8h - add v13.8h, v19.8h, v24.8h - sqrdmulh v27.8h, v20.8h, v10.8h - mls v3.8h, v23.8h, v7.h[0] - sub v29.8h, v19.8h, v24.8h - mul v26.8h, v20.8h, v17.8h - mls v26.8h, v27.8h, v7.h[0] - add v27.8h, v13.8h, v3.8h - sqrdmulh v14.8h, v0.8h, v4.h[3] - sub v19.8h, v13.8h, v3.8h - ldur q5, [x2, #-64] - mul v0.8h, v30.8h, v4.h[0] - trn1 v8.4s, v27.4s, v19.4s - sub v21.8h, v29.8h, v26.8h - add v11.8h, v29.8h, v26.8h - trn2 v30.4s, v27.4s, v19.4s - sqrdmulh v19.8h, v16.8h, v4.h[5] - trn2 v10.4s, v11.4s, v21.4s - mul v22.8h, v16.8h, v4.h[4] - trn1 v28.4s, v11.4s, v21.4s - trn1 v29.2d, v30.2d, v10.2d - ldur q21, [x2, #-48] - mls v0.8h, v1.8h, v7.h[0] - trn2 v20.2d, v8.2d, v28.2d - trn2 v26.2d, v30.2d, v10.2d - str q29, [x0, #16] - trn1 v3.2d, v8.2d, v28.2d - mls v22.8h, v19.8h, v7.h[0] - str q20, [x0, #32] - str q26, [x0, #48] - mls v6.8h, v14.8h, v7.h[0] - str q3, [x0], #64 - sub x4, x4, #0x1 - cbnz x4, Lmlkem_ntt_layer4567_start - - add v4.8h, v15.8h, v0.8h - sub v14.8h, v15.8h, v0.8h - ldur q26, [x2, #-16] - add v8.8h, v14.8h, v22.8h - sub v27.8h, v14.8h, v22.8h - sub v13.8h, v4.8h, v6.8h - add v29.8h, v4.8h, v6.8h - trn2 v11.4s, v8.4s, v27.4s - trn2 v1.4s, v29.4s, v13.4s - trn1 v27.4s, v8.4s, v27.4s - trn1 v17.4s, v29.4s, v13.4s - trn2 v28.2d, v1.2d, v11.2d - trn1 v16.2d, v1.2d, v11.2d - sqrdmulh v0.8h, v28.8h, v18.8h - trn2 v19.2d, v17.2d, v27.2d - trn1 v1.2d, v17.2d, v27.2d - mul v27.8h, v28.8h, v12.8h - sqrdmulh v9.8h, v19.8h, v18.8h - mls v27.8h, v0.8h, v7.h[0] - mul v20.8h, v19.8h, v12.8h - mls v20.8h, v9.8h, v7.h[0] - sub v30.8h, v16.8h, v27.8h - add v25.8h, v16.8h, v27.8h - sqrdmulh v14.8h, v30.8h, v26.8h - ldur q26, [x2, #-32] - sqrdmulh v31.8h, v25.8h, v21.8h - add v27.8h, v1.8h, v20.8h - mul v15.8h, v30.8h, v26.8h - mls v15.8h, v14.8h, v7.h[0] - sub v26.8h, v1.8h, v20.8h - mul v12.8h, v25.8h, v5.8h - mls v12.8h, v31.8h, v7.h[0] - sub v2.8h, v26.8h, v15.8h - add v0.8h, v26.8h, v15.8h - trn2 v14.4s, v0.4s, v2.4s - sub v26.8h, v27.8h, v12.8h - add v27.8h, v27.8h, v12.8h - trn1 v17.4s, v0.4s, v2.4s - trn1 v5.4s, v27.4s, v26.4s - trn2 v26.4s, v27.4s, v26.4s - trn1 v25.2d, v26.2d, v14.2d - trn1 v0.2d, v5.2d, v17.2d - trn2 v21.2d, v26.2d, v14.2d - trn2 v26.2d, v5.2d, v17.2d - str q25, [x0, #16] - str q0, [x0], #64 - stur q21, [x0, #-16] - stur q26, [x0, #-32] - CFI_STACKLOAD2(d8,d9,0) - CFI_STACKLOAD2(d10,d11,16) - CFI_STACKLOAD2(d12,d13,32) - CFI_STACKLOAD2(d14,d15,48) - CFI_INC_SP(64) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(mlkem_ntt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_reduce.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_reduce.S deleted file mode 100644 index 68c012ae7ab..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_reduce.S +++ /dev/null @@ -1,112 +0,0 @@ -// Copyright (c) 2024 The mlkem-native project authors -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT - -// ---------------------------------------------------------------------------- -// Canonical reduction of polynomial coefficients for ML-KEM -// Input a[256] (signed 16-bit words); output a[256] (signed 16-bit words) -// -// This reduces each element of the 256-element array of 16-bit signed -// integers modulo 3329 with the result being 0 <= r < 3329, in-place. -// This is intended for use when that array represents polynomial -// coefficients for ML-KEM, but that is not relevant to its operation. -// -// extern void mlkem_reduce(int16_t a[static 256]); -// -// Standard ARM ABI: X0 = a -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(mlkem_reduce) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(mlkem_reduce) - S2N_BN_SYM_PRIVACY_DIRECTIVE(mlkem_reduce) - .text - .balign 4 - -S2N_BN_SYMBOL(mlkem_reduce): - CFI_START - -// This matches the code in the mlkem-native repository -// https://github.com/pq-code-package/mlkem-native/blob/main/mlkem/native/aarch64/src/poly_reduce_asm.S - - mov w2, #0xd01 - dup v3.8h, w2 - mov w2, #0x4ebf - dup v4.8h, w2 - mov x1, #0x8 - ldr q21, [x0, #0x20] - ldr q23, [x0, #0x30] - sqdmulh v7.8h, v21.8h, v4.h[0] - sqdmulh v30.8h, v23.8h, v4.h[0] - srshr v7.8h, v7.8h, #0xb - srshr v30.8h, v30.8h, #0xb - mls v21.8h, v7.8h, v3.h[0] - mls v23.8h, v30.8h, v3.h[0] - ldr q5, [x0, #0x10] - sshr v7.8h, v21.8h, #0xf - sshr v30.8h, v23.8h, #0xf - and v7.16b, v3.16b, v7.16b - add v21.8h, v21.8h, v7.8h - and v7.16b, v3.16b, v30.16b - add v16.8h, v23.8h, v7.8h - sub x1, x1, #0x1 - -mlkem_reduce_loop: - ldr q6, [x0], #0x40 - ldr q30, [x0, #0x20] - sqdmulh v31.8h, v6.8h, v4.h[0] - sqdmulh v29.8h, v5.8h, v4.h[0] - sqdmulh v22.8h, v30.8h, v4.h[0] - stur q16, [x0, #-0x10] - srshr v20.8h, v31.8h, #0xb - srshr v28.8h, v29.8h, #0xb - stur q21, [x0, #-0x20] - mls v6.8h, v20.8h, v3.h[0] - mls v5.8h, v28.8h, v3.h[0] - ldr q2, [x0, #0x30] - sshr v31.8h, v6.8h, #0xf - srshr v19.8h, v22.8h, #0xb - and v22.16b, v3.16b, v31.16b - add v0.8h, v6.8h, v22.8h - mls v30.8h, v19.8h, v3.h[0] - sshr v26.8h, v5.8h, #0xf - sqdmulh v25.8h, v2.8h, v4.h[0] - and v17.16b, v3.16b, v26.16b - add v1.8h, v5.8h, v17.8h - sshr v31.8h, v30.8h, #0xf - srshr v25.8h, v25.8h, #0xb - stur q1, [x0, #-0x30] - and v18.16b, v3.16b, v31.16b - mls v2.8h, v25.8h, v3.h[0] - add v21.8h, v30.8h, v18.8h - ldr q5, [x0, #0x10] - sshr v18.8h, v2.8h, #0xf - stur q0, [x0, #-0x40] - and v27.16b, v3.16b, v18.16b - add v16.8h, v2.8h, v27.8h - sub x1, x1, #0x1 - cbnz x1, mlkem_reduce_loop - sqdmulh v20.8h, v5.8h, v4.h[0] - ldr q24, [x0], #0x40 - stur q21, [x0, #-0x20] - srshr v20.8h, v20.8h, #0xb - sqdmulh v25.8h, v24.8h, v4.h[0] - stur q16, [x0, #-0x10] - mls v5.8h, v20.8h, v3.h[0] - srshr v20.8h, v25.8h, #0xb - sshr v2.8h, v5.8h, #0xf - mls v24.8h, v20.8h, v3.h[0] - and v20.16b, v3.16b, v2.16b - add v31.8h, v5.8h, v20.8h - sshr v20.8h, v24.8h, #0xf - stur q31, [x0, #-0x30] - and v31.16b, v3.16b, v20.16b - add v24.8h, v24.8h, v31.8h - stur q24, [x0, #-0x40] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(mlkem_reduce) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_rej_uniform_VARIABLE_TIME.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_rej_uniform_VARIABLE_TIME.S deleted file mode 100644 index 508cf30be15..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_rej_uniform_VARIABLE_TIME.S +++ /dev/null @@ -1,216 +0,0 @@ -// Copyright (c) 2024 The mlkem-native project authors -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT - -// ---------------------------------------------------------------------------- -// Uniform rejection sampling for ML-KEM -// Inputs *buf (unsigned bytes), buflen, table (unsigned bytes); output r[256] (signed 16-bit words), return -// -// extern uint64_t mlkem_rej_uniform_VARIABLE_TIME -// (int16_t r[S2N_BIGNUM_STATIC 256], -// const uint8_t *buf,uint64_t buflen, -// const uint8_t *table); -// -// Interprets the input buffer as packed 12-bit numbers with a length of -// buflen bytes, assumed to be a multiple of 24. Fills the output array -// with those numbers from the packed buffer that are < 3329, in the order -// of appearance, returning the total number of entries written, with a -// maximum of 256. The table argument is a specific precomputed table of -// constants that is defined in this file (see also our test code): -// -// https://github.com/pq-code-package/mlkem-native/blob/main/mlkem/native/aarch64/src/rej_uniform_table.c -// -// Unique (at the moment) among s2n-bignum functions this is *not* a -// constant-time function. The time taken depends not only on the -// buffer size "buflen", but also how many elements of the buffer are -// needed to provide the 256 entries for the output. -// -// Standard ARM ABI: X0 = buf, X1 = r, X2 = buflen, X3 = table -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(mlkem_rej_uniform_VARIABLE_TIME) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(mlkem_rej_uniform_VARIABLE_TIME) - S2N_BN_SYM_PRIVACY_DIRECTIVE(mlkem_rej_uniform_VARIABLE_TIME) - .text - .balign 4 - -S2N_BN_SYMBOL(mlkem_rej_uniform_VARIABLE_TIME): - CFI_START - -// This is almost identical to the code from mlkem-native: -// -// https://github.com/pq-code-package/mlkem-native/blob/main/mlkem/native/aarch64/src/rej_uniform_asm.S -// -// The only difference is systematic use of full-length scalar registers -// Xnn instead of the mixed use of 32-bit counterparts Wnn in most -// settings where that is applicable. - - CFI_DEC_SP(576) - mov x7, #0x1 - movk x7, #0x2, lsl #16 - movk x7, #0x4, lsl #32 - movk x7, #0x8, lsl #48 - mov v31.d[0], x7 - mov x7, #0x10 - movk x7, #0x20, lsl #16 - movk x7, #0x40, lsl #32 - movk x7, #0x80, lsl #48 - mov v31.d[1], x7 - mov w11, #0xd01 - dup v30.8h, w11 - mov x8, sp - mov x7, x8 - mov w11, #0x0 - eor v16.16b, v16.16b, v16.16b -Lmlkem_rej_uniform_initial_zero: - str q16, [x7], #0x40 - stur q16, [x7, #-0x30] - stur q16, [x7, #-0x20] - stur q16, [x7, #-0x10] - add x11, x11, #0x20 - cmp x11, #0x100 - b.lt Lmlkem_rej_uniform_initial_zero - mov x7, x8 - mov w9, #0x0 - mov w4, #0x100 - cmp x2, #0x30 - b.lo Lmlkem_rej_uniform_loop48_end - -Lmlkem_rej_uniform_loop48: - cmp x9, x4 - b.hs Lmlkem_rej_uniform_memory_copy - sub x2, x2, #0x30 - ld3 { v0.16b, v1.16b, v2.16b }, [x1], #48 - zip1 v4.16b, v0.16b, v1.16b - zip2 v5.16b, v0.16b, v1.16b - zip1 v6.16b, v1.16b, v2.16b - zip2 v7.16b, v1.16b, v2.16b - bic v4.8h, #0xf0, lsl #8 - bic v5.8h, #0xf0, lsl #8 - ushr v6.8h, v6.8h, #0x4 - ushr v7.8h, v7.8h, #0x4 - zip1 v16.8h, v4.8h, v6.8h - zip2 v17.8h, v4.8h, v6.8h - zip1 v18.8h, v5.8h, v7.8h - zip2 v19.8h, v5.8h, v7.8h - cmhi v4.8h, v30.8h, v16.8h - cmhi v5.8h, v30.8h, v17.8h - cmhi v6.8h, v30.8h, v18.8h - cmhi v7.8h, v30.8h, v19.8h - and v4.16b, v4.16b, v31.16b - and v5.16b, v5.16b, v31.16b - and v6.16b, v6.16b, v31.16b - and v7.16b, v7.16b, v31.16b - uaddlv s20, v4.8h - uaddlv s21, v5.8h - uaddlv s22, v6.8h - uaddlv s23, v7.8h - fmov w12, s20 - fmov w13, s21 - fmov w14, s22 - fmov w15, s23 - ldr q24, [x3, x12, lsl #4] - ldr q25, [x3, x13, lsl #4] - ldr q26, [x3, x14, lsl #4] - ldr q27, [x3, x15, lsl #4] - cnt v4.16b, v4.16b - cnt v5.16b, v5.16b - cnt v6.16b, v6.16b - cnt v7.16b, v7.16b - uaddlv s20, v4.8h - uaddlv s21, v5.8h - uaddlv s22, v6.8h - uaddlv s23, v7.8h - fmov w12, s20 - fmov w13, s21 - fmov w14, s22 - fmov w15, s23 - tbl v16.16b, { v16.16b }, v24.16b - tbl v17.16b, { v17.16b }, v25.16b - tbl v18.16b, { v18.16b }, v26.16b - tbl v19.16b, { v19.16b }, v27.16b - str q16, [x7] - add x7, x7, x12, lsl #1 - str q17, [x7] - add x7, x7, x13, lsl #1 - str q18, [x7] - add x7, x7, x14, lsl #1 - str q19, [x7] - add x7, x7, x15, lsl #1 - add x12, x12, x13 - add x14, x14, x15 - add x9, x9, x12 - add x9, x9, x14 - cmp x2, #0x30 - b.hs Lmlkem_rej_uniform_loop48 - -Lmlkem_rej_uniform_loop48_end: - cmp x9, x4 - b.hs Lmlkem_rej_uniform_memory_copy - cmp x2, #0x18 - b.lo Lmlkem_rej_uniform_memory_copy - sub x2, x2, #0x18 - ld3 { v0.8b, v1.8b, v2.8b }, [x1], #24 - zip1 v4.16b, v0.16b, v1.16b - zip1 v5.16b, v1.16b, v2.16b - bic v4.8h, #0xf0, lsl #8 - ushr v5.8h, v5.8h, #0x4 - zip1 v16.8h, v4.8h, v5.8h - zip2 v17.8h, v4.8h, v5.8h - cmhi v4.8h, v30.8h, v16.8h - cmhi v5.8h, v30.8h, v17.8h - and v4.16b, v4.16b, v31.16b - and v5.16b, v5.16b, v31.16b - uaddlv s20, v4.8h - uaddlv s21, v5.8h - fmov w12, s20 - fmov w13, s21 - ldr q24, [x3, x12, lsl #4] - ldr q25, [x3, x13, lsl #4] - cnt v4.16b, v4.16b - cnt v5.16b, v5.16b - uaddlv s20, v4.8h - uaddlv s21, v5.8h - fmov w12, s20 - fmov w13, s21 - tbl v16.16b, { v16.16b }, v24.16b - tbl v17.16b, { v17.16b }, v25.16b - str q16, [x7] - add x7, x7, x12, lsl #1 - str q17, [x7] - add x7, x7, x13, lsl #1 - add x9, x9, x12 - add x9, x9, x13 - -Lmlkem_rej_uniform_memory_copy: - cmp x9, x4 - csel x9, x9, x4, lo - mov x11, #0x0 - mov x7, x8 - -Lmlkem_rej_uniform_final_copy: - ldr q16, [x7], #0x40 - ldur q17, [x7, #-0x30] - ldur q18, [x7, #-0x20] - ldur q19, [x7, #-0x10] - str q16, [x0], #0x40 - stur q17, [x0, #-0x30] - stur q18, [x0, #-0x20] - stur q19, [x0, #-0x10] - add x11, x11, #0x20 - cmp x11, #0x100 - b.lt Lmlkem_rej_uniform_final_copy - mov x0, x9 - b Lmlkem_rej_uniform_return - -Lmlkem_rej_uniform_return: - CFI_INC_SP(576) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(mlkem_rej_uniform_VARIABLE_TIME) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_tobytes.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_tobytes.S deleted file mode 100644 index 506587036b3..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_tobytes.S +++ /dev/null @@ -1,124 +0,0 @@ -// Copyright (c) 2024 The mlkem-native project authors -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT - -// ---------------------------------------------------------------------------- -// Pack ML-KEM polynomial coefficients as 12-bit numbers -// Input a[256] (signed 16-bit words); output r[384] (bytes) -// -// This accepts an array of 256 16-bit numbers assumed to be in the range -// 0 <= a[i] < 2^12 (typically they will be < 3329, the ML-KEM prime). -// It packs them into the output array as 12-bit unsigned numbers. -// -// extern void mlkem_tobytes(uint8_t r[static 384],const int16_t a[static 256]); -// -// Standard ARM ABI: X0 = r, X1 = a -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(mlkem_tobytes) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(mlkem_tobytes) - S2N_BN_SYM_PRIVACY_DIRECTIVE(mlkem_tobytes) - .text - .balign 4 - -S2N_BN_SYMBOL(mlkem_tobytes): - CFI_START - -// This code is essentially a verbatim copy of the mlkem-native version -// https://github.com/pq-code-package/mlkem-native/blob/main/mlkem/native/aarch64/src/poly_tobytes_asm.S - - mov x2, #0x10 - ldr q6, [x1], #0x20 - ldur q24, [x1, #-0x10] - ldr q30, [x1], #0x20 - ldur q22, [x1, #-0x10] - ldr q5, [x1], #0x20 - ldur q17, [x1, #-0x10] - ldr q19, [x1], #0x20 - ldur q4, [x1, #-0x10] - lsr x2, x2, #2 - sub x2, x2, #0x1 - -mlkem_tobytes_asm_asm_loop_start: - uzp1 v25.8h, v6.8h, v24.8h - uzp2 v6.8h, v6.8h, v24.8h - xtn v24.8b, v25.8h - shrn v25.8b, v25.8h, #0x8 - xtn v18.8b, v6.8h - shrn v26.8b, v6.8h, #0x4 - sli v25.8b, v18.8b, #0x4 - st3 { v24.8b, v25.8b, v26.8b }, [x0], #24 - uzp1 v25.8h, v30.8h, v22.8h - uzp2 v6.8h, v30.8h, v22.8h - xtn v24.8b, v25.8h - xtn v18.8b, v6.8h - uzp1 v30.8h, v5.8h, v17.8h - uzp2 v22.8h, v5.8h, v17.8h - xtn v5.8b, v30.8h - xtn v17.8b, v22.8h - uzp1 v28.8h, v19.8h, v4.8h - uzp2 v19.8h, v19.8h, v4.8h - xtn v4.8b, v28.8h - xtn v20.8b, v19.8h - shrn v25.8b, v25.8h, #0x8 - sli v25.8b, v18.8b, #0x4 - shrn v26.8b, v6.8h, #0x4 - st3 { v24.8b, v25.8b, v26.8b }, [x0], #24 - shrn v6.8b, v30.8h, #0x8 - sli v6.8b, v17.8b, #0x4 - shrn v7.8b, v22.8h, #0x4 - st3 { v5.8b, v6.8b, v7.8b }, [x0], #24 - shrn v5.8b, v28.8h, #0x8 - shrn v6.8b, v19.8h, #0x4 - sli v5.8b, v20.8b, #0x4 - st3 { v4.8b, v5.8b, v6.8b }, [x0], #24 - ldr q6, [x1], #0x20 - ldur q24, [x1, #-0x10] - ldr q30, [x1], #0x20 - ldur q22, [x1, #-0x10] - ldr q5, [x1], #0x20 - ldur q17, [x1, #-0x10] - ldr q19, [x1], #0x20 - ldur q4, [x1, #-0x10] - sub x2, x2, #0x1 - cbnz x2, mlkem_tobytes_asm_asm_loop_start - uzp1 v25.8h, v30.8h, v22.8h - uzp2 v18.8h, v30.8h, v22.8h - uzp1 v30.8h, v6.8h, v24.8h - uzp2 v6.8h, v6.8h, v24.8h - uzp1 v24.8h, v5.8h, v17.8h - uzp2 v22.8h, v5.8h, v17.8h - uzp1 v5.8h, v19.8h, v4.8h - uzp2 v17.8h, v19.8h, v4.8h - xtn v19.8b, v25.8h - shrn v20.8b, v25.8h, #0x8 - xtn v25.8b, v18.8h - shrn v21.8b, v18.8h, #0x4 - xtn v28.8b, v30.8h - shrn v29.8b, v30.8h, #0x8 - xtn v18.8b, v6.8h - shrn v30.8b, v6.8h, #0x4 - xtn v1.8b, v24.8h - shrn v2.8b, v24.8h, #0x8 - xtn v6.8b, v22.8h - shrn v3.8b, v22.8h, #0x4 - xtn v22.8b, v5.8h - shrn v23.8b, v5.8h, #0x8 - xtn v5.8b, v17.8h - shrn v24.8b, v17.8h, #0x4 - sli v20.8b, v25.8b, #0x4 - sli v29.8b, v18.8b, #0x4 - st3 { v28.8b, v29.8b, v30.8b }, [x0], #24 - st3 { v19.8b, v20.8b, v21.8b }, [x0], #24 - sli v2.8b, v6.8b, #0x4 - st3 { v1.8b, v2.8b, v3.8b }, [x0], #24 - sli v23.8b, v5.8b, #0x4 - st3 { v22.8b, v23.8b, v24.8b }, [x0], #24 - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(mlkem_tobytes) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_tomont.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_tomont.S deleted file mode 100644 index 260d6a6622c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/mlkem/mlkem_tomont.S +++ /dev/null @@ -1,93 +0,0 @@ -// Copyright (c) 2024 The mlkem-native project authors -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT - -// ---------------------------------------------------------------------------- -// Conversion of ML-KEM polynomial coefficients to Montgomery form -// Input a[256] (signed 16-bit words); output a[256] (signed 16-bit words) -// -// This converts each element of the 256-element array of 16-bit signed -// integers modulo 3329 into Montgomery form, giving a signed result -// satisfying (output[i] == 2^16 * input[i]) (mod 3329), without full -// modular reduction but with |output[i]| < 3329 guaranteed. -// -// extern void mlkem_tomont(int16_t a[static 256]); -// -// Standard ARM ABI: X0 = a -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(mlkem_tomont) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(mlkem_tomont) - S2N_BN_SYM_PRIVACY_DIRECTIVE(mlkem_tomont) - .text - .balign 4 - -S2N_BN_SYMBOL(mlkem_tomont): - CFI_START - -// This matches the code in the mlkem-native repository -// https://github.com/pq-code-package/mlkem-native/blob/main/mlkem/native/aarch64/src/poly_tomont_asm.S - - mov w2, #0xd01 - dup v4.8h, w2 - mov w2, #0x4ebf - dup v5.8h, w2 - mov w2, #-0x414 - dup v2.8h, w2 - mov w2, #-0x2824 - dup v3.8h, w2 - mov x1, #0x8 - ldr q26, [x0, #0x30] - ldr q23, [x0, #0x10] - mul v17.8h, v26.8h, v2.8h - sqrdmulh v7.8h, v26.8h, v3.8h - ldr q27, [x0, #0x20] - sub x1, x1, #0x1 - -mlkem_tomont_loop: - mls v17.8h, v7.8h, v4.h[0] - sqrdmulh v5.8h, v23.8h, v3.8h - ldr q7, [x0], #0x40 - stur q17, [x0, #-0x10] - sqrdmulh v29.8h, v27.8h, v3.8h - sqrdmulh v19.8h, v7.8h, v3.8h - mul v25.8h, v23.8h, v2.8h - mul v0.8h, v7.8h, v2.8h - mul v26.8h, v27.8h, v2.8h - ldr q7, [x0, #0x30] - mls v25.8h, v5.8h, v4.h[0] - ldr q23, [x0, #0x10] - mls v26.8h, v29.8h, v4.h[0] - mls v0.8h, v19.8h, v4.h[0] - stur q25, [x0, #-0x30] - mul v17.8h, v7.8h, v2.8h - sqrdmulh v7.8h, v7.8h, v3.8h - stur q0, [x0, #-0x40] - ldr q27, [x0, #0x20] - stur q26, [x0, #-0x20] - sub x1, x1, #0x1 - cbnz x1, mlkem_tomont_loop - - mls v17.8h, v7.8h, v4.h[0] - sqrdmulh v7.8h, v23.8h, v3.8h - mul v26.8h, v23.8h, v2.8h - sqrdmulh v25.8h, v27.8h, v3.8h - ldr q23, [x0], #0x40 - mul v27.8h, v27.8h, v2.8h - mls v26.8h, v7.8h, v4.h[0] - sqrdmulh v7.8h, v23.8h, v3.8h - mul v23.8h, v23.8h, v2.8h - stur q17, [x0, #-0x10] - mls v27.8h, v25.8h, v4.h[0] - stur q26, [x0, #-0x30] - mls v23.8h, v7.8h, v4.h[0] - stur q27, [x0, #-0x20] - stur q23, [x0, #-0x40] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(mlkem_tomont) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/Makefile b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/Makefile deleted file mode 100644 index 4489fbc1665..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/Makefile +++ /dev/null @@ -1,66 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - -# If actually on an ARM8 machine, just use the GNU assembler (as). Otherwise -# use a cross-assembling version so that the code can still be assembled -# and the proofs checked against the object files (though you won't be able -# to run code without additional emulation infrastructure). The aarch64 -# cross-assembling version can be installed manually by something like: -# -# sudo apt-get install binutils-aarch64-linux-gnu - -UNAME_RESULT=$(shell uname -p) - -ifeq ($(UNAME_RESULT),aarch64) -GAS=as -else -GAS=aarch64-linux-gnu-as -endif - -# List of object files - -OBJ = bignum_add_p256.o \ - bignum_bigendian_4.o \ - bignum_cmul_p256.o \ - bignum_deamont_p256.o \ - bignum_demont_p256.o \ - bignum_double_p256.o \ - bignum_half_p256.o \ - bignum_inv_p256.o \ - bignum_littleendian_4.o \ - bignum_mod_n256.o \ - bignum_mod_n256_4.o \ - bignum_mod_p256.o \ - bignum_mod_p256_4.o \ - bignum_montinv_p256.o \ - bignum_montmul_p256.o \ - bignum_montmul_p256_alt.o \ - bignum_montsqr_p256.o \ - bignum_montsqr_p256_alt.o \ - bignum_mux_4.o \ - bignum_neg_p256.o \ - bignum_nonzero_4.o \ - bignum_optneg_p256.o \ - bignum_sub_p256.o \ - bignum_tomont_p256.o \ - bignum_triple_p256.o \ - p256_montjadd.o \ - p256_montjadd_alt.o \ - p256_montjdouble.o \ - p256_montjdouble_alt.o \ - p256_montjmixadd.o \ - p256_montjmixadd_alt.o \ - p256_montjscalarmul.o \ - p256_montjscalarmul_alt.o \ - p256_scalarmul.o \ - p256_scalarmul_alt.o \ - p256_scalarmulbase.o \ - p256_scalarmulbase_alt.o - -%.o : %.S ; $(CC) -E -I../../include $< | $(GAS) -o $@ - - -default: $(OBJ); - -clean:; rm -f *.o *.correct unopt/*.o diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_add_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_add_p256.S deleted file mode 100644 index d5e0c805918..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_add_p256.S +++ /dev/null @@ -1,78 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Add modulo p_256, z := (x + y) mod p_256, assuming x and y reduced -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_add_p256(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_add_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_add_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_add_p256) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 -#define c x3 -#define d0 x4 -#define d1 x5 -#define d2 x6 -#define d3 x7 -#define n0 x8 -#define n1 x9 -#define n2 x10 -#define n3 x11 - -S2N_BN_SYMBOL(bignum_add_p256): - CFI_START - -// First just add the numbers as [c;d3;d2;d1;d0] - - ldp d0, d1, [x] - ldp n0, n1, [y] - adds d0, d0, n0 - adcs d1, d1, n1 - ldp d2, d3, [x, #16] - ldp n2, n3, [y, #16] - adcs d2, d2, n2 - adcs d3, d3, n3 - adc c, xzr, xzr - -// Now let [c;n3;n2;n1;n0] = [c;d3;d2;d1;d0] - p_256 - - subs n0, d0, #0xffffffffffffffff - mov n1, #0x00000000ffffffff - sbcs n1, d1, n1 - sbcs n2, d2, xzr - mov n3, #0xffffffff00000001 - sbcs n3, d3, n3 - sbcs c, c, xzr - -// Select result according to whether (x + y) - p_256 < 0 - - csel d0, d0, n0, cc - csel d1, d1, n1, cc - csel d2, d2, n2, cc - csel d3, d3, n3, cc - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_add_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_bigendian_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_bigendian_4.S deleted file mode 100644 index 40c9a39acd1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_bigendian_4.S +++ /dev/null @@ -1,145 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert 4-digit (256-bit) bignum to/from big-endian form -// Input x[4]; output z[4] -// -// extern void bignum_bigendian_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// The same function is given two other prototypes whose names reflect the -// treatment of one or other argument as a byte array rather than word array: -// -// extern void bignum_frombebytes_4(uint64_t z[static 4], -// const uint8_t x[static 32]); -// -// extern void bignum_tobebytes_4(uint8_t z[static 32], -// const uint64_t x[static 4]); -// -// The implementation works by loading in bytes and storing in words (i.e. -// stylistically it is "frombebytes"); in the more common little-endian -// usage of ARM, this is just byte reversal. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_bigendian_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_bigendian_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_bigendian_4) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_frombebytes_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_frombebytes_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_frombebytes_4) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tobebytes_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tobebytes_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tobebytes_4) - - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d x2 -#define dshort w2 -#define a x3 -#define c x4 - -// The reads and writes are organized in mirror-image pairs (0-3 and 1-2) -// to allow x and z to point to the same buffer without using more -// intermediate registers. - -S2N_BN_SYMBOL(bignum_bigendian_4): -S2N_BN_SYMBOL(bignum_frombebytes_4): -S2N_BN_SYMBOL(bignum_tobebytes_4): - CFI_START - -// 0 and 3 words - - ldrb dshort, [x, #7] - extr a, d, xzr, #8 - ldrb dshort, [x, #6] - extr a, d, a, #8 - ldrb dshort, [x, #5] - extr a, d, a, #8 - ldrb dshort, [x, #4] - extr a, d, a, #8 - ldrb dshort, [x, #3] - extr a, d, a, #8 - ldrb dshort, [x, #2] - extr a, d, a, #8 - ldrb dshort, [x, #1] - extr a, d, a, #8 - ldrb dshort, [x] - extr a, d, a, #8 - - ldrb dshort, [x, #31] - extr c, d, xzr, #8 - ldrb dshort, [x, #30] - extr c, d, c, #8 - ldrb dshort, [x, #29] - extr c, d, c, #8 - ldrb dshort, [x, #28] - extr c, d, c, #8 - ldrb dshort, [x, #27] - extr c, d, c, #8 - ldrb dshort, [x, #26] - extr c, d, c, #8 - ldrb dshort, [x, #25] - extr c, d, c, #8 - ldrb dshort, [x, #24] - extr c, d, c, #8 - - str a, [z, #24] - str c, [z] - -// 1 and 2 words - - ldrb dshort, [x, #15] - extr a, d, xzr, #8 - ldrb dshort, [x, #14] - extr a, d, a, #8 - ldrb dshort, [x, #13] - extr a, d, a, #8 - ldrb dshort, [x, #12] - extr a, d, a, #8 - ldrb dshort, [x, #11] - extr a, d, a, #8 - ldrb dshort, [x, #10] - extr a, d, a, #8 - ldrb dshort, [x, #9] - extr a, d, a, #8 - ldrb dshort, [x, #8] - extr a, d, a, #8 - - ldrb dshort, [x, #23] - extr c, d, xzr, #8 - ldrb dshort, [x, #22] - extr c, d, c, #8 - ldrb dshort, [x, #21] - extr c, d, c, #8 - ldrb dshort, [x, #20] - extr c, d, c, #8 - ldrb dshort, [x, #19] - extr c, d, c, #8 - ldrb dshort, [x, #18] - extr c, d, c, #8 - ldrb dshort, [x, #17] - extr c, d, c, #8 - ldrb dshort, [x, #16] - extr c, d, c, #8 - - str a, [z, #16] - str c, [z, #8] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_bigendian_4) -S2N_BN_SIZE_DIRECTIVE(bignum_frombebytes_4) -S2N_BN_SIZE_DIRECTIVE(bignum_tobebytes_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_cmul_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_cmul_p256.S deleted file mode 100644 index 5926862d85c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_cmul_p256.S +++ /dev/null @@ -1,137 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_256, z := (c * x) mod p_256, assuming -// x reduced -// Inputs c, x[4]; output z[4] -// -// extern void bignum_cmul_p256(uint64_t z[static 4], uint64_t c, -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = c, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p256) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p256_alt) - .text - .balign 4 - -#define z x0 -#define m x1 -#define x x2 - -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 -#define h x7 -#define c x8 -#define a0 x9 -#define a1 x10 -#define a2 x11 - -// These are the same! -#define a3 x12 -#define q x12 - - -S2N_BN_SYMBOL(bignum_cmul_p256): - -S2N_BN_SYMBOL(bignum_cmul_p256_alt): - CFI_START - -// First do the multiply, straightforwardly to [d;d3;d2;d1;d0] - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - mul d0, m, a0 - mul d1, m, a1 - mul d2, m, a2 - mul d3, m, a3 - umulh a0, m, a0 - umulh a1, m, a1 - umulh a2, m, a2 - umulh h, m, a3 - adds d1, d1, a0 - adcs d2, d2, a1 - adcs d3, d3, a2 - adcs h, h, xzr - -// Writing the product as z = 2^256 * h + 2^192 * l + t = 2^192 * hl + t, our -// intended quotient approximation is (hl + hl>>32 + 1)>>64. Note that by -// hypothesis our product is <= (2^64 - 1) * (p_256 - 1), so there is no need -// to max this out to avoid wrapping, unlike in the more general case of -// bignum_mod_p256. - - subs xzr, xzr, xzr // set carry flag for +1 - extr q, h, d3, #32 - adcs xzr, d3, q - lsr q, h, #32 - adcs q, h, q - -// It's easy to see -p_256 <= z - q * p_256 < p_256, so we just need to -// subtract q * p_256 and then correct if that is negative by adding p_256. -// We want z - q * p_256 -// = (z + 2^224 * q) - (2^256 + 2^192 + 2^96 - 1) * q -// -// We just do that computation in 5 words, freely ignoring the carry, -// since we have plenty to make our later decision just based on one bit, -// so one extra word is ample. - -// First do [a2;a1] = 2^32 * q, which we use twice - - lsl a1, q, #32 - lsr a2, q, #32 - -// Add that to hl, hence including the 2^224 * q part - - adds d3, d3, a1 - adc h, h, a2 - -// Now accumulate [a2;a1;a0] = (2^96 - 1) * q. -// Remember q might be zero so we truly need a (short) carry chain here. - - subs a0, xzr, q - sbcs a1, a1, xzr - sbc a2, a2, xzr - -// Hence load remaining digits and do the subtraction - - subs d0, d0, a0 - sbcs d1, d1, a1 - sbcs d2, d2, a2 - sbcs d3, d3, q - sbcs c, h, q - -// Now our top word is either zero or all 1s, and we use this to discriminate -// whether a correction is needed because our result is negative -// So correct by adding masked p_256 - - adds d0, d0, c - mov h, #0x00000000ffffffff - and h, h, c - adcs d1, d1, h - adcs d2, d2, xzr - mov h, #0xffffffff00000001 - and h, h, c - adc d3, d3, h - -// Finally store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_deamont_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_deamont_p256.S deleted file mode 100644 index 791948b3dd3..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_deamont_p256.S +++ /dev/null @@ -1,121 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from almost-Montgomery form, z := (x / 2^256) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_deamont_p256(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Convert a 4-digit bignum x out of its (optionally almost) Montgomery form, -// "almost" meaning any 4-digit input will work, with no range restriction. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_deamont_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_deamont_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_deamont_p256) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_deamont_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_deamont_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_deamont_p256_alt) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1] and generating d4 from zero, re-using -// d0 as a temporary internally together with t0, t1 and t2. -// It is fine for d4 to be the same register as d0, and it often is. -// --------------------------------------------------------------------------- - -#define montreds(d4,d3,d2,d1,d0, t2,t1,t0) \ -/* Let w = d0, the original word we use as offset; d0 gets recycled */ \ -/* First let [t2;t1] = 2^32 * w */ \ -/* then let [d0;t0] = (2^64 - 2^32 + 1) * w (overwrite old d0) */ \ - lsl t1, d0, #32 __LF \ - subs t0, d0, t1 __LF \ - lsr t2, d0, #32 __LF \ - sbc d0, d0, t2 __LF \ -/* Hence [d4;..;d1] := [d3;d2;d1;0] + (2^256 - 2^224 + 2^192 + 2^96) * w */ \ - adds d1, d1, t1 __LF \ - adcs d2, d2, t2 __LF \ - adcs d3, d3, t0 __LF \ - adc d4, d0, xzr - -// Input parameters - -#define z x0 -#define x x1 - -// Rotating registers for the intermediate windows (with repetitions) - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 - -// Other temporaries - -#define u x6 -#define v x7 -#define w x8 - -S2N_BN_SYMBOL(bignum_deamont_p256): - -S2N_BN_SYMBOL(bignum_deamont_p256_alt): - CFI_START - -// Set up an initial window with the input x and an extra leading zero - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Systematically scroll left doing 1-step reductions - - montreds(d0,d3,d2,d1,d0, u,v,w) - - montreds(d1,d0,d3,d2,d1, u,v,w) - - montreds(d2,d1,d0,d3,d2, u,v,w) - - montreds(d3,d2,d1,d0,d3, u,v,w) - -// Now compare end result in [d3;d2;d1;d0] with p_256 = [w; 0; v; -1] - - mov v, #0x00000000ffffffff - mov w, #0xffffffff00000001 - - subs xzr, d0, #-1 - sbcs xzr, d1, v - sbcs xzr, d2, xzr - sbcs xzr, d3, w - -// Convert the condition [d3;d2;d1;d0] >= p_256 into a bitmask -// and do a masked subtraction - - csetm u, cs - - subs d0, d0, u - and v, v, u - sbcs d1, d1, v - sbcs d2, d2, xzr - and w, w, u - sbc d3, d3, w - -// Write back result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_deamont_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_demont_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_demont_p256.S deleted file mode 100644 index 136b817a5b3..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_demont_p256.S +++ /dev/null @@ -1,99 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^256) mod p_256, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_demont_p256(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// This assumes the input is < p_256 for correctness. If this is not the case, -// use the variant "bignum_deamont_p256" instead. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_p256) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_p256_alt) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1] and generating d4 from zero, re-using -// d0 as a temporary internally together with t0, t1 and t2. -// It is fine for d4 to be the same register as d0, and it often is. -// --------------------------------------------------------------------------- - -#define montreds(d4,d3,d2,d1,d0, t2,t1,t0) \ -/* Let w = d0, the original word we use as offset; d0 gets recycled */ \ -/* First let [t2;t1] = 2^32 * w */ \ -/* then let [d0;t0] = (2^64 - 2^32 + 1) * w (overwrite old d0) */ \ - lsl t1, d0, #32 __LF \ - subs t0, d0, t1 __LF \ - lsr t2, d0, #32 __LF \ - sbc d0, d0, t2 __LF \ -/* Hence [d4;..;d1] := [d3;d2;d1;0] + (2^256 - 2^224 + 2^192 + 2^96) * w */ \ - adds d1, d1, t1 __LF \ - adcs d2, d2, t2 __LF \ - adcs d3, d3, t0 __LF \ - adc d4, d0, xzr - -// Input parameters - -#define z x0 -#define x x1 - -// Rotating registers for the intermediate windows (with repetitions) - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 - -// Other temporaries - -#define u x6 -#define v x7 -#define w x8 - -S2N_BN_SYMBOL(bignum_demont_p256): - -S2N_BN_SYMBOL(bignum_demont_p256_alt): - CFI_START - -// Set up an initial window with the input x and an extra leading zero - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Systematically scroll left doing 1-step reductions - - montreds(d0,d3,d2,d1,d0, u,v,w) - - montreds(d1,d0,d3,d2,d1, u,v,w) - - montreds(d2,d1,d0,d3,d2, u,v,w) - - montreds(d3,d2,d1,d0,d3, u,v,w) - -// Write back result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_double_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_double_p256.S deleted file mode 100644 index 9041e177094..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_double_p256.S +++ /dev/null @@ -1,78 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo p_256, z := (2 * x) mod p_256, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_double_p256(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_double_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_double_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_double_p256) - .text - .balign 4 - -#define z x0 -#define x x1 -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define c x6 -#define n0 x7 -#define n1 x8 -#define n2 x9 -#define n3 x10 - - -S2N_BN_SYMBOL(bignum_double_p256): - CFI_START - -// Double the input number as 2 * x = c + [d3; d2; d1; d0] -// It's worth considering doing this with extr...63 instead - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - adds d0, d0, d0 - adcs d1, d1, d1 - adcs d2, d2, d2 - adcs d3, d3, d3 - adc c, xzr, xzr - -// Subtract p_256 to give 2 * x - p_256 = c + [n3; n2; n1; n0] - - subs n0, d0, #0xffffffffffffffff - mov n1, #0x00000000ffffffff - sbcs n1, d1, n1 - sbcs n2, d2, xzr - mov n3, #0xffffffff00000001 - sbcs n3, d3, n3 - sbcs c, c, xzr - -// Now CF is set (because of inversion) if 2 * x >= p_256, in which case the -// correct result is [n3; n2; n1; n0], otherwise [d3; d2; d1; d0] - - csel d0, d0, n0, cc - csel d1, d1, n1, cc - csel d2, d2, n2, cc - csel d3, d3, n3, cc - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_double_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_half_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_half_p256.S deleted file mode 100644 index be2555e4506..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_half_p256.S +++ /dev/null @@ -1,75 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Halve modulo p_256, z := (x / 2) mod p_256, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_half_p256(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_half_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_half_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_half_p256) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x6 -#define m x7 -#define n x8 - -S2N_BN_SYMBOL(bignum_half_p256): - CFI_START - -// Load the 4 digits of x - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Get a bitmask corresponding to the lowest bit of the input - - and m, d0, #1 - neg m, m - -// Do a masked addition of p_256, catching carry in a 5th word - - adds d0, d0, m - and n, m, #0x00000000ffffffff - adcs d1, d1, n - adcs d2, d2, xzr - and n, m, #0xffffffff00000001 - adcs d3, d3, n - adc d4, xzr, xzr - -// Now shift that sum right one place - - extr d0, d1, d0, #1 - extr d1, d2, d1, #1 - extr d2, d3, d2, #1 - extr d3, d4, d3, #1 - -// Store back - - stp d0, d1, [z] - stp d2, d3, [z, #16] - -// Return - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_half_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_inv_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_inv_p256.S deleted file mode 100644 index 2af7218bb6c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_inv_p256.S +++ /dev/null @@ -1,1279 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Modular inverse modulo p_256 = 2^256 - 2^224 + 2^192 + 2^96 - 1 -// Input x[4]; output z[4] -// -// extern void bignum_inv_p256(uint64_t z[static 4],const uint64_t x[static 4]); -// -// If the 4-digit input x is coprime to p_256, i.e. is not divisible -// by it, returns z < p_256 such that x * z == 1 (mod p_256). Note that -// x does not need to be reduced modulo p_256, but the output always is. -// If the input is divisible (i.e. is 0 or p_256), then there can be no -// modular inverse and z = 0 is returned. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_inv_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_inv_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_inv_p256) - - .text - .balign 4 - -// Size in bytes of a 64-bit word - -#define N 8 - -// Used for the return pointer - -#define res x20 - -// Loop counter and d = 2 * delta value for divstep - -#define i x21 -#define d x22 - -// Registers used for matrix element magnitudes and signs - -#define m00 x10 -#define m01 x11 -#define m10 x12 -#define m11 x13 -#define s00 x14 -#define s01 x15 -#define s10 x16 -#define s11 x17 - -// Initial carries for combinations - -#define car0 x9 -#define car1 x19 - -// Input and output, plain registers treated according to pattern - -#define reg0 x0, #0 -#define reg1 x1, #0 -#define reg2 x2, #0 -#define reg3 x3, #0 -#define reg4 x4, #0 - -#define x x1, #0 -#define z x0, #0 - -// Pointer-offset pairs for temporaries on stack - -#define f sp, #0 -#define g sp, #(6*N) -#define u sp, #(12*N) -#define v sp, #(16*N) - -// Total size to reserve on the stack - -#define NSPACE 20*N - -// --------------------------------------------------------------------------- -// Core signed almost-Montgomery reduction macro. Takes input in -// [d4;d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to -// the existing [d4;d3;d2;d1], and re-using d0 as a temporary internally -// as well as t0, t1, t2. This is almost-Montgomery, i.e. the result fits -// in 4 digits but is not necessarily strictly reduced mod p_256. -// --------------------------------------------------------------------------- - -#define amontred(d4,d3,d2,d1,d0, t2,t1,t0) \ -/* We only know the input is -2^316 < x < 2^316. To do traditional */ \ -/* unsigned Montgomery reduction, start by adding 2^61 * p_256. */ \ - mov t0, #0xe000000000000000 __LF \ - adds d0, d0, t0 __LF \ - sbcs d1, d1, xzr __LF \ - mov t1, #0x000000001fffffff __LF \ - adcs d2, d2, t1 __LF \ - mov t2, #0x2000000000000000 __LF \ - adcs d3, d3, t2 __LF \ - mov t0, #0x1fffffffe0000000 __LF \ - adc d4, d4, t0 __LF \ -/* Let w = d0, the original word we use as offset; d0 gets recycled */ \ -/* First let [t2;t1] = 2^32 * w */ \ -/* then let [d0;t0] = (2^64 - 2^32 + 1) * w (overwrite old d0) */ \ - lsl t1, d0, #32 __LF \ - subs t0, d0, t1 __LF \ - lsr t2, d0, #32 __LF \ - sbc d0, d0, t2 __LF \ -/* Hence basic [d4;d3;d2;d1] += (2^256 - 2^224 + 2^192 + 2^96) * w */ \ - adds d1, d1, t1 __LF \ - adcs d2, d2, t2 __LF \ - adcs d3, d3, t0 __LF \ - adcs d4, d4, d0 __LF \ -/* Now capture top carry and subtract p_256 if set (almost-Montgomery) */ \ - mov t0, #0xffffffffffffffff __LF \ - mov t1, #0x00000000ffffffff __LF \ - mov t2, #0xffffffff00000001 __LF \ - csel t0, t0, xzr, cs __LF \ - csel t1, t1, xzr, cs __LF \ - csel t2, t2, xzr, cs __LF \ - subs d1, d1, t0 __LF \ - sbcs d2, d2, t1 __LF \ - sbcs d3, d3, xzr __LF \ - sbc d4, d4, t2 - -// Very similar to a subroutine call to the s2n-bignum word_divstep59. -// But different in register usage and returning the final matrix in -// registers as follows -// -// [ m00 m01] -// [ m10 m11] - -#define divstep59() \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x8, x4, #0x100, lsl #12 __LF \ - sbfx x8, x8, #21, #21 __LF \ - mov x11, #0x100000 __LF \ - add x11, x11, x11, lsl #21 __LF \ - add x9, x4, x11 __LF \ - asr x9, x9, #42 __LF \ - add x10, x5, #0x100, lsl #12 __LF \ - sbfx x10, x10, #21, #21 __LF \ - add x11, x5, x11 __LF \ - asr x11, x11, #42 __LF \ - mul x6, x8, x2 __LF \ - mul x7, x9, x3 __LF \ - mul x2, x10, x2 __LF \ - mul x3, x11, x3 __LF \ - add x4, x6, x7 __LF \ - add x5, x2, x3 __LF \ - asr x2, x4, #20 __LF \ - asr x3, x5, #20 __LF \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x12, x4, #0x100, lsl #12 __LF \ - sbfx x12, x12, #21, #21 __LF \ - mov x15, #0x100000 __LF \ - add x15, x15, x15, lsl #21 __LF \ - add x13, x4, x15 __LF \ - asr x13, x13, #42 __LF \ - add x14, x5, #0x100, lsl #12 __LF \ - sbfx x14, x14, #21, #21 __LF \ - add x15, x5, x15 __LF \ - asr x15, x15, #42 __LF \ - mul x6, x12, x2 __LF \ - mul x7, x13, x3 __LF \ - mul x2, x14, x2 __LF \ - mul x3, x15, x3 __LF \ - add x4, x6, x7 __LF \ - add x5, x2, x3 __LF \ - asr x2, x4, #20 __LF \ - asr x3, x5, #20 __LF \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - mul x2, x12, x8 __LF \ - mul x3, x12, x9 __LF \ - mul x6, x14, x8 __LF \ - mul x7, x14, x9 __LF \ - madd x8, x13, x10, x2 __LF \ - madd x9, x13, x11, x3 __LF \ - madd x16, x15, x10, x6 __LF \ - madd x17, x15, x11, x7 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x12, x4, #0x100, lsl #12 __LF \ - sbfx x12, x12, #22, #21 __LF \ - mov x15, #0x100000 __LF \ - add x15, x15, x15, lsl #21 __LF \ - add x13, x4, x15 __LF \ - asr x13, x13, #43 __LF \ - add x14, x5, #0x100, lsl #12 __LF \ - sbfx x14, x14, #22, #21 __LF \ - add x15, x5, x15 __LF \ - asr x15, x15, #43 __LF \ - mneg x2, x12, x8 __LF \ - mneg x3, x12, x9 __LF \ - mneg x4, x14, x8 __LF \ - mneg x5, x14, x9 __LF \ - msub m00, x13, x16, x2 __LF \ - msub m01, x13, x17, x3 __LF \ - msub m10, x15, x16, x4 __LF \ - msub m11, x15, x17, x5 - -S2N_BN_SYMBOL(bignum_inv_p256): - CFI_START - -// Save registers and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_DEC_SP(NSPACE) - -// Save the return pointer for the end so we can overwrite x0 later - - mov res, x0 - -// Copy the prime and input into the main f and g variables respectively. -// Make sure x is reduced so that g <= f as assumed in the bound proof. - - mov x10, #0xffffffffffffffff - mov x11, #0x00000000ffffffff - mov x13, #0xffffffff00000001 - stp x10, x11, [f] - stp xzr, x13, [f+2*N] - str xzr, [f+4*N] - - ldp x2, x3, [x1] - subs x10, x2, x10 - sbcs x11, x3, x11 - ldp x4, x5, [x1, #(2*N)] - sbcs x12, x4, xzr - sbcs x13, x5, x13 - - csel x2, x2, x10, cc - csel x3, x3, x11, cc - csel x4, x4, x12, cc - csel x5, x5, x13, cc - - stp x2, x3, [g] - stp x4, x5, [g+2*N] - str xzr, [g+4*N] - -// Also maintain reduced < 2^256 vector [u,v] such that -// [f,g] == x * 2^{5*i-50} * [u,v] (mod p_256) -// starting with [p_256,x] == x * 2^{5*0-50} * [0,2^50] (mod p_256) -// The weird-looking 5*i modifications come in because we are doing -// 64-bit word-sized Montgomery reductions at each stage, which is -// 5 bits more than the 59-bit requirement to keep things stable. - - stp xzr, xzr, [u] - stp xzr, xzr, [u+2*N] - - mov x10, #0x0004000000000000 - stp x10, xzr, [v] - stp xzr, xzr, [v+2*N] - -// Start of main loop. We jump into the middle so that the divstep -// portion is common to the special tenth iteration after a uniform -// first 9. - - mov i, #10 - mov d, #1 - b Lbignum_inv_p256_midloop - -Lbignum_inv_p256_loop: - -// Separate the matrix elements into sign-magnitude pairs - - cmp m00, xzr - csetm s00, mi - cneg m00, m00, mi - - cmp m01, xzr - csetm s01, mi - cneg m01, m01, mi - - cmp m10, xzr - csetm s10, mi - cneg m10, m10, mi - - cmp m11, xzr - csetm s11, mi - cneg m11, m11, mi - -// Adjust the initial values to allow for complement instead of negation -// This initial offset is the same for [f,g] and [u,v] compositions. -// Save it in stable registers for the [u,v] part and do [f,g] first. - - and x0, m00, s00 - and x1, m01, s01 - add car0, x0, x1 - - and x0, m10, s10 - and x1, m11, s11 - add car1, x0, x1 - -// Now the computation of the updated f and g values. This maintains a -// 2-word carry between stages so we can conveniently insert the shift -// right by 59 before storing back, and not overwrite digits we need -// again of the old f and g values. -// -// Digit 0 of [f,g] - - ldr x7, [f] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [g] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - adc x2, x2, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x5, car1, x0 - adc x3, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x5, x5, x0 - adc x3, x3, x1 - -// Digit 1 of [f,g] - - ldr x7, [f+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [g+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [f] - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [g] - -// Digit 2 of [f,g] - - ldr x7, [f+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [g+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [f+N] - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [g+N] - -// Digits 3 and 4 of [f,g] - - ldr x7, [f+3*N] - eor x1, x7, s00 - ldr x23, [f+4*N] - eor x3, x23, s00 - and x3, x3, m00 - neg x3, x3 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [g+3*N] - eor x1, x8, s01 - ldr x24, [g+4*N] - eor x0, x24, s01 - and x0, x0, m01 - sub x3, x3, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [f+2*N] - extr x5, x3, x5, #59 - str x5, [f+3*N] - asr x3, x3, #59 - str x3, [f+4*N] - - eor x1, x7, s10 - eor x5, x23, s10 - and x5, x5, m10 - neg x5, x5 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, s11 - eor x0, x24, s11 - and x0, x0, m11 - sub x5, x5, x0 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x2, x2, x0 - adc x5, x5, x1 - extr x4, x2, x4, #59 - str x4, [g+2*N] - extr x2, x5, x2, #59 - str x2, [g+3*N] - asr x5, x5, #59 - str x5, [g+4*N] - -// Now the computation of the updated u and v values and their -// Montgomery reductions. A very similar accumulation except that -// the top words of u and v are unsigned and we don't shift. -// -// Digit 0 of [u,v] - - ldr x7, [u] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [v] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - str x4, [u] - adc x2, x2, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x5, car1, x0 - adc x3, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x5, x5, x0 - str x5, [v] - adc x3, x3, x1 - -// Digit 1 of [u,v] - - ldr x7, [u+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [v+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - str x2, [u+N] - adc x6, x6, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x3, x3, x0 - str x3, [v+N] - adc x4, x4, x1 - -// Digit 2 of [u,v] - - ldr x7, [u+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [v+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - str x6, [u+2*N] - adc x5, x5, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x4, x4, x0 - str x4, [v+2*N] - adc x2, x2, x1 - -// Digits 3 and 4 of u (top is unsigned) - - ldr x7, [u+3*N] - eor x1, x7, s00 - and x3, s00, m00 - neg x3, x3 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [v+3*N] - eor x1, x8, s01 - and x0, s01, m01 - sub x3, x3, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - -// Montgomery reduction of u - - ldp x0, x1, [u] - ldr x6, [u+2*N] - amontred(x3,x5,x6,x1,x0, x10,x11,x14) - stp x1, x6, [u] - stp x5, x3, [u+16] - -// Digits 3 and 4 of v (top is unsigned) - - eor x1, x7, s10 - and x5, s10, m10 - neg x5, x5 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, s11 - and x0, s11, m11 - sub x5, x5, x0 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x2, x2, x0 - adc x5, x5, x1 - -// Montgomery reduction of v - - ldp x0, x1, [v] - ldr x3, [v+2*N] - amontred(x5,x2,x3,x1,x0, x10,x11,x14) - stp x1, x3, [v] - stp x2, x5, [v+16] - -Lbignum_inv_p256_midloop: - - mov x1, d - ldr x2, [f] - ldr x3, [g] - divstep59() - mov d, x1 - -// Next iteration - - subs i, i, #1 - bne Lbignum_inv_p256_loop - -// The 10th and last iteration does not need anything except the -// u value and the sign of f; the latter can be obtained from the -// lowest word of f. So it's done differently from the main loop. -// Find the sign of the new f. For this we just need one digit -// since we know (for in-scope cases) that f is either +1 or -1. -// We don't explicitly shift right by 59 either, but looking at -// bit 63 (or any bit >= 60) of the unshifted result is enough -// to distinguish -1 from +1; this is then made into a mask. - - ldr x0, [f] - ldr x1, [g] - mul x0, x0, m00 - madd x1, x1, m01, x0 - asr x0, x1, #63 - -// Now separate out the matrix into sign-magnitude pairs -// and adjust each one based on the sign of f. -// -// Note that at this point we expect |f|=1 and we got its -// sign above, so then since [f,0] == x * [u,v] (mod p_256) -// we want to flip the sign of u according to that of f. - - cmp m00, xzr - csetm s00, mi - cneg m00, m00, mi - eor s00, s00, x0 - - cmp m01, xzr - csetm s01, mi - cneg m01, m01, mi - eor s01, s01, x0 - - cmp m10, xzr - csetm s10, mi - cneg m10, m10, mi - eor s10, s10, x0 - - cmp m11, xzr - csetm s11, mi - cneg m11, m11, mi - eor s11, s11, x0 - -// Adjust the initial value to allow for complement instead of negation - - and x0, m00, s00 - and x1, m01, s01 - add car0, x0, x1 - -// Digit 0 of [u] - - ldr x7, [u] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [v] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - str x4, [u] - adc x2, x2, x1 - -// Digit 1 of [u] - - ldr x7, [u+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [v+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - str x2, [u+N] - adc x6, x6, x1 - -// Digit 2 of [u] - - ldr x7, [u+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [v+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - str x6, [u+2*N] - adc x5, x5, x1 - -// Digits 3 and 4 of u (top is unsigned) - - ldr x7, [u+3*N] - eor x1, x7, s00 - and x3, s00, m00 - neg x3, x3 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [v+3*N] - eor x1, x8, s01 - and x0, s01, m01 - sub x3, x3, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - -// Montgomery reduction of u. This needs to be strict not "almost" -// so it is followed by an optional subtraction of p_256 - - ldp x0, x1, [u] - ldr x2, [u+2*N] - amontred(x3,x5,x2,x1,x0, x10,x11,x14) - - mov x10, #0xffffffffffffffff - subs x10, x1, x10 - mov x11, #0x00000000ffffffff - sbcs x11, x2, x11 - mov x13, #0xffffffff00000001 - sbcs x12, x5, xzr - sbcs x13, x3, x13 - - csel x10, x1, x10, cc - csel x11, x2, x11, cc - csel x12, x5, x12, cc - csel x13, x3, x13, cc - -// Store it back to the final output - - stp x10, x11, [res] - stp x12, x13, [res, #16] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_inv_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_littleendian_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_littleendian_4.S deleted file mode 100644 index 7d2efbce3f1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_littleendian_4.S +++ /dev/null @@ -1,142 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert 4-digit (256-bit) bignum to/from little-endian form -// Input x[4]; output z[4] -// -// extern void bignum_littleendian_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// The same function is given two other prototypes whose names reflect the -// treatment of one or other argument as a byte array rather than word array: -// -// extern void bignum_fromlebytes_4(uint64_t z[static 4], -// const uint8_t x[static 32]); -// -// extern void bignum_tolebytes_4(uint8_t z[static 32], -// const uint64_t x[static 4]); -// -// The implementation works by loading in bytes and storing in words (i.e. -// stylistically it is "fromlebytes"); in the more common little-endian -// usage of ARM, this is just copying. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_littleendian_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_littleendian_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_littleendian_4) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_fromlebytes_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_fromlebytes_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_fromlebytes_4) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tolebytes_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tolebytes_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tolebytes_4) - - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d x2 -#define dshort w2 -#define a x3 - -S2N_BN_SYMBOL(bignum_littleendian_4): -S2N_BN_SYMBOL(bignum_fromlebytes_4): -S2N_BN_SYMBOL(bignum_tolebytes_4): - CFI_START - -// word 0 - - ldrb dshort, [x] - extr a, d, xzr, #8 - ldrb dshort, [x, #1] - extr a, d, a, #8 - ldrb dshort, [x, #2] - extr a, d, a, #8 - ldrb dshort, [x, #3] - extr a, d, a, #8 - ldrb dshort, [x, #4] - extr a, d, a, #8 - ldrb dshort, [x, #5] - extr a, d, a, #8 - ldrb dshort, [x, #6] - extr a, d, a, #8 - ldrb dshort, [x, #7] - extr a, d, a, #8 - str a, [z] - -// word 1 - - ldrb dshort, [x, #8] - extr a, d, xzr, #8 - ldrb dshort, [x, #9] - extr a, d, a, #8 - ldrb dshort, [x, #10] - extr a, d, a, #8 - ldrb dshort, [x, #11] - extr a, d, a, #8 - ldrb dshort, [x, #12] - extr a, d, a, #8 - ldrb dshort, [x, #13] - extr a, d, a, #8 - ldrb dshort, [x, #14] - extr a, d, a, #8 - ldrb dshort, [x, #15] - extr a, d, a, #8 - str a, [z, #8] - -// word 2 - - ldrb dshort, [x, #16] - extr a, d, xzr, #8 - ldrb dshort, [x, #17] - extr a, d, a, #8 - ldrb dshort, [x, #18] - extr a, d, a, #8 - ldrb dshort, [x, #19] - extr a, d, a, #8 - ldrb dshort, [x, #20] - extr a, d, a, #8 - ldrb dshort, [x, #21] - extr a, d, a, #8 - ldrb dshort, [x, #22] - extr a, d, a, #8 - ldrb dshort, [x, #23] - extr a, d, a, #8 - str a, [z, #16] - -// word 3 - - ldrb dshort, [x, #24] - extr a, d, xzr, #8 - ldrb dshort, [x, #25] - extr a, d, a, #8 - ldrb dshort, [x, #26] - extr a, d, a, #8 - ldrb dshort, [x, #27] - extr a, d, a, #8 - ldrb dshort, [x, #28] - extr a, d, a, #8 - ldrb dshort, [x, #29] - extr a, d, a, #8 - ldrb dshort, [x, #30] - extr a, d, a, #8 - ldrb dshort, [x, #31] - extr a, d, a, #8 - str a, [z, #24] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_littleendian_4) -S2N_BN_SIZE_DIRECTIVE(bignum_fromlebytes_4) -S2N_BN_SIZE_DIRECTIVE(bignum_tolebytes_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_n256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_n256.S deleted file mode 100644 index 22fbbaefb80..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_n256.S +++ /dev/null @@ -1,181 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_256 -// Input x[k]; output z[4] -// -// extern void bignum_mod_n256(uint64_t z[static 4], uint64_t k, -// const uint64_t *x); -// -// Reduction is modulo the group order of the NIST curve P-256. -// -// Standard ARM ABI: X0 = z, X1 = k, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n256) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n256_alt) - .text - .balign 4 - -#define z x0 -#define k x1 -#define x x2 - -#define m0 x3 -#define m1 x4 -#define m2 x5 -#define m3 x6 - -#define t0 x7 -#define t1 x8 -#define t2 x9 -#define t3 x10 -#define t4 x11 - -#define n0 x12 -#define n1 x13 -#define n3 x14 - -// These two are aliased: we only load d when finished with q - -#define q x15 -#define d x15 - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(bignum_mod_n256): - -S2N_BN_SYMBOL(bignum_mod_n256_alt): - CFI_START - -// If the input is already <= 3 words long, go to a trivial "copy" path - - cmp k, #4 - bcc Lbignum_mod_n256_short - -// Otherwise load the top 4 digits (top-down) and reduce k by 4 - - sub k, k, #4 - lsl t0, k, #3 - add t0, t0, x - ldp m2, m3, [t0, #16] - ldp m0, m1, [t0] - -// Load the complicated three words of 2^256 - n_256 = [n3; 0; n1; n0] - - movbig( n0, #0x0c46, #0x353d, #0x039c, #0xdaaf) - movbig( n1, #0x4319, #0x0552, #0x58e8, #0x617b) - mov n3, #0x00000000ffffffff - -// Reduce the top 4 digits mod n_256 (a conditional subtraction of n_256) - - adds t0, m0, n0 - adcs t1, m1, n1 - adcs t2, m2, xzr - adcs t3, m3, n3 - csel m0, m0, t0, cc - csel m1, m1, t1, cc - csel m2, m2, t2, cc - csel m3, m3, t3, cc - -// Now do (k-4) iterations of 5->4 word modular reduction - - cbz k, Lbignum_mod_n256_writeback -Lbignum_mod_n256_loop: - -// Writing the input as z = 2^256 * m3 + 2^192 * m2 + t = 2^192 * h + t, our -// intended quotient approximation is MIN ((h + h>>32 + 1)>>64) (2^64 - 1). - - subs xzr, xzr, xzr // set carry flag for +1 - extr q, m3, m2, #32 - adcs xzr, m2, q - lsr q, m3, #32 - adcs q, m3, q - csetm t0, cs - orr q, q, t0 - -// [t4;t3;t2;t1;t0] = q * (2^256 - n_256) - - mul t0, n0, q - mul t1, n1, q - mul t3, n3, q - umulh t2, n0, q - adds t1, t1, t2 - umulh t2, n1, q - adc t2, t2, xzr // No carry: high of mul + {0,1} - umulh t4, n3, q - -// Compensate for 2^256 * q - - sub m3, m3, q - -// Decrement k and load the next digit (note that d aliases to q) - - sub k, k, #1 - ldr d, [x, k, lsl #3] - -// [t4;t3;t2;t1;t0] = [m3;m2;m1;m0;d] - q * n_256 - - adds t0, d, t0 - adcs t1, m0, t1 - adcs t2, m1, t2 - adcs t3, m2, t3 - adc t4, m3, t4 - -// Now our top word t4 is either zero or all 1s. Use it for a masked -// addition of n_256, which we can do by a *subtraction* of -// 2^256 - n_256 from our portion, re-using the constants - - and d, t4, n0 - subs m0, t0, d - and d, t4, n1 - sbcs m1, t1, d - sbcs m2, t2, xzr - and d, t4, n3 - sbc m3, t3, d - - cbnz k, Lbignum_mod_n256_loop - -// Finally write back [m3;m2;m1;m0] and return - -Lbignum_mod_n256_writeback: - stp m0, m1, [z] - stp m2, m3, [z, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n256) - -// Short case: just copy the input with zero-padding - -Lbignum_mod_n256_short: - mov m0, xzr - mov m1, xzr - mov m2, xzr - mov m3, xzr - - cbz k, Lbignum_mod_n256_writeback - ldr m0, [x] - subs k, k, #1 - beq Lbignum_mod_n256_writeback - ldr m1, [x, #8] - subs k, k, #1 - beq Lbignum_mod_n256_writeback - ldr m2, [x, #16] - b Lbignum_mod_n256_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_n256_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_n256_4.S deleted file mode 100644 index df2947b42d6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_n256_4.S +++ /dev/null @@ -1,85 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_256 -// Input x[4]; output z[4] -// -// extern void bignum_mod_n256_4(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Reduction is modulo the group order of the NIST curve P-256. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n256_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n256_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n256_4) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define n0 x2 -#define n1 x3 -#define n2 x4 -#define n3 x5 - -#define d0 x6 -#define d1 x7 -#define d2 x8 -#define d3 x9 - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(bignum_mod_n256_4): - CFI_START - -// Load the complicated three words of n_256, the other being all 1s - - movbig( n0, #0xf3b9, #0xcac2, #0xfc63, #0x2551) - movbig( n1, #0xbce6, #0xfaad, #0xa717, #0x9e84) - mov n3, #0xffffffff00000000 - -// Load the input number - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Do the subtraction. Since word 2 of n_256 is all 1s, that can be -// done by adding zero with carry, thanks to the inverted carry. - - subs n0, d0, n0 - sbcs n1, d1, n1 - adcs n2, d2, xzr - sbcs n3, d3, n3 - -// Now if the carry is *clear* (inversion at work) the subtraction carried -// and hence we should have done nothing, so we reset each n_i = d_i - - csel n0, d0, n0, cc - csel n1, d1, n1, cc - csel n2, d2, n2, cc - csel n3, d3, n3, cc - -// Store the end result - - stp n0, n1, [z] - stp n2, n3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n256_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_p256.S deleted file mode 100644 index 9078fbdf8a0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_p256.S +++ /dev/null @@ -1,168 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_256 -// Input x[k]; output z[4] -// -// extern void bignum_mod_p256(uint64_t z[static 4], uint64_t k, -// const uint64_t *x); -// -// Standard ARM ABI: X0 = z, X1 = k, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p256) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p256_alt) - .text - .balign 4 - -#define z x0 -#define k x1 -#define x x2 - -#define m0 x3 -#define m1 x4 -#define m2 x5 -#define m3 x6 - -#define t0 x7 -#define t1 x8 -#define t2 x9 -#define t3 x10 -#define t4 x11 - -#define n1 x12 -#define n3 x13 - -#define q x14 - - -S2N_BN_SYMBOL(bignum_mod_p256): - -S2N_BN_SYMBOL(bignum_mod_p256_alt): - CFI_START - -// If the input is already <= 3 words long, go to a trivial "copy" path - - cmp k, #4 - bcc Lbignum_mod_p256_short - -// Otherwise load the top 4 digits (top-down) and reduce k by 4 - - sub k, k, #4 - lsl t0, k, #3 - add t0, t0, x - ldp m2, m3, [t0, #16] - ldp m0, m1, [t0] - -// Load the complicated words of p_256 = [n3;0;n1;-1] - - mov n1, #0x00000000ffffffff - mov n3, #0xffffffff00000001 - -// Reduce the top 4 digits mod p_256 (a conditional subtraction of p_256) - - subs t0, m0, #-1 - sbcs t1, m1, n1 - sbcs t2, m2, xzr - sbcs t3, m3, n3 - - csel m0, m0, t0, cc - csel m1, m1, t1, cc - csel m2, m2, t2, cc - csel m3, m3, t3, cc - -// Now do (k-4) iterations of 5->4 word modular reduction - - cbz k, Lbignum_mod_p256_writeback -Lbignum_mod_p256_loop: - -// Decrement k and load the next digit as t0. We then want to reduce -// [m3;m2;m1;m0;t0] |-> [m3;m2;m1;m0]; the shuffling downwards is absorbed -// into the various ALU operations - - sub k, k, #1 - ldr t0, [x, k, lsl #3] - -// Writing the input as z = 2^256 * h + 2^192 * l + t = 2^192 * hl + t, our -// intended quotient approximation is MIN ((hl + hl>>32 + 1)>>64) (2^64 - 1). - - subs xzr, xzr, xzr // set carry flag for +1 - extr q, m3, m2, #32 - adcs xzr, m2, q - lsr q, m3, #32 - adcs q, m3, q - csetm t1, cs - orr q, q, t1 - -// First do [t2;t1] = 2^32 * q, which we use twice - - lsl t1, q, #32 - lsr t2, q, #32 - -// Add 2^224 * q to sum - - adds t3, m2, t1 - adc t4, m3, t2 - -// Accumulate [t2;t1;m3] = (2^96 - 1) * q, using m3 briefly as a temporary - - subs m3, xzr, q - sbcs t1, t1, xzr - sbc t2, t2, xzr - -// Subtract (2^256 + 2^192 + 2^96 - 1) * q - - subs t0, t0, m3 - sbcs t1, m0, t1 - sbcs t2, m1, t2 - sbcs t3, t3, q - sbc t4, t4, q - -// Use top word as mask to correct - - adds m0, t0, t4 - and t0, n1, t4 - adcs m1, t1, t0 - adcs m2, t2, xzr - and t0, n3, t4 - adc m3, t3, t0 - - cbnz k, Lbignum_mod_p256_loop - -// Finally write back [m3;m2;m1;m0] and return - -Lbignum_mod_p256_writeback: - stp m0, m1, [z] - stp m2, m3, [z, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p256) - -// Short case: just copy the input with zero-padding - -Lbignum_mod_p256_short: - mov m0, xzr - mov m1, xzr - mov m2, xzr - mov m3, xzr - - cbz k, Lbignum_mod_p256_writeback - ldr m0, [x] - subs k, k, #1 - beq Lbignum_mod_p256_writeback - ldr m1, [x, #8] - subs k, k, #1 - beq Lbignum_mod_p256_writeback - ldr m2, [x, #16] - b Lbignum_mod_p256_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_p256_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_p256_4.S deleted file mode 100644 index 2c750816e37..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mod_p256_4.S +++ /dev/null @@ -1,75 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_mod_p256_4(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p256_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p256_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p256_4) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define n0 x2 -#define n1 x3 -#define n2 x4 -#define n3 x5 - -#define d0 x6 -#define d1 x7 -#define d2 x8 -#define d3 x9 - - -S2N_BN_SYMBOL(bignum_mod_p256_4): - CFI_START - -// Load the three nonzero words of p_256 = [n3;0;n2;n1] - - mov n0, #0xffffffffffffffff - mov n1, #0x00000000ffffffff - mov n3, #0xffffffff00000001 - -// Load the input number - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Do the subtraction. - - subs n0, d0, n0 - sbcs n1, d1, n1 - sbcs n2, d2, xzr - sbcs n3, d3, n3 - -// Now if the carry is *clear* (inversion at work) the subtraction carried -// and hence we should have done nothing, so we reset each n_i = d_i - - csel n0, d0, n0, cc - csel n1, d1, n1, cc - csel n2, d2, n2, cc - csel n3, d3, n3, cc - -// Store the end result - - stp n0, n1, [z] - stp n2, n3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p256_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montmul_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montmul_p256.S deleted file mode 100644 index effb9ec5062..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montmul_p256.S +++ /dev/null @@ -1,468 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_256 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_p256(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_256, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_256 (in particular this is true if we are in -// the "usual" case x < p_256 and y < p_256). -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -// bignum_montmul_p256 is functionally equivalent to -// unopt/bignum_montmul_p256_base. -// It is written in a way that -// 1. A subset of scalar multiplications in bignum_montmul_p256_base are carefully -// chosen and vectorized -// 2. The vectorized assembly is rescheduled using the SLOTHY superoptimizer. -// https://github.com/slothy-optimizer/slothy -// -// The output program of step 1. is as follows: -// -// ldp x7, x13, [x1] -// ldr q16, [x1] -// ldp x9, x15, [x1, #16] -// ldp x14, x4, [x2] -// ldr q19, [x2] -// ldp x12, x16, [x2, #16] -// ldr q29, [x1, #16] -// ldr q30, [x2, #16] -// uzp1 v17.4S, v19.4S, v16.4S -// rev64 v18.4S, v19.4S -// uzp1 v28.4S, v16.4S, v16.4S -// mul v24.4S, v18.4S, v16.4S -// uaddlp v18.2D, v24.4S -// shl v16.2D, v18.2D, #32 -// umlal v16.2D, v28.2S, v17.2S -// mov x2, v16.d[0] -// mov x1, v16.d[1] -// umulh x5, x7, x14 -// adds x17, x2, x1 -// umulh x3, x13, x4 -// adcs x8, x5, x3 -// adcs x10, x3, xzr -// adds x5, x5, x17 -// adcs x1, x1, x8 -// adcs x8, x10, xzr -// subs x17, x7, x13 -// cneg x3, x17, cc -// csetm x11, cc -// subs x10, x4, x14 -// cneg x6, x10, cc -// mul x17, x3, x6 -// umulh x6, x3, x6 -// cinv x11, x11, cc -// eor x17, x17, x11 -// eor x3, x6, x11 -// cmn x11, #0x1 -// adcs x5, x5, x17 -// adcs x10, x1, x3 -// adc x1, x8, x11 -// lsl x3, x2, #32 -// subs x17, x2, x3 -// lsr x11, x2, #32 -// sbc x8, x2, x11 -// adds x2, x5, x3 -// adcs x6, x10, x11 -// adcs x3, x1, x17 -// adc x10, x8, xzr -// lsl x5, x2, #32 -// subs x17, x2, x5 -// lsr x11, x2, #32 -// sbc x8, x2, x11 -// adds x2, x6, x5 -// adcs x6, x3, x11 -// adcs x1, x10, x17 -// adc x17, x8, xzr -// stp x2, x6, [x0] // @slothy:writes=buffer0 -// stp x1, x17, [x0, #16] // @slothy:writes=buffer16 -// movi v28.2D, #0x00000000ffffffff -// uzp2 v22.4S, v30.4S, v30.4S -// xtn v4.2S, v29.2D -// xtn v27.2S, v30.2D -// rev64 v23.4S, v30.4S -// umull v17.2D, v4.2S, v27.2S -// umull v7.2D, v4.2S, v22.2S -// uzp2 v16.4S, v29.4S, v29.4S -// mul v29.4S, v23.4S, v29.4S -// usra v7.2D, v17.2D, #32 -// umull v30.2D, v16.2S, v22.2S -// uaddlp v20.2D, v29.4S -// and v18.16B, v7.16B, v28.16B -// umlal v18.2D, v16.2S, v27.2S -// shl v16.2D, v20.2D, #32 -// usra v30.2D, v7.2D, #32 -// umlal v16.2D, v4.2S, v27.2S -// usra v30.2D, v18.2D, #32 -// mov x11, v16.d[0] -// mov x5, v16.d[1] -// mov x2, v30.d[0] -// adds x3, x11, x5 -// mov x17, v30.d[1] -// adcs x8, x2, x17 -// adcs x1, x17, xzr -// adds x17, x2, x3 -// adcs x8, x5, x8 -// adcs x1, x1, xzr -// subs x2, x9, x15 -// cneg x6, x2, cc -// csetm x3, cc -// subs x2, x16, x12 -// cneg x5, x2, cc -// mul x10, x6, x5 -// umulh x5, x6, x5 -// cinv x3, x3, cc -// eor x10, x10, x3 -// eor x6, x5, x3 -// cmn x3, #0x1 -// adcs x2, x17, x10 -// adcs x6, x8, x6 -// adc x5, x1, x3 -// subs x7, x9, x7 -// sbcs x3, x15, x13 -// ngc x17, xzr -// cmn x17, #0x1 -// eor x8, x7, x17 -// adcs x13, x8, xzr -// eor x15, x3, x17 -// adcs x1, x15, xzr -// subs x9, x14, x12 -// sbcs x14, x4, x16 -// ngc x3, xzr -// cmn x3, #0x1 -// eor x12, x9, x3 -// adcs x7, x12, xzr -// eor x12, x14, x3 -// adcs x12, x12, xzr -// eor x10, x17, x3 -// ldp x4, x15, [x0] // @slothy:reads=buffer0 -// adds x17, x11, x4 -// adcs x16, x2, x15 -// ldp x3, x15, [x0, #16] // @slothy:reads=buffer16 -// adcs x11, x6, x3 -// adcs x9, x5, x15 -// adc x14, xzr, xzr -// mul x6, x13, x7 -// mul x8, x1, x12 -// umulh x5, x13, x7 -// adds x3, x6, x8 -// umulh x2, x1, x12 -// adcs x4, x5, x2 -// adcs x15, x2, xzr -// adds x3, x5, x3 -// adcs x4, x8, x4 -// adcs x15, x15, xzr -// subs x1, x13, x1 -// cneg x8, x1, cc -// csetm x5, cc -// subs x1, x12, x7 -// cneg x2, x1, cc -// mul x7, x8, x2 -// umulh x2, x8, x2 -// cinv x13, x5, cc -// eor x7, x7, x13 -// eor x2, x2, x13 -// cmn x13, #0x1 -// adcs x3, x3, x7 -// adcs x4, x4, x2 -// adc x5, x15, x13 -// cmn x10, #0x1 -// eor x8, x6, x10 -// adcs x15, x8, x17 -// eor x2, x3, x10 -// adcs x2, x2, x16 -// eor x6, x4, x10 -// adcs x3, x6, x11 -// eor x7, x5, x10 -// adcs x1, x7, x9 -// adcs x13, x14, x10 -// adcs x12, x10, xzr -// adc x10, x10, xzr -// adds x5, x3, x17 -// adcs x8, x1, x16 -// adcs x13, x13, x11 -// adcs x6, x12, x9 -// adc x4, x10, x14 -// lsl x9, x15, #32 -// subs x7, x15, x9 -// lsr x1, x15, #32 -// sbc x14, x15, x1 -// adds x10, x2, x9 -// adcs x15, x5, x1 -// adcs x5, x8, x7 -// adc x7, x14, xzr -// lsl x12, x10, #32 -// subs x17, x10, x12 -// lsr x9, x10, #32 -// sbc x3, x10, x9 -// adds x12, x15, x12 -// adcs x5, x5, x9 -// adcs x14, x7, x17 -// adc x2, x3, xzr -// adds x14, x13, x14 -// adcs x6, x6, x2 -// adc x17, x4, xzr -// add x7, x17, #0x1 -// lsl x16, x7, #32 -// adds x3, x6, x16 -// adc x1, x17, xzr -// neg x15, x7 -// sub x13, x16, #0x1 -// subs x9, x12, x15 -// sbcs x8, x5, x13 -// sbcs x15, x14, xzr -// sbcs x3, x3, x7 -// sbcs x7, x1, x7 -// adds x4, x9, x7 -// mov x6, #0xffffffff -// and x17, x6, x7 -// adcs x8, x8, x17 -// adcs x5, x15, xzr -// mov x10, #0xffffffff00000001 -// and x1, x10, x7 -// adc x12, x3, x1 -// stp x4, x8, [x0] // @slothy:writes=buffer0 -// stp x5, x12, [x0, #16] // @slothy:writes=buffer16 -// ret -// -// The bash script used for step 2 is as follows: -// -// # Store the assembly instructions except the last 'ret' as, say, 'input.S' -// export OUTPUTS="[hint_buffer0,hint_buffer16]" -// export RESERVED_REGS="[x18,x19,x20,x21,x22,x23,x24,x25,x26,x27,x28,x29,x30,sp,q8,q9,q10,q11,q12,q13,q14,q15,v8,v9,v10,v11,v12,v13,v14,v15]" -// /tools/external/slothy.sh input.S my_out_dir -// # my_out_dir/3.opt.s is the optimized assembly. Its output may differ -// # from this file since the sequence is non-deterministically chosen. -// # Please add 'ret' at the end of the output assembly. - - - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p256) - .text - .balign 4 - -S2N_BN_SYMBOL(bignum_montmul_p256): - CFI_START - - ldr q20, [x2] - ldp x7, x17, [x1] - ldr q0, [x1] - ldp x6, x10, [x2] - ldp x11, x15, [x1, #16] - rev64 v16.4S, v20.4S - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4S, v16.4S, v0.4S - umulh x12, x17, x10 - uzp1 v28.4S, v20.4S, v0.4S - subs x14, x11, x7 - ldr q20, [x2, #16] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2D, v16.4S - umulh x4, x7, x6 - uzp1 v21.4S, v0.4S, v0.4S - cneg x11, x8, cc - shl v17.2D, v27.2D, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2D, v21.2S, v28.2S - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [x1, #16] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2S, v20.2D - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4S, v20.4S, v20.4S - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2S, v28.2D - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x2, #16] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x9, x3, x13 - adcs x3, x8, x7 - umulh x8, x14, x11 - umull v21.2D, v0.2S, v1.2S - adcs x12, x10, x12 - umull v3.2D, v0.2S, v16.2S - adc x15, x15, xzr - rev64 v24.4S, v20.4S - stp x12, x15, [x0, #16] - movi v2.2D, #0x00000000ffffffff - mul x10, x14, x11 - mul v4.4S, v24.4S, v28.4S - subs x13, x14, x5 - uzp2 v19.4S, v28.4S, v28.4S - csetm x15, cc - usra v3.2D, v21.2D, #32 - mul x7, x5, x1 - umull v21.2D, v19.2S, v16.2S - cneg x13, x13, cc - uaddlp v5.2D, v4.4S - subs x11, x1, x11 - and v16.16B, v3.16B, v2.16B - umulh x5, x5, x1 - shl v24.2D, v5.2D, #32 - cneg x11, x11, cc - umlal v16.2D, v19.2S, v1.2S - cinv x12, x15, cc - umlal v24.2D, v0.2S, v1.2S - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - stp x9, x3, [x0] - usra v21.2D, v3.2D, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2D, v16.2D, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - ldp x15, x8, [x0] - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - ldp x9, x13, [x0, #16] - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x15 - adcs x15, x16, x8 - eor x5, x17, x4 - adcs x9, x1, x9 - eor x1, x10, x5 - adcs x16, x2, x13 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [x0] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montmul_p256_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montmul_p256_alt.S deleted file mode 100644 index 00ae388e191..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montmul_p256_alt.S +++ /dev/null @@ -1,211 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_256 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_p256_alt(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_256, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_256 (in particular this is true if we are in -// the "usual" case x < p_256 and y < p_256). -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p256_alt) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1] and generating d4 from zero, re-using -// d0 as a temporary internally together with tmp. The "mc" parameter is -// assumed to be a register whose value is 0xFFFFFFFF00000001. -// It is fine for d4 to be the same register as d0, and it often is. -// --------------------------------------------------------------------------- - -#define montreds(d4,d3,d2,d1,d0, tmp,mc) \ - adds d1, d1, d0, lsl #32 __LF \ - lsr tmp, d0, #32 __LF \ - adcs d2, d2, tmp __LF \ - mul tmp, d0, mc __LF \ - umulh d4, d0, mc __LF \ - adcs d3, d3, tmp __LF \ - adc d4, d4, xzr - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define b0 x7 -#define b1 x8 -#define b2 x9 -#define b3 x10 - -#define l x11 - -#define u0 x12 -#define u1 x13 -#define u2 x14 -#define u3 x15 -#define u4 x16 - -// These alias to the input arguments when no longer needed - -#define u5 a0 -#define u6 a1 -#define u7 a2 -#define h a3 -#define mc b3 - -S2N_BN_SYMBOL(bignum_montmul_p256_alt): - CFI_START - -// Load operands and set up row 0 = [u4;...;u0] = a0 * [b3;...;b0] - - ldp a0, a1, [x] - ldp b0, b1, [y] - - mul u0, a0, b0 - umulh u1, a0, b0 - mul l, a0, b1 - umulh u2, a0, b1 - adds u1, u1, l - - ldp b2, b3, [y, #16] - - mul l, a0, b2 - umulh u3, a0, b2 - adcs u2, u2, l - - mul l, a0, b3 - umulh u4, a0, b3 - adcs u3, u3, l - adc u4, u4, xzr - - ldp a2, a3, [x, #16] - -// Row 1 = [u5;...;u0] = [a1;a0] * [b3;...;b0] - - mul l, a1, b0 - adds u1, u1, l - mul l, a1, b1 - adcs u2, u2, l - mul l, a1, b2 - adcs u3, u3, l - mul l, a1, b3 - adcs u4, u4, l - umulh u5, a1, b3 - adc u5, u5, xzr - - umulh l, a1, b0 - adds u2, u2, l - umulh l, a1, b1 - adcs u3, u3, l - umulh l, a1, b2 - adcs u4, u4, l - adc u5, u5, xzr - -// Row 2 = [u6;...;u0] = [a2;a1;a0] * [b3;...;b0] - - mul l, a2, b0 - adds u2, u2, l - mul l, a2, b1 - adcs u3, u3, l - mul l, a2, b2 - adcs u4, u4, l - mul l, a2, b3 - adcs u5, u5, l - umulh u6, a2, b3 - adc u6, u6, xzr - - umulh l, a2, b0 - adds u3, u3, l - umulh l, a2, b1 - adcs u4, u4, l - umulh l, a2, b2 - adcs u5, u5, l - adc u6, u6, xzr - -// Row 3 = [u7;...;u0] = [a3;...a0] * [b3;...;b0] -// Interleave the first Montgomery rotation of the low half - - mul l, a3, b0 - adds u3, u3, l - mul l, a3, b1 - adcs u4, u4, l - mul l, a3, b2 - adcs u5, u5, l - mul l, a3, b3 - adcs u6, u6, l - umulh u7, a3, b3 - adc u7, u7, xzr - - mov mc, 0xFFFFFFFF00000001 - montreds(u0,u3,u2,u1,u0, l,mc) - - umulh l, a3, b0 - adds u4, u4, l - umulh l, a3, b1 - adcs u5, u5, l - umulh l, a3, b2 - adcs u6, u6, l - adc u7, u7, xzr - -// Perform 3 further Montgomery steps to rotate the lower half - - montreds(u1,u0,u3,u2,u1, l,mc) - montreds(u2,u1,u0,u3,u2, l,mc) - montreds(u3,u2,u1,u0,u3, l,mc) - -// Add high and low parts, catching carry in b1 - - adds u0, u0, u4 - adcs u1, u1, u5 - adcs u2, u2, u6 - adcs u3, u3, u7 - cset b1, cs - -// Set [mc;0;l;-1] = p_256 and form [u7,u6,u5,u4] = [b1;u3;u2;u1;u0] - p_256 - - mov l, #0x00000000ffffffff - - subs u4, u0, #-1 - sbcs u5, u1, l - sbcs u6, u2, xzr - sbcs u7, u3, mc - sbcs xzr, b1, xzr - -// Now CF is clear if the comparison carried so the original was fine -// Otherwise take the form with p_256 subtracted. - - csel u0, u0, u4, cc - csel u1, u1, u5, cc - csel u2, u2, u6, cc - csel u3, u3, u7, cc - -// Store back final result - - stp u0, u1, [z] - stp u2, u3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_p256_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montsqr_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montsqr_p256.S deleted file mode 100644 index 2da1136e21e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montsqr_p256.S +++ /dev/null @@ -1,330 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_p256(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_256, assuming x^2 <= 2^256 * p_256, which is -// guaranteed in particular if x < p_256 initially (the "intended" case). -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -// bignum_montsqr_p256 is functionally equivalent to -// unopt/bignum_montsqr_p256_base. -// It is written in a way that -// 1. A subset of scalar multiplications in bignum_montsqr_p256_base are carefully -// chosen and vectorized -// 2. The vectorized assembly is rescheduled using the SLOTHY superoptimizer. -// https://github.com/slothy-optimizer/slothy -// -// The output program of step 1. is as follows: -// -// ldp x7, x3, [x1] -// ldr q6, [x1] -// ldp x9, x8, [x1, #16] -// ldr q18, [x1, #16] -// ldr q27, [x1] -// umull v16.2D, v27.2S, v27.2S -// umull2 v17.2D, v27.4S, v27.4S -// xtn v30.2S, v27.2D -// uzp2 v27.4S, v27.4S, v27.4S -// umull v27.2D, v27.2S, v30.2S -// mov x6, v16.d[0] -// mov x12, v16.d[1] -// mov x13, v17.d[0] -// mov x1, v17.d[1] -// mov x15, v27.d[0] -// mov x10, v27.d[1] -// adds x4, x6, x15, lsl #33 -// lsr x6, x15, #31 -// adc x15, x12, x6 -// adds x13, x13, x10, lsl #33 -// lsr x6, x10, #31 -// adc x12, x1, x6 -// mul x6, x7, x3 -// umulh x1, x7, x3 -// adds x5, x15, x6, lsl #1 -// extr x6, x1, x6, #63 -// adcs x10, x13, x6 -// lsr x6, x1, #63 -// adc x15, x12, x6 -// lsl x6, x4, #32 -// subs x13, x4, x6 -// lsr x12, x4, #32 -// sbc x1, x4, x12 -// adds x6, x5, x6 -// adcs x5, x10, x12 -// adcs x10, x15, x13 -// adc x15, x1, xzr -// lsl x13, x6, #32 -// subs x12, x6, x13 -// lsr x1, x6, #32 -// sbc x6, x6, x1 -// adds x16, x5, x13 -// adcs x11, x10, x1 -// adcs x2, x15, x12 -// adc x17, x6, xzr -// uzp1 v30.4S, v18.4S, v6.4S -// rev64 v27.4S, v18.4S -// uzp1 v18.4S, v6.4S, v6.4S -// mul v27.4S, v27.4S, v6.4S -// uaddlp v5.2D, v27.4S -// shl v6.2D, v5.2D, #32 -// umlal v6.2D, v18.2S, v30.2S -// mov x4, v6.d[0] -// mov x5, v6.d[1] -// umulh x10, x7, x9 -// subs x6, x7, x3 -// cneg x13, x6, cc -// csetm x12, cc -// subs x6, x8, x9 -// cneg x6, x6, cc -// mul x1, x13, x6 -// umulh x6, x13, x6 -// cinv x15, x12, cc -// eor x12, x1, x15 -// eor x13, x6, x15 -// adds x1, x4, x10 -// adc x6, x10, xzr -// umulh x3, x3, x8 -// adds x1, x1, x5 -// adcs x6, x6, x3 -// adc x3, x3, xzr -// adds x6, x6, x5 -// adc x3, x3, xzr -// cmn x15, #0x1 -// adcs x12, x1, x12 -// adcs x1, x6, x13 -// adc x3, x3, x15 -// adds x6, x4, x4 -// adcs x13, x12, x12 -// adcs x12, x1, x1 -// adcs x1, x3, x3 -// adc x3, xzr, xzr -// adds x6, x6, x16 -// adcs x5, x13, x11 -// adcs x10, x12, x2 -// adcs x15, x1, x17 -// adc x13, x3, xzr -// lsl x3, x6, #32 -// subs x12, x6, x3 -// lsr x1, x6, #32 -// sbc x6, x6, x1 -// adds x3, x5, x3 -// adcs x5, x10, x1 -// adcs x15, x15, x12 -// adcs x13, x13, x6 -// adc x10, xzr, xzr -// lsl x6, x3, #32 -// subs x12, x3, x6 -// lsr x1, x3, #32 -// sbc x3, x3, x1 -// adds x6, x5, x6 -// adcs x15, x15, x1 -// adcs x13, x13, x12 -// adcs x12, x10, x3 -// adc x1, xzr, xzr -// mul x3, x9, x9 -// adds x5, x6, x3 -// mul x6, x8, x8 -// umulh x3, x9, x9 -// adcs x15, x15, x3 -// adcs x13, x13, x6 -// umulh x3, x8, x8 -// adcs x12, x12, x3 -// adc x1, x1, xzr -// mul x6, x9, x8 -// umulh x3, x9, x8 -// adds x8, x6, x6 -// adcs x9, x3, x3 -// adc x3, xzr, xzr -// adds x10, x15, x8 -// adcs x15, x13, x9 -// adcs x13, x12, x3 -// adcs x12, x1, xzr -// mov x3, #0xffffffff -// adds x6, x5, #0x1 -// sbcs x8, x10, x3 -// mov x3, #0xffffffff00000001 -// sbcs x9, x15, xzr -// sbcs x1, x13, x3 -// sbcs xzr, x12, xzr -// csel x6, x6, x5, cs -// csel x8, x8, x10, cs -// csel x9, x9, x15, cs -// csel x3, x1, x13, cs -// stp x6, x8, [x0] // @slothy:writes=buffer0 -// stp x9, x3, [x0, #16] // @slothy:writes=buffer16 -// ret -// -// The bash script used for step 2 is as follows: -// -// # Store the assembly instructions except the last 'ret' as, say, 'input.S' -// export OUTPUTS="[hint_buffer0,hint_buffer16]" -// export RESERVED_REGS="[x18,x19,x20,x21,x22,x23,x24,x25,x26,x27,x28,x29,x30,sp,q8,q9,q10,q11,q12,q13,q14,q15,v8,v9,v10,v11,v12,v13,v14,v15]" -// /tools/external/slothy.sh input.S my_out_dir -// # my_out_dir/3.opt.s is the optimized assembly. Its output may differ -// # from this file since the sequence is non-deterministically chosen. -// # Please add 'ret' at the end of the output assembly. - - - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p256) - .text - .balign 4 - -S2N_BN_SYMBOL(bignum_montsqr_p256): - CFI_START - - ldr q19, [x1] - ldp x9, x13, [x1] - ldr q23, [x1, #16] - ldr q0, [x1] - ldp x1, x10, [x1, #16] - uzp2 v29.4S, v19.4S, v19.4S - xtn v4.2S, v19.2D - umulh x8, x9, x13 - rev64 v20.4S, v23.4S - umull v16.2D, v19.2S, v19.2S - umull v1.2D, v29.2S, v4.2S - mul v20.4S, v20.4S, v0.4S - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2D, v19.4S, v19.4S - mov x4, v16.d[0] - uzp1 v17.4S, v23.4S, v0.4S - uaddlp v19.2D, v20.4S - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4S, v0.4S, v0.4S - shl v19.2D, v19.2D, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2D, v20.2S, v17.2S - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x16, x3, x16, cs - csel x14, x8, x14, cs - csel x12, x11, x12, cs - csel x2, x5, x2, cs - stp x14, x12, [x0, #16] - stp x16, x2, [x0] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montsqr_p256_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montsqr_p256_alt.S deleted file mode 100644 index fca64e16122..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_montsqr_p256_alt.S +++ /dev/null @@ -1,188 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_p256_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_256, assuming x^2 <= 2^256 * p_256, which is -// guaranteed in particular if x < p_256 initially (the "intended" case). -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p256_alt) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1] and generating d4 from zero, re-using -// d0 as a temporary internally together with "tmp". The "mc" parameter is -// assumed to be a register whose value is 0xFFFFFFFF00000001. -// It is fine for d4 to be the same register as d0, and it often is. -// --------------------------------------------------------------------------- - -#define montreds(d4,d3,d2,d1,d0, tmp,mc) \ - adds d1, d1, d0, lsl #32 __LF \ - lsr tmp, d0, #32 __LF \ - adcs d2, d2, tmp __LF \ - mul tmp, d0, mc __LF \ - umulh d4, d0, mc __LF \ - adcs d3, d3, tmp __LF \ - adc d4, d4, xzr - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 - -#define l x6 -#define h x7 - -#define u0 x8 -#define u1 x9 -#define u2 x10 -#define u3 x11 -#define u4 x12 -#define u5 x13 -#define u6 x14 - -// This one is the same as h, which is safe with this computation sequence - -#define u7 h - -// This one is the same as a3, and is used for the Montgomery constant -// 0xFFFFFFFF00000001 - -#define mc x5 - -S2N_BN_SYMBOL(bignum_montsqr_p256_alt): - CFI_START - -// Load all the elements, set up an initial window [u6;...u1] = [23;03;01] -// and chain in the addition of 02 + 12 + 13 (no carry-out is possible). -// This gives all the "heterogeneous" terms of the squaring ready to double - - ldp a0, a1, [x] - - mul u1, a0, a1 - umulh u2, a0, a1 - - ldp a2, a3, [x, #16] - - mul u3, a0, a3 - umulh u4, a0, a3 - - mul l, a0, a2 - umulh h, a0, a2 - adds u2, u2, l - - adcs u3, u3, h - mul l, a1, a2 - umulh h, a1, a2 - adc h, h, xzr - adds u3, u3, l - - mul u5, a2, a3 - umulh u6, a2, a3 - - adcs u4, u4, h - mul l, a1, a3 - umulh h, a1, a3 - adc h, h, xzr - adds u4, u4, l - - adcs u5, u5, h - adc u6, u6, xzr - -// Now just double it; this simple approach seems to work better than extr - - adds u1, u1, u1 - adcs u2, u2, u2 - adcs u3, u3, u3 - adcs u4, u4, u4 - adcs u5, u5, u5 - adcs u6, u6, u6 - cset u7, cs - -// Add the homogeneous terms 00 + 11 + 22 + 33 - - umulh l, a0, a0 - mul u0, a0, a0 - adds u1, u1, l - - mul l, a1, a1 - adcs u2, u2, l - umulh l, a1, a1 - adcs u3, u3, l - - - mul l, a2, a2 - adcs u4, u4, l - umulh l, a2, a2 - adcs u5, u5, l - - mul l, a3, a3 - adcs u6, u6, l - umulh l, a3, a3 - adc u7, u7, l - -// Squaring complete. Perform 4 Montgomery steps to rotate the lower half - - mov mc, #0xFFFFFFFF00000001 - montreds(u0,u3,u2,u1,u0, a0,mc) - montreds(u1,u0,u3,u2,u1, a0,mc) - montreds(u2,u1,u0,u3,u2, a0,mc) - montreds(u3,u2,u1,u0,u3, a0,mc) - -// Add high and low parts, catching carry in a0 - - adds u0, u0, u4 - adcs u1, u1, u5 - adcs u2, u2, u6 - adcs u3, u3, u7 - cset a0, cs - -// Set [a3;0;a1;-1] = p_256 and form [u7,u6,u5,u4] = [a0;u3;u2;u1;u0] - p_256 -// Note that a3 == mc was already set above - - mov a1, #0x00000000ffffffff - - subs u4, u0, #-1 - sbcs u5, u1, a1 - sbcs u6, u2, xzr - sbcs u7, u3, mc - sbcs xzr, a0, xzr - -// Now CF is clear if the comparison carried so the original was fine -// Otherwise take the form with p_256 subtracted. - - csel u0, u0, u4, cc - csel u1, u1, u5, cc - csel u2, u2, u6, cc - csel u3, u3, u7, cc - -// Store back final result - - stp u0, u1, [z] - stp u2, u3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_p256_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mux_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mux_4.S deleted file mode 100644 index 868bae1f4c5..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_mux_4.S +++ /dev/null @@ -1,63 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// 256-bit multiplex/select z := x (if p nonzero) or z := y (if p zero) -// Inputs p, x[4], y[4]; output z[4] -// -// extern void bignum_mux_4(uint64_t p, uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// It is assumed that all numbers x, y and z have the same size 4 digits. -// -// Standard ARM ABI: X0 = p, X1 = z, X2 = x, X3 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mux_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mux_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mux_4) - .text - .balign 4 - -#define p x0 -#define z x1 -#define x x2 -#define y x3 -#define a x4 - - -S2N_BN_SYMBOL(bignum_mux_4): - CFI_START - -cmp p, #0 // Set condition codes p = 0 - - ldr a, [x] - ldr p, [y] - csel a, a, p, ne - str a, [z] - - ldr a, [x, #8] - ldr p, [y, #8] - csel a, a, p, ne - str a, [z, #8] - - ldr a, [x, #16] - ldr p, [y, #16] - csel a, a, p, ne - str a, [z, #16] - - ldr a, [x, #24] - ldr p, [y, #24] - csel a, a, p, ne - str a, [z, #24] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mux_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_neg_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_neg_p256.S deleted file mode 100644 index 8f5f0b4b3c1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_neg_p256.S +++ /dev/null @@ -1,72 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Negate modulo p_256, z := (-x) mod p_256, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_neg_p256(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_neg_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_neg_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_neg_p256) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define p x2 -#define t x3 - -#define d0 x4 -#define d1 x5 -#define d2 x6 -#define d3 x7 - - -S2N_BN_SYMBOL(bignum_neg_p256): - CFI_START - -// Load the 4 digits of x - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Set a bitmask p for the input being nonzero, so that we avoid doing -// -0 = p_256 and hence maintain strict modular reduction - - orr t, d0, d1 - orr p, d2, d3 - orr p, p, t - cmp p, #0 - csetm p, ne - -// Mask the nontrivial words of p_256 = [n3;0;n1;-1] and subtract - - subs d0, p, d0 - and t, p, #0x00000000ffffffff - sbcs d1, t, d1 - sbcs d2, xzr, d2 - and t, p, #0xffffffff00000001 - sbc d3, t, d3 - -// Write back the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - -// Return - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_neg_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_nonzero_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_nonzero_4.S deleted file mode 100644 index 33a5c7d83a1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_nonzero_4.S +++ /dev/null @@ -1,49 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// 256-bit nonzeroness test, returning 1 if x is nonzero, 0 if x is zero -// Input x[4]; output function return -// -// extern uint64_t bignum_nonzero_4(const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = x, returns X0 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_nonzero_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_nonzero_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_nonzero_4) - .text - .balign 4 - -#define x x0 -#define a x1 -#define d x2 -#define c x3 - - -S2N_BN_SYMBOL(bignum_nonzero_4): - CFI_START - -// Generate a = an OR of all the words in the bignum - - ldp a, d, [x] - orr a, a, d - ldp c, d, [x, #16] - orr c, c, d - orr a, a, c - -// Set a standard C condition based on whether a is nonzero - - cmp a, xzr - cset x0, ne - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_nonzero_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_optneg_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_optneg_p256.S deleted file mode 100644 index 5e42e5979c8..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_optneg_p256.S +++ /dev/null @@ -1,89 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo p_256, z := (-x) mod p_256 (if p nonzero) or -// z := x (if p zero), assuming x reduced -// Inputs p, x[4]; output z[4] -// -// extern void bignum_optneg_p256(uint64_t z[static 4], uint64_t p, -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = p, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg_p256) - .text - .balign 4 - -#define z x0 -#define p x1 -#define x x2 - -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 -#define n0 x7 -#define n1 x8 -#define n2 x9 -#define n3 x10 - - -S2N_BN_SYMBOL(bignum_optneg_p256): - CFI_START - -// Load the 4 digits of x - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Adjust p by zeroing it if the input is zero (to avoid giving -0 = p, which -// is not strictly reduced even though it's correct modulo p) - - orr n0, d0, d1 - orr n1, d2, d3 - orr n2, n0, n1 - cmp n2, #0 - csel p, xzr, p, eq - -// Load the three nonzero words of p_256 = [n3;0;n1;n0] - - mov n0, #0xffffffffffffffff - mov n1, #0x00000000ffffffff - mov n3, #0xffffffff00000001 - -// Do the subtraction, which by hypothesis does not underflow - - subs n0, n0, d0 - sbcs n1, n1, d1 - sbcs n2, xzr, d2 - sbc n3, n3, d3 - -// Set condition code if original x is nonzero and p was nonzero - - cmp p, #0 - -// Hence multiplex and write back - - csel n0, n0, d0, ne - csel n1, n1, d1, ne - csel n2, n2, d2, ne - csel n3, n3, d3, ne - - stp n0, n1, [z] - stp n2, n3, [z, #16] - -// Return - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_sub_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_sub_p256.S deleted file mode 100644 index a4533308d8f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_sub_p256.S +++ /dev/null @@ -1,72 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Subtract modulo p_256, z := (x - y) mod p_256 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_sub_p256(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sub_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sub_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sub_p256) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 -#define c x3 -#define l x4 -#define d0 x5 -#define d1 x6 -#define d2 x7 -#define d3 x8 - - -S2N_BN_SYMBOL(bignum_sub_p256): - CFI_START - -// First just subtract the numbers as [d3; d2; d1; d0] -// Set a mask based on (inverted) carry indicating x < y = correction is needed - - ldp d0, d1, [x] - ldp l, c, [y] - subs d0, d0, l - sbcs d1, d1, c - ldp d2, d3, [x, #16] - ldp l, c, [y, #16] - sbcs d2, d2, l - sbcs d3, d3, c - -// Create a mask for the condition x < y, when we need to correct - - csetm c, cc - -// Now correct by adding masked p_256 - - adds d0, d0, c - and l, c, #0x00000000ffffffff - adcs d1, d1, l - adcs d2, d2, xzr - and l, c, #0xffffffff00000001 - adc d3, d3, l - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sub_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_tomont_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_tomont_p256.S deleted file mode 100644 index 6852a1a091c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_tomont_p256.S +++ /dev/null @@ -1,122 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert to Montgomery form z := (2^256 * x) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_tomont_p256(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tomont_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tomont_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tomont_p256) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tomont_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tomont_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tomont_p256_alt) - .text - .balign 4 - -// ---------------------------------------------------------------------------- -// Core "x |-> (2^64 * x) mod p_256" macro, with x assumed to be < p_256. -// Input is in [d4;d3;d2;d1] and output in [d3;d2;d1;d0] -// using d4 as well as t1, t2, t3 as temporaries. -// ---------------------------------------------------------------------------- - -#define modstep_p256(d4, d3,d2,d1,d0, t1,t2,t3) \ -/* Writing the input as z = 2^256 * h + 2^192 * l + t = 2^192 * hl + t, */ \ -/* our quotient approximation is MIN ((hl + hl>>32 + 1)>>64) (2^64 - 1). */ \ - subs xzr, xzr, xzr __LF/* Set carry flag for +1 */ \ - extr t3, d4, d3, #32 __LF \ - adcs xzr, d3, t3 __LF \ - lsr t3, d4, #32 __LF \ - adcs t3, d4, t3 __LF \ - csetm d0, cs __LF \ - orr t3, t3, d0 __LF \ -/* First do [t2;t1] = 2^32 * q, which we use twice */ \ - lsl t1, t3, #32 __LF \ - lsr t2, t3, #32 __LF \ -/* Add 2^224 * q to sum */ \ - adds d3, d3, t1 __LF \ - adc d4, d4, t2 __LF \ -/* Accumulate [t2;t1;d0] = (2^96 - 1) * q */ \ - subs d0, xzr, t3 __LF \ - sbcs t1, t1, xzr __LF \ - sbc t2, t2, xzr __LF \ -/* Subtract (2^256 + 2^192 + 2^96 - 1) * q */ \ - subs d0, xzr, d0 __LF \ - sbcs d1, d1, t1 __LF \ - sbcs d2, d2, t2 __LF \ - sbcs d3, d3, t3 __LF \ - sbcs d4, d4, t3 __LF \ -/* Use top word as mask to correct */ \ - adds d0, d0, d4 __LF \ - mov t1, #0x00000000ffffffff __LF \ - and t1, t1, d4 __LF \ - adcs d1, d1, t1 __LF \ - adcs d2, d2, xzr __LF \ - mov t1, #0xffffffff00000001 __LF \ - and t1, t1, d4 __LF \ - adc d3, d3, t1 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x6 - -#define t0 x1 -#define t1 x7 -#define t2 x8 -#define t3 x9 - -S2N_BN_SYMBOL(bignum_tomont_p256): - -S2N_BN_SYMBOL(bignum_tomont_p256_alt): - CFI_START - -// Load the input - - ldp d0, d1, [x1] - ldp d2, d3, [x1, #16] - -// Do an initial reduction to make sure this is < p_256, using just -// a copy of the bignum_mod_p256_4 code. This is needed to set up the -// invariant "input < p_256" for the main modular reduction steps. - - mov t0, #0xffffffffffffffff - mov t1, #0x00000000ffffffff - mov t3, #0xffffffff00000001 - subs t0, d0, t0 - sbcs t1, d1, t1 - sbcs t2, d2, xzr - sbcs t3, d3, t3 - csel d0, d0, t0, cc - csel d1, d1, t1, cc - csel d2, d2, t2, cc - csel d3, d3, t3, cc - -// Successively multiply by 2^64 and reduce - - modstep_p256(d3,d2,d1,d0,d4, t1,t2,t3) - modstep_p256(d2,d1,d0,d4,d3, t1,t2,t3) - modstep_p256(d1,d0,d4,d3,d2, t1,t2,t3) - modstep_p256(d0,d4,d3,d2,d1, t1,t2,t3) - -// Store the result and return - - stp d1, d2, [x0] - stp d3, d4, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_tomont_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_triple_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_triple_p256.S deleted file mode 100644 index f8a00096415..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/bignum_triple_p256.S +++ /dev/null @@ -1,118 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_256, z := (3 * x) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_triple_p256(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// The input x can be any 4-digit bignum, not necessarily reduced modulo p_256, -// and the result is always fully reduced, i.e. z = (3 * x) mod p_256. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p256) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p256_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define h x6 - -// Slightly offset aliases for the d_i for readability. - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 - -// More aliases for the same thing at different stages - -#define q x7 -#define c x7 - -// Other temporary variables - -#define t0 x8 -#define t1 x9 - - -S2N_BN_SYMBOL(bignum_triple_p256): - -S2N_BN_SYMBOL(bignum_triple_p256_alt): - CFI_START - -// Load the inputs - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - -// First do the multiplication by 3, getting z = [h; d3; ...; d0] - - lsl d0, a0, #1 - adds d0, d0, a0 - extr d1, a1, a0, #63 - adcs d1, d1, a1 - extr d2, a2, a1, #63 - adcs d2, d2, a2 - extr d3, a3, a2, #63 - adcs d3, d3, a3 - lsr h, a3, #63 - adc h, h, xzr - -// For this limited range a simple quotient estimate of q = h + 1 works, where -// h = floor(z / 2^256). Then -p_256 <= z - q * p_256 < p_256, so we just need -// to subtract q * p_256 and then if that's negative, add back p_256. - - add q, h, #1 - -// Initial subtraction of z - q * p_256, with bitmask c for the carry - - lsl t1, q, #32 - adds d3, d3, t1 - adc h, h, xzr - sub t0, xzr, q - sub t1, t1, #1 - subs d0, d0, t0 - sbcs d1, d1, t1 - sbcs d2, d2, xzr - sbcs d3, d3, q - sbc c, h, q - -// Use the bitmask c for final masked addition of p_256. - - adds d0, d0, c - mov t0, #0x00000000ffffffff - and t0, t0, c - adcs d1, d1, t0 - adcs d2, d2, xzr - neg t1, t0 - adc d3, d3, t1 - -// Finally store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjadd.S deleted file mode 100644 index dc231feba8f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjadd.S +++ /dev/null @@ -1,3165 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjadd(uint64_t p3[static 12], const uint64_t p1[static 12], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - -// This is functionally equivalent to p256_montjadd in unopt/p256_montjadd.S. -// This is the result of doing the following sequence of optimizations: -// 1. Function inlining -// 2. Eliminating redundant load/store instructions -// 3. Folding (add addr, const) + load/store -// Function inlining is done manually. The second and third optimizations are -// done by a script. - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_montjadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjadd) - - .text - .balign 4 - -#define NUMSIZE 32 -#define NSPACE NUMSIZE*7 - -S2N_BN_SYMBOL(p256_montjadd): - CFI_START - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_PUSH2(x27,x30) - CFI_DEC_SP(NSPACE) - - mov x21, x0 - mov x22, x1 - mov x23, x2 - mov x0, sp - ldr q19, [x22, #64] - ldp x9, x13, [x22, #64] - ldr q23, [x22, #80] - ldr q0, [x22, #64] - ldp x1, x10, [x22, #80] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x19, x3, x16, cs - csel x14, x8, x14, cs - csel x12, x11, x12, cs - csel x20, x5, x2, cs - stp x14, x12, [x0, #16] - stp x19, x20, [x0] - ldr q19, [x23, #64] - ldp x9, x13, [x23, #64] - ldr q23, [x23, #80] - ldr q0, [x23, #64] - ldp x1, x10, [x23, #80] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x16, x3, x16, cs - csel x14, x8, x14, cs - csel x12, x11, x12, cs - csel x2, x5, x2, cs - stp x14, x12, [sp, #176] - stp x16, x2, [sp, #160] - ldr q20, [x22, #32] - ldp x7, x17, [x23, #64] - ldr q0, [x23, #64] - ldp x6, x10, [x22, #32] - ldp x11, x15, [x23, #80] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [x22, #48] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [x23, #80] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x22, #48] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x24, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x24 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [sp, #192] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #208] - ldr q20, [x23, #32] - ldp x7, x17, [x22, #64] - ldr q0, [x22, #64] - ldp x6, x10, [x23, #32] - ldp x11, x15, [x22, #80] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [x23, #48] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [x22, #80] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x23, #48] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x24, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x24 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x24, x11, x13 - and x1, x1, x13 - adcs x25, x4, x1 - and x1, x12, x13 - stp x24, x25, [sp, #32] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #48] - mov x1, sp - ldr q20, [x23, #0] - ldr q0, [x1] - ldp x6, x10, [x23, #0] - ldp x11, x15, [x1, #16] - rev64 v16.4s, v20.4s - subs x4, x19, x20 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x20, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x19 - ldr q20, [x23, #16] - sbcs x5, x15, x20 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x19, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [x1, #16] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x23, #16] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x19, x3, x13 - adcs x20, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x19 - adcs x15, x16, x20 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [sp, #64] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #80] - ldr q20, [x22, #0] - ldp x7, x17, [sp, #160] - ldr q0, [sp, #160] - ldp x6, x10, [x22, #0] - ldp x11, x15, [sp, #176] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [x22, #16] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [sp, #176] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x22, #16] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x19, x3, x13 - adcs x20, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x19 - adcs x15, x16, x20 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [sp, #128] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #144] - mov x1, sp - ldr q20, [sp, #32] - ldp x7, x17, [x1] - ldr q0, [x1] - ldp x11, x15, [x1, #16] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x25 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [sp, #48] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x24 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x25, x24 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [x1, #16] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #48] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x24, x7 - sbcs x9, x25, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x19, x3, x13 - adcs x20, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x24, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x25, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x19 - adcs x15, x16, x20 - eor x5, x17, x4 - adcs x9, x1, x24 - eor x1, x10, x5 - adcs x16, x2, x25 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x19, x11, x13 - and x1, x1, x13 - adcs x20, x4, x1 - and x1, x12, x13 - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #48] - ldr q20, [sp, #192] - ldp x7, x17, [sp, #160] - ldr q0, [sp, #160] - ldp x6, x10, [sp, #192] - ldp x11, x15, [sp, #176] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [sp, #208] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [sp, #176] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #208] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x24, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x24 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x9, x11, x13 - and x1, x1, x13 - adcs x10, x4, x1 - and x1, x12, x13 - stp x9, x10, [sp, #192] - adcs x11, x7, xzr - adc x12, x17, x1 - stp x11, x12, [sp, #208] - ldp x5, x6, [sp, #64] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x13, x5, x3 - and x4, x3, #0xffffffff - adcs x24, x6, x4 - adcs x25, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x26, x8, x4 - stp x13, x24, [sp, #160] - stp x25, x26, [sp, #176] - subs x5, x19, x9 - sbcs x6, x20, x10 - ldp x7, x8, [sp, #48] - sbcs x7, x7, x11 - sbcs x8, x8, x12 - csetm x3, cc - adds x19, x5, x3 - and x4, x3, #0xffffffff - adcs x20, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x19, x20, [sp, #32] - stp x7, x8, [sp, #48] - ldr q19, [sp, #160] - ldr q23, [sp, #176] - ldr q0, [sp, #160] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x13, x24 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x13, x24 - umulh x15, x13, x25 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x13, x24 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x26, x25 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x24, x26 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x25, x26 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x25, x26 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x26, x26 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x26, x26 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x25, x25 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x25, x25 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x24, x3, x16, cs - csel x25, x8, x14, cs - csel x26, x11, x12, cs - csel x27, x5, x2, cs - stp x25, x26, [sp, #112] - stp x24, x27, [sp, #96] - mov x0, sp - ldr q19, [sp, #32] - ldr q23, [sp, #48] - ldr q0, [sp, #32] - ldp x1, x10, [sp, #48] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x19, x20 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x19, x20 - umulh x15, x19, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x19, x20 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x20, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x16, x3, x16, cs - csel x14, x8, x14, cs - csel x12, x11, x12, cs - csel x2, x5, x2, cs - stp x14, x12, [x0, #16] - stp x16, x2, [x0] - ldr q20, [sp, #128] - ldr q0, [sp, #96] - ldp x6, x10, [sp, #128] - rev64 v16.4s, v20.4s - subs x4, x24, x27 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x27, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x25, x24 - ldr q20, [sp, #144] - sbcs x5, x26, x27 - ngc x17, xzr - subs x8, x25, x26 - uaddlp v27.2d, v16.4s - umulh x4, x24, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [sp, #112] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #144] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x19, x3, x13 - adcs x20, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x25, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x26, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x19 - adcs x15, x16, x20 - eor x5, x17, x4 - adcs x9, x1, x25 - eor x1, x10, x5 - adcs x16, x2, x26 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x19, x11, x13 - and x1, x1, x13 - adcs x20, x4, x1 - and x1, x12, x13 - stp x19, x20, [sp, #128] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #144] - ldr q20, [sp, #64] - ldr q0, [sp, #96] - ldp x6, x10, [sp, #64] - ldp x11, x15, [sp, #112] - rev64 v16.4s, v20.4s - subs x4, x24, x27 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x27, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x24 - ldr q20, [sp, #80] - sbcs x5, x15, x27 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x24, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [sp, #112] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #80] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x24, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x24 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x9, x11, x13 - and x1, x1, x13 - adcs x10, x4, x1 - and x1, x12, x13 - stp x9, x10, [sp, #64] - adcs x11, x7, xzr - adc x12, x17, x1 - stp x11, x12, [sp, #80] - mov x0, sp - mov x1, sp - ldp x5, x6, [x1] - subs x5, x5, x19 - sbcs x6, x6, x20 - ldp x7, x8, [x1, #16] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x24, x5, x3 - and x4, x3, #0xffffffff - adcs x25, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x7, x8, [x0, #16] - subs x5, x9, x19 - sbcs x6, x10, x20 - ldp x4, x3, [sp, #144] - sbcs x7, x11, x4 - sbcs x8, x12, x3 - csetm x3, cc - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [sp, #96] - stp x7, x8, [sp, #112] - ldr q20, [x22, #64] - ldp x7, x17, [sp, #160] - ldr q0, [sp, #160] - ldp x6, x10, [x22, #64] - ldp x11, x15, [sp, #176] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [x22, #80] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [sp, #176] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x22, #80] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x19, x3, x13 - adcs x20, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x19 - adcs x15, x16, x20 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [sp, #160] - adcs x19, x7, xzr - adc x20, x17, x1 - stp x19, x20, [sp, #176] - mov x0, sp - mov x1, sp - ldp x4, x3, [sp, #64] - subs x5, x24, x4 - sbcs x6, x25, x3 - ldp x7, x8, [x1, #16] - ldp x4, x3, [sp, #80] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x9, x5, x3 - and x4, x3, #0xffffffff - adcs x10, x6, x4 - adcs x11, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x3, x8, x4 - stp x9, x10, [x0] - stp x11, x3, [x0, #16] - ldp x5, x6, [sp, #128] - subs x5, x5, x9 - sbcs x6, x6, x10 - ldp x7, x8, [sp, #144] - sbcs x7, x7, x11 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [sp, #128] - stp x7, x8, [sp, #144] - ldr q20, [sp, #192] - ldp x7, x17, [sp, #96] - ldr q0, [sp, #96] - ldp x6, x10, [sp, #192] - ldp x11, x15, [sp, #112] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [sp, #208] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [sp, #112] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #208] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x24, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x24 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [sp, #96] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #112] - ldr q20, [x23, #64] - ldp x7, x17, [sp, #160] - ldr q0, [sp, #160] - ldp x6, x10, [x23, #64] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x19, x7 - ldr q20, [x23, #80] - sbcs x5, x20, x17 - ngc x17, xzr - subs x8, x19, x20 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [sp, #176] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x23, #80] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x19, x3, x13 - adcs x20, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x24, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x25, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x19 - adcs x15, x16, x20 - eor x5, x17, x4 - adcs x9, x1, x24 - eor x1, x10, x5 - adcs x16, x2, x25 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x19, x11, x13 - and x1, x1, x13 - adcs x20, x4, x1 - and x1, x12, x13 - stp x19, x20, [sp, #160] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #176] - ldr q20, [sp, #128] - ldp x7, x17, [sp, #32] - ldr q0, [sp, #32] - ldp x6, x10, [sp, #128] - ldp x11, x15, [sp, #48] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [sp, #144] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [sp, #48] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #144] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x24, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x24 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x5, x11, x13 - and x1, x1, x13 - adcs x6, x4, x1 - and x1, x12, x13 - adcs x7, x7, xzr - adc x9, x17, x1 - ldp x4, x3, [sp, #96] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x4, x3, [sp, #112] - sbcs x7, x7, x4 - sbcs x8, x9, x3 - csetm x3, cc - adds x15, x5, x3 - and x4, x3, #0xffffffff - adcs x24, x6, x4 - adcs x25, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x26, x8, x4 - stp x15, x24, [sp, #128] - stp x25, x26, [sp, #144] - ldp x0, x1, [x22, #64] - ldp x2, x3, [x22, #80] - orr x12, x0, x1 - orr x13, x2, x3 - orr x12, x12, x13 - cmp x12, xzr - cset x12, ne - ldp x4, x5, [x23, #64] - ldp x6, x7, [x23, #80] - orr x13, x4, x5 - orr x14, x6, x7 - orr x13, x13, x14 - cmp x13, xzr - cset x13, ne - cmp x13, x12 - csel x8, x0, x19, cc - csel x9, x1, x20, cc - csel x8, x4, x8, hi - csel x9, x5, x9, hi - ldp x10, x11, [sp, #176] - csel x10, x2, x10, cc - csel x11, x3, x11, cc - csel x10, x6, x10, hi - csel x11, x7, x11, hi - ldp x12, x13, [x22] - ldp x0, x1, [sp] - csel x0, x12, x0, cc - csel x1, x13, x1, cc - ldp x12, x13, [x23] - csel x0, x12, x0, hi - csel x1, x13, x1, hi - ldp x12, x13, [x22, #16] - ldp x2, x3, [sp, #16] - csel x2, x12, x2, cc - csel x3, x13, x3, cc - ldp x12, x13, [x23, #16] - csel x2, x12, x2, hi - csel x3, x13, x3, hi - ldp x12, x13, [x22, #32] - csel x4, x12, x15, cc - csel x5, x13, x24, cc - ldp x12, x13, [x23, #32] - csel x4, x12, x4, hi - csel x5, x13, x5, hi - ldp x12, x13, [x22, #48] - csel x6, x12, x25, cc - csel x7, x13, x26, cc - ldp x12, x13, [x23, #48] - csel x6, x12, x6, hi - csel x7, x13, x7, hi - stp x0, x1, [x21] - stp x2, x3, [x21, #16] - stp x4, x5, [x21, #32] - stp x6, x7, [x21, #48] - stp x8, x9, [x21, #64] - stp x10, x11, [x21, #80] - - CFI_INC_SP(NSPACE) - CFI_POP2(x27,x30) - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_montjadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjadd_alt.S deleted file mode 100644 index 0357673d354..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjadd_alt.S +++ /dev/null @@ -1,555 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjadd_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_montjadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjadd_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x15 -#define input_x x16 -#define input_y x17 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE -#define z_2 input_y, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define z1sq sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define x1a sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define z2sq sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define y1a sp, #(NUMSIZE*6) - -#define NSPACE NUMSIZE*7 - -// Corresponds to bignum_montmul_p256_alt except registers - -#define montmul_p256(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x0, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x1, x3, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x1, x1, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x1, x1, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x0, x0, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x1, x1, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x0, x0, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x1, x1, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x0, x0, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - mov x10, #0xffffffff00000001 __LF \ - adds x13, x13, x12, lsl #32 __LF \ - lsr x11, x12, #32 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x12, x10 __LF \ - umulh x12, x12, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x12, x12, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x1, x1, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - adds x14, x14, x13, lsl #32 __LF \ - lsr x11, x13, #32 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x13, x10 __LF \ - umulh x13, x13, x10 __LF \ - adcs x12, x12, x11 __LF \ - adc x13, x13, xzr __LF \ - adds x0, x0, x14, lsl #32 __LF \ - lsr x11, x14, #32 __LF \ - adcs x12, x12, x11 __LF \ - mul x11, x14, x10 __LF \ - umulh x14, x14, x10 __LF \ - adcs x13, x13, x11 __LF \ - adc x14, x14, xzr __LF \ - adds x12, x12, x0, lsl #32 __LF \ - lsr x11, x0, #32 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x0, x10 __LF \ - umulh x0, x0, x10 __LF \ - adcs x14, x14, x11 __LF \ - adc x0, x0, xzr __LF \ - adds x12, x12, x1 __LF \ - adcs x13, x13, x3 __LF \ - adcs x14, x14, x4 __LF \ - adcs x0, x0, x5 __LF \ - cset x8, cs __LF \ - mov x11, #0xffffffff __LF \ - adds x1, x12, #0x1 __LF \ - sbcs x3, x13, x11 __LF \ - sbcs x4, x14, xzr __LF \ - sbcs x5, x0, x10 __LF \ - sbcs xzr, x8, xzr __LF \ - csel x12, x12, x1, cc __LF \ - csel x13, x13, x3, cc __LF \ - csel x14, x14, x4, cc __LF \ - csel x0, x0, x5, cc __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x0, [P0+16] - -// Corresponds exactly to bignum_montsqr_p256_alt - -#define montsqr_p256(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x6, x2, x4 __LF \ - umulh x7, x2, x4 __LF \ - adds x10, x10, x6 __LF \ - adcs x11, x11, x7 __LF \ - mul x6, x3, x4 __LF \ - umulh x7, x3, x4 __LF \ - adc x7, x7, xzr __LF \ - adds x11, x11, x6 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x7 __LF \ - mul x6, x3, x5 __LF \ - umulh x7, x3, x5 __LF \ - adc x7, x7, xzr __LF \ - adds x12, x12, x6 __LF \ - adcs x13, x13, x7 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x7, cs __LF \ - umulh x6, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x6 __LF \ - mul x6, x3, x3 __LF \ - adcs x10, x10, x6 __LF \ - umulh x6, x3, x3 __LF \ - adcs x11, x11, x6 __LF \ - mul x6, x4, x4 __LF \ - adcs x12, x12, x6 __LF \ - umulh x6, x4, x4 __LF \ - adcs x13, x13, x6 __LF \ - mul x6, x5, x5 __LF \ - adcs x14, x14, x6 __LF \ - umulh x6, x5, x5 __LF \ - adc x7, x7, x6 __LF \ - adds x9, x9, x8, lsl #32 __LF \ - lsr x3, x8, #32 __LF \ - adcs x10, x10, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x8, x3 __LF \ - umulh x8, x8, x3 __LF \ - adcs x11, x11, x2 __LF \ - adc x8, x8, xzr __LF \ - adds x10, x10, x9, lsl #32 __LF \ - lsr x3, x9, #32 __LF \ - adcs x11, x11, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x9, x3 __LF \ - umulh x9, x9, x3 __LF \ - adcs x8, x8, x2 __LF \ - adc x9, x9, xzr __LF \ - adds x11, x11, x10, lsl #32 __LF \ - lsr x3, x10, #32 __LF \ - adcs x8, x8, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x10, x3 __LF \ - umulh x10, x10, x3 __LF \ - adcs x9, x9, x2 __LF \ - adc x10, x10, xzr __LF \ - adds x8, x8, x11, lsl #32 __LF \ - lsr x3, x11, #32 __LF \ - adcs x9, x9, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x11, x3 __LF \ - umulh x11, x11, x3 __LF \ - adcs x10, x10, x2 __LF \ - adc x11, x11, xzr __LF \ - adds x8, x8, x12 __LF \ - adcs x9, x9, x13 __LF \ - adcs x10, x10, x14 __LF \ - adcs x11, x11, x7 __LF \ - cset x2, cs __LF \ - mov x3, #0xffffffff __LF \ - mov x5, #0xffffffff00000001 __LF \ - adds x12, x8, #0x1 __LF \ - sbcs x13, x9, x3 __LF \ - sbcs x14, x10, xzr __LF \ - sbcs x7, x11, x5 __LF \ - sbcs xzr, x2, xzr __LF \ - csel x8, x8, x12, cc __LF \ - csel x9, x9, x13, cc __LF \ - csel x10, x10, x14, cc __LF \ - csel x11, x11, x7, cc __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Almost-Montgomery variant which we use when an input to other muls -// with the other argument fully reduced (which is always safe). - -#define amontsqr_p256(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x6, x2, x4 __LF \ - umulh x7, x2, x4 __LF \ - adds x10, x10, x6 __LF \ - adcs x11, x11, x7 __LF \ - mul x6, x3, x4 __LF \ - umulh x7, x3, x4 __LF \ - adc x7, x7, xzr __LF \ - adds x11, x11, x6 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x7 __LF \ - mul x6, x3, x5 __LF \ - umulh x7, x3, x5 __LF \ - adc x7, x7, xzr __LF \ - adds x12, x12, x6 __LF \ - adcs x13, x13, x7 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x7, cs __LF \ - umulh x6, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x6 __LF \ - mul x6, x3, x3 __LF \ - adcs x10, x10, x6 __LF \ - umulh x6, x3, x3 __LF \ - adcs x11, x11, x6 __LF \ - mul x6, x4, x4 __LF \ - adcs x12, x12, x6 __LF \ - umulh x6, x4, x4 __LF \ - adcs x13, x13, x6 __LF \ - mul x6, x5, x5 __LF \ - adcs x14, x14, x6 __LF \ - umulh x6, x5, x5 __LF \ - adc x7, x7, x6 __LF \ - adds x9, x9, x8, lsl #32 __LF \ - lsr x3, x8, #32 __LF \ - adcs x10, x10, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x8, x3 __LF \ - umulh x8, x8, x3 __LF \ - adcs x11, x11, x2 __LF \ - adc x8, x8, xzr __LF \ - adds x10, x10, x9, lsl #32 __LF \ - lsr x3, x9, #32 __LF \ - adcs x11, x11, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x9, x3 __LF \ - umulh x9, x9, x3 __LF \ - adcs x8, x8, x2 __LF \ - adc x9, x9, xzr __LF \ - adds x11, x11, x10, lsl #32 __LF \ - lsr x3, x10, #32 __LF \ - adcs x8, x8, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x10, x3 __LF \ - umulh x10, x10, x3 __LF \ - adcs x9, x9, x2 __LF \ - adc x10, x10, xzr __LF \ - adds x8, x8, x11, lsl #32 __LF \ - lsr x3, x11, #32 __LF \ - adcs x9, x9, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x11, x3 __LF \ - umulh x11, x11, x3 __LF \ - adcs x10, x10, x2 __LF \ - adc x11, x11, xzr __LF \ - adds x8, x8, x12 __LF \ - adcs x9, x9, x13 __LF \ - adcs x10, x10, x14 __LF \ - adcs x11, x11, x7 __LF \ - mov x2, #0xffffffffffffffff __LF \ - csel x2, xzr, x2, cc __LF \ - mov x3, #0xffffffff __LF \ - csel x3, xzr, x3, cc __LF \ - mov x5, #0xffffffff00000001 __LF \ - csel x5, xzr, x5, cc __LF \ - subs x8, x8, x2 __LF \ - sbcs x9, x9, x3 __LF \ - sbcs x10, x10, xzr __LF \ - sbc x11, x11, x5 __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Corresponds exactly to bignum_sub_p256 - -#define sub_p256(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - csetm x3, cc __LF \ - adds x5, x5, x3 __LF \ - mov x4, #0xffffffff __LF \ - and x4, x4, x3 __LF \ - adcs x6, x6, x4 __LF \ - adcs x7, x7, xzr __LF \ - mov x4, #0xffffffff00000001 __LF \ - and x4, x4, x3 __LF \ - adc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -S2N_BN_SYMBOL(p256_montjadd_alt): - CFI_START - -// Make room on stack for temporary variables -// Move the input arguments to stable places - - CFI_DEC_SP(NSPACE) - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations -// 12 * multiply + 4 * square + 7 * subtract - - amontsqr_p256(z1sq,z_1) - amontsqr_p256(z2sq,z_2) - - montmul_p256(y1a,z_2,y_1) - montmul_p256(y2a,z_1,y_2) - - montmul_p256(x2a,z1sq,x_2) - montmul_p256(x1a,z2sq,x_1) - montmul_p256(y2a,z1sq,y2a) - montmul_p256(y1a,z2sq,y1a) - - sub_p256(xd,x2a,x1a) - sub_p256(yd,y2a,y1a) - - amontsqr_p256(zz,xd) - montsqr_p256(ww,yd) - - montmul_p256(zzx1,zz,x1a) - montmul_p256(zzx2,zz,x2a) - - sub_p256(resx,ww,zzx1) - sub_p256(t1,zzx2,zzx1) - - montmul_p256(xd,xd,z_1) - - sub_p256(resx,resx,zzx2) - - sub_p256(t2,zzx1,resx) - - montmul_p256(t1,t1,y1a) - montmul_p256(resz,xd,z_2) - montmul_p256(t2,yd,t2) - - sub_p256(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "HI" <=> CF /\ ~ZF <=> P1 = 0 /\ ~(P2 = 0) -// and "LO" <=> ~CF <=> ~(P1 = 0) /\ P2 = 0 - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - - orr x12, x0, x1 - orr x13, x2, x3 - orr x12, x12, x13 - cmp x12, xzr - cset x12, ne - - ldp x4, x5, [z_2] - ldp x6, x7, [z_2+16] - - orr x13, x4, x5 - orr x14, x6, x7 - orr x13, x13, x14 - cmp x13, xzr - cset x13, ne - - cmp x13, x12 - -// Multiplex the outputs accordingly, re-using the z's in registers - - ldp x8, x9, [resz] - csel x8, x0, x8, lo - csel x9, x1, x9, lo - csel x8, x4, x8, hi - csel x9, x5, x9, hi - ldp x10, x11, [resz+16] - csel x10, x2, x10, lo - csel x11, x3, x11, lo - csel x10, x6, x10, hi - csel x11, x7, x11, hi - - ldp x12, x13, [x_1] - ldp x0, x1, [resx] - csel x0, x12, x0, lo - csel x1, x13, x1, lo - ldp x12, x13, [x_2] - csel x0, x12, x0, hi - csel x1, x13, x1, hi - - ldp x12, x13, [x_1+16] - ldp x2, x3, [resx+16] - csel x2, x12, x2, lo - csel x3, x13, x3, lo - ldp x12, x13, [x_2+16] - csel x2, x12, x2, hi - csel x3, x13, x3, hi - - ldp x12, x13, [y_1] - ldp x4, x5, [resy] - csel x4, x12, x4, lo - csel x5, x13, x5, lo - ldp x12, x13, [y_2] - csel x4, x12, x4, hi - csel x5, x13, x5, hi - - ldp x12, x13, [y_1+16] - ldp x6, x7, [resy+16] - csel x6, x12, x6, lo - csel x7, x13, x7, lo - ldp x12, x13, [y_2+16] - csel x6, x12, x6, hi - csel x7, x13, x7, hi - -// Finally store back the multiplexed values - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [y_3] - stp x6, x7, [y_3+16] - stp x8, x9, [z_3] - stp x10, x11, [z_3+16] - -// Restore registers and return - - CFI_INC_SP(NSPACE) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_montjadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjdouble.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjdouble.S deleted file mode 100644 index e29ebd030df..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjdouble.S +++ /dev/null @@ -1,1555 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjdouble(uint64_t p3[static 12], -// const uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - -// This is functionally equivalent to p256_montjdouble in unopt/p256_montjdouble.S. -// This is the result of doing the following sequence of optimizations: -// 1. Function inlining -// 2. Eliminating redundant load/store instructions -// 3. Folding (add addr, const) + load/store -// Function inlining is done manually. The second and third optimizations are -// done by a script. - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjdouble) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_montjdouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjdouble) - .text - .balign 4 - -#define NUMSIZE 32 -#define NSPACE NUMSIZE*6 - -S2N_BN_SYMBOL(p256_montjdouble): - CFI_START - - CFI_DEC_SP(NSPACE+80) - CFI_STACKSAVE2(x19,x20,NSPACE) - CFI_STACKSAVE2(x21,x22,NSPACE+16) - CFI_STACKSAVE2(x23,x24,NSPACE+32) - CFI_STACKSAVE2(x25,x26,NSPACE+48) - CFI_STACKSAVE1Z(x27,NSPACE+64) - - mov x19, x0 - mov x20, x1 - mov x0, sp - ldr q19, [x20, #64] - ldp x9, x13, [x20, #64] - ldr q23, [x20, #80] - ldr q0, [x20, #64] - ldp x1, x10, [x20, #80] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x21, x3, x16, cs - csel x22, x8, x14, cs - csel x23, x11, x12, cs - csel x24, x5, x2, cs - stp x22, x23, [x0, #16] - stp x21, x24, [x0] - ldr q19, [x20, #32] - ldp x9, x13, [x20, #32] - ldr q23, [x20, #48] - ldr q0, [x20, #32] - ldp x1, x10, [x20, #48] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x16, x3, x16, cs - csel x14, x8, x14, cs - csel x12, x11, x12, cs - csel x2, x5, x2, cs - stp x14, x12, [sp, #48] - stp x16, x2, [sp, #32] - ldp x5, x6, [x20, #0] - subs x5, x5, x21 - sbcs x6, x6, x24 - ldp x7, x8, [x20, #16] - sbcs x7, x7, x22 - sbcs x8, x8, x23 - csetm x3, cc - adds x10, x5, x3 - and x4, x3, #0xffffffff - adcs x25, x6, x4 - adcs x26, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x27, x8, x4 - stp x10, x25, [sp, #96] - stp x26, x27, [sp, #112] - ldp x5, x6, [x20] - adds x5, x5, x21 - adcs x6, x6, x24 - ldp x7, x8, [x20, #16] - adcs x7, x7, x22 - adcs x8, x8, x23 - csetm x3, cs - subs x9, x5, x3 - and x1, x3, #0xffffffff - sbcs x5, x6, x1 - sbcs x7, x7, xzr - and x2, x3, #0xffffffff00000001 - sbc x8, x8, x2 - stp x9, x5, [sp, #64] - stp x7, x8, [sp, #80] - ldr q20, [sp, #96] - ldr q0, [sp, #64] - rev64 v16.4s, v20.4s - subs x4, x9, x5 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x5, x25 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x7, x9 - ldr q20, [sp, #112] - sbcs x5, x8, x5 - ngc x17, xzr - subs x8, x7, x8 - uaddlp v27.2d, v16.4s - umulh x4, x9, x10 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x25, x10 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [sp, #80] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x10, x26 - sbcs x9, x25, x27 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x27, x26 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x21, x3, x13 - adcs x22, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x23, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x24, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x21 - adcs x15, x16, x22 - eor x5, x17, x4 - adcs x9, x1, x23 - eor x1, x10, x5 - adcs x16, x2, x24 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x21, x11, x13 - and x1, x1, x13 - adcs x22, x4, x1 - and x1, x12, x13 - stp x21, x22, [sp, #96] - adcs x23, x7, xzr - adc x24, x17, x1 - stp x23, x24, [sp, #112] - ldp x4, x5, [x20, #32] - ldp x8, x9, [x20, #64] - adds x4, x4, x8 - adcs x5, x5, x9 - ldp x6, x7, [x20, #48] - ldp x10, x11, [x20, #80] - adcs x6, x6, x10 - adcs x7, x7, x11 - adc x3, xzr, xzr - adds x8, x4, #0x1 - mov x9, #0xffffffff - sbcs x9, x5, x9 - sbcs x10, x6, xzr - mov x11, #0xffffffff00000001 - sbcs x11, x7, x11 - sbcs x3, x3, xzr - csel x4, x4, x8, cc - csel x5, x5, x9, cc - csel x6, x6, x10, cc - csel x7, x7, x11, cc - stp x4, x5, [sp, #64] - stp x6, x7, [sp, #80] - ldr q20, [sp, #32] - ldp x7, x17, [x20, #0] - ldr q0, [x20, #0] - ldp x6, x10, [sp, #32] - ldp x11, x15, [x20, #16] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [sp, #48] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [x20, #16] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #48] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x20, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x20 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x20, x11, x13 - and x1, x1, x13 - adcs x25, x4, x1 - and x1, x12, x13 - stp x20, x25, [sp, #128] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #144] - ldr q19, [sp, #96] - ldr q23, [sp, #112] - ldr q0, [sp, #96] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x21, x22 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x21, x22 - umulh x15, x21, x23 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x21, x22 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x24, x23 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x22, x24 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x23, x24 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x23, x24 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x24, x24 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x24, x24 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x23, x23 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x23, x23 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x21, x3, x16, cs - csel x22, x8, x14, cs - csel x23, x11, x12, cs - csel x24, x5, x2, cs - ldr q19, [sp, #64] - ldp x9, x13, [sp, #64] - ldr q23, [sp, #80] - ldr q0, [sp, #64] - ldp x1, x10, [sp, #80] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x13, x3, x16, cs - csel x14, x8, x14, cs - csel x15, x11, x12, cs - csel x26, x5, x2, cs - mov x1, #0x9 - mov x2, #0xffffffffffffffff - subs x9, x2, x21 - mov x2, #0xffffffff - sbcs x10, x2, x24 - ngcs x11, x22 - mov x2, #0xffffffff00000001 - sbc x12, x2, x23 - mul x3, x1, x9 - mul x4, x1, x10 - mul x5, x1, x11 - mul x6, x1, x12 - umulh x9, x1, x9 - umulh x10, x1, x10 - umulh x11, x1, x11 - umulh x7, x1, x12 - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, xzr - mov x1, #0xc - mul x8, x20, x1 - umulh x9, x20, x1 - adds x3, x3, x8 - mul x8, x25, x1 - umulh x10, x25, x1 - adcs x4, x4, x8 - ldp x11, x12, [sp, #144] - mul x8, x11, x1 - umulh x11, x11, x1 - adcs x5, x5, x8 - mul x8, x12, x1 - umulh x12, x12, x1 - adcs x6, x6, x8 - adc x7, x7, xzr - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, x12 - add x8, x7, #0x1 - lsl x10, x8, #32 - adds x6, x6, x10 - adc x7, x7, xzr - neg x9, x8 - sub x10, x10, #0x1 - subs x3, x3, x9 - sbcs x4, x4, x10 - sbcs x5, x5, xzr - sbcs x6, x6, x8 - sbc x8, x7, x8 - adds x20, x3, x8 - and x9, x8, #0xffffffff - adcs x21, x4, x9 - adcs x22, x5, xzr - neg x10, x9 - adc x23, x6, x10 - stp x20, x21, [sp, #160] - stp x22, x23, [sp, #176] - mov x2, sp - ldp x4, x3, [x2] - subs x5, x13, x4 - sbcs x6, x26, x3 - ldp x4, x3, [x2, #16] - sbcs x7, x14, x4 - sbcs x8, x15, x3 - csetm x3, cc - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [sp, #64] - stp x7, x8, [sp, #80] - mov x0, sp - ldr q19, [sp, #32] - ldp x9, x13, [sp, #32] - ldr q23, [sp, #48] - ldr q0, [sp, #32] - ldp x1, x10, [sp, #48] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x24, x3, x16, cs - csel x25, x8, x14, cs - csel x26, x11, x12, cs - csel x27, x5, x2, cs - stp x25, x26, [x0, #16] - stp x24, x27, [x0] - ldr q20, [sp, #96] - ldr q0, [sp, #160] - ldp x6, x10, [sp, #96] - rev64 v16.4s, v20.4s - subs x4, x20, x21 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x21, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x22, x20 - ldr q20, [sp, #112] - sbcs x5, x23, x21 - ngc x17, xzr - subs x8, x22, x23 - uaddlp v27.2d, v16.4s - umulh x4, x20, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [sp, #176] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #112] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x20, x3, x13 - adcs x21, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x22, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x23, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x20 - adcs x15, x16, x21 - eor x5, x17, x4 - adcs x9, x1, x22 - eor x1, x10, x5 - adcs x16, x2, x23 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x14, x11, x13 - and x1, x1, x13 - adcs x15, x4, x1 - and x1, x12, x13 - stp x14, x15, [sp, #96] - adcs x13, x7, xzr - adc x20, x17, x1 - stp x13, x20, [sp, #112] - ldp x5, x6, [sp, #64] - ldp x4, x3, [sp, #32] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [sp, #48] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [x19, #64] - stp x7, x8, [x19, #80] - ldp x1, x2, [sp, #128] - lsl x0, x1, #2 - ldp x6, x7, [sp, #160] - subs x0, x0, x6 - extr x1, x2, x1, #62 - sbcs x1, x1, x7 - ldp x3, x4, [sp, #144] - extr x2, x3, x2, #62 - ldp x6, x7, [sp, #176] - sbcs x2, x2, x6 - extr x3, x4, x3, #62 - sbcs x3, x3, x7 - lsr x4, x4, #62 - sbc x4, x4, xzr - add x5, x4, #0x1 - lsl x8, x5, #32 - negs x6, x8 - ngcs x7, xzr - sbc x8, x8, x5 - adds x0, x0, x5 - adcs x1, x1, x6 - adcs x2, x2, x7 - adcs x3, x3, x8 - csetm x5, cc - adds x0, x0, x5 - and x6, x5, #0xffffffff - adcs x1, x1, x6 - adcs x2, x2, xzr - neg x7, x6 - adc x3, x3, x7 - stp x0, x1, [x19] - stp x2, x3, [x19, #16] - mov x2, #0xffffffffffffffff - subs x9, x2, x24 - mov x2, #0xffffffff - sbcs x10, x2, x27 - ngcs x11, x25 - mov x2, #0xffffffff00000001 - sbc x12, x2, x26 - lsl x3, x9, #3 - extr x4, x10, x9, #61 - extr x5, x11, x10, #61 - extr x6, x12, x11, #61 - lsr x7, x12, #61 - mov x1, #0x3 - mul x8, x14, x1 - umulh x9, x14, x1 - adds x3, x3, x8 - mul x8, x15, x1 - umulh x10, x15, x1 - adcs x4, x4, x8 - mul x8, x13, x1 - umulh x11, x13, x1 - adcs x5, x5, x8 - mul x8, x20, x1 - umulh x12, x20, x1 - adcs x6, x6, x8 - adc x7, x7, xzr - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, x12 - add x8, x7, #0x1 - lsl x10, x8, #32 - adds x6, x6, x10 - adc x7, x7, xzr - neg x9, x8 - sub x10, x10, #0x1 - subs x3, x3, x9 - sbcs x4, x4, x10 - sbcs x5, x5, xzr - sbcs x6, x6, x8 - sbc x8, x7, x8 - adds x3, x3, x8 - and x9, x8, #0xffffffff - adcs x4, x4, x9 - adcs x5, x5, xzr - neg x10, x9 - adc x6, x6, x10 - stp x3, x4, [x19, #32] - stp x5, x6, [x19, #48] - - CFI_STACKLOAD1Z(x27,NSPACE+64) - CFI_STACKLOAD2(x25,x26,NSPACE+48) - CFI_STACKLOAD2(x23,x24,NSPACE+32) - CFI_STACKLOAD2(x21,x22,NSPACE+16) - CFI_STACKLOAD2(x19,x20,NSPACE) - CFI_INC_SP((NSPACE+80)) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_montjdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjdouble_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjdouble_alt.S deleted file mode 100644 index a5d531a0698..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjdouble_alt.S +++ /dev/null @@ -1,587 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjdouble_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjdouble_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_montjdouble_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjdouble_alt) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x15 -#define input_x x16 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define z2 sp, #(NUMSIZE*0) -#define y4 sp, #(NUMSIZE*0) - -#define y2 sp, #(NUMSIZE*1) - -#define t1 sp, #(NUMSIZE*2) - -#define t2 sp, #(NUMSIZE*3) -#define x2p sp, #(NUMSIZE*3) -#define dx2 sp, #(NUMSIZE*3) - -#define xy2 sp, #(NUMSIZE*4) - -#define x4p sp, #(NUMSIZE*5) -#define d sp, #(NUMSIZE*5) - -#define NSPACE NUMSIZE*6 - -// Corresponds exactly to bignum_montmul_p256_alt except registers - -#define montmul_p256(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x0, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x1, x3, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x1, x1, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x1, x1, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x0, x0, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x1, x1, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x0, x0, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x1, x1, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x0, x0, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - mov x10, #0xffffffff00000001 __LF \ - adds x13, x13, x12, lsl #32 __LF \ - lsr x11, x12, #32 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x12, x10 __LF \ - umulh x12, x12, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x12, x12, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x1, x1, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - adds x14, x14, x13, lsl #32 __LF \ - lsr x11, x13, #32 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x13, x10 __LF \ - umulh x13, x13, x10 __LF \ - adcs x12, x12, x11 __LF \ - adc x13, x13, xzr __LF \ - adds x0, x0, x14, lsl #32 __LF \ - lsr x11, x14, #32 __LF \ - adcs x12, x12, x11 __LF \ - mul x11, x14, x10 __LF \ - umulh x14, x14, x10 __LF \ - adcs x13, x13, x11 __LF \ - adc x14, x14, xzr __LF \ - adds x12, x12, x0, lsl #32 __LF \ - lsr x11, x0, #32 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x0, x10 __LF \ - umulh x0, x0, x10 __LF \ - adcs x14, x14, x11 __LF \ - adc x0, x0, xzr __LF \ - adds x12, x12, x1 __LF \ - adcs x13, x13, x3 __LF \ - adcs x14, x14, x4 __LF \ - adcs x0, x0, x5 __LF \ - cset x8, cs __LF \ - mov x11, #0xffffffff __LF \ - adds x1, x12, #0x1 __LF \ - sbcs x3, x13, x11 __LF \ - sbcs x4, x14, xzr __LF \ - sbcs x5, x0, x10 __LF \ - sbcs xzr, x8, xzr __LF \ - csel x12, x12, x1, cc __LF \ - csel x13, x13, x3, cc __LF \ - csel x14, x14, x4, cc __LF \ - csel x0, x0, x5, cc __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x0, [P0+16] - -// Corresponds exactly to bignum_montsqr_p256_alt - -#define montsqr_p256(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x6, x2, x4 __LF \ - umulh x7, x2, x4 __LF \ - adds x10, x10, x6 __LF \ - adcs x11, x11, x7 __LF \ - mul x6, x3, x4 __LF \ - umulh x7, x3, x4 __LF \ - adc x7, x7, xzr __LF \ - adds x11, x11, x6 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x7 __LF \ - mul x6, x3, x5 __LF \ - umulh x7, x3, x5 __LF \ - adc x7, x7, xzr __LF \ - adds x12, x12, x6 __LF \ - adcs x13, x13, x7 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x7, hs __LF \ - umulh x6, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x6 __LF \ - mul x6, x3, x3 __LF \ - adcs x10, x10, x6 __LF \ - umulh x6, x3, x3 __LF \ - adcs x11, x11, x6 __LF \ - mul x6, x4, x4 __LF \ - adcs x12, x12, x6 __LF \ - umulh x6, x4, x4 __LF \ - adcs x13, x13, x6 __LF \ - mul x6, x5, x5 __LF \ - adcs x14, x14, x6 __LF \ - umulh x6, x5, x5 __LF \ - adc x7, x7, x6 __LF \ - mov x5, #-4294967295 __LF \ - adds x9, x9, x8, lsl #32 __LF \ - lsr x3, x8, #32 __LF \ - adcs x10, x10, x3 __LF \ - mul x2, x8, x5 __LF \ - umulh x8, x8, x5 __LF \ - adcs x11, x11, x2 __LF \ - adc x8, x8, xzr __LF \ - adds x10, x10, x9, lsl #32 __LF \ - lsr x3, x9, #32 __LF \ - adcs x11, x11, x3 __LF \ - mul x2, x9, x5 __LF \ - umulh x9, x9, x5 __LF \ - adcs x8, x8, x2 __LF \ - adc x9, x9, xzr __LF \ - adds x11, x11, x10, lsl #32 __LF \ - lsr x3, x10, #32 __LF \ - adcs x8, x8, x3 __LF \ - mul x2, x10, x5 __LF \ - umulh x10, x10, x5 __LF \ - adcs x9, x9, x2 __LF \ - adc x10, x10, xzr __LF \ - adds x8, x8, x11, lsl #32 __LF \ - lsr x3, x11, #32 __LF \ - adcs x9, x9, x3 __LF \ - mul x2, x11, x5 __LF \ - umulh x11, x11, x5 __LF \ - adcs x10, x10, x2 __LF \ - adc x11, x11, xzr __LF \ - adds x8, x8, x12 __LF \ - adcs x9, x9, x13 __LF \ - adcs x10, x10, x14 __LF \ - adcs x11, x11, x7 __LF \ - cset x2, hs __LF \ - mov x3, #4294967295 __LF \ - adds x12, x8, #1 __LF \ - sbcs x13, x9, x3 __LF \ - sbcs x14, x10, xzr __LF \ - sbcs x7, x11, x5 __LF \ - sbcs xzr, x2, xzr __LF \ - csel x8, x8, x12, lo __LF \ - csel x9, x9, x13, lo __LF \ - csel x10, x10, x14, lo __LF \ - csel x11, x11, x7, lo __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Corresponds exactly to bignum_sub_p256 - -#define sub_p256(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - csetm x3, lo __LF \ - adds x5, x5, x3 __LF \ - and x4, x3, #0xffffffff __LF \ - adcs x6, x6, x4 __LF \ - adcs x7, x7, xzr __LF \ - and x4, x3, #0xffffffff00000001 __LF \ - adc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Corresponds exactly to bignum_add_p256 - -#define add_p256(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - adds x5, x5, x4 __LF \ - adcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - adcs x7, x7, x4 __LF \ - adcs x8, x8, x3 __LF \ - adc x3, xzr, xzr __LF \ - cmn x5, #1 __LF \ - mov x4, #4294967295 __LF \ - sbcs xzr, x6, x4 __LF \ - sbcs xzr, x7, xzr __LF \ - mov x4, #-4294967295 __LF \ - sbcs xzr, x8, x4 __LF \ - adcs x3, x3, xzr __LF \ - csetm x3, ne __LF \ - subs x5, x5, x3 __LF \ - and x4, x3, #0xffffffff __LF \ - sbcs x6, x6, x4 __LF \ - sbcs x7, x7, xzr __LF \ - and x4, x3, #0xffffffff00000001 __LF \ - sbc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// A weak version of add that only guarantees sum in 4 digits - -#define weakadd_p256(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - adds x5, x5, x4 __LF \ - adcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - adcs x7, x7, x4 __LF \ - adcs x8, x8, x3 __LF \ - csetm x3, cs __LF \ - subs x5, x5, x3 __LF \ - and x1, x3, #4294967295 __LF \ - sbcs x6, x6, x1 __LF \ - sbcs x7, x7, xzr __LF \ - and x2, x3, #-4294967295 __LF \ - sbc x8, x8, x2 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// P0 = C * P1 - D * P2 computed as D * (p_256 - P2) + C * P1 -// Quotient estimation is done just as q = h + 1 as in bignum_triple_p256 -// This also applies to the other functions following. - -#define cmsub_p256(P0,C,P1,D,P2) \ - mov x1, D __LF \ - mov x2, #-1 __LF \ - ldp x9, x10, [P2] __LF \ - subs x9, x2, x9 __LF \ - mov x2, #4294967295 __LF \ - sbcs x10, x2, x10 __LF \ - ldp x11, x12, [P2+16] __LF \ - sbcs x11, xzr, x11 __LF \ - mov x2, #-4294967295 __LF \ - sbc x12, x2, x12 __LF \ - mul x3, x1, x9 __LF \ - mul x4, x1, x10 __LF \ - mul x5, x1, x11 __LF \ - mul x6, x1, x12 __LF \ - umulh x9, x1, x9 __LF \ - umulh x10, x1, x10 __LF \ - umulh x11, x1, x11 __LF \ - umulh x7, x1, x12 __LF \ - adds x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - adcs x6, x6, x11 __LF \ - adc x7, x7, xzr __LF \ - mov x1, C __LF \ - ldp x9, x10, [P1] __LF \ - mul x8, x9, x1 __LF \ - umulh x9, x9, x1 __LF \ - adds x3, x3, x8 __LF \ - mul x8, x10, x1 __LF \ - umulh x10, x10, x1 __LF \ - adcs x4, x4, x8 __LF \ - ldp x11, x12, [P1+16] __LF \ - mul x8, x11, x1 __LF \ - umulh x11, x11, x1 __LF \ - adcs x5, x5, x8 __LF \ - mul x8, x12, x1 __LF \ - umulh x12, x12, x1 __LF \ - adcs x6, x6, x8 __LF \ - adc x7, x7, xzr __LF \ - adds x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - adcs x6, x6, x11 __LF \ - adc x7, x7, x12 __LF \ - add x8, x7, #1 __LF \ - lsl x10, x8, #32 __LF \ - adds x6, x6, x10 __LF \ - adc x7, x7, xzr __LF \ - neg x9, x8 __LF \ - sub x10, x10, #1 __LF \ - subs x3, x3, x9 __LF \ - sbcs x4, x4, x10 __LF \ - sbcs x5, x5, xzr __LF \ - sbcs x6, x6, x8 __LF \ - sbc x8, x7, x8 __LF \ - adds x3, x3, x8 __LF \ - and x9, x8, #4294967295 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, xzr __LF \ - neg x10, x9 __LF \ - adc x6, x6, x10 __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -// P0 = 4 * P1 - P2, by direct subtraction of P2; the method -// in bignum_cmul_p256 etc. for quotient estimation still -// works when the value to be reduced is negative, as -// long as it is > -p_256, which is the case here. The -// actual accumulation of q * p_256 is done a bit differently -// so it works for the q = 0 case. - -#define cmsub41_p256(P0,P1,P2) \ - ldp x1, x2, [P1] __LF \ - lsl x0, x1, #2 __LF \ - ldp x6, x7, [P2] __LF \ - subs x0, x0, x6 __LF \ - extr x1, x2, x1, #62 __LF \ - sbcs x1, x1, x7 __LF \ - ldp x3, x4, [P1+16] __LF \ - extr x2, x3, x2, #62 __LF \ - ldp x6, x7, [P2+16] __LF \ - sbcs x2, x2, x6 __LF \ - extr x3, x4, x3, #62 __LF \ - sbcs x3, x3, x7 __LF \ - lsr x4, x4, #62 __LF \ - sbc x4, x4, xzr __LF \ - add x5, x4, #1 __LF \ - lsl x8, x5, #32 __LF \ - subs x6, xzr, x8 __LF \ - sbcs x7, xzr, xzr __LF \ - sbc x8, x8, x5 __LF \ - adds x0, x0, x5 __LF \ - adcs x1, x1, x6 __LF \ - adcs x2, x2, x7 __LF \ - adcs x3, x3, x8 __LF \ - csetm x5, cc __LF \ - adds x0, x0, x5 __LF \ - and x6, x5, #4294967295 __LF \ - adcs x1, x1, x6 __LF \ - adcs x2, x2, xzr __LF \ - neg x7, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -// P0 = 3 * P1 - 8 * P2, computed as (p_256 - P2) << 3 + 3 * P1 - -#define cmsub38_p256(P0,P1,P2) \ - mov x1, 8 __LF \ - mov x2, #-1 __LF \ - ldp x9, x10, [P2] __LF \ - subs x9, x2, x9 __LF \ - mov x2, #4294967295 __LF \ - sbcs x10, x2, x10 __LF \ - ldp x11, x12, [P2+16] __LF \ - sbcs x11, xzr, x11 __LF \ - mov x2, #-4294967295 __LF \ - sbc x12, x2, x12 __LF \ - lsl x3, x9, #3 __LF \ - extr x4, x10, x9, #61 __LF \ - extr x5, x11, x10, #61 __LF \ - extr x6, x12, x11, #61 __LF \ - lsr x7, x12, #61 __LF \ - mov x1, 3 __LF \ - ldp x9, x10, [P1] __LF \ - mul x8, x9, x1 __LF \ - umulh x9, x9, x1 __LF \ - adds x3, x3, x8 __LF \ - mul x8, x10, x1 __LF \ - umulh x10, x10, x1 __LF \ - adcs x4, x4, x8 __LF \ - ldp x11, x12, [P1+16] __LF \ - mul x8, x11, x1 __LF \ - umulh x11, x11, x1 __LF \ - adcs x5, x5, x8 __LF \ - mul x8, x12, x1 __LF \ - umulh x12, x12, x1 __LF \ - adcs x6, x6, x8 __LF \ - adc x7, x7, xzr __LF \ - adds x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - adcs x6, x6, x11 __LF \ - adc x7, x7, x12 __LF \ - add x8, x7, #1 __LF \ - lsl x10, x8, #32 __LF \ - adds x6, x6, x10 __LF \ - adc x7, x7, xzr __LF \ - neg x9, x8 __LF \ - sub x10, x10, #1 __LF \ - subs x3, x3, x9 __LF \ - sbcs x4, x4, x10 __LF \ - sbcs x5, x5, xzr __LF \ - sbcs x6, x6, x8 __LF \ - sbc x8, x7, x8 __LF \ - adds x3, x3, x8 __LF \ - and x9, x8, #4294967295 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, xzr __LF \ - neg x10, x9 __LF \ - adc x6, x6, x10 __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -S2N_BN_SYMBOL(p256_montjdouble_alt): - CFI_START - -// Make room on stack for temporary variables - - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - -// Main code, just a sequence of basic field operations - -// z2 = z^2 -// y2 = y^2 - - montsqr_p256(z2,z_1) - montsqr_p256(y2,y_1) - -// x2p = x^2 - z^4 = (x + z^2) * (x - z^2) - - sub_p256(t2,x_1,z2) - weakadd_p256(t1,x_1,z2) - montmul_p256(x2p,t1,t2) - -// t1 = y + z -// xy2 = x * y^2 -// x4p = x2p^2 - - add_p256(t1,y_1,z_1) - montmul_p256(xy2,x_1,y2) - montsqr_p256(x4p,x2p) - -// t1 = (y + z)^2 - - montsqr_p256(t1,t1) - -// d = 12 * xy2 - 9 * x4p -// t1 = y^2 + 2 * y * z - - cmsub_p256(d,12,xy2,9,x4p) - sub_p256(t1,t1,z2) - -// y4 = y^4 - - montsqr_p256(y4,y2) - -// dx2 = d * x2p - - montmul_p256(dx2,d,x2p) - -// z_3' = 2 * y * z - - sub_p256(z_3,t1,y2) - -// x' = 4 * xy2 - d - - cmsub41_p256(x_3,xy2,d) - -// y' = 3 * dx2 - 8 * y4 - - cmsub38_p256(y_3,dx2,y4) - -// Restore stack and return - - CFI_INC_SP(NSPACE) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_montjdouble_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjmixadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjmixadd.S deleted file mode 100644 index 78d2140b4c8..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjmixadd.S +++ /dev/null @@ -1,513 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjmixadd(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 8]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjmixadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_montjmixadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjmixadd) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x17 -#define input_x x19 -#define input_y x20 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define zp2 sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define NSPACE NUMSIZE*6 - -// Corresponds to bignum_montmul_p256 but uses x0 in place of x17 - -#define montmul_p256(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2] __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x7 __LF \ - mul x13, x4, x8 __LF \ - umulh x12, x3, x7 __LF \ - adds x16, x11, x13 __LF \ - umulh x14, x4, x8 __LF \ - adcs x0, x12, x14 __LF \ - adcs x14, x14, xzr __LF \ - adds x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adcs x14, x14, xzr __LF \ - subs x15, x3, x4 __LF \ - cneg x15, x15, lo __LF \ - csetm x1, lo __LF \ - subs x0, x8, x7 __LF \ - cneg x0, x0, lo __LF \ - mul x16, x15, x0 __LF \ - umulh x0, x15, x0 __LF \ - cinv x1, x1, lo __LF \ - eor x16, x16, x1 __LF \ - eor x0, x0, x1 __LF \ - cmn x1, #1 __LF \ - adcs x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adc x14, x14, x1 __LF \ - lsl x0, x11, #32 __LF \ - subs x1, x11, x0 __LF \ - lsr x16, x11, #32 __LF \ - sbc x11, x11, x16 __LF \ - adds x12, x12, x0 __LF \ - adcs x13, x13, x16 __LF \ - adcs x14, x14, x1 __LF \ - adc x11, x11, xzr __LF \ - lsl x0, x12, #32 __LF \ - subs x1, x12, x0 __LF \ - lsr x16, x12, #32 __LF \ - sbc x12, x12, x16 __LF \ - adds x13, x13, x0 __LF \ - adcs x14, x14, x16 __LF \ - adcs x11, x11, x1 __LF \ - adc x12, x12, xzr __LF \ - stp x13, x14, [P0] __LF \ - stp x11, x12, [P0+16] __LF \ - mul x11, x5, x9 __LF \ - mul x13, x6, x10 __LF \ - umulh x12, x5, x9 __LF \ - adds x16, x11, x13 __LF \ - umulh x14, x6, x10 __LF \ - adcs x0, x12, x14 __LF \ - adcs x14, x14, xzr __LF \ - adds x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adcs x14, x14, xzr __LF \ - subs x15, x5, x6 __LF \ - cneg x15, x15, lo __LF \ - csetm x1, lo __LF \ - subs x0, x10, x9 __LF \ - cneg x0, x0, lo __LF \ - mul x16, x15, x0 __LF \ - umulh x0, x15, x0 __LF \ - cinv x1, x1, lo __LF \ - eor x16, x16, x1 __LF \ - eor x0, x0, x1 __LF \ - cmn x1, #1 __LF \ - adcs x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adc x14, x14, x1 __LF \ - subs x3, x5, x3 __LF \ - sbcs x4, x6, x4 __LF \ - ngc x5, xzr __LF \ - cmn x5, #1 __LF \ - eor x3, x3, x5 __LF \ - adcs x3, x3, xzr __LF \ - eor x4, x4, x5 __LF \ - adcs x4, x4, xzr __LF \ - subs x7, x7, x9 __LF \ - sbcs x8, x8, x10 __LF \ - ngc x9, xzr __LF \ - cmn x9, #1 __LF \ - eor x7, x7, x9 __LF \ - adcs x7, x7, xzr __LF \ - eor x8, x8, x9 __LF \ - adcs x8, x8, xzr __LF \ - eor x10, x5, x9 __LF \ - ldp x15, x1, [P0] __LF \ - adds x15, x11, x15 __LF \ - adcs x1, x12, x1 __LF \ - ldp x5, x9, [P0+16] __LF \ - adcs x5, x13, x5 __LF \ - adcs x9, x14, x9 __LF \ - adc x2, xzr, xzr __LF \ - mul x11, x3, x7 __LF \ - mul x13, x4, x8 __LF \ - umulh x12, x3, x7 __LF \ - adds x16, x11, x13 __LF \ - umulh x14, x4, x8 __LF \ - adcs x0, x12, x14 __LF \ - adcs x14, x14, xzr __LF \ - adds x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adcs x14, x14, xzr __LF \ - subs x3, x3, x4 __LF \ - cneg x3, x3, lo __LF \ - csetm x4, lo __LF \ - subs x0, x8, x7 __LF \ - cneg x0, x0, lo __LF \ - mul x16, x3, x0 __LF \ - umulh x0, x3, x0 __LF \ - cinv x4, x4, lo __LF \ - eor x16, x16, x4 __LF \ - eor x0, x0, x4 __LF \ - cmn x4, #1 __LF \ - adcs x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adc x14, x14, x4 __LF \ - cmn x10, #1 __LF \ - eor x11, x11, x10 __LF \ - adcs x11, x11, x15 __LF \ - eor x12, x12, x10 __LF \ - adcs x12, x12, x1 __LF \ - eor x13, x13, x10 __LF \ - adcs x13, x13, x5 __LF \ - eor x14, x14, x10 __LF \ - adcs x14, x14, x9 __LF \ - adcs x3, x2, x10 __LF \ - adcs x4, x10, xzr __LF \ - adc x10, x10, xzr __LF \ - adds x13, x13, x15 __LF \ - adcs x14, x14, x1 __LF \ - adcs x3, x3, x5 __LF \ - adcs x4, x4, x9 __LF \ - adc x10, x10, x2 __LF \ - lsl x0, x11, #32 __LF \ - subs x1, x11, x0 __LF \ - lsr x16, x11, #32 __LF \ - sbc x11, x11, x16 __LF \ - adds x12, x12, x0 __LF \ - adcs x13, x13, x16 __LF \ - adcs x14, x14, x1 __LF \ - adc x11, x11, xzr __LF \ - lsl x0, x12, #32 __LF \ - subs x1, x12, x0 __LF \ - lsr x16, x12, #32 __LF \ - sbc x12, x12, x16 __LF \ - adds x13, x13, x0 __LF \ - adcs x14, x14, x16 __LF \ - adcs x11, x11, x1 __LF \ - adc x12, x12, xzr __LF \ - adds x3, x3, x11 __LF \ - adcs x4, x4, x12 __LF \ - adc x10, x10, xzr __LF \ - add x2, x10, #1 __LF \ - lsl x16, x2, #32 __LF \ - adds x4, x4, x16 __LF \ - adc x10, x10, xzr __LF \ - neg x15, x2 __LF \ - sub x16, x16, #1 __LF \ - subs x13, x13, x15 __LF \ - sbcs x14, x14, x16 __LF \ - sbcs x3, x3, xzr __LF \ - sbcs x4, x4, x2 __LF \ - sbcs x7, x10, x2 __LF \ - adds x13, x13, x7 __LF \ - mov x10, #4294967295 __LF \ - and x10, x10, x7 __LF \ - adcs x14, x14, x10 __LF \ - adcs x3, x3, xzr __LF \ - mov x10, #-4294967295 __LF \ - and x10, x10, x7 __LF \ - adc x4, x4, x10 __LF \ - stp x13, x14, [P0] __LF \ - stp x3, x4, [P0+16] - -// Corresponds to bignum_montsqr_p256 but uses x0 in place of x17 - -#define montsqr_p256(P0,P1) \ - ldp x2, x3, [P1] __LF \ - ldp x4, x5, [P1+16] __LF \ - umull x15, w2, w2 __LF \ - lsr x11, x2, #32 __LF \ - umull x16, w11, w11 __LF \ - umull x11, w2, w11 __LF \ - adds x15, x15, x11, lsl #33 __LF \ - lsr x11, x11, #31 __LF \ - adc x16, x16, x11 __LF \ - umull x0, w3, w3 __LF \ - lsr x11, x3, #32 __LF \ - umull x1, w11, w11 __LF \ - umull x11, w3, w11 __LF \ - mul x12, x2, x3 __LF \ - umulh x13, x2, x3 __LF \ - adds x0, x0, x11, lsl #33 __LF \ - lsr x11, x11, #31 __LF \ - adc x1, x1, x11 __LF \ - adds x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adc x1, x1, xzr __LF \ - adds x16, x16, x12 __LF \ - adcs x0, x0, x13 __LF \ - adc x1, x1, xzr __LF \ - lsl x12, x15, #32 __LF \ - subs x13, x15, x12 __LF \ - lsr x11, x15, #32 __LF \ - sbc x15, x15, x11 __LF \ - adds x16, x16, x12 __LF \ - adcs x0, x0, x11 __LF \ - adcs x1, x1, x13 __LF \ - adc x15, x15, xzr __LF \ - lsl x12, x16, #32 __LF \ - subs x13, x16, x12 __LF \ - lsr x11, x16, #32 __LF \ - sbc x16, x16, x11 __LF \ - adds x0, x0, x12 __LF \ - adcs x1, x1, x11 __LF \ - adcs x15, x15, x13 __LF \ - adc x16, x16, xzr __LF \ - mul x6, x2, x4 __LF \ - mul x14, x3, x5 __LF \ - umulh x8, x2, x4 __LF \ - subs x10, x2, x3 __LF \ - cneg x10, x10, lo __LF \ - csetm x13, lo __LF \ - subs x12, x5, x4 __LF \ - cneg x12, x12, lo __LF \ - mul x11, x10, x12 __LF \ - umulh x12, x10, x12 __LF \ - cinv x13, x13, lo __LF \ - eor x11, x11, x13 __LF \ - eor x12, x12, x13 __LF \ - adds x7, x6, x8 __LF \ - adc x8, x8, xzr __LF \ - umulh x9, x3, x5 __LF \ - adds x7, x7, x14 __LF \ - adcs x8, x8, x9 __LF \ - adc x9, x9, xzr __LF \ - adds x8, x8, x14 __LF \ - adc x9, x9, xzr __LF \ - cmn x13, #1 __LF \ - adcs x7, x7, x11 __LF \ - adcs x8, x8, x12 __LF \ - adc x9, x9, x13 __LF \ - adds x6, x6, x6 __LF \ - adcs x7, x7, x7 __LF \ - adcs x8, x8, x8 __LF \ - adcs x9, x9, x9 __LF \ - adc x10, xzr, xzr __LF \ - adds x6, x6, x0 __LF \ - adcs x7, x7, x1 __LF \ - adcs x8, x8, x15 __LF \ - adcs x9, x9, x16 __LF \ - adc x10, x10, xzr __LF \ - lsl x12, x6, #32 __LF \ - subs x13, x6, x12 __LF \ - lsr x11, x6, #32 __LF \ - sbc x6, x6, x11 __LF \ - adds x7, x7, x12 __LF \ - adcs x8, x8, x11 __LF \ - adcs x9, x9, x13 __LF \ - adcs x10, x10, x6 __LF \ - adc x6, xzr, xzr __LF \ - lsl x12, x7, #32 __LF \ - subs x13, x7, x12 __LF \ - lsr x11, x7, #32 __LF \ - sbc x7, x7, x11 __LF \ - adds x8, x8, x12 __LF \ - adcs x9, x9, x11 __LF \ - adcs x10, x10, x13 __LF \ - adcs x6, x6, x7 __LF \ - adc x7, xzr, xzr __LF \ - mul x11, x4, x4 __LF \ - adds x8, x8, x11 __LF \ - mul x12, x5, x5 __LF \ - umulh x11, x4, x4 __LF \ - adcs x9, x9, x11 __LF \ - adcs x10, x10, x12 __LF \ - umulh x12, x5, x5 __LF \ - adcs x6, x6, x12 __LF \ - adc x7, x7, xzr __LF \ - mul x11, x4, x5 __LF \ - umulh x12, x4, x5 __LF \ - adds x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adc x13, xzr, xzr __LF \ - adds x9, x9, x11 __LF \ - adcs x10, x10, x12 __LF \ - adcs x6, x6, x13 __LF \ - adcs x7, x7, xzr __LF \ - mov x11, #4294967295 __LF \ - adds x5, x8, #1 __LF \ - sbcs x11, x9, x11 __LF \ - mov x13, #-4294967295 __LF \ - sbcs x12, x10, xzr __LF \ - sbcs x13, x6, x13 __LF \ - sbcs xzr, x7, xzr __LF \ - csel x8, x5, x8, hs __LF \ - csel x9, x11, x9, hs __LF \ - csel x10, x12, x10, hs __LF \ - csel x6, x13, x6, hs __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x6, [P0+16] - -// Corresponds exactly to bignum_sub_p256 - -#define sub_p256(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - csetm x3, cc __LF \ - adds x5, x5, x3 __LF \ - mov x4, #0xffffffff __LF \ - and x4, x4, x3 __LF \ - adcs x6, x6, x4 __LF \ - adcs x7, x7, xzr __LF \ - mov x4, #0xffffffff00000001 __LF \ - and x4, x4, x3 __LF \ - adc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -S2N_BN_SYMBOL(p256_montjmixadd): - CFI_START - -// Save regs and make room on stack for temporary variables - - CFI_PUSH2(x19,x20) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - montsqr_p256(zp2,z_1) - montmul_p256(y2a,z_1,y_2) - - montmul_p256(x2a,zp2,x_2) - montmul_p256(y2a,zp2,y2a) - - sub_p256(xd,x2a,x_1) - sub_p256(yd,y2a,y_1) - - montsqr_p256(zz,xd) - montsqr_p256(ww,yd) - - montmul_p256(zzx1,zz,x_1) - montmul_p256(zzx2,zz,x2a) - - sub_p256(resx,ww,zzx1) - sub_p256(t1,zzx2,zzx1) - - montmul_p256(resz,xd,z_1) - - sub_p256(resx,resx,zzx2) - - sub_p256(t2,zzx1,resx) - - montmul_p256(t1,t1,y_1) - montmul_p256(t2,yd,t2) - - sub_p256(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - orr x4, x0, x1 - orr x5, x2, x3 - orr x4, x4, x5 - cmp x4, xzr - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with a z = 1 coordinate (in -// Montgomery form so not the simple constant 1 but rather 2^256 - p_256), -// hence giving 0 + p2 = p2 for the final result. - - ldp x0, x1, [resx] - ldp x12, x13, [x_2] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x2, x3, [resx+16] - ldp x12, x13, [x_2+16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - - ldp x4, x5, [resy] - ldp x12, x13, [y_2] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x6, x7, [resy+16] - ldp x12, x13, [y_2+16] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - - ldp x8, x9, [resz] - mov x12, #0x0000000000000001 - mov x13, #0xffffffff00000000 - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x10, x11, [resz+16] - mov x12, #0xffffffffffffffff - mov x13, #0x00000000fffffffe - csel x10, x10, x12, ne - csel x11, x11, x13, ne - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [y_3] - stp x6, x7, [y_3+16] - stp x8, x9, [z_3] - stp x10, x11, [z_3+16] - -// Restore registers and return - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_montjmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjmixadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjmixadd_alt.S deleted file mode 100644 index 4d9e0edccec..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_montjmixadd_alt.S +++ /dev/null @@ -1,517 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjmixadd_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 8]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjmixadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_montjmixadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjmixadd_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x15 -#define input_x x16 -#define input_y x17 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define zp2 sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define NSPACE NUMSIZE*6 - -// Corresponds to bignum_montmul_p256_alt except registers - -#define montmul_p256(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x0, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x1, x3, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x1, x1, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x1, x1, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x0, x0, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x1, x1, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x0, x0, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x1, x1, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x0, x0, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - mov x10, #0xffffffff00000001 __LF \ - adds x13, x13, x12, lsl #32 __LF \ - lsr x11, x12, #32 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x12, x10 __LF \ - umulh x12, x12, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x12, x12, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x1, x1, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - adds x14, x14, x13, lsl #32 __LF \ - lsr x11, x13, #32 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x13, x10 __LF \ - umulh x13, x13, x10 __LF \ - adcs x12, x12, x11 __LF \ - adc x13, x13, xzr __LF \ - adds x0, x0, x14, lsl #32 __LF \ - lsr x11, x14, #32 __LF \ - adcs x12, x12, x11 __LF \ - mul x11, x14, x10 __LF \ - umulh x14, x14, x10 __LF \ - adcs x13, x13, x11 __LF \ - adc x14, x14, xzr __LF \ - adds x12, x12, x0, lsl #32 __LF \ - lsr x11, x0, #32 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x0, x10 __LF \ - umulh x0, x0, x10 __LF \ - adcs x14, x14, x11 __LF \ - adc x0, x0, xzr __LF \ - adds x12, x12, x1 __LF \ - adcs x13, x13, x3 __LF \ - adcs x14, x14, x4 __LF \ - adcs x0, x0, x5 __LF \ - cset x8, cs __LF \ - mov x11, #0xffffffff __LF \ - adds x1, x12, #0x1 __LF \ - sbcs x3, x13, x11 __LF \ - sbcs x4, x14, xzr __LF \ - sbcs x5, x0, x10 __LF \ - sbcs xzr, x8, xzr __LF \ - csel x12, x12, x1, cc __LF \ - csel x13, x13, x3, cc __LF \ - csel x14, x14, x4, cc __LF \ - csel x0, x0, x5, cc __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x0, [P0+16] - -// Corresponds exactly to bignum_montsqr_p256_alt - -#define montsqr_p256(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x6, x2, x4 __LF \ - umulh x7, x2, x4 __LF \ - adds x10, x10, x6 __LF \ - adcs x11, x11, x7 __LF \ - mul x6, x3, x4 __LF \ - umulh x7, x3, x4 __LF \ - adc x7, x7, xzr __LF \ - adds x11, x11, x6 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x7 __LF \ - mul x6, x3, x5 __LF \ - umulh x7, x3, x5 __LF \ - adc x7, x7, xzr __LF \ - adds x12, x12, x6 __LF \ - adcs x13, x13, x7 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x7, cs __LF \ - umulh x6, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x6 __LF \ - mul x6, x3, x3 __LF \ - adcs x10, x10, x6 __LF \ - umulh x6, x3, x3 __LF \ - adcs x11, x11, x6 __LF \ - mul x6, x4, x4 __LF \ - adcs x12, x12, x6 __LF \ - umulh x6, x4, x4 __LF \ - adcs x13, x13, x6 __LF \ - mul x6, x5, x5 __LF \ - adcs x14, x14, x6 __LF \ - umulh x6, x5, x5 __LF \ - adc x7, x7, x6 __LF \ - adds x9, x9, x8, lsl #32 __LF \ - lsr x3, x8, #32 __LF \ - adcs x10, x10, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x8, x3 __LF \ - umulh x8, x8, x3 __LF \ - adcs x11, x11, x2 __LF \ - adc x8, x8, xzr __LF \ - adds x10, x10, x9, lsl #32 __LF \ - lsr x3, x9, #32 __LF \ - adcs x11, x11, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x9, x3 __LF \ - umulh x9, x9, x3 __LF \ - adcs x8, x8, x2 __LF \ - adc x9, x9, xzr __LF \ - adds x11, x11, x10, lsl #32 __LF \ - lsr x3, x10, #32 __LF \ - adcs x8, x8, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x10, x3 __LF \ - umulh x10, x10, x3 __LF \ - adcs x9, x9, x2 __LF \ - adc x10, x10, xzr __LF \ - adds x8, x8, x11, lsl #32 __LF \ - lsr x3, x11, #32 __LF \ - adcs x9, x9, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x11, x3 __LF \ - umulh x11, x11, x3 __LF \ - adcs x10, x10, x2 __LF \ - adc x11, x11, xzr __LF \ - adds x8, x8, x12 __LF \ - adcs x9, x9, x13 __LF \ - adcs x10, x10, x14 __LF \ - adcs x11, x11, x7 __LF \ - cset x2, cs __LF \ - mov x3, #0xffffffff __LF \ - mov x5, #0xffffffff00000001 __LF \ - adds x12, x8, #0x1 __LF \ - sbcs x13, x9, x3 __LF \ - sbcs x14, x10, xzr __LF \ - sbcs x7, x11, x5 __LF \ - sbcs xzr, x2, xzr __LF \ - csel x8, x8, x12, cc __LF \ - csel x9, x9, x13, cc __LF \ - csel x10, x10, x14, cc __LF \ - csel x11, x11, x7, cc __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Almost-Montgomery variant which we use when an input to other muls -// with the other argument fully reduced (which is always safe). - -#define amontsqr_p256(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x6, x2, x4 __LF \ - umulh x7, x2, x4 __LF \ - adds x10, x10, x6 __LF \ - adcs x11, x11, x7 __LF \ - mul x6, x3, x4 __LF \ - umulh x7, x3, x4 __LF \ - adc x7, x7, xzr __LF \ - adds x11, x11, x6 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x7 __LF \ - mul x6, x3, x5 __LF \ - umulh x7, x3, x5 __LF \ - adc x7, x7, xzr __LF \ - adds x12, x12, x6 __LF \ - adcs x13, x13, x7 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x7, cs __LF \ - umulh x6, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x6 __LF \ - mul x6, x3, x3 __LF \ - adcs x10, x10, x6 __LF \ - umulh x6, x3, x3 __LF \ - adcs x11, x11, x6 __LF \ - mul x6, x4, x4 __LF \ - adcs x12, x12, x6 __LF \ - umulh x6, x4, x4 __LF \ - adcs x13, x13, x6 __LF \ - mul x6, x5, x5 __LF \ - adcs x14, x14, x6 __LF \ - umulh x6, x5, x5 __LF \ - adc x7, x7, x6 __LF \ - adds x9, x9, x8, lsl #32 __LF \ - lsr x3, x8, #32 __LF \ - adcs x10, x10, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x8, x3 __LF \ - umulh x8, x8, x3 __LF \ - adcs x11, x11, x2 __LF \ - adc x8, x8, xzr __LF \ - adds x10, x10, x9, lsl #32 __LF \ - lsr x3, x9, #32 __LF \ - adcs x11, x11, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x9, x3 __LF \ - umulh x9, x9, x3 __LF \ - adcs x8, x8, x2 __LF \ - adc x9, x9, xzr __LF \ - adds x11, x11, x10, lsl #32 __LF \ - lsr x3, x10, #32 __LF \ - adcs x8, x8, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x10, x3 __LF \ - umulh x10, x10, x3 __LF \ - adcs x9, x9, x2 __LF \ - adc x10, x10, xzr __LF \ - adds x8, x8, x11, lsl #32 __LF \ - lsr x3, x11, #32 __LF \ - adcs x9, x9, x3 __LF \ - mov x3, #0xffffffff00000001 __LF \ - mul x2, x11, x3 __LF \ - umulh x11, x11, x3 __LF \ - adcs x10, x10, x2 __LF \ - adc x11, x11, xzr __LF \ - adds x8, x8, x12 __LF \ - adcs x9, x9, x13 __LF \ - adcs x10, x10, x14 __LF \ - adcs x11, x11, x7 __LF \ - mov x2, #0xffffffffffffffff __LF \ - csel x2, xzr, x2, cc __LF \ - mov x3, #0xffffffff __LF \ - csel x3, xzr, x3, cc __LF \ - mov x5, #0xffffffff00000001 __LF \ - csel x5, xzr, x5, cc __LF \ - subs x8, x8, x2 __LF \ - sbcs x9, x9, x3 __LF \ - sbcs x10, x10, xzr __LF \ - sbc x11, x11, x5 __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Corresponds exactly to bignum_sub_p256 - -#define sub_p256(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - csetm x3, cc __LF \ - adds x5, x5, x3 __LF \ - mov x4, #0xffffffff __LF \ - and x4, x4, x3 __LF \ - adcs x6, x6, x4 __LF \ - adcs x7, x7, xzr __LF \ - mov x4, #0xffffffff00000001 __LF \ - and x4, x4, x3 __LF \ - adc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -S2N_BN_SYMBOL(p256_montjmixadd_alt): - CFI_START - -// Make room on stack for temporary variables -// Move the input arguments to stable places - - CFI_DEC_SP(NSPACE) - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - amontsqr_p256(zp2,z_1) - montmul_p256(y2a,z_1,y_2) - - montmul_p256(x2a,zp2,x_2) - montmul_p256(y2a,zp2,y2a) - - sub_p256(xd,x2a,x_1) - sub_p256(yd,y2a,y_1) - - amontsqr_p256(zz,xd) - montsqr_p256(ww,yd) - - montmul_p256(zzx1,zz,x_1) - montmul_p256(zzx2,zz,x2a) - - sub_p256(resx,ww,zzx1) - sub_p256(t1,zzx2,zzx1) - - montmul_p256(resz,xd,z_1) - - sub_p256(resx,resx,zzx2) - - sub_p256(t2,zzx1,resx) - - montmul_p256(t1,t1,y_1) - montmul_p256(t2,yd,t2) - - sub_p256(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - orr x4, x0, x1 - orr x5, x2, x3 - orr x4, x4, x5 - cmp x4, xzr - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with a z = 1 coordinate (in -// Montgomery form so not the simple constant 1 but rather 2^256 - p_256), -// hence giving 0 + p2 = p2 for the final result. - - ldp x0, x1, [resx] - ldp x12, x13, [x_2] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x2, x3, [resx+16] - ldp x12, x13, [x_2+16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - - ldp x4, x5, [resy] - ldp x12, x13, [y_2] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x6, x7, [resy+16] - ldp x12, x13, [y_2+16] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - - ldp x8, x9, [resz] - mov x12, #0x0000000000000001 - mov x13, #0xffffffff00000000 - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x10, x11, [resz+16] - mov x12, #0xffffffffffffffff - mov x13, #0x00000000fffffffe - csel x10, x10, x12, ne - csel x11, x11, x13, ne - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [y_3] - stp x6, x7, [y_3+16] - stp x8, x9, [z_3] - stp x10, x11, [z_3+16] - -// Restore stack and return - - CFI_INC_SP(NSPACE) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_montjmixadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmul.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmul.S deleted file mode 100644 index 944d47ee578..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmul.S +++ /dev/null @@ -1,8620 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Scalar multiplication for P-256 -// Input scalar[4], point[8]; output res[8] -// -// extern void p256_scalarmul -// (uint64_t res[static 8], -// const uint64_t scalar[static 4], -// const uint64_t point[static 8]); -// -// Given scalar = n and point = P, assumed to be on the NIST elliptic -// curve P-256, returns the point (X,Y) = n * P. The input and output -// are affine points, and in the case of the point at infinity as -// the result, (0,0) is returned. -// -// Standard ARM ABI: X0 = res, X1 = scalar, X2 = point -// ---------------------------------------------------------------------------- - - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_scalarmul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_scalarmul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_scalarmul) - - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Safe copies of inputs (res lasts the whole code, point not so long) -// and additional values in variables, with some aliasing - -#define res x19 -#define sgn x20 -#define j x20 -#define point x21 - -// Intermediate variables on the stack. The last z2, z3 values can -// safely be overlaid on the table, which is no longer needed at the end. - -#define scalarb sp, #(0*NUMSIZE) -#define acc sp, #(1*NUMSIZE) -#define tabent sp, #(4*NUMSIZE) - -#define tab sp, #(7*NUMSIZE) - -#define z2 sp, #(7*NUMSIZE) -#define z3 sp, #(8*NUMSIZE) - -#define NSPACE 31*NUMSIZE - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(p256_scalarmul): - CFI_START - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x30) - CFI_DEC_SP(NSPACE) - -// Preserve the "res" and "point" input arguments. We load and process the -// scalar immediately so we don't bother preserving that input argument. -// Also, "point" is only needed early on and so its register gets re-used. - - mov res, x0 - mov point, x2 - -// Load the digits of group order n_256 = [x12;x13;x14;x15] - - movbig(x12, #0xf3b9, #0xcac2, #0xfc63, #0x2551) - movbig(x13, #0xbce6, #0xfaad, #0xa717, #0x9e84) - mov x14, #0xffffffffffffffff - mov x15, #0xffffffff00000000 - -// First, reduce the input scalar mod n_256, i.e. conditionally subtract n_256 - - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - - subs x6, x2, x12 - sbcs x7, x3, x13 - sbcs x8, x4, x14 - sbcs x9, x5, x15 - - csel x2, x2, x6, cc - csel x3, x3, x7, cc - csel x4, x4, x8, cc - csel x5, x5, x9, cc - -// Now if the top bit of the reduced scalar is set, negate it mod n_256, -// i.e. do n |-> n_256 - n. Remember the sign as "sgn" so we can -// correspondingly negate the point below. - - subs x6, x12, x2 - sbcs x7, x13, x3 - sbcs x8, x14, x4 - sbc x9, x15, x5 - - tst x5, #0x8000000000000000 - csel x2, x2, x6, eq - csel x3, x3, x7, eq - csel x4, x4, x8, eq - csel x5, x5, x9, eq - cset sgn, ne - -// In either case then add the recoding constant 0x08888...888 to allow -// signed digits. - - mov x6, 0x8888888888888888 - adds x2, x2, x6 - adcs x3, x3, x6 - bic x7, x6, #0xF000000000000000 - adcs x4, x4, x6 - adc x5, x5, x7 - - stp x2, x3, [scalarb] - stp x4, x5, [scalarb+16] - -// Set the tab[0] table entry to Montgomery-Jacobian point = 1 * P -// The z coordinate is just the Montgomery form of the constant 1. - - add x0, tab - mov x1, point - CFI_BL(Lp256_scalarmul_local_tomont_p256) - - add x1, point, #32 - add x0, tab+32 - CFI_BL(Lp256_scalarmul_local_tomont_p256) - - mov x0, #0x0000000000000001 - mov x1, #0xffffffff00000000 - stp x0, x1, [tab+64] - mov x2, #0xffffffffffffffff - mov x3, #0x00000000fffffffe - stp x2, x3, [tab+80] - -// If the top bit of the scalar was set, negate (y coordinate of) the point - - ldp x4, x5, [tab+32] - ldp x6, x7, [tab+48] - - mov x0, 0xffffffffffffffff - subs x0, x0, x4 - mov x1, 0x00000000ffffffff - sbcs x1, x1, x5 - mov x3, 0xffffffff00000001 - sbcs x2, xzr, x6 - sbc x3, x3, x7 - - cmp sgn, xzr - csel x4, x0, x4, ne - csel x5, x1, x5, ne - csel x6, x2, x6, ne - csel x7, x3, x7, ne - - stp x4, x5, [tab+32] - stp x6, x7, [tab+48] - -// Compute and record tab[1] = 2 * p, ..., tab[7] = 8 * P - - add x0, tab+96*1 - add x1, tab - CFI_BL(Lp256_scalarmul_local_p256_montjdouble) - - add x0, tab+96*2 - add x1, tab+96*1 - add x2, tab - CFI_BL(Lp256_scalarmul_local_p256_montjmixadd) - - add x0, tab+96*3 - add x1, tab+96*1 - CFI_BL(Lp256_scalarmul_local_p256_montjdouble) - - add x0, tab+96*4 - add x1, tab+96*3 - add x2, tab - CFI_BL(Lp256_scalarmul_local_p256_montjmixadd) - - add x0, tab+96*5 - add x1, tab+96*2 - CFI_BL(Lp256_scalarmul_local_p256_montjdouble) - - add x0, tab+96*6 - add x1, tab+96*5 - add x2, tab - CFI_BL(Lp256_scalarmul_local_p256_montjmixadd) - - add x0, tab+96*7 - add x1, tab+96*3 - CFI_BL(Lp256_scalarmul_local_p256_montjdouble) - -// Initialize the accumulator as a table entry for top 4 bits (unrecoded) - - ldr x14, [scalarb+24] - lsr x14, x14, #60 - - mov x0, xzr - mov x1, xzr - mov x2, xzr - mov x3, xzr - mov x4, xzr - mov x5, xzr - mov x6, xzr - mov x7, xzr - mov x8, xzr - mov x9, xzr - mov x10, xzr - mov x11, xzr - add x15, tab - - .set i, 1 -.rep 8 - cmp x14, #i - ldp x12, x13, [x15] - csel x0, x12, x0, eq - csel x1, x13, x1, eq - ldp x12, x13, [x15, #16] - csel x2, x12, x2, eq - csel x3, x13, x3, eq - ldp x12, x13, [x15, #32] - csel x4, x12, x4, eq - csel x5, x13, x5, eq - ldp x12, x13, [x15, #48] - csel x6, x12, x6, eq - csel x7, x13, x7, eq - ldp x12, x13, [x15, #64] - csel x8, x12, x8, eq - csel x9, x13, x9, eq - ldp x12, x13, [x15, #80] - csel x10, x12, x10, eq - csel x11, x13, x11, eq - add x15, x15, #96 - .set i, (i+1) -.endr - stp x0, x1, [acc] - stp x2, x3, [acc+16] - stp x4, x5, [acc+32] - stp x6, x7, [acc+48] - stp x8, x9, [acc+64] - stp x10, x11, [acc+80] - - mov j, #252 - -// Main loop over size-4 bitfields: double 4 times then add signed digit - -Lp256_scalarmul_loop: - sub j, j, #4 - - add x0, acc - add x1, acc - CFI_BL(Lp256_scalarmul_local_p256_montjdouble) - - add x0, acc - add x1, acc - CFI_BL(Lp256_scalarmul_local_p256_montjdouble) - - add x0, acc - add x1, acc - CFI_BL(Lp256_scalarmul_local_p256_montjdouble) - - add x0, acc - add x1, acc - CFI_BL(Lp256_scalarmul_local_p256_montjdouble) - - lsr x2, j, #6 - ldr x14, [sp, x2, lsl #3] // Exploits scalarb = sp exactly - lsr x14, x14, j - and x14, x14, #15 - - subs x14, x14, #8 - cset x16, lo // x16 = sign of digit (1 = negative) - cneg x14, x14, lo // x14 = absolute value of digit - -// Conditionally select the table entry tab[i-1] = i * P in constant time - - mov x0, xzr - mov x1, xzr - mov x2, xzr - mov x3, xzr - mov x4, xzr - mov x5, xzr - mov x6, xzr - mov x7, xzr - mov x8, xzr - mov x9, xzr - mov x10, xzr - mov x11, xzr - add x15, tab - .set i, 1 -.rep 8 - cmp x14, #i - ldp x12, x13, [x15] - csel x0, x12, x0, eq - csel x1, x13, x1, eq - ldp x12, x13, [x15, #16] - csel x2, x12, x2, eq - csel x3, x13, x3, eq - ldp x12, x13, [x15, #32] - csel x4, x12, x4, eq - csel x5, x13, x5, eq - ldp x12, x13, [x15, #48] - csel x6, x12, x6, eq - csel x7, x13, x7, eq - ldp x12, x13, [x15, #64] - csel x8, x12, x8, eq - csel x9, x13, x9, eq - ldp x12, x13, [x15, #80] - csel x10, x12, x10, eq - csel x11, x13, x11, eq - add x15, x15, #96 - .set i, (i+1) -.endr - -// Store it to "tabent" with the y coordinate optionally negated - - stp x0, x1, [tabent] - stp x2, x3, [tabent+16] - - mov x0, 0xffffffffffffffff - subs x0, x0, x4 - mov x1, 0x00000000ffffffff - sbcs x1, x1, x5 - mov x3, 0xffffffff00000001 - sbcs x2, xzr, x6 - sbc x3, x3, x7 - - cmp x16, xzr - csel x4, x0, x4, ne - csel x5, x1, x5, ne - csel x6, x2, x6, ne - csel x7, x3, x7, ne - - stp x4, x5, [tabent+32] - stp x6, x7, [tabent+48] - stp x8, x9, [tabent+64] - stp x10, x11, [tabent+80] - - add x0, acc - add x1, acc - add x2, tabent - CFI_BL(Lp256_scalarmul_local_p256_montjadd) - - cbnz j, Lp256_scalarmul_loop - -// That's the end of the main loop, and we just need to translate -// back from the Jacobian representation to affine. First of all, -// let z2 = 1/z^2 and z3 = 1/z^3, both without Montgomery form - - add x0, z2 - add x1, acc+64 - CFI_BL(Lp256_scalarmul_local_montsqr_p256) - - add x0, z3 - add x2, z2 - add x1, acc+64 - CFI_BL(Lp256_scalarmul_local_montmul_p256) - - add x0, z2 - add x1, z3 - CFI_BL(Lp256_scalarmul_local_demont_p256) - - add x0, z3 - add x1, z2 - CFI_BL(Lp256_scalarmul_local_inv_p256) - - add x0, z2 - add x2, z3 - add x1, acc+64 - CFI_BL(Lp256_scalarmul_local_montmul_p256) - -// Convert back from Jacobian (X,Y,Z) |-> (X/Z^2, Y/Z^3) - - add x1, acc - add x2, z2 - mov x0, res - CFI_BL(Lp256_scalarmul_local_montmul_p256) - - add x0, res, #32 - add x1, acc+32 - add x2, z3 - CFI_BL(Lp256_scalarmul_local_montmul_p256) - -// Restore stack and registers and return - - CFI_INC_SP(NSPACE) - CFI_POP2(x21,x30) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_scalarmul) - -// Local copies of subroutines, complete clones at the moment - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_local_demont_p256) - -Lp256_scalarmul_local_demont_p256: - CFI_START - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - lsl x7, x2, #32 - subs x8, x2, x7 - lsr x6, x2, #32 - sbc x2, x2, x6 - adds x3, x3, x7 - adcs x4, x4, x6 - adcs x5, x5, x8 - adc x2, x2, xzr - lsl x7, x3, #32 - subs x8, x3, x7 - lsr x6, x3, #32 - sbc x3, x3, x6 - adds x4, x4, x7 - adcs x5, x5, x6 - adcs x2, x2, x8 - adc x3, x3, xzr - lsl x7, x4, #32 - subs x8, x4, x7 - lsr x6, x4, #32 - sbc x4, x4, x6 - adds x5, x5, x7 - adcs x2, x2, x6 - adcs x3, x3, x8 - adc x4, x4, xzr - lsl x7, x5, #32 - subs x8, x5, x7 - lsr x6, x5, #32 - sbc x5, x5, x6 - adds x2, x2, x7 - adcs x3, x3, x6 - adcs x4, x4, x8 - adc x5, x5, xzr - stp x2, x3, [x0] - stp x4, x5, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_local_demont_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_local_inv_p256) - -Lp256_scalarmul_local_inv_p256: - CFI_START - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_DEC_SP(160) - mov x20, x0 - mov x10, #0xffffffffffffffff - mov x11, #0xffffffff - mov x13, #0xffffffff00000001 - stp x10, x11, [sp] - stp xzr, x13, [sp, #16] - str xzr, [sp, #32] - ldp x2, x3, [x1] - subs x10, x2, x10 - sbcs x11, x3, x11 - ldp x4, x5, [x1, #16] - sbcs x12, x4, xzr - sbcs x13, x5, x13 - csel x2, x2, x10, cc - csel x3, x3, x11, cc - csel x4, x4, x12, cc - csel x5, x5, x13, cc - stp x2, x3, [sp, #48] - stp x4, x5, [sp, #64] - str xzr, [sp, #80] - stp xzr, xzr, [sp, #96] - stp xzr, xzr, [sp, #112] - mov x10, #0x4000000000000 - stp x10, xzr, [sp, #128] - stp xzr, xzr, [sp, #144] - mov x21, #0xa - mov x22, #0x1 - b Lp256_scalarmul_inv_midloop -Lp256_scalarmul_inv_loop: - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - and x0, x12, x16 - and x1, x13, x17 - add x19, x0, x1 - ldr x7, [sp] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #48] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x7, [sp, #8] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #56] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [sp] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [sp, #48] - ldr x7, [sp, #16] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #64] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [sp, #8] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [sp, #56] - ldr x7, [sp, #24] - eor x1, x7, x14 - ldr x23, [sp, #32] - eor x3, x23, x14 - and x3, x3, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #72] - eor x1, x8, x15 - ldr x24, [sp, #80] - eor x0, x24, x15 - and x0, x0, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [sp, #16] - extr x5, x3, x5, #59 - str x5, [sp, #24] - asr x3, x3, #59 - str x3, [sp, #32] - eor x1, x7, x16 - eor x5, x23, x16 - and x5, x5, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - eor x0, x24, x17 - and x0, x0, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - extr x4, x2, x4, #59 - str x4, [sp, #64] - extr x2, x5, x2, #59 - str x2, [sp, #72] - asr x5, x5, #59 - str x5, [sp, #80] - ldr x7, [sp, #96] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #128] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #96] - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - str x5, [sp, #128] - adc x3, x3, x1 - ldr x7, [sp, #104] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #136] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #104] - adc x6, x6, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - str x3, [sp, #136] - adc x4, x4, x1 - ldr x7, [sp, #112] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #144] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #112] - adc x5, x5, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - str x4, [sp, #144] - adc x2, x2, x1 - ldr x7, [sp, #120] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #152] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - ldp x0, x1, [sp, #96] - ldr x6, [sp, #112] - mov x14, #0xe000000000000000 - adds x0, x0, x14 - sbcs x1, x1, xzr - mov x11, #0x1fffffff - adcs x6, x6, x11 - mov x10, #0x2000000000000000 - adcs x5, x5, x10 - mov x14, #0x1fffffffe0000000 - adc x3, x3, x14 - lsl x11, x0, #32 - subs x14, x0, x11 - lsr x10, x0, #32 - sbc x0, x0, x10 - adds x1, x1, x11 - adcs x6, x6, x10 - adcs x5, x5, x14 - adcs x3, x3, x0 - mov x14, #0xffffffffffffffff - mov x11, #0xffffffff - mov x10, #0xffffffff00000001 - csel x14, x14, xzr, cs - csel x11, x11, xzr, cs - csel x10, x10, xzr, cs - subs x1, x1, x14 - sbcs x6, x6, x11 - sbcs x5, x5, xzr - sbc x3, x3, x10 - stp x1, x6, [sp, #96] - stp x5, x3, [sp, #112] - eor x1, x7, x16 - and x5, x16, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - and x0, x17, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - ldp x0, x1, [sp, #128] - ldr x3, [sp, #144] - mov x14, #0xe000000000000000 - adds x0, x0, x14 - sbcs x1, x1, xzr - mov x11, #0x1fffffff - adcs x3, x3, x11 - mov x10, #0x2000000000000000 - adcs x2, x2, x10 - mov x14, #0x1fffffffe0000000 - adc x5, x5, x14 - lsl x11, x0, #32 - subs x14, x0, x11 - lsr x10, x0, #32 - sbc x0, x0, x10 - adds x1, x1, x11 - adcs x3, x3, x10 - adcs x2, x2, x14 - adcs x5, x5, x0 - mov x14, #0xffffffffffffffff - mov x11, #0xffffffff - mov x10, #0xffffffff00000001 - csel x14, x14, xzr, cs - csel x11, x11, xzr, cs - csel x10, x10, xzr, cs - subs x1, x1, x14 - sbcs x3, x3, x11 - sbcs x2, x2, xzr - sbc x5, x5, x10 - stp x1, x3, [sp, #128] - stp x2, x5, [sp, #144] -Lp256_scalarmul_inv_midloop: - mov x1, x22 - ldr x2, [sp] - ldr x3, [sp, #48] - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x8, x4, #0x100, lsl #12 - sbfx x8, x8, #21, #21 - mov x11, #0x100000 - add x11, x11, x11, lsl #21 - add x9, x4, x11 - asr x9, x9, #42 - add x10, x5, #0x100, lsl #12 - sbfx x10, x10, #21, #21 - add x11, x5, x11 - asr x11, x11, #42 - mul x6, x8, x2 - mul x7, x9, x3 - mul x2, x10, x2 - mul x3, x11, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #21, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #42 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #21, #21 - add x15, x5, x15 - asr x15, x15, #42 - mul x6, x12, x2 - mul x7, x13, x3 - mul x2, x14, x2 - mul x3, x15, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - mul x2, x12, x8 - mul x3, x12, x9 - mul x6, x14, x8 - mul x7, x14, x9 - madd x8, x13, x10, x2 - madd x9, x13, x11, x3 - madd x16, x15, x10, x6 - madd x17, x15, x11, x7 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #22, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #43 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #22, #21 - add x15, x5, x15 - asr x15, x15, #43 - mneg x2, x12, x8 - mneg x3, x12, x9 - mneg x4, x14, x8 - mneg x5, x14, x9 - msub x10, x13, x16, x2 - msub x11, x13, x17, x3 - msub x12, x15, x16, x4 - msub x13, x15, x17, x5 - mov x22, x1 - subs x21, x21, #0x1 - b.ne Lp256_scalarmul_inv_loop - ldr x0, [sp] - ldr x1, [sp, #48] - mul x0, x0, x10 - madd x1, x1, x11, x0 - asr x0, x1, #63 - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - eor x14, x14, x0 - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - eor x15, x15, x0 - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - eor x16, x16, x0 - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - eor x17, x17, x0 - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - ldr x7, [sp, #96] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #128] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #96] - adc x2, x2, x1 - ldr x7, [sp, #104] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #136] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #104] - adc x6, x6, x1 - ldr x7, [sp, #112] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #144] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #112] - adc x5, x5, x1 - ldr x7, [sp, #120] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #152] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - ldp x0, x1, [sp, #96] - ldr x2, [sp, #112] - mov x14, #0xe000000000000000 - adds x0, x0, x14 - sbcs x1, x1, xzr - mov x11, #0x1fffffff - adcs x2, x2, x11 - mov x10, #0x2000000000000000 - adcs x5, x5, x10 - mov x14, #0x1fffffffe0000000 - adc x3, x3, x14 - lsl x11, x0, #32 - subs x14, x0, x11 - lsr x10, x0, #32 - sbc x0, x0, x10 - adds x1, x1, x11 - adcs x2, x2, x10 - adcs x5, x5, x14 - adcs x3, x3, x0 - mov x14, #0xffffffffffffffff - mov x11, #0xffffffff - mov x10, #0xffffffff00000001 - csel x14, x14, xzr, cs - csel x11, x11, xzr, cs - csel x10, x10, xzr, cs - subs x1, x1, x14 - sbcs x2, x2, x11 - sbcs x5, x5, xzr - sbc x3, x3, x10 - mov x10, #0xffffffffffffffff - subs x10, x1, x10 - mov x11, #0xffffffff - sbcs x11, x2, x11 - mov x13, #0xffffffff00000001 - sbcs x12, x5, xzr - sbcs x13, x3, x13 - csel x10, x1, x10, cc - csel x11, x2, x11, cc - csel x12, x5, x12, cc - csel x13, x3, x13, cc - stp x10, x11, [x20] - stp x12, x13, [x20, #16] - CFI_INC_SP(160) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_local_inv_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_local_montmul_p256) - -Lp256_scalarmul_local_montmul_p256: - CFI_START - ldr q20, [x2] - ldp x7, x17, [x1] - ldr q0, [x1] - ldp x6, x10, [x2] - ldp x11, x15, [x1, #16] - rev64 v16.4S, v20.4S - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4S, v16.4S, v0.4S - umulh x12, x17, x10 - uzp1 v28.4S, v20.4S, v0.4S - subs x14, x11, x7 - ldr q20, [x2, #16] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2D, v16.4S - umulh x4, x7, x6 - uzp1 v21.4S, v0.4S, v0.4S - cneg x11, x8, cc - shl v17.2D, v27.2D, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2D, v21.2S, v28.2S - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [x1, #16] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2S, v20.2D - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4S, v20.4S, v20.4S - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2S, v28.2D - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x2, #16] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x9, x3, x13 - adcs x3, x8, x7 - umulh x8, x14, x11 - umull v21.2D, v0.2S, v1.2S - adcs x12, x10, x12 - umull v3.2D, v0.2S, v16.2S - adc x15, x15, xzr - rev64 v24.4S, v20.4S - stp x12, x15, [x0, #16] - movi v2.2D, #0x00000000ffffffff - mul x10, x14, x11 - mul v4.4S, v24.4S, v28.4S - subs x13, x14, x5 - uzp2 v19.4S, v28.4S, v28.4S - csetm x15, cc - usra v3.2D, v21.2D, #32 - mul x7, x5, x1 - umull v21.2D, v19.2S, v16.2S - cneg x13, x13, cc - uaddlp v5.2D, v4.4S - subs x11, x1, x11 - and v16.16B, v3.16B, v2.16B - umulh x5, x5, x1 - shl v24.2D, v5.2D, #32 - cneg x11, x11, cc - umlal v16.2D, v19.2S, v1.2S - cinv x12, x15, cc - umlal v24.2D, v0.2S, v1.2S - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - stp x9, x3, [x0] - usra v21.2D, v3.2D, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2D, v16.2D, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - ldp x15, x8, [x0] - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - ldp x9, x13, [x0, #16] - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x15 - adcs x15, x16, x8 - eor x5, x17, x4 - adcs x9, x1, x9 - eor x1, x10, x5 - adcs x16, x2, x13 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [x0] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_local_montmul_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_local_montsqr_p256) - -Lp256_scalarmul_local_montsqr_p256: - CFI_START - ldr q19, [x1] - ldp x9, x13, [x1] - ldr q23, [x1, #16] - ldr q0, [x1] - ldp x1, x10, [x1, #16] - uzp2 v29.4S, v19.4S, v19.4S - xtn v4.2S, v19.2D - umulh x8, x9, x13 - rev64 v20.4S, v23.4S - umull v16.2D, v19.2S, v19.2S - umull v1.2D, v29.2S, v4.2S - mul v20.4S, v20.4S, v0.4S - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2D, v19.4S, v19.4S - mov x4, v16.d[0] - uzp1 v17.4S, v23.4S, v0.4S - uaddlp v19.2D, v20.4S - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4S, v0.4S, v0.4S - shl v19.2D, v19.2D, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2D, v20.2S, v17.2S - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x16, x3, x16, cs - csel x14, x8, x14, cs - csel x12, x11, x12, cs - csel x2, x5, x2, cs - stp x14, x12, [x0, #16] - stp x16, x2, [x0] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_local_montsqr_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_local_tomont_p256) - -Lp256_scalarmul_local_tomont_p256: - CFI_START - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - mov x1, #0xffffffffffffffff - mov x7, #0xffffffff - mov x9, #0xffffffff00000001 - subs x1, x2, x1 - sbcs x7, x3, x7 - sbcs x8, x4, xzr - sbcs x9, x5, x9 - csel x2, x2, x1, cc - csel x3, x3, x7, cc - csel x4, x4, x8, cc - csel x5, x5, x9, cc - cmp xzr, xzr - extr x9, x5, x4, #32 - adcs xzr, x4, x9 - lsr x9, x5, #32 - adcs x9, x5, x9 - csetm x6, cs - orr x9, x9, x6 - lsl x7, x9, #32 - lsr x8, x9, #32 - adds x4, x4, x7 - adc x5, x5, x8 - negs x6, x9 - sbcs x7, x7, xzr - sbc x8, x8, xzr - negs x6, x6 - sbcs x2, x2, x7 - sbcs x3, x3, x8 - sbcs x4, x4, x9 - sbcs x5, x5, x9 - adds x6, x6, x5 - mov x7, #0xffffffff - and x7, x7, x5 - adcs x2, x2, x7 - adcs x3, x3, xzr - mov x7, #0xffffffff00000001 - and x7, x7, x5 - adc x4, x4, x7 - cmp xzr, xzr - extr x9, x4, x3, #32 - adcs xzr, x3, x9 - lsr x9, x4, #32 - adcs x9, x4, x9 - csetm x5, cs - orr x9, x9, x5 - lsl x7, x9, #32 - lsr x8, x9, #32 - adds x3, x3, x7 - adc x4, x4, x8 - negs x5, x9 - sbcs x7, x7, xzr - sbc x8, x8, xzr - negs x5, x5 - sbcs x6, x6, x7 - sbcs x2, x2, x8 - sbcs x3, x3, x9 - sbcs x4, x4, x9 - adds x5, x5, x4 - mov x7, #0xffffffff - and x7, x7, x4 - adcs x6, x6, x7 - adcs x2, x2, xzr - mov x7, #0xffffffff00000001 - and x7, x7, x4 - adc x3, x3, x7 - cmp xzr, xzr - extr x9, x3, x2, #32 - adcs xzr, x2, x9 - lsr x9, x3, #32 - adcs x9, x3, x9 - csetm x4, cs - orr x9, x9, x4 - lsl x7, x9, #32 - lsr x8, x9, #32 - adds x2, x2, x7 - adc x3, x3, x8 - negs x4, x9 - sbcs x7, x7, xzr - sbc x8, x8, xzr - negs x4, x4 - sbcs x5, x5, x7 - sbcs x6, x6, x8 - sbcs x2, x2, x9 - sbcs x3, x3, x9 - adds x4, x4, x3 - mov x7, #0xffffffff - and x7, x7, x3 - adcs x5, x5, x7 - adcs x6, x6, xzr - mov x7, #0xffffffff00000001 - and x7, x7, x3 - adc x2, x2, x7 - cmp xzr, xzr - extr x9, x2, x6, #32 - adcs xzr, x6, x9 - lsr x9, x2, #32 - adcs x9, x2, x9 - csetm x3, cs - orr x9, x9, x3 - lsl x7, x9, #32 - lsr x8, x9, #32 - adds x6, x6, x7 - adc x2, x2, x8 - negs x3, x9 - sbcs x7, x7, xzr - sbc x8, x8, xzr - negs x3, x3 - sbcs x4, x4, x7 - sbcs x5, x5, x8 - sbcs x6, x6, x9 - sbcs x2, x2, x9 - adds x3, x3, x2 - mov x7, #0xffffffff - and x7, x7, x2 - adcs x4, x4, x7 - adcs x5, x5, xzr - mov x7, #0xffffffff00000001 - and x7, x7, x2 - adc x6, x6, x7 - stp x3, x4, [x0] - stp x5, x6, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_local_tomont_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_local_p256_montjadd) - -Lp256_scalarmul_local_p256_montjadd: - CFI_START - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_PUSH2(x27,x30) - CFI_DEC_SP(224) - mov x21, x0 - mov x22, x1 - mov x23, x2 - mov x0, sp - ldr q19, [x22, #64] - ldp x9, x13, [x22, #64] - ldr q23, [x22, #80] - ldr q0, [x22, #64] - ldp x1, x10, [x22, #80] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc // cc = lo, ul, last - cneg x6, x14, cc // cc = lo, ul, last - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc // cc = lo, ul, last - cinv x2, x5, cc // cc = lo, ul, last - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff // #4294967295 - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 // #-4294967295 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x19, x3, x16, cs // cs = hs, nlast - csel x14, x8, x14, cs // cs = hs, nlast - csel x12, x11, x12, cs // cs = hs, nlast - csel x20, x5, x2, cs // cs = hs, nlast - stp x14, x12, [x0, #16] - stp x19, x20, [x0] - ldr q19, [x23, #64] - ldp x9, x13, [x23, #64] - ldr q23, [x23, #80] - ldr q0, [x23, #64] - ldp x1, x10, [x23, #80] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc // cc = lo, ul, last - cneg x6, x14, cc // cc = lo, ul, last - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc // cc = lo, ul, last - cinv x2, x5, cc // cc = lo, ul, last - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff // #4294967295 - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 // #-4294967295 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x16, x3, x16, cs // cs = hs, nlast - csel x14, x8, x14, cs // cs = hs, nlast - csel x12, x11, x12, cs // cs = hs, nlast - csel x2, x5, x2, cs // cs = hs, nlast - stp x14, x12, [sp, #176] - stp x16, x2, [sp, #160] - ldr q20, [x22, #32] - ldp x7, x17, [x23, #64] - ldr q0, [x23, #64] - ldp x6, x10, [x22, #32] - ldp x11, x15, [x23, #80] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [x22, #48] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [x23, #80] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x22, #48] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x24, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x24 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [sp, #192] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #208] - ldr q20, [x23, #32] - ldp x7, x17, [x22, #64] - ldr q0, [x22, #64] - ldp x6, x10, [x23, #32] - ldp x11, x15, [x22, #80] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [x23, #48] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [x22, #80] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x23, #48] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x24, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x24 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x24, x11, x13 - and x1, x1, x13 - adcs x25, x4, x1 - and x1, x12, x13 - stp x24, x25, [sp, #32] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #48] - mov x1, sp - ldr q20, [x23] - ldr q0, [x1] - ldp x6, x10, [x23] - ldp x11, x15, [x1, #16] - rev64 v16.4s, v20.4s - subs x4, x19, x20 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x20, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x19 - ldr q20, [x23, #16] - sbcs x5, x15, x20 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x19, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [x1, #16] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x23, #16] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x19, x3, x13 - adcs x20, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x19 - adcs x15, x16, x20 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [sp, #64] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #80] - ldr q20, [x22] - ldp x7, x17, [sp, #160] - ldr q0, [sp, #160] - ldp x6, x10, [x22] - ldp x11, x15, [sp, #176] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [x22, #16] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [sp, #176] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x22, #16] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x19, x3, x13 - adcs x20, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x19 - adcs x15, x16, x20 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [sp, #128] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #144] - mov x1, sp - ldr q20, [sp, #32] - ldp x7, x17, [x1] - ldr q0, [x1] - ldp x11, x15, [x1, #16] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x25 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [sp, #48] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x24 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x25, x24 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [x1, #16] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #48] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x24, x7 - sbcs x9, x25, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x19, x3, x13 - adcs x20, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x24, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x25, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x19 - adcs x15, x16, x20 - eor x5, x17, x4 - adcs x9, x1, x24 - eor x1, x10, x5 - adcs x16, x2, x25 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x19, x11, x13 - and x1, x1, x13 - adcs x20, x4, x1 - and x1, x12, x13 - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #48] - ldr q20, [sp, #192] - ldp x7, x17, [sp, #160] - ldr q0, [sp, #160] - ldp x6, x10, [sp, #192] - ldp x11, x15, [sp, #176] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [sp, #208] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [sp, #176] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #208] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x24, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x24 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x9, x11, x13 - and x1, x1, x13 - adcs x10, x4, x1 - and x1, x12, x13 - stp x9, x10, [sp, #192] - adcs x11, x7, xzr - adc x12, x17, x1 - stp x11, x12, [sp, #208] - ldp x5, x6, [sp, #64] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc // cc = lo, ul, last - adds x13, x5, x3 - and x4, x3, #0xffffffff - adcs x24, x6, x4 - adcs x25, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x26, x8, x4 - stp x13, x24, [sp, #160] - stp x25, x26, [sp, #176] - subs x5, x19, x9 - sbcs x6, x20, x10 - ldp x7, x8, [sp, #48] - sbcs x7, x7, x11 - sbcs x8, x8, x12 - csetm x3, cc // cc = lo, ul, last - adds x19, x5, x3 - and x4, x3, #0xffffffff - adcs x20, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x19, x20, [sp, #32] - stp x7, x8, [sp, #48] - ldr q19, [sp, #160] - ldr q23, [sp, #176] - ldr q0, [sp, #160] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x13, x24 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x13, x24 - umulh x15, x13, x25 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x13, x24 - mov x12, v1.d[0] - csetm x5, cc // cc = lo, ul, last - cneg x6, x14, cc // cc = lo, ul, last - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x26, x25 - mov x9, v1.d[1] - cneg x17, x2, cc // cc = lo, ul, last - cinv x2, x5, cc // cc = lo, ul, last - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x24, x26 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x25, x26 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x25, x26 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x26, x26 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x26, x26 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x25, x25 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x25, x25 - adcs x2, x2, x9 - mov x6, #0xffffffff // #4294967295 - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 // #-4294967295 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x24, x3, x16, cs // cs = hs, nlast - csel x25, x8, x14, cs // cs = hs, nlast - csel x26, x11, x12, cs // cs = hs, nlast - csel x27, x5, x2, cs // cs = hs, nlast - stp x25, x26, [sp, #112] - stp x24, x27, [sp, #96] - mov x0, sp - ldr q19, [sp, #32] - ldr q23, [sp, #48] - ldr q0, [sp, #32] - ldp x1, x10, [sp, #48] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x19, x20 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x19, x20 - umulh x15, x19, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x19, x20 - mov x12, v1.d[0] - csetm x5, cc // cc = lo, ul, last - cneg x6, x14, cc // cc = lo, ul, last - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc // cc = lo, ul, last - cinv x2, x5, cc // cc = lo, ul, last - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x20, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff // #4294967295 - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 // #-4294967295 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x16, x3, x16, cs // cs = hs, nlast - csel x14, x8, x14, cs // cs = hs, nlast - csel x12, x11, x12, cs // cs = hs, nlast - csel x2, x5, x2, cs // cs = hs, nlast - stp x14, x12, [x0, #16] - stp x16, x2, [x0] - ldr q20, [sp, #128] - ldr q0, [sp, #96] - ldp x6, x10, [sp, #128] - rev64 v16.4s, v20.4s - subs x4, x24, x27 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x27, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x25, x24 - ldr q20, [sp, #144] - sbcs x5, x26, x27 - ngc x17, xzr - subs x8, x25, x26 - uaddlp v27.2d, v16.4s - umulh x4, x24, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [sp, #112] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #144] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x19, x3, x13 - adcs x20, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x25, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x26, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x19 - adcs x15, x16, x20 - eor x5, x17, x4 - adcs x9, x1, x25 - eor x1, x10, x5 - adcs x16, x2, x26 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x19, x11, x13 - and x1, x1, x13 - adcs x20, x4, x1 - and x1, x12, x13 - stp x19, x20, [sp, #128] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #144] - ldr q20, [sp, #64] - ldr q0, [sp, #96] - ldp x6, x10, [sp, #64] - ldp x11, x15, [sp, #112] - rev64 v16.4s, v20.4s - subs x4, x24, x27 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x27, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x24 - ldr q20, [sp, #80] - sbcs x5, x15, x27 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x24, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [sp, #112] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #80] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x24, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x24 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x9, x11, x13 - and x1, x1, x13 - adcs x10, x4, x1 - and x1, x12, x13 - stp x9, x10, [sp, #64] - adcs x11, x7, xzr - adc x12, x17, x1 - stp x11, x12, [sp, #80] - mov x0, sp - mov x1, sp - ldp x5, x6, [x1] - subs x5, x5, x19 - sbcs x6, x6, x20 - ldp x7, x8, [x1, #16] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc // cc = lo, ul, last - adds x24, x5, x3 - and x4, x3, #0xffffffff - adcs x25, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x7, x8, [x0, #16] - subs x5, x9, x19 - sbcs x6, x10, x20 - ldp x4, x3, [sp, #144] - sbcs x7, x11, x4 - sbcs x8, x12, x3 - csetm x3, cc // cc = lo, ul, last - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [sp, #96] - stp x7, x8, [sp, #112] - ldr q20, [x22, #64] - ldp x7, x17, [sp, #160] - ldr q0, [sp, #160] - ldp x6, x10, [x22, #64] - ldp x11, x15, [sp, #176] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [x22, #80] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [sp, #176] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x22, #80] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x19, x3, x13 - adcs x20, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x19 - adcs x15, x16, x20 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [sp, #160] - adcs x19, x7, xzr - adc x20, x17, x1 - stp x19, x20, [sp, #176] - mov x0, sp - mov x1, sp - ldp x4, x3, [sp, #64] - subs x5, x24, x4 - sbcs x6, x25, x3 - ldp x7, x8, [x1, #16] - ldp x4, x3, [sp, #80] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc // cc = lo, ul, last - adds x9, x5, x3 - and x4, x3, #0xffffffff - adcs x10, x6, x4 - adcs x11, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x3, x8, x4 - stp x9, x10, [x0] - stp x11, x3, [x0, #16] - ldp x5, x6, [sp, #128] - subs x5, x5, x9 - sbcs x6, x6, x10 - ldp x7, x8, [sp, #144] - sbcs x7, x7, x11 - sbcs x8, x8, x3 - csetm x3, cc // cc = lo, ul, last - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [sp, #128] - stp x7, x8, [sp, #144] - ldr q20, [sp, #192] - ldp x7, x17, [sp, #96] - ldr q0, [sp, #96] - ldp x6, x10, [sp, #192] - ldp x11, x15, [sp, #112] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [sp, #208] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [sp, #112] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #208] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x24, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x24 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [sp, #96] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #112] - ldr q20, [x23, #64] - ldp x7, x17, [sp, #160] - ldr q0, [sp, #160] - ldp x6, x10, [x23, #64] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x19, x7 - ldr q20, [x23, #80] - sbcs x5, x20, x17 - ngc x17, xzr - subs x8, x19, x20 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [sp, #176] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x23, #80] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x19, x3, x13 - adcs x20, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x24, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x25, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x19 - adcs x15, x16, x20 - eor x5, x17, x4 - adcs x9, x1, x24 - eor x1, x10, x5 - adcs x16, x2, x25 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x19, x11, x13 - and x1, x1, x13 - adcs x20, x4, x1 - and x1, x12, x13 - stp x19, x20, [sp, #160] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #176] - ldr q20, [sp, #128] - ldp x7, x17, [sp, #32] - ldr q0, [sp, #32] - ldp x6, x10, [sp, #128] - ldp x11, x15, [sp, #48] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [sp, #144] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [sp, #48] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #144] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x24, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x24 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x5, x11, x13 - and x1, x1, x13 - adcs x6, x4, x1 - and x1, x12, x13 - adcs x7, x7, xzr - adc x9, x17, x1 - ldp x4, x3, [sp, #96] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x4, x3, [sp, #112] - sbcs x7, x7, x4 - sbcs x8, x9, x3 - csetm x3, cc // cc = lo, ul, last - adds x15, x5, x3 - and x4, x3, #0xffffffff - adcs x24, x6, x4 - adcs x25, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x26, x8, x4 - stp x15, x24, [sp, #128] - stp x25, x26, [sp, #144] - ldp x0, x1, [x22, #64] - ldp x2, x3, [x22, #80] - orr x12, x0, x1 - orr x13, x2, x3 - orr x12, x12, x13 - cmp x12, xzr - cset x12, ne // ne = any - ldp x4, x5, [x23, #64] - ldp x6, x7, [x23, #80] - orr x13, x4, x5 - orr x14, x6, x7 - orr x13, x13, x14 - cmp x13, xzr - cset x13, ne // ne = any - cmp x13, x12 - csel x8, x0, x19, cc // cc = lo, ul, last - csel x9, x1, x20, cc // cc = lo, ul, last - csel x8, x4, x8, hi // hi = pmore - csel x9, x5, x9, hi // hi = pmore - ldp x10, x11, [sp, #176] - csel x10, x2, x10, cc // cc = lo, ul, last - csel x11, x3, x11, cc // cc = lo, ul, last - csel x10, x6, x10, hi // hi = pmore - csel x11, x7, x11, hi // hi = pmore - ldp x12, x13, [x22] - ldp x0, x1, [sp] - csel x0, x12, x0, cc // cc = lo, ul, last - csel x1, x13, x1, cc // cc = lo, ul, last - ldp x12, x13, [x23] - csel x0, x12, x0, hi // hi = pmore - csel x1, x13, x1, hi // hi = pmore - ldp x12, x13, [x22, #16] - ldp x2, x3, [sp, #16] - csel x2, x12, x2, cc // cc = lo, ul, last - csel x3, x13, x3, cc // cc = lo, ul, last - ldp x12, x13, [x23, #16] - csel x2, x12, x2, hi // hi = pmore - csel x3, x13, x3, hi // hi = pmore - ldp x12, x13, [x22, #32] - csel x4, x12, x15, cc // cc = lo, ul, last - csel x5, x13, x24, cc // cc = lo, ul, last - ldp x12, x13, [x23, #32] - csel x4, x12, x4, hi // hi = pmore - csel x5, x13, x5, hi // hi = pmore - ldp x12, x13, [x22, #48] - csel x6, x12, x25, cc // cc = lo, ul, last - csel x7, x13, x26, cc // cc = lo, ul, last - ldp x12, x13, [x23, #48] - csel x6, x12, x6, hi // hi = pmore - csel x7, x13, x7, hi // hi = pmore - stp x0, x1, [x21] - stp x2, x3, [x21, #16] - stp x4, x5, [x21, #32] - stp x6, x7, [x21, #48] - stp x8, x9, [x21, #64] - stp x10, x11, [x21, #80] - CFI_INC_SP(224) - CFI_POP2(x27,x30) - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_local_p256_montjadd) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_local_p256_montjdouble) - -Lp256_scalarmul_local_p256_montjdouble: - CFI_START - CFI_DEC_SP(272) - stp x19, x20, [sp, #192] - stp x21, x22, [sp, #208] - stp x23, x24, [sp, #224] - stp x25, x26, [sp, #240] - stp x27, xzr, [sp, #256] - mov x19, x0 - mov x20, x1 - mov x0, sp - ldr q19, [x20, #64] - ldp x9, x13, [x20, #64] - ldr q23, [x20, #80] - ldr q0, [x20, #64] - ldp x1, x10, [x20, #80] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc // cc = lo, ul, last - cneg x6, x14, cc // cc = lo, ul, last - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc // cc = lo, ul, last - cinv x2, x5, cc // cc = lo, ul, last - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff // #4294967295 - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 // #-4294967295 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x21, x3, x16, cs // cs = hs, nlast - csel x22, x8, x14, cs // cs = hs, nlast - csel x23, x11, x12, cs // cs = hs, nlast - csel x24, x5, x2, cs // cs = hs, nlast - stp x22, x23, [x0, #16] - stp x21, x24, [x0] - ldr q19, [x20, #32] - ldp x9, x13, [x20, #32] - ldr q23, [x20, #48] - ldr q0, [x20, #32] - ldp x1, x10, [x20, #48] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc // cc = lo, ul, last - cneg x6, x14, cc // cc = lo, ul, last - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc // cc = lo, ul, last - cinv x2, x5, cc // cc = lo, ul, last - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff // #4294967295 - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 // #-4294967295 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x16, x3, x16, cs // cs = hs, nlast - csel x14, x8, x14, cs // cs = hs, nlast - csel x12, x11, x12, cs // cs = hs, nlast - csel x2, x5, x2, cs // cs = hs, nlast - stp x14, x12, [sp, #48] - stp x16, x2, [sp, #32] - ldp x5, x6, [x20] - subs x5, x5, x21 - sbcs x6, x6, x24 - ldp x7, x8, [x20, #16] - sbcs x7, x7, x22 - sbcs x8, x8, x23 - csetm x3, cc // cc = lo, ul, last - adds x10, x5, x3 - and x4, x3, #0xffffffff - adcs x25, x6, x4 - adcs x26, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x27, x8, x4 - stp x10, x25, [sp, #96] - stp x26, x27, [sp, #112] - ldp x5, x6, [x20] - adds x5, x5, x21 - adcs x6, x6, x24 - ldp x7, x8, [x20, #16] - adcs x7, x7, x22 - adcs x8, x8, x23 - csetm x3, cs // cs = hs, nlast - subs x9, x5, x3 - and x1, x3, #0xffffffff - sbcs x5, x6, x1 - sbcs x7, x7, xzr - and x2, x3, #0xffffffff00000001 - sbc x8, x8, x2 - stp x9, x5, [sp, #64] - stp x7, x8, [sp, #80] - ldr q20, [sp, #96] - ldr q0, [sp, #64] - rev64 v16.4s, v20.4s - subs x4, x9, x5 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x5, x25 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x7, x9 - ldr q20, [sp, #112] - sbcs x5, x8, x5 - ngc x17, xzr - subs x8, x7, x8 - uaddlp v27.2d, v16.4s - umulh x4, x9, x10 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x25, x10 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [sp, #80] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x10, x26 - sbcs x9, x25, x27 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x27, x26 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x21, x3, x13 - adcs x22, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x23, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x24, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x21 - adcs x15, x16, x22 - eor x5, x17, x4 - adcs x9, x1, x23 - eor x1, x10, x5 - adcs x16, x2, x24 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x21, x11, x13 - and x1, x1, x13 - adcs x22, x4, x1 - and x1, x12, x13 - stp x21, x22, [sp, #96] - adcs x23, x7, xzr - adc x24, x17, x1 - stp x23, x24, [sp, #112] - ldp x4, x5, [x20, #32] - ldp x8, x9, [x20, #64] - adds x4, x4, x8 - adcs x5, x5, x9 - ldp x6, x7, [x20, #48] - ldp x10, x11, [x20, #80] - adcs x6, x6, x10 - adcs x7, x7, x11 - adc x3, xzr, xzr - adds x8, x4, #0x1 - mov x9, #0xffffffff // #4294967295 - sbcs x9, x5, x9 - sbcs x10, x6, xzr - mov x11, #0xffffffff00000001 // #-4294967295 - sbcs x11, x7, x11 - sbcs x3, x3, xzr - csel x4, x4, x8, cc // cc = lo, ul, last - csel x5, x5, x9, cc // cc = lo, ul, last - csel x6, x6, x10, cc // cc = lo, ul, last - csel x7, x7, x11, cc // cc = lo, ul, last - stp x4, x5, [sp, #64] - stp x6, x7, [sp, #80] - ldr q20, [sp, #32] - ldp x7, x17, [x20] - ldr q0, [x20] - ldp x6, x10, [sp, #32] - ldp x11, x15, [x20, #16] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [sp, #48] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [x20, #16] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #48] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x20, x3, x13 - adcs x25, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x26, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x27, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x20 - adcs x15, x16, x25 - eor x5, x17, x4 - adcs x9, x1, x26 - eor x1, x10, x5 - adcs x16, x2, x27 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x20, x11, x13 - and x1, x1, x13 - adcs x25, x4, x1 - and x1, x12, x13 - stp x20, x25, [sp, #128] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [sp, #144] - ldr q19, [sp, #96] - ldr q23, [sp, #112] - ldr q0, [sp, #96] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x21, x22 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x21, x22 - umulh x15, x21, x23 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x21, x22 - mov x12, v1.d[0] - csetm x5, cc // cc = lo, ul, last - cneg x6, x14, cc // cc = lo, ul, last - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x24, x23 - mov x9, v1.d[1] - cneg x17, x2, cc // cc = lo, ul, last - cinv x2, x5, cc // cc = lo, ul, last - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x22, x24 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x23, x24 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x23, x24 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x24, x24 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x24, x24 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x23, x23 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x23, x23 - adcs x2, x2, x9 - mov x6, #0xffffffff // #4294967295 - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 // #-4294967295 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x21, x3, x16, cs // cs = hs, nlast - csel x22, x8, x14, cs // cs = hs, nlast - csel x23, x11, x12, cs // cs = hs, nlast - csel x24, x5, x2, cs // cs = hs, nlast - ldr q19, [sp, #64] - ldp x9, x13, [sp, #64] - ldr q23, [sp, #80] - ldr q0, [sp, #64] - ldp x1, x10, [sp, #80] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc // cc = lo, ul, last - cneg x6, x14, cc // cc = lo, ul, last - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc // cc = lo, ul, last - cinv x2, x5, cc // cc = lo, ul, last - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff // #4294967295 - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 // #-4294967295 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x13, x3, x16, cs // cs = hs, nlast - csel x14, x8, x14, cs // cs = hs, nlast - csel x15, x11, x12, cs // cs = hs, nlast - csel x26, x5, x2, cs // cs = hs, nlast - mov x1, #0x9 // #9 - mov x2, #0xffffffffffffffff // #-1 - subs x9, x2, x21 - mov x2, #0xffffffff // #4294967295 - sbcs x10, x2, x24 - ngcs x11, x22 - mov x2, #0xffffffff00000001 // #-4294967295 - sbc x12, x2, x23 - mul x3, x1, x9 - mul x4, x1, x10 - mul x5, x1, x11 - mul x6, x1, x12 - umulh x9, x1, x9 - umulh x10, x1, x10 - umulh x11, x1, x11 - umulh x7, x1, x12 - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, xzr - mov x1, #0xc // #12 - mul x8, x20, x1 - umulh x9, x20, x1 - adds x3, x3, x8 - mul x8, x25, x1 - umulh x10, x25, x1 - adcs x4, x4, x8 - ldp x11, x12, [sp, #144] - mul x8, x11, x1 - umulh x11, x11, x1 - adcs x5, x5, x8 - mul x8, x12, x1 - umulh x12, x12, x1 - adcs x6, x6, x8 - adc x7, x7, xzr - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, x12 - add x8, x7, #0x1 - lsl x10, x8, #32 - adds x6, x6, x10 - adc x7, x7, xzr - neg x9, x8 - sub x10, x10, #0x1 - subs x3, x3, x9 - sbcs x4, x4, x10 - sbcs x5, x5, xzr - sbcs x6, x6, x8 - sbc x8, x7, x8 - adds x20, x3, x8 - and x9, x8, #0xffffffff - adcs x21, x4, x9 - adcs x22, x5, xzr - neg x10, x9 - adc x23, x6, x10 - stp x20, x21, [sp, #160] - stp x22, x23, [sp, #176] - mov x2, sp - ldp x4, x3, [x2] - subs x5, x13, x4 - sbcs x6, x26, x3 - ldp x4, x3, [x2, #16] - sbcs x7, x14, x4 - sbcs x8, x15, x3 - csetm x3, cc // cc = lo, ul, last - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [sp, #64] - stp x7, x8, [sp, #80] - mov x0, sp - ldr q19, [sp, #32] - ldp x9, x13, [sp, #32] - ldr q23, [sp, #48] - ldr q0, [sp, #32] - ldp x1, x10, [sp, #48] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc // cc = lo, ul, last - cneg x6, x14, cc // cc = lo, ul, last - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc // cc = lo, ul, last - cinv x2, x5, cc // cc = lo, ul, last - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff // #4294967295 - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 // #-4294967295 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x24, x3, x16, cs // cs = hs, nlast - csel x25, x8, x14, cs // cs = hs, nlast - csel x26, x11, x12, cs // cs = hs, nlast - csel x27, x5, x2, cs // cs = hs, nlast - stp x25, x26, [x0, #16] - stp x24, x27, [x0] - ldr q20, [sp, #96] - ldr q0, [sp, #160] - ldp x6, x10, [sp, #96] - rev64 v16.4s, v20.4s - subs x4, x20, x21 - csetm x3, cc // cc = lo, ul, last - cneg x13, x4, cc // cc = lo, ul, last - mul v16.4s, v16.4s, v0.4s - umulh x12, x21, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x22, x20 - ldr q20, [sp, #112] - sbcs x5, x23, x21 - ngc x17, xzr - subs x8, x22, x23 - uaddlp v27.2d, v16.4s - umulh x4, x20, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc // cc = lo, ul, last - shl v17.2d, v27.2d, #32 - csetm x15, cc // cc = lo, ul, last - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc // cc = lo, ul, last - cinv x9, x3, cc // cc = lo, ul, last - cmn x17, #0x1 - ldr q28, [sp, #176] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [sp, #112] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc // cc = lo, ul, last - cneg x6, x6, cc // cc = lo, ul, last - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x20, x3, x13 - adcs x21, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x22, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x23, x15, xzr - rev64 v24.4s, v20.4s - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc // cc = lo, ul, last - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc // cc = lo, ul, last - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc // cc = lo, ul, last - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc // cc = lo, ul, last - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x20 - adcs x15, x16, x21 - eor x5, x17, x4 - adcs x9, x1, x22 - eor x1, x10, x5 - adcs x16, x2, x23 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff // #4294967295 - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 // #-4294967295 - adds x14, x11, x13 - and x1, x1, x13 - adcs x15, x4, x1 - and x1, x12, x13 - stp x14, x15, [sp, #96] - adcs x13, x7, xzr - adc x20, x17, x1 - stp x13, x20, [sp, #112] - ldp x5, x6, [sp, #64] - ldp x4, x3, [sp, #32] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [sp, #48] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc // cc = lo, ul, last - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [x19, #64] - stp x7, x8, [x19, #80] - ldp x1, x2, [sp, #128] - lsl x0, x1, #2 - ldp x6, x7, [sp, #160] - subs x0, x0, x6 - extr x1, x2, x1, #62 - sbcs x1, x1, x7 - ldp x3, x4, [sp, #144] - extr x2, x3, x2, #62 - ldp x6, x7, [sp, #176] - sbcs x2, x2, x6 - extr x3, x4, x3, #62 - sbcs x3, x3, x7 - lsr x4, x4, #62 - sbc x4, x4, xzr - add x5, x4, #0x1 - lsl x8, x5, #32 - negs x6, x8 - ngcs x7, xzr - sbc x8, x8, x5 - adds x0, x0, x5 - adcs x1, x1, x6 - adcs x2, x2, x7 - adcs x3, x3, x8 - csetm x5, cc // cc = lo, ul, last - adds x0, x0, x5 - and x6, x5, #0xffffffff - adcs x1, x1, x6 - adcs x2, x2, xzr - neg x7, x6 - adc x3, x3, x7 - stp x0, x1, [x19] - stp x2, x3, [x19, #16] - mov x2, #0xffffffffffffffff // #-1 - subs x9, x2, x24 - mov x2, #0xffffffff // #4294967295 - sbcs x10, x2, x27 - ngcs x11, x25 - mov x2, #0xffffffff00000001 // #-4294967295 - sbc x12, x2, x26 - lsl x3, x9, #3 - extr x4, x10, x9, #61 - extr x5, x11, x10, #61 - extr x6, x12, x11, #61 - lsr x7, x12, #61 - mov x1, #0x3 // #3 - mul x8, x14, x1 - umulh x9, x14, x1 - adds x3, x3, x8 - mul x8, x15, x1 - umulh x10, x15, x1 - adcs x4, x4, x8 - mul x8, x13, x1 - umulh x11, x13, x1 - adcs x5, x5, x8 - mul x8, x20, x1 - umulh x12, x20, x1 - adcs x6, x6, x8 - adc x7, x7, xzr - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, x12 - add x8, x7, #0x1 - lsl x10, x8, #32 - adds x6, x6, x10 - adc x7, x7, xzr - neg x9, x8 - sub x10, x10, #0x1 - subs x3, x3, x9 - sbcs x4, x4, x10 - sbcs x5, x5, xzr - sbcs x6, x6, x8 - sbc x8, x7, x8 - adds x3, x3, x8 - and x9, x8, #0xffffffff - adcs x4, x4, x9 - adcs x5, x5, xzr - neg x10, x9 - adc x6, x6, x10 - stp x3, x4, [x19, #32] - stp x5, x6, [x19, #48] - ldp x27, xzr, [sp, #256] - ldp x25, x26, [sp, #240] - ldp x23, x24, [sp, #224] - ldp x21, x22, [sp, #208] - ldp x19, x20, [sp, #192] - CFI_INC_SP(272) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_local_p256_montjdouble) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_local_p256_montjmixadd) - -Lp256_scalarmul_local_p256_montjmixadd: - CFI_START - CFI_PUSH2(x19,x20) - CFI_DEC_SP(192) - mov x17, x0 - mov x19, x1 - mov x20, x2 - ldp x2, x3, [x19, #64] - ldp x4, x5, [x19, #80] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x0, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x0, x0, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x0, x0, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - subs x13, x15, x12 - lsr x11, x15, #32 - sbc x15, x15, x11 - adds x16, x16, x12 - adcs x0, x0, x11 - adcs x1, x1, x13 - adc x15, x15, xzr - lsl x12, x16, #32 - subs x13, x16, x12 - lsr x11, x16, #32 - sbc x16, x16, x11 - adds x0, x0, x12 - adcs x1, x1, x11 - adcs x15, x15, x13 - adc x16, x16, xzr - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, cc - csetm x13, cc - subs x12, x5, x4 - cneg x12, x12, cc - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, cc - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x0 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - subs x13, x6, x12 - lsr x11, x6, #32 - sbc x6, x6, x11 - adds x7, x7, x12 - adcs x8, x8, x11 - adcs x9, x9, x13 - adcs x10, x10, x6 - adc x6, xzr, xzr - lsl x12, x7, #32 - subs x13, x7, x12 - lsr x11, x7, #32 - sbc x7, x7, x11 - adds x8, x8, x12 - adcs x9, x9, x11 - adcs x10, x10, x13 - adcs x6, x6, x7 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #0xffffffff - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #0xffffffff00000001 - sbcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, cs - csel x9, x11, x9, cs - csel x10, x12, x10, cs - csel x6, x13, x6, cs - stp x8, x9, [sp] - stp x10, x6, [sp, #16] - ldp x3, x4, [x19, #64] - ldp x5, x6, [x19, #80] - ldp x7, x8, [x20, #32] - ldp x9, x10, [x20, #48] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #32] - stp x11, x12, [sp, #48] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #32] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #48] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #32] - stp x3, x4, [sp, #48] - ldp x3, x4, [sp] - ldp x5, x6, [sp, #16] - ldp x7, x8, [x20] - ldp x9, x10, [x20, #16] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #64] - stp x11, x12, [sp, #80] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #64] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #80] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #64] - stp x3, x4, [sp, #80] - ldp x3, x4, [sp] - ldp x5, x6, [sp, #16] - ldp x7, x8, [sp, #32] - ldp x9, x10, [sp, #48] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #32] - stp x11, x12, [sp, #48] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #32] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #48] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #32] - stp x3, x4, [sp, #48] - ldp x5, x6, [sp, #64] - ldp x4, x3, [x19] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [x19, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #160] - stp x7, x8, [sp, #176] - ldp x5, x6, [sp, #32] - ldp x4, x3, [x19, #32] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #48] - ldp x4, x3, [x19, #48] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #32] - stp x7, x8, [sp, #48] - ldp x2, x3, [sp, #160] - ldp x4, x5, [sp, #176] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x0, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x0, x0, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x0, x0, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - subs x13, x15, x12 - lsr x11, x15, #32 - sbc x15, x15, x11 - adds x16, x16, x12 - adcs x0, x0, x11 - adcs x1, x1, x13 - adc x15, x15, xzr - lsl x12, x16, #32 - subs x13, x16, x12 - lsr x11, x16, #32 - sbc x16, x16, x11 - adds x0, x0, x12 - adcs x1, x1, x11 - adcs x15, x15, x13 - adc x16, x16, xzr - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, cc - csetm x13, cc - subs x12, x5, x4 - cneg x12, x12, cc - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, cc - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x0 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - subs x13, x6, x12 - lsr x11, x6, #32 - sbc x6, x6, x11 - adds x7, x7, x12 - adcs x8, x8, x11 - adcs x9, x9, x13 - adcs x10, x10, x6 - adc x6, xzr, xzr - lsl x12, x7, #32 - subs x13, x7, x12 - lsr x11, x7, #32 - sbc x7, x7, x11 - adds x8, x8, x12 - adcs x9, x9, x11 - adcs x10, x10, x13 - adcs x6, x6, x7 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #0xffffffff - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #0xffffffff00000001 - sbcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, cs - csel x9, x11, x9, cs - csel x10, x12, x10, cs - csel x6, x13, x6, cs - stp x8, x9, [sp, #96] - stp x10, x6, [sp, #112] - ldp x2, x3, [sp, #32] - ldp x4, x5, [sp, #48] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x0, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x0, x0, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x0, x0, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - subs x13, x15, x12 - lsr x11, x15, #32 - sbc x15, x15, x11 - adds x16, x16, x12 - adcs x0, x0, x11 - adcs x1, x1, x13 - adc x15, x15, xzr - lsl x12, x16, #32 - subs x13, x16, x12 - lsr x11, x16, #32 - sbc x16, x16, x11 - adds x0, x0, x12 - adcs x1, x1, x11 - adcs x15, x15, x13 - adc x16, x16, xzr - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, cc - csetm x13, cc - subs x12, x5, x4 - cneg x12, x12, cc - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, cc - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x0 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - subs x13, x6, x12 - lsr x11, x6, #32 - sbc x6, x6, x11 - adds x7, x7, x12 - adcs x8, x8, x11 - adcs x9, x9, x13 - adcs x10, x10, x6 - adc x6, xzr, xzr - lsl x12, x7, #32 - subs x13, x7, x12 - lsr x11, x7, #32 - sbc x7, x7, x11 - adds x8, x8, x12 - adcs x9, x9, x11 - adcs x10, x10, x13 - adcs x6, x6, x7 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #0xffffffff - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #0xffffffff00000001 - sbcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, cs - csel x9, x11, x9, cs - csel x10, x12, x10, cs - csel x6, x13, x6, cs - stp x8, x9, [sp] - stp x10, x6, [sp, #16] - ldp x3, x4, [sp, #96] - ldp x5, x6, [sp, #112] - ldp x7, x8, [x19] - ldp x9, x10, [x19, #16] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #128] - stp x11, x12, [sp, #144] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #128] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #144] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #128] - stp x3, x4, [sp, #144] - ldp x3, x4, [sp, #96] - ldp x5, x6, [sp, #112] - ldp x7, x8, [sp, #64] - ldp x9, x10, [sp, #80] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #64] - stp x11, x12, [sp, #80] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #64] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #80] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #64] - stp x3, x4, [sp, #80] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #16] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #16] - ldp x5, x6, [sp, #64] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #96] - stp x7, x8, [sp, #112] - ldp x3, x4, [sp, #160] - ldp x5, x6, [sp, #176] - ldp x7, x8, [x19, #64] - ldp x9, x10, [x19, #80] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #160] - stp x11, x12, [sp, #176] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #160] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #176] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #160] - stp x3, x4, [sp, #176] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #64] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #16] - ldp x4, x3, [sp, #80] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #16] - ldp x5, x6, [sp, #128] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #144] - ldp x4, x3, [sp, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #128] - stp x7, x8, [sp, #144] - ldp x3, x4, [sp, #96] - ldp x5, x6, [sp, #112] - ldp x7, x8, [x19, #32] - ldp x9, x10, [x19, #48] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #96] - stp x11, x12, [sp, #112] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #96] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #112] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #96] - stp x3, x4, [sp, #112] - ldp x3, x4, [sp, #32] - ldp x5, x6, [sp, #48] - ldp x7, x8, [sp, #128] - ldp x9, x10, [sp, #144] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #128] - stp x11, x12, [sp, #144] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #128] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #144] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #128] - stp x3, x4, [sp, #144] - ldp x5, x6, [sp, #128] - ldp x4, x3, [sp, #96] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #144] - ldp x4, x3, [sp, #112] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #128] - stp x7, x8, [sp, #144] - ldp x0, x1, [x19, #64] - ldp x2, x3, [x19, #80] - orr x4, x0, x1 - orr x5, x2, x3 - orr x4, x4, x5 - cmp x4, xzr - ldp x0, x1, [sp] - ldp x12, x13, [x20] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x2, x3, [sp, #16] - ldp x12, x13, [x20, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x4, x5, [sp, #128] - ldp x12, x13, [x20, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x6, x7, [sp, #144] - ldp x12, x13, [x20, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x8, x9, [sp, #160] - mov x12, #0x1 - mov x13, #0xffffffff00000000 - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x10, x11, [sp, #176] - mov x12, #0xffffffffffffffff - mov x13, #0xfffffffe - csel x10, x10, x12, ne - csel x11, x11, x13, ne - stp x0, x1, [x17] - stp x2, x3, [x17, #16] - stp x4, x5, [x17, #32] - stp x6, x7, [x17, #48] - stp x8, x9, [x17, #64] - stp x10, x11, [x17, #80] - CFI_INC_SP(192) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_local_p256_montjmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmul_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmul_alt.S deleted file mode 100644 index 11858fdf733..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmul_alt.S +++ /dev/null @@ -1,6235 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Scalar multiplication for P-256 -// Input scalar[4], point[8]; output res[8] -// -// extern void p256_scalarmul_alt -// (uint64_t res[static 8], -// const uint64_t scalar[static 4], -// const uint64_t point[static 8]); -// -// Given scalar = n and point = P, assumed to be on the NIST elliptic -// curve P-256, returns the point (X,Y) = n * P. The input and output -// are affine points, and in the case of the point at infinity as -// the result, (0,0) is returned. -// -// Standard ARM ABI: X0 = res, X1 = scalar, X2 = point -// ---------------------------------------------------------------------------- - - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_scalarmul_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_scalarmul_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_scalarmul_alt) - - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Safe copies of inputs (res lasts the whole code, point not so long) -// and additional values in variables, with some aliasing - -#define res x19 -#define sgn x20 -#define j x20 -#define point x21 - -// Intermediate variables on the stack. The last z2, z3 values can -// safely be overlaid on the table, which is no longer needed at the end. - -#define scalarb sp, #(0*NUMSIZE) -#define acc sp, #(1*NUMSIZE) -#define tabent sp, #(4*NUMSIZE) - -#define tab sp, #(7*NUMSIZE) - -#define z2 sp, #(7*NUMSIZE) -#define z3 sp, #(8*NUMSIZE) - -#define NSPACE 31*NUMSIZE - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(p256_scalarmul_alt): - CFI_START - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x30) - CFI_DEC_SP(NSPACE) - -// Preserve the "res" and "point" input arguments. We load and process the -// scalar immediately so we don't bother preserving that input argument. -// Also, "point" is only needed early on and so its register gets re-used. - - mov res, x0 - mov point, x2 - -// Load the digits of group order n_256 = [x12;x13;x14;x15] - - movbig(x12, #0xf3b9, #0xcac2, #0xfc63, #0x2551) - movbig(x13, #0xbce6, #0xfaad, #0xa717, #0x9e84) - mov x14, #0xffffffffffffffff - mov x15, #0xffffffff00000000 - -// First, reduce the input scalar mod n_256, i.e. conditionally subtract n_256 - - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - - subs x6, x2, x12 - sbcs x7, x3, x13 - sbcs x8, x4, x14 - sbcs x9, x5, x15 - - csel x2, x2, x6, cc - csel x3, x3, x7, cc - csel x4, x4, x8, cc - csel x5, x5, x9, cc - -// Now if the top bit of the reduced scalar is set, negate it mod n_256, -// i.e. do n |-> n_256 - n. Remember the sign as "sgn" so we can -// correspondingly negate the point below. - - subs x6, x12, x2 - sbcs x7, x13, x3 - sbcs x8, x14, x4 - sbc x9, x15, x5 - - tst x5, #0x8000000000000000 - csel x2, x2, x6, eq - csel x3, x3, x7, eq - csel x4, x4, x8, eq - csel x5, x5, x9, eq - cset sgn, ne - -// In either case then add the recoding constant 0x08888...888 to allow -// signed digits. - - mov x6, 0x8888888888888888 - adds x2, x2, x6 - adcs x3, x3, x6 - bic x7, x6, #0xF000000000000000 - adcs x4, x4, x6 - adc x5, x5, x7 - - stp x2, x3, [scalarb] - stp x4, x5, [scalarb+16] - -// Set the tab[0] table entry to Montgomery-Jacobian point = 1 * P -// The z coordinate is just the Montgomery form of the constant 1. - - add x0, tab - mov x1, point - CFI_BL(Lp256_scalarmul_alt_local_tomont_p256) - - add x1, point, #32 - add x0, tab+32 - CFI_BL(Lp256_scalarmul_alt_local_tomont_p256) - - mov x0, #0x0000000000000001 - mov x1, #0xffffffff00000000 - stp x0, x1, [tab+64] - mov x2, #0xffffffffffffffff - mov x3, #0x00000000fffffffe - stp x2, x3, [tab+80] - -// If the top bit of the scalar was set, negate (y coordinate of) the point - - ldp x4, x5, [tab+32] - ldp x6, x7, [tab+48] - - mov x0, 0xffffffffffffffff - subs x0, x0, x4 - mov x1, 0x00000000ffffffff - sbcs x1, x1, x5 - mov x3, 0xffffffff00000001 - sbcs x2, xzr, x6 - sbc x3, x3, x7 - - cmp sgn, xzr - csel x4, x0, x4, ne - csel x5, x1, x5, ne - csel x6, x2, x6, ne - csel x7, x3, x7, ne - - stp x4, x5, [tab+32] - stp x6, x7, [tab+48] - -// Compute and record tab[1] = 2 * p, ..., tab[7] = 8 * P - - add x0, tab+96*1 - add x1, tab - CFI_BL(Lp256_scalarmul_alt_local_p256_montjdouble) - - add x0, tab+96*2 - add x1, tab+96*1 - add x2, tab - CFI_BL(Lp256_scalarmul_alt_local_p256_montjmixadd) - - add x0, tab+96*3 - add x1, tab+96*1 - CFI_BL(Lp256_scalarmul_alt_local_p256_montjdouble) - - add x0, tab+96*4 - add x1, tab+96*3 - add x2, tab - CFI_BL(Lp256_scalarmul_alt_local_p256_montjmixadd) - - add x0, tab+96*5 - add x1, tab+96*2 - CFI_BL(Lp256_scalarmul_alt_local_p256_montjdouble) - - add x0, tab+96*6 - add x1, tab+96*5 - add x2, tab - CFI_BL(Lp256_scalarmul_alt_local_p256_montjmixadd) - - add x0, tab+96*7 - add x1, tab+96*3 - CFI_BL(Lp256_scalarmul_alt_local_p256_montjdouble) - -// Initialize the accumulator as a table entry for top 4 bits (unrecoded) - - ldr x14, [scalarb+24] - lsr x14, x14, #60 - - mov x0, xzr - mov x1, xzr - mov x2, xzr - mov x3, xzr - mov x4, xzr - mov x5, xzr - mov x6, xzr - mov x7, xzr - mov x8, xzr - mov x9, xzr - mov x10, xzr - mov x11, xzr - add x15, tab - - .set i, 1 -.rep 8 - cmp x14, #i - ldp x12, x13, [x15] - csel x0, x12, x0, eq - csel x1, x13, x1, eq - ldp x12, x13, [x15, #16] - csel x2, x12, x2, eq - csel x3, x13, x3, eq - ldp x12, x13, [x15, #32] - csel x4, x12, x4, eq - csel x5, x13, x5, eq - ldp x12, x13, [x15, #48] - csel x6, x12, x6, eq - csel x7, x13, x7, eq - ldp x12, x13, [x15, #64] - csel x8, x12, x8, eq - csel x9, x13, x9, eq - ldp x12, x13, [x15, #80] - csel x10, x12, x10, eq - csel x11, x13, x11, eq - add x15, x15, #96 - .set i, (i+1) -.endr - stp x0, x1, [acc] - stp x2, x3, [acc+16] - stp x4, x5, [acc+32] - stp x6, x7, [acc+48] - stp x8, x9, [acc+64] - stp x10, x11, [acc+80] - - mov j, #252 - -// Main loop over size-4 bitfields: double 4 times then add signed digit - -Lp256_scalarmul_alt_loop: - sub j, j, #4 - - add x0, acc - add x1, acc - CFI_BL(Lp256_scalarmul_alt_local_p256_montjdouble) - - add x0, acc - add x1, acc - CFI_BL(Lp256_scalarmul_alt_local_p256_montjdouble) - - add x0, acc - add x1, acc - CFI_BL(Lp256_scalarmul_alt_local_p256_montjdouble) - - add x0, acc - add x1, acc - CFI_BL(Lp256_scalarmul_alt_local_p256_montjdouble) - - lsr x2, j, #6 - ldr x14, [sp, x2, lsl #3] // Exploits scalarb = sp exactly - lsr x14, x14, j - and x14, x14, #15 - - subs x14, x14, #8 - cset x16, lo // x16 = sign of digit (1 = negative) - cneg x14, x14, lo // x14 = absolute value of digit - -// Conditionally select the table entry tab[i-1] = i * P in constant time - - mov x0, xzr - mov x1, xzr - mov x2, xzr - mov x3, xzr - mov x4, xzr - mov x5, xzr - mov x6, xzr - mov x7, xzr - mov x8, xzr - mov x9, xzr - mov x10, xzr - mov x11, xzr - add x15, tab - .set i, 1 -.rep 8 - cmp x14, #i - ldp x12, x13, [x15] - csel x0, x12, x0, eq - csel x1, x13, x1, eq - ldp x12, x13, [x15, #16] - csel x2, x12, x2, eq - csel x3, x13, x3, eq - ldp x12, x13, [x15, #32] - csel x4, x12, x4, eq - csel x5, x13, x5, eq - ldp x12, x13, [x15, #48] - csel x6, x12, x6, eq - csel x7, x13, x7, eq - ldp x12, x13, [x15, #64] - csel x8, x12, x8, eq - csel x9, x13, x9, eq - ldp x12, x13, [x15, #80] - csel x10, x12, x10, eq - csel x11, x13, x11, eq - add x15, x15, #96 - .set i, (i+1) -.endr - -// Store it to "tabent" with the y coordinate optionally negated - - stp x0, x1, [tabent] - stp x2, x3, [tabent+16] - - mov x0, 0xffffffffffffffff - subs x0, x0, x4 - mov x1, 0x00000000ffffffff - sbcs x1, x1, x5 - mov x3, 0xffffffff00000001 - sbcs x2, xzr, x6 - sbc x3, x3, x7 - - cmp x16, xzr - csel x4, x0, x4, ne - csel x5, x1, x5, ne - csel x6, x2, x6, ne - csel x7, x3, x7, ne - - stp x4, x5, [tabent+32] - stp x6, x7, [tabent+48] - stp x8, x9, [tabent+64] - stp x10, x11, [tabent+80] - - add x0, acc - add x1, acc - add x2, tabent - CFI_BL(Lp256_scalarmul_alt_local_p256_montjadd) - - cbnz j, Lp256_scalarmul_alt_loop - -// That's the end of the main loop, and we just need to translate -// back from the Jacobian representation to affine. First of all, -// let z2 = 1/z^2 and z3 = 1/z^3, both without Montgomery form - - add x0, z2 - add x1, acc+64 - CFI_BL(Lp256_scalarmul_alt_local_montsqr_p256) - - add x0, z3 - add x2, z2 - add x1, acc+64 - CFI_BL(Lp256_scalarmul_alt_local_montmul_p256) - - add x0, z2 - add x1, z3 - CFI_BL(Lp256_scalarmul_alt_local_demont_p256) - - add x0, z3 - add x1, z2 - CFI_BL(Lp256_scalarmul_alt_local_inv_p256) - - add x0, z2 - add x2, z3 - add x1, acc+64 - CFI_BL(Lp256_scalarmul_alt_local_montmul_p256) - -// Convert back from Jacobian (X,Y,Z) |-> (X/Z^2, Y/Z^3) - - add x1, acc - add x2, z2 - mov x0, res - CFI_BL(Lp256_scalarmul_alt_local_montmul_p256) - - add x0, res, #32 - add x1, acc+32 - add x2, z3 - CFI_BL(Lp256_scalarmul_alt_local_montmul_p256) - -// Restore stack and registers and return - - CFI_INC_SP(NSPACE) - CFI_POP2(x21,x30) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_scalarmul_alt) - -// Local copies of subroutines, complete clones at the moment - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_alt_local_demont_p256) - -Lp256_scalarmul_alt_local_demont_p256: - CFI_START - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - lsl x7, x2, #32 - subs x8, x2, x7 - lsr x6, x2, #32 - sbc x2, x2, x6 - adds x3, x3, x7 - adcs x4, x4, x6 - adcs x5, x5, x8 - adc x2, x2, xzr - lsl x7, x3, #32 - subs x8, x3, x7 - lsr x6, x3, #32 - sbc x3, x3, x6 - adds x4, x4, x7 - adcs x5, x5, x6 - adcs x2, x2, x8 - adc x3, x3, xzr - lsl x7, x4, #32 - subs x8, x4, x7 - lsr x6, x4, #32 - sbc x4, x4, x6 - adds x5, x5, x7 - adcs x2, x2, x6 - adcs x3, x3, x8 - adc x4, x4, xzr - lsl x7, x5, #32 - subs x8, x5, x7 - lsr x6, x5, #32 - sbc x5, x5, x6 - adds x2, x2, x7 - adcs x3, x3, x6 - adcs x4, x4, x8 - adc x5, x5, xzr - stp x2, x3, [x0] - stp x4, x5, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_alt_local_demont_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_alt_local_inv_p256) - -Lp256_scalarmul_alt_local_inv_p256: - CFI_START - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_DEC_SP(160) - mov x20, x0 - mov x10, #0xffffffffffffffff - mov x11, #0xffffffff - mov x13, #0xffffffff00000001 - stp x10, x11, [sp] - stp xzr, x13, [sp, #16] - str xzr, [sp, #32] - ldp x2, x3, [x1] - subs x10, x2, x10 - sbcs x11, x3, x11 - ldp x4, x5, [x1, #16] - sbcs x12, x4, xzr - sbcs x13, x5, x13 - csel x2, x2, x10, cc - csel x3, x3, x11, cc - csel x4, x4, x12, cc - csel x5, x5, x13, cc - stp x2, x3, [sp, #48] - stp x4, x5, [sp, #64] - str xzr, [sp, #80] - stp xzr, xzr, [sp, #96] - stp xzr, xzr, [sp, #112] - mov x10, #0x4000000000000 - stp x10, xzr, [sp, #128] - stp xzr, xzr, [sp, #144] - mov x21, #0xa - mov x22, #0x1 - b Lp256_scalarmul_alt_inv_midloop -Lp256_scalarmul_alt_inv_loop: - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - and x0, x12, x16 - and x1, x13, x17 - add x19, x0, x1 - ldr x7, [sp] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #48] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x7, [sp, #8] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #56] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [sp] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [sp, #48] - ldr x7, [sp, #16] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #64] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [sp, #8] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [sp, #56] - ldr x7, [sp, #24] - eor x1, x7, x14 - ldr x23, [sp, #32] - eor x3, x23, x14 - and x3, x3, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #72] - eor x1, x8, x15 - ldr x24, [sp, #80] - eor x0, x24, x15 - and x0, x0, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [sp, #16] - extr x5, x3, x5, #59 - str x5, [sp, #24] - asr x3, x3, #59 - str x3, [sp, #32] - eor x1, x7, x16 - eor x5, x23, x16 - and x5, x5, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - eor x0, x24, x17 - and x0, x0, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - extr x4, x2, x4, #59 - str x4, [sp, #64] - extr x2, x5, x2, #59 - str x2, [sp, #72] - asr x5, x5, #59 - str x5, [sp, #80] - ldr x7, [sp, #96] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #128] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #96] - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - str x5, [sp, #128] - adc x3, x3, x1 - ldr x7, [sp, #104] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #136] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #104] - adc x6, x6, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - str x3, [sp, #136] - adc x4, x4, x1 - ldr x7, [sp, #112] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #144] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #112] - adc x5, x5, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - str x4, [sp, #144] - adc x2, x2, x1 - ldr x7, [sp, #120] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #152] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - ldp x0, x1, [sp, #96] - ldr x6, [sp, #112] - mov x14, #0xe000000000000000 - adds x0, x0, x14 - sbcs x1, x1, xzr - mov x11, #0x1fffffff - adcs x6, x6, x11 - mov x10, #0x2000000000000000 - adcs x5, x5, x10 - mov x14, #0x1fffffffe0000000 - adc x3, x3, x14 - lsl x11, x0, #32 - subs x14, x0, x11 - lsr x10, x0, #32 - sbc x0, x0, x10 - adds x1, x1, x11 - adcs x6, x6, x10 - adcs x5, x5, x14 - adcs x3, x3, x0 - mov x14, #0xffffffffffffffff - mov x11, #0xffffffff - mov x10, #0xffffffff00000001 - csel x14, x14, xzr, cs - csel x11, x11, xzr, cs - csel x10, x10, xzr, cs - subs x1, x1, x14 - sbcs x6, x6, x11 - sbcs x5, x5, xzr - sbc x3, x3, x10 - stp x1, x6, [sp, #96] - stp x5, x3, [sp, #112] - eor x1, x7, x16 - and x5, x16, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - and x0, x17, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - ldp x0, x1, [sp, #128] - ldr x3, [sp, #144] - mov x14, #0xe000000000000000 - adds x0, x0, x14 - sbcs x1, x1, xzr - mov x11, #0x1fffffff - adcs x3, x3, x11 - mov x10, #0x2000000000000000 - adcs x2, x2, x10 - mov x14, #0x1fffffffe0000000 - adc x5, x5, x14 - lsl x11, x0, #32 - subs x14, x0, x11 - lsr x10, x0, #32 - sbc x0, x0, x10 - adds x1, x1, x11 - adcs x3, x3, x10 - adcs x2, x2, x14 - adcs x5, x5, x0 - mov x14, #0xffffffffffffffff - mov x11, #0xffffffff - mov x10, #0xffffffff00000001 - csel x14, x14, xzr, cs - csel x11, x11, xzr, cs - csel x10, x10, xzr, cs - subs x1, x1, x14 - sbcs x3, x3, x11 - sbcs x2, x2, xzr - sbc x5, x5, x10 - stp x1, x3, [sp, #128] - stp x2, x5, [sp, #144] -Lp256_scalarmul_alt_inv_midloop: - mov x1, x22 - ldr x2, [sp] - ldr x3, [sp, #48] - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x8, x4, #0x100, lsl #12 - sbfx x8, x8, #21, #21 - mov x11, #0x100000 - add x11, x11, x11, lsl #21 - add x9, x4, x11 - asr x9, x9, #42 - add x10, x5, #0x100, lsl #12 - sbfx x10, x10, #21, #21 - add x11, x5, x11 - asr x11, x11, #42 - mul x6, x8, x2 - mul x7, x9, x3 - mul x2, x10, x2 - mul x3, x11, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #21, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #42 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #21, #21 - add x15, x5, x15 - asr x15, x15, #42 - mul x6, x12, x2 - mul x7, x13, x3 - mul x2, x14, x2 - mul x3, x15, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - mul x2, x12, x8 - mul x3, x12, x9 - mul x6, x14, x8 - mul x7, x14, x9 - madd x8, x13, x10, x2 - madd x9, x13, x11, x3 - madd x16, x15, x10, x6 - madd x17, x15, x11, x7 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #22, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #43 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #22, #21 - add x15, x5, x15 - asr x15, x15, #43 - mneg x2, x12, x8 - mneg x3, x12, x9 - mneg x4, x14, x8 - mneg x5, x14, x9 - msub x10, x13, x16, x2 - msub x11, x13, x17, x3 - msub x12, x15, x16, x4 - msub x13, x15, x17, x5 - mov x22, x1 - subs x21, x21, #0x1 - b.ne Lp256_scalarmul_alt_inv_loop - ldr x0, [sp] - ldr x1, [sp, #48] - mul x0, x0, x10 - madd x1, x1, x11, x0 - asr x0, x1, #63 - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - eor x14, x14, x0 - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - eor x15, x15, x0 - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - eor x16, x16, x0 - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - eor x17, x17, x0 - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - ldr x7, [sp, #96] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #128] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #96] - adc x2, x2, x1 - ldr x7, [sp, #104] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #136] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #104] - adc x6, x6, x1 - ldr x7, [sp, #112] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #144] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #112] - adc x5, x5, x1 - ldr x7, [sp, #120] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #152] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - ldp x0, x1, [sp, #96] - ldr x2, [sp, #112] - mov x14, #0xe000000000000000 - adds x0, x0, x14 - sbcs x1, x1, xzr - mov x11, #0x1fffffff - adcs x2, x2, x11 - mov x10, #0x2000000000000000 - adcs x5, x5, x10 - mov x14, #0x1fffffffe0000000 - adc x3, x3, x14 - lsl x11, x0, #32 - subs x14, x0, x11 - lsr x10, x0, #32 - sbc x0, x0, x10 - adds x1, x1, x11 - adcs x2, x2, x10 - adcs x5, x5, x14 - adcs x3, x3, x0 - mov x14, #0xffffffffffffffff - mov x11, #0xffffffff - mov x10, #0xffffffff00000001 - csel x14, x14, xzr, cs - csel x11, x11, xzr, cs - csel x10, x10, xzr, cs - subs x1, x1, x14 - sbcs x2, x2, x11 - sbcs x5, x5, xzr - sbc x3, x3, x10 - mov x10, #0xffffffffffffffff - subs x10, x1, x10 - mov x11, #0xffffffff - sbcs x11, x2, x11 - mov x13, #0xffffffff00000001 - sbcs x12, x5, xzr - sbcs x13, x3, x13 - csel x10, x1, x10, cc - csel x11, x2, x11, cc - csel x12, x5, x12, cc - csel x13, x3, x13, cc - stp x10, x11, [x20] - stp x12, x13, [x20, #16] - CFI_INC_SP(160) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_alt_local_inv_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_alt_local_montmul_p256) - -Lp256_scalarmul_alt_local_montmul_p256: - CFI_START - ldp x3, x4, [x1] - ldp x7, x8, [x2] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x2, #16] - mul x11, x3, x9 - umulh x15, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x16, x3, x10 - adcs x15, x15, x11 - adc x16, x16, xzr - ldp x5, x6, [x1, #16] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x15, x15, x11 - mul x11, x4, x10 - adcs x16, x16, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x15, x15, x11 - umulh x11, x4, x9 - adcs x16, x16, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x15, x15, x11 - mul x11, x5, x9 - adcs x16, x16, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x15, x15, x11 - umulh x11, x5, x8 - adcs x16, x16, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x15, x15, x11 - mul x11, x6, x8 - adcs x16, x16, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x15, x15, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x16, x16, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x15, x15, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x15, x15, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x15, lsl #32 - lsr x11, x15, #32 - adcs x13, x13, x11 - mul x11, x15, x10 - umulh x15, x15, x10 - adcs x14, x14, x11 - adc x15, x15, xzr - adds x12, x12, x16 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x15, x15, x5 - cset x8, cs - mov x11, #0xffffffff - adds x16, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x15, x10 - sbcs xzr, x8, xzr - csel x12, x12, x16, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x15, x15, x5, cc - stp x12, x13, [x0] - stp x14, x15, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_alt_local_montmul_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_alt_local_montsqr_p256) - -Lp256_scalarmul_alt_local_montsqr_p256: - CFI_START - ldp x2, x3, [x1] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [x1, #16] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - mov x5, #0xffffffff00000001 - adds x9, x9, x8, lsl #32 - lsr x2, x8, #32 - adcs x10, x10, x2 - mul x2, x8, x5 - umulh x8, x8, x5 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x2, x9, #32 - adcs x11, x11, x2 - mul x2, x9, x5 - umulh x9, x9, x5 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x2, x10, #32 - adcs x8, x8, x2 - mul x2, x10, x5 - umulh x10, x10, x5 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x2, x11, #32 - adcs x9, x9, x2 - mul x2, x11, x5 - umulh x11, x11, x5 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, cs - mov x3, #0xffffffff - adds x12, x8, #0x1 - sbcs x13, x9, x3 - sbcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, cc - csel x9, x9, x13, cc - csel x10, x10, x14, cc - csel x11, x11, x7, cc - stp x8, x9, [x0] - stp x10, x11, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_alt_local_montsqr_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_alt_local_tomont_p256) - -Lp256_scalarmul_alt_local_tomont_p256: - CFI_START - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - mov x1, #0xffffffffffffffff - mov x7, #0xffffffff - mov x9, #0xffffffff00000001 - subs x1, x2, x1 - sbcs x7, x3, x7 - sbcs x8, x4, xzr - sbcs x9, x5, x9 - csel x2, x2, x1, cc - csel x3, x3, x7, cc - csel x4, x4, x8, cc - csel x5, x5, x9, cc - cmp xzr, xzr - extr x9, x5, x4, #32 - adcs xzr, x4, x9 - lsr x9, x5, #32 - adcs x9, x5, x9 - csetm x6, cs - orr x9, x9, x6 - lsl x7, x9, #32 - lsr x8, x9, #32 - adds x4, x4, x7 - adc x5, x5, x8 - negs x6, x9 - sbcs x7, x7, xzr - sbc x8, x8, xzr - negs x6, x6 - sbcs x2, x2, x7 - sbcs x3, x3, x8 - sbcs x4, x4, x9 - sbcs x5, x5, x9 - adds x6, x6, x5 - mov x7, #0xffffffff - and x7, x7, x5 - adcs x2, x2, x7 - adcs x3, x3, xzr - mov x7, #0xffffffff00000001 - and x7, x7, x5 - adc x4, x4, x7 - cmp xzr, xzr - extr x9, x4, x3, #32 - adcs xzr, x3, x9 - lsr x9, x4, #32 - adcs x9, x4, x9 - csetm x5, cs - orr x9, x9, x5 - lsl x7, x9, #32 - lsr x8, x9, #32 - adds x3, x3, x7 - adc x4, x4, x8 - negs x5, x9 - sbcs x7, x7, xzr - sbc x8, x8, xzr - negs x5, x5 - sbcs x6, x6, x7 - sbcs x2, x2, x8 - sbcs x3, x3, x9 - sbcs x4, x4, x9 - adds x5, x5, x4 - mov x7, #0xffffffff - and x7, x7, x4 - adcs x6, x6, x7 - adcs x2, x2, xzr - mov x7, #0xffffffff00000001 - and x7, x7, x4 - adc x3, x3, x7 - cmp xzr, xzr - extr x9, x3, x2, #32 - adcs xzr, x2, x9 - lsr x9, x3, #32 - adcs x9, x3, x9 - csetm x4, cs - orr x9, x9, x4 - lsl x7, x9, #32 - lsr x8, x9, #32 - adds x2, x2, x7 - adc x3, x3, x8 - negs x4, x9 - sbcs x7, x7, xzr - sbc x8, x8, xzr - negs x4, x4 - sbcs x5, x5, x7 - sbcs x6, x6, x8 - sbcs x2, x2, x9 - sbcs x3, x3, x9 - adds x4, x4, x3 - mov x7, #0xffffffff - and x7, x7, x3 - adcs x5, x5, x7 - adcs x6, x6, xzr - mov x7, #0xffffffff00000001 - and x7, x7, x3 - adc x2, x2, x7 - cmp xzr, xzr - extr x9, x2, x6, #32 - adcs xzr, x6, x9 - lsr x9, x2, #32 - adcs x9, x2, x9 - csetm x3, cs - orr x9, x9, x3 - lsl x7, x9, #32 - lsr x8, x9, #32 - adds x6, x6, x7 - adc x2, x2, x8 - negs x3, x9 - sbcs x7, x7, xzr - sbc x8, x8, xzr - negs x3, x3 - sbcs x4, x4, x7 - sbcs x5, x5, x8 - sbcs x6, x6, x9 - sbcs x2, x2, x9 - adds x3, x3, x2 - mov x7, #0xffffffff - and x7, x7, x2 - adcs x4, x4, x7 - adcs x5, x5, xzr - mov x7, #0xffffffff00000001 - and x7, x7, x2 - adc x6, x6, x7 - stp x3, x4, [x0] - stp x5, x6, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_alt_local_tomont_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_alt_local_p256_montjadd) - -Lp256_scalarmul_alt_local_p256_montjadd: - CFI_START - CFI_DEC_SP(224) - mov x15, x0 - mov x16, x1 - mov x17, x2 - ldp x2, x3, [x16, #64] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [x16, #80] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mov x3, #0xffffffff00000001 - mul x2, x8, x3 - umulh x8, x8, x3 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mov x3, #0xffffffff00000001 - mul x2, x9, x3 - umulh x9, x9, x3 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mov x3, #0xffffffff00000001 - mul x2, x10, x3 - umulh x10, x10, x3 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mov x3, #0xffffffff00000001 - mul x2, x11, x3 - umulh x11, x11, x3 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - mov x2, #0xffffffffffffffff - csel x2, xzr, x2, cc - mov x3, #0xffffffff - csel x3, xzr, x3, cc - mov x5, #0xffffffff00000001 - csel x5, xzr, x5, cc - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, xzr - sbc x11, x11, x5 - stp x8, x9, [sp] - stp x10, x11, [sp, #16] - ldp x2, x3, [x17, #64] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [x17, #80] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mov x3, #0xffffffff00000001 - mul x2, x8, x3 - umulh x8, x8, x3 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mov x3, #0xffffffff00000001 - mul x2, x9, x3 - umulh x9, x9, x3 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mov x3, #0xffffffff00000001 - mul x2, x10, x3 - umulh x10, x10, x3 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mov x3, #0xffffffff00000001 - mul x2, x11, x3 - umulh x11, x11, x3 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - mov x2, #0xffffffffffffffff - csel x2, xzr, x2, cc - mov x3, #0xffffffff - csel x3, xzr, x3, cc - mov x5, #0xffffffff00000001 - csel x5, xzr, x5, cc - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, xzr - sbc x11, x11, x5 - stp x8, x9, [sp, #160] - stp x10, x11, [sp, #176] - ldp x3, x4, [x17, #64] - ldp x7, x8, [x16, #32] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x16, #48] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [x17, #80] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #192] - stp x14, x0, [sp, #208] - ldp x3, x4, [x16, #64] - ldp x7, x8, [x17, #32] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x17, #48] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [x16, #80] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #32] - stp x14, x0, [sp, #48] - ldp x3, x4, [sp] - ldp x7, x8, [x17] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x17, #16] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #16] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #64] - stp x14, x0, [sp, #80] - ldp x3, x4, [sp, #160] - ldp x7, x8, [x16] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x16, #16] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #176] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #128] - stp x14, x0, [sp, #144] - ldp x3, x4, [sp] - ldp x7, x8, [sp, #32] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #48] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #16] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #32] - stp x14, x0, [sp, #48] - ldp x3, x4, [sp, #160] - ldp x7, x8, [sp, #192] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #208] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #176] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #192] - stp x14, x0, [sp, #208] - ldp x5, x6, [sp, #64] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #160] - stp x7, x8, [sp, #176] - ldp x5, x6, [sp, #32] - ldp x4, x3, [sp, #192] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #48] - ldp x4, x3, [sp, #208] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #32] - stp x7, x8, [sp, #48] - ldp x2, x3, [sp, #160] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #176] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mov x3, #0xffffffff00000001 - mul x2, x8, x3 - umulh x8, x8, x3 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mov x3, #0xffffffff00000001 - mul x2, x9, x3 - umulh x9, x9, x3 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mov x3, #0xffffffff00000001 - mul x2, x10, x3 - umulh x10, x10, x3 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mov x3, #0xffffffff00000001 - mul x2, x11, x3 - umulh x11, x11, x3 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - mov x2, #0xffffffffffffffff - csel x2, xzr, x2, cc - mov x3, #0xffffffff - csel x3, xzr, x3, cc - mov x5, #0xffffffff00000001 - csel x5, xzr, x5, cc - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, xzr - sbc x11, x11, x5 - stp x8, x9, [sp, #96] - stp x10, x11, [sp, #112] - ldp x2, x3, [sp, #32] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #48] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mov x3, #0xffffffff00000001 - mul x2, x8, x3 - umulh x8, x8, x3 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mov x3, #0xffffffff00000001 - mul x2, x9, x3 - umulh x9, x9, x3 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mov x3, #0xffffffff00000001 - mul x2, x10, x3 - umulh x10, x10, x3 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mov x3, #0xffffffff00000001 - mul x2, x11, x3 - umulh x11, x11, x3 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, cs - mov x3, #0xffffffff - mov x5, #0xffffffff00000001 - adds x12, x8, #0x1 - sbcs x13, x9, x3 - sbcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, cc - csel x9, x9, x13, cc - csel x10, x10, x14, cc - csel x11, x11, x7, cc - stp x8, x9, [sp] - stp x10, x11, [sp, #16] - ldp x3, x4, [sp, #96] - ldp x7, x8, [sp, #128] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #144] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #112] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #128] - stp x14, x0, [sp, #144] - ldp x3, x4, [sp, #96] - ldp x7, x8, [sp, #64] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #80] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #112] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #64] - stp x14, x0, [sp, #80] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #16] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #16] - ldp x5, x6, [sp, #64] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #96] - stp x7, x8, [sp, #112] - ldp x3, x4, [sp, #160] - ldp x7, x8, [x16, #64] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x16, #80] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #176] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #160] - stp x14, x0, [sp, #176] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #64] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #16] - ldp x4, x3, [sp, #80] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #16] - ldp x5, x6, [sp, #128] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #144] - ldp x4, x3, [sp, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #128] - stp x7, x8, [sp, #144] - ldp x3, x4, [sp, #96] - ldp x7, x8, [sp, #192] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #208] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #112] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #96] - stp x14, x0, [sp, #112] - ldp x3, x4, [sp, #160] - ldp x7, x8, [x17, #64] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x17, #80] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #176] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #160] - stp x14, x0, [sp, #176] - ldp x3, x4, [sp, #32] - ldp x7, x8, [sp, #128] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #144] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #48] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #128] - stp x14, x0, [sp, #144] - ldp x5, x6, [sp, #128] - ldp x4, x3, [sp, #96] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #144] - ldp x4, x3, [sp, #112] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #128] - stp x7, x8, [sp, #144] - ldp x0, x1, [x16, #64] - ldp x2, x3, [x16, #80] - orr x12, x0, x1 - orr x13, x2, x3 - orr x12, x12, x13 - cmp x12, xzr - cset x12, ne - ldp x4, x5, [x17, #64] - ldp x6, x7, [x17, #80] - orr x13, x4, x5 - orr x14, x6, x7 - orr x13, x13, x14 - cmp x13, xzr - cset x13, ne - cmp x13, x12 - ldp x8, x9, [sp, #160] - csel x8, x0, x8, cc - csel x9, x1, x9, cc - csel x8, x4, x8, hi - csel x9, x5, x9, hi - ldp x10, x11, [sp, #176] - csel x10, x2, x10, cc - csel x11, x3, x11, cc - csel x10, x6, x10, hi - csel x11, x7, x11, hi - ldp x12, x13, [x16] - ldp x0, x1, [sp] - csel x0, x12, x0, cc - csel x1, x13, x1, cc - ldp x12, x13, [x17] - csel x0, x12, x0, hi - csel x1, x13, x1, hi - ldp x12, x13, [x16, #16] - ldp x2, x3, [sp, #16] - csel x2, x12, x2, cc - csel x3, x13, x3, cc - ldp x12, x13, [x17, #16] - csel x2, x12, x2, hi - csel x3, x13, x3, hi - ldp x12, x13, [x16, #32] - ldp x4, x5, [sp, #128] - csel x4, x12, x4, cc - csel x5, x13, x5, cc - ldp x12, x13, [x17, #32] - csel x4, x12, x4, hi - csel x5, x13, x5, hi - ldp x12, x13, [x16, #48] - ldp x6, x7, [sp, #144] - csel x6, x12, x6, cc - csel x7, x13, x7, cc - ldp x12, x13, [x17, #48] - csel x6, x12, x6, hi - csel x7, x13, x7, hi - stp x0, x1, [x15] - stp x2, x3, [x15, #16] - stp x4, x5, [x15, #32] - stp x6, x7, [x15, #48] - stp x8, x9, [x15, #64] - stp x10, x11, [x15, #80] - CFI_INC_SP(224) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_alt_local_p256_montjadd) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_alt_local_p256_montjdouble) - -Lp256_scalarmul_alt_local_p256_montjdouble: - CFI_START - CFI_DEC_SP(192) - mov x15, x0 - mov x16, x1 - ldp x2, x3, [x16, #64] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [x16, #80] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - mov x5, #0xffffffff00000001 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mul x2, x8, x5 - umulh x8, x8, x5 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mul x2, x9, x5 - umulh x9, x9, x5 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mul x2, x10, x5 - umulh x10, x10, x5 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mul x2, x11, x5 - umulh x11, x11, x5 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, cs - mov x3, #0xffffffff - adds x12, x8, #0x1 - sbcs x13, x9, x3 - sbcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, cc - csel x9, x9, x13, cc - csel x10, x10, x14, cc - csel x11, x11, x7, cc - stp x8, x9, [sp] - stp x10, x11, [sp, #16] - ldp x2, x3, [x16, #32] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [x16, #48] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - mov x5, #0xffffffff00000001 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mul x2, x8, x5 - umulh x8, x8, x5 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mul x2, x9, x5 - umulh x9, x9, x5 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mul x2, x10, x5 - umulh x10, x10, x5 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mul x2, x11, x5 - umulh x11, x11, x5 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, cs - mov x3, #0xffffffff - adds x12, x8, #0x1 - sbcs x13, x9, x3 - sbcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, cc - csel x9, x9, x13, cc - csel x10, x10, x14, cc - csel x11, x11, x7, cc - stp x8, x9, [sp, #32] - stp x10, x11, [sp, #48] - ldp x5, x6, [x16] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [x16, #16] - ldp x4, x3, [sp, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [sp, #96] - stp x7, x8, [sp, #112] - ldp x5, x6, [x16] - ldp x4, x3, [sp] - adds x5, x5, x4 - adcs x6, x6, x3 - ldp x7, x8, [x16, #16] - ldp x4, x3, [sp, #16] - adcs x7, x7, x4 - adcs x8, x8, x3 - csetm x3, cs - subs x5, x5, x3 - and x1, x3, #0xffffffff - sbcs x6, x6, x1 - sbcs x7, x7, xzr - and x2, x3, #0xffffffff00000001 - sbc x8, x8, x2 - stp x5, x6, [sp, #64] - stp x7, x8, [sp, #80] - ldp x3, x4, [sp, #64] - ldp x7, x8, [sp, #96] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #112] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #80] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #96] - stp x14, x0, [sp, #112] - ldp x5, x6, [x16, #32] - ldp x4, x3, [x16, #64] - adds x5, x5, x4 - adcs x6, x6, x3 - ldp x7, x8, [x16, #48] - ldp x4, x3, [x16, #80] - adcs x7, x7, x4 - adcs x8, x8, x3 - adc x3, xzr, xzr - cmn x5, #0x1 - mov x4, #0xffffffff - sbcs xzr, x6, x4 - sbcs xzr, x7, xzr - mov x4, #0xffffffff00000001 - sbcs xzr, x8, x4 - adcs x3, x3, xzr - csetm x3, ne - subs x5, x5, x3 - and x4, x3, #0xffffffff - sbcs x6, x6, x4 - sbcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - sbc x8, x8, x4 - stp x5, x6, [sp, #64] - stp x7, x8, [sp, #80] - ldp x3, x4, [x16] - ldp x7, x8, [sp, #32] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #48] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [x16, #16] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #128] - stp x14, x0, [sp, #144] - ldp x2, x3, [sp, #96] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #112] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - mov x5, #0xffffffff00000001 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mul x2, x8, x5 - umulh x8, x8, x5 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mul x2, x9, x5 - umulh x9, x9, x5 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mul x2, x10, x5 - umulh x10, x10, x5 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mul x2, x11, x5 - umulh x11, x11, x5 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, cs - mov x3, #0xffffffff - adds x12, x8, #0x1 - sbcs x13, x9, x3 - sbcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, cc - csel x9, x9, x13, cc - csel x10, x10, x14, cc - csel x11, x11, x7, cc - stp x8, x9, [sp, #160] - stp x10, x11, [sp, #176] - ldp x2, x3, [sp, #64] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #80] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - mov x5, #0xffffffff00000001 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mul x2, x8, x5 - umulh x8, x8, x5 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mul x2, x9, x5 - umulh x9, x9, x5 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mul x2, x10, x5 - umulh x10, x10, x5 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mul x2, x11, x5 - umulh x11, x11, x5 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, cs - mov x3, #0xffffffff - adds x12, x8, #0x1 - sbcs x13, x9, x3 - sbcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, cc - csel x9, x9, x13, cc - csel x10, x10, x14, cc - csel x11, x11, x7, cc - stp x8, x9, [sp, #64] - stp x10, x11, [sp, #80] - mov x1, #0x9 - mov x2, #0xffffffffffffffff - ldp x9, x10, [sp, #160] - subs x9, x2, x9 - mov x2, #0xffffffff - sbcs x10, x2, x10 - ldp x11, x12, [sp, #176] - ngcs x11, x11 - mov x2, #0xffffffff00000001 - sbc x12, x2, x12 - mul x3, x1, x9 - mul x4, x1, x10 - mul x5, x1, x11 - mul x6, x1, x12 - umulh x9, x1, x9 - umulh x10, x1, x10 - umulh x11, x1, x11 - umulh x7, x1, x12 - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, xzr - mov x1, #0xc - ldp x9, x10, [sp, #128] - mul x8, x9, x1 - umulh x9, x9, x1 - adds x3, x3, x8 - mul x8, x10, x1 - umulh x10, x10, x1 - adcs x4, x4, x8 - ldp x11, x12, [sp, #144] - mul x8, x11, x1 - umulh x11, x11, x1 - adcs x5, x5, x8 - mul x8, x12, x1 - umulh x12, x12, x1 - adcs x6, x6, x8 - adc x7, x7, xzr - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, x12 - add x8, x7, #0x1 - lsl x10, x8, #32 - adds x6, x6, x10 - adc x7, x7, xzr - neg x9, x8 - sub x10, x10, #0x1 - subs x3, x3, x9 - sbcs x4, x4, x10 - sbcs x5, x5, xzr - sbcs x6, x6, x8 - sbc x8, x7, x8 - adds x3, x3, x8 - and x9, x8, #0xffffffff - adcs x4, x4, x9 - adcs x5, x5, xzr - neg x10, x9 - adc x6, x6, x10 - stp x3, x4, [sp, #160] - stp x5, x6, [sp, #176] - ldp x5, x6, [sp, #64] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [sp, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [sp, #64] - stp x7, x8, [sp, #80] - ldp x2, x3, [sp, #32] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #48] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - mov x5, #0xffffffff00000001 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mul x2, x8, x5 - umulh x8, x8, x5 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mul x2, x9, x5 - umulh x9, x9, x5 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mul x2, x10, x5 - umulh x10, x10, x5 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mul x2, x11, x5 - umulh x11, x11, x5 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, cs - mov x3, #0xffffffff - adds x12, x8, #0x1 - sbcs x13, x9, x3 - sbcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, cc - csel x9, x9, x13, cc - csel x10, x10, x14, cc - csel x11, x11, x7, cc - stp x8, x9, [sp] - stp x10, x11, [sp, #16] - ldp x3, x4, [sp, #160] - ldp x7, x8, [sp, #96] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #112] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #176] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #96] - stp x14, x0, [sp, #112] - ldp x5, x6, [sp, #64] - ldp x4, x3, [sp, #32] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [sp, #48] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [x15, #64] - stp x7, x8, [x15, #80] - ldp x1, x2, [sp, #128] - lsl x0, x1, #2 - ldp x6, x7, [sp, #160] - subs x0, x0, x6 - extr x1, x2, x1, #62 - sbcs x1, x1, x7 - ldp x3, x4, [sp, #144] - extr x2, x3, x2, #62 - ldp x6, x7, [sp, #176] - sbcs x2, x2, x6 - extr x3, x4, x3, #62 - sbcs x3, x3, x7 - lsr x4, x4, #62 - sbc x4, x4, xzr - add x5, x4, #0x1 - lsl x8, x5, #32 - negs x6, x8 - ngcs x7, xzr - sbc x8, x8, x5 - adds x0, x0, x5 - adcs x1, x1, x6 - adcs x2, x2, x7 - adcs x3, x3, x8 - csetm x5, cc - adds x0, x0, x5 - and x6, x5, #0xffffffff - adcs x1, x1, x6 - adcs x2, x2, xzr - neg x7, x6 - adc x3, x3, x7 - stp x0, x1, [x15] - stp x2, x3, [x15, #16] - mov x1, #0x8 - mov x2, #0xffffffffffffffff - ldp x9, x10, [sp] - subs x9, x2, x9 - mov x2, #0xffffffff - sbcs x10, x2, x10 - ldp x11, x12, [sp, #16] - ngcs x11, x11 - mov x2, #0xffffffff00000001 - sbc x12, x2, x12 - lsl x3, x9, #3 - extr x4, x10, x9, #61 - extr x5, x11, x10, #61 - extr x6, x12, x11, #61 - lsr x7, x12, #61 - mov x1, #0x3 - ldp x9, x10, [sp, #96] - mul x8, x9, x1 - umulh x9, x9, x1 - adds x3, x3, x8 - mul x8, x10, x1 - umulh x10, x10, x1 - adcs x4, x4, x8 - ldp x11, x12, [sp, #112] - mul x8, x11, x1 - umulh x11, x11, x1 - adcs x5, x5, x8 - mul x8, x12, x1 - umulh x12, x12, x1 - adcs x6, x6, x8 - adc x7, x7, xzr - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, x12 - add x8, x7, #0x1 - lsl x10, x8, #32 - adds x6, x6, x10 - adc x7, x7, xzr - neg x9, x8 - sub x10, x10, #0x1 - subs x3, x3, x9 - sbcs x4, x4, x10 - sbcs x5, x5, xzr - sbcs x6, x6, x8 - sbc x8, x7, x8 - adds x3, x3, x8 - and x9, x8, #0xffffffff - adcs x4, x4, x9 - adcs x5, x5, xzr - neg x10, x9 - adc x6, x6, x10 - stp x3, x4, [x15, #32] - stp x5, x6, [x15, #48] - CFI_INC_SP(192) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_alt_local_p256_montjdouble) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_alt_local_p256_montjmixadd) - -Lp256_scalarmul_alt_local_p256_montjmixadd: - CFI_START - CFI_DEC_SP(192) - mov x15, x0 - mov x16, x1 - mov x17, x2 - ldp x2, x3, [x16, #64] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [x16, #80] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mov x3, #0xffffffff00000001 - mul x2, x8, x3 - umulh x8, x8, x3 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mov x3, #0xffffffff00000001 - mul x2, x9, x3 - umulh x9, x9, x3 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mov x3, #0xffffffff00000001 - mul x2, x10, x3 - umulh x10, x10, x3 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mov x3, #0xffffffff00000001 - mul x2, x11, x3 - umulh x11, x11, x3 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - mov x2, #0xffffffffffffffff - csel x2, xzr, x2, cc - mov x3, #0xffffffff - csel x3, xzr, x3, cc - mov x5, #0xffffffff00000001 - csel x5, xzr, x5, cc - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, xzr - sbc x11, x11, x5 - stp x8, x9, [sp] - stp x10, x11, [sp, #16] - ldp x3, x4, [x16, #64] - ldp x7, x8, [x17, #32] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x17, #48] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [x16, #80] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #32] - stp x14, x0, [sp, #48] - ldp x3, x4, [sp] - ldp x7, x8, [x17] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x17, #16] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #16] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #64] - stp x14, x0, [sp, #80] - ldp x3, x4, [sp] - ldp x7, x8, [sp, #32] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #48] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #16] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #32] - stp x14, x0, [sp, #48] - ldp x5, x6, [sp, #64] - ldp x4, x3, [x16] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [x16, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #160] - stp x7, x8, [sp, #176] - ldp x5, x6, [sp, #32] - ldp x4, x3, [x16, #32] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #48] - ldp x4, x3, [x16, #48] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #32] - stp x7, x8, [sp, #48] - ldp x2, x3, [sp, #160] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #176] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mov x3, #0xffffffff00000001 - mul x2, x8, x3 - umulh x8, x8, x3 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mov x3, #0xffffffff00000001 - mul x2, x9, x3 - umulh x9, x9, x3 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mov x3, #0xffffffff00000001 - mul x2, x10, x3 - umulh x10, x10, x3 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mov x3, #0xffffffff00000001 - mul x2, x11, x3 - umulh x11, x11, x3 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - mov x2, #0xffffffffffffffff - csel x2, xzr, x2, cc - mov x3, #0xffffffff - csel x3, xzr, x3, cc - mov x5, #0xffffffff00000001 - csel x5, xzr, x5, cc - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, xzr - sbc x11, x11, x5 - stp x8, x9, [sp, #96] - stp x10, x11, [sp, #112] - ldp x2, x3, [sp, #32] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #48] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mov x3, #0xffffffff00000001 - mul x2, x8, x3 - umulh x8, x8, x3 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mov x3, #0xffffffff00000001 - mul x2, x9, x3 - umulh x9, x9, x3 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mov x3, #0xffffffff00000001 - mul x2, x10, x3 - umulh x10, x10, x3 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mov x3, #0xffffffff00000001 - mul x2, x11, x3 - umulh x11, x11, x3 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, cs - mov x3, #0xffffffff - mov x5, #0xffffffff00000001 - adds x12, x8, #0x1 - sbcs x13, x9, x3 - sbcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, cc - csel x9, x9, x13, cc - csel x10, x10, x14, cc - csel x11, x11, x7, cc - stp x8, x9, [sp] - stp x10, x11, [sp, #16] - ldp x3, x4, [sp, #96] - ldp x7, x8, [x16] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x16, #16] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #112] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #128] - stp x14, x0, [sp, #144] - ldp x3, x4, [sp, #96] - ldp x7, x8, [sp, #64] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #80] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #112] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #64] - stp x14, x0, [sp, #80] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #16] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #16] - ldp x5, x6, [sp, #64] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #96] - stp x7, x8, [sp, #112] - ldp x3, x4, [sp, #160] - ldp x7, x8, [x16, #64] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x16, #80] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #176] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #160] - stp x14, x0, [sp, #176] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #64] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #16] - ldp x4, x3, [sp, #80] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #16] - ldp x5, x6, [sp, #128] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #144] - ldp x4, x3, [sp, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #128] - stp x7, x8, [sp, #144] - ldp x3, x4, [sp, #96] - ldp x7, x8, [x16, #32] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x16, #48] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #112] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #96] - stp x14, x0, [sp, #112] - ldp x3, x4, [sp, #32] - ldp x7, x8, [sp, #128] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #144] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #48] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #128] - stp x14, x0, [sp, #144] - ldp x5, x6, [sp, #128] - ldp x4, x3, [sp, #96] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #144] - ldp x4, x3, [sp, #112] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #128] - stp x7, x8, [sp, #144] - ldp x0, x1, [x16, #64] - ldp x2, x3, [x16, #80] - orr x4, x0, x1 - orr x5, x2, x3 - orr x4, x4, x5 - cmp x4, xzr - ldp x0, x1, [sp] - ldp x12, x13, [x17] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x2, x3, [sp, #16] - ldp x12, x13, [x17, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x4, x5, [sp, #128] - ldp x12, x13, [x17, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x6, x7, [sp, #144] - ldp x12, x13, [x17, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x8, x9, [sp, #160] - mov x12, #0x1 - mov x13, #0xffffffff00000000 - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x10, x11, [sp, #176] - mov x12, #0xffffffffffffffff - mov x13, #0xfffffffe - csel x10, x10, x12, ne - csel x11, x11, x13, ne - stp x0, x1, [x15] - stp x2, x3, [x15, #16] - stp x4, x5, [x15, #32] - stp x6, x7, [x15, #48] - stp x8, x9, [x15, #64] - stp x10, x11, [x15, #80] - CFI_INC_SP(192) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_alt_local_p256_montjmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmulbase.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmulbase.S deleted file mode 100644 index 0153e222767..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmulbase.S +++ /dev/null @@ -1,3782 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Scalar multiplication for precomputed point on NIST curve P-256 -// Input scalar[4], blocksize, table[]; output res[8] -// -// extern void p256_scalarmulbase -// (uint64_t res[static 8], -// const uint64_t scalar[static 4], -// uint64_t blocksize, -// const uint64_t *table); -// -// Given scalar = n and point = P, assumed to be on the NIST elliptic -// curve P-256, the input argument "table" is expected to be a table of -// multiples of the point P in Montgomery-affine form, with each block -// corresponding to "blocksize" bits of the scalar as follows, where -// B = 2^{blocksize-1} (e.g. B = 8 for blocksize = 4): -// -// For each i,j with blocksize * i <= 256 and 1 <= j <= B -// the multiple 2^{blocksize * i} * j * P is stored at -// tab[8 * (B * i + (j - 1))], considered as uint64_t pointers -// or tab + 64 * (B * i + (j - 1)) as byte pointers. -// -// Standard ARM ABI: X0 = res, X1 = scalar, X2 = blocksize, X3 = table -// ---------------------------------------------------------------------------- - - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_scalarmulbase) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_scalarmulbase) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_scalarmulbase) - - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Safe copies of inputs and additional variables, with some aliasing - -#define res x19 -#define blocksize x20 -#define table x21 -#define i x22 -#define bf x23 -#define cf x24 -#define j x25 - -// Intermediate variables on the stack. The last z2, z3 values can -// safely be overlaid on "nacc", which is no longer needed at the end. -// Uppercase syntactic variants make x86_att version simpler to generate - -#define rscalar sp, #(0*NUMSIZE) -#define acc sp, #(1*NUMSIZE) -#define nacc sp, #(4*NUMSIZE) -#define tabent sp, #(7*NUMSIZE) - -#define z2 sp, #(4*NUMSIZE) -#define z3 sp, #(5*NUMSIZE) - -#define NSPACE 9*NUMSIZE - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(p256_scalarmulbase): - CFI_START - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x30) - CFI_DEC_SP(NSPACE) - -// Preserve the input arguments except the scalar, since that gets absorbed -// immediately. The "table" value subsequently gets shifted up each iteration -// of the loop, while "res" and "blocksize" are static throughout. - - mov res, x0 - mov blocksize, x2 - mov table, x3 - -// Load the digits of group order n_256 = [x15;x14;x13;x12] - - movbig(x12, #0xf3b9, #0xcac2, #0xfc63, #0x2551) - movbig(x13, #0xbce6, #0xfaad, #0xa717, #0x9e84) - mov x14, #0xffffffffffffffff - mov x15, #0xffffffff00000000 - -// First, reduce the input scalar mod n_256, i.e. conditionally subtract n_256 -// Store it to "rscalar" (reduced scalar) - - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - - subs x6, x2, x12 - sbcs x7, x3, x13 - sbcs x8, x4, x14 - sbcs x9, x5, x15 - - csel x2, x2, x6, cc - csel x3, x3, x7, cc - csel x4, x4, x8, cc - csel x5, x5, x9, cc - - stp x2, x3, [rscalar] - stp x4, x5, [rscalar+16] - -// Initialize the accumulator to all zeros and the "carry flag" cf to 0 - - stp xzr, xzr, [acc] - stp xzr, xzr, [acc+16] - stp xzr, xzr, [acc+32] - stp xzr, xzr, [acc+48] - stp xzr, xzr, [acc+64] - stp xzr, xzr, [acc+80] - mov cf, xzr - -// Main loop over {i >= 0 | blocksize * i <= 256}. Note the non-strict -// inequality, to allow top carry for any choices of blocksize. - - mov i, xzr - -Lp256_scalarmulbase_loop: - -// The next raw bitfield is bf = bitfield(blocksize * i,blocksize) + cf, -// adding in the deferred carry cf. We then shift the whole scalar right -// by blocksize so we can keep picking bitfield(0,blocksize). - - ldp x0, x1, [rscalar] - ldp x2, x3, [rscalar+16] - - mov x4, #1 - lsl x4, x4, blocksize - sub x4, x4, #1 - and x4, x4, x0 - add bf, x4, cf - - neg x8, blocksize - - lsl x5, x1, x8 - - lsr x0, x0, blocksize - orr x0, x0, x5 - - lsl x6, x2, x8 - lsr x1, x1, blocksize - orr x1, x1, x6 - - lsl x7, x3, x8 - lsr x2, x2, blocksize - orr x2, x2, x7 - - lsr x3, x3, blocksize - - stp x0, x1, [rscalar] - stp x2, x3, [rscalar+16] - -// Now if bf <= B we just select entry j, unnegated and set cf = 0. -// If bf > B we set j = 2 * B - bf and negate the j'th entry, setting cf = 1. -// In either case we ultimately add bf, in the latter case with deferred -// carry as 2 * B - (2 * B - bf) = bf. - - mov x0, #1 - lsl x1, x0, blocksize - lsr x0, x1, #1 - - sub x2, x1, bf - - cmp x0, bf - cset cf, cc - csel j, x2, bf, cc - -// Load table entry j - 1 for nonzero j in constant-time style. - - mov x16, #1 - lsl x16, x16, blocksize - lsr x16, x16, #1 - mov x17, j - -Lp256_scalarmulbase_tabloop: - ldp x8, x9, [table] - ldp x10, x11, [table, #16] - ldp x12, x13, [table, #32] - ldp x14, x15, [table, #48] - - subs x17, x17, #1 - csel x0, x8, x0, eq - csel x1, x9, x1, eq - csel x2, x10, x2, eq - csel x3, x11, x3, eq - csel x4, x12, x4, eq - csel x5, x13, x5, eq - csel x6, x14, x6, eq - csel x7, x15, x7, eq - - add table, table, #64 - - sub x16, x16, #1 - cbnz x16, Lp256_scalarmulbase_tabloop - -// Before storing back, optionally negate the y coordinate of the table entry - - stp x0, x1, [tabent] - stp x2, x3, [tabent+16] - - mov x0, 0xffffffffffffffff - subs x0, x0, x4 - mov x1, 0x00000000ffffffff - sbcs x1, x1, x5 - mov x3, 0xffffffff00000001 - sbcs x2, xzr, x6 - sbc x3, x3, x7 - - cmp cf, xzr - csel x4, x0, x4, ne - csel x5, x1, x5, ne - csel x6, x2, x6, ne - csel x7, x3, x7, ne - - stp x4, x5, [tabent+32] - stp x6, x7, [tabent+48] - -// Add the adjusted table point to the accumulator - - add x0, nacc - add x1, acc - add x2, tabent - CFI_BL(Lp256_scalarmulbase_local_p256_montjmixadd) - -// However, only commit that update to the accumulator if j is nonzero, -// because the mixed addition function does not handle this case directly, -// and in any case we didn't choose the table entry appropriately. - - cmp j, xzr - ldp x0, x1, [acc] - ldp x12, x13, [nacc] - csel x0, x12, x0, ne - csel x1, x13, x1, ne - - ldp x2, x3, [acc+16] - ldp x12, x13, [nacc+16] - csel x2, x12, x2, ne - csel x3, x13, x3, ne - - ldp x4, x5, [acc+32] - ldp x12, x13, [nacc+32] - csel x4, x12, x4, ne - csel x5, x13, x5, ne - - ldp x6, x7, [acc+48] - ldp x12, x13, [nacc+48] - csel x6, x12, x6, ne - csel x7, x13, x7, ne - - ldp x8, x9, [acc+64] - ldp x12, x13, [nacc+64] - csel x8, x12, x8, ne - csel x9, x13, x9, ne - - ldp x10, x11, [acc+80] - ldp x12, x13, [nacc+80] - csel x10, x12, x10, ne - csel x11, x13, x11, ne - - stp x0, x1, [acc] - stp x2, x3, [acc+16] - stp x4, x5, [acc+32] - stp x6, x7, [acc+48] - stp x8, x9, [acc+64] - stp x10, x11, [acc+80] - -// Loop while blocksize * i <= 256 - - add i, i, #1 - mul x0, blocksize, i - cmp x0, #257 - bcc Lp256_scalarmulbase_loop - -// That's the end of the main loop, and we just need to translate -// back from the Jacobian representation to affine. First of all, -// let z2 = 1/z^2 and z3 = 1/z^3, both without Montgomery form - - add x0, z2 - add x1, acc+64 - CFI_BL(Lp256_scalarmulbase_local_montsqr_p256) - - add x0, z3 - add x1, acc+64 - add x2, z2 - CFI_BL(Lp256_scalarmulbase_local_montmul_p256) - - add x0, z2 - add x1, z3 - CFI_BL(Lp256_scalarmulbase_local_demont_p256) - - add x0, z3 - add x1, z2 - CFI_BL(Lp256_scalarmulbase_local_inv_p256) - - add x0, z2 - add x1, acc+64 - add x2, z3 - CFI_BL(Lp256_scalarmulbase_local_montmul_p256) - -// Convert back from Jacobian (X,Y,Z) |-> (X/Z^2, Y/Z^3) - - mov x0, res - add x1, acc - add x2, z2 - CFI_BL(Lp256_scalarmulbase_local_montmul_p256) - - add x0, res, #32 - add x1, acc+32 - add x2, z3 - CFI_BL(Lp256_scalarmulbase_local_montmul_p256) - -// Restore stack and registers and return - - CFI_INC_SP(NSPACE) - CFI_POP2(x25,x30) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_scalarmulbase) - -// Local copies of subroutines, complete clones at the moment - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_local_demont_p256) - -Lp256_scalarmulbase_local_demont_p256: - CFI_START - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - lsl x7, x2, #32 - subs x8, x2, x7 - lsr x6, x2, #32 - sbc x2, x2, x6 - adds x3, x3, x7 - adcs x4, x4, x6 - adcs x5, x5, x8 - adc x2, x2, xzr - lsl x7, x3, #32 - subs x8, x3, x7 - lsr x6, x3, #32 - sbc x3, x3, x6 - adds x4, x4, x7 - adcs x5, x5, x6 - adcs x2, x2, x8 - adc x3, x3, xzr - lsl x7, x4, #32 - subs x8, x4, x7 - lsr x6, x4, #32 - sbc x4, x4, x6 - adds x5, x5, x7 - adcs x2, x2, x6 - adcs x3, x3, x8 - adc x4, x4, xzr - lsl x7, x5, #32 - subs x8, x5, x7 - lsr x6, x5, #32 - sbc x5, x5, x6 - adds x2, x2, x7 - adcs x3, x3, x6 - adcs x4, x4, x8 - adc x5, x5, xzr - stp x2, x3, [x0] - stp x4, x5, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_local_demont_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_local_inv_p256) - -Lp256_scalarmulbase_local_inv_p256: - CFI_START - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_DEC_SP(160) - mov x20, x0 - mov x10, #0xffffffffffffffff - mov x11, #0xffffffff - mov x13, #0xffffffff00000001 - stp x10, x11, [sp] - stp xzr, x13, [sp, #16] - str xzr, [sp, #32] - ldp x2, x3, [x1] - subs x10, x2, x10 - sbcs x11, x3, x11 - ldp x4, x5, [x1, #16] - sbcs x12, x4, xzr - sbcs x13, x5, x13 - csel x2, x2, x10, cc - csel x3, x3, x11, cc - csel x4, x4, x12, cc - csel x5, x5, x13, cc - stp x2, x3, [sp, #48] - stp x4, x5, [sp, #64] - str xzr, [sp, #80] - stp xzr, xzr, [sp, #96] - stp xzr, xzr, [sp, #112] - mov x10, #0x4000000000000 - stp x10, xzr, [sp, #128] - stp xzr, xzr, [sp, #144] - mov x21, #0xa - mov x22, #0x1 - b Lp256_scalarmulbase_inv_midloop -Lp256_scalarmulbase_inv_loop: - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - and x0, x12, x16 - and x1, x13, x17 - add x19, x0, x1 - ldr x7, [sp] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #48] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x7, [sp, #8] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #56] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [sp] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [sp, #48] - ldr x7, [sp, #16] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #64] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [sp, #8] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [sp, #56] - ldr x7, [sp, #24] - eor x1, x7, x14 - ldr x23, [sp, #32] - eor x3, x23, x14 - and x3, x3, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #72] - eor x1, x8, x15 - ldr x24, [sp, #80] - eor x0, x24, x15 - and x0, x0, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [sp, #16] - extr x5, x3, x5, #59 - str x5, [sp, #24] - asr x3, x3, #59 - str x3, [sp, #32] - eor x1, x7, x16 - eor x5, x23, x16 - and x5, x5, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - eor x0, x24, x17 - and x0, x0, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - extr x4, x2, x4, #59 - str x4, [sp, #64] - extr x2, x5, x2, #59 - str x2, [sp, #72] - asr x5, x5, #59 - str x5, [sp, #80] - ldr x7, [sp, #96] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #128] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #96] - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - str x5, [sp, #128] - adc x3, x3, x1 - ldr x7, [sp, #104] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #136] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #104] - adc x6, x6, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - str x3, [sp, #136] - adc x4, x4, x1 - ldr x7, [sp, #112] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #144] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #112] - adc x5, x5, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - str x4, [sp, #144] - adc x2, x2, x1 - ldr x7, [sp, #120] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #152] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - ldp x0, x1, [sp, #96] - ldr x6, [sp, #112] - mov x14, #0xe000000000000000 - adds x0, x0, x14 - sbcs x1, x1, xzr - mov x11, #0x1fffffff - adcs x6, x6, x11 - mov x10, #0x2000000000000000 - adcs x5, x5, x10 - mov x14, #0x1fffffffe0000000 - adc x3, x3, x14 - lsl x11, x0, #32 - subs x14, x0, x11 - lsr x10, x0, #32 - sbc x0, x0, x10 - adds x1, x1, x11 - adcs x6, x6, x10 - adcs x5, x5, x14 - adcs x3, x3, x0 - mov x14, #0xffffffffffffffff - mov x11, #0xffffffff - mov x10, #0xffffffff00000001 - csel x14, x14, xzr, cs - csel x11, x11, xzr, cs - csel x10, x10, xzr, cs - subs x1, x1, x14 - sbcs x6, x6, x11 - sbcs x5, x5, xzr - sbc x3, x3, x10 - stp x1, x6, [sp, #96] - stp x5, x3, [sp, #112] - eor x1, x7, x16 - and x5, x16, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - and x0, x17, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - ldp x0, x1, [sp, #128] - ldr x3, [sp, #144] - mov x14, #0xe000000000000000 - adds x0, x0, x14 - sbcs x1, x1, xzr - mov x11, #0x1fffffff - adcs x3, x3, x11 - mov x10, #0x2000000000000000 - adcs x2, x2, x10 - mov x14, #0x1fffffffe0000000 - adc x5, x5, x14 - lsl x11, x0, #32 - subs x14, x0, x11 - lsr x10, x0, #32 - sbc x0, x0, x10 - adds x1, x1, x11 - adcs x3, x3, x10 - adcs x2, x2, x14 - adcs x5, x5, x0 - mov x14, #0xffffffffffffffff - mov x11, #0xffffffff - mov x10, #0xffffffff00000001 - csel x14, x14, xzr, cs - csel x11, x11, xzr, cs - csel x10, x10, xzr, cs - subs x1, x1, x14 - sbcs x3, x3, x11 - sbcs x2, x2, xzr - sbc x5, x5, x10 - stp x1, x3, [sp, #128] - stp x2, x5, [sp, #144] -Lp256_scalarmulbase_inv_midloop: - mov x1, x22 - ldr x2, [sp] - ldr x3, [sp, #48] - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x8, x4, #0x100, lsl #12 - sbfx x8, x8, #21, #21 - mov x11, #0x100000 - add x11, x11, x11, lsl #21 - add x9, x4, x11 - asr x9, x9, #42 - add x10, x5, #0x100, lsl #12 - sbfx x10, x10, #21, #21 - add x11, x5, x11 - asr x11, x11, #42 - mul x6, x8, x2 - mul x7, x9, x3 - mul x2, x10, x2 - mul x3, x11, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #21, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #42 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #21, #21 - add x15, x5, x15 - asr x15, x15, #42 - mul x6, x12, x2 - mul x7, x13, x3 - mul x2, x14, x2 - mul x3, x15, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - mul x2, x12, x8 - mul x3, x12, x9 - mul x6, x14, x8 - mul x7, x14, x9 - madd x8, x13, x10, x2 - madd x9, x13, x11, x3 - madd x16, x15, x10, x6 - madd x17, x15, x11, x7 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #22, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #43 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #22, #21 - add x15, x5, x15 - asr x15, x15, #43 - mneg x2, x12, x8 - mneg x3, x12, x9 - mneg x4, x14, x8 - mneg x5, x14, x9 - msub x10, x13, x16, x2 - msub x11, x13, x17, x3 - msub x12, x15, x16, x4 - msub x13, x15, x17, x5 - mov x22, x1 - subs x21, x21, #0x1 - bne Lp256_scalarmulbase_inv_loop - ldr x0, [sp] - ldr x1, [sp, #48] - mul x0, x0, x10 - madd x1, x1, x11, x0 - asr x0, x1, #63 - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - eor x14, x14, x0 - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - eor x15, x15, x0 - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - eor x16, x16, x0 - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - eor x17, x17, x0 - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - ldr x7, [sp, #96] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #128] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #96] - adc x2, x2, x1 - ldr x7, [sp, #104] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #136] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #104] - adc x6, x6, x1 - ldr x7, [sp, #112] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #144] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #112] - adc x5, x5, x1 - ldr x7, [sp, #120] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #152] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - ldp x0, x1, [sp, #96] - ldr x2, [sp, #112] - mov x14, #0xe000000000000000 - adds x0, x0, x14 - sbcs x1, x1, xzr - mov x11, #0x1fffffff - adcs x2, x2, x11 - mov x10, #0x2000000000000000 - adcs x5, x5, x10 - mov x14, #0x1fffffffe0000000 - adc x3, x3, x14 - lsl x11, x0, #32 - subs x14, x0, x11 - lsr x10, x0, #32 - sbc x0, x0, x10 - adds x1, x1, x11 - adcs x2, x2, x10 - adcs x5, x5, x14 - adcs x3, x3, x0 - mov x14, #0xffffffffffffffff - mov x11, #0xffffffff - mov x10, #0xffffffff00000001 - csel x14, x14, xzr, cs - csel x11, x11, xzr, cs - csel x10, x10, xzr, cs - subs x1, x1, x14 - sbcs x2, x2, x11 - sbcs x5, x5, xzr - sbc x3, x3, x10 - mov x10, #0xffffffffffffffff - subs x10, x1, x10 - mov x11, #0xffffffff - sbcs x11, x2, x11 - mov x13, #0xffffffff00000001 - sbcs x12, x5, xzr - sbcs x13, x3, x13 - csel x10, x1, x10, cc - csel x11, x2, x11, cc - csel x12, x5, x12, cc - csel x13, x3, x13, cc - stp x10, x11, [x20] - stp x12, x13, [x20, #16] - CFI_INC_SP(160) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_local_inv_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_local_montmul_p256) - -Lp256_scalarmulbase_local_montmul_p256: - CFI_START - ldr q20, [x2] - ldp x7, x17, [x1] - ldr q0, [x1] - ldp x6, x10, [x2] - ldp x11, x15, [x1, #16] - rev64 v16.4S, v20.4S - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4S, v16.4S, v0.4S - umulh x12, x17, x10 - uzp1 v28.4S, v20.4S, v0.4S - subs x14, x11, x7 - ldr q20, [x2, #16] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2D, v16.4S - umulh x4, x7, x6 - uzp1 v21.4S, v0.4S, v0.4S - cneg x11, x8, cc - shl v17.2D, v27.2D, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2D, v21.2S, v28.2S - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [x1, #16] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2S, v20.2D - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4S, v20.4S, v20.4S - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2S, v28.2D - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x2, #16] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x9, x3, x13 - adcs x3, x8, x7 - umulh x8, x14, x11 - umull v21.2D, v0.2S, v1.2S - adcs x12, x10, x12 - umull v3.2D, v0.2S, v16.2S - adc x15, x15, xzr - rev64 v24.4S, v20.4S - stp x12, x15, [x0, #16] - movi v2.2D, #0x00000000ffffffff - mul x10, x14, x11 - mul v4.4S, v24.4S, v28.4S - subs x13, x14, x5 - uzp2 v19.4S, v28.4S, v28.4S - csetm x15, cc - usra v3.2D, v21.2D, #32 - mul x7, x5, x1 - umull v21.2D, v19.2S, v16.2S - cneg x13, x13, cc - uaddlp v5.2D, v4.4S - subs x11, x1, x11 - and v16.16B, v3.16B, v2.16B - umulh x5, x5, x1 - shl v24.2D, v5.2D, #32 - cneg x11, x11, cc - umlal v16.2D, v19.2S, v1.2S - cinv x12, x15, cc - umlal v24.2D, v0.2S, v1.2S - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - stp x9, x3, [x0] - usra v21.2D, v3.2D, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2D, v16.2D, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - ldp x15, x8, [x0] - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - ldp x9, x13, [x0, #16] - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x15 - adcs x15, x16, x8 - eor x5, x17, x4 - adcs x9, x1, x9 - eor x1, x10, x5 - adcs x16, x2, x13 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [x0] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_local_montmul_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_local_montsqr_p256) - -Lp256_scalarmulbase_local_montsqr_p256: - CFI_START - ldr q19, [x1] - ldp x9, x13, [x1] - ldr q23, [x1, #16] - ldr q0, [x1] - ldp x1, x10, [x1, #16] - uzp2 v29.4S, v19.4S, v19.4S - xtn v4.2S, v19.2D - umulh x8, x9, x13 - rev64 v20.4S, v23.4S - umull v16.2D, v19.2S, v19.2S - umull v1.2D, v29.2S, v4.2S - mul v20.4S, v20.4S, v0.4S - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2D, v19.4S, v19.4S - mov x4, v16.d[0] - uzp1 v17.4S, v23.4S, v0.4S - uaddlp v19.2D, v20.4S - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4S, v0.4S, v0.4S - shl v19.2D, v19.2D, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2D, v20.2S, v17.2S - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x16, x3, x16, cs - csel x14, x8, x14, cs - csel x12, x11, x12, cs - csel x2, x5, x2, cs - stp x14, x12, [x0, #16] - stp x16, x2, [x0] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_local_montsqr_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_local_p256_montjmixadd) - -Lp256_scalarmulbase_local_p256_montjmixadd: - CFI_START - CFI_PUSH2(x19,x20) - CFI_DEC_SP(192) - mov x17, x0 - mov x19, x1 - mov x20, x2 - ldp x2, x3, [x19, #64] - ldp x4, x5, [x19, #80] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x0, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x0, x0, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x0, x0, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - subs x13, x15, x12 - lsr x11, x15, #32 - sbc x15, x15, x11 - adds x16, x16, x12 - adcs x0, x0, x11 - adcs x1, x1, x13 - adc x15, x15, xzr - lsl x12, x16, #32 - subs x13, x16, x12 - lsr x11, x16, #32 - sbc x16, x16, x11 - adds x0, x0, x12 - adcs x1, x1, x11 - adcs x15, x15, x13 - adc x16, x16, xzr - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, cc - csetm x13, cc - subs x12, x5, x4 - cneg x12, x12, cc - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, cc - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x0 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - subs x13, x6, x12 - lsr x11, x6, #32 - sbc x6, x6, x11 - adds x7, x7, x12 - adcs x8, x8, x11 - adcs x9, x9, x13 - adcs x10, x10, x6 - adc x6, xzr, xzr - lsl x12, x7, #32 - subs x13, x7, x12 - lsr x11, x7, #32 - sbc x7, x7, x11 - adds x8, x8, x12 - adcs x9, x9, x11 - adcs x10, x10, x13 - adcs x6, x6, x7 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #0xffffffff - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #0xffffffff00000001 - sbcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, cs - csel x9, x11, x9, cs - csel x10, x12, x10, cs - csel x6, x13, x6, cs - stp x8, x9, [sp] - stp x10, x6, [sp, #16] - ldp x3, x4, [x19, #64] - ldp x5, x6, [x19, #80] - ldp x7, x8, [x20, #32] - ldp x9, x10, [x20, #48] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #32] - stp x11, x12, [sp, #48] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #32] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #48] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #32] - stp x3, x4, [sp, #48] - ldp x3, x4, [sp] - ldp x5, x6, [sp, #16] - ldp x7, x8, [x20] - ldp x9, x10, [x20, #16] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #64] - stp x11, x12, [sp, #80] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #64] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #80] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #64] - stp x3, x4, [sp, #80] - ldp x3, x4, [sp] - ldp x5, x6, [sp, #16] - ldp x7, x8, [sp, #32] - ldp x9, x10, [sp, #48] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #32] - stp x11, x12, [sp, #48] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #32] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #48] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #32] - stp x3, x4, [sp, #48] - ldp x5, x6, [sp, #64] - ldp x4, x3, [x19] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [x19, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #160] - stp x7, x8, [sp, #176] - ldp x5, x6, [sp, #32] - ldp x4, x3, [x19, #32] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #48] - ldp x4, x3, [x19, #48] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #32] - stp x7, x8, [sp, #48] - ldp x2, x3, [sp, #160] - ldp x4, x5, [sp, #176] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x0, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x0, x0, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x0, x0, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - subs x13, x15, x12 - lsr x11, x15, #32 - sbc x15, x15, x11 - adds x16, x16, x12 - adcs x0, x0, x11 - adcs x1, x1, x13 - adc x15, x15, xzr - lsl x12, x16, #32 - subs x13, x16, x12 - lsr x11, x16, #32 - sbc x16, x16, x11 - adds x0, x0, x12 - adcs x1, x1, x11 - adcs x15, x15, x13 - adc x16, x16, xzr - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, cc - csetm x13, cc - subs x12, x5, x4 - cneg x12, x12, cc - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, cc - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x0 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - subs x13, x6, x12 - lsr x11, x6, #32 - sbc x6, x6, x11 - adds x7, x7, x12 - adcs x8, x8, x11 - adcs x9, x9, x13 - adcs x10, x10, x6 - adc x6, xzr, xzr - lsl x12, x7, #32 - subs x13, x7, x12 - lsr x11, x7, #32 - sbc x7, x7, x11 - adds x8, x8, x12 - adcs x9, x9, x11 - adcs x10, x10, x13 - adcs x6, x6, x7 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #0xffffffff - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #0xffffffff00000001 - sbcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, cs - csel x9, x11, x9, cs - csel x10, x12, x10, cs - csel x6, x13, x6, cs - stp x8, x9, [sp, #96] - stp x10, x6, [sp, #112] - ldp x2, x3, [sp, #32] - ldp x4, x5, [sp, #48] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x0, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x0, x0, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x0, x0, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - subs x13, x15, x12 - lsr x11, x15, #32 - sbc x15, x15, x11 - adds x16, x16, x12 - adcs x0, x0, x11 - adcs x1, x1, x13 - adc x15, x15, xzr - lsl x12, x16, #32 - subs x13, x16, x12 - lsr x11, x16, #32 - sbc x16, x16, x11 - adds x0, x0, x12 - adcs x1, x1, x11 - adcs x15, x15, x13 - adc x16, x16, xzr - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, cc - csetm x13, cc - subs x12, x5, x4 - cneg x12, x12, cc - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, cc - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x0 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - subs x13, x6, x12 - lsr x11, x6, #32 - sbc x6, x6, x11 - adds x7, x7, x12 - adcs x8, x8, x11 - adcs x9, x9, x13 - adcs x10, x10, x6 - adc x6, xzr, xzr - lsl x12, x7, #32 - subs x13, x7, x12 - lsr x11, x7, #32 - sbc x7, x7, x11 - adds x8, x8, x12 - adcs x9, x9, x11 - adcs x10, x10, x13 - adcs x6, x6, x7 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #0xffffffff - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #0xffffffff00000001 - sbcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, cs - csel x9, x11, x9, cs - csel x10, x12, x10, cs - csel x6, x13, x6, cs - stp x8, x9, [sp] - stp x10, x6, [sp, #16] - ldp x3, x4, [sp, #96] - ldp x5, x6, [sp, #112] - ldp x7, x8, [x19] - ldp x9, x10, [x19, #16] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #128] - stp x11, x12, [sp, #144] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #128] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #144] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #128] - stp x3, x4, [sp, #144] - ldp x3, x4, [sp, #96] - ldp x5, x6, [sp, #112] - ldp x7, x8, [sp, #64] - ldp x9, x10, [sp, #80] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #64] - stp x11, x12, [sp, #80] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #64] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #80] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #64] - stp x3, x4, [sp, #80] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #16] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #16] - ldp x5, x6, [sp, #64] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #96] - stp x7, x8, [sp, #112] - ldp x3, x4, [sp, #160] - ldp x5, x6, [sp, #176] - ldp x7, x8, [x19, #64] - ldp x9, x10, [x19, #80] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #160] - stp x11, x12, [sp, #176] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #160] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #176] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #160] - stp x3, x4, [sp, #176] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #64] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #16] - ldp x4, x3, [sp, #80] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #16] - ldp x5, x6, [sp, #128] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #144] - ldp x4, x3, [sp, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #128] - stp x7, x8, [sp, #144] - ldp x3, x4, [sp, #96] - ldp x5, x6, [sp, #112] - ldp x7, x8, [x19, #32] - ldp x9, x10, [x19, #48] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #96] - stp x11, x12, [sp, #112] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #96] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #112] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #96] - stp x3, x4, [sp, #112] - ldp x3, x4, [sp, #32] - ldp x5, x6, [sp, #48] - ldp x7, x8, [sp, #128] - ldp x9, x10, [sp, #144] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, cc - csetm x1, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - stp x13, x14, [sp, #128] - stp x11, x12, [sp, #144] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, cc - csetm x1, cc - subs x0, x10, x9 - cneg x0, x0, cc - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, cc - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #128] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #144] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, cc - csetm x4, cc - subs x0, x8, x7 - cneg x0, x0, cc - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, cc - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x0, x11, #32 - subs x1, x11, x0 - lsr x16, x11, #32 - sbc x11, x11, x16 - adds x12, x12, x0 - adcs x13, x13, x16 - adcs x14, x14, x1 - adc x11, x11, xzr - lsl x0, x12, #32 - subs x1, x12, x0 - lsr x16, x12, #32 - sbc x12, x12, x16 - adds x13, x13, x0 - adcs x14, x14, x16 - adcs x11, x11, x1 - adc x12, x12, xzr - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x16, x2, #32 - adds x4, x4, x16 - adc x10, x10, xzr - neg x15, x2 - sub x16, x16, #0x1 - subs x13, x13, x15 - sbcs x14, x14, x16 - sbcs x3, x3, xzr - sbcs x4, x4, x2 - sbcs x7, x10, x2 - adds x13, x13, x7 - mov x10, #0xffffffff - and x10, x10, x7 - adcs x14, x14, x10 - adcs x3, x3, xzr - mov x10, #0xffffffff00000001 - and x10, x10, x7 - adc x4, x4, x10 - stp x13, x14, [sp, #128] - stp x3, x4, [sp, #144] - ldp x5, x6, [sp, #128] - ldp x4, x3, [sp, #96] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #144] - ldp x4, x3, [sp, #112] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #128] - stp x7, x8, [sp, #144] - ldp x0, x1, [x19, #64] - ldp x2, x3, [x19, #80] - orr x4, x0, x1 - orr x5, x2, x3 - orr x4, x4, x5 - cmp x4, xzr - ldp x0, x1, [sp] - ldp x12, x13, [x20] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x2, x3, [sp, #16] - ldp x12, x13, [x20, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x4, x5, [sp, #128] - ldp x12, x13, [x20, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x6, x7, [sp, #144] - ldp x12, x13, [x20, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x8, x9, [sp, #160] - mov x12, #0x1 - mov x13, #0xffffffff00000000 - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x10, x11, [sp, #176] - mov x12, #0xffffffffffffffff - mov x13, #0xfffffffe - csel x10, x10, x12, ne - csel x11, x11, x13, ne - stp x0, x1, [x17] - stp x2, x3, [x17, #16] - stp x4, x5, [x17, #32] - stp x6, x7, [x17, #48] - stp x8, x9, [x17, #64] - stp x10, x11, [x17, #80] - CFI_INC_SP(192) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_local_p256_montjmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmulbase_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmulbase_alt.S deleted file mode 100644 index bbc9af51866..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/p256_scalarmulbase_alt.S +++ /dev/null @@ -1,3057 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Scalar multiplication for precomputed point on NIST curve P-256 -// Input scalar[4], blocksize, table[]; output res[8] -// -// extern void p256_scalarmulbase_alt -// (uint64_t res[static 8], -// const uint64_t scalar[static 4], -// uint64_t blocksize, -// const uint64_t *table); -// -// Given scalar = n and point = P, assumed to be on the NIST elliptic -// curve P-256, the input argument "table" is expected to be a table of -// multiples of the point P in Montgomery-affine form, with each block -// corresponding to "blocksize" bits of the scalar as follows, where -// B = 2^{blocksize-1} (e.g. B = 8 for blocksize = 4): -// -// For each i,j with blocksize * i <= 256 and 1 <= j <= B -// the multiple 2^{blocksize * i} * j * P is stored at -// tab[8 * (B * i + (j - 1))], considered as uint64_t pointers -// or tab + 64 * (B * i + (j - 1)) as byte pointers. -// -// Standard ARM ABI: X0 = res, X1 = scalar, X2 = blocksize, X3 = table -// ---------------------------------------------------------------------------- - - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_scalarmulbase_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_scalarmulbase_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_scalarmulbase_alt) - - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Safe copies of inputs and additional variables, with some aliasing - -#define res x19 -#define blocksize x20 -#define table x21 -#define i x22 -#define bf x23 -#define cf x24 -#define j x25 - -// Intermediate variables on the stack. The last z2, z3 values can -// safely be overlaid on "nacc", which is no longer needed at the end. -// Uppercase syntactic variants make x86_att version simpler to generate - -#define rscalar sp, #(0*NUMSIZE) -#define acc sp, #(1*NUMSIZE) -#define nacc sp, #(4*NUMSIZE) -#define tabent sp, #(7*NUMSIZE) - -#define z2 sp, #(4*NUMSIZE) -#define z3 sp, #(5*NUMSIZE) - -#define NSPACE 9*NUMSIZE - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(p256_scalarmulbase_alt): - CFI_START - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x30) - CFI_DEC_SP(NSPACE) - -// Preserve the input arguments except the scalar, since that gets absorbed -// immediately. The "table" value subsequently gets shifted up each iteration -// of the loop, while "res" and "blocksize" are static throughout. - - mov res, x0 - mov blocksize, x2 - mov table, x3 - -// Load the digits of group order n_256 = [x15;x14;x13;x12] - - movbig(x12, #0xf3b9, #0xcac2, #0xfc63, #0x2551) - movbig(x13, #0xbce6, #0xfaad, #0xa717, #0x9e84) - mov x14, #0xffffffffffffffff - mov x15, #0xffffffff00000000 - -// First, reduce the input scalar mod n_256, i.e. conditionally subtract n_256 -// Store it to "rscalar" (reduced scalar) - - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - - subs x6, x2, x12 - sbcs x7, x3, x13 - sbcs x8, x4, x14 - sbcs x9, x5, x15 - - csel x2, x2, x6, cc - csel x3, x3, x7, cc - csel x4, x4, x8, cc - csel x5, x5, x9, cc - - stp x2, x3, [rscalar] - stp x4, x5, [rscalar+16] - -// Initialize the accumulator to all zeros and the "carry flag" cf to 0 - - stp xzr, xzr, [acc] - stp xzr, xzr, [acc+16] - stp xzr, xzr, [acc+32] - stp xzr, xzr, [acc+48] - stp xzr, xzr, [acc+64] - stp xzr, xzr, [acc+80] - mov cf, xzr - -// Main loop over {i >= 0 | blocksize * i <= 256}. Note the non-strict -// inequality, to allow top carry for any choices of blocksize. - - mov i, xzr - -Lp256_scalarmulbase_alt_loop: - -// The next raw bitfield is bf = bitfield(blocksize * i,blocksize) + cf, -// adding in the deferred carry cf. We then shift the whole scalar right -// by blocksize so we can keep picking bitfield(0,blocksize). - - ldp x0, x1, [rscalar] - ldp x2, x3, [rscalar+16] - - mov x4, #1 - lsl x4, x4, blocksize - sub x4, x4, #1 - and x4, x4, x0 - add bf, x4, cf - - neg x8, blocksize - - lsl x5, x1, x8 - - lsr x0, x0, blocksize - orr x0, x0, x5 - - lsl x6, x2, x8 - lsr x1, x1, blocksize - orr x1, x1, x6 - - lsl x7, x3, x8 - lsr x2, x2, blocksize - orr x2, x2, x7 - - lsr x3, x3, blocksize - - stp x0, x1, [rscalar] - stp x2, x3, [rscalar+16] - -// Now if bf <= B we just select entry j, unnegated and set cf = 0. -// If bf > B we set j = 2 * B - bf and negate the j'th entry, setting cf = 1. -// In either case we ultimately add bf, in the latter case with deferred -// carry as 2 * B - (2 * B - bf) = bf. - - mov x0, #1 - lsl x1, x0, blocksize - lsr x0, x1, #1 - - sub x2, x1, bf - - cmp x0, bf - cset cf, cc - csel j, x2, bf, cc - -// Load table entry j - 1 for nonzero j in constant-time style. - - mov x16, #1 - lsl x16, x16, blocksize - lsr x16, x16, #1 - mov x17, j - -Lp256_scalarmulbase_alt_tabloop: - ldp x8, x9, [table] - ldp x10, x11, [table, #16] - ldp x12, x13, [table, #32] - ldp x14, x15, [table, #48] - - subs x17, x17, #1 - csel x0, x8, x0, eq - csel x1, x9, x1, eq - csel x2, x10, x2, eq - csel x3, x11, x3, eq - csel x4, x12, x4, eq - csel x5, x13, x5, eq - csel x6, x14, x6, eq - csel x7, x15, x7, eq - - add table, table, #64 - - sub x16, x16, #1 - cbnz x16, Lp256_scalarmulbase_alt_tabloop - -// Before storing back, optionally negate the y coordinate of the table entry - - stp x0, x1, [tabent] - stp x2, x3, [tabent+16] - - mov x0, 0xffffffffffffffff - subs x0, x0, x4 - mov x1, 0x00000000ffffffff - sbcs x1, x1, x5 - mov x3, 0xffffffff00000001 - sbcs x2, xzr, x6 - sbc x3, x3, x7 - - cmp cf, xzr - csel x4, x0, x4, ne - csel x5, x1, x5, ne - csel x6, x2, x6, ne - csel x7, x3, x7, ne - - stp x4, x5, [tabent+32] - stp x6, x7, [tabent+48] - -// Add the adjusted table point to the accumulator - - add x0, nacc - add x1, acc - add x2, tabent - CFI_BL(Lp256_scalarmulbase_alt_local_p256_montjmixadd) - -// However, only commit that update to the accumulator if j is nonzero, -// because the mixed addition function does not handle this case directly, -// and in any case we didn't choose the table entry appropriately. - - cmp j, xzr - ldp x0, x1, [acc] - ldp x12, x13, [nacc] - csel x0, x12, x0, ne - csel x1, x13, x1, ne - - ldp x2, x3, [acc+16] - ldp x12, x13, [nacc+16] - csel x2, x12, x2, ne - csel x3, x13, x3, ne - - ldp x4, x5, [acc+32] - ldp x12, x13, [nacc+32] - csel x4, x12, x4, ne - csel x5, x13, x5, ne - - ldp x6, x7, [acc+48] - ldp x12, x13, [nacc+48] - csel x6, x12, x6, ne - csel x7, x13, x7, ne - - ldp x8, x9, [acc+64] - ldp x12, x13, [nacc+64] - csel x8, x12, x8, ne - csel x9, x13, x9, ne - - ldp x10, x11, [acc+80] - ldp x12, x13, [nacc+80] - csel x10, x12, x10, ne - csel x11, x13, x11, ne - - stp x0, x1, [acc] - stp x2, x3, [acc+16] - stp x4, x5, [acc+32] - stp x6, x7, [acc+48] - stp x8, x9, [acc+64] - stp x10, x11, [acc+80] - -// Loop while blocksize * i <= 256 - - add i, i, #1 - mul x0, blocksize, i - cmp x0, #257 - bcc Lp256_scalarmulbase_alt_loop - -// That's the end of the main loop, and we just need to translate -// back from the Jacobian representation to affine. First of all, -// let z2 = 1/z^2 and z3 = 1/z^3, both without Montgomery form - - add x0, z2 - add x1, acc+64 - CFI_BL(Lp256_scalarmulbase_alt_local_montsqr_p256) - - add x0, z3 - add x1, acc+64 - add x2, z2 - CFI_BL(Lp256_scalarmulbase_alt_local_montmul_p256) - - add x0, z2 - add x1, z3 - CFI_BL(Lp256_scalarmulbase_alt_local_demont_p256) - - add x0, z3 - add x1, z2 - CFI_BL(Lp256_scalarmulbase_alt_local_inv_p256) - - add x0, z2 - add x1, acc+64 - add x2, z3 - CFI_BL(Lp256_scalarmulbase_alt_local_montmul_p256) - -// Convert back from Jacobian (X,Y,Z) |-> (X/Z^2, Y/Z^3) - - mov x0, res - add x1, acc - add x2, z2 - CFI_BL(Lp256_scalarmulbase_alt_local_montmul_p256) - - add x0, res, #32 - add x1, acc+32 - add x2, z3 - CFI_BL(Lp256_scalarmulbase_alt_local_montmul_p256) - -// Restore stack and registers and return - - CFI_INC_SP(NSPACE) - CFI_POP2(x25,x30) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_scalarmulbase_alt) - -// Local copies of subroutines, complete clones at the moment - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_alt_local_demont_p256) - -Lp256_scalarmulbase_alt_local_demont_p256: - CFI_START - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - lsl x7, x2, #32 - subs x8, x2, x7 - lsr x6, x2, #32 - sbc x2, x2, x6 - adds x3, x3, x7 - adcs x4, x4, x6 - adcs x5, x5, x8 - adc x2, x2, xzr - lsl x7, x3, #32 - subs x8, x3, x7 - lsr x6, x3, #32 - sbc x3, x3, x6 - adds x4, x4, x7 - adcs x5, x5, x6 - adcs x2, x2, x8 - adc x3, x3, xzr - lsl x7, x4, #32 - subs x8, x4, x7 - lsr x6, x4, #32 - sbc x4, x4, x6 - adds x5, x5, x7 - adcs x2, x2, x6 - adcs x3, x3, x8 - adc x4, x4, xzr - lsl x7, x5, #32 - subs x8, x5, x7 - lsr x6, x5, #32 - sbc x5, x5, x6 - adds x2, x2, x7 - adcs x3, x3, x6 - adcs x4, x4, x8 - adc x5, x5, xzr - stp x2, x3, [x0] - stp x4, x5, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_alt_local_demont_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_alt_local_inv_p256) - -Lp256_scalarmulbase_alt_local_inv_p256: - CFI_START - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_DEC_SP(160) - mov x20, x0 - mov x10, #0xffffffffffffffff - mov x11, #0xffffffff - mov x13, #0xffffffff00000001 - stp x10, x11, [sp] - stp xzr, x13, [sp, #16] - str xzr, [sp, #32] - ldp x2, x3, [x1] - subs x10, x2, x10 - sbcs x11, x3, x11 - ldp x4, x5, [x1, #16] - sbcs x12, x4, xzr - sbcs x13, x5, x13 - csel x2, x2, x10, cc - csel x3, x3, x11, cc - csel x4, x4, x12, cc - csel x5, x5, x13, cc - stp x2, x3, [sp, #48] - stp x4, x5, [sp, #64] - str xzr, [sp, #80] - stp xzr, xzr, [sp, #96] - stp xzr, xzr, [sp, #112] - mov x10, #0x4000000000000 - stp x10, xzr, [sp, #128] - stp xzr, xzr, [sp, #144] - mov x21, #0xa - mov x22, #0x1 - b Lp256_scalarmulbase_alt_inv_midloop -Lp256_scalarmulbase_alt_inv_loop: - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - and x0, x12, x16 - and x1, x13, x17 - add x19, x0, x1 - ldr x7, [sp] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #48] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x7, [sp, #8] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #56] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [sp] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [sp, #48] - ldr x7, [sp, #16] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #64] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [sp, #8] - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [sp, #56] - ldr x7, [sp, #24] - eor x1, x7, x14 - ldr x23, [sp, #32] - eor x3, x23, x14 - and x3, x3, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #72] - eor x1, x8, x15 - ldr x24, [sp, #80] - eor x0, x24, x15 - and x0, x0, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [sp, #16] - extr x5, x3, x5, #59 - str x5, [sp, #24] - asr x3, x3, #59 - str x3, [sp, #32] - eor x1, x7, x16 - eor x5, x23, x16 - and x5, x5, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - eor x0, x24, x17 - and x0, x0, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - extr x4, x2, x4, #59 - str x4, [sp, #64] - extr x2, x5, x2, #59 - str x2, [sp, #72] - asr x5, x5, #59 - str x5, [sp, #80] - ldr x7, [sp, #96] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #128] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #96] - adc x2, x2, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x5, x19, x0 - adc x3, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x5, x5, x0 - str x5, [sp, #128] - adc x3, x3, x1 - ldr x7, [sp, #104] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #136] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #104] - adc x6, x6, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x3, x3, x0 - str x3, [sp, #136] - adc x4, x4, x1 - ldr x7, [sp, #112] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #144] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #112] - adc x5, x5, x1 - eor x1, x7, x16 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, x17 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x4, x4, x0 - str x4, [sp, #144] - adc x2, x2, x1 - ldr x7, [sp, #120] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #152] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - ldp x0, x1, [sp, #96] - ldr x6, [sp, #112] - mov x14, #0xe000000000000000 - adds x0, x0, x14 - sbcs x1, x1, xzr - mov x11, #0x1fffffff - adcs x6, x6, x11 - mov x10, #0x2000000000000000 - adcs x5, x5, x10 - mov x14, #0x1fffffffe0000000 - adc x3, x3, x14 - lsl x11, x0, #32 - subs x14, x0, x11 - lsr x10, x0, #32 - sbc x0, x0, x10 - adds x1, x1, x11 - adcs x6, x6, x10 - adcs x5, x5, x14 - adcs x3, x3, x0 - mov x14, #0xffffffffffffffff - mov x11, #0xffffffff - mov x10, #0xffffffff00000001 - csel x14, x14, xzr, cs - csel x11, x11, xzr, cs - csel x10, x10, xzr, cs - subs x1, x1, x14 - sbcs x6, x6, x11 - sbcs x5, x5, xzr - sbc x3, x3, x10 - stp x1, x6, [sp, #96] - stp x5, x3, [sp, #112] - eor x1, x7, x16 - and x5, x16, x12 - neg x5, x5 - mul x0, x1, x12 - umulh x1, x1, x12 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, x17 - and x0, x17, x13 - sub x5, x5, x0 - mul x0, x1, x13 - umulh x1, x1, x13 - adds x2, x2, x0 - adc x5, x5, x1 - ldp x0, x1, [sp, #128] - ldr x3, [sp, #144] - mov x14, #0xe000000000000000 - adds x0, x0, x14 - sbcs x1, x1, xzr - mov x11, #0x1fffffff - adcs x3, x3, x11 - mov x10, #0x2000000000000000 - adcs x2, x2, x10 - mov x14, #0x1fffffffe0000000 - adc x5, x5, x14 - lsl x11, x0, #32 - subs x14, x0, x11 - lsr x10, x0, #32 - sbc x0, x0, x10 - adds x1, x1, x11 - adcs x3, x3, x10 - adcs x2, x2, x14 - adcs x5, x5, x0 - mov x14, #0xffffffffffffffff - mov x11, #0xffffffff - mov x10, #0xffffffff00000001 - csel x14, x14, xzr, cs - csel x11, x11, xzr, cs - csel x10, x10, xzr, cs - subs x1, x1, x14 - sbcs x3, x3, x11 - sbcs x2, x2, xzr - sbc x5, x5, x10 - stp x1, x3, [sp, #128] - stp x2, x5, [sp, #144] -Lp256_scalarmulbase_alt_inv_midloop: - mov x1, x22 - ldr x2, [sp] - ldr x3, [sp, #48] - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x8, x4, #0x100, lsl #12 - sbfx x8, x8, #21, #21 - mov x11, #0x100000 - add x11, x11, x11, lsl #21 - add x9, x4, x11 - asr x9, x9, #42 - add x10, x5, #0x100, lsl #12 - sbfx x10, x10, #21, #21 - add x11, x5, x11 - asr x11, x11, #42 - mul x6, x8, x2 - mul x7, x9, x3 - mul x2, x10, x2 - mul x3, x11, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #21, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #42 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #21, #21 - add x15, x5, x15 - asr x15, x15, #42 - mul x6, x12, x2 - mul x7, x13, x3 - mul x2, x14, x2 - mul x3, x15, x3 - add x4, x6, x7 - add x5, x2, x3 - asr x2, x4, #20 - asr x3, x5, #20 - and x4, x2, #0xfffff - orr x4, x4, #0xfffffe0000000000 - and x5, x3, #0xfffff - orr x5, x5, #0xc000000000000000 - tst x5, #0x1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - mul x2, x12, x8 - mul x3, x12, x9 - mul x6, x14, x8 - mul x7, x14, x9 - madd x8, x13, x10, x2 - madd x9, x13, x11, x3 - madd x16, x15, x10, x6 - madd x17, x15, x11, x7 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - tst x5, #0x2 - asr x5, x5, #1 - csel x6, x4, xzr, ne - ccmp x1, xzr, #0x8, ne - cneg x1, x1, ge - cneg x6, x6, ge - csel x4, x5, x4, ge - add x5, x5, x6 - add x1, x1, #0x2 - asr x5, x5, #1 - add x12, x4, #0x100, lsl #12 - sbfx x12, x12, #22, #21 - mov x15, #0x100000 - add x15, x15, x15, lsl #21 - add x13, x4, x15 - asr x13, x13, #43 - add x14, x5, #0x100, lsl #12 - sbfx x14, x14, #22, #21 - add x15, x5, x15 - asr x15, x15, #43 - mneg x2, x12, x8 - mneg x3, x12, x9 - mneg x4, x14, x8 - mneg x5, x14, x9 - msub x10, x13, x16, x2 - msub x11, x13, x17, x3 - msub x12, x15, x16, x4 - msub x13, x15, x17, x5 - mov x22, x1 - subs x21, x21, #0x1 - bne Lp256_scalarmulbase_alt_inv_loop - ldr x0, [sp] - ldr x1, [sp, #48] - mul x0, x0, x10 - madd x1, x1, x11, x0 - asr x0, x1, #63 - cmp x10, xzr - csetm x14, mi - cneg x10, x10, mi - eor x14, x14, x0 - cmp x11, xzr - csetm x15, mi - cneg x11, x11, mi - eor x15, x15, x0 - cmp x12, xzr - csetm x16, mi - cneg x12, x12, mi - eor x16, x16, x0 - cmp x13, xzr - csetm x17, mi - cneg x13, x13, mi - eor x17, x17, x0 - and x0, x10, x14 - and x1, x11, x15 - add x9, x0, x1 - ldr x7, [sp, #96] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x4, x9, x0 - adc x2, xzr, x1 - ldr x8, [sp, #128] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x4, x4, x0 - str x4, [sp, #96] - adc x2, x2, x1 - ldr x7, [sp, #104] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [sp, #136] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x2, x2, x0 - str x2, [sp, #104] - adc x6, x6, x1 - ldr x7, [sp, #112] - eor x1, x7, x14 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [sp, #144] - eor x1, x8, x15 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x6, x6, x0 - str x6, [sp, #112] - adc x5, x5, x1 - ldr x7, [sp, #120] - eor x1, x7, x14 - and x3, x14, x10 - neg x3, x3 - mul x0, x1, x10 - umulh x1, x1, x10 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [sp, #152] - eor x1, x8, x15 - and x0, x15, x11 - sub x3, x3, x0 - mul x0, x1, x11 - umulh x1, x1, x11 - adds x5, x5, x0 - adc x3, x3, x1 - ldp x0, x1, [sp, #96] - ldr x2, [sp, #112] - mov x14, #0xe000000000000000 - adds x0, x0, x14 - sbcs x1, x1, xzr - mov x11, #0x1fffffff - adcs x2, x2, x11 - mov x10, #0x2000000000000000 - adcs x5, x5, x10 - mov x14, #0x1fffffffe0000000 - adc x3, x3, x14 - lsl x11, x0, #32 - subs x14, x0, x11 - lsr x10, x0, #32 - sbc x0, x0, x10 - adds x1, x1, x11 - adcs x2, x2, x10 - adcs x5, x5, x14 - adcs x3, x3, x0 - mov x14, #0xffffffffffffffff - mov x11, #0xffffffff - mov x10, #0xffffffff00000001 - csel x14, x14, xzr, cs - csel x11, x11, xzr, cs - csel x10, x10, xzr, cs - subs x1, x1, x14 - sbcs x2, x2, x11 - sbcs x5, x5, xzr - sbc x3, x3, x10 - mov x10, #0xffffffffffffffff - subs x10, x1, x10 - mov x11, #0xffffffff - sbcs x11, x2, x11 - mov x13, #0xffffffff00000001 - sbcs x12, x5, xzr - sbcs x13, x3, x13 - csel x10, x1, x10, cc - csel x11, x2, x11, cc - csel x12, x5, x12, cc - csel x13, x3, x13, cc - stp x10, x11, [x20] - stp x12, x13, [x20, #16] - CFI_INC_SP(160) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_alt_local_inv_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_alt_local_montmul_p256) - -Lp256_scalarmulbase_alt_local_montmul_p256: - CFI_START - ldp x3, x4, [x1] - ldp x7, x8, [x2] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x2, #16] - mul x11, x3, x9 - umulh x15, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x16, x3, x10 - adcs x15, x15, x11 - adc x16, x16, xzr - ldp x5, x6, [x1, #16] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x15, x15, x11 - mul x11, x4, x10 - adcs x16, x16, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x15, x15, x11 - umulh x11, x4, x9 - adcs x16, x16, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x15, x15, x11 - mul x11, x5, x9 - adcs x16, x16, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x15, x15, x11 - umulh x11, x5, x8 - adcs x16, x16, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x15, x15, x11 - mul x11, x6, x8 - adcs x16, x16, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x15, x15, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x16, x16, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x15, x15, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x15, x15, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x15, lsl #32 - lsr x11, x15, #32 - adcs x13, x13, x11 - mul x11, x15, x10 - umulh x15, x15, x10 - adcs x14, x14, x11 - adc x15, x15, xzr - adds x12, x12, x16 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x15, x15, x5 - cset x8, cs - mov x11, #0xffffffff - adds x16, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x15, x10 - sbcs xzr, x8, xzr - csel x12, x12, x16, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x15, x15, x5, cc - stp x12, x13, [x0] - stp x14, x15, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_alt_local_montmul_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_alt_local_montsqr_p256) - -Lp256_scalarmulbase_alt_local_montsqr_p256: - CFI_START - ldp x2, x3, [x1] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [x1, #16] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - mov x5, #0xffffffff00000001 - adds x9, x9, x8, lsl #32 - lsr x2, x8, #32 - adcs x10, x10, x2 - mul x2, x8, x5 - umulh x8, x8, x5 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x2, x9, #32 - adcs x11, x11, x2 - mul x2, x9, x5 - umulh x9, x9, x5 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x2, x10, #32 - adcs x8, x8, x2 - mul x2, x10, x5 - umulh x10, x10, x5 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x2, x11, #32 - adcs x9, x9, x2 - mul x2, x11, x5 - umulh x11, x11, x5 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, cs - mov x3, #0xffffffff - adds x12, x8, #0x1 - sbcs x13, x9, x3 - sbcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, cc - csel x9, x9, x13, cc - csel x10, x10, x14, cc - csel x11, x11, x7, cc - stp x8, x9, [x0] - stp x10, x11, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_alt_local_montsqr_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_alt_local_p256_montjmixadd) - -Lp256_scalarmulbase_alt_local_p256_montjmixadd: - CFI_START - CFI_DEC_SP(192) - mov x15, x0 - mov x16, x1 - mov x17, x2 - ldp x2, x3, [x16, #64] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [x16, #80] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mov x3, #0xffffffff00000001 - mul x2, x8, x3 - umulh x8, x8, x3 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mov x3, #0xffffffff00000001 - mul x2, x9, x3 - umulh x9, x9, x3 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mov x3, #0xffffffff00000001 - mul x2, x10, x3 - umulh x10, x10, x3 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mov x3, #0xffffffff00000001 - mul x2, x11, x3 - umulh x11, x11, x3 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - mov x2, #0xffffffffffffffff - csel x2, xzr, x2, cc - mov x3, #0xffffffff - csel x3, xzr, x3, cc - mov x5, #0xffffffff00000001 - csel x5, xzr, x5, cc - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, xzr - sbc x11, x11, x5 - stp x8, x9, [sp] - stp x10, x11, [sp, #16] - ldp x3, x4, [x16, #64] - ldp x7, x8, [x17, #32] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x17, #48] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [x16, #80] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #32] - stp x14, x0, [sp, #48] - ldp x3, x4, [sp] - ldp x7, x8, [x17] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x17, #16] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #16] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #64] - stp x14, x0, [sp, #80] - ldp x3, x4, [sp] - ldp x7, x8, [sp, #32] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #48] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #16] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #32] - stp x14, x0, [sp, #48] - ldp x5, x6, [sp, #64] - ldp x4, x3, [x16] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [x16, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #160] - stp x7, x8, [sp, #176] - ldp x5, x6, [sp, #32] - ldp x4, x3, [x16, #32] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #48] - ldp x4, x3, [x16, #48] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #32] - stp x7, x8, [sp, #48] - ldp x2, x3, [sp, #160] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #176] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mov x3, #0xffffffff00000001 - mul x2, x8, x3 - umulh x8, x8, x3 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mov x3, #0xffffffff00000001 - mul x2, x9, x3 - umulh x9, x9, x3 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mov x3, #0xffffffff00000001 - mul x2, x10, x3 - umulh x10, x10, x3 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mov x3, #0xffffffff00000001 - mul x2, x11, x3 - umulh x11, x11, x3 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - mov x2, #0xffffffffffffffff - csel x2, xzr, x2, cc - mov x3, #0xffffffff - csel x3, xzr, x3, cc - mov x5, #0xffffffff00000001 - csel x5, xzr, x5, cc - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, xzr - sbc x11, x11, x5 - stp x8, x9, [sp, #96] - stp x10, x11, [sp, #112] - ldp x2, x3, [sp, #32] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #48] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, cs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - adds x9, x9, x8, lsl #32 - lsr x3, x8, #32 - adcs x10, x10, x3 - mov x3, #0xffffffff00000001 - mul x2, x8, x3 - umulh x8, x8, x3 - adcs x11, x11, x2 - adc x8, x8, xzr - adds x10, x10, x9, lsl #32 - lsr x3, x9, #32 - adcs x11, x11, x3 - mov x3, #0xffffffff00000001 - mul x2, x9, x3 - umulh x9, x9, x3 - adcs x8, x8, x2 - adc x9, x9, xzr - adds x11, x11, x10, lsl #32 - lsr x3, x10, #32 - adcs x8, x8, x3 - mov x3, #0xffffffff00000001 - mul x2, x10, x3 - umulh x10, x10, x3 - adcs x9, x9, x2 - adc x10, x10, xzr - adds x8, x8, x11, lsl #32 - lsr x3, x11, #32 - adcs x9, x9, x3 - mov x3, #0xffffffff00000001 - mul x2, x11, x3 - umulh x11, x11, x3 - adcs x10, x10, x2 - adc x11, x11, xzr - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, cs - mov x3, #0xffffffff - mov x5, #0xffffffff00000001 - adds x12, x8, #0x1 - sbcs x13, x9, x3 - sbcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, cc - csel x9, x9, x13, cc - csel x10, x10, x14, cc - csel x11, x11, x7, cc - stp x8, x9, [sp] - stp x10, x11, [sp, #16] - ldp x3, x4, [sp, #96] - ldp x7, x8, [x16] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x16, #16] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #112] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #128] - stp x14, x0, [sp, #144] - ldp x3, x4, [sp, #96] - ldp x7, x8, [sp, #64] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #80] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #112] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #64] - stp x14, x0, [sp, #80] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #16] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #16] - ldp x5, x6, [sp, #64] - ldp x4, x3, [sp, #128] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #80] - ldp x4, x3, [sp, #144] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #96] - stp x7, x8, [sp, #112] - ldp x3, x4, [sp, #160] - ldp x7, x8, [x16, #64] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x16, #80] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #176] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #160] - stp x14, x0, [sp, #176] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #64] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #16] - ldp x4, x3, [sp, #80] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #16] - ldp x5, x6, [sp, #128] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #144] - ldp x4, x3, [sp, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #128] - stp x7, x8, [sp, #144] - ldp x3, x4, [sp, #96] - ldp x7, x8, [x16, #32] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x16, #48] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #112] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #96] - stp x14, x0, [sp, #112] - ldp x3, x4, [sp, #32] - ldp x7, x8, [sp, #128] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #144] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #48] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - mov x10, #0xffffffff00000001 - adds x13, x13, x12, lsl #32 - lsr x11, x12, #32 - adcs x14, x14, x11 - mul x11, x12, x10 - umulh x12, x12, x10 - adcs x0, x0, x11 - adc x12, x12, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - adds x14, x14, x13, lsl #32 - lsr x11, x13, #32 - adcs x0, x0, x11 - mul x11, x13, x10 - umulh x13, x13, x10 - adcs x12, x12, x11 - adc x13, x13, xzr - adds x0, x0, x14, lsl #32 - lsr x11, x14, #32 - adcs x12, x12, x11 - mul x11, x14, x10 - umulh x14, x14, x10 - adcs x13, x13, x11 - adc x14, x14, xzr - adds x12, x12, x0, lsl #32 - lsr x11, x0, #32 - adcs x13, x13, x11 - mul x11, x0, x10 - umulh x0, x0, x10 - adcs x14, x14, x11 - adc x0, x0, xzr - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, cs - mov x11, #0xffffffff - adds x1, x12, #0x1 - sbcs x3, x13, x11 - sbcs x4, x14, xzr - sbcs x5, x0, x10 - sbcs xzr, x8, xzr - csel x12, x12, x1, cc - csel x13, x13, x3, cc - csel x14, x14, x4, cc - csel x0, x0, x5, cc - stp x12, x13, [sp, #128] - stp x14, x0, [sp, #144] - ldp x5, x6, [sp, #128] - ldp x4, x3, [sp, #96] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #144] - ldp x4, x3, [sp, #112] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - mov x4, #0xffffffff - and x4, x4, x3 - adcs x6, x6, x4 - adcs x7, x7, xzr - mov x4, #0xffffffff00000001 - and x4, x4, x3 - adc x8, x8, x4 - stp x5, x6, [sp, #128] - stp x7, x8, [sp, #144] - ldp x0, x1, [x16, #64] - ldp x2, x3, [x16, #80] - orr x4, x0, x1 - orr x5, x2, x3 - orr x4, x4, x5 - cmp x4, xzr - ldp x0, x1, [sp] - ldp x12, x13, [x17] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x2, x3, [sp, #16] - ldp x12, x13, [x17, #16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - ldp x4, x5, [sp, #128] - ldp x12, x13, [x17, #32] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x6, x7, [sp, #144] - ldp x12, x13, [x17, #48] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - ldp x8, x9, [sp, #160] - mov x12, #0x1 - mov x13, #0xffffffff00000000 - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x10, x11, [sp, #176] - mov x12, #0xffffffffffffffff - mov x13, #0xfffffffe - csel x10, x10, x12, ne - csel x11, x11, x13, ne - stp x0, x1, [x15] - stp x2, x3, [x15, #16] - stp x4, x5, [x15, #32] - stp x6, x7, [x15, #48] - stp x8, x9, [x15, #64] - stp x10, x11, [x15, #80] - CFI_INC_SP(192) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_alt_local_p256_montjmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/README.md b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/README.md deleted file mode 100644 index fa63f949fd1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/README.md +++ /dev/null @@ -1,9 +0,0 @@ -This directory contains Arm implementations that are functional but slower -than the implementations with the same file names. The implementations in the -parent directory are mechanically/manually optimized versions of this -directory, meaning that their high-level algorithms are unchanged but the -implementation details are updated. - -These functions will only be compiled when running HOL Light proofs using -`make proofs` because HOL Light proofs use these to keep proofs simple. -The compiled object files will not be included in libs2nbignum. diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/bignum_montmul_p256_base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/bignum_montmul_p256_base.S deleted file mode 100644 index 8644f3e930f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/bignum_montmul_p256_base.S +++ /dev/null @@ -1,275 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_256 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_p256_base -// (uint64_t z[static 4], uint64_t x[static 4], uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_256, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_256 (in particular this is true if we are in -// the "usual" case x < p_256 and y < p_256). -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p256_base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p256_base) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro returning (c,h,l) = 3-word 1s complement (x - y) * (w - z) -// c,h,l,t should all be different -// t,h should not overlap w,z -// --------------------------------------------------------------------------- - -#define muldiffn(c,h,l, t, x,y, w,z) \ - subs t, x, y __LF \ - cneg t, t, cc __LF \ - csetm c, cc __LF \ - subs h, w, z __LF \ - cneg h, h, cc __LF \ - mul l, t, h __LF \ - umulh h, t, h __LF \ - cinv c, c, cc __LF \ - eor l, l, c __LF \ - eor h, h, c - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1] and generating d4 from zero, re-using -// d0 as a temporary internally together with t0, t1 and t2. -// It is fine for d4 to be the same register as d0, and it often is. -// --------------------------------------------------------------------------- - -#define montreds(d4,d3,d2,d1,d0, t2,t1,t0) \ -/* Let w = d0, the original word we use as offset; d0 gets recycled */ \ -/* First let [t2;t1] = 2^32 * w */ \ -/* then let [d0;t0] = (2^64 - 2^32 + 1) * w (overwrite old d0) */ \ - lsl t1, d0, #32 __LF \ - subs t0, d0, t1 __LF \ - lsr t2, d0, #32 __LF \ - sbc d0, d0, t2 __LF \ -/* Hence [d4;..;d1] := [d3;d2;d1;0] + (2^256 - 2^224 + 2^192 + 2^96) * w */ \ - adds d1, d1, t1 __LF \ - adcs d2, d2, t2 __LF \ - adcs d3, d3, t0 __LF \ - adc d4, d0, xzr - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define b0 x7 -#define b1 x8 -#define b2 x9 -#define b3 x10 - -#define s0 x11 -#define s1 x12 -#define s2 x13 -#define s3 x14 -#define t0 x15 -#define t1 x16 -#define t2 x17 -#define t3 x1 -#define s4 x2 - -S2N_BN_SYMBOL(bignum_montmul_p256_base): - -// Load in all words of both inputs - - ldp a0, a1, [x1] - ldp a2, a3, [x1, #16] - ldp b0, b1, [x2] - ldp b2, b3, [x2, #16] - -// Multiply low halves with a 2x2->4 ADK multiplier as L = [s3;s2;s1;s0] - - mul s0, a0, b0 - mul s2, a1, b1 - umulh s1, a0, b0 - adds t1, s0, s2 - umulh s3, a1, b1 - adcs t2, s1, s3 - adcs s3, s3, xzr - adds s1, s1, t1 - adcs s2, s2, t2 - adcs s3, s3, xzr - muldiffn(t3,t2,t1, t0, a0,a1, b1,b0) - adds xzr, t3, #1 - adcs s1, s1, t1 - adcs s2, s2, t2 - adc s3, s3, t3 - -// Perform two "short" Montgomery steps on the low product to -// get a modified low result L' = [s1;s0;s3;s2] -// This shifts it to an offset compatible with middle terms -// Stash the result L' temporarily in the output buffer to avoid -// using additional registers. - - montreds(s0,s3,s2,s1,s0, t1,t2,t3) - montreds(s1,s0,s3,s2,s1, t1,t2,t3) - - stp s2, s3, [x0] - stp s0, s1, [x0, #16] - -// Multiply high halves with a 2x2->4 ADK multiplier as H = [s3;s2;s1;s0] - - mul s0, a2, b2 - mul s2, a3, b3 - umulh s1, a2, b2 - adds t1, s0, s2 - umulh s3, a3, b3 - adcs t2, s1, s3 - adcs s3, s3, xzr - adds s1, s1, t1 - adcs s2, s2, t2 - adcs s3, s3, xzr - muldiffn(t3,t2,t1, t0, a2,a3, b3,b2) - adds xzr, t3, #1 - adcs s1, s1, t1 - adcs s2, s2, t2 - adc s3, s3, t3 - -// Compute sign-magnitude a2,[a1,a0] = x_hi - x_lo - - subs a0, a2, a0 - sbcs a1, a3, a1 - sbc a2, xzr, xzr - adds xzr, a2, #1 - eor a0, a0, a2 - adcs a0, a0, xzr - eor a1, a1, a2 - adcs a1, a1, xzr - -// Compute sign-magnitude b2,[b1,b0] = y_lo - y_hi - - subs b0, b0, b2 - sbcs b1, b1, b3 - sbc b2, xzr, xzr - adds xzr, b2, #1 - eor b0, b0, b2 - adcs b0, b0, xzr - eor b1, b1, b2 - adcs b1, b1, xzr - -// Save the correct sign for the sub-product in b3 - - eor b3, a2, b2 - -// Add the high H to the modified low term L' as H + L' = [s4;b2;a2;t3;t0] - - ldp t0, t3, [x0] - adds t0, s0, t0 - adcs t3, s1, t3 - ldp a2, b2, [x0, #16] - adcs a2, s2, a2 - adcs b2, s3, b2 - adc s4, xzr, xzr - -// Multiply with yet a third 2x2->4 ADK multiplier for complex mid-term M - - mul s0, a0, b0 - mul s2, a1, b1 - umulh s1, a0, b0 - adds t1, s0, s2 - umulh s3, a1, b1 - adcs t2, s1, s3 - adcs s3, s3, xzr - adds s1, s1, t1 - adcs s2, s2, t2 - adcs s3, s3, xzr - muldiffn(a1,t2,t1, a0, a0,a1, b1,b0) - adds xzr, a1, #1 - adcs s1, s1, t1 - adcs s2, s2, t2 - adc s3, s3, a1 - -// Set up a sign-modified version of the mid-product in a long accumulator -// as [b3;a1;a0;s3;s2;s1;s0], adding in the H + L' term once with -// zero offset as this signed value is created - - adds xzr, b3, #1 - eor s0, s0, b3 - adcs s0, s0, t0 - eor s1, s1, b3 - adcs s1, s1, t3 - eor s2, s2, b3 - adcs s2, s2, a2 - eor s3, s3, b3 - adcs s3, s3, b2 - adcs a0, s4, b3 - adcs a1, b3, xzr - adc b3, b3, xzr - -// Add in the stashed H + L' term an offset of 2 words as well - - adds s2, s2, t0 - adcs s3, s3, t3 - adcs a0, a0, a2 - adcs a1, a1, b2 - adc b3, b3, s4 - -// Do two more Montgomery steps on the composed term -// Net pre-reduct is in [b3;a1;a0;s3;s2] - - montreds(s0,s3,s2,s1,s0, t1,t2,t3) - montreds(s1,s0,s3,s2,s1, t1,t2,t3) - - adds a0, a0, s0 - adcs a1, a1, s1 - adc b3, b3, xzr - -// Because of the way we added L' in two places, we can overspill by -// more than usual in Montgomery, with the result being only known to -// be < 3 * p_256, not the usual < 2 * p_256. So now we do a more -// elaborate final correction in the style of bignum_cmul_p256, though -// we can use much simpler quotient estimation logic (q = h + 1) and -// slightly more direct accumulation of p_256 * q. - -#define d0 s2 -#define d1 s3 -#define d2 a0 -#define d3 a1 -#define h b3 - -#define q s4 -#define c b0 - - add q, h, #1 - lsl t1, q, #32 - - adds d3, d3, t1 - adc h, h, xzr - sub t0, xzr, q - sub t1, t1, #1 - subs d0, d0, t0 - sbcs d1, d1, t1 - sbcs d2, d2, xzr - sbcs d3, d3, q - sbcs c, h, q - adds d0, d0, c - mov h, #0x00000000ffffffff - and h, h, c - adcs d1, d1, h - adcs d2, d2, xzr - mov h, #0xffffffff00000001 - and h, h, c - adc d3, d3, h - -// Finally store the result - - stp d0, d1, [x0] - stp d2, d3, [x0, #16] - - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/bignum_montsqr_p256_base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/bignum_montsqr_p256_base.S deleted file mode 100644 index 12f2ca405c4..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/bignum_montsqr_p256_base.S +++ /dev/null @@ -1,266 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_p256_base -// (uint64_t z[static 4], uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_256, assuming x^2 <= 2^256 * p_256, which is -// guaranteed in particular if x < p_256 initially (the "intended" case). -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p256_base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p256_base) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro returning (c,h,l) = 3-word 1s complement (x - y) * (w - z) -// c,h,l,t should all be different -// t,h should not overlap w,z -// --------------------------------------------------------------------------- - -#define muldiffn(c,h,l, t, x,y, w,z) \ - subs t, x, y __LF \ - cneg t, t, cc __LF \ - csetm c, cc __LF \ - subs h, w, z __LF \ - cneg h, h, cc __LF \ - mul l, t, h __LF \ - umulh h, t, h __LF \ - cinv c, c, cc __LF \ - eor l, l, c __LF \ - eor h, h, c - -// --------------------------------------------------------------------------- -// Core one-step "end" Montgomery reduction macro. Takes input in -// [d5;d4;d3;d2;d1;d0] and returns result in [d5;d4;d3;d2;d1], adding to -// the existing [d4;d3;d2;d1], re-using d0 as a temporary internally as well -// as t1, t2, t3, and initializing d5 from zero (hence "end"). -// --------------------------------------------------------------------------- - -#define montrede(d5, d4,d3,d2,d1,d0, t2,t1,t0) \ -/* Let w = d0, the original word we use as offset; d0 gets recycled */ \ -/* First let [t2;t1] = 2^32 * w */ \ -/* then let [d0;t0] = (2^64 - 2^32 + 1) * w (overwrite old d0) */ \ - lsl t1, d0, #32 __LF \ - subs t0, d0, t1 __LF \ - lsr t2, d0, #32 __LF \ - sbc d0, d0, t2 __LF \ -/* Hence basic [d4;d3;d2;d1] += (2^256 - 2^224 + 2^192 + 2^96) * w */ \ - adds d1, d1, t1 __LF \ - adcs d2, d2, t2 __LF \ - adcs d3, d3, t0 __LF \ - adcs d4, d4, d0 __LF \ - adc d5, xzr, xzr - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1] and generating d4 from zero, re-using -// d0 as a temporary internally together with t0, t1 and t2. -// It is fine for d4 to be the same register as d0, and it often is. -// --------------------------------------------------------------------------- - -#define montreds(d4,d3,d2,d1,d0, t2,t1,t0) \ -/* Let w = d0, the original word we use as offset; d0 gets recycled */ \ -/* First let [t2;t1] = 2^32 * w */ \ -/* then let [d0;t0] = (2^64 - 2^32 + 1) * w (overwrite old d0) */ \ - lsl t1, d0, #32 __LF \ - subs t0, d0, t1 __LF \ - lsr t2, d0, #32 __LF \ - sbc d0, d0, t2 __LF \ -/* Hence [d4;..;d1] := [d3;d2;d1;0] + (2^256 - 2^224 + 2^192 + 2^96) * w */ \ - adds d1, d1, t1 __LF \ - adcs d2, d2, t2 __LF \ - adcs d3, d3, t0 __LF \ - adc d4, d0, xzr - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 - -#define c0 x6 -#define c1 x7 -#define c2 x8 -#define c3 x9 -#define c4 x10 -#define d1 x11 -#define d2 x12 -#define d3 x13 -#define d4 x14 - -#define s0 x15 -#define s1 x16 -#define s2 x17 -#define s3 x1 - -#define a0short w2 -#define a1short w3 -#define d1short w11 - -S2N_BN_SYMBOL(bignum_montsqr_p256_base): - -// Load in all words of the input - - ldp a0, a1, [x1] - ldp a2, a3, [x1, #16] - -// Square the low half, getting a result in [s3;s2;s1;s0] -// This uses 32x32->64 multiplications to reduce the number of UMULHs - - umull s0, a0short, a0short - lsr d1, a0, #32 - umull s1, d1short, d1short - umull d1, a0short, d1short - adds s0, s0, d1, lsl #33 - lsr d1, d1, #31 - adc s1, s1, d1 - umull s2, a1short, a1short - lsr d1, a1, #32 - umull s3, d1short, d1short - umull d1, a1short, d1short - mul d2, a0, a1 - umulh d3, a0, a1 - adds s2, s2, d1, lsl #33 - lsr d1, d1, #31 - adc s3, s3, d1 - adds d2, d2, d2 - adcs d3, d3, d3 - adc s3, s3, xzr - adds s1, s1, d2 - adcs s2, s2, d3 - adc s3, s3, xzr - -// Perform two "short" Montgomery steps on the low square -// This shifts it to an offset compatible with middle product - - montreds(s0,s3,s2,s1,s0, d1,d2,d3) - - montreds(s1,s0,s3,s2,s1, d1,d2,d3) - -// Compute cross-product with ADK 2x2->4 multiplier as [c3;c2;c1;c0] - - mul c0, a0, a2 - mul d4, a1, a3 - umulh c2, a0, a2 - muldiffn(d3,d2,d1, c4, a0,a1, a3,a2) - - adds c1, c0, c2 - adc c2, c2, xzr - - umulh c3, a1, a3 - - adds c1, c1, d4 - adcs c2, c2, c3 - adc c3, c3, xzr - adds c2, c2, d4 - adc c3, c3, xzr - - adds xzr, d3, #1 - adcs c1, c1, d1 - adcs c2, c2, d2 - adc c3, c3, d3 - -// Double it and add the Montgomerified low square - - adds c0, c0, c0 - adcs c1, c1, c1 - adcs c2, c2, c2 - adcs c3, c3, c3 - adc c4, xzr, xzr - - adds c0, c0, s2 - adcs c1, c1, s3 - adcs c2, c2, s0 - adcs c3, c3, s1 - adc c4, c4, xzr - -// Montgomery-reduce the combined low and middle term another twice - - montrede(c0,c4,c3,c2,c1,c0, d1,d2,d3) - - montrede(c1,c0,c4,c3,c2,c1, d1,d2,d3) - -// Our sum so far is in [c1,c0,c4,c3,c2]; choose more intuitive names - -#define r0 x8 -#define r1 x9 -#define r2 x10 -#define r3 x6 -#define c x7 - -// So we can have these as temps - -#define t1 x11 -#define t2 x12 -#define t3 x13 - -// Add in the pure squares 22 + 33 - - mul t1, a2, a2 - adds r0, r0, t1 - mul t2, a3, a3 - umulh t1, a2, a2 - adcs r1, r1, t1 - adcs r2, r2, t2 - umulh t2, a3, a3 - adcs r3, r3, t2 - adc c, c, xzr - -// Construct the 23 term, double and add it in - - mul t1, a2, a3 - umulh t2, a2, a3 - adds t1, t1, t1 - adcs t2, t2, t2 - adc t3, xzr, xzr - - adds r1, r1, t1 - adcs r2, r2, t2 - adcs r3, r3, t3 - adcs c, c, xzr - -// We know, writing B = 2^{4*64} that the full implicit result is -// B^2 c <= z + (B - 1) * p < B * p + (B - 1) * p < 2 * B * p, -// so the top half is certainly < 2 * p. If c = 1 already, we know -// subtracting p will give the reduced modulus. But now we do a -// subtraction-comparison to catch cases where the residue is >= p. -// The constants are such that [t3;0;t1;-1] = p_256. - -#define t0 x5 - -// Set CF (because of inversion) iff (0,p_256) <= (c,r3,r2,r1,r0) - - mov t1, #0x00000000ffffffff - subs t0, r0, #-1 - sbcs t1, r1, t1 - mov t3, #0xffffffff00000001 - sbcs t2, r2, xzr - sbcs t3, r3, t3 - sbcs xzr, c, xzr - -// Select final output accordingly - - csel r0, t0, r0, cs - csel r1, t1, r1, cs - csel r2, t2, r2, cs - csel r3, t3, r3, cs - -// Store things back in place - - stp r0, r1, [x0] - stp r2, r3, [x0, #16] - - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/p256_montjadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/p256_montjadd.S deleted file mode 100644 index 4365e855609..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/p256_montjadd.S +++ /dev/null @@ -1,612 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjadd -// (uint64_t p3[static 12],uint64_t p1[static 12],uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjadd) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x21 -#define input_x x22 -#define input_y x23 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE -#define z_2 input_y, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z1sq sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define x1a sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define z2sq sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define y1a sp, #(NUMSIZE*6) - -#define NSPACE (NUMSIZE*7) - - -#define montmul_p256(P0,P1,P2) \ - add x0, P0;\ - add x1, P1;\ - add x2, P2;\ - bl .montmul_p256 - -#define montsqr_p256(P0,P1) \ - add x0, P0;\ - add x1, P1;\ - bl .montsqr_p256 - -#define sub_p256(P0,P1,P2) \ - add x0, P0;\ - add x1, P1;\ - add x2, P2;\ - bl .sub_p256 - - -// Corresponds exactly to bignum_montmul_p256 - -.montmul_p256: - ldr q20, [x2] - ldp x7, x17, [x1] - ldr q0, [x1] - ldp x6, x10, [x2] - ldp x11, x15, [x1, #16] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [x2, #16] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [x1, #16] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x2, #16] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x9, x3, x13 - adcs x3, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x12, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x15, x15, xzr - rev64 v24.4s, v20.4s - stp x12, x15, [x0, #16] - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - stp x9, x3, [x0] - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - ldp x15, x8, [x0] - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - ldp x9, x13, [x0, #16] - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x15 - adcs x15, x16, x8 - eor x5, x17, x4 - adcs x9, x1, x9 - eor x1, x10, x5 - adcs x16, x2, x13 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [x0] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [x0, #16] - ret - -// Corresponds exactly to bignum_montsqr_p256 - -.montsqr_p256: - ldr q19, [x1] - ldp x9, x13, [x1] - ldr q23, [x1, #16] - ldr q0, [x1] - ldp x1, x10, [x1, #16] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x16, x3, x16, cs - csel x14, x8, x14, cs - csel x12, x11, x12, cs - csel x2, x5, x2, cs - stp x14, x12, [x0, #16] - stp x16, x2, [x0] - ret - -// Corresponds exactly to bignum_sub_p256 - -.sub_p256: - ldp x5, x6, [x1] - ldp x4, x3, [x2] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [x1, #16] - ldp x4, x3, [x2, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [x0] - stp x7, x8, [x0, #16] - ret - - -S2N_BN_SYMBOL(p256_montjadd): - -// Save regs and make room on stack for temporary variables - - stp x19, x20, [sp, #-16]! - stp x21, x22, [sp, #-16]! - stp x23, x30, [sp, #-16]! - sub sp, sp, NSPACE - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations -// 12 * multiply + 4 * square + 7 * subtract - - montsqr_p256(z1sq,z_1) - montsqr_p256(z2sq,z_2) - - montmul_p256(y1a,z_2,y_1) - montmul_p256(y2a,z_1,y_2) - - montmul_p256(x2a,z1sq,x_2) - montmul_p256(x1a,z2sq,x_1) - montmul_p256(y2a,z1sq,y2a) - montmul_p256(y1a,z2sq,y1a) - - sub_p256(xd,x2a,x1a) - sub_p256(yd,y2a,y1a) - - montsqr_p256(zz,xd) - montsqr_p256(ww,yd) - - montmul_p256(zzx1,zz,x1a) - montmul_p256(zzx2,zz,x2a) - - sub_p256(resx,ww,zzx1) - sub_p256(t1,zzx2,zzx1) - - montmul_p256(xd,xd,z_1) - - sub_p256(resx,resx,zzx2) - - sub_p256(t2,zzx1,resx) - - montmul_p256(t1,t1,y1a) - montmul_p256(resz,xd,z_2) - montmul_p256(t2,yd,t2) - - sub_p256(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "HI" <=> CF /\ ~ZF <=> P1 = 0 /\ ~(P2 = 0) -// and "LO" <=> ~CF <=> ~(P1 = 0) /\ P2 = 0 - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - - orr x12, x0, x1 - orr x13, x2, x3 - orr x12, x12, x13 - cmp x12, xzr - cset x12, ne - - ldp x4, x5, [z_2] - ldp x6, x7, [z_2+16] - - orr x13, x4, x5 - orr x14, x6, x7 - orr x13, x13, x14 - cmp x13, xzr - cset x13, ne - - cmp x13, x12 - -// Multiplex the outputs accordingly, re-using the z's in registers - - ldp x8, x9, [resz] - csel x8, x0, x8, lo - csel x9, x1, x9, lo - csel x8, x4, x8, hi - csel x9, x5, x9, hi - ldp x10, x11, [resz+16] - csel x10, x2, x10, lo - csel x11, x3, x11, lo - csel x10, x6, x10, hi - csel x11, x7, x11, hi - - ldp x12, x13, [x_1] - ldp x0, x1, [resx] - csel x0, x12, x0, lo - csel x1, x13, x1, lo - ldp x12, x13, [x_2] - csel x0, x12, x0, hi - csel x1, x13, x1, hi - - ldp x12, x13, [x_1+16] - ldp x2, x3, [resx+16] - csel x2, x12, x2, lo - csel x3, x13, x3, lo - ldp x12, x13, [x_2+16] - csel x2, x12, x2, hi - csel x3, x13, x3, hi - - ldp x12, x13, [y_1] - ldp x4, x5, [resy] - csel x4, x12, x4, lo - csel x5, x13, x5, lo - ldp x12, x13, [y_2] - csel x4, x12, x4, hi - csel x5, x13, x5, hi - - ldp x12, x13, [y_1+16] - ldp x6, x7, [resy+16] - csel x6, x12, x6, lo - csel x7, x13, x7, lo - ldp x12, x13, [y_2+16] - csel x6, x12, x6, hi - csel x7, x13, x7, hi - -// Finally store back the multiplexed values - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [y_3] - stp x6, x7, [y_3+16] - stp x8, x9, [z_3] - stp x10, x11, [z_3+16] - -// Restore registers and return - - add sp, sp, NSPACE - ldp x23, x30, [sp], 16 - ldp x21, x22, [sp], 16 - ldp x19, x20, [sp], 16 - ret - - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/p256_montjdouble.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/p256_montjdouble.S deleted file mode 100644 index ff9641c5720..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p256/unopt/p256_montjdouble.S +++ /dev/null @@ -1,748 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjdouble -// (uint64_t p3[static 12],uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjdouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjdouble) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x19 -#define input_x x20 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z2 sp, #(NUMSIZE*0) -#define y4 sp, #(NUMSIZE*0) - -#define y2 sp, #(NUMSIZE*1) - -#define t1 sp, #(NUMSIZE*2) - -#define t2 sp, #(NUMSIZE*3) -#define x2p sp, #(NUMSIZE*3) -#define dx2 sp, #(NUMSIZE*3) - -#define xy2 sp, #(NUMSIZE*4) - -#define x4p sp, #(NUMSIZE*5) -#define d_ sp, #(NUMSIZE*5) - -#define NSPACE #(NUMSIZE*6) - -// Corresponds exactly to bignum_montmul_p256 - -.montmul_p256: - ldr q20, [x2] - ldp x7, x17, [x1] - ldr q0, [x1] - ldp x6, x10, [x2] - ldp x11, x15, [x1, #16] - rev64 v16.4s, v20.4s - subs x4, x7, x17 - csetm x3, cc - cneg x13, x4, cc - mul v16.4s, v16.4s, v0.4s - umulh x12, x17, x10 - uzp1 v28.4s, v20.4s, v0.4s - subs x14, x11, x7 - ldr q20, [x2, #16] - sbcs x5, x15, x17 - ngc x17, xzr - subs x8, x11, x15 - uaddlp v27.2d, v16.4s - umulh x4, x7, x6 - uzp1 v21.4s, v0.4s, v0.4s - cneg x11, x8, cc - shl v17.2d, v27.2d, #32 - csetm x15, cc - subs x9, x10, x6 - eor x7, x14, x17 - umlal v17.2d, v21.2s, v28.2s - cneg x8, x9, cc - cinv x9, x3, cc - cmn x17, #0x1 - ldr q28, [x1, #16] - adcs x14, x7, xzr - mul x7, x13, x8 - eor x1, x5, x17 - adcs x5, x1, xzr - xtn v1.2s, v20.2d - mov x1, v17.d[0] - mov x3, v17.d[1] - uzp2 v16.4s, v20.4s, v20.4s - umulh x16, x13, x8 - eor x13, x7, x9 - adds x8, x1, x3 - adcs x7, x4, x12 - xtn v0.2s, v28.2d - adcs x12, x12, xzr - adds x8, x4, x8 - adcs x3, x3, x7 - ldp x7, x2, [x2, #16] - adcs x12, x12, xzr - cmn x9, #0x1 - adcs x8, x8, x13 - eor x13, x16, x9 - adcs x16, x3, x13 - lsl x3, x1, #32 - adc x13, x12, x9 - subs x12, x6, x7 - sbcs x9, x10, x2 - lsr x10, x1, #32 - ngc x4, xzr - subs x6, x2, x7 - cinv x2, x15, cc - cneg x6, x6, cc - subs x7, x1, x3 - eor x9, x9, x4 - sbc x1, x1, x10 - adds x15, x8, x3 - adcs x3, x16, x10 - mul x16, x11, x6 - adcs x8, x13, x7 - eor x13, x12, x4 - adc x10, x1, xzr - cmn x4, #0x1 - umulh x6, x11, x6 - adcs x11, x13, xzr - adcs x1, x9, xzr - lsl x13, x15, #32 - subs x12, x15, x13 - lsr x7, x15, #32 - sbc x15, x15, x7 - adds x9, x3, x13 - adcs x3, x8, x7 - umulh x8, x14, x11 - umull v21.2d, v0.2s, v1.2s - adcs x12, x10, x12 - umull v3.2d, v0.2s, v16.2s - adc x15, x15, xzr - rev64 v24.4s, v20.4s - stp x12, x15, [x0, #16] - movi v2.2d, #0xffffffff - mul x10, x14, x11 - mul v4.4s, v24.4s, v28.4s - subs x13, x14, x5 - uzp2 v19.4s, v28.4s, v28.4s - csetm x15, cc - usra v3.2d, v21.2d, #32 - mul x7, x5, x1 - umull v21.2d, v19.2s, v16.2s - cneg x13, x13, cc - uaddlp v5.2d, v4.4s - subs x11, x1, x11 - and v16.16b, v3.16b, v2.16b - umulh x5, x5, x1 - shl v24.2d, v5.2d, #32 - cneg x11, x11, cc - umlal v16.2d, v19.2s, v1.2s - cinv x12, x15, cc - umlal v24.2d, v0.2s, v1.2s - adds x15, x10, x7 - mul x14, x13, x11 - eor x1, x6, x2 - adcs x6, x8, x5 - stp x9, x3, [x0] - usra v21.2d, v3.2d, #32 - adcs x9, x5, xzr - umulh x11, x13, x11 - adds x15, x8, x15 - adcs x7, x7, x6 - eor x8, x14, x12 - usra v21.2d, v16.2d, #32 - adcs x13, x9, xzr - cmn x12, #0x1 - mov x9, v24.d[1] - adcs x14, x15, x8 - eor x6, x11, x12 - adcs x6, x7, x6 - mov x5, v24.d[0] - mov x11, v21.d[1] - mov x7, v21.d[0] - adc x3, x13, x12 - adds x12, x5, x9 - adcs x13, x7, x11 - ldp x15, x8, [x0] - adcs x11, x11, xzr - adds x12, x7, x12 - eor x16, x16, x2 - adcs x7, x9, x13 - adcs x11, x11, xzr - cmn x2, #0x1 - ldp x9, x13, [x0, #16] - adcs x16, x12, x16 - adcs x1, x7, x1 - adc x2, x11, x2 - adds x7, x5, x15 - adcs x15, x16, x8 - eor x5, x17, x4 - adcs x9, x1, x9 - eor x1, x10, x5 - adcs x16, x2, x13 - adc x2, xzr, xzr - cmn x5, #0x1 - eor x13, x14, x5 - adcs x14, x1, x7 - eor x1, x6, x5 - adcs x6, x13, x15 - adcs x10, x1, x9 - eor x4, x3, x5 - mov x1, #0xffffffff - adcs x8, x4, x16 - lsr x13, x14, #32 - adcs x17, x2, x5 - adcs x11, x5, xzr - adc x4, x5, xzr - adds x12, x10, x7 - adcs x7, x8, x15 - adcs x5, x17, x9 - adcs x9, x11, x16 - lsl x11, x14, #32 - adc x10, x4, x2 - subs x17, x14, x11 - sbc x4, x14, x13 - adds x11, x6, x11 - adcs x12, x12, x13 - lsl x15, x11, #32 - adcs x17, x7, x17 - lsr x7, x11, #32 - adc x13, x4, xzr - subs x4, x11, x15 - sbc x11, x11, x7 - adds x8, x12, x15 - adcs x15, x17, x7 - adcs x4, x13, x4 - adc x11, x11, xzr - adds x7, x5, x4 - adcs x17, x9, x11 - adc x13, x10, xzr - add x12, x13, #0x1 - neg x11, x12 - lsl x4, x12, #32 - adds x17, x17, x4 - sub x4, x4, #0x1 - adc x13, x13, xzr - subs x11, x8, x11 - sbcs x4, x15, x4 - sbcs x7, x7, xzr - sbcs x17, x17, x12 - sbcs x13, x13, x12 - mov x12, #0xffffffff00000001 - adds x11, x11, x13 - and x1, x1, x13 - adcs x4, x4, x1 - and x1, x12, x13 - stp x11, x4, [x0] - adcs x4, x7, xzr - adc x1, x17, x1 - stp x4, x1, [x0, #16] - ret - -// Corresponds exactly to bignum_montsqr_p256 - -.montsqr_p256: - ldr q19, [x1] - ldp x9, x13, [x1] - ldr q23, [x1, #16] - ldr q0, [x1] - ldp x1, x10, [x1, #16] - uzp2 v29.4s, v19.4s, v19.4s - xtn v4.2s, v19.2d - umulh x8, x9, x13 - rev64 v20.4s, v23.4s - umull v16.2d, v19.2s, v19.2s - umull v1.2d, v29.2s, v4.2s - mul v20.4s, v20.4s, v0.4s - subs x14, x9, x13 - umulh x15, x9, x1 - mov x16, v16.d[1] - umull2 v4.2d, v19.4s, v19.4s - mov x4, v16.d[0] - uzp1 v17.4s, v23.4s, v0.4s - uaddlp v19.2d, v20.4s - lsr x7, x8, #63 - mul x11, x9, x13 - mov x12, v1.d[0] - csetm x5, cc - cneg x6, x14, cc - mov x3, v4.d[1] - mov x14, v4.d[0] - subs x2, x10, x1 - mov x9, v1.d[1] - cneg x17, x2, cc - cinv x2, x5, cc - adds x5, x4, x12, lsl #33 - extr x4, x8, x11, #63 - lsr x8, x12, #31 - uzp1 v20.4s, v0.4s, v0.4s - shl v19.2d, v19.2d, #32 - adc x16, x16, x8 - adds x8, x14, x9, lsl #33 - lsr x14, x9, #31 - lsl x9, x5, #32 - umlal v19.2d, v20.2s, v17.2s - adc x14, x3, x14 - adds x16, x16, x11, lsl #1 - lsr x3, x5, #32 - umulh x12, x6, x17 - adcs x4, x8, x4 - adc x11, x14, x7 - subs x8, x5, x9 - sbc x5, x5, x3 - adds x16, x16, x9 - mov x14, v19.d[0] - mul x17, x6, x17 - adcs x3, x4, x3 - lsl x7, x16, #32 - umulh x13, x13, x10 - adcs x11, x11, x8 - lsr x8, x16, #32 - adc x5, x5, xzr - subs x9, x16, x7 - sbc x16, x16, x8 - adds x7, x3, x7 - mov x3, v19.d[1] - adcs x6, x11, x8 - umulh x11, x1, x10 - adcs x5, x5, x9 - eor x8, x12, x2 - adc x9, x16, xzr - adds x16, x14, x15 - adc x15, x15, xzr - adds x12, x16, x3 - eor x16, x17, x2 - mul x4, x1, x10 - adcs x15, x15, x13 - adc x17, x13, xzr - adds x15, x15, x3 - adc x3, x17, xzr - cmn x2, #0x1 - mul x17, x10, x10 - adcs x12, x12, x16 - adcs x16, x15, x8 - umulh x10, x10, x10 - adc x2, x3, x2 - adds x14, x14, x14 - adcs x12, x12, x12 - adcs x16, x16, x16 - adcs x2, x2, x2 - adc x15, xzr, xzr - adds x14, x14, x7 - mul x3, x1, x1 - adcs x12, x12, x6 - lsr x7, x14, #32 - adcs x16, x16, x5 - lsl x5, x14, #32 - umulh x13, x1, x1 - adcs x2, x2, x9 - mov x6, #0xffffffff - adc x15, x15, xzr - adds x8, x4, x4 - adcs x1, x11, x11 - mov x11, #0xffffffff00000001 - adc x4, xzr, xzr - subs x9, x14, x5 - sbc x14, x14, x7 - adds x12, x12, x5 - adcs x16, x16, x7 - lsl x5, x12, #32 - lsr x7, x12, #32 - adcs x2, x2, x9 - adcs x14, x15, x14 - adc x15, xzr, xzr - subs x9, x12, x5 - sbc x12, x12, x7 - adds x16, x16, x5 - adcs x2, x2, x7 - adcs x14, x14, x9 - adcs x12, x15, x12 - adc x15, xzr, xzr - adds x16, x16, x3 - adcs x2, x2, x13 - adcs x14, x14, x17 - adcs x12, x12, x10 - adc x15, x15, xzr - adds x2, x2, x8 - adcs x14, x14, x1 - adcs x12, x12, x4 - adcs x15, x15, xzr - adds x3, x16, #0x1 - sbcs x5, x2, x6 - sbcs x8, x14, xzr - sbcs x11, x12, x11 - sbcs xzr, x15, xzr - csel x16, x3, x16, cs - csel x14, x8, x14, cs - csel x12, x11, x12, cs - csel x2, x5, x2, cs - stp x14, x12, [x0, #16] - stp x16, x2, [x0] - ret - -// Corresponds exactly to bignum_sub_p256 - -.sub_p256: - ldp x5, x6, [x1] - ldp x4, x3, [x2] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [x1, #16] - ldp x4, x3, [x2, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, cc - adds x5, x5, x3 - and x4, x3, #0xffffffff - adcs x6, x6, x4 - adcs x7, x7, xzr - and x4, x3, #0xffffffff00000001 - adc x8, x8, x4 - stp x5, x6, [x0] - stp x7, x8, [x0, #16] - ret - -// Corresponds exactly to bignum_add_p256 - -.add_p256: - ldp x4, x5, [x1] - ldp x8, x9, [x2] - adds x4, x4, x8 - adcs x5, x5, x9 - ldp x6, x7, [x1, #16] - ldp x10, x11, [x2, #16] - adcs x6, x6, x10 - adcs x7, x7, x11 - adc x3, xzr, xzr - adds x8, x4, #0x1 - mov x9, #0xffffffff - sbcs x9, x5, x9 - sbcs x10, x6, xzr - mov x11, #0xffffffff00000001 - sbcs x11, x7, x11 - sbcs x3, x3, xzr - csel x4, x4, x8, cc - csel x5, x5, x9, cc - csel x6, x6, x10, cc - csel x7, x7, x11, cc - stp x4, x5, [x0] - stp x6, x7, [x0, #16] - ret - - -#define montmul_p256(P0,P1,P2) \ - add x0, P0;\ - add x1, P1;\ - add x2, P2;\ - bl .montmul_p256 - -#define montsqr_p256(P0,P1) \ - add x0, P0;\ - add x1, P1;\ - bl .montsqr_p256 - -#define sub_p256(P0,P1,P2) \ - add x0, P0;\ - add x1, P1;\ - add x2, P2;\ - bl .sub_p256 - -#define add_p256(P0,P1,P2) \ - add x0, P0;\ - add x1, P1;\ - add x2, P2;\ - bl .add_p256 - - -// A weak version of add that only guarantees sum in 4 digits - -#define weakadd_p256(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - adds x5, x5, x4 __LF \ - adcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - adcs x7, x7, x4 __LF \ - adcs x8, x8, x3 __LF \ - csetm x3, cs __LF \ - subs x5, x5, x3 __LF \ - and x1, x3, #4294967295 __LF \ - sbcs x6, x6, x1 __LF \ - sbcs x7, x7, xzr __LF \ - and x2, x3, #-4294967295 __LF \ - sbc x8, x8, x2 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// P0 = C * P1 - D * P2 computed as D * (p_256 - P2) + C * P1 -// Quotient estimation is done just as q = h + 1 as in bignum_triple_p256 -// This also applies to the other functions following. - -#define cmsub_p256(P0,C,P1,D,P2) \ - mov x1, D __LF \ - mov x2, #-1 __LF \ - ldp x9, x10, [P2] __LF \ - subs x9, x2, x9 __LF \ - mov x2, #4294967295 __LF \ - sbcs x10, x2, x10 __LF \ - ldp x11, x12, [P2+16] __LF \ - sbcs x11, xzr, x11 __LF \ - mov x2, #-4294967295 __LF \ - sbc x12, x2, x12 __LF \ - mul x3, x1, x9 __LF \ - mul x4, x1, x10 __LF \ - mul x5, x1, x11 __LF \ - mul x6, x1, x12 __LF \ - umulh x9, x1, x9 __LF \ - umulh x10, x1, x10 __LF \ - umulh x11, x1, x11 __LF \ - umulh x7, x1, x12 __LF \ - adds x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - adcs x6, x6, x11 __LF \ - adc x7, x7, xzr __LF \ - mov x1, C __LF \ - ldp x9, x10, [P1] __LF \ - mul x8, x9, x1 __LF \ - umulh x9, x9, x1 __LF \ - adds x3, x3, x8 __LF \ - mul x8, x10, x1 __LF \ - umulh x10, x10, x1 __LF \ - adcs x4, x4, x8 __LF \ - ldp x11, x12, [P1+16] __LF \ - mul x8, x11, x1 __LF \ - umulh x11, x11, x1 __LF \ - adcs x5, x5, x8 __LF \ - mul x8, x12, x1 __LF \ - umulh x12, x12, x1 __LF \ - adcs x6, x6, x8 __LF \ - adc x7, x7, xzr __LF \ - adds x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - adcs x6, x6, x11 __LF \ - adc x7, x7, x12 __LF \ - add x8, x7, #1 __LF \ - lsl x10, x8, #32 __LF \ - adds x6, x6, x10 __LF \ - adc x7, x7, xzr __LF \ - neg x9, x8 __LF \ - sub x10, x10, #1 __LF \ - subs x3, x3, x9 __LF \ - sbcs x4, x4, x10 __LF \ - sbcs x5, x5, xzr __LF \ - sbcs x6, x6, x8 __LF \ - sbc x8, x7, x8 __LF \ - adds x3, x3, x8 __LF \ - and x9, x8, #4294967295 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, xzr __LF \ - neg x10, x9 __LF \ - adc x6, x6, x10 __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -// P0 = 4 * P1 - P2, by direct subtraction of P2; the method -// in bignum_cmul_p256 etc. for quotient estimation still -// works when the value to be reduced is negative, as -// long as it is > -p_256, which is the case here. The -// actual accumulation of q * p_256 is done a bit differently -// so it works for the q = 0 case. - -#define cmsub41_p256(P0,P1,P2) \ - ldp x1, x2, [P1] __LF \ - lsl x0, x1, #2 __LF \ - ldp x6, x7, [P2] __LF \ - subs x0, x0, x6 __LF \ - extr x1, x2, x1, #62 __LF \ - sbcs x1, x1, x7 __LF \ - ldp x3, x4, [P1+16] __LF \ - extr x2, x3, x2, #62 __LF \ - ldp x6, x7, [P2+16] __LF \ - sbcs x2, x2, x6 __LF \ - extr x3, x4, x3, #62 __LF \ - sbcs x3, x3, x7 __LF \ - lsr x4, x4, #62 __LF \ - sbc x4, x4, xzr __LF \ - add x5, x4, #1 __LF \ - lsl x8, x5, #32 __LF \ - subs x6, xzr, x8 __LF \ - sbcs x7, xzr, xzr __LF \ - sbc x8, x8, x5 __LF \ - adds x0, x0, x5 __LF \ - adcs x1, x1, x6 __LF \ - adcs x2, x2, x7 __LF \ - adcs x3, x3, x8 __LF \ - csetm x5, cc __LF \ - adds x0, x0, x5 __LF \ - and x6, x5, #4294967295 __LF \ - adcs x1, x1, x6 __LF \ - adcs x2, x2, xzr __LF \ - neg x7, x6 __LF \ - adc x3, x3, x7 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -// P0 = 3 * P1 - 8 * P2, computed as (p_256 - P2) << 3 + 3 * P1 - -#define cmsub38_p256(P0,P1,P2) \ - mov x1, 8 __LF \ - mov x2, #-1 __LF \ - ldp x9, x10, [P2] __LF \ - subs x9, x2, x9 __LF \ - mov x2, #4294967295 __LF \ - sbcs x10, x2, x10 __LF \ - ldp x11, x12, [P2+16] __LF \ - sbcs x11, xzr, x11 __LF \ - mov x2, #-4294967295 __LF \ - sbc x12, x2, x12 __LF \ - lsl x3, x9, #3 __LF \ - extr x4, x10, x9, #61 __LF \ - extr x5, x11, x10, #61 __LF \ - extr x6, x12, x11, #61 __LF \ - lsr x7, x12, #61 __LF \ - mov x1, 3 __LF \ - ldp x9, x10, [P1] __LF \ - mul x8, x9, x1 __LF \ - umulh x9, x9, x1 __LF \ - adds x3, x3, x8 __LF \ - mul x8, x10, x1 __LF \ - umulh x10, x10, x1 __LF \ - adcs x4, x4, x8 __LF \ - ldp x11, x12, [P1+16] __LF \ - mul x8, x11, x1 __LF \ - umulh x11, x11, x1 __LF \ - adcs x5, x5, x8 __LF \ - mul x8, x12, x1 __LF \ - umulh x12, x12, x1 __LF \ - adcs x6, x6, x8 __LF \ - adc x7, x7, xzr __LF \ - adds x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - adcs x6, x6, x11 __LF \ - adc x7, x7, x12 __LF \ - add x8, x7, #1 __LF \ - lsl x10, x8, #32 __LF \ - adds x6, x6, x10 __LF \ - adc x7, x7, xzr __LF \ - neg x9, x8 __LF \ - sub x10, x10, #1 __LF \ - subs x3, x3, x9 __LF \ - sbcs x4, x4, x10 __LF \ - sbcs x5, x5, xzr __LF \ - sbcs x6, x6, x8 __LF \ - sbc x8, x7, x8 __LF \ - adds x3, x3, x8 __LF \ - and x9, x8, #4294967295 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, xzr __LF \ - neg x10, x9 __LF \ - adc x6, x6, x10 __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -S2N_BN_SYMBOL(p256_montjdouble): - -// Save registers and make room on stack for temporary variables - - sub sp, sp, NSPACE+32 - stp x30, xzr, [sp, NSPACE+16] - stp x19, x20, [sp, NSPACE] - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - -// Main code, just a sequence of basic field operations - -// z2 = z^2 -// y2 = y^2 - - montsqr_p256(z2,z_1) - montsqr_p256(y2,y_1) - -// x2p = x^2 - z^4 = (x + z^2) * (x - z^2) - - sub_p256(t2,x_1,z2) - weakadd_p256(t1,x_1,z2) - montmul_p256(x2p,t1,t2) - -// t1 = y + z -// xy2 = x * y^2 -// x4p = x2p^2 - - add_p256(t1,y_1,z_1) - montmul_p256(xy2,x_1,y2) - montsqr_p256(x4p,x2p) - -// t1 = (y + z)^2 - - montsqr_p256(t1,t1) - -// d = 12 * xy2 - 9 * x4p -// t1 = y^2 + 2 * y * z - - cmsub_p256(d_,12,xy2,9,x4p) - sub_p256(t1,t1,z2) - -// y4 = y^4 - - montsqr_p256(y4,y2) - -// dx2 = d * x2p - - montmul_p256(dx2,d_,x2p) - -// z_3' = 2 * y * z - - sub_p256(z_3,t1,y2) - -// x' = 4 * xy2 - d - - cmsub41_p256(x_3,xy2,d_) - -// y' = 3 * dx2 - 8 * y4 - - cmsub38_p256(y_3,dx2,y4) - -// Restore registers and stack and return - - ldp x19, x20, [sp, NSPACE] - ldp x30, xzr, [sp, NSPACE+16] - add sp, sp, NSPACE+32 - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/Makefile b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/Makefile deleted file mode 100644 index 0606619cf85..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/Makefile +++ /dev/null @@ -1,62 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - -# If actually on an ARM8 machine, just use the GNU assembler (as). Otherwise -# use a cross-assembling version so that the code can still be assembled -# and the proofs checked against the object files (though you won't be able -# to run code without additional emulation infrastructure). The aarch64 -# cross-assembling version can be installed manually by something like: -# -# sudo apt-get install binutils-aarch64-linux-gnu - -UNAME_RESULT=$(shell uname -p) - -ifeq ($(UNAME_RESULT),aarch64) -GAS=as -else -GAS=aarch64-linux-gnu-as -endif - -# List of object files - -OBJ = bignum_add_p384.o \ - bignum_bigendian_6.o \ - bignum_cmul_p384.o \ - bignum_deamont_p384.o \ - bignum_demont_p384.o \ - bignum_double_p384.o \ - bignum_half_p384.o \ - bignum_inv_p384.o \ - bignum_littleendian_6.o \ - bignum_mod_n384.o \ - bignum_mod_n384_6.o \ - bignum_mod_p384.o \ - bignum_mod_p384_6.o \ - bignum_montinv_p384.o \ - bignum_montmul_p384.o \ - bignum_montmul_p384_alt.o \ - bignum_montsqr_p384.o \ - bignum_montsqr_p384_alt.o \ - bignum_mux_6.o \ - bignum_neg_p384.o \ - bignum_nonzero_6.o \ - bignum_optneg_p384.o \ - bignum_sub_p384.o \ - bignum_tomont_p384.o \ - bignum_triple_p384.o \ - p384_montjadd.o \ - p384_montjadd_alt.o \ - p384_montjdouble.o \ - p384_montjdouble_alt.o \ - p384_montjmixadd.o \ - p384_montjmixadd_alt.o \ - p384_montjscalarmul.o \ - p384_montjscalarmul_alt.o - -%.o : %.S ; $(CC) -E -I../../include $< | $(GAS) -o $@ - - -default: $(OBJ); - -clean:; rm -f *.o *.correct diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_bigendian_6.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_bigendian_6.S deleted file mode 100644 index dfb91695666..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_bigendian_6.S +++ /dev/null @@ -1,184 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert 6-digit (384-bit) bignum to/from big-endian form -// Input x[6]; output z[6] -// -// extern void bignum_bigendian_6(uint64_t z[static 6], -// const uint64_t x[static 6]); -// -// The same function is given two other prototypes whose names reflect the -// treatment of one or other argument as a byte array rather than word array: -// -// extern void bignum_frombebytes_6(uint64_t z[static 6], -// const uint8_t x[static 48]); -// -// extern void bignum_tobebytes_6(uint8_t z[static 48], -// const uint64_t x[static 6]); -// -// The implementation works by loading in bytes and storing in words (i.e. -// stylistically it is "frombebytes"); in the more common little-endian -// usage of ARM, this is just byte reversal. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_bigendian_6) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_bigendian_6) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_bigendian_6) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_frombebytes_6) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_frombebytes_6) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_frombebytes_6) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tobebytes_6) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tobebytes_6) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tobebytes_6) - - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d x2 -#define dshort w2 -#define a x3 -#define c x4 - -// The reads and writes are organized in mirror-image pairs (0-5, 1-4, 2-3) -// to allow x and z to point to the same buffer without using more -// intermediate registers. - -S2N_BN_SYMBOL(bignum_bigendian_6): -S2N_BN_SYMBOL(bignum_frombebytes_6): -S2N_BN_SYMBOL(bignum_tobebytes_6): - CFI_START - -// 0 and 5 words - - ldrb dshort, [x, #7] - extr a, d, xzr, #8 - ldrb dshort, [x, #6] - extr a, d, a, #8 - ldrb dshort, [x, #5] - extr a, d, a, #8 - ldrb dshort, [x, #4] - extr a, d, a, #8 - ldrb dshort, [x, #3] - extr a, d, a, #8 - ldrb dshort, [x, #2] - extr a, d, a, #8 - ldrb dshort, [x, #1] - extr a, d, a, #8 - ldrb dshort, [x] - extr a, d, a, #8 - - ldrb dshort, [x, #47] - extr c, d, xzr, #8 - ldrb dshort, [x, #46] - extr c, d, c, #8 - ldrb dshort, [x, #45] - extr c, d, c, #8 - ldrb dshort, [x, #44] - extr c, d, c, #8 - ldrb dshort, [x, #43] - extr c, d, c, #8 - ldrb dshort, [x, #42] - extr c, d, c, #8 - ldrb dshort, [x, #41] - extr c, d, c, #8 - ldrb dshort, [x, #40] - extr c, d, c, #8 - - str a, [z, #40] - str c, [z] - -// 1 and 4 words - - ldrb dshort, [x, #15] - extr a, d, xzr, #8 - ldrb dshort, [x, #14] - extr a, d, a, #8 - ldrb dshort, [x, #13] - extr a, d, a, #8 - ldrb dshort, [x, #12] - extr a, d, a, #8 - ldrb dshort, [x, #11] - extr a, d, a, #8 - ldrb dshort, [x, #10] - extr a, d, a, #8 - ldrb dshort, [x, #9] - extr a, d, a, #8 - ldrb dshort, [x, #8] - extr a, d, a, #8 - - ldrb dshort, [x, #39] - extr c, d, xzr, #8 - ldrb dshort, [x, #38] - extr c, d, c, #8 - ldrb dshort, [x, #37] - extr c, d, c, #8 - ldrb dshort, [x, #36] - extr c, d, c, #8 - ldrb dshort, [x, #35] - extr c, d, c, #8 - ldrb dshort, [x, #34] - extr c, d, c, #8 - ldrb dshort, [x, #33] - extr c, d, c, #8 - ldrb dshort, [x, #32] - extr c, d, c, #8 - - str a, [z, #32] - str c, [z, #8] - -// 2 and 3 words - - ldrb dshort, [x, #23] - extr a, d, xzr, #8 - ldrb dshort, [x, #22] - extr a, d, a, #8 - ldrb dshort, [x, #21] - extr a, d, a, #8 - ldrb dshort, [x, #20] - extr a, d, a, #8 - ldrb dshort, [x, #19] - extr a, d, a, #8 - ldrb dshort, [x, #18] - extr a, d, a, #8 - ldrb dshort, [x, #17] - extr a, d, a, #8 - ldrb dshort, [x, #16] - extr a, d, a, #8 - - ldrb dshort, [x, #31] - extr c, d, xzr, #8 - ldrb dshort, [x, #30] - extr c, d, c, #8 - ldrb dshort, [x, #29] - extr c, d, c, #8 - ldrb dshort, [x, #28] - extr c, d, c, #8 - ldrb dshort, [x, #27] - extr c, d, c, #8 - ldrb dshort, [x, #26] - extr c, d, c, #8 - ldrb dshort, [x, #25] - extr c, d, c, #8 - ldrb dshort, [x, #24] - extr c, d, c, #8 - - str a, [z, #24] - str c, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_bigendian_6) -S2N_BN_SIZE_DIRECTIVE(bignum_frombebytes_6) -S2N_BN_SIZE_DIRECTIVE(bignum_tobebytes_6) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_cmul_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_cmul_p384.S deleted file mode 100644 index 11d26630fde..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_cmul_p384.S +++ /dev/null @@ -1,147 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_384, z := (c * x) mod p_384, assuming -// x reduced -// Inputs c, x[6]; output z[6] -// -// extern void bignum_cmul_p384(uint64_t z[static 6], uint64_t c, -// const uint64_t x[static 6]); -// -// Standard ARM ABI: X0 = z, X1 = c, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p384) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p384_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p384_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p384_alt) - .text - .balign 4 - -#define z x0 -#define c x1 -#define x x2 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x6 -#define d5 x7 -#define a0 x8 -#define a1 x9 -#define a2 x10 -#define a3 x11 -#define a4 x12 -#define a5 x13 - -// Some shared here - -#define h x1 -#define h1 x12 -#define hn x13 -#define m x8 -#define l x9 - - -S2N_BN_SYMBOL(bignum_cmul_p384): - -S2N_BN_SYMBOL(bignum_cmul_p384_alt): - CFI_START - -// First do the multiply, straightforwardly, getting [h; d5; ...; d0] - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - ldp a4, a5, [x, #32] - mul d0, c, a0 - mul d1, c, a1 - mul d2, c, a2 - mul d3, c, a3 - mul d4, c, a4 - mul d5, c, a5 - umulh a0, c, a0 - umulh a1, c, a1 - umulh a2, c, a2 - umulh a3, c, a3 - umulh a4, c, a4 - umulh h, c, a5 - adds d1, d1, a0 - adcs d2, d2, a1 - adcs d3, d3, a2 - adcs d4, d4, a3 - adcs d5, d5, a4 - adc h, h, xzr - -// Let h be the top word of this intermediate product and l the low 6 words. -// By the range hypothesis on the input, we know h1 = h + 1 does not wrap -// And then -p_384 <= z - h1 * p_384 < p_384, so we just need to subtract -// h1 * p_384 and then correct if that is negative by adding p_384. -// -// Write p_384 = 2^384 - r where r = 2^128 + 2^96 - 2^32 + 1 -// -// We want z - (h + 1) * (2^384 - r) -// = (2^384 * h + l) - (h + 1) * (2^384 - r) -// = (l + (h + 1) * r) - 2^384. -// -// Thus we can do the computation in 6 words of l + (h + 1) * r, and if it -// does *not* carry we need to add p_384. We can rewrite this as the following, -// using ~h = 2^64 - (h + 1) and absorbing the 2^64 in the higher term -// using h instead of h + 1. -// -// l + (h + 1) * r -// = l + 2^128 * (h + 1) + 2^96 * (h + 1) - 2^32 * (h + 1) + (h + 1) -// = l + 2^128 * (h + 1) + 2^96 * h + 2^32 * ~h + (h + 1) - - add h1, h, #1 - orn hn, xzr, h - lsl a0, hn, #32 - extr a1, h, hn, #32 - lsr a2, h, #32 - - adds a0, a0, h1 - adcs a1, a1, xzr - adcs a2, a2, h1 - adc a3, xzr, xzr - - adds d0, d0, a0 - adcs d1, d1, a1 - adcs d2, d2, a2 - adcs d3, d3, a3 - adcs d4, d4, xzr - adcs d5, d5, xzr - -// Catch the carry and do a masked addition of p_384 - - csetm m, cc - - mov l, #0x00000000ffffffff - and l, l, m - adds d0, d0, l - eor l, l, m - adcs d1, d1, l - mov l, #0xfffffffffffffffe - and l, l, m - adcs d2, d2, l - adcs d3, d3, m - adcs d4, d4, m - adc d5, d5, m - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_demont_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_demont_p384.S deleted file mode 100644 index 4ace612054e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_demont_p384.S +++ /dev/null @@ -1,122 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^384) mod p_384, assuming x reduced -// Input x[6]; output z[6] -// -// extern void bignum_demont_p384(uint64_t z[static 6], -// const uint64_t x[static 6]); -// -// This assumes the input is < p_384 for correctness. If this is not the case, -// use the variant "bignum_deamont_p384" instead. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_p384) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_p384_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_p384_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_p384_alt) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d5;d4;d3;d2;d1;d0] and returns result in [d6;d5;d4;d3;d2;d1], -// adding to the existing contents of [d5;d4;d3;d2;d1]. It is fine -// for d6 to be the same register as d0. -// -// We want to add (2^384 - 2^128 - 2^96 + 2^32 - 1) * w -// where w = [d0 + (d0<<32)] mod 2^64 -// --------------------------------------------------------------------------- - -#define montreds(d6,d5,d4,d3,d2,d1,d0, t3,t2,t1) \ -/* Our correction multiplier is w = [d0 + (d0<<32)] mod 2^64 */ \ -/* Recycle d0 (which we know gets implicitly cancelled) to store it */ \ - lsl t1, d0, #32 __LF \ - add d0, t1, d0 __LF \ -/* Now let [t2;t1] = 2^64 * w - w + w_hi where w_hi = floor(w/2^32) */ \ -/* We need to subtract 2^32 * this, and we can ignore its lower 32 */ \ -/* bits since by design it will cancel anyway; we only need the w_hi */ \ -/* part to get the carry propagation going. */ \ - lsr t1, d0, #32 __LF \ - subs t1, t1, d0 __LF \ - sbc t2, d0, xzr __LF \ -/* Now select in t1 the field to subtract from d1 */ \ - extr t1, t2, t1, #32 __LF \ -/* And now get the terms to subtract from d2 and d3 */ \ - lsr t2, t2, #32 __LF \ - adds t2, t2, d0 __LF \ - adc t3, xzr, xzr __LF \ -/* Do the subtraction of that portion */ \ - subs d1, d1, t1 __LF \ - sbcs d2, d2, t2 __LF \ - sbcs d3, d3, t3 __LF \ - sbcs d4, d4, xzr __LF \ - sbcs d5, d5, xzr __LF \ -/* Now effectively add 2^384 * w by taking d0 as the input for last sbc */ \ - sbc d6, d0, xzr - -// Input parameters - -#define z x0 -#define x x1 - -// Rotating registers for the intermediate windows - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x6 -#define d5 x7 - -// Other temporaries - -#define u x8 -#define v x9 -#define w x10 - -S2N_BN_SYMBOL(bignum_demont_p384): - -S2N_BN_SYMBOL(bignum_demont_p384_alt): - CFI_START - -// Set up an initial window with the input x and an extra leading zero - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - ldp d4, d5, [x, #32] - -// Systematically scroll left doing 1-step reductions - - montreds(d0,d5,d4,d3,d2,d1,d0, u,v,w) - - montreds(d1,d0,d5,d4,d3,d2,d1, u,v,w) - - montreds(d2,d1,d0,d5,d4,d3,d2, u,v,w) - - montreds(d3,d2,d1,d0,d5,d4,d3, u,v,w) - - montreds(d4,d3,d2,d1,d0,d5,d4, u,v,w) - - montreds(d5,d4,d3,d2,d1,d0,d5, u,v,w) - -// This is already our answer with no correction needed - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_double_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_double_p384.S deleted file mode 100644 index d7af29e7a80..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_double_p384.S +++ /dev/null @@ -1,92 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo p_384, z := (2 * x) mod p_384, assuming x reduced -// Input x[6]; output z[6] -// -// extern void bignum_double_p384(uint64_t z[static 6], -// const uint64_t x[static 6]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_double_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_double_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_double_p384) - .text - .balign 4 - -#define z x0 -#define x x1 -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x6 -#define d5 x7 -#define c x8 -#define n0 x9 -#define n1 x10 -#define n2 x11 -#define n3 x12 -#define n4 x13 -#define n5 x14 - - -S2N_BN_SYMBOL(bignum_double_p384): - CFI_START - -// Double the input number as 2 * x = c + [d5; d4; d3; d2; d1; d0] -// It's worth considering doing this with extr...63 instead - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - ldp d4, d5, [x, #32] - adds d0, d0, d0 - adcs d1, d1, d1 - adcs d2, d2, d2 - adcs d3, d3, d3 - adcs d4, d4, d4 - adcs d5, d5, d5 - adc c, xzr, xzr - -// Subtract p_384 to give 2 * x - p_384 = c + [n5; n4; n3; n2; n1; n0] - - mov n0, #0x00000000ffffffff - subs n0, d0, n0 - mov n1, #0xffffffff00000000 - sbcs n1, d1, n1 - mov n2, #0xfffffffffffffffe - sbcs n2, d2, n2 - adcs n3, d3, xzr - adcs n4, d4, xzr - adcs n5, d5, xzr - sbcs c, c, xzr - -// Now CF is set (because of inversion) if 2 * x >= p_384, in which case the -// correct result is [n5; n4; n3; n2; n1; n0], otherwise -// [d5; d4; d3; d2; d1; d0] - - csel d0, d0, n0, cc - csel d1, d1, n1, cc - csel d2, d2, n2, cc - csel d3, d3, n3, cc - csel d4, d4, n4, cc - csel d5, d5, n5, cc - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_double_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_half_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_half_p384.S deleted file mode 100644 index df1e92f860d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_half_p384.S +++ /dev/null @@ -1,86 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Halve modulo p_384, z := (x / 2) mod p_384, assuming x reduced -// Input x[6]; output z[6] -// -// extern void bignum_half_p384(uint64_t z[static 6], const uint64_t x[static 6]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_half_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_half_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_half_p384) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x6 -#define d5 x7 -#define d6 x8 -#define d7 x9 -#define m x10 -#define n x11 - - -S2N_BN_SYMBOL(bignum_half_p384): - CFI_START - -// Load the 4 digits of x - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - ldp d4, d5, [x, #32] - -// Get a bitmask corresponding to the lowest bit of the input - - and m, d0, #1 - neg m, m - -// Do a masked addition of p_384, catching carry in a 7th word - - and n, m, #0x00000000ffffffff - adds d0, d0, n - and n, m, #0xffffffff00000000 - adcs d1, d1, n - and n, m, #0xfffffffffffffffe - adcs d2, d2, n - adcs d3, d3, m - adcs d4, d4, m - adcs d5, d5, m - adc d6, xzr, xzr - -// Now shift that sum right one place - - extr d0, d1, d0, #1 - extr d1, d2, d1, #1 - extr d2, d3, d2, #1 - extr d3, d4, d3, #1 - extr d4, d5, d4, #1 - extr d5, d6, d5, #1 - -// Store back - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - -// Return - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_half_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_inv_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_inv_p384.S deleted file mode 100644 index 3f499a9d42d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_inv_p384.S +++ /dev/null @@ -1,1474 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Modular inverse modulo p_384 = 2^384 - 2^128 - 2^96 + 2^32 - 1 -// Input x[6]; output z[6] -// -// extern void bignum_inv_p384(uint64_t z[static 6],const uint64_t x[static 6]); -// -// If the 6-digit input x is coprime to p_384, i.e. is not divisible -// by it, returns z < p_384 such that x * z == 1 (mod p_384). Note that -// x does not need to be reduced modulo p_384, but the output always is. -// If the input is divisible (i.e. is 0 or p_384), then there can be no -// modular inverse and z = 0 is returned. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_inv_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_inv_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_inv_p384) - - .text - .balign 4 - -// Size in bytes of a 64-bit word - -#define N 8 - -// Used for the return pointer - -#define res x20 - -// Loop counter and d = 2 * delta value for divstep - -#define i x21 -#define d x22 - -// Registers used for matrix element magnitudes and signs - -#define m00 x10 -#define m01 x11 -#define m10 x12 -#define m11 x13 -#define s00 x14 -#define s01 x15 -#define s10 x16 -#define s11 x17 - -// Initial carries for combinations - -#define car0 x9 -#define car1 x19 - -// Input and output, plain registers treated according to pattern - -#define reg0 x0, #0 -#define reg1 x1, #0 -#define reg2 x2, #0 -#define reg3 x3, #0 -#define reg4 x4, #0 - -#define x x1, #0 -#define z x0, #0 - -// Pointer-offset pairs for temporaries on stack -// The u and v variables are 6 words each as expected, but the f and g -// variables are 8 words each -- they need to have at least one extra -// word for a sign word, and to preserve alignment we "round up" to 8. -// In fact, we currently keep an extra word in u and v as well. - -#define f sp, #0 -#define g sp, #(8*N) -#define u sp, #(16*N) -#define v sp, #(24*N) - -// Total size to reserve on the stack - -#define NSPACE 32*N - -// --------------------------------------------------------------------------- -// Core signed almost-Montgomery reduction macro. Takes input in -// [d6;d5;d4;d3;d2;d1;d0] and returns result in [d6;d5d4;d3;d2;d1], adding -// to the existing [d6;d5;d4;d3;d2;d1], and re-using d0 as a temporary -// internally as well as t0, t1, t2. This is almost-Montgomery, i.e. the -// result fits in 6 digits but is not necessarily strictly reduced mod p_384. -// --------------------------------------------------------------------------- - -#define amontred(d6,d5,d4,d3,d2,d1,d0, t3,t2,t1) \ -/* We only know the input is -2^444 < x < 2^444. To do traditional */ \ -/* unsigned Montgomery reduction, start by adding 2^61 * p_384. */ \ - mov t1, #0xe000000000000000 __LF \ - adds d0, d0, t1 __LF \ - mov t2, #0x000000001fffffff __LF \ - adcs d1, d1, t2 __LF \ - mov t3, #0xffffffffe0000000 __LF \ - bic t3, t3, #0x2000000000000000 __LF \ - adcs d2, d2, t3 __LF \ - sbcs d3, d3, xzr __LF \ - sbcs d4, d4, xzr __LF \ - sbcs d5, d5, xzr __LF \ - mov t1, #0x1fffffffffffffff __LF \ - adc d6, d6, t1 __LF \ -/* Our correction multiplier is w = [d0 + (d0<<32)] mod 2^64 */ \ -/* Store it back into d0 since we no longer need that digit. */ \ - add d0, d0, d0, lsl #32 __LF \ -/* Now let [t3;t2;t1;-] = (2^384 - p_384) * w */ \ -/* We know the lowest word will cancel d0 so we don't need it */ \ - mov t1, #0xffffffff00000001 __LF \ - umulh t1, t1, d0 __LF \ - mov t2, #0x00000000ffffffff __LF \ - mul t3, t2, d0 __LF \ - umulh t2, t2, d0 __LF \ - adds t1, t1, t3 __LF \ - adcs t2, t2, d0 __LF \ - cset t3, cs __LF \ -/* Now x + p_384 * w = (x + 2^384 * w) - (2^384 - p_384) * w */ \ -/* We catch the net top carry from add-subtract in the digit d0 */ \ - adds d6, d6, d0 __LF \ - cset d0, cs __LF \ - subs d1, d1, t1 __LF \ - sbcs d2, d2, t2 __LF \ - sbcs d3, d3, t3 __LF \ - sbcs d4, d4, xzr __LF \ - sbcs d5, d5, xzr __LF \ - sbcs d6, d6, xzr __LF \ - sbcs d0, d0, xzr __LF \ -/* Now if d0 is nonzero we subtract p_384 (almost-Montgomery) */ \ - neg d0, d0 __LF \ - and t1, d0, #0x00000000ffffffff __LF \ - and t2, d0, #0xffffffff00000000 __LF \ - and t3, d0, #0xfffffffffffffffe __LF \ - subs d1, d1, t1 __LF \ - sbcs d2, d2, t2 __LF \ - sbcs d3, d3, t3 __LF \ - sbcs d4, d4, d0 __LF \ - sbcs d5, d5, d0 __LF \ - sbc d6, d6, d0 - -// Very similar to a subroutine call to the s2n-bignum word_divstep59. -// But different in register usage and returning the final matrix in -// registers as follows -// -// [ m00 m01] -// [ m10 m11] - -#define divstep59() \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x8, x4, #0x100, lsl #12 __LF \ - sbfx x8, x8, #21, #21 __LF \ - mov x11, #0x100000 __LF \ - add x11, x11, x11, lsl #21 __LF \ - add x9, x4, x11 __LF \ - asr x9, x9, #42 __LF \ - add x10, x5, #0x100, lsl #12 __LF \ - sbfx x10, x10, #21, #21 __LF \ - add x11, x5, x11 __LF \ - asr x11, x11, #42 __LF \ - mul x6, x8, x2 __LF \ - mul x7, x9, x3 __LF \ - mul x2, x10, x2 __LF \ - mul x3, x11, x3 __LF \ - add x4, x6, x7 __LF \ - add x5, x2, x3 __LF \ - asr x2, x4, #20 __LF \ - asr x3, x5, #20 __LF \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x12, x4, #0x100, lsl #12 __LF \ - sbfx x12, x12, #21, #21 __LF \ - mov x15, #0x100000 __LF \ - add x15, x15, x15, lsl #21 __LF \ - add x13, x4, x15 __LF \ - asr x13, x13, #42 __LF \ - add x14, x5, #0x100, lsl #12 __LF \ - sbfx x14, x14, #21, #21 __LF \ - add x15, x5, x15 __LF \ - asr x15, x15, #42 __LF \ - mul x6, x12, x2 __LF \ - mul x7, x13, x3 __LF \ - mul x2, x14, x2 __LF \ - mul x3, x15, x3 __LF \ - add x4, x6, x7 __LF \ - add x5, x2, x3 __LF \ - asr x2, x4, #20 __LF \ - asr x3, x5, #20 __LF \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - mul x2, x12, x8 __LF \ - mul x3, x12, x9 __LF \ - mul x6, x14, x8 __LF \ - mul x7, x14, x9 __LF \ - madd x8, x13, x10, x2 __LF \ - madd x9, x13, x11, x3 __LF \ - madd x16, x15, x10, x6 __LF \ - madd x17, x15, x11, x7 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x12, x4, #0x100, lsl #12 __LF \ - sbfx x12, x12, #22, #21 __LF \ - mov x15, #0x100000 __LF \ - add x15, x15, x15, lsl #21 __LF \ - add x13, x4, x15 __LF \ - asr x13, x13, #43 __LF \ - add x14, x5, #0x100, lsl #12 __LF \ - sbfx x14, x14, #22, #21 __LF \ - add x15, x5, x15 __LF \ - asr x15, x15, #43 __LF \ - mneg x2, x12, x8 __LF \ - mneg x3, x12, x9 __LF \ - mneg x4, x14, x8 __LF \ - mneg x5, x14, x9 __LF \ - msub m00, x13, x16, x2 __LF \ - msub m01, x13, x17, x3 __LF \ - msub m10, x15, x16, x4 __LF \ - msub m11, x15, x17, x5 - -S2N_BN_SYMBOL(bignum_inv_p384): - CFI_START - -// Save registers and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_DEC_SP(NSPACE) - -// Save the return pointer for the end so we can overwrite x0 later - - mov res, x0 - -// Copy the prime and input into the main f and g variables respectively. -// Make sure x is reduced so that g <= f as assumed in the bound proof. - - mov x10, #0x00000000ffffffff - mov x11, #0xffffffff00000000 - mov x12, #0xfffffffffffffffe - mov x15, #0xffffffffffffffff - stp x10, x11, [f] - stp x12, x15, [f+2*N] - stp x15, x15, [f+4*N] - str xzr, [f+6*N] - - ldp x2, x3, [x1] - subs x10, x2, x10 - sbcs x11, x3, x11 - ldp x4, x5, [x1, #(2*N)] - sbcs x12, x4, x12 - sbcs x13, x5, x15 - ldp x6, x7, [x1, #(4*N)] - sbcs x14, x6, x15 - sbcs x15, x7, x15 - - csel x2, x2, x10, cc - csel x3, x3, x11, cc - csel x4, x4, x12, cc - csel x5, x5, x13, cc - csel x6, x6, x14, cc - csel x7, x7, x15, cc - - stp x2, x3, [g] - stp x4, x5, [g+2*N] - stp x6, x7, [g+4*N] - str xzr, [g+6*N] - -// Also maintain reduced < 2^384 vector [u,v] such that -// [f,g] == x * 2^{5*i-75} * [u,v] (mod p_384) -// starting with [p_384,x] == x * 2^{5*0-75} * [0,2^75] (mod p_384) -// The weird-looking 5*i modifications come in because we are doing -// 64-bit word-sized Montgomery reductions at each stage, which is -// 5 bits more than the 59-bit requirement to keep things stable. - - stp xzr, xzr, [u] - stp xzr, xzr, [u+2*N] - stp xzr, xzr, [u+4*N] - - mov x10, #2048 - stp xzr, x10, [v] - stp xzr, xzr, [v+2*N] - stp xzr, xzr, [v+4*N] - -// Start of main loop. We jump into the middle so that the divstep -// portion is common to the special fifteenth iteration after a uniform -// first 14. - - mov i, #15 - mov d, #1 - b Lbignum_inv_p384_midloop - -Lbignum_inv_p384_loop: - -// Separate the matrix elements into sign-magnitude pairs - - cmp m00, xzr - csetm s00, mi - cneg m00, m00, mi - - cmp m01, xzr - csetm s01, mi - cneg m01, m01, mi - - cmp m10, xzr - csetm s10, mi - cneg m10, m10, mi - - cmp m11, xzr - csetm s11, mi - cneg m11, m11, mi - -// Adjust the initial values to allow for complement instead of negation -// This initial offset is the same for [f,g] and [u,v] compositions. -// Save it in stable registers for the [u,v] part and do [f,g] first. - - and x0, m00, s00 - and x1, m01, s01 - add car0, x0, x1 - - and x0, m10, s10 - and x1, m11, s11 - add car1, x0, x1 - -// Now the computation of the updated f and g values. This maintains a -// 2-word carry between stages so we can conveniently insert the shift -// right by 59 before storing back, and not overwrite digits we need -// again of the old f and g values. -// -// Digit 0 of [f,g] - - ldr x7, [f] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [g] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - adc x2, x2, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x5, car1, x0 - adc x3, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x5, x5, x0 - adc x3, x3, x1 - -// Digit 1 of [f,g] - - ldr x7, [f+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [g+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [f] - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [g] - -// Digit 2 of [f,g] - - ldr x7, [f+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [g+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [f+N] - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [g+N] - -// Digit 3 of [f,g] - - ldr x7, [f+3*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, xzr, x1 - ldr x8, [g+3*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [f+2*N] - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x2, x2, x0 - adc x6, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [g+2*N] - -// Digit 4 of [f,g] - - ldr x7, [f+4*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x3, x3, x0 - adc x4, xzr, x1 - ldr x8, [g+4*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [f+3*N] - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x6, x6, x0 - adc x5, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [g+3*N] - -// Digits 5 and 6 of [f,g] - - ldr x7, [f+5*N] - eor x1, x7, s00 - ldr x23, [f+6*N] - eor x2, x23, s00 - and x2, x2, m00 - neg x2, x2 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, x4, x0 - adc x2, x2, x1 - ldr x8, [g+5*N] - eor x1, x8, s01 - ldr x24, [g+6*N] - eor x0, x24, s01 - and x0, x0, m01 - sub x2, x2, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [f+4*N] - extr x4, x2, x4, #59 - str x4, [f+5*N] - asr x2, x2, #59 - str x2, [f+6*N] - - eor x1, x7, s10 - eor x4, x23, s10 - and x4, x4, m10 - neg x4, x4 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x5, x5, x0 - adc x4, x4, x1 - eor x1, x8, s11 - eor x0, x24, s11 - and x0, x0, m11 - sub x4, x4, x0 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x5, x5, x0 - adc x4, x4, x1 - extr x6, x5, x6, #59 - str x6, [g+4*N] - extr x5, x4, x5, #59 - str x5, [g+5*N] - asr x4, x4, #59 - str x4, [g+6*N] - -// Now the computation of the updated u and v values and their -// Montgomery reductions. A very similar accumulation except that -// the top words of u and v are unsigned and we don't shift. -// -// Digit 0 of [u,v] - - ldr x7, [u] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [v] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - str x4, [u] - adc x2, x2, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x5, car1, x0 - adc x3, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x5, x5, x0 - str x5, [v] - adc x3, x3, x1 - -// Digit 1 of [u,v] - - ldr x7, [u+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [v+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - str x2, [u+N] - adc x6, x6, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x3, x3, x0 - str x3, [v+N] - adc x4, x4, x1 - -// Digit 2 of [u,v] - - ldr x7, [u+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [v+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - str x6, [u+2*N] - adc x5, x5, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x4, x4, x0 - str x4, [v+2*N] - adc x2, x2, x1 - -// Digit 3 of [u,v] - - ldr x7, [u+3*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, xzr, x1 - ldr x8, [v+3*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - str x5, [u+3*N] - adc x3, x3, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x2, x2, x0 - adc x6, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x2, x2, x0 - str x2, [v+3*N] - adc x6, x6, x1 - -// Digit 4 of [u,v] - - ldr x7, [u+4*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x3, x3, x0 - adc x4, xzr, x1 - ldr x8, [v+4*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x3, x3, x0 - str x3, [u+4*N] - adc x4, x4, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x6, x6, x0 - adc x5, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x6, x6, x0 - str x6, [v+4*N] - adc x5, x5, x1 - -// Digits 5 and 6 of [u,v] (top is unsigned) - - ldr x7, [u+5*N] - eor x1, x7, s00 - and x2, s00, m00 - neg x2, x2 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, x4, x0 - adc x2, x2, x1 - ldr x8, [v+5*N] - eor x1, x8, s01 - and x0, s01, m01 - sub x2, x2, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - str x4, [u+5*N] - adc x2, x2, x1 - str x2, [u+6*N] - - eor x1, x7, s10 - and x4, s10, m10 - neg x4, x4 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x5, x5, x0 - adc x4, x4, x1 - eor x1, x8, s11 - and x0, s11, m11 - sub x4, x4, x0 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x5, x5, x0 - str x5, [v+5*N] - adc x4, x4, x1 - str x4, [v+6*N] - -// Montgomery reduction of u - - ldp x0, x1, [u] - ldp x2, x3, [u+16] - ldp x4, x5, [u+32] - ldr x6, [u+48] - amontred(x6,x5,x4,x3,x2,x1,x0, x9,x8,x7) - stp x1, x2, [u] - stp x3, x4, [u+16] - stp x5, x6, [u+32] - -// Montgomery reduction of v - - ldp x0, x1, [v] - ldp x2, x3, [v+16] - ldp x4, x5, [v+32] - ldr x6, [v+48] - amontred(x6,x5,x4,x3,x2,x1,x0, x9,x8,x7) - stp x1, x2, [v] - stp x3, x4, [v+16] - stp x5, x6, [v+32] - -Lbignum_inv_p384_midloop: - - mov x1, d - ldr x2, [f] - ldr x3, [g] - divstep59() - mov d, x1 - -// Next iteration - - subs i, i, #1 - bne Lbignum_inv_p384_loop - -// The 15th and last iteration does not need anything except the -// u value and the sign of f; the latter can be obtained from the -// lowest word of f. So it's done differently from the main loop. -// Find the sign of the new f. For this we just need one digit -// since we know (for in-scope cases) that f is either +1 or -1. -// We don't explicitly shift right by 59 either, but looking at -// bit 63 (or any bit >= 60) of the unshifted result is enough -// to distinguish -1 from +1; this is then made into a mask. - - ldr x0, [f] - ldr x1, [g] - mul x0, x0, m00 - madd x1, x1, m01, x0 - asr x0, x1, #63 - -// Now separate out the matrix into sign-magnitude pairs -// and adjust each one based on the sign of f. -// -// Note that at this point we expect |f|=1 and we got its -// sign above, so then since [f,0] == x * [u,v] (mod p_384) -// we want to flip the sign of u according to that of f. - - cmp m00, xzr - csetm s00, mi - cneg m00, m00, mi - eor s00, s00, x0 - - cmp m01, xzr - csetm s01, mi - cneg m01, m01, mi - eor s01, s01, x0 - - cmp m10, xzr - csetm s10, mi - cneg m10, m10, mi - eor s10, s10, x0 - - cmp m11, xzr - csetm s11, mi - cneg m11, m11, mi - eor s11, s11, x0 - -// Adjust the initial value to allow for complement instead of negation - - and x0, m00, s00 - and x1, m01, s01 - add car0, x0, x1 - -// Digit 0 of [u] - - ldr x7, [u] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [v] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - str x4, [u] - adc x2, x2, x1 - -// Digit 1 of [u] - - ldr x7, [u+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [v+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - str x2, [u+N] - adc x6, x6, x1 - -// Digit 2 of [u] - - ldr x7, [u+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [v+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - str x6, [u+2*N] - adc x5, x5, x1 - -// Digit 3 of [u] - - ldr x7, [u+3*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, xzr, x1 - ldr x8, [v+3*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - str x5, [u+3*N] - adc x3, x3, x1 - -// Digit 4 of [u] - - ldr x7, [u+4*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x3, x3, x0 - adc x4, xzr, x1 - ldr x8, [v+4*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x3, x3, x0 - str x3, [u+4*N] - adc x4, x4, x1 - -// Digits 5 and 6 of [u] (top is unsigned) - - ldr x7, [u+5*N] - eor x1, x7, s00 - and x2, s00, m00 - neg x2, x2 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, x4, x0 - adc x2, x2, x1 - ldr x8, [v+5*N] - eor x1, x8, s01 - and x0, s01, m01 - sub x2, x2, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - str x4, [u+5*N] - adc x2, x2, x1 - str x2, [u+6*N] - -// Montgomery reduction of u. This needs to be strict not "almost" -// so it is followed by an optional subtraction of p_384 - - ldp x10, x0, [u] - ldp x1, x2, [u+16] - ldp x3, x4, [u+32] - ldr x5, [u+48] - amontred(x5,x4,x3,x2,x1,x0,x10, x9,x8,x7) - - mov x10, #0x00000000ffffffff - subs x10, x0, x10 - mov x11, #0xffffffff00000000 - sbcs x11, x1, x11 - mov x12, #0xfffffffffffffffe - sbcs x12, x2, x12 - mov x15, #0xffffffffffffffff - sbcs x13, x3, x15 - sbcs x14, x4, x15 - sbcs x15, x5, x15 - - csel x0, x0, x10, cc - csel x1, x1, x11, cc - csel x2, x2, x12, cc - csel x3, x3, x13, cc - csel x4, x4, x14, cc - csel x5, x5, x15, cc - -// Store it back to the final output - - stp x0, x1, [res] - stp x2, x3, [res, #16] - stp x4, x5, [res, #32] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_inv_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_n384.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_n384.S deleted file mode 100644 index 5eb4bf45814..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_n384.S +++ /dev/null @@ -1,209 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_384 -// Input x[k]; output z[6] -// -// extern void bignum_mod_n384(uint64_t z[static 6], uint64_t k, -// const uint64_t *x); -// -// Reduction is modulo the group order of the NIST curve P-384. -// -// Standard ARM ABI: X0 = z, X1 = k, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n384) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n384_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n384_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n384_alt) - .text - .balign 4 - -#define z x0 -#define k x1 -#define x x2 - -#define m0 x3 -#define m1 x4 -#define m2 x5 -#define m3 x6 -#define m4 x7 -#define m5 x8 - -#define t0 x9 -#define t1 x10 -#define t2 x11 -#define t3 x12 -#define t4 x13 -#define t5 x14 - -#define n0 x15 -#define n1 x16 -#define n2 x17 - -// Aliased to t4 - -#define q x13 - -// Aliased to t5 - -#define d x14 - -// This is aliased to t5; we get one extra (free-ish?) reg-reg move in the -// main loop by not using an additional register, which seems an OK decision. - -#define t x14 - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(bignum_mod_n384): - -S2N_BN_SYMBOL(bignum_mod_n384_alt): - CFI_START - -// If the input is already <= 5 words long, go to a trivial "copy" path - - cmp k, #6 - bcc Lbignum_mod_n384_short - -// Otherwise load the top 6 digits (top-down) and reduce k by 6 - - sub k, k, #6 - lsl t0, k, #3 - add t0, t0, x - ldp m4, m5, [t0, #32] - ldp m2, m3, [t0, #16] - ldp m0, m1, [t0] - -// Load the complicated three words of 2^384 - n_384 = [0; 0; 0; n2; n1; n0] - - movbig( n0, #0x1313, #0xe695, #0x333a, #0xd68d) - movbig( n1, #0xa7e5, #0xf24d, #0xb74f, #0x5885) - movbig( n2, #0x389c, #0xb27e, #0x0bc8, #0xd220) - -// Reduce the top 6 digits mod n_384 (a conditional subtraction of n_384) - - adds t0, m0, n0 - adcs t1, m1, n1 - adcs t2, m2, n2 - adcs t3, m3, xzr - adcs t4, m4, xzr - adcs t5, m5, xzr - csel m0, m0, t0, cc - csel m1, m1, t1, cc - csel m2, m2, t2, cc - csel m3, m3, t3, cc - csel m4, m4, t4, cc - csel m5, m5, t5, cc - -// Now do (k-6) iterations of 7->6 word modular reduction - - cbz k, Lbignum_mod_n384_writeback -Lbignum_mod_n384_loop: - -// Compute q = min (m5 + 1) (2^64 - 1) - - adds q, m5, #1 - csetm t0, cs - orr q, q, t0 - -// [t3;t2;t1;t0] = q * (2^384 - n_384) - - mul t0, n0, q - mul t1, n1, q - mul t2, n2, q - - umulh t3, n0, q - adds t1, t1, t3 - umulh t3, n1, q - adcs t2, t2, t3 - umulh t3, n2, q - adc t3, xzr, t3 - -// Decrement k and load the next digit - - sub k, k, #1 - ldr d, [x, k, lsl #3] - -// Compensate for 2^384 * q - - sub m5, m5, q - -// [m5;m4;t4;t3;t2;t1;t0] = [m5;m4;m3;m2;m1;m0;d] - q * n_384 - - adds t0, d, t0 - adcs t1, m0, t1 - adcs t2, m1, t2 - adcs t3, m2, t3 - adcs t4, m3, xzr - adcs m4, m4, xzr - adc m5, m5, xzr - -// Now our top word m5 is either zero or all 1s. Use it for a masked -// addition of n_384, which we can do by a *subtraction* of -// 2^384 - n_384 from our portion, re-using the constants - - and t, m5, n0 - subs m0, t0, t - and t, m5, n1 - sbcs m1, t1, t - and t, m5, n2 - sbcs m2, t2, t - sbcs m3, t3, xzr - sbcs t, t4, xzr - sbc m5, m4, xzr - mov m4, t - - cbnz k, Lbignum_mod_n384_loop - -// Finally write back [m5;m4;m3;m2;m1;m0] and return - -Lbignum_mod_n384_writeback: - stp m0, m1, [z] - stp m2, m3, [z, #16] - stp m4, m5, [z, #32] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n384) - -// Short case: just copy the input with zero-padding - -Lbignum_mod_n384_short: - mov m0, xzr - mov m1, xzr - mov m2, xzr - mov m3, xzr - mov m4, xzr - mov m5, xzr - - cbz k, Lbignum_mod_n384_writeback - ldr m0, [x] - subs k, k, #1 - beq Lbignum_mod_n384_writeback - ldr m1, [x, #8] - subs k, k, #1 - beq Lbignum_mod_n384_writeback - ldr m2, [x, #16] - subs k, k, #1 - beq Lbignum_mod_n384_writeback - ldr m3, [x, #24] - subs k, k, #1 - beq Lbignum_mod_n384_writeback - ldr m4, [x, #32] - b Lbignum_mod_n384_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_n384_6.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_n384_6.S deleted file mode 100644 index a530304d65f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_n384_6.S +++ /dev/null @@ -1,93 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_384 -// Input x[6]; output z[6] -// -// extern void bignum_mod_n384_6(uint64_t z[static 6], const uint64_t x[static 6]); -// -// Reduction is modulo the group order of the NIST curve P-384. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n384_6) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n384_6) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n384_6) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define n0 x2 -#define n1 x3 -#define n2 x4 -#define n3 x5 -#define n4 x6 -#define n5 x7 - -#define d0 x8 -#define d1 x9 -#define d2 x10 -#define d3 x11 -#define d4 x12 -#define d5 x13 - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(bignum_mod_n384_6): - CFI_START - -// Load the complicated lower three words of n_384 - - movbig( n0, #0xecec, #0x196a, #0xccc5, #0x2973) - movbig( n1, #0x581a, #0x0db2, #0x48b0, #0xa77a) - movbig( n2, #0xc763, #0x4d81, #0xf437, #0x2ddf) - -// Load the input number - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - ldp d4, d5, [x, #32] - -// Do the subtraction. Since the top three words of n_384 are all 1s -// we can devolve the top to adding 0, thanks to the inverted carry. - - subs n0, d0, n0 - sbcs n1, d1, n1 - sbcs n2, d2, n2 - adcs n3, d3, xzr - adcs n4, d4, xzr - adcs n5, d5, xzr - -// Now if the carry is *clear* (inversion at work) the subtraction carried -// and hence we should have done nothing, so we reset each n_i = d_i - - csel n0, d0, n0, cc - csel n1, d1, n1, cc - csel n2, d2, n2, cc - csel n3, d3, n3, cc - csel n4, d4, n4, cc - csel n5, d5, n5, cc - -// Store the end result - - stp n0, n1, [z] - stp n2, n3, [z, #16] - stp n4, n5, [z, #32] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n384_6) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_p384.S deleted file mode 100644 index 2a10ff8495a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_p384.S +++ /dev/null @@ -1,182 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_384 -// Input x[k]; output z[6] -// -// extern void bignum_mod_p384(uint64_t z[static 6], uint64_t k, -// const uint64_t *x); -// -// Standard ARM ABI: X0 = z, X1 = k, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p384) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p384_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p384_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p384_alt) - .text - .balign 4 - -#define z x0 -#define k x1 -#define x x2 - -#define m0 x3 -#define m1 x4 -#define m2 x5 -#define m3 x6 -#define m4 x7 -#define m5 x8 - -#define t0 x9 -#define t1 x10 -#define t2 x11 -#define t3 x12 -#define t4 x13 -#define t5 x14 - -#define n0 x15 -#define n1 x16 -#define n2 x17 - - -S2N_BN_SYMBOL(bignum_mod_p384): - -S2N_BN_SYMBOL(bignum_mod_p384_alt): - CFI_START - -// If the input is already <= 5 words long, go to a trivial "copy" path - - cmp k, #6 - bcc Lbignum_mod_p384_short - -// Otherwise load the top 6 digits (top-down) and reduce k by 6 - - sub k, k, #6 - lsl t0, k, #3 - add t0, t0, x - ldp m4, m5, [t0, #32] - ldp m2, m3, [t0, #16] - ldp m0, m1, [t0] - -// Load the complicated lower three words of p_384 = [-1;-1;-1;n2;n1;n0] - - mov n0, #0x00000000ffffffff - mov n1, #0xffffffff00000000 - mov n2, #0xfffffffffffffffe - -// Reduce the top 6 digits mod p_384 (a conditional subtraction of p_384) - - subs t0, m0, n0 - sbcs t1, m1, n1 - sbcs t2, m2, n2 - adcs t3, m3, xzr - adcs t4, m4, xzr - adcs t5, m5, xzr - csel m0, m0, t0, cc - csel m1, m1, t1, cc - csel m2, m2, t2, cc - csel m3, m3, t3, cc - csel m4, m4, t4, cc - csel m5, m5, t5, cc - -// Now do (k-6) iterations of 7->6 word modular reduction - - cbz k, Lbignum_mod_p384_writeback -Lbignum_mod_p384_loop: - -// Decrement k and load the next digit as t5. We now want to reduce -// [m5;m4;m3;m2;m1;m0;t5] |-> [m5;m4;m3;m2;m1;m0]; the shuffling downwards is -// absorbed into the various ALU operations - - sub k, k, #1 - ldr t5, [x, k, lsl #3] - -// Initial quotient approximation q = min (h + 1) (2^64 - 1) - - adds m5, m5, #1 - csetm t3, cs - add m5, m5, t3 - orn n1, xzr, t3 - sub t2, m5, #1 - sub t1, xzr, m5 - -// Correction term [m5;t2;t1;t0] = q * (2^384 - p_384), using m5 as a temp - - lsl t0, t1, #32 - extr t1, t2, t1, #32 - lsr t2, t2, #32 - adds t0, t0, m5 - adcs t1, t1, xzr - adcs t2, t2, m5 - adc m5, xzr, xzr - -// Addition to the initial value - - adds t0, t5, t0 - adcs t1, m0, t1 - adcs t2, m1, t2 - adcs t3, m2, m5 - adcs t4, m3, xzr - adcs t5, m4, xzr - adc n1, n1, xzr - -// Use net top of the 7-word answer (now in n1) for masked correction - - and m5, n0, n1 - adds m0, t0, m5 - eor m5, m5, n1 - adcs m1, t1, m5 - and m5, n2, n1 - adcs m2, t2, m5 - adcs m3, t3, n1 - adcs m4, t4, n1 - adc m5, t5, n1 - - cbnz k, Lbignum_mod_p384_loop - -// Finally write back [m5;m4;m3;m2;m1;m0] and return - -Lbignum_mod_p384_writeback: - stp m0, m1, [z] - stp m2, m3, [z, #16] - stp m4, m5, [z, #32] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p384) - -// Short case: just copy the input with zero-padding - -Lbignum_mod_p384_short: - mov m0, xzr - mov m1, xzr - mov m2, xzr - mov m3, xzr - mov m4, xzr - mov m5, xzr - - cbz k, Lbignum_mod_p384_writeback - ldr m0, [x] - subs k, k, #1 - beq Lbignum_mod_p384_writeback - ldr m1, [x, #8] - subs k, k, #1 - beq Lbignum_mod_p384_writeback - ldr m2, [x, #16] - subs k, k, #1 - beq Lbignum_mod_p384_writeback - ldr m3, [x, #24] - subs k, k, #1 - beq Lbignum_mod_p384_writeback - ldr m4, [x, #32] - b Lbignum_mod_p384_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_p384_6.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_p384_6.S deleted file mode 100644 index 454143023fc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mod_p384_6.S +++ /dev/null @@ -1,86 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_384 -// Input x[6]; output z[6] -// -// extern void bignum_mod_p384_6(uint64_t z[static 6], const uint64_t x[static 6]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p384_6) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p384_6) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p384_6) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define n0 x2 -#define n1 x3 -#define n2 x4 -#define n3 x5 -#define n4 x6 -#define n5 x7 - -#define d0 x8 -#define d1 x9 -#define d2 x10 -#define d3 x11 -#define d4 x12 -#define d5 x13 - - -S2N_BN_SYMBOL(bignum_mod_p384_6): - CFI_START - -// Load the complicated lower three words of p_384 = [-1;-1;-1;n2;n1;n0] - - mov n0, #0x00000000ffffffff - mov n1, #0xffffffff00000000 - mov n2, #0xfffffffffffffffe - -// Load the input number - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - ldp d4, d5, [x, #32] - -// Do the subtraction. Since the top three words of p_384 are all 1s -// we can devolve the top to adding 0, thanks to the inverted carry. - - subs n0, d0, n0 - sbcs n1, d1, n1 - sbcs n2, d2, n2 - adcs n3, d3, xzr - adcs n4, d4, xzr - adcs n5, d5, xzr - -// Now if the carry is *clear* (inversion at work) the subtraction carried -// and hence we should have done nothing, so we reset each n_i = d_i - - csel n0, d0, n0, cc - csel n1, d1, n1, cc - csel n2, d2, n2, cc - csel n3, d3, n3, cc - csel n4, d4, n4, cc - csel n5, d5, n5, cc - -// Store the end result - - stp n0, n1, [z] - stp n2, n3, [z, #16] - stp n4, n5, [z, #32] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p384_6) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mux_6.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mux_6.S deleted file mode 100644 index 661e809f13b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_mux_6.S +++ /dev/null @@ -1,73 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// 384-bit multiplex/select z := x (if p nonzero) or z := y (if p zero) -// Inputs p, x[6], y[6]; output z[6] -// -// extern void bignum_mux_6(uint64_t p, uint64_t z[static 6], -// const uint64_t x[static 6], -// const uint64_t y[static 6]); -// -// It is assumed that all numbers x, y and z have the same size 6 digits. -// -// Standard ARM ABI: X0 = p, X1 = z, X2 = x, X3 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mux_6) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mux_6) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mux_6) - .text - .balign 4 - -#define p x0 -#define z x1 -#define x x2 -#define y x3 -#define a x4 - - -S2N_BN_SYMBOL(bignum_mux_6): - CFI_START - -cmp p, #0 // Set condition codes p = 0 - - ldr a, [x] - ldr p, [y] - csel a, a, p, ne - str a, [z] - - ldr a, [x, #8] - ldr p, [y, #8] - csel a, a, p, ne - str a, [z, #8] - - ldr a, [x, #16] - ldr p, [y, #16] - csel a, a, p, ne - str a, [z, #16] - - ldr a, [x, #24] - ldr p, [y, #24] - csel a, a, p, ne - str a, [z, #24] - - ldr a, [x, #32] - ldr p, [y, #32] - csel a, a, p, ne - str a, [z, #32] - - ldr a, [x, #40] - ldr p, [y, #40] - csel a, a, p, ne - str a, [z, #40] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mux_6) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_optneg_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_optneg_p384.S deleted file mode 100644 index e31a921ef26..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_optneg_p384.S +++ /dev/null @@ -1,102 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo p_384, z := (-x) mod p_384 (if p nonzero) or -// z := x (if p zero), assuming x reduced -// Inputs p, x[6]; output z[6] -// -// extern void bignum_optneg_p384(uint64_t z[static 6], uint64_t p, -// const uint64_t x[static 6]); -// -// Standard ARM ABI: X0 = z, X1 = p, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg_p384) - .text - .balign 4 - -#define z x0 -#define p x1 -#define x x2 - -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 -#define d4 x7 -#define d5 x8 -#define n0 x9 -#define n1 x10 -#define n2 x11 -#define n3 x12 -#define n4 x13 -#define n5 x14 - - -S2N_BN_SYMBOL(bignum_optneg_p384): - CFI_START - -// Load the 6 digits of x - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - ldp d4, d5, [x, #32] - -// Adjust p by zeroing it if the input is zero (to avoid giving -0 = p, which -// is not strictly reduced even though it's correct modulo p) - - orr n0, d0, d1 - orr n1, d2, d3 - orr n2, d4, d5 - orr n3, n0, n1 - orr n4, n2, n3 - cmp n4, #0 - csel p, xzr, p, eq - -// Load the complicated lower three words of p_384 = [-1;-1;-1;n2;n1;n0] and -1 - - mov n0, #0x00000000ffffffff - mov n1, #0xffffffff00000000 - mov n2, #0xfffffffffffffffe - mov n5, #0xffffffffffffffff - -// Do the subtraction, which by hypothesis does not underflow - - subs n0, n0, d0 - sbcs n1, n1, d1 - sbcs n2, n2, d2 - sbcs n3, n5, d3 - sbcs n4, n5, d4 - sbcs n5, n5, d5 - -// Set condition code if original x is nonzero and p was nonzero - - cmp p, #0 - -// Hence multiplex and write back - - csel n0, n0, d0, ne - csel n1, n1, d1, ne - csel n2, n2, d2, ne - csel n3, n3, d3, ne - csel n4, n4, d4, ne - csel n5, n5, d5, ne - - stp n0, n1, [z] - stp n2, n3, [z, #16] - stp n4, n5, [z, #32] - -// Return - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_triple_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_triple_p384.S deleted file mode 100644 index 53e3251ba1f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/bignum_triple_p384.S +++ /dev/null @@ -1,136 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_384, z := (3 * x) mod p_384 -// Input x[6]; output z[6] -// -// extern void bignum_triple_p384(uint64_t z[static 6], -// const uint64_t x[static 6]); -// -// The input x can be any 6-digit bignum, not necessarily reduced modulo p_384, -// and the result is always fully reduced, i.e. z = (3 * x) mod p_384. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p384) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p384_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p384_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p384_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x6 -#define d5 x7 -#define h x8 - -// Slightly offset aliases for the d_i for readability. - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define a4 x7 -#define a5 x8 - -// More aliases for the same thing at different stages - -#define q x8 -#define c x8 - -// Other temporary variables - -#define t0 x9 -#define t1 x10 - - -S2N_BN_SYMBOL(bignum_triple_p384): - -S2N_BN_SYMBOL(bignum_triple_p384_alt): - CFI_START - -// Load the inputs - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - ldp a4, a5, [x, #32] - -// First do the multiplication by 3, getting z = [h; d5; ...; d0] - - lsl d0, a0, #1 - adds d0, d0, a0 - extr d1, a1, a0, #63 - adcs d1, d1, a1 - extr d2, a2, a1, #63 - adcs d2, d2, a2 - extr d3, a3, a2, #63 - adcs d3, d3, a3 - extr d4, a4, a3, #63 - adcs d4, d4, a4 - extr d5, a5, a4, #63 - adcs d5, d5, a5 - lsr h, a5, #63 - adc h, h, xzr - -// For this limited range a simple quotient estimate of q = h + 1 works, where -// h = floor(z / 2^384). Then -p_384 <= z - q * p_384 < p_384, so we just need -// to subtract q * p_384 and then if that's negative, add back p_384. - - add q, h, #1 - -// Initial subtraction of z - q * p_384, with bitmask c for the carry -// Actually done as an addition of (z - 2^384 * h) + q * (2^384 - p_384) -// which, because q = h + 1, is exactly 2^384 + (z - q * p_384), and -// therefore CF <=> 2^384 + (z - q * p_384) >= 2^384 <=> z >= q * p_384. - - lsl t1, q, #32 - subs t0, q, t1 - sbc t1, t1, xzr - - adds d0, d0, t0 - adcs d1, d1, t1 - adcs d2, d2, q - adcs d3, d3, xzr - adcs d4, d4, xzr - adcs d5, d5, xzr - csetm c, cc - -// Use the bitmask c for final masked addition of p_384. - - mov t0, #0x00000000ffffffff - and t0, t0, c - adds d0, d0, t0 - eor t0, t0, c - adcs d1, d1, t0 - mov t0, #0xfffffffffffffffe - and t0, t0, c - adcs d2, d2, t0 - adcs d3, d3, c - adcs d4, d4, c - adc d5, d5, c - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjadd.S deleted file mode 100644 index 3b5e5534248..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjadd.S +++ /dev/null @@ -1,6440 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-384 in Montgomery-Jacobian coordinates -// -// extern void p384_montjadd(uint64_t p3[static 18], const uint64_t p1[static 18], -// const uint64_t p2[static 18]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^384 * x) mod p_384. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - -// This is functionally equivalent to p384_montjadd in unopt/p384_montjadd.S. -// This is the result of doing the following sequence of optimizations: -// 1. Function inlining -// 2. Eliminating redundant load/store instructions -// 3. Folding (add addr, const) + load/store -// Function inlining is done manually. The second and third optimizations are -// done by a script. - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p384_montjadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p384_montjadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p384_montjadd) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 48 - -// 7 NUMSIZEs for the point operation, one extra NUMSIZE for field operations - -#define NSPACE NUMSIZE*8 - -S2N_BN_SYMBOL(p384_montjadd): - CFI_START - -// Save regs and make room on stack for temporary variables - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_PUSH1Z(x27) - CFI_DEC_SP(NSPACE) - - mov x24, x0 - mov x25, x1 - mov x26, x2 - mov x0, sp - ldr q1, [x25, #96] - ldp x9, x2, [x25, #96] - ldr q0, [x25, #96] - ldp x4, x6, [x25, #112] - rev64 v21.4s, v1.4s - uzp2 v28.4s, v1.4s, v1.4s - umulh x7, x9, x2 - xtn v17.2s, v1.2d - mul v27.4s, v21.4s, v0.4s - ldr q20, [x25, #128] - xtn v30.2s, v0.2d - ldr q1, [x25, #128] - uzp2 v31.4s, v0.4s, v0.4s - ldp x5, x10, [x25, #128] - umulh x8, x9, x4 - uaddlp v3.2d, v27.4s - umull v16.2d, v30.2s, v17.2s - mul x16, x9, x4 - umull v27.2d, v30.2s, v28.2s - shrn v0.2s, v20.2d, #32 - xtn v7.2s, v20.2d - shl v20.2d, v3.2d, #32 - umull v3.2d, v31.2s, v28.2s - mul x3, x2, x4 - umlal v20.2d, v30.2s, v17.2s - umull v22.2d, v7.2s, v0.2s - usra v27.2d, v16.2d, #32 - umulh x11, x2, x4 - movi v21.2d, #0xffffffff - uzp2 v28.4s, v1.4s, v1.4s - adds x15, x16, x7 - and v5.16b, v27.16b, v21.16b - adcs x3, x3, x8 - usra v3.2d, v27.2d, #32 - dup v29.2d, x6 - adcs x16, x11, xzr - mov x14, v20.d[0] - umlal v5.2d, v31.2s, v17.2s - mul x8, x9, x2 - mov x7, v20.d[1] - shl v19.2d, v22.2d, #33 - xtn v25.2s, v29.2d - rev64 v31.4s, v1.4s - lsl x13, x14, #32 - uzp2 v6.4s, v29.4s, v29.4s - umlal v19.2d, v7.2s, v7.2s - usra v3.2d, v5.2d, #32 - adds x1, x8, x8 - umulh x8, x4, x4 - add x12, x13, x14 - mul v17.4s, v31.4s, v29.4s - xtn v4.2s, v1.2d - adcs x14, x15, x15 - lsr x13, x12, #32 - adcs x15, x3, x3 - umull v31.2d, v25.2s, v28.2s - adcs x11, x16, x16 - umull v21.2d, v25.2s, v4.2s - mov x17, v3.d[0] - umull v18.2d, v6.2s, v28.2s - adc x16, x8, xzr - uaddlp v16.2d, v17.4s - movi v1.2d, #0xffffffff - subs x13, x13, x12 - usra v31.2d, v21.2d, #32 - sbc x8, x12, xzr - adds x17, x17, x1 - mul x1, x4, x4 - shl v28.2d, v16.2d, #32 - mov x3, v3.d[1] - adcs x14, x7, x14 - extr x7, x8, x13, #32 - adcs x13, x3, x15 - and v3.16b, v31.16b, v1.16b - adcs x11, x1, x11 - lsr x1, x8, #32 - umlal v3.2d, v6.2s, v4.2s - usra v18.2d, v31.2d, #32 - adc x3, x16, xzr - adds x1, x1, x12 - umlal v28.2d, v25.2s, v4.2s - adc x16, xzr, xzr - subs x15, x17, x7 - sbcs x7, x14, x1 - lsl x1, x15, #32 - sbcs x16, x13, x16 - add x8, x1, x15 - usra v18.2d, v3.2d, #32 - sbcs x14, x11, xzr - lsr x1, x8, #32 - sbcs x17, x3, xzr - sbc x11, x12, xzr - subs x13, x1, x8 - umulh x12, x4, x10 - sbc x1, x8, xzr - extr x13, x1, x13, #32 - lsr x1, x1, #32 - adds x15, x1, x8 - adc x1, xzr, xzr - subs x7, x7, x13 - sbcs x13, x16, x15 - lsl x3, x7, #32 - umulh x16, x2, x5 - sbcs x15, x14, x1 - add x7, x3, x7 - sbcs x3, x17, xzr - lsr x1, x7, #32 - sbcs x14, x11, xzr - sbc x11, x8, xzr - subs x8, x1, x7 - sbc x1, x7, xzr - extr x8, x1, x8, #32 - lsr x1, x1, #32 - adds x1, x1, x7 - adc x17, xzr, xzr - subs x13, x13, x8 - umulh x8, x9, x6 - sbcs x1, x15, x1 - sbcs x15, x3, x17 - sbcs x3, x14, xzr - mul x17, x2, x5 - sbcs x11, x11, xzr - stp x13, x1, [x0] - sbc x14, x7, xzr - mul x7, x4, x10 - subs x1, x9, x2 - stp x15, x3, [x0, #16] - csetm x15, cc - cneg x1, x1, cc - stp x11, x14, [x0, #32] - mul x14, x9, x6 - adds x17, x8, x17 - adcs x7, x16, x7 - adc x13, x12, xzr - subs x12, x5, x6 - cneg x3, x12, cc - cinv x16, x15, cc - mul x8, x1, x3 - umulh x1, x1, x3 - eor x12, x8, x16 - adds x11, x17, x14 - adcs x3, x7, x17 - adcs x15, x13, x7 - adc x8, x13, xzr - adds x3, x3, x14 - adcs x15, x15, x17 - adcs x17, x8, x7 - eor x1, x1, x16 - adc x13, x13, xzr - subs x9, x9, x4 - csetm x8, cc - cneg x9, x9, cc - subs x4, x2, x4 - cneg x4, x4, cc - csetm x7, cc - subs x2, x10, x6 - cinv x8, x8, cc - cneg x2, x2, cc - cmn x16, #0x1 - adcs x11, x11, x12 - mul x12, x9, x2 - adcs x3, x3, x1 - adcs x15, x15, x16 - umulh x9, x9, x2 - adcs x17, x17, x16 - adc x13, x13, x16 - subs x1, x10, x5 - cinv x2, x7, cc - cneg x1, x1, cc - eor x9, x9, x8 - cmn x8, #0x1 - eor x7, x12, x8 - mul x12, x4, x1 - adcs x3, x3, x7 - adcs x7, x15, x9 - adcs x15, x17, x8 - ldp x9, x17, [x0, #16] - umulh x4, x4, x1 - adc x8, x13, x8 - cmn x2, #0x1 - eor x1, x12, x2 - adcs x1, x7, x1 - ldp x7, x16, [x0] - eor x12, x4, x2 - adcs x4, x15, x12 - ldp x15, x12, [x0, #32] - adc x8, x8, x2 - adds x13, x14, x14 - umulh x14, x5, x10 - adcs x2, x11, x11 - adcs x3, x3, x3 - adcs x1, x1, x1 - adcs x4, x4, x4 - adcs x11, x8, x8 - adc x8, xzr, xzr - adds x13, x13, x7 - adcs x2, x2, x16 - mul x16, x5, x10 - adcs x3, x3, x9 - adcs x1, x1, x17 - umulh x5, x5, x5 - lsl x9, x13, #32 - add x9, x9, x13 - adcs x4, x4, x15 - mov x13, v28.d[1] - adcs x15, x11, x12 - lsr x7, x9, #32 - adc x11, x8, xzr - subs x7, x7, x9 - umulh x10, x10, x10 - sbc x17, x9, xzr - extr x7, x17, x7, #32 - lsr x17, x17, #32 - adds x17, x17, x9 - adc x12, xzr, xzr - subs x8, x2, x7 - sbcs x17, x3, x17 - lsl x7, x8, #32 - sbcs x2, x1, x12 - add x3, x7, x8 - sbcs x12, x4, xzr - lsr x1, x3, #32 - sbcs x7, x15, xzr - sbc x15, x9, xzr - subs x1, x1, x3 - sbc x4, x3, xzr - lsr x9, x4, #32 - extr x8, x4, x1, #32 - adds x9, x9, x3 - adc x4, xzr, xzr - subs x1, x17, x8 - lsl x17, x1, #32 - sbcs x8, x2, x9 - sbcs x9, x12, x4 - add x17, x17, x1 - mov x1, v18.d[1] - lsr x2, x17, #32 - sbcs x7, x7, xzr - mov x12, v18.d[0] - sbcs x15, x15, xzr - sbc x3, x3, xzr - subs x4, x2, x17 - sbc x2, x17, xzr - adds x12, x13, x12 - adcs x16, x16, x1 - lsr x13, x2, #32 - extr x1, x2, x4, #32 - adc x2, x14, xzr - adds x4, x13, x17 - mul x13, x6, x6 - adc x14, xzr, xzr - subs x1, x8, x1 - sbcs x4, x9, x4 - mov x9, v28.d[0] - sbcs x7, x7, x14 - sbcs x8, x15, xzr - sbcs x3, x3, xzr - sbc x14, x17, xzr - adds x17, x9, x9 - adcs x12, x12, x12 - mov x15, v19.d[0] - adcs x9, x16, x16 - umulh x6, x6, x6 - adcs x16, x2, x2 - adc x2, xzr, xzr - adds x11, x11, x8 - adcs x3, x3, xzr - adcs x14, x14, xzr - adcs x8, xzr, xzr - adds x13, x1, x13 - mov x1, v19.d[1] - adcs x6, x4, x6 - mov x4, #0xffffffff - adcs x15, x7, x15 - adcs x7, x11, x5 - adcs x1, x3, x1 - adcs x14, x14, x10 - adc x11, x8, xzr - adds x6, x6, x17 - adcs x8, x15, x12 - adcs x3, x7, x9 - adcs x15, x1, x16 - mov x16, #0xffffffff00000001 - adcs x14, x14, x2 - mov x2, #0x1 - adc x17, x11, xzr - cmn x13, x16 - adcs xzr, x6, x4 - adcs xzr, x8, x2 - adcs xzr, x3, xzr - adcs xzr, x15, xzr - adcs xzr, x14, xzr - adc x1, x17, xzr - neg x9, x1 - and x1, x16, x9 - adds x11, x13, x1 - and x13, x4, x9 - adcs x5, x6, x13 - and x1, x2, x9 - adcs x7, x8, x1 - stp x11, x5, [x0] - adcs x11, x3, xzr - adcs x2, x15, xzr - stp x7, x11, [x0, #16] - adc x17, x14, xzr - stp x2, x17, [x0, #32] - ldr q1, [x26, #96] - ldp x9, x2, [x26, #96] - ldr q0, [x26, #96] - ldp x4, x6, [x26, #112] - rev64 v21.4s, v1.4s - uzp2 v28.4s, v1.4s, v1.4s - umulh x7, x9, x2 - xtn v17.2s, v1.2d - mul v27.4s, v21.4s, v0.4s - ldr q20, [x26, #128] - xtn v30.2s, v0.2d - ldr q1, [x26, #128] - uzp2 v31.4s, v0.4s, v0.4s - ldp x5, x10, [x26, #128] - umulh x8, x9, x4 - uaddlp v3.2d, v27.4s - umull v16.2d, v30.2s, v17.2s - mul x16, x9, x4 - umull v27.2d, v30.2s, v28.2s - shrn v0.2s, v20.2d, #32 - xtn v7.2s, v20.2d - shl v20.2d, v3.2d, #32 - umull v3.2d, v31.2s, v28.2s - mul x3, x2, x4 - umlal v20.2d, v30.2s, v17.2s - umull v22.2d, v7.2s, v0.2s - usra v27.2d, v16.2d, #32 - umulh x11, x2, x4 - movi v21.2d, #0xffffffff - uzp2 v28.4s, v1.4s, v1.4s - adds x15, x16, x7 - and v5.16b, v27.16b, v21.16b - adcs x3, x3, x8 - usra v3.2d, v27.2d, #32 - dup v29.2d, x6 - adcs x16, x11, xzr - mov x14, v20.d[0] - umlal v5.2d, v31.2s, v17.2s - mul x8, x9, x2 - mov x7, v20.d[1] - shl v19.2d, v22.2d, #33 - xtn v25.2s, v29.2d - rev64 v31.4s, v1.4s - lsl x13, x14, #32 - uzp2 v6.4s, v29.4s, v29.4s - umlal v19.2d, v7.2s, v7.2s - usra v3.2d, v5.2d, #32 - adds x1, x8, x8 - umulh x8, x4, x4 - add x12, x13, x14 - mul v17.4s, v31.4s, v29.4s - xtn v4.2s, v1.2d - adcs x14, x15, x15 - lsr x13, x12, #32 - adcs x15, x3, x3 - umull v31.2d, v25.2s, v28.2s - adcs x11, x16, x16 - umull v21.2d, v25.2s, v4.2s - mov x17, v3.d[0] - umull v18.2d, v6.2s, v28.2s - adc x16, x8, xzr - uaddlp v16.2d, v17.4s - movi v1.2d, #0xffffffff - subs x13, x13, x12 - usra v31.2d, v21.2d, #32 - sbc x8, x12, xzr - adds x17, x17, x1 - mul x1, x4, x4 - shl v28.2d, v16.2d, #32 - mov x3, v3.d[1] - adcs x14, x7, x14 - extr x7, x8, x13, #32 - adcs x13, x3, x15 - and v3.16b, v31.16b, v1.16b - adcs x11, x1, x11 - lsr x1, x8, #32 - umlal v3.2d, v6.2s, v4.2s - usra v18.2d, v31.2d, #32 - adc x3, x16, xzr - adds x1, x1, x12 - umlal v28.2d, v25.2s, v4.2s - adc x16, xzr, xzr - subs x15, x17, x7 - sbcs x7, x14, x1 - lsl x1, x15, #32 - sbcs x16, x13, x16 - add x8, x1, x15 - usra v18.2d, v3.2d, #32 - sbcs x14, x11, xzr - lsr x1, x8, #32 - sbcs x17, x3, xzr - sbc x11, x12, xzr - subs x13, x1, x8 - umulh x12, x4, x10 - sbc x1, x8, xzr - extr x13, x1, x13, #32 - lsr x1, x1, #32 - adds x15, x1, x8 - adc x1, xzr, xzr - subs x7, x7, x13 - sbcs x13, x16, x15 - lsl x3, x7, #32 - umulh x16, x2, x5 - sbcs x15, x14, x1 - add x7, x3, x7 - sbcs x3, x17, xzr - lsr x1, x7, #32 - sbcs x14, x11, xzr - sbc x11, x8, xzr - subs x8, x1, x7 - sbc x1, x7, xzr - extr x8, x1, x8, #32 - lsr x1, x1, #32 - adds x1, x1, x7 - adc x17, xzr, xzr - subs x13, x13, x8 - umulh x8, x9, x6 - sbcs x1, x15, x1 - sbcs x15, x3, x17 - sbcs x3, x14, xzr - mul x17, x2, x5 - sbcs x11, x11, xzr - stp x13, x1, [sp, #240] - sbc x14, x7, xzr - mul x7, x4, x10 - subs x1, x9, x2 - stp x15, x3, [sp, #256] - csetm x15, cc - cneg x1, x1, cc - stp x11, x14, [sp, #272] - mul x14, x9, x6 - adds x17, x8, x17 - adcs x7, x16, x7 - adc x13, x12, xzr - subs x12, x5, x6 - cneg x3, x12, cc - cinv x16, x15, cc - mul x8, x1, x3 - umulh x1, x1, x3 - eor x12, x8, x16 - adds x11, x17, x14 - adcs x3, x7, x17 - adcs x15, x13, x7 - adc x8, x13, xzr - adds x3, x3, x14 - adcs x15, x15, x17 - adcs x17, x8, x7 - eor x1, x1, x16 - adc x13, x13, xzr - subs x9, x9, x4 - csetm x8, cc - cneg x9, x9, cc - subs x4, x2, x4 - cneg x4, x4, cc - csetm x7, cc - subs x2, x10, x6 - cinv x8, x8, cc - cneg x2, x2, cc - cmn x16, #0x1 - adcs x11, x11, x12 - mul x12, x9, x2 - adcs x3, x3, x1 - adcs x15, x15, x16 - umulh x9, x9, x2 - adcs x17, x17, x16 - adc x13, x13, x16 - subs x1, x10, x5 - cinv x2, x7, cc - cneg x1, x1, cc - eor x9, x9, x8 - cmn x8, #0x1 - eor x7, x12, x8 - mul x12, x4, x1 - adcs x3, x3, x7 - adcs x7, x15, x9 - adcs x15, x17, x8 - ldp x9, x17, [sp, #256] - umulh x4, x4, x1 - adc x8, x13, x8 - cmn x2, #0x1 - eor x1, x12, x2 - adcs x1, x7, x1 - ldp x7, x16, [sp, #240] - eor x12, x4, x2 - adcs x4, x15, x12 - ldp x15, x12, [sp, #272] - adc x8, x8, x2 - adds x13, x14, x14 - umulh x14, x5, x10 - adcs x2, x11, x11 - adcs x3, x3, x3 - adcs x1, x1, x1 - adcs x4, x4, x4 - adcs x11, x8, x8 - adc x8, xzr, xzr - adds x13, x13, x7 - adcs x2, x2, x16 - mul x16, x5, x10 - adcs x3, x3, x9 - adcs x1, x1, x17 - umulh x5, x5, x5 - lsl x9, x13, #32 - add x9, x9, x13 - adcs x4, x4, x15 - mov x13, v28.d[1] - adcs x15, x11, x12 - lsr x7, x9, #32 - adc x11, x8, xzr - subs x7, x7, x9 - umulh x10, x10, x10 - sbc x17, x9, xzr - extr x7, x17, x7, #32 - lsr x17, x17, #32 - adds x17, x17, x9 - adc x12, xzr, xzr - subs x8, x2, x7 - sbcs x17, x3, x17 - lsl x7, x8, #32 - sbcs x2, x1, x12 - add x3, x7, x8 - sbcs x12, x4, xzr - lsr x1, x3, #32 - sbcs x7, x15, xzr - sbc x15, x9, xzr - subs x1, x1, x3 - sbc x4, x3, xzr - lsr x9, x4, #32 - extr x8, x4, x1, #32 - adds x9, x9, x3 - adc x4, xzr, xzr - subs x1, x17, x8 - lsl x17, x1, #32 - sbcs x8, x2, x9 - sbcs x9, x12, x4 - add x17, x17, x1 - mov x1, v18.d[1] - lsr x2, x17, #32 - sbcs x7, x7, xzr - mov x12, v18.d[0] - sbcs x15, x15, xzr - sbc x3, x3, xzr - subs x4, x2, x17 - sbc x2, x17, xzr - adds x12, x13, x12 - adcs x16, x16, x1 - lsr x13, x2, #32 - extr x1, x2, x4, #32 - adc x2, x14, xzr - adds x4, x13, x17 - mul x13, x6, x6 - adc x14, xzr, xzr - subs x1, x8, x1 - sbcs x4, x9, x4 - mov x9, v28.d[0] - sbcs x7, x7, x14 - sbcs x8, x15, xzr - sbcs x3, x3, xzr - sbc x14, x17, xzr - adds x17, x9, x9 - adcs x12, x12, x12 - mov x15, v19.d[0] - adcs x9, x16, x16 - umulh x6, x6, x6 - adcs x16, x2, x2 - adc x2, xzr, xzr - adds x11, x11, x8 - adcs x3, x3, xzr - adcs x14, x14, xzr - adcs x8, xzr, xzr - adds x13, x1, x13 - mov x1, v19.d[1] - adcs x6, x4, x6 - mov x4, #0xffffffff - adcs x15, x7, x15 - adcs x7, x11, x5 - adcs x1, x3, x1 - adcs x14, x14, x10 - adc x11, x8, xzr - adds x6, x6, x17 - adcs x8, x15, x12 - adcs x3, x7, x9 - adcs x15, x1, x16 - mov x16, #0xffffffff00000001 - adcs x14, x14, x2 - mov x2, #0x1 - adc x17, x11, xzr - cmn x13, x16 - adcs xzr, x6, x4 - adcs xzr, x8, x2 - adcs xzr, x3, xzr - adcs xzr, x15, xzr - adcs xzr, x14, xzr - adc x1, x17, xzr - neg x9, x1 - and x1, x16, x9 - adds x11, x13, x1 - and x13, x4, x9 - adcs x5, x6, x13 - and x1, x2, x9 - adcs x7, x8, x1 - stp x11, x5, [sp, #240] - adcs x11, x3, xzr - adcs x2, x15, xzr - stp x7, x11, [sp, #256] - adc x17, x14, xzr - stp x2, x17, [sp, #272] - stp x23, x24, [sp, #0x150] // It is #-48 after inlining, but access to sp+negative in the middle of fn is bad - ldr q3, [x26, #96] - ldr q25, [x25, #48] - ldp x13, x23, [x25, #48] - ldp x3, x21, [x26, #96] - rev64 v23.4s, v25.4s - uzp1 v17.4s, v25.4s, v3.4s - umulh x15, x3, x13 - mul v6.4s, v23.4s, v3.4s - uzp1 v3.4s, v3.4s, v3.4s - ldr q27, [x25, #80] - ldp x8, x24, [x26, #112] - subs x6, x3, x21 - ldr q0, [x26, #128] - movi v23.2d, #0xffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4s, v27.4s - uzp2 v25.4s, v27.4s, v27.4s - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2s, v0.2d - xtn v24.2s, v27.2d - cneg x20, x7, cc - ldp x6, x14, [x25, #64] - mul v27.4s, v4.4s, v0.4s - uaddlp v20.2d, v6.4s - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4s, v0.4s, v0.4s - umull v21.2d, v22.2s, v25.2s - shl v0.2d, v20.2d, #32 - umlal v0.2d, v3.2s, v17.2s - mul x22, x8, x6 - umull v1.2d, v6.2s, v25.2s - subs x12, x3, x8 - umull v20.2d, v22.2s, v24.2s - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2d, v20.2d, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2d, v21.2d, #32 - adds x22, x15, x7 - and v26.16b, v21.16b, v23.16b - adcs x16, x12, x15 - uaddlp v25.2d, v27.4s - adcs x9, x19, x12 - umlal v26.2d, v6.2s, v24.2s - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2d, v25.2d, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2d, v22.2s, v24.2s - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2d, v26.2d, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [x25, #80] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [x26, #128] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [sp, #288] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [sp, #304] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [sp, #320] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [sp, #288] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [sp, #304] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [sp, #320] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [sp, #288] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [sp, #304] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [sp, #320] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [sp, #288] - ldp x21, x12, [sp, #304] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [sp, #320] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x14, x24, x11 - stp x22, x5, [sp, #288] - adcs x5, x13, x23 - adcs x21, x8, x23 - stp x14, x5, [sp, #304] - adc x12, x15, x23 - stp x21, x12, [sp, #320] - ldr q3, [x25, #96] - ldr q25, [x26, #48] - ldp x13, x23, [x26, #48] - ldp x3, x21, [x25, #96] - rev64 v23.4s, v25.4s - uzp1 v17.4s, v25.4s, v3.4s - umulh x15, x3, x13 - mul v6.4s, v23.4s, v3.4s - uzp1 v3.4s, v3.4s, v3.4s - ldr q27, [x26, #80] - ldp x8, x24, [x25, #112] - subs x6, x3, x21 - ldr q0, [x25, #128] - movi v23.2d, #0xffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4s, v27.4s - uzp2 v25.4s, v27.4s, v27.4s - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2s, v0.2d - xtn v24.2s, v27.2d - cneg x20, x7, cc - ldp x6, x14, [x26, #64] - mul v27.4s, v4.4s, v0.4s - uaddlp v20.2d, v6.4s - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4s, v0.4s, v0.4s - umull v21.2d, v22.2s, v25.2s - shl v0.2d, v20.2d, #32 - umlal v0.2d, v3.2s, v17.2s - mul x22, x8, x6 - umull v1.2d, v6.2s, v25.2s - subs x12, x3, x8 - umull v20.2d, v22.2s, v24.2s - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2d, v20.2d, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2d, v21.2d, #32 - adds x22, x15, x7 - and v26.16b, v21.16b, v23.16b - adcs x16, x12, x15 - uaddlp v25.2d, v27.4s - adcs x9, x19, x12 - umlal v26.2d, v6.2s, v24.2s - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2d, v25.2d, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2d, v22.2s, v24.2s - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2d, v26.2d, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [x26, #80] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [x25, #128] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [sp, #48] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [sp, #64] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [sp, #80] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [sp, #48] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [sp, #64] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [sp, #80] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [sp, #48] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [sp, #64] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [sp, #80] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [sp, #48] - ldp x21, x12, [sp, #64] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [sp, #80] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x14, x24, x11 - stp x22, x5, [sp, #48] - adcs x5, x13, x23 - adcs x21, x8, x23 - stp x14, x5, [sp, #64] - adc x12, x15, x23 - stp x21, x12, [sp, #80] - mov x1, sp - ldr q3, [x1] - ldr q25, [x26, #0] - ldp x13, x23, [x26, #0] - ldp x3, x21, [x1] - rev64 v23.4s, v25.4s - uzp1 v17.4s, v25.4s, v3.4s - umulh x15, x3, x13 - mul v6.4s, v23.4s, v3.4s - uzp1 v3.4s, v3.4s, v3.4s - ldr q27, [x26, #32] - ldp x8, x24, [x1, #16] - subs x6, x3, x21 - ldr q0, [x1, #32] - movi v23.2d, #0xffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4s, v27.4s - uzp2 v25.4s, v27.4s, v27.4s - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2s, v0.2d - xtn v24.2s, v27.2d - cneg x20, x7, cc - ldp x6, x14, [x26, #16] - mul v27.4s, v4.4s, v0.4s - uaddlp v20.2d, v6.4s - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4s, v0.4s, v0.4s - umull v21.2d, v22.2s, v25.2s - shl v0.2d, v20.2d, #32 - umlal v0.2d, v3.2s, v17.2s - mul x22, x8, x6 - umull v1.2d, v6.2s, v25.2s - subs x12, x3, x8 - umull v20.2d, v22.2s, v24.2s - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2d, v20.2d, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2d, v21.2d, #32 - adds x22, x15, x7 - and v26.16b, v21.16b, v23.16b - adcs x16, x12, x15 - uaddlp v25.2d, v27.4s - adcs x9, x19, x12 - umlal v26.2d, v6.2s, v24.2s - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2d, v25.2d, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2d, v22.2s, v24.2s - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2d, v26.2d, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [x26, #32] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [x1, #32] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [sp, #96] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [sp, #112] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [sp, #128] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [sp, #96] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [sp, #112] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [sp, #128] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [sp, #96] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [sp, #112] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [sp, #128] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [sp, #96] - ldp x21, x12, [sp, #112] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [sp, #128] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x14, x24, x11 - stp x22, x5, [sp, #96] - adcs x5, x13, x23 - adcs x21, x8, x23 - stp x14, x5, [sp, #112] - adc x12, x15, x23 - stp x21, x12, [sp, #128] - ldr q3, [sp, #240] - ldr q25, [x25, #0] - ldp x13, x23, [x25, #0] - ldp x3, x21, [sp, #240] - rev64 v23.4s, v25.4s - uzp1 v17.4s, v25.4s, v3.4s - umulh x15, x3, x13 - mul v6.4s, v23.4s, v3.4s - uzp1 v3.4s, v3.4s, v3.4s - ldr q27, [x25, #32] - ldp x8, x24, [sp, #256] - subs x6, x3, x21 - ldr q0, [sp, #272] - movi v23.2d, #0xffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4s, v27.4s - uzp2 v25.4s, v27.4s, v27.4s - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2s, v0.2d - xtn v24.2s, v27.2d - cneg x20, x7, cc - ldp x6, x14, [x25, #16] - mul v27.4s, v4.4s, v0.4s - uaddlp v20.2d, v6.4s - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4s, v0.4s, v0.4s - umull v21.2d, v22.2s, v25.2s - shl v0.2d, v20.2d, #32 - umlal v0.2d, v3.2s, v17.2s - mul x22, x8, x6 - umull v1.2d, v6.2s, v25.2s - subs x12, x3, x8 - umull v20.2d, v22.2s, v24.2s - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2d, v20.2d, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2d, v21.2d, #32 - adds x22, x15, x7 - and v26.16b, v21.16b, v23.16b - adcs x16, x12, x15 - uaddlp v25.2d, v27.4s - adcs x9, x19, x12 - umlal v26.2d, v6.2s, v24.2s - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2d, v25.2d, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2d, v22.2s, v24.2s - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2d, v26.2d, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [x25, #32] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [sp, #272] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [sp, #192] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [sp, #208] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [sp, #224] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [sp, #192] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [sp, #208] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [sp, #224] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [sp, #192] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [sp, #208] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [sp, #224] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [sp, #192] - ldp x21, x12, [sp, #208] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [sp, #224] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x14, x24, x11 - stp x22, x5, [sp, #192] - adcs x5, x13, x23 - adcs x21, x8, x23 - stp x14, x5, [sp, #208] - adc x12, x15, x23 - stp x21, x12, [sp, #224] - mov x1, sp - ldr q3, [x1] - ldr q25, [sp, #48] - ldp x13, x23, [sp, #48] - ldp x3, x21, [x1] - rev64 v23.4s, v25.4s - uzp1 v17.4s, v25.4s, v3.4s - umulh x15, x3, x13 - mul v6.4s, v23.4s, v3.4s - uzp1 v3.4s, v3.4s, v3.4s - ldr q27, [sp, #80] - ldp x8, x24, [x1, #16] - subs x6, x3, x21 - ldr q0, [x1, #32] - movi v23.2d, #0xffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4s, v27.4s - uzp2 v25.4s, v27.4s, v27.4s - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2s, v0.2d - xtn v24.2s, v27.2d - cneg x20, x7, cc - ldp x6, x14, [sp, #64] - mul v27.4s, v4.4s, v0.4s - uaddlp v20.2d, v6.4s - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4s, v0.4s, v0.4s - umull v21.2d, v22.2s, v25.2s - shl v0.2d, v20.2d, #32 - umlal v0.2d, v3.2s, v17.2s - mul x22, x8, x6 - umull v1.2d, v6.2s, v25.2s - subs x12, x3, x8 - umull v20.2d, v22.2s, v24.2s - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2d, v20.2d, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2d, v21.2d, #32 - adds x22, x15, x7 - and v26.16b, v21.16b, v23.16b - adcs x16, x12, x15 - uaddlp v25.2d, v27.4s - adcs x9, x19, x12 - umlal v26.2d, v6.2s, v24.2s - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2d, v25.2d, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2d, v22.2s, v24.2s - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2d, v26.2d, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [sp, #80] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [x1, #32] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [sp, #48] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [sp, #64] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [sp, #80] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [sp, #48] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [sp, #64] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [sp, #80] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [sp, #48] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [sp, #64] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [sp, #80] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [sp, #48] - ldp x21, x12, [sp, #64] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [sp, #80] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x14, x24, x11 - stp x22, x5, [sp, #48] - adcs x5, x13, x23 - adcs x21, x8, x23 - stp x14, x5, [sp, #64] - adc x12, x15, x23 - stp x21, x12, [sp, #80] - ldr q3, [sp, #240] - ldr q25, [sp, #288] - ldp x13, x23, [sp, #288] - ldp x3, x21, [sp, #240] - rev64 v23.4s, v25.4s - uzp1 v17.4s, v25.4s, v3.4s - umulh x15, x3, x13 - mul v6.4s, v23.4s, v3.4s - uzp1 v3.4s, v3.4s, v3.4s - ldr q27, [sp, #320] - ldp x8, x24, [sp, #256] - subs x6, x3, x21 - ldr q0, [sp, #272] - movi v23.2d, #0xffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4s, v27.4s - uzp2 v25.4s, v27.4s, v27.4s - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2s, v0.2d - xtn v24.2s, v27.2d - cneg x20, x7, cc - ldp x6, x14, [sp, #304] - mul v27.4s, v4.4s, v0.4s - uaddlp v20.2d, v6.4s - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4s, v0.4s, v0.4s - umull v21.2d, v22.2s, v25.2s - shl v0.2d, v20.2d, #32 - umlal v0.2d, v3.2s, v17.2s - mul x22, x8, x6 - umull v1.2d, v6.2s, v25.2s - subs x12, x3, x8 - umull v20.2d, v22.2s, v24.2s - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2d, v20.2d, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2d, v21.2d, #32 - adds x22, x15, x7 - and v26.16b, v21.16b, v23.16b - adcs x16, x12, x15 - uaddlp v25.2d, v27.4s - adcs x9, x19, x12 - umlal v26.2d, v6.2s, v24.2s - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2d, v25.2d, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2d, v22.2s, v24.2s - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2d, v26.2d, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [sp, #320] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [sp, #272] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [sp, #288] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [sp, #304] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [sp, #320] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [sp, #288] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [sp, #304] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [sp, #320] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [sp, #288] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [sp, #304] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [sp, #320] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [sp, #288] - ldp x21, x12, [sp, #304] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [sp, #320] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x2, x24, x11 - stp x22, x5, [sp, #288] - adcs x11, x13, x23 - adcs x12, x8, x23 - stp x2, x11, [sp, #304] - adc x13, x15, x23 - stp x12, x13, [sp, #320] - ldp x5, x6, [sp, #96] - ldp x4, x3, [sp, #192] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #112] - ldp x4, x3, [sp, #208] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - ldp x9, x10, [sp, #128] - ldp x4, x3, [sp, #224] - sbcs x9, x9, x4 - sbcs x10, x10, x3 - csetm x3, cc - mov x4, #0xffffffff - and x4, x4, x3 - adds x5, x5, x4 - eor x4, x4, x3 - adcs x6, x6, x4 - mov x4, #0xfffffffffffffffe - and x4, x4, x3 - adcs x7, x7, x4 - adcs x8, x8, x3 - adcs x9, x9, x3 - adc x10, x10, x3 - stp x5, x6, [sp, #240] - stp x7, x8, [sp, #256] - stp x9, x10, [sp, #272] - ldp x5, x6, [sp, #48] - ldp x4, x3, [sp, #288] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #64] - sbcs x7, x7, x2 - sbcs x8, x8, x11 - ldp x9, x10, [sp, #80] - sbcs x9, x9, x12 - sbcs x10, x10, x13 - csetm x3, cc - mov x4, #0xffffffff - and x4, x4, x3 - adds x5, x5, x4 - eor x4, x4, x3 - adcs x6, x6, x4 - mov x4, #0xfffffffffffffffe - and x4, x4, x3 - adcs x7, x7, x4 - adcs x8, x8, x3 - adcs x9, x9, x3 - adc x10, x10, x3 - stp x5, x6, [sp, #48] - stp x7, x8, [sp, #64] - stp x9, x10, [sp, #80] - ldr q1, [sp, #240] - ldp x9, x2, [sp, #240] - ldr q0, [sp, #240] - ldp x4, x6, [sp, #256] - rev64 v21.4s, v1.4s - uzp2 v28.4s, v1.4s, v1.4s - umulh x7, x9, x2 - xtn v17.2s, v1.2d - mul v27.4s, v21.4s, v0.4s - ldr q20, [sp, #272] - xtn v30.2s, v0.2d - ldr q1, [sp, #272] - uzp2 v31.4s, v0.4s, v0.4s - ldp x5, x10, [sp, #272] - umulh x8, x9, x4 - uaddlp v3.2d, v27.4s - umull v16.2d, v30.2s, v17.2s - mul x16, x9, x4 - umull v27.2d, v30.2s, v28.2s - shrn v0.2s, v20.2d, #32 - xtn v7.2s, v20.2d - shl v20.2d, v3.2d, #32 - umull v3.2d, v31.2s, v28.2s - mul x3, x2, x4 - umlal v20.2d, v30.2s, v17.2s - umull v22.2d, v7.2s, v0.2s - usra v27.2d, v16.2d, #32 - umulh x11, x2, x4 - movi v21.2d, #0xffffffff - uzp2 v28.4s, v1.4s, v1.4s - adds x15, x16, x7 - and v5.16b, v27.16b, v21.16b - adcs x3, x3, x8 - usra v3.2d, v27.2d, #32 - dup v29.2d, x6 - adcs x16, x11, xzr - mov x14, v20.d[0] - umlal v5.2d, v31.2s, v17.2s - mul x8, x9, x2 - mov x7, v20.d[1] - shl v19.2d, v22.2d, #33 - xtn v25.2s, v29.2d - rev64 v31.4s, v1.4s - lsl x13, x14, #32 - uzp2 v6.4s, v29.4s, v29.4s - umlal v19.2d, v7.2s, v7.2s - usra v3.2d, v5.2d, #32 - adds x1, x8, x8 - umulh x8, x4, x4 - add x12, x13, x14 - mul v17.4s, v31.4s, v29.4s - xtn v4.2s, v1.2d - adcs x14, x15, x15 - lsr x13, x12, #32 - adcs x15, x3, x3 - umull v31.2d, v25.2s, v28.2s - adcs x11, x16, x16 - umull v21.2d, v25.2s, v4.2s - mov x17, v3.d[0] - umull v18.2d, v6.2s, v28.2s - adc x16, x8, xzr - uaddlp v16.2d, v17.4s - movi v1.2d, #0xffffffff - subs x13, x13, x12 - usra v31.2d, v21.2d, #32 - sbc x8, x12, xzr - adds x17, x17, x1 - mul x1, x4, x4 - shl v28.2d, v16.2d, #32 - mov x3, v3.d[1] - adcs x14, x7, x14 - extr x7, x8, x13, #32 - adcs x13, x3, x15 - and v3.16b, v31.16b, v1.16b - adcs x11, x1, x11 - lsr x1, x8, #32 - umlal v3.2d, v6.2s, v4.2s - usra v18.2d, v31.2d, #32 - adc x3, x16, xzr - adds x1, x1, x12 - umlal v28.2d, v25.2s, v4.2s - adc x16, xzr, xzr - subs x15, x17, x7 - sbcs x7, x14, x1 - lsl x1, x15, #32 - sbcs x16, x13, x16 - add x8, x1, x15 - usra v18.2d, v3.2d, #32 - sbcs x14, x11, xzr - lsr x1, x8, #32 - sbcs x17, x3, xzr - sbc x11, x12, xzr - subs x13, x1, x8 - umulh x12, x4, x10 - sbc x1, x8, xzr - extr x13, x1, x13, #32 - lsr x1, x1, #32 - adds x15, x1, x8 - adc x1, xzr, xzr - subs x7, x7, x13 - sbcs x13, x16, x15 - lsl x3, x7, #32 - umulh x16, x2, x5 - sbcs x15, x14, x1 - add x7, x3, x7 - sbcs x3, x17, xzr - lsr x1, x7, #32 - sbcs x14, x11, xzr - sbc x11, x8, xzr - subs x8, x1, x7 - sbc x1, x7, xzr - extr x8, x1, x8, #32 - lsr x1, x1, #32 - adds x1, x1, x7 - adc x17, xzr, xzr - subs x13, x13, x8 - umulh x8, x9, x6 - sbcs x1, x15, x1 - sbcs x15, x3, x17 - sbcs x3, x14, xzr - mul x17, x2, x5 - sbcs x11, x11, xzr - stp x13, x1, [sp, #144] - sbc x14, x7, xzr - mul x7, x4, x10 - subs x1, x9, x2 - stp x15, x3, [sp, #160] - csetm x15, cc - cneg x1, x1, cc - stp x11, x14, [sp, #176] - mul x14, x9, x6 - adds x17, x8, x17 - adcs x7, x16, x7 - adc x13, x12, xzr - subs x12, x5, x6 - cneg x3, x12, cc - cinv x16, x15, cc - mul x8, x1, x3 - umulh x1, x1, x3 - eor x12, x8, x16 - adds x11, x17, x14 - adcs x3, x7, x17 - adcs x15, x13, x7 - adc x8, x13, xzr - adds x3, x3, x14 - adcs x15, x15, x17 - adcs x17, x8, x7 - eor x1, x1, x16 - adc x13, x13, xzr - subs x9, x9, x4 - csetm x8, cc - cneg x9, x9, cc - subs x4, x2, x4 - cneg x4, x4, cc - csetm x7, cc - subs x2, x10, x6 - cinv x8, x8, cc - cneg x2, x2, cc - cmn x16, #0x1 - adcs x11, x11, x12 - mul x12, x9, x2 - adcs x3, x3, x1 - adcs x15, x15, x16 - umulh x9, x9, x2 - adcs x17, x17, x16 - adc x13, x13, x16 - subs x1, x10, x5 - cinv x2, x7, cc - cneg x1, x1, cc - eor x9, x9, x8 - cmn x8, #0x1 - eor x7, x12, x8 - mul x12, x4, x1 - adcs x3, x3, x7 - adcs x7, x15, x9 - adcs x15, x17, x8 - ldp x9, x17, [sp, #160] - umulh x4, x4, x1 - adc x8, x13, x8 - cmn x2, #0x1 - eor x1, x12, x2 - adcs x1, x7, x1 - ldp x7, x16, [sp, #144] - eor x12, x4, x2 - adcs x4, x15, x12 - ldp x15, x12, [sp, #176] - adc x8, x8, x2 - adds x13, x14, x14 - umulh x14, x5, x10 - adcs x2, x11, x11 - adcs x3, x3, x3 - adcs x1, x1, x1 - adcs x4, x4, x4 - adcs x11, x8, x8 - adc x8, xzr, xzr - adds x13, x13, x7 - adcs x2, x2, x16 - mul x16, x5, x10 - adcs x3, x3, x9 - adcs x1, x1, x17 - umulh x5, x5, x5 - lsl x9, x13, #32 - add x9, x9, x13 - adcs x4, x4, x15 - mov x13, v28.d[1] - adcs x15, x11, x12 - lsr x7, x9, #32 - adc x11, x8, xzr - subs x7, x7, x9 - umulh x10, x10, x10 - sbc x17, x9, xzr - extr x7, x17, x7, #32 - lsr x17, x17, #32 - adds x17, x17, x9 - adc x12, xzr, xzr - subs x8, x2, x7 - sbcs x17, x3, x17 - lsl x7, x8, #32 - sbcs x2, x1, x12 - add x3, x7, x8 - sbcs x12, x4, xzr - lsr x1, x3, #32 - sbcs x7, x15, xzr - sbc x15, x9, xzr - subs x1, x1, x3 - sbc x4, x3, xzr - lsr x9, x4, #32 - extr x8, x4, x1, #32 - adds x9, x9, x3 - adc x4, xzr, xzr - subs x1, x17, x8 - lsl x17, x1, #32 - sbcs x8, x2, x9 - sbcs x9, x12, x4 - add x17, x17, x1 - mov x1, v18.d[1] - lsr x2, x17, #32 - sbcs x7, x7, xzr - mov x12, v18.d[0] - sbcs x15, x15, xzr - sbc x3, x3, xzr - subs x4, x2, x17 - sbc x2, x17, xzr - adds x12, x13, x12 - adcs x16, x16, x1 - lsr x13, x2, #32 - extr x1, x2, x4, #32 - adc x2, x14, xzr - adds x4, x13, x17 - mul x13, x6, x6 - adc x14, xzr, xzr - subs x1, x8, x1 - sbcs x4, x9, x4 - mov x9, v28.d[0] - sbcs x7, x7, x14 - sbcs x8, x15, xzr - sbcs x3, x3, xzr - sbc x14, x17, xzr - adds x17, x9, x9 - adcs x12, x12, x12 - mov x15, v19.d[0] - adcs x9, x16, x16 - umulh x6, x6, x6 - adcs x16, x2, x2 - adc x2, xzr, xzr - adds x11, x11, x8 - adcs x3, x3, xzr - adcs x14, x14, xzr - adcs x8, xzr, xzr - adds x13, x1, x13 - mov x1, v19.d[1] - adcs x6, x4, x6 - mov x4, #0xffffffff - adcs x15, x7, x15 - adcs x7, x11, x5 - adcs x1, x3, x1 - adcs x14, x14, x10 - adc x11, x8, xzr - adds x6, x6, x17 - adcs x8, x15, x12 - adcs x3, x7, x9 - adcs x15, x1, x16 - mov x16, #0xffffffff00000001 - adcs x14, x14, x2 - mov x2, #0x1 - adc x17, x11, xzr - cmn x13, x16 - adcs xzr, x6, x4 - adcs xzr, x8, x2 - adcs xzr, x3, xzr - adcs xzr, x15, xzr - adcs xzr, x14, xzr - adc x1, x17, xzr - neg x9, x1 - and x1, x16, x9 - adds x11, x13, x1 - and x13, x4, x9 - adcs x5, x6, x13 - and x1, x2, x9 - adcs x7, x8, x1 - stp x11, x5, [sp, #144] - adcs x11, x3, xzr - adcs x2, x15, xzr - stp x7, x11, [sp, #160] - adc x17, x14, xzr - stp x2, x17, [sp, #176] - mov x0, sp - ldr q1, [sp, #48] - ldp x9, x2, [sp, #48] - ldr q0, [sp, #48] - ldp x4, x6, [sp, #64] - rev64 v21.4s, v1.4s - uzp2 v28.4s, v1.4s, v1.4s - umulh x7, x9, x2 - xtn v17.2s, v1.2d - mul v27.4s, v21.4s, v0.4s - ldr q20, [sp, #80] - xtn v30.2s, v0.2d - ldr q1, [sp, #80] - uzp2 v31.4s, v0.4s, v0.4s - ldp x5, x10, [sp, #80] - umulh x8, x9, x4 - uaddlp v3.2d, v27.4s - umull v16.2d, v30.2s, v17.2s - mul x16, x9, x4 - umull v27.2d, v30.2s, v28.2s - shrn v0.2s, v20.2d, #32 - xtn v7.2s, v20.2d - shl v20.2d, v3.2d, #32 - umull v3.2d, v31.2s, v28.2s - mul x3, x2, x4 - umlal v20.2d, v30.2s, v17.2s - umull v22.2d, v7.2s, v0.2s - usra v27.2d, v16.2d, #32 - umulh x11, x2, x4 - movi v21.2d, #0xffffffff - uzp2 v28.4s, v1.4s, v1.4s - adds x15, x16, x7 - and v5.16b, v27.16b, v21.16b - adcs x3, x3, x8 - usra v3.2d, v27.2d, #32 - dup v29.2d, x6 - adcs x16, x11, xzr - mov x14, v20.d[0] - umlal v5.2d, v31.2s, v17.2s - mul x8, x9, x2 - mov x7, v20.d[1] - shl v19.2d, v22.2d, #33 - xtn v25.2s, v29.2d - rev64 v31.4s, v1.4s - lsl x13, x14, #32 - uzp2 v6.4s, v29.4s, v29.4s - umlal v19.2d, v7.2s, v7.2s - usra v3.2d, v5.2d, #32 - adds x1, x8, x8 - umulh x8, x4, x4 - add x12, x13, x14 - mul v17.4s, v31.4s, v29.4s - xtn v4.2s, v1.2d - adcs x14, x15, x15 - lsr x13, x12, #32 - adcs x15, x3, x3 - umull v31.2d, v25.2s, v28.2s - adcs x11, x16, x16 - umull v21.2d, v25.2s, v4.2s - mov x17, v3.d[0] - umull v18.2d, v6.2s, v28.2s - adc x16, x8, xzr - uaddlp v16.2d, v17.4s - movi v1.2d, #0xffffffff - subs x13, x13, x12 - usra v31.2d, v21.2d, #32 - sbc x8, x12, xzr - adds x17, x17, x1 - mul x1, x4, x4 - shl v28.2d, v16.2d, #32 - mov x3, v3.d[1] - adcs x14, x7, x14 - extr x7, x8, x13, #32 - adcs x13, x3, x15 - and v3.16b, v31.16b, v1.16b - adcs x11, x1, x11 - lsr x1, x8, #32 - umlal v3.2d, v6.2s, v4.2s - usra v18.2d, v31.2d, #32 - adc x3, x16, xzr - adds x1, x1, x12 - umlal v28.2d, v25.2s, v4.2s - adc x16, xzr, xzr - subs x15, x17, x7 - sbcs x7, x14, x1 - lsl x1, x15, #32 - sbcs x16, x13, x16 - add x8, x1, x15 - usra v18.2d, v3.2d, #32 - sbcs x14, x11, xzr - lsr x1, x8, #32 - sbcs x17, x3, xzr - sbc x11, x12, xzr - subs x13, x1, x8 - umulh x12, x4, x10 - sbc x1, x8, xzr - extr x13, x1, x13, #32 - lsr x1, x1, #32 - adds x15, x1, x8 - adc x1, xzr, xzr - subs x7, x7, x13 - sbcs x13, x16, x15 - lsl x3, x7, #32 - umulh x16, x2, x5 - sbcs x15, x14, x1 - add x7, x3, x7 - sbcs x3, x17, xzr - lsr x1, x7, #32 - sbcs x14, x11, xzr - sbc x11, x8, xzr - subs x8, x1, x7 - sbc x1, x7, xzr - extr x8, x1, x8, #32 - lsr x1, x1, #32 - adds x1, x1, x7 - adc x17, xzr, xzr - subs x13, x13, x8 - umulh x8, x9, x6 - sbcs x1, x15, x1 - sbcs x15, x3, x17 - sbcs x3, x14, xzr - mul x17, x2, x5 - sbcs x11, x11, xzr - stp x13, x1, [x0] - sbc x14, x7, xzr - mul x7, x4, x10 - subs x1, x9, x2 - stp x15, x3, [x0, #16] - csetm x15, cc - cneg x1, x1, cc - stp x11, x14, [x0, #32] - mul x14, x9, x6 - adds x17, x8, x17 - adcs x7, x16, x7 - adc x13, x12, xzr - subs x12, x5, x6 - cneg x3, x12, cc - cinv x16, x15, cc - mul x8, x1, x3 - umulh x1, x1, x3 - eor x12, x8, x16 - adds x11, x17, x14 - adcs x3, x7, x17 - adcs x15, x13, x7 - adc x8, x13, xzr - adds x3, x3, x14 - adcs x15, x15, x17 - adcs x17, x8, x7 - eor x1, x1, x16 - adc x13, x13, xzr - subs x9, x9, x4 - csetm x8, cc - cneg x9, x9, cc - subs x4, x2, x4 - cneg x4, x4, cc - csetm x7, cc - subs x2, x10, x6 - cinv x8, x8, cc - cneg x2, x2, cc - cmn x16, #0x1 - adcs x11, x11, x12 - mul x12, x9, x2 - adcs x3, x3, x1 - adcs x15, x15, x16 - umulh x9, x9, x2 - adcs x17, x17, x16 - adc x13, x13, x16 - subs x1, x10, x5 - cinv x2, x7, cc - cneg x1, x1, cc - eor x9, x9, x8 - cmn x8, #0x1 - eor x7, x12, x8 - mul x12, x4, x1 - adcs x3, x3, x7 - adcs x7, x15, x9 - adcs x15, x17, x8 - ldp x9, x17, [x0, #16] - umulh x4, x4, x1 - adc x8, x13, x8 - cmn x2, #0x1 - eor x1, x12, x2 - adcs x1, x7, x1 - ldp x7, x16, [x0] - eor x12, x4, x2 - adcs x4, x15, x12 - ldp x15, x12, [x0, #32] - adc x8, x8, x2 - adds x13, x14, x14 - umulh x14, x5, x10 - adcs x2, x11, x11 - adcs x3, x3, x3 - adcs x1, x1, x1 - adcs x4, x4, x4 - adcs x11, x8, x8 - adc x8, xzr, xzr - adds x13, x13, x7 - adcs x2, x2, x16 - mul x16, x5, x10 - adcs x3, x3, x9 - adcs x1, x1, x17 - umulh x5, x5, x5 - lsl x9, x13, #32 - add x9, x9, x13 - adcs x4, x4, x15 - mov x13, v28.d[1] - adcs x15, x11, x12 - lsr x7, x9, #32 - adc x11, x8, xzr - subs x7, x7, x9 - umulh x10, x10, x10 - sbc x17, x9, xzr - extr x7, x17, x7, #32 - lsr x17, x17, #32 - adds x17, x17, x9 - adc x12, xzr, xzr - subs x8, x2, x7 - sbcs x17, x3, x17 - lsl x7, x8, #32 - sbcs x2, x1, x12 - add x3, x7, x8 - sbcs x12, x4, xzr - lsr x1, x3, #32 - sbcs x7, x15, xzr - sbc x15, x9, xzr - subs x1, x1, x3 - sbc x4, x3, xzr - lsr x9, x4, #32 - extr x8, x4, x1, #32 - adds x9, x9, x3 - adc x4, xzr, xzr - subs x1, x17, x8 - lsl x17, x1, #32 - sbcs x8, x2, x9 - sbcs x9, x12, x4 - add x17, x17, x1 - mov x1, v18.d[1] - lsr x2, x17, #32 - sbcs x7, x7, xzr - mov x12, v18.d[0] - sbcs x15, x15, xzr - sbc x3, x3, xzr - subs x4, x2, x17 - sbc x2, x17, xzr - adds x12, x13, x12 - adcs x16, x16, x1 - lsr x13, x2, #32 - extr x1, x2, x4, #32 - adc x2, x14, xzr - adds x4, x13, x17 - mul x13, x6, x6 - adc x14, xzr, xzr - subs x1, x8, x1 - sbcs x4, x9, x4 - mov x9, v28.d[0] - sbcs x7, x7, x14 - sbcs x8, x15, xzr - sbcs x3, x3, xzr - sbc x14, x17, xzr - adds x17, x9, x9 - adcs x12, x12, x12 - mov x15, v19.d[0] - adcs x9, x16, x16 - umulh x6, x6, x6 - adcs x16, x2, x2 - adc x2, xzr, xzr - adds x11, x11, x8 - adcs x3, x3, xzr - adcs x14, x14, xzr - adcs x8, xzr, xzr - adds x13, x1, x13 - mov x1, v19.d[1] - adcs x6, x4, x6 - mov x4, #0xffffffff - adcs x15, x7, x15 - adcs x7, x11, x5 - adcs x1, x3, x1 - adcs x14, x14, x10 - adc x11, x8, xzr - adds x6, x6, x17 - adcs x8, x15, x12 - adcs x3, x7, x9 - adcs x15, x1, x16 - mov x16, #0xffffffff00000001 - adcs x14, x14, x2 - mov x2, #0x1 - adc x17, x11, xzr - cmn x13, x16 - adcs xzr, x6, x4 - adcs xzr, x8, x2 - adcs xzr, x3, xzr - adcs xzr, x15, xzr - adcs xzr, x14, xzr - adc x1, x17, xzr - neg x9, x1 - and x1, x16, x9 - adds x11, x13, x1 - and x13, x4, x9 - adcs x5, x6, x13 - and x1, x2, x9 - adcs x7, x8, x1 - stp x11, x5, [x0] - adcs x11, x3, xzr - adcs x2, x15, xzr - stp x7, x11, [x0, #16] - adc x17, x14, xzr - stp x2, x17, [x0, #32] - ldr q3, [sp, #144] - ldr q25, [sp, #192] - ldp x13, x23, [sp, #192] - ldp x3, x21, [sp, #144] - rev64 v23.4s, v25.4s - uzp1 v17.4s, v25.4s, v3.4s - umulh x15, x3, x13 - mul v6.4s, v23.4s, v3.4s - uzp1 v3.4s, v3.4s, v3.4s - ldr q27, [sp, #224] - ldp x8, x24, [sp, #160] - subs x6, x3, x21 - ldr q0, [sp, #176] - movi v23.2d, #0xffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4s, v27.4s - uzp2 v25.4s, v27.4s, v27.4s - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2s, v0.2d - xtn v24.2s, v27.2d - cneg x20, x7, cc - ldp x6, x14, [sp, #208] - mul v27.4s, v4.4s, v0.4s - uaddlp v20.2d, v6.4s - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4s, v0.4s, v0.4s - umull v21.2d, v22.2s, v25.2s - shl v0.2d, v20.2d, #32 - umlal v0.2d, v3.2s, v17.2s - mul x22, x8, x6 - umull v1.2d, v6.2s, v25.2s - subs x12, x3, x8 - umull v20.2d, v22.2s, v24.2s - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2d, v20.2d, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2d, v21.2d, #32 - adds x22, x15, x7 - and v26.16b, v21.16b, v23.16b - adcs x16, x12, x15 - uaddlp v25.2d, v27.4s - adcs x9, x19, x12 - umlal v26.2d, v6.2s, v24.2s - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2d, v25.2d, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2d, v22.2s, v24.2s - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2d, v26.2d, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [sp, #224] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [sp, #176] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [sp, #192] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [sp, #208] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [sp, #224] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [sp, #192] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [sp, #208] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [sp, #224] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [sp, #192] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [sp, #208] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [sp, #224] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [sp, #192] - ldp x21, x12, [sp, #208] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [sp, #224] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x14, x24, x11 - stp x22, x5, [sp, #192] - adcs x5, x13, x23 - adcs x21, x8, x23 - stp x14, x5, [sp, #208] - adc x12, x15, x23 - stp x21, x12, [sp, #224] - ldr q3, [sp, #144] - ldr q25, [sp, #96] - ldp x13, x23, [sp, #96] - ldp x3, x21, [sp, #144] - rev64 v23.4s, v25.4s - uzp1 v17.4s, v25.4s, v3.4s - umulh x15, x3, x13 - mul v6.4s, v23.4s, v3.4s - uzp1 v3.4s, v3.4s, v3.4s - ldr q27, [sp, #128] - ldp x8, x24, [sp, #160] - subs x6, x3, x21 - ldr q0, [sp, #176] - movi v23.2d, #0xffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4s, v27.4s - uzp2 v25.4s, v27.4s, v27.4s - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2s, v0.2d - xtn v24.2s, v27.2d - cneg x20, x7, cc - ldp x6, x14, [sp, #112] - mul v27.4s, v4.4s, v0.4s - uaddlp v20.2d, v6.4s - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4s, v0.4s, v0.4s - umull v21.2d, v22.2s, v25.2s - shl v0.2d, v20.2d, #32 - umlal v0.2d, v3.2s, v17.2s - mul x22, x8, x6 - umull v1.2d, v6.2s, v25.2s - subs x12, x3, x8 - umull v20.2d, v22.2s, v24.2s - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2d, v20.2d, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2d, v21.2d, #32 - adds x22, x15, x7 - and v26.16b, v21.16b, v23.16b - adcs x16, x12, x15 - uaddlp v25.2d, v27.4s - adcs x9, x19, x12 - umlal v26.2d, v6.2s, v24.2s - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2d, v25.2d, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2d, v22.2s, v24.2s - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2d, v26.2d, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [sp, #128] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [sp, #176] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [sp, #96] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [sp, #112] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [sp, #128] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [sp, #96] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [sp, #112] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [sp, #128] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [sp, #96] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [sp, #112] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [sp, #128] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [sp, #96] - ldp x21, x12, [sp, #112] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [sp, #128] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x2, x24, x11 - stp x22, x5, [sp, #96] - adcs x11, x13, x23 - adcs x12, x8, x23 - stp x2, x11, [sp, #112] - adc x13, x15, x23 - stp x12, x13, [sp, #128] - mov x0, sp - mov x1, sp - ldp x5, x6, [x1] - ldp x4, x3, [sp, #192] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [x1, #16] - ldp x4, x3, [sp, #208] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - ldp x9, x10, [x1, #32] - ldp x4, x3, [sp, #224] - sbcs x9, x9, x4 - sbcs x10, x10, x3 - csetm x3, cc - mov x4, #0xffffffff - and x4, x4, x3 - adds x5, x5, x4 - eor x4, x4, x3 - adcs x6, x6, x4 - mov x4, #0xfffffffffffffffe - and x4, x4, x3 - adcs x7, x7, x4 - adcs x8, x8, x3 - adcs x9, x9, x3 - adc x10, x10, x3 - stp x5, x6, [x0] - stp x7, x8, [x0, #16] - stp x9, x10, [x0, #32] - ldp x5, x6, [sp, #96] - ldp x4, x3, [sp, #192] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x4, x3, [sp, #208] - sbcs x7, x2, x4 - sbcs x8, x11, x3 - ldp x4, x3, [sp, #224] - sbcs x9, x12, x4 - sbcs x10, x13, x3 - csetm x3, cc - mov x4, #0xffffffff - and x4, x4, x3 - adds x5, x5, x4 - eor x4, x4, x3 - adcs x6, x6, x4 - mov x4, #0xfffffffffffffffe - and x4, x4, x3 - adcs x7, x7, x4 - adcs x8, x8, x3 - adcs x9, x9, x3 - adc x10, x10, x3 - stp x5, x6, [sp, #144] - stp x7, x8, [sp, #160] - stp x9, x10, [sp, #176] - ldr q3, [sp, #240] - ldr q25, [x25, #96] - ldp x13, x23, [x25, #96] - ldp x3, x21, [sp, #240] - rev64 v23.4s, v25.4s - uzp1 v17.4s, v25.4s, v3.4s - umulh x15, x3, x13 - mul v6.4s, v23.4s, v3.4s - uzp1 v3.4s, v3.4s, v3.4s - ldr q27, [x25, #128] - ldp x8, x24, [sp, #256] - subs x6, x3, x21 - ldr q0, [sp, #272] - movi v23.2d, #0xffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4s, v27.4s - uzp2 v25.4s, v27.4s, v27.4s - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2s, v0.2d - xtn v24.2s, v27.2d - cneg x20, x7, cc - ldp x6, x14, [x25, #112] - mul v27.4s, v4.4s, v0.4s - uaddlp v20.2d, v6.4s - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4s, v0.4s, v0.4s - umull v21.2d, v22.2s, v25.2s - shl v0.2d, v20.2d, #32 - umlal v0.2d, v3.2s, v17.2s - mul x22, x8, x6 - umull v1.2d, v6.2s, v25.2s - subs x12, x3, x8 - umull v20.2d, v22.2s, v24.2s - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2d, v20.2d, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2d, v21.2d, #32 - adds x22, x15, x7 - and v26.16b, v21.16b, v23.16b - adcs x16, x12, x15 - uaddlp v25.2d, v27.4s - adcs x9, x19, x12 - umlal v26.2d, v6.2s, v24.2s - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2d, v25.2d, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2d, v22.2s, v24.2s - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2d, v26.2d, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [x25, #128] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [sp, #272] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [sp, #240] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [sp, #256] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [sp, #272] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [sp, #240] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [sp, #256] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [sp, #272] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [sp, #240] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [sp, #256] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [sp, #272] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [sp, #240] - ldp x21, x12, [sp, #256] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [sp, #272] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x14, x24, x11 - stp x22, x5, [sp, #240] - adcs x5, x13, x23 - adcs x21, x8, x23 - stp x14, x5, [sp, #256] - adc x12, x15, x23 - stp x21, x12, [sp, #272] - mov x0, sp - mov x1, sp - ldp x5, x6, [x1] - ldp x4, x3, [sp, #96] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [x1, #16] - ldp x4, x3, [sp, #112] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - ldp x9, x10, [x1, #32] - ldp x4, x3, [sp, #128] - sbcs x9, x9, x4 - sbcs x10, x10, x3 - csetm x3, cc - mov x4, #0xffffffff - and x4, x4, x3 - adds x2, x5, x4 - eor x4, x4, x3 - adcs x11, x6, x4 - mov x4, #0xfffffffffffffffe - and x4, x4, x3 - adcs x4, x7, x4 - adcs x12, x8, x3 - adcs x13, x9, x3 - adc x3, x10, x3 - stp x2, x11, [x0] - stp x4, x12, [x0, #16] - stp x13, x3, [x0, #32] - ldp x5, x6, [sp, #192] - subs x5, x5, x2 - sbcs x6, x6, x11 - ldp x7, x8, [sp, #208] - sbcs x7, x7, x4 - sbcs x8, x8, x12 - ldp x9, x10, [sp, #224] - sbcs x9, x9, x13 - sbcs x10, x10, x3 - csetm x3, cc - mov x4, #0xffffffff - and x4, x4, x3 - adds x5, x5, x4 - eor x4, x4, x3 - adcs x6, x6, x4 - mov x4, #0xfffffffffffffffe - and x4, x4, x3 - adcs x7, x7, x4 - adcs x8, x8, x3 - adcs x9, x9, x3 - adc x10, x10, x3 - stp x5, x6, [sp, #192] - stp x7, x8, [sp, #208] - stp x9, x10, [sp, #224] - ldr q3, [sp, #144] - ldr q25, [sp, #288] - ldp x13, x23, [sp, #288] - ldp x3, x21, [sp, #144] - rev64 v23.4s, v25.4s - uzp1 v17.4s, v25.4s, v3.4s - umulh x15, x3, x13 - mul v6.4s, v23.4s, v3.4s - uzp1 v3.4s, v3.4s, v3.4s - ldr q27, [sp, #320] - ldp x8, x24, [sp, #160] - subs x6, x3, x21 - ldr q0, [sp, #176] - movi v23.2d, #0xffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4s, v27.4s - uzp2 v25.4s, v27.4s, v27.4s - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2s, v0.2d - xtn v24.2s, v27.2d - cneg x20, x7, cc - ldp x6, x14, [sp, #304] - mul v27.4s, v4.4s, v0.4s - uaddlp v20.2d, v6.4s - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4s, v0.4s, v0.4s - umull v21.2d, v22.2s, v25.2s - shl v0.2d, v20.2d, #32 - umlal v0.2d, v3.2s, v17.2s - mul x22, x8, x6 - umull v1.2d, v6.2s, v25.2s - subs x12, x3, x8 - umull v20.2d, v22.2s, v24.2s - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2d, v20.2d, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2d, v21.2d, #32 - adds x22, x15, x7 - and v26.16b, v21.16b, v23.16b - adcs x16, x12, x15 - uaddlp v25.2d, v27.4s - adcs x9, x19, x12 - umlal v26.2d, v6.2s, v24.2s - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2d, v25.2d, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2d, v22.2s, v24.2s - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2d, v26.2d, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [sp, #320] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [sp, #176] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [sp, #144] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [sp, #160] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [sp, #176] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [sp, #144] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [sp, #160] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [sp, #176] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [sp, #144] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [sp, #160] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [sp, #176] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [sp, #144] - ldp x21, x12, [sp, #160] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [sp, #176] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x14, x24, x11 - stp x22, x5, [sp, #144] - adcs x5, x13, x23 - adcs x21, x8, x23 - stp x14, x5, [sp, #160] - adc x12, x15, x23 - stp x21, x12, [sp, #176] - ldr q3, [sp, #240] - ldr q25, [x26, #96] - ldp x13, x23, [x26, #96] - ldp x3, x21, [sp, #240] - rev64 v23.4s, v25.4s - uzp1 v17.4s, v25.4s, v3.4s - umulh x15, x3, x13 - mul v6.4s, v23.4s, v3.4s - uzp1 v3.4s, v3.4s, v3.4s - ldr q27, [x26, #128] - ldp x8, x24, [sp, #256] - subs x6, x3, x21 - ldr q0, [sp, #272] - movi v23.2d, #0xffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4s, v27.4s - uzp2 v25.4s, v27.4s, v27.4s - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2s, v0.2d - xtn v24.2s, v27.2d - cneg x20, x7, cc - ldp x6, x14, [x26, #112] - mul v27.4s, v4.4s, v0.4s - uaddlp v20.2d, v6.4s - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4s, v0.4s, v0.4s - umull v21.2d, v22.2s, v25.2s - shl v0.2d, v20.2d, #32 - umlal v0.2d, v3.2s, v17.2s - mul x22, x8, x6 - umull v1.2d, v6.2s, v25.2s - subs x12, x3, x8 - umull v20.2d, v22.2s, v24.2s - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2d, v20.2d, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2d, v21.2d, #32 - adds x22, x15, x7 - and v26.16b, v21.16b, v23.16b - adcs x16, x12, x15 - uaddlp v25.2d, v27.4s - adcs x9, x19, x12 - umlal v26.2d, v6.2s, v24.2s - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2d, v25.2d, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2d, v22.2s, v24.2s - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2d, v26.2d, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [x26, #128] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [sp, #272] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [sp, #240] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [sp, #256] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [sp, #272] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [sp, #240] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [sp, #256] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [sp, #272] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [sp, #240] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [sp, #256] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [sp, #272] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [sp, #240] - ldp x21, x12, [sp, #256] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [sp, #272] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x14, x24, x11 - stp x22, x5, [sp, #240] - adcs x5, x13, x23 - adcs x21, x8, x23 - stp x14, x5, [sp, #256] - adc x12, x15, x23 - stp x21, x12, [sp, #272] - ldp x2, x27, [sp, #0x150] // It is #-48 after inlining, but access to sp+negative in the middle of fn is bad - ldr q3, [sp, #48] - ldr q25, [sp, #192] - ldp x13, x23, [sp, #192] - ldp x3, x21, [sp, #48] - rev64 v23.4s, v25.4s - uzp1 v17.4s, v25.4s, v3.4s - umulh x15, x3, x13 - mul v6.4s, v23.4s, v3.4s - uzp1 v3.4s, v3.4s, v3.4s - ldr q27, [sp, #224] - ldp x8, x24, [sp, #64] - subs x6, x3, x21 - ldr q0, [sp, #80] - movi v23.2d, #0xffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4s, v27.4s - uzp2 v25.4s, v27.4s, v27.4s - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2s, v0.2d - xtn v24.2s, v27.2d - cneg x20, x7, cc - ldp x6, x14, [sp, #208] - mul v27.4s, v4.4s, v0.4s - uaddlp v20.2d, v6.4s - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4s, v0.4s, v0.4s - umull v21.2d, v22.2s, v25.2s - shl v0.2d, v20.2d, #32 - umlal v0.2d, v3.2s, v17.2s - mul x22, x8, x6 - umull v1.2d, v6.2s, v25.2s - subs x12, x3, x8 - umull v20.2d, v22.2s, v24.2s - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2d, v20.2d, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2d, v21.2d, #32 - adds x22, x15, x7 - and v26.16b, v21.16b, v23.16b - adcs x16, x12, x15 - uaddlp v25.2d, v27.4s - adcs x9, x19, x12 - umlal v26.2d, v6.2s, v24.2s - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2d, v25.2d, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2d, v22.2s, v24.2s - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2d, v26.2d, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [sp, #224] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [sp, #80] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [sp, #192] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [sp, #208] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [sp, #224] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [sp, #192] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [sp, #208] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [sp, #224] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [sp, #192] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [sp, #208] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [sp, #224] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [sp, #192] - ldp x21, x12, [sp, #208] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [sp, #224] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x2, x6, x20 - eor x3, x20, x23 - adcs x6, x7, x3 - adcs x7, x24, x11 - adcs x9, x13, x23 - adcs x10, x8, x23 - adc x11, x15, x23 - ldp x4, x3, [sp, #144] - subs x5, x2, x4 - sbcs x6, x6, x3 - ldp x4, x3, [sp, #160] - sbcs x7, x7, x4 - sbcs x8, x9, x3 - ldp x4, x3, [sp, #176] - sbcs x9, x10, x4 - sbcs x10, x11, x3 - csetm x3, cc - mov x4, #0xffffffff - and x4, x4, x3 - adds x19, x5, x4 - eor x4, x4, x3 - adcs x24, x6, x4 - mov x4, #0xfffffffffffffffe - and x4, x4, x3 - adcs x7, x7, x4 - adcs x8, x8, x3 - adcs x9, x9, x3 - adc x10, x10, x3 - stp x7, x8, [sp, #208] - stp x9, x10, [sp, #224] - ldp x0, x1, [x25, #96] - ldp x2, x3, [x25, #112] - ldp x4, x5, [x25, #128] - orr x20, x0, x1 - orr x21, x2, x3 - orr x22, x4, x5 - orr x20, x20, x21 - orr x20, x20, x22 - cmp x20, xzr - cset x20, ne - ldp x6, x7, [x26, #96] - ldp x8, x9, [x26, #112] - ldp x10, x11, [x26, #128] - orr x21, x6, x7 - orr x22, x8, x9 - orr x23, x10, x11 - orr x21, x21, x22 - orr x21, x21, x23 - cmp x21, xzr - cset x21, ne - cmp x21, x20 - ldp x12, x13, [sp, #240] - csel x12, x0, x12, cc - csel x13, x1, x13, cc - csel x12, x6, x12, hi - csel x13, x7, x13, hi - ldp x14, x15, [sp, #256] - csel x14, x2, x14, cc - csel x15, x3, x15, cc - csel x14, x8, x14, hi - csel x15, x9, x15, hi - ldp x16, x17, [sp, #272] - csel x16, x4, x16, cc - csel x17, x5, x17, cc - csel x16, x10, x16, hi - csel x17, x11, x17, hi - ldp x20, x21, [x25] - ldp x0, x1, [sp, #0] - csel x0, x20, x0, cc - csel x1, x21, x1, cc - ldp x20, x21, [x26] - csel x0, x20, x0, hi - csel x1, x21, x1, hi - ldp x20, x21, [x25, #16] - ldp x2, x3, [sp, #16] - csel x2, x20, x2, cc - csel x3, x21, x3, cc - ldp x20, x21, [x26, #16] - csel x2, x20, x2, hi - csel x3, x21, x3, hi - ldp x20, x21, [x25, #32] - ldp x4, x5, [sp, #32] - csel x4, x20, x4, cc - csel x5, x21, x5, cc - ldp x20, x21, [x26, #32] - csel x4, x20, x4, hi - csel x5, x21, x5, hi - ldp x20, x21, [x25, #48] - csel x6, x20, x19, cc - csel x7, x21, x24, cc - ldp x20, x21, [x26, #48] - csel x6, x20, x6, hi - csel x7, x21, x7, hi - ldp x20, x21, [x25, #64] - ldp x8, x9, [sp, #208] - csel x8, x20, x8, cc - csel x9, x21, x9, cc - ldp x20, x21, [x26, #64] - csel x8, x20, x8, hi - csel x9, x21, x9, hi - ldp x20, x21, [x25, #80] - ldp x10, x11, [sp, #224] - csel x10, x20, x10, cc - csel x11, x21, x11, cc - ldp x20, x21, [x26, #80] - csel x10, x20, x10, hi - csel x11, x21, x11, hi - stp x0, x1, [x27] - stp x2, x3, [x27, #16] - stp x4, x5, [x27, #32] - stp x6, x7, [x27, #48] - stp x8, x9, [x27, #64] - stp x10, x11, [x27, #80] - stp x12, x13, [x27, #96] - stp x14, x15, [x27, #112] - stp x16, x17, [x27, #128] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - - CFI_POP1Z(x27) - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p384_montjadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjadd_alt.S deleted file mode 100644 index ed7870e0e6f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjadd_alt.S +++ /dev/null @@ -1,999 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-384 in Montgomery-Jacobian coordinates -// -// extern void p384_montjadd_alt(uint64_t p3[static 18], -// const uint64_t p1[static 18], -// const uint64_t p2[static 18]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^384 * x) mod p_384. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p384_montjadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p384_montjadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p384_montjadd_alt) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 48 - -// Stable homes for input arguments during main code sequence - -#define input_z x24 -#define input_x x25 -#define input_y x26 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE -#define z_2 input_y, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define z1sq sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define x1a sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define z2sq sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define y1a sp, #(NUMSIZE*6) - -#define NSPACE NUMSIZE*7 - -// Corresponds exactly to bignum_montmul_p384_alt - -#define montmul_p384(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - mul x12, x3, x5 __LF \ - umulh x13, x3, x5 __LF \ - mul x11, x3, x6 __LF \ - umulh x14, x3, x6 __LF \ - adds x13, x13, x11 __LF \ - ldp x7, x8, [P2+16] __LF \ - mul x11, x3, x7 __LF \ - umulh x15, x3, x7 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x8 __LF \ - umulh x16, x3, x8 __LF \ - adcs x15, x15, x11 __LF \ - ldp x9, x10, [P2+32] __LF \ - mul x11, x3, x9 __LF \ - umulh x17, x3, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x19, x3, x10 __LF \ - adcs x17, x17, x11 __LF \ - adc x19, x19, xzr __LF \ - mul x11, x4, x5 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x6 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x7 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x17, x17, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x19, x19, x11 __LF \ - cset x20, cs __LF \ - umulh x11, x4, x5 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x6 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x7 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x17, x17, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x19, x19, x11 __LF \ - umulh x11, x4, x10 __LF \ - adc x20, x20, x11 __LF \ - ldp x3, x4, [P1+16] __LF \ - mul x11, x3, x5 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x3, x6 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x3, x7 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x3, x8 __LF \ - adcs x17, x17, x11 __LF \ - mul x11, x3, x9 __LF \ - adcs x19, x19, x11 __LF \ - mul x11, x3, x10 __LF \ - adcs x20, x20, x11 __LF \ - cset x21, cs __LF \ - umulh x11, x3, x5 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x3, x6 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x3, x7 __LF \ - adcs x17, x17, x11 __LF \ - umulh x11, x3, x8 __LF \ - adcs x19, x19, x11 __LF \ - umulh x11, x3, x9 __LF \ - adcs x20, x20, x11 __LF \ - umulh x11, x3, x10 __LF \ - adc x21, x21, x11 __LF \ - mul x11, x4, x5 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x4, x6 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x4, x7 __LF \ - adcs x17, x17, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x19, x19, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x20, x20, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x21, x21, x11 __LF \ - cset x22, cs __LF \ - umulh x11, x4, x5 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x4, x6 __LF \ - adcs x17, x17, x11 __LF \ - umulh x11, x4, x7 __LF \ - adcs x19, x19, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x20, x20, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x21, x21, x11 __LF \ - umulh x11, x4, x10 __LF \ - adc x22, x22, x11 __LF \ - ldp x3, x4, [P1+32] __LF \ - mul x11, x3, x5 __LF \ - adds x16, x16, x11 __LF \ - mul x11, x3, x6 __LF \ - adcs x17, x17, x11 __LF \ - mul x11, x3, x7 __LF \ - adcs x19, x19, x11 __LF \ - mul x11, x3, x8 __LF \ - adcs x20, x20, x11 __LF \ - mul x11, x3, x9 __LF \ - adcs x21, x21, x11 __LF \ - mul x11, x3, x10 __LF \ - adcs x22, x22, x11 __LF \ - cset x2, cs __LF \ - umulh x11, x3, x5 __LF \ - adds x17, x17, x11 __LF \ - umulh x11, x3, x6 __LF \ - adcs x19, x19, x11 __LF \ - umulh x11, x3, x7 __LF \ - adcs x20, x20, x11 __LF \ - umulh x11, x3, x8 __LF \ - adcs x21, x21, x11 __LF \ - umulh x11, x3, x9 __LF \ - adcs x22, x22, x11 __LF \ - umulh x11, x3, x10 __LF \ - adc x2, x2, x11 __LF \ - mul x11, x4, x5 __LF \ - adds x17, x17, x11 __LF \ - mul x11, x4, x6 __LF \ - adcs x19, x19, x11 __LF \ - mul x11, x4, x7 __LF \ - adcs x20, x20, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x21, x21, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x22, x22, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x2, x2, x11 __LF \ - cset x1, cs __LF \ - umulh x11, x4, x5 __LF \ - adds x19, x19, x11 __LF \ - umulh x11, x4, x6 __LF \ - adcs x20, x20, x11 __LF \ - umulh x11, x4, x7 __LF \ - adcs x21, x21, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x22, x22, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x2, x2, x11 __LF \ - umulh x11, x4, x10 __LF \ - adc x1, x1, x11 __LF \ - lsl x7, x12, #32 __LF \ - add x12, x7, x12 __LF \ - mov x7, #0xffffffff00000001 __LF \ - umulh x7, x7, x12 __LF \ - mov x6, #0xffffffff __LF \ - mul x5, x6, x12 __LF \ - umulh x6, x6, x12 __LF \ - adds x7, x7, x5 __LF \ - adcs x6, x6, x12 __LF \ - adc x5, xzr, xzr __LF \ - subs x13, x13, x7 __LF \ - sbcs x14, x14, x6 __LF \ - sbcs x15, x15, x5 __LF \ - sbcs x16, x16, xzr __LF \ - sbcs x17, x17, xzr __LF \ - sbc x12, x12, xzr __LF \ - lsl x7, x13, #32 __LF \ - add x13, x7, x13 __LF \ - mov x7, #0xffffffff00000001 __LF \ - umulh x7, x7, x13 __LF \ - mov x6, #0xffffffff __LF \ - mul x5, x6, x13 __LF \ - umulh x6, x6, x13 __LF \ - adds x7, x7, x5 __LF \ - adcs x6, x6, x13 __LF \ - adc x5, xzr, xzr __LF \ - subs x14, x14, x7 __LF \ - sbcs x15, x15, x6 __LF \ - sbcs x16, x16, x5 __LF \ - sbcs x17, x17, xzr __LF \ - sbcs x12, x12, xzr __LF \ - sbc x13, x13, xzr __LF \ - lsl x7, x14, #32 __LF \ - add x14, x7, x14 __LF \ - mov x7, #0xffffffff00000001 __LF \ - umulh x7, x7, x14 __LF \ - mov x6, #0xffffffff __LF \ - mul x5, x6, x14 __LF \ - umulh x6, x6, x14 __LF \ - adds x7, x7, x5 __LF \ - adcs x6, x6, x14 __LF \ - adc x5, xzr, xzr __LF \ - subs x15, x15, x7 __LF \ - sbcs x16, x16, x6 __LF \ - sbcs x17, x17, x5 __LF \ - sbcs x12, x12, xzr __LF \ - sbcs x13, x13, xzr __LF \ - sbc x14, x14, xzr __LF \ - lsl x7, x15, #32 __LF \ - add x15, x7, x15 __LF \ - mov x7, #0xffffffff00000001 __LF \ - umulh x7, x7, x15 __LF \ - mov x6, #0xffffffff __LF \ - mul x5, x6, x15 __LF \ - umulh x6, x6, x15 __LF \ - adds x7, x7, x5 __LF \ - adcs x6, x6, x15 __LF \ - adc x5, xzr, xzr __LF \ - subs x16, x16, x7 __LF \ - sbcs x17, x17, x6 __LF \ - sbcs x12, x12, x5 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x15, x15, xzr __LF \ - lsl x7, x16, #32 __LF \ - add x16, x7, x16 __LF \ - mov x7, #0xffffffff00000001 __LF \ - umulh x7, x7, x16 __LF \ - mov x6, #0xffffffff __LF \ - mul x5, x6, x16 __LF \ - umulh x6, x6, x16 __LF \ - adds x7, x7, x5 __LF \ - adcs x6, x6, x16 __LF \ - adc x5, xzr, xzr __LF \ - subs x17, x17, x7 __LF \ - sbcs x12, x12, x6 __LF \ - sbcs x13, x13, x5 __LF \ - sbcs x14, x14, xzr __LF \ - sbcs x15, x15, xzr __LF \ - sbc x16, x16, xzr __LF \ - lsl x7, x17, #32 __LF \ - add x17, x7, x17 __LF \ - mov x7, #0xffffffff00000001 __LF \ - umulh x7, x7, x17 __LF \ - mov x6, #0xffffffff __LF \ - mul x5, x6, x17 __LF \ - umulh x6, x6, x17 __LF \ - adds x7, x7, x5 __LF \ - adcs x6, x6, x17 __LF \ - adc x5, xzr, xzr __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, x6 __LF \ - sbcs x14, x14, x5 __LF \ - sbcs x15, x15, xzr __LF \ - sbcs x16, x16, xzr __LF \ - sbc x17, x17, xzr __LF \ - adds x12, x12, x19 __LF \ - adcs x13, x13, x20 __LF \ - adcs x14, x14, x21 __LF \ - adcs x15, x15, x22 __LF \ - adcs x16, x16, x2 __LF \ - adcs x17, x17, x1 __LF \ - adc x10, xzr, xzr __LF \ - mov x11, #0xffffffff00000001 __LF \ - adds x19, x12, x11 __LF \ - mov x11, #0xffffffff __LF \ - adcs x20, x13, x11 __LF \ - mov x11, #0x1 __LF \ - adcs x21, x14, x11 __LF \ - adcs x22, x15, xzr __LF \ - adcs x2, x16, xzr __LF \ - adcs x1, x17, xzr __LF \ - adcs x10, x10, xzr __LF \ - csel x12, x12, x19, eq __LF \ - csel x13, x13, x20, eq __LF \ - csel x14, x14, x21, eq __LF \ - csel x15, x15, x22, eq __LF \ - csel x16, x16, x2, eq __LF \ - csel x17, x17, x1, eq __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] __LF \ - stp x16, x17, [P0+32] - -// Corresponds exactly to bignum_montsqr_p384_alt - -#define montsqr_p384(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x8, x2, x4 __LF \ - adds x10, x10, x8 __LF \ - mul x11, x2, x5 __LF \ - mul x8, x3, x4 __LF \ - adcs x11, x11, x8 __LF \ - umulh x12, x2, x5 __LF \ - mul x8, x3, x5 __LF \ - adcs x12, x12, x8 __LF \ - ldp x6, x7, [P1+32] __LF \ - mul x13, x2, x7 __LF \ - mul x8, x3, x6 __LF \ - adcs x13, x13, x8 __LF \ - umulh x14, x2, x7 __LF \ - mul x8, x3, x7 __LF \ - adcs x14, x14, x8 __LF \ - mul x15, x5, x6 __LF \ - adcs x15, x15, xzr __LF \ - umulh x16, x5, x6 __LF \ - adc x16, x16, xzr __LF \ - umulh x8, x2, x4 __LF \ - adds x11, x11, x8 __LF \ - umulh x8, x3, x4 __LF \ - adcs x12, x12, x8 __LF \ - umulh x8, x3, x5 __LF \ - adcs x13, x13, x8 __LF \ - umulh x8, x3, x6 __LF \ - adcs x14, x14, x8 __LF \ - umulh x8, x3, x7 __LF \ - adcs x15, x15, x8 __LF \ - adc x16, x16, xzr __LF \ - mul x8, x2, x6 __LF \ - adds x12, x12, x8 __LF \ - mul x8, x4, x5 __LF \ - adcs x13, x13, x8 __LF \ - mul x8, x4, x6 __LF \ - adcs x14, x14, x8 __LF \ - mul x8, x4, x7 __LF \ - adcs x15, x15, x8 __LF \ - mul x8, x5, x7 __LF \ - adcs x16, x16, x8 __LF \ - mul x17, x6, x7 __LF \ - adcs x17, x17, xzr __LF \ - umulh x19, x6, x7 __LF \ - adc x19, x19, xzr __LF \ - umulh x8, x2, x6 __LF \ - adds x13, x13, x8 __LF \ - umulh x8, x4, x5 __LF \ - adcs x14, x14, x8 __LF \ - umulh x8, x4, x6 __LF \ - adcs x15, x15, x8 __LF \ - umulh x8, x4, x7 __LF \ - adcs x16, x16, x8 __LF \ - umulh x8, x5, x7 __LF \ - adcs x17, x17, x8 __LF \ - adc x19, x19, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - adcs x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adcs x17, x17, x17 __LF \ - adcs x19, x19, x19 __LF \ - cset x20, hs __LF \ - umulh x8, x2, x2 __LF \ - mul x2, x2, x2 __LF \ - adds x9, x9, x8 __LF \ - mul x8, x3, x3 __LF \ - adcs x10, x10, x8 __LF \ - umulh x8, x3, x3 __LF \ - adcs x11, x11, x8 __LF \ - mul x8, x4, x4 __LF \ - adcs x12, x12, x8 __LF \ - umulh x8, x4, x4 __LF \ - adcs x13, x13, x8 __LF \ - mul x8, x5, x5 __LF \ - adcs x14, x14, x8 __LF \ - umulh x8, x5, x5 __LF \ - adcs x15, x15, x8 __LF \ - mul x8, x6, x6 __LF \ - adcs x16, x16, x8 __LF \ - umulh x8, x6, x6 __LF \ - adcs x17, x17, x8 __LF \ - mul x8, x7, x7 __LF \ - adcs x19, x19, x8 __LF \ - umulh x8, x7, x7 __LF \ - adc x20, x20, x8 __LF \ - lsl x5, x2, #32 __LF \ - add x2, x5, x2 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x2 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x2 __LF \ - umulh x4, x4, x2 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x2 __LF \ - adc x3, xzr, xzr __LF \ - subs x9, x9, x5 __LF \ - sbcs x10, x10, x4 __LF \ - sbcs x11, x11, x3 __LF \ - sbcs x12, x12, xzr __LF \ - sbcs x13, x13, xzr __LF \ - sbc x2, x2, xzr __LF \ - lsl x5, x9, #32 __LF \ - add x9, x5, x9 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x9 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x9 __LF \ - umulh x4, x4, x9 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x9 __LF \ - adc x3, xzr, xzr __LF \ - subs x10, x10, x5 __LF \ - sbcs x11, x11, x4 __LF \ - sbcs x12, x12, x3 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x2, x2, xzr __LF \ - sbc x9, x9, xzr __LF \ - lsl x5, x10, #32 __LF \ - add x10, x5, x10 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x10 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x10 __LF \ - umulh x4, x4, x10 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x10 __LF \ - adc x3, xzr, xzr __LF \ - subs x11, x11, x5 __LF \ - sbcs x12, x12, x4 __LF \ - sbcs x13, x13, x3 __LF \ - sbcs x2, x2, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - lsl x5, x11, #32 __LF \ - add x11, x5, x11 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x11 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x11 __LF \ - umulh x4, x4, x11 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x11 __LF \ - adc x3, xzr, xzr __LF \ - subs x12, x12, x5 __LF \ - sbcs x13, x13, x4 __LF \ - sbcs x2, x2, x3 __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbc x11, x11, xzr __LF \ - lsl x5, x12, #32 __LF \ - add x12, x5, x12 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x12 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x12 __LF \ - umulh x4, x4, x12 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x12 __LF \ - adc x3, xzr, xzr __LF \ - subs x13, x13, x5 __LF \ - sbcs x2, x2, x4 __LF \ - sbcs x9, x9, x3 __LF \ - sbcs x10, x10, xzr __LF \ - sbcs x11, x11, xzr __LF \ - sbc x12, x12, xzr __LF \ - lsl x5, x13, #32 __LF \ - add x13, x5, x13 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x13 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x13 __LF \ - umulh x4, x4, x13 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x13 __LF \ - adc x3, xzr, xzr __LF \ - subs x2, x2, x5 __LF \ - sbcs x9, x9, x4 __LF \ - sbcs x10, x10, x3 __LF \ - sbcs x11, x11, xzr __LF \ - sbcs x12, x12, xzr __LF \ - sbc x13, x13, xzr __LF \ - adds x2, x2, x14 __LF \ - adcs x9, x9, x15 __LF \ - adcs x10, x10, x16 __LF \ - adcs x11, x11, x17 __LF \ - adcs x12, x12, x19 __LF \ - adcs x13, x13, x20 __LF \ - adc x6, xzr, xzr __LF \ - mov x8, #-4294967295 __LF \ - adds x14, x2, x8 __LF \ - mov x8, #4294967295 __LF \ - adcs x15, x9, x8 __LF \ - mov x8, #1 __LF \ - adcs x16, x10, x8 __LF \ - adcs x17, x11, xzr __LF \ - adcs x19, x12, xzr __LF \ - adcs x20, x13, xzr __LF \ - adcs x6, x6, xzr __LF \ - csel x2, x2, x14, eq __LF \ - csel x9, x9, x15, eq __LF \ - csel x10, x10, x16, eq __LF \ - csel x11, x11, x17, eq __LF \ - csel x12, x12, x19, eq __LF \ - csel x13, x13, x20, eq __LF \ - stp x2, x9, [P0] __LF \ - stp x10, x11, [P0+16] __LF \ - stp x12, x13, [P0+32] - -// Almost-Montgomery variant which we use when an input to other muls -// with the other argument fully reduced (which is always safe). In -// fact, with the Karatsuba-based Montgomery mul here, we don't even -// *need* the restriction that the other argument is reduced. - -#define amontsqr_p384(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x8, x2, x4 __LF \ - adds x10, x10, x8 __LF \ - mul x11, x2, x5 __LF \ - mul x8, x3, x4 __LF \ - adcs x11, x11, x8 __LF \ - umulh x12, x2, x5 __LF \ - mul x8, x3, x5 __LF \ - adcs x12, x12, x8 __LF \ - ldp x6, x7, [P1+32] __LF \ - mul x13, x2, x7 __LF \ - mul x8, x3, x6 __LF \ - adcs x13, x13, x8 __LF \ - umulh x14, x2, x7 __LF \ - mul x8, x3, x7 __LF \ - adcs x14, x14, x8 __LF \ - mul x15, x5, x6 __LF \ - adcs x15, x15, xzr __LF \ - umulh x16, x5, x6 __LF \ - adc x16, x16, xzr __LF \ - umulh x8, x2, x4 __LF \ - adds x11, x11, x8 __LF \ - umulh x8, x3, x4 __LF \ - adcs x12, x12, x8 __LF \ - umulh x8, x3, x5 __LF \ - adcs x13, x13, x8 __LF \ - umulh x8, x3, x6 __LF \ - adcs x14, x14, x8 __LF \ - umulh x8, x3, x7 __LF \ - adcs x15, x15, x8 __LF \ - adc x16, x16, xzr __LF \ - mul x8, x2, x6 __LF \ - adds x12, x12, x8 __LF \ - mul x8, x4, x5 __LF \ - adcs x13, x13, x8 __LF \ - mul x8, x4, x6 __LF \ - adcs x14, x14, x8 __LF \ - mul x8, x4, x7 __LF \ - adcs x15, x15, x8 __LF \ - mul x8, x5, x7 __LF \ - adcs x16, x16, x8 __LF \ - mul x17, x6, x7 __LF \ - adcs x17, x17, xzr __LF \ - umulh x19, x6, x7 __LF \ - adc x19, x19, xzr __LF \ - umulh x8, x2, x6 __LF \ - adds x13, x13, x8 __LF \ - umulh x8, x4, x5 __LF \ - adcs x14, x14, x8 __LF \ - umulh x8, x4, x6 __LF \ - adcs x15, x15, x8 __LF \ - umulh x8, x4, x7 __LF \ - adcs x16, x16, x8 __LF \ - umulh x8, x5, x7 __LF \ - adcs x17, x17, x8 __LF \ - adc x19, x19, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - adcs x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adcs x17, x17, x17 __LF \ - adcs x19, x19, x19 __LF \ - cset x20, hs __LF \ - umulh x8, x2, x2 __LF \ - mul x2, x2, x2 __LF \ - adds x9, x9, x8 __LF \ - mul x8, x3, x3 __LF \ - adcs x10, x10, x8 __LF \ - umulh x8, x3, x3 __LF \ - adcs x11, x11, x8 __LF \ - mul x8, x4, x4 __LF \ - adcs x12, x12, x8 __LF \ - umulh x8, x4, x4 __LF \ - adcs x13, x13, x8 __LF \ - mul x8, x5, x5 __LF \ - adcs x14, x14, x8 __LF \ - umulh x8, x5, x5 __LF \ - adcs x15, x15, x8 __LF \ - mul x8, x6, x6 __LF \ - adcs x16, x16, x8 __LF \ - umulh x8, x6, x6 __LF \ - adcs x17, x17, x8 __LF \ - mul x8, x7, x7 __LF \ - adcs x19, x19, x8 __LF \ - umulh x8, x7, x7 __LF \ - adc x20, x20, x8 __LF \ - lsl x5, x2, #32 __LF \ - add x2, x5, x2 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x2 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x2 __LF \ - umulh x4, x4, x2 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x2 __LF \ - adc x3, xzr, xzr __LF \ - subs x9, x9, x5 __LF \ - sbcs x10, x10, x4 __LF \ - sbcs x11, x11, x3 __LF \ - sbcs x12, x12, xzr __LF \ - sbcs x13, x13, xzr __LF \ - sbc x2, x2, xzr __LF \ - lsl x5, x9, #32 __LF \ - add x9, x5, x9 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x9 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x9 __LF \ - umulh x4, x4, x9 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x9 __LF \ - adc x3, xzr, xzr __LF \ - subs x10, x10, x5 __LF \ - sbcs x11, x11, x4 __LF \ - sbcs x12, x12, x3 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x2, x2, xzr __LF \ - sbc x9, x9, xzr __LF \ - lsl x5, x10, #32 __LF \ - add x10, x5, x10 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x10 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x10 __LF \ - umulh x4, x4, x10 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x10 __LF \ - adc x3, xzr, xzr __LF \ - subs x11, x11, x5 __LF \ - sbcs x12, x12, x4 __LF \ - sbcs x13, x13, x3 __LF \ - sbcs x2, x2, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - lsl x5, x11, #32 __LF \ - add x11, x5, x11 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x11 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x11 __LF \ - umulh x4, x4, x11 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x11 __LF \ - adc x3, xzr, xzr __LF \ - subs x12, x12, x5 __LF \ - sbcs x13, x13, x4 __LF \ - sbcs x2, x2, x3 __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbc x11, x11, xzr __LF \ - lsl x5, x12, #32 __LF \ - add x12, x5, x12 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x12 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x12 __LF \ - umulh x4, x4, x12 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x12 __LF \ - adc x3, xzr, xzr __LF \ - subs x13, x13, x5 __LF \ - sbcs x2, x2, x4 __LF \ - sbcs x9, x9, x3 __LF \ - sbcs x10, x10, xzr __LF \ - sbcs x11, x11, xzr __LF \ - sbc x12, x12, xzr __LF \ - lsl x5, x13, #32 __LF \ - add x13, x5, x13 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x13 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x13 __LF \ - umulh x4, x4, x13 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x13 __LF \ - adc x3, xzr, xzr __LF \ - subs x2, x2, x5 __LF \ - sbcs x9, x9, x4 __LF \ - sbcs x10, x10, x3 __LF \ - sbcs x11, x11, xzr __LF \ - sbcs x12, x12, xzr __LF \ - sbc x13, x13, xzr __LF \ - adds x2, x2, x14 __LF \ - adcs x9, x9, x15 __LF \ - adcs x10, x10, x16 __LF \ - adcs x11, x11, x17 __LF \ - adcs x12, x12, x19 __LF \ - adcs x13, x13, x20 __LF \ - mov x14, #-4294967295 __LF \ - mov x15, #4294967295 __LF \ - csel x14, x14, xzr, cs __LF \ - csel x15, x15, xzr, cs __LF \ - cset x16, cs __LF \ - adds x2, x2, x14 __LF \ - adcs x9, x9, x15 __LF \ - adcs x10, x10, x16 __LF \ - adcs x11, x11, xzr __LF \ - adcs x12, x12, xzr __LF \ - adc x13, x13, xzr __LF \ - stp x2, x9, [P0] __LF \ - stp x10, x11, [P0+16] __LF \ - stp x12, x13, [P0+32] - -// Corresponds exactly to bignum_sub_p384 - -#define sub_p384(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - ldp x9, x10, [P1+32] __LF \ - ldp x4, x3, [P2+32] __LF \ - sbcs x9, x9, x4 __LF \ - sbcs x10, x10, x3 __LF \ - csetm x3, lo __LF \ - mov x4, #4294967295 __LF \ - and x4, x4, x3 __LF \ - adds x5, x5, x4 __LF \ - eor x4, x4, x3 __LF \ - adcs x6, x6, x4 __LF \ - mov x4, #-2 __LF \ - and x4, x4, x3 __LF \ - adcs x7, x7, x4 __LF \ - adcs x8, x8, x3 __LF \ - adcs x9, x9, x3 __LF \ - adc x10, x10, x3 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] __LF \ - stp x9, x10, [P0+32] - -S2N_BN_SYMBOL(p384_montjadd_alt): - CFI_START - -// Save regs and make room on stack for temporary variables - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - amontsqr_p384(z1sq,z_1) - amontsqr_p384(z2sq,z_2) - - montmul_p384(y1a,z_2,y_1) - montmul_p384(y2a,z_1,y_2) - - montmul_p384(x2a,z1sq,x_2) - montmul_p384(x1a,z2sq,x_1) - montmul_p384(y2a,z1sq,y2a) - montmul_p384(y1a,z2sq,y1a) - - sub_p384(xd,x2a,x1a) - sub_p384(yd,y2a,y1a) - - amontsqr_p384(zz,xd) - montsqr_p384(ww,yd) - - montmul_p384(zzx1,zz,x1a) - montmul_p384(zzx2,zz,x2a) - - sub_p384(resx,ww,zzx1) - sub_p384(t1,zzx2,zzx1) - - montmul_p384(xd,xd,z_1) - - sub_p384(resx,resx,zzx2) - - sub_p384(t2,zzx1,resx) - - montmul_p384(t1,t1,y1a) - montmul_p384(resz,xd,z_2) - montmul_p384(t2,yd,t2) - - sub_p384(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "HI" <=> CF /\ ~ZF <=> P1 = 0 /\ ~(P2 = 0) -// and "LO" <=> ~CF <=> ~(P1 = 0) /\ P2 = 0 - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - ldp x4, x5, [z_1+32] - - orr x20, x0, x1 - orr x21, x2, x3 - orr x22, x4, x5 - orr x20, x20, x21 - orr x20, x20, x22 - cmp x20, xzr - cset x20, ne - - ldp x6, x7, [z_2] - ldp x8, x9, [z_2+16] - ldp x10, x11, [z_2+32] - - orr x21, x6, x7 - orr x22, x8, x9 - orr x23, x10, x11 - orr x21, x21, x22 - orr x21, x21, x23 - cmp x21, xzr - cset x21, ne - - cmp x21, x20 - -// Multiplex the outputs accordingly, re-using the z's in registers - - ldp x12, x13, [resz] - csel x12, x0, x12, lo - csel x13, x1, x13, lo - csel x12, x6, x12, hi - csel x13, x7, x13, hi - ldp x14, x15, [resz+16] - csel x14, x2, x14, lo - csel x15, x3, x15, lo - csel x14, x8, x14, hi - csel x15, x9, x15, hi - ldp x16, x17, [resz+32] - csel x16, x4, x16, lo - csel x17, x5, x17, lo - csel x16, x10, x16, hi - csel x17, x11, x17, hi - - ldp x20, x21, [x_1] - ldp x0, x1, [resx] - csel x0, x20, x0, lo - csel x1, x21, x1, lo - ldp x20, x21, [x_2] - csel x0, x20, x0, hi - csel x1, x21, x1, hi - - ldp x20, x21, [x_1+16] - ldp x2, x3, [resx+16] - csel x2, x20, x2, lo - csel x3, x21, x3, lo - ldp x20, x21, [x_2+16] - csel x2, x20, x2, hi - csel x3, x21, x3, hi - - ldp x20, x21, [x_1+32] - ldp x4, x5, [resx+32] - csel x4, x20, x4, lo - csel x5, x21, x5, lo - ldp x20, x21, [x_2+32] - csel x4, x20, x4, hi - csel x5, x21, x5, hi - - ldp x20, x21, [y_1] - ldp x6, x7, [resy] - csel x6, x20, x6, lo - csel x7, x21, x7, lo - ldp x20, x21, [y_2] - csel x6, x20, x6, hi - csel x7, x21, x7, hi - - ldp x20, x21, [y_1+16] - ldp x8, x9, [resy+16] - csel x8, x20, x8, lo - csel x9, x21, x9, lo - ldp x20, x21, [y_2+16] - csel x8, x20, x8, hi - csel x9, x21, x9, hi - - ldp x20, x21, [y_1+32] - ldp x10, x11, [resy+32] - csel x10, x20, x10, lo - csel x11, x21, x11, lo - ldp x20, x21, [y_2+32] - csel x10, x20, x10, hi - csel x11, x21, x11, hi - -// Finally store back the multiplexed values - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [x_3+32] - stp x6, x7, [y_3] - stp x8, x9, [y_3+16] - stp x10, x11, [y_3+32] - stp x12, x13, [z_3] - stp x14, x15, [z_3+16] - stp x16, x17, [z_3+32] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p384_montjadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjmixadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjmixadd.S deleted file mode 100644 index 9d147574176..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjmixadd.S +++ /dev/null @@ -1,882 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on NIST curve P-384 in Montgomery-Jacobian coordinates -// -// extern void p384_montjmixadd(uint64_t p3[static 18], -// const uint64_t p1[static 18], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^384 * x) mod p_384. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p384_montjmixadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p384_montjmixadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p384_montjmixadd) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 48 - -// Stable homes for input arguments during main code sequence - -#define input_z x24 -#define input_x x25 -#define input_y x26 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define zp2 sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define NSPACE NUMSIZE*6 - -// Corresponds to bignum_montmul_p384 except x24 -> x0 - -#define montmul_p384(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P1+32] __LF \ - ldp x9, x10, [P2] __LF \ - ldp x11, x12, [P2+16] __LF \ - ldp x13, x14, [P2+32] __LF \ - mul x15, x3, x9 __LF \ - mul x21, x4, x10 __LF \ - mul x22, x5, x11 __LF \ - umulh x23, x3, x9 __LF \ - umulh x0, x4, x10 __LF \ - umulh x1, x5, x11 __LF \ - adds x23, x23, x21 __LF \ - adcs x0, x0, x22 __LF \ - adc x1, x1, xzr __LF \ - adds x16, x23, x15 __LF \ - adcs x17, x0, x23 __LF \ - adcs x19, x1, x0 __LF \ - adc x20, x1, xzr __LF \ - adds x17, x17, x15 __LF \ - adcs x19, x19, x23 __LF \ - adcs x20, x20, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x0, x3, x4 __LF \ - cneg x0, x0, lo __LF \ - csetm x23, lo __LF \ - subs x22, x10, x9 __LF \ - cneg x22, x22, lo __LF \ - mul x21, x0, x22 __LF \ - umulh x22, x0, x22 __LF \ - cinv x23, x23, lo __LF \ - eor x21, x21, x23 __LF \ - eor x22, x22, x23 __LF \ - cmn x23, #1 __LF \ - adcs x16, x16, x21 __LF \ - adcs x17, x17, x22 __LF \ - adcs x19, x19, x23 __LF \ - adcs x20, x20, x23 __LF \ - adc x1, x1, x23 __LF \ - subs x0, x3, x5 __LF \ - cneg x0, x0, lo __LF \ - csetm x23, lo __LF \ - subs x22, x11, x9 __LF \ - cneg x22, x22, lo __LF \ - mul x21, x0, x22 __LF \ - umulh x22, x0, x22 __LF \ - cinv x23, x23, lo __LF \ - eor x21, x21, x23 __LF \ - eor x22, x22, x23 __LF \ - cmn x23, #1 __LF \ - adcs x17, x17, x21 __LF \ - adcs x19, x19, x22 __LF \ - adcs x20, x20, x23 __LF \ - adc x1, x1, x23 __LF \ - subs x0, x4, x5 __LF \ - cneg x0, x0, lo __LF \ - csetm x23, lo __LF \ - subs x22, x11, x10 __LF \ - cneg x22, x22, lo __LF \ - mul x21, x0, x22 __LF \ - umulh x22, x0, x22 __LF \ - cinv x23, x23, lo __LF \ - eor x21, x21, x23 __LF \ - eor x22, x22, x23 __LF \ - cmn x23, #1 __LF \ - adcs x19, x19, x21 __LF \ - adcs x20, x20, x22 __LF \ - adc x1, x1, x23 __LF \ - lsl x23, x15, #32 __LF \ - add x15, x23, x15 __LF \ - lsr x23, x15, #32 __LF \ - subs x23, x23, x15 __LF \ - sbc x22, x15, xzr __LF \ - extr x23, x22, x23, #32 __LF \ - lsr x22, x22, #32 __LF \ - adds x22, x22, x15 __LF \ - adc x21, xzr, xzr __LF \ - subs x16, x16, x23 __LF \ - sbcs x17, x17, x22 __LF \ - sbcs x19, x19, x21 __LF \ - sbcs x20, x20, xzr __LF \ - sbcs x1, x1, xzr __LF \ - sbc x15, x15, xzr __LF \ - lsl x23, x16, #32 __LF \ - add x16, x23, x16 __LF \ - lsr x23, x16, #32 __LF \ - subs x23, x23, x16 __LF \ - sbc x22, x16, xzr __LF \ - extr x23, x22, x23, #32 __LF \ - lsr x22, x22, #32 __LF \ - adds x22, x22, x16 __LF \ - adc x21, xzr, xzr __LF \ - subs x17, x17, x23 __LF \ - sbcs x19, x19, x22 __LF \ - sbcs x20, x20, x21 __LF \ - sbcs x1, x1, xzr __LF \ - sbcs x15, x15, xzr __LF \ - sbc x16, x16, xzr __LF \ - lsl x23, x17, #32 __LF \ - add x17, x23, x17 __LF \ - lsr x23, x17, #32 __LF \ - subs x23, x23, x17 __LF \ - sbc x22, x17, xzr __LF \ - extr x23, x22, x23, #32 __LF \ - lsr x22, x22, #32 __LF \ - adds x22, x22, x17 __LF \ - adc x21, xzr, xzr __LF \ - subs x19, x19, x23 __LF \ - sbcs x20, x20, x22 __LF \ - sbcs x1, x1, x21 __LF \ - sbcs x15, x15, xzr __LF \ - sbcs x16, x16, xzr __LF \ - sbc x17, x17, xzr __LF \ - stp x19, x20, [P0] __LF \ - stp x1, x15, [P0+16] __LF \ - stp x16, x17, [P0+32] __LF \ - mul x15, x6, x12 __LF \ - mul x21, x7, x13 __LF \ - mul x22, x8, x14 __LF \ - umulh x23, x6, x12 __LF \ - umulh x0, x7, x13 __LF \ - umulh x1, x8, x14 __LF \ - adds x23, x23, x21 __LF \ - adcs x0, x0, x22 __LF \ - adc x1, x1, xzr __LF \ - adds x16, x23, x15 __LF \ - adcs x17, x0, x23 __LF \ - adcs x19, x1, x0 __LF \ - adc x20, x1, xzr __LF \ - adds x17, x17, x15 __LF \ - adcs x19, x19, x23 __LF \ - adcs x20, x20, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x0, x6, x7 __LF \ - cneg x0, x0, lo __LF \ - csetm x23, lo __LF \ - subs x22, x13, x12 __LF \ - cneg x22, x22, lo __LF \ - mul x21, x0, x22 __LF \ - umulh x22, x0, x22 __LF \ - cinv x23, x23, lo __LF \ - eor x21, x21, x23 __LF \ - eor x22, x22, x23 __LF \ - cmn x23, #1 __LF \ - adcs x16, x16, x21 __LF \ - adcs x17, x17, x22 __LF \ - adcs x19, x19, x23 __LF \ - adcs x20, x20, x23 __LF \ - adc x1, x1, x23 __LF \ - subs x0, x6, x8 __LF \ - cneg x0, x0, lo __LF \ - csetm x23, lo __LF \ - subs x22, x14, x12 __LF \ - cneg x22, x22, lo __LF \ - mul x21, x0, x22 __LF \ - umulh x22, x0, x22 __LF \ - cinv x23, x23, lo __LF \ - eor x21, x21, x23 __LF \ - eor x22, x22, x23 __LF \ - cmn x23, #1 __LF \ - adcs x17, x17, x21 __LF \ - adcs x19, x19, x22 __LF \ - adcs x20, x20, x23 __LF \ - adc x1, x1, x23 __LF \ - subs x0, x7, x8 __LF \ - cneg x0, x0, lo __LF \ - csetm x23, lo __LF \ - subs x22, x14, x13 __LF \ - cneg x22, x22, lo __LF \ - mul x21, x0, x22 __LF \ - umulh x22, x0, x22 __LF \ - cinv x23, x23, lo __LF \ - eor x21, x21, x23 __LF \ - eor x22, x22, x23 __LF \ - cmn x23, #1 __LF \ - adcs x19, x19, x21 __LF \ - adcs x20, x20, x22 __LF \ - adc x1, x1, x23 __LF \ - subs x6, x6, x3 __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x5 __LF \ - ngc x3, xzr __LF \ - cmn x3, #1 __LF \ - eor x6, x6, x3 __LF \ - adcs x6, x6, xzr __LF \ - eor x7, x7, x3 __LF \ - adcs x7, x7, xzr __LF \ - eor x8, x8, x3 __LF \ - adc x8, x8, xzr __LF \ - subs x9, x9, x12 __LF \ - sbcs x10, x10, x13 __LF \ - sbcs x11, x11, x14 __LF \ - ngc x14, xzr __LF \ - cmn x14, #1 __LF \ - eor x9, x9, x14 __LF \ - adcs x9, x9, xzr __LF \ - eor x10, x10, x14 __LF \ - adcs x10, x10, xzr __LF \ - eor x11, x11, x14 __LF \ - adc x11, x11, xzr __LF \ - eor x14, x3, x14 __LF \ - ldp x21, x22, [P0] __LF \ - adds x15, x15, x21 __LF \ - adcs x16, x16, x22 __LF \ - ldp x21, x22, [P0+16] __LF \ - adcs x17, x17, x21 __LF \ - adcs x19, x19, x22 __LF \ - ldp x21, x22, [P0+32] __LF \ - adcs x20, x20, x21 __LF \ - adcs x1, x1, x22 __LF \ - adc x2, xzr, xzr __LF \ - stp x15, x16, [P0] __LF \ - stp x17, x19, [P0+16] __LF \ - stp x20, x1, [P0+32] __LF \ - mul x15, x6, x9 __LF \ - mul x21, x7, x10 __LF \ - mul x22, x8, x11 __LF \ - umulh x23, x6, x9 __LF \ - umulh x0, x7, x10 __LF \ - umulh x1, x8, x11 __LF \ - adds x23, x23, x21 __LF \ - adcs x0, x0, x22 __LF \ - adc x1, x1, xzr __LF \ - adds x16, x23, x15 __LF \ - adcs x17, x0, x23 __LF \ - adcs x19, x1, x0 __LF \ - adc x20, x1, xzr __LF \ - adds x17, x17, x15 __LF \ - adcs x19, x19, x23 __LF \ - adcs x20, x20, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x0, x6, x7 __LF \ - cneg x0, x0, lo __LF \ - csetm x23, lo __LF \ - subs x22, x10, x9 __LF \ - cneg x22, x22, lo __LF \ - mul x21, x0, x22 __LF \ - umulh x22, x0, x22 __LF \ - cinv x23, x23, lo __LF \ - eor x21, x21, x23 __LF \ - eor x22, x22, x23 __LF \ - cmn x23, #1 __LF \ - adcs x16, x16, x21 __LF \ - adcs x17, x17, x22 __LF \ - adcs x19, x19, x23 __LF \ - adcs x20, x20, x23 __LF \ - adc x1, x1, x23 __LF \ - subs x0, x6, x8 __LF \ - cneg x0, x0, lo __LF \ - csetm x23, lo __LF \ - subs x22, x11, x9 __LF \ - cneg x22, x22, lo __LF \ - mul x21, x0, x22 __LF \ - umulh x22, x0, x22 __LF \ - cinv x23, x23, lo __LF \ - eor x21, x21, x23 __LF \ - eor x22, x22, x23 __LF \ - cmn x23, #1 __LF \ - adcs x17, x17, x21 __LF \ - adcs x19, x19, x22 __LF \ - adcs x20, x20, x23 __LF \ - adc x1, x1, x23 __LF \ - subs x0, x7, x8 __LF \ - cneg x0, x0, lo __LF \ - csetm x23, lo __LF \ - subs x22, x11, x10 __LF \ - cneg x22, x22, lo __LF \ - mul x21, x0, x22 __LF \ - umulh x22, x0, x22 __LF \ - cinv x23, x23, lo __LF \ - eor x21, x21, x23 __LF \ - eor x22, x22, x23 __LF \ - cmn x23, #1 __LF \ - adcs x19, x19, x21 __LF \ - adcs x20, x20, x22 __LF \ - adc x1, x1, x23 __LF \ - ldp x3, x4, [P0] __LF \ - ldp x5, x6, [P0+16] __LF \ - ldp x7, x8, [P0+32] __LF \ - cmn x14, #1 __LF \ - eor x15, x15, x14 __LF \ - adcs x15, x15, x3 __LF \ - eor x16, x16, x14 __LF \ - adcs x16, x16, x4 __LF \ - eor x17, x17, x14 __LF \ - adcs x17, x17, x5 __LF \ - eor x19, x19, x14 __LF \ - adcs x19, x19, x6 __LF \ - eor x20, x20, x14 __LF \ - adcs x20, x20, x7 __LF \ - eor x1, x1, x14 __LF \ - adcs x1, x1, x8 __LF \ - adcs x9, x14, x2 __LF \ - adcs x10, x14, xzr __LF \ - adcs x11, x14, xzr __LF \ - adc x12, x14, xzr __LF \ - adds x19, x19, x3 __LF \ - adcs x20, x20, x4 __LF \ - adcs x1, x1, x5 __LF \ - adcs x9, x9, x6 __LF \ - adcs x10, x10, x7 __LF \ - adcs x11, x11, x8 __LF \ - adc x12, x12, x2 __LF \ - lsl x23, x15, #32 __LF \ - add x15, x23, x15 __LF \ - lsr x23, x15, #32 __LF \ - subs x23, x23, x15 __LF \ - sbc x22, x15, xzr __LF \ - extr x23, x22, x23, #32 __LF \ - lsr x22, x22, #32 __LF \ - adds x22, x22, x15 __LF \ - adc x21, xzr, xzr __LF \ - subs x16, x16, x23 __LF \ - sbcs x17, x17, x22 __LF \ - sbcs x19, x19, x21 __LF \ - sbcs x20, x20, xzr __LF \ - sbcs x1, x1, xzr __LF \ - sbc x15, x15, xzr __LF \ - lsl x23, x16, #32 __LF \ - add x16, x23, x16 __LF \ - lsr x23, x16, #32 __LF \ - subs x23, x23, x16 __LF \ - sbc x22, x16, xzr __LF \ - extr x23, x22, x23, #32 __LF \ - lsr x22, x22, #32 __LF \ - adds x22, x22, x16 __LF \ - adc x21, xzr, xzr __LF \ - subs x17, x17, x23 __LF \ - sbcs x19, x19, x22 __LF \ - sbcs x20, x20, x21 __LF \ - sbcs x1, x1, xzr __LF \ - sbcs x15, x15, xzr __LF \ - sbc x16, x16, xzr __LF \ - lsl x23, x17, #32 __LF \ - add x17, x23, x17 __LF \ - lsr x23, x17, #32 __LF \ - subs x23, x23, x17 __LF \ - sbc x22, x17, xzr __LF \ - extr x23, x22, x23, #32 __LF \ - lsr x22, x22, #32 __LF \ - adds x22, x22, x17 __LF \ - adc x21, xzr, xzr __LF \ - subs x19, x19, x23 __LF \ - sbcs x20, x20, x22 __LF \ - sbcs x1, x1, x21 __LF \ - sbcs x15, x15, xzr __LF \ - sbcs x16, x16, xzr __LF \ - sbc x17, x17, xzr __LF \ - adds x9, x9, x15 __LF \ - adcs x10, x10, x16 __LF \ - adcs x11, x11, x17 __LF \ - adc x12, x12, xzr __LF \ - add x22, x12, #1 __LF \ - lsl x21, x22, #32 __LF \ - subs x0, x22, x21 __LF \ - sbc x21, x21, xzr __LF \ - adds x19, x19, x0 __LF \ - adcs x20, x20, x21 __LF \ - adcs x1, x1, x22 __LF \ - adcs x9, x9, xzr __LF \ - adcs x10, x10, xzr __LF \ - adcs x11, x11, xzr __LF \ - csetm x22, lo __LF \ - mov x23, #4294967295 __LF \ - and x23, x23, x22 __LF \ - adds x19, x19, x23 __LF \ - eor x23, x23, x22 __LF \ - adcs x20, x20, x23 __LF \ - mov x23, #-2 __LF \ - and x23, x23, x22 __LF \ - adcs x1, x1, x23 __LF \ - adcs x9, x9, x22 __LF \ - adcs x10, x10, x22 __LF \ - adc x11, x11, x22 __LF \ - stp x19, x20, [P0] __LF \ - stp x1, x9, [P0+16] __LF \ - stp x10, x11, [P0+32] - -// Corresponds exactly to bignum_montsqr_p384 - -#define montsqr_p384(P0,P1) \ - ldp x2, x3, [P1] __LF \ - ldp x4, x5, [P1+16] __LF \ - ldp x6, x7, [P1+32] __LF \ - mul x14, x2, x3 __LF \ - mul x15, x2, x4 __LF \ - mul x16, x3, x4 __LF \ - mul x8, x2, x2 __LF \ - mul x10, x3, x3 __LF \ - mul x12, x4, x4 __LF \ - umulh x17, x2, x3 __LF \ - adds x15, x15, x17 __LF \ - umulh x17, x2, x4 __LF \ - adcs x16, x16, x17 __LF \ - umulh x17, x3, x4 __LF \ - adcs x17, x17, xzr __LF \ - umulh x9, x2, x2 __LF \ - umulh x11, x3, x3 __LF \ - umulh x13, x4, x4 __LF \ - adds x14, x14, x14 __LF \ - adcs x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adcs x17, x17, x17 __LF \ - adc x13, x13, xzr __LF \ - adds x9, x9, x14 __LF \ - adcs x10, x10, x15 __LF \ - adcs x11, x11, x16 __LF \ - adcs x12, x12, x17 __LF \ - adc x13, x13, xzr __LF \ - lsl x16, x8, #32 __LF \ - add x8, x16, x8 __LF \ - lsr x16, x8, #32 __LF \ - subs x16, x16, x8 __LF \ - sbc x15, x8, xzr __LF \ - extr x16, x15, x16, #32 __LF \ - lsr x15, x15, #32 __LF \ - adds x15, x15, x8 __LF \ - adc x14, xzr, xzr __LF \ - subs x9, x9, x16 __LF \ - sbcs x10, x10, x15 __LF \ - sbcs x11, x11, x14 __LF \ - sbcs x12, x12, xzr __LF \ - sbcs x13, x13, xzr __LF \ - sbc x8, x8, xzr __LF \ - lsl x16, x9, #32 __LF \ - add x9, x16, x9 __LF \ - lsr x16, x9, #32 __LF \ - subs x16, x16, x9 __LF \ - sbc x15, x9, xzr __LF \ - extr x16, x15, x16, #32 __LF \ - lsr x15, x15, #32 __LF \ - adds x15, x15, x9 __LF \ - adc x14, xzr, xzr __LF \ - subs x10, x10, x16 __LF \ - sbcs x11, x11, x15 __LF \ - sbcs x12, x12, x14 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x8, x8, xzr __LF \ - sbc x9, x9, xzr __LF \ - lsl x16, x10, #32 __LF \ - add x10, x16, x10 __LF \ - lsr x16, x10, #32 __LF \ - subs x16, x16, x10 __LF \ - sbc x15, x10, xzr __LF \ - extr x16, x15, x16, #32 __LF \ - lsr x15, x15, #32 __LF \ - adds x15, x15, x10 __LF \ - adc x14, xzr, xzr __LF \ - subs x11, x11, x16 __LF \ - sbcs x12, x12, x15 __LF \ - sbcs x13, x13, x14 __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - stp x11, x12, [P0] __LF \ - stp x13, x8, [P0+16] __LF \ - stp x9, x10, [P0+32] __LF \ - mul x8, x2, x5 __LF \ - mul x14, x3, x6 __LF \ - mul x15, x4, x7 __LF \ - umulh x16, x2, x5 __LF \ - umulh x17, x3, x6 __LF \ - umulh x1, x4, x7 __LF \ - adds x16, x16, x14 __LF \ - adcs x17, x17, x15 __LF \ - adc x1, x1, xzr __LF \ - adds x9, x16, x8 __LF \ - adcs x10, x17, x16 __LF \ - adcs x11, x1, x17 __LF \ - adc x12, x1, xzr __LF \ - adds x10, x10, x8 __LF \ - adcs x11, x11, x16 __LF \ - adcs x12, x12, x17 __LF \ - adc x13, x1, xzr __LF \ - subs x17, x2, x3 __LF \ - cneg x17, x17, lo __LF \ - csetm x14, lo __LF \ - subs x15, x6, x5 __LF \ - cneg x15, x15, lo __LF \ - mul x16, x17, x15 __LF \ - umulh x15, x17, x15 __LF \ - cinv x14, x14, lo __LF \ - eor x16, x16, x14 __LF \ - eor x15, x15, x14 __LF \ - cmn x14, #1 __LF \ - adcs x9, x9, x16 __LF \ - adcs x10, x10, x15 __LF \ - adcs x11, x11, x14 __LF \ - adcs x12, x12, x14 __LF \ - adc x13, x13, x14 __LF \ - subs x17, x2, x4 __LF \ - cneg x17, x17, lo __LF \ - csetm x14, lo __LF \ - subs x15, x7, x5 __LF \ - cneg x15, x15, lo __LF \ - mul x16, x17, x15 __LF \ - umulh x15, x17, x15 __LF \ - cinv x14, x14, lo __LF \ - eor x16, x16, x14 __LF \ - eor x15, x15, x14 __LF \ - cmn x14, #1 __LF \ - adcs x10, x10, x16 __LF \ - adcs x11, x11, x15 __LF \ - adcs x12, x12, x14 __LF \ - adc x13, x13, x14 __LF \ - subs x17, x3, x4 __LF \ - cneg x17, x17, lo __LF \ - csetm x14, lo __LF \ - subs x15, x7, x6 __LF \ - cneg x15, x15, lo __LF \ - mul x16, x17, x15 __LF \ - umulh x15, x17, x15 __LF \ - cinv x14, x14, lo __LF \ - eor x16, x16, x14 __LF \ - eor x15, x15, x14 __LF \ - cmn x14, #1 __LF \ - adcs x11, x11, x16 __LF \ - adcs x12, x12, x15 __LF \ - adc x13, x13, x14 __LF \ - adds x8, x8, x8 __LF \ - adcs x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adc x17, xzr, xzr __LF \ - ldp x2, x3, [P0] __LF \ - adds x8, x8, x2 __LF \ - adcs x9, x9, x3 __LF \ - ldp x2, x3, [P0+16] __LF \ - adcs x10, x10, x2 __LF \ - adcs x11, x11, x3 __LF \ - ldp x2, x3, [P0+32] __LF \ - adcs x12, x12, x2 __LF \ - adcs x13, x13, x3 __LF \ - adc x17, x17, xzr __LF \ - lsl x4, x8, #32 __LF \ - add x8, x4, x8 __LF \ - lsr x4, x8, #32 __LF \ - subs x4, x4, x8 __LF \ - sbc x3, x8, xzr __LF \ - extr x4, x3, x4, #32 __LF \ - lsr x3, x3, #32 __LF \ - adds x3, x3, x8 __LF \ - adc x2, xzr, xzr __LF \ - subs x9, x9, x4 __LF \ - sbcs x10, x10, x3 __LF \ - sbcs x11, x11, x2 __LF \ - sbcs x12, x12, xzr __LF \ - sbcs x13, x13, xzr __LF \ - sbc x8, x8, xzr __LF \ - lsl x4, x9, #32 __LF \ - add x9, x4, x9 __LF \ - lsr x4, x9, #32 __LF \ - subs x4, x4, x9 __LF \ - sbc x3, x9, xzr __LF \ - extr x4, x3, x4, #32 __LF \ - lsr x3, x3, #32 __LF \ - adds x3, x3, x9 __LF \ - adc x2, xzr, xzr __LF \ - subs x10, x10, x4 __LF \ - sbcs x11, x11, x3 __LF \ - sbcs x12, x12, x2 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x8, x8, xzr __LF \ - sbc x9, x9, xzr __LF \ - lsl x4, x10, #32 __LF \ - add x10, x4, x10 __LF \ - lsr x4, x10, #32 __LF \ - subs x4, x4, x10 __LF \ - sbc x3, x10, xzr __LF \ - extr x4, x3, x4, #32 __LF \ - lsr x3, x3, #32 __LF \ - adds x3, x3, x10 __LF \ - adc x2, xzr, xzr __LF \ - subs x11, x11, x4 __LF \ - sbcs x12, x12, x3 __LF \ - sbcs x13, x13, x2 __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - adds x17, x17, x8 __LF \ - adcs x8, x9, xzr __LF \ - adcs x9, x10, xzr __LF \ - adcs x10, xzr, xzr __LF \ - mul x1, x5, x5 __LF \ - adds x11, x11, x1 __LF \ - mul x14, x6, x6 __LF \ - mul x15, x7, x7 __LF \ - umulh x1, x5, x5 __LF \ - adcs x12, x12, x1 __LF \ - umulh x1, x6, x6 __LF \ - adcs x13, x13, x14 __LF \ - adcs x17, x17, x1 __LF \ - umulh x1, x7, x7 __LF \ - adcs x8, x8, x15 __LF \ - adcs x9, x9, x1 __LF \ - adc x10, x10, xzr __LF \ - mul x1, x5, x6 __LF \ - mul x14, x5, x7 __LF \ - mul x15, x6, x7 __LF \ - umulh x16, x5, x6 __LF \ - adds x14, x14, x16 __LF \ - umulh x16, x5, x7 __LF \ - adcs x15, x15, x16 __LF \ - umulh x16, x6, x7 __LF \ - adc x16, x16, xzr __LF \ - adds x1, x1, x1 __LF \ - adcs x14, x14, x14 __LF \ - adcs x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x5, xzr, xzr __LF \ - adds x12, x12, x1 __LF \ - adcs x13, x13, x14 __LF \ - adcs x17, x17, x15 __LF \ - adcs x8, x8, x16 __LF \ - adcs x9, x9, x5 __LF \ - adc x10, x10, xzr __LF \ - mov x1, #-4294967295 __LF \ - mov x14, #4294967295 __LF \ - mov x15, #1 __LF \ - cmn x11, x1 __LF \ - adcs xzr, x12, x14 __LF \ - adcs xzr, x13, x15 __LF \ - adcs xzr, x17, xzr __LF \ - adcs xzr, x8, xzr __LF \ - adcs xzr, x9, xzr __LF \ - adc x10, x10, xzr __LF \ - neg x10, x10 __LF \ - and x1, x1, x10 __LF \ - adds x11, x11, x1 __LF \ - and x14, x14, x10 __LF \ - adcs x12, x12, x14 __LF \ - and x15, x15, x10 __LF \ - adcs x13, x13, x15 __LF \ - adcs x17, x17, xzr __LF \ - adcs x8, x8, xzr __LF \ - adc x9, x9, xzr __LF \ - stp x11, x12, [P0] __LF \ - stp x13, x17, [P0+16] __LF \ - stp x8, x9, [P0+32] - -// Corresponds exactly to bignum_sub_p384 - -#define sub_p384(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - ldp x9, x10, [P1+32] __LF \ - ldp x4, x3, [P2+32] __LF \ - sbcs x9, x9, x4 __LF \ - sbcs x10, x10, x3 __LF \ - csetm x3, lo __LF \ - mov x4, #4294967295 __LF \ - and x4, x4, x3 __LF \ - adds x5, x5, x4 __LF \ - eor x4, x4, x3 __LF \ - adcs x6, x6, x4 __LF \ - mov x4, #-2 __LF \ - and x4, x4, x3 __LF \ - adcs x7, x7, x4 __LF \ - adcs x8, x8, x3 __LF \ - adcs x9, x9, x3 __LF \ - adc x10, x10, x3 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] __LF \ - stp x9, x10, [P0+32] - -S2N_BN_SYMBOL(p384_montjmixadd): - CFI_START - -// Save regs and make room on stack for temporary variables - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - montsqr_p384(zp2,z_1) - montmul_p384(y2a,z_1,y_2) - - montmul_p384(x2a,zp2,x_2) - montmul_p384(y2a,zp2,y2a) - - sub_p384(xd,x2a,x_1) - sub_p384(yd,y2a,y_1) - - montsqr_p384(zz,xd) - montsqr_p384(ww,yd) - - montmul_p384(zzx1,zz,x_1) - montmul_p384(zzx2,zz,x2a) - - sub_p384(resx,ww,zzx1) - sub_p384(t1,zzx2,zzx1) - - montmul_p384(resz,xd,z_1) - - sub_p384(resx,resx,zzx2) - - sub_p384(t2,zzx1,resx) - - montmul_p384(t1,t1,y_1) - montmul_p384(t2,yd,t2) - - sub_p384(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - ldp x4, x5, [z_1+32] - orr x6, x0, x1 - orr x7, x2, x3 - orr x8, x4, x5 - orr x6, x6, x7 - orr x6, x6, x8 - cmp x6, xzr - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with a z = 1 coordinate (in -// Montgomery form so not the simple constant 1 but rather 2^384 - p_384), -// hence giving 0 + p2 = p2 for the final result. - - ldp x0, x1, [resx] - ldp x19, x20, [x_2] - csel x0, x0, x19, ne - csel x1, x1, x20, ne - ldp x2, x3, [resx+16] - ldp x19, x20, [x_2+16] - csel x2, x2, x19, ne - csel x3, x3, x20, ne - ldp x4, x5, [resx+32] - ldp x19, x20, [x_2+32] - csel x4, x4, x19, ne - csel x5, x5, x20, ne - - ldp x6, x7, [resy] - ldp x19, x20, [y_2] - csel x6, x6, x19, ne - csel x7, x7, x20, ne - ldp x8, x9, [resy+16] - ldp x19, x20, [y_2+16] - csel x8, x8, x19, ne - csel x9, x9, x20, ne - ldp x10, x11, [resy+32] - ldp x19, x20, [y_2+32] - csel x10, x10, x19, ne - csel x11, x11, x20, ne - - ldp x12, x13, [resz] - mov x19, #0xffffffff00000001 - mov x20, #0x00000000ffffffff - csel x12, x12, x19, ne - csel x13, x13, x20, ne - ldp x14, x15, [resz+16] - mov x19, #1 - csel x14, x14, x19, ne - csel x15, x15, xzr, ne - ldp x16, x17, [resz+32] - csel x16, x16, xzr, ne - csel x17, x17, xzr, ne - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [x_3+32] - stp x6, x7, [y_3] - stp x8, x9, [y_3+16] - stp x10, x11, [y_3+32] - stp x12, x13, [z_3] - stp x14, x15, [z_3+16] - stp x16, x17, [z_3+32] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p384_montjmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjmixadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjmixadd_alt.S deleted file mode 100644 index 2e88884a3db..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/p384_montjmixadd_alt.S +++ /dev/null @@ -1,947 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on NIST curve P-384 in Montgomery-Jacobian coordinates -// -// extern void p384_montjmixadd_alt(uint64_t p3[static 18], -// const uint64_t p1[static 18], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^384 * x) mod p_384. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p384_montjmixadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p384_montjmixadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p384_montjmixadd_alt) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 48 - -// Stable homes for input arguments during main code sequence - -#define input_z x24 -#define input_x x25 -#define input_y x26 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define zp2 sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define NSPACE NUMSIZE*6 - -// Corresponds exactly to bignum_montmul_p384_alt - -#define montmul_p384(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - mul x12, x3, x5 __LF \ - umulh x13, x3, x5 __LF \ - mul x11, x3, x6 __LF \ - umulh x14, x3, x6 __LF \ - adds x13, x13, x11 __LF \ - ldp x7, x8, [P2+16] __LF \ - mul x11, x3, x7 __LF \ - umulh x15, x3, x7 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x8 __LF \ - umulh x16, x3, x8 __LF \ - adcs x15, x15, x11 __LF \ - ldp x9, x10, [P2+32] __LF \ - mul x11, x3, x9 __LF \ - umulh x17, x3, x9 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x19, x3, x10 __LF \ - adcs x17, x17, x11 __LF \ - adc x19, x19, xzr __LF \ - mul x11, x4, x5 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x6 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x7 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x17, x17, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x19, x19, x11 __LF \ - cset x20, cs __LF \ - umulh x11, x4, x5 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x6 __LF \ - adcs x15, x15, x11 __LF \ - umulh x11, x4, x7 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x17, x17, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x19, x19, x11 __LF \ - umulh x11, x4, x10 __LF \ - adc x20, x20, x11 __LF \ - ldp x3, x4, [P1+16] __LF \ - mul x11, x3, x5 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x3, x6 __LF \ - adcs x15, x15, x11 __LF \ - mul x11, x3, x7 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x3, x8 __LF \ - adcs x17, x17, x11 __LF \ - mul x11, x3, x9 __LF \ - adcs x19, x19, x11 __LF \ - mul x11, x3, x10 __LF \ - adcs x20, x20, x11 __LF \ - cset x21, cs __LF \ - umulh x11, x3, x5 __LF \ - adds x15, x15, x11 __LF \ - umulh x11, x3, x6 __LF \ - adcs x16, x16, x11 __LF \ - umulh x11, x3, x7 __LF \ - adcs x17, x17, x11 __LF \ - umulh x11, x3, x8 __LF \ - adcs x19, x19, x11 __LF \ - umulh x11, x3, x9 __LF \ - adcs x20, x20, x11 __LF \ - umulh x11, x3, x10 __LF \ - adc x21, x21, x11 __LF \ - mul x11, x4, x5 __LF \ - adds x15, x15, x11 __LF \ - mul x11, x4, x6 __LF \ - adcs x16, x16, x11 __LF \ - mul x11, x4, x7 __LF \ - adcs x17, x17, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x19, x19, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x20, x20, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x21, x21, x11 __LF \ - cset x22, cs __LF \ - umulh x11, x4, x5 __LF \ - adds x16, x16, x11 __LF \ - umulh x11, x4, x6 __LF \ - adcs x17, x17, x11 __LF \ - umulh x11, x4, x7 __LF \ - adcs x19, x19, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x20, x20, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x21, x21, x11 __LF \ - umulh x11, x4, x10 __LF \ - adc x22, x22, x11 __LF \ - ldp x3, x4, [P1+32] __LF \ - mul x11, x3, x5 __LF \ - adds x16, x16, x11 __LF \ - mul x11, x3, x6 __LF \ - adcs x17, x17, x11 __LF \ - mul x11, x3, x7 __LF \ - adcs x19, x19, x11 __LF \ - mul x11, x3, x8 __LF \ - adcs x20, x20, x11 __LF \ - mul x11, x3, x9 __LF \ - adcs x21, x21, x11 __LF \ - mul x11, x3, x10 __LF \ - adcs x22, x22, x11 __LF \ - cset x2, cs __LF \ - umulh x11, x3, x5 __LF \ - adds x17, x17, x11 __LF \ - umulh x11, x3, x6 __LF \ - adcs x19, x19, x11 __LF \ - umulh x11, x3, x7 __LF \ - adcs x20, x20, x11 __LF \ - umulh x11, x3, x8 __LF \ - adcs x21, x21, x11 __LF \ - umulh x11, x3, x9 __LF \ - adcs x22, x22, x11 __LF \ - umulh x11, x3, x10 __LF \ - adc x2, x2, x11 __LF \ - mul x11, x4, x5 __LF \ - adds x17, x17, x11 __LF \ - mul x11, x4, x6 __LF \ - adcs x19, x19, x11 __LF \ - mul x11, x4, x7 __LF \ - adcs x20, x20, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x21, x21, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x22, x22, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x2, x2, x11 __LF \ - cset x1, cs __LF \ - umulh x11, x4, x5 __LF \ - adds x19, x19, x11 __LF \ - umulh x11, x4, x6 __LF \ - adcs x20, x20, x11 __LF \ - umulh x11, x4, x7 __LF \ - adcs x21, x21, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x22, x22, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x2, x2, x11 __LF \ - umulh x11, x4, x10 __LF \ - adc x1, x1, x11 __LF \ - lsl x7, x12, #32 __LF \ - add x12, x7, x12 __LF \ - mov x7, #0xffffffff00000001 __LF \ - umulh x7, x7, x12 __LF \ - mov x6, #0xffffffff __LF \ - mul x5, x6, x12 __LF \ - umulh x6, x6, x12 __LF \ - adds x7, x7, x5 __LF \ - adcs x6, x6, x12 __LF \ - adc x5, xzr, xzr __LF \ - subs x13, x13, x7 __LF \ - sbcs x14, x14, x6 __LF \ - sbcs x15, x15, x5 __LF \ - sbcs x16, x16, xzr __LF \ - sbcs x17, x17, xzr __LF \ - sbc x12, x12, xzr __LF \ - lsl x7, x13, #32 __LF \ - add x13, x7, x13 __LF \ - mov x7, #0xffffffff00000001 __LF \ - umulh x7, x7, x13 __LF \ - mov x6, #0xffffffff __LF \ - mul x5, x6, x13 __LF \ - umulh x6, x6, x13 __LF \ - adds x7, x7, x5 __LF \ - adcs x6, x6, x13 __LF \ - adc x5, xzr, xzr __LF \ - subs x14, x14, x7 __LF \ - sbcs x15, x15, x6 __LF \ - sbcs x16, x16, x5 __LF \ - sbcs x17, x17, xzr __LF \ - sbcs x12, x12, xzr __LF \ - sbc x13, x13, xzr __LF \ - lsl x7, x14, #32 __LF \ - add x14, x7, x14 __LF \ - mov x7, #0xffffffff00000001 __LF \ - umulh x7, x7, x14 __LF \ - mov x6, #0xffffffff __LF \ - mul x5, x6, x14 __LF \ - umulh x6, x6, x14 __LF \ - adds x7, x7, x5 __LF \ - adcs x6, x6, x14 __LF \ - adc x5, xzr, xzr __LF \ - subs x15, x15, x7 __LF \ - sbcs x16, x16, x6 __LF \ - sbcs x17, x17, x5 __LF \ - sbcs x12, x12, xzr __LF \ - sbcs x13, x13, xzr __LF \ - sbc x14, x14, xzr __LF \ - lsl x7, x15, #32 __LF \ - add x15, x7, x15 __LF \ - mov x7, #0xffffffff00000001 __LF \ - umulh x7, x7, x15 __LF \ - mov x6, #0xffffffff __LF \ - mul x5, x6, x15 __LF \ - umulh x6, x6, x15 __LF \ - adds x7, x7, x5 __LF \ - adcs x6, x6, x15 __LF \ - adc x5, xzr, xzr __LF \ - subs x16, x16, x7 __LF \ - sbcs x17, x17, x6 __LF \ - sbcs x12, x12, x5 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x15, x15, xzr __LF \ - lsl x7, x16, #32 __LF \ - add x16, x7, x16 __LF \ - mov x7, #0xffffffff00000001 __LF \ - umulh x7, x7, x16 __LF \ - mov x6, #0xffffffff __LF \ - mul x5, x6, x16 __LF \ - umulh x6, x6, x16 __LF \ - adds x7, x7, x5 __LF \ - adcs x6, x6, x16 __LF \ - adc x5, xzr, xzr __LF \ - subs x17, x17, x7 __LF \ - sbcs x12, x12, x6 __LF \ - sbcs x13, x13, x5 __LF \ - sbcs x14, x14, xzr __LF \ - sbcs x15, x15, xzr __LF \ - sbc x16, x16, xzr __LF \ - lsl x7, x17, #32 __LF \ - add x17, x7, x17 __LF \ - mov x7, #0xffffffff00000001 __LF \ - umulh x7, x7, x17 __LF \ - mov x6, #0xffffffff __LF \ - mul x5, x6, x17 __LF \ - umulh x6, x6, x17 __LF \ - adds x7, x7, x5 __LF \ - adcs x6, x6, x17 __LF \ - adc x5, xzr, xzr __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, x6 __LF \ - sbcs x14, x14, x5 __LF \ - sbcs x15, x15, xzr __LF \ - sbcs x16, x16, xzr __LF \ - sbc x17, x17, xzr __LF \ - adds x12, x12, x19 __LF \ - adcs x13, x13, x20 __LF \ - adcs x14, x14, x21 __LF \ - adcs x15, x15, x22 __LF \ - adcs x16, x16, x2 __LF \ - adcs x17, x17, x1 __LF \ - adc x10, xzr, xzr __LF \ - mov x11, #0xffffffff00000001 __LF \ - adds x19, x12, x11 __LF \ - mov x11, #0xffffffff __LF \ - adcs x20, x13, x11 __LF \ - mov x11, #0x1 __LF \ - adcs x21, x14, x11 __LF \ - adcs x22, x15, xzr __LF \ - adcs x2, x16, xzr __LF \ - adcs x1, x17, xzr __LF \ - adcs x10, x10, xzr __LF \ - csel x12, x12, x19, eq __LF \ - csel x13, x13, x20, eq __LF \ - csel x14, x14, x21, eq __LF \ - csel x15, x15, x22, eq __LF \ - csel x16, x16, x2, eq __LF \ - csel x17, x17, x1, eq __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x15, [P0+16] __LF \ - stp x16, x17, [P0+32] - -// Corresponds exactly to bignum_montsqr_p384_alt - -#define montsqr_p384(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x8, x2, x4 __LF \ - adds x10, x10, x8 __LF \ - mul x11, x2, x5 __LF \ - mul x8, x3, x4 __LF \ - adcs x11, x11, x8 __LF \ - umulh x12, x2, x5 __LF \ - mul x8, x3, x5 __LF \ - adcs x12, x12, x8 __LF \ - ldp x6, x7, [P1+32] __LF \ - mul x13, x2, x7 __LF \ - mul x8, x3, x6 __LF \ - adcs x13, x13, x8 __LF \ - umulh x14, x2, x7 __LF \ - mul x8, x3, x7 __LF \ - adcs x14, x14, x8 __LF \ - mul x15, x5, x6 __LF \ - adcs x15, x15, xzr __LF \ - umulh x16, x5, x6 __LF \ - adc x16, x16, xzr __LF \ - umulh x8, x2, x4 __LF \ - adds x11, x11, x8 __LF \ - umulh x8, x3, x4 __LF \ - adcs x12, x12, x8 __LF \ - umulh x8, x3, x5 __LF \ - adcs x13, x13, x8 __LF \ - umulh x8, x3, x6 __LF \ - adcs x14, x14, x8 __LF \ - umulh x8, x3, x7 __LF \ - adcs x15, x15, x8 __LF \ - adc x16, x16, xzr __LF \ - mul x8, x2, x6 __LF \ - adds x12, x12, x8 __LF \ - mul x8, x4, x5 __LF \ - adcs x13, x13, x8 __LF \ - mul x8, x4, x6 __LF \ - adcs x14, x14, x8 __LF \ - mul x8, x4, x7 __LF \ - adcs x15, x15, x8 __LF \ - mul x8, x5, x7 __LF \ - adcs x16, x16, x8 __LF \ - mul x17, x6, x7 __LF \ - adcs x17, x17, xzr __LF \ - umulh x19, x6, x7 __LF \ - adc x19, x19, xzr __LF \ - umulh x8, x2, x6 __LF \ - adds x13, x13, x8 __LF \ - umulh x8, x4, x5 __LF \ - adcs x14, x14, x8 __LF \ - umulh x8, x4, x6 __LF \ - adcs x15, x15, x8 __LF \ - umulh x8, x4, x7 __LF \ - adcs x16, x16, x8 __LF \ - umulh x8, x5, x7 __LF \ - adcs x17, x17, x8 __LF \ - adc x19, x19, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - adcs x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adcs x17, x17, x17 __LF \ - adcs x19, x19, x19 __LF \ - cset x20, hs __LF \ - umulh x8, x2, x2 __LF \ - mul x2, x2, x2 __LF \ - adds x9, x9, x8 __LF \ - mul x8, x3, x3 __LF \ - adcs x10, x10, x8 __LF \ - umulh x8, x3, x3 __LF \ - adcs x11, x11, x8 __LF \ - mul x8, x4, x4 __LF \ - adcs x12, x12, x8 __LF \ - umulh x8, x4, x4 __LF \ - adcs x13, x13, x8 __LF \ - mul x8, x5, x5 __LF \ - adcs x14, x14, x8 __LF \ - umulh x8, x5, x5 __LF \ - adcs x15, x15, x8 __LF \ - mul x8, x6, x6 __LF \ - adcs x16, x16, x8 __LF \ - umulh x8, x6, x6 __LF \ - adcs x17, x17, x8 __LF \ - mul x8, x7, x7 __LF \ - adcs x19, x19, x8 __LF \ - umulh x8, x7, x7 __LF \ - adc x20, x20, x8 __LF \ - lsl x5, x2, #32 __LF \ - add x2, x5, x2 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x2 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x2 __LF \ - umulh x4, x4, x2 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x2 __LF \ - adc x3, xzr, xzr __LF \ - subs x9, x9, x5 __LF \ - sbcs x10, x10, x4 __LF \ - sbcs x11, x11, x3 __LF \ - sbcs x12, x12, xzr __LF \ - sbcs x13, x13, xzr __LF \ - sbc x2, x2, xzr __LF \ - lsl x5, x9, #32 __LF \ - add x9, x5, x9 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x9 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x9 __LF \ - umulh x4, x4, x9 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x9 __LF \ - adc x3, xzr, xzr __LF \ - subs x10, x10, x5 __LF \ - sbcs x11, x11, x4 __LF \ - sbcs x12, x12, x3 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x2, x2, xzr __LF \ - sbc x9, x9, xzr __LF \ - lsl x5, x10, #32 __LF \ - add x10, x5, x10 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x10 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x10 __LF \ - umulh x4, x4, x10 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x10 __LF \ - adc x3, xzr, xzr __LF \ - subs x11, x11, x5 __LF \ - sbcs x12, x12, x4 __LF \ - sbcs x13, x13, x3 __LF \ - sbcs x2, x2, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - lsl x5, x11, #32 __LF \ - add x11, x5, x11 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x11 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x11 __LF \ - umulh x4, x4, x11 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x11 __LF \ - adc x3, xzr, xzr __LF \ - subs x12, x12, x5 __LF \ - sbcs x13, x13, x4 __LF \ - sbcs x2, x2, x3 __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbc x11, x11, xzr __LF \ - lsl x5, x12, #32 __LF \ - add x12, x5, x12 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x12 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x12 __LF \ - umulh x4, x4, x12 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x12 __LF \ - adc x3, xzr, xzr __LF \ - subs x13, x13, x5 __LF \ - sbcs x2, x2, x4 __LF \ - sbcs x9, x9, x3 __LF \ - sbcs x10, x10, xzr __LF \ - sbcs x11, x11, xzr __LF \ - sbc x12, x12, xzr __LF \ - lsl x5, x13, #32 __LF \ - add x13, x5, x13 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x13 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x13 __LF \ - umulh x4, x4, x13 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x13 __LF \ - adc x3, xzr, xzr __LF \ - subs x2, x2, x5 __LF \ - sbcs x9, x9, x4 __LF \ - sbcs x10, x10, x3 __LF \ - sbcs x11, x11, xzr __LF \ - sbcs x12, x12, xzr __LF \ - sbc x13, x13, xzr __LF \ - adds x2, x2, x14 __LF \ - adcs x9, x9, x15 __LF \ - adcs x10, x10, x16 __LF \ - adcs x11, x11, x17 __LF \ - adcs x12, x12, x19 __LF \ - adcs x13, x13, x20 __LF \ - adc x6, xzr, xzr __LF \ - mov x8, #-4294967295 __LF \ - adds x14, x2, x8 __LF \ - mov x8, #4294967295 __LF \ - adcs x15, x9, x8 __LF \ - mov x8, #1 __LF \ - adcs x16, x10, x8 __LF \ - adcs x17, x11, xzr __LF \ - adcs x19, x12, xzr __LF \ - adcs x20, x13, xzr __LF \ - adcs x6, x6, xzr __LF \ - csel x2, x2, x14, eq __LF \ - csel x9, x9, x15, eq __LF \ - csel x10, x10, x16, eq __LF \ - csel x11, x11, x17, eq __LF \ - csel x12, x12, x19, eq __LF \ - csel x13, x13, x20, eq __LF \ - stp x2, x9, [P0] __LF \ - stp x10, x11, [P0+16] __LF \ - stp x12, x13, [P0+32] - -// Almost-Montgomery variant which we use when an input to other muls -// with the other argument fully reduced (which is always safe). In -// fact, with the Karatsuba-based Montgomery mul here, we don't even -// *need* the restriction that the other argument is reduced. - -#define amontsqr_p384(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x8, x2, x4 __LF \ - adds x10, x10, x8 __LF \ - mul x11, x2, x5 __LF \ - mul x8, x3, x4 __LF \ - adcs x11, x11, x8 __LF \ - umulh x12, x2, x5 __LF \ - mul x8, x3, x5 __LF \ - adcs x12, x12, x8 __LF \ - ldp x6, x7, [P1+32] __LF \ - mul x13, x2, x7 __LF \ - mul x8, x3, x6 __LF \ - adcs x13, x13, x8 __LF \ - umulh x14, x2, x7 __LF \ - mul x8, x3, x7 __LF \ - adcs x14, x14, x8 __LF \ - mul x15, x5, x6 __LF \ - adcs x15, x15, xzr __LF \ - umulh x16, x5, x6 __LF \ - adc x16, x16, xzr __LF \ - umulh x8, x2, x4 __LF \ - adds x11, x11, x8 __LF \ - umulh x8, x3, x4 __LF \ - adcs x12, x12, x8 __LF \ - umulh x8, x3, x5 __LF \ - adcs x13, x13, x8 __LF \ - umulh x8, x3, x6 __LF \ - adcs x14, x14, x8 __LF \ - umulh x8, x3, x7 __LF \ - adcs x15, x15, x8 __LF \ - adc x16, x16, xzr __LF \ - mul x8, x2, x6 __LF \ - adds x12, x12, x8 __LF \ - mul x8, x4, x5 __LF \ - adcs x13, x13, x8 __LF \ - mul x8, x4, x6 __LF \ - adcs x14, x14, x8 __LF \ - mul x8, x4, x7 __LF \ - adcs x15, x15, x8 __LF \ - mul x8, x5, x7 __LF \ - adcs x16, x16, x8 __LF \ - mul x17, x6, x7 __LF \ - adcs x17, x17, xzr __LF \ - umulh x19, x6, x7 __LF \ - adc x19, x19, xzr __LF \ - umulh x8, x2, x6 __LF \ - adds x13, x13, x8 __LF \ - umulh x8, x4, x5 __LF \ - adcs x14, x14, x8 __LF \ - umulh x8, x4, x6 __LF \ - adcs x15, x15, x8 __LF \ - umulh x8, x4, x7 __LF \ - adcs x16, x16, x8 __LF \ - umulh x8, x5, x7 __LF \ - adcs x17, x17, x8 __LF \ - adc x19, x19, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - adcs x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adcs x17, x17, x17 __LF \ - adcs x19, x19, x19 __LF \ - cset x20, hs __LF \ - umulh x8, x2, x2 __LF \ - mul x2, x2, x2 __LF \ - adds x9, x9, x8 __LF \ - mul x8, x3, x3 __LF \ - adcs x10, x10, x8 __LF \ - umulh x8, x3, x3 __LF \ - adcs x11, x11, x8 __LF \ - mul x8, x4, x4 __LF \ - adcs x12, x12, x8 __LF \ - umulh x8, x4, x4 __LF \ - adcs x13, x13, x8 __LF \ - mul x8, x5, x5 __LF \ - adcs x14, x14, x8 __LF \ - umulh x8, x5, x5 __LF \ - adcs x15, x15, x8 __LF \ - mul x8, x6, x6 __LF \ - adcs x16, x16, x8 __LF \ - umulh x8, x6, x6 __LF \ - adcs x17, x17, x8 __LF \ - mul x8, x7, x7 __LF \ - adcs x19, x19, x8 __LF \ - umulh x8, x7, x7 __LF \ - adc x20, x20, x8 __LF \ - lsl x5, x2, #32 __LF \ - add x2, x5, x2 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x2 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x2 __LF \ - umulh x4, x4, x2 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x2 __LF \ - adc x3, xzr, xzr __LF \ - subs x9, x9, x5 __LF \ - sbcs x10, x10, x4 __LF \ - sbcs x11, x11, x3 __LF \ - sbcs x12, x12, xzr __LF \ - sbcs x13, x13, xzr __LF \ - sbc x2, x2, xzr __LF \ - lsl x5, x9, #32 __LF \ - add x9, x5, x9 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x9 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x9 __LF \ - umulh x4, x4, x9 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x9 __LF \ - adc x3, xzr, xzr __LF \ - subs x10, x10, x5 __LF \ - sbcs x11, x11, x4 __LF \ - sbcs x12, x12, x3 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x2, x2, xzr __LF \ - sbc x9, x9, xzr __LF \ - lsl x5, x10, #32 __LF \ - add x10, x5, x10 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x10 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x10 __LF \ - umulh x4, x4, x10 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x10 __LF \ - adc x3, xzr, xzr __LF \ - subs x11, x11, x5 __LF \ - sbcs x12, x12, x4 __LF \ - sbcs x13, x13, x3 __LF \ - sbcs x2, x2, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - lsl x5, x11, #32 __LF \ - add x11, x5, x11 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x11 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x11 __LF \ - umulh x4, x4, x11 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x11 __LF \ - adc x3, xzr, xzr __LF \ - subs x12, x12, x5 __LF \ - sbcs x13, x13, x4 __LF \ - sbcs x2, x2, x3 __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbc x11, x11, xzr __LF \ - lsl x5, x12, #32 __LF \ - add x12, x5, x12 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x12 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x12 __LF \ - umulh x4, x4, x12 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x12 __LF \ - adc x3, xzr, xzr __LF \ - subs x13, x13, x5 __LF \ - sbcs x2, x2, x4 __LF \ - sbcs x9, x9, x3 __LF \ - sbcs x10, x10, xzr __LF \ - sbcs x11, x11, xzr __LF \ - sbc x12, x12, xzr __LF \ - lsl x5, x13, #32 __LF \ - add x13, x5, x13 __LF \ - mov x5, #-4294967295 __LF \ - umulh x5, x5, x13 __LF \ - mov x4, #4294967295 __LF \ - mul x3, x4, x13 __LF \ - umulh x4, x4, x13 __LF \ - adds x5, x5, x3 __LF \ - adcs x4, x4, x13 __LF \ - adc x3, xzr, xzr __LF \ - subs x2, x2, x5 __LF \ - sbcs x9, x9, x4 __LF \ - sbcs x10, x10, x3 __LF \ - sbcs x11, x11, xzr __LF \ - sbcs x12, x12, xzr __LF \ - sbc x13, x13, xzr __LF \ - adds x2, x2, x14 __LF \ - adcs x9, x9, x15 __LF \ - adcs x10, x10, x16 __LF \ - adcs x11, x11, x17 __LF \ - adcs x12, x12, x19 __LF \ - adcs x13, x13, x20 __LF \ - mov x14, #-4294967295 __LF \ - mov x15, #4294967295 __LF \ - csel x14, x14, xzr, cs __LF \ - csel x15, x15, xzr, cs __LF \ - cset x16, cs __LF \ - adds x2, x2, x14 __LF \ - adcs x9, x9, x15 __LF \ - adcs x10, x10, x16 __LF \ - adcs x11, x11, xzr __LF \ - adcs x12, x12, xzr __LF \ - adc x13, x13, xzr __LF \ - stp x2, x9, [P0] __LF \ - stp x10, x11, [P0+16] __LF \ - stp x12, x13, [P0+32] - -// Corresponds exactly to bignum_sub_p384 - -#define sub_p384(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - ldp x9, x10, [P1+32] __LF \ - ldp x4, x3, [P2+32] __LF \ - sbcs x9, x9, x4 __LF \ - sbcs x10, x10, x3 __LF \ - csetm x3, lo __LF \ - mov x4, #4294967295 __LF \ - and x4, x4, x3 __LF \ - adds x5, x5, x4 __LF \ - eor x4, x4, x3 __LF \ - adcs x6, x6, x4 __LF \ - mov x4, #-2 __LF \ - and x4, x4, x3 __LF \ - adcs x7, x7, x4 __LF \ - adcs x8, x8, x3 __LF \ - adcs x9, x9, x3 __LF \ - adc x10, x10, x3 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] __LF \ - stp x9, x10, [P0+32] - -S2N_BN_SYMBOL(p384_montjmixadd_alt): - CFI_START - -// Save regs and make room on stack for temporary variables - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - amontsqr_p384(zp2,z_1) - montmul_p384(y2a,z_1,y_2) - - montmul_p384(x2a,zp2,x_2) - montmul_p384(y2a,zp2,y2a) - - sub_p384(xd,x2a,x_1) - sub_p384(yd,y2a,y_1) - - amontsqr_p384(zz,xd) - montsqr_p384(ww,yd) - - montmul_p384(zzx1,zz,x_1) - montmul_p384(zzx2,zz,x2a) - - sub_p384(resx,ww,zzx1) - sub_p384(t1,zzx2,zzx1) - - montmul_p384(resz,xd,z_1) - - sub_p384(resx,resx,zzx2) - - sub_p384(t2,zzx1,resx) - - montmul_p384(t1,t1,y_1) - montmul_p384(t2,yd,t2) - - sub_p384(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - ldp x4, x5, [z_1+32] - orr x6, x0, x1 - orr x7, x2, x3 - orr x8, x4, x5 - orr x6, x6, x7 - orr x6, x6, x8 - cmp x6, xzr - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with a z = 1 coordinate (in -// Montgomery form so not the simple constant 1 but rather 2^384 - p_384), -// hence giving 0 + p2 = p2 for the final result. - - ldp x0, x1, [resx] - ldp x19, x20, [x_2] - csel x0, x0, x19, ne - csel x1, x1, x20, ne - ldp x2, x3, [resx+16] - ldp x19, x20, [x_2+16] - csel x2, x2, x19, ne - csel x3, x3, x20, ne - ldp x4, x5, [resx+32] - ldp x19, x20, [x_2+32] - csel x4, x4, x19, ne - csel x5, x5, x20, ne - - ldp x6, x7, [resy] - ldp x19, x20, [y_2] - csel x6, x6, x19, ne - csel x7, x7, x20, ne - ldp x8, x9, [resy+16] - ldp x19, x20, [y_2+16] - csel x8, x8, x19, ne - csel x9, x9, x20, ne - ldp x10, x11, [resy+32] - ldp x19, x20, [y_2+32] - csel x10, x10, x19, ne - csel x11, x11, x20, ne - - ldp x12, x13, [resz] - mov x19, #0xffffffff00000001 - mov x20, #0x00000000ffffffff - csel x12, x12, x19, ne - csel x13, x13, x20, ne - ldp x14, x15, [resz+16] - mov x19, #1 - csel x14, x14, x19, ne - csel x15, x15, xzr, ne - ldp x16, x17, [resz+32] - csel x16, x16, xzr, ne - csel x17, x17, xzr, ne - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [x_3+32] - stp x6, x7, [y_3] - stp x8, x9, [y_3+16] - stp x10, x11, [y_3+32] - stp x12, x13, [z_3] - stp x14, x15, [z_3+16] - stp x16, x17, [z_3+32] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p384_montjmixadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/bignum_montmul_p384_base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/bignum_montmul_p384_base.S deleted file mode 100644 index c90703b1612..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/bignum_montmul_p384_base.S +++ /dev/null @@ -1,417 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^384) mod p_384 -// Inputs x[6], y[6]; output z[6] -// -// extern void bignum_montmul_p384_base -// (uint64_t z[static 6], uint64_t x[static 6], uint64_t y[static 6]); -// -// Does z := (2^{-384} * x * y) mod p_384, assuming that the inputs x and y -// satisfy x * y <= 2^384 * p_384 (in particular this is true if we are in -// the "usual" case x < p_384 and y < p_384). -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p384_base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p384_base) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro returning (c,h,l) = 3-word 1s complement (x - y) * (w - z) -// c,h,l,t should all be different -// t,h should not overlap w,z -// --------------------------------------------------------------------------- - -#define muldiffn(c,h,l, t, x,y, w,z) \ - subs t, x, y __LF \ - cneg t, t, cc __LF \ - csetm c, cc __LF \ - subs h, w, z __LF \ - cneg h, h, cc __LF \ - mul l, t, h __LF \ - umulh h, t, h __LF \ - cinv c, c, cc __LF \ - eor l, l, c __LF \ - eor h, h, c - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d5;d4;d3;d2;d1;d0] and returns result in [d6;d5;d4;d3;d2;d1], -// adding to the existing contents of [d5;d4;d3;d2;d1]. It is fine -// for d6 to be the same register as d0. -// -// We want to add (2^384 - 2^128 - 2^96 + 2^32 - 1) * w -// where w = [d0 + (d0<<32)] mod 2^64 -// --------------------------------------------------------------------------- - -#define montreds(d6,d5,d4,d3,d2,d1,d0, t3,t2,t1) \ -/* Our correction multiplier is w = [d0 + (d0<<32)] mod 2^64 */ \ -/* Recycle d0 (which we know gets implicitly cancelled) to store it */ \ - lsl t1, d0, #32 __LF \ - add d0, t1, d0 __LF \ -/* Now let [t2;t1] = 2^64 * w - w + w_hi where w_hi = floor(w/2^32) */ \ -/* We need to subtract 2^32 * this, and we can ignore its lower 32 */ \ -/* bits since by design it will cancel anyway; we only need the w_hi */ \ -/* part to get the carry propagation going. */ \ - lsr t1, d0, #32 __LF \ - subs t1, t1, d0 __LF \ - sbc t2, d0, xzr __LF \ -/* Now select in t1 the field to subtract from d1 */ \ - extr t1, t2, t1, #32 __LF \ -/* And now get the terms to subtract from d2 and d3 */ \ - lsr t2, t2, #32 __LF \ - adds t2, t2, d0 __LF \ - adc t3, xzr, xzr __LF \ -/* Do the subtraction of that portion */ \ - subs d1, d1, t1 __LF \ - sbcs d2, d2, t2 __LF \ - sbcs d3, d3, t3 __LF \ - sbcs d4, d4, xzr __LF \ - sbcs d5, d5, xzr __LF \ -/* Now effectively add 2^384 * w by taking d0 as the input for last sbc */ \ - sbc d6, d0, xzr - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define a4 x7 -#define a5 x8 -#define b0 x9 -#define b1 x10 -#define b2 x11 -#define b3 x12 -#define b4 x13 -#define b5 x14 - -#define s0 x15 -#define s1 x16 -#define s2 x17 -#define s3 x19 -#define s4 x20 -#define s5 x1 -#define s6 x2 - -#define t1 x21 -#define t2 x22 -#define t3 x23 -#define t4 x24 - -S2N_BN_SYMBOL(bignum_montmul_p384_base): - -// Save some registers - - stp x19, x20, [sp, -16]! - stp x21, x22, [sp, -16]! - stp x23, x24, [sp, -16]! - -// Load in all words of both inputs - - ldp a0, a1, [x1] - ldp a2, a3, [x1, #16] - ldp a4, a5, [x1, #32] - ldp b0, b1, [x2] - ldp b2, b3, [x2, #16] - ldp b4, b5, [x2, #32] - -// Multiply low halves with a 3x3->6 ADK multiplier as [s5;s4;s3;s2;s1;s0] - - mul s0, a0, b0 - mul t1, a1, b1 - mul t2, a2, b2 - umulh t3, a0, b0 - umulh t4, a1, b1 - umulh s5, a2, b2 - - adds t3, t3, t1 - adcs t4, t4, t2 - adc s5, s5, xzr - - adds s1, t3, s0 - adcs s2, t4, t3 - adcs s3, s5, t4 - adc s4, s5, xzr - - adds s2, s2, s0 - adcs s3, s3, t3 - adcs s4, s4, t4 - adc s5, s5, xzr - - muldiffn(t3,t2,t1, t4, a0,a1, b1,b0) - adds xzr, t3, #1 - adcs s1, s1, t1 - adcs s2, s2, t2 - adcs s3, s3, t3 - adcs s4, s4, t3 - adc s5, s5, t3 - - muldiffn(t3,t2,t1, t4, a0,a2, b2,b0) - adds xzr, t3, #1 - adcs s2, s2, t1 - adcs s3, s3, t2 - adcs s4, s4, t3 - adc s5, s5, t3 - - muldiffn(t3,t2,t1, t4, a1,a2, b2,b1) - adds xzr, t3, #1 - adcs s3, s3, t1 - adcs s4, s4, t2 - adc s5, s5, t3 - -// Perform three "short" Montgomery steps on the low product -// This shifts it to an offset compatible with middle terms -// Stash the result temporarily in the output buffer -// We could keep this in registers by directly adding to it in the next -// ADK block, but if anything that seems to be slightly slower - - montreds(s0,s5,s4,s3,s2,s1,s0, t1,t2,t3) - - montreds(s1,s0,s5,s4,s3,s2,s1, t1,t2,t3) - - montreds(s2,s1,s0,s5,s4,s3,s2, t1,t2,t3) - - stp s3, s4, [x0] - stp s5, s0, [x0, #16] - stp s1, s2, [x0, #32] - -// Multiply high halves with a 3x3->6 ADK multiplier as [s5;s4;s3;s2;s1;s0] - - mul s0, a3, b3 - mul t1, a4, b4 - mul t2, a5, b5 - umulh t3, a3, b3 - umulh t4, a4, b4 - umulh s5, a5, b5 - - adds t3, t3, t1 - adcs t4, t4, t2 - adc s5, s5, xzr - - adds s1, t3, s0 - adcs s2, t4, t3 - adcs s3, s5, t4 - adc s4, s5, xzr - - adds s2, s2, s0 - adcs s3, s3, t3 - adcs s4, s4, t4 - adc s5, s5, xzr - - muldiffn(t3,t2,t1, t4, a3,a4, b4,b3) - adds xzr, t3, #1 - adcs s1, s1, t1 - adcs s2, s2, t2 - adcs s3, s3, t3 - adcs s4, s4, t3 - adc s5, s5, t3 - - muldiffn(t3,t2,t1, t4, a3,a5, b5,b3) - adds xzr, t3, #1 - adcs s2, s2, t1 - adcs s3, s3, t2 - adcs s4, s4, t3 - adc s5, s5, t3 - - muldiffn(t3,t2,t1, t4, a4,a5, b5,b4) - adds xzr, t3, #1 - adcs s3, s3, t1 - adcs s4, s4, t2 - adc s5, s5, t3 - -// Compute sign-magnitude a0,[a5,a4,a3] = x_hi - x_lo - - subs a3, a3, a0 - sbcs a4, a4, a1 - sbcs a5, a5, a2 - sbc a0, xzr, xzr - adds xzr, a0, #1 - eor a3, a3, a0 - adcs a3, a3, xzr - eor a4, a4, a0 - adcs a4, a4, xzr - eor a5, a5, a0 - adc a5, a5, xzr - -// Compute sign-magnitude b5,[b2,b1,b0] = y_lo - y_hi - - subs b0, b0, b3 - sbcs b1, b1, b4 - sbcs b2, b2, b5 - sbc b5, xzr, xzr - - adds xzr, b5, #1 - eor b0, b0, b5 - adcs b0, b0, xzr - eor b1, b1, b5 - adcs b1, b1, xzr - eor b2, b2, b5 - adc b2, b2, xzr - -// Save the correct sign for the sub-product in b5 - - eor b5, a0, b5 - -// Add the high H to the modified low term L' and re-stash 6 words, -// keeping top word in s6 - - ldp t1, t2, [x0] - adds s0, s0, t1 - adcs s1, s1, t2 - ldp t1, t2, [x0, #16] - adcs s2, s2, t1 - adcs s3, s3, t2 - ldp t1, t2, [x0, #32] - adcs s4, s4, t1 - adcs s5, s5, t2 - adc s6, xzr, xzr - stp s0, s1, [x0] - stp s2, s3, [x0, #16] - stp s4, s5, [x0, #32] - -// Multiply with yet a third 3x3 ADK for the complex mid-term - - mul s0, a3, b0 - mul t1, a4, b1 - mul t2, a5, b2 - umulh t3, a3, b0 - umulh t4, a4, b1 - umulh s5, a5, b2 - - adds t3, t3, t1 - adcs t4, t4, t2 - adc s5, s5, xzr - - adds s1, t3, s0 - adcs s2, t4, t3 - adcs s3, s5, t4 - adc s4, s5, xzr - - adds s2, s2, s0 - adcs s3, s3, t3 - adcs s4, s4, t4 - adc s5, s5, xzr - - muldiffn(t3,t2,t1, t4, a3,a4, b1,b0) - adds xzr, t3, #1 - adcs s1, s1, t1 - adcs s2, s2, t2 - adcs s3, s3, t3 - adcs s4, s4, t3 - adc s5, s5, t3 - - muldiffn(t3,t2,t1, t4, a3,a5, b2,b0) - adds xzr, t3, #1 - adcs s2, s2, t1 - adcs s3, s3, t2 - adcs s4, s4, t3 - adc s5, s5, t3 - - muldiffn(t3,t2,t1, t4, a4,a5, b2,b1) - adds xzr, t3, #1 - adcs s3, s3, t1 - adcs s4, s4, t2 - adc s5, s5, t3 - -// Unstash the H + L' sum to add in twice - - ldp a0, a1, [x0] - ldp a2, a3, [x0, #16] - ldp a4, a5, [x0, #32] - -// Set up a sign-modified version of the mid-product in a long accumulator -// as [b3;b2;b1;b0;s5;s4;s3;s2;s1;s0], adding in the H + L' term once with -// zero offset as this signed value is created - - adds xzr, b5, #1 - eor s0, s0, b5 - adcs s0, s0, a0 - eor s1, s1, b5 - adcs s1, s1, a1 - eor s2, s2, b5 - adcs s2, s2, a2 - eor s3, s3, b5 - adcs s3, s3, a3 - eor s4, s4, b5 - adcs s4, s4, a4 - eor s5, s5, b5 - adcs s5, s5, a5 - adcs b0, b5, s6 - adcs b1, b5, xzr - adcs b2, b5, xzr - adc b3, b5, xzr - -// Add in the stashed H + L' term an offset of 3 words as well - - adds s3, s3, a0 - adcs s4, s4, a1 - adcs s5, s5, a2 - adcs b0, b0, a3 - adcs b1, b1, a4 - adcs b2, b2, a5 - adc b3, b3, s6 - -// Do three more Montgomery steps on the composed term - - montreds(s0,s5,s4,s3,s2,s1,s0, t1,t2,t3) - montreds(s1,s0,s5,s4,s3,s2,s1, t1,t2,t3) - montreds(s2,s1,s0,s5,s4,s3,s2, t1,t2,t3) - - adds b0, b0, s0 - adcs b1, b1, s1 - adcs b2, b2, s2 - adc b3, b3, xzr - -// Because of the way we added L' in two places, we can overspill by -// more than usual in Montgomery, with the result being only known to -// be < 3 * p_384, not the usual < 2 * p_384. So now we do a more -// elaborate final correction in the style of bignum_cmul_p384, just -// a little bit simpler because we know q is small. - - add t2, b3, #1 - lsl t1, t2, #32 - subs t4, t2, t1 - sbc t1, t1, xzr - - adds s3, s3, t4 - adcs s4, s4, t1 - adcs s5, s5, t2 - adcs b0, b0, xzr - adcs b1, b1, xzr - adcs b2, b2, xzr - - csetm t2, cc - - mov t3, #0x00000000ffffffff - and t3, t3, t2 - adds s3, s3, t3 - eor t3, t3, t2 - adcs s4, s4, t3 - mov t3, #0xfffffffffffffffe - and t3, t3, t2 - adcs s5, s5, t3 - adcs b0, b0, t2 - adcs b1, b1, t2 - adc b2, b2, t2 - -// Write back the result - - stp s3, s4, [x0] - stp s5, b0, [x0, #16] - stp b1, b2, [x0, #32] - -// Restore registers and return - - ldp x23, x24, [sp], #16 - ldp x21, x22, [sp], #16 - ldp x19, x20, [sp], #16 - - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/bignum_montsqr_p384_base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/bignum_montsqr_p384_base.S deleted file mode 100644 index d8589608154..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/bignum_montsqr_p384_base.S +++ /dev/null @@ -1,374 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^384) mod p_384 -// Input x[6]; output z[6] -// -// extern void bignum_montsqr_p384_base -// (uint64_t z[static 6], uint64_t x[static 6]); -// -// Does z := (x^2 / 2^384) mod p_384, assuming x^2 <= 2^384 * p_384, which is -// guaranteed in particular if x < p_384 initially (the "intended" case). -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p384_base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p384_base) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro returning (c,h,l) = 3-word 1s complement (x - y) * (w - z) -// c,h,l,t should all be different -// t,h should not overlap w,z -// --------------------------------------------------------------------------- - -#define muldiffn(c,h,l, t, x,y, w,z) \ - subs t, x, y __LF \ - cneg t, t, cc __LF \ - csetm c, cc __LF \ - subs h, w, z __LF \ - cneg h, h, cc __LF \ - mul l, t, h __LF \ - umulh h, t, h __LF \ - cinv c, c, cc __LF \ - eor l, l, c __LF \ - eor h, h, c - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d5;d4;d3;d2;d1;d0] and returns result in [d6;d5;d4;d3;d2;d1], -// adding to the existing contents of [d5;d4;d3;d2;d1]. It is fine -// for d6 to be the same register as d0. -// -// We want to add (2^384 - 2^128 - 2^96 + 2^32 - 1) * w -// where w = [d0 + (d0<<32)] mod 2^64 -// --------------------------------------------------------------------------- - -#define montreds(d6,d5,d4,d3,d2,d1,d0, t3,t2,t1) \ -/* Our correction multiplier is w = [d0 + (d0<<32)] mod 2^64 */ \ -/* Recycle d0 (which we know gets implicitly cancelled) to store it */ \ - lsl t1, d0, #32 __LF \ - add d0, t1, d0 __LF \ -/* Now let [t2;t1] = 2^64 * w - w + w_hi where w_hi = floor(w/2^32) */ \ -/* We need to subtract 2^32 * this, and we can ignore its lower 32 */ \ -/* bits since by design it will cancel anyway; we only need the w_hi */ \ -/* part to get the carry propagation going. */ \ - lsr t1, d0, #32 __LF \ - subs t1, t1, d0 __LF \ - sbc t2, d0, xzr __LF \ -/* Now select in t1 the field to subtract from d1 */ \ - extr t1, t2, t1, #32 __LF \ -/* And now get the terms to subtract from d2 and d3 */ \ - lsr t2, t2, #32 __LF \ - adds t2, t2, d0 __LF \ - adc t3, xzr, xzr __LF \ -/* Do the subtraction of that portion */ \ - subs d1, d1, t1 __LF \ - sbcs d2, d2, t2 __LF \ - sbcs d3, d3, t3 __LF \ - sbcs d4, d4, xzr __LF \ - sbcs d5, d5, xzr __LF \ -/* Now effectively add 2^384 * w by taking d0 as the input for last sbc */ \ - sbc d6, d0, xzr - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 -#define a4 x6 -#define a5 x7 - -#define c0 x8 -#define c1 x9 -#define c2 x10 -#define c3 x11 -#define c4 x12 -#define c5 x13 -#define d1 x14 -#define d2 x15 -#define d3 x16 -#define d4 x17 - -S2N_BN_SYMBOL(bignum_montsqr_p384_base): - -// Load in all words of the input - - ldp a0, a1, [x1] - ldp a2, a3, [x1, #16] - ldp a4, a5, [x1, #32] - -// Square the low half getting a result in [c5;c4;c3;c2;c1;c0] - - mul d1, a0, a1 - mul d2, a0, a2 - mul d3, a1, a2 - mul c0, a0, a0 - mul c2, a1, a1 - mul c4, a2, a2 - - umulh d4, a0, a1 - adds d2, d2, d4 - umulh d4, a0, a2 - adcs d3, d3, d4 - umulh d4, a1, a2 - adcs d4, d4, xzr - - umulh c1, a0, a0 - umulh c3, a1, a1 - umulh c5, a2, a2 - - adds d1, d1, d1 - adcs d2, d2, d2 - adcs d3, d3, d3 - adcs d4, d4, d4 - adc c5, c5, xzr - - adds c1, c1, d1 - adcs c2, c2, d2 - adcs c3, c3, d3 - adcs c4, c4, d4 - adc c5, c5, xzr - -// Perform three "short" Montgomery steps on the low square -// This shifts it to an offset compatible with middle product -// Stash the result temporarily in the output buffer (to avoid more registers) - - montreds(c0,c5,c4,c3,c2,c1,c0, d1,d2,d3) - - montreds(c1,c0,c5,c4,c3,c2,c1, d1,d2,d3) - - montreds(c2,c1,c0,c5,c4,c3,c2, d1,d2,d3) - - stp c3, c4, [x0] - stp c5, c0, [x0, #16] - stp c1, c2, [x0, #32] - -// Compute product of the cross-term with ADK 3x3->6 multiplier - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 -#define a4 x6 -#define a5 x7 -#define s0 x8 -#define s1 x9 -#define s2 x10 -#define s3 x11 -#define s4 x12 -#define s5 x13 - -#define l1 x14 -#define l2 x15 -#define h0 x16 -#define h1 x17 -#define h2 x1 - -#define s6 h1 -#define c l1 -#define h l2 -#define l h0 -#define t h1 - - mul s0, a0, a3 - mul l1, a1, a4 - mul l2, a2, a5 - umulh h0, a0, a3 - umulh h1, a1, a4 - umulh h2, a2, a5 - - adds h0, h0, l1 - adcs h1, h1, l2 - adc h2, h2, xzr - - adds s1, h0, s0 - adcs s2, h1, h0 - adcs s3, h2, h1 - adc s4, h2, xzr - - adds s2, s2, s0 - adcs s3, s3, h0 - adcs s4, s4, h1 - adc s5, h2, xzr - - muldiffn(c,h,l, t, a0,a1, a4,a3) - adds xzr, c, #1 - adcs s1, s1, l - adcs s2, s2, h - adcs s3, s3, c - adcs s4, s4, c - adc s5, s5, c - - muldiffn(c,h,l, t, a0,a2, a5,a3) - adds xzr, c, #1 - adcs s2, s2, l - adcs s3, s3, h - adcs s4, s4, c - adc s5, s5, c - - muldiffn(c,h,l, t, a1,a2, a5,a4) - adds xzr, c, #1 - adcs s3, s3, l - adcs s4, s4, h - adc s5, s5, c - -// Double it and add the stashed Montgomerified low square - - adds s0, s0, s0 - adcs s1, s1, s1 - adcs s2, s2, s2 - adcs s3, s3, s3 - adcs s4, s4, s4 - adcs s5, s5, s5 - adc s6, xzr, xzr - - ldp a0, a1, [x0] - adds s0, s0, a0 - adcs s1, s1, a1 - ldp a0, a1, [x0, #16] - adcs s2, s2, a0 - adcs s3, s3, a1 - ldp a0, a1, [x0, #32] - adcs s4, s4, a0 - adcs s5, s5, a1 - adc s6, s6, xzr - -// Montgomery-reduce the combined low and middle term another thrice - - montreds(s0,s5,s4,s3,s2,s1,s0, a0,a1,a2) - - montreds(s1,s0,s5,s4,s3,s2,s1, a0,a1,a2) - - montreds(s2,s1,s0,s5,s4,s3,s2, a0,a1,a2) - - adds s6, s6, s0 - adcs s0, s1, xzr - adcs s1, s2, xzr - adcs s2, xzr, xzr - -// Our sum so far is in [s2;s1;s0;s6;s5;s4;s3] -// Choose more intuitive names - -#define r0 x11 -#define r1 x12 -#define r2 x13 -#define r3 x17 -#define r4 x8 -#define r5 x9 -#define r6 x10 - -// Remind ourselves what else we can't destroy - -#define a3 x5 -#define a4 x6 -#define a5 x7 - -// So we can have these as temps - -#define t1 x1 -#define t2 x14 -#define t3 x15 -#define t4 x16 - -// Add in all the pure squares 33 + 44 + 55 - - mul t1, a3, a3 - adds r0, r0, t1 - mul t2, a4, a4 - mul t3, a5, a5 - umulh t1, a3, a3 - adcs r1, r1, t1 - umulh t1, a4, a4 - adcs r2, r2, t2 - adcs r3, r3, t1 - umulh t1, a5, a5 - adcs r4, r4, t3 - adcs r5, r5, t1 - adc r6, r6, xzr - -// Now compose the 34 + 35 + 45 terms, which need doubling - - mul t1, a3, a4 - mul t2, a3, a5 - mul t3, a4, a5 - umulh t4, a3, a4 - adds t2, t2, t4 - umulh t4, a3, a5 - adcs t3, t3, t4 - umulh t4, a4, a5 - adc t4, t4, xzr - -// Double and add. Recycle one of the no-longer-needed inputs as a temp - -#define t5 x5 - - adds t1, t1, t1 - adcs t2, t2, t2 - adcs t3, t3, t3 - adcs t4, t4, t4 - adc t5, xzr, xzr - - adds r1, r1, t1 - adcs r2, r2, t2 - adcs r3, r3, t3 - adcs r4, r4, t4 - adcs r5, r5, t5 - adc r6, r6, xzr - -// We know, writing B = 2^{6*64} that the full implicit result is -// B^2 c <= z + (B - 1) * p < B * p + (B - 1) * p < 2 * B * p, -// so the top half is certainly < 2 * p. If c = 1 already, we know -// subtracting p will give the reduced modulus. But now we do a -// comparison to catch cases where the residue is >= p. -// First set [0;0;0;t3;t2;t1] = 2^384 - p_384 - - mov t1, #0xffffffff00000001 - mov t2, #0x00000000ffffffff - mov t3, #0x0000000000000001 - -// Let dd = [] be the 6-word intermediate result. -// Set CF if the addition dd + (2^384 - p_384) >= 2^384, hence iff dd >= p_384. - - adds xzr, r0, t1 - adcs xzr, r1, t2 - adcs xzr, r2, t3 - adcs xzr, r3, xzr - adcs xzr, r4, xzr - adcs xzr, r5, xzr - -// Now just add this new carry into the existing r6. It's easy to see they -// can't both be 1 by our range assumptions, so this gives us a {0,1} flag - - adc r6, r6, xzr - -// Now convert it into a bitmask - - sub r6, xzr, r6 - -// Masked addition of 2^384 - p_384, hence subtraction of p_384 - - and t1, t1, r6 - adds r0, r0, t1 - and t2, t2, r6 - adcs r1, r1, t2 - and t3, t3, r6 - adcs r2, r2, t3 - adcs r3, r3, xzr - adcs r4, r4, xzr - adc r5, r5, xzr - -// Store it back - - stp r0, r1, [x0] - stp r2, r3, [x0, #16] - stp r4, r5, [x0, #32] - - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/p384_montjadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/p384_montjadd.S deleted file mode 100644 index df9009cd6dc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/p384_montjadd.S +++ /dev/null @@ -1,1036 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-384 in Montgomery-Jacobian coordinates -// -// extern void p384_montjadd -// (uint64_t p3[static 18],uint64_t p1[static 18],uint64_t p2[static 18]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^384 * x) mod p_384. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p384_montjadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p384_montjadd) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 48 - -// Stable homes for input arguments during main code sequence - -#define input_z x24 -#define input_x x25 -#define input_y x26 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE -#define z_2 input_y, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z1sq sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define x1a sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define z2sq sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define y1a sp, #(NUMSIZE*6) - -#define NSPACE (NUMSIZE*7) - -// Corresponds to bignum_montmul_p384, with callee-save register spills -// rewritten to update sp in advance - -.montmul_p384: - sub sp, sp, 48 - stp x19, x20, [sp, 32] - stp x21, x22, [sp, 16] - stp x23, x24, [sp] - ldr q3, [x1] - ldr q25, [x2] - ldp x13, x23, [x2] - ldp x3, x21, [x1] - rev64 v23.4S, v25.4S - uzp1 v17.4S, v25.4S, v3.4S - umulh x15, x3, x13 - mul v6.4S, v23.4S, v3.4S - uzp1 v3.4S, v3.4S, v3.4S - ldr q27, [x2, #32] - ldp x8, x24, [x1, #16] - subs x6, x3, x21 - ldr q0, [x1, #32] - movi v23.2D, #0x00000000ffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4S, v27.4S - uzp2 v25.4S, v27.4S, v27.4S - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2S, v0.2D - xtn v24.2S, v27.2D - cneg x20, x7, cc - ldp x6, x14, [x2, #16] - mul v27.4S, v4.4S, v0.4S - uaddlp v20.2D, v6.4S - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4S, v0.4S, v0.4S - umull v21.2D, v22.2S, v25.2S - shl v0.2D, v20.2D, #32 - umlal v0.2D, v3.2S, v17.2S - mul x22, x8, x6 - umull v1.2D, v6.2S, v25.2S - subs x12, x3, x8 - umull v20.2D, v22.2S, v24.2S - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2D, v20.2D, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2D, v21.2D, #32 - adds x22, x15, x7 - and v26.16B, v21.16B, v23.16B - adcs x16, x12, x15 - uaddlp v25.2D, v27.4S - adcs x9, x19, x12 - umlal v26.2D, v6.2S, v24.2S - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2D, v25.2D, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2D, v22.2S, v24.2S - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2D, v26.2D, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [x2, #32] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [x1, #32] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [x0] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [x0, #16] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [x0, #32] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [x0] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [x0, #16] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [x0, #32] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [x0] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [x0, #16] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [x0, #32] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [x0] - ldp x21, x12, [x0, #16] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [x0, #32] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x14, x24, x11 - stp x22, x5, [x0] - adcs x5, x13, x23 - adcs x21, x8, x23 - stp x14, x5, [x0, #16] - adc x12, x15, x23 - stp x21, x12, [x0, #32] - ldp x23, x24, [sp] - ldp x21, x22, [sp, 16] - ldp x19, x20, [sp, 32] - add sp, sp, 48 - ret - -// Corresponds exactly to bignum_montsqr_p384 - -.montsqr_p384: - ldr q1, [x1] - ldp x9, x2, [x1] - ldr q0, [x1] - ldp x4, x6, [x1, #16] - rev64 v21.4S, v1.4S - uzp2 v28.4S, v1.4S, v1.4S - umulh x7, x9, x2 - xtn v17.2S, v1.2D - mul v27.4S, v21.4S, v0.4S - ldr q20, [x1, #32] - xtn v30.2S, v0.2D - ldr q1, [x1, #32] - uzp2 v31.4S, v0.4S, v0.4S - ldp x5, x10, [x1, #32] - umulh x8, x9, x4 - uaddlp v3.2D, v27.4S - umull v16.2D, v30.2S, v17.2S - mul x16, x9, x4 - umull v27.2D, v30.2S, v28.2S - shrn v0.2S, v20.2D, #32 - xtn v7.2S, v20.2D - shl v20.2D, v3.2D, #32 - umull v3.2D, v31.2S, v28.2S - mul x3, x2, x4 - umlal v20.2D, v30.2S, v17.2S - umull v22.2D, v7.2S, v0.2S - usra v27.2D, v16.2D, #32 - umulh x11, x2, x4 - movi v21.2D, #0x00000000ffffffff - uzp2 v28.4S, v1.4S, v1.4S - adds x15, x16, x7 - and v5.16B, v27.16B, v21.16B - adcs x3, x3, x8 - usra v3.2D, v27.2D, #32 - dup v29.2D, x6 - adcs x16, x11, xzr - mov x14, v20.d[0] - umlal v5.2D, v31.2S, v17.2S - mul x8, x9, x2 - mov x7, v20.d[1] - shl v19.2D, v22.2D, #33 - xtn v25.2S, v29.2D - rev64 v31.4S, v1.4S - lsl x13, x14, #32 - uzp2 v6.4S, v29.4S, v29.4S - umlal v19.2D, v7.2S, v7.2S - usra v3.2D, v5.2D, #32 - adds x1, x8, x8 - umulh x8, x4, x4 - add x12, x13, x14 - mul v17.4S, v31.4S, v29.4S - xtn v4.2S, v1.2D - adcs x14, x15, x15 - lsr x13, x12, #32 - adcs x15, x3, x3 - umull v31.2D, v25.2S, v28.2S - adcs x11, x16, x16 - umull v21.2D, v25.2S, v4.2S - mov x17, v3.d[0] - umull v18.2D, v6.2S, v28.2S - adc x16, x8, xzr - uaddlp v16.2D, v17.4S - movi v1.2D, #0x00000000ffffffff - subs x13, x13, x12 - usra v31.2D, v21.2D, #32 - sbc x8, x12, xzr - adds x17, x17, x1 - mul x1, x4, x4 - shl v28.2D, v16.2D, #32 - mov x3, v3.d[1] - adcs x14, x7, x14 - extr x7, x8, x13, #32 - adcs x13, x3, x15 - and v3.16B, v31.16B, v1.16B - adcs x11, x1, x11 - lsr x1, x8, #32 - umlal v3.2D, v6.2S, v4.2S - usra v18.2D, v31.2D, #32 - adc x3, x16, xzr - adds x1, x1, x12 - umlal v28.2D, v25.2S, v4.2S - adc x16, xzr, xzr - subs x15, x17, x7 - sbcs x7, x14, x1 - lsl x1, x15, #32 - sbcs x16, x13, x16 - add x8, x1, x15 - usra v18.2D, v3.2D, #32 - sbcs x14, x11, xzr - lsr x1, x8, #32 - sbcs x17, x3, xzr - sbc x11, x12, xzr - subs x13, x1, x8 - umulh x12, x4, x10 - sbc x1, x8, xzr - extr x13, x1, x13, #32 - lsr x1, x1, #32 - adds x15, x1, x8 - adc x1, xzr, xzr - subs x7, x7, x13 - sbcs x13, x16, x15 - lsl x3, x7, #32 - umulh x16, x2, x5 - sbcs x15, x14, x1 - add x7, x3, x7 - sbcs x3, x17, xzr - lsr x1, x7, #32 - sbcs x14, x11, xzr - sbc x11, x8, xzr - subs x8, x1, x7 - sbc x1, x7, xzr - extr x8, x1, x8, #32 - lsr x1, x1, #32 - adds x1, x1, x7 - adc x17, xzr, xzr - subs x13, x13, x8 - umulh x8, x9, x6 - sbcs x1, x15, x1 - sbcs x15, x3, x17 - sbcs x3, x14, xzr - mul x17, x2, x5 - sbcs x11, x11, xzr - stp x13, x1, [x0] - sbc x14, x7, xzr - mul x7, x4, x10 - subs x1, x9, x2 - stp x15, x3, [x0, #16] - csetm x15, cc - cneg x1, x1, cc - stp x11, x14, [x0, #32] - mul x14, x9, x6 - adds x17, x8, x17 - adcs x7, x16, x7 - adc x13, x12, xzr - subs x12, x5, x6 - cneg x3, x12, cc - cinv x16, x15, cc - mul x8, x1, x3 - umulh x1, x1, x3 - eor x12, x8, x16 - adds x11, x17, x14 - adcs x3, x7, x17 - adcs x15, x13, x7 - adc x8, x13, xzr - adds x3, x3, x14 - adcs x15, x15, x17 - adcs x17, x8, x7 - eor x1, x1, x16 - adc x13, x13, xzr - subs x9, x9, x4 - csetm x8, cc - cneg x9, x9, cc - subs x4, x2, x4 - cneg x4, x4, cc - csetm x7, cc - subs x2, x10, x6 - cinv x8, x8, cc - cneg x2, x2, cc - cmn x16, #0x1 - adcs x11, x11, x12 - mul x12, x9, x2 - adcs x3, x3, x1 - adcs x15, x15, x16 - umulh x9, x9, x2 - adcs x17, x17, x16 - adc x13, x13, x16 - subs x1, x10, x5 - cinv x2, x7, cc - cneg x1, x1, cc - eor x9, x9, x8 - cmn x8, #0x1 - eor x7, x12, x8 - mul x12, x4, x1 - adcs x3, x3, x7 - adcs x7, x15, x9 - adcs x15, x17, x8 - ldp x9, x17, [x0, #16] - umulh x4, x4, x1 - adc x8, x13, x8 - cmn x2, #0x1 - eor x1, x12, x2 - adcs x1, x7, x1 - ldp x7, x16, [x0] - eor x12, x4, x2 - adcs x4, x15, x12 - ldp x15, x12, [x0, #32] - adc x8, x8, x2 - adds x13, x14, x14 - umulh x14, x5, x10 - adcs x2, x11, x11 - adcs x3, x3, x3 - adcs x1, x1, x1 - adcs x4, x4, x4 - adcs x11, x8, x8 - adc x8, xzr, xzr - adds x13, x13, x7 - adcs x2, x2, x16 - mul x16, x5, x10 - adcs x3, x3, x9 - adcs x1, x1, x17 - umulh x5, x5, x5 - lsl x9, x13, #32 - add x9, x9, x13 - adcs x4, x4, x15 - mov x13, v28.d[1] - adcs x15, x11, x12 - lsr x7, x9, #32 - adc x11, x8, xzr - subs x7, x7, x9 - umulh x10, x10, x10 - sbc x17, x9, xzr - extr x7, x17, x7, #32 - lsr x17, x17, #32 - adds x17, x17, x9 - adc x12, xzr, xzr - subs x8, x2, x7 - sbcs x17, x3, x17 - lsl x7, x8, #32 - sbcs x2, x1, x12 - add x3, x7, x8 - sbcs x12, x4, xzr - lsr x1, x3, #32 - sbcs x7, x15, xzr - sbc x15, x9, xzr - subs x1, x1, x3 - sbc x4, x3, xzr - lsr x9, x4, #32 - extr x8, x4, x1, #32 - adds x9, x9, x3 - adc x4, xzr, xzr - subs x1, x17, x8 - lsl x17, x1, #32 - sbcs x8, x2, x9 - sbcs x9, x12, x4 - add x17, x17, x1 - mov x1, v18.d[1] - lsr x2, x17, #32 - sbcs x7, x7, xzr - mov x12, v18.d[0] - sbcs x15, x15, xzr - sbc x3, x3, xzr - subs x4, x2, x17 - sbc x2, x17, xzr - adds x12, x13, x12 - adcs x16, x16, x1 - lsr x13, x2, #32 - extr x1, x2, x4, #32 - adc x2, x14, xzr - adds x4, x13, x17 - mul x13, x6, x6 - adc x14, xzr, xzr - subs x1, x8, x1 - sbcs x4, x9, x4 - mov x9, v28.d[0] - sbcs x7, x7, x14 - sbcs x8, x15, xzr - sbcs x3, x3, xzr - sbc x14, x17, xzr - adds x17, x9, x9 - adcs x12, x12, x12 - mov x15, v19.d[0] - adcs x9, x16, x16 - umulh x6, x6, x6 - adcs x16, x2, x2 - adc x2, xzr, xzr - adds x11, x11, x8 - adcs x3, x3, xzr - adcs x14, x14, xzr - adcs x8, xzr, xzr - adds x13, x1, x13 - mov x1, v19.d[1] - adcs x6, x4, x6 - mov x4, #0xffffffff - adcs x15, x7, x15 - adcs x7, x11, x5 - adcs x1, x3, x1 - adcs x14, x14, x10 - adc x11, x8, xzr - adds x6, x6, x17 - adcs x8, x15, x12 - adcs x3, x7, x9 - adcs x15, x1, x16 - mov x16, #0xffffffff00000001 - adcs x14, x14, x2 - mov x2, #0x1 - adc x17, x11, xzr - cmn x13, x16 - adcs xzr, x6, x4 - adcs xzr, x8, x2 - adcs xzr, x3, xzr - adcs xzr, x15, xzr - adcs xzr, x14, xzr - adc x1, x17, xzr - neg x9, x1 - and x1, x16, x9 - adds x11, x13, x1 - and x13, x4, x9 - adcs x5, x6, x13 - and x1, x2, x9 - adcs x7, x8, x1 - stp x11, x5, [x0] - adcs x11, x3, xzr - adcs x2, x15, xzr - stp x7, x11, [x0, #16] - adc x17, x14, xzr - stp x2, x17, [x0, #32] - ret - -// Corresponds exactly to bignum_sub_p384 - -.sub_p384: - ldp x5, x6, [x1] - ldp x4, x3, [x2] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [x1, #16] - ldp x4, x3, [x2, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - ldp x9, x10, [x1, #32] - ldp x4, x3, [x2, #32] - sbcs x9, x9, x4 - sbcs x10, x10, x3 - csetm x3, cc - mov x4, #0xffffffff - and x4, x4, x3 - adds x5, x5, x4 - eor x4, x4, x3 - adcs x6, x6, x4 - mov x4, #0xfffffffffffffffe - and x4, x4, x3 - adcs x7, x7, x4 - adcs x8, x8, x3 - adcs x9, x9, x3 - adc x10, x10, x3 - stp x5, x6, [x0] - stp x7, x8, [x0, #16] - stp x9, x10, [x0, #32] - ret - - -#define montmul_p384(P0,P1,P2) \ - add x0, P0;\ - add x1, P1;\ - add x2, P2;\ - bl .montmul_p384 - -#define montsqr_p384(P0,P1) \ - add x0, P0;\ - add x1, P1;\ - bl .montsqr_p384 - -#define sub_p384(P0,P1,P2) \ - add x0, P0;\ - add x1, P1;\ - add x2, P2;\ - bl .sub_p384 - - -S2N_BN_SYMBOL(p384_montjadd): - -// Save regs and make room on stack for temporary variables - - stp x19, x20, [sp, #-16]! - stp x21, x22, [sp, #-16]! - stp x23, x24, [sp, #-16]! - stp x25, x26, [sp, #-16]! - stp x30, xzr, [sp, #-16]! - sub sp, sp, NSPACE - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - montsqr_p384(z1sq,z_1) - montsqr_p384(z2sq,z_2) - - montmul_p384(y1a,z_2,y_1) - montmul_p384(y2a,z_1,y_2) - - montmul_p384(x2a,z1sq,x_2) - montmul_p384(x1a,z2sq,x_1) - montmul_p384(y2a,z1sq,y2a) - montmul_p384(y1a,z2sq,y1a) - - sub_p384(xd,x2a,x1a) - sub_p384(yd,y2a,y1a) - - montsqr_p384(zz,xd) - montsqr_p384(ww,yd) - - montmul_p384(zzx1,zz,x1a) - montmul_p384(zzx2,zz,x2a) - - sub_p384(resx,ww,zzx1) - sub_p384(t1,zzx2,zzx1) - - montmul_p384(xd,xd,z_1) - - sub_p384(resx,resx,zzx2) - - sub_p384(t2,zzx1,resx) - - montmul_p384(t1,t1,y1a) - montmul_p384(resz,xd,z_2) - montmul_p384(t2,yd,t2) - - sub_p384(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "HI" <=> CF /\ ~ZF <=> P1 = 0 /\ ~(P2 = 0) -// and "LO" <=> ~CF <=> ~(P1 = 0) /\ P2 = 0 - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - ldp x4, x5, [z_1+32] - - orr x20, x0, x1 - orr x21, x2, x3 - orr x22, x4, x5 - orr x20, x20, x21 - orr x20, x20, x22 - cmp x20, xzr - cset x20, ne - - ldp x6, x7, [z_2] - ldp x8, x9, [z_2+16] - ldp x10, x11, [z_2+32] - - orr x21, x6, x7 - orr x22, x8, x9 - orr x23, x10, x11 - orr x21, x21, x22 - orr x21, x21, x23 - cmp x21, xzr - cset x21, ne - - cmp x21, x20 - -// Multiplex the outputs accordingly, re-using the z's in registers - - ldp x12, x13, [resz] - csel x12, x0, x12, lo - csel x13, x1, x13, lo - csel x12, x6, x12, hi - csel x13, x7, x13, hi - ldp x14, x15, [resz+16] - csel x14, x2, x14, lo - csel x15, x3, x15, lo - csel x14, x8, x14, hi - csel x15, x9, x15, hi - ldp x16, x17, [resz+32] - csel x16, x4, x16, lo - csel x17, x5, x17, lo - csel x16, x10, x16, hi - csel x17, x11, x17, hi - - ldp x20, x21, [x_1] - ldp x0, x1, [resx] - csel x0, x20, x0, lo - csel x1, x21, x1, lo - ldp x20, x21, [x_2] - csel x0, x20, x0, hi - csel x1, x21, x1, hi - - ldp x20, x21, [x_1+16] - ldp x2, x3, [resx+16] - csel x2, x20, x2, lo - csel x3, x21, x3, lo - ldp x20, x21, [x_2+16] - csel x2, x20, x2, hi - csel x3, x21, x3, hi - - ldp x20, x21, [x_1+32] - ldp x4, x5, [resx+32] - csel x4, x20, x4, lo - csel x5, x21, x5, lo - ldp x20, x21, [x_2+32] - csel x4, x20, x4, hi - csel x5, x21, x5, hi - - ldp x20, x21, [y_1] - ldp x6, x7, [resy] - csel x6, x20, x6, lo - csel x7, x21, x7, lo - ldp x20, x21, [y_2] - csel x6, x20, x6, hi - csel x7, x21, x7, hi - - ldp x20, x21, [y_1+16] - ldp x8, x9, [resy+16] - csel x8, x20, x8, lo - csel x9, x21, x9, lo - ldp x20, x21, [y_2+16] - csel x8, x20, x8, hi - csel x9, x21, x9, hi - - ldp x20, x21, [y_1+32] - ldp x10, x11, [resy+32] - csel x10, x20, x10, lo - csel x11, x21, x11, lo - ldp x20, x21, [y_2+32] - csel x10, x20, x10, hi - csel x11, x21, x11, hi - -// Finally store back the multiplexed values - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [x_3+32] - stp x6, x7, [y_3] - stp x8, x9, [y_3+16] - stp x10, x11, [y_3+32] - stp x12, x13, [z_3] - stp x14, x15, [z_3+16] - stp x16, x17, [z_3+32] - -// Restore stack and registers - - add sp, sp, NSPACE - - ldp x30, xzr, [sp], 16 - ldp x25, x26, [sp], 16 - ldp x23, x24, [sp], 16 - ldp x21, x22, [sp], 16 - ldp x19, x20, [sp], 16 - - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/p384_montjdouble.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/p384_montjdouble.S deleted file mode 100644 index 42bf3735ce1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p384/unopt/p384_montjdouble.S +++ /dev/null @@ -1,1216 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on NIST curve P-384 in Montgomery-Jacobian coordinates -// -// extern void p384_montjdouble -// (uint64_t p3[static 18],uint64_t p1[static 18]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^384 * x) mod p_384. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p384_montjdouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p384_montjdouble) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 48 - -// Stable homes for input arguments during main code sequence - -#define input_z x25 -#define input_x x26 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z2 sp, #(NUMSIZE*0) -#define y2 sp, #(NUMSIZE*1) -#define x2p sp, #(NUMSIZE*2) -#define xy2 sp, #(NUMSIZE*3) - -#define y4 sp, #(NUMSIZE*4) -#define t2 sp, #(NUMSIZE*4) - -#define dx2 sp, #(NUMSIZE*5) -#define t1 sp, #(NUMSIZE*5) - -#define d_ sp, #(NUMSIZE*6) -#define x4p sp, #(NUMSIZE*6) - -#define NSPACE #(NUMSIZE*7) - -// Corresponds exactly to bignum_montmul_p384 - -.montmul_p384: - sub sp, sp, 48 - stp x19, x20, [sp, 32] - stp x21, x22, [sp, 16] - stp x23, x24, [sp] - ldr q3, [x1] - ldr q25, [x2] - ldp x13, x23, [x2] - ldp x3, x21, [x1] - rev64 v23.4S, v25.4S - uzp1 v17.4S, v25.4S, v3.4S - umulh x15, x3, x13 - mul v6.4S, v23.4S, v3.4S - uzp1 v3.4S, v3.4S, v3.4S - ldr q27, [x2, #32] - ldp x8, x24, [x1, #16] - subs x6, x3, x21 - ldr q0, [x1, #32] - movi v23.2D, #0x00000000ffffffff - csetm x10, cc - umulh x19, x21, x23 - rev64 v4.4S, v27.4S - uzp2 v25.4S, v27.4S, v27.4S - cneg x4, x6, cc - subs x7, x23, x13 - xtn v22.2S, v0.2D - xtn v24.2S, v27.2D - cneg x20, x7, cc - ldp x6, x14, [x2, #16] - mul v27.4S, v4.4S, v0.4S - uaddlp v20.2D, v6.4S - cinv x5, x10, cc - mul x16, x4, x20 - uzp2 v6.4S, v0.4S, v0.4S - umull v21.2D, v22.2S, v25.2S - shl v0.2D, v20.2D, #32 - umlal v0.2D, v3.2S, v17.2S - mul x22, x8, x6 - umull v1.2D, v6.2S, v25.2S - subs x12, x3, x8 - umull v20.2D, v22.2S, v24.2S - cneg x17, x12, cc - umulh x9, x8, x6 - mov x12, v0.d[1] - eor x11, x16, x5 - mov x7, v0.d[0] - csetm x10, cc - usra v21.2D, v20.2D, #32 - adds x15, x15, x12 - adcs x12, x19, x22 - umulh x20, x4, x20 - adc x19, x9, xzr - usra v1.2D, v21.2D, #32 - adds x22, x15, x7 - and v26.16B, v21.16B, v23.16B - adcs x16, x12, x15 - uaddlp v25.2D, v27.4S - adcs x9, x19, x12 - umlal v26.2D, v6.2S, v24.2S - adc x4, x19, xzr - adds x16, x16, x7 - shl v27.2D, v25.2D, #32 - adcs x9, x9, x15 - adcs x4, x4, x12 - eor x12, x20, x5 - adc x15, x19, xzr - subs x20, x6, x13 - cneg x20, x20, cc - cinv x10, x10, cc - cmn x5, #0x1 - mul x19, x17, x20 - adcs x11, x22, x11 - adcs x12, x16, x12 - adcs x9, x9, x5 - umulh x17, x17, x20 - adcs x22, x4, x5 - adc x5, x15, x5 - subs x16, x21, x8 - cneg x20, x16, cc - eor x19, x19, x10 - csetm x4, cc - subs x16, x6, x23 - cneg x16, x16, cc - umlal v27.2D, v22.2S, v24.2S - mul x15, x20, x16 - cinv x4, x4, cc - cmn x10, #0x1 - usra v1.2D, v26.2D, #32 - adcs x19, x12, x19 - eor x17, x17, x10 - adcs x9, x9, x17 - adcs x22, x22, x10 - lsl x12, x7, #32 - umulh x20, x20, x16 - eor x16, x15, x4 - ldp x15, x17, [x2, #32] - add x2, x12, x7 - adc x7, x5, x10 - ldp x5, x10, [x1, #32] - lsr x1, x2, #32 - eor x12, x20, x4 - subs x1, x1, x2 - sbc x20, x2, xzr - cmn x4, #0x1 - adcs x9, x9, x16 - extr x1, x20, x1, #32 - lsr x20, x20, #32 - adcs x22, x22, x12 - adc x16, x7, x4 - adds x12, x20, x2 - umulh x7, x24, x14 - adc x4, xzr, xzr - subs x1, x11, x1 - sbcs x20, x19, x12 - sbcs x12, x9, x4 - lsl x9, x1, #32 - add x1, x9, x1 - sbcs x9, x22, xzr - mul x22, x24, x14 - sbcs x16, x16, xzr - lsr x4, x1, #32 - sbc x19, x2, xzr - subs x4, x4, x1 - sbc x11, x1, xzr - extr x2, x11, x4, #32 - lsr x4, x11, #32 - adds x4, x4, x1 - adc x11, xzr, xzr - subs x2, x20, x2 - sbcs x4, x12, x4 - sbcs x20, x9, x11 - lsl x12, x2, #32 - add x2, x12, x2 - sbcs x9, x16, xzr - lsr x11, x2, #32 - sbcs x19, x19, xzr - sbc x1, x1, xzr - subs x16, x11, x2 - sbc x12, x2, xzr - extr x16, x12, x16, #32 - lsr x12, x12, #32 - adds x11, x12, x2 - adc x12, xzr, xzr - subs x16, x4, x16 - mov x4, v27.d[0] - sbcs x11, x20, x11 - sbcs x20, x9, x12 - stp x16, x11, [x0] - sbcs x11, x19, xzr - sbcs x9, x1, xzr - stp x20, x11, [x0, #16] - mov x1, v1.d[0] - sbc x20, x2, xzr - subs x12, x24, x5 - mov x11, v27.d[1] - cneg x16, x12, cc - csetm x2, cc - subs x19, x15, x14 - mov x12, v1.d[1] - cinv x2, x2, cc - cneg x19, x19, cc - stp x9, x20, [x0, #32] - mul x9, x16, x19 - adds x4, x7, x4 - adcs x11, x1, x11 - adc x1, x12, xzr - adds x20, x4, x22 - umulh x19, x16, x19 - adcs x7, x11, x4 - eor x16, x9, x2 - adcs x9, x1, x11 - adc x12, x1, xzr - adds x7, x7, x22 - adcs x4, x9, x4 - adcs x9, x12, x11 - adc x12, x1, xzr - cmn x2, #0x1 - eor x1, x19, x2 - adcs x11, x20, x16 - adcs x19, x7, x1 - adcs x1, x4, x2 - adcs x20, x9, x2 - adc x2, x12, x2 - subs x12, x24, x10 - cneg x16, x12, cc - csetm x12, cc - subs x9, x17, x14 - cinv x12, x12, cc - cneg x9, x9, cc - subs x3, x24, x3 - sbcs x21, x5, x21 - mul x24, x16, x9 - sbcs x4, x10, x8 - ngc x8, xzr - subs x10, x5, x10 - eor x5, x24, x12 - csetm x7, cc - cneg x24, x10, cc - subs x10, x17, x15 - cinv x7, x7, cc - cneg x10, x10, cc - subs x14, x13, x14 - sbcs x15, x23, x15 - eor x13, x21, x8 - mul x23, x24, x10 - sbcs x17, x6, x17 - eor x6, x3, x8 - ngc x21, xzr - umulh x9, x16, x9 - cmn x8, #0x1 - eor x3, x23, x7 - adcs x23, x6, xzr - adcs x13, x13, xzr - eor x16, x4, x8 - adc x16, x16, xzr - eor x4, x17, x21 - umulh x17, x24, x10 - cmn x21, #0x1 - eor x24, x14, x21 - eor x6, x15, x21 - adcs x15, x24, xzr - adcs x14, x6, xzr - adc x6, x4, xzr - cmn x12, #0x1 - eor x4, x9, x12 - adcs x19, x19, x5 - umulh x5, x23, x15 - adcs x1, x1, x4 - adcs x10, x20, x12 - eor x4, x17, x7 - ldp x20, x9, [x0] - adc x2, x2, x12 - cmn x7, #0x1 - adcs x12, x1, x3 - ldp x17, x24, [x0, #16] - mul x1, x16, x6 - adcs x3, x10, x4 - adc x2, x2, x7 - ldp x7, x4, [x0, #32] - adds x20, x22, x20 - mul x10, x13, x14 - adcs x11, x11, x9 - eor x9, x8, x21 - adcs x21, x19, x17 - stp x20, x11, [x0] - adcs x12, x12, x24 - mul x8, x23, x15 - adcs x3, x3, x7 - stp x21, x12, [x0, #16] - adcs x12, x2, x4 - adc x19, xzr, xzr - subs x21, x23, x16 - umulh x2, x16, x6 - stp x3, x12, [x0, #32] - cneg x3, x21, cc - csetm x24, cc - umulh x11, x13, x14 - subs x21, x13, x16 - eor x7, x8, x9 - cneg x17, x21, cc - csetm x16, cc - subs x21, x6, x15 - cneg x22, x21, cc - cinv x21, x24, cc - subs x20, x23, x13 - umulh x12, x3, x22 - cneg x23, x20, cc - csetm x24, cc - subs x20, x14, x15 - cinv x24, x24, cc - mul x22, x3, x22 - cneg x3, x20, cc - subs x13, x6, x14 - cneg x20, x13, cc - cinv x15, x16, cc - adds x13, x5, x10 - mul x4, x23, x3 - adcs x11, x11, x1 - adc x14, x2, xzr - adds x5, x13, x8 - adcs x16, x11, x13 - umulh x23, x23, x3 - adcs x3, x14, x11 - adc x1, x14, xzr - adds x10, x16, x8 - adcs x6, x3, x13 - adcs x8, x1, x11 - umulh x13, x17, x20 - eor x1, x4, x24 - adc x4, x14, xzr - cmn x24, #0x1 - adcs x1, x5, x1 - eor x16, x23, x24 - eor x11, x1, x9 - adcs x23, x10, x16 - eor x2, x22, x21 - adcs x3, x6, x24 - mul x14, x17, x20 - eor x17, x13, x15 - adcs x13, x8, x24 - adc x8, x4, x24 - cmn x21, #0x1 - adcs x6, x23, x2 - mov x16, #0xfffffffffffffffe - eor x20, x12, x21 - adcs x20, x3, x20 - eor x23, x14, x15 - adcs x2, x13, x21 - adc x8, x8, x21 - cmn x15, #0x1 - ldp x5, x4, [x0] - ldp x21, x12, [x0, #16] - adcs x22, x20, x23 - eor x23, x22, x9 - adcs x17, x2, x17 - adc x22, x8, x15 - cmn x9, #0x1 - adcs x15, x7, x5 - ldp x10, x14, [x0, #32] - eor x1, x6, x9 - lsl x2, x15, #32 - adcs x8, x11, x4 - adcs x13, x1, x21 - eor x1, x22, x9 - adcs x24, x23, x12 - eor x11, x17, x9 - adcs x23, x11, x10 - adcs x7, x1, x14 - adcs x17, x9, x19 - adcs x20, x9, xzr - add x1, x2, x15 - lsr x3, x1, #32 - adcs x11, x9, xzr - adc x9, x9, xzr - subs x3, x3, x1 - sbc x6, x1, xzr - adds x24, x24, x5 - adcs x4, x23, x4 - extr x3, x6, x3, #32 - lsr x6, x6, #32 - adcs x21, x7, x21 - adcs x15, x17, x12 - adcs x7, x20, x10 - adcs x20, x11, x14 - mov x14, #0xffffffff - adc x22, x9, x19 - adds x12, x6, x1 - adc x10, xzr, xzr - subs x3, x8, x3 - sbcs x12, x13, x12 - lsl x9, x3, #32 - add x3, x9, x3 - sbcs x10, x24, x10 - sbcs x24, x4, xzr - lsr x9, x3, #32 - sbcs x21, x21, xzr - sbc x1, x1, xzr - subs x9, x9, x3 - sbc x13, x3, xzr - extr x9, x13, x9, #32 - lsr x13, x13, #32 - adds x13, x13, x3 - adc x6, xzr, xzr - subs x12, x12, x9 - sbcs x17, x10, x13 - lsl x2, x12, #32 - sbcs x10, x24, x6 - add x9, x2, x12 - sbcs x6, x21, xzr - lsr x5, x9, #32 - sbcs x21, x1, xzr - sbc x13, x3, xzr - subs x8, x5, x9 - sbc x19, x9, xzr - lsr x12, x19, #32 - extr x3, x19, x8, #32 - adds x8, x12, x9 - adc x1, xzr, xzr - subs x2, x17, x3 - sbcs x12, x10, x8 - sbcs x5, x6, x1 - sbcs x3, x21, xzr - sbcs x19, x13, xzr - sbc x24, x9, xzr - adds x23, x15, x3 - adcs x8, x7, x19 - adcs x11, x20, x24 - adc x9, x22, xzr - add x24, x9, #0x1 - lsl x7, x24, #32 - subs x21, x24, x7 - sbc x10, x7, xzr - adds x6, x2, x21 - adcs x7, x12, x10 - adcs x24, x5, x24 - adcs x13, x23, xzr - adcs x8, x8, xzr - adcs x15, x11, xzr - csetm x23, cc - and x11, x16, x23 - and x20, x14, x23 - adds x22, x6, x20 - eor x3, x20, x23 - adcs x5, x7, x3 - adcs x14, x24, x11 - stp x22, x5, [x0] - adcs x5, x13, x23 - adcs x21, x8, x23 - stp x14, x5, [x0, #16] - adc x12, x15, x23 - stp x21, x12, [x0, #32] - ldp x23, x24, [sp] - ldp x21, x22, [sp, 16] - ldp x19, x20, [sp, 32] - add sp, sp, 48 - ret - -// Corresponds exactly to bignum_montsqr_p384 - -.montsqr_p384: - ldr q1, [x1] - ldp x9, x2, [x1] - ldr q0, [x1] - ldp x4, x6, [x1, #16] - rev64 v21.4S, v1.4S - uzp2 v28.4S, v1.4S, v1.4S - umulh x7, x9, x2 - xtn v17.2S, v1.2D - mul v27.4S, v21.4S, v0.4S - ldr q20, [x1, #32] - xtn v30.2S, v0.2D - ldr q1, [x1, #32] - uzp2 v31.4S, v0.4S, v0.4S - ldp x5, x10, [x1, #32] - umulh x8, x9, x4 - uaddlp v3.2D, v27.4S - umull v16.2D, v30.2S, v17.2S - mul x16, x9, x4 - umull v27.2D, v30.2S, v28.2S - shrn v0.2S, v20.2D, #32 - xtn v7.2S, v20.2D - shl v20.2D, v3.2D, #32 - umull v3.2D, v31.2S, v28.2S - mul x3, x2, x4 - umlal v20.2D, v30.2S, v17.2S - umull v22.2D, v7.2S, v0.2S - usra v27.2D, v16.2D, #32 - umulh x11, x2, x4 - movi v21.2D, #0x00000000ffffffff - uzp2 v28.4S, v1.4S, v1.4S - adds x15, x16, x7 - and v5.16B, v27.16B, v21.16B - adcs x3, x3, x8 - usra v3.2D, v27.2D, #32 - dup v29.2D, x6 - adcs x16, x11, xzr - mov x14, v20.d[0] - umlal v5.2D, v31.2S, v17.2S - mul x8, x9, x2 - mov x7, v20.d[1] - shl v19.2D, v22.2D, #33 - xtn v25.2S, v29.2D - rev64 v31.4S, v1.4S - lsl x13, x14, #32 - uzp2 v6.4S, v29.4S, v29.4S - umlal v19.2D, v7.2S, v7.2S - usra v3.2D, v5.2D, #32 - adds x1, x8, x8 - umulh x8, x4, x4 - add x12, x13, x14 - mul v17.4S, v31.4S, v29.4S - xtn v4.2S, v1.2D - adcs x14, x15, x15 - lsr x13, x12, #32 - adcs x15, x3, x3 - umull v31.2D, v25.2S, v28.2S - adcs x11, x16, x16 - umull v21.2D, v25.2S, v4.2S - mov x17, v3.d[0] - umull v18.2D, v6.2S, v28.2S - adc x16, x8, xzr - uaddlp v16.2D, v17.4S - movi v1.2D, #0x00000000ffffffff - subs x13, x13, x12 - usra v31.2D, v21.2D, #32 - sbc x8, x12, xzr - adds x17, x17, x1 - mul x1, x4, x4 - shl v28.2D, v16.2D, #32 - mov x3, v3.d[1] - adcs x14, x7, x14 - extr x7, x8, x13, #32 - adcs x13, x3, x15 - and v3.16B, v31.16B, v1.16B - adcs x11, x1, x11 - lsr x1, x8, #32 - umlal v3.2D, v6.2S, v4.2S - usra v18.2D, v31.2D, #32 - adc x3, x16, xzr - adds x1, x1, x12 - umlal v28.2D, v25.2S, v4.2S - adc x16, xzr, xzr - subs x15, x17, x7 - sbcs x7, x14, x1 - lsl x1, x15, #32 - sbcs x16, x13, x16 - add x8, x1, x15 - usra v18.2D, v3.2D, #32 - sbcs x14, x11, xzr - lsr x1, x8, #32 - sbcs x17, x3, xzr - sbc x11, x12, xzr - subs x13, x1, x8 - umulh x12, x4, x10 - sbc x1, x8, xzr - extr x13, x1, x13, #32 - lsr x1, x1, #32 - adds x15, x1, x8 - adc x1, xzr, xzr - subs x7, x7, x13 - sbcs x13, x16, x15 - lsl x3, x7, #32 - umulh x16, x2, x5 - sbcs x15, x14, x1 - add x7, x3, x7 - sbcs x3, x17, xzr - lsr x1, x7, #32 - sbcs x14, x11, xzr - sbc x11, x8, xzr - subs x8, x1, x7 - sbc x1, x7, xzr - extr x8, x1, x8, #32 - lsr x1, x1, #32 - adds x1, x1, x7 - adc x17, xzr, xzr - subs x13, x13, x8 - umulh x8, x9, x6 - sbcs x1, x15, x1 - sbcs x15, x3, x17 - sbcs x3, x14, xzr - mul x17, x2, x5 - sbcs x11, x11, xzr - stp x13, x1, [x0] - sbc x14, x7, xzr - mul x7, x4, x10 - subs x1, x9, x2 - stp x15, x3, [x0, #16] - csetm x15, cc - cneg x1, x1, cc - stp x11, x14, [x0, #32] - mul x14, x9, x6 - adds x17, x8, x17 - adcs x7, x16, x7 - adc x13, x12, xzr - subs x12, x5, x6 - cneg x3, x12, cc - cinv x16, x15, cc - mul x8, x1, x3 - umulh x1, x1, x3 - eor x12, x8, x16 - adds x11, x17, x14 - adcs x3, x7, x17 - adcs x15, x13, x7 - adc x8, x13, xzr - adds x3, x3, x14 - adcs x15, x15, x17 - adcs x17, x8, x7 - eor x1, x1, x16 - adc x13, x13, xzr - subs x9, x9, x4 - csetm x8, cc - cneg x9, x9, cc - subs x4, x2, x4 - cneg x4, x4, cc - csetm x7, cc - subs x2, x10, x6 - cinv x8, x8, cc - cneg x2, x2, cc - cmn x16, #0x1 - adcs x11, x11, x12 - mul x12, x9, x2 - adcs x3, x3, x1 - adcs x15, x15, x16 - umulh x9, x9, x2 - adcs x17, x17, x16 - adc x13, x13, x16 - subs x1, x10, x5 - cinv x2, x7, cc - cneg x1, x1, cc - eor x9, x9, x8 - cmn x8, #0x1 - eor x7, x12, x8 - mul x12, x4, x1 - adcs x3, x3, x7 - adcs x7, x15, x9 - adcs x15, x17, x8 - ldp x9, x17, [x0, #16] - umulh x4, x4, x1 - adc x8, x13, x8 - cmn x2, #0x1 - eor x1, x12, x2 - adcs x1, x7, x1 - ldp x7, x16, [x0] - eor x12, x4, x2 - adcs x4, x15, x12 - ldp x15, x12, [x0, #32] - adc x8, x8, x2 - adds x13, x14, x14 - umulh x14, x5, x10 - adcs x2, x11, x11 - adcs x3, x3, x3 - adcs x1, x1, x1 - adcs x4, x4, x4 - adcs x11, x8, x8 - adc x8, xzr, xzr - adds x13, x13, x7 - adcs x2, x2, x16 - mul x16, x5, x10 - adcs x3, x3, x9 - adcs x1, x1, x17 - umulh x5, x5, x5 - lsl x9, x13, #32 - add x9, x9, x13 - adcs x4, x4, x15 - mov x13, v28.d[1] - adcs x15, x11, x12 - lsr x7, x9, #32 - adc x11, x8, xzr - subs x7, x7, x9 - umulh x10, x10, x10 - sbc x17, x9, xzr - extr x7, x17, x7, #32 - lsr x17, x17, #32 - adds x17, x17, x9 - adc x12, xzr, xzr - subs x8, x2, x7 - sbcs x17, x3, x17 - lsl x7, x8, #32 - sbcs x2, x1, x12 - add x3, x7, x8 - sbcs x12, x4, xzr - lsr x1, x3, #32 - sbcs x7, x15, xzr - sbc x15, x9, xzr - subs x1, x1, x3 - sbc x4, x3, xzr - lsr x9, x4, #32 - extr x8, x4, x1, #32 - adds x9, x9, x3 - adc x4, xzr, xzr - subs x1, x17, x8 - lsl x17, x1, #32 - sbcs x8, x2, x9 - sbcs x9, x12, x4 - add x17, x17, x1 - mov x1, v18.d[1] - lsr x2, x17, #32 - sbcs x7, x7, xzr - mov x12, v18.d[0] - sbcs x15, x15, xzr - sbc x3, x3, xzr - subs x4, x2, x17 - sbc x2, x17, xzr - adds x12, x13, x12 - adcs x16, x16, x1 - lsr x13, x2, #32 - extr x1, x2, x4, #32 - adc x2, x14, xzr - adds x4, x13, x17 - mul x13, x6, x6 - adc x14, xzr, xzr - subs x1, x8, x1 - sbcs x4, x9, x4 - mov x9, v28.d[0] - sbcs x7, x7, x14 - sbcs x8, x15, xzr - sbcs x3, x3, xzr - sbc x14, x17, xzr - adds x17, x9, x9 - adcs x12, x12, x12 - mov x15, v19.d[0] - adcs x9, x16, x16 - umulh x6, x6, x6 - adcs x16, x2, x2 - adc x2, xzr, xzr - adds x11, x11, x8 - adcs x3, x3, xzr - adcs x14, x14, xzr - adcs x8, xzr, xzr - adds x13, x1, x13 - mov x1, v19.d[1] - adcs x6, x4, x6 - mov x4, #0xffffffff - adcs x15, x7, x15 - adcs x7, x11, x5 - adcs x1, x3, x1 - adcs x14, x14, x10 - adc x11, x8, xzr - adds x6, x6, x17 - adcs x8, x15, x12 - adcs x3, x7, x9 - adcs x15, x1, x16 - mov x16, #0xffffffff00000001 - adcs x14, x14, x2 - mov x2, #0x1 - adc x17, x11, xzr - cmn x13, x16 - adcs xzr, x6, x4 - adcs xzr, x8, x2 - adcs xzr, x3, xzr - adcs xzr, x15, xzr - adcs xzr, x14, xzr - adc x1, x17, xzr - neg x9, x1 - and x1, x16, x9 - adds x11, x13, x1 - and x13, x4, x9 - adcs x5, x6, x13 - and x1, x2, x9 - adcs x7, x8, x1 - stp x11, x5, [x0] - adcs x11, x3, xzr - adcs x2, x15, xzr - stp x7, x11, [x0, #16] - adc x17, x14, xzr - stp x2, x17, [x0, #32] - ret - -// Corresponds exactly to bignum_sub_p384 - -.sub_p384: - ldp x5, x6, [x1] - ldp x4, x3, [x2] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [x1, #16] - ldp x4, x3, [x2, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - ldp x9, x10, [x1, #32] - ldp x4, x3, [x2, #32] - sbcs x9, x9, x4 - sbcs x10, x10, x3 - csetm x3, cc - mov x4, #0xffffffff - and x4, x4, x3 - adds x5, x5, x4 - eor x4, x4, x3 - adcs x6, x6, x4 - mov x4, #0xfffffffffffffffe - and x4, x4, x3 - adcs x7, x7, x4 - adcs x8, x8, x3 - adcs x9, x9, x3 - adc x10, x10, x3 - stp x5, x6, [x0] - stp x7, x8, [x0, #16] - stp x9, x10, [x0, #32] - ret - -// Corresponds exactly to bignum_add_p384 - -.add_p384: - ldp x5, x6, [x1] - ldp x4, x3, [x2] - adds x5, x5, x4 - adcs x6, x6, x3 - ldp x7, x8, [x1, #16] - ldp x4, x3, [x2, #16] - adcs x7, x7, x4 - adcs x8, x8, x3 - ldp x9, x10, [x1, #32] - ldp x4, x3, [x2, #32] - adcs x9, x9, x4 - adcs x10, x10, x3 - adc x3, xzr, xzr - mov x4, #0xffffffff - cmp x5, x4 - mov x4, #0xffffffff00000000 - sbcs xzr, x6, x4 - mov x4, #0xfffffffffffffffe - sbcs xzr, x7, x4 - adcs xzr, x8, xzr - adcs xzr, x9, xzr - adcs xzr, x10, xzr - adcs x3, x3, xzr - csetm x3, ne - mov x4, #0xffffffff - and x4, x4, x3 - subs x5, x5, x4 - eor x4, x4, x3 - sbcs x6, x6, x4 - mov x4, #0xfffffffffffffffe - and x4, x4, x3 - sbcs x7, x7, x4 - sbcs x8, x8, x3 - sbcs x9, x9, x3 - sbc x10, x10, x3 - stp x5, x6, [x0] - stp x7, x8, [x0, #16] - stp x9, x10, [x0, #32] - ret - - -#define montmul_p384(P0,P1,P2) \ - add x0, P0;\ - add x1, P1;\ - add x2, P2;\ - bl .montmul_p384 - -#define montsqr_p384(P0,P1) \ - add x0, P0;\ - add x1, P1;\ - bl .montsqr_p384 - -#define sub_p384(P0,P1,P2) \ - add x0, P0;\ - add x1, P1;\ - add x2, P2;\ - bl .sub_p384 - -#define add_p384(P0,P1,P2) \ - add x0, P0;\ - add x1, P1;\ - add x2, P2;\ - bl .add_p384 - - -// P0 = 4 * P1 - P2 - -#define cmsub41_p384(P0,P1,P2) \ - ldp x1, x2, [P1] __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P1+32] __LF \ - lsl x0, x1, #2 __LF \ - ldp x7, x8, [P2] __LF \ - subs x0, x0, x7 __LF \ - extr x1, x2, x1, #62 __LF \ - sbcs x1, x1, x8 __LF \ - ldp x7, x8, [P2+16] __LF \ - extr x2, x3, x2, #62 __LF \ - sbcs x2, x2, x7 __LF \ - extr x3, x4, x3, #62 __LF \ - sbcs x3, x3, x8 __LF \ - extr x4, x5, x4, #62 __LF \ - ldp x7, x8, [P2+32] __LF \ - sbcs x4, x4, x7 __LF \ - extr x5, x6, x5, #62 __LF \ - sbcs x5, x5, x8 __LF \ - lsr x6, x6, #62 __LF \ - adc x6, x6, xzr __LF \ - lsl x7, x6, #32 __LF \ - subs x8, x6, x7 __LF \ - sbc x7, x7, xzr __LF \ - adds x0, x0, x8 __LF \ - adcs x1, x1, x7 __LF \ - adcs x2, x2, x6 __LF \ - adcs x3, x3, xzr __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - csetm x8, cc __LF \ - mov x9, #0xffffffff __LF \ - and x9, x9, x8 __LF \ - adds x0, x0, x9 __LF \ - eor x9, x9, x8 __LF \ - adcs x1, x1, x9 __LF \ - mov x9, #0xfffffffffffffffe __LF \ - and x9, x9, x8 __LF \ - adcs x2, x2, x9 __LF \ - adcs x3, x3, x8 __LF \ - adcs x4, x4, x8 __LF \ - adc x5, x5, x8 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] __LF \ - stp x4, x5, [P0+32] - -// P0 = C * P1 - D * P2 - -#define cmsub_p384(P0,C,P1,D,P2) \ - ldp x0, x1, [P2] __LF \ - mov x6, #0x00000000ffffffff __LF \ - subs x6, x6, x0 __LF \ - mov x7, #0xffffffff00000000 __LF \ - sbcs x7, x7, x1 __LF \ - ldp x0, x1, [P2+16] __LF \ - mov x8, #0xfffffffffffffffe __LF \ - sbcs x8, x8, x0 __LF \ - mov x13, #0xffffffffffffffff __LF \ - sbcs x9, x13, x1 __LF \ - ldp x0, x1, [P2+32] __LF \ - sbcs x10, x13, x0 __LF \ - sbc x11, x13, x1 __LF \ - mov x12, D __LF \ - mul x0, x12, x6 __LF \ - mul x1, x12, x7 __LF \ - mul x2, x12, x8 __LF \ - mul x3, x12, x9 __LF \ - mul x4, x12, x10 __LF \ - mul x5, x12, x11 __LF \ - umulh x6, x12, x6 __LF \ - umulh x7, x12, x7 __LF \ - umulh x8, x12, x8 __LF \ - umulh x9, x12, x9 __LF \ - umulh x10, x12, x10 __LF \ - umulh x12, x12, x11 __LF \ - adds x1, x1, x6 __LF \ - adcs x2, x2, x7 __LF \ - adcs x3, x3, x8 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - mov x6, #1 __LF \ - adc x6, x12, x6 __LF \ - ldp x8, x9, [P1] __LF \ - ldp x10, x11, [P1+16] __LF \ - ldp x12, x13, [P1+32] __LF \ - mov x14, C __LF \ - mul x15, x14, x8 __LF \ - umulh x8, x14, x8 __LF \ - adds x0, x0, x15 __LF \ - mul x15, x14, x9 __LF \ - umulh x9, x14, x9 __LF \ - adcs x1, x1, x15 __LF \ - mul x15, x14, x10 __LF \ - umulh x10, x14, x10 __LF \ - adcs x2, x2, x15 __LF \ - mul x15, x14, x11 __LF \ - umulh x11, x14, x11 __LF \ - adcs x3, x3, x15 __LF \ - mul x15, x14, x12 __LF \ - umulh x12, x14, x12 __LF \ - adcs x4, x4, x15 __LF \ - mul x15, x14, x13 __LF \ - umulh x13, x14, x13 __LF \ - adcs x5, x5, x15 __LF \ - adc x6, x6, xzr __LF \ - adds x1, x1, x8 __LF \ - adcs x2, x2, x9 __LF \ - adcs x3, x3, x10 __LF \ - adcs x4, x4, x11 __LF \ - adcs x5, x5, x12 __LF \ - adcs x6, x6, x13 __LF \ - lsl x7, x6, #32 __LF \ - subs x8, x6, x7 __LF \ - sbc x7, x7, xzr __LF \ - adds x0, x0, x8 __LF \ - adcs x1, x1, x7 __LF \ - adcs x2, x2, x6 __LF \ - adcs x3, x3, xzr __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - csetm x6, cc __LF \ - mov x7, #0xffffffff __LF \ - and x7, x7, x6 __LF \ - adds x0, x0, x7 __LF \ - eor x7, x7, x6 __LF \ - adcs x1, x1, x7 __LF \ - mov x7, #0xfffffffffffffffe __LF \ - and x7, x7, x6 __LF \ - adcs x2, x2, x7 __LF \ - adcs x3, x3, x6 __LF \ - adcs x4, x4, x6 __LF \ - adc x5, x5, x6 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] __LF \ - stp x4, x5, [P0+32] - -// A weak version of add that only guarantees sum in 6 digits - -#define weakadd_p384(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - adds x5, x5, x4 __LF \ - adcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - adcs x7, x7, x4 __LF \ - adcs x8, x8, x3 __LF \ - ldp x9, x10, [P1+32] __LF \ - ldp x4, x3, [P2+32] __LF \ - adcs x9, x9, x4 __LF \ - adcs x10, x10, x3 __LF \ - csetm x3, cs __LF \ - mov x4, #0xffffffff __LF \ - and x4, x4, x3 __LF \ - subs x5, x5, x4 __LF \ - eor x4, x4, x3 __LF \ - sbcs x6, x6, x4 __LF \ - mov x4, #0xfffffffffffffffe __LF \ - and x4, x4, x3 __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - sbcs x9, x9, x3 __LF \ - sbc x10, x10, x3 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] __LF \ - stp x9, x10, [P0+32] - -// P0 = 3 * P1 - 8 * P2 - -#define cmsub38_p384(P0,P1,P2) \ - ldp x0, x1, [P2] __LF \ - mov x6, #0x00000000ffffffff __LF \ - subs x6, x6, x0 __LF \ - mov x7, #0xffffffff00000000 __LF \ - sbcs x7, x7, x1 __LF \ - ldp x0, x1, [P2+16] __LF \ - mov x8, #0xfffffffffffffffe __LF \ - sbcs x8, x8, x0 __LF \ - mov x13, #0xffffffffffffffff __LF \ - sbcs x9, x13, x1 __LF \ - ldp x0, x1, [P2+32] __LF \ - sbcs x10, x13, x0 __LF \ - sbc x11, x13, x1 __LF \ - lsl x0, x6, #3 __LF \ - extr x1, x7, x6, #61 __LF \ - extr x2, x8, x7, #61 __LF \ - extr x3, x9, x8, #61 __LF \ - extr x4, x10, x9, #61 __LF \ - extr x5, x11, x10, #61 __LF \ - lsr x6, x11, #61 __LF \ - add x6, x6, #1 __LF \ - ldp x8, x9, [P1] __LF \ - ldp x10, x11, [P1+16] __LF \ - ldp x12, x13, [P1+32] __LF \ - mov x14, 3 __LF \ - mul x15, x14, x8 __LF \ - umulh x8, x14, x8 __LF \ - adds x0, x0, x15 __LF \ - mul x15, x14, x9 __LF \ - umulh x9, x14, x9 __LF \ - adcs x1, x1, x15 __LF \ - mul x15, x14, x10 __LF \ - umulh x10, x14, x10 __LF \ - adcs x2, x2, x15 __LF \ - mul x15, x14, x11 __LF \ - umulh x11, x14, x11 __LF \ - adcs x3, x3, x15 __LF \ - mul x15, x14, x12 __LF \ - umulh x12, x14, x12 __LF \ - adcs x4, x4, x15 __LF \ - mul x15, x14, x13 __LF \ - umulh x13, x14, x13 __LF \ - adcs x5, x5, x15 __LF \ - adc x6, x6, xzr __LF \ - adds x1, x1, x8 __LF \ - adcs x2, x2, x9 __LF \ - adcs x3, x3, x10 __LF \ - adcs x4, x4, x11 __LF \ - adcs x5, x5, x12 __LF \ - adcs x6, x6, x13 __LF \ - lsl x7, x6, #32 __LF \ - subs x8, x6, x7 __LF \ - sbc x7, x7, xzr __LF \ - adds x0, x0, x8 __LF \ - adcs x1, x1, x7 __LF \ - adcs x2, x2, x6 __LF \ - adcs x3, x3, xzr __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - csetm x6, cc __LF \ - mov x7, #0xffffffff __LF \ - and x7, x7, x6 __LF \ - adds x0, x0, x7 __LF \ - eor x7, x7, x6 __LF \ - adcs x1, x1, x7 __LF \ - mov x7, #0xfffffffffffffffe __LF \ - and x7, x7, x6 __LF \ - adcs x2, x2, x7 __LF \ - adcs x3, x3, x6 __LF \ - adcs x4, x4, x6 __LF \ - adc x5, x5, x6 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] __LF \ - stp x4, x5, [P0+32] - -S2N_BN_SYMBOL(p384_montjdouble): - -// Save regs and make room on stack for temporary variables - - sub sp, sp, NSPACE+80 - stp x19, x20, [sp, NSPACE] - stp x21, x22, [sp, NSPACE+16] - stp x23, x24, [sp, NSPACE+32] - stp x25, x26, [sp, NSPACE+48] - stp x30, xzr, [sp, NSPACE+64] - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - -// Main code, just a sequence of basic field operations - -// z2 = z^2 -// y2 = y^2 - - montsqr_p384(z2,z_1) - montsqr_p384(y2,y_1) - -// x2p = x^2 - z^4 = (x + z^2) * (x - z^2) - - weakadd_p384(t1,x_1,z2) - sub_p384(t2,x_1,z2) - montmul_p384(x2p,t1,t2) - -// t1 = y + z -// x4p = x2p^2 -// xy2 = x * y^2 - - add_p384(t1,y_1,z_1) - montsqr_p384(x4p,x2p) - montmul_p384(xy2,x_1,y2) - -// t2 = (y + z)^2 - - montsqr_p384(t2,t1) - -// d = 12 * xy2 - 9 * x4p -// t1 = y^2 + 2 * y * z - - cmsub_p384(d_,12,xy2,9,x4p) - sub_p384(t1,t2,z2) - -// y4 = y^4 - - montsqr_p384(y4,y2) - -// z_3' = 2 * y * z -// dx2 = d * x2p - - sub_p384(z_3,t1,y2) - montmul_p384(dx2,d_,x2p) - -// x' = 4 * xy2 - d - - cmsub41_p384(x_3,xy2,d_) - -// y' = 3 * dx2 - 8 * y4 - - cmsub38_p384(y_3,dx2,y4) - -// Restore stack and registers - - ldp x19, x20, [sp, NSPACE] - ldp x21, x22, [sp, NSPACE+16] - ldp x23, x24, [sp, NSPACE+32] - ldp x25, x26, [sp, NSPACE+48] - ldp x30, xzr, [sp, NSPACE+64] - add sp, sp, NSPACE+80 - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/Makefile b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/Makefile deleted file mode 100644 index 620ff871d4f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/Makefile +++ /dev/null @@ -1,61 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - -# If actually on an ARM8 machine, just use the GNU assembler (as). Otherwise -# use a cross-assembling version so that the code can still be assembled -# and the proofs checked against the object files (though you won't be able -# to run code without additional emulation infrastructure). The aarch64 -# cross-assembling version can be installed manually by something like: -# -# sudo apt-get install binutils-aarch64-linux-gnu - -UNAME_RESULT=$(shell uname -p) - -ifeq ($(UNAME_RESULT),aarch64) -GAS=as -else -GAS=aarch64-linux-gnu-as -endif - -# List of object files - -OBJ = bignum_add_p521.o \ - bignum_cmul_p521.o \ - bignum_deamont_p521.o \ - bignum_demont_p521.o \ - bignum_double_p521.o \ - bignum_fromlebytes_p521.o \ - bignum_half_p521.o \ - bignum_inv_p521.o \ - bignum_mod_n521_9.o \ - bignum_mod_p521_9.o \ - bignum_montmul_p521.o \ - bignum_montmul_p521_alt.o \ - bignum_montsqr_p521.o \ - bignum_montsqr_p521_alt.o \ - bignum_mul_p521.o \ - bignum_mul_p521_alt.o \ - bignum_neg_p521.o \ - bignum_optneg_p521.o \ - bignum_sqr_p521.o \ - bignum_sqr_p521_alt.o \ - bignum_sub_p521.o \ - bignum_tolebytes_p521.o \ - bignum_tomont_p521.o \ - bignum_triple_p521.o \ - p521_jadd.o \ - p521_jadd_alt.o \ - p521_jdouble.o \ - p521_jdouble_alt.o \ - p521_jmixadd.o \ - p521_jmixadd_alt.o \ - p521_jscalarmul.o \ - p521_jscalarmul_alt.o - -%.o : %.S ; $(CC) -E -I../../include $< | $(GAS) -o $@ - - -default: $(OBJ); - -clean:; rm -f *.o *.correct diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_cmul_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_cmul_p521.S deleted file mode 100644 index 68d88dfc674..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_cmul_p521.S +++ /dev/null @@ -1,154 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_521, z := (c * x) mod p_521, assuming -// x reduced -// Inputs c, x[9]; output z[9] -// -// extern void bignum_cmul_p521(uint64_t z[static 9], uint64_t c, -// const uint64_t x[static 9]); -// -// Standard ARM ABI: X0 = z, X1 = c, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p521) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p521_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p521_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p521_alt) - .text - .balign 4 - -#define z x0 -#define c x1 -#define x x2 - -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 -#define d4 x7 -#define d5 x8 -#define d6 x9 -#define d7 x10 -#define d8 x11 -#define d9 x12 - -// Heavily aliased subject to ordering - -#define a0 d3 -#define a1 d4 -#define a2 d5 -#define a3 d6 -#define a4 d7 -#define a5 d8 -#define a6 d9 -#define h d9 - -// Other variables - -#define a7 x13 -#define a8 x14 -#define dd x15 - -S2N_BN_SYMBOL(bignum_cmul_p521): - -S2N_BN_SYMBOL(bignum_cmul_p521_alt): - CFI_START - -// First do the multiply, getting [d9; ...; d0], and as this is done -// accumulate an AND "dd" of digits d7,...,d1 for later use - - ldp a0, a1, [x] - mul d0, c, a0 - mul d1, c, a1 - umulh a0, c, a0 - adds d1, d1, a0 - umulh a1, c, a1 - - ldp a2, a3, [x, #16] - mul d2, c, a2 - mul d3, c, a3 - umulh a2, c, a2 - adcs d2, d2, a1 - and dd, d1, d2 - umulh a3, c, a3 - adcs d3, d3, a2 - and dd, dd, d3 - - ldp a4, a5, [x, #32] - mul d4, c, a4 - mul d5, c, a5 - umulh a4, c, a4 - adcs d4, d4, a3 - and dd, dd, d4 - umulh a5, c, a5 - adcs d5, d5, a4 - and dd, dd, d5 - - ldp a6, a7, [x, #48] - mul d6, c, a6 - mul d7, c, a7 - umulh a6, c, a6 - adcs d6, d6, a5 - and dd, dd, d6 - umulh a7, c, a7 - adcs d7, d7, a6 - and dd, dd, d7 - - ldr a8, [x, #64] - mul d8, c, a8 - adcs d8, d8, a7 - umulh a8, c, a8 - adc d9, xzr, a8 - -// Extract the high part h and mask off the low part l = [d8;d7;...;d0] -// but stuff d8 with 1 bits at the left to ease a comparison below - - extr h, d9, d8, #9 - orr d8, d8, #~0x1FF - -// Decide whether h + l >= p_521 <=> h + l + 1 >= 2^521. Since this can only -// happen if digits d7,...d1 are all 1s, we use the AND of them "dd" to -// condense the carry chain, and since we stuffed 1 bits into d8 we get -// the result in CF without an additional comparison. - - subs xzr, xzr, xzr - adcs xzr, d0, h - adcs xzr, dd, xzr - adcs xzr, d8, xzr - -// Now if CF is set we want (h + l) - p_521 = (h + l + 1) - 2^521 -// while otherwise we want just h + l. So mask h + l + CF to 521 bits. -// This masking also gets rid of the stuffing with 1s we did above. - - adcs d0, d0, h - adcs d1, d1, xzr - adcs d2, d2, xzr - adcs d3, d3, xzr - adcs d4, d4, xzr - adcs d5, d5, xzr - adcs d6, d6, xzr - adcs d7, d7, xzr - adc d8, d8, xzr - and d8, d8, #0x1FF - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - stp d6, d7, [z, #48] - str d8, [z, #64] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_deamont_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_deamont_p521.S deleted file mode 100644 index 66599c01fcc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_deamont_p521.S +++ /dev/null @@ -1,120 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^576) mod p_521 -// Input x[9]; output z[9] -// -// extern void bignum_deamont_p521(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Convert a 9-digit bignum x out of its (optionally almost) Montgomery form, -// "almost" meaning any 9-digit input will work, with no range restriction. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_deamont_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_deamont_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_deamont_p521) - .text - .balign 4 - -// Input parameters - -#define z x0 -#define x x1 - -// Rotating registers for the intermediate windows - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x6 -#define d5 x7 -#define d6 x8 -#define d7 x9 -#define d8 x10 - -// Some other variables, not all distinct - -#define c x11 -#define h x11 -#define l x12 -#define u x12 - -S2N_BN_SYMBOL(bignum_deamont_p521): - CFI_START - -// Load all the inputs - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - ldp d4, d5, [x, #32] - ldp d6, d7, [x, #48] - ldr d8, [x, #64] - -// Stash the lowest 55 bits at the top of c, then shift the whole 576-bit -// input right by 9*64 - 521 = 576 - 521 = 55 bits. As this is done, -// accumulate an AND of words d0..d6. - - lsl c, d0, #9 - extr d0, d1, d0, #55 - extr d1, d2, d1, #55 - and u, d0, d1 - extr d2, d3, d2, #55 - and u, u, d2 - extr d3, d4, d3, #55 - and u, u, d3 - extr d4, d5, d4, #55 - and u, u, d4 - extr d5, d6, d5, #55 - and u, u, d5 - extr d6, d7, d6, #55 - and u, u, d6 - extr d7, d8, d7, #55 - lsr d8, d8, #55 - -// Now writing x = 2^55 * h + l (so here [d8;..d0] = h and c = 2^9 * l) -// we want (h + 2^{521-55} * l) mod p_521 = s mod p_521. Since s < 2 * p_521 -// this is just "if s >= p_521 then s - p_521 else s". First get -// CF <=> s >= p_521, creating the digits [h,l] to add for the l part. - - adds xzr, u, #1 - lsl l, c, #9 - adcs xzr, d7, l - orr d8, d8, #~0x1FF - lsr h, c, #55 - adcs xzr, d8, h - -// Now the result = s mod p_521 = (if s >= p_521 then s - p_521 else s) = -// (s + CF) mod 2^521. So do the addition inheriting the carry-in. - - adcs d0, d0, xzr - adcs d1, d1, xzr - adcs d2, d2, xzr - adcs d3, d3, xzr - adcs d4, d4, xzr - adcs d5, d5, xzr - adcs d6, d6, xzr - adcs d7, d7, l - adc d8, d8, h - and d8, d8, #0x1FF - -// Store back the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - stp d6, d7, [z, #48] - str d8, [z, #64] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_deamont_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_demont_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_demont_p521.S deleted file mode 100644 index 7209d3d6dfa..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_demont_p521.S +++ /dev/null @@ -1,75 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^576) mod p_521, assuming x reduced -// Input x[9]; output z[9] -// -// extern void bignum_demont_p521(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// This assumes the input is < p_521 for correctness. If this is not the case, -// use the variant "bignum_deamont_p521" instead. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_p521) - .text - .balign 4 - -// Input parameters - -#define z x0 -#define x x1 - -// Rotating registers for the intermediate windows - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x2 -#define d5 x3 -#define d6 x4 -#define d7 x5 -#define d8 x2 -#define c x6 - -S2N_BN_SYMBOL(bignum_demont_p521): - CFI_START - -// Rotate, as a 521-bit quantity, by 9*64 - 521 = 55 bits right. - - ldp d0, d1, [x] - lsl c, d0, #9 - extr d0, d1, d0, #55 - ldp d2, d3, [x, #16] - extr d1, d2, d1, #55 - stp d0, d1, [z] - extr d2, d3, d2, #55 - ldp d4, d5, [x, #32] - extr d3, d4, d3, #55 - stp d2, d3, [z, #16] - extr d4, d5, d4, #55 - ldp d6, d7, [x, #48] - extr d5, d6, d5, #55 - stp d4, d5, [z, #32] - extr d6, d7, d6, #55 - ldr d8, [x, #64] - orr d8, d8, c - extr d7, d8, d7, #55 - stp d6, d7, [z, #48] - lsr d8, d8, #55 - str d8, [z, #64] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_double_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_double_p521.S deleted file mode 100644 index 27e60a69400..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_double_p521.S +++ /dev/null @@ -1,72 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo p_521, z := (2 * x) mod p_521, assuming x reduced -// Input x[9]; output z[9] -// -// extern void bignum_double_p521(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_double_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_double_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_double_p521) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define c x2 -#define h x3 -#define l x4 - -S2N_BN_SYMBOL(bignum_double_p521): - CFI_START - -// We can decide whether 2 * x >= p_521 just by 2 * x >= 2^521, which -// amounts to whether the top word is >= 256 - - ldr c, [x, #64] - subs xzr, c, #256 - -// Now if 2 * x >= p_521 we want 2 * x - p_521 = (2 * x + 1) - 2^521 -// and otherwise just 2 * x. Feed in the condition as the carry bit -// to get 2 * x + [2 * x >= p_521] then just mask it off to 521 bits. - - ldp l, h, [x] - adcs l, l, l - adcs h, h, h - stp l, h, [z] - - ldp l, h, [x, #16] - adcs l, l, l - adcs h, h, h - stp l, h, [z, #16] - - ldp l, h, [x, #32] - adcs l, l, l - adcs h, h, h - stp l, h, [z, #32] - - ldp l, h, [x, #48] - adcs l, l, l - adcs h, h, h - stp l, h, [z, #48] - - adc c, c, c - and c, c, #0x1FF - str c, [z, #64] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_double_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_half_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_half_p521.S deleted file mode 100644 index 97e88adcad9..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_half_p521.S +++ /dev/null @@ -1,77 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Halve modulo p_521, z := (x / 2) mod p_521, assuming x reduced -// Input x[9]; output z[9] -// -// extern void bignum_half_p521(uint64_t z[static 9], const uint64_t x[static 9]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_half_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_half_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_half_p521) - .text - .balign 4 - -#define z x0 -#define x x1 - -// We use distinct variables for clarity, but these are heavily aliased - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x2 -#define d5 x3 -#define d6 x4 -#define d7 x5 -#define d8 x2 -#define a x6 - - -S2N_BN_SYMBOL(bignum_half_p521): - CFI_START - -// We do a 521-bit rotation one bit right, since 2^521 == 1 (mod p_521) - - ldp d0, d1, [x] - and a, d0, #1 - extr d0, d1, d0, #1 - - ldp d2, d3, [x, #16] - extr d1, d2, d1, #1 - stp d0, d1, [z] - extr d2, d3, d2, #1 - - ldp d4, d5, [x, #32] - extr d3, d4, d3, #1 - stp d2, d3, [z, #16] - extr d4, d5, d4, #1 - - ldp d6, d7, [x, #48] - extr d5, d6, d5, #1 - stp d4, d5, [z, #32] - extr d6, d7, d6, #1 - - ldr d8, [x, #64] - extr d7, d8, d7, #1 - stp d6, d7, [z, #48] - lsl d8, d8, #55 - extr d8, a, d8, #56 - str d8, [z, #64] - -// Return - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_half_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_mod_n521_9.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_mod_n521_9.S deleted file mode 100644 index 446f95766fc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_mod_n521_9.S +++ /dev/null @@ -1,148 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_521 -// Input x[9]; output z[9] -// -// extern void bignum_mod_n521_9(uint64_t z[static 9], const uint64_t x[static 9]); -// -// Reduction is modulo the group order of the NIST curve P-521. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n521_9) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n521_9) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n521_9) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n521_9_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n521_9_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n521_9_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define n0 x2 -#define n1 x3 -#define n2 x4 -#define n3 x5 - -#define d0 x6 -#define d1 x7 -#define d2 x8 -#define d3 x9 -#define d4 x10 -#define d5 x11 -#define d6 x12 -#define d7 x13 -#define d8 x14 - -#define q x15 - -// Re-use d6 and d7 as temporaries before they are needed - -#define s d6 -#define t d7 - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(bignum_mod_n521_9): - -S2N_BN_SYMBOL(bignum_mod_n521_9_alt): - CFI_START - -// Load the top digit first into d8. -// The initial quotient estimate is q = h + 1 where x = 2^521 * h + t - - ldr d8, [x, #64] - lsr q, d8, #9 - add q, q, #1 - -// Let [5; n3; n2; n1; n0] = r_521 = 2^521 - n_521 -// and form [d4;d3;d2;d1;d0] = q * r_521 - - movbig( n0, #0x4490, #0x48e1, #0x6ec7, #0x9bf7) - mul d0, n0, q - movbig( n1, #0xc44a, #0x3647, #0x7663, #0xb851) - mul d1, n1, q - movbig( n2, #0x8033, #0xfeb7, #0x08f6, #0x5a2f) - mul d2, n2, q - movbig( n3, #0xae79, #0x787c, #0x40d0, #0x6994) - mul d3, n3, q - lsl d4, q, #2 - add d4, d4, q - umulh t, n0, q - adds d1, d1, t - umulh t, n1, q - adcs d2, d2, t - umulh t, n2, q - adcs d3, d3, t - umulh t, n3, q - adc d4, d4, t - -// Now load other digits and form r = x - q * n_521 = (q * r_521 + t) - 2^521. -// But the computed result stuffs in 1s from bit 521 onwards and actually -// gives r' = (q * r_521 + t) + (2^576 - 2^521) = r + 2^576, including the -// top carry. Hence CF <=> r >= 0, while r' == r (mod 2^521). - - ldp s, t, [x] - adds d0, d0, s - adcs d1, d1, t - ldp s, t, [x, #16] - adcs d2, d2, s - adcs d3, d3, t - ldp t, d5, [x, #32] - adcs d4, d4, t - adcs d5, d5, xzr - ldp d6, d7, [x, #48] - adcs d6, d6, xzr - adcs d7, d7, xzr - orr d8, d8, #~0x1FF - adcs d8, d8, xzr - -// We already know r < n_521, but if it actually went negative then -// we need to add back n_521 again. Recycle q as a bitmask for r < n_521, -// and just subtract r_521 and mask rather than literally adding 2^521. -// This also gets rid of the bit-stuffing above. - - csetm q, cc - and n0, n0, q - subs d0, d0, n0 - and n1, n1, q - sbcs d1, d1, n1 - and n2, n2, q - sbcs d2, d2, n2 - and n3, n3, q - sbcs d3, d3, n3 - mov n0, #5 - and n0, n0, q - sbcs d4, d4, n0 - sbcs d5, d5, xzr - sbcs d6, d6, xzr - sbcs d7, d7, xzr - sbc d8, d8, xzr - and d8, d8, #0x1FF - -// Store the end result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - stp d6, d7, [z, #48] - str d8, [z, #64] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n521_9) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_mod_p521_9.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_mod_p521_9.S deleted file mode 100644 index 9df01608a50..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_mod_p521_9.S +++ /dev/null @@ -1,97 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_521 -// Input x[9]; output z[9] -// -// extern void bignum_mod_p521_9(uint64_t z[static 9], const uint64_t x[static 9]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p521_9) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p521_9) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p521_9) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define h x2 -#define t x3 -#define d0 x4 -#define d1 x5 -#define d2 x6 -#define d3 x7 -#define d4 x8 -#define d5 x9 -#define d6 x10 -#define d7 x11 -#define d8 x12 - -S2N_BN_SYMBOL(bignum_mod_p521_9): - CFI_START - -// Load top digit first and get its upper bits in h so that we -// separate out x = 2^521 * H + L with h = H. Now x mod p_521 = -// (H + L) mod p_521 = if H + L >= p_521 then H + L - p_521 else H + L. - - ldr d8, [x, #64] - lsr h, d8, #9 - -// Load in the other digits and decide whether H + L >= p_521. This is -// equivalent to H + L + 1 >= 2^521, and since this can only happen if -// digits d7,...,d1 consist entirely of 1 bits, we can condense the -// carry chain by ANDing digits together, perhaps reducing its latency. -// This condenses only three pairs; the payoff beyond that seems limited. -// By stuffing in 1 bits from 521 position upwards, get CF directly - - subs xzr, xzr, xzr - ldp d0, d1, [x] - adcs xzr, d0, h - adcs xzr, d1, xzr - ldp d2, d3, [x, #16] - and t, d2, d3 - adcs xzr, t, xzr - ldp d4, d5, [x, #32] - and t, d4, d5 - adcs xzr, t, xzr - ldp d6, d7, [x, #48] - and t, d6, d7 - adcs xzr, t, xzr - orr t, d8, #~0x1FF - adcs t, t, xzr - -// Now H + L >= p_521 <=> H + L + 1 >= 2^521 <=> CF from this comparison. -// So if CF is set we want (H + L) - p_521 = (H + L + 1) - 2^521 -// while otherwise we want just H + L. So mask H + L + CF to 521 bits. - - adcs d0, d0, h - adcs d1, d1, xzr - adcs d2, d2, xzr - adcs d3, d3, xzr - adcs d4, d4, xzr - adcs d5, d5, xzr - adcs d6, d6, xzr - adcs d7, d7, xzr - adc d8, d8, xzr - and d8, d8, #0x1FF - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - stp d6, d7, [z, #48] - str d8, [z, #64] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p521_9) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montmul_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montmul_p521.S deleted file mode 100644 index dd4aabe3e14..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montmul_p521.S +++ /dev/null @@ -1,1423 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^576) mod p_521 -// Inputs x[9], y[9]; output z[9] -// -// extern void bignum_montmul_p521(uint64_t z[static 9], -// const uint64_t x[static 9], -// const uint64_t y[static 9]); -// -// Does z := (x * y / 2^576) mod p_521, assuming x < p_521, y < p_521. This -// means the Montgomery base is the "native size" 2^{9*64} = 2^576; since -// p_521 is a Mersenne prime the basic modular multiplication bignum_mul_p521 -// can be considered a Montgomery operation to base 2^521. -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - -// bignum_montmul_p521 is functionally equivalent to -// unopt/bignum_montmul_p521_base. -// It is written in a way that -// 1. A subset of scalar multiplications in bignum_montmul_p384 are carefully -// chosen and vectorized -// 2. The vectorized assembly is rescheduled using the SLOTHY superoptimizer. -// https://github.com/slothy-optimizer/slothy -// -// The output program of step 1. is as follows: -// -// stp x19, x20, [sp, #-16]! -// stp x21, x22, [sp, #-16]! -// stp x23, x24, [sp, #-16]! -// stp x25, x26, [sp, #-16]! -// sub sp, sp, #80 -// ldp x14, x7, [x1] -// ldp x3, x25, [x1, #16] -// ldp x10, x24, [x2] -// ldr q0, [x1] -// ldr q25, [x2] -// ldp x12, x6, [x2, #16] -// movi v18.2D, #0x00000000ffffffff -// uzp2 v3.4S, v25.4S, v25.4S -// xtn v26.2S, v0.2D -// xtn v22.2S, v25.2D -// rev64 v24.4S, v25.4S -// umull v19.2D, v26.2S, v22.2S -// umull v25.2D, v26.2S, v3.2S -// uzp2 v20.4S, v0.4S, v0.4S -// mul v0.4S, v24.4S, v0.4S -// usra v25.2D, v19.2D, #32 -// umull v6.2D, v20.2S, v3.2S -// uaddlp v0.2D, v0.4S -// and v18.16B, v25.16B, v18.16B -// umlal v18.2D, v20.2S, v22.2S -// shl v0.2D, v0.2D, #32 -// usra v6.2D, v25.2D, #32 -// umlal v0.2D, v26.2S, v22.2S -// usra v6.2D, v18.2D, #32 -// mov x23, v0.d[0] -// mov x16, v0.d[1] -// mul x5, x3, x12 -// mul x21, x25, x6 -// mov x19, v6.d[0] -// adds x16, x16, x19 -// mov x19, v6.d[1] -// adcs x5, x5, x19 -// umulh x19, x3, x12 -// adcs x21, x21, x19 -// umulh x19, x25, x6 -// adc x19, x19, xzr -// adds x8, x16, x23 -// adcs x16, x5, x16 -// adcs x5, x21, x5 -// adcs x21, x19, x21 -// adc x19, xzr, x19 -// adds x11, x16, x23 -// adcs x15, x5, x8 -// adcs x16, x21, x16 -// adcs x5, x19, x5 -// adcs x21, xzr, x21 -// adc x19, xzr, x19 -// subs x20, x3, x25 -// cneg x20, x20, cc -// csetm x9, cc -// subs x13, x6, x12 -// cneg x13, x13, cc -// mul x26, x20, x13 -// umulh x20, x20, x13 -// cinv x9, x9, cc -// cmn x9, #0x1 -// eor x13, x26, x9 -// adcs x5, x5, x13 -// eor x20, x20, x9 -// adcs x21, x21, x20 -// adc x19, x19, x9 -// subs x20, x14, x7 -// cneg x20, x20, cc -// csetm x9, cc -// subs x13, x24, x10 -// cneg x13, x13, cc -// mul x26, x20, x13 -// umulh x20, x20, x13 -// cinv x9, x9, cc -// cmn x9, #0x1 -// eor x13, x26, x9 -// adcs x8, x8, x13 -// eor x20, x20, x9 -// adcs x11, x11, x20 -// adcs x15, x15, x9 -// adcs x16, x16, x9 -// adcs x5, x5, x9 -// adcs x21, x21, x9 -// adc x19, x19, x9 -// subs x20, x7, x25 -// cneg x20, x20, cc -// csetm x9, cc -// subs x13, x6, x24 -// cneg x13, x13, cc -// mul x26, x20, x13 -// umulh x20, x20, x13 -// cinv x9, x9, cc -// cmn x9, #0x1 -// eor x13, x26, x9 -// adcs x16, x16, x13 -// eor x20, x20, x9 -// adcs x5, x5, x20 -// adcs x21, x21, x9 -// adc x19, x19, x9 -// subs x20, x14, x3 -// cneg x20, x20, cc -// csetm x9, cc -// subs x13, x12, x10 -// cneg x13, x13, cc -// mul x26, x20, x13 -// umulh x20, x20, x13 -// cinv x9, x9, cc -// cmn x9, #0x1 -// eor x13, x26, x9 -// adcs x11, x11, x13 -// eor x20, x20, x9 -// adcs x15, x15, x20 -// adcs x16, x16, x9 -// adcs x5, x5, x9 -// adcs x21, x21, x9 -// adc x19, x19, x9 -// subs x25, x14, x25 -// cneg x25, x25, cc -// csetm x20, cc -// subs x10, x6, x10 -// cneg x10, x10, cc -// mul x6, x25, x10 -// umulh x25, x25, x10 -// cinv x10, x20, cc -// cmn x10, #0x1 -// eor x6, x6, x10 -// adcs x6, x15, x6 -// eor x25, x25, x10 -// adcs x25, x16, x25 -// adcs x16, x5, x10 -// adcs x5, x21, x10 -// adc x10, x19, x10 -// subs x7, x7, x3 -// cneg x7, x7, cc -// csetm x3, cc -// subs x24, x12, x24 -// cneg x24, x24, cc -// mul x12, x7, x24 -// umulh x7, x7, x24 -// cinv x3, x3, cc -// cmn x3, #0x1 -// eor x24, x12, x3 -// adcs x24, x6, x24 -// eor x7, x7, x3 -// adcs x7, x25, x7 -// adcs x25, x16, x3 -// adcs x12, x5, x3 -// adc x3, x10, x3 -// lsl x10, x23, #9 -// extr x6, x8, x23, #55 -// extr x23, x11, x8, #55 -// extr x16, x24, x11, #55 -// lsr x24, x24, #55 -// stp x7, x25, [sp] // @slothy:writes=stack0 -// stp x12, x3, [sp, #16] // @slothy:writes=stack16 -// stp x10, x6, [sp, #32] // @slothy:writes=stack32 -// stp x23, x16, [sp, #48] // @slothy:writes=stack48 -// str x24, [sp, #64] // @slothy:writes=stack64 -// ldp x7, x3, [x1, #32] -// ldr q0, [x1, #32] -// ldp x25, x10, [x1, #48] -// ldp x24, x12, [x2, #32] -// ldr q25, [x2, #32] -// ldp x6, x23, [x2, #48] -// ldr q18, [x1, #48] -// ldr q3, [x2, #48] -// uzp1 v26.4S, v25.4S, v0.4S -// rev64 v25.4S, v25.4S -// uzp1 v22.4S, v0.4S, v0.4S -// mul v0.4S, v25.4S, v0.4S -// uaddlp v0.2D, v0.4S -// shl v0.2D, v0.2D, #32 -// umlal v0.2D, v22.2S, v26.2S -// mov x16, v0.d[0] -// mov x5, v0.d[1] -// movi v0.2D, #0x00000000ffffffff -// uzp2 v25.4S, v3.4S, v3.4S -// xtn v26.2S, v18.2D -// xtn v22.2S, v3.2D -// rev64 v24.4S, v3.4S -// umull v19.2D, v26.2S, v22.2S -// umull v3.2D, v26.2S, v25.2S -// uzp2 v20.4S, v18.4S, v18.4S -// mul v18.4S, v24.4S, v18.4S -// usra v3.2D, v19.2D, #32 -// umull v6.2D, v20.2S, v25.2S -// uaddlp v25.2D, v18.4S -// and v0.16B, v3.16B, v0.16B -// umlal v0.2D, v20.2S, v22.2S -// shl v25.2D, v25.2D, #32 -// usra v6.2D, v3.2D, #32 -// umlal v25.2D, v26.2S, v22.2S -// usra v6.2D, v0.2D, #32 -// mov x21, v25.d[0] -// mov x19, v25.d[1] -// umulh x8, x7, x24 -// adds x5, x5, x8 -// umulh x8, x3, x12 -// adcs x21, x21, x8 -// mov x8, v6.d[0] -// adcs x19, x19, x8 -// mov x8, v6.d[1] -// adc x8, x8, xzr -// adds x11, x5, x16 -// adcs x5, x21, x5 -// adcs x21, x19, x21 -// adcs x19, x8, x19 -// adc x8, xzr, x8 -// adds x15, x5, x16 -// adcs x20, x21, x11 -// adcs x5, x19, x5 -// adcs x21, x8, x21 -// adcs x19, xzr, x19 -// adc x8, xzr, x8 -// subs x9, x25, x10 -// cneg x9, x9, cc -// csetm x13, cc -// subs x26, x23, x6 -// cneg x26, x26, cc -// mul x22, x9, x26 -// umulh x9, x9, x26 -// cinv x13, x13, cc -// cmn x13, #0x1 -// eor x26, x22, x13 -// adcs x21, x21, x26 -// eor x9, x9, x13 -// adcs x19, x19, x9 -// adc x8, x8, x13 -// subs x9, x7, x3 -// cneg x9, x9, cc -// csetm x13, cc -// subs x26, x12, x24 -// cneg x26, x26, cc -// mul x22, x9, x26 -// umulh x9, x9, x26 -// cinv x13, x13, cc -// cmn x13, #0x1 -// eor x26, x22, x13 -// adcs x11, x11, x26 -// eor x9, x9, x13 -// adcs x15, x15, x9 -// adcs x20, x20, x13 -// adcs x5, x5, x13 -// adcs x21, x21, x13 -// adcs x19, x19, x13 -// adc x8, x8, x13 -// subs x9, x3, x10 -// cneg x9, x9, cc -// csetm x13, cc -// subs x26, x23, x12 -// cneg x26, x26, cc -// mul x22, x9, x26 -// umulh x9, x9, x26 -// cinv x13, x13, cc -// cmn x13, #0x1 -// eor x26, x22, x13 -// adcs x5, x5, x26 -// eor x9, x9, x13 -// adcs x14, x21, x9 -// adcs x21, x19, x13 -// adc x19, x8, x13 -// subs x9, x7, x25 -// cneg x8, x9, cc -// csetm x9, cc -// subs x13, x6, x24 -// cneg x13, x13, cc -// mul x26, x8, x13 -// umulh x8, x8, x13 -// cinv x9, x9, cc -// cmn x9, #0x1 -// eor x13, x26, x9 -// adcs x15, x15, x13 -// eor x8, x8, x9 -// adcs x8, x20, x8 -// adcs x5, x5, x9 -// adcs x20, x14, x9 -// adcs x21, x21, x9 -// adc x19, x19, x9 -// subs x9, x7, x10 -// cneg x9, x9, cc -// csetm x13, cc -// subs x26, x23, x24 -// cneg x26, x26, cc -// mul x22, x9, x26 -// umulh x9, x9, x26 -// cinv x13, x13, cc -// cmn x13, #0x1 -// eor x26, x22, x13 -// adcs x8, x8, x26 -// eor x9, x9, x13 -// adcs x5, x5, x9 -// adcs x20, x20, x13 -// adcs x21, x21, x13 -// adc x19, x19, x13 -// subs x9, x3, x25 -// cneg x9, x9, cc -// csetm x13, cc -// subs x26, x6, x12 -// cneg x26, x26, cc -// mul x22, x9, x26 -// umulh x9, x9, x26 -// cinv x13, x13, cc -// cmn x13, #0x1 -// eor x26, x22, x13 -// adcs x8, x8, x26 -// eor x9, x9, x13 -// adcs x5, x5, x9 -// adcs x20, x20, x13 -// adcs x21, x21, x13 -// adc x19, x19, x13 -// ldp x9, x13, [sp] // @slothy:reads=stack0 -// adds x16, x16, x9 -// adcs x11, x11, x13 -// stp x16, x11, [sp] // @slothy:writes=stack0 -// ldp x16, x11, [sp, #16] // @slothy:reads=stack16 -// adcs x16, x15, x16 -// adcs x8, x8, x11 -// stp x16, x8, [sp, #16] // @slothy:writes=stack16 -// ldp x16, x8, [sp, #32] // @slothy:reads=stack32 -// adcs x16, x5, x16 -// adcs x5, x20, x8 -// stp x16, x5, [sp, #32] // @slothy:writes=stack32 -// ldp x16, x5, [sp, #48] // @slothy:reads=stack48 -// adcs x16, x21, x16 -// adcs x5, x19, x5 -// stp x16, x5, [sp, #48] // @slothy:writes=stack48 -// ldr x16, [sp, #64] // @slothy:reads=stack64 -// adc x16, x16, xzr -// str x16, [sp, #64] // @slothy:writes=stack64 -// ldp x16, x5, [x1] -// subs x7, x7, x16 -// sbcs x3, x3, x5 -// ldp x16, x5, [x1, #16] -// sbcs x25, x25, x16 -// sbcs x10, x10, x5 -// csetm x16, cc -// ldp x5, x21, [x2] -// subs x24, x5, x24 -// sbcs x12, x21, x12 -// ldp x5, x19, [x2, #16] -// sbcs x6, x5, x6 -// sbcs x23, x19, x23 -// csetm x5, cc -// eor x7, x7, x16 -// subs x7, x7, x16 -// eor x3, x3, x16 -// sbcs x3, x3, x16 -// eor x25, x25, x16 -// sbcs x25, x25, x16 -// eor x10, x10, x16 -// sbc x10, x10, x16 -// eor x24, x24, x5 -// subs x24, x24, x5 -// eor x12, x12, x5 -// sbcs x12, x12, x5 -// eor x6, x6, x5 -// sbcs x6, x6, x5 -// eor x23, x23, x5 -// sbc x23, x23, x5 -// eor x16, x5, x16 -// mul x21, x7, x24 -// mul x5, x3, x12 -// mul x19, x25, x6 -// mul x8, x10, x23 -// umulh x11, x7, x24 -// adds x5, x5, x11 -// umulh x11, x3, x12 -// adcs x19, x19, x11 -// umulh x11, x25, x6 -// adcs x8, x8, x11 -// umulh x11, x10, x23 -// adc x11, x11, xzr -// adds x15, x5, x21 -// adcs x5, x19, x5 -// adcs x19, x8, x19 -// adcs x8, x11, x8 -// adc x11, xzr, x11 -// adds x20, x5, x21 -// adcs x9, x19, x15 -// adcs x5, x8, x5 -// adcs x19, x11, x19 -// adcs x8, xzr, x8 -// adc x11, xzr, x11 -// subs x13, x25, x10 -// cneg x13, x13, cc -// csetm x26, cc -// subs x22, x23, x6 -// cneg x22, x22, cc -// mul x4, x13, x22 -// umulh x13, x13, x22 -// cinv x26, x26, cc -// cmn x26, #0x1 -// eor x22, x4, x26 -// adcs x19, x19, x22 -// eor x13, x13, x26 -// adcs x8, x8, x13 -// adc x11, x11, x26 -// subs x13, x7, x3 -// cneg x13, x13, cc -// csetm x26, cc -// subs x22, x12, x24 -// cneg x22, x22, cc -// mul x4, x13, x22 -// umulh x13, x13, x22 -// cinv x26, x26, cc -// cmn x26, #0x1 -// eor x22, x4, x26 -// adcs x15, x15, x22 -// eor x13, x13, x26 -// adcs x20, x20, x13 -// adcs x9, x9, x26 -// adcs x5, x5, x26 -// adcs x19, x19, x26 -// adcs x8, x8, x26 -// adc x11, x11, x26 -// subs x13, x3, x10 -// cneg x13, x13, cc -// csetm x26, cc -// subs x22, x23, x12 -// cneg x22, x22, cc -// mul x4, x13, x22 -// umulh x13, x13, x22 -// cinv x26, x26, cc -// cmn x26, #0x1 -// eor x22, x4, x26 -// adcs x5, x5, x22 -// eor x13, x13, x26 -// adcs x19, x19, x13 -// adcs x8, x8, x26 -// adc x11, x11, x26 -// subs x13, x7, x25 -// cneg x13, x13, cc -// csetm x26, cc -// subs x22, x6, x24 -// cneg x22, x22, cc -// mul x4, x13, x22 -// umulh x13, x13, x22 -// cinv x26, x26, cc -// cmn x26, #0x1 -// eor x22, x4, x26 -// adcs x20, x20, x22 -// eor x13, x13, x26 -// adcs x9, x9, x13 -// adcs x5, x5, x26 -// adcs x19, x19, x26 -// adcs x8, x8, x26 -// adc x11, x11, x26 -// subs x7, x7, x10 -// cneg x7, x7, cc -// csetm x10, cc -// subs x24, x23, x24 -// cneg x24, x24, cc -// mul x23, x7, x24 -// umulh x7, x7, x24 -// cinv x10, x10, cc -// cmn x10, #0x1 -// eor x24, x23, x10 -// adcs x24, x9, x24 -// eor x7, x7, x10 -// adcs x7, x5, x7 -// adcs x23, x19, x10 -// adcs x5, x8, x10 -// adc x10, x11, x10 -// subs x3, x3, x25 -// cneg x3, x3, cc -// csetm x25, cc -// subs x12, x6, x12 -// cneg x12, x12, cc -// mul x6, x3, x12 -// umulh x3, x3, x12 -// cinv x25, x25, cc -// cmn x25, #0x1 -// eor x12, x6, x25 -// adcs x24, x24, x12 -// eor x3, x3, x25 -// adcs x7, x7, x3 -// adcs x3, x23, x25 -// adcs x12, x5, x25 -// adc x25, x10, x25 -// ldp x10, x6, [sp] // @slothy:reads=stack0 -// ldp x23, x5, [sp, #16] // @slothy:reads=stack16 -// eor x21, x21, x16 -// adds x21, x21, x10 -// eor x19, x15, x16 -// adcs x19, x19, x6 -// eor x8, x20, x16 -// adcs x8, x8, x23 -// eor x24, x24, x16 -// adcs x24, x24, x5 -// eor x7, x7, x16 -// ldp x11, x15, [sp, #32] // @slothy:reads=stack32 -// ldp x20, x9, [sp, #48] // @slothy:reads=stack48 -// ldr x13, [sp, #64] // @slothy:reads=stack64 -// adcs x7, x7, x11 -// eor x3, x3, x16 -// adcs x3, x3, x15 -// eor x12, x12, x16 -// adcs x12, x12, x20 -// eor x25, x25, x16 -// adcs x25, x25, x9 -// adc x26, x13, xzr -// adds x7, x7, x10 -// adcs x3, x3, x6 -// adcs x10, x12, x23 -// adcs x25, x25, x5 -// and x12, x16, #0x1ff -// lsl x6, x21, #9 -// orr x12, x6, x12 -// adcs x12, x11, x12 -// extr x6, x19, x21, #55 -// adcs x6, x15, x6 -// extr x23, x8, x19, #55 -// adcs x23, x20, x23 -// extr x16, x24, x8, #55 -// adcs x16, x9, x16 -// lsr x24, x24, #55 -// adc x24, x24, x13 -// ldr x5, [x2, #64] -// ldp x21, x19, [x1] -// and x8, x21, #0xfffffffffffff -// mul x8, x5, x8 -// ldr x11, [x1, #64] -// ldp x15, x20, [x2] -// and x9, x15, #0xfffffffffffff -// mul x9, x11, x9 -// add x8, x8, x9 -// extr x21, x19, x21, #52 -// and x21, x21, #0xfffffffffffff -// mul x21, x5, x21 -// extr x15, x20, x15, #52 -// and x15, x15, #0xfffffffffffff -// mul x15, x11, x15 -// add x21, x21, x15 -// lsr x15, x8, #52 -// add x21, x21, x15 -// lsl x8, x8, #12 -// extr x8, x21, x8, #12 -// adds x7, x7, x8 -// ldp x8, x15, [x1, #16] -// ldp x9, x13, [x2, #16] -// extr x19, x8, x19, #40 -// and x19, x19, #0xfffffffffffff -// mul x19, x5, x19 -// extr x20, x9, x20, #40 -// and x20, x20, #0xfffffffffffff -// mul x20, x11, x20 -// add x19, x19, x20 -// lsr x20, x21, #52 -// add x19, x19, x20 -// lsl x21, x21, #12 -// extr x21, x19, x21, #24 -// adcs x3, x3, x21 -// extr x21, x15, x8, #28 -// and x21, x21, #0xfffffffffffff -// mul x21, x5, x21 -// extr x8, x13, x9, #28 -// and x8, x8, #0xfffffffffffff -// mul x8, x11, x8 -// add x21, x21, x8 -// lsr x8, x19, #52 -// add x21, x21, x8 -// lsl x19, x19, #12 -// extr x19, x21, x19, #36 -// adcs x10, x10, x19 -// and x19, x3, x10 -// ldp x8, x20, [x1, #32] -// ldp x9, x22, [x2, #32] -// extr x15, x8, x15, #16 -// and x15, x15, #0xfffffffffffff -// mul x4, x5, x15 -// extr x15, x9, x13, #16 -// and x15, x15, #0xfffffffffffff -// mul x15, x11, x15 -// add x15, x4, x15 -// lsl x13, x26, #48 -// add x15, x15, x13 -// lsr x13, x21, #52 -// add x15, x15, x13 -// lsl x21, x21, #12 -// extr x21, x15, x21, #48 -// adcs x25, x25, x21 -// and x21, x19, x25 -// lsr x19, x8, #4 -// and x19, x19, #0xfffffffffffff -// mul x19, x5, x19 -// lsr x26, x9, #4 -// and x13, x26, #0xfffffffffffff -// mul x26, x11, x13 -// add x19, x19, x26 -// lsr x13, x15, #52 -// add x19, x19, x13 -// lsl x15, x15, #12 -// extr x15, x19, x15, #60 -// extr x8, x20, x8, #56 -// and x8, x8, #0xfffffffffffff -// mul x8, x5, x8 -// extr x9, x22, x9, #56 -// and x9, x9, #0xfffffffffffff -// mul x9, x11, x9 -// add x8, x8, x9 -// lsr x19, x19, #52 -// add x19, x8, x19 -// lsl x8, x15, #8 -// extr x8, x19, x8, #8 -// adcs x12, x12, x8 -// and x21, x21, x12 -// ldp x1, x8, [x1, #48] -// ldp x2, x15, [x2, #48] -// extr x20, x1, x20, #44 -// and x20, x20, #0xfffffffffffff -// mul x20, x5, x20 -// extr x9, x2, x22, #44 -// and x9, x9, #0xfffffffffffff -// mul x9, x11, x9 -// add x20, x20, x9 -// lsr x9, x19, #52 -// add x22, x20, x9 -// lsl x19, x19, #12 -// extr x19, x22, x19, #20 -// adcs x6, x6, x19 -// and x21, x21, x6 -// extr x1, x8, x1, #32 -// and x1, x1, #0xfffffffffffff -// mul x1, x5, x1 -// extr x2, x15, x2, #32 -// and x2, x2, #0xfffffffffffff -// mul x2, x11, x2 -// add x2, x1, x2 -// lsr x1, x22, #52 -// add x2, x2, x1 -// lsl x1, x22, #12 -// extr x1, x2, x1, #32 -// adcs x23, x23, x1 -// and x21, x21, x23 -// lsr x1, x8, #20 -// mul x1, x5, x1 -// lsr x19, x15, #20 -// mul x19, x11, x19 -// add x1, x1, x19 -// lsr x19, x2, #52 -// add x19, x1, x19 -// lsl x2, x2, #12 -// extr x2, x19, x2, #44 -// adcs x16, x16, x2 -// and x2, x21, x16 -// mul x5, x5, x11 -// lsr x1, x19, #44 -// add x5, x5, x1 -// adc x24, x24, x5 -// lsr x5, x24, #9 -// orr x24, x24, #0xfffffffffffffe00 -// cmp xzr, xzr -// adcs xzr, x7, x5 -// adcs xzr, x2, xzr -// adcs xzr, x24, xzr -// adcs x7, x7, x5 -// adcs x2, x3, xzr -// adcs x10, x10, xzr -// adcs x25, x25, xzr -// adcs x12, x12, xzr -// adcs x6, x6, xzr -// adcs x23, x23, xzr -// adcs x16, x16, xzr -// adc x3, x24, xzr -// stp x2, x10, [x0] // @slothy:writes=buffer0 -// stp x25, x12, [x0, #16] // @slothy:writes=buffer16 -// stp x6, x23, [x0, #32] // @slothy:writes=buffer32 -// lsl x25, x7, #9 -// and x3, x3, #0x1ff -// orr x3, x3, x25 -// stp x16, x3, [x0, #48] // @slothy:writes=buffer48 -// lsr x14, x7, #55 -// str x14, [x0, #64] // @slothy:writes=buffer64 -// add sp, sp, #80 -// ldp x25, x26, [sp], #16 -// ldp x23, x24, [sp], #16 -// ldp x21, x22, [sp], #16 -// ldp x19, x20, [sp], #16 -// ret -// -// The bash script used for step 2 is as follows: -// -// # Store the assembly instructions except the last 'ret', -// # callee-register store/loads and add/sub sp #80 as, say, 'input.S'. -// export OUTPUTS="[hint_buffer0,hint_buffer16,hint_buffer32,hint_buffer48,hint_buffer64]" -// export RESERVED_REGS="[x18,x27,x28,x29,x30,sp,q8,q9,q10,q11,q12,q13,q14,q15,v8,v9,v10,v11,v12,v13,v14,v15]" -// /tools/external/slothy.sh input.S my_out_dir -// # my_out_dir/3.opt.s is the optimized assembly. Its output may differ -// # from this file since the sequence is non-deterministically chosen. -// # Please add 'ret' at the end of the output assembly. - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p521) - .text - .balign 4 - -S2N_BN_SYMBOL(bignum_montmul_p521): - CFI_START - -// Save registers and make space for the temporary buffer - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_DEC_SP(80) - - ldr q24, [x2] - ldr q21, [x1] - ldr q1, [x2, #48] - ldp x23, x20, [x1, #16] - movi v18.2D, #0x00000000ffffffff - ldp x19, x17, [x2, #16] - uzp2 v3.4S, v24.4S, v24.4S - xtn v6.2S, v21.2D - ldp x11, x22, [x1] - rev64 v5.4S, v24.4S - xtn v24.2S, v24.2D - subs x16, x23, x20 - umull v29.2D, v6.2S, v3.2S - rev64 v31.4S, v1.4S - cneg x26, x16, cc - umull v27.2D, v6.2S, v24.2S - ldr q19, [x1, #48] - csetm x12, cc - mul x15, x20, x17 - mul v26.4S, v5.4S, v21.4S - uzp2 v28.4S, v21.4S, v21.4S - subs x6, x17, x19 - xtn v7.2S, v1.2D - cinv x10, x12, cc - cneg x3, x6, cc - uzp2 v21.4S, v1.4S, v1.4S - umull v1.2D, v28.2S, v3.2S - mul x12, x26, x3 - usra v29.2D, v27.2D, #32 - mul v25.4S, v31.4S, v19.4S - usra v1.2D, v29.2D, #32 - uaddlp v31.2D, v26.4S - umulh x14, x26, x3 - eor x12, x12, x10 - and v26.16B, v29.16B, v18.16B - uaddlp v2.2D, v25.4S - subs x16, x11, x22 - shl v0.2D, v31.2D, #32 - xtn v31.2S, v19.2D - cneg x6, x16, cc - shl v16.2D, v2.2D, #32 - umlal v26.2D, v28.2S, v24.2S - umlal v0.2D, v6.2S, v24.2S - uzp2 v30.4S, v19.4S, v19.4S - umulh x26, x20, x17 - umull v22.2D, v31.2S, v21.2S - umull v29.2D, v30.2S, v21.2S - usra v1.2D, v26.2D, #32 - mul x13, x23, x19 - eor x9, x14, x10 - ldr q5, [x2, #32] - umull v26.2D, v31.2S, v7.2S - ldp x21, x4, [x2] - csetm x8, cc - mov x16, v0.d[1] - ldr q6, [x1, #32] - umlal v16.2D, v31.2S, v7.2S - mov x3, v0.d[0] - umulh x14, x23, x19 - mov x25, v1.d[1] - mov x5, v1.d[0] - usra v22.2D, v26.2D, #32 - rev64 v3.4S, v5.4S - adds x16, x16, x5 - uzp1 v24.4S, v5.4S, v6.4S - movi v26.2D, #0x00000000ffffffff - adcs x7, x13, x25 - uzp1 v0.4S, v6.4S, v6.4S - mul v5.4S, v3.4S, v6.4S - adcs x25, x15, x14 - adc x13, x26, xzr - adds x26, x16, x3 - and v6.16B, v22.16B, v26.16B - usra v29.2D, v22.2D, #32 - adcs x16, x7, x16 - adcs x14, x25, x7 - umlal v6.2D, v30.2S, v7.2S - adcs x7, x13, x25 - uaddlp v7.2D, v5.4S - adc x13, xzr, x13 - adds x25, x16, x3 - adcs x24, x14, x26 - shl v1.2D, v7.2D, #32 - adcs x5, x7, x16 - usra v29.2D, v6.2D, #32 - adcs x16, x13, x14 - umlal v1.2D, v0.2S, v24.2S - adcs x14, xzr, x7 - adc x13, xzr, x13 - subs x7, x4, x21 - cneg x7, x7, cc - mul x15, x6, x7 - umulh x7, x6, x7 - cinv x6, x8, cc - cmn x10, #0x1 - adcs x16, x16, x12 - eor x8, x15, x6 - adcs x14, x14, x9 - adc x9, x13, x10 - subs x13, x22, x20 - cneg x13, x13, cc - csetm x10, cc - subs x12, x17, x4 - cinv x15, x10, cc - cneg x10, x12, cc - cmn x6, #0x1 - umulh x12, x13, x10 - eor x7, x7, x6 - adcs x26, x26, x8 - adcs x7, x25, x7 - adcs x8, x24, x6 - adcs x24, x5, x6 - adcs x25, x16, x6 - mul x5, x13, x10 - adcs x13, x14, x6 - adc x14, x9, x6 - subs x10, x11, x23 - csetm x16, cc - cneg x9, x10, cc - subs x6, x19, x21 - cinv x10, x16, cc - cneg x16, x6, cc - eor x5, x5, x15 - subs x20, x11, x20 - mul x6, x9, x16 - csetm x11, cc - cneg x20, x20, cc - subs x17, x17, x21 - cneg x17, x17, cc - cinv x11, x11, cc - umulh x9, x9, x16 - eor x16, x12, x15 - subs x21, x22, x23 - cneg x22, x21, cc - eor x12, x6, x10 - csetm x6, cc - cmn x15, #0x1 - eor x9, x9, x10 - adcs x5, x24, x5 - umulh x23, x20, x17 - lsl x24, x3, #9 - adcs x25, x25, x16 - adcs x21, x13, x15 - adc x16, x14, x15 - subs x13, x19, x4 - cneg x14, x13, cc - cinv x15, x6, cc - cmn x10, #0x1 - mul x13, x20, x17 - extr x17, x26, x3, #55 - adcs x12, x7, x12 - adcs x8, x8, x9 - eor x19, x23, x11 - adcs x6, x5, x10 - eor x13, x13, x11 - mov x5, v29.d[0] - adcs x25, x25, x10 - extr x26, x12, x26, #55 - mul x4, x22, x14 - adcs x7, x21, x10 - stp x24, x17, [sp, #32] - ldp x20, x21, [x1, #48] - adc x24, x16, x10 - cmn x11, #0x1 - mov x16, v16.d[0] - umulh x17, x22, x14 - adcs x13, x8, x13 - eor x9, x4, x15 - adcs x10, x6, x19 - ldp x22, x23, [x1, #32] - adcs x3, x25, x11 - ldp x4, x19, [x2, #32] - eor x17, x17, x15 - adcs x7, x7, x11 - adc x14, x24, x11 - subs x6, x20, x21 - csetm x11, cc - cneg x8, x6, cc - cmn x15, #0x1 - umulh x25, x22, x4 - adcs x24, x13, x9 - adcs x10, x10, x17 - extr x13, x24, x12, #55 - adcs x9, x3, x15 - ldp x17, x3, [x2, #48] - umulh x6, x23, x19 - adcs x7, x7, x15 - adc x14, x14, x15 - subs x12, x22, x23 - stp x10, x9, [sp] - mov x9, v1.d[1] - csetm x10, cc - stp x7, x14, [sp, #16] - cneg x12, x12, cc - subs x14, x3, x17 - mov x7, v16.d[1] - cneg x15, x14, cc - mov x14, v29.d[1] - cinv x11, x11, cc - adds x9, x9, x25 - mul x25, x8, x15 - stp x26, x13, [sp, #48] - lsr x24, x24, #55 - adcs x26, x16, x6 - mov x13, v1.d[0] - str x24, [sp, #64] - adcs x7, x7, x5 - adc x5, x14, xzr - umulh x6, x8, x15 - eor x15, x25, x11 - subs x25, x19, x4 - cinv x16, x10, cc - cneg x10, x25, cc - eor x6, x6, x11 - adds x8, x9, x13 - adcs x14, x26, x9 - mul x9, x12, x10 - adcs x24, x7, x26 - adcs x7, x5, x7 - umulh x25, x12, x10 - adc x12, xzr, x5 - adds x26, x14, x13 - eor x10, x9, x16 - adcs x9, x24, x8 - adcs x5, x7, x14 - adcs x14, x12, x24 - adcs x7, xzr, x7 - adc x12, xzr, x12 - eor x24, x25, x16 - cmn x11, #0x1 - adcs x25, x14, x15 - adcs x14, x7, x6 - adc x11, x12, x11 - subs x12, x23, x21 - csetm x15, cc - cneg x7, x12, cc - subs x12, x3, x19 - cneg x12, x12, cc - cinv x15, x15, cc - cmn x16, #0x1 - adcs x6, x8, x10 - mul x10, x7, x12 - adcs x26, x26, x24 - adcs x9, x9, x16 - umulh x24, x7, x12 - eor x8, x10, x15 - adcs x5, x5, x16 - adcs x25, x25, x16 - adcs x7, x14, x16 - adc x16, x11, x16 - subs x11, x22, x20 - cneg x11, x11, cc - csetm x14, cc - subs x10, x17, x4 - cinv x14, x14, cc - cneg x10, x10, cc - cmn x15, #0x1 - eor x12, x24, x15 - adcs x5, x5, x8 - mul x24, x11, x10 - adcs x8, x25, x12 - adcs x25, x7, x15 - adc x16, x16, x15 - subs x12, x22, x21 - umulh x10, x11, x10 - cneg x15, x12, cc - csetm x11, cc - subs x12, x3, x4 - cneg x12, x12, cc - cinv x7, x11, cc - mul x11, x15, x12 - eor x24, x24, x14 - cmn x14, #0x1 - eor x10, x10, x14 - adcs x24, x26, x24 - eor x26, x11, x7 - adcs x10, x9, x10 - ldp x11, x9, [x1, #16] - umulh x15, x15, x12 - adcs x5, x5, x14 - adcs x8, x8, x14 - adcs x25, x25, x14 - adc x12, x16, x14 - cmn x7, #0x1 - adcs x16, x10, x26 - eor x14, x15, x7 - adcs x26, x5, x14 - ldp x5, x10, [x1] - adcs x14, x8, x7 - adcs x15, x25, x7 - adc x7, x12, x7 - subs x25, x23, x20 - cneg x25, x25, cc - csetm x8, cc - subs x22, x22, x5 - sbcs x10, x23, x10 - ldp x23, x12, [x2] - sbcs x20, x20, x11 - sbcs x21, x21, x9 - csetm x9, cc - subs x11, x17, x19 - cneg x5, x11, cc - cinv x11, x8, cc - subs x23, x23, x4 - sbcs x19, x12, x19 - eor x20, x20, x9 - ldp x12, x4, [x2, #16] - eor x21, x21, x9 - umulh x8, x25, x5 - eor x22, x22, x9 - eor x10, x10, x9 - sbcs x17, x12, x17 - sbcs x3, x4, x3 - mul x25, x25, x5 - csetm x12, cc - subs x22, x22, x9 - eor x4, x23, x12 - sbcs x23, x10, x9 - eor x10, x3, x12 - sbcs x20, x20, x9 - eor x5, x8, x11 - eor x3, x19, x12 - sbc x21, x21, x9 - subs x4, x4, x12 - eor x25, x25, x11 - sbcs x19, x3, x12 - eor x3, x17, x12 - sbcs x17, x3, x12 - umulh x8, x23, x19 - sbc x3, x10, x12 - cmn x11, #0x1 - adcs x25, x16, x25 - adcs x26, x26, x5 - ldp x10, x5, [sp] - adcs x16, x14, x11 - mul x14, x22, x4 - adcs x15, x15, x11 - adc x7, x7, x11 - adds x11, x13, x10 - umulh x10, x21, x3 - adcs x13, x6, x5 - ldp x6, x5, [sp, #16] - stp x11, x13, [sp] - eor x13, x12, x9 - mul x9, x23, x19 - adcs x6, x24, x6 - ldp x11, x24, [sp, #32] - mul x12, x20, x17 - adcs x25, x25, x5 - stp x6, x25, [sp, #16] - ldp x6, x25, [sp, #48] - umulh x5, x20, x17 - adcs x11, x26, x11 - ldr x26, [sp, #64] - adcs x16, x16, x24 - stp x11, x16, [sp, #32] - adcs x11, x15, x6 - umulh x24, x22, x4 - adcs x25, x7, x25 - adc x7, x26, xzr - stp x11, x25, [sp, #48] - subs x26, x20, x21 - csetm x15, cc - cneg x25, x26, cc - str x7, [sp, #64] - mul x11, x21, x3 - subs x6, x22, x23 - cneg x6, x6, cc - csetm x16, cc - subs x26, x3, x17 - cneg x26, x26, cc - cinv x7, x15, cc - adds x24, x9, x24 - adcs x8, x12, x8 - umulh x12, x25, x26 - adcs x5, x11, x5 - adc x11, x10, xzr - subs x15, x19, x4 - cinv x9, x16, cc - mul x26, x25, x26 - eor x25, x12, x7 - cneg x12, x15, cc - adds x16, x24, x14 - eor x15, x26, x7 - umulh x26, x6, x12 - adcs x10, x8, x24 - adcs x8, x5, x8 - adcs x24, x11, x5 - adc x5, xzr, x11 - adds x11, x10, x14 - mul x12, x6, x12 - adcs x6, x8, x16 - eor x14, x14, x13 - adcs x10, x24, x10 - adcs x8, x5, x8 - adcs x24, xzr, x24 - adc x5, xzr, x5 - cmn x7, #0x1 - adcs x15, x8, x15 - adcs x24, x24, x25 - eor x25, x26, x9 - adc x8, x5, x7 - eor x5, x12, x9 - subs x26, x23, x21 - cneg x12, x26, cc - csetm x26, cc - subs x7, x3, x19 - cneg x7, x7, cc - cinv x26, x26, cc - cmn x9, #0x1 - adcs x5, x16, x5 - mul x16, x12, x7 - adcs x25, x11, x25 - umulh x7, x12, x7 - adcs x12, x6, x9 - eor x11, x16, x26 - adcs x6, x10, x9 - adcs x10, x15, x9 - adcs x24, x24, x9 - adc x8, x8, x9 - subs x15, x22, x20 - cneg x15, x15, cc - csetm x9, cc - subs x16, x17, x4 - cneg x16, x16, cc - cinv x9, x9, cc - subs x21, x22, x21 - mul x22, x15, x16 - eor x7, x7, x26 - cneg x21, x21, cc - umulh x16, x15, x16 - csetm x15, cc - subs x4, x3, x4 - cneg x3, x4, cc - eor x4, x22, x9 - cinv x15, x15, cc - cmn x26, #0x1 - eor x22, x5, x13 - adcs x5, x6, x11 - adcs x6, x10, x7 - adcs x10, x24, x26 - eor x11, x16, x9 - adc x8, x8, x26 - subs x16, x23, x20 - cneg x7, x16, cc - csetm x23, cc - cmn x9, #0x1 - adcs x16, x25, x4 - mul x4, x21, x3 - adcs x24, x12, x11 - eor x11, x16, x13 - adcs x26, x5, x9 - adcs x16, x6, x9 - umulh x20, x21, x3 - adcs x6, x10, x9 - ldp x3, x10, [x1] - adc x12, x8, x9 - subs x21, x17, x19 - cneg x8, x21, cc - eor x25, x20, x15 - eor x20, x4, x15 - mul x19, x7, x8 - cinv x17, x23, cc - cmn x15, #0x1 - adcs x4, x24, x20 - extr x21, x10, x3, #52 - umulh x9, x7, x8 - and x24, x21, #0xfffffffffffff - adcs x26, x26, x25 - eor x7, x19, x17 - adcs x5, x16, x15 - and x23, x3, #0xfffffffffffff - eor x9, x9, x17 - adcs x21, x6, x15 - adc x6, x12, x15 - cmn x17, #0x1 - adcs x25, x4, x7 - and x4, x13, #0x1ff - ldp x16, x8, [sp] - adcs x20, x26, x9 - adcs x12, x5, x17 - ldp x3, x5, [sp, #16] - eor x15, x12, x13 - adcs x12, x21, x17 - adc x9, x6, x17 - adds x21, x14, x16 - lsl x7, x21, #9 - eor x26, x12, x13 - ldp x19, x17, [sp, #32] - orr x4, x7, x4 - eor x14, x25, x13 - adcs x7, x22, x8 - adcs x12, x11, x3 - eor x11, x20, x13 - ldp x6, x25, [sp, #48] - eor x20, x9, x13 - adcs x22, x14, x5 - ldr x14, [x2, #64] - adcs x9, x11, x19 - ldr x11, [sp, #64] - adcs x13, x15, x17 - adcs x26, x26, x6 - adcs x20, x20, x25 - adc x15, x11, xzr - adds x16, x9, x16 - mul x9, x14, x23 - adcs x23, x13, x8 - extr x13, x7, x21, #55 - adcs x21, x26, x3 - ldp x3, x26, [x1, #16] - extr x8, x22, x12, #55 - adcs x20, x20, x5 - adcs x19, x19, x4 - mul x4, x14, x24 - ldp x5, x24, [x2] - adcs x17, x17, x13 - extr x13, x26, x3, #28 - extr x10, x3, x10, #40 - extr x7, x12, x7, #55 - and x12, x13, #0xfffffffffffff - adcs x3, x6, x7 - ldr x6, [x1, #64] - extr x7, x24, x5, #52 - and x5, x5, #0xfffffffffffff - mul x12, x14, x12 - adcs x13, x25, x8 - and x7, x7, #0xfffffffffffff - ldp x8, x25, [x2, #16] - mul x5, x6, x5 - extr x24, x8, x24, #40 - and x24, x24, #0xfffffffffffff - add x9, x9, x5 - lsr x5, x22, #55 - mul x7, x6, x7 - extr x22, x25, x8, #28 - and x10, x10, #0xfffffffffffff - mul x10, x14, x10 - lsr x8, x9, #52 - lsl x9, x9, #12 - add x7, x4, x7 - adc x4, x5, x11 - ldp x11, x5, [x2, #32] - add x8, x7, x8 - and x7, x22, #0xfffffffffffff - extr x22, x8, x9, #12 - lsl x9, x15, #48 - mul x15, x6, x24 - add x10, x10, x15 - lsr x15, x8, #52 - extr x25, x11, x25, #16 - and x25, x25, #0xfffffffffffff - mul x24, x6, x7 - add x7, x10, x15 - lsr x10, x7, #52 - lsl x8, x8, #12 - extr x8, x7, x8, #24 - adds x22, x16, x22 - ldp x16, x15, [x1, #32] - adcs x23, x23, x8 - extr x8, x5, x11, #56 - mul x25, x6, x25 - add x24, x12, x24 - add x12, x24, x10 - lsr x10, x16, #4 - lsl x7, x7, #12 - extr x24, x12, x7, #36 - and x10, x10, #0xfffffffffffff - extr x26, x16, x26, #16 - mul x10, x14, x10 - and x8, x8, #0xfffffffffffff - adcs x21, x21, x24 - and x7, x26, #0xfffffffffffff - mul x7, x14, x7 - lsr x24, x11, #4 - and x24, x24, #0xfffffffffffff - extr x11, x15, x16, #56 - lsl x26, x12, #12 - and x16, x11, #0xfffffffffffff - mul x11, x6, x24 - lsr x12, x12, #52 - ldp x2, x24, [x2, #48] - add x25, x7, x25 - add x25, x25, x9 - and x9, x23, x21 - mul x8, x6, x8 - add x12, x25, x12 - add x25, x10, x11 - extr x11, x12, x26, #48 - ldp x7, x26, [x1, #48] - extr x5, x2, x5, #44 - lsr x1, x12, #52 - mul x10, x14, x16 - lsr x16, x24, #20 - add x10, x10, x8 - extr x8, x26, x7, #32 - and x8, x8, #0xfffffffffffff - extr x24, x24, x2, #32 - mul x2, x6, x16 - add x1, x25, x1 - lsr x25, x26, #20 - and x26, x24, #0xfffffffffffff - and x24, x5, #0xfffffffffffff - extr x16, x7, x15, #44 - mul x7, x6, x24 - adcs x11, x20, x11 - and x20, x16, #0xfffffffffffff - lsl x5, x12, #12 - and x15, x9, x11 - mul x24, x14, x20 - lsr x9, x1, #52 - add x20, x10, x9 - extr x12, x1, x5, #60 - lsl x9, x20, #12 - lsl x5, x12, #8 - mul x10, x14, x8 - extr x12, x20, x5, #8 - lsr x1, x20, #52 - add x7, x24, x7 - adcs x8, x19, x12 - and x5, x15, x8 - add x7, x7, x1 - mul x20, x6, x26 - extr x24, x7, x9, #20 - lsr x19, x7, #52 - mul x25, x14, x25 - lsl x16, x7, #12 - add x20, x10, x20 - adcs x12, x17, x24 - add x19, x20, x19 - lsr x26, x19, #52 - mul x24, x14, x6 - and x5, x5, x12 - add x6, x25, x2 - lsl x17, x19, #12 - add x14, x6, x26 - extr x16, x19, x16, #32 - lsr x6, x14, #44 - extr x19, x14, x17, #44 - add x9, x24, x6 - adcs x17, x3, x16 - adcs x2, x13, x19 - and x7, x5, x17 - adc x15, x4, x9 - cmp xzr, xzr - orr x1, x15, #0xfffffffffffffe00 - lsr x3, x15, #9 - adcs xzr, x22, x3 - and x15, x7, x2 - adcs xzr, x15, xzr - adcs xzr, x1, xzr - adcs x7, x22, x3 - lsl x3, x7, #9 - lsr x15, x7, #55 - str x15, [x0, #64] - adcs x13, x23, xzr - adcs x16, x21, xzr - stp x13, x16, [x0] - adcs x13, x11, xzr - adcs x16, x8, xzr - stp x13, x16, [x0, #16] - adcs x19, x12, xzr - adcs x16, x17, xzr - adcs x13, x2, xzr - stp x19, x16, [x0, #32] - adc x16, x1, xzr - and x16, x16, #0x1ff - orr x16, x16, x3 - stp x13, x16, [x0, #48] - -// Restore regs and return - - CFI_INC_SP(80) - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montmul_p521_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montmul_p521_alt.S deleted file mode 100644 index 8dce747975f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montmul_p521_alt.S +++ /dev/null @@ -1,559 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^576) mod p_521 -// Inputs x[9], y[9]; output z[9] -// -// extern void bignum_montmul_p521_alt(uint64_t z[static 9], -// const uint64_t x[static 9], -// const uint64_t y[static 9]); -// -// Does z := (x * y / 2^576) mod p_521, assuming x < p_521, y < p_521. This -// means the Montgomery base is the "native size" 2^{9*64} = 2^576; since -// p_521 is a Mersenne prime the basic modular multiplication bignum_mul_p521 -// can be considered a Montgomery operation to base 2^521. -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p521_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_p521_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p521_alt) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 - -// These are repeated mod 2 as we load paris of inputs - -#define a0 x3 -#define a1 x4 -#define a2 x3 -#define a3 x4 -#define a4 x3 -#define a5 x4 -#define a6 x3 -#define a7 x4 -#define a8 x3 - -#define b0 x5 -#define b1 x6 -#define b2 x7 -#define b3 x8 -#define b4 x9 -#define b5 x10 -#define b6 x11 -#define b7 x12 -#define b8 x13 - -#define t x14 - -// These repeat mod 11 as we stash some intermediate results in the -// output buffer. - -#define u0 x15 -#define u1 x16 -#define u2 x17 -#define u3 x19 -#define u4 x20 -#define u5 x21 -#define u6 x22 -#define u7 x23 -#define u8 x24 -#define u9 x25 -#define u10 x26 -#define u11 x15 -#define u12 x16 -#define u13 x17 -#define u14 x19 -#define u15 x20 -#define u16 x21 - -S2N_BN_SYMBOL(bignum_montmul_p521_alt): - CFI_START - -// Save more registers and make space for the temporary buffer - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_DEC_SP(64) - -// Load operands and set up row 0 = [u9;...;u0] = a0 * [b8;...;b0] - - ldp a0, a1, [x] - ldp b0, b1, [y] - - mul u0, a0, b0 - umulh u1, a0, b0 - mul t, a0, b1 - umulh u2, a0, b1 - adds u1, u1, t - - ldp b2, b3, [y, #16] - - mul t, a0, b2 - umulh u3, a0, b2 - adcs u2, u2, t - - mul t, a0, b3 - umulh u4, a0, b3 - adcs u3, u3, t - - ldp b4, b5, [y, #32] - - mul t, a0, b4 - umulh u5, a0, b4 - adcs u4, u4, t - - mul t, a0, b5 - umulh u6, a0, b5 - adcs u5, u5, t - - ldp b6, b7, [y, #48] - - mul t, a0, b6 - umulh u7, a0, b6 - adcs u6, u6, t - - ldr b8, [y, #64] - - mul t, a0, b7 - umulh u8, a0, b7 - adcs u7, u7, t - - mul t, a0, b8 - umulh u9, a0, b8 - adcs u8, u8, t - - adc u9, u9, xzr - -// Row 1 = [u10;...;u0] = [a1;a0] * [b8;...;b0] - - mul t, a1, b0 - adds u1, u1, t - mul t, a1, b1 - adcs u2, u2, t - mul t, a1, b2 - adcs u3, u3, t - mul t, a1, b3 - adcs u4, u4, t - mul t, a1, b4 - adcs u5, u5, t - mul t, a1, b5 - adcs u6, u6, t - mul t, a1, b6 - adcs u7, u7, t - mul t, a1, b7 - adcs u8, u8, t - mul t, a1, b8 - adcs u9, u9, t - cset u10, cs - - umulh t, a1, b0 - adds u2, u2, t - umulh t, a1, b1 - adcs u3, u3, t - umulh t, a1, b2 - adcs u4, u4, t - umulh t, a1, b3 - adcs u5, u5, t - umulh t, a1, b4 - adcs u6, u6, t - umulh t, a1, b5 - adcs u7, u7, t - umulh t, a1, b6 - adcs u8, u8, t - umulh t, a1, b7 - adcs u9, u9, t - umulh t, a1, b8 - adc u10, u10, t - - stp u0, u1, [sp] - -// Row 2 = [u11;...;u0] = [a2;a1;a0] * [b8;...;b0] - - ldp a2, a3, [x, #16] - - mul t, a2, b0 - adds u2, u2, t - mul t, a2, b1 - adcs u3, u3, t - mul t, a2, b2 - adcs u4, u4, t - mul t, a2, b3 - adcs u5, u5, t - mul t, a2, b4 - adcs u6, u6, t - mul t, a2, b5 - adcs u7, u7, t - mul t, a2, b6 - adcs u8, u8, t - mul t, a2, b7 - adcs u9, u9, t - mul t, a2, b8 - adcs u10, u10, t - cset u11, cs - - umulh t, a2, b0 - adds u3, u3, t - umulh t, a2, b1 - adcs u4, u4, t - umulh t, a2, b2 - adcs u5, u5, t - umulh t, a2, b3 - adcs u6, u6, t - umulh t, a2, b4 - adcs u7, u7, t - umulh t, a2, b5 - adcs u8, u8, t - umulh t, a2, b6 - adcs u9, u9, t - umulh t, a2, b7 - adcs u10, u10, t - umulh t, a2, b8 - adc u11, u11, t - -// Row 3 = [u12;...;u0] = [a3;a2;a1;a0] * [b8;...;b0] - - mul t, a3, b0 - adds u3, u3, t - mul t, a3, b1 - adcs u4, u4, t - mul t, a3, b2 - adcs u5, u5, t - mul t, a3, b3 - adcs u6, u6, t - mul t, a3, b4 - adcs u7, u7, t - mul t, a3, b5 - adcs u8, u8, t - mul t, a3, b6 - adcs u9, u9, t - mul t, a3, b7 - adcs u10, u10, t - mul t, a3, b8 - adcs u11, u11, t - cset u12, cs - - umulh t, a3, b0 - adds u4, u4, t - umulh t, a3, b1 - adcs u5, u5, t - umulh t, a3, b2 - adcs u6, u6, t - umulh t, a3, b3 - adcs u7, u7, t - umulh t, a3, b4 - adcs u8, u8, t - umulh t, a3, b5 - adcs u9, u9, t - umulh t, a3, b6 - adcs u10, u10, t - umulh t, a3, b7 - adcs u11, u11, t - umulh t, a3, b8 - adc u12, u12, t - - stp u2, u3, [sp, #16] - -// Row 4 = [u13;...;u0] = [a4;a3;a2;a1;a0] * [b8;...;b0] - - ldp a4, a5, [x, #32] - - mul t, a4, b0 - adds u4, u4, t - mul t, a4, b1 - adcs u5, u5, t - mul t, a4, b2 - adcs u6, u6, t - mul t, a4, b3 - adcs u7, u7, t - mul t, a4, b4 - adcs u8, u8, t - mul t, a4, b5 - adcs u9, u9, t - mul t, a4, b6 - adcs u10, u10, t - mul t, a4, b7 - adcs u11, u11, t - mul t, a4, b8 - adcs u12, u12, t - cset u13, cs - - umulh t, a4, b0 - adds u5, u5, t - umulh t, a4, b1 - adcs u6, u6, t - umulh t, a4, b2 - adcs u7, u7, t - umulh t, a4, b3 - adcs u8, u8, t - umulh t, a4, b4 - adcs u9, u9, t - umulh t, a4, b5 - adcs u10, u10, t - umulh t, a4, b6 - adcs u11, u11, t - umulh t, a4, b7 - adcs u12, u12, t - umulh t, a4, b8 - adc u13, u13, t - -// Row 5 = [u14;...;u0] = [a5;a4;a3;a2;a1;a0] * [b8;...;b0] - - mul t, a5, b0 - adds u5, u5, t - mul t, a5, b1 - adcs u6, u6, t - mul t, a5, b2 - adcs u7, u7, t - mul t, a5, b3 - adcs u8, u8, t - mul t, a5, b4 - adcs u9, u9, t - mul t, a5, b5 - adcs u10, u10, t - mul t, a5, b6 - adcs u11, u11, t - mul t, a5, b7 - adcs u12, u12, t - mul t, a5, b8 - adcs u13, u13, t - cset u14, cs - - umulh t, a5, b0 - adds u6, u6, t - umulh t, a5, b1 - adcs u7, u7, t - umulh t, a5, b2 - adcs u8, u8, t - umulh t, a5, b3 - adcs u9, u9, t - umulh t, a5, b4 - adcs u10, u10, t - umulh t, a5, b5 - adcs u11, u11, t - umulh t, a5, b6 - adcs u12, u12, t - umulh t, a5, b7 - adcs u13, u13, t - umulh t, a5, b8 - adc u14, u14, t - - stp u4, u5, [sp, #32] - -// Row 6 = [u15;...;u0] = [a6;a5;a4;a3;a2;a1;a0] * [b8;...;b0] - - ldp a6, a7, [x, #48] - - mul t, a6, b0 - adds u6, u6, t - mul t, a6, b1 - adcs u7, u7, t - mul t, a6, b2 - adcs u8, u8, t - mul t, a6, b3 - adcs u9, u9, t - mul t, a6, b4 - adcs u10, u10, t - mul t, a6, b5 - adcs u11, u11, t - mul t, a6, b6 - adcs u12, u12, t - mul t, a6, b7 - adcs u13, u13, t - mul t, a6, b8 - adcs u14, u14, t - cset u15, cs - - umulh t, a6, b0 - adds u7, u7, t - umulh t, a6, b1 - adcs u8, u8, t - umulh t, a6, b2 - adcs u9, u9, t - umulh t, a6, b3 - adcs u10, u10, t - umulh t, a6, b4 - adcs u11, u11, t - umulh t, a6, b5 - adcs u12, u12, t - umulh t, a6, b6 - adcs u13, u13, t - umulh t, a6, b7 - adcs u14, u14, t - umulh t, a6, b8 - adc u15, u15, t - -// Row 7 = [u16;...;u0] = [a7;a6;a5;a4;a3;a2;a1;a0] * [b8;...;b0] - - mul t, a7, b0 - adds u7, u7, t - mul t, a7, b1 - adcs u8, u8, t - mul t, a7, b2 - adcs u9, u9, t - mul t, a7, b3 - adcs u10, u10, t - mul t, a7, b4 - adcs u11, u11, t - mul t, a7, b5 - adcs u12, u12, t - mul t, a7, b6 - adcs u13, u13, t - mul t, a7, b7 - adcs u14, u14, t - mul t, a7, b8 - adcs u15, u15, t - cset u16, cs - - umulh t, a7, b0 - adds u8, u8, t - umulh t, a7, b1 - adcs u9, u9, t - umulh t, a7, b2 - adcs u10, u10, t - umulh t, a7, b3 - adcs u11, u11, t - umulh t, a7, b4 - adcs u12, u12, t - umulh t, a7, b5 - adcs u13, u13, t - umulh t, a7, b6 - adcs u14, u14, t - umulh t, a7, b7 - adcs u15, u15, t - umulh t, a7, b8 - adc u16, u16, t - - stp u6, u7, [sp, #48] - -// Row 8 = [u16;...;u0] = [a8;a7;a6;a5;a4;a3;a2;a1;a0] * [b8;...;b0] - - ldr a8, [x, #64] - - mul t, a8, b0 - adds u8, u8, t - mul t, a8, b1 - adcs u9, u9, t - mul t, a8, b2 - adcs u10, u10, t - mul t, a8, b3 - adcs u11, u11, t - mul t, a8, b4 - adcs u12, u12, t - mul t, a8, b5 - adcs u13, u13, t - mul t, a8, b6 - adcs u14, u14, t - mul t, a8, b7 - adcs u15, u15, t - mul t, a8, b8 - adc u16, u16, t - - umulh t, a8, b0 - adds u9, u9, t - umulh t, a8, b1 - adcs u10, u10, t - umulh t, a8, b2 - adcs u11, u11, t - umulh t, a8, b3 - adcs u12, u12, t - umulh t, a8, b4 - adcs u13, u13, t - umulh t, a8, b5 - adcs u14, u14, t - umulh t, a8, b6 - adcs u15, u15, t - umulh t, a8, b7 - adc u16, u16, t - -// Now we have the full product, which we consider as -// 2^521 * h + l. Form h + l + 1 - - subs xzr, xzr, xzr - ldp b0, b1, [sp] - extr t, u9, u8, #9 - adcs b0, b0, t - extr t, u10, u9, #9 - adcs b1, b1, t - ldp b2, b3, [sp, #16] - extr t, u11, u10, #9 - adcs b2, b2, t - extr t, u12, u11, #9 - adcs b3, b3, t - ldp b4, b5, [sp, #32] - extr t, u13, u12, #9 - adcs b4, b4, t - extr t, u14, u13, #9 - adcs b5, b5, t - ldp b6, b7, [sp, #48] - extr t, u15, u14, #9 - adcs b6, b6, t - extr t, u16, u15, #9 - adcs b7, b7, t - orr b8, u8, #~0x1FF - lsr t, u16, #9 - adcs b8, b8, t - -// Now CF is set if h + l + 1 >= 2^521, which means it's already -// the answer, while if ~CF the answer is h + l so we should subtract -// 1 (all considered in 521 bits). Hence subtract ~CF and mask. - - sbcs b0, b0, xzr - sbcs b1, b1, xzr - sbcs b2, b2, xzr - sbcs b3, b3, xzr - sbcs b4, b4, xzr - sbcs b5, b5, xzr - sbcs b6, b6, xzr - sbcs b7, b7, xzr - sbc b8, b8, xzr - and b8, b8, #0x1FF - -// So far, this has been the same as a pure modular multiplication. -// Now finally the Montgomery ingredient, which is just a 521-bit -// rotation by 9*64 - 521 = 55 bits right. - - lsl t, b0, #9 - extr b0, b1, b0, #55 - extr b1, b2, b1, #55 - extr b2, b3, b2, #55 - extr b3, b4, b3, #55 - orr b8, b8, t - extr b4, b5, b4, #55 - extr b5, b6, b5, #55 - extr b6, b7, b6, #55 - extr b7, b8, b7, #55 - lsr b8, b8, #55 - -// Store back digits of final result - - stp b0, b1, [z] - stp b2, b3, [z, #16] - stp b4, b5, [z, #32] - stp b6, b7, [z, #48] - str b8, [z, #64] - -// Restore registers - - CFI_INC_SP(64) - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_p521_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montsqr_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montsqr_p521.S deleted file mode 100644 index 6f6c1c8b253..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montsqr_p521.S +++ /dev/null @@ -1,1130 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^576) mod p_521 -// Input x[9]; output z[9] -// -// extern void bignum_montsqr_p521(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Does z := (x^2 / 2^576) mod p_521, assuming x < p_521. This means the -// Montgomery base is the "native size" 2^{9*64} = 2^576; since p_521 is -// a Mersenne prime the basic modular squaring bignum_sqr_p521 can be -// considered a Montgomery operation to base 2^521. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - -// bignum_montsqr_p521 is functionally equivalent to -// unopt/bignum_montsqr_p521. -// It is written in a way that -// 1. A subset of scalar multiplications in bignum_montmul_p384 are carefully -// chosen and vectorized -// 2. The vectorized assembly is rescheduled using the SLOTHY superoptimizer. -// https://github.com/slothy-optimizer/slothy -// -// The output program of step 1. is as follows: -// -// stp x19, x20, [sp, #-16]! -// stp x21, x22, [sp, #-16]! -// stp x23, x24, [sp, #-16]! -// ldp x16, x8, [x1] -// ldr q18, [x1] -// ldr q5, [x1] -// ldr q20, [x1] -// ldp x17, x13, [x1, #16] -// ldr q17, [x1, #16] -// ldr q1, [x1, #16] -// ldr q28, [x1, #16] -// ldp x9, x15, [x1, #32] -// ldr q27, [x1] -// ldr q29, [x1, #32] -// ldp x23, x2, [x1, #48] -// ldr q6, [x1, #48] -// ldr q4, [x1, #48] -// mul x24, x9, x23 -// mul x11, x15, x2 -// umulh x20, x9, x23 -// subs x4, x9, x15 -// cneg x22, x4, cc -// csetm x12, cc -// subs x4, x2, x23 -// cneg x4, x4, cc -// mul x19, x22, x4 -// umulh x4, x22, x4 -// cinv x7, x12, cc -// eor x14, x19, x7 -// eor x22, x4, x7 -// adds x12, x24, x20 -// adc x19, x20, xzr -// umulh x4, x15, x2 -// adds x12, x12, x11 -// adcs x19, x19, x4 -// adc x4, x4, xzr -// adds x19, x19, x11 -// adc x4, x4, xzr -// cmn x7, #0x1 -// adcs x12, x12, x14 -// adcs x19, x19, x22 -// adc x4, x4, x7 -// adds x11, x24, x24 -// adcs x20, x12, x12 -// adcs x10, x19, x19 -// adcs x3, x4, x4 -// adc x5, xzr, xzr -// ldr q30, [x1, #32] -// umull v0.2D, v30.2S, v30.2S -// umull2 v2.2D, v30.4S, v30.4S -// xtn v24.2S, v30.2D -// uzp2 v30.4S, v30.4S, v30.4S -// umull v30.2D, v30.2S, v24.2S -// mov x7, v0.d[0] -// mov x14, v0.d[1] -// mov x19, v2.d[0] -// mov x22, v2.d[1] -// mov x4, v30.d[0] -// mov x12, v30.d[1] -// adds x21, x7, x4, lsl #33 -// lsr x4, x4, #31 -// adc x14, x14, x4 -// adds x19, x19, x12, lsl #33 -// lsr x4, x12, #31 -// adc x22, x22, x4 -// mul x4, x9, x15 -// umulh x12, x9, x15 -// adds x24, x14, x4, lsl #1 -// extr x4, x12, x4, #63 -// adcs x19, x19, x4 -// lsr x4, x12, #63 -// adc x4, x22, x4 -// adds x11, x11, x19 -// adcs x20, x20, x4 -// adcs x10, x10, xzr -// adcs x3, x3, xzr -// adc x6, x5, xzr -// movi v3.2D, #0x00000000ffffffff -// uzp2 v16.4S, v4.4S, v4.4S -// xtn v25.2S, v6.2D -// xtn v23.2S, v4.2D -// rev64 v30.4S, v4.4S -// umull v24.2D, v25.2S, v23.2S -// umull v0.2D, v25.2S, v16.2S -// uzp2 v2.4S, v6.4S, v6.4S -// mul v30.4S, v30.4S, v6.4S -// usra v0.2D, v24.2D, #32 -// umull v19.2D, v2.2S, v16.2S -// uaddlp v30.2D, v30.4S -// and v24.16B, v0.16B, v3.16B -// umlal v24.2D, v2.2S, v23.2S -// shl v30.2D, v30.2D, #32 -// usra v19.2D, v0.2D, #32 -// umlal v30.2D, v25.2S, v23.2S -// usra v19.2D, v24.2D, #32 -// mov x5, v30.d[0] -// mov x7, v30.d[1] -// mul x14, x23, x2 -// mov x19, v19.d[0] -// mov x4, v19.d[1] -// umulh x22, x23, x2 -// adds x12, x19, x14 -// adcs x19, x7, x22 -// adc x4, x4, xzr -// adds x12, x12, x14 -// adcs x19, x19, x22 -// adc x4, x4, xzr -// adds x7, x5, x10 -// adcs x3, x12, x3 -// adcs x14, x19, x6 -// adc x10, x4, xzr -// ldr x4, [x1, #64] -// add x6, x4, x4 -// mul x5, x4, x4 -// and x4, x16, #0xfffffffffffff -// mul x22, x6, x4 -// extr x4, x8, x16, #52 -// and x4, x4, #0xfffffffffffff -// mul x19, x6, x4 -// lsr x4, x22, #52 -// add x12, x19, x4 -// lsl x4, x22, #12 -// extr x4, x12, x4, #12 -// adds x21, x21, x4 -// extr x4, x17, x8, #40 -// and x4, x4, #0xfffffffffffff -// mul x19, x6, x4 -// lsr x4, x12, #52 -// add x22, x19, x4 -// lsl x4, x12, #12 -// extr x4, x22, x4, #24 -// adcs x24, x24, x4 -// extr x4, x13, x17, #28 -// and x4, x4, #0xfffffffffffff -// mul x19, x6, x4 -// lsr x4, x22, #52 -// add x12, x19, x4 -// lsl x4, x22, #12 -// extr x4, x12, x4, #36 -// adcs x11, x11, x4 -// extr x4, x9, x13, #16 -// and x4, x4, #0xfffffffffffff -// mul x19, x6, x4 -// lsr x4, x12, #52 -// add x22, x19, x4 -// lsl x4, x12, #12 -// extr x4, x22, x4, #48 -// adcs x20, x20, x4 -// lsr x4, x9, #4 -// and x4, x4, #0xfffffffffffff -// mul x19, x6, x4 -// lsr x4, x22, #52 -// add x12, x19, x4 -// lsl x4, x22, #12 -// extr x22, x12, x4, #60 -// extr x4, x15, x9, #56 -// and x4, x4, #0xfffffffffffff -// mul x19, x6, x4 -// lsr x4, x12, #52 -// add x12, x19, x4 -// lsl x4, x22, #8 -// extr x4, x12, x4, #8 -// adcs x7, x7, x4 -// extr x4, x23, x15, #44 -// and x4, x4, #0xfffffffffffff -// mul x19, x6, x4 -// lsr x4, x12, #52 -// add x22, x19, x4 -// lsl x4, x12, #12 -// extr x4, x22, x4, #20 -// adcs x1, x3, x4 -// extr x4, x2, x23, #32 -// and x4, x4, #0xfffffffffffff -// mul x19, x6, x4 -// lsr x4, x22, #52 -// add x12, x19, x4 -// lsl x4, x22, #12 -// extr x4, x12, x4, #32 -// adcs x14, x14, x4 -// lsr x4, x2, #20 -// mul x19, x6, x4 -// lsr x4, x12, #52 -// add x19, x19, x4 -// lsl x4, x12, #12 -// extr x4, x19, x4, #44 -// adcs x22, x10, x4 -// lsr x4, x19, #44 -// adc x12, x5, x4 -// extr x19, x24, x21, #9 -// extr x4, x11, x24, #9 -// stp x19, x4, [x0] // @slothy:writes=buffer0 -// extr x19, x20, x11, #9 -// extr x4, x7, x20, #9 -// stp x19, x4, [x0, #16] // @slothy:writes=buffer16 -// extr x19, x1, x7, #9 -// extr x4, x14, x1, #9 -// stp x19, x4, [x0, #32] // @slothy:writes=buffer32 -// extr x19, x22, x14, #9 -// extr x4, x12, x22, #9 -// stp x19, x4, [x0, #48] // @slothy:writes=buffer48 -// and x19, x21, #0x1ff -// lsr x4, x12, #9 -// add x4, x19, x4 -// str x4, [x0, #64] -// uzp1 v2.4S, v28.4S, v18.4S -// rev64 v30.4S, v28.4S -// uzp1 v24.4S, v18.4S, v18.4S -// mul v30.4S, v30.4S, v18.4S -// uaddlp v30.2D, v30.4S -// shl v30.2D, v30.2D, #32 -// umlal v30.2D, v24.2S, v2.2S -// mov x11, v30.d[0] -// mov x20, v30.d[1] -// umulh x7, x16, x17 -// subs x4, x16, x8 -// cneg x22, x4, cc -// csetm x12, cc -// subs x4, x13, x17 -// cneg x4, x4, cc -// mul x19, x22, x4 -// umulh x4, x22, x4 -// cinv x1, x12, cc -// eor x14, x19, x1 -// eor x22, x4, x1 -// adds x12, x11, x7 -// adc x19, x7, xzr -// umulh x4, x8, x13 -// adds x12, x12, x20 -// adcs x19, x19, x4 -// adc x4, x4, xzr -// adds x19, x19, x20 -// adc x4, x4, xzr -// cmn x1, #0x1 -// adcs x12, x12, x14 -// adcs x19, x19, x22 -// adc x4, x4, x1 -// adds x21, x11, x11 -// adcs x24, x12, x12 -// adcs x11, x19, x19 -// adcs x20, x4, x4 -// adc x7, xzr, xzr -// movi v3.2D, #0x00000000ffffffff -// uzp2 v16.4S, v20.4S, v20.4S -// xtn v25.2S, v5.2D -// xtn v23.2S, v20.2D -// rev64 v30.4S, v20.4S -// umull v24.2D, v25.2S, v23.2S -// umull v0.2D, v25.2S, v16.2S -// uzp2 v2.4S, v5.4S, v5.4S -// mul v30.4S, v30.4S, v5.4S -// usra v0.2D, v24.2D, #32 -// umull v19.2D, v2.2S, v16.2S -// uaddlp v30.2D, v30.4S -// and v24.16B, v0.16B, v3.16B -// umlal v24.2D, v2.2S, v23.2S -// shl v30.2D, v30.2D, #32 -// usra v19.2D, v0.2D, #32 -// umlal v30.2D, v25.2S, v23.2S -// usra v19.2D, v24.2D, #32 -// mov x10, v30.d[0] -// mov x1, v30.d[1] -// mul x14, x16, x8 -// mov x19, v19.d[0] -// mov x4, v19.d[1] -// umulh x22, x16, x8 -// adds x12, x19, x14 -// adcs x19, x1, x22 -// adc x4, x4, xzr -// adds x3, x12, x14 -// adcs x19, x19, x22 -// adc x4, x4, xzr -// adds x5, x21, x19 -// adcs x21, x24, x4 -// adcs x24, x11, xzr -// adcs x11, x20, xzr -// adc x20, x7, xzr -// movi v3.2D, #0x00000000ffffffff -// uzp2 v16.4S, v1.4S, v1.4S -// xtn v25.2S, v17.2D -// xtn v23.2S, v1.2D -// rev64 v30.4S, v1.4S -// umull v24.2D, v25.2S, v23.2S -// umull v0.2D, v25.2S, v16.2S -// uzp2 v2.4S, v17.4S, v17.4S -// mul v30.4S, v30.4S, v17.4S -// usra v0.2D, v24.2D, #32 -// umull v19.2D, v2.2S, v16.2S -// uaddlp v30.2D, v30.4S -// and v24.16B, v0.16B, v3.16B -// umlal v24.2D, v2.2S, v23.2S -// shl v30.2D, v30.2D, #32 -// usra v19.2D, v0.2D, #32 -// umlal v30.2D, v25.2S, v23.2S -// usra v19.2D, v24.2D, #32 -// mov x7, v30.d[0] -// mov x1, v30.d[1] -// mul x14, x17, x13 -// mov x19, v19.d[0] -// mov x4, v19.d[1] -// umulh x22, x17, x13 -// adds x12, x19, x14 -// adcs x19, x1, x22 -// adc x4, x4, xzr -// adds x12, x12, x14 -// adcs x19, x19, x22 -// adc x4, x4, xzr -// adds x1, x7, x24 -// adcs x14, x12, x11 -// adcs x22, x19, x20 -// adc x12, x4, xzr -// ldp x19, x4, [x0] // @slothy:reads=buffer0 -// adds x19, x19, x10 -// adcs x4, x4, x3 -// stp x19, x4, [x0] // @slothy:writes=buffer0 -// ldp x19, x4, [x0, #16] // @slothy:reads=buffer16 -// adcs x19, x19, x5 -// adcs x4, x4, x21 -// stp x19, x4, [x0, #16] // @slothy:writes=buffer16 -// ldp x19, x4, [x0, #32] // @slothy:reads=buffer32 -// adcs x19, x19, x1 -// adcs x4, x4, x14 -// stp x19, x4, [x0, #32] // @slothy:writes=buffer32 -// ldp x19, x4, [x0, #48] // @slothy:reads=buffer48 -// adcs x19, x19, x22 -// adcs x4, x4, x12 -// stp x19, x4, [x0, #48] // @slothy:writes=buffer48 -// ldr x4, [x0, #64] -// adc x4, x4, xzr -// str x4, [x0, #64] -// movi v3.2D, #0x00000000ffffffff -// uzp2 v2.4S, v29.4S, v29.4S -// xtn v16.2S, v27.2D -// xtn v25.2S, v29.2D -// rev64 v30.4S, v29.4S -// umull v24.2D, v16.2S, v25.2S -// umull v23.2D, v16.2S, v2.2S -// uzp2 v0.4S, v27.4S, v27.4S -// mul v30.4S, v30.4S, v27.4S -// usra v23.2D, v24.2D, #32 -// umull v2.2D, v0.2S, v2.2S -// uaddlp v30.2D, v30.4S -// and v24.16B, v23.16B, v3.16B -// umlal v24.2D, v0.2S, v25.2S -// shl v30.2D, v30.2D, #32 -// usra v2.2D, v23.2D, #32 -// umlal v30.2D, v16.2S, v25.2S -// usra v2.2D, v24.2D, #32 -// mov x6, v30.d[0] -// mov x22, v30.d[1] -// mul x12, x17, x23 -// mul x19, x13, x2 -// mov x4, v2.d[0] -// adds x22, x22, x4 -// mov x4, v2.d[1] -// adcs x12, x12, x4 -// umulh x4, x17, x23 -// adcs x19, x19, x4 -// umulh x4, x13, x2 -// adc x4, x4, xzr -// adds x21, x22, x6 -// adcs x22, x12, x22 -// adcs x12, x19, x12 -// adcs x19, x4, x19 -// adc x4, xzr, x4 -// adds x24, x22, x6 -// adcs x11, x12, x21 -// adcs x20, x19, x22 -// adcs x1, x4, x12 -// adcs x14, xzr, x19 -// adc x7, xzr, x4 -// subs x4, x17, x13 -// cneg x12, x4, cc -// csetm x22, cc -// subs x4, x2, x23 -// cneg x19, x4, cc -// mul x4, x12, x19 -// umulh x12, x12, x19 -// cinv x19, x22, cc -// cmn x19, #0x1 -// eor x4, x4, x19 -// adcs x1, x1, x4 -// eor x4, x12, x19 -// adcs x14, x14, x4 -// adc x7, x7, x19 -// subs x4, x16, x8 -// cneg x12, x4, cc -// csetm x22, cc -// subs x4, x15, x9 -// cneg x19, x4, cc -// mul x4, x12, x19 -// umulh x12, x12, x19 -// cinv x19, x22, cc -// cmn x19, #0x1 -// eor x4, x4, x19 -// adcs x10, x21, x4 -// eor x4, x12, x19 -// adcs x24, x24, x4 -// adcs x11, x11, x19 -// adcs x20, x20, x19 -// adcs x1, x1, x19 -// adcs x14, x14, x19 -// adc x7, x7, x19 -// subs x4, x8, x13 -// cneg x12, x4, cc -// csetm x22, cc -// subs x4, x2, x15 -// cneg x19, x4, cc -// mul x4, x12, x19 -// umulh x12, x12, x19 -// cinv x19, x22, cc -// cmn x19, #0x1 -// eor x4, x4, x19 -// adcs x20, x20, x4 -// eor x4, x12, x19 -// adcs x1, x1, x4 -// adcs x14, x14, x19 -// adc x7, x7, x19 -// subs x4, x16, x17 -// cneg x12, x4, cc -// csetm x22, cc -// subs x4, x23, x9 -// cneg x19, x4, cc -// mul x4, x12, x19 -// umulh x12, x12, x19 -// cinv x19, x22, cc -// cmn x19, #0x1 -// eor x4, x4, x19 -// adcs x24, x24, x4 -// eor x4, x12, x19 -// adcs x11, x11, x4 -// adcs x20, x20, x19 -// adcs x1, x1, x19 -// adcs x14, x14, x19 -// adc x7, x7, x19 -// subs x4, x16, x13 -// cneg x12, x4, cc -// csetm x22, cc -// subs x4, x2, x9 -// cneg x19, x4, cc -// mul x4, x12, x19 -// umulh x12, x12, x19 -// cinv x19, x22, cc -// cmn x19, #0x1 -// eor x4, x4, x19 -// adcs x11, x11, x4 -// eor x4, x12, x19 -// adcs x20, x20, x4 -// adcs x1, x1, x19 -// adcs x14, x14, x19 -// adc x7, x7, x19 -// subs x4, x8, x17 -// cneg x12, x4, cc -// csetm x22, cc -// subs x4, x23, x15 -// cneg x19, x4, cc -// mul x4, x12, x19 -// umulh x12, x12, x19 -// cinv x19, x22, cc -// cmn x19, #0x1 -// eor x4, x4, x19 -// adcs x3, x11, x4 -// eor x4, x12, x19 -// adcs x5, x20, x4 -// adcs x1, x1, x19 -// adcs x14, x14, x19 -// adc x22, x7, x19 -// ldp x12, x19, [x0] // @slothy:reads=buffer0 -// extr x4, x1, x5, #8 -// adds x11, x4, x12 -// extr x4, x14, x1, #8 -// adcs x20, x4, x19 -// ldp x19, x12, [x0, #16] // @slothy:reads=buffer16 -// extr x4, x22, x14, #8 -// adcs x7, x4, x19 -// and x19, x20, x7 -// lsr x4, x22, #8 -// adcs x1, x4, x12 -// and x22, x19, x1 -// ldp x19, x12, [x0, #32] // @slothy:reads=buffer32 -// lsl x4, x6, #1 -// adcs x14, x4, x19 -// and x19, x22, x14 -// extr x4, x10, x6, #63 -// adcs x21, x4, x12 -// and x22, x19, x21 -// ldp x19, x12, [x0, #48] // @slothy:reads=buffer48 -// extr x4, x24, x10, #63 -// adcs x2, x4, x19 -// and x19, x22, x2 -// extr x4, x3, x24, #63 -// adcs x24, x4, x12 -// and x12, x19, x24 -// ldr x19, [x0, #64] -// extr x4, x5, x3, #63 -// and x4, x4, #0x1ff -// adc x4, x19, x4 -// lsr x19, x4, #9 -// orr x4, x4, #0xfffffffffffffe00 -// cmp xzr, xzr -// adcs xzr, x11, x19 -// adcs xzr, x12, xzr -// adcs xzr, x4, xzr -// adcs x11, x11, x19 -// adcs x20, x20, xzr -// adcs x7, x7, xzr -// adcs x1, x1, xzr -// adcs x14, x14, xzr -// adcs x22, x21, xzr -// adcs x12, x2, xzr -// adcs x24, x24, xzr -// adc x4, x4, xzr -// and x19, x4, #0x1ff -// lsl x4, x11, #9 -// extr x11, x20, x11, #55 -// extr x20, x7, x20, #55 -// extr x7, x1, x7, #55 -// extr x1, x14, x1, #55 -// orr x4, x19, x4 -// extr x14, x22, x14, #55 -// extr x22, x12, x22, #55 -// extr x12, x24, x12, #55 -// extr x19, x4, x24, #55 -// lsr x4, x4, #55 -// stp x11, x20, [x0] // @slothy:writes=buffer0 -// stp x7, x1, [x0, #16] // @slothy:writes=buffer16 -// stp x14, x22, [x0, #32] // @slothy:writes=buffer32 -// stp x12, x19, [x0, #48] // @slothy:writes=buffer48 -// str x4, [x0, #64] -// ldp x23, x24, [sp], #16 -// ldp x21, x22, [sp], #16 -// ldp x19, x20, [sp], #16 -// ret -// -// The bash script used for step 2 is as follows: -// -// # Store the assembly instructions except the last 'ret', -// # callee-register store/loads as, say, 'input.S'. -// export OUTPUTS="[hint_buffer0,hint_buffer16,hint_buffer32,hint_buffer48,hint_buffer64]" -// export RESERVED_REGS="[x18,x25,x26,x27,x28,x29,x30,sp,q8,q9,q10,q11,q12,q13,q14,q15,v8,v9,v10,v11,v12,v13,v14,v15]" -// /tools/external/slothy.sh input.S my_out_dir -// # my_out_dir/3.opt.s is the optimized assembly. Its output may differ -// # from this file since the sequence is non-deterministically chosen. -// # Please add 'ret' at the end of the output assembly. - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p521) - .text - .balign 4 - -S2N_BN_SYMBOL(bignum_montsqr_p521): - CFI_START - -// Save registers - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - -// The optimized body - - ldr q31, [x1, #48] - ldp x9, x15, [x1, #32] - ldp x23, x2, [x1, #48] - ldr q0, [x1, #48] - ldr q29, [x1, #32] - rev64 v21.4S, v31.4S - umulh x13, x9, x23 - mul v23.4S, v21.4S, v0.4S - xtn v21.2S, v0.2D - uzp2 v19.4S, v31.4S, v31.4S - xtn v2.2S, v29.2D - xtn v30.2S, v31.2D - uzp2 v3.4S, v29.4S, v29.4S - umull v6.2D, v21.2S, v19.2S - mul x10, x9, x23 - uaddlp v23.2D, v23.4S - umull v22.2D, v21.2S, v30.2S - adds x22, x10, x13 - mul x17, x9, x15 - movi v25.2D, #0x00000000ffffffff - uzp2 v1.4S, v0.4S, v0.4S - adc x8, x13, xzr - subs x19, x9, x15 - umull v28.2D, v3.2S, v2.2S - shl v31.2D, v23.2D, #32 - csetm x5, cc - cneg x3, x19, cc - umull v19.2D, v1.2S, v19.2S - ldr q4, [x1, #16] - subs x24, x2, x23 - mul x6, x15, x2 - usra v6.2D, v22.2D, #32 - ldr q23, [x1] - cneg x13, x24, cc - umulh x24, x15, x2 - umull v5.2D, v29.2S, v29.2S - rev64 v3.4S, v4.4S - cinv x19, x5, cc - adds x16, x22, x6 - mov x14, v28.d[1] - umlal v31.2D, v21.2S, v30.2S - umull2 v17.2D, v29.4S, v29.4S - mov x20, v28.d[0] - mul v29.4S, v3.4S, v23.4S - and v22.16B, v6.16B, v25.16B - mul x5, x3, x13 - mov x4, v5.d[1] - mov x7, v5.d[0] - adcs x11, x8, x24 - ldr q5, [x1] - ldr q0, [x1] - adc x22, x24, xzr - adds x8, x11, x6 - usra v19.2D, v6.2D, #32 - umlal v22.2D, v1.2S, v30.2S - adc x11, x22, xzr - adds x21, x7, x20, lsl #33 - mov x24, v17.d[1] - mov x22, v17.d[0] - lsr x12, x20, #31 - uzp1 v2.4S, v4.4S, v23.4S - uzp1 v20.4S, v23.4S, v23.4S - usra v19.2D, v22.2D, #32 - adc x4, x4, x12 - lsr x6, x14, #31 - adds x20, x22, x14, lsl #33 - ldr q17, [x1, #16] - uzp2 v22.4S, v0.4S, v0.4S - eor x12, x5, x19 - umulh x7, x3, x13 - xtn v23.2S, v0.2D - adc x5, x24, x6 - cmn x19, #0x1 - xtn v25.2S, v5.2D - ldr q27, [x1] - adcs x16, x16, x12 - uaddlp v1.2D, v29.4S - umulh x3, x9, x15 - eor x13, x7, x19 - adcs x24, x8, x13 - adc x11, x11, x19 - adds x12, x10, x10 - adcs x13, x16, x16 - mul x19, x23, x2 - umull v21.2D, v25.2S, v23.2S - adcs x7, x24, x24 - ldp x16, x8, [x1] - umull v3.2D, v25.2S, v22.2S - uzp2 v6.4S, v5.4S, v5.4S - adcs x10, x11, x11 - ldr q29, [x1, #32] - adc x14, xzr, xzr - adds x24, x4, x17, lsl #1 - mov x4, v31.d[1] - shl v30.2D, v1.2D, #32 - lsr x6, x3, #63 - extr x11, x3, x17, #63 - ldr q1, [x1, #16] - mov x22, v19.d[1] - adcs x20, x20, x11 - umulh x3, x23, x2 - movi v4.2D, #0x00000000ffffffff - usra v3.2D, v21.2D, #32 - adc x5, x5, x6 - adds x11, x12, x20 - mov x6, v19.d[0] - umull v19.2D, v6.2S, v22.2S - adcs x20, x13, x5 - rev64 v22.4S, v0.4S - ldr x5, [x1, #64] - ldp x17, x13, [x1, #16] - adcs x7, x7, xzr - umlal v30.2D, v20.2S, v2.2S - adcs x12, x10, xzr - and x1, x16, #0xfffffffffffff - mul v22.4S, v22.4S, v5.4S - adc x14, x14, xzr - adds x6, x6, x19 - xtn v5.2S, v1.2D - adcs x10, x4, x3 - mov x4, v31.d[0] - adc x22, x22, xzr - adds x19, x6, x19 - add x6, x5, x5 - and v21.16B, v3.16B, v4.16B - adcs x10, x10, x3 - extr x3, x8, x16, #52 - mul x1, x6, x1 - usra v19.2D, v3.2D, #32 - adc x22, x22, xzr - adds x7, x4, x7 - umlal v21.2D, v6.2S, v23.2S - and x4, x3, #0xfffffffffffff - adcs x3, x19, x12 - uzp2 v28.4S, v1.4S, v1.4S - extr x19, x17, x8, #40 - mul x12, x6, x4 - adcs x14, x10, x14 - rev64 v4.4S, v1.4S - mul x5, x5, x5 - lsr x4, x9, #4 - adc x10, x22, xzr - lsl x22, x1, #12 - lsr x1, x1, #52 - add x12, x12, x1 - and x1, x19, #0xfffffffffffff - extr x19, x12, x22, #12 - mul x1, x6, x1 - extr x22, x13, x17, #28 - adds x21, x21, x19 - mul v31.4S, v4.4S, v17.4S - and x19, x22, #0xfffffffffffff - lsr x22, x12, #52 - lsl x12, x12, #12 - mul x19, x6, x19 - add x22, x1, x22 - extr x1, x22, x12, #24 - and x4, x4, #0xfffffffffffff - adcs x12, x24, x1 - extr x1, x9, x13, #16 - mul x24, x6, x4 - and x1, x1, #0xfffffffffffff - lsr x4, x22, #52 - add x4, x19, x4 - lsl x22, x22, #12 - mul x1, x6, x1 - extr x22, x4, x22, #36 - adcs x11, x11, x22 - extr x22, x11, x12, #9 - extr x19, x12, x21, #9 - uaddlp v3.2D, v22.4S - lsl x12, x4, #12 - stp x19, x22, [x0] - umulh x19, x16, x17 - uaddlp v31.2D, v31.4S - lsr x22, x4, #52 - extr x4, x15, x9, #56 - usra v19.2D, v21.2D, #32 - add x22, x1, x22 - extr x1, x23, x15, #44 - shl v4.2D, v31.2D, #32 - extr x12, x22, x12, #48 - and x4, x4, #0xfffffffffffff - uzp2 v7.4S, v17.4S, v17.4S - adcs x20, x20, x12 - xtn v17.2S, v17.2D - lsl x12, x22, #12 - lsr x22, x22, #52 - mul x4, x6, x4 - add x22, x24, x22 - and x24, x1, #0xfffffffffffff - extr x1, x2, x23, #32 - extr x12, x22, x12, #60 - lsl x12, x12, #8 - lsr x22, x22, #52 - mul x24, x6, x24 - add x4, x4, x22 - and x22, x1, #0xfffffffffffff - extr x12, x4, x12, #8 - lsl x1, x4, #12 - lsr x4, x4, #52 - adcs x7, x7, x12 - mul x12, x6, x22 - add x24, x24, x4 - extr x1, x24, x1, #20 - extr x22, x20, x11, #9 - extr x20, x7, x20, #9 - lsr x11, x2, #20 - mul x6, x6, x11 - lsr x4, x24, #52 - add x4, x12, x4 - lsl x12, x24, #12 - adcs x3, x3, x1 - extr x24, x4, x12, #32 - lsr x11, x4, #52 - adcs x12, x14, x24 - umull v31.2D, v17.2S, v28.2S - add x24, x6, x11 - lsl x1, x4, #12 - extr x7, x3, x7, #9 - rev64 v6.4S, v29.4S - umull v22.2D, v17.2S, v5.2S - extr x11, x12, x3, #9 - extr x14, x24, x1, #44 - umlal v4.2D, v17.2S, v5.2S - adcs x3, x10, x14 - umulh x10, x8, x13 - lsr x14, x24, #44 - adc x24, x5, x14 - subs x5, x16, x8 - stp x22, x20, [x0, #16] - csetm x1, cc - shl v21.2D, v3.2D, #32 - movi v17.2D, #0x00000000ffffffff - cneg x20, x5, cc - subs x5, x13, x17 - usra v31.2D, v22.2D, #32 - cneg x14, x5, cc - lsr x6, x24, #9 - and x22, x21, #0x1ff - mov x4, v30.d[0] - add x6, x22, x6 - stp x7, x11, [x0, #32] - umulh x22, x20, x14 - mov x5, v30.d[1] - str x6, [x0, #64] - extr x12, x3, x12, #9 - umull v28.2D, v7.2S, v28.2S - mul x11, x20, x14 - mul v6.4S, v6.4S, v27.4S - and v1.16B, v31.16B, v17.16B - cinv x21, x1, cc - adds x6, x4, x19 - uzp2 v22.4S, v27.4S, v27.4S - adc x20, x19, xzr - adds x6, x6, x5 - umlal v1.2D, v7.2S, v5.2S - xtn v20.2S, v29.2D - eor x22, x22, x21 - adcs x7, x20, x10 - usra v28.2D, v31.2D, #32 - eor x20, x11, x21 - usra v28.2D, v1.2D, #32 - xtn v0.2S, v27.2D - adc x10, x10, xzr - adds x1, x7, x5 - umlal v21.2D, v25.2S, v23.2S - uzp2 v29.4S, v29.4S, v29.4S - adc x19, x10, xzr - cmn x21, #0x1 - umull v3.2D, v0.2S, v20.2S - adcs x5, x6, x20 - extr x10, x24, x3, #9 - umull v31.2D, v0.2S, v29.2S - adcs x1, x1, x22 - stp x12, x10, [x0, #48] - mul x24, x16, x8 - mov x3, v28.d[1] - usra v31.2D, v3.2D, #32 - adc x10, x19, x21 - adds x7, x4, x4 - umulh x14, x16, x8 - uaddlp v3.2D, v6.4S - mov x4, v28.d[0] - adcs x12, x5, x5 - mov x5, v19.d[0] - movi v23.2D, #0x00000000ffffffff - adcs x20, x1, x1 - mov x19, v21.d[1] - mov x1, v19.d[1] - adcs x22, x10, x10 - and v17.16B, v31.16B, v23.16B - adc x6, xzr, xzr - umlal v17.2D, v22.2S, v20.2S - adds x10, x5, x24 - mul x11, x17, x13 - mov x5, v21.d[0] - umull v28.2D, v22.2S, v29.2S - adcs x19, x19, x14 - shl v5.2D, v3.2D, #32 - adc x21, x1, xzr - adds x10, x10, x24 - adcs x1, x19, x14 - umulh x14, x17, x13 - adc x19, x21, xzr - adds x7, x7, x1 - adcs x1, x12, x19 - adcs x24, x20, xzr - mov x20, v4.d[1] - usra v28.2D, v31.2D, #32 - mov x21, v4.d[0] - adcs x19, x22, xzr - adc x6, x6, xzr - adds x4, x4, x11 - adcs x20, x20, x14 - adc x22, x3, xzr - adds x12, x4, x11 - umulh x11, x13, x2 - adcs x3, x20, x14 - adc x20, x22, xzr - adds x21, x21, x24 - ldp x22, x24, [x0] - adcs x4, x12, x19 - ldp x19, x14, [x0, #16] - usra v28.2D, v17.2D, #32 - adcs x3, x3, x6 - umlal v5.2D, v0.2S, v20.2S - adc x6, x20, xzr - umulh x20, x17, x23 - adds x12, x22, x5 - ldp x22, x5, [x0, #32] - adcs x10, x24, x10 - adcs x19, x19, x7 - stp x12, x10, [x0] - ldp x12, x7, [x0, #48] - adcs x10, x14, x1 - mul x14, x13, x2 - ldr x24, [x0, #64] - adcs x22, x22, x21 - adcs x5, x5, x4 - mov x21, v28.d[1] - stp x22, x5, [x0, #32] - mul x1, x17, x23 - adcs x3, x12, x3 - mov x4, v28.d[0] - mov x12, v5.d[1] - stp x19, x10, [x0, #16] - adcs x19, x7, x6 - mov x6, v5.d[0] - adc x10, x24, xzr - subs x7, x16, x8 - cneg x5, x7, cc - csetm x24, cc - subs x7, x15, x9 - cneg x22, x7, cc - cinv x7, x24, cc - adds x12, x12, x4 - umulh x4, x5, x22 - adcs x1, x1, x21 - stp x3, x19, [x0, #48] - str x10, [x0, #64] - adcs x20, x14, x20 - adc x21, x11, xzr - subs x14, x17, x13 - cneg x10, x14, cc - csetm x3, cc - subs x19, x2, x23 - cneg x19, x19, cc - cinv x11, x3, cc - adds x14, x12, x6 - mul x24, x5, x22 - adcs x22, x1, x12 - eor x3, x4, x7 - mul x4, x10, x19 - adcs x1, x20, x1 - adcs x12, x21, x20 - adc x5, xzr, x21 - umulh x19, x10, x19 - adds x20, x22, x6 - eor x10, x24, x7 - adcs x21, x1, x14 - eor x24, x4, x11 - adcs x4, x12, x22 - adcs x1, x5, x1 - adcs x12, xzr, x12 - adc x22, xzr, x5 - eor x5, x19, x11 - cmn x11, #0x1 - adcs x19, x1, x24 - adcs x5, x12, x5 - adc x24, x22, x11 - subs x1, x8, x13 - cneg x22, x1, cc - csetm x1, cc - subs x11, x2, x15 - cinv x1, x1, cc - cneg x12, x11, cc - cmn x7, #0x1 - adcs x10, x14, x10 - mul x14, x22, x12 - adcs x20, x20, x3 - eor x11, x14, x1 - adcs x3, x21, x7 - umulh x21, x22, x12 - adcs x22, x4, x7 - adcs x4, x19, x7 - adcs x12, x5, x7 - adc x7, x24, x7 - subs x14, x16, x17 - csetm x5, cc - cneg x19, x14, cc - subs x24, x23, x9 - cneg x14, x24, cc - cinv x5, x5, cc - cmn x1, #0x1 - mul x24, x19, x14 - adcs x22, x22, x11 - eor x11, x21, x1 - eor x24, x24, x5 - umulh x19, x19, x14 - adcs x4, x4, x11 - adcs x14, x12, x1 - adc x1, x7, x1 - subs x17, x8, x17 - cneg x12, x17, cc - csetm x17, cc - subs x16, x16, x13 - cneg x11, x16, cc - csetm x16, cc - subs x23, x23, x15 - cinv x7, x17, cc - cneg x13, x23, cc - mul x15, x12, x13 - subs x23, x2, x9 - cinv x8, x16, cc - cneg x17, x23, cc - eor x16, x19, x5 - mul x23, x11, x17 - cmn x5, #0x1 - adcs x20, x20, x24 - eor x15, x15, x7 - adcs x3, x3, x16 - adcs x2, x22, x5 - umulh x16, x11, x17 - adcs x19, x4, x5 - ldp x4, x22, [x0, #48] - extr x21, x10, x6, #63 - adcs x24, x14, x5 - eor x23, x23, x8 - adc x1, x1, x5 - cmn x8, #0x1 - umulh x9, x12, x13 - eor x14, x16, x8 - adcs x3, x3, x23 - ldp x11, x5, [x0, #16] - ldp x13, x16, [x0] - adcs x23, x2, x14 - adcs x14, x19, x8 - extr x19, x20, x10, #63 - lsl x12, x6, #1 - adcs x17, x24, x8 - adc x1, x1, x8 - cmn x7, #0x1 - adcs x24, x3, x15 - eor x9, x9, x7 - ldp x15, x3, [x0, #32] - adcs x9, x23, x9 - ldr x8, [x0, #64] - extr x20, x24, x20, #63 - adcs x23, x14, x7 - extr x2, x9, x24, #63 - adcs x14, x17, x7 - and x24, x2, #0x1ff - extr x9, x23, x9, #8 - extr x6, x14, x23, #8 - adc x23, x1, x7 - adds x10, x9, x13 - adcs x13, x6, x16 - extr x1, x23, x14, #8 - lsr x23, x23, #8 - adcs x7, x1, x11 - adcs x2, x23, x5 - and x23, x13, x7 - adcs x16, x12, x15 - and x23, x23, x2 - adcs x14, x21, x3 - and x23, x23, x16 - adcs x5, x19, x4 - and x23, x23, x14 - adcs x22, x20, x22 - and x23, x23, x5 - and x1, x23, x22 - adc x9, x8, x24 - lsr x23, x9, #9 - cmp xzr, xzr - orr x17, x9, #0xfffffffffffffe00 - adcs xzr, x10, x23 - adcs xzr, x1, xzr - adcs xzr, x17, xzr - adcs x23, x10, x23 - adcs x9, x13, xzr - lsl x4, x23, #9 - adcs x1, x7, xzr - extr x23, x9, x23, #55 - extr x9, x1, x9, #55 - adcs x10, x2, xzr - extr x1, x10, x1, #55 - stp x23, x9, [x0] - adcs x19, x16, xzr - adcs x9, x14, xzr - extr x23, x19, x10, #55 - adcs x10, x5, xzr - stp x1, x23, [x0, #16] - extr x5, x9, x19, #55 - adcs x1, x22, xzr - extr x23, x10, x9, #55 - adc x9, x17, xzr - stp x5, x23, [x0, #32] - extr x10, x1, x10, #55 - and x23, x9, #0x1ff - orr x23, x23, x4 - extr x9, x23, x1, #55 - lsr x23, x23, #55 - stp x10, x9, [x0, #48] - str x23, [x0, #64] - -// Restore regs and return - - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montsqr_p521_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montsqr_p521_alt.S deleted file mode 100644 index fa2d9c5b75d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_montsqr_p521_alt.S +++ /dev/null @@ -1,389 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^576) mod p_521 -// Input x[9]; output z[9] -// -// extern void bignum_montsqr_p521_alt(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Does z := (x^2 / 2^576) mod p_521, assuming x < p_521. This means the -// Montgomery base is the "native size" 2^{9*64} = 2^576; since p_521 is -// a Mersenne prime the basic modular squaring bignum_sqr_p521 can be -// considered a Montgomery operation to base 2^521. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p521_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_p521_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p521_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 -#define a4 x6 -#define a5 x7 -#define a6 x8 -#define a7 x9 -#define a8 x1 // Overwrites input argument at last load - -#define l x10 - -#define u0 x11 -#define u1 x12 -#define u2 x13 -#define u3 x14 -#define u4 x15 -#define u5 x16 -#define u6 x17 -#define u7 x19 -#define u8 x20 -#define u9 x21 -#define u10 x22 -#define u11 x23 -#define u12 x24 -#define u13 x25 -#define u14 x26 -#define u15 x27 -#define u16 x29 - -S2N_BN_SYMBOL(bignum_montsqr_p521_alt): - CFI_START - -// It's convenient to have more registers to play with - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_PUSH2(x27,x29) - -// Load low 8 elements as [a7;a6;a5;a4;a3;a2;a1;a0], set up an initial -// window [u8;u7;u6;u5;u4;u3;u2;u1] = 10 + 20 + 30 + 40 + 50 + 60 + 70 - - ldp a0, a1, [x] - - mul u1, a0, a1 - umulh u2, a0, a1 - - ldp a2, a3, [x, #16] - - mul l, a0, a2 - umulh u3, a0, a2 - adds u2, u2, l - - ldp a4, a5, [x, #32] - - mul l, a0, a3 - umulh u4, a0, a3 - adcs u3, u3, l - - ldp a6, a7, [x, #48] - - mul l, a0, a4 - umulh u5, a0, a4 - adcs u4, u4, l - - mul l, a0, a5 - umulh u6, a0, a5 - adcs u5, u5, l - - mul l, a0, a6 - umulh u7, a0, a6 - adcs u6, u6, l - - mul l, a0, a7 - umulh u8, a0, a7 - adcs u7, u7, l - - adc u8, u8, xzr - -// Add in the next diagonal = 21 + 31 + 41 + 51 + 61 + 71 + 54 - - mul l, a1, a2 - adds u3, u3, l - mul l, a1, a3 - adcs u4, u4, l - mul l, a1, a4 - adcs u5, u5, l - mul l, a1, a5 - adcs u6, u6, l - mul l, a1, a6 - adcs u7, u7, l - mul l, a1, a7 - adcs u8, u8, l - cset u9, cs - - umulh l, a1, a2 - adds u4, u4, l - umulh l, a1, a3 - adcs u5, u5, l - umulh l, a1, a4 - adcs u6, u6, l - umulh l, a1, a5 - adcs u7, u7, l - umulh l, a1, a6 - adcs u8, u8, l - umulh l, a1, a7 - adc u9, u9, l - mul l, a4, a5 - umulh u10, a4, a5 - adds u9, u9, l - adc u10, u10, xzr - -// And the next one = 32 + 42 + 52 + 62 + 72 + 64 + 65 - - mul l, a2, a3 - adds u5, u5, l - mul l, a2, a4 - adcs u6, u6, l - mul l, a2, a5 - adcs u7, u7, l - mul l, a2, a6 - adcs u8, u8, l - mul l, a2, a7 - adcs u9, u9, l - mul l, a4, a6 - adcs u10, u10, l - cset u11, cs - - umulh l, a2, a3 - adds u6, u6, l - umulh l, a2, a4 - adcs u7, u7, l - umulh l, a2, a5 - adcs u8, u8, l - umulh l, a2, a6 - adcs u9, u9, l - umulh l, a2, a7 - adcs u10, u10, l - umulh l, a4, a6 - adc u11, u11, l - mul l, a5, a6 - umulh u12, a5, a6 - adds u11, u11, l - adc u12, u12, xzr - -// And the final one = 43 + 53 + 63 + 73 + 74 + 75 + 76 - - mul l, a3, a4 - adds u7, u7, l - mul l, a3, a5 - adcs u8, u8, l - mul l, a3, a6 - adcs u9, u9, l - mul l, a3, a7 - adcs u10, u10, l - mul l, a4, a7 - adcs u11, u11, l - mul l, a5, a7 - adcs u12, u12, l - cset u13, cs - - umulh l, a3, a4 - adds u8, u8, l - umulh l, a3, a5 - adcs u9, u9, l - umulh l, a3, a6 - adcs u10, u10, l - umulh l, a3, a7 - adcs u11, u11, l - umulh l, a4, a7 - adcs u12, u12, l - umulh l, a5, a7 - adc u13, u13, l - mul l, a6, a7 - umulh u14, a6, a7 - adds u13, u13, l - adc u14, u14, xzr - -// Double that, with u15 holding the top carry - - adds u1, u1, u1 - adcs u2, u2, u2 - adcs u3, u3, u3 - adcs u4, u4, u4 - adcs u5, u5, u5 - adcs u6, u6, u6 - adcs u7, u7, u7 - adcs u8, u8, u8 - adcs u9, u9, u9 - adcs u10, u10, u10 - adcs u11, u11, u11 - adcs u12, u12, u12 - adcs u13, u13, u13 - adcs u14, u14, u14 - cset u15, cs - -// Add the homogeneous terms 00 + 11 + 22 + 33 + 44 + 55 + 66 + 77 - - umulh l, a0, a0 - mul u0, a0, a0 - adds u1, u1, l - - mul l, a1, a1 - adcs u2, u2, l - umulh l, a1, a1 - adcs u3, u3, l - - mul l, a2, a2 - adcs u4, u4, l - umulh l, a2, a2 - adcs u5, u5, l - - mul l, a3, a3 - adcs u6, u6, l - umulh l, a3, a3 - adcs u7, u7, l - - mul l, a4, a4 - adcs u8, u8, l - umulh l, a4, a4 - adcs u9, u9, l - - mul l, a5, a5 - adcs u10, u10, l - umulh l, a5, a5 - adcs u11, u11, l - - mul l, a6, a6 - adcs u12, u12, l - umulh l, a6, a6 - adcs u13, u13, l - - mul l, a7, a7 - adcs u14, u14, l - umulh l, a7, a7 - adc u15, u15, l - -// Now load in the top digit a8, and also set up its double and square - - ldr a8, [x, #64] - mul u16, a8, a8 - add a8, a8, a8 - -// Add a8 * [a7;...;a0] into the top of the buffer - - mul l, a8, a0 - adds u8, u8, l - mul l, a8, a1 - adcs u9, u9, l - mul l, a8, a2 - adcs u10, u10, l - mul l, a8, a3 - adcs u11, u11, l - mul l, a8, a4 - adcs u12, u12, l - mul l, a8, a5 - adcs u13, u13, l - mul l, a8, a6 - adcs u14, u14, l - mul l, a8, a7 - adcs u15, u15, l - adc u16, u16, xzr - - umulh l, a8, a0 - adds u9, u9, l - umulh l, a8, a1 - adcs u10, u10, l - umulh l, a8, a2 - adcs u11, u11, l - umulh l, a8, a3 - adcs u12, u12, l - umulh l, a8, a4 - adcs u13, u13, l - umulh l, a8, a5 - adcs u14, u14, l - umulh l, a8, a6 - adcs u15, u15, l - umulh l, a8, a7 - adc u16, u16, l - -// Now we have the full product, which we consider as -// 2^521 * h + l. Form h + l + 1 - - subs xzr, xzr, xzr - extr l, u9, u8, #9 - adcs u0, u0, l - extr l, u10, u9, #9 - adcs u1, u1, l - extr l, u11, u10, #9 - adcs u2, u2, l - extr l, u12, u11, #9 - adcs u3, u3, l - extr l, u13, u12, #9 - adcs u4, u4, l - extr l, u14, u13, #9 - adcs u5, u5, l - extr l, u15, u14, #9 - adcs u6, u6, l - extr l, u16, u15, #9 - adcs u7, u7, l - orr u8, u8, #~0x1FF - lsr l, u16, #9 - adcs u8, u8, l - -// Now CF is set if h + l + 1 >= 2^521, which means it's already -// the answer, while if ~CF the answer is h + l so we should subtract -// 1 (all considered in 521 bits). Hence subtract ~CF and mask. - - sbcs u0, u0, xzr - sbcs u1, u1, xzr - sbcs u2, u2, xzr - sbcs u3, u3, xzr - sbcs u4, u4, xzr - sbcs u5, u5, xzr - sbcs u6, u6, xzr - sbcs u7, u7, xzr - sbc u8, u8, xzr - and u8, u8, #0x1FF - -// So far, this has been the same as a pure modular squaring -// Now finally the Montgomery ingredient, which is just a 521-bit -// rotation by 9*64 - 521 = 55 bits right. - - lsl l, u0, #9 - extr u0, u1, u0, #55 - extr u1, u2, u1, #55 - extr u2, u3, u2, #55 - extr u3, u4, u3, #55 - orr u8, u8, l - extr u4, u5, u4, #55 - extr u5, u6, u5, #55 - extr u6, u7, u6, #55 - extr u7, u8, u7, #55 - lsr u8, u8, #55 - -// Store back digits of final result - - stp u0, u1, [z] - stp u2, u3, [z, #16] - stp u4, u5, [z, #32] - stp u6, u7, [z, #48] - str u8, [z, #64] - -// Restore registers and return - - CFI_POP2(x27,x29) - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_p521_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_optneg_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_optneg_p521.S deleted file mode 100644 index 27eccb184f7..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_optneg_p521.S +++ /dev/null @@ -1,92 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo p_521, z := (-x) mod p_521 (if p nonzero) or -// z := x (if p zero), assuming x reduced -// Inputs p, x[9]; output z[9] -// -// extern void bignum_optneg_p521(uint64_t z[static 9], uint64_t p, -// const uint64_t x[static 9]); -// -// Standard ARM ABI: X0 = z, X1 = p, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg_p521) - .text - .balign 4 - -#define z x0 -#define p x1 -#define x x2 -#define q x3 - -#define d0 x4 -#define d1 x5 -#define d2 x6 -#define d3 x7 -#define d4 x8 -#define d5 x9 -#define d6 x10 -#define d7 x11 -#define d8 x12 - -S2N_BN_SYMBOL(bignum_optneg_p521): - CFI_START - -// Load the 9 digits of x and generate q = the OR of them all - - ldp d0, d1, [x] - orr d6, d0, d1 - ldp d2, d3, [x, #16] - orr d7, d2, d3 - orr q, d6, d7 - ldp d4, d5, [x, #32] - orr d8, d4, d5 - orr q, q, d8 - ldp d6, d7, [x, #48] - orr d8, d6, d7 - orr q, q, d8 - ldr d8, [x, #64] - orr q, q, d8 - -// Turn q into a bitmask for "input is nonzero and p is nonzero", so that -// we avoid doing -0 = p_521 and hence maintain strict modular reduction - - cmp q, #0 - csetm q, ne - cmp p, #0 - csel q, xzr, q, eq - -// Since p_521 is all 1s, the subtraction is just an exclusive-or with q -// to give an optional inversion, with a slight fiddle for the top digit. - - eor d0, d0, q - eor d1, d1, q - eor d2, d2, q - eor d3, d3, q - eor d4, d4, q - eor d5, d5, q - eor d6, d6, q - eor d7, d7, q - and q, q, #0x1FF - eor d8, d8, q - -// Write back the result and return - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - stp d6, d7, [z, #48] - str d8, [z, #64] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_tomont_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_tomont_p521.S deleted file mode 100644 index d9d7b281bf0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_tomont_p521.S +++ /dev/null @@ -1,118 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert to Montgomery form z := (2^576 * x) mod p_521 -// Input x[9]; output z[9] -// -// extern void bignum_tomont_p521(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tomont_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tomont_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tomont_p521) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define h x2 -#define t x3 -#define d0 x4 -#define d1 x5 -#define d2 x6 -#define d3 x7 -#define d4 x8 -#define d5 x9 -#define d6 x10 -#define d7 x11 -#define d8 x12 - -S2N_BN_SYMBOL(bignum_tomont_p521): - CFI_START - -// Load top digit first and get its upper bits in h so that we -// separate out x = 2^521 * H + L with h = H. Now x mod p_521 = -// (H + L) mod p_521 = if H + L >= p_521 then H + L - p_521 else H + L. - - ldr d8, [x, #64] - lsr h, d8, #9 - -// Load in the other digits and decide whether H + L >= p_521. This is -// equivalent to H + L + 1 >= 2^521, and since this can only happen if -// digits d7,...,d1 consist entirely of 1 bits, we can condense the -// carry chain by ANDing digits together, perhaps reducing its latency. -// This condenses only three pairs; the payoff beyond that seems limited. -// By stuffing in 1 bits from 521 position upwards, get CF directly - - subs xzr, xzr, xzr - ldp d0, d1, [x] - adcs xzr, d0, h - adcs xzr, d1, xzr - ldp d2, d3, [x, #16] - and t, d2, d3 - adcs xzr, t, xzr - ldp d4, d5, [x, #32] - and t, d4, d5 - adcs xzr, t, xzr - ldp d6, d7, [x, #48] - and t, d6, d7 - adcs xzr, t, xzr - orr t, d8, #~0x1FF - adcs t, t, xzr - -// Now H + L >= p_521 <=> H + L + 1 >= 2^521 <=> CF from this comparison. -// So if CF is set we want (H + L) - p_521 = (H + L + 1) - 2^521 -// while otherwise we want just H + L. So mask H + L + CF to 521 bits. - - adcs d0, d0, h - adcs d1, d1, xzr - adcs d2, d2, xzr - adcs d3, d3, xzr - adcs d4, d4, xzr - adcs d5, d5, xzr - adcs d6, d6, xzr - adcs d7, d7, xzr - adc d8, d8, xzr - -// So far, this is just a modular reduction as in bignum_mod_p521_9, -// except that the final masking of d8 is skipped since that comes out -// in the wash anyway from the next block, which is the Montgomery map, -// multiplying by 2^576 modulo p_521. Because 2^521 == 1 (mod p_521) -// this is just rotation left by 576 - 521 = 55 bits. To rotate in a -// right-to-left fashion, which might blend better with the carry -// chain above, the digit register indices themselves get shuffled up. - - lsl t, d0, #55 - extr d0, d1, d0, #9 - extr d1, d2, d1, #9 - extr d2, d3, d2, #9 - extr d3, d4, d3, #9 - extr d4, d5, d4, #9 - extr d5, d6, d5, #9 - extr d6, d7, d6, #9 - extr d7, d8, d7, #9 - lsr d8, d7, #9 - orr t, t, d8 - and d7, d7, #0x1FF - -// Store the result from the shuffled registers [d7;d6;...;d1;d0;t] - - stp t, d0, [z] - stp d1, d2, [z, #16] - stp d3, d4, [z, #32] - stp d5, d6, [z, #48] - str d7, [z, #64] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_tomont_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_triple_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_triple_p521.S deleted file mode 100644 index 134cfb91942..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/bignum_triple_p521.S +++ /dev/null @@ -1,121 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_521, z := (3 * x) mod p_521, assuming x reduced -// Input x[9]; output z[9] -// -// extern void bignum_triple_p521(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p521) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p521_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p521_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p521_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define h x2 -#define l x3 - -#define d0 x4 -#define d1 x5 -#define d2 x6 -#define d3 x7 -#define d4 x8 -#define d5 x9 -#define d6 x10 -#define d7 x11 -#define d8 x12 - - -S2N_BN_SYMBOL(bignum_triple_p521): - -S2N_BN_SYMBOL(bignum_triple_p521_alt): - CFI_START - -// Pick out top bit to wrap to the zero position in the doubling step - - ldr d8, [x, #64] - lsl l, d8, #55 - -// Rotate left to get x' == 2 * x (mod p_521) and add to x + 1 (carryin) to get -// s = [d8;d7;d6;d5;d4;d3;d2;d1;d0] = x + x' + 1 == 3 * x + 1 (mod p_521) - - subs xzr, xzr, xzr - - ldp d0, d1, [x] - extr l, d0, l, #63 - extr h, d1, d0, #63 - adcs d0, d0, l - - ldp d2, d3, [x, #16] - extr l, d2, d1, #63 - adcs d1, d1, h - extr h, d3, d2, #63 - adcs d2, d2, l - - ldp d4, d5, [x, #32] - extr l, d4, d3, #63 - adcs d3, d3, h - extr h, d5, d4, #63 - adcs d4, d4, l - - ldp d6, d7, [x, #48] - extr l, d6, d5, #63 - adcs d5, d5, h - extr h, d7, d6, #63 - adcs d6, d6, l - - extr l, d8, d7, #63 - adcs d7, d7, h - and l, l, #0x1FF - adcs d8, d8, l - -// We know x, x' < p_521 (they are the same bits except for the positions) -// so x + x' + 1 <= 2 * (p_521 - 1) + 1 < 2 * p_521. -// Note that x + x' >= p_521 <=> s = x + x' + 1 >= 2^521 -// Set CF <=> s = x + x' + 1 >= 2^521 and make it a mask in l as well - - subs l, d8, #512 - csetm l, cs - -// Now if CF is set (and l is all 1s), we want (x + x') - p_521 = s - 2^521 -// while otherwise we want x + x' = s - 1 (from existing CF, which is nice) - - sbcs d0, d0, xzr - and l, l, #512 - sbcs d1, d1, xzr - sbcs d2, d2, xzr - sbcs d3, d3, xzr - sbcs d4, d4, xzr - sbcs d5, d5, xzr - sbcs d6, d6, xzr - sbcs d7, d7, xzr - sbc d8, d8, l - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - stp d6, d7, [z, #48] - str d8, [z, #64] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jadd.S deleted file mode 100644 index b8db4ad9c67..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jadd.S +++ /dev/null @@ -1,1626 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-521 in Jacobian coordinates -// -// extern void p521_jadd(uint64_t p3[static 27], const uint64_t p1[static 27], -// const uint64_t p2[static 27]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// It is assumed that all coordinates of the input points p1 and p2 are -// fully reduced mod p_521, that both z coordinates are nonzero and -// that neither p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents -// the same affine point as". -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p521_jadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p521_jadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p521_jadd) - - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 72 - -// Stable homes for input arguments during main code sequence - -#define input_z x26 -#define input_x x27 -#define input_y x28 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE -#define z_2 input_y, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define z1sq sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define x1a sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define z2sq sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define tmp sp, #(NUMSIZE*6) - -#define y1a sp, #(NUMSIZE*7) - -#define NSPACE NUMSIZE*8 - -// For the three field operations, we use subroutines not inlining. -// Call local code very close to bignum_mul_p521 and bignum_sqr_p521 -// and bignum_sub_p521 - -#define mul_p521(P0,P1,P2) \ - add x0, P0 __LF \ - add x1, P1 __LF \ - add x2, P2 __LF \ - CFI_BL(Lp521_jadd_local_mul_p521) - -#define sqr_p521(P0,P1) \ - add x0, P0 __LF \ - add x1, P1 __LF \ - CFI_BL(Lp521_jadd_local_sqr_p521) - -#define sub_p521(P0,P1,P2) \ - add x0, P0 __LF \ - add x1, P1 __LF \ - add x2, P2 __LF \ - CFI_BL(Lp521_jadd_local_sub_p521) - -S2N_BN_SYMBOL(p521_jadd): - CFI_START - -// Save regs and make room on stack for temporary variables - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_PUSH2(x27,x28) - CFI_PUSH2(x29,x30) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations - - sqr_p521(z1sq,z_1) - sqr_p521(z2sq,z_2) - - mul_p521(y1a,z_2,y_1) - mul_p521(y2a,z_1,y_2) - - mul_p521(x2a,z1sq,x_2) - mul_p521(x1a,z2sq,x_1) - mul_p521(y2a,z1sq,y2a) - mul_p521(y1a,z2sq,y1a) - - sub_p521(xd,x2a,x1a) - sub_p521(yd,y2a,y1a) - - sqr_p521(zz,xd) - sqr_p521(ww,yd) - - mul_p521(zzx1,zz,x1a) - mul_p521(zzx2,zz,x2a) - - sub_p521(resx,ww,zzx1) - sub_p521(t1,zzx2,zzx1) - - mul_p521(xd,xd,z_1) - - sub_p521(resx,resx,zzx2) - - sub_p521(t2,zzx1,resx) - - mul_p521(t1,t1,y1a) - mul_p521(resz,xd,z_2) - mul_p521(t2,yd,t2) - - sub_p521(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "HI" <=> CF /\ ~ZF <=> P1 = 0 /\ ~(P2 = 0) -// and "LO" <=> ~CF <=> ~(P1 = 0) /\ P2 = 0 -// Multiplex the z outputs accordingly and re-store in resz - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - ldp x4, x5, [z_1+32] - ldp x6, x7, [z_1+48] - ldr x8, [z_1+64] - - orr x20, x0, x1 - orr x21, x2, x3 - orr x22, x4, x5 - orr x23, x6, x7 - orr x20, x20, x21 - orr x22, x22, x23 - orr x20, x20, x8 - orr x20, x20, x22 - cmp x20, xzr - cset x20, ne - - ldp x10, x11, [z_2] - ldp x12, x13, [z_2+16] - ldp x14, x15, [z_2+32] - ldp x16, x17, [z_2+48] - ldr x19, [z_2+64] - - orr x21, x10, x11 - orr x22, x12, x13 - orr x23, x14, x15 - orr x24, x16, x17 - orr x21, x21, x22 - orr x23, x23, x24 - orr x21, x21, x19 - orr x21, x21, x23 - - csel x0, x0, x10, ne - csel x1, x1, x11, ne - csel x2, x2, x12, ne - csel x3, x3, x13, ne - csel x4, x4, x14, ne - csel x5, x5, x15, ne - csel x6, x6, x16, ne - csel x7, x7, x17, ne - csel x8, x8, x19, ne - - cmp x21, xzr - cset x21, ne - - cmp x21, x20 - - ldp x10, x11, [resz] - ldp x12, x13, [resz+16] - ldp x14, x15, [resz+32] - ldp x16, x17, [resz+48] - ldr x19, [resz+64] - - csel x0, x0, x10, ne - csel x1, x1, x11, ne - csel x2, x2, x12, ne - csel x3, x3, x13, ne - csel x4, x4, x14, ne - csel x5, x5, x15, ne - csel x6, x6, x16, ne - csel x7, x7, x17, ne - csel x8, x8, x19, ne - - stp x0, x1, [resz] - stp x2, x3, [resz+16] - stp x4, x5, [resz+32] - stp x6, x7, [resz+48] - str x8, [resz+64] - -// Multiplex the x and y outputs too, keeping the results in registers - - ldp x20, x21, [x_1] - ldp x0, x1, [resx] - csel x0, x20, x0, lo - csel x1, x21, x1, lo - ldp x20, x21, [x_2] - csel x0, x20, x0, hi - csel x1, x21, x1, hi - - ldp x20, x21, [x_1+16] - ldp x2, x3, [resx+16] - csel x2, x20, x2, lo - csel x3, x21, x3, lo - ldp x20, x21, [x_2+16] - csel x2, x20, x2, hi - csel x3, x21, x3, hi - - ldp x20, x21, [x_1+32] - ldp x4, x5, [resx+32] - csel x4, x20, x4, lo - csel x5, x21, x5, lo - ldp x20, x21, [x_2+32] - csel x4, x20, x4, hi - csel x5, x21, x5, hi - - ldp x20, x21, [x_1+48] - ldp x6, x7, [resx+48] - csel x6, x20, x6, lo - csel x7, x21, x7, lo - ldp x20, x21, [x_2+48] - csel x6, x20, x6, hi - csel x7, x21, x7, hi - - ldr x20, [x_1+64] - ldr x8, [resx+64] - csel x8, x20, x8, lo - ldr x21, [x_2+64] - csel x8, x21, x8, hi - - - ldp x20, x21, [y_1] - ldp x10, x11, [resy] - csel x10, x20, x10, lo - csel x11, x21, x11, lo - ldp x20, x21, [y_2] - csel x10, x20, x10, hi - csel x11, x21, x11, hi - - ldp x20, x21, [y_1+16] - ldp x12, x13, [resy+16] - csel x12, x20, x12, lo - csel x13, x21, x13, lo - ldp x20, x21, [y_2+16] - csel x12, x20, x12, hi - csel x13, x21, x13, hi - - ldp x20, x21, [y_1+32] - ldp x14, x15, [resy+32] - csel x14, x20, x14, lo - csel x15, x21, x15, lo - ldp x20, x21, [y_2+32] - csel x14, x20, x14, hi - csel x15, x21, x15, hi - - ldp x20, x21, [y_1+48] - ldp x16, x17, [resy+48] - csel x16, x20, x16, lo - csel x17, x21, x17, lo - ldp x20, x21, [y_2+48] - csel x16, x20, x16, hi - csel x17, x21, x17, hi - - ldr x20, [y_1+64] - ldr x19, [resy+64] - csel x19, x20, x19, lo - ldr x21, [y_2+64] - csel x19, x21, x19, hi - -// Finally store back the multiplexed values - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [x_3+32] - stp x6, x7, [x_3+48] - str x8, [x_3+64] - - ldp x0, x1, [resz] - ldp x2, x3, [resz+16] - ldp x4, x5, [resz+32] - ldp x6, x7, [resz+48] - ldr x8, [resz+64] - - stp x10, x11, [y_3] - stp x12, x13, [y_3+16] - stp x14, x15, [y_3+32] - stp x16, x17, [y_3+48] - str x19, [y_3+64] - - stp x0, x1, [z_3] - stp x2, x3, [z_3+16] - stp x4, x5, [z_3+32] - stp x6, x7, [z_3+48] - str x8, [z_3+64] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - - CFI_POP2(x29,x30) - CFI_POP2(x27,x28) - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p521_jadd) - -// Local versions of the three field operations, identical to -// bignum_mul_p521, bignum_sqr_p521 and bignum_sub_p521. - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp521_jadd_local_mul_p521) - -Lp521_jadd_local_mul_p521: - CFI_START - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_DEC_SP(80) - ldr q6, [x2] - ldp x10, x17, [x1, #16] - ldr q4, [x1] - ldr q16, [x2, #32] - ldp x5, x20, [x2, #16] - ldr q2, [x1, #32] - movi v31.2D, #0x00000000ffffffff - uzp2 v17.4S, v6.4S, v6.4S - rev64 v7.4S, v6.4S - ldp x15, x21, [x1] - xtn v25.2S, v6.2D - xtn v22.2S, v4.2D - subs x14, x10, x17 - mul v7.4S, v7.4S, v4.4S - csetm x8, cc - rev64 v3.4S, v16.4S - xtn v1.2S, v16.2D - ldp x13, x16, [x2] - mul x26, x10, x5 - uzp2 v16.4S, v16.4S, v16.4S - uaddlp v26.2D, v7.4S - cneg x4, x14, cc - subs x24, x15, x21 - xtn v5.2S, v2.2D - mul v28.4S, v3.4S, v2.4S - shl v26.2D, v26.2D, #32 - mul x22, x17, x20 - umull v20.2D, v22.2S, v25.2S - uzp2 v6.4S, v4.4S, v4.4S - umull v18.2D, v22.2S, v17.2S - uzp2 v4.4S, v2.4S, v2.4S - cneg x14, x24, cc - csetm x7, cc - umulh x11, x17, x20 - usra v18.2D, v20.2D, #32 - uaddlp v7.2D, v28.4S - subs x19, x16, x13 - umlal v26.2D, v22.2S, v25.2S - cneg x19, x19, cc - shl v28.2D, v7.2D, #32 - umull v7.2D, v5.2S, v1.2S - umull v30.2D, v5.2S, v16.2S - cinv x6, x7, cc - mul x25, x14, x19 - umlal v28.2D, v5.2S, v1.2S - umull v21.2D, v6.2S, v17.2S - umulh x14, x14, x19 - usra v30.2D, v7.2D, #32 - subs x9, x20, x5 - and v29.16B, v18.16B, v31.16B - cinv x23, x8, cc - mov x8, v26.d[1] - cneg x12, x9, cc - usra v21.2D, v18.2D, #32 - umlal v29.2D, v6.2S, v25.2S - mul x24, x4, x12 - umull v18.2D, v4.2S, v16.2S - movi v25.2D, #0x00000000ffffffff - eor x9, x14, x6 - and v7.16B, v30.16B, v25.16B - usra v21.2D, v29.2D, #32 - umulh x7, x10, x5 - usra v18.2D, v30.2D, #32 - umlal v7.2D, v4.2S, v1.2S - mov x19, v21.d[0] - umulh x3, x4, x12 - mov x14, v21.d[1] - usra v18.2D, v7.2D, #32 - adds x4, x8, x19 - mov x8, v26.d[0] - adcs x19, x26, x14 - adcs x14, x22, x7 - adc x12, x11, xzr - adds x11, x4, x8 - adcs x26, x19, x4 - adcs x22, x14, x19 - eor x4, x24, x23 - adcs x14, x12, x14 - eor x7, x25, x6 - adc x25, xzr, x12 - eor x19, x3, x23 - adds x3, x26, x8 - adcs x24, x22, x11 - adcs x12, x14, x26 - adcs x22, x25, x22 - adcs x26, xzr, x14 - adc x14, xzr, x25 - cmn x23, #0x1 - adcs x22, x22, x4 - adcs x19, x26, x19 - adc x25, x14, x23 - subs x14, x21, x17 - cneg x23, x14, cc - csetm x26, cc - subs x4, x20, x16 - cneg x14, x4, cc - cinv x4, x26, cc - cmn x6, #0x1 - adcs x11, x11, x7 - mul x7, x23, x14 - adcs x9, x3, x9 - adcs x26, x24, x6 - umulh x3, x23, x14 - adcs x14, x12, x6 - adcs x22, x22, x6 - adcs x12, x19, x6 - extr x24, x11, x8, #55 - adc x6, x25, x6 - subs x19, x15, x17 - csetm x17, cc - cneg x23, x19, cc - subs x19, x20, x13 - lsl x25, x8, #9 - eor x8, x7, x4 - cneg x20, x19, cc - umulh x7, x23, x20 - cinv x19, x17, cc - subs x17, x15, x10 - csetm x15, cc - stp x25, x24, [sp, #32] - cneg x24, x17, cc - mul x20, x23, x20 - subs x25, x5, x13 - cneg x13, x25, cc - cinv x15, x15, cc - mul x25, x24, x13 - subs x21, x21, x10 - csetm x23, cc - cneg x17, x21, cc - subs x21, x5, x16 - umulh x13, x24, x13 - cinv x10, x23, cc - cneg x23, x21, cc - cmn x4, #0x1 - adcs x14, x14, x8 - eor x21, x3, x4 - adcs x21, x22, x21 - eor x5, x20, x19 - adcs x24, x12, x4 - mul x12, x17, x23 - eor x8, x25, x15 - adc x25, x6, x4 - cmn x15, #0x1 - adcs x6, x9, x8 - ldp x20, x8, [x2, #48] - eor x9, x13, x15 - adcs x4, x26, x9 - umulh x26, x17, x23 - ldp x17, x13, [x1, #48] - adcs x9, x14, x15 - adcs x16, x21, x15 - adcs x14, x24, x15 - eor x21, x7, x19 - mul x23, x17, x20 - adc x24, x25, x15 - cmn x19, #0x1 - adcs x7, x4, x5 - adcs x9, x9, x21 - umulh x3, x13, x8 - adcs x16, x16, x19 - adcs x22, x14, x19 - eor x5, x12, x10 - adc x12, x24, x19 - cmn x10, #0x1 - adcs x19, x7, x5 - eor x14, x26, x10 - mov x7, v28.d[1] - adcs x24, x9, x14 - extr x4, x19, x6, #55 - umulh x15, x17, x20 - mov x14, v18.d[1] - lsr x9, x19, #55 - adcs x5, x16, x10 - mov x16, v18.d[0] - adcs x19, x22, x10 - str x9, [sp, #64] - extr x25, x6, x11, #55 - adc x21, x12, x10 - subs x26, x17, x13 - stp x25, x4, [sp, #48] - stp x19, x21, [sp, #16] - csetm x6, cc - cneg x4, x26, cc - mul x19, x13, x8 - subs x11, x8, x20 - stp x24, x5, [sp] - ldp x21, x10, [x1, #32] - cinv x12, x6, cc - cneg x6, x11, cc - mov x9, v28.d[0] - umulh x25, x4, x6 - adds x22, x7, x16 - ldp x16, x5, [x2, #32] - adcs x14, x23, x14 - adcs x11, x19, x15 - adc x24, x3, xzr - adds x3, x22, x9 - adcs x15, x14, x22 - mul x22, x4, x6 - adcs x6, x11, x14 - adcs x4, x24, x11 - eor x14, x25, x12 - adc x26, xzr, x24 - subs x7, x21, x10 - csetm x23, cc - cneg x19, x7, cc - subs x24, x5, x16 - cneg x11, x24, cc - cinv x7, x23, cc - adds x25, x15, x9 - eor x23, x22, x12 - adcs x22, x6, x3 - mul x24, x19, x11 - adcs x15, x4, x15 - adcs x6, x26, x6 - umulh x19, x19, x11 - adcs x11, xzr, x4 - adc x26, xzr, x26 - cmn x12, #0x1 - adcs x4, x6, x23 - eor x6, x24, x7 - adcs x14, x11, x14 - adc x26, x26, x12 - subs x11, x10, x13 - cneg x12, x11, cc - csetm x11, cc - eor x19, x19, x7 - subs x24, x8, x5 - cinv x11, x11, cc - cneg x24, x24, cc - cmn x7, #0x1 - adcs x3, x3, x6 - mul x23, x12, x24 - adcs x25, x25, x19 - adcs x6, x22, x7 - umulh x19, x12, x24 - adcs x22, x15, x7 - adcs x12, x4, x7 - eor x24, x23, x11 - adcs x4, x14, x7 - adc x26, x26, x7 - eor x19, x19, x11 - subs x14, x21, x17 - cneg x7, x14, cc - csetm x14, cc - subs x23, x20, x16 - cinv x14, x14, cc - cneg x23, x23, cc - cmn x11, #0x1 - adcs x22, x22, x24 - mul x24, x7, x23 - adcs x15, x12, x19 - adcs x4, x4, x11 - adc x19, x26, x11 - umulh x26, x7, x23 - subs x7, x21, x13 - eor x11, x24, x14 - cneg x23, x7, cc - csetm x12, cc - subs x7, x8, x16 - cneg x7, x7, cc - cinv x12, x12, cc - cmn x14, #0x1 - eor x26, x26, x14 - adcs x11, x25, x11 - mul x25, x23, x7 - adcs x26, x6, x26 - adcs x6, x22, x14 - adcs x24, x15, x14 - umulh x23, x23, x7 - adcs x4, x4, x14 - adc x22, x19, x14 - eor x14, x25, x12 - eor x7, x23, x12 - cmn x12, #0x1 - adcs x14, x26, x14 - ldp x19, x25, [x2] - ldp x15, x23, [x2, #16] - adcs x26, x6, x7 - adcs x24, x24, x12 - adcs x7, x4, x12 - adc x4, x22, x12 - subs x19, x19, x16 - ldp x16, x22, [x1] - sbcs x6, x25, x5 - ldp x12, x25, [x1, #16] - sbcs x15, x15, x20 - sbcs x8, x23, x8 - csetm x23, cc - subs x21, x21, x16 - eor x16, x19, x23 - sbcs x19, x10, x22 - eor x22, x6, x23 - eor x8, x8, x23 - sbcs x6, x17, x12 - sbcs x13, x13, x25 - csetm x12, cc - subs x10, x10, x17 - cneg x17, x10, cc - csetm x25, cc - subs x5, x20, x5 - eor x10, x19, x12 - cneg x19, x5, cc - eor x20, x15, x23 - eor x21, x21, x12 - cinv x15, x25, cc - mul x25, x17, x19 - subs x16, x16, x23 - sbcs x5, x22, x23 - eor x6, x6, x12 - sbcs x20, x20, x23 - eor x22, x13, x12 - sbc x8, x8, x23 - subs x21, x21, x12 - umulh x19, x17, x19 - sbcs x10, x10, x12 - sbcs x17, x6, x12 - eor x6, x19, x15 - eor x19, x25, x15 - umulh x25, x17, x20 - sbc x13, x22, x12 - cmn x15, #0x1 - adcs x22, x14, x19 - adcs x19, x26, x6 - ldp x6, x26, [sp] - adcs x14, x24, x15 - umulh x24, x21, x16 - adcs x7, x7, x15 - adc x15, x4, x15 - adds x4, x9, x6 - eor x9, x23, x12 - adcs x12, x3, x26 - stp x4, x12, [sp] - ldp x4, x26, [sp, #16] - umulh x12, x10, x5 - ldp x6, x23, [sp, #32] - adcs x3, x11, x4 - mul x4, x13, x8 - adcs x26, x22, x26 - ldp x22, x11, [sp, #48] - adcs x6, x19, x6 - stp x3, x26, [sp, #16] - mul x26, x10, x5 - adcs x14, x14, x23 - stp x6, x14, [sp, #32] - ldr x6, [sp, #64] - adcs x22, x7, x22 - adcs x14, x15, x11 - mul x11, x17, x20 - adc x19, x6, xzr - stp x22, x14, [sp, #48] - adds x14, x26, x24 - str x19, [sp, #64] - umulh x19, x13, x8 - adcs x7, x11, x12 - adcs x22, x4, x25 - mul x6, x21, x16 - adc x19, x19, xzr - subs x11, x17, x13 - cneg x12, x11, cc - csetm x11, cc - subs x24, x8, x20 - cinv x11, x11, cc - cneg x24, x24, cc - adds x4, x14, x6 - adcs x14, x7, x14 - mul x3, x12, x24 - adcs x7, x22, x7 - adcs x22, x19, x22 - umulh x12, x12, x24 - adc x24, xzr, x19 - adds x19, x14, x6 - eor x3, x3, x11 - adcs x26, x7, x4 - adcs x14, x22, x14 - adcs x25, x24, x7 - adcs x23, xzr, x22 - eor x7, x12, x11 - adc x12, xzr, x24 - subs x22, x21, x10 - cneg x24, x22, cc - csetm x22, cc - subs x15, x5, x16 - cinv x22, x22, cc - cneg x15, x15, cc - cmn x11, #0x1 - adcs x3, x25, x3 - mul x25, x24, x15 - adcs x23, x23, x7 - adc x11, x12, x11 - subs x7, x10, x13 - umulh x15, x24, x15 - cneg x12, x7, cc - csetm x7, cc - eor x24, x25, x22 - eor x25, x15, x22 - cmn x22, #0x1 - adcs x24, x4, x24 - adcs x19, x19, x25 - adcs x15, x26, x22 - adcs x4, x14, x22 - adcs x26, x3, x22 - adcs x25, x23, x22 - adc x23, x11, x22 - subs x14, x21, x17 - cneg x3, x14, cc - csetm x11, cc - subs x14, x8, x5 - cneg x14, x14, cc - cinv x7, x7, cc - subs x13, x21, x13 - cneg x21, x13, cc - csetm x13, cc - mul x22, x12, x14 - subs x8, x8, x16 - cinv x13, x13, cc - umulh x14, x12, x14 - cneg x12, x8, cc - subs x8, x20, x16 - cneg x8, x8, cc - cinv x16, x11, cc - eor x22, x22, x7 - cmn x7, #0x1 - eor x14, x14, x7 - adcs x4, x4, x22 - mul x11, x3, x8 - adcs x22, x26, x14 - adcs x14, x25, x7 - eor x25, x24, x9 - adc x26, x23, x7 - umulh x7, x3, x8 - subs x17, x10, x17 - cneg x24, x17, cc - eor x3, x11, x16 - csetm x11, cc - subs x20, x20, x5 - cneg x5, x20, cc - cinv x11, x11, cc - cmn x16, #0x1 - mul x17, x21, x12 - eor x8, x7, x16 - adcs x10, x19, x3 - and x19, x9, #0x1ff - adcs x20, x15, x8 - umulh x15, x21, x12 - eor x12, x10, x9 - eor x8, x6, x9 - adcs x6, x4, x16 - adcs x4, x22, x16 - adcs x21, x14, x16 - adc x7, x26, x16 - mul x10, x24, x5 - cmn x13, #0x1 - ldp x3, x14, [x1] - eor x17, x17, x13 - umulh x5, x24, x5 - adcs x20, x20, x17 - eor x17, x15, x13 - adcs x16, x6, x17 - eor x22, x10, x11 - adcs x23, x4, x13 - extr x10, x14, x3, #52 - and x26, x3, #0xfffffffffffff - adcs x24, x21, x13 - and x15, x10, #0xfffffffffffff - adc x6, x7, x13 - cmn x11, #0x1 - adcs x17, x20, x22 - eor x4, x5, x11 - ldp x21, x10, [sp] - adcs x7, x16, x4 - eor x16, x17, x9 - eor x13, x7, x9 - ldp x3, x17, [sp, #16] - adcs x7, x23, x11 - eor x23, x7, x9 - ldp x5, x22, [sp, #32] - adcs x7, x24, x11 - adc x24, x6, x11 - ldr x6, [x2, #64] - adds x20, x8, x21 - lsl x11, x20, #9 - eor x4, x7, x9 - orr x7, x11, x19 - eor x8, x24, x9 - adcs x11, x25, x10 - mul x26, x6, x26 - ldp x19, x24, [sp, #48] - adcs x12, x12, x3 - adcs x16, x16, x17 - adcs x9, x13, x5 - ldr x25, [sp, #64] - extr x20, x11, x20, #55 - adcs x13, x23, x22 - adcs x4, x4, x19 - extr x23, x12, x11, #55 - adcs x8, x8, x24 - adc x11, x25, xzr - adds x21, x9, x21 - extr x9, x16, x12, #55 - lsr x12, x16, #55 - adcs x10, x13, x10 - mul x15, x6, x15 - adcs x13, x4, x3 - ldp x16, x4, [x2] - ldr x3, [x1, #64] - adcs x17, x8, x17 - adcs x5, x5, x7 - adcs x20, x22, x20 - adcs x8, x19, x23 - and x22, x16, #0xfffffffffffff - ldp x19, x7, [x1, #16] - adcs x9, x24, x9 - extr x24, x4, x16, #52 - adc x16, x12, x25 - mul x22, x3, x22 - and x25, x24, #0xfffffffffffff - extr x14, x19, x14, #40 - and x12, x14, #0xfffffffffffff - extr x23, x7, x19, #28 - ldp x19, x24, [x2, #16] - mul x14, x3, x25 - and x23, x23, #0xfffffffffffff - add x22, x26, x22 - lsl x11, x11, #48 - lsr x26, x22, #52 - lsl x25, x22, #12 - mul x22, x6, x12 - extr x12, x19, x4, #40 - add x4, x15, x14 - mul x15, x6, x23 - add x4, x4, x26 - extr x23, x24, x19, #28 - ldp x14, x19, [x1, #32] - and x26, x12, #0xfffffffffffff - extr x12, x4, x25, #12 - and x25, x23, #0xfffffffffffff - adds x21, x21, x12 - mul x12, x3, x26 - extr x23, x14, x7, #16 - and x23, x23, #0xfffffffffffff - mul x7, x3, x25 - ldp x25, x26, [x2, #32] - add x12, x22, x12 - extr x22, x19, x14, #56 - mul x23, x6, x23 - lsr x14, x14, #4 - extr x24, x25, x24, #16 - add x7, x15, x7 - and x15, x24, #0xfffffffffffff - and x22, x22, #0xfffffffffffff - lsr x24, x4, #52 - mul x15, x3, x15 - and x14, x14, #0xfffffffffffff - add x12, x12, x24 - lsl x24, x4, #12 - lsr x4, x12, #52 - extr x24, x12, x24, #24 - adcs x10, x10, x24 - lsl x24, x12, #12 - add x12, x7, x4 - mul x22, x6, x22 - add x4, x23, x15 - extr x7, x12, x24, #36 - adcs x13, x13, x7 - lsl x15, x12, #12 - add x7, x4, x11 - lsr x24, x12, #52 - ldp x23, x11, [x2, #48] - add x4, x7, x24 - mul x12, x6, x14 - extr x7, x26, x25, #56 - extr x14, x4, x15, #48 - and x2, x7, #0xfffffffffffff - extr x24, x11, x23, #32 - ldp x15, x7, [x1, #48] - and x1, x24, #0xfffffffffffff - lsr x24, x4, #52 - mul x2, x3, x2 - extr x26, x23, x26, #44 - lsr x23, x25, #4 - and x23, x23, #0xfffffffffffff - and x25, x26, #0xfffffffffffff - extr x26, x7, x15, #32 - extr x19, x15, x19, #44 - mul x23, x3, x23 - and x15, x26, #0xfffffffffffff - lsl x26, x4, #12 - and x4, x19, #0xfffffffffffff - lsr x11, x11, #20 - mul x19, x6, x4 - adcs x17, x17, x14 - add x14, x22, x2 - add x22, x12, x23 - lsr x7, x7, #20 - add x22, x22, x24 - extr x2, x22, x26, #60 - mul x24, x3, x25 - lsr x22, x22, #52 - add x14, x14, x22 - lsl x22, x2, #8 - extr x22, x14, x22, #8 - lsl x2, x14, #12 - mul x1, x3, x1 - adcs x12, x5, x22 - mul x5, x6, x15 - and x26, x10, x13 - and x4, x26, x17 - add x23, x19, x24 - lsr x14, x14, #52 - mul x22, x3, x11 - add x11, x23, x14 - extr x25, x11, x2, #20 - lsl x19, x11, #12 - adcs x25, x20, x25 - and x14, x4, x12 - add x1, x5, x1 - and x14, x14, x25 - mul x15, x6, x7 - add x26, x15, x22 - mul x6, x6, x3 - lsr x22, x11, #52 - add x4, x1, x22 - lsr x1, x4, #52 - extr x3, x4, x19, #32 - lsl x15, x4, #12 - add x7, x26, x1 - adcs x23, x8, x3 - extr x20, x7, x15, #44 - and x3, x14, x23 - lsr x19, x7, #44 - adcs x7, x9, x20 - add x11, x6, x19 - adc x4, x16, x11 - lsr x14, x4, #9 - cmp xzr, xzr - and x15, x3, x7 - orr x3, x4, #0xfffffffffffffe00 - adcs xzr, x21, x14 - adcs xzr, x15, xzr - adcs xzr, x3, xzr - adcs x11, x21, x14 - and x14, x11, #0x1ff - adcs x1, x10, xzr - extr x10, x1, x11, #9 - str x14, [x0, #64] - adcs x14, x13, xzr - extr x11, x14, x1, #9 - adcs x1, x17, xzr - extr x4, x1, x14, #9 - stp x10, x11, [x0] - adcs x11, x12, xzr - extr x14, x11, x1, #9 - adcs x10, x25, xzr - extr x11, x10, x11, #9 - stp x4, x14, [x0, #16] - adcs x14, x23, xzr - extr x10, x14, x10, #9 - adcs x1, x7, xzr - stp x11, x10, [x0, #32] - extr x14, x1, x14, #9 - adc x10, x3, xzr - extr x26, x10, x1, #9 - stp x14, x26, [x0, #48] - CFI_INC_SP(80) - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp521_jadd_local_mul_p521) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp521_jadd_local_sqr_p521) - -Lp521_jadd_local_sqr_p521: - CFI_START - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - ldr q23, [x1, #32] - ldp x9, x2, [x1, #32] - ldr q16, [x1, #32] - ldr q20, [x1, #48] - ldp x6, x13, [x1, #48] - rev64 v2.4S, v23.4S - mul x14, x9, x2 - ldr q31, [x1, #48] - subs x22, x9, x2 - uzp2 v26.4S, v23.4S, v23.4S - mul v30.4S, v2.4S, v16.4S - xtn v0.2S, v20.2D - csetm x12, cc - xtn v21.2S, v16.2D - xtn v23.2S, v23.2D - umulh x10, x9, x6 - rev64 v27.4S, v31.4S - umull v2.2D, v21.2S, v26.2S - cneg x23, x22, cc - uaddlp v25.2D, v30.4S - umull v18.2D, v21.2S, v23.2S - mul x22, x9, x6 - mul v6.4S, v27.4S, v20.4S - uzp2 v17.4S, v20.4S, v20.4S - shl v20.2D, v25.2D, #32 - uzp2 v27.4S, v31.4S, v31.4S - mul x16, x2, x13 - umlal v20.2D, v21.2S, v23.2S - usra v2.2D, v18.2D, #32 - adds x8, x22, x10 - umull v25.2D, v17.2S, v27.2S - xtn v31.2S, v31.2D - movi v1.2D, #0xffffffff - adc x3, x10, xzr - umulh x21, x2, x13 - uzp2 v21.4S, v16.4S, v16.4S - umull v18.2D, v0.2S, v27.2S - subs x19, x13, x6 - and v7.16B, v2.16B, v1.16B - umull v27.2D, v0.2S, v31.2S - cneg x20, x19, cc - movi v30.2D, #0xffffffff - umull v16.2D, v21.2S, v26.2S - umlal v7.2D, v21.2S, v23.2S - mul x19, x23, x20 - cinv x7, x12, cc - uaddlp v6.2D, v6.4S - eor x12, x19, x7 - adds x11, x8, x16 - umulh x10, x23, x20 - ldr q1, [x1] - usra v16.2D, v2.2D, #32 - adcs x19, x3, x21 - shl v2.2D, v6.2D, #32 - adc x20, x21, xzr - adds x17, x19, x16 - usra v18.2D, v27.2D, #32 - adc x19, x20, xzr - cmn x7, #0x1 - umlal v2.2D, v0.2S, v31.2S - umulh x16, x9, x2 - adcs x8, x11, x12 - usra v16.2D, v7.2D, #32 - ldr x12, [x1, #64] - eor x20, x10, x7 - umulh x10, x6, x13 - mov x23, v2.d[0] - mov x3, v2.d[1] - adcs x21, x17, x20 - usra v25.2D, v18.2D, #32 - and v23.16B, v18.16B, v30.16B - adc x7, x19, x7 - adds x22, x22, x22 - ldr q7, [x1, #16] - adcs x17, x8, x8 - umlal v23.2D, v17.2S, v31.2S - mov x19, v16.d[0] - mul x11, x12, x12 - ldr q4, [x1] - usra v25.2D, v23.2D, #32 - add x5, x12, x12 - adcs x15, x21, x21 - ldr q28, [x1] - mov x12, v20.d[1] - adcs x24, x7, x7 - mov x21, v16.d[1] - adc x4, xzr, xzr - adds x19, x19, x14 - ldr q18, [x1, #16] - xtn v26.2S, v1.2D - adcs x8, x12, x16 - adc x21, x21, xzr - adds x7, x19, x14 - xtn v23.2S, v7.2D - rev64 v21.4S, v28.4S - adcs x12, x8, x16 - ldp x20, x19, [x1] - mov x16, v25.d[1] - xtn v22.2S, v28.2D - adc x14, x21, xzr - adds x8, x22, x12 - uzp2 v24.4S, v28.4S, v28.4S - rev64 v28.4S, v18.4S - mul x12, x6, x13 - mul v16.4S, v21.4S, v1.4S - shrn v31.2S, v7.2D, #32 - adcs x22, x17, x14 - mov x14, v25.d[0] - and x21, x20, #0xfffffffffffff - umull v17.2D, v26.2S, v24.2S - ldr q2, [x1, #32] - adcs x17, x15, xzr - ldr q30, [x1, #48] - umull v7.2D, v26.2S, v22.2S - adcs x15, x24, xzr - ldr q0, [x1, #16] - movi v6.2D, #0xffffffff - adc x4, x4, xzr - adds x14, x14, x12 - uzp1 v27.4S, v18.4S, v4.4S - uzp2 v19.4S, v1.4S, v1.4S - adcs x24, x3, x10 - mul x3, x5, x21 - umull v29.2D, v23.2S, v31.2S - ldr q5, [x1] - adc x21, x16, xzr - adds x16, x14, x12 - extr x12, x19, x20, #52 - umull v18.2D, v19.2S, v24.2S - adcs x24, x24, x10 - and x10, x12, #0xfffffffffffff - ldp x14, x12, [x1, #16] - usra v17.2D, v7.2D, #32 - adc x21, x21, xzr - adds x23, x23, x17 - mul x17, x5, x10 - shl v21.2D, v29.2D, #33 - lsl x10, x3, #12 - lsr x1, x3, #52 - rev64 v29.4S, v2.4S - uaddlp v25.2D, v16.4S - add x17, x17, x1 - adcs x16, x16, x15 - extr x3, x14, x19, #40 - mov x15, v20.d[0] - extr x10, x17, x10, #12 - and x3, x3, #0xfffffffffffff - shl v3.2D, v25.2D, #32 - and v6.16B, v17.16B, v6.16B - mul x1, x5, x3 - usra v18.2D, v17.2D, #32 - adcs x3, x24, x4 - extr x4, x12, x14, #28 - umlal v6.2D, v19.2S, v22.2S - xtn v20.2S, v2.2D - umlal v3.2D, v26.2S, v22.2S - movi v26.2D, #0xffffffff - lsr x24, x17, #52 - and x4, x4, #0xfffffffffffff - uzp2 v19.4S, v2.4S, v2.4S - add x1, x1, x24 - mul x24, x5, x4 - lsl x4, x17, #12 - xtn v24.2S, v5.2D - extr x17, x1, x4, #24 - adc x21, x21, xzr - umlal v21.2D, v23.2S, v23.2S - adds x4, x15, x10 - lsl x10, x1, #12 - adcs x15, x7, x17 - mul v23.4S, v28.4S, v4.4S - and x7, x4, #0x1ff - lsr x17, x1, #52 - umulh x1, x19, x12 - uzp2 v17.4S, v5.4S, v5.4S - extr x4, x15, x4, #9 - add x24, x24, x17 - mul v29.4S, v29.4S, v5.4S - extr x17, x24, x10, #36 - extr x10, x9, x12, #16 - uzp1 v28.4S, v4.4S, v4.4S - adcs x17, x8, x17 - and x8, x10, #0xfffffffffffff - umull v16.2D, v24.2S, v20.2S - extr x10, x17, x15, #9 - mul x15, x5, x8 - stp x4, x10, [x0] - lsl x4, x24, #12 - lsr x8, x9, #4 - uaddlp v4.2D, v23.4S - and x8, x8, #0xfffffffffffff - umull v23.2D, v24.2S, v19.2S - mul x8, x5, x8 - extr x10, x2, x9, #56 - lsr x24, x24, #52 - and x10, x10, #0xfffffffffffff - add x15, x15, x24 - extr x4, x15, x4, #48 - mul x24, x5, x10 - lsr x10, x15, #52 - usra v23.2D, v16.2D, #32 - add x10, x8, x10 - shl v4.2D, v4.2D, #32 - adcs x22, x22, x4 - extr x4, x6, x2, #44 - lsl x15, x15, #12 - lsr x8, x10, #52 - extr x15, x10, x15, #60 - and x10, x4, #0xfffffffffffff - umlal v4.2D, v28.2S, v27.2S - add x8, x24, x8 - extr x4, x13, x6, #32 - mul x24, x5, x10 - uzp2 v16.4S, v30.4S, v30.4S - lsl x10, x15, #8 - rev64 v28.4S, v30.4S - and x15, x4, #0xfffffffffffff - extr x4, x8, x10, #8 - mul x10, x5, x15 - lsl x15, x8, #12 - adcs x23, x23, x4 - lsr x4, x8, #52 - lsr x8, x13, #20 - add x4, x24, x4 - mul x8, x5, x8 - lsr x24, x4, #52 - extr x15, x4, x15, #20 - lsl x4, x4, #12 - add x10, x10, x24 - adcs x15, x16, x15 - extr x4, x10, x4, #32 - umulh x5, x20, x14 - adcs x3, x3, x4 - usra v18.2D, v6.2D, #32 - lsl x16, x10, #12 - extr x24, x15, x23, #9 - lsr x10, x10, #52 - uzp2 v27.4S, v0.4S, v0.4S - add x8, x8, x10 - extr x10, x3, x15, #9 - extr x4, x22, x17, #9 - and v25.16B, v23.16B, v26.16B - lsr x17, x8, #44 - extr x15, x8, x16, #44 - extr x16, x23, x22, #9 - xtn v7.2S, v30.2D - mov x8, v4.d[0] - stp x24, x10, [x0, #32] - uaddlp v30.2D, v29.4S - stp x4, x16, [x0, #16] - umulh x24, x20, x19 - adcs x15, x21, x15 - adc x16, x11, x17 - subs x11, x20, x19 - xtn v5.2S, v0.2D - csetm x17, cc - extr x3, x15, x3, #9 - mov x22, v4.d[1] - cneg x21, x11, cc - subs x10, x12, x14 - mul v31.4S, v28.4S, v0.4S - cneg x10, x10, cc - cinv x11, x17, cc - shl v4.2D, v30.2D, #32 - umull v28.2D, v5.2S, v16.2S - extr x23, x16, x15, #9 - adds x4, x8, x5 - mul x17, x21, x10 - umull v22.2D, v5.2S, v7.2S - adc x15, x5, xzr - adds x4, x4, x22 - uaddlp v2.2D, v31.4S - lsr x5, x16, #9 - adcs x16, x15, x1 - mov x15, v18.d[0] - adc x1, x1, xzr - umulh x10, x21, x10 - adds x22, x16, x22 - umlal v4.2D, v24.2S, v20.2S - umull v30.2D, v27.2S, v16.2S - stp x3, x23, [x0, #48] - add x3, x7, x5 - adc x16, x1, xzr - usra v28.2D, v22.2D, #32 - mul x23, x20, x19 - eor x1, x17, x11 - cmn x11, #0x1 - mov x17, v18.d[1] - umull v18.2D, v17.2S, v19.2S - adcs x7, x4, x1 - eor x1, x10, x11 - umlal v25.2D, v17.2S, v20.2S - movi v16.2D, #0xffffffff - adcs x22, x22, x1 - usra v18.2D, v23.2D, #32 - umulh x4, x14, x14 - adc x1, x16, x11 - adds x10, x8, x8 - shl v23.2D, v2.2D, #32 - str x3, [x0, #64] - adcs x5, x7, x7 - and v16.16B, v28.16B, v16.16B - usra v30.2D, v28.2D, #32 - adcs x7, x22, x22 - mov x21, v3.d[1] - adcs x11, x1, x1 - umlal v16.2D, v27.2S, v7.2S - adc x22, xzr, xzr - adds x16, x15, x23 - mul x8, x14, x12 - umlal v23.2D, v5.2S, v7.2S - usra v18.2D, v25.2D, #32 - umulh x15, x14, x12 - adcs x21, x21, x24 - usra v30.2D, v16.2D, #32 - adc x1, x17, xzr - adds x3, x16, x23 - adcs x21, x21, x24 - adc x1, x1, xzr - adds x24, x10, x21 - umulh x21, x12, x12 - adcs x16, x5, x1 - adcs x10, x7, xzr - mov x17, v21.d[1] - adcs x23, x11, xzr - adc x5, x22, xzr - adds x1, x4, x8 - adcs x22, x17, x15 - ldp x17, x4, [x0] - mov x11, v21.d[0] - adc x21, x21, xzr - adds x1, x1, x8 - adcs x15, x22, x15 - adc x8, x21, xzr - adds x22, x11, x10 - mov x21, v3.d[0] - adcs x11, x1, x23 - ldp x1, x10, [x0, #16] - adcs x15, x15, x5 - adc x7, x8, xzr - adds x8, x17, x21 - mov x23, v4.d[1] - ldp x5, x21, [x0, #32] - adcs x17, x4, x3 - ldr x4, [x0, #64] - mov x3, v18.d[0] - adcs x24, x1, x24 - stp x8, x17, [x0] - adcs x17, x10, x16 - ldp x1, x16, [x0, #48] - adcs x5, x5, x22 - adcs x8, x21, x11 - stp x5, x8, [x0, #32] - adcs x1, x1, x15 - mov x15, v23.d[1] - adcs x21, x16, x7 - stp x1, x21, [x0, #48] - adc x10, x4, xzr - subs x7, x14, x12 - mov x16, v18.d[1] - cneg x5, x7, cc - csetm x4, cc - subs x11, x13, x6 - mov x8, v23.d[0] - cneg x7, x11, cc - cinv x21, x4, cc - mov x11, v30.d[0] - adds x4, x23, x3 - mul x22, x5, x7 - mov x23, v30.d[1] - adcs x8, x8, x16 - adcs x16, x15, x11 - adc x11, x23, xzr - umulh x3, x5, x7 - stp x24, x17, [x0, #16] - mov x5, v4.d[0] - subs x15, x20, x19 - cneg x7, x15, cc - str x10, [x0, #64] - csetm x1, cc - subs x24, x2, x9 - cneg x17, x24, cc - cinv x15, x1, cc - adds x23, x4, x5 - umulh x1, x7, x17 - adcs x24, x8, x4 - adcs x10, x16, x8 - eor x8, x22, x21 - adcs x16, x11, x16 - mul x22, x7, x17 - eor x17, x1, x15 - adc x1, xzr, x11 - adds x11, x24, x5 - eor x7, x3, x21 - adcs x3, x10, x23 - adcs x24, x16, x24 - adcs x4, x1, x10 - eor x10, x22, x15 - adcs x16, xzr, x16 - adc x1, xzr, x1 - cmn x21, #0x1 - adcs x8, x4, x8 - adcs x22, x16, x7 - adc x7, x1, x21 - subs x21, x19, x12 - csetm x4, cc - cneg x1, x21, cc - subs x21, x13, x2 - cinv x16, x4, cc - cneg x4, x21, cc - cmn x15, #0x1 - adcs x21, x23, x10 - mul x23, x1, x4 - adcs x11, x11, x17 - adcs x3, x3, x15 - umulh x1, x1, x4 - adcs x24, x24, x15 - adcs x8, x8, x15 - adcs x22, x22, x15 - eor x17, x23, x16 - adc x15, x7, x15 - subs x7, x20, x14 - cneg x7, x7, cc - csetm x4, cc - subs x10, x20, x12 - cneg x23, x10, cc - csetm x10, cc - subs x12, x6, x9 - cinv x20, x4, cc - cneg x12, x12, cc - cmn x16, #0x1 - eor x1, x1, x16 - adcs x17, x24, x17 - mul x4, x7, x12 - adcs x8, x8, x1 - umulh x1, x7, x12 - adcs x24, x22, x16 - adc x7, x15, x16 - subs x12, x13, x9 - cneg x12, x12, cc - cinv x13, x10, cc - subs x19, x19, x14 - mul x9, x23, x12 - cneg x19, x19, cc - csetm x10, cc - eor x16, x1, x20 - subs x22, x6, x2 - umulh x12, x23, x12 - eor x1, x4, x20 - cinv x4, x10, cc - cneg x22, x22, cc - cmn x20, #0x1 - adcs x15, x11, x1 - eor x6, x12, x13 - adcs x10, x3, x16 - adcs x17, x17, x20 - eor x23, x9, x13 - adcs x2, x8, x20 - mul x11, x19, x22 - adcs x24, x24, x20 - adc x7, x7, x20 - cmn x13, #0x1 - adcs x3, x10, x23 - umulh x22, x19, x22 - adcs x17, x17, x6 - eor x12, x22, x4 - extr x22, x15, x21, #63 - adcs x8, x2, x13 - extr x21, x21, x5, #63 - ldp x16, x23, [x0] - adcs x20, x24, x13 - eor x1, x11, x4 - adc x6, x7, x13 - cmn x4, #0x1 - ldp x2, x7, [x0, #16] - adcs x1, x3, x1 - extr x19, x1, x15, #63 - adcs x14, x17, x12 - extr x1, x14, x1, #63 - lsl x17, x5, #1 - adcs x8, x8, x4 - extr x12, x8, x14, #8 - ldp x15, x11, [x0, #32] - adcs x9, x20, x4 - adc x3, x6, x4 - adds x16, x12, x16 - extr x6, x9, x8, #8 - ldp x14, x12, [x0, #48] - extr x8, x3, x9, #8 - adcs x20, x6, x23 - ldr x24, [x0, #64] - lsr x6, x3, #8 - adcs x8, x8, x2 - and x2, x1, #0x1ff - and x1, x20, x8 - adcs x4, x6, x7 - adcs x3, x17, x15 - and x1, x1, x4 - adcs x9, x21, x11 - and x1, x1, x3 - adcs x6, x22, x14 - and x1, x1, x9 - and x21, x1, x6 - adcs x14, x19, x12 - adc x1, x24, x2 - cmp xzr, xzr - orr x12, x1, #0xfffffffffffffe00 - lsr x1, x1, #9 - adcs xzr, x16, x1 - and x21, x21, x14 - adcs xzr, x21, xzr - adcs xzr, x12, xzr - adcs x21, x16, x1 - adcs x1, x20, xzr - adcs x19, x8, xzr - stp x21, x1, [x0] - adcs x1, x4, xzr - adcs x21, x3, xzr - stp x19, x1, [x0, #16] - adcs x1, x9, xzr - stp x21, x1, [x0, #32] - adcs x21, x6, xzr - adcs x1, x14, xzr - stp x21, x1, [x0, #48] - adc x1, x12, xzr - and x1, x1, #0x1ff - str x1, [x0, #64] - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp521_jadd_local_sqr_p521) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp521_jadd_local_sub_p521) - -Lp521_jadd_local_sub_p521: - CFI_START - ldp x5, x6, [x1] - ldp x4, x3, [x2] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [x1, #16] - ldp x4, x3, [x2, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - ldp x9, x10, [x1, #32] - ldp x4, x3, [x2, #32] - sbcs x9, x9, x4 - sbcs x10, x10, x3 - ldp x11, x12, [x1, #48] - ldp x4, x3, [x2, #48] - sbcs x11, x11, x4 - sbcs x12, x12, x3 - ldr x13, [x1, #64] - ldr x4, [x2, #64] - sbcs x13, x13, x4 - sbcs x5, x5, xzr - sbcs x6, x6, xzr - sbcs x7, x7, xzr - sbcs x8, x8, xzr - sbcs x9, x9, xzr - sbcs x10, x10, xzr - sbcs x11, x11, xzr - sbcs x12, x12, xzr - sbcs x13, x13, xzr - and x13, x13, #0x1ff - stp x5, x6, [x0] - stp x7, x8, [x0, #16] - stp x9, x10, [x0, #32] - stp x11, x12, [x0, #48] - str x13, [x0, #64] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp521_jadd_local_sub_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jadd_alt.S deleted file mode 100644 index 72ab200549e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jadd_alt.S +++ /dev/null @@ -1,984 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-521 in Jacobian coordinates -// -// extern void p521_jadd_alt(uint64_t p3[static 27], const uint64_t p1[static 27], -// const uint64_t p2[static 27]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// It is assumed that all coordinates of the input points p1 and p2 are -// fully reduced mod p_521, that both z coordinates are nonzero and -// that neither p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents -// the same affine point as". -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p521_jadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p521_jadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p521_jadd_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 72 - -// Stable homes for input arguments during main code sequence - -#define input_z x26 -#define input_x x27 -#define input_y x28 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE -#define z_2 input_y, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z1sq sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define x1a sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define z2sq sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define y1a sp, #(NUMSIZE*6) - -// NUMSIZE*7 is not 16-aligned so we round it up - -#define NSPACE 512 - -// Corresponds exactly to bignum_mul_p521_alt - -#define mul_p521(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - mul x15, x3, x5 __LF \ - umulh x16, x3, x5 __LF \ - mul x14, x3, x6 __LF \ - umulh x17, x3, x6 __LF \ - adds x16, x16, x14 __LF \ - ldp x7, x8, [P2+16] __LF \ - mul x14, x3, x7 __LF \ - umulh x19, x3, x7 __LF \ - adcs x17, x17, x14 __LF \ - mul x14, x3, x8 __LF \ - umulh x20, x3, x8 __LF \ - adcs x19, x19, x14 __LF \ - ldp x9, x10, [P2+32] __LF \ - mul x14, x3, x9 __LF \ - umulh x21, x3, x9 __LF \ - adcs x20, x20, x14 __LF \ - mul x14, x3, x10 __LF \ - umulh x22, x3, x10 __LF \ - adcs x21, x21, x14 __LF \ - ldp x11, x12, [P2+48] __LF \ - mul x14, x3, x11 __LF \ - umulh x23, x3, x11 __LF \ - adcs x22, x22, x14 __LF \ - ldr x13, [P2+64] __LF \ - mul x14, x3, x12 __LF \ - umulh x24, x3, x12 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x3, x13 __LF \ - umulh x1, x3, x13 __LF \ - adcs x24, x24, x14 __LF \ - adc x1, x1, xzr __LF \ - mul x14, x4, x5 __LF \ - adds x16, x16, x14 __LF \ - mul x14, x4, x6 __LF \ - adcs x17, x17, x14 __LF \ - mul x14, x4, x7 __LF \ - adcs x19, x19, x14 __LF \ - mul x14, x4, x8 __LF \ - adcs x20, x20, x14 __LF \ - mul x14, x4, x9 __LF \ - adcs x21, x21, x14 __LF \ - mul x14, x4, x10 __LF \ - adcs x22, x22, x14 __LF \ - mul x14, x4, x11 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x4, x12 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x4, x13 __LF \ - adcs x1, x1, x14 __LF \ - cset x0, hs __LF \ - umulh x14, x4, x5 __LF \ - adds x17, x17, x14 __LF \ - umulh x14, x4, x6 __LF \ - adcs x19, x19, x14 __LF \ - umulh x14, x4, x7 __LF \ - adcs x20, x20, x14 __LF \ - umulh x14, x4, x8 __LF \ - adcs x21, x21, x14 __LF \ - umulh x14, x4, x9 __LF \ - adcs x22, x22, x14 __LF \ - umulh x14, x4, x10 __LF \ - adcs x23, x23, x14 __LF \ - umulh x14, x4, x11 __LF \ - adcs x24, x24, x14 __LF \ - umulh x14, x4, x12 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x4, x13 __LF \ - adc x0, x0, x14 __LF \ - stp x15, x16, [P0] __LF \ - ldp x3, x4, [P1+16] __LF \ - mul x14, x3, x5 __LF \ - adds x17, x17, x14 __LF \ - mul x14, x3, x6 __LF \ - adcs x19, x19, x14 __LF \ - mul x14, x3, x7 __LF \ - adcs x20, x20, x14 __LF \ - mul x14, x3, x8 __LF \ - adcs x21, x21, x14 __LF \ - mul x14, x3, x9 __LF \ - adcs x22, x22, x14 __LF \ - mul x14, x3, x10 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x3, x11 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x3, x12 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x3, x13 __LF \ - adcs x0, x0, x14 __LF \ - cset x15, hs __LF \ - umulh x14, x3, x5 __LF \ - adds x19, x19, x14 __LF \ - umulh x14, x3, x6 __LF \ - adcs x20, x20, x14 __LF \ - umulh x14, x3, x7 __LF \ - adcs x21, x21, x14 __LF \ - umulh x14, x3, x8 __LF \ - adcs x22, x22, x14 __LF \ - umulh x14, x3, x9 __LF \ - adcs x23, x23, x14 __LF \ - umulh x14, x3, x10 __LF \ - adcs x24, x24, x14 __LF \ - umulh x14, x3, x11 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x3, x12 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x3, x13 __LF \ - adc x15, x15, x14 __LF \ - mul x14, x4, x5 __LF \ - adds x19, x19, x14 __LF \ - mul x14, x4, x6 __LF \ - adcs x20, x20, x14 __LF \ - mul x14, x4, x7 __LF \ - adcs x21, x21, x14 __LF \ - mul x14, x4, x8 __LF \ - adcs x22, x22, x14 __LF \ - mul x14, x4, x9 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x4, x10 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x4, x11 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x4, x12 __LF \ - adcs x0, x0, x14 __LF \ - mul x14, x4, x13 __LF \ - adcs x15, x15, x14 __LF \ - cset x16, hs __LF \ - umulh x14, x4, x5 __LF \ - adds x20, x20, x14 __LF \ - umulh x14, x4, x6 __LF \ - adcs x21, x21, x14 __LF \ - umulh x14, x4, x7 __LF \ - adcs x22, x22, x14 __LF \ - umulh x14, x4, x8 __LF \ - adcs x23, x23, x14 __LF \ - umulh x14, x4, x9 __LF \ - adcs x24, x24, x14 __LF \ - umulh x14, x4, x10 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x4, x11 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x4, x12 __LF \ - adcs x15, x15, x14 __LF \ - umulh x14, x4, x13 __LF \ - adc x16, x16, x14 __LF \ - stp x17, x19, [P0+16] __LF \ - ldp x3, x4, [P1+32] __LF \ - mul x14, x3, x5 __LF \ - adds x20, x20, x14 __LF \ - mul x14, x3, x6 __LF \ - adcs x21, x21, x14 __LF \ - mul x14, x3, x7 __LF \ - adcs x22, x22, x14 __LF \ - mul x14, x3, x8 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x3, x9 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x3, x10 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x3, x11 __LF \ - adcs x0, x0, x14 __LF \ - mul x14, x3, x12 __LF \ - adcs x15, x15, x14 __LF \ - mul x14, x3, x13 __LF \ - adcs x16, x16, x14 __LF \ - cset x17, hs __LF \ - umulh x14, x3, x5 __LF \ - adds x21, x21, x14 __LF \ - umulh x14, x3, x6 __LF \ - adcs x22, x22, x14 __LF \ - umulh x14, x3, x7 __LF \ - adcs x23, x23, x14 __LF \ - umulh x14, x3, x8 __LF \ - adcs x24, x24, x14 __LF \ - umulh x14, x3, x9 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x3, x10 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x3, x11 __LF \ - adcs x15, x15, x14 __LF \ - umulh x14, x3, x12 __LF \ - adcs x16, x16, x14 __LF \ - umulh x14, x3, x13 __LF \ - adc x17, x17, x14 __LF \ - mul x14, x4, x5 __LF \ - adds x21, x21, x14 __LF \ - mul x14, x4, x6 __LF \ - adcs x22, x22, x14 __LF \ - mul x14, x4, x7 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x4, x8 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x4, x9 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x4, x10 __LF \ - adcs x0, x0, x14 __LF \ - mul x14, x4, x11 __LF \ - adcs x15, x15, x14 __LF \ - mul x14, x4, x12 __LF \ - adcs x16, x16, x14 __LF \ - mul x14, x4, x13 __LF \ - adcs x17, x17, x14 __LF \ - cset x19, hs __LF \ - umulh x14, x4, x5 __LF \ - adds x22, x22, x14 __LF \ - umulh x14, x4, x6 __LF \ - adcs x23, x23, x14 __LF \ - umulh x14, x4, x7 __LF \ - adcs x24, x24, x14 __LF \ - umulh x14, x4, x8 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x4, x9 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x4, x10 __LF \ - adcs x15, x15, x14 __LF \ - umulh x14, x4, x11 __LF \ - adcs x16, x16, x14 __LF \ - umulh x14, x4, x12 __LF \ - adcs x17, x17, x14 __LF \ - umulh x14, x4, x13 __LF \ - adc x19, x19, x14 __LF \ - stp x20, x21, [P0+32] __LF \ - ldp x3, x4, [P1+48] __LF \ - mul x14, x3, x5 __LF \ - adds x22, x22, x14 __LF \ - mul x14, x3, x6 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x3, x7 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x3, x8 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x3, x9 __LF \ - adcs x0, x0, x14 __LF \ - mul x14, x3, x10 __LF \ - adcs x15, x15, x14 __LF \ - mul x14, x3, x11 __LF \ - adcs x16, x16, x14 __LF \ - mul x14, x3, x12 __LF \ - adcs x17, x17, x14 __LF \ - mul x14, x3, x13 __LF \ - adcs x19, x19, x14 __LF \ - cset x20, hs __LF \ - umulh x14, x3, x5 __LF \ - adds x23, x23, x14 __LF \ - umulh x14, x3, x6 __LF \ - adcs x24, x24, x14 __LF \ - umulh x14, x3, x7 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x3, x8 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x3, x9 __LF \ - adcs x15, x15, x14 __LF \ - umulh x14, x3, x10 __LF \ - adcs x16, x16, x14 __LF \ - umulh x14, x3, x11 __LF \ - adcs x17, x17, x14 __LF \ - umulh x14, x3, x12 __LF \ - adcs x19, x19, x14 __LF \ - umulh x14, x3, x13 __LF \ - adc x20, x20, x14 __LF \ - mul x14, x4, x5 __LF \ - adds x23, x23, x14 __LF \ - mul x14, x4, x6 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x4, x7 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x4, x8 __LF \ - adcs x0, x0, x14 __LF \ - mul x14, x4, x9 __LF \ - adcs x15, x15, x14 __LF \ - mul x14, x4, x10 __LF \ - adcs x16, x16, x14 __LF \ - mul x14, x4, x11 __LF \ - adcs x17, x17, x14 __LF \ - mul x14, x4, x12 __LF \ - adcs x19, x19, x14 __LF \ - mul x14, x4, x13 __LF \ - adcs x20, x20, x14 __LF \ - cset x21, hs __LF \ - umulh x14, x4, x5 __LF \ - adds x24, x24, x14 __LF \ - umulh x14, x4, x6 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x4, x7 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x4, x8 __LF \ - adcs x15, x15, x14 __LF \ - umulh x14, x4, x9 __LF \ - adcs x16, x16, x14 __LF \ - umulh x14, x4, x10 __LF \ - adcs x17, x17, x14 __LF \ - umulh x14, x4, x11 __LF \ - adcs x19, x19, x14 __LF \ - umulh x14, x4, x12 __LF \ - adcs x20, x20, x14 __LF \ - umulh x14, x4, x13 __LF \ - adc x21, x21, x14 __LF \ - stp x22, x23, [P0+48] __LF \ - ldr x3, [P1+64] __LF \ - mul x14, x3, x5 __LF \ - adds x24, x24, x14 __LF \ - mul x14, x3, x6 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x3, x7 __LF \ - adcs x0, x0, x14 __LF \ - mul x14, x3, x8 __LF \ - adcs x15, x15, x14 __LF \ - mul x14, x3, x9 __LF \ - adcs x16, x16, x14 __LF \ - mul x14, x3, x10 __LF \ - adcs x17, x17, x14 __LF \ - mul x14, x3, x11 __LF \ - adcs x19, x19, x14 __LF \ - mul x14, x3, x12 __LF \ - adcs x20, x20, x14 __LF \ - mul x14, x3, x13 __LF \ - adc x21, x21, x14 __LF \ - umulh x14, x3, x5 __LF \ - adds x1, x1, x14 __LF \ - umulh x14, x3, x6 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x3, x7 __LF \ - adcs x15, x15, x14 __LF \ - umulh x14, x3, x8 __LF \ - adcs x16, x16, x14 __LF \ - umulh x14, x3, x9 __LF \ - adcs x17, x17, x14 __LF \ - umulh x14, x3, x10 __LF \ - adcs x19, x19, x14 __LF \ - umulh x14, x3, x11 __LF \ - adcs x20, x20, x14 __LF \ - umulh x14, x3, x12 __LF \ - adc x21, x21, x14 __LF \ - cmp xzr, xzr __LF \ - ldp x5, x6, [P0] __LF \ - extr x14, x1, x24, #9 __LF \ - adcs x5, x5, x14 __LF \ - extr x14, x0, x1, #9 __LF \ - adcs x6, x6, x14 __LF \ - ldp x7, x8, [P0+16] __LF \ - extr x14, x15, x0, #9 __LF \ - adcs x7, x7, x14 __LF \ - extr x14, x16, x15, #9 __LF \ - adcs x8, x8, x14 __LF \ - ldp x9, x10, [P0+32] __LF \ - extr x14, x17, x16, #9 __LF \ - adcs x9, x9, x14 __LF \ - extr x14, x19, x17, #9 __LF \ - adcs x10, x10, x14 __LF \ - ldp x11, x12, [P0+48] __LF \ - extr x14, x20, x19, #9 __LF \ - adcs x11, x11, x14 __LF \ - extr x14, x21, x20, #9 __LF \ - adcs x12, x12, x14 __LF \ - orr x13, x24, #0xfffffffffffffe00 __LF \ - lsr x14, x21, #9 __LF \ - adcs x13, x13, x14 __LF \ - sbcs x5, x5, xzr __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbcs x11, x11, xzr __LF \ - sbcs x12, x12, xzr __LF \ - sbc x13, x13, xzr __LF \ - and x13, x13, #0x1ff __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] __LF \ - stp x9, x10, [P0+32] __LF \ - stp x11, x12, [P0+48] __LF \ - str x13, [P0+64] - -// Corresponds exactly to bignum_sqr_p521_alt - -#define sqr_p521(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x11, x2, x3 __LF \ - umulh x12, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x10, x2, x4 __LF \ - umulh x13, x2, x4 __LF \ - adds x12, x12, x10 __LF \ - ldp x6, x7, [P1+32] __LF \ - mul x10, x2, x5 __LF \ - umulh x14, x2, x5 __LF \ - adcs x13, x13, x10 __LF \ - ldp x8, x9, [P1+48] __LF \ - mul x10, x2, x6 __LF \ - umulh x15, x2, x6 __LF \ - adcs x14, x14, x10 __LF \ - mul x10, x2, x7 __LF \ - umulh x16, x2, x7 __LF \ - adcs x15, x15, x10 __LF \ - mul x10, x2, x8 __LF \ - umulh x17, x2, x8 __LF \ - adcs x16, x16, x10 __LF \ - mul x10, x2, x9 __LF \ - umulh x19, x2, x9 __LF \ - adcs x17, x17, x10 __LF \ - adc x19, x19, xzr __LF \ - mul x10, x3, x4 __LF \ - adds x13, x13, x10 __LF \ - mul x10, x3, x5 __LF \ - adcs x14, x14, x10 __LF \ - mul x10, x3, x6 __LF \ - adcs x15, x15, x10 __LF \ - mul x10, x3, x7 __LF \ - adcs x16, x16, x10 __LF \ - mul x10, x3, x8 __LF \ - adcs x17, x17, x10 __LF \ - mul x10, x3, x9 __LF \ - adcs x19, x19, x10 __LF \ - cset x20, hs __LF \ - umulh x10, x3, x4 __LF \ - adds x14, x14, x10 __LF \ - umulh x10, x3, x5 __LF \ - adcs x15, x15, x10 __LF \ - umulh x10, x3, x6 __LF \ - adcs x16, x16, x10 __LF \ - umulh x10, x3, x7 __LF \ - adcs x17, x17, x10 __LF \ - umulh x10, x3, x8 __LF \ - adcs x19, x19, x10 __LF \ - umulh x10, x3, x9 __LF \ - adc x20, x20, x10 __LF \ - mul x10, x6, x7 __LF \ - umulh x21, x6, x7 __LF \ - adds x20, x20, x10 __LF \ - adc x21, x21, xzr __LF \ - mul x10, x4, x5 __LF \ - adds x15, x15, x10 __LF \ - mul x10, x4, x6 __LF \ - adcs x16, x16, x10 __LF \ - mul x10, x4, x7 __LF \ - adcs x17, x17, x10 __LF \ - mul x10, x4, x8 __LF \ - adcs x19, x19, x10 __LF \ - mul x10, x4, x9 __LF \ - adcs x20, x20, x10 __LF \ - mul x10, x6, x8 __LF \ - adcs x21, x21, x10 __LF \ - cset x22, hs __LF \ - umulh x10, x4, x5 __LF \ - adds x16, x16, x10 __LF \ - umulh x10, x4, x6 __LF \ - adcs x17, x17, x10 __LF \ - umulh x10, x4, x7 __LF \ - adcs x19, x19, x10 __LF \ - umulh x10, x4, x8 __LF \ - adcs x20, x20, x10 __LF \ - umulh x10, x4, x9 __LF \ - adcs x21, x21, x10 __LF \ - umulh x10, x6, x8 __LF \ - adc x22, x22, x10 __LF \ - mul x10, x7, x8 __LF \ - umulh x23, x7, x8 __LF \ - adds x22, x22, x10 __LF \ - adc x23, x23, xzr __LF \ - mul x10, x5, x6 __LF \ - adds x17, x17, x10 __LF \ - mul x10, x5, x7 __LF \ - adcs x19, x19, x10 __LF \ - mul x10, x5, x8 __LF \ - adcs x20, x20, x10 __LF \ - mul x10, x5, x9 __LF \ - adcs x21, x21, x10 __LF \ - mul x10, x6, x9 __LF \ - adcs x22, x22, x10 __LF \ - mul x10, x7, x9 __LF \ - adcs x23, x23, x10 __LF \ - cset x24, hs __LF \ - umulh x10, x5, x6 __LF \ - adds x19, x19, x10 __LF \ - umulh x10, x5, x7 __LF \ - adcs x20, x20, x10 __LF \ - umulh x10, x5, x8 __LF \ - adcs x21, x21, x10 __LF \ - umulh x10, x5, x9 __LF \ - adcs x22, x22, x10 __LF \ - umulh x10, x6, x9 __LF \ - adcs x23, x23, x10 __LF \ - umulh x10, x7, x9 __LF \ - adc x24, x24, x10 __LF \ - mul x10, x8, x9 __LF \ - umulh x25, x8, x9 __LF \ - adds x24, x24, x10 __LF \ - adc x25, x25, xzr __LF \ - adds x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - adcs x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adcs x17, x17, x17 __LF \ - adcs x19, x19, x19 __LF \ - adcs x20, x20, x20 __LF \ - adcs x21, x21, x21 __LF \ - adcs x22, x22, x22 __LF \ - adcs x23, x23, x23 __LF \ - adcs x24, x24, x24 __LF \ - adcs x25, x25, x25 __LF \ - cset x0, hs __LF \ - umulh x10, x2, x2 __LF \ - adds x11, x11, x10 __LF \ - mul x10, x3, x3 __LF \ - adcs x12, x12, x10 __LF \ - umulh x10, x3, x3 __LF \ - adcs x13, x13, x10 __LF \ - mul x10, x4, x4 __LF \ - adcs x14, x14, x10 __LF \ - umulh x10, x4, x4 __LF \ - adcs x15, x15, x10 __LF \ - mul x10, x5, x5 __LF \ - adcs x16, x16, x10 __LF \ - umulh x10, x5, x5 __LF \ - adcs x17, x17, x10 __LF \ - mul x10, x6, x6 __LF \ - adcs x19, x19, x10 __LF \ - umulh x10, x6, x6 __LF \ - adcs x20, x20, x10 __LF \ - mul x10, x7, x7 __LF \ - adcs x21, x21, x10 __LF \ - umulh x10, x7, x7 __LF \ - adcs x22, x22, x10 __LF \ - mul x10, x8, x8 __LF \ - adcs x23, x23, x10 __LF \ - umulh x10, x8, x8 __LF \ - adcs x24, x24, x10 __LF \ - mul x10, x9, x9 __LF \ - adcs x25, x25, x10 __LF \ - umulh x10, x9, x9 __LF \ - adc x0, x0, x10 __LF \ - ldr x1, [P1+64] __LF \ - add x1, x1, x1 __LF \ - mul x10, x1, x2 __LF \ - adds x19, x19, x10 __LF \ - umulh x10, x1, x2 __LF \ - adcs x20, x20, x10 __LF \ - mul x10, x1, x4 __LF \ - adcs x21, x21, x10 __LF \ - umulh x10, x1, x4 __LF \ - adcs x22, x22, x10 __LF \ - mul x10, x1, x6 __LF \ - adcs x23, x23, x10 __LF \ - umulh x10, x1, x6 __LF \ - adcs x24, x24, x10 __LF \ - mul x10, x1, x8 __LF \ - adcs x25, x25, x10 __LF \ - umulh x10, x1, x8 __LF \ - adcs x0, x0, x10 __LF \ - lsr x4, x1, #1 __LF \ - mul x4, x4, x4 __LF \ - adc x4, x4, xzr __LF \ - mul x10, x1, x3 __LF \ - adds x20, x20, x10 __LF \ - umulh x10, x1, x3 __LF \ - adcs x21, x21, x10 __LF \ - mul x10, x1, x5 __LF \ - adcs x22, x22, x10 __LF \ - umulh x10, x1, x5 __LF \ - adcs x23, x23, x10 __LF \ - mul x10, x1, x7 __LF \ - adcs x24, x24, x10 __LF \ - umulh x10, x1, x7 __LF \ - adcs x25, x25, x10 __LF \ - mul x10, x1, x9 __LF \ - adcs x0, x0, x10 __LF \ - umulh x10, x1, x9 __LF \ - adc x4, x4, x10 __LF \ - mul x2, x2, x2 __LF \ - cmp xzr, xzr __LF \ - extr x10, x20, x19, #9 __LF \ - adcs x2, x2, x10 __LF \ - extr x10, x21, x20, #9 __LF \ - adcs x11, x11, x10 __LF \ - extr x10, x22, x21, #9 __LF \ - adcs x12, x12, x10 __LF \ - extr x10, x23, x22, #9 __LF \ - adcs x13, x13, x10 __LF \ - extr x10, x24, x23, #9 __LF \ - adcs x14, x14, x10 __LF \ - extr x10, x25, x24, #9 __LF \ - adcs x15, x15, x10 __LF \ - extr x10, x0, x25, #9 __LF \ - adcs x16, x16, x10 __LF \ - extr x10, x4, x0, #9 __LF \ - adcs x17, x17, x10 __LF \ - orr x19, x19, #0xfffffffffffffe00 __LF \ - lsr x10, x4, #9 __LF \ - adcs x19, x19, x10 __LF \ - sbcs x2, x2, xzr __LF \ - sbcs x11, x11, xzr __LF \ - sbcs x12, x12, xzr __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbcs x15, x15, xzr __LF \ - sbcs x16, x16, xzr __LF \ - sbcs x17, x17, xzr __LF \ - sbc x19, x19, xzr __LF \ - and x19, x19, #0x1ff __LF \ - stp x2, x11, [P0] __LF \ - stp x12, x13, [P0+16] __LF \ - stp x14, x15, [P0+32] __LF \ - stp x16, x17, [P0+48] __LF \ - str x19, [P0+64] - -// Corresponds exactly to bignum_sub_p521 - -#define sub_p521(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - ldp x9, x10, [P1+32] __LF \ - ldp x4, x3, [P2+32] __LF \ - sbcs x9, x9, x4 __LF \ - sbcs x10, x10, x3 __LF \ - ldp x11, x12, [P1+48] __LF \ - ldp x4, x3, [P2+48] __LF \ - sbcs x11, x11, x4 __LF \ - sbcs x12, x12, x3 __LF \ - ldr x13, [P1+64] __LF \ - ldr x4, [P2+64] __LF \ - sbcs x13, x13, x4 __LF \ - sbcs x5, x5, xzr __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbcs x11, x11, xzr __LF \ - sbcs x12, x12, xzr __LF \ - sbcs x13, x13, xzr __LF \ - and x13, x13, #0x1ff __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] __LF \ - stp x9, x10, [P0+32] __LF \ - stp x11, x12, [P0+48] __LF \ - str x13, [P0+64] - -S2N_BN_SYMBOL(p521_jadd_alt): - CFI_START - -// Save regs and make room on stack for temporary variables - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_PUSH2(x27,x28) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations - - sqr_p521(z1sq,z_1) - sqr_p521(z2sq,z_2) - - mul_p521(y1a,z_2,y_1) - mul_p521(y2a,z_1,y_2) - - mul_p521(x2a,z1sq,x_2) - mul_p521(x1a,z2sq,x_1) - mul_p521(y2a,z1sq,y2a) - mul_p521(y1a,z2sq,y1a) - - sub_p521(xd,x2a,x1a) - sub_p521(yd,y2a,y1a) - - sqr_p521(zz,xd) - sqr_p521(ww,yd) - - mul_p521(zzx1,zz,x1a) - mul_p521(zzx2,zz,x2a) - - sub_p521(resx,ww,zzx1) - sub_p521(t1,zzx2,zzx1) - - mul_p521(xd,xd,z_1) - - sub_p521(resx,resx,zzx2) - - sub_p521(t2,zzx1,resx) - - mul_p521(t1,t1,y1a) - mul_p521(resz,xd,z_2) - mul_p521(t2,yd,t2) - - sub_p521(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "HI" <=> CF /\ ~ZF <=> P1 = 0 /\ ~(P2 = 0) -// and "LO" <=> ~CF <=> ~(P1 = 0) /\ P2 = 0 -// Multiplex the z outputs accordingly and re-store in resz - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - ldp x4, x5, [z_1+32] - ldp x6, x7, [z_1+48] - ldr x8, [z_1+64] - - orr x20, x0, x1 - orr x21, x2, x3 - orr x22, x4, x5 - orr x23, x6, x7 - orr x20, x20, x21 - orr x22, x22, x23 - orr x20, x20, x8 - orr x20, x20, x22 - cmp x20, xzr - cset x20, ne - - ldp x10, x11, [z_2] - ldp x12, x13, [z_2+16] - ldp x14, x15, [z_2+32] - ldp x16, x17, [z_2+48] - ldr x19, [z_2+64] - - orr x21, x10, x11 - orr x22, x12, x13 - orr x23, x14, x15 - orr x24, x16, x17 - orr x21, x21, x22 - orr x23, x23, x24 - orr x21, x21, x19 - orr x21, x21, x23 - - csel x0, x0, x10, ne - csel x1, x1, x11, ne - csel x2, x2, x12, ne - csel x3, x3, x13, ne - csel x4, x4, x14, ne - csel x5, x5, x15, ne - csel x6, x6, x16, ne - csel x7, x7, x17, ne - csel x8, x8, x19, ne - - cmp x21, xzr - cset x21, ne - - cmp x21, x20 - - ldp x10, x11, [resz] - ldp x12, x13, [resz+16] - ldp x14, x15, [resz+32] - ldp x16, x17, [resz+48] - ldr x19, [resz+64] - - csel x0, x0, x10, ne - csel x1, x1, x11, ne - csel x2, x2, x12, ne - csel x3, x3, x13, ne - csel x4, x4, x14, ne - csel x5, x5, x15, ne - csel x6, x6, x16, ne - csel x7, x7, x17, ne - csel x8, x8, x19, ne - - stp x0, x1, [resz] - stp x2, x3, [resz+16] - stp x4, x5, [resz+32] - stp x6, x7, [resz+48] - str x8, [resz+64] - -// Multiplex the x and y outputs too, keeping the results in registers - - ldp x20, x21, [x_1] - ldp x0, x1, [resx] - csel x0, x20, x0, lo - csel x1, x21, x1, lo - ldp x20, x21, [x_2] - csel x0, x20, x0, hi - csel x1, x21, x1, hi - - ldp x20, x21, [x_1+16] - ldp x2, x3, [resx+16] - csel x2, x20, x2, lo - csel x3, x21, x3, lo - ldp x20, x21, [x_2+16] - csel x2, x20, x2, hi - csel x3, x21, x3, hi - - ldp x20, x21, [x_1+32] - ldp x4, x5, [resx+32] - csel x4, x20, x4, lo - csel x5, x21, x5, lo - ldp x20, x21, [x_2+32] - csel x4, x20, x4, hi - csel x5, x21, x5, hi - - ldp x20, x21, [x_1+48] - ldp x6, x7, [resx+48] - csel x6, x20, x6, lo - csel x7, x21, x7, lo - ldp x20, x21, [x_2+48] - csel x6, x20, x6, hi - csel x7, x21, x7, hi - - ldr x20, [x_1+64] - ldr x8, [resx+64] - csel x8, x20, x8, lo - ldr x21, [x_2+64] - csel x8, x21, x8, hi - - - ldp x20, x21, [y_1] - ldp x10, x11, [resy] - csel x10, x20, x10, lo - csel x11, x21, x11, lo - ldp x20, x21, [y_2] - csel x10, x20, x10, hi - csel x11, x21, x11, hi - - ldp x20, x21, [y_1+16] - ldp x12, x13, [resy+16] - csel x12, x20, x12, lo - csel x13, x21, x13, lo - ldp x20, x21, [y_2+16] - csel x12, x20, x12, hi - csel x13, x21, x13, hi - - ldp x20, x21, [y_1+32] - ldp x14, x15, [resy+32] - csel x14, x20, x14, lo - csel x15, x21, x15, lo - ldp x20, x21, [y_2+32] - csel x14, x20, x14, hi - csel x15, x21, x15, hi - - ldp x20, x21, [y_1+48] - ldp x16, x17, [resy+48] - csel x16, x20, x16, lo - csel x17, x21, x17, lo - ldp x20, x21, [y_2+48] - csel x16, x20, x16, hi - csel x17, x21, x17, hi - - ldr x20, [y_1+64] - ldr x19, [resy+64] - csel x19, x20, x19, lo - ldr x21, [y_2+64] - csel x19, x21, x19, hi - -// Finally store back the multiplexed values - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [x_3+32] - stp x6, x7, [x_3+48] - str x8, [x_3+64] - - ldp x0, x1, [resz] - ldp x2, x3, [resz+16] - ldp x4, x5, [resz+32] - ldp x6, x7, [resz+48] - ldr x8, [resz+64] - - stp x10, x11, [y_3] - stp x12, x13, [y_3+16] - stp x14, x15, [y_3+32] - stp x16, x17, [y_3+48] - str x19, [y_3+64] - - stp x0, x1, [z_3] - stp x2, x3, [z_3+16] - stp x4, x5, [z_3+32] - stp x6, x7, [z_3+48] - str x8, [z_3+64] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - - CFI_POP2(x27,x28) - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p521_jadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jmixadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jmixadd.S deleted file mode 100644 index e1c98e59cd4..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jmixadd.S +++ /dev/null @@ -1,1363 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on NIST curve P-521 in Jacobian coordinates -// -// extern void p521_jmixadd(uint64_t p3[static 27], const uint64_t p1[static 27], -// const uint64_t p2[static 18]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. It is assumed that -// all the coordinates of the input points p1 and p2 are fully reduced -// mod p_521, that the z coordinate of p1 is nonzero and that neither -// p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents the same affine -// point as". -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p521_jmixadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p521_jmixadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p521_jmixadd) - - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 72 - -// Stable homes for input arguments during main code sequence - -#define input_z x26 -#define input_x x27 -#define input_y x28 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define zp2 sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define tmp sp, #(NUMSIZE*6) - -#define NSPACE 512 - -// For the three field operations, we use subroutines not inlining. -// Call local code very close to bignum_mul_p521 and bignum_sqr_p521 -// and bignum_sub_p521 - -#define mul_p521(P0,P1,P2) \ - add x0, P0 __LF \ - add x1, P1 __LF \ - add x2, P2 __LF \ - CFI_BL(Lp521_jmixadd_local_mul_p521) - -#define sqr_p521(P0,P1) \ - add x0, P0 __LF \ - add x1, P1 __LF \ - CFI_BL(Lp521_jmixadd_local_sqr_p521) - -#define sub_p521(P0,P1,P2) \ - add x0, P0 __LF \ - add x1, P1 __LF \ - add x2, P2 __LF \ - CFI_BL(Lp521_jmixadd_local_sub_p521) - -S2N_BN_SYMBOL(p521_jmixadd): - CFI_START - -// Save regs and make room on stack for temporary variables - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_PUSH2(x27,x28) - CFI_PUSH2(x29,x30) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations - - sqr_p521(zp2,z_1) - mul_p521(y2a,z_1,y_2) - - mul_p521(x2a,zp2,x_2) - mul_p521(y2a,zp2,y2a) - - sub_p521(xd,x2a,x_1) - sub_p521(yd,y2a,y_1) - - sqr_p521(zz,xd) - sqr_p521(ww,yd) - - mul_p521(zzx1,zz,x_1) - mul_p521(zzx2,zz,x2a) - - sub_p521(resx,ww,zzx1) - sub_p521(t1,zzx2,zzx1) - - mul_p521(resz,xd,z_1) - - sub_p521(resx,resx,zzx2) - - sub_p521(t2,zzx1,resx) - - mul_p521(t1,t1,y_1) - mul_p521(t2,yd,t2) - - sub_p521(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - ldp x0, x1, [z_1] - orr x0, x0, x1 - ldp x2, x3, [z_1+16] - orr x2, x2, x3 - ldp x4, x5, [z_1+32] - orr x4, x4, x5 - ldp x6, x7, [z_1+48] - orr x6, x6, x7 - ldr x8, [z_1+64] - orr x0, x0, x2 - orr x4, x4, x6 - orr x0, x0, x4 - orr x0, x0, x8 - cmp x0, xzr - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with an extra z = 1 -// coordinate, hence giving 0 + p2 = p2 for the final result. - - ldp x0, x1, [resx] - ldp x20, x21, [x_2] - csel x0, x0, x20, ne - csel x1, x1, x21, ne - ldp x2, x3, [resx+16] - ldp x20, x21, [x_2+16] - csel x2, x2, x20, ne - csel x3, x3, x21, ne - ldp x4, x5, [resx+32] - ldp x20, x21, [x_2+32] - csel x4, x4, x20, ne - csel x5, x5, x21, ne - ldp x6, x7, [resx+48] - ldp x20, x21, [x_2+48] - csel x6, x6, x20, ne - csel x7, x7, x21, ne - ldr x8, [resx+64] - ldr x20, [x_2+64] - csel x8, x8, x20, ne - - ldp x10, x11, [resy] - ldp x20, x21, [y_2] - csel x10, x10, x20, ne - csel x11, x11, x21, ne - ldp x12, x13, [resy+16] - ldp x20, x21, [y_2+16] - csel x12, x12, x20, ne - csel x13, x13, x21, ne - ldp x14, x15, [resy+32] - ldp x20, x21, [y_2+32] - csel x14, x14, x20, ne - csel x15, x15, x21, ne - ldp x16, x17, [resy+48] - ldp x20, x21, [y_2+48] - csel x16, x16, x20, ne - csel x17, x17, x21, ne - ldr x19, [resy+64] - ldr x20, [y_2+64] - csel x19, x19, x20, ne - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [x_3+32] - stp x6, x7, [x_3+48] - str x8, [x_3+64] - stp x10, x11, [y_3] - stp x12, x13, [y_3+16] - stp x14, x15, [y_3+32] - stp x16, x17, [y_3+48] - str x19, [y_3+64] - - ldp x0, x1, [resz] - mov x20, #1 - csel x0, x0, x20, ne - csel x1, x1, xzr, ne - ldp x2, x3, [resz+16] - csel x2, x2, xzr, ne - csel x3, x3, xzr, ne - ldp x4, x5, [resz+32] - csel x4, x4, xzr, ne - csel x5, x5, xzr, ne - ldp x6, x7, [resz+48] - csel x6, x6, xzr, ne - csel x7, x7, xzr, ne - ldr x8, [resz+64] - csel x8, x8, xzr, ne - - stp x0, x1, [z_3] - stp x2, x3, [z_3+16] - stp x4, x5, [z_3+32] - stp x6, x7, [z_3+48] - str x8, [z_3+64] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - - CFI_POP2(x29,x30) - CFI_POP2(x27,x28) - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p521_jmixadd) - -// Local versions of the three field operations, almost identical to -// bignum_mul_p521, bignum_sqr_p521 and bignum_sub_p521 except for -// avoiding all intial register save-restore, and in the case of -// local_mul_p521, using the tmp buffer as temporary storage and -// avoiding x26. - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp521_jmixadd_local_mul_p521) - -Lp521_jmixadd_local_mul_p521: - CFI_START - ldp x3, x4, [x1] - ldp x5, x6, [x1, #16] - ldp x7, x8, [x2] - ldp x9, x10, [x2, #16] - mul x11, x3, x7 - mul x15, x4, x8 - mul x16, x5, x9 - mul x17, x6, x10 - umulh x19, x3, x7 - adds x15, x15, x19 - umulh x19, x4, x8 - adcs x16, x16, x19 - umulh x19, x5, x9 - adcs x17, x17, x19 - umulh x19, x6, x10 - adc x19, x19, xzr - adds x12, x15, x11 - adcs x15, x16, x15 - adcs x16, x17, x16 - adcs x17, x19, x17 - adc x19, xzr, x19 - adds x13, x15, x11 - adcs x14, x16, x12 - adcs x15, x17, x15 - adcs x16, x19, x16 - adcs x17, xzr, x17 - adc x19, xzr, x19 - subs x24, x5, x6 - cneg x24, x24, lo - csetm x21, lo - subs x22, x10, x9 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x16, x16, x23 - eor x22, x22, x21 - adcs x17, x17, x22 - adc x19, x19, x21 - subs x24, x3, x4 - cneg x24, x24, lo - csetm x21, lo - subs x22, x8, x7 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x12, x12, x23 - eor x22, x22, x21 - adcs x13, x13, x22 - adcs x14, x14, x21 - adcs x15, x15, x21 - adcs x16, x16, x21 - adcs x17, x17, x21 - adc x19, x19, x21 - subs x24, x4, x6 - cneg x24, x24, lo - csetm x21, lo - subs x22, x10, x8 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x15, x15, x23 - eor x22, x22, x21 - adcs x16, x16, x22 - adcs x17, x17, x21 - adc x19, x19, x21 - subs x24, x3, x5 - cneg x24, x24, lo - csetm x21, lo - subs x22, x9, x7 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x13, x13, x23 - eor x22, x22, x21 - adcs x14, x14, x22 - adcs x15, x15, x21 - adcs x16, x16, x21 - adcs x17, x17, x21 - adc x19, x19, x21 - subs x24, x3, x6 - cneg x24, x24, lo - csetm x21, lo - subs x22, x10, x7 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x14, x14, x23 - eor x22, x22, x21 - adcs x15, x15, x22 - adcs x16, x16, x21 - adcs x17, x17, x21 - adc x19, x19, x21 - subs x24, x4, x5 - cneg x24, x24, lo - csetm x21, lo - subs x22, x9, x8 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x14, x14, x23 - eor x22, x22, x21 - adcs x15, x15, x22 - adcs x16, x16, x21 - adcs x17, x17, x21 - adc x19, x19, x21 - lsl x21, x11, #9 - extr x11, x12, x11, #55 - extr x12, x13, x12, #55 - extr x13, x14, x13, #55 - lsr x14, x14, #55 - ldp x3, x4, [x1, #32] - ldp x5, x6, [x1, #48] - ldp x7, x8, [x2, #32] - ldp x9, x10, [x2, #48] - stp x15, x16, [tmp] - stp x17, x19, [tmp+16] - stp x21, x11, [tmp+32] - stp x12, x13, [tmp+48] - str x14, [tmp+64] - mul x11, x3, x7 - mul x15, x4, x8 - mul x16, x5, x9 - mul x17, x6, x10 - umulh x19, x3, x7 - adds x15, x15, x19 - umulh x19, x4, x8 - adcs x16, x16, x19 - umulh x19, x5, x9 - adcs x17, x17, x19 - umulh x19, x6, x10 - adc x19, x19, xzr - adds x12, x15, x11 - adcs x15, x16, x15 - adcs x16, x17, x16 - adcs x17, x19, x17 - adc x19, xzr, x19 - adds x13, x15, x11 - adcs x14, x16, x12 - adcs x15, x17, x15 - adcs x16, x19, x16 - adcs x17, xzr, x17 - adc x19, xzr, x19 - subs x24, x5, x6 - cneg x24, x24, lo - csetm x21, lo - subs x22, x10, x9 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x16, x16, x23 - eor x22, x22, x21 - adcs x17, x17, x22 - adc x19, x19, x21 - subs x24, x3, x4 - cneg x24, x24, lo - csetm x21, lo - subs x22, x8, x7 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x12, x12, x23 - eor x22, x22, x21 - adcs x13, x13, x22 - adcs x14, x14, x21 - adcs x15, x15, x21 - adcs x16, x16, x21 - adcs x17, x17, x21 - adc x19, x19, x21 - subs x24, x4, x6 - cneg x24, x24, lo - csetm x21, lo - subs x22, x10, x8 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x15, x15, x23 - eor x22, x22, x21 - adcs x16, x16, x22 - adcs x17, x17, x21 - adc x19, x19, x21 - subs x24, x3, x5 - cneg x24, x24, lo - csetm x21, lo - subs x22, x9, x7 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x13, x13, x23 - eor x22, x22, x21 - adcs x14, x14, x22 - adcs x15, x15, x21 - adcs x16, x16, x21 - adcs x17, x17, x21 - adc x19, x19, x21 - subs x24, x3, x6 - cneg x24, x24, lo - csetm x21, lo - subs x22, x10, x7 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x14, x14, x23 - eor x22, x22, x21 - adcs x15, x15, x22 - adcs x16, x16, x21 - adcs x17, x17, x21 - adc x19, x19, x21 - subs x24, x4, x5 - cneg x24, x24, lo - csetm x21, lo - subs x22, x9, x8 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x14, x14, x23 - eor x22, x22, x21 - adcs x15, x15, x22 - adcs x16, x16, x21 - adcs x17, x17, x21 - adc x19, x19, x21 - ldp x23, x22, [tmp] - adds x11, x11, x23 - adcs x12, x12, x22 - stp x11, x12, [tmp] - ldp x23, x22, [tmp+16] - adcs x13, x13, x23 - adcs x14, x14, x22 - stp x13, x14, [tmp+16] - ldp x23, x22, [tmp+32] - adcs x15, x15, x23 - adcs x16, x16, x22 - stp x15, x16, [tmp+32] - ldp x23, x22, [tmp+48] - adcs x17, x17, x23 - adcs x19, x19, x22 - stp x17, x19, [tmp+48] - ldr x21, [tmp+64] - adc x21, x21, xzr - str x21, [tmp+64] - ldp x23, x22, [x1] - subs x3, x3, x23 - sbcs x4, x4, x22 - ldp x23, x22, [x1, #16] - sbcs x5, x5, x23 - sbcs x6, x6, x22 - csetm x24, lo - ldp x23, x22, [x2] - subs x7, x23, x7 - sbcs x8, x22, x8 - ldp x23, x22, [x2, #16] - sbcs x9, x23, x9 - sbcs x10, x22, x10 - csetm x25, lo - eor x3, x3, x24 - subs x3, x3, x24 - eor x4, x4, x24 - sbcs x4, x4, x24 - eor x5, x5, x24 - sbcs x5, x5, x24 - eor x6, x6, x24 - sbc x6, x6, x24 - eor x7, x7, x25 - subs x7, x7, x25 - eor x8, x8, x25 - sbcs x8, x8, x25 - eor x9, x9, x25 - sbcs x9, x9, x25 - eor x10, x10, x25 - sbc x10, x10, x25 - eor x25, x25, x24 - mul x11, x3, x7 - mul x15, x4, x8 - mul x16, x5, x9 - mul x17, x6, x10 - umulh x19, x3, x7 - adds x15, x15, x19 - umulh x19, x4, x8 - adcs x16, x16, x19 - umulh x19, x5, x9 - adcs x17, x17, x19 - umulh x19, x6, x10 - adc x19, x19, xzr - adds x12, x15, x11 - adcs x15, x16, x15 - adcs x16, x17, x16 - adcs x17, x19, x17 - adc x19, xzr, x19 - adds x13, x15, x11 - adcs x14, x16, x12 - adcs x15, x17, x15 - adcs x16, x19, x16 - adcs x17, xzr, x17 - adc x19, xzr, x19 - subs x24, x5, x6 - cneg x24, x24, lo - csetm x21, lo - subs x22, x10, x9 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x16, x16, x23 - eor x22, x22, x21 - adcs x17, x17, x22 - adc x19, x19, x21 - subs x24, x3, x4 - cneg x24, x24, lo - csetm x21, lo - subs x22, x8, x7 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x12, x12, x23 - eor x22, x22, x21 - adcs x13, x13, x22 - adcs x14, x14, x21 - adcs x15, x15, x21 - adcs x16, x16, x21 - adcs x17, x17, x21 - adc x19, x19, x21 - subs x24, x4, x6 - cneg x24, x24, lo - csetm x21, lo - subs x22, x10, x8 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x15, x15, x23 - eor x22, x22, x21 - adcs x16, x16, x22 - adcs x17, x17, x21 - adc x19, x19, x21 - subs x24, x3, x5 - cneg x24, x24, lo - csetm x21, lo - subs x22, x9, x7 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x13, x13, x23 - eor x22, x22, x21 - adcs x14, x14, x22 - adcs x15, x15, x21 - adcs x16, x16, x21 - adcs x17, x17, x21 - adc x19, x19, x21 - subs x24, x3, x6 - cneg x24, x24, lo - csetm x21, lo - subs x22, x10, x7 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x14, x14, x23 - eor x22, x22, x21 - adcs x15, x15, x22 - adcs x16, x16, x21 - adcs x17, x17, x21 - adc x19, x19, x21 - subs x24, x4, x5 - cneg x24, x24, lo - csetm x21, lo - subs x22, x9, x8 - cneg x22, x22, lo - mul x23, x24, x22 - umulh x22, x24, x22 - cinv x21, x21, lo - cmn x21, #1 - eor x23, x23, x21 - adcs x14, x14, x23 - eor x22, x22, x21 - adcs x15, x15, x22 - adcs x16, x16, x21 - adcs x17, x17, x21 - adc x19, x19, x21 - ldp x3, x4, [tmp] - ldp x5, x6, [tmp+16] - eor x11, x11, x25 - adds x11, x11, x3 - eor x12, x12, x25 - adcs x12, x12, x4 - eor x13, x13, x25 - adcs x13, x13, x5 - eor x14, x14, x25 - adcs x14, x14, x6 - eor x15, x15, x25 - ldp x7, x8, [tmp+32] - ldp x9, x10, [tmp+48] - ldr x20, [tmp+64] - adcs x15, x15, x7 - eor x16, x16, x25 - adcs x16, x16, x8 - eor x17, x17, x25 - adcs x17, x17, x9 - eor x19, x19, x25 - adcs x19, x19, x10 - adc x21, x20, xzr - adds x15, x15, x3 - adcs x16, x16, x4 - adcs x17, x17, x5 - adcs x19, x19, x6 - and x25, x25, #0x1ff - lsl x24, x11, #9 - orr x24, x24, x25 - adcs x7, x7, x24 - extr x24, x12, x11, #55 - adcs x8, x8, x24 - extr x24, x13, x12, #55 - adcs x9, x9, x24 - extr x24, x14, x13, #55 - adcs x10, x10, x24 - lsr x24, x14, #55 - adc x20, x24, x20 - ldr x6, [x2, #64] - ldp x3, x4, [x1] - and x23, x3, #0xfffffffffffff - mul x23, x6, x23 - ldr x14, [x1, #64] - ldp x11, x12, [x2] - and x24, x11, #0xfffffffffffff - mul x24, x14, x24 - add x23, x23, x24 - extr x24, x4, x3, #52 - and x24, x24, #0xfffffffffffff - mul x22, x6, x24 - extr x24, x12, x11, #52 - and x24, x24, #0xfffffffffffff - mul x24, x14, x24 - add x22, x22, x24 - lsr x24, x23, #52 - add x22, x22, x24 - lsl x23, x23, #12 - extr x24, x22, x23, #12 - adds x15, x15, x24 - ldp x5, x3, [x1, #16] - ldp x13, x11, [x2, #16] - extr x24, x5, x4, #40 - and x24, x24, #0xfffffffffffff - mul x23, x6, x24 - extr x24, x13, x12, #40 - and x24, x24, #0xfffffffffffff - mul x24, x14, x24 - add x23, x23, x24 - lsr x24, x22, #52 - add x23, x23, x24 - lsl x22, x22, #12 - extr x24, x23, x22, #24 - adcs x16, x16, x24 - extr x24, x3, x5, #28 - and x24, x24, #0xfffffffffffff - mul x22, x6, x24 - extr x24, x11, x13, #28 - and x24, x24, #0xfffffffffffff - mul x24, x14, x24 - add x22, x22, x24 - lsr x24, x23, #52 - add x22, x22, x24 - lsl x23, x23, #12 - extr x24, x22, x23, #36 - adcs x17, x17, x24 - and x25, x16, x17 - ldp x4, x5, [x1, #32] - ldp x12, x13, [x2, #32] - extr x24, x4, x3, #16 - and x24, x24, #0xfffffffffffff - mul x23, x6, x24 - extr x24, x12, x11, #16 - and x24, x24, #0xfffffffffffff - mul x24, x14, x24 - add x23, x23, x24 - lsl x21, x21, #48 - add x23, x23, x21 - lsr x24, x22, #52 - add x23, x23, x24 - lsl x22, x22, #12 - extr x24, x23, x22, #48 - adcs x19, x19, x24 - and x25, x25, x19 - lsr x24, x4, #4 - and x24, x24, #0xfffffffffffff - mul x22, x6, x24 - lsr x24, x12, #4 - and x24, x24, #0xfffffffffffff - mul x24, x14, x24 - add x22, x22, x24 - lsr x24, x23, #52 - add x22, x22, x24 - lsl x23, x23, #12 - extr x21, x22, x23, #60 - extr x24, x5, x4, #56 - and x24, x24, #0xfffffffffffff - mul x23, x6, x24 - extr x24, x13, x12, #56 - and x24, x24, #0xfffffffffffff - mul x24, x14, x24 - add x23, x23, x24 - lsr x24, x22, #52 - add x23, x23, x24 - lsl x21, x21, #8 - extr x24, x23, x21, #8 - adcs x7, x7, x24 - and x25, x25, x7 - ldp x3, x4, [x1, #48] - ldp x11, x12, [x2, #48] - extr x24, x3, x5, #44 - and x24, x24, #0xfffffffffffff - mul x22, x6, x24 - extr x24, x11, x13, #44 - and x24, x24, #0xfffffffffffff - mul x24, x14, x24 - add x22, x22, x24 - lsr x24, x23, #52 - add x22, x22, x24 - lsl x23, x23, #12 - extr x24, x22, x23, #20 - adcs x8, x8, x24 - and x25, x25, x8 - extr x24, x4, x3, #32 - and x24, x24, #0xfffffffffffff - mul x23, x6, x24 - extr x24, x12, x11, #32 - and x24, x24, #0xfffffffffffff - mul x24, x14, x24 - add x23, x23, x24 - lsr x24, x22, #52 - add x23, x23, x24 - lsl x22, x22, #12 - extr x24, x23, x22, #32 - adcs x9, x9, x24 - and x25, x25, x9 - lsr x24, x4, #20 - mul x22, x6, x24 - lsr x24, x12, #20 - mul x24, x14, x24 - add x22, x22, x24 - lsr x24, x23, #52 - add x22, x22, x24 - lsl x23, x23, #12 - extr x24, x22, x23, #44 - adcs x10, x10, x24 - and x25, x25, x10 - mul x24, x6, x14 - lsr x22, x22, #44 - add x24, x24, x22 - adc x20, x20, x24 - lsr x22, x20, #9 - orr x20, x20, #0xfffffffffffffe00 - cmp xzr, xzr - adcs xzr, x15, x22 - adcs xzr, x25, xzr - adcs xzr, x20, xzr - adcs x15, x15, x22 - adcs x16, x16, xzr - adcs x17, x17, xzr - adcs x19, x19, xzr - adcs x7, x7, xzr - adcs x8, x8, xzr - adcs x9, x9, xzr - adcs x10, x10, xzr - adc x20, x20, xzr - and x22, x15, #0x1ff - extr x15, x16, x15, #9 - extr x16, x17, x16, #9 - stp x15, x16, [x0] - extr x17, x19, x17, #9 - extr x19, x7, x19, #9 - stp x17, x19, [x0, #16] - extr x7, x8, x7, #9 - extr x8, x9, x8, #9 - stp x7, x8, [x0, #32] - extr x9, x10, x9, #9 - extr x10, x20, x10, #9 - stp x9, x10, [x0, #48] - str x22, [x0, #64] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp521_jmixadd_local_mul_p521) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp521_jmixadd_local_sqr_p521) - -Lp521_jmixadd_local_sqr_p521: - CFI_START - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - ldp x6, x7, [x1, #32] - ldp x8, x9, [x1, #48] - mul x12, x6, x8 - mul x17, x7, x9 - umulh x22, x6, x8 - subs x23, x6, x7 - cneg x23, x23, cc - csetm x11, cc - subs x10, x9, x8 - cneg x10, x10, cc - mul x16, x23, x10 - umulh x10, x23, x10 - cinv x11, x11, cc - eor x16, x16, x11 - eor x10, x10, x11 - adds x13, x12, x22 - adc x22, x22, xzr - umulh x23, x7, x9 - adds x13, x13, x17 - adcs x22, x22, x23 - adc x23, x23, xzr - adds x22, x22, x17 - adc x23, x23, xzr - cmn x11, #0x1 - adcs x13, x13, x16 - adcs x22, x22, x10 - adc x23, x23, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adcs x22, x22, x22 - adcs x23, x23, x23 - adc x19, xzr, xzr - mul x10, x6, x6 - mul x16, x7, x7 - mul x21, x6, x7 - umulh x11, x6, x6 - umulh x17, x7, x7 - umulh x20, x6, x7 - adds x11, x11, x21 - adcs x16, x16, x20 - adc x17, x17, xzr - adds x11, x11, x21 - adcs x16, x16, x20 - adc x17, x17, xzr - adds x12, x12, x16 - adcs x13, x13, x17 - adcs x22, x22, xzr - adcs x23, x23, xzr - adc x19, x19, xzr - mul x14, x8, x8 - mul x16, x9, x9 - mul x21, x8, x9 - umulh x15, x8, x8 - umulh x17, x9, x9 - umulh x20, x8, x9 - adds x15, x15, x21 - adcs x16, x16, x20 - adc x17, x17, xzr - adds x15, x15, x21 - adcs x16, x16, x20 - adc x17, x17, xzr - adds x14, x14, x22 - adcs x15, x15, x23 - adcs x16, x16, x19 - adc x17, x17, xzr - ldr x19, [x1, #64] - add x23, x19, x19 - mul x19, x19, x19 - and x21, x2, #0xfffffffffffff - mul x21, x23, x21 - extr x20, x3, x2, #52 - and x20, x20, #0xfffffffffffff - mul x20, x23, x20 - lsr x22, x21, #52 - add x20, x20, x22 - lsl x21, x21, #12 - extr x22, x20, x21, #12 - adds x10, x10, x22 - extr x21, x4, x3, #40 - and x21, x21, #0xfffffffffffff - mul x21, x23, x21 - lsr x22, x20, #52 - add x21, x21, x22 - lsl x20, x20, #12 - extr x22, x21, x20, #24 - adcs x11, x11, x22 - extr x20, x5, x4, #28 - and x20, x20, #0xfffffffffffff - mul x20, x23, x20 - lsr x22, x21, #52 - add x20, x20, x22 - lsl x21, x21, #12 - extr x22, x20, x21, #36 - adcs x12, x12, x22 - extr x21, x6, x5, #16 - and x21, x21, #0xfffffffffffff - mul x21, x23, x21 - lsr x22, x20, #52 - add x21, x21, x22 - lsl x20, x20, #12 - extr x22, x21, x20, #48 - adcs x13, x13, x22 - lsr x20, x6, #4 - and x20, x20, #0xfffffffffffff - mul x20, x23, x20 - lsr x22, x21, #52 - add x20, x20, x22 - lsl x21, x21, #12 - extr x24, x20, x21, #60 - extr x21, x7, x6, #56 - and x21, x21, #0xfffffffffffff - mul x21, x23, x21 - lsr x22, x20, #52 - add x21, x21, x22 - lsl x24, x24, #8 - extr x22, x21, x24, #8 - adcs x14, x14, x22 - extr x20, x8, x7, #44 - and x20, x20, #0xfffffffffffff - mul x20, x23, x20 - lsr x22, x21, #52 - add x20, x20, x22 - lsl x21, x21, #12 - extr x22, x20, x21, #20 - adcs x15, x15, x22 - extr x21, x9, x8, #32 - and x21, x21, #0xfffffffffffff - mul x21, x23, x21 - lsr x22, x20, #52 - add x21, x21, x22 - lsl x20, x20, #12 - extr x22, x21, x20, #32 - adcs x16, x16, x22 - lsr x20, x9, #20 - mul x20, x23, x20 - lsr x22, x21, #52 - add x20, x20, x22 - lsl x21, x21, #12 - extr x22, x20, x21, #44 - adcs x17, x17, x22 - lsr x20, x20, #44 - adc x19, x19, x20 - extr x21, x11, x10, #9 - extr x20, x12, x11, #9 - stp x21, x20, [x0] - extr x21, x13, x12, #9 - extr x20, x14, x13, #9 - stp x21, x20, [x0, #16] - extr x21, x15, x14, #9 - extr x20, x16, x15, #9 - stp x21, x20, [x0, #32] - extr x21, x17, x16, #9 - extr x20, x19, x17, #9 - stp x21, x20, [x0, #48] - and x22, x10, #0x1ff - lsr x19, x19, #9 - add x22, x22, x19 - str x22, [x0, #64] - mul x12, x2, x4 - mul x17, x3, x5 - umulh x22, x2, x4 - subs x23, x2, x3 - cneg x23, x23, cc - csetm x11, cc - subs x10, x5, x4 - cneg x10, x10, cc - mul x16, x23, x10 - umulh x10, x23, x10 - cinv x11, x11, cc - eor x16, x16, x11 - eor x10, x10, x11 - adds x13, x12, x22 - adc x22, x22, xzr - umulh x23, x3, x5 - adds x13, x13, x17 - adcs x22, x22, x23 - adc x23, x23, xzr - adds x22, x22, x17 - adc x23, x23, xzr - cmn x11, #0x1 - adcs x13, x13, x16 - adcs x22, x22, x10 - adc x23, x23, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adcs x22, x22, x22 - adcs x23, x23, x23 - adc x19, xzr, xzr - mul x10, x2, x2 - mul x16, x3, x3 - mul x21, x2, x3 - umulh x11, x2, x2 - umulh x17, x3, x3 - umulh x20, x2, x3 - adds x11, x11, x21 - adcs x16, x16, x20 - adc x17, x17, xzr - adds x11, x11, x21 - adcs x16, x16, x20 - adc x17, x17, xzr - adds x12, x12, x16 - adcs x13, x13, x17 - adcs x22, x22, xzr - adcs x23, x23, xzr - adc x19, x19, xzr - mul x14, x4, x4 - mul x16, x5, x5 - mul x21, x4, x5 - umulh x15, x4, x4 - umulh x17, x5, x5 - umulh x20, x4, x5 - adds x15, x15, x21 - adcs x16, x16, x20 - adc x17, x17, xzr - adds x15, x15, x21 - adcs x16, x16, x20 - adc x17, x17, xzr - adds x14, x14, x22 - adcs x15, x15, x23 - adcs x16, x16, x19 - adc x17, x17, xzr - ldp x21, x20, [x0] - adds x21, x21, x10 - adcs x20, x20, x11 - stp x21, x20, [x0] - ldp x21, x20, [x0, #16] - adcs x21, x21, x12 - adcs x20, x20, x13 - stp x21, x20, [x0, #16] - ldp x21, x20, [x0, #32] - adcs x21, x21, x14 - adcs x20, x20, x15 - stp x21, x20, [x0, #32] - ldp x21, x20, [x0, #48] - adcs x21, x21, x16 - adcs x20, x20, x17 - stp x21, x20, [x0, #48] - ldr x22, [x0, #64] - adc x22, x22, xzr - str x22, [x0, #64] - mul x10, x2, x6 - mul x14, x3, x7 - mul x15, x4, x8 - mul x16, x5, x9 - umulh x17, x2, x6 - adds x14, x14, x17 - umulh x17, x3, x7 - adcs x15, x15, x17 - umulh x17, x4, x8 - adcs x16, x16, x17 - umulh x17, x5, x9 - adc x17, x17, xzr - adds x11, x14, x10 - adcs x14, x15, x14 - adcs x15, x16, x15 - adcs x16, x17, x16 - adc x17, xzr, x17 - adds x12, x14, x10 - adcs x13, x15, x11 - adcs x14, x16, x14 - adcs x15, x17, x15 - adcs x16, xzr, x16 - adc x17, xzr, x17 - subs x22, x4, x5 - cneg x22, x22, cc - csetm x19, cc - subs x20, x9, x8 - cneg x20, x20, cc - mul x21, x22, x20 - umulh x20, x22, x20 - cinv x19, x19, cc - cmn x19, #0x1 - eor x21, x21, x19 - adcs x15, x15, x21 - eor x20, x20, x19 - adcs x16, x16, x20 - adc x17, x17, x19 - subs x22, x2, x3 - cneg x22, x22, cc - csetm x19, cc - subs x20, x7, x6 - cneg x20, x20, cc - mul x21, x22, x20 - umulh x20, x22, x20 - cinv x19, x19, cc - cmn x19, #0x1 - eor x21, x21, x19 - adcs x11, x11, x21 - eor x20, x20, x19 - adcs x12, x12, x20 - adcs x13, x13, x19 - adcs x14, x14, x19 - adcs x15, x15, x19 - adcs x16, x16, x19 - adc x17, x17, x19 - subs x22, x3, x5 - cneg x22, x22, cc - csetm x19, cc - subs x20, x9, x7 - cneg x20, x20, cc - mul x21, x22, x20 - umulh x20, x22, x20 - cinv x19, x19, cc - cmn x19, #0x1 - eor x21, x21, x19 - adcs x14, x14, x21 - eor x20, x20, x19 - adcs x15, x15, x20 - adcs x16, x16, x19 - adc x17, x17, x19 - subs x22, x2, x4 - cneg x22, x22, cc - csetm x19, cc - subs x20, x8, x6 - cneg x20, x20, cc - mul x21, x22, x20 - umulh x20, x22, x20 - cinv x19, x19, cc - cmn x19, #0x1 - eor x21, x21, x19 - adcs x12, x12, x21 - eor x20, x20, x19 - adcs x13, x13, x20 - adcs x14, x14, x19 - adcs x15, x15, x19 - adcs x16, x16, x19 - adc x17, x17, x19 - subs x22, x2, x5 - cneg x22, x22, cc - csetm x19, cc - subs x20, x9, x6 - cneg x20, x20, cc - mul x21, x22, x20 - umulh x20, x22, x20 - cinv x19, x19, cc - cmn x19, #0x1 - eor x21, x21, x19 - adcs x13, x13, x21 - eor x20, x20, x19 - adcs x14, x14, x20 - adcs x15, x15, x19 - adcs x16, x16, x19 - adc x17, x17, x19 - subs x22, x3, x4 - cneg x22, x22, cc - csetm x19, cc - subs x20, x8, x7 - cneg x20, x20, cc - mul x21, x22, x20 - umulh x20, x22, x20 - cinv x19, x19, cc - cmn x19, #0x1 - eor x21, x21, x19 - adcs x13, x13, x21 - eor x20, x20, x19 - adcs x14, x14, x20 - adcs x15, x15, x19 - adcs x16, x16, x19 - adc x17, x17, x19 - ldp x21, x20, [x0] - extr x2, x15, x14, #8 - adds x2, x2, x21 - extr x3, x16, x15, #8 - adcs x3, x3, x20 - ldp x21, x20, [x0, #16] - extr x4, x17, x16, #8 - adcs x4, x4, x21 - and x22, x3, x4 - lsr x5, x17, #8 - adcs x5, x5, x20 - and x22, x22, x5 - ldp x21, x20, [x0, #32] - lsl x6, x10, #1 - adcs x6, x6, x21 - and x22, x22, x6 - extr x7, x11, x10, #63 - adcs x7, x7, x20 - and x22, x22, x7 - ldp x21, x20, [x0, #48] - extr x8, x12, x11, #63 - adcs x8, x8, x21 - and x22, x22, x8 - extr x9, x13, x12, #63 - adcs x9, x9, x20 - and x22, x22, x9 - ldr x21, [x0, #64] - extr x10, x14, x13, #63 - and x10, x10, #0x1ff - adc x10, x21, x10 - lsr x20, x10, #9 - orr x10, x10, #0xfffffffffffffe00 - cmp xzr, xzr - adcs xzr, x2, x20 - adcs xzr, x22, xzr - adcs xzr, x10, xzr - adcs x2, x2, x20 - adcs x3, x3, xzr - adcs x4, x4, xzr - adcs x5, x5, xzr - adcs x6, x6, xzr - adcs x7, x7, xzr - adcs x8, x8, xzr - adcs x9, x9, xzr - adc x10, x10, xzr - and x10, x10, #0x1ff - stp x2, x3, [x0] - stp x4, x5, [x0, #16] - stp x6, x7, [x0, #32] - stp x8, x9, [x0, #48] - str x10, [x0, #64] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp521_jmixadd_local_sqr_p521) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp521_jmixadd_local_sub_p521) - -Lp521_jmixadd_local_sub_p521: - CFI_START - ldp x5, x6, [x1] - ldp x4, x3, [x2] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [x1, #16] - ldp x4, x3, [x2, #16] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - ldp x9, x10, [x1, #32] - ldp x4, x3, [x2, #32] - sbcs x9, x9, x4 - sbcs x10, x10, x3 - ldp x11, x12, [x1, #48] - ldp x4, x3, [x2, #48] - sbcs x11, x11, x4 - sbcs x12, x12, x3 - ldr x13, [x1, #64] - ldr x4, [x2, #64] - sbcs x13, x13, x4 - sbcs x5, x5, xzr - sbcs x6, x6, xzr - sbcs x7, x7, xzr - sbcs x8, x8, xzr - sbcs x9, x9, xzr - sbcs x10, x10, xzr - sbcs x11, x11, xzr - sbcs x12, x12, xzr - sbcs x13, x13, xzr - and x13, x13, #0x1ff - stp x5, x6, [x0] - stp x7, x8, [x0, #16] - stp x9, x10, [x0, #32] - stp x11, x12, [x0, #48] - str x13, [x0, #64] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp521_jmixadd_local_sub_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jmixadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jmixadd_alt.S deleted file mode 100644 index 3f88c6a93cc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/p521_jmixadd_alt.S +++ /dev/null @@ -1,888 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on NIST curve P-521 in Jacobian coordinates -// -// extern void p521_jmixadd_alt(uint64_t p3[static 27], -// const uint64_t p1[static 27], -// const uint64_t p2[static 18]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. It is assumed that -// all the coordinates of the input points p1 and p2 are fully reduced -// mod p_521, that the z coordinate of p1 is nonzero and that neither -// p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents the same affine -// point as". -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p521_jmixadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p521_jmixadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p521_jmixadd_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 72 - -// Stable homes for input arguments during main code sequence - -#define input_z x26 -#define input_x x27 -#define input_y x28 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define zp2 sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define NSPACE NUMSIZE*6 - -// Corresponds exactly to bignum_mul_p521_alt - -#define mul_p521(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - mul x15, x3, x5 __LF \ - umulh x16, x3, x5 __LF \ - mul x14, x3, x6 __LF \ - umulh x17, x3, x6 __LF \ - adds x16, x16, x14 __LF \ - ldp x7, x8, [P2+16] __LF \ - mul x14, x3, x7 __LF \ - umulh x19, x3, x7 __LF \ - adcs x17, x17, x14 __LF \ - mul x14, x3, x8 __LF \ - umulh x20, x3, x8 __LF \ - adcs x19, x19, x14 __LF \ - ldp x9, x10, [P2+32] __LF \ - mul x14, x3, x9 __LF \ - umulh x21, x3, x9 __LF \ - adcs x20, x20, x14 __LF \ - mul x14, x3, x10 __LF \ - umulh x22, x3, x10 __LF \ - adcs x21, x21, x14 __LF \ - ldp x11, x12, [P2+48] __LF \ - mul x14, x3, x11 __LF \ - umulh x23, x3, x11 __LF \ - adcs x22, x22, x14 __LF \ - ldr x13, [P2+64] __LF \ - mul x14, x3, x12 __LF \ - umulh x24, x3, x12 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x3, x13 __LF \ - umulh x1, x3, x13 __LF \ - adcs x24, x24, x14 __LF \ - adc x1, x1, xzr __LF \ - mul x14, x4, x5 __LF \ - adds x16, x16, x14 __LF \ - mul x14, x4, x6 __LF \ - adcs x17, x17, x14 __LF \ - mul x14, x4, x7 __LF \ - adcs x19, x19, x14 __LF \ - mul x14, x4, x8 __LF \ - adcs x20, x20, x14 __LF \ - mul x14, x4, x9 __LF \ - adcs x21, x21, x14 __LF \ - mul x14, x4, x10 __LF \ - adcs x22, x22, x14 __LF \ - mul x14, x4, x11 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x4, x12 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x4, x13 __LF \ - adcs x1, x1, x14 __LF \ - cset x0, hs __LF \ - umulh x14, x4, x5 __LF \ - adds x17, x17, x14 __LF \ - umulh x14, x4, x6 __LF \ - adcs x19, x19, x14 __LF \ - umulh x14, x4, x7 __LF \ - adcs x20, x20, x14 __LF \ - umulh x14, x4, x8 __LF \ - adcs x21, x21, x14 __LF \ - umulh x14, x4, x9 __LF \ - adcs x22, x22, x14 __LF \ - umulh x14, x4, x10 __LF \ - adcs x23, x23, x14 __LF \ - umulh x14, x4, x11 __LF \ - adcs x24, x24, x14 __LF \ - umulh x14, x4, x12 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x4, x13 __LF \ - adc x0, x0, x14 __LF \ - stp x15, x16, [P0] __LF \ - ldp x3, x4, [P1+16] __LF \ - mul x14, x3, x5 __LF \ - adds x17, x17, x14 __LF \ - mul x14, x3, x6 __LF \ - adcs x19, x19, x14 __LF \ - mul x14, x3, x7 __LF \ - adcs x20, x20, x14 __LF \ - mul x14, x3, x8 __LF \ - adcs x21, x21, x14 __LF \ - mul x14, x3, x9 __LF \ - adcs x22, x22, x14 __LF \ - mul x14, x3, x10 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x3, x11 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x3, x12 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x3, x13 __LF \ - adcs x0, x0, x14 __LF \ - cset x15, hs __LF \ - umulh x14, x3, x5 __LF \ - adds x19, x19, x14 __LF \ - umulh x14, x3, x6 __LF \ - adcs x20, x20, x14 __LF \ - umulh x14, x3, x7 __LF \ - adcs x21, x21, x14 __LF \ - umulh x14, x3, x8 __LF \ - adcs x22, x22, x14 __LF \ - umulh x14, x3, x9 __LF \ - adcs x23, x23, x14 __LF \ - umulh x14, x3, x10 __LF \ - adcs x24, x24, x14 __LF \ - umulh x14, x3, x11 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x3, x12 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x3, x13 __LF \ - adc x15, x15, x14 __LF \ - mul x14, x4, x5 __LF \ - adds x19, x19, x14 __LF \ - mul x14, x4, x6 __LF \ - adcs x20, x20, x14 __LF \ - mul x14, x4, x7 __LF \ - adcs x21, x21, x14 __LF \ - mul x14, x4, x8 __LF \ - adcs x22, x22, x14 __LF \ - mul x14, x4, x9 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x4, x10 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x4, x11 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x4, x12 __LF \ - adcs x0, x0, x14 __LF \ - mul x14, x4, x13 __LF \ - adcs x15, x15, x14 __LF \ - cset x16, hs __LF \ - umulh x14, x4, x5 __LF \ - adds x20, x20, x14 __LF \ - umulh x14, x4, x6 __LF \ - adcs x21, x21, x14 __LF \ - umulh x14, x4, x7 __LF \ - adcs x22, x22, x14 __LF \ - umulh x14, x4, x8 __LF \ - adcs x23, x23, x14 __LF \ - umulh x14, x4, x9 __LF \ - adcs x24, x24, x14 __LF \ - umulh x14, x4, x10 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x4, x11 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x4, x12 __LF \ - adcs x15, x15, x14 __LF \ - umulh x14, x4, x13 __LF \ - adc x16, x16, x14 __LF \ - stp x17, x19, [P0+16] __LF \ - ldp x3, x4, [P1+32] __LF \ - mul x14, x3, x5 __LF \ - adds x20, x20, x14 __LF \ - mul x14, x3, x6 __LF \ - adcs x21, x21, x14 __LF \ - mul x14, x3, x7 __LF \ - adcs x22, x22, x14 __LF \ - mul x14, x3, x8 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x3, x9 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x3, x10 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x3, x11 __LF \ - adcs x0, x0, x14 __LF \ - mul x14, x3, x12 __LF \ - adcs x15, x15, x14 __LF \ - mul x14, x3, x13 __LF \ - adcs x16, x16, x14 __LF \ - cset x17, hs __LF \ - umulh x14, x3, x5 __LF \ - adds x21, x21, x14 __LF \ - umulh x14, x3, x6 __LF \ - adcs x22, x22, x14 __LF \ - umulh x14, x3, x7 __LF \ - adcs x23, x23, x14 __LF \ - umulh x14, x3, x8 __LF \ - adcs x24, x24, x14 __LF \ - umulh x14, x3, x9 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x3, x10 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x3, x11 __LF \ - adcs x15, x15, x14 __LF \ - umulh x14, x3, x12 __LF \ - adcs x16, x16, x14 __LF \ - umulh x14, x3, x13 __LF \ - adc x17, x17, x14 __LF \ - mul x14, x4, x5 __LF \ - adds x21, x21, x14 __LF \ - mul x14, x4, x6 __LF \ - adcs x22, x22, x14 __LF \ - mul x14, x4, x7 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x4, x8 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x4, x9 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x4, x10 __LF \ - adcs x0, x0, x14 __LF \ - mul x14, x4, x11 __LF \ - adcs x15, x15, x14 __LF \ - mul x14, x4, x12 __LF \ - adcs x16, x16, x14 __LF \ - mul x14, x4, x13 __LF \ - adcs x17, x17, x14 __LF \ - cset x19, hs __LF \ - umulh x14, x4, x5 __LF \ - adds x22, x22, x14 __LF \ - umulh x14, x4, x6 __LF \ - adcs x23, x23, x14 __LF \ - umulh x14, x4, x7 __LF \ - adcs x24, x24, x14 __LF \ - umulh x14, x4, x8 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x4, x9 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x4, x10 __LF \ - adcs x15, x15, x14 __LF \ - umulh x14, x4, x11 __LF \ - adcs x16, x16, x14 __LF \ - umulh x14, x4, x12 __LF \ - adcs x17, x17, x14 __LF \ - umulh x14, x4, x13 __LF \ - adc x19, x19, x14 __LF \ - stp x20, x21, [P0+32] __LF \ - ldp x3, x4, [P1+48] __LF \ - mul x14, x3, x5 __LF \ - adds x22, x22, x14 __LF \ - mul x14, x3, x6 __LF \ - adcs x23, x23, x14 __LF \ - mul x14, x3, x7 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x3, x8 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x3, x9 __LF \ - adcs x0, x0, x14 __LF \ - mul x14, x3, x10 __LF \ - adcs x15, x15, x14 __LF \ - mul x14, x3, x11 __LF \ - adcs x16, x16, x14 __LF \ - mul x14, x3, x12 __LF \ - adcs x17, x17, x14 __LF \ - mul x14, x3, x13 __LF \ - adcs x19, x19, x14 __LF \ - cset x20, hs __LF \ - umulh x14, x3, x5 __LF \ - adds x23, x23, x14 __LF \ - umulh x14, x3, x6 __LF \ - adcs x24, x24, x14 __LF \ - umulh x14, x3, x7 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x3, x8 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x3, x9 __LF \ - adcs x15, x15, x14 __LF \ - umulh x14, x3, x10 __LF \ - adcs x16, x16, x14 __LF \ - umulh x14, x3, x11 __LF \ - adcs x17, x17, x14 __LF \ - umulh x14, x3, x12 __LF \ - adcs x19, x19, x14 __LF \ - umulh x14, x3, x13 __LF \ - adc x20, x20, x14 __LF \ - mul x14, x4, x5 __LF \ - adds x23, x23, x14 __LF \ - mul x14, x4, x6 __LF \ - adcs x24, x24, x14 __LF \ - mul x14, x4, x7 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x4, x8 __LF \ - adcs x0, x0, x14 __LF \ - mul x14, x4, x9 __LF \ - adcs x15, x15, x14 __LF \ - mul x14, x4, x10 __LF \ - adcs x16, x16, x14 __LF \ - mul x14, x4, x11 __LF \ - adcs x17, x17, x14 __LF \ - mul x14, x4, x12 __LF \ - adcs x19, x19, x14 __LF \ - mul x14, x4, x13 __LF \ - adcs x20, x20, x14 __LF \ - cset x21, hs __LF \ - umulh x14, x4, x5 __LF \ - adds x24, x24, x14 __LF \ - umulh x14, x4, x6 __LF \ - adcs x1, x1, x14 __LF \ - umulh x14, x4, x7 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x4, x8 __LF \ - adcs x15, x15, x14 __LF \ - umulh x14, x4, x9 __LF \ - adcs x16, x16, x14 __LF \ - umulh x14, x4, x10 __LF \ - adcs x17, x17, x14 __LF \ - umulh x14, x4, x11 __LF \ - adcs x19, x19, x14 __LF \ - umulh x14, x4, x12 __LF \ - adcs x20, x20, x14 __LF \ - umulh x14, x4, x13 __LF \ - adc x21, x21, x14 __LF \ - stp x22, x23, [P0+48] __LF \ - ldr x3, [P1+64] __LF \ - mul x14, x3, x5 __LF \ - adds x24, x24, x14 __LF \ - mul x14, x3, x6 __LF \ - adcs x1, x1, x14 __LF \ - mul x14, x3, x7 __LF \ - adcs x0, x0, x14 __LF \ - mul x14, x3, x8 __LF \ - adcs x15, x15, x14 __LF \ - mul x14, x3, x9 __LF \ - adcs x16, x16, x14 __LF \ - mul x14, x3, x10 __LF \ - adcs x17, x17, x14 __LF \ - mul x14, x3, x11 __LF \ - adcs x19, x19, x14 __LF \ - mul x14, x3, x12 __LF \ - adcs x20, x20, x14 __LF \ - mul x14, x3, x13 __LF \ - adc x21, x21, x14 __LF \ - umulh x14, x3, x5 __LF \ - adds x1, x1, x14 __LF \ - umulh x14, x3, x6 __LF \ - adcs x0, x0, x14 __LF \ - umulh x14, x3, x7 __LF \ - adcs x15, x15, x14 __LF \ - umulh x14, x3, x8 __LF \ - adcs x16, x16, x14 __LF \ - umulh x14, x3, x9 __LF \ - adcs x17, x17, x14 __LF \ - umulh x14, x3, x10 __LF \ - adcs x19, x19, x14 __LF \ - umulh x14, x3, x11 __LF \ - adcs x20, x20, x14 __LF \ - umulh x14, x3, x12 __LF \ - adc x21, x21, x14 __LF \ - cmp xzr, xzr __LF \ - ldp x5, x6, [P0] __LF \ - extr x14, x1, x24, #9 __LF \ - adcs x5, x5, x14 __LF \ - extr x14, x0, x1, #9 __LF \ - adcs x6, x6, x14 __LF \ - ldp x7, x8, [P0+16] __LF \ - extr x14, x15, x0, #9 __LF \ - adcs x7, x7, x14 __LF \ - extr x14, x16, x15, #9 __LF \ - adcs x8, x8, x14 __LF \ - ldp x9, x10, [P0+32] __LF \ - extr x14, x17, x16, #9 __LF \ - adcs x9, x9, x14 __LF \ - extr x14, x19, x17, #9 __LF \ - adcs x10, x10, x14 __LF \ - ldp x11, x12, [P0+48] __LF \ - extr x14, x20, x19, #9 __LF \ - adcs x11, x11, x14 __LF \ - extr x14, x21, x20, #9 __LF \ - adcs x12, x12, x14 __LF \ - orr x13, x24, #0xfffffffffffffe00 __LF \ - lsr x14, x21, #9 __LF \ - adcs x13, x13, x14 __LF \ - sbcs x5, x5, xzr __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbcs x11, x11, xzr __LF \ - sbcs x12, x12, xzr __LF \ - sbc x13, x13, xzr __LF \ - and x13, x13, #0x1ff __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] __LF \ - stp x9, x10, [P0+32] __LF \ - stp x11, x12, [P0+48] __LF \ - str x13, [P0+64] - -// Corresponds exactly to bignum_sqr_p521_alt - -#define sqr_p521(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x11, x2, x3 __LF \ - umulh x12, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x10, x2, x4 __LF \ - umulh x13, x2, x4 __LF \ - adds x12, x12, x10 __LF \ - ldp x6, x7, [P1+32] __LF \ - mul x10, x2, x5 __LF \ - umulh x14, x2, x5 __LF \ - adcs x13, x13, x10 __LF \ - ldp x8, x9, [P1+48] __LF \ - mul x10, x2, x6 __LF \ - umulh x15, x2, x6 __LF \ - adcs x14, x14, x10 __LF \ - mul x10, x2, x7 __LF \ - umulh x16, x2, x7 __LF \ - adcs x15, x15, x10 __LF \ - mul x10, x2, x8 __LF \ - umulh x17, x2, x8 __LF \ - adcs x16, x16, x10 __LF \ - mul x10, x2, x9 __LF \ - umulh x19, x2, x9 __LF \ - adcs x17, x17, x10 __LF \ - adc x19, x19, xzr __LF \ - mul x10, x3, x4 __LF \ - adds x13, x13, x10 __LF \ - mul x10, x3, x5 __LF \ - adcs x14, x14, x10 __LF \ - mul x10, x3, x6 __LF \ - adcs x15, x15, x10 __LF \ - mul x10, x3, x7 __LF \ - adcs x16, x16, x10 __LF \ - mul x10, x3, x8 __LF \ - adcs x17, x17, x10 __LF \ - mul x10, x3, x9 __LF \ - adcs x19, x19, x10 __LF \ - cset x20, hs __LF \ - umulh x10, x3, x4 __LF \ - adds x14, x14, x10 __LF \ - umulh x10, x3, x5 __LF \ - adcs x15, x15, x10 __LF \ - umulh x10, x3, x6 __LF \ - adcs x16, x16, x10 __LF \ - umulh x10, x3, x7 __LF \ - adcs x17, x17, x10 __LF \ - umulh x10, x3, x8 __LF \ - adcs x19, x19, x10 __LF \ - umulh x10, x3, x9 __LF \ - adc x20, x20, x10 __LF \ - mul x10, x6, x7 __LF \ - umulh x21, x6, x7 __LF \ - adds x20, x20, x10 __LF \ - adc x21, x21, xzr __LF \ - mul x10, x4, x5 __LF \ - adds x15, x15, x10 __LF \ - mul x10, x4, x6 __LF \ - adcs x16, x16, x10 __LF \ - mul x10, x4, x7 __LF \ - adcs x17, x17, x10 __LF \ - mul x10, x4, x8 __LF \ - adcs x19, x19, x10 __LF \ - mul x10, x4, x9 __LF \ - adcs x20, x20, x10 __LF \ - mul x10, x6, x8 __LF \ - adcs x21, x21, x10 __LF \ - cset x22, hs __LF \ - umulh x10, x4, x5 __LF \ - adds x16, x16, x10 __LF \ - umulh x10, x4, x6 __LF \ - adcs x17, x17, x10 __LF \ - umulh x10, x4, x7 __LF \ - adcs x19, x19, x10 __LF \ - umulh x10, x4, x8 __LF \ - adcs x20, x20, x10 __LF \ - umulh x10, x4, x9 __LF \ - adcs x21, x21, x10 __LF \ - umulh x10, x6, x8 __LF \ - adc x22, x22, x10 __LF \ - mul x10, x7, x8 __LF \ - umulh x23, x7, x8 __LF \ - adds x22, x22, x10 __LF \ - adc x23, x23, xzr __LF \ - mul x10, x5, x6 __LF \ - adds x17, x17, x10 __LF \ - mul x10, x5, x7 __LF \ - adcs x19, x19, x10 __LF \ - mul x10, x5, x8 __LF \ - adcs x20, x20, x10 __LF \ - mul x10, x5, x9 __LF \ - adcs x21, x21, x10 __LF \ - mul x10, x6, x9 __LF \ - adcs x22, x22, x10 __LF \ - mul x10, x7, x9 __LF \ - adcs x23, x23, x10 __LF \ - cset x24, hs __LF \ - umulh x10, x5, x6 __LF \ - adds x19, x19, x10 __LF \ - umulh x10, x5, x7 __LF \ - adcs x20, x20, x10 __LF \ - umulh x10, x5, x8 __LF \ - adcs x21, x21, x10 __LF \ - umulh x10, x5, x9 __LF \ - adcs x22, x22, x10 __LF \ - umulh x10, x6, x9 __LF \ - adcs x23, x23, x10 __LF \ - umulh x10, x7, x9 __LF \ - adc x24, x24, x10 __LF \ - mul x10, x8, x9 __LF \ - umulh x25, x8, x9 __LF \ - adds x24, x24, x10 __LF \ - adc x25, x25, xzr __LF \ - adds x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - adcs x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adcs x17, x17, x17 __LF \ - adcs x19, x19, x19 __LF \ - adcs x20, x20, x20 __LF \ - adcs x21, x21, x21 __LF \ - adcs x22, x22, x22 __LF \ - adcs x23, x23, x23 __LF \ - adcs x24, x24, x24 __LF \ - adcs x25, x25, x25 __LF \ - cset x0, hs __LF \ - umulh x10, x2, x2 __LF \ - adds x11, x11, x10 __LF \ - mul x10, x3, x3 __LF \ - adcs x12, x12, x10 __LF \ - umulh x10, x3, x3 __LF \ - adcs x13, x13, x10 __LF \ - mul x10, x4, x4 __LF \ - adcs x14, x14, x10 __LF \ - umulh x10, x4, x4 __LF \ - adcs x15, x15, x10 __LF \ - mul x10, x5, x5 __LF \ - adcs x16, x16, x10 __LF \ - umulh x10, x5, x5 __LF \ - adcs x17, x17, x10 __LF \ - mul x10, x6, x6 __LF \ - adcs x19, x19, x10 __LF \ - umulh x10, x6, x6 __LF \ - adcs x20, x20, x10 __LF \ - mul x10, x7, x7 __LF \ - adcs x21, x21, x10 __LF \ - umulh x10, x7, x7 __LF \ - adcs x22, x22, x10 __LF \ - mul x10, x8, x8 __LF \ - adcs x23, x23, x10 __LF \ - umulh x10, x8, x8 __LF \ - adcs x24, x24, x10 __LF \ - mul x10, x9, x9 __LF \ - adcs x25, x25, x10 __LF \ - umulh x10, x9, x9 __LF \ - adc x0, x0, x10 __LF \ - ldr x1, [P1+64] __LF \ - add x1, x1, x1 __LF \ - mul x10, x1, x2 __LF \ - adds x19, x19, x10 __LF \ - umulh x10, x1, x2 __LF \ - adcs x20, x20, x10 __LF \ - mul x10, x1, x4 __LF \ - adcs x21, x21, x10 __LF \ - umulh x10, x1, x4 __LF \ - adcs x22, x22, x10 __LF \ - mul x10, x1, x6 __LF \ - adcs x23, x23, x10 __LF \ - umulh x10, x1, x6 __LF \ - adcs x24, x24, x10 __LF \ - mul x10, x1, x8 __LF \ - adcs x25, x25, x10 __LF \ - umulh x10, x1, x8 __LF \ - adcs x0, x0, x10 __LF \ - lsr x4, x1, #1 __LF \ - mul x4, x4, x4 __LF \ - adc x4, x4, xzr __LF \ - mul x10, x1, x3 __LF \ - adds x20, x20, x10 __LF \ - umulh x10, x1, x3 __LF \ - adcs x21, x21, x10 __LF \ - mul x10, x1, x5 __LF \ - adcs x22, x22, x10 __LF \ - umulh x10, x1, x5 __LF \ - adcs x23, x23, x10 __LF \ - mul x10, x1, x7 __LF \ - adcs x24, x24, x10 __LF \ - umulh x10, x1, x7 __LF \ - adcs x25, x25, x10 __LF \ - mul x10, x1, x9 __LF \ - adcs x0, x0, x10 __LF \ - umulh x10, x1, x9 __LF \ - adc x4, x4, x10 __LF \ - mul x2, x2, x2 __LF \ - cmp xzr, xzr __LF \ - extr x10, x20, x19, #9 __LF \ - adcs x2, x2, x10 __LF \ - extr x10, x21, x20, #9 __LF \ - adcs x11, x11, x10 __LF \ - extr x10, x22, x21, #9 __LF \ - adcs x12, x12, x10 __LF \ - extr x10, x23, x22, #9 __LF \ - adcs x13, x13, x10 __LF \ - extr x10, x24, x23, #9 __LF \ - adcs x14, x14, x10 __LF \ - extr x10, x25, x24, #9 __LF \ - adcs x15, x15, x10 __LF \ - extr x10, x0, x25, #9 __LF \ - adcs x16, x16, x10 __LF \ - extr x10, x4, x0, #9 __LF \ - adcs x17, x17, x10 __LF \ - orr x19, x19, #0xfffffffffffffe00 __LF \ - lsr x10, x4, #9 __LF \ - adcs x19, x19, x10 __LF \ - sbcs x2, x2, xzr __LF \ - sbcs x11, x11, xzr __LF \ - sbcs x12, x12, xzr __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbcs x15, x15, xzr __LF \ - sbcs x16, x16, xzr __LF \ - sbcs x17, x17, xzr __LF \ - sbc x19, x19, xzr __LF \ - and x19, x19, #0x1ff __LF \ - stp x2, x11, [P0] __LF \ - stp x12, x13, [P0+16] __LF \ - stp x14, x15, [P0+32] __LF \ - stp x16, x17, [P0+48] __LF \ - str x19, [P0+64] - -// Corresponds exactly to bignum_sub_p521 - -#define sub_p521(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - ldp x9, x10, [P1+32] __LF \ - ldp x4, x3, [P2+32] __LF \ - sbcs x9, x9, x4 __LF \ - sbcs x10, x10, x3 __LF \ - ldp x11, x12, [P1+48] __LF \ - ldp x4, x3, [P2+48] __LF \ - sbcs x11, x11, x4 __LF \ - sbcs x12, x12, x3 __LF \ - ldr x13, [P1+64] __LF \ - ldr x4, [P2+64] __LF \ - sbcs x13, x13, x4 __LF \ - sbcs x5, x5, xzr __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbcs x11, x11, xzr __LF \ - sbcs x12, x12, xzr __LF \ - sbcs x13, x13, xzr __LF \ - and x13, x13, #0x1ff __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] __LF \ - stp x9, x10, [P0+32] __LF \ - stp x11, x12, [P0+48] __LF \ - str x13, [P0+64] - -S2N_BN_SYMBOL(p521_jmixadd_alt): - CFI_START - -// Save regs and make room on stack for temporary variables - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_PUSH2(x25,x26) - CFI_PUSH2(x27,x28) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations - - sqr_p521(zp2,z_1) - mul_p521(y2a,z_1,y_2) - - mul_p521(x2a,zp2,x_2) - mul_p521(y2a,zp2,y2a) - - sub_p521(xd,x2a,x_1) - sub_p521(yd,y2a,y_1) - - sqr_p521(zz,xd) - sqr_p521(ww,yd) - - mul_p521(zzx1,zz,x_1) - mul_p521(zzx2,zz,x2a) - - sub_p521(resx,ww,zzx1) - sub_p521(t1,zzx2,zzx1) - - mul_p521(resz,xd,z_1) - - sub_p521(resx,resx,zzx2) - - sub_p521(t2,zzx1,resx) - - mul_p521(t1,t1,y_1) - mul_p521(t2,yd,t2) - - sub_p521(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - ldp x0, x1, [z_1] - orr x0, x0, x1 - ldp x2, x3, [z_1+16] - orr x2, x2, x3 - ldp x4, x5, [z_1+32] - orr x4, x4, x5 - ldp x6, x7, [z_1+48] - orr x6, x6, x7 - ldr x8, [z_1+64] - orr x0, x0, x2 - orr x4, x4, x6 - orr x0, x0, x4 - orr x0, x0, x8 - cmp x0, xzr - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with an extra z = 1 -// coordinate, hence giving 0 + p2 = p2 for the final result. - - ldp x0, x1, [resx] - ldp x20, x21, [x_2] - csel x0, x0, x20, ne - csel x1, x1, x21, ne - ldp x2, x3, [resx+16] - ldp x20, x21, [x_2+16] - csel x2, x2, x20, ne - csel x3, x3, x21, ne - ldp x4, x5, [resx+32] - ldp x20, x21, [x_2+32] - csel x4, x4, x20, ne - csel x5, x5, x21, ne - ldp x6, x7, [resx+48] - ldp x20, x21, [x_2+48] - csel x6, x6, x20, ne - csel x7, x7, x21, ne - ldr x8, [resx+64] - ldr x20, [x_2+64] - csel x8, x8, x20, ne - - ldp x10, x11, [resy] - ldp x20, x21, [y_2] - csel x10, x10, x20, ne - csel x11, x11, x21, ne - ldp x12, x13, [resy+16] - ldp x20, x21, [y_2+16] - csel x12, x12, x20, ne - csel x13, x13, x21, ne - ldp x14, x15, [resy+32] - ldp x20, x21, [y_2+32] - csel x14, x14, x20, ne - csel x15, x15, x21, ne - ldp x16, x17, [resy+48] - ldp x20, x21, [y_2+48] - csel x16, x16, x20, ne - csel x17, x17, x21, ne - ldr x19, [resy+64] - ldr x20, [y_2+64] - csel x19, x19, x20, ne - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [x_3+32] - stp x6, x7, [x_3+48] - str x8, [x_3+64] - stp x10, x11, [y_3] - stp x12, x13, [y_3+16] - stp x14, x15, [y_3+32] - stp x16, x17, [y_3+48] - str x19, [y_3+64] - - ldp x0, x1, [resz] - mov x20, #1 - csel x0, x0, x20, ne - csel x1, x1, xzr, ne - ldp x2, x3, [resz+16] - csel x2, x2, xzr, ne - csel x3, x3, xzr, ne - ldp x4, x5, [resz+32] - csel x4, x4, xzr, ne - csel x5, x5, xzr, ne - ldp x6, x7, [resz+48] - csel x6, x6, xzr, ne - csel x7, x7, xzr, ne - ldr x8, [resz+64] - csel x8, x8, xzr, ne - - stp x0, x1, [z_3] - stp x2, x3, [z_3+16] - stp x4, x5, [z_3+32] - stp x6, x7, [z_3+48] - str x8, [z_3+64] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - - CFI_POP2(x27,x28) - CFI_POP2(x25,x26) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p521_jmixadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_montmul_p521_base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_montmul_p521_base.S deleted file mode 100644 index 1e8c0514a09..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_montmul_p521_base.S +++ /dev/null @@ -1,593 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^576) mod p_521 -// Inputs x[9], y[9]; output z[9] -// -// extern void bignum_montmul_p521_base -// (uint64_t z[static 9], uint64_t x[static 9], uint64_t y[static 9]); -// -// Does z := (x * y / 2^576) mod p_521, assuming x < p_521, y < p_521. This -// means the Montgomery base is the "native size" 2^{9*64} = 2^576; since -// p_521 is a Mersenne prime the basic modular multiplication bignum_mul_p521_base -// can be considered a Montgomery operation to base 2^521. -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p521_base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p521_base) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro computing [c,b,a] := [b,a] + (x - y) * (w - z), adding with carry -// to the [b,a] components but leaving CF aligned with the c term, which is -// a sign bitmask for (x - y) * (w - z). Continued add-with-carry operations -// with [c,...,c] will continue the carry chain correctly starting from -// the c position if desired to add to a longer term of the form [...,b,a]. -// -// c,h,l,t should all be different and t,h should not overlap w,z. -// --------------------------------------------------------------------------- - -#define muldiffnadd(b,a,x,y,w,z) \ - subs t, x, y __LF \ - cneg t, t, cc __LF \ - csetm c, cc __LF \ - subs h, w, z __LF \ - cneg h, h, cc __LF \ - mul l, t, h __LF \ - umulh h, t, h __LF \ - cinv c, c, cc __LF \ - adds xzr, c, #1 __LF \ - eor l, l, c __LF \ - adcs a, a, l __LF \ - eor h, h, c __LF \ - adcs b, b, h - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define b0 x7 -#define b1 x8 -#define b2 x9 -#define b3 x10 - -#define s0 x11 -#define s1 x12 -#define s2 x13 -#define s3 x14 -#define s4 x15 -#define s5 x16 -#define s6 x17 -#define s7 x19 -#define s8 x20 - -#define c x21 -#define h x22 -#define l x23 -#define t x24 -#define s x25 -#define u x26 - -// --------------------------------------------------------------------------- -// Core 4x4->8 ADK multiplication macro -// Does [s7,s6,s5,s4,s3,s2,s1,s0] = [a3,a2,a1,a0] * [b3,b2,b1,b0] -// --------------------------------------------------------------------------- - -#define mul4 \ -/* First accumulate all the "simple" products as [s7,s6,s5,s4,s0] */ \ - \ - mul s0, a0, b0 __LF \ - mul s4, a1, b1 __LF \ - mul s5, a2, b2 __LF \ - mul s6, a3, b3 __LF \ - \ - umulh s7, a0, b0 __LF \ - adds s4, s4, s7 __LF \ - umulh s7, a1, b1 __LF \ - adcs s5, s5, s7 __LF \ - umulh s7, a2, b2 __LF \ - adcs s6, s6, s7 __LF \ - umulh s7, a3, b3 __LF \ - adc s7, s7, xzr __LF \ - \ -/* Multiply by B + 1 to get [s7;s6;s5;s4;s1;s0] */ \ - \ - adds s1, s4, s0 __LF \ - adcs s4, s5, s4 __LF \ - adcs s5, s6, s5 __LF \ - adcs s6, s7, s6 __LF \ - adc s7, xzr, s7 __LF \ - \ -/* Multiply by B^2 + 1 to get [s7;s6;s5;s4;s3;s2;s1;s0] */ \ - \ - adds s2, s4, s0 __LF \ - adcs s3, s5, s1 __LF \ - adcs s4, s6, s4 __LF \ - adcs s5, s7, s5 __LF \ - adcs s6, xzr, s6 __LF \ - adc s7, xzr, s7 __LF \ - \ -/* Now add in all the "complicated" terms. */ \ - \ - muldiffnadd(s6,s5, a2,a3, b3,b2) __LF \ - adc s7, s7, c __LF \ - \ - muldiffnadd(s2,s1, a0,a1, b1,b0) __LF \ - adcs s3, s3, c __LF \ - adcs s4, s4, c __LF \ - adcs s5, s5, c __LF \ - adcs s6, s6, c __LF \ - adc s7, s7, c __LF \ - \ - muldiffnadd(s5,s4, a1,a3, b3,b1) __LF \ - adcs s6, s6, c __LF \ - adc s7, s7, c __LF \ - \ - muldiffnadd(s3,s2, a0,a2, b2,b0) __LF \ - adcs s4, s4, c __LF \ - adcs s5, s5, c __LF \ - adcs s6, s6, c __LF \ - adc s7, s7, c __LF \ - \ - muldiffnadd(s4,s3, a0,a3, b3,b0) __LF \ - adcs s5, s5, c __LF \ - adcs s6, s6, c __LF \ - adc s7, s7, c __LF \ - muldiffnadd(s4,s3, a1,a2, b2,b1) __LF \ - adcs s5, s5, c __LF \ - adcs s6, s6, c __LF \ - adc s7, s7, c \ - -S2N_BN_SYMBOL(bignum_montmul_p521_base): - -// Save registers and make space for the temporary buffer - - stp x19, x20, [sp, #-16]! - stp x21, x22, [sp, #-16]! - stp x23, x24, [sp, #-16]! - stp x25, x26, [sp, #-16]! - sub sp, sp, #80 - -// Load 4-digit low parts and multiply them to get L - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - ldp b0, b1, [y] - ldp b2, b3, [y, #16] - mul4 - -// Shift right 256 bits modulo p_521 and stash in temp buffer - - lsl c, s0, #9 - extr s0, s1, s0, #55 - extr s1, s2, s1, #55 - extr s2, s3, s2, #55 - lsr s3, s3, #55 - stp s4, s5, [sp] - stp s6, s7, [sp, #16] - stp c, s0, [sp, #32] - stp s1, s2, [sp, #48] - str s3, [sp, #64] - -// Load 4-digit low parts and multiply them to get H - - ldp a0, a1, [x, #32] - ldp a2, a3, [x, #48] - ldp b0, b1, [y, #32] - ldp b2, b3, [y, #48] - mul4 - -// Add to the existing temporary buffer and re-stash. -// This gives a result HL congruent to (2^256 * H + L) / 2^256 modulo p_521 - - ldp l, h, [sp] - adds s0, s0, l - adcs s1, s1, h - stp s0, s1, [sp] - ldp l, h, [sp, #16] - adcs s2, s2, l - adcs s3, s3, h - stp s2, s3, [sp, #16] - ldp l, h, [sp, #32] - adcs s4, s4, l - adcs s5, s5, h - stp s4, s5, [sp, #32] - ldp l, h, [sp, #48] - adcs s6, s6, l - adcs s7, s7, h - stp s6, s7, [sp, #48] - ldr c, [sp, #64] - adc c, c, xzr - str c, [sp, #64] - -// Compute t,[a3,a2,a1,a0] = x_hi - x_lo -// and s,[b3,b2,b1,b0] = y_lo - y_hi -// sign-magnitude differences, then XOR overall sign bitmask into s - - ldp l, h, [x] - subs a0, a0, l - sbcs a1, a1, h - ldp l, h, [x, #16] - sbcs a2, a2, l - sbcs a3, a3, h - csetm t, cc - ldp l, h, [y] - subs b0, l, b0 - sbcs b1, h, b1 - ldp l, h, [y, #16] - sbcs b2, l, b2 - sbcs b3, h, b3 - csetm s, cc - - eor a0, a0, t - subs a0, a0, t - eor a1, a1, t - sbcs a1, a1, t - eor a2, a2, t - sbcs a2, a2, t - eor a3, a3, t - sbc a3, a3, t - - eor b0, b0, s - subs b0, b0, s - eor b1, b1, s - sbcs b1, b1, s - eor b2, b2, s - sbcs b2, b2, s - eor b3, b3, s - sbc b3, b3, s - - eor s, s, t - -// Now do yet a third 4x4 multiply to get mid-term product M - - mul4 - -// We now want, at the 256 position, 2^256 * HL + HL + (-1)^s * M -// To keep things positive we use M' = p_521 - M in place of -M, -// and this notion of negation just amounts to complementation in 521 bits. -// Fold in the re-addition of the appropriately scaled lowest 4 words -// The initial result is [s8; b3;b2;b1;b0; s7;s6;s5;s4;s3;s2;s1;s0] -// Rebase it as a 9-word value at the 512 bit position using -// [s8; b3;b2;b1;b0; s7;s6;s5;s4;s3;s2;s1;s0] == -// [s8; b3;b2;b1;b0; s7;s6;s5;s4] + 2^265 * [s3;s2;s1;s0] = -// ([s8; b3;b2;b1;b0] + 2^9 * [s3;s2;s1;s0]); s7;s6;s5;s4] -// -// Accumulate as [s8; b3;b2;b1;b0; s7;s6;s5;s4] but leave out an additional -// small c (s8 + suspended carry) to add at the 256 position here (512 -// overall). This can be added in the next block (to b0 = sum4). - - ldp a0, a1, [sp] - ldp a2, a3, [sp, #16] - - eor s0, s0, s - adds s0, s0, a0 - eor s1, s1, s - adcs s1, s1, a1 - eor s2, s2, s - adcs s2, s2, a2 - eor s3, s3, s - adcs s3, s3, a3 - eor s4, s4, s - - ldp b0, b1, [sp, #32] - ldp b2, b3, [sp, #48] - ldr s8, [sp, #64] - - adcs s4, s4, b0 - eor s5, s5, s - adcs s5, s5, b1 - eor s6, s6, s - adcs s6, s6, b2 - eor s7, s7, s - adcs s7, s7, b3 - adc c, s8, xzr - - adds s4, s4, a0 - adcs s5, s5, a1 - adcs s6, s6, a2 - adcs s7, s7, a3 - and s, s, #0x1FF - lsl t, s0, #9 - orr t, t, s - adcs b0, b0, t - extr t, s1, s0, #55 - adcs b1, b1, t - extr t, s2, s1, #55 - adcs b2, b2, t - extr t, s3, s2, #55 - adcs b3, b3, t - lsr t, s3, #55 - adc s8, t, s8 - -// Augment the total with the contribution from the top little words -// w and v. If we write the inputs as 2^512 * w + x and 2^512 * v + y -// then we are otherwise just doing x * y so we actually need to add -// 2^512 * (2^512 * w * v + w * y + v * x). We do this is an involved -// way chopping x and y into 52-bit chunks so we can do most of the core -// arithmetic using only basic muls, no umulh (since w, v are only 9 bits). -// This does however involve some intricate bit-splicing plus arithmetic. -// To make things marginally less confusing we introduce some new names -// at the human level: x = [c7;...;c0] and y = [d7;...d0], which are -// not all distinct, and [sum8;sum7;...;sum0] for the running sum. -// Also accumulate u = sum1 AND ... AND sum7 for the later comparison - -#define sum0 s4 -#define sum1 s5 -#define sum2 s6 -#define sum3 s7 -#define sum4 b0 -#define sum5 b1 -#define sum6 b2 -#define sum7 b3 -#define sum8 s8 - -#define c0 a0 -#define c1 a1 -#define c2 a2 -#define c3 a0 -#define c4 a1 -#define c5 a2 -#define c6 a0 -#define c7 a1 - -#define d0 s0 -#define d1 s1 -#define d2 s2 -#define d3 s0 -#define d4 s1 -#define d5 s2 -#define d6 s0 -#define d7 s1 - -#define v a3 -#define w s3 - -// 0 * 52 = 64 * 0 + 0 - - ldr v, [y, #64] - ldp c0, c1, [x] - and l, c0, #0x000fffffffffffff - mul l, v, l - ldr w, [x, #64] - ldp d0, d1, [y] - and t, d0, #0x000fffffffffffff - mul t, w, t - add l, l, t - -// 1 * 52 = 64 * 0 + 52 - - extr t, c1, c0, #52 - and t, t, #0x000fffffffffffff - mul h, v, t - extr t, d1, d0, #52 - and t, t, #0x000fffffffffffff - mul t, w, t - add h, h, t - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #12 - adds sum0, sum0, t - -// 2 * 52 = 64 * 1 + 40 - - ldp c2, c3, [x, #16] - ldp d2, d3, [y, #16] - extr t, c2, c1, #40 - and t, t, #0x000fffffffffffff - mul l, v, t - extr t, d2, d1, #40 - and t, t, #0x000fffffffffffff - mul t, w, t - add l, l, t - lsr t, h, #52 - add l, l, t - - lsl h, h, #12 - extr t, l, h, #24 - adcs sum1, sum1, t - -// 3 * 52 = 64 * 2 + 28 - - extr t, c3, c2, #28 - and t, t, #0x000fffffffffffff - mul h, v, t - extr t, d3, d2, #28 - and t, t, #0x000fffffffffffff - mul t, w, t - add h, h, t - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #36 - adcs sum2, sum2, t - and u, sum1, sum2 - -// 4 * 52 = 64 * 3 + 16 -// At this point we also fold in the addition of c at the right place. -// Note that 4 * 64 = 4 * 52 + 48 so we shift c left 48 places to align. - - ldp c4, c5, [x, #32] - ldp d4, d5, [y, #32] - extr t, c4, c3, #16 - and t, t, #0x000fffffffffffff - mul l, v, t - extr t, d4, d3, #16 - and t, t, #0x000fffffffffffff - mul t, w, t - add l, l, t - - lsl c, c, #48 - add l, l, c - - lsr t, h, #52 - add l, l, t - - lsl h, h, #12 - extr t, l, h, #48 - adcs sum3, sum3, t - and u, u, sum3 - -// 5 * 52 = 64 * 4 + 4 - - lsr t, c4, #4 - and t, t, #0x000fffffffffffff - mul h, v, t - lsr t, d4, #4 - and t, t, #0x000fffffffffffff - mul t, w, t - add h, h, t - - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr s, h, l, #60 - -// 6 * 52 = 64 * 4 + 56 - - extr t, c5, c4, #56 - and t, t, #0x000fffffffffffff - mul l, v, t - extr t, d5, d4, #56 - and t, t, #0x000fffffffffffff - mul t, w, t - add l, l, t - - lsr t, h, #52 - add l, l, t - - lsl s, s, #8 - extr t, l, s, #8 - adcs sum4, sum4, t - and u, u, sum4 - -// 7 * 52 = 64 * 5 + 44 - - ldp c6, c7, [x, #48] - ldp d6, d7, [y, #48] - extr t, c6, c5, #44 - and t, t, #0x000fffffffffffff - mul h, v, t - extr t, d6, d5, #44 - and t, t, #0x000fffffffffffff - mul t, w, t - add h, h, t - - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #20 - adcs sum5, sum5, t - and u, u, sum5 - -// 8 * 52 = 64 * 6 + 32 - - extr t, c7, c6, #32 - and t, t, #0x000fffffffffffff - mul l, v, t - extr t, d7, d6, #32 - and t, t, #0x000fffffffffffff - mul t, w, t - add l, l, t - - lsr t, h, #52 - add l, l, t - - lsl h, h, #12 - extr t, l, h, #32 - adcs sum6, sum6, t - and u, u, sum6 - -// 9 * 52 = 64 * 7 + 20 - - lsr t, c7, #20 - mul h, v, t - lsr t, d7, #20 - mul t, w, t - add h, h, t - - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #44 - adcs sum7, sum7, t - and u, u, sum7 - -// Top word - - mul t, v, w - lsr h, h, #44 - add t, t, h - adc sum8, sum8, t - -// Extract the high part h and mask off the low part l = [sum8;sum7;...;sum0] -// but stuff sum8 with 1 bits at the left to ease a comparison below - - lsr h, sum8, #9 - orr sum8, sum8, #~0x1FF - -// Decide whether h + l >= p_521 <=> h + l + 1 >= 2^521. Since this can only -// happen if digits sum7,...sum1 are all 1s, we use the AND of them "u" to -// condense the carry chain, and since we stuffed 1 bits into sum8 we get -// the result in CF without an additional comparison. - - subs xzr, xzr, xzr - adcs xzr, sum0, h - adcs xzr, u, xzr - adcs xzr, sum8, xzr - -// Now if CF is set we want (h + l) - p_521 = (h + l + 1) - 2^521 -// while otherwise we want just h + l. So mask h + l + CF to 521 bits. -// The masking is combined with the writeback in the next block. - - adcs sum0, sum0, h - adcs sum1, sum1, xzr - adcs sum2, sum2, xzr - adcs sum3, sum3, xzr - adcs sum4, sum4, xzr - adcs sum5, sum5, xzr - adcs sum6, sum6, xzr - adcs sum7, sum7, xzr - adc sum8, sum8, xzr - -// The result is actually [sum8;...;sum0] == product / 2^512, since we are -// in the 512 position. For Montgomery we want product / 2^576, so write -// back [sum8;...;sum0] rotated right by 64 bits, as a 521-bit quantity. - - stp sum1, sum2, [z] - stp sum3, sum4, [z, #16] - stp sum5, sum6, [z, #32] - lsl h, sum0, #9 - and sum8, sum8, #0x1FF - orr sum8, sum8, h - stp sum7, sum8, [z, #48] - lsr sum0, sum0, #55 - str sum0, [z, #64] - -// Restore regs and return - - add sp, sp, #80 - ldp x25, x26, [sp], #16 - ldp x23, x24, [sp], #16 - ldp x21, x22, [sp], #16 - ldp x19, x20, [sp], #16 - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_montsqr_p521_base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_montsqr_p521_base.S deleted file mode 100644 index db36339d7f2..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_montsqr_p521_base.S +++ /dev/null @@ -1,625 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^576) mod p_521 -// Input x[9]; output z[9] -// -// extern void bignum_montsqr_p521_base -// (uint64_t z[static 9], uint64_t x[static 9]); -// -// Does z := (x^2 / 2^576) mod p_521, assuming x < p_521. This means the -// Montgomery base is the "native size" 2^{9*64} = 2^576; since p_521 is -// a Mersenne prime the basic modular squaring bignum_sqr_p521_base can be -// considered a Montgomery operation to base 2^521. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p521_base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p521_base) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 -#define b0 x6 -#define b1 x7 -#define b2 x8 -#define b3 x9 - -#define s0 x10 -#define s1 x11 -#define s2 x12 -#define s3 x13 -#define s4 x14 -#define s5 x15 -#define s6 x16 -#define s7 x17 - -#define c x19 -#define h x20 -#define l x21 -#define t x22 -#define u x23 -#define v x24 - -// Aliased to earlier ones we no longer need - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x6 -#define d5 x7 -#define d6 x8 -#define d7 x9 -#define d8 x10 - -S2N_BN_SYMBOL(bignum_montsqr_p521_base): - -// Save registers - - stp x19, x20, [sp, #-16]! - stp x21, x22, [sp, #-16]! - stp x23, x24, [sp, #-16]! - -// Load all the inputs first - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - ldp b0, b1, [x, #32] - ldp b2, b3, [x, #48] - -// Square the upper half with a register-renamed variant of bignum_sqr_4_8 - - mul s2, b0, b2 - mul s7, b1, b3 - umulh t, b0, b2 - subs u, b0, b1 - cneg u, u, cc - csetm s1, cc - subs s0, b3, b2 - cneg s0, s0, cc - mul s6, u, s0 - umulh s0, u, s0 - cinv s1, s1, cc - eor s6, s6, s1 - eor s0, s0, s1 - adds s3, s2, t - adc t, t, xzr - umulh u, b1, b3 - adds s3, s3, s7 - adcs t, t, u - adc u, u, xzr - adds t, t, s7 - adc u, u, xzr - cmn s1, #0x1 - adcs s3, s3, s6 - adcs t, t, s0 - adc u, u, s1 - adds s2, s2, s2 - adcs s3, s3, s3 - adcs t, t, t - adcs u, u, u - adc c, xzr, xzr - mul s0, b0, b0 - mul s6, b1, b1 - mul l, b0, b1 - umulh s1, b0, b0 - umulh s7, b1, b1 - umulh h, b0, b1 - adds s1, s1, l - adcs s6, s6, h - adc s7, s7, xzr - adds s1, s1, l - adcs s6, s6, h - adc s7, s7, xzr - adds s2, s2, s6 - adcs s3, s3, s7 - adcs t, t, xzr - adcs u, u, xzr - adc c, c, xzr - mul s4, b2, b2 - mul s6, b3, b3 - mul l, b2, b3 - umulh s5, b2, b2 - umulh s7, b3, b3 - umulh h, b2, b3 - adds s5, s5, l - adcs s6, s6, h - adc s7, s7, xzr - adds s5, s5, l - adcs s6, s6, h - adc s7, s7, xzr - adds s4, s4, t - adcs s5, s5, u - adcs s6, s6, c - adc s7, s7, xzr - -// Augment the high part with the contribution from the top little word C. -// If we write the input as 2^512 * C + x then we are otherwise just doing -// x^2, so we need to add to the high part 2^512 * C^2 + (2 * C) * x. -// Accumulate it as [c;s7;...;s0] = H'. Since 2 * C is only 10 bits long -// we multiply 52-bit chunks of the x digits by 2 * C and solve the overlap -// with non-overflowing addition to get 52-bit chunks of the result with -// similar alignment. Then we stitch these back together and add them into -// the running total. This is quite a bit of palaver, but it avoids using -// the standard 2-part multiplications involving umulh, and on target -// microarchitectures seems to improve performance by about 5%. We could -// equally well use 53 or 54 since they are still <= 64 - 10, but below -// 52 we would end up using more multiplications. - - ldr c, [x, #64] - add u, c, c - mul c, c, c - -// 0 * 52 = 64 * 0 + 0 - - and l, a0, #0x000fffffffffffff - mul l, u, l - -// 1 * 52 = 64 * 0 + 52 - - extr h, a1, a0, #52 - and h, h, #0x000fffffffffffff - mul h, u, h - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #12 - adds s0, s0, t - -// 2 * 52 = 64 * 1 + 40 - - extr l, a2, a1, #40 - and l, l, #0x000fffffffffffff - mul l, u, l - lsr t, h, #52 - add l, l, t - - lsl h, h, #12 - extr t, l, h, #24 - adcs s1, s1, t - -// 3 * 52 = 64 * 2 + 28 - - extr h, a3, a2, #28 - and h, h, #0x000fffffffffffff - mul h, u, h - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #36 - adcs s2, s2, t - -// 4 * 52 = 64 * 3 + 16 - - extr l, b0, a3, #16 - and l, l, #0x000fffffffffffff - mul l, u, l - lsr t, h, #52 - add l, l, t - - lsl h, h, #12 - extr t, l, h, #48 - adcs s3, s3, t - -// 5 * 52 = 64 * 4 + 4 - - lsr h, b0, #4 - and h, h, #0x000fffffffffffff - mul h, u, h - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr v, h, l, #60 - -// 6 * 52 = 64 * 4 + 56 - - extr l, b1, b0, #56 - and l, l, #0x000fffffffffffff - mul l, u, l - lsr t, h, #52 - add l, l, t - - lsl v, v, #8 - extr t, l, v, #8 - adcs s4, s4, t - -// 7 * 52 = 64 * 5 + 44 - - extr h, b2, b1, #44 - and h, h, #0x000fffffffffffff - mul h, u, h - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #20 - adcs s5, s5, t - -// 8 * 52 = 64 * 6 + 32 - - extr l, b3, b2, #32 - and l, l, #0x000fffffffffffff - mul l, u, l - lsr t, h, #52 - add l, l, t - - lsl h, h, #12 - extr t, l, h, #32 - adcs s6, s6, t - -// 9 * 52 = 64 * 7 + 20 - - lsr h, b3, #20 - mul h, u, h - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #44 - adcs s7, s7, t - -// Top word - - lsr h, h, #44 - adc c, c, h - -// Rotate [c;s7;...;s0] before storing in the buffer. -// We want to add 2^512 * H', which splitting H' at bit 9 is -// 2^521 * H_top + 2^512 * H_bot == 2^512 * H_bot + H_top (mod p_521) - - extr l, s1, s0, #9 - extr h, s2, s1, #9 - stp l, h, [z] - - extr l, s3, s2, #9 - extr h, s4, s3, #9 - stp l, h, [z, #16] - - extr l, s5, s4, #9 - extr h, s6, s5, #9 - stp l, h, [z, #32] - - extr l, s7, s6, #9 - extr h, c, s7, #9 - stp l, h, [z, #48] - - and t, s0, #0x1FF - lsr c, c, #9 - add t, t, c - str t, [z, #64] - -// Square the lower half with an analogous variant of bignum_sqr_4_8 - - mul s2, a0, a2 - mul s7, a1, a3 - umulh t, a0, a2 - subs u, a0, a1 - cneg u, u, cc - csetm s1, cc - subs s0, a3, a2 - cneg s0, s0, cc - mul s6, u, s0 - umulh s0, u, s0 - cinv s1, s1, cc - eor s6, s6, s1 - eor s0, s0, s1 - adds s3, s2, t - adc t, t, xzr - umulh u, a1, a3 - adds s3, s3, s7 - adcs t, t, u - adc u, u, xzr - adds t, t, s7 - adc u, u, xzr - cmn s1, #0x1 - adcs s3, s3, s6 - adcs t, t, s0 - adc u, u, s1 - adds s2, s2, s2 - adcs s3, s3, s3 - adcs t, t, t - adcs u, u, u - adc c, xzr, xzr - mul s0, a0, a0 - mul s6, a1, a1 - mul l, a0, a1 - umulh s1, a0, a0 - umulh s7, a1, a1 - umulh h, a0, a1 - adds s1, s1, l - adcs s6, s6, h - adc s7, s7, xzr - adds s1, s1, l - adcs s6, s6, h - adc s7, s7, xzr - adds s2, s2, s6 - adcs s3, s3, s7 - adcs t, t, xzr - adcs u, u, xzr - adc c, c, xzr - mul s4, a2, a2 - mul s6, a3, a3 - mul l, a2, a3 - umulh s5, a2, a2 - umulh s7, a3, a3 - umulh h, a2, a3 - adds s5, s5, l - adcs s6, s6, h - adc s7, s7, xzr - adds s5, s5, l - adcs s6, s6, h - adc s7, s7, xzr - adds s4, s4, t - adcs s5, s5, u - adcs s6, s6, c - adc s7, s7, xzr - -// Add it directly to the existing buffer - - ldp l, h, [z] - adds l, l, s0 - adcs h, h, s1 - stp l, h, [z] - - ldp l, h, [z, #16] - adcs l, l, s2 - adcs h, h, s3 - stp l, h, [z, #16] - - ldp l, h, [z, #32] - adcs l, l, s4 - adcs h, h, s5 - stp l, h, [z, #32] - - ldp l, h, [z, #48] - adcs l, l, s6 - adcs h, h, s7 - stp l, h, [z, #48] - - ldr t, [z, #64] - adc t, t, xzr - str t, [z, #64] - -// Now get the cross-product in [s7,...,s0] with variant of bignum_mul_4_8 - - mul s0, a0, b0 - mul s4, a1, b1 - mul s5, a2, b2 - mul s6, a3, b3 - umulh s7, a0, b0 - adds s4, s4, s7 - umulh s7, a1, b1 - adcs s5, s5, s7 - umulh s7, a2, b2 - adcs s6, s6, s7 - umulh s7, a3, b3 - adc s7, s7, xzr - adds s1, s4, s0 - adcs s4, s5, s4 - adcs s5, s6, s5 - adcs s6, s7, s6 - adc s7, xzr, s7 - adds s2, s4, s0 - adcs s3, s5, s1 - adcs s4, s6, s4 - adcs s5, s7, s5 - adcs s6, xzr, s6 - adc s7, xzr, s7 - subs t, a2, a3 - cneg t, t, cc - csetm c, cc - subs h, b3, b2 - cneg h, h, cc - mul l, t, h - umulh h, t, h - cinv c, c, cc - cmn c, #0x1 - eor l, l, c - adcs s5, s5, l - eor h, h, c - adcs s6, s6, h - adc s7, s7, c - subs t, a0, a1 - cneg t, t, cc - csetm c, cc - subs h, b1, b0 - cneg h, h, cc - mul l, t, h - umulh h, t, h - cinv c, c, cc - cmn c, #0x1 - eor l, l, c - adcs s1, s1, l - eor h, h, c - adcs s2, s2, h - adcs s3, s3, c - adcs s4, s4, c - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - subs t, a1, a3 - cneg t, t, cc - csetm c, cc - subs h, b3, b1 - cneg h, h, cc - mul l, t, h - umulh h, t, h - cinv c, c, cc - cmn c, #0x1 - eor l, l, c - adcs s4, s4, l - eor h, h, c - adcs s5, s5, h - adcs s6, s6, c - adc s7, s7, c - subs t, a0, a2 - cneg t, t, cc - csetm c, cc - subs h, b2, b0 - cneg h, h, cc - mul l, t, h - umulh h, t, h - cinv c, c, cc - cmn c, #0x1 - eor l, l, c - adcs s2, s2, l - eor h, h, c - adcs s3, s3, h - adcs s4, s4, c - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - subs t, a0, a3 - cneg t, t, cc - csetm c, cc - subs h, b3, b0 - cneg h, h, cc - mul l, t, h - umulh h, t, h - cinv c, c, cc - cmn c, #0x1 - eor l, l, c - adcs s3, s3, l - eor h, h, c - adcs s4, s4, h - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - subs t, a1, a2 - cneg t, t, cc - csetm c, cc - subs h, b2, b1 - cneg h, h, cc - mul l, t, h - umulh h, t, h - cinv c, c, cc - cmn c, #0x1 - eor l, l, c - adcs s3, s3, l - eor h, h, c - adcs s4, s4, h - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - -// Let the cross product be M. We want to add 2^256 * 2 * M to the buffer -// Split M into M_top (248 bits) and M_bot (264 bits), so we add -// 2^521 * M_top + 2^257 * M_bot == 2^257 * M_bot + M_top (mod p_521) -// Accumulate the (non-reduced in general) 9-word answer [d8;...;d0] -// As this sum is built, accumulate t = AND of words d7...d1 to help -// in condensing the carry chain in the comparison that comes next - - ldp l, h, [z] - extr d0, s5, s4, #8 - adds d0, d0, l - extr d1, s6, s5, #8 - adcs d1, d1, h - - ldp l, h, [z, #16] - extr d2, s7, s6, #8 - adcs d2, d2, l - and t, d1, d2 - lsr d3, s7, #8 - adcs d3, d3, h - and t, t, d3 - - ldp l, h, [z, #32] - lsl d4, s0, #1 - adcs d4, d4, l - and t, t, d4 - extr d5, s1, s0, #63 - adcs d5, d5, h - and t, t, d5 - - ldp l, h, [z, #48] - extr d6, s2, s1, #63 - adcs d6, d6, l - and t, t, d6 - extr d7, s3, s2, #63 - adcs d7, d7, h - and t, t, d7 - - ldr l, [z, #64] - extr d8, s4, s3, #63 - and d8, d8, #0x1FF - adc d8, l, d8 - -// Extract the high part h and mask off the low part l = [d8;d7;...;d0] -// but stuff d8 with 1 bits at the left to ease a comparison below - - lsr h, d8, #9 - orr d8, d8, #~0x1FF - -// Decide whether h + l >= p_521 <=> h + l + 1 >= 2^521. Since this can only -// happen if digits d7,...d1 are all 1s, we use the AND of them "t" to -// condense the carry chain, and since we stuffed 1 bits into d8 we get -// the result in CF without an additional comparison. - - subs xzr, xzr, xzr - adcs xzr, d0, h - adcs xzr, t, xzr - adcs xzr, d8, xzr - -// Now if CF is set we want (h + l) - p_521 = (h + l + 1) - 2^521 -// while otherwise we want just h + l. So mask h + l + CF to 521 bits. -// This masking also gets rid of the stuffing with 1s we did above. - - adcs d0, d0, h - adcs d1, d1, xzr - adcs d2, d2, xzr - adcs d3, d3, xzr - adcs d4, d4, xzr - adcs d5, d5, xzr - adcs d6, d6, xzr - adcs d7, d7, xzr - adc d8, d8, xzr - and d8, d8, #0x1FF - -// So far, this has been the same as a pure modular squaring. -// Now finally the Montgomery ingredient, which is just a 521-bit -// rotation by 9*64 - 521 = 55 bits right. - - lsl c, d0, #9 - extr d0, d1, d0, #55 - extr d1, d2, d1, #55 - extr d2, d3, d2, #55 - extr d3, d4, d3, #55 - orr d8, d8, c - extr d4, d5, d4, #55 - extr d5, d6, d5, #55 - extr d6, d7, d6, #55 - extr d7, d8, d7, #55 - lsr d8, d8, #55 - -// Store the final result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - stp d6, d7, [z, #48] - str d8, [z, #64] - -// Restore regs and return - - ldp x23, x24, [sp], #16 - ldp x21, x22, [sp], #16 - ldp x19, x20, [sp], #16 - - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_mul_p521_base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_mul_p521_base.S deleted file mode 100644 index 7ebe8a1244b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_mul_p521_base.S +++ /dev/null @@ -1,592 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply modulo p_521, z := (x * y) mod p_521, assuming x and y reduced -// Inputs x[9], y[9]; output z[9] -// -// extern void bignum_mul_p521_base -// (uint64_t z[static 9], uint64_t x[static 9], uint64_t y[static 9]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_p521_base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_p521_base) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro computing [c,b,a] := [b,a] + (x - y) * (w - z), adding with carry -// to the [b,a] components but leaving CF aligned with the c term, which is -// a sign bitmask for (x - y) * (w - z). Continued add-with-carry operations -// with [c,...,c] will continue the carry chain correctly starting from -// the c position if desired to add to a longer term of the form [...,b,a]. -// -// c,h,l,t should all be different and t,h should not overlap w,z. -// --------------------------------------------------------------------------- - -#define muldiffnadd(b,a,x,y,w,z) \ - subs t, x, y __LF \ - cneg t, t, cc __LF \ - csetm c, cc __LF \ - subs h, w, z __LF \ - cneg h, h, cc __LF \ - mul l, t, h __LF \ - umulh h, t, h __LF \ - cinv c, c, cc __LF \ - adds xzr, c, #1 __LF \ - eor l, l, c __LF \ - adcs a, a, l __LF \ - eor h, h, c __LF \ - adcs b, b, h - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define b0 x7 -#define b1 x8 -#define b2 x9 -#define b3 x10 - -#define s0 x11 -#define s1 x12 -#define s2 x13 -#define s3 x14 -#define s4 x15 -#define s5 x16 -#define s6 x17 -#define s7 x19 -#define s8 x20 - -#define c x21 -#define h x22 -#define l x23 -#define t x24 -#define s x25 -#define u x26 - -// --------------------------------------------------------------------------- -// Core 4x4->8 ADK multiplication macro -// Does [s7,s6,s5,s4,s3,s2,s1,s0] = [a3,a2,a1,a0] * [b3,b2,b1,b0] -// --------------------------------------------------------------------------- - -#define mul4 \ -/* First accumulate all the "simple" products as [s7,s6,s5,s4,s0] */ \ - \ - mul s0, a0, b0 __LF \ - mul s4, a1, b1 __LF \ - mul s5, a2, b2 __LF \ - mul s6, a3, b3 __LF \ - \ - umulh s7, a0, b0 __LF \ - adds s4, s4, s7 __LF \ - umulh s7, a1, b1 __LF \ - adcs s5, s5, s7 __LF \ - umulh s7, a2, b2 __LF \ - adcs s6, s6, s7 __LF \ - umulh s7, a3, b3 __LF \ - adc s7, s7, xzr __LF \ - \ -/* Multiply by B + 1 to get [s7;s6;s5;s4;s1;s0] */ \ - \ - adds s1, s4, s0 __LF \ - adcs s4, s5, s4 __LF \ - adcs s5, s6, s5 __LF \ - adcs s6, s7, s6 __LF \ - adc s7, xzr, s7 __LF \ - \ -/* Multiply by B^2 + 1 to get [s7;s6;s5;s4;s3;s2;s1;s0] */ \ - \ - adds s2, s4, s0 __LF \ - adcs s3, s5, s1 __LF \ - adcs s4, s6, s4 __LF \ - adcs s5, s7, s5 __LF \ - adcs s6, xzr, s6 __LF \ - adc s7, xzr, s7 __LF \ - \ -/* Now add in all the "complicated" terms. */ \ - \ - muldiffnadd(s6,s5, a2,a3, b3,b2) __LF \ - adc s7, s7, c __LF \ - \ - muldiffnadd(s2,s1, a0,a1, b1,b0) __LF \ - adcs s3, s3, c __LF \ - adcs s4, s4, c __LF \ - adcs s5, s5, c __LF \ - adcs s6, s6, c __LF \ - adc s7, s7, c __LF \ - \ - muldiffnadd(s5,s4, a1,a3, b3,b1) __LF \ - adcs s6, s6, c __LF \ - adc s7, s7, c __LF \ - \ - muldiffnadd(s3,s2, a0,a2, b2,b0) __LF \ - adcs s4, s4, c __LF \ - adcs s5, s5, c __LF \ - adcs s6, s6, c __LF \ - adc s7, s7, c __LF \ - \ - muldiffnadd(s4,s3, a0,a3, b3,b0) __LF \ - adcs s5, s5, c __LF \ - adcs s6, s6, c __LF \ - adc s7, s7, c __LF \ - muldiffnadd(s4,s3, a1,a2, b2,b1) __LF \ - adcs s5, s5, c __LF \ - adcs s6, s6, c __LF \ - adc s7, s7, c \ - -S2N_BN_SYMBOL(bignum_mul_p521_base): - -// Save registers and make space for the temporary buffer - - stp x19, x20, [sp, #-16]! - stp x21, x22, [sp, #-16]! - stp x23, x24, [sp, #-16]! - stp x25, x26, [sp, #-16]! - sub sp, sp, #80 - -// Load 4-digit low parts and multiply them to get L - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - ldp b0, b1, [y] - ldp b2, b3, [y, #16] - mul4 - -// Shift right 256 bits modulo p_521 and stash in temp buffer - - lsl c, s0, #9 - extr s0, s1, s0, #55 - extr s1, s2, s1, #55 - extr s2, s3, s2, #55 - lsr s3, s3, #55 - stp s4, s5, [sp] - stp s6, s7, [sp, #16] - stp c, s0, [sp, #32] - stp s1, s2, [sp, #48] - str s3, [sp, #64] - -// Load 4-digit low parts and multiply them to get H - - ldp a0, a1, [x, #32] - ldp a2, a3, [x, #48] - ldp b0, b1, [y, #32] - ldp b2, b3, [y, #48] - mul4 - -// Add to the existing temporary buffer and re-stash. -// This gives a result HL congruent to (2^256 * H + L) / 2^256 modulo p_521 - - ldp l, h, [sp] - adds s0, s0, l - adcs s1, s1, h - stp s0, s1, [sp] - ldp l, h, [sp, #16] - adcs s2, s2, l - adcs s3, s3, h - stp s2, s3, [sp, #16] - ldp l, h, [sp, #32] - adcs s4, s4, l - adcs s5, s5, h - stp s4, s5, [sp, #32] - ldp l, h, [sp, #48] - adcs s6, s6, l - adcs s7, s7, h - stp s6, s7, [sp, #48] - ldr c, [sp, #64] - adc c, c, xzr - str c, [sp, #64] - -// Compute t,[a3,a2,a1,a0] = x_hi - x_lo -// and s,[b3,b2,b1,b0] = y_lo - y_hi -// sign-magnitude differences, then XOR overall sign bitmask into s - - ldp l, h, [x] - subs a0, a0, l - sbcs a1, a1, h - ldp l, h, [x, #16] - sbcs a2, a2, l - sbcs a3, a3, h - csetm t, cc - ldp l, h, [y] - subs b0, l, b0 - sbcs b1, h, b1 - ldp l, h, [y, #16] - sbcs b2, l, b2 - sbcs b3, h, b3 - csetm s, cc - - eor a0, a0, t - subs a0, a0, t - eor a1, a1, t - sbcs a1, a1, t - eor a2, a2, t - sbcs a2, a2, t - eor a3, a3, t - sbc a3, a3, t - - eor b0, b0, s - subs b0, b0, s - eor b1, b1, s - sbcs b1, b1, s - eor b2, b2, s - sbcs b2, b2, s - eor b3, b3, s - sbc b3, b3, s - - eor s, s, t - -// Now do yet a third 4x4 multiply to get mid-term product M - - mul4 - -// We now want, at the 256 position, 2^256 * HL + HL + (-1)^s * M -// To keep things positive we use M' = p_521 - M in place of -M, -// and this notion of negation just amounts to complementation in 521 bits. -// Fold in the re-addition of the appropriately scaled lowest 4 words -// The initial result is [s8; b3;b2;b1;b0; s7;s6;s5;s4;s3;s2;s1;s0] -// Rebase it as a 9-word value at the 512 bit position using -// [s8; b3;b2;b1;b0; s7;s6;s5;s4;s3;s2;s1;s0] == -// [s8; b3;b2;b1;b0; s7;s6;s5;s4] + 2^265 * [s3;s2;s1;s0] = -// ([s8; b3;b2;b1;b0] + 2^9 * [s3;s2;s1;s0]); s7;s6;s5;s4] -// -// Accumulate as [s8; b3;b2;b1;b0; s7;s6;s5;s4] but leave out an additional -// small c (s8 + suspended carry) to add at the 256 position here (512 -// overall). This can be added in the next block (to b0 = sum4). - - ldp a0, a1, [sp] - ldp a2, a3, [sp, #16] - - eor s0, s0, s - adds s0, s0, a0 - eor s1, s1, s - adcs s1, s1, a1 - eor s2, s2, s - adcs s2, s2, a2 - eor s3, s3, s - adcs s3, s3, a3 - eor s4, s4, s - - ldp b0, b1, [sp, #32] - ldp b2, b3, [sp, #48] - ldr s8, [sp, #64] - - adcs s4, s4, b0 - eor s5, s5, s - adcs s5, s5, b1 - eor s6, s6, s - adcs s6, s6, b2 - eor s7, s7, s - adcs s7, s7, b3 - adc c, s8, xzr - - adds s4, s4, a0 - adcs s5, s5, a1 - adcs s6, s6, a2 - adcs s7, s7, a3 - and s, s, #0x1FF - lsl t, s0, #9 - orr t, t, s - adcs b0, b0, t - extr t, s1, s0, #55 - adcs b1, b1, t - extr t, s2, s1, #55 - adcs b2, b2, t - extr t, s3, s2, #55 - adcs b3, b3, t - lsr t, s3, #55 - adc s8, t, s8 - -// Augment the total with the contribution from the top little words -// w and v. If we write the inputs as 2^512 * w + x and 2^512 * v + y -// then we are otherwise just doing x * y so we actually need to add -// 2^512 * (2^512 * w * v + w * y + v * x). We do this is an involved -// way chopping x and y into 52-bit chunks so we can do most of the core -// arithmetic using only basic muls, no umulh (since w, v are only 9 bits). -// This does however involve some intricate bit-splicing plus arithmetic. -// To make things marginally less confusing we introduce some new names -// at the human level: x = [c7;...;c0] and y = [d7;...d0], which are -// not all distinct, and [sum8;sum7;...;sum0] for the running sum. -// Also accumulate u = sum1 AND ... AND sum7 for the later comparison - -#define sum0 s4 -#define sum1 s5 -#define sum2 s6 -#define sum3 s7 -#define sum4 b0 -#define sum5 b1 -#define sum6 b2 -#define sum7 b3 -#define sum8 s8 - -#define c0 a0 -#define c1 a1 -#define c2 a2 -#define c3 a0 -#define c4 a1 -#define c5 a2 -#define c6 a0 -#define c7 a1 - -#define d0 s0 -#define d1 s1 -#define d2 s2 -#define d3 s0 -#define d4 s1 -#define d5 s2 -#define d6 s0 -#define d7 s1 - -#define v a3 -#define w s3 - -// 0 * 52 = 64 * 0 + 0 - - ldr v, [y, #64] - ldp c0, c1, [x] - and l, c0, #0x000fffffffffffff - mul l, v, l - ldr w, [x, #64] - ldp d0, d1, [y] - and t, d0, #0x000fffffffffffff - mul t, w, t - add l, l, t - -// 1 * 52 = 64 * 0 + 52 - - extr t, c1, c0, #52 - and t, t, #0x000fffffffffffff - mul h, v, t - extr t, d1, d0, #52 - and t, t, #0x000fffffffffffff - mul t, w, t - add h, h, t - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #12 - adds sum0, sum0, t - -// 2 * 52 = 64 * 1 + 40 - - ldp c2, c3, [x, #16] - ldp d2, d3, [y, #16] - extr t, c2, c1, #40 - and t, t, #0x000fffffffffffff - mul l, v, t - extr t, d2, d1, #40 - and t, t, #0x000fffffffffffff - mul t, w, t - add l, l, t - lsr t, h, #52 - add l, l, t - - lsl h, h, #12 - extr t, l, h, #24 - adcs sum1, sum1, t - -// 3 * 52 = 64 * 2 + 28 - - extr t, c3, c2, #28 - and t, t, #0x000fffffffffffff - mul h, v, t - extr t, d3, d2, #28 - and t, t, #0x000fffffffffffff - mul t, w, t - add h, h, t - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #36 - adcs sum2, sum2, t - and u, sum1, sum2 - -// 4 * 52 = 64 * 3 + 16 -// At this point we also fold in the addition of c at the right place. -// Note that 4 * 64 = 4 * 52 + 48 so we shift c left 48 places to align. - - ldp c4, c5, [x, #32] - ldp d4, d5, [y, #32] - extr t, c4, c3, #16 - and t, t, #0x000fffffffffffff - mul l, v, t - extr t, d4, d3, #16 - and t, t, #0x000fffffffffffff - mul t, w, t - add l, l, t - - lsl c, c, #48 - add l, l, c - - lsr t, h, #52 - add l, l, t - - lsl h, h, #12 - extr t, l, h, #48 - adcs sum3, sum3, t - and u, u, sum3 - -// 5 * 52 = 64 * 4 + 4 - - lsr t, c4, #4 - and t, t, #0x000fffffffffffff - mul h, v, t - lsr t, d4, #4 - and t, t, #0x000fffffffffffff - mul t, w, t - add h, h, t - - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr s, h, l, #60 - -// 6 * 52 = 64 * 4 + 56 - - extr t, c5, c4, #56 - and t, t, #0x000fffffffffffff - mul l, v, t - extr t, d5, d4, #56 - and t, t, #0x000fffffffffffff - mul t, w, t - add l, l, t - - lsr t, h, #52 - add l, l, t - - lsl s, s, #8 - extr t, l, s, #8 - adcs sum4, sum4, t - and u, u, sum4 - -// 7 * 52 = 64 * 5 + 44 - - ldp c6, c7, [x, #48] - ldp d6, d7, [y, #48] - extr t, c6, c5, #44 - and t, t, #0x000fffffffffffff - mul h, v, t - extr t, d6, d5, #44 - and t, t, #0x000fffffffffffff - mul t, w, t - add h, h, t - - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #20 - adcs sum5, sum5, t - and u, u, sum5 - -// 8 * 52 = 64 * 6 + 32 - - extr t, c7, c6, #32 - and t, t, #0x000fffffffffffff - mul l, v, t - extr t, d7, d6, #32 - and t, t, #0x000fffffffffffff - mul t, w, t - add l, l, t - - lsr t, h, #52 - add l, l, t - - lsl h, h, #12 - extr t, l, h, #32 - adcs sum6, sum6, t - and u, u, sum6 - -// 9 * 52 = 64 * 7 + 20 - - lsr t, c7, #20 - mul h, v, t - lsr t, d7, #20 - mul t, w, t - add h, h, t - - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #44 - adcs sum7, sum7, t - and u, u, sum7 - -// Top word - - mul t, v, w - lsr h, h, #44 - add t, t, h - adc sum8, sum8, t - -// Extract the high part h and mask off the low part l = [sum8;sum7;...;sum0] -// but stuff sum8 with 1 bits at the left to ease a comparison below - - lsr h, sum8, #9 - orr sum8, sum8, #~0x1FF - -// Decide whether h + l >= p_521 <=> h + l + 1 >= 2^521. Since this can only -// happen if digits sum7,...sum1 are all 1s, we use the AND of them "u" to -// condense the carry chain, and since we stuffed 1 bits into sum8 we get -// the result in CF without an additional comparison. - - subs xzr, xzr, xzr - adcs xzr, sum0, h - adcs xzr, u, xzr - adcs xzr, sum8, xzr - -// Now if CF is set we want (h + l) - p_521 = (h + l + 1) - 2^521 -// while otherwise we want just h + l. So mask h + l + CF to 521 bits. -// We don't need to mask away bits above 521 since they disappear below. - - adcs sum0, sum0, h - adcs sum1, sum1, xzr - adcs sum2, sum2, xzr - adcs sum3, sum3, xzr - adcs sum4, sum4, xzr - adcs sum5, sum5, xzr - adcs sum6, sum6, xzr - adcs sum7, sum7, xzr - adc sum8, sum8, xzr - -// The result is actually 2^512 * [sum8;...;sum0] == 2^-9 * [sum8;...;sum0] -// so we rotate right by 9 bits - - and h, sum0, #0x1FF - extr sum0, sum1, sum0, #9 - extr sum1, sum2, sum1, #9 - stp sum0, sum1, [z] - extr sum2, sum3, sum2, #9 - extr sum3, sum4, sum3, #9 - stp sum2, sum3, [z, #16] - extr sum4, sum5, sum4, #9 - extr sum5, sum6, sum5, #9 - stp sum4, sum5, [z, #32] - extr sum6, sum7, sum6, #9 - extr sum7, sum8, sum7, #9 - stp sum6, sum7, [z, #48] - str h, [z, #64] - -// Restore regs and return - - add sp, sp, #80 - ldp x25, x26, [sp], #16 - ldp x23, x24, [sp], #16 - ldp x21, x22, [sp], #16 - ldp x19, x20, [sp], #16 - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_sqr_p521_base.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_sqr_p521_base.S deleted file mode 100644 index 07d17ef9a3b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/p521/unopt/bignum_sqr_p521_base.S +++ /dev/null @@ -1,603 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square modulo p_521, z := (x^2) mod p_521, assuming x reduced -// Input x[9]; output z[9] -// -// extern void bignum_sqr_p521_base (uint64_t z[static 9], uint64_t x[static 9]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_p521_base) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_p521_base) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 -#define b0 x6 -#define b1 x7 -#define b2 x8 -#define b3 x9 - -#define s0 x10 -#define s1 x11 -#define s2 x12 -#define s3 x13 -#define s4 x14 -#define s5 x15 -#define s6 x16 -#define s7 x17 - -#define c x19 -#define h x20 -#define l x21 -#define t x22 -#define u x23 -#define v x24 - -// Aliased to earlier ones we no longer need - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x6 -#define d5 x7 -#define d6 x8 -#define d7 x9 -#define d8 x10 - -S2N_BN_SYMBOL(bignum_sqr_p521_base): - -// Save registers - - stp x19, x20, [sp, #-16]! - stp x21, x22, [sp, #-16]! - stp x23, x24, [sp, #-16]! - -// Load all the inputs first - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - ldp b0, b1, [x, #32] - ldp b2, b3, [x, #48] - -// Square the upper half with a register-renamed variant of bignum_sqr_4_8 - - mul s2, b0, b2 - mul s7, b1, b3 - umulh t, b0, b2 - subs u, b0, b1 - cneg u, u, cc - csetm s1, cc - subs s0, b3, b2 - cneg s0, s0, cc - mul s6, u, s0 - umulh s0, u, s0 - cinv s1, s1, cc - eor s6, s6, s1 - eor s0, s0, s1 - adds s3, s2, t - adc t, t, xzr - umulh u, b1, b3 - adds s3, s3, s7 - adcs t, t, u - adc u, u, xzr - adds t, t, s7 - adc u, u, xzr - cmn s1, #0x1 - adcs s3, s3, s6 - adcs t, t, s0 - adc u, u, s1 - adds s2, s2, s2 - adcs s3, s3, s3 - adcs t, t, t - adcs u, u, u - adc c, xzr, xzr - mul s0, b0, b0 - mul s6, b1, b1 - mul l, b0, b1 - umulh s1, b0, b0 - umulh s7, b1, b1 - umulh h, b0, b1 - adds s1, s1, l - adcs s6, s6, h - adc s7, s7, xzr - adds s1, s1, l - adcs s6, s6, h - adc s7, s7, xzr - adds s2, s2, s6 - adcs s3, s3, s7 - adcs t, t, xzr - adcs u, u, xzr - adc c, c, xzr - mul s4, b2, b2 - mul s6, b3, b3 - mul l, b2, b3 - umulh s5, b2, b2 - umulh s7, b3, b3 - umulh h, b2, b3 - adds s5, s5, l - adcs s6, s6, h - adc s7, s7, xzr - adds s5, s5, l - adcs s6, s6, h - adc s7, s7, xzr - adds s4, s4, t - adcs s5, s5, u - adcs s6, s6, c - adc s7, s7, xzr - -// Augment the high part with the contribution from the top little word C. -// If we write the input as 2^512 * C + x then we are otherwise just doing -// x^2, so we need to add to the high part 2^512 * C^2 + (2 * C) * x. -// Accumulate it as [c;s7;...;s0] = H'. Since 2 * C is only 10 bits long -// we multiply 52-bit chunks of the x digits by 2 * C and solve the overlap -// with non-overflowing addition to get 52-bit chunks of the result with -// similar alignment. Then we stitch these back together and add them into -// the running total. This is quite a bit of palaver, but it avoids using -// the standard 2-part multiplications involving umulh, and on target -// microarchitectures seems to improve performance by about 5%. We could -// equally well use 53 or 54 since they are still <= 64 - 10, but below -// 52 we would end up using more multiplications. - - ldr c, [x, #64] - add u, c, c - mul c, c, c - -// 0 * 52 = 64 * 0 + 0 - - and l, a0, #0x000fffffffffffff - mul l, u, l - -// 1 * 52 = 64 * 0 + 52 - - extr h, a1, a0, #52 - and h, h, #0x000fffffffffffff - mul h, u, h - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #12 - adds s0, s0, t - -// 2 * 52 = 64 * 1 + 40 - - extr l, a2, a1, #40 - and l, l, #0x000fffffffffffff - mul l, u, l - lsr t, h, #52 - add l, l, t - - lsl h, h, #12 - extr t, l, h, #24 - adcs s1, s1, t - -// 3 * 52 = 64 * 2 + 28 - - extr h, a3, a2, #28 - and h, h, #0x000fffffffffffff - mul h, u, h - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #36 - adcs s2, s2, t - -// 4 * 52 = 64 * 3 + 16 - - extr l, b0, a3, #16 - and l, l, #0x000fffffffffffff - mul l, u, l - lsr t, h, #52 - add l, l, t - - lsl h, h, #12 - extr t, l, h, #48 - adcs s3, s3, t - -// 5 * 52 = 64 * 4 + 4 - - lsr h, b0, #4 - and h, h, #0x000fffffffffffff - mul h, u, h - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr v, h, l, #60 - -// 6 * 52 = 64 * 4 + 56 - - extr l, b1, b0, #56 - and l, l, #0x000fffffffffffff - mul l, u, l - lsr t, h, #52 - add l, l, t - - lsl v, v, #8 - extr t, l, v, #8 - adcs s4, s4, t - -// 7 * 52 = 64 * 5 + 44 - - extr h, b2, b1, #44 - and h, h, #0x000fffffffffffff - mul h, u, h - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #20 - adcs s5, s5, t - -// 8 * 52 = 64 * 6 + 32 - - extr l, b3, b2, #32 - and l, l, #0x000fffffffffffff - mul l, u, l - lsr t, h, #52 - add l, l, t - - lsl h, h, #12 - extr t, l, h, #32 - adcs s6, s6, t - -// 9 * 52 = 64 * 7 + 20 - - lsr h, b3, #20 - mul h, u, h - lsr t, l, #52 - add h, h, t - - lsl l, l, #12 - extr t, h, l, #44 - adcs s7, s7, t - -// Top word - - lsr h, h, #44 - adc c, c, h - -// Rotate [c;s7;...;s0] before storing in the buffer. -// We want to add 2^512 * H', which splitting H' at bit 9 is -// 2^521 * H_top + 2^512 * H_bot == 2^512 * H_bot + H_top (mod p_521) - - extr l, s1, s0, #9 - extr h, s2, s1, #9 - stp l, h, [z] - - extr l, s3, s2, #9 - extr h, s4, s3, #9 - stp l, h, [z, #16] - - extr l, s5, s4, #9 - extr h, s6, s5, #9 - stp l, h, [z, #32] - - extr l, s7, s6, #9 - extr h, c, s7, #9 - stp l, h, [z, #48] - - and t, s0, #0x1FF - lsr c, c, #9 - add t, t, c - str t, [z, #64] - -// Square the lower half with an analogous variant of bignum_sqr_4_8 - - mul s2, a0, a2 - mul s7, a1, a3 - umulh t, a0, a2 - subs u, a0, a1 - cneg u, u, cc - csetm s1, cc - subs s0, a3, a2 - cneg s0, s0, cc - mul s6, u, s0 - umulh s0, u, s0 - cinv s1, s1, cc - eor s6, s6, s1 - eor s0, s0, s1 - adds s3, s2, t - adc t, t, xzr - umulh u, a1, a3 - adds s3, s3, s7 - adcs t, t, u - adc u, u, xzr - adds t, t, s7 - adc u, u, xzr - cmn s1, #0x1 - adcs s3, s3, s6 - adcs t, t, s0 - adc u, u, s1 - adds s2, s2, s2 - adcs s3, s3, s3 - adcs t, t, t - adcs u, u, u - adc c, xzr, xzr - mul s0, a0, a0 - mul s6, a1, a1 - mul l, a0, a1 - umulh s1, a0, a0 - umulh s7, a1, a1 - umulh h, a0, a1 - adds s1, s1, l - adcs s6, s6, h - adc s7, s7, xzr - adds s1, s1, l - adcs s6, s6, h - adc s7, s7, xzr - adds s2, s2, s6 - adcs s3, s3, s7 - adcs t, t, xzr - adcs u, u, xzr - adc c, c, xzr - mul s4, a2, a2 - mul s6, a3, a3 - mul l, a2, a3 - umulh s5, a2, a2 - umulh s7, a3, a3 - umulh h, a2, a3 - adds s5, s5, l - adcs s6, s6, h - adc s7, s7, xzr - adds s5, s5, l - adcs s6, s6, h - adc s7, s7, xzr - adds s4, s4, t - adcs s5, s5, u - adcs s6, s6, c - adc s7, s7, xzr - -// Add it directly to the existing buffer - - ldp l, h, [z] - adds l, l, s0 - adcs h, h, s1 - stp l, h, [z] - - ldp l, h, [z, #16] - adcs l, l, s2 - adcs h, h, s3 - stp l, h, [z, #16] - - ldp l, h, [z, #32] - adcs l, l, s4 - adcs h, h, s5 - stp l, h, [z, #32] - - ldp l, h, [z, #48] - adcs l, l, s6 - adcs h, h, s7 - stp l, h, [z, #48] - - ldr t, [z, #64] - adc t, t, xzr - str t, [z, #64] - -// Now get the cross-product in [s7,...,s0] with variant of bignum_mul_4_8 - - mul s0, a0, b0 - mul s4, a1, b1 - mul s5, a2, b2 - mul s6, a3, b3 - umulh s7, a0, b0 - adds s4, s4, s7 - umulh s7, a1, b1 - adcs s5, s5, s7 - umulh s7, a2, b2 - adcs s6, s6, s7 - umulh s7, a3, b3 - adc s7, s7, xzr - adds s1, s4, s0 - adcs s4, s5, s4 - adcs s5, s6, s5 - adcs s6, s7, s6 - adc s7, xzr, s7 - adds s2, s4, s0 - adcs s3, s5, s1 - adcs s4, s6, s4 - adcs s5, s7, s5 - adcs s6, xzr, s6 - adc s7, xzr, s7 - subs t, a2, a3 - cneg t, t, cc - csetm c, cc - subs h, b3, b2 - cneg h, h, cc - mul l, t, h - umulh h, t, h - cinv c, c, cc - cmn c, #0x1 - eor l, l, c - adcs s5, s5, l - eor h, h, c - adcs s6, s6, h - adc s7, s7, c - subs t, a0, a1 - cneg t, t, cc - csetm c, cc - subs h, b1, b0 - cneg h, h, cc - mul l, t, h - umulh h, t, h - cinv c, c, cc - cmn c, #0x1 - eor l, l, c - adcs s1, s1, l - eor h, h, c - adcs s2, s2, h - adcs s3, s3, c - adcs s4, s4, c - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - subs t, a1, a3 - cneg t, t, cc - csetm c, cc - subs h, b3, b1 - cneg h, h, cc - mul l, t, h - umulh h, t, h - cinv c, c, cc - cmn c, #0x1 - eor l, l, c - adcs s4, s4, l - eor h, h, c - adcs s5, s5, h - adcs s6, s6, c - adc s7, s7, c - subs t, a0, a2 - cneg t, t, cc - csetm c, cc - subs h, b2, b0 - cneg h, h, cc - mul l, t, h - umulh h, t, h - cinv c, c, cc - cmn c, #0x1 - eor l, l, c - adcs s2, s2, l - eor h, h, c - adcs s3, s3, h - adcs s4, s4, c - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - subs t, a0, a3 - cneg t, t, cc - csetm c, cc - subs h, b3, b0 - cneg h, h, cc - mul l, t, h - umulh h, t, h - cinv c, c, cc - cmn c, #0x1 - eor l, l, c - adcs s3, s3, l - eor h, h, c - adcs s4, s4, h - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - subs t, a1, a2 - cneg t, t, cc - csetm c, cc - subs h, b2, b1 - cneg h, h, cc - mul l, t, h - umulh h, t, h - cinv c, c, cc - cmn c, #0x1 - eor l, l, c - adcs s3, s3, l - eor h, h, c - adcs s4, s4, h - adcs s5, s5, c - adcs s6, s6, c - adc s7, s7, c - -// Let the cross product be M. We want to add 2^256 * 2 * M to the buffer -// Split M into M_top (248 bits) and M_bot (264 bits), so we add -// 2^521 * M_top + 2^257 * M_bot == 2^257 * M_bot + M_top (mod p_521) -// Accumulate the (non-reduced in general) 9-word answer [d8;...;d0] -// As this sum is built, accumulate t = AND of words d7...d1 to help -// in condensing the carry chain in the comparison that comes next - - ldp l, h, [z] - extr d0, s5, s4, #8 - adds d0, d0, l - extr d1, s6, s5, #8 - adcs d1, d1, h - - ldp l, h, [z, #16] - extr d2, s7, s6, #8 - adcs d2, d2, l - and t, d1, d2 - lsr d3, s7, #8 - adcs d3, d3, h - and t, t, d3 - - ldp l, h, [z, #32] - lsl d4, s0, #1 - adcs d4, d4, l - and t, t, d4 - extr d5, s1, s0, #63 - adcs d5, d5, h - and t, t, d5 - - ldp l, h, [z, #48] - extr d6, s2, s1, #63 - adcs d6, d6, l - and t, t, d6 - extr d7, s3, s2, #63 - adcs d7, d7, h - and t, t, d7 - - ldr l, [z, #64] - extr d8, s4, s3, #63 - and d8, d8, #0x1FF - adc d8, l, d8 - -// Extract the high part h and mask off the low part l = [d8;d7;...;d0] -// but stuff d8 with 1 bits at the left to ease a comparison below - - lsr h, d8, #9 - orr d8, d8, #~0x1FF - -// Decide whether h + l >= p_521 <=> h + l + 1 >= 2^521. Since this can only -// happen if digits d7,...d1 are all 1s, we use the AND of them "t" to -// condense the carry chain, and since we stuffed 1 bits into d8 we get -// the result in CF without an additional comparison. - - subs xzr, xzr, xzr - adcs xzr, d0, h - adcs xzr, t, xzr - adcs xzr, d8, xzr - -// Now if CF is set we want (h + l) - p_521 = (h + l + 1) - 2^521 -// while otherwise we want just h + l. So mask h + l + CF to 521 bits. -// This masking also gets rid of the stuffing with 1s we did above. - - adcs d0, d0, h - adcs d1, d1, xzr - adcs d2, d2, xzr - adcs d3, d3, xzr - adcs d4, d4, xzr - adcs d5, d5, xzr - adcs d6, d6, xzr - adcs d7, d7, xzr - adc d8, d8, xzr - and d8, d8, #0x1FF - -// Store the final result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - stp d4, d5, [z, #32] - stp d6, d7, [z, #48] - str d8, [z, #64] - -// Restore regs and return - - ldp x23, x24, [sp], #16 - ldp x21, x22, [sp], #16 - ldp x19, x20, [sp], #16 - - ret - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/Makefile b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/Makefile deleted file mode 100644 index 5ba07a7d7fc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/Makefile +++ /dev/null @@ -1,56 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - -# If actually on an ARM8 machine, just use the GNU assembler (as). Otherwise -# use a cross-assembling version so that the code can still be assembled -# and the proofs checked against the object files (though you won't be able -# to run code without additional emulation infrastructure). The aarch64 -# cross-assembling version can be installed manually by something like: -# -# sudo apt-get install binutils-aarch64-linux-gnu - -UNAME_RESULT=$(shell uname -p) - -ifeq ($(UNAME_RESULT),aarch64) -GAS=as -else -GAS=aarch64-linux-gnu-as -endif - -# List of object files - -OBJ = bignum_add_p256k1.o \ - bignum_cmul_p256k1.o \ - bignum_deamont_p256k1.o \ - bignum_demont_p256k1.o \ - bignum_double_p256k1.o \ - bignum_half_p256k1.o \ - bignum_mod_n256k1_4.o \ - bignum_mod_p256k1_4.o \ - bignum_montmul_p256k1.o \ - bignum_montmul_p256k1_alt.o \ - bignum_montsqr_p256k1.o \ - bignum_montsqr_p256k1_alt.o \ - bignum_mul_p256k1.o \ - bignum_mul_p256k1_alt.o \ - bignum_neg_p256k1.o \ - bignum_optneg_p256k1.o \ - bignum_sqr_p256k1.o \ - bignum_sqr_p256k1_alt.o \ - bignum_sub_p256k1.o \ - bignum_tomont_p256k1.o \ - bignum_triple_p256k1.o \ - secp256k1_jadd.o \ - secp256k1_jadd_alt.o \ - secp256k1_jdouble.o \ - secp256k1_jdouble_alt.o \ - secp256k1_jmixadd.o \ - secp256k1_jmixadd_alt.o - -%.o : %.S ; $(CC) -E -I../../include $< | $(GAS) -o $@ - - -default: $(OBJ); - -clean:; rm -f *.o *.correct diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_add_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_add_p256k1.S deleted file mode 100644 index 0e845b1f89d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_add_p256k1.S +++ /dev/null @@ -1,84 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Add modulo p_256k1, z := (x + y) mod p_256k1, assuming x and y reduced -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_add_p256k1(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_add_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_add_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_add_p256k1) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 -#define c x3 -#define l x4 -#define d0 x5 -#define d1 x6 -#define d2 x7 -#define d3 x8 -#define dd x9 - -S2N_BN_SYMBOL(bignum_add_p256k1): - CFI_START - -// First just add the numbers as z = x + y = 2^256 * c + [d3; d2; d1; d0] -// Also create dd = d3 AND d2 AND d1 to condense the later comparison - - ldp d0, d1, [x] - ldp l, c, [y] - adds d0, d0, l - adcs d1, d1, c - ldp d2, d3, [x, #16] - ldp l, c, [y, #16] - adcs d2, d2, l - and dd, d1, d2 - adcs d3, d3, c - and dd, dd, d3 - adc c, xzr, xzr - -// Let l = 4294968273 so that p_256k1 = 2^256 - l - - mov l, #977 - orr l, l, #0x100000000 - -// Decide whether z >= p_256k1 <=> z + 4294968273 >= 2^256 - - adds xzr, d0, l - adcs xzr, dd, xzr - adcs c, c, xzr - -// Now c <> 0 <=> z >= p_256k1, so mask the constant l accordingly - - csel l, l, xzr, ne - -// If z >= p_256k1 do z := z - p_256k1, i.e. add l in 4 digits - - adds d0, d0, l - adcs d1, d1, xzr - adcs d2, d2, xzr - adc d3, d3, xzr - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_add_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_cmul_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_cmul_p256k1.S deleted file mode 100644 index c09dcb7b59f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_cmul_p256k1.S +++ /dev/null @@ -1,101 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_256k1, z := (c * x) mod p_256k1, assuming -// x reduced -// Inputs c, x[4]; output z[4] -// -// extern void bignum_cmul_p256k1(uint64_t z[static 4], uint64_t c, -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = c, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p256k1) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p256k1_alt) - .text - .balign 4 - -#define z x0 -#define m x1 -#define x x2 - -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 -#define a0 x7 -#define a1 x8 - -#define a2 x9 -#define c x9 - -#define a3 x10 -#define h x10 -#define q x10 - - -S2N_BN_SYMBOL(bignum_cmul_p256k1): - -S2N_BN_SYMBOL(bignum_cmul_p256k1_alt): - CFI_START - -// First do the multiply, straightforwardly to get [h;d3;d2;d1;d0] - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - mul d0, m, a0 - mul d1, m, a1 - mul d2, m, a2 - mul d3, m, a3 - umulh a0, m, a0 - umulh a1, m, a1 - umulh a2, m, a2 - umulh h, m, a3 - adds d1, d1, a0 - adcs d2, d2, a1 - adcs d3, d3, a2 - adcs h, h, xzr - -// Now the quotient estimate is q = h + 1, and then we do the reduction, -// writing z = [d3;d2;d1;d0], as z' = (2^256 * h + z) - q * p_256k1 = -// (2^256 * h + z) - q * (2^256 - 4294968273) = -2^256 + (z + 4294968273 * q) - - add q, h, #1 - mov c, #977 - orr c, c, #0x100000000 - mul a0, q, c - umulh a1, q, c - adds d0, d0, a0 - adcs d1, d1, a1 - adcs d2, d2, xzr - adcs d3, d3, xzr - -// Because of the implicit -2^256, CF means >= 0 so z' is the answer; ~CF -// means z' < 0 so we add p_256k1, which in 4 digits means subtracting c. - - csel c, c, xzr, cc - subs d0, d0, c - sbcs d1, d1, xzr - sbcs d2, d2, xzr - sbc d3, d3, xzr - -// Finally store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_deamont_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_deamont_p256k1.S deleted file mode 100644 index d5437aea72f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_deamont_p256k1.S +++ /dev/null @@ -1,115 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^256) mod p_256k1, -// Input x[4]; output z[4] -// -// extern void bignum_deamont_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Convert a 4-digit bignum x out of its (optionally almost) Montgomery form, -// "almost" meaning any 4-digit input will work, with no range restriction. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_deamont_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_deamont_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_deamont_p256k1) - .text - .balign 4 - -// Input parameters - -#define z x0 -#define x x1 - -// Rotating registers for the intermediate windows - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 - -// Other temporaries - -#define t x6 -#define w x7 -#define c x8 -#define dd x9 - -S2N_BN_SYMBOL(bignum_deamont_p256k1): - CFI_START - -// Load input and set up constants c = 4294968273 so p_256k1 = 2^256 - c, -// and w the negated multiplicative inverse p_256k1 * w == -1 (mod 2^64). - - ldp d0, d1, [x] - movz w, #0x3531 - movk w, #0xd225, lsl #16 - ldp d2, d3, [x, #16] - movk w, #0x091d, lsl #32 - movk w, #0xd838, lsl #48 - mov c, #977 - orr c, c, #0x100000000 - -// Four stages of Montgomery reduction, rotating the register window -// Let dd be the AND of all 4 words of the cofactor q as it is computed - - mul d0, w, d0 - umulh t, d0, c - subs d1, d1, t - - mul d1, w, d1 - umulh t, d1, c - and dd, d0, d1 - sbcs d2, d2, t - - mul d2, w, d2 - umulh t, d2, c - and dd, dd, d2 - sbcs d3, d3, t - - mul d3, w, d3 - umulh t, d3, c - and dd, dd, d3 - sbcs d0, d0, t - - sbcs d1, d1, xzr - sbcs d2, d2, xzr - sbc d3, d3, xzr - -// The result thus far is z = (x + q * p_256k1) / 2^256. Note that -// z < p_256k1 <=> x < (2^256 - q) * p_256k1, and since -// x < 2^256 < 2 * p_256k1, we have that *if* q < 2^256 - 1 then -// z < p_256k1. Conversely if q = 2^256 - 1 then since -// x + q * p_256k1 == 0 (mod 2^256) we have x == p_256k1 (mod 2^256) -// and thus x = p_256k1, and z >= p_256k1 (in fact z = p_256k1). -// So in summary z < p_256k1 <=> ~(q = 2^256 - 1) <=> ~(x = p_256k1). -// and hence iff q is all 1s, or equivalently dd is all 1s, we -// correct by subtracting p_256k1 to get 0. Since this is only one -// case we compute the result more explicitly rather than doing -// arithmetic with carry propagation. - - add c, c, d0 - cmp dd, #-1 - csel d0, c, d0, eq - csel d1, xzr, d1, eq - csel d2, xzr, d2, eq - csel d3, xzr, d3, eq - -// Write back result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_deamont_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_demont_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_demont_p256k1.S deleted file mode 100644 index 7c7eaebd5cd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_demont_p256k1.S +++ /dev/null @@ -1,92 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^256) mod p_256k1, -// assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_demont_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// This assumes the input is < p_256k1 for correctness. If this is not the -// case, use the variant "bignum_deamont_p256k1" instead. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_p256k1) - .text - .balign 4 - -// Input parameters - -#define z x0 -#define x x1 - -// Rotating registers for the intermediate windows - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 - -// Other temporaries - -#define t x6 -#define w x7 -#define c x8 - -S2N_BN_SYMBOL(bignum_demont_p256k1): - CFI_START - -// Load input and set up constants c = 4294968273 so p_256k1 = 2^256 - c, -// and w the negated multiplicative inverse p_256k1 * w == -1 (mod 2^64). - - ldp d0, d1, [x] - movz w, #0x3531 - movk w, #0xd225, lsl #16 - ldp d2, d3, [x, #16] - movk w, #0x091d, lsl #32 - movk w, #0xd838, lsl #48 - mov c, #977 - orr c, c, #0x100000000 - -// Four stages of Montgomery reduction, rotating the register window - - mul d0, w, d0 - umulh t, d0, c - subs d1, d1, t - - mul d1, w, d1 - umulh t, d1, c - sbcs d2, d2, t - - mul d2, w, d2 - umulh t, d2, c - sbcs d3, d3, t - - mul d3, w, d3 - umulh t, d3, c - sbcs d0, d0, t - - sbcs d1, d1, xzr - sbcs d2, d2, xzr - sbc d3, d3, xzr - -// Write back result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_double_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_double_p256k1.S deleted file mode 100644 index 640ed5ec633..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_double_p256k1.S +++ /dev/null @@ -1,81 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo p_256k1, z := (2 * x) mod p_256k1, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_double_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_double_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_double_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_double_p256k1) - .text - .balign 4 - -#define z x0 -#define x x1 -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define c x6 -#define dd x7 -#define l x8 - -S2N_BN_SYMBOL(bignum_double_p256k1): - CFI_START - -// Load the inputs and double top-down as z = 2^256 * c + [d3;d2;d1;d0] -// While doing this, create an AND dd of [d3;d2;d1] to condense comparison - - ldp d2, d3, [x, #16] - lsr c, d3, #63 - extr d3, d3, d2, #63 - ldp d0, d1, [x] - extr d2, d2, d1, #63 - and dd, d2, d3 - extr d1, d1, d0, #63 - and dd, dd, d1 - lsl d0, d0, #1 - -// Let l = 4294968273 so that p_256k1 = 2^256 - l - - mov l, #977 - orr l, l, #0x100000000 - -// Decide whether z >= p_256k1 <=> z + 4294968273 >= 2^256 - - adds xzr, d0, l - adcs xzr, dd, xzr - adcs c, c, xzr - -// Now c <> 0 <=> z >= p_256k1, so mask the constant l accordingly - - csel l, l, xzr, ne - -// If z >= p_256k1 do z := z - p_256k1, i.e. add l in 4 digits - - adds d0, d0, l - adcs d1, d1, xzr - adcs d2, d2, xzr - adc d3, d3, xzr - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_double_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_half_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_half_p256k1.S deleted file mode 100644 index 09358135729..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_half_p256k1.S +++ /dev/null @@ -1,73 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Halve modulo p_256k1, z := (x / 2) mod p_256k1, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_half_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_half_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_half_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_half_p256k1) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define c x6 - -S2N_BN_SYMBOL(bignum_half_p256k1): - CFI_START - -// Load the 4 digits of x - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Let b be the LSB of the input (i.e. whether it is odd). -// Create c = 4294968273 * b - - mov c, #977 - orr c, c, #0x100000000 - tst d0, #1 - csel c, c, xzr, ne - -// We want (x + b * p_256k1) / 2 where b is that LSB, in {0,1}. -// That amounts to (2^256 * b + x - 4294968273 * b) / 2, and -// modulo 4 words that's the same as ([2^256 * c + x] - c) / 2. -// So do that subtraction and shift a place right as we go. - - subs d0, d0, c - sbcs d1, d1, xzr - extr d0, d1, d0, #1 - sbcs d2, d2, xzr - extr d1, d2, d1, #1 - sbcs d3, d3, xzr - extr d2, d3, d2, #1 - sbc c, c, xzr - extr d3, c, d3, #1 - -// Store back and return - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_half_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mod_n256k1_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mod_n256k1_4.S deleted file mode 100644 index 3ce6606815d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mod_n256k1_4.S +++ /dev/null @@ -1,86 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_mod_n256k1_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Reduction is modulo the group order of the secp256k1 curve. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n256k1_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n256k1_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n256k1_4) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define n0 x2 -#define n1 x3 -#define n2 x4 -#define n3 x5 - -#define d0 x6 -#define d1 x7 -#define d2 x8 -#define d3 x9 - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(bignum_mod_n256k1_4): - CFI_START - -// Load the complicated three words of n_256k1, the other being all 1s - - movbig( n0, #0xbfd2, #0x5e8c, #0xd036, #0x4141) - movbig( n1, #0xbaae, #0xdce6, #0xaf48, #0xa03b) - mov n2, 0xFFFFFFFFFFFFFFFE - -// Load the input number - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Do the subtraction. Since word 3 of n_256k1 is all 1s, that can be -// done by adding zero with carry, thanks to the inverted carry. - - subs n0, d0, n0 - sbcs n1, d1, n1 - sbcs n2, d2, n2 - adcs n3, d3, xzr - -// Now if the carry is *clear* (inversion at work) the subtraction carried -// and hence we should have done nothing, so we reset each n_i = d_i - - csel n0, d0, n0, cc - csel n1, d1, n1, cc - csel n2, d2, n2, cc - csel n3, d3, n3, cc - -// Store the end result - - stp n0, n1, [z] - stp n2, n3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n256k1_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mod_p256k1_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mod_p256k1_4.S deleted file mode 100644 index de3033c7f2e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mod_p256k1_4.S +++ /dev/null @@ -1,70 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_mod_p256k1_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p256k1_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p256k1_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p256k1_4) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d x6 -#define c x7 - -S2N_BN_SYMBOL(bignum_mod_p256k1_4): - CFI_START - -// Load the inputs as [d3;d2;d1;d0] and let d be an AND of [d3;d2;d1] to -// condense the comparison below. - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - and d, d1, d2 - and d, d, d3 - -// Compare x >= p_256k1 = 2^256 - 4294968273 using condensed carry: -// we get a carry from the lowest digit and all other digits are 1. -// We end up with c and d as adjusted digits for x - p_256k1 if so. - - mov c, #977 - orr c, c, #0x100000000 - adds c, c, d0 - adcs d, d, xzr - -// If indeed x >= p_256k1 then x := x - p_256k1, using c and d - - csel d0, d0, c, cc - csel d1, d1, d, cc - csel d2, d2, d, cc - csel d3, d3, d, cc - -// Store the end result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p256k1_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montmul_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montmul_p256k1.S deleted file mode 100644 index d69dd659c1e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montmul_p256k1.S +++ /dev/null @@ -1,284 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_256k1 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_256k1, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_256k1 (in particular this is true if we are in -// the "usual" case x < p_256k1 and y < p_256k1). -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p256k1) - .text - .balign 4 - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -// --------------------------------------------------------------------------- -// Macro returning (c,h,l) = 3-word 1s complement (x - y) * (w - z) -// c,h,l,t should all be different -// t,h should not overlap w,z -// --------------------------------------------------------------------------- - -#define muldiffn(c,h,l, t, x,y, w,z) \ - subs t, x, y __LF \ - cneg t, t, cc __LF \ - csetm c, cc __LF \ - subs h, w, z __LF \ - cneg h, h, cc __LF \ - mul l, t, h __LF \ - umulh h, t, h __LF \ - cinv c, c, cc __LF \ - eor l, l, c __LF \ - eor h, h, c - -// --------------------------------------------------------------------------- -// Core two-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d5;d4;d3;d2], modifying the -// existing contents of [d3;d2;d1] and generating d4 and d5, while -// using t1, t2, and t3 as temporaries. It's OK if d4 == d0 and d5 == d1. -// --------------------------------------------------------------------------- - -#define montreds2(d5,d4,d3,d2,d1,d0) \ - movbig(t2, 0xd838, #0x091d, #0xd225, #0x3531) __LF \ - mul d4, t2, d0 __LF \ - mov t3, #977 __LF \ - orr t3, t3, #0x100000000 __LF \ - umulh t1, d4, t3 __LF \ - subs d1, d1, t1 __LF \ - mul d5, t2, d1 __LF \ - umulh t1, d5, t3 __LF \ - sbcs d2, d2, t1 __LF \ - sbcs d3, d3, xzr __LF \ - sbcs d4, d4, xzr __LF \ - sbc d5, d5, xzr - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define b0 x7 -#define b1 x8 -#define b2 x9 -#define b3 x10 - -#define s0 x11 -#define s1 x12 -#define s2 x13 -#define s3 x14 -#define t0 x15 -#define t1 x16 -#define t2 x17 -#define t3 x1 -#define s4 x2 - -S2N_BN_SYMBOL(bignum_montmul_p256k1): - CFI_START - -// Load in all words of both inputs - - ldp a0, a1, [x1] - ldp a2, a3, [x1, #16] - ldp b0, b1, [x2] - ldp b2, b3, [x2, #16] - -// Multiply low halves with a 2x2->4 ADK multiplier as L = [s3;s2;s1;s0] - - mul s0, a0, b0 - mul s2, a1, b1 - umulh s1, a0, b0 - adds t1, s0, s2 - umulh s3, a1, b1 - adcs t2, s1, s3 - adcs s3, s3, xzr - adds s1, s1, t1 - adcs s2, s2, t2 - adcs s3, s3, xzr - muldiffn(t3,t2,t1, t0, a0,a1, b1,b0) - adds xzr, t3, #1 - adcs s1, s1, t1 - adcs s2, s2, t2 - adc s3, s3, t3 - -// Perform two "short" Montgomery steps on the low product to -// get a modified low result L' = [s1;s0;s3;s2] -// This shifts it to an offset compatible with middle terms -// Stash the result L' temporarily in the output buffer to avoid -// using additional registers. - - montreds2(s1,s0,s3,s2,s1,s0) - - stp s2, s3, [x0] - stp s0, s1, [x0, #16] - -// Multiply high halves with a 2x2->4 ADK multiplier as H = [s3;s2;s1;s0] - - mul s0, a2, b2 - mul s2, a3, b3 - umulh s1, a2, b2 - adds t1, s0, s2 - umulh s3, a3, b3 - adcs t2, s1, s3 - adcs s3, s3, xzr - adds s1, s1, t1 - adcs s2, s2, t2 - adcs s3, s3, xzr - muldiffn(t3,t2,t1, t0, a2,a3, b3,b2) - adds xzr, t3, #1 - adcs s1, s1, t1 - adcs s2, s2, t2 - adc s3, s3, t3 - -// Compute sign-magnitude a2,[a1,a0] = x_hi - x_lo - - subs a0, a2, a0 - sbcs a1, a3, a1 - sbc a2, xzr, xzr - adds xzr, a2, #1 - eor a0, a0, a2 - adcs a0, a0, xzr - eor a1, a1, a2 - adcs a1, a1, xzr - -// Compute sign-magnitude b2,[b1,b0] = y_lo - y_hi - - subs b0, b0, b2 - sbcs b1, b1, b3 - sbc b2, xzr, xzr - adds xzr, b2, #1 - eor b0, b0, b2 - adcs b0, b0, xzr - eor b1, b1, b2 - adcs b1, b1, xzr - -// Save the correct sign for the sub-product in b3 - - eor b3, a2, b2 - -// Add the high H to the modified low term L' as H + L' = [s4;b2;a2;t3;t0] - - ldp t0, t3, [x0] - adds t0, s0, t0 - adcs t3, s1, t3 - ldp a2, b2, [x0, #16] - adcs a2, s2, a2 - adcs b2, s3, b2 - adc s4, xzr, xzr - -// Multiply with yet a third 2x2->4 ADK multiplier for complex mid-term M - - mul s0, a0, b0 - mul s2, a1, b1 - umulh s1, a0, b0 - adds t1, s0, s2 - umulh s3, a1, b1 - adcs t2, s1, s3 - adcs s3, s3, xzr - adds s1, s1, t1 - adcs s2, s2, t2 - adcs s3, s3, xzr - muldiffn(a1,t2,t1, a0, a0,a1, b1,b0) - adds xzr, a1, #1 - adcs s1, s1, t1 - adcs s2, s2, t2 - adc s3, s3, a1 - -// Set up a sign-modified version of the mid-product in a long accumulator -// as [b3;a1;a0;s3;s2;s1;s0], adding in the H + L' term once with -// zero offset as this signed value is created - - adds xzr, b3, #1 - eor s0, s0, b3 - adcs s0, s0, t0 - eor s1, s1, b3 - adcs s1, s1, t3 - eor s2, s2, b3 - adcs s2, s2, a2 - eor s3, s3, b3 - adcs s3, s3, b2 - adcs a0, s4, b3 - adcs a1, b3, xzr - adc b3, b3, xzr - -// Add in the stashed H + L' term an offset of 2 words as well - - adds s2, s2, t0 - adcs s3, s3, t3 - adcs a0, a0, a2 - adcs a1, a1, b2 - adc b3, b3, s4 - -// Do two more Montgomery steps on the composed term -// Net pre-reduct is in [b3;a1;a0;s3;s2] - - montreds2(s1,s0,s3,s2,s1,s0) - -// Finish addition and form condensed upper digits as "dd" - -#define dd b1 - - adds a0, a0, s0 - and dd, s3, a0 - adcs a1, a1, s1 - and dd, dd, a1 - adc b3, b3, xzr - -// Because of the way we added L' in two places, we can overspill by -// more than usual in Montgomery, with the result being only known to -// be < 3 * p_256k1, not the usual < 2 * p_256k1. So now we do a more -// elaborate final correction, making use of the condensed carry dd -// to see if the initial estimate q = 4294968273 * (h + 1) results -// in a negative true result, and if so use q = 4294968273 * h. - -#define d0 s2 -#define d1 s3 -#define d2 a0 -#define d3 a1 -#define h b3 - -#define q s4 -#define c b0 - - madd q, h, t3, t3 - - adds xzr, d0, q - sub h, q, t3 - adcs xzr, dd, xzr - - csel q, q, h, cs - - adds d0, d0, q - adcs d1, d1, xzr - adcs d2, d2, xzr - adc d3, d3, xzr - -// Finally store the result - - stp d0, d1, [x0] - stp d2, d3, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montmul_p256k1_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montmul_p256k1_alt.S deleted file mode 100644 index 11826ec8131..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montmul_p256k1_alt.S +++ /dev/null @@ -1,239 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_256k1 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_p256k1_alt(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_256k1, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_256k1 (in particular this is true if we are in -// the "usual" case x < p_256k1 and y < p_256k1). -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p256k1_alt) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define b0 x7 -#define b1 x8 -#define b2 x9 -#define b3 x10 - -#define l x11 - -#define u0 x12 -#define u1 x13 -#define u2 x14 -#define u3 x15 -#define u4 x16 - -#define c x17 - -// These alias to the input arguments when no longer needed - -#define u5 a0 -#define u6 a1 -#define u7 a2 - -#define w x1 -#define t x2 -#define uu b3 - -S2N_BN_SYMBOL(bignum_montmul_p256k1_alt): - CFI_START - -// Load operands and set up row 0 = [u4;...;u0] = a0 * [b3;...;b0] - - ldp a0, a1, [x] - ldp b0, b1, [y] - - mul u0, a0, b0 - umulh u1, a0, b0 - mul l, a0, b1 - umulh u2, a0, b1 - adds u1, u1, l - - ldp b2, b3, [y, #16] - - mul l, a0, b2 - umulh u3, a0, b2 - adcs u2, u2, l - - mul l, a0, b3 - umulh u4, a0, b3 - adcs u3, u3, l - adc u4, u4, xzr - - ldp a2, a3, [x, #16] - -// Start the Montgomery reductions now to interleave better, though -// conceptually they all happen after the multiplication, only modifying -// any u_i when the multiplication process no longer uses it. Set up -// constants c = 4294968273 so that p_256k1 = 2^256 - c, and w the negated -// multiplicative inverse so that p_256k1 * w == -1 (mod 2^64). - - movz w, #0x3531 - movk w, #0xd225, lsl #16 - movk w, #0x091d, lsl #32 - movk w, #0xd838, lsl #48 - mov c, #977 - orr c, c, #0x100000000 - -// Precompute this part ahead of the main Montgomery stage. This -// is a repeated pattern below, since it seems to slightly improve -// dependent latencies. - - mul u0, w, u0 - -// Row 1 = [u5;...;u0] = [a1;a0] * [b3;...;b0] - - mul l, a1, b0 - adds u1, u1, l - mul l, a1, b1 - adcs u2, u2, l - mul l, a1, b2 - adcs u3, u3, l - mul l, a1, b3 - adcs u4, u4, l - umulh u5, a1, b3 - adc u5, u5, xzr - - umulh l, a1, b0 - adds u2, u2, l - umulh l, a1, b1 - adcs u3, u3, l - umulh l, a1, b2 - adcs u4, u4, l - adc u5, u5, xzr - -// Montgomery stage 0; use t to record the suspended carry - - umulh l, u0, c - subs u1, u1, l - cset t, cc - -// Row 2 = [u6;...;u0] = [a2;a1;a0] * [b3;...;b0] - - mul l, a2, b0 - adds u2, u2, l - mul l, a2, b1 - adcs u3, u3, l - mul l, a2, b2 - adcs u4, u4, l - mul l, a2, b3 - adcs u5, u5, l - umulh u6, a2, b3 - adc u6, u6, xzr - - mul u1, w, u1 - - umulh l, a2, b0 - adds u3, u3, l - umulh l, a2, b1 - adcs u4, u4, l - umulh l, a2, b2 - adcs u5, u5, l - adc u6, u6, xzr - -// Montgomery stage 1 - - umulh l, u1, c - add l, l, t - subs u2, u2, l - cset t, cc - -// Row 3 = [u7;...;u0] = [a3;...a0] * [b3;...;b0] - - mul l, a3, b0 - adds u3, u3, l - mul l, a3, b1 - adcs u4, u4, l - mul l, a3, b2 - adcs u5, u5, l - mul l, a3, b3 - adcs u6, u6, l - umulh u7, a3, b3 - adc u7, u7, xzr - - mul u2, w, u2 - - umulh l, a3, b0 - adds u4, u4, l - umulh l, a3, b1 - adcs u5, u5, l - umulh l, a3, b2 - adcs u6, u6, l - adc u7, u7, xzr - -// Montgomery stages 2 and 3 (no longer using t to link the carries). - - umulh l, u2, c - add l, l, t - subs u3, u3, l - mul u3, w, u3 - umulh l, u3, c - sbcs u0, u0, l - sbcs u1, u1, xzr - sbcs u2, u2, xzr - sbc u3, u3, xzr - -// Now if a * b = 2^256 * h + l is the full product, we now have -// [u7;u6;u5;u4] = h and 2^256 * [u3;u2;u1;u0] == l (mod p_256k1) because -// of the Montgomery reductions on the low half. Now add the high part -// and the Montgomery-reduced low part. - - adds u0, u0, u4 - adcs u1, u1, u5 - adcs u2, u2, u6 - and uu, u1, u2 - adcs u3, u3, u7 - and uu, uu, u3 - cset t, cs - -// Decide whether z >= p_256k1 <=> z + 4294968273 >= 2^256 - - adds xzr, u0, c - adcs xzr, uu, xzr - adcs t, t, xzr - -// Now t <> 0 <=> z >= p_256k1, so mask the constant c accordingly - - csel c, c, xzr, ne - -// If z >= p_256k1 do z := z - p_256k1, i.e. add c in 4 digits - - adds u0, u0, c - adcs u1, u1, xzr - adcs u2, u2, xzr - adc u3, u3, xzr - -// Write back - - stp u0, u1, [z] - stp u2, u3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_p256k1_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montsqr_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montsqr_p256k1.S deleted file mode 100644 index ea9f14ccd98..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montsqr_p256k1.S +++ /dev/null @@ -1,188 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_256k1, assuming x^2 <= 2^256 * p_256k1, which -// is guaranteed in particular if x < p_256k1 initially (the "intended" case). -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p256k1) - .text - .balign 4 - -#define z x0 -#define x x1 - -// Variables - -#define u0 x2 -#define u1 x3 -#define u2 x4 -#define u3 x5 -#define u4 x6 -#define u5 x7 -#define u6 x8 -#define u7 x9 - -#define w x10 -#define c x11 -#define t x12 -#define uu x13 - -S2N_BN_SYMBOL(bignum_montsqr_p256k1): - CFI_START - -// First just a near-clone of bignum_sqr_4_8 to get the square, using -// different registers to collect full product without writeback. - - ldp u4, u5, [x] - ldp x10, x11, [x, #16] - mul u2, u4, x10 - mul u7, u5, x11 - umulh x12, u4, x10 - subs x13, u4, u5 - cneg x13, x13, cc - csetm u1, cc - subs u0, x11, x10 - cneg u0, u0, cc - mul u6, x13, u0 - umulh u0, x13, u0 - cinv u1, u1, cc - eor u6, u6, u1 - eor u0, u0, u1 - adds u3, u2, x12 - adc x12, x12, xzr - umulh x13, u5, x11 - adds u3, u3, u7 - adcs x12, x12, x13 - adc x13, x13, xzr - adds x12, x12, u7 - adc x13, x13, xzr - cmn u1, #0x1 - adcs u3, u3, u6 - adcs x12, x12, u0 - adc x13, x13, u1 - adds u2, u2, u2 - adcs u3, u3, u3 - adcs x12, x12, x12 - adcs x13, x13, x13 - adc x14, xzr, xzr - mul u0, u4, u4 - mul u6, u5, u5 - mul x15, u4, u5 - umulh u1, u4, u4 - umulh u7, u5, u5 - umulh x16, u4, u5 - adds u1, u1, x15 - adcs u6, u6, x16 - adc u7, u7, xzr - adds u1, u1, x15 - adcs u6, u6, x16 - adc u7, u7, xzr - adds u2, u2, u6 - adcs u3, u3, u7 - adcs x12, x12, xzr - adcs x13, x13, xzr - adc x14, x14, xzr - mul u4, x10, x10 - mul u6, x11, x11 - mul x15, x10, x11 - umulh u5, x10, x10 - umulh u7, x11, x11 - umulh x16, x10, x11 - adds u5, u5, x15 - adcs u6, u6, x16 - adc u7, u7, xzr - adds u5, u5, x15 - adcs u6, u6, x16 - adc u7, u7, xzr - adds u4, u4, x12 - adcs u5, u5, x13 - adcs u6, u6, x14 - adc u7, u7, xzr - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [u7,u6,u5,u4] and l = [u3,u2,u1,u0]. Set up constants -// c = 4294968273 so that p_256k1 = 2^256 - c, and w the negated -// multiplicative inverse so that p_256k1 * w == -1 (mod 2^64). - - movz w, #0x3531 - movk w, #0xd225, lsl #16 - movk w, #0x091d, lsl #32 - movk w, #0xd838, lsl #48 - mov c, #977 - orr c, c, #0x100000000 - -// Do 4 iterations of Montgomery reduction, rotating [u3;u2;u1;u0] - - mul u0, w, u0 - umulh t, u0, c - subs u1, u1, t - - mul u1, w, u1 - umulh t, u1, c - sbcs u2, u2, t - - mul u2, w, u2 - umulh t, u2, c - sbcs u3, u3, t - - mul u3, w, u3 - umulh t, u3, c - sbcs u0, u0, t - - sbcs u1, u1, xzr - sbcs u2, u2, xzr - sbc u3, u3, xzr - -// Add the high part and the Montgomery reduced low part - - adds u0, u0, u4 - adcs u1, u1, u5 - adcs u2, u2, u6 - and uu, u1, u2 - adcs u3, u3, u7 - and uu, uu, u3 - cset t, cs - -// Decide whether z >= p_256k1 <=> z + 4294968273 >= 2^256 - - adds xzr, u0, c - adcs xzr, uu, xzr - adcs t, t, xzr - -// Now t <> 0 <=> z >= p_256k1, so mask the constant c accordingly - - csel c, c, xzr, ne - -// If z >= p_256k1 do z := z - p_256k1, i.e. add c in 4 digits - - adds u0, u0, c - adcs u1, u1, xzr - adcs u2, u2, xzr - adc u3, u3, xzr - -// Write back - - stp u0, u1, [x0] - stp u2, u3, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montsqr_p256k1_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montsqr_p256k1_alt.S deleted file mode 100644 index bdc21bcedd2..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_montsqr_p256k1_alt.S +++ /dev/null @@ -1,199 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_p256k1_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_256k1, assuming x^2 <= 2^256 * p_256k1, which -// is guaranteed in particular if x < p_256k1 initially (the "intended" case). -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p256k1_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 - -#define h x6 -#define l x7 - -#define u0 x8 -#define u1 x9 -#define u2 x10 -#define u3 x11 -#define u4 x12 -#define u5 x13 -#define u6 x14 -#define u7 x15 - -// Just aliases (we only use w after loading the inputs) - -#define w x -#define t h -#define c a0 -#define uu a1 - -S2N_BN_SYMBOL(bignum_montsqr_p256k1_alt): - CFI_START - -// Load all the elements, set up an initial window [u6;...u1] = [23;03;01] -// and chain in the addition of 02 + 12 + 13 (no carry-out is possible). -// This gives all the "heterogeneous" terms of the squaring ready to double - - ldp a0, a1, [x] - - mul u1, a0, a1 - umulh u2, a0, a1 - - ldp a2, a3, [x, #16] - - mul u3, a0, a3 - umulh u4, a0, a3 - - mul l, a0, a2 - umulh h, a0, a2 - adds u2, u2, l - - adcs u3, u3, h - mul l, a1, a2 - umulh h, a1, a2 - adc h, h, xzr - adds u3, u3, l - - mul u5, a2, a3 - umulh u6, a2, a3 - - adcs u4, u4, h - mul l, a1, a3 - umulh h, a1, a3 - adc h, h, xzr - adds u4, u4, l - - adcs u5, u5, h - adc u6, u6, xzr - -// Now just double it; this simple approach seems to work better than extr - - adds u1, u1, u1 - adcs u2, u2, u2 - adcs u3, u3, u3 - adcs u4, u4, u4 - adcs u5, u5, u5 - adcs u6, u6, u6 - cset u7, cs - -// Add the homogeneous terms 00 + 11 + 22 + 33 - - umulh l, a0, a0 - mul u0, a0, a0 - adds u1, u1, l - -// Start the Montgomery reductions now to interleave better, though -// conceptually they all happen after the multiplication, only modifying -// any u_i when the multiplication process no longer uses it. Set up -// constants c = 4294968273 so that p_256k1 = 2^256 - c, and w the negated -// multiplicative inverse so that p_256k1 * w == -1 (mod 2^64). -// Precompute a little ahead of the main Montgomery stage. - - movz w, #0x3531 - movk w, #0xd225, lsl #16 - movk w, #0x091d, lsl #32 - movk w, #0xd838, lsl #48 - mov c, #977 - orr c, c, #0x100000000 - mul u0, w, u0 - - mul l, a1, a1 - adcs u2, u2, l - umulh l, a1, a1 - adcs u3, u3, l - - mul l, a2, a2 - adcs u4, u4, l - umulh l, a2, a2 - adcs u5, u5, l - - mul l, a3, a3 - adcs u6, u6, l - umulh l, a3, a3 - adc u7, u7, l - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [u7,u6,u5,u4] and l = [u3,u2,u1,u0']. We actually precomputed -// the Montgomery multiplier in u0, but otherwise continue with -// 4 iterations of Montgomery reduction, rotating [u3;u2;u1;u0] - - umulh l, u0, c - subs u1, u1, l - - mul u1, w, u1 - umulh l, u1, c - sbcs u2, u2, l - - mul u2, w, u2 - umulh l, u2, c - sbcs u3, u3, l - - mul u3, w, u3 - umulh l, u3, c - sbcs u0, u0, l - - sbcs u1, u1, xzr - sbcs u2, u2, xzr - sbc u3, u3, xzr - -// Add the high part and the Montgomery reduced low part - - adds u0, u0, u4 - adcs u1, u1, u5 - adcs u2, u2, u6 - and uu, u1, u2 - adcs u3, u3, u7 - and uu, uu, u3 - cset t, cs - -// Decide whether z >= p_256k1 <=> z + 4294968273 >= 2^256 - - adds xzr, u0, c - adcs xzr, uu, xzr - adcs t, t, xzr - -// Now t <> 0 <=> z >= p_256k1, so mask the constant c accordingly - - csel c, c, xzr, ne - -// If z >= p_256k1 do z := z - p_256k1, i.e. add c in 4 digits - - adds u0, u0, c - adcs u1, u1, xzr - adcs u2, u2, xzr - adc u3, u3, xzr - -// Write back - - stp u0, u1, [z] - stp u2, u3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_p256k1_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mul_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mul_p256k1.S deleted file mode 100644 index 59e2353e737..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mul_p256k1.S +++ /dev/null @@ -1,307 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply modulo p_256k1, z := (x * y) mod p_256k1 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_mul_p256k1(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_p256k1) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a1 x4 -#define b0 x5 -#define b1 x6 - -#define u0 x7 -#define u1 x8 -#define u2 x9 -#define u3 x10 -#define u4 x11 -#define u5 x12 -#define u6 x13 -#define u7 x14 - -#define t x15 - -#define sgn x16 -#define ysgn x17 - -// These are aliases to registers used elsewhere including input pointers. -// By the time they are used this does not conflict with other uses. - -#define m0 y -#define m1 ysgn -#define m2 t -#define m3 x -#define u u2 - -// For the reduction stages, again aliasing other things - -#define c x1 -#define h x2 -#define l x15 -#define d x16 -#define q x17 -#define a2 x11 -#define a3 x12 -#define b2 x13 -#define b3 x14 - -S2N_BN_SYMBOL(bignum_mul_p256k1): - CFI_START - -// Multiply the low halves using Karatsuba 2x2->4 to get [u3,u2,u1,u0] - - ldp a0, a1, [x] - ldp b0, b1, [y] - - mul u0, a0, b0 - umulh u1, a0, b0 - mul u2, a1, b1 - umulh u3, a1, b1 - - subs a1, a1, a0 - cneg a1, a1, cc - csetm sgn, cc - - adds u2, u2, u1 - adc u3, u3, xzr - - subs a0, b0, b1 - cneg a0, a0, cc - cinv sgn, sgn, cc - - mul t, a1, a0 - umulh a0, a1, a0 - - adds u1, u0, u2 - adcs u2, u2, u3 - adc u3, u3, xzr - - adds xzr, sgn, #1 - eor t, t, sgn - adcs u1, t, u1 - eor a0, a0, sgn - adcs u2, a0, u2 - adc u3, u3, sgn - -// Multiply the high halves using Karatsuba 2x2->4 to get [u7,u6,u5,u4] - - ldp a0, a1, [x, #16] - ldp b0, b1, [y, #16] - - mul u4, a0, b0 - umulh u5, a0, b0 - mul u6, a1, b1 - umulh u7, a1, b1 - - subs a1, a1, a0 - cneg a1, a1, cc - csetm sgn, cc - - adds u6, u6, u5 - adc u7, u7, xzr - - subs a0, b0, b1 - cneg a0, a0, cc - cinv sgn, sgn, cc - - mul t, a1, a0 - umulh a0, a1, a0 - - adds u5, u4, u6 - adcs u6, u6, u7 - adc u7, u7, xzr - - adds xzr, sgn, #1 - eor t, t, sgn - adcs u5, t, u5 - eor a0, a0, sgn - adcs u6, a0, u6 - adc u7, u7, sgn - -// Compute sgn,[a1,a0] = x_hi - x_lo -// and ysgn,[b1,b0] = y_lo - y_hi -// sign-magnitude differences - - ldp a0, a1, [x, #16] - ldp t, sgn, [x] - subs a0, a0, t - sbcs a1, a1, sgn - csetm sgn, cc - - ldp t, ysgn, [y] - subs b0, t, b0 - sbcs b1, ysgn, b1 - csetm ysgn, cc - - eor a0, a0, sgn - subs a0, a0, sgn - eor a1, a1, sgn - sbc a1, a1, sgn - - eor b0, b0, ysgn - subs b0, b0, ysgn - eor b1, b1, ysgn - sbc b1, b1, ysgn - -// Save the correct sign for the sub-product - - eor sgn, ysgn, sgn - -// Add H' = H + L_top, still in [u7,u6,u5,u4] - - adds u4, u4, u2 - adcs u5, u5, u3 - adcs u6, u6, xzr - adc u7, u7, xzr - -// Now compute the mid-product as [m3,m2,m1,m0] - - mul m0, a0, b0 - umulh m1, a0, b0 - mul m2, a1, b1 - umulh m3, a1, b1 - - subs a1, a1, a0 - cneg a1, a1, cc - csetm u, cc - - adds m2, m2, m1 - adc m3, m3, xzr - - subs b1, b0, b1 - cneg b1, b1, cc - cinv u, u, cc - - mul b0, a1, b1 - umulh b1, a1, b1 - - adds m1, m0, m2 - adcs m2, m2, m3 - adc m3, m3, xzr - - adds xzr, u, #1 - eor b0, b0, u - adcs m1, b0, m1 - eor b1, b1, u - adcs m2, b1, m2 - adc m3, m3, u - -// Accumulate the positive mid-terms as [u7,u6,u5,u4,u3,u2] - - adds u2, u4, u0 - adcs u3, u5, u1 - adcs u4, u6, u4 - adcs u5, u7, u5 - adcs u6, u6, xzr - adc u7, u7, xzr - -// Add in the sign-adjusted complex term - - adds xzr, sgn, #1 - eor m0, m0, sgn - adcs u2, m0, u2 - eor m1, m1, sgn - adcs u3, m1, u3 - eor m2, m2, sgn - adcs u4, m2, u4 - eor m3, m3, sgn - adcs u5, m3, u5 - adcs u6, u6, sgn - adc u7, u7, sgn - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [u7,u6,u5,u4] and l = [u3,u2,u1,u0] -// and this is == 4294968273 * h + l (mod p_256k1) -// Some of the word products are done straightforwardly using mul + umulh -// while others are broken down in a more complicated way as -// (2^32 + 977) * (2^32 * h + l) = 2^64 * h + 2^32 * (d * h + l) + d * l - - mov d, #977 - orr c, d, #0x100000000 - - mul a0, c, u4 - umulh b0, c, u4 - - and l, u5, #0xFFFFFFFF - lsr h, u5, #32 - mul a1, d, l - madd l, d, h, l - adds a1, a1, l, lsl #32 - lsr l, l, #32 - adc b1, h, l - - mul a2, c, u6 - umulh b2, c, u6 - - and l, u7, #0xFFFFFFFF - lsr h, u7, #32 - mul a3, d, l - madd l, d, h, l - adds a3, a3, l, lsl #32 - lsr l, l, #32 - adc b3, h, l - - adds u0, u0, a0 - adcs u1, u1, a1 - adcs u2, u2, a2 - adcs u3, u3, a3 - cset u4, cs - - adds u1, u1, b0 - adcs u2, u2, b1 - adcs u3, u3, b2 - adc u4, u4, b3 - -// Now we have reduced to 5 digits, 2^256 * h + l = [u4,u3,u2,u1,u0] -// Use q = h + 1 as the initial quotient estimate, either right or 1 too big. -// Since q <= 2^33 we do 4294968273 * q = (q<<32) + 977 * q to avoid umulh - - add q, u4, #1 - mul a0, d, q - lsr a1, q, #32 - adds a0, a0, q, lsl #32 - adc a1, xzr, a1 - adds u0, u0, a0 - adcs u1, u1, a1 - adcs u2, u2, xzr - adcs u3, u3, xzr - -// Now the effective answer is 2^256 * (CF - 1) + [u3,u2,u1,u0] -// So we correct if CF = 0 by subtracting 4294968273, i.e. by -// adding p_256k1 to the "full" answer - - csel c, c, xzr, cc - subs u0, u0, c - sbcs u1, u1, xzr - sbcs u2, u2, xzr - sbc u3, u3, xzr - -// Write back and return - - stp u0, u1, [x0] - stp u2, u3, [x0, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mul_p256k1_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mul_p256k1_alt.S deleted file mode 100644 index 2474c170c3d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_mul_p256k1_alt.S +++ /dev/null @@ -1,205 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply modulo p_256k1, z := (x * y) mod p_256k1 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_mul_p256k1_alt(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_p256k1_alt) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define b0 x7 -#define b1 x8 -#define b2 x9 -#define b3 x10 - -#define l x11 - -#define u0 x12 -#define u1 x13 -#define u2 x14 -#define u3 x15 -#define u4 x16 - -// These alias to the input arguments when no longer needed - -#define u5 a0 -#define u6 a1 -#define u7 a2 - -#define c b0 -#define q b1 -#define h b2 - -S2N_BN_SYMBOL(bignum_mul_p256k1_alt): - CFI_START - -// Load operands and set up row 0 = [u4;...;u0] = a0 * [b3;...;b0] - - ldp a0, a1, [x] - ldp b0, b1, [y] - - mul u0, a0, b0 - umulh u1, a0, b0 - mul l, a0, b1 - umulh u2, a0, b1 - adds u1, u1, l - - ldp b2, b3, [y, #16] - - mul l, a0, b2 - umulh u3, a0, b2 - adcs u2, u2, l - - mul l, a0, b3 - umulh u4, a0, b3 - adcs u3, u3, l - adc u4, u4, xzr - - ldp a2, a3, [x, #16] - -// Row 1 = [u5;...;u0] = [a1;a0] * [b3;...;b0] - - mul l, a1, b0 - adds u1, u1, l - mul l, a1, b1 - adcs u2, u2, l - mul l, a1, b2 - adcs u3, u3, l - mul l, a1, b3 - adcs u4, u4, l - umulh u5, a1, b3 - adc u5, u5, xzr - - umulh l, a1, b0 - adds u2, u2, l - umulh l, a1, b1 - adcs u3, u3, l - umulh l, a1, b2 - adcs u4, u4, l - adc u5, u5, xzr - -// Row 2 = [u6;...;u0] = [a2;a1;a0] * [b3;...;b0] - - mul l, a2, b0 - adds u2, u2, l - mul l, a2, b1 - adcs u3, u3, l - mul l, a2, b2 - adcs u4, u4, l - mul l, a2, b3 - adcs u5, u5, l - umulh u6, a2, b3 - adc u6, u6, xzr - - umulh l, a2, b0 - adds u3, u3, l - umulh l, a2, b1 - adcs u4, u4, l - umulh l, a2, b2 - adcs u5, u5, l - adc u6, u6, xzr - -// Row 3 = [u7;...;u0] = [a3;...a0] * [b3;...;b0] - - mul l, a3, b0 - adds u3, u3, l - mul l, a3, b1 - adcs u4, u4, l - mul l, a3, b2 - adcs u5, u5, l - mul l, a3, b3 - adcs u6, u6, l - umulh u7, a3, b3 - adc u7, u7, xzr - - umulh l, a3, b0 - adds u4, u4, l - umulh l, a3, b1 - adcs u5, u5, l - umulh l, a3, b2 - adcs u6, u6, l - adc u7, u7, xzr - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [u7,u6,u5,u4] and l = [u3,u2,u1,u0] -// and this is == 4294968273 * h + l (mod p_256k1) - - mov c, #977 - orr c, c, #0x100000000 - - mul l, c, u4 - umulh h, c, u4 - adds u0, u0, l - - mul l, c, u5 - umulh u5, c, u5 - adcs u1, u1, l - - mul l, c, u6 - umulh u6, c, u6 - adcs u2, u2, l - - mul l, c, u7 - umulh u7, c, u7 - adcs u3, u3, l - cset u4, cs - - adds u1, u1, h - adcs u2, u2, u5 - adcs u3, u3, u6 - adc u4, u4, u7 - -// Now we have reduced to 5 digits, 2^256 * h + l = [u4,u3,u2,u1,u0] -// Use q = h + 1 as the initial quotient estimate, either right or 1 too big. - - add q, u4, #1 - mul l, c, q - umulh h, c, q - adds u0, u0, l - adcs u1, u1, h - adcs u2, u2, xzr - adcs u3, u3, xzr - -// Now the effective answer is 2^256 * (CF - 1) + [u3,u2,u1,u0] -// So we correct if CF = 0 by subtracting 4294968273, i.e. by -// adding p_256k1 to the "full" answer - - csel c, c, xzr, cc - subs u0, u0, c - sbcs u1, u1, xzr - sbcs u2, u2, xzr - sbc u3, u3, xzr - -// Write back and return - - stp u0, u1, [x0] - stp u2, u3, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_p256k1_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_neg_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_neg_p256k1.S deleted file mode 100644 index e1b2868e196..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_neg_p256k1.S +++ /dev/null @@ -1,69 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Negate modulo p_256k1, z := (-x) mod p_256k1, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_neg_p256k1(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_neg_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_neg_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_neg_p256k1) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define p x2 -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 -#define c x7 - -S2N_BN_SYMBOL(bignum_neg_p256k1): - CFI_START - -// Load the 4 digits of x and let c be an OR of all the digits - - ldp d0, d1, [x] - orr c, d0, d1 - ldp d2, d3, [x, #16] - orr c, c, d2 - orr c, c, d3 - -// Turn q into a strict bitmask, and c a masked constant -4294968273, -// computing it in effect as ~4294968272 = ~(2^32 + 976) - - cmp c, xzr - csetm p, ne - mov c, #976 - orr c, c, #0x100000000 - bic c, p, c - -// Now just do [2^256 - 4294968273] - x where the constant is masked - - subs d0, c, d0 - sbcs d1, p, d1 - sbcs d2, p, d2 - sbc d3, p, d3 - -// Write back result and return - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_neg_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_optneg_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_optneg_p256k1.S deleted file mode 100644 index 6c83ba5a8b0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_optneg_p256k1.S +++ /dev/null @@ -1,79 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo p_256k1, z := (-x) mod p_256k1 (if p nonzero) or -// z := x (if p zero), assuming x reduced -// Inputs p, x[4]; output z[4] -// -// extern void bignum_optneg_p256k1(uint64_t z[static 4], uint64_t p, -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = p, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg_p256k1) - .text - .balign 4 - -#define z x0 -#define p x1 -#define x x2 - -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 -#define c x7 - -S2N_BN_SYMBOL(bignum_optneg_p256k1): - CFI_START - -// Load the 4 digits of x and let c be an OR of all the digits - - ldp d0, d1, [x] - orr c, d0, d1 - ldp d2, d3, [x, #16] - orr c, c, d2 - orr c, c, d3 - -// Turn p into a strict bitmask. Force it to zero if the input is zero, -// to avoid giving -0 = p_256k1, which is not reduced though correct modulo. - - cmp p, xzr - csetm p, ne - cmp c, xzr - csel p, xzr, p, eq - -// We want z := if p then (2^256 - 4294968273) - x else x -// which is: [if p then ~x else x] - [if p then 4294968272 else 0] - - mov c, #976 - orr c, c, #0x100000000 - and c, c, p - - eor d0, d0, p - subs d0, d0, c - eor d1, d1, p - sbcs d1, d1, xzr - eor d2, d2, p - sbcs d2, d2, xzr - eor d3, d3, p - sbc d3, d3, xzr - -// Write back result and return - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_sqr_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_sqr_p256k1.S deleted file mode 100644 index 33d785ce9ed..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_sqr_p256k1.S +++ /dev/null @@ -1,227 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square modulo p_256k1, z := (x^2) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_sqr_p256k1(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_p256k1) - .text - .balign 4 - -#define z x0 -#define x x1 - -// Variables - -#define u0 x2 -#define u1 x3 -#define u2 x4 -#define u3 x5 -#define u4 x6 -#define u5 x7 -#define u6 x8 -#define u7 x9 - -#define a0 x10 -#define a1 x11 -#define a2 x12 -#define b0 x13 -#define b1 x14 -#define b3 x15 -#define c x16 -#define d x17 - -// Some additional aliases - -#define l u4 -#define h u5 -#define b2 u6 -#define q u4 -#define a3 u7 - -S2N_BN_SYMBOL(bignum_sqr_p256k1): - CFI_START - -// First just a near-clone of bignum_sqr_4_8 to get the square, using -// different registers to collect full product without writeback. - - ldp x10, x11, [x1] - ldp x12, x13, [x1, #16] - umull x2, w10, w10 - lsr x14, x10, #32 - umull x3, w14, w14 - umull x14, w10, w14 - adds x2, x2, x14, lsl #33 - lsr x14, x14, #31 - adc x3, x3, x14 - umull x4, w11, w11 - lsr x14, x11, #32 - umull x5, w14, w14 - umull x14, w11, w14 - mul x15, x10, x11 - umulh x16, x10, x11 - adds x4, x4, x14, lsl #33 - lsr x14, x14, #31 - adc x5, x5, x14 - adds x15, x15, x15 - adcs x16, x16, x16 - adc x5, x5, xzr - adds x3, x3, x15 - adcs x4, x4, x16 - adc x5, x5, xzr - umull x6, w12, w12 - lsr x14, x12, #32 - umull x7, w14, w14 - umull x14, w12, w14 - adds x6, x6, x14, lsl #33 - lsr x14, x14, #31 - adc x7, x7, x14 - umull x8, w13, w13 - lsr x14, x13, #32 - umull x9, w14, w14 - umull x14, w13, w14 - mul x15, x12, x13 - umulh x16, x12, x13 - adds x8, x8, x14, lsl #33 - lsr x14, x14, #31 - adc x9, x9, x14 - adds x15, x15, x15 - adcs x16, x16, x16 - adc x9, x9, xzr - adds x7, x7, x15 - adcs x8, x8, x16 - adc x9, x9, xzr - subs x10, x10, x12 - sbcs x11, x11, x13 - csetm x16, cc - eor x10, x10, x16 - subs x10, x10, x16 - eor x11, x11, x16 - sbc x11, x11, x16 - adds x6, x6, x4 - adcs x7, x7, x5 - adcs x8, x8, xzr - adc x9, x9, xzr - umull x12, w10, w10 - lsr x5, x10, #32 - umull x13, w5, w5 - umull x5, w10, w5 - adds x12, x12, x5, lsl #33 - lsr x5, x5, #31 - adc x13, x13, x5 - umull x15, w11, w11 - lsr x5, x11, #32 - umull x14, w5, w5 - umull x5, w11, w5 - mul x4, x10, x11 - umulh x16, x10, x11 - adds x15, x15, x5, lsl #33 - lsr x5, x5, #31 - adc x14, x14, x5 - adds x4, x4, x4 - adcs x16, x16, x16 - adc x14, x14, xzr - adds x13, x13, x4 - adcs x15, x15, x16 - adc x14, x14, xzr - adds x4, x2, x6 - adcs x5, x3, x7 - adcs x6, x6, x8 - adcs x7, x7, x9 - csetm x16, cc - subs x4, x4, x12 - sbcs x5, x5, x13 - sbcs x6, x6, x15 - sbcs x7, x7, x14 - adcs x8, x8, x16 - adc x9, x9, x16 - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [u7,u6,u5,u4] and l = [u3,u2,u1,u0] -// and this is == 4294968273 * h + l (mod p_256k1) -// Some of the word products are done straightforwardly using mul + umulh -// while others are broken down in a more complicated way as -// (2^32 + 977) * (2^32 * h + l) = 2^64 * h + 2^32 * (d * h + l) + d * l - - mov d, #977 - orr c, d, #0x100000000 - - mul a0, c, u4 - umulh b0, c, u4 - - and l, u5, #0xFFFFFFFF - lsr h, u5, #32 - mul a1, d, l - madd l, d, h, l - adds a1, a1, l, lsl #32 - lsr l, l, #32 - adc b1, h, l - - mul a2, c, u6 - umulh b2, c, u6 - - and l, u7, #0xFFFFFFFF - lsr h, u7, #32 - mul a3, d, l - madd l, d, h, l - adds a3, a3, l, lsl #32 - lsr l, l, #32 - adc b3, h, l - - adds u0, u0, a0 - adcs u1, u1, a1 - adcs u2, u2, a2 - adcs u3, u3, a3 - cset u4, cs - - adds u1, u1, b0 - adcs u2, u2, b1 - adcs u3, u3, b2 - adc u4, u4, b3 - -// Now we have reduced to 5 digits, 2^256 * h + l = [u4,u3,u2,u1,u0] -// Use q = h + 1 as the initial quotient estimate, either right or 1 too big. -// Since q <= 2^33 we do 4294968273 * q = (q<<32) + 977 * q to avoid umulh - - add q, u4, #1 - mul a0, d, q - lsr a1, q, #32 - adds a0, a0, q, lsl #32 - adc a1, xzr, a1 - adds u0, u0, a0 - adcs u1, u1, a1 - adcs u2, u2, xzr - adcs u3, u3, xzr - -// Now the effective answer is 2^256 * (CF - 1) + [u3,u2,u1,u0] -// So we correct if CF = 0 by subtracting 4294968273, i.e. by -// adding p_256k1 to the "full" answer - - csel c, c, xzr, cc - subs u0, u0, c - sbcs u1, u1, xzr - sbcs u2, u2, xzr - sbc u3, u3, xzr - -// Write back - - stp u0, u1, [x0] - stp u2, u3, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_sqr_p256k1_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_sqr_p256k1_alt.S deleted file mode 100644 index ec06703f884..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_sqr_p256k1_alt.S +++ /dev/null @@ -1,179 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square modulo p_256k1, z := (x^2) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_sqr_p256k1_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_p256k1_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 - -#define h x6 -#define l x7 - -#define u0 x8 -#define u1 x9 -#define u2 x10 -#define u3 x11 -#define u4 x12 -#define u5 x13 -#define u6 x14 - -// Just aliases - -#define q a0 -#define c a1 -#define t a2 -#define u7 h - -S2N_BN_SYMBOL(bignum_sqr_p256k1_alt): - CFI_START - -// Load all the elements, set up an initial window [u6;...u1] = [23;03;01] -// and chain in the addition of 02 + 12 + 13 (no carry-out is possible). -// This gives all the "heterogeneous" terms of the squaring ready to double - - ldp a0, a1, [x] - - mul u1, a0, a1 - umulh u2, a0, a1 - - ldp a2, a3, [x, #16] - - mul u3, a0, a3 - umulh u4, a0, a3 - - mul l, a0, a2 - umulh h, a0, a2 - adds u2, u2, l - - adcs u3, u3, h - mul l, a1, a2 - umulh h, a1, a2 - adc h, h, xzr - adds u3, u3, l - - mul u5, a2, a3 - umulh u6, a2, a3 - - adcs u4, u4, h - mul l, a1, a3 - umulh h, a1, a3 - adc h, h, xzr - adds u4, u4, l - - adcs u5, u5, h - adc u6, u6, xzr - -// Now just double it; this simple approach seems to work better than extr - - adds u1, u1, u1 - adcs u2, u2, u2 - adcs u3, u3, u3 - adcs u4, u4, u4 - adcs u5, u5, u5 - adcs u6, u6, u6 - cset u7, cs - -// Add the homogeneous terms 00 + 11 + 22 + 33 - - umulh l, a0, a0 - mul u0, a0, a0 - adds u1, u1, l - - mul l, a1, a1 - adcs u2, u2, l - umulh l, a1, a1 - adcs u3, u3, l - - mul l, a2, a2 - adcs u4, u4, l - umulh l, a2, a2 - adcs u5, u5, l - - mul l, a3, a3 - adcs u6, u6, l - umulh l, a3, a3 - adc u7, u7, l - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [u7,u6,u5,u4] and l = [u3,u2,u1,u0] -// and this is == 4294968273 * h + l (mod p_256k1) - - mov c, #977 - orr c, c, #0x100000000 - - mul l, c, u4 - umulh t, c, u4 - adds u0, u0, l - - mul l, c, u5 - umulh u5, c, u5 - adcs u1, u1, l - - mul l, c, u6 - umulh u6, c, u6 - adcs u2, u2, l - - mul l, c, u7 - umulh u7, c, u7 - adcs u3, u3, l - cset u4, cs - - adds u1, u1, t - adcs u2, u2, u5 - adcs u3, u3, u6 - adc u4, u4, u7 - -// Now we have reduced to 5 digits, 2^256 * h + l = [u4,u3,u2,u1,u0] -// Use q = h + 1 as the initial quotient estimate, either right or 1 too big. - - add q, u4, #1 - mul l, c, q - umulh h, c, q - adds u0, u0, l - adcs u1, u1, h - adcs u2, u2, xzr - adcs u3, u3, xzr - -// Now the effective answer is 2^256 * (CF - 1) + [u3,u2,u1,u0] -// So we correct if CF = 0 by subtracting 4294968273, i.e. by -// adding p_256k1 to the "full" answer - - csel c, c, xzr, cc - subs u0, u0, c - sbcs u1, u1, xzr - sbcs u2, u2, xzr - sbc u3, u3, xzr - -// Write back and return - - stp u0, u1, [x0] - stp u2, u3, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_p256k1_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_sub_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_sub_p256k1.S deleted file mode 100644 index 9079fc0a115..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_sub_p256k1.S +++ /dev/null @@ -1,73 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Subtract modulo p_256k1, z := (x - y) mod p_256k1 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_sub_p256k1(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sub_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sub_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sub_p256k1) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 -#define c x3 -#define l x4 -#define d0 x5 -#define d1 x6 -#define d2 x7 -#define d3 x8 - -S2N_BN_SYMBOL(bignum_sub_p256k1): - CFI_START - -// First just subtract the numbers as [d3; d2; d1; d0] = x - y, -// with the inverted carry flag meaning CF <=> x >= y. - - ldp d0, d1, [x] - ldp l, c, [y] - subs d0, d0, l - sbcs d1, d1, c - ldp d2, d3, [x, #16] - ldp l, c, [y, #16] - sbcs d2, d2, l - sbcs d3, d3, c - -// Now if x < y we want to add back p_256k1, which staying within 4 digits -// means subtracting 4294968273, since p_256k1 = 2^256 - 4294968273. -// Let c be that constant 4294968273 when x < y, zero otherwise. - - mov l, #977 - orr c, l, #0x100000000 - csel c, c, xzr, cc - -// Now correct by adding masked p_256k1, i.e. subtracting c - - subs d0, d0, c - sbcs d1, d1, xzr - sbcs d2, d2, xzr - sbc d3, d3, xzr - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sub_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_tomont_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_tomont_p256k1.S deleted file mode 100644 index 5a46c932c82..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_tomont_p256k1.S +++ /dev/null @@ -1,107 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert to Montgomery form z := (2^256 * x) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_tomont_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tomont_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tomont_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tomont_p256k1) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tomont_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tomont_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tomont_p256k1_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define m x2 - -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 -#define a0 x7 -#define a1 x8 - -#define a2 x9 -#define c x9 - -#define a3 x10 -#define h x10 -#define q x10 - -S2N_BN_SYMBOL(bignum_tomont_p256k1): - -S2N_BN_SYMBOL(bignum_tomont_p256k1_alt): - CFI_START - -// Since 2^256 == 4294968273 (mod p_256k1) we more or less just set -// m = 4294968273 then devolve to a near-clone of bignum_cmul_p256k1; -// the logic that q = h + 1 < 2^64 and hence doesn't wrap still holds -// since the multiplier 4294968273 is known to be much less than 2^64. -// We can also re-use the initial constant m instead of re-creating it. - - mov m, #977 - orr m, m, #0x100000000 - -// First do the multiply, straightforwardly to get [h;d3;d2;d1;d0] - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - mul d0, m, a0 - mul d1, m, a1 - mul d2, m, a2 - mul d3, m, a3 - umulh a0, m, a0 - umulh a1, m, a1 - umulh a2, m, a2 - umulh h, m, a3 - adds d1, d1, a0 - adcs d2, d2, a1 - adcs d3, d3, a2 - adcs h, h, xzr - -// Now the quotient estimate is q = h + 1, and then we do the reduction, -// writing z = [d3;d2;d1;d0], as z' = (2^256 * h + z) - q * p_256k1 = -// (2^256 * h + z) - q * (2^256 - 4294968273) = -2^256 + (z + 4294968273 * q) - - add q, h, #1 - mul a0, q, m - umulh a1, q, m - adds d0, d0, a0 - adcs d1, d1, a1 - adcs d2, d2, xzr - adcs d3, d3, xzr - -// Because of the implicit -2^256, CF means >= 0 so z' is the answer; ~CF -// means z' < 0 so we add p_256k1, which in 4 digits means subtracting m. - - csel m, m, xzr, cc - subs d0, d0, m - sbcs d1, d1, xzr - sbcs d2, d2, xzr - sbcs d3, d3, xzr - -// Finally store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_tomont_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_triple_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_triple_p256k1.S deleted file mode 100644 index 871dcc3105f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/bignum_triple_p256k1.S +++ /dev/null @@ -1,109 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_256k1, z := (3 * x) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_triple_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// The input x can be any 4-digit bignum, not necessarily reduced modulo -// p_256k1, and the result is always fully reduced, z = (3 * x) mod p_256k1. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p256k1) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p256k1_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define h x6 - -// Slightly offset aliases for the d_i for readability. - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 - -// More aliases for the same thing at different stages - -#define m x6 - -// Other temporary variables - -#define c x7 - -S2N_BN_SYMBOL(bignum_triple_p256k1): -S2N_BN_SYMBOL(bignum_triple_p256k1_alt): - CFI_START - -// Load the inputs - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - -// First do the multiplication by 3, getting z = [h; d3; ...; d0] - - adds d0, a0, a0, lsl #1 - extr d1, a1, a0, #63 - adcs d1, d1, a1 - extr d2, a2, a1, #63 - adcs d2, d2, a2 - extr d3, a3, a2, #63 - adcs d3, d3, a3 - lsr h, a3, #63 - adc h, h, xzr - -// For this limited range a simple quotient estimate of q = h + 1 works, where -// h = floor(z / 2^256). Then -p_256k1 <= z - q * p_256k1 < p_256k1. - - mov c, #977 - orr c, c, #0x100000000 - madd m, h, c, c - -// Initial subtraction of z - q * p_256k1, actually by adding q * 4294968273. - - adds d0, d0, m - adcs d1, d1, xzr - adcs d2, d2, xzr - adcs d3, d3, xzr - -// With z = 2^256 * h + l, the underlying result z' is actually -// (2^256 * h + l) - q * (2^256 - 4294968273) = (l + q * 4294968273) - 2^256 -// so carry-clear <=> z' is negative. Correct by subtracting in that case. - - csel c, c, xzr, cc - subs d0, d0, c - sbcs d1, d1, xzr - sbcs d2, d2, xzr - sbc d3, d3, xzr - -// Finally store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p256k1) -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p256k1_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jadd.S deleted file mode 100644 index eb451fed046..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jadd.S +++ /dev/null @@ -1,554 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on SECG curve secp256k1 in Jacobian coordinates -// -// extern void secp256k1_jadd(uint64_t p3[static 12], const uint64_t p1[static 12], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// It is assumed that all coordinates of the input points p1 and p2 are -// fully reduced mod p_256k1, that both z coordinates are nonzero and -// that neither p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents -// the same affine point as". -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(secp256k1_jadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(secp256k1_jadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(secp256k1_jadd) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x19 -#define input_x x20 -#define input_y x21 - -// The magic constant 2^256 - p_256k1 - -#define pconst x17 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE -#define z_2 input_y, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define z1sq sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define x1a sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define z2sq sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define y1a sp, #(NUMSIZE*6) - -#define NSPACE NUMSIZE*7 - -// Corresponds exactly to bignum_mul_p256k1 except for registers and -// re-use of the pconst register for the constant 4294968273 - -#define mul_p256k1(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - mul x7, x3, x5 __LF \ - umulh x8, x3, x5 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, lo __LF \ - csetm x16, lo __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, lo __LF \ - cinv x16, x16, lo __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - mul x11, x3, x5 __LF \ - umulh x12, x3, x5 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, lo __LF \ - csetm x16, lo __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, lo __LF \ - cinv x16, x16, lo __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, lo __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, lo __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, lo __LF \ - csetm x9, lo __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, lo __LF \ - cinv x9, x9, lo __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x16, #977 __LF \ - mul x3, pconst, x11 __LF \ - umulh x5, pconst, x11 __LF \ - and x15, x12, #0xffffffff __LF \ - lsr x2, x12, #32 __LF \ - mul x4, x16, x15 __LF \ - madd x15, x16, x2, x15 __LF \ - adds x4, x4, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x6, x2, x15 __LF \ - mul x11, pconst, x13 __LF \ - umulh x13, pconst, x13 __LF \ - and x15, x14, #0xffffffff __LF \ - lsr x2, x14, #32 __LF \ - mul x12, x16, x15 __LF \ - madd x15, x16, x2, x15 __LF \ - adds x12, x12, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x14, x2, x15 __LF \ - adds x7, x7, x3 __LF \ - adcs x8, x8, x4 __LF \ - adcs x9, x9, x11 __LF \ - adcs x10, x10, x12 __LF \ - cset x11, hs __LF \ - adds x8, x8, x5 __LF \ - adcs x9, x9, x6 __LF \ - adcs x10, x10, x13 __LF \ - adc x11, x11, x14 __LF \ - add x0, x11, #1 __LF \ - mul x3, x16, x0 __LF \ - lsr x4, x0, #32 __LF \ - adds x3, x3, x0, lsl #32 __LF \ - adc x4, xzr, x4 __LF \ - adds x7, x7, x3 __LF \ - adcs x8, x8, x4 __LF \ - adcs x9, x9, xzr __LF \ - adcs x10, x10, xzr __LF \ - csel x1, pconst, xzr, lo __LF \ - subs x7, x7, x1 __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// Corresponds exactly to bignum_sqr_p256k1 except for -// re-use of the pconst register for the constant 4294968273 - -#define sqr_p256k1(P0,P1) \ - ldp x10, x11, [P1] __LF \ - ldp x12, x13, [P1+16] __LF \ - umull x2, w10, w10 __LF \ - lsr x14, x10, #32 __LF \ - umull x3, w14, w14 __LF \ - umull x14, w10, w14 __LF \ - adds x2, x2, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x3, x3, x14 __LF \ - umull x4, w11, w11 __LF \ - lsr x14, x11, #32 __LF \ - umull x5, w14, w14 __LF \ - umull x14, w11, w14 __LF \ - mul x15, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x4, x4, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x5, x5, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x5, x5, xzr __LF \ - adds x3, x3, x15 __LF \ - adcs x4, x4, x16 __LF \ - adc x5, x5, xzr __LF \ - umull x6, w12, w12 __LF \ - lsr x14, x12, #32 __LF \ - umull x7, w14, w14 __LF \ - umull x14, w12, w14 __LF \ - adds x6, x6, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x7, x7, x14 __LF \ - umull x8, w13, w13 __LF \ - lsr x14, x13, #32 __LF \ - umull x9, w14, w14 __LF \ - umull x14, w13, w14 __LF \ - mul x15, x12, x13 __LF \ - umulh x16, x12, x13 __LF \ - adds x8, x8, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x9, x9, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x9, x9, xzr __LF \ - adds x7, x7, x15 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, xzr __LF \ - subs x10, x10, x12 __LF \ - sbcs x11, x11, x13 __LF \ - csetm x16, lo __LF \ - eor x10, x10, x16 __LF \ - subs x10, x10, x16 __LF \ - eor x11, x11, x16 __LF \ - sbc x11, x11, x16 __LF \ - adds x6, x6, x4 __LF \ - adcs x7, x7, x5 __LF \ - adcs x8, x8, xzr __LF \ - adc x9, x9, xzr __LF \ - umull x12, w10, w10 __LF \ - lsr x5, x10, #32 __LF \ - umull x13, w5, w5 __LF \ - umull x5, w10, w5 __LF \ - adds x12, x12, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x13, x13, x5 __LF \ - umull x15, w11, w11 __LF \ - lsr x5, x11, #32 __LF \ - umull x14, w5, w5 __LF \ - umull x5, w11, w5 __LF \ - mul x4, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x15, x15, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x14, x14, x5 __LF \ - adds x4, x4, x4 __LF \ - adcs x16, x16, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x13, x13, x4 __LF \ - adcs x15, x15, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x4, x2, x6 __LF \ - adcs x5, x3, x7 __LF \ - adcs x6, x6, x8 __LF \ - adcs x7, x7, x9 __LF \ - csetm x16, lo __LF \ - subs x4, x4, x12 __LF \ - sbcs x5, x5, x13 __LF \ - sbcs x6, x6, x15 __LF \ - sbcs x7, x7, x14 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, x16 __LF \ - mov x16, #977 __LF \ - mul x10, pconst, x6 __LF \ - umulh x13, pconst, x6 __LF \ - and x6, x7, #0xffffffff __LF \ - lsr x7, x7, #32 __LF \ - mul x11, x16, x6 __LF \ - madd x6, x16, x7, x6 __LF \ - adds x11, x11, x6, lsl #32 __LF \ - lsr x6, x6, #32 __LF \ - adc x14, x7, x6 __LF \ - mul x12, pconst, x8 __LF \ - umulh x8, pconst, x8 __LF \ - and x6, x9, #0xffffffff __LF \ - lsr x7, x9, #32 __LF \ - mul x9, x16, x6 __LF \ - madd x6, x16, x7, x6 __LF \ - adds x9, x9, x6, lsl #32 __LF \ - lsr x6, x6, #32 __LF \ - adc x15, x7, x6 __LF \ - adds x2, x2, x10 __LF \ - adcs x3, x3, x11 __LF \ - adcs x4, x4, x12 __LF \ - adcs x5, x5, x9 __LF \ - cset x6, hs __LF \ - adds x3, x3, x13 __LF \ - adcs x4, x4, x14 __LF \ - adcs x5, x5, x8 __LF \ - adc x6, x6, x15 __LF \ - add x6, x6, #1 __LF \ - mul x10, x16, x6 __LF \ - lsr x11, x6, #32 __LF \ - adds x10, x10, x6, lsl #32 __LF \ - adc x11, xzr, x11 __LF \ - adds x2, x2, x10 __LF \ - adcs x3, x3, x11 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - csel x16, pconst, xzr, lo __LF \ - subs x2, x2, x16 __LF \ - sbcs x3, x3, xzr __LF \ - sbcs x4, x4, xzr __LF \ - sbc x5, x5, xzr __LF \ - stp x2, x3, [P0] __LF \ - stp x4, x5, [P0+16] - -// Corresponds exactly to bignum_sub_p256k1 - -#define sub_p256k1(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #0x3d1 __LF \ - orr x3, x4, #0x100000000 __LF \ - csel x3, x3, xzr, cc __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -S2N_BN_SYMBOL(secp256k1_jadd): - CFI_START - -// Save registers and make room on stack for temporary variables - - CFI_DEC_SP(NSPACE+32) - CFI_STACKSAVE2(x19,x20,NSPACE) - CFI_STACKSAVE2(x21,x22,NSPACE+16) - -// Move the input arguments to stable place - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Set up pconst = 4294968273, so p_256k1 = 2^256 - pconst - - mov pconst, #977 - orr pconst, pconst, #0x100000000 - -// Main code, just a sequence of basic field operations - - sqr_p256k1(z1sq,z_1) - sqr_p256k1(z2sq,z_2) - - mul_p256k1(y1a,z_2,y_1) - mul_p256k1(y2a,z_1,y_2) - - mul_p256k1(x2a,z1sq,x_2) - mul_p256k1(x1a,z2sq,x_1) - mul_p256k1(y2a,z1sq,y2a) - mul_p256k1(y1a,z2sq,y1a) - - sub_p256k1(xd,x2a,x1a) - sub_p256k1(yd,y2a,y1a) - - sqr_p256k1(zz,xd) - sqr_p256k1(ww,yd) - - mul_p256k1(zzx1,zz,x1a) - mul_p256k1(zzx2,zz,x2a) - - sub_p256k1(resx,ww,zzx1) - sub_p256k1(t1,zzx2,zzx1) - - mul_p256k1(xd,xd,z_1) - - sub_p256k1(resx,resx,zzx2) - - sub_p256k1(t2,zzx1,resx) - - mul_p256k1(t1,t1,y1a) - mul_p256k1(resz,xd,z_2) - mul_p256k1(t2,yd,t2) - - sub_p256k1(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "HI" <=> CF /\ ~ZF <=> P1 = 0 /\ ~(P2 = 0) -// and "LO" <=> ~CF <=> ~(P1 = 0) /\ P2 = 0 - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - - orr x12, x0, x1 - orr x13, x2, x3 - orr x12, x12, x13 - cmp x12, xzr - cset x12, ne - - ldp x4, x5, [z_2] - ldp x6, x7, [z_2+16] - - orr x13, x4, x5 - orr x14, x6, x7 - orr x13, x13, x14 - cmp x13, xzr - cset x13, ne - - cmp x13, x12 - -// Multiplex the outputs accordingly, re-using the z's in registers - - ldp x8, x9, [resz] - csel x8, x0, x8, lo - csel x9, x1, x9, lo - csel x8, x4, x8, hi - csel x9, x5, x9, hi - ldp x10, x11, [resz+16] - csel x10, x2, x10, lo - csel x11, x3, x11, lo - csel x10, x6, x10, hi - csel x11, x7, x11, hi - - ldp x12, x13, [x_1] - ldp x0, x1, [resx] - csel x0, x12, x0, lo - csel x1, x13, x1, lo - ldp x12, x13, [x_2] - csel x0, x12, x0, hi - csel x1, x13, x1, hi - - ldp x12, x13, [x_1+16] - ldp x2, x3, [resx+16] - csel x2, x12, x2, lo - csel x3, x13, x3, lo - ldp x12, x13, [x_2+16] - csel x2, x12, x2, hi - csel x3, x13, x3, hi - - ldp x12, x13, [y_1] - ldp x4, x5, [resy] - csel x4, x12, x4, lo - csel x5, x13, x5, lo - ldp x12, x13, [y_2] - csel x4, x12, x4, hi - csel x5, x13, x5, hi - - ldp x12, x13, [y_1+16] - ldp x6, x7, [resy+16] - csel x6, x12, x6, lo - csel x7, x13, x7, lo - ldp x12, x13, [y_2+16] - csel x6, x12, x6, hi - csel x7, x13, x7, hi - -// Finally store back the multiplexed values - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [y_3] - stp x6, x7, [y_3+16] - stp x8, x9, [z_3] - stp x10, x11, [z_3+16] - -// Restore stack and return - - CFI_STACKLOAD2(x19,x20,NSPACE) - CFI_STACKLOAD2(x21,x22,NSPACE+16) - CFI_INC_SP((NSPACE+32)) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(secp256k1_jadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jadd_alt.S deleted file mode 100644 index 157e7331e02..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jadd_alt.S +++ /dev/null @@ -1,427 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on SECG curve secp256k1 in Jacobian coordinates -// -// extern void secp256k1_jadd_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// It is assumed that all coordinates of the input points p1 and p2 are -// fully reduced mod p_256k1, that both z coordinates are nonzero and -// that neither p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents -// the same affine point as". -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(secp256k1_jadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(secp256k1_jadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(secp256k1_jadd_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x15 -#define input_x x16 -#define input_y x17 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE -#define z_2 input_y, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define z1sq sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define x1a sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define z2sq sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define y1a sp, #(NUMSIZE*6) - -#define NSPACE NUMSIZE*7 - -// Corresponds exactly to bignum_mul_p256k1_alt - -#define mul_p256k1(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x0, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x1, x3, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x1, x1, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x1, x1, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x0, x0, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x1, x1, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x0, x0, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x1, x1, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x0, x0, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x1, x1, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x3d1 __LF \ - orr x7, x7, #0x100000000 __LF \ - mul x11, x7, x1 __LF \ - umulh x9, x7, x1 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x0, x0, x11 __LF \ - cset x1, cs __LF \ - adds x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adcs x0, x0, x4 __LF \ - adc x1, x1, x5 __LF \ - add x8, x1, #0x1 __LF \ - mul x11, x7, x8 __LF \ - umulh x9, x7, x8 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, xzr __LF \ - adcs x0, x0, xzr __LF \ - csel x7, x7, xzr, cc __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x0, x0, xzr __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x0, [P0+16] - -// Corresponds exactly to bignum_sqr_p256k1_alt - -#define sqr_p256k1(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x7, x2, x4 __LF \ - umulh x6, x2, x4 __LF \ - adds x10, x10, x7 __LF \ - adcs x11, x11, x6 __LF \ - mul x7, x3, x4 __LF \ - umulh x6, x3, x4 __LF \ - adc x6, x6, xzr __LF \ - adds x11, x11, x7 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x6 __LF \ - mul x7, x3, x5 __LF \ - umulh x6, x3, x5 __LF \ - adc x6, x6, xzr __LF \ - adds x12, x12, x7 __LF \ - adcs x13, x13, x6 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x6, cs __LF \ - umulh x7, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x7 __LF \ - mul x7, x3, x3 __LF \ - adcs x10, x10, x7 __LF \ - umulh x7, x3, x3 __LF \ - adcs x11, x11, x7 __LF \ - mul x7, x4, x4 __LF \ - adcs x12, x12, x7 __LF \ - umulh x7, x4, x4 __LF \ - adcs x13, x13, x7 __LF \ - mul x7, x5, x5 __LF \ - adcs x14, x14, x7 __LF \ - umulh x7, x5, x5 __LF \ - adc x6, x6, x7 __LF \ - mov x3, #0x3d1 __LF \ - orr x3, x3, #0x100000000 __LF \ - mul x7, x3, x12 __LF \ - umulh x4, x3, x12 __LF \ - adds x8, x8, x7 __LF \ - mul x7, x3, x13 __LF \ - umulh x13, x3, x13 __LF \ - adcs x9, x9, x7 __LF \ - mul x7, x3, x14 __LF \ - umulh x14, x3, x14 __LF \ - adcs x10, x10, x7 __LF \ - mul x7, x3, x6 __LF \ - umulh x6, x3, x6 __LF \ - adcs x11, x11, x7 __LF \ - cset x12, cs __LF \ - adds x9, x9, x4 __LF \ - adcs x10, x10, x13 __LF \ - adcs x11, x11, x14 __LF \ - adc x12, x12, x6 __LF \ - add x2, x12, #0x1 __LF \ - mul x7, x3, x2 __LF \ - umulh x6, x3, x2 __LF \ - adds x8, x8, x7 __LF \ - adcs x9, x9, x6 __LF \ - adcs x10, x10, xzr __LF \ - adcs x11, x11, xzr __LF \ - csel x3, x3, xzr, cc __LF \ - subs x8, x8, x3 __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbc x11, x11, xzr __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Corresponds exactly to bignum_sub_p256k1 - -#define sub_p256k1(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #0x3d1 __LF \ - orr x3, x4, #0x100000000 __LF \ - csel x3, x3, xzr, cc __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -S2N_BN_SYMBOL(secp256k1_jadd_alt): - CFI_START - -// Make room on stack for temporary variables -// Move the input arguments to stable places - - CFI_DEC_SP(NSPACE) - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations - - sqr_p256k1(z1sq,z_1) - sqr_p256k1(z2sq,z_2) - - mul_p256k1(y1a,z_2,y_1) - mul_p256k1(y2a,z_1,y_2) - - mul_p256k1(x2a,z1sq,x_2) - mul_p256k1(x1a,z2sq,x_1) - mul_p256k1(y2a,z1sq,y2a) - mul_p256k1(y1a,z2sq,y1a) - - sub_p256k1(xd,x2a,x1a) - sub_p256k1(yd,y2a,y1a) - - sqr_p256k1(zz,xd) - sqr_p256k1(ww,yd) - - mul_p256k1(zzx1,zz,x1a) - mul_p256k1(zzx2,zz,x2a) - - sub_p256k1(resx,ww,zzx1) - sub_p256k1(t1,zzx2,zzx1) - - mul_p256k1(xd,xd,z_1) - - sub_p256k1(resx,resx,zzx2) - - sub_p256k1(t2,zzx1,resx) - - mul_p256k1(t1,t1,y1a) - mul_p256k1(resz,xd,z_2) - mul_p256k1(t2,yd,t2) - - sub_p256k1(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "HI" <=> CF /\ ~ZF <=> P1 = 0 /\ ~(P2 = 0) -// and "LO" <=> ~CF <=> ~(P1 = 0) /\ P2 = 0 - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - - orr x12, x0, x1 - orr x13, x2, x3 - orr x12, x12, x13 - cmp x12, xzr - cset x12, ne - - ldp x4, x5, [z_2] - ldp x6, x7, [z_2+16] - - orr x13, x4, x5 - orr x14, x6, x7 - orr x13, x13, x14 - cmp x13, xzr - cset x13, ne - - cmp x13, x12 - -// Multiplex the outputs accordingly, re-using the z's in registers - - ldp x8, x9, [resz] - csel x8, x0, x8, lo - csel x9, x1, x9, lo - csel x8, x4, x8, hi - csel x9, x5, x9, hi - ldp x10, x11, [resz+16] - csel x10, x2, x10, lo - csel x11, x3, x11, lo - csel x10, x6, x10, hi - csel x11, x7, x11, hi - - ldp x12, x13, [x_1] - ldp x0, x1, [resx] - csel x0, x12, x0, lo - csel x1, x13, x1, lo - ldp x12, x13, [x_2] - csel x0, x12, x0, hi - csel x1, x13, x1, hi - - ldp x12, x13, [x_1+16] - ldp x2, x3, [resx+16] - csel x2, x12, x2, lo - csel x3, x13, x3, lo - ldp x12, x13, [x_2+16] - csel x2, x12, x2, hi - csel x3, x13, x3, hi - - ldp x12, x13, [y_1] - ldp x4, x5, [resy] - csel x4, x12, x4, lo - csel x5, x13, x5, lo - ldp x12, x13, [y_2] - csel x4, x12, x4, hi - csel x5, x13, x5, hi - - ldp x12, x13, [y_1+16] - ldp x6, x7, [resy+16] - csel x6, x12, x6, lo - csel x7, x13, x7, lo - ldp x12, x13, [y_2+16] - csel x6, x12, x6, hi - csel x7, x13, x7, hi - -// Finally store back the multiplexed values - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [y_3] - stp x6, x7, [y_3+16] - stp x8, x9, [z_3] - stp x10, x11, [z_3+16] - -// Restore stack and return - - CFI_INC_SP(NSPACE) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(secp256k1_jadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jdouble.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jdouble.S deleted file mode 100644 index f4f257fba62..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jdouble.S +++ /dev/null @@ -1,895 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on SECG curve secp256k1 in Jacobian coordinates -// -// extern void secp256k1_jdouble(uint64_t p3[static 12], -// const uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// It is assumed that all coordinates of the input point are fully -// reduced mod p_256k1 and that the z coordinate is not zero. -// -// Standard ARM ABI: X0 = p3, X1 = p1 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(secp256k1_jdouble) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(secp256k1_jdouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(secp256k1_jdouble) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x19 -#define input_x x20 - -// The magic constant 2^256 - p_256k1 - -#define pconst x17 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries - -#define x_2 sp, #(NUMSIZE*0) -#define y_2 sp, #(NUMSIZE*1) -#define d sp, #(NUMSIZE*2) -#define tmp sp, #(NUMSIZE*3) -#define x_4 sp, #(NUMSIZE*4) -#define y_4 sp, #(NUMSIZE*6) -#define dx2 sp, #(NUMSIZE*8) -#define xy2 sp, #(NUMSIZE*10) - -#define NSPACE NUMSIZE*12 - -// Corresponds exactly to bignum_mul_p256k1 except for registers and -// re-use of the pconst register for the constant 4294968273 - -#define mul_p256k1(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - mul x7, x3, x5 __LF \ - umulh x8, x3, x5 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, lo __LF \ - csetm x16, lo __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, lo __LF \ - cinv x16, x16, lo __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - mul x11, x3, x5 __LF \ - umulh x12, x3, x5 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, lo __LF \ - csetm x16, lo __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, lo __LF \ - cinv x16, x16, lo __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, lo __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, lo __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, lo __LF \ - csetm x9, lo __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, lo __LF \ - cinv x9, x9, lo __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x16, #977 __LF \ - mul x3, pconst, x11 __LF \ - umulh x5, pconst, x11 __LF \ - and x15, x12, #0xffffffff __LF \ - lsr x2, x12, #32 __LF \ - mul x4, x16, x15 __LF \ - madd x15, x16, x2, x15 __LF \ - adds x4, x4, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x6, x2, x15 __LF \ - mul x11, pconst, x13 __LF \ - umulh x13, pconst, x13 __LF \ - and x15, x14, #0xffffffff __LF \ - lsr x2, x14, #32 __LF \ - mul x12, x16, x15 __LF \ - madd x15, x16, x2, x15 __LF \ - adds x12, x12, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x14, x2, x15 __LF \ - adds x7, x7, x3 __LF \ - adcs x8, x8, x4 __LF \ - adcs x9, x9, x11 __LF \ - adcs x10, x10, x12 __LF \ - cset x11, hs __LF \ - adds x8, x8, x5 __LF \ - adcs x9, x9, x6 __LF \ - adcs x10, x10, x13 __LF \ - adc x11, x11, x14 __LF \ - add x0, x11, #1 __LF \ - mul x3, x16, x0 __LF \ - lsr x4, x0, #32 __LF \ - adds x3, x3, x0, lsl #32 __LF \ - adc x4, xzr, x4 __LF \ - adds x7, x7, x3 __LF \ - adcs x8, x8, x4 __LF \ - adcs x9, x9, xzr __LF \ - adcs x10, x10, xzr __LF \ - csel x1, pconst, xzr, lo __LF \ - subs x7, x7, x1 __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// Corresponds exactly to bignum_sqr_p256k1 except for -// re-use of the pconst register for the constant 4294968273 - -#define sqr_p256k1(P0,P1) \ - ldp x10, x11, [P1] __LF \ - ldp x12, x13, [P1+16] __LF \ - umull x2, w10, w10 __LF \ - lsr x14, x10, #32 __LF \ - umull x3, w14, w14 __LF \ - umull x14, w10, w14 __LF \ - adds x2, x2, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x3, x3, x14 __LF \ - umull x4, w11, w11 __LF \ - lsr x14, x11, #32 __LF \ - umull x5, w14, w14 __LF \ - umull x14, w11, w14 __LF \ - mul x15, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x4, x4, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x5, x5, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x5, x5, xzr __LF \ - adds x3, x3, x15 __LF \ - adcs x4, x4, x16 __LF \ - adc x5, x5, xzr __LF \ - umull x6, w12, w12 __LF \ - lsr x14, x12, #32 __LF \ - umull x7, w14, w14 __LF \ - umull x14, w12, w14 __LF \ - adds x6, x6, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x7, x7, x14 __LF \ - umull x8, w13, w13 __LF \ - lsr x14, x13, #32 __LF \ - umull x9, w14, w14 __LF \ - umull x14, w13, w14 __LF \ - mul x15, x12, x13 __LF \ - umulh x16, x12, x13 __LF \ - adds x8, x8, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x9, x9, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x9, x9, xzr __LF \ - adds x7, x7, x15 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, xzr __LF \ - subs x10, x10, x12 __LF \ - sbcs x11, x11, x13 __LF \ - csetm x16, lo __LF \ - eor x10, x10, x16 __LF \ - subs x10, x10, x16 __LF \ - eor x11, x11, x16 __LF \ - sbc x11, x11, x16 __LF \ - adds x6, x6, x4 __LF \ - adcs x7, x7, x5 __LF \ - adcs x8, x8, xzr __LF \ - adc x9, x9, xzr __LF \ - umull x12, w10, w10 __LF \ - lsr x5, x10, #32 __LF \ - umull x13, w5, w5 __LF \ - umull x5, w10, w5 __LF \ - adds x12, x12, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x13, x13, x5 __LF \ - umull x15, w11, w11 __LF \ - lsr x5, x11, #32 __LF \ - umull x14, w5, w5 __LF \ - umull x5, w11, w5 __LF \ - mul x4, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x15, x15, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x14, x14, x5 __LF \ - adds x4, x4, x4 __LF \ - adcs x16, x16, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x13, x13, x4 __LF \ - adcs x15, x15, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x4, x2, x6 __LF \ - adcs x5, x3, x7 __LF \ - adcs x6, x6, x8 __LF \ - adcs x7, x7, x9 __LF \ - csetm x16, lo __LF \ - subs x4, x4, x12 __LF \ - sbcs x5, x5, x13 __LF \ - sbcs x6, x6, x15 __LF \ - sbcs x7, x7, x14 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, x16 __LF \ - mov x16, #977 __LF \ - mul x10, pconst, x6 __LF \ - umulh x13, pconst, x6 __LF \ - and x6, x7, #0xffffffff __LF \ - lsr x7, x7, #32 __LF \ - mul x11, x16, x6 __LF \ - madd x6, x16, x7, x6 __LF \ - adds x11, x11, x6, lsl #32 __LF \ - lsr x6, x6, #32 __LF \ - adc x14, x7, x6 __LF \ - mul x12, pconst, x8 __LF \ - umulh x8, pconst, x8 __LF \ - and x6, x9, #0xffffffff __LF \ - lsr x7, x9, #32 __LF \ - mul x9, x16, x6 __LF \ - madd x6, x16, x7, x6 __LF \ - adds x9, x9, x6, lsl #32 __LF \ - lsr x6, x6, #32 __LF \ - adc x15, x7, x6 __LF \ - adds x2, x2, x10 __LF \ - adcs x3, x3, x11 __LF \ - adcs x4, x4, x12 __LF \ - adcs x5, x5, x9 __LF \ - cset x6, hs __LF \ - adds x3, x3, x13 __LF \ - adcs x4, x4, x14 __LF \ - adcs x5, x5, x8 __LF \ - adc x6, x6, x15 __LF \ - add x6, x6, #1 __LF \ - mul x10, x16, x6 __LF \ - lsr x11, x6, #32 __LF \ - adds x10, x10, x6, lsl #32 __LF \ - adc x11, xzr, x11 __LF \ - adds x2, x2, x10 __LF \ - adcs x3, x3, x11 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - csel x16, pconst, xzr, lo __LF \ - subs x2, x2, x16 __LF \ - sbcs x3, x3, xzr __LF \ - sbcs x4, x4, xzr __LF \ - sbc x5, x5, xzr __LF \ - stp x2, x3, [P0] __LF \ - stp x4, x5, [P0+16] - -// Rough versions producing 5-word results - -#define roughmul_p256k1(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - mul x7, x3, x5 __LF \ - umulh x8, x3, x5 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, lo __LF \ - csetm x16, lo __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, lo __LF \ - cinv x16, x16, lo __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - mul x11, x3, x5 __LF \ - umulh x12, x3, x5 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, lo __LF \ - csetm x16, lo __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, lo __LF \ - cinv x16, x16, lo __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, lo __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, lo __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, lo __LF \ - csetm x9, lo __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, lo __LF \ - cinv x9, x9, lo __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x16, #977 __LF \ - mul x3, pconst, x11 __LF \ - umulh x5, pconst, x11 __LF \ - and x15, x12, #0xffffffff __LF \ - lsr x2, x12, #32 __LF \ - mul x4, x16, x15 __LF \ - madd x15, x16, x2, x15 __LF \ - adds x4, x4, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x6, x2, x15 __LF \ - mul x11, pconst, x13 __LF \ - umulh x13, pconst, x13 __LF \ - and x15, x14, #0xffffffff __LF \ - lsr x2, x14, #32 __LF \ - mul x12, x16, x15 __LF \ - madd x15, x16, x2, x15 __LF \ - adds x12, x12, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x14, x2, x15 __LF \ - adds x7, x7, x3 __LF \ - adcs x8, x8, x4 __LF \ - adcs x9, x9, x11 __LF \ - adcs x10, x10, x12 __LF \ - cset x11, hs __LF \ - adds x8, x8, x5 __LF \ - adcs x9, x9, x6 __LF \ - adcs x10, x10, x13 __LF \ - adc x11, x11, x14 __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] __LF \ - str x11, [P0+32] - -#define roughsqr_p256k1(P0,P1) \ - ldp x10, x11, [P1] __LF \ - ldp x12, x13, [P1+16] __LF \ - umull x2, w10, w10 __LF \ - lsr x14, x10, #32 __LF \ - umull x3, w14, w14 __LF \ - umull x14, w10, w14 __LF \ - adds x2, x2, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x3, x3, x14 __LF \ - umull x4, w11, w11 __LF \ - lsr x14, x11, #32 __LF \ - umull x5, w14, w14 __LF \ - umull x14, w11, w14 __LF \ - mul x15, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x4, x4, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x5, x5, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x5, x5, xzr __LF \ - adds x3, x3, x15 __LF \ - adcs x4, x4, x16 __LF \ - adc x5, x5, xzr __LF \ - umull x6, w12, w12 __LF \ - lsr x14, x12, #32 __LF \ - umull x7, w14, w14 __LF \ - umull x14, w12, w14 __LF \ - adds x6, x6, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x7, x7, x14 __LF \ - umull x8, w13, w13 __LF \ - lsr x14, x13, #32 __LF \ - umull x9, w14, w14 __LF \ - umull x14, w13, w14 __LF \ - mul x15, x12, x13 __LF \ - umulh x16, x12, x13 __LF \ - adds x8, x8, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x9, x9, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x9, x9, xzr __LF \ - adds x7, x7, x15 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, xzr __LF \ - subs x10, x10, x12 __LF \ - sbcs x11, x11, x13 __LF \ - csetm x16, lo __LF \ - eor x10, x10, x16 __LF \ - subs x10, x10, x16 __LF \ - eor x11, x11, x16 __LF \ - sbc x11, x11, x16 __LF \ - adds x6, x6, x4 __LF \ - adcs x7, x7, x5 __LF \ - adcs x8, x8, xzr __LF \ - adc x9, x9, xzr __LF \ - umull x12, w10, w10 __LF \ - lsr x5, x10, #32 __LF \ - umull x13, w5, w5 __LF \ - umull x5, w10, w5 __LF \ - adds x12, x12, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x13, x13, x5 __LF \ - umull x15, w11, w11 __LF \ - lsr x5, x11, #32 __LF \ - umull x14, w5, w5 __LF \ - umull x5, w11, w5 __LF \ - mul x4, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x15, x15, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x14, x14, x5 __LF \ - adds x4, x4, x4 __LF \ - adcs x16, x16, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x13, x13, x4 __LF \ - adcs x15, x15, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x4, x2, x6 __LF \ - adcs x5, x3, x7 __LF \ - adcs x6, x6, x8 __LF \ - adcs x7, x7, x9 __LF \ - csetm x16, lo __LF \ - subs x4, x4, x12 __LF \ - sbcs x5, x5, x13 __LF \ - sbcs x6, x6, x15 __LF \ - sbcs x7, x7, x14 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, x16 __LF \ - mov x16, #977 __LF \ - mul x10, pconst, x6 __LF \ - umulh x13, pconst, x6 __LF \ - and x6, x7, #0xffffffff __LF \ - lsr x7, x7, #32 __LF \ - mul x11, x16, x6 __LF \ - madd x6, x16, x7, x6 __LF \ - adds x11, x11, x6, lsl #32 __LF \ - lsr x6, x6, #32 __LF \ - adc x14, x7, x6 __LF \ - mul x12, pconst, x8 __LF \ - umulh x8, pconst, x8 __LF \ - and x6, x9, #0xffffffff __LF \ - lsr x7, x9, #32 __LF \ - mul x9, x16, x6 __LF \ - madd x6, x16, x7, x6 __LF \ - adds x9, x9, x6, lsl #32 __LF \ - lsr x6, x6, #32 __LF \ - adc x15, x7, x6 __LF \ - adds x2, x2, x10 __LF \ - adcs x3, x3, x11 __LF \ - adcs x4, x4, x12 __LF \ - adcs x5, x5, x9 __LF \ - cset x6, hs __LF \ - adds x3, x3, x13 __LF \ - adcs x4, x4, x14 __LF \ - adcs x5, x5, x8 __LF \ - adc x6, x6, x15 __LF \ - stp x2, x3, [P0] __LF \ - stp x4, x5, [P0+16] __LF \ - str x6, [P0+32] - -// Weak doubling operation, staying in 4 digits but not in general -// fully normalizing modulo p_256k1 - -#define weakdouble_p256k1(P0,P1) \ - ldp x1, x2, [P1] __LF \ - lsl x0, x1, #1 __LF \ - ldp x3, x4, [P1+16] __LF \ - ands xzr, x4, #0x8000000000000000 __LF \ - csel x5, pconst, xzr, ne __LF \ - extr x1, x2, x1, #63 __LF \ - adds x0, x0, x5 __LF \ - extr x2, x3, x2, #63 __LF \ - adcs x1, x1, xzr __LF \ - extr x3, x4, x3, #63 __LF \ - adcs x2, x2, xzr __LF \ - stp x0, x1, [P0] __LF \ - adc x3, x3, xzr __LF \ - stp x2, x3, [P0+16] - -// P0 = C * P1 - D * P2 with 5-word inputs P1 and P2 -// Only used here with C = 12, D = 9, but could be used more generally. -// We start with (2^40 * 2^256 + C * P1) - (D * P2 + 2^40 * k) -// where p_256k1 = 2^256 - k (so k = 4294968273) - -#define cmsub_p256k1(P0,C,P1,D,P2) \ - mov x10, C __LF \ - ldp x4, x5, [P1] __LF \ - mul x0, x4, x10 __LF \ - mul x1, x5, x10 __LF \ - ldp x6, x7, [P1+16] __LF \ - mul x2, x6, x10 __LF \ - mul x3, x7, x10 __LF \ - ldr x13, [P1+32] __LF \ - umulh x4, x4, x10 __LF \ - adds x1, x1, x4 __LF \ - umulh x5, x5, x10 __LF \ - adcs x2, x2, x5 __LF \ - umulh x6, x6, x10 __LF \ - adcs x3, x3, x6 __LF \ - umulh x4, x7, x10 __LF \ - mul x13, x13, x10 __LF \ - adc x9, x4, x13 __LF \ - orr x9, x9, #0x10000000000 __LF \ - /* [x9; x3;x2;x1;x0] = 2^40 * 2^256 + C * P1 */ \ - mov x10, D __LF \ - ldp x13, x14, [P2] __LF \ - mul x5, x14, x10 __LF \ - umulh x6, x14, x10 __LF \ - adds x5, x5, pconst, lsr #24 __LF \ - adc x6, x6, xzr __LF \ - mul x4, x13, x10 __LF \ - adds x4, x4, pconst, lsl #40 __LF \ - umulh x13, x13, x10 __LF \ - adcs x5, x5, x13 __LF \ - ldp x13, x14, [P2+16] __LF \ - mul x12, x13, x10 __LF \ - umulh x7, x13, x10 __LF \ - ldr x13, [P2+32] __LF \ - adcs x6, x6, x12 __LF \ - mul x12, x14, x10 __LF \ - umulh x8, x14, x10 __LF \ - mul x13, x13, x10 __LF \ - adcs x7, x7, x12 __LF \ - adc x8, x8, x13 __LF \ - /* [x8; x7;x6;x5;x4] = D * P2 + 2^40 * k */ \ - subs x0, x0, x4 __LF \ - sbcs x1, x1, x5 __LF \ - sbcs x2, x2, x6 __LF \ - sbcs x3, x3, x7 __LF \ - sbc x4, x9, x8 __LF \ - /* [x4; x3;x2;x1;x0] = 2^40*p_256k1+result */ \ - add x10, x4, #1 __LF \ - /* (h + 1) is quotient estimate */ \ - mul x4, pconst, x10 __LF \ - umulh x5, pconst, x10 __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - adcs x2, x2, xzr __LF \ - adcs x3, x3, xzr __LF \ - csel x11, pconst, xzr, cc __LF \ - /* If un-correction needed */ \ - subs x0, x0, x11 __LF \ - sbcs x1, x1, xzr __LF \ - stp x0, x1, [P0] __LF \ - sbcs x2, x2, xzr __LF \ - sbc x3, x3, xzr __LF \ - stp x2, x3, [P0+16] - -// P0 = 3 * P1 - 8 * P2 with 5-digit P1 and P2 -// We start with (2^40 * 2^256 + 3 * P1) - (8 * P2 + 2^40 * k) -// where p_256k1 = 2^256 - k (so k = 4294968273) - -#define cmsub38_p256k1(P0,P1,P2) \ - mov x10, #3 __LF \ - ldp x4, x5, [P1] __LF \ - mul x0, x4, x10 __LF \ - mul x1, x5, x10 __LF \ - ldp x6, x7, [P1+16] __LF \ - mul x2, x6, x10 __LF \ - mul x3, x7, x10 __LF \ - ldr x13, [P1+32] __LF \ - umulh x4, x4, x10 __LF \ - adds x1, x1, x4 __LF \ - umulh x5, x5, x10 __LF \ - adcs x2, x2, x5 __LF \ - umulh x6, x6, x10 __LF \ - adcs x3, x3, x6 __LF \ - umulh x4, x7, x10 __LF \ - mul x13, x13, x10 __LF \ - adc x9, x4, x13 __LF \ - orr x9, x9, #0x10000000000 __LF \ - /* [x9; x3;x2;x1;x0] = 2^40 * 2^256 + 3 * P1 */ \ - lsl x12, pconst, #40 __LF \ - ldp x13, x14, [P2] __LF \ - lsl x4, x13, #3 __LF \ - adds x4, x4, x12 __LF \ - extr x5, x14, x13, #61 __LF \ - lsr x12, pconst, #24 __LF \ - adcs x5, x5, x12 __LF \ - ldp x11, x12, [P2+16] __LF \ - extr x6, x11, x14, #61 __LF \ - adcs x6, x6, xzr __LF \ - ldr x13, [P2+32] __LF \ - extr x7, x12, x11, #61 __LF \ - adcs x7, x7, xzr __LF \ - extr x8, x13, x12, #61 __LF \ - adc x8, x8, xzr __LF \ - /* [x8; x7;x6;x5;x4] = 8 * P2 + 2^40 * k */ \ - subs x0, x0, x4 __LF \ - sbcs x1, x1, x5 __LF \ - sbcs x2, x2, x6 __LF \ - sbcs x3, x3, x7 __LF \ - sbc x4, x9, x8 __LF \ - /* [x4; x3;x2;x1;x0] = 2^40*p_256k1+result */ \ - add x10, x4, #1 __LF \ - /* (h + 1) is quotient estimate */ \ - mul x4, pconst, x10 __LF \ - umulh x5, pconst, x10 __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - adcs x2, x2, xzr __LF \ - adcs x3, x3, xzr __LF \ - csel x11, pconst, xzr, cc __LF \ - /* If un-correction needed */ \ - subs x0, x0, x11 __LF \ - sbcs x1, x1, xzr __LF \ - stp x0, x1, [P0] __LF \ - sbcs x2, x2, xzr __LF \ - sbc x3, x3, xzr __LF \ - stp x2, x3, [P0+16] - -// P0 = 4 * P1 - P2 with 5-digit P1, 4-digit P2 and result. -// This is done by direct subtraction of P2 since the method -// in bignum_cmul_p256k1 etc. for quotient estimation still -// works when the value to be reduced is negative, as -// long as it is > -p_256k1, which is the case here. - -#define cmsub41_p256k1(P0,P1,P2) \ - ldp x1, x2, [P1] __LF \ - lsl x0, x1, #2 __LF \ - ldp x6, x7, [P2] __LF \ - subs x0, x0, x6 __LF \ - extr x1, x2, x1, #62 __LF \ - sbcs x1, x1, x7 __LF \ - ldp x3, x4, [P1+16] __LF \ - extr x2, x3, x2, #62 __LF \ - ldp x6, x7, [P2+16] __LF \ - sbcs x2, x2, x6 __LF \ - extr x3, x4, x3, #62 __LF \ - sbcs x3, x3, x7 __LF \ - ldr x5, [P1+32] __LF \ - extr x4, x5, x4, #62 __LF \ - sbc x4, x4, xzr __LF \ - add x5, x4, #1 __LF \ - /* (h + 1) is quotient estimate */ \ - mul x4, pconst, x5 __LF \ - adds x0, x0, x4 __LF \ - umulh x5, pconst, x5 __LF \ - adcs x1, x1, x5 __LF \ - adcs x2, x2, xzr __LF \ - adcs x3, x3, xzr __LF \ - csel x4, pconst, xzr, cc __LF \ - /* If un-correction needed */ \ - subs x0, x0, x4 __LF \ - sbcs x1, x1, xzr __LF \ - stp x0, x1, [P0] __LF \ - sbcs x2, x2, xzr __LF \ - sbc x3, x3, xzr __LF \ - stp x2, x3, [P0+16] - -S2N_BN_SYMBOL(secp256k1_jdouble): - CFI_START - -// Save registers and make room on stack for temporary variables - - CFI_DEC_SP(NSPACE+16) - CFI_STACKSAVE2(x19,x20,NSPACE) - -// Move the input arguments to stable place - - mov input_z, x0 - mov input_x, x1 - -// Set up pconst = 4294968273, so p_256k1 = 2^256 - pconst - - mov pconst, #977 - orr pconst, pconst, #0x100000000 - -// Main sequence of operations - - // y_2 = y^2 - - sqr_p256k1(y_2,y_1) - - // x_2 = x^2 - - sqr_p256k1(x_2,x_1) - - // tmp = 2 * y_1 (in 4 words but not fully normalized) - - weakdouble_p256k1(tmp,y_1) - - // xy2 = x * y^2 (5-digit partially reduced) - // x_4 = x^4 (5-digit partially reduced) - - roughmul_p256k1(xy2,x_1,y_2) - roughsqr_p256k1(x_4,x_2) - - // z_3 = 2 * y_1 * z_1 - - mul_p256k1(z_3,z_1,tmp) - - // d = 12 * xy2 - 9 * x_4 - - cmsub_p256k1(d,12,xy2,9,x_4) - - // y4 = y2^2 (5-digit partially reduced) - - roughsqr_p256k1(y_4,y_2) - - // dx2 = d * x_2 (5-digit partially reduced) - - roughmul_p256k1(dx2,x_2,d) - - // x_3 = 4 * xy2 - d - - cmsub41_p256k1(x_3,xy2,d) - - // y_3 = 3 * dx2 - 8 * y_4 - - cmsub38_p256k1(y_3,dx2,y_4) - -// Restore stack and return - - CFI_STACKLOAD2(x19,x20,NSPACE) - CFI_INC_SP((NSPACE+16)) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(secp256k1_jdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jdouble_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jdouble_alt.S deleted file mode 100644 index dd360d5a46e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jdouble_alt.S +++ /dev/null @@ -1,665 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on SECG curve secp256k1 in Jacobian coordinates -// -// extern void secp256k1_jdouble_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// It is assumed that all coordinates of the input point are fully -// reduced mod p_256k1 and that the z coordinate is not zero. -// -// Standard ARM ABI: X0 = p3, X1 = p1 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(secp256k1_jdouble_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(secp256k1_jdouble_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(secp256k1_jdouble_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x15 -#define input_x x16 - -// The magic constant 2^256 - p_256k1 - -#define pconst x17 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries - -#define x_2 sp, #(NUMSIZE*0) -#define y_2 sp, #(NUMSIZE*1) -#define d sp, #(NUMSIZE*2) -#define tmp sp, #(NUMSIZE*3) -#define x_4 sp, #(NUMSIZE*4) -#define y_4 sp, #(NUMSIZE*6) -#define dx2 sp, #(NUMSIZE*8) -#define xy2 sp, #(NUMSIZE*10) - -#define NSPACE NUMSIZE*12 - -// Corresponds exactly to bignum_mul_p256k1_alt except for -// re-use of the pconst register for the constant 4294968273 - -#define mul_p256k1(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x0, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x1, x3, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x1, x1, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x1, x1, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x0, x0, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x1, x1, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x0, x0, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x1, x1, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x0, x0, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x1, x1, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mul x11, pconst, x1 __LF \ - umulh x9, pconst, x1 __LF \ - adds x12, x12, x11 __LF \ - mul x11, pconst, x3 __LF \ - umulh x3, pconst, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, pconst, x4 __LF \ - umulh x4, pconst, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, pconst, x5 __LF \ - umulh x5, pconst, x5 __LF \ - adcs x0, x0, x11 __LF \ - cset x1, cs __LF \ - adds x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adcs x0, x0, x4 __LF \ - adc x1, x1, x5 __LF \ - add x8, x1, #0x1 __LF \ - mul x11, pconst, x8 __LF \ - umulh x9, pconst, x8 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, xzr __LF \ - adcs x0, x0, xzr __LF \ - csel x7, pconst, xzr, cc __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x0, x0, xzr __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x0, [P0+16] - -// Corresponds exactly to bignum_sqr_p256k1_alt except for -// re-use of the pconst register for the constant 4294968273 - -#define sqr_p256k1(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x7, x2, x4 __LF \ - umulh x6, x2, x4 __LF \ - adds x10, x10, x7 __LF \ - adcs x11, x11, x6 __LF \ - mul x7, x3, x4 __LF \ - umulh x6, x3, x4 __LF \ - adc x6, x6, xzr __LF \ - adds x11, x11, x7 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x6 __LF \ - mul x7, x3, x5 __LF \ - umulh x6, x3, x5 __LF \ - adc x6, x6, xzr __LF \ - adds x12, x12, x7 __LF \ - adcs x13, x13, x6 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x6, cs __LF \ - umulh x7, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x7 __LF \ - mul x7, x3, x3 __LF \ - adcs x10, x10, x7 __LF \ - umulh x7, x3, x3 __LF \ - adcs x11, x11, x7 __LF \ - mul x7, x4, x4 __LF \ - adcs x12, x12, x7 __LF \ - umulh x7, x4, x4 __LF \ - adcs x13, x13, x7 __LF \ - mul x7, x5, x5 __LF \ - adcs x14, x14, x7 __LF \ - umulh x7, x5, x5 __LF \ - adc x6, x6, x7 __LF \ - mul x7, pconst, x12 __LF \ - umulh x4, pconst, x12 __LF \ - adds x8, x8, x7 __LF \ - mul x7, pconst, x13 __LF \ - umulh x13, pconst, x13 __LF \ - adcs x9, x9, x7 __LF \ - mul x7, pconst, x14 __LF \ - umulh x14, pconst, x14 __LF \ - adcs x10, x10, x7 __LF \ - mul x7, pconst, x6 __LF \ - umulh x6, pconst, x6 __LF \ - adcs x11, x11, x7 __LF \ - cset x12, cs __LF \ - adds x9, x9, x4 __LF \ - adcs x10, x10, x13 __LF \ - adcs x11, x11, x14 __LF \ - adc x12, x12, x6 __LF \ - add x2, x12, #0x1 __LF \ - mul x7, pconst, x2 __LF \ - umulh x6, pconst, x2 __LF \ - adds x8, x8, x7 __LF \ - adcs x9, x9, x6 __LF \ - adcs x10, x10, xzr __LF \ - adcs x11, x11, xzr __LF \ - csel x3, pconst, xzr, cc __LF \ - subs x8, x8, x3 __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbc x11, x11, xzr __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Rough versions producing 5-word results - -#define roughmul_p256k1(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x0, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x1, x3, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x1, x1, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x1, x1, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x0, x0, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x1, x1, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x0, x0, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x1, x1, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x0, x0, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x1, x1, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mul x11, pconst, x1 __LF \ - umulh x9, pconst, x1 __LF \ - adds x12, x12, x11 __LF \ - mul x11, pconst, x3 __LF \ - umulh x3, pconst, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, pconst, x4 __LF \ - umulh x4, pconst, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, pconst, x5 __LF \ - umulh x5, pconst, x5 __LF \ - adcs x0, x0, x11 __LF \ - cset x1, cs __LF \ - adds x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adcs x0, x0, x4 __LF \ - adc x1, x1, x5 __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x0, [P0+16] __LF \ - str x1, [P0+32] - -#define roughsqr_p256k1(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x7, x2, x4 __LF \ - umulh x6, x2, x4 __LF \ - adds x10, x10, x7 __LF \ - adcs x11, x11, x6 __LF \ - mul x7, x3, x4 __LF \ - umulh x6, x3, x4 __LF \ - adc x6, x6, xzr __LF \ - adds x11, x11, x7 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x6 __LF \ - mul x7, x3, x5 __LF \ - umulh x6, x3, x5 __LF \ - adc x6, x6, xzr __LF \ - adds x12, x12, x7 __LF \ - adcs x13, x13, x6 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x6, cs __LF \ - umulh x7, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x7 __LF \ - mul x7, x3, x3 __LF \ - adcs x10, x10, x7 __LF \ - umulh x7, x3, x3 __LF \ - adcs x11, x11, x7 __LF \ - mul x7, x4, x4 __LF \ - adcs x12, x12, x7 __LF \ - umulh x7, x4, x4 __LF \ - adcs x13, x13, x7 __LF \ - mul x7, x5, x5 __LF \ - adcs x14, x14, x7 __LF \ - umulh x7, x5, x5 __LF \ - adc x6, x6, x7 __LF \ - mul x7, pconst, x12 __LF \ - umulh x4, pconst, x12 __LF \ - adds x8, x8, x7 __LF \ - mul x7, pconst, x13 __LF \ - umulh x13, pconst, x13 __LF \ - adcs x9, x9, x7 __LF \ - mul x7, pconst, x14 __LF \ - umulh x14, pconst, x14 __LF \ - adcs x10, x10, x7 __LF \ - mul x7, pconst, x6 __LF \ - umulh x6, pconst, x6 __LF \ - adcs x11, x11, x7 __LF \ - cset x12, cs __LF \ - adds x9, x9, x4 __LF \ - adcs x10, x10, x13 __LF \ - adcs x11, x11, x14 __LF \ - adc x12, x12, x6 __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] __LF \ - str x12, [P0+32] - -// Weak doubling operation, staying in 4 digits but not in general -// fully normalizing modulo p_256k1 - -#define weakdouble_p256k1(P0,P1) \ - ldp x1, x2, [P1] __LF \ - lsl x0, x1, #1 __LF \ - ldp x3, x4, [P1+16] __LF \ - ands xzr, x4, #0x8000000000000000 __LF \ - csel x5, pconst, xzr, ne __LF \ - extr x1, x2, x1, #63 __LF \ - adds x0, x0, x5 __LF \ - extr x2, x3, x2, #63 __LF \ - adcs x1, x1, xzr __LF \ - extr x3, x4, x3, #63 __LF \ - adcs x2, x2, xzr __LF \ - stp x0, x1, [P0] __LF \ - adc x3, x3, xzr __LF \ - stp x2, x3, [P0+16] - -// P0 = C * P1 - D * P2 with 5-word inputs P1 and P2 -// Only used here with C = 12, D = 9, but could be used more generally. -// We start with (2^40 * 2^256 + C * P1) - (D * P2 + 2^40 * k) -// where p_256k1 = 2^256 - k (so k = 4294968273) - -#define cmsub_p256k1(P0,C,P1,D,P2) \ - mov x10, C __LF \ - ldp x4, x5, [P1] __LF \ - mul x0, x4, x10 __LF \ - mul x1, x5, x10 __LF \ - ldp x6, x7, [P1+16] __LF \ - mul x2, x6, x10 __LF \ - mul x3, x7, x10 __LF \ - ldr x13, [P1+32] __LF \ - umulh x4, x4, x10 __LF \ - adds x1, x1, x4 __LF \ - umulh x5, x5, x10 __LF \ - adcs x2, x2, x5 __LF \ - umulh x6, x6, x10 __LF \ - adcs x3, x3, x6 __LF \ - umulh x4, x7, x10 __LF \ - mul x13, x13, x10 __LF \ - adc x9, x4, x13 __LF \ - orr x9, x9, #0x10000000000 __LF \ - /* [x9; x3;x2;x1;x0] = 2^40 * 2^256 + C * P1 */ \ - mov x10, D __LF \ - ldp x13, x14, [P2] __LF \ - mul x5, x14, x10 __LF \ - umulh x6, x14, x10 __LF \ - adds x5, x5, pconst, lsr #24 __LF \ - adc x6, x6, xzr __LF \ - mul x4, x13, x10 __LF \ - adds x4, x4, pconst, lsl #40 __LF \ - umulh x13, x13, x10 __LF \ - adcs x5, x5, x13 __LF \ - ldp x13, x14, [P2+16] __LF \ - mul x12, x13, x10 __LF \ - umulh x7, x13, x10 __LF \ - ldr x13, [P2+32] __LF \ - adcs x6, x6, x12 __LF \ - mul x12, x14, x10 __LF \ - umulh x8, x14, x10 __LF \ - mul x13, x13, x10 __LF \ - adcs x7, x7, x12 __LF \ - adc x8, x8, x13 __LF \ - /* [x8; x7;x6;x5;x4] = D * P2 + 2^40 * k */ \ - subs x0, x0, x4 __LF \ - sbcs x1, x1, x5 __LF \ - sbcs x2, x2, x6 __LF \ - sbcs x3, x3, x7 __LF \ - sbc x4, x9, x8 __LF \ - /* [x4; x3;x2;x1;x0] = 2^40*p_256k1+result */ \ - add x10, x4, #1 __LF \ - /* (h + 1) is quotient estimate */ \ - mul x4, pconst, x10 __LF \ - umulh x5, pconst, x10 __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - adcs x2, x2, xzr __LF \ - adcs x3, x3, xzr __LF \ - csel x11, pconst, xzr, cc __LF \ - /* If un-correction needed */ \ - subs x0, x0, x11 __LF \ - sbcs x1, x1, xzr __LF \ - stp x0, x1, [P0] __LF \ - sbcs x2, x2, xzr __LF \ - sbc x3, x3, xzr __LF \ - stp x2, x3, [P0+16] - -// P0 = 3 * P1 - 8 * P2 with 5-digit P1 and P2 -// We start with (2^40 * 2^256 + 3 * P1) - (8 * P2 + 2^40 * k) -// where p_256k1 = 2^256 - k (so k = 4294968273) - -#define cmsub38_p256k1(P0,P1,P2) \ - mov x10, #3 __LF \ - ldp x4, x5, [P1] __LF \ - mul x0, x4, x10 __LF \ - mul x1, x5, x10 __LF \ - ldp x6, x7, [P1+16] __LF \ - mul x2, x6, x10 __LF \ - mul x3, x7, x10 __LF \ - ldr x13, [P1+32] __LF \ - umulh x4, x4, x10 __LF \ - adds x1, x1, x4 __LF \ - umulh x5, x5, x10 __LF \ - adcs x2, x2, x5 __LF \ - umulh x6, x6, x10 __LF \ - adcs x3, x3, x6 __LF \ - umulh x4, x7, x10 __LF \ - mul x13, x13, x10 __LF \ - adc x9, x4, x13 __LF \ - orr x9, x9, #0x10000000000 __LF \ - /* [x9; x3;x2;x1;x0] = 2^40 * 2^256 + 3 * P1 */ \ - lsl x12, pconst, #40 __LF \ - ldp x13, x14, [P2] __LF \ - lsl x4, x13, #3 __LF \ - adds x4, x4, x12 __LF \ - extr x5, x14, x13, #61 __LF \ - lsr x12, pconst, #24 __LF \ - adcs x5, x5, x12 __LF \ - ldp x11, x12, [P2+16] __LF \ - extr x6, x11, x14, #61 __LF \ - adcs x6, x6, xzr __LF \ - ldr x13, [P2+32] __LF \ - extr x7, x12, x11, #61 __LF \ - adcs x7, x7, xzr __LF \ - extr x8, x13, x12, #61 __LF \ - adc x8, x8, xzr __LF \ - /* [x8; x7;x6;x5;x4] = 8 * P2 + 2^40 * k */ \ - subs x0, x0, x4 __LF \ - sbcs x1, x1, x5 __LF \ - sbcs x2, x2, x6 __LF \ - sbcs x3, x3, x7 __LF \ - sbc x4, x9, x8 __LF \ - /* [x4; x3;x2;x1;x0] = 2^40*p_256k1+result */ \ - add x10, x4, #1 __LF \ - /* (h + 1) is quotient estimate */ \ - mul x4, pconst, x10 __LF \ - umulh x5, pconst, x10 __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x5 __LF \ - adcs x2, x2, xzr __LF \ - adcs x3, x3, xzr __LF \ - csel x11, pconst, xzr, cc __LF \ - /* If un-correction needed */ \ - subs x0, x0, x11 __LF \ - sbcs x1, x1, xzr __LF \ - stp x0, x1, [P0] __LF \ - sbcs x2, x2, xzr __LF \ - sbc x3, x3, xzr __LF \ - stp x2, x3, [P0+16] - -// P0 = 4 * P1 - P2 with 5-digit P1, 4-digit P2 and result. -// This is done by direct subtraction of P2 since the method -// in bignum_cmul_p256k1 etc. for quotient estimation still -// works when the value to be reduced is negative, as -// long as it is > -p_256k1, which is the case here. - -#define cmsub41_p256k1(P0,P1,P2) \ - ldp x1, x2, [P1] __LF \ - lsl x0, x1, #2 __LF \ - ldp x6, x7, [P2] __LF \ - subs x0, x0, x6 __LF \ - extr x1, x2, x1, #62 __LF \ - sbcs x1, x1, x7 __LF \ - ldp x3, x4, [P1+16] __LF \ - extr x2, x3, x2, #62 __LF \ - ldp x6, x7, [P2+16] __LF \ - sbcs x2, x2, x6 __LF \ - extr x3, x4, x3, #62 __LF \ - sbcs x3, x3, x7 __LF \ - ldr x5, [P1+32] __LF \ - extr x4, x5, x4, #62 __LF \ - sbc x4, x4, xzr __LF \ - add x5, x4, #1 __LF \ - /* (h + 1) is quotient estimate */ \ - mul x4, pconst, x5 __LF \ - adds x0, x0, x4 __LF \ - umulh x5, pconst, x5 __LF \ - adcs x1, x1, x5 __LF \ - adcs x2, x2, xzr __LF \ - adcs x3, x3, xzr __LF \ - csel x4, pconst, xzr, cc __LF \ - /* If un-correction needed */ \ - subs x0, x0, x4 __LF \ - sbcs x1, x1, xzr __LF \ - stp x0, x1, [P0] __LF \ - sbcs x2, x2, xzr __LF \ - sbc x3, x3, xzr __LF \ - stp x2, x3, [P0+16] - -S2N_BN_SYMBOL(secp256k1_jdouble_alt): - CFI_START - -// Make room on stack for temp registers - - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable place - - mov input_z, x0 - mov input_x, x1 - -// Set up pconst = 4294968273, so p_256k1 = 2^256 - pconst - - mov pconst, #977 - orr pconst, pconst, #0x100000000 - -// Main sequence of operations - - // y_2 = y^2 - - sqr_p256k1(y_2,y_1) - - // x_2 = x^2 - - sqr_p256k1(x_2,x_1) - - // tmp = 2 * y_1 (in 4 words but not fully normalized) - - weakdouble_p256k1(tmp,y_1) - - // xy2 = x * y^2 (5-digit partially reduced) - // x_4 = x^4 (5-digit partially reduced) - - roughmul_p256k1(xy2,x_1,y_2) - roughsqr_p256k1(x_4,x_2) - - // z_3 = 2 * y_1 * z_1 - - mul_p256k1(z_3,z_1,tmp) - - // d = 12 * xy2 - 9 * x_4 - - cmsub_p256k1(d,12,xy2,9,x_4) - - // y4 = y2^2 (5-digit partially reduced) - - roughsqr_p256k1(y_4,y_2) - - // dx2 = d * x_2 (5-digit partially reduced) - - roughmul_p256k1(dx2,x_2,d) - - // x_3 = 4 * xy2 - d - - cmsub41_p256k1(x_3,xy2,d) - - // y_3 = 3 * dx2 - 8 * y_4 - - cmsub38_p256k1(y_3,dx2,y_4) - -// Restore stack and return - - CFI_INC_SP(NSPACE) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(secp256k1_jdouble_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jmixadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jmixadd.S deleted file mode 100644 index c6619ae6021..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jmixadd.S +++ /dev/null @@ -1,513 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on SECG curve secp256k1 in Jacobian coordinates -// -// extern void secp256k1_jmixadd(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 8]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. It is assumed that -// all the coordinates of the input points p1 and p2 are fully reduced -// mod p_256k1, that the z coordinate of p1 is nonzero and that neither -// p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents the same affine -// point as". -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(secp256k1_jmixadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(secp256k1_jmixadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(secp256k1_jmixadd) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x19 -#define input_x x20 -#define input_y x21 - -// The magic constant 2^256 - p_256k1 - -#define pconst x17 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define zp2 sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define NSPACE NUMSIZE*6 - -// Corresponds exactly to bignum_mul_p256k1 except for registers and -// re-use of the pconst register for the constant 4294968273 - -#define mul_p256k1(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P2] __LF \ - mul x7, x3, x5 __LF \ - umulh x8, x3, x5 __LF \ - mul x9, x4, x6 __LF \ - umulh x10, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, lo __LF \ - csetm x16, lo __LF \ - adds x9, x9, x8 __LF \ - adc x10, x10, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, lo __LF \ - cinv x16, x16, lo __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x8, x7, x9 __LF \ - adcs x9, x9, x10 __LF \ - adc x10, x10, xzr __LF \ - cmn x16, #1 __LF \ - eor x15, x15, x16 __LF \ - adcs x8, x15, x8 __LF \ - eor x3, x3, x16 __LF \ - adcs x9, x3, x9 __LF \ - adc x10, x10, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x5, x6, [P2+16] __LF \ - mul x11, x3, x5 __LF \ - umulh x12, x3, x5 __LF \ - mul x13, x4, x6 __LF \ - umulh x14, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, lo __LF \ - csetm x16, lo __LF \ - adds x13, x13, x12 __LF \ - adc x14, x14, xzr __LF \ - subs x3, x5, x6 __LF \ - cneg x3, x3, lo __LF \ - cinv x16, x16, lo __LF \ - mul x15, x4, x3 __LF \ - umulh x3, x4, x3 __LF \ - adds x12, x11, x13 __LF \ - adcs x13, x13, x14 __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #1 __LF \ - eor x15, x15, x16 __LF \ - adcs x12, x15, x12 __LF \ - eor x3, x3, x16 __LF \ - adcs x13, x3, x13 __LF \ - adc x14, x14, x16 __LF \ - ldp x3, x4, [P1+16] __LF \ - ldp x15, x16, [P1] __LF \ - subs x3, x3, x15 __LF \ - sbcs x4, x4, x16 __LF \ - csetm x16, lo __LF \ - ldp x15, x0, [P2] __LF \ - subs x5, x15, x5 __LF \ - sbcs x6, x0, x6 __LF \ - csetm x0, lo __LF \ - eor x3, x3, x16 __LF \ - subs x3, x3, x16 __LF \ - eor x4, x4, x16 __LF \ - sbc x4, x4, x16 __LF \ - eor x5, x5, x0 __LF \ - subs x5, x5, x0 __LF \ - eor x6, x6, x0 __LF \ - sbc x6, x6, x0 __LF \ - eor x16, x0, x16 __LF \ - adds x11, x11, x9 __LF \ - adcs x12, x12, x10 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - mul x2, x3, x5 __LF \ - umulh x0, x3, x5 __LF \ - mul x15, x4, x6 __LF \ - umulh x1, x4, x6 __LF \ - subs x4, x4, x3 __LF \ - cneg x4, x4, lo __LF \ - csetm x9, lo __LF \ - adds x15, x15, x0 __LF \ - adc x1, x1, xzr __LF \ - subs x6, x5, x6 __LF \ - cneg x6, x6, lo __LF \ - cinv x9, x9, lo __LF \ - mul x5, x4, x6 __LF \ - umulh x6, x4, x6 __LF \ - adds x0, x2, x15 __LF \ - adcs x15, x15, x1 __LF \ - adc x1, x1, xzr __LF \ - cmn x9, #1 __LF \ - eor x5, x5, x9 __LF \ - adcs x0, x5, x0 __LF \ - eor x6, x6, x9 __LF \ - adcs x15, x6, x15 __LF \ - adc x1, x1, x9 __LF \ - adds x9, x11, x7 __LF \ - adcs x10, x12, x8 __LF \ - adcs x11, x13, x11 __LF \ - adcs x12, x14, x12 __LF \ - adcs x13, x13, xzr __LF \ - adc x14, x14, xzr __LF \ - cmn x16, #1 __LF \ - eor x2, x2, x16 __LF \ - adcs x9, x2, x9 __LF \ - eor x0, x0, x16 __LF \ - adcs x10, x0, x10 __LF \ - eor x15, x15, x16 __LF \ - adcs x11, x15, x11 __LF \ - eor x1, x1, x16 __LF \ - adcs x12, x1, x12 __LF \ - adcs x13, x13, x16 __LF \ - adc x14, x14, x16 __LF \ - mov x16, #977 __LF \ - mul x3, pconst, x11 __LF \ - umulh x5, pconst, x11 __LF \ - and x15, x12, #0xffffffff __LF \ - lsr x2, x12, #32 __LF \ - mul x4, x16, x15 __LF \ - madd x15, x16, x2, x15 __LF \ - adds x4, x4, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x6, x2, x15 __LF \ - mul x11, pconst, x13 __LF \ - umulh x13, pconst, x13 __LF \ - and x15, x14, #0xffffffff __LF \ - lsr x2, x14, #32 __LF \ - mul x12, x16, x15 __LF \ - madd x15, x16, x2, x15 __LF \ - adds x12, x12, x15, lsl #32 __LF \ - lsr x15, x15, #32 __LF \ - adc x14, x2, x15 __LF \ - adds x7, x7, x3 __LF \ - adcs x8, x8, x4 __LF \ - adcs x9, x9, x11 __LF \ - adcs x10, x10, x12 __LF \ - cset x11, hs __LF \ - adds x8, x8, x5 __LF \ - adcs x9, x9, x6 __LF \ - adcs x10, x10, x13 __LF \ - adc x11, x11, x14 __LF \ - add x0, x11, #1 __LF \ - mul x3, x16, x0 __LF \ - lsr x4, x0, #32 __LF \ - adds x3, x3, x0, lsl #32 __LF \ - adc x4, xzr, x4 __LF \ - adds x7, x7, x3 __LF \ - adcs x8, x8, x4 __LF \ - adcs x9, x9, xzr __LF \ - adcs x10, x10, xzr __LF \ - csel x1, pconst, xzr, lo __LF \ - subs x7, x7, x1 __LF \ - sbcs x8, x8, xzr __LF \ - sbcs x9, x9, xzr __LF \ - sbc x10, x10, xzr __LF \ - stp x7, x8, [P0] __LF \ - stp x9, x10, [P0+16] - -// Corresponds exactly to bignum_sqr_p256k1 except for -// re-use of the pconst register for the constant 4294968273 - -#define sqr_p256k1(P0,P1) \ - ldp x10, x11, [P1] __LF \ - ldp x12, x13, [P1+16] __LF \ - umull x2, w10, w10 __LF \ - lsr x14, x10, #32 __LF \ - umull x3, w14, w14 __LF \ - umull x14, w10, w14 __LF \ - adds x2, x2, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x3, x3, x14 __LF \ - umull x4, w11, w11 __LF \ - lsr x14, x11, #32 __LF \ - umull x5, w14, w14 __LF \ - umull x14, w11, w14 __LF \ - mul x15, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x4, x4, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x5, x5, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x5, x5, xzr __LF \ - adds x3, x3, x15 __LF \ - adcs x4, x4, x16 __LF \ - adc x5, x5, xzr __LF \ - umull x6, w12, w12 __LF \ - lsr x14, x12, #32 __LF \ - umull x7, w14, w14 __LF \ - umull x14, w12, w14 __LF \ - adds x6, x6, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x7, x7, x14 __LF \ - umull x8, w13, w13 __LF \ - lsr x14, x13, #32 __LF \ - umull x9, w14, w14 __LF \ - umull x14, w13, w14 __LF \ - mul x15, x12, x13 __LF \ - umulh x16, x12, x13 __LF \ - adds x8, x8, x14, lsl #33 __LF \ - lsr x14, x14, #31 __LF \ - adc x9, x9, x14 __LF \ - adds x15, x15, x15 __LF \ - adcs x16, x16, x16 __LF \ - adc x9, x9, xzr __LF \ - adds x7, x7, x15 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, xzr __LF \ - subs x10, x10, x12 __LF \ - sbcs x11, x11, x13 __LF \ - csetm x16, lo __LF \ - eor x10, x10, x16 __LF \ - subs x10, x10, x16 __LF \ - eor x11, x11, x16 __LF \ - sbc x11, x11, x16 __LF \ - adds x6, x6, x4 __LF \ - adcs x7, x7, x5 __LF \ - adcs x8, x8, xzr __LF \ - adc x9, x9, xzr __LF \ - umull x12, w10, w10 __LF \ - lsr x5, x10, #32 __LF \ - umull x13, w5, w5 __LF \ - umull x5, w10, w5 __LF \ - adds x12, x12, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x13, x13, x5 __LF \ - umull x15, w11, w11 __LF \ - lsr x5, x11, #32 __LF \ - umull x14, w5, w5 __LF \ - umull x5, w11, w5 __LF \ - mul x4, x10, x11 __LF \ - umulh x16, x10, x11 __LF \ - adds x15, x15, x5, lsl #33 __LF \ - lsr x5, x5, #31 __LF \ - adc x14, x14, x5 __LF \ - adds x4, x4, x4 __LF \ - adcs x16, x16, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x13, x13, x4 __LF \ - adcs x15, x15, x16 __LF \ - adc x14, x14, xzr __LF \ - adds x4, x2, x6 __LF \ - adcs x5, x3, x7 __LF \ - adcs x6, x6, x8 __LF \ - adcs x7, x7, x9 __LF \ - csetm x16, lo __LF \ - subs x4, x4, x12 __LF \ - sbcs x5, x5, x13 __LF \ - sbcs x6, x6, x15 __LF \ - sbcs x7, x7, x14 __LF \ - adcs x8, x8, x16 __LF \ - adc x9, x9, x16 __LF \ - mov x16, #977 __LF \ - mul x10, pconst, x6 __LF \ - umulh x13, pconst, x6 __LF \ - and x6, x7, #0xffffffff __LF \ - lsr x7, x7, #32 __LF \ - mul x11, x16, x6 __LF \ - madd x6, x16, x7, x6 __LF \ - adds x11, x11, x6, lsl #32 __LF \ - lsr x6, x6, #32 __LF \ - adc x14, x7, x6 __LF \ - mul x12, pconst, x8 __LF \ - umulh x8, pconst, x8 __LF \ - and x6, x9, #0xffffffff __LF \ - lsr x7, x9, #32 __LF \ - mul x9, x16, x6 __LF \ - madd x6, x16, x7, x6 __LF \ - adds x9, x9, x6, lsl #32 __LF \ - lsr x6, x6, #32 __LF \ - adc x15, x7, x6 __LF \ - adds x2, x2, x10 __LF \ - adcs x3, x3, x11 __LF \ - adcs x4, x4, x12 __LF \ - adcs x5, x5, x9 __LF \ - cset x6, hs __LF \ - adds x3, x3, x13 __LF \ - adcs x4, x4, x14 __LF \ - adcs x5, x5, x8 __LF \ - adc x6, x6, x15 __LF \ - add x6, x6, #1 __LF \ - mul x10, x16, x6 __LF \ - lsr x11, x6, #32 __LF \ - adds x10, x10, x6, lsl #32 __LF \ - adc x11, xzr, x11 __LF \ - adds x2, x2, x10 __LF \ - adcs x3, x3, x11 __LF \ - adcs x4, x4, xzr __LF \ - adcs x5, x5, xzr __LF \ - csel x16, pconst, xzr, lo __LF \ - subs x2, x2, x16 __LF \ - sbcs x3, x3, xzr __LF \ - sbcs x4, x4, xzr __LF \ - sbc x5, x5, xzr __LF \ - stp x2, x3, [P0] __LF \ - stp x4, x5, [P0+16] - -// Corresponds exactly to bignum_sub_p256k1 - -#define sub_p256k1(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #0x3d1 __LF \ - orr x3, x4, #0x100000000 __LF \ - csel x3, x3, xzr, cc __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -S2N_BN_SYMBOL(secp256k1_jmixadd): - CFI_START - -// Save registers and make room on stack for temporary variables - - CFI_DEC_SP(NSPACE+32) - CFI_STACKSAVE2(x19,x20,NSPACE) - CFI_STACKSAVE2(x21,x22,NSPACE+16) - -// Move the input arguments to stable place - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Set up pconst = 4294968273, so p_256k1 = 2^256 - pconst - - mov pconst, #977 - orr pconst, pconst, #0x100000000 - -// Main code, just a sequence of basic field operations - - sqr_p256k1(zp2,z_1) - mul_p256k1(y2a,z_1,y_2) - - mul_p256k1(x2a,zp2,x_2) - mul_p256k1(y2a,zp2,y2a) - - sub_p256k1(xd,x2a,x_1) - sub_p256k1(yd,y2a,y_1) - - sqr_p256k1(zz,xd) - sqr_p256k1(ww,yd) - - mul_p256k1(zzx1,zz,x_1) - mul_p256k1(zzx2,zz,x2a) - - sub_p256k1(resx,ww,zzx1) - sub_p256k1(t1,zzx2,zzx1) - - mul_p256k1(resz,xd,z_1) - - sub_p256k1(resx,resx,zzx2) - - sub_p256k1(t2,zzx1,resx) - - mul_p256k1(t1,t1,y_1) - mul_p256k1(t2,yd,t2) - - sub_p256k1(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - orr x4, x0, x1 - orr x5, x2, x3 - orr x4, x4, x5 - cmp x4, xzr - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with an extra z = 1 -// coordinate, hence giving 0 + p2 = p2 for the final result. - - ldp x0, x1, [resx] - ldp x12, x13, [x_2] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x2, x3, [resx+16] - ldp x12, x13, [x_2+16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - - ldp x4, x5, [resy] - ldp x12, x13, [y_2] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x6, x7, [resy+16] - ldp x12, x13, [y_2+16] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - - ldp x8, x9, [resz] - mov x12, #1 - csel x8, x8, x12, ne - csel x9, x9, xzr, ne - ldp x10, x11, [resz+16] - csel x10, x10, xzr, ne - csel x11, x11, xzr, ne - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [y_3] - stp x6, x7, [y_3+16] - stp x8, x9, [z_3] - stp x10, x11, [z_3+16] - -// Restore stack and return - - CFI_STACKLOAD2(x19,x20,NSPACE) - CFI_STACKLOAD2(x21,x22,NSPACE+16) - CFI_INC_SP((NSPACE+32)) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(secp256k1_jmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jmixadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jmixadd_alt.S deleted file mode 100644 index 9b96247302d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/secp256k1/secp256k1_jmixadd_alt.S +++ /dev/null @@ -1,385 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on SECG curve secp256k1 in Jacobian coordinates -// -// extern void secp256k1_jmixadd_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 8]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. It is assumed that -// all the coordinates of the input points p1 and p2 are fully reduced -// mod p_256k1, that the z coordinate of p1 is nonzero and that neither -// p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents the same affine -// point as". -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(secp256k1_jmixadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(secp256k1_jmixadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(secp256k1_jmixadd_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x15 -#define input_x x16 -#define input_y x17 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define zp2 sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define NSPACE NUMSIZE*6 - -// Corresponds exactly to bignum_mul_p256k1_alt - -#define mul_p256k1(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x0, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x1, x3, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x1, x1, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x1, x1, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x0, x0, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x1, x1, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x0, x0, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x1, x1, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x0, x0, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x1, x1, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - mov x7, #0x3d1 __LF \ - orr x7, x7, #0x100000000 __LF \ - mul x11, x7, x1 __LF \ - umulh x9, x7, x1 __LF \ - adds x12, x12, x11 __LF \ - mul x11, x7, x3 __LF \ - umulh x3, x7, x3 __LF \ - adcs x13, x13, x11 __LF \ - mul x11, x7, x4 __LF \ - umulh x4, x7, x4 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x7, x5 __LF \ - umulh x5, x7, x5 __LF \ - adcs x0, x0, x11 __LF \ - cset x1, cs __LF \ - adds x13, x13, x9 __LF \ - adcs x14, x14, x3 __LF \ - adcs x0, x0, x4 __LF \ - adc x1, x1, x5 __LF \ - add x8, x1, #0x1 __LF \ - mul x11, x7, x8 __LF \ - umulh x9, x7, x8 __LF \ - adds x12, x12, x11 __LF \ - adcs x13, x13, x9 __LF \ - adcs x14, x14, xzr __LF \ - adcs x0, x0, xzr __LF \ - csel x7, x7, xzr, cc __LF \ - subs x12, x12, x7 __LF \ - sbcs x13, x13, xzr __LF \ - sbcs x14, x14, xzr __LF \ - sbc x0, x0, xzr __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x0, [P0+16] - -// Corresponds exactly to bignum_sqr_p256k1_alt - -#define sqr_p256k1(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x7, x2, x4 __LF \ - umulh x6, x2, x4 __LF \ - adds x10, x10, x7 __LF \ - adcs x11, x11, x6 __LF \ - mul x7, x3, x4 __LF \ - umulh x6, x3, x4 __LF \ - adc x6, x6, xzr __LF \ - adds x11, x11, x7 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x6 __LF \ - mul x7, x3, x5 __LF \ - umulh x6, x3, x5 __LF \ - adc x6, x6, xzr __LF \ - adds x12, x12, x7 __LF \ - adcs x13, x13, x6 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x6, cs __LF \ - umulh x7, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x7 __LF \ - mul x7, x3, x3 __LF \ - adcs x10, x10, x7 __LF \ - umulh x7, x3, x3 __LF \ - adcs x11, x11, x7 __LF \ - mul x7, x4, x4 __LF \ - adcs x12, x12, x7 __LF \ - umulh x7, x4, x4 __LF \ - adcs x13, x13, x7 __LF \ - mul x7, x5, x5 __LF \ - adcs x14, x14, x7 __LF \ - umulh x7, x5, x5 __LF \ - adc x6, x6, x7 __LF \ - mov x3, #0x3d1 __LF \ - orr x3, x3, #0x100000000 __LF \ - mul x7, x3, x12 __LF \ - umulh x4, x3, x12 __LF \ - adds x8, x8, x7 __LF \ - mul x7, x3, x13 __LF \ - umulh x13, x3, x13 __LF \ - adcs x9, x9, x7 __LF \ - mul x7, x3, x14 __LF \ - umulh x14, x3, x14 __LF \ - adcs x10, x10, x7 __LF \ - mul x7, x3, x6 __LF \ - umulh x6, x3, x6 __LF \ - adcs x11, x11, x7 __LF \ - cset x12, cs __LF \ - adds x9, x9, x4 __LF \ - adcs x10, x10, x13 __LF \ - adcs x11, x11, x14 __LF \ - adc x12, x12, x6 __LF \ - add x2, x12, #0x1 __LF \ - mul x7, x3, x2 __LF \ - umulh x6, x3, x2 __LF \ - adds x8, x8, x7 __LF \ - adcs x9, x9, x6 __LF \ - adcs x10, x10, xzr __LF \ - adcs x11, x11, xzr __LF \ - csel x3, x3, xzr, cc __LF \ - subs x8, x8, x3 __LF \ - sbcs x9, x9, xzr __LF \ - sbcs x10, x10, xzr __LF \ - sbc x11, x11, xzr __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Corresponds exactly to bignum_sub_p256k1 - -#define sub_p256k1(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - mov x4, #0x3d1 __LF \ - orr x3, x4, #0x100000000 __LF \ - csel x3, x3, xzr, cc __LF \ - subs x5, x5, x3 __LF \ - sbcs x6, x6, xzr __LF \ - sbcs x7, x7, xzr __LF \ - sbc x8, x8, xzr __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -S2N_BN_SYMBOL(secp256k1_jmixadd_alt): - CFI_START - -// Make room on stack for temporary variables -// Move the input arguments to stable places - - CFI_DEC_SP(NSPACE) - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations - - sqr_p256k1(zp2,z_1) - mul_p256k1(y2a,z_1,y_2) - - mul_p256k1(x2a,zp2,x_2) - mul_p256k1(y2a,zp2,y2a) - - sub_p256k1(xd,x2a,x_1) - sub_p256k1(yd,y2a,y_1) - - sqr_p256k1(zz,xd) - sqr_p256k1(ww,yd) - - mul_p256k1(zzx1,zz,x_1) - mul_p256k1(zzx2,zz,x2a) - - sub_p256k1(resx,ww,zzx1) - sub_p256k1(t1,zzx2,zzx1) - - mul_p256k1(resz,xd,z_1) - - sub_p256k1(resx,resx,zzx2) - - sub_p256k1(t2,zzx1,resx) - - mul_p256k1(t1,t1,y_1) - mul_p256k1(t2,yd,t2) - - sub_p256k1(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - orr x4, x0, x1 - orr x5, x2, x3 - orr x4, x4, x5 - cmp x4, xzr - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with an extra z = 1 -// coordinate, hence giving 0 + p2 = p2 for the final result. - - ldp x0, x1, [resx] - ldp x12, x13, [x_2] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x2, x3, [resx+16] - ldp x12, x13, [x_2+16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - - ldp x4, x5, [resy] - ldp x12, x13, [y_2] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x6, x7, [resy+16] - ldp x12, x13, [y_2+16] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - - ldp x8, x9, [resz] - mov x12, #1 - csel x8, x8, x12, ne - csel x9, x9, xzr, ne - ldp x10, x11, [resz+16] - csel x10, x10, xzr, ne - csel x11, x11, xzr, ne - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [y_3] - stp x6, x7, [y_3+16] - stp x8, x9, [z_3] - stp x10, x11, [z_3+16] - -// Restore stack and return - - CFI_INC_SP(NSPACE) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(secp256k1_jmixadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sha3/Makefile b/third_party/s2n-bignum/s2n-bignum-imported/arm/sha3/Makefile deleted file mode 100644 index a4e96cb8d2d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sha3/Makefile +++ /dev/null @@ -1,36 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - -# If actually on an ARM8 machine, just use the GNU assembler (as). Otherwise -# use a cross-assembling version so that the code can still be assembled -# and the proofs checked against the object files (though you won't be able -# to run code without additional emulation infrastructure). The aarch64 -# cross-assembling version can be installed manually by something like: -# -# sudo apt-get install binutils-aarch64-linux-gnu - -UNAME_RESULT=$(shell uname -p) - -ifeq ($(UNAME_RESULT),aarch64) -GAS=as -else -GAS=aarch64-linux-gnu-as -endif - -# List of object files - -OBJ = sha3_keccak_f1600.o \ - sha3_keccak_f1600_alt.o \ - sha3_keccak2_f1600.o \ - sha3_keccak2_f1600_alt.o \ - sha3_keccak4_f1600.o \ - sha3_keccak4_f1600_alt.o \ - sha3_keccak4_f1600_alt2.o - -%.o : %.S ; $(CC) -E -I../../include $< | $(GAS) -o $@ - - -default: $(OBJ); - -clean:; rm -f *.o *.correct unopt/*.o diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sha3/sha3_keccak2_f1600_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sha3/sha3_keccak2_f1600_alt.S deleted file mode 100644 index b9d93be08b6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sha3/sha3_keccak2_f1600_alt.S +++ /dev/null @@ -1,292 +0,0 @@ -// Copyright (c) 2024 The mlkem-native project authors -// Copyright (c) 2021-2022 Arm Limited -// Copyright (c) 2022 Matthias Kannwischer -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT - -// ---------------------------------------------------------------------------- -// Keccak-f1600 permutation for SHA3, batch of two independent operations -// Input a[50], rc[24]; output a[50] -// -// The input/output argument is in effect two 25-element Keccak arrays -// a[0...24] and a[25..49], which could be considered as type a[25][2]. -// -// Thinking of each such input/output array as a row-major flattening of a -// 5x5 matrix of 64-bit words, this performs the Keccak-f1600 permutation, -// all 24 rounds with the distinct round constants rc[i] for each one. For -// correct operation, the input pointer rc should point at the standard -// round constants as in the specification: -// -// https://keccak.team/keccak_specs_summary.html#roundConstants -// -// This operation is at the core of SHA3 and is fully specified here: -// -// https://keccak.team/files/Keccak-reference-3.0.pdf -// -// extern void sha3_keccak2_f1600_alt(uint64_t a[static 50], -// const uint64_t rc[static 24]); -// -// Standard ARM ABI: X0 = a, X1 = rc -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - .arch armv8.4-a+sha3 - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sha3_keccak2_f1600_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sha3_keccak2_f1600_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sha3_keccak2_f1600_alt) - .text - .balign 4 - -S2N_BN_SYMBOL(sha3_keccak2_f1600_alt): - CFI_START - -// This is similar to the code in the mlkem-native repository here: -// -// mlkem/fips202/native/aarch64/src/keccak_f1600_x2_v8a_v84a_asm_hybrid.S -// -// The main difference is the avoidance of ld2/st2 in favour of explicit -// transposition operations and conventional loads and stores. We also -// avoid saving and restoring some unused integer registers. - - CFI_DEC_SP(64) - CFI_STACKSAVE2(d8,d9,0) - CFI_STACKSAVE2(d10,d11,0x10) - CFI_STACKSAVE2(d12,d13,0x20) - CFI_STACKSAVE2(d14,d15,0x30) - -// Load the Keccak initial state into upper and lower parts of Q0..Q24 - - add x2, x0, #0xc8 - - ldp q24, q25, [x0] - ldp q26, q27, [x2] - trn1 v0.2d, v24.2d, v26.2d - trn2 v1.2d, v24.2d, v26.2d - trn1 v2.2d, v25.2d, v27.2d - trn2 v3.2d, v25.2d, v27.2d - - ldp q24, q25, [x0, #0x20] - ldp q26, q27, [x2, #0x20] - trn1 v4.2d, v24.2d, v26.2d - trn2 v5.2d, v24.2d, v26.2d - trn1 v6.2d, v25.2d, v27.2d - trn2 v7.2d, v25.2d, v27.2d - - ldp q24, q25, [x0, #0x40] - ldp q26, q27, [x2, #0x40] - trn1 v8.2d, v24.2d, v26.2d - trn2 v9.2d, v24.2d, v26.2d - trn1 v10.2d, v25.2d, v27.2d - trn2 v11.2d, v25.2d, v27.2d - - ldp q24, q25, [x0, #0x60] - ldp q26, q27, [x2, #0x60] - trn1 v12.2d, v24.2d, v26.2d - trn2 v13.2d, v24.2d, v26.2d - trn1 v14.2d, v25.2d, v27.2d - trn2 v15.2d, v25.2d, v27.2d - - ldp q24, q25, [x0, #0x80] - ldp q26, q27, [x2, #0x80] - trn1 v16.2d, v24.2d, v26.2d - trn2 v17.2d, v24.2d, v26.2d - trn1 v18.2d, v25.2d, v27.2d - trn2 v19.2d, v25.2d, v27.2d - - ldp q24, q25, [x0, #0xa0] - ldp q26, q27, [x2, #0xa0] - trn1 v20.2d, v24.2d, v26.2d - trn2 v21.2d, v24.2d, v26.2d - trn1 v22.2d, v25.2d, v27.2d - trn2 v23.2d, v25.2d, v27.2d - - ldr d24, [x0, #0xc0] - ldr d25, [x2, #0xc0] - trn1 v24.2d, v24.2d, v25.2d - -// Now 24 rounds of the iteration - - mov x2, #24 - -Lsha3_keccak2_f1600_alt_loop: - eor v30.16b, v0.16b, v5.16b - eor v30.16b, v30.16b, v10.16b - eor3 v30.16b, v30.16b, v15.16b, v20.16b - eor v29.16b, v1.16b, v6.16b - eor v29.16b, v29.16b, v11.16b - eor3 v29.16b, v29.16b, v16.16b, v21.16b - eor v28.16b, v2.16b, v7.16b - eor v28.16b, v28.16b, v12.16b - eor3 v28.16b, v28.16b, v17.16b, v22.16b - eor v27.16b, v3.16b, v8.16b - eor v27.16b, v27.16b, v13.16b - eor3 v27.16b, v27.16b, v18.16b, v23.16b - eor v26.16b, v4.16b, v9.16b - eor v26.16b, v26.16b, v14.16b - eor3 v26.16b, v26.16b, v19.16b, v24.16b - add v31.2d, v28.2d, v28.2d - sri v31.2d, v28.2d, #0x3f - eor v25.16b, v31.16b, v30.16b - rax1 v28.2d, v28.2d, v26.2d - add v31.2d, v29.2d, v29.2d - sri v31.2d, v29.2d, #0x3f - eor v26.16b, v31.16b, v26.16b - rax1 v29.2d, v29.2d, v27.2d - add v31.2d, v30.2d, v30.2d - sri v31.2d, v30.2d, #0x3f - eor v27.16b, v31.16b, v27.16b - eor v30.16b, v0.16b, v26.16b - xar v0.2d, v2.2d, v29.2d, #0x2 - eor v31.16b, v12.16b, v29.16b - shl v2.2d, v31.2d, #0x2b - sri v2.2d, v31.2d, #0x15 - xar v12.2d, v13.2d, v28.2d, #0x27 - eor v31.16b, v19.16b, v27.16b - shl v13.2d, v31.2d, #0x8 - sri v13.2d, v31.2d, #0x38 - xar v19.2d, v23.2d, v28.2d, #0x8 - eor v31.16b, v15.16b, v26.16b - shl v23.2d, v31.2d, #0x29 - sri v23.2d, v31.2d, #0x17 - xar v15.2d, v1.2d, v25.2d, #0x3f - eor v31.16b, v8.16b, v28.16b - shl v1.2d, v31.2d, #0x37 - sri v1.2d, v31.2d, #0x9 - xar v8.2d, v16.2d, v25.2d, #0x13 - eor v31.16b, v7.16b, v29.16b - shl v16.2d, v31.2d, #0x6 - sri v16.2d, v31.2d, #0x3a - xar v7.2d, v10.2d, v26.2d, #0x3d - eor v31.16b, v3.16b, v28.16b - shl v10.2d, v31.2d, #0x1c - sri v10.2d, v31.2d, #0x24 - xar v3.2d, v18.2d, v28.2d, #0x2b - eor v31.16b, v17.16b, v29.16b - shl v18.2d, v31.2d, #0xf - sri v18.2d, v31.2d, #0x31 - xar v17.2d, v11.2d, v25.2d, #0x36 - eor v31.16b, v9.16b, v27.16b - shl v11.2d, v31.2d, #0x14 - sri v11.2d, v31.2d, #0x2c - xar v9.2d, v22.2d, v29.2d, #0x3 - eor v31.16b, v14.16b, v27.16b - shl v22.2d, v31.2d, #0x27 - sri v22.2d, v31.2d, #0x19 - xar v14.2d, v20.2d, v26.2d, #0x2e - eor v31.16b, v4.16b, v27.16b - shl v20.2d, v31.2d, #0x1b - sri v20.2d, v31.2d, #0x25 - xar v4.2d, v24.2d, v27.2d, #0x32 - eor v31.16b, v21.16b, v25.16b - shl v24.2d, v31.2d, #0x2 - sri v24.2d, v31.2d, #0x3e - xar v21.2d, v5.2d, v26.2d, #0x1c - eor v31.16b, v6.16b, v25.16b - shl v27.2d, v31.2d, #0x2c - sri v27.2d, v31.2d, #0x14 - ld1r { v28.2d }, [x1], #8 - bcax v5.16b, v10.16b, v7.16b, v11.16b - bic v31.16b, v8.16b, v7.16b - eor v6.16b, v31.16b, v11.16b - bcax v7.16b, v7.16b, v9.16b, v8.16b - bic v31.16b, v10.16b, v9.16b - eor v8.16b, v31.16b, v8.16b - bcax v9.16b, v9.16b, v11.16b, v10.16b - bic v31.16b, v12.16b, v16.16b - eor v10.16b, v31.16b, v15.16b - bcax v11.16b, v16.16b, v13.16b, v12.16b - bic v31.16b, v14.16b, v13.16b - eor v12.16b, v31.16b, v12.16b - bcax v13.16b, v13.16b, v15.16b, v14.16b - bic v31.16b, v16.16b, v15.16b - eor v14.16b, v31.16b, v14.16b - bcax v15.16b, v20.16b, v17.16b, v21.16b - bic v31.16b, v18.16b, v17.16b - eor v16.16b, v31.16b, v21.16b - bcax v17.16b, v17.16b, v19.16b, v18.16b - bic v31.16b, v20.16b, v19.16b - eor v18.16b, v31.16b, v18.16b - bcax v19.16b, v19.16b, v21.16b, v20.16b - bic v31.16b, v22.16b, v1.16b - eor v20.16b, v31.16b, v0.16b - bcax v21.16b, v1.16b, v23.16b, v22.16b - bic v31.16b, v24.16b, v23.16b - eor v22.16b, v31.16b, v22.16b - bcax v23.16b, v23.16b, v0.16b, v24.16b - bic v31.16b, v1.16b, v0.16b - eor v24.16b, v31.16b, v24.16b - bcax v0.16b, v30.16b, v2.16b, v27.16b - bic v31.16b, v3.16b, v2.16b - eor v1.16b, v31.16b, v27.16b - bcax v2.16b, v2.16b, v4.16b, v3.16b - bic v31.16b, v30.16b, v4.16b - eor v3.16b, v31.16b, v3.16b - bcax v4.16b, v4.16b, v27.16b, v30.16b - eor v0.16b, v0.16b, v28.16b - sub x2, x2, #0x1 - cbnz x2, Lsha3_keccak2_f1600_alt_loop - -// Store back the state - - add x2, x0, #0xc8 - - trn1 v25.2d, v0.2d, v1.2d - trn1 v26.2d, v2.2d, v3.2d - stp q25, q26, [x0] - trn2 v25.2d, v0.2d, v1.2d - trn2 v26.2d, v2.2d, v3.2d - stp q25, q26, [x2] - - trn1 v25.2d, v4.2d, v5.2d - trn1 v26.2d, v6.2d, v7.2d - stp q25, q26, [x0, #0x20] - trn2 v25.2d, v4.2d, v5.2d - trn2 v26.2d, v6.2d, v7.2d - stp q25, q26, [x2, #0x20] - - trn1 v25.2d, v8.2d, v9.2d - trn1 v26.2d, v10.2d, v11.2d - stp q25, q26, [x0, #0x40] - trn2 v25.2d, v8.2d, v9.2d - trn2 v26.2d, v10.2d, v11.2d - stp q25, q26, [x2, #0x40] - - trn1 v25.2d, v12.2d, v13.2d - trn1 v26.2d, v14.2d, v15.2d - stp q25, q26, [x0, #0x60] - trn2 v25.2d, v12.2d, v13.2d - trn2 v26.2d, v14.2d, v15.2d - stp q25, q26, [x2, #0x60] - - trn1 v25.2d, v16.2d, v17.2d - trn1 v26.2d, v18.2d, v19.2d - stp q25, q26, [x0, #0x80] - trn2 v25.2d, v16.2d, v17.2d - trn2 v26.2d, v18.2d, v19.2d - stp q25, q26, [x2, #0x80] - - trn1 v25.2d, v20.2d, v21.2d - trn1 v26.2d, v22.2d, v23.2d - stp q25, q26, [x0, #0xa0] - trn2 v25.2d, v20.2d, v21.2d - trn2 v26.2d, v22.2d, v23.2d - stp q25, q26, [x2, #0xa0] - - str d24, [x0, #0xc0] - trn2 v24.2d, v24.2d, v24.2d - str d24, [x2, #0xc0] - -// Restore registers and return - - CFI_STACKLOAD2(d8,d9,0) - CFI_STACKLOAD2(d10,d11,0x10) - CFI_STACKLOAD2(d12,d13,0x20) - CFI_STACKLOAD2(d14,d15,0x30) - CFI_INC_SP(64) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sha3_keccak2_f1600_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sha3/sha3_keccak4_f1600.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sha3/sha3_keccak4_f1600.S deleted file mode 100644 index fe9d23a60a3..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sha3/sha3_keccak4_f1600.S +++ /dev/null @@ -1,865 +0,0 @@ -// Copyright (c) 2024 The mlkem-native project authors -// Copyright (c) 2021-2022 Arm Limited -// Copyright (c) 2022 Matthias Kannwischer -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT - -// ---------------------------------------------------------------------------- -// Keccak-f1600 permutation for SHA3, batch of four independent operations -// Input a[100], rc[24]; output a[100] -// -// The input/output argument is in effect four 25-element Keccak arrays -// a[0...24], a[25..49], a[50..74] and a[75..99], which could be considered -// as type a[25][4]. -// -// Thinking of each such input/output array as a row-major flattening of a -// 5x5 matrix of 64-bit words, this performs the Keccak-f1600 permutation, -// all 24 rounds with the distinct round constants rc[i] for each one. For -// correct operation, the input pointer rc should point at the standard -// round constants as in the specification: -// -// https://keccak.team/keccak_specs_summary.html#roundConstants -// -// This operation is at the core of SHA3 and is fully specified here: -// -// https://keccak.team/files/Keccak-reference-3.0.pdf -// -// extern void sha3_keccak4_f1600(uint64_t a[static 100], -// const uint64_t rc[static 24]); -// -// Standard ARM ABI: X0 = a, X1 = rc -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_arm.h" - - .arch armv8.4-a+sha3 - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sha3_keccak4_f1600) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sha3_keccak4_f1600) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sha3_keccak4_f1600) - .text - .balign 4 - -S2N_BN_SYMBOL(sha3_keccak4_f1600): - CFI_START - -// This is similar to the code in the mlkem-native repository here: -// -// mlkem/fips202/native/aarch64/src/keccak_f1600_x4_scalar_v84a_asm_hybrid.S -// -// The main difference is the avoidance of ld2/st2 in favour of explicit -// transposition operations and conventional loads and stores. - - CFI_DEC_SP(224) - CFI_STACKSAVE2(x19,x20,0x30) - CFI_STACKSAVE2(x21,x22,0x40) - CFI_STACKSAVE2(x23,x24,0x50) - CFI_STACKSAVE2(x25,x26,0x60) - CFI_STACKSAVE2(x27,x28,0x70) - CFI_STACKSAVE2(x29,x30,0x80) - CFI_STACKSAVE2(d8,d9,0x90) - CFI_STACKSAVE2(d10,d11,0xa0) - CFI_STACKSAVE2(d12,d13,0xb0) - CFI_STACKSAVE2(d14,d15,0xc0) - mov x29, x1 - mov x30, #0x0 - str x30, [sp, #0x20] - str x29, [sp, #0x8] - str x29, [sp, #0x10] - str x0, [sp] - - add x2, x0, #0xc8 - - ldp q24, q25, [x0] - ldp q26, q27, [x2] - trn1 v0.2d, v24.2d, v26.2d - trn2 v1.2d, v24.2d, v26.2d - trn1 v2.2d, v25.2d, v27.2d - trn2 v3.2d, v25.2d, v27.2d - - ldp q24, q25, [x0, #0x20] - ldp q26, q27, [x2, #0x20] - trn1 v4.2d, v24.2d, v26.2d - trn2 v5.2d, v24.2d, v26.2d - trn1 v6.2d, v25.2d, v27.2d - trn2 v7.2d, v25.2d, v27.2d - - ldp q24, q25, [x0, #0x40] - ldp q26, q27, [x2, #0x40] - trn1 v8.2d, v24.2d, v26.2d - trn2 v9.2d, v24.2d, v26.2d - trn1 v10.2d, v25.2d, v27.2d - trn2 v11.2d, v25.2d, v27.2d - - ldp q24, q25, [x0, #0x60] - ldp q26, q27, [x2, #0x60] - trn1 v12.2d, v24.2d, v26.2d - trn2 v13.2d, v24.2d, v26.2d - trn1 v14.2d, v25.2d, v27.2d - trn2 v15.2d, v25.2d, v27.2d - - ldp q24, q25, [x0, #0x80] - ldp q26, q27, [x2, #0x80] - trn1 v16.2d, v24.2d, v26.2d - trn2 v17.2d, v24.2d, v26.2d - trn1 v18.2d, v25.2d, v27.2d - trn2 v19.2d, v25.2d, v27.2d - - ldp q24, q25, [x0, #0xa0] - ldp q26, q27, [x2, #0xa0] - trn1 v20.2d, v24.2d, v26.2d - trn2 v21.2d, v24.2d, v26.2d - trn1 v22.2d, v25.2d, v27.2d - trn2 v23.2d, v25.2d, v27.2d - - ldr d24, [x0, #0xc0] - ldr d25, [x2, #0xc0] - trn1 v24.2d, v24.2d, v25.2d - - add x0, x0, #0x190 - ldp x1, x6, [x0] - ldp x11, x16, [x0, #0x10] - ldp x21, x2, [x0, #0x20] - ldp x7, x12, [x0, #0x30] - ldp x17, x22, [x0, #0x40] - ldp x3, x8, [x0, #0x50] - ldp x13, x28, [x0, #0x60] - ldp x23, x4, [x0, #0x70] - ldp x9, x14, [x0, #0x80] - ldp x19, x24, [x0, #0x90] - ldp x5, x10, [x0, #0xa0] - ldp x15, x20, [x0, #0xb0] - ldr x25, [x0, #0xc0] - sub x0, x0, #0x190 - -Lsha3_keccak4_f1600_initial: - eor x30, x24, x25 - eor x27, x9, x10 - eor x0, x30, x21 - eor x26, x27, x6 - eor x27, x26, x7 - eor x29, x0, x22 - eor x26, x29, x23 - eor x29, x4, x5 - eor x30, x29, x1 - eor x0, x27, x8 - eor x29, x30, x2 - eor x30, x19, x20 - eor x30, x30, x16 - eor x27, x26, x0, ror #63 - eor x4, x4, x27 - eor x30, x30, x17 - eor x30, x30, x28 - eor x29, x29, x3 - eor x0, x0, x30, ror #63 - eor x30, x30, x29, ror #63 - eor x22, x22, x30 - eor x23, x23, x30 - str x23, [sp, #0xd0] - eor x23, x14, x15 - eor x14, x14, x0 - eor x23, x23, x11 - eor x15, x15, x0 - eor x1, x1, x27 - eor x23, x23, x12 - eor x23, x23, x13 - eor x11, x11, x0 - eor x29, x29, x23, ror #63 - eor x23, x23, x26, ror #63 - eor x26, x13, x0 - eor x13, x28, x23 - eor x28, x24, x30 - eor x24, x16, x23 - eor x16, x21, x30 - eor x21, x25, x30 - eor x30, x19, x23 - eor x19, x20, x23 - eor x20, x17, x23 - eor x17, x12, x0 - eor x0, x2, x27 - eor x2, x6, x29 - eor x6, x8, x29 - bic x8, x28, x13, ror #47 - eor x12, x3, x27 - bic x3, x13, x17, ror #19 - eor x5, x5, x27 - ldr x27, [sp, #0xd0] - bic x25, x17, x2, ror #5 - eor x9, x9, x29 - eor x23, x25, x5, ror #52 - eor x3, x3, x2, ror #24 - eor x8, x8, x17, ror #2 - eor x17, x10, x29 - bic x25, x12, x22, ror #47 - eor x29, x7, x29 - bic x10, x4, x27, ror #2 - bic x7, x5, x28, ror #10 - eor x10, x10, x20, ror #50 - eor x13, x7, x13, ror #57 - bic x7, x2, x5, ror #47 - eor x2, x25, x24, ror #39 - bic x25, x20, x11, ror #57 - bic x5, x17, x4, ror #25 - eor x25, x25, x17, ror #53 - bic x17, x11, x17, ror #60 - eor x28, x7, x28, ror #57 - bic x7, x9, x12, ror #42 - eor x7, x7, x22, ror #25 - bic x22, x22, x24, ror #56 - bic x24, x24, x15, ror #31 - eor x22, x22, x15, ror #23 - bic x20, x27, x20, ror #48 - bic x15, x15, x9, ror #16 - eor x12, x15, x12, ror #58 - eor x15, x5, x27, ror #27 - eor x5, x20, x11, ror #41 - ldr x11, [sp, #0x8] - eor x20, x17, x4, ror #21 - eor x17, x24, x9, ror #47 - mov x24, #0x1 - bic x9, x0, x16, ror #9 - str x24, [sp, #0x18] - bic x24, x29, x1, ror #44 - bic x27, x1, x21, ror #50 - bic x4, x26, x29, ror #63 - eor x1, x1, x4, ror #21 - ldr x11, [x11] - bic x4, x21, x30, ror #57 - eor x21, x24, x21, ror #30 - eor x24, x9, x19, ror #44 - bic x9, x14, x6, ror #5 - eor x9, x9, x0, ror #43 - bic x0, x6, x0, ror #38 - eor x1, x1, x11 - eor x11, x4, x26, ror #35 - eor x4, x0, x16, ror #47 - bic x0, x16, x19, ror #35 - eor x16, x27, x30, ror #43 - bic x27, x30, x26, ror #42 - bic x26, x19, x14, ror #41 - eor x19, x0, x14, ror #12 - eor x14, x26, x6, ror #46 - eor x6, x27, x29, ror #41 - eor x0, x15, x11, ror #52 - eor x0, x0, x13, ror #48 - eor x26, x8, x9, ror #57 - eor x27, x0, x14, ror #10 - eor x29, x16, x28, ror #63 - eor x26, x26, x6, ror #51 - eor x30, x23, x22, ror #50 - eor x0, x26, x10, ror #31 - eor x29, x29, x19, ror #37 - eor x27, x27, x12, ror #5 - eor x30, x30, x24, ror #34 - eor x0, x0, x7, ror #27 - eor x26, x30, x21, ror #26 - eor x26, x26, x25, ror #15 - ror x30, x27, #0x3e - eor x30, x30, x26, ror #57 - ror x26, x26, #0x3a - eor x16, x30, x16 - eor x28, x30, x28, ror #63 - str x28, [sp, #0xd0] - eor x29, x29, x17, ror #36 - eor x28, x1, x2, ror #61 - eor x19, x30, x19, ror #37 - eor x29, x29, x20, ror #2 - eor x28, x28, x4, ror #54 - eor x26, x26, x0, ror #55 - eor x28, x28, x3, ror #39 - eor x28, x28, x5, ror #25 - ror x0, x0, #0x38 - eor x0, x0, x29, ror #63 - eor x27, x28, x27, ror #61 - eor x13, x0, x13, ror #46 - eor x28, x29, x28, ror #63 - eor x29, x30, x20, ror #2 - eor x20, x26, x3, ror #39 - eor x11, x0, x11, ror #50 - eor x25, x28, x25, ror #9 - eor x3, x28, x21, ror #20 - eor x21, x26, x1 - eor x9, x27, x9, ror #49 - eor x24, x28, x24, ror #28 - eor x1, x30, x17, ror #36 - eor x14, x0, x14, ror #8 - eor x22, x28, x22, ror #44 - eor x8, x27, x8, ror #56 - eor x17, x27, x7, ror #19 - eor x15, x0, x15, ror #62 - bic x7, x20, x22, ror #47 - eor x4, x26, x4, ror #54 - eor x0, x0, x12, ror #3 - eor x28, x28, x23, ror #58 - eor x23, x26, x2, ror #61 - eor x26, x26, x5, ror #25 - eor x2, x7, x16, ror #39 - bic x7, x9, x20, ror #42 - bic x30, x15, x9, ror #16 - eor x7, x7, x22, ror #25 - eor x12, x30, x20, ror #58 - bic x20, x22, x16, ror #56 - eor x30, x27, x6, ror #43 - eor x22, x20, x15, ror #23 - bic x6, x19, x13, ror #42 - eor x6, x6, x17, ror #41 - bic x5, x13, x17, ror #63 - eor x5, x21, x5, ror #21 - bic x17, x17, x21, ror #44 - eor x27, x27, x10, ror #23 - bic x21, x21, x25, ror #50 - bic x20, x27, x4, ror #25 - bic x10, x16, x15, ror #31 - eor x16, x21, x19, ror #43 - eor x21, x17, x25, ror #30 - bic x19, x25, x19, ror #57 - ldr x25, [sp, #0x18] - eor x17, x10, x9, ror #47 - ldr x9, [sp, #0x8] - eor x15, x20, x28, ror #27 - bic x20, x4, x28, ror #2 - eor x10, x20, x1, ror #50 - bic x20, x11, x27, ror #60 - eor x20, x20, x4, ror #21 - bic x4, x28, x1, ror #48 - bic x1, x1, x11, ror #57 - ldr x28, [x9, x25, lsl #3] - ldr x9, [sp, #0xd0] - add x25, x25, #0x1 - str x25, [sp, #0x18] - cmp x25, #0x17 - eor x25, x1, x27, ror #53 - bic x27, x30, x26, ror #47 - eor x1, x5, x28 - eor x5, x4, x11, ror #41 - eor x11, x19, x13, ror #35 - bic x13, x26, x24, ror #10 - eor x28, x27, x24, ror #57 - bic x27, x24, x9, ror #47 - bic x19, x23, x3, ror #9 - bic x4, x29, x14, ror #41 - eor x24, x19, x29, ror #44 - bic x29, x3, x29, ror #35 - eor x13, x13, x9, ror #57 - eor x19, x29, x14, ror #12 - bic x29, x9, x0, ror #19 - bic x14, x14, x8, ror #5 - eor x9, x14, x23, ror #43 - eor x14, x4, x8, ror #46 - bic x23, x8, x23, ror #38 - eor x8, x27, x0, ror #2 - eor x4, x23, x3, ror #47 - bic x3, x0, x30, ror #5 - eor x23, x3, x26, ror #52 - eor x3, x29, x30, ror #24 - eor3 v30.16b, v0.16b, v5.16b, v10.16b - eor3 v30.16b, v30.16b, v15.16b, v20.16b - eor3 v29.16b, v1.16b, v6.16b, v11.16b - eor3 v29.16b, v29.16b, v16.16b, v21.16b - eor3 v28.16b, v2.16b, v7.16b, v12.16b - eor3 v28.16b, v28.16b, v17.16b, v22.16b - eor3 v27.16b, v3.16b, v8.16b, v13.16b - eor3 v27.16b, v27.16b, v18.16b, v23.16b - eor3 v26.16b, v4.16b, v9.16b, v14.16b - eor3 v26.16b, v26.16b, v19.16b, v24.16b - rax1 v25.2d, v30.2d, v28.2d - rax1 v28.2d, v28.2d, v26.2d - rax1 v26.2d, v26.2d, v29.2d - rax1 v29.2d, v29.2d, v27.2d - rax1 v27.2d, v27.2d, v30.2d - eor v30.16b, v0.16b, v26.16b - xar v0.2d, v2.2d, v29.2d, #0x2 - xar v2.2d, v12.2d, v29.2d, #0x15 - xar v12.2d, v13.2d, v28.2d, #0x27 - xar v13.2d, v19.2d, v27.2d, #0x38 - xar v19.2d, v23.2d, v28.2d, #0x8 - xar v23.2d, v15.2d, v26.2d, #0x17 - xar v15.2d, v1.2d, v25.2d, #0x3f - xar v1.2d, v8.2d, v28.2d, #0x9 - xar v8.2d, v16.2d, v25.2d, #0x13 - xar v16.2d, v7.2d, v29.2d, #0x3a - xar v7.2d, v10.2d, v26.2d, #0x3d - xar v10.2d, v3.2d, v28.2d, #0x24 - xar v3.2d, v18.2d, v28.2d, #0x2b - xar v18.2d, v17.2d, v29.2d, #0x31 - xar v17.2d, v11.2d, v25.2d, #0x36 - xar v11.2d, v9.2d, v27.2d, #0x2c - xar v9.2d, v22.2d, v29.2d, #0x3 - xar v22.2d, v14.2d, v27.2d, #0x19 - xar v14.2d, v20.2d, v26.2d, #0x2e - xar v20.2d, v4.2d, v27.2d, #0x25 - xar v4.2d, v24.2d, v27.2d, #0x32 - xar v24.2d, v21.2d, v25.2d, #0x3e - xar v21.2d, v5.2d, v26.2d, #0x1c - xar v27.2d, v6.2d, v25.2d, #0x14 - ldr x30, [sp, #0x10] - ld1r { v28.2d }, [x30], #8 - str x30, [sp, #0x10] - bcax v5.16b, v10.16b, v7.16b, v11.16b - bcax v6.16b, v11.16b, v8.16b, v7.16b - bcax v7.16b, v7.16b, v9.16b, v8.16b - bcax v8.16b, v8.16b, v10.16b, v9.16b - bcax v9.16b, v9.16b, v11.16b, v10.16b - bcax v10.16b, v15.16b, v12.16b, v16.16b - bcax v11.16b, v16.16b, v13.16b, v12.16b - bcax v12.16b, v12.16b, v14.16b, v13.16b - bcax v13.16b, v13.16b, v15.16b, v14.16b - bcax v14.16b, v14.16b, v16.16b, v15.16b - bcax v15.16b, v20.16b, v17.16b, v21.16b - bcax v16.16b, v21.16b, v18.16b, v17.16b - bcax v17.16b, v17.16b, v19.16b, v18.16b - bcax v18.16b, v18.16b, v20.16b, v19.16b - bcax v19.16b, v19.16b, v21.16b, v20.16b - bcax v20.16b, v0.16b, v22.16b, v1.16b - bcax v21.16b, v1.16b, v23.16b, v22.16b - bcax v22.16b, v22.16b, v24.16b, v23.16b - bcax v23.16b, v23.16b, v0.16b, v24.16b - bcax v24.16b, v24.16b, v1.16b, v0.16b - bcax v0.16b, v30.16b, v2.16b, v27.16b - bcax v1.16b, v27.16b, v3.16b, v2.16b - bcax v2.16b, v2.16b, v4.16b, v3.16b - bcax v3.16b, v3.16b, v30.16b, v4.16b - bcax v4.16b, v4.16b, v27.16b, v30.16b - eor v0.16b, v0.16b, v28.16b - -Lsha3_keccak4_f1600_loop: - eor x0, x15, x11, ror #52 - eor x0, x0, x13, ror #48 - eor x26, x8, x9, ror #57 - eor x27, x0, x14, ror #10 - eor3 v30.16b, v0.16b, v5.16b, v10.16b - eor3 v30.16b, v30.16b, v15.16b, v20.16b - eor x29, x16, x28, ror #63 - eor x26, x26, x6, ror #51 - eor x30, x23, x22, ror #50 - eor3 v29.16b, v1.16b, v6.16b, v11.16b - eor x0, x26, x10, ror #31 - eor x29, x29, x19, ror #37 - eor x27, x27, x12, ror #5 - eor3 v29.16b, v29.16b, v16.16b, v21.16b - eor x30, x30, x24, ror #34 - eor x0, x0, x7, ror #27 - eor x26, x30, x21, ror #26 - eor3 v28.16b, v2.16b, v7.16b, v12.16b - eor x26, x26, x25, ror #15 - ror x30, x27, #0x3e - eor x30, x30, x26, ror #57 - ror x26, x26, #0x3a - eor3 v28.16b, v28.16b, v17.16b, v22.16b - eor x16, x30, x16 - eor x28, x30, x28, ror #63 - str x28, [sp, #0xd0] - eor3 v27.16b, v3.16b, v8.16b, v13.16b - eor x29, x29, x17, ror #36 - eor x28, x1, x2, ror #61 - eor x19, x30, x19, ror #37 - eor3 v27.16b, v27.16b, v18.16b, v23.16b - eor x29, x29, x20, ror #2 - eor x28, x28, x4, ror #54 - eor x26, x26, x0, ror #55 - eor3 v26.16b, v4.16b, v9.16b, v14.16b - eor x28, x28, x3, ror #39 - eor x28, x28, x5, ror #25 - ror x0, x0, #0x38 - eor x0, x0, x29, ror #63 - eor3 v26.16b, v26.16b, v19.16b, v24.16b - eor x27, x28, x27, ror #61 - eor x13, x0, x13, ror #46 - eor x28, x29, x28, ror #63 - rax1 v25.2d, v30.2d, v28.2d - eor x29, x30, x20, ror #2 - eor x20, x26, x3, ror #39 - eor x11, x0, x11, ror #50 - rax1 v28.2d, v28.2d, v26.2d - eor x25, x28, x25, ror #9 - eor x3, x28, x21, ror #20 - eor x21, x26, x1 - rax1 v26.2d, v26.2d, v29.2d - eor x9, x27, x9, ror #49 - eor x24, x28, x24, ror #28 - eor x1, x30, x17, ror #36 - eor x14, x0, x14, ror #8 - rax1 v29.2d, v29.2d, v27.2d - eor x22, x28, x22, ror #44 - eor x8, x27, x8, ror #56 - eor x17, x27, x7, ror #19 - rax1 v27.2d, v27.2d, v30.2d - eor x15, x0, x15, ror #62 - bic x7, x20, x22, ror #47 - eor x4, x26, x4, ror #54 - eor v30.16b, v0.16b, v26.16b - eor x0, x0, x12, ror #3 - eor x28, x28, x23, ror #58 - eor x23, x26, x2, ror #61 - xar v0.2d, v2.2d, v29.2d, #0x2 - eor x26, x26, x5, ror #25 - eor x2, x7, x16, ror #39 - bic x7, x9, x20, ror #42 - bic x30, x15, x9, ror #16 - xar v2.2d, v12.2d, v29.2d, #0x15 - eor x7, x7, x22, ror #25 - eor x12, x30, x20, ror #58 - bic x20, x22, x16, ror #56 - xar v12.2d, v13.2d, v28.2d, #0x27 - eor x30, x27, x6, ror #43 - eor x22, x20, x15, ror #23 - bic x6, x19, x13, ror #42 - xar v13.2d, v19.2d, v27.2d, #0x38 - eor x6, x6, x17, ror #41 - bic x5, x13, x17, ror #63 - eor x5, x21, x5, ror #21 - xar v19.2d, v23.2d, v28.2d, #0x8 - bic x17, x17, x21, ror #44 - eor x27, x27, x10, ror #23 - bic x21, x21, x25, ror #50 - bic x20, x27, x4, ror #25 - xar v23.2d, v15.2d, v26.2d, #0x17 - bic x10, x16, x15, ror #31 - eor x16, x21, x19, ror #43 - eor x21, x17, x25, ror #30 - xar v15.2d, v1.2d, v25.2d, #0x3f - bic x19, x25, x19, ror #57 - ldr x25, [sp, #0x18] - eor x17, x10, x9, ror #47 - xar v1.2d, v8.2d, v28.2d, #0x9 - ldr x9, [sp, #0x8] - eor x15, x20, x28, ror #27 - bic x20, x4, x28, ror #2 - xar v8.2d, v16.2d, v25.2d, #0x13 - eor x10, x20, x1, ror #50 - bic x20, x11, x27, ror #60 - eor x20, x20, x4, ror #21 - bic x4, x28, x1, ror #48 - xar v16.2d, v7.2d, v29.2d, #0x3a - bic x1, x1, x11, ror #57 - ldr x28, [x9, x25, lsl #3] - ldr x9, [sp, #0xd0] - xar v7.2d, v10.2d, v26.2d, #0x3d - add x25, x25, #0x1 - str x25, [sp, #0x18] - cmp x25, #0x17 - xar v10.2d, v3.2d, v28.2d, #0x24 - eor x25, x1, x27, ror #53 - bic x27, x30, x26, ror #47 - eor x1, x5, x28 - xar v3.2d, v18.2d, v28.2d, #0x2b - eor x5, x4, x11, ror #41 - eor x11, x19, x13, ror #35 - bic x13, x26, x24, ror #10 - eor x28, x27, x24, ror #57 - xar v18.2d, v17.2d, v29.2d, #0x31 - bic x27, x24, x9, ror #47 - bic x19, x23, x3, ror #9 - bic x4, x29, x14, ror #41 - xar v17.2d, v11.2d, v25.2d, #0x36 - eor x24, x19, x29, ror #44 - bic x29, x3, x29, ror #35 - eor x13, x13, x9, ror #57 - xar v11.2d, v9.2d, v27.2d, #0x2c - eor x19, x29, x14, ror #12 - bic x29, x9, x0, ror #19 - bic x14, x14, x8, ror #5 - xar v9.2d, v22.2d, v29.2d, #0x3 - eor x9, x14, x23, ror #43 - eor x14, x4, x8, ror #46 - bic x23, x8, x23, ror #38 - eor x8, x27, x0, ror #2 - xar v22.2d, v14.2d, v27.2d, #0x19 - eor x4, x23, x3, ror #47 - bic x3, x0, x30, ror #5 - eor x23, x3, x26, ror #52 - xar v14.2d, v20.2d, v26.2d, #0x2e - eor x3, x29, x30, ror #24 - eor x0, x15, x11, ror #52 - eor x0, x0, x13, ror #48 - xar v20.2d, v4.2d, v27.2d, #0x25 - eor x26, x8, x9, ror #57 - eor x27, x0, x14, ror #10 - eor x29, x16, x28, ror #63 - xar v4.2d, v24.2d, v27.2d, #0x32 - eor x26, x26, x6, ror #51 - eor x30, x23, x22, ror #50 - eor x0, x26, x10, ror #31 - eor x29, x29, x19, ror #37 - xar v24.2d, v21.2d, v25.2d, #0x3e - eor x27, x27, x12, ror #5 - eor x30, x30, x24, ror #34 - eor x0, x0, x7, ror #27 - xar v21.2d, v5.2d, v26.2d, #0x1c - eor x26, x30, x21, ror #26 - eor x26, x26, x25, ror #15 - ror x30, x27, #0x3e - xar v27.2d, v6.2d, v25.2d, #0x14 - eor x30, x30, x26, ror #57 - ror x26, x26, #0x3a - eor x16, x30, x16 - bcax v5.16b, v10.16b, v7.16b, v11.16b - eor x28, x30, x28, ror #63 - str x28, [sp, #0xd0] - eor x29, x29, x17, ror #36 - eor x28, x1, x2, ror #61 - bcax v6.16b, v11.16b, v8.16b, v7.16b - eor x19, x30, x19, ror #37 - eor x29, x29, x20, ror #2 - eor x28, x28, x4, ror #54 - bcax v7.16b, v7.16b, v9.16b, v8.16b - eor x26, x26, x0, ror #55 - eor x28, x28, x3, ror #39 - eor x28, x28, x5, ror #25 - bcax v8.16b, v8.16b, v10.16b, v9.16b - ror x0, x0, #0x38 - eor x0, x0, x29, ror #63 - eor x27, x28, x27, ror #61 - bcax v9.16b, v9.16b, v11.16b, v10.16b - eor x13, x0, x13, ror #46 - eor x28, x29, x28, ror #63 - eor x29, x30, x20, ror #2 - eor x20, x26, x3, ror #39 - bcax v10.16b, v15.16b, v12.16b, v16.16b - eor x11, x0, x11, ror #50 - eor x25, x28, x25, ror #9 - eor x3, x28, x21, ror #20 - bcax v11.16b, v16.16b, v13.16b, v12.16b - eor x21, x26, x1 - eor x9, x27, x9, ror #49 - eor x24, x28, x24, ror #28 - bcax v12.16b, v12.16b, v14.16b, v13.16b - eor x1, x30, x17, ror #36 - eor x14, x0, x14, ror #8 - eor x22, x28, x22, ror #44 - bcax v13.16b, v13.16b, v15.16b, v14.16b - eor x8, x27, x8, ror #56 - eor x17, x27, x7, ror #19 - eor x15, x0, x15, ror #62 - bic x7, x20, x22, ror #47 - bcax v14.16b, v14.16b, v16.16b, v15.16b - eor x4, x26, x4, ror #54 - eor x0, x0, x12, ror #3 - eor x28, x28, x23, ror #58 - bcax v15.16b, v20.16b, v17.16b, v21.16b - eor x23, x26, x2, ror #61 - eor x26, x26, x5, ror #25 - eor x2, x7, x16, ror #39 - bcax v16.16b, v21.16b, v18.16b, v17.16b - bic x7, x9, x20, ror #42 - bic x30, x15, x9, ror #16 - eor x7, x7, x22, ror #25 - bcax v17.16b, v17.16b, v19.16b, v18.16b - eor x12, x30, x20, ror #58 - bic x20, x22, x16, ror #56 - eor x30, x27, x6, ror #43 - eor x22, x20, x15, ror #23 - bcax v18.16b, v18.16b, v20.16b, v19.16b - bic x6, x19, x13, ror #42 - eor x6, x6, x17, ror #41 - bic x5, x13, x17, ror #63 - bcax v19.16b, v19.16b, v21.16b, v20.16b - eor x5, x21, x5, ror #21 - bic x17, x17, x21, ror #44 - eor x27, x27, x10, ror #23 - bcax v20.16b, v0.16b, v22.16b, v1.16b - bic x21, x21, x25, ror #50 - bic x20, x27, x4, ror #25 - bic x10, x16, x15, ror #31 - bcax v21.16b, v1.16b, v23.16b, v22.16b - eor x16, x21, x19, ror #43 - eor x21, x17, x25, ror #30 - bic x19, x25, x19, ror #57 - ldr x25, [sp, #0x18] - bcax v22.16b, v22.16b, v24.16b, v23.16b - eor x17, x10, x9, ror #47 - ldr x9, [sp, #0x8] - eor x15, x20, x28, ror #27 - bcax v23.16b, v23.16b, v0.16b, v24.16b - bic x20, x4, x28, ror #2 - eor x10, x20, x1, ror #50 - bic x20, x11, x27, ror #60 - bcax v24.16b, v24.16b, v1.16b, v0.16b - eor x20, x20, x4, ror #21 - bic x4, x28, x1, ror #48 - bic x1, x1, x11, ror #57 - bcax v0.16b, v30.16b, v2.16b, v27.16b - ldr x28, [x9, x25, lsl #3] - ldr x9, [sp, #0xd0] - add x25, x25, #0x1 - str x25, [sp, #0x18] - bcax v1.16b, v27.16b, v3.16b, v2.16b - cmp x25, #0x17 - eor x25, x1, x27, ror #53 - bic x27, x30, x26, ror #47 - bcax v2.16b, v2.16b, v4.16b, v3.16b - eor x1, x5, x28 - eor x5, x4, x11, ror #41 - eor x11, x19, x13, ror #35 - bcax v3.16b, v3.16b, v30.16b, v4.16b - bic x13, x26, x24, ror #10 - eor x28, x27, x24, ror #57 - bic x27, x24, x9, ror #47 - bcax v4.16b, v4.16b, v27.16b, v30.16b - bic x19, x23, x3, ror #9 - bic x4, x29, x14, ror #41 - eor x24, x19, x29, ror #44 - bic x29, x3, x29, ror #35 - eor x13, x13, x9, ror #57 - eor x19, x29, x14, ror #12 - bic x29, x9, x0, ror #19 - bic x14, x14, x8, ror #5 - eor x9, x14, x23, ror #43 - eor x14, x4, x8, ror #46 - bic x23, x8, x23, ror #38 - eor x8, x27, x0, ror #2 - eor x4, x23, x3, ror #47 - bic x3, x0, x30, ror #5 - eor x23, x3, x26, ror #52 - eor x3, x29, x30, ror #24 - ldr x30, [sp, #0x10] - ld1r { v28.2d }, [x30], #8 - str x30, [sp, #0x10] - eor v0.16b, v0.16b, v28.16b - ble Lsha3_keccak4_f1600_loop - - ror x2, x2, #0x3d - ror x3, x3, #0x27 - ror x4, x4, #0x36 - ror x5, x5, #0x19 - ror x6, x6, #0x2b - ror x7, x7, #0x13 - ror x8, x8, #0x38 - ror x9, x9, #0x31 - ror x10, x10, #0x17 - ror x11, x11, #0x32 - ror x12, x12, #0x3 - ror x13, x13, #0x2e - ror x14, x14, #0x8 - ror x15, x15, #0x3e - ror x17, x17, #0x24 - ror x28, x28, #0x3f - ror x19, x19, #0x25 - ror x20, x20, #0x2 - ror x21, x21, #0x14 - ror x22, x22, #0x2c - ror x23, x23, #0x3a - ror x24, x24, #0x1c - ror x25, x25, #0x9 - ldr x30, [sp, #0x20] - cmp x30, #0x1 - - beq Lsha3_keccak4_f1600_done - mov x30, #0x1 - str x30, [sp, #0x20] - ldr x0, [sp] - add x0, x0, #0x190 - stp x1, x6, [x0] - stp x11, x16, [x0, #0x10] - stp x21, x2, [x0, #0x20] - stp x7, x12, [x0, #0x30] - stp x17, x22, [x0, #0x40] - stp x3, x8, [x0, #0x50] - stp x13, x28, [x0, #0x60] - stp x23, x4, [x0, #0x70] - stp x9, x14, [x0, #0x80] - stp x19, x24, [x0, #0x90] - stp x5, x10, [x0, #0xa0] - stp x15, x20, [x0, #0xb0] - str x25, [x0, #0xc0] - sub x0, x0, #0x190 - add x0, x0, #0x258 - ldp x1, x6, [x0] - ldp x11, x16, [x0, #0x10] - ldp x21, x2, [x0, #0x20] - ldp x7, x12, [x0, #0x30] - ldp x17, x22, [x0, #0x40] - ldp x3, x8, [x0, #0x50] - ldp x13, x28, [x0, #0x60] - ldp x23, x4, [x0, #0x70] - ldp x9, x14, [x0, #0x80] - ldp x19, x24, [x0, #0x90] - ldp x5, x10, [x0, #0xa0] - ldp x15, x20, [x0, #0xb0] - ldr x25, [x0, #0xc0] - sub x0, x0, #0x258 - b Lsha3_keccak4_f1600_initial - - -Lsha3_keccak4_f1600_done: - ldr x0, [sp] - add x0, x0, #0x258 - stp x1, x6, [x0] - stp x11, x16, [x0, #0x10] - stp x21, x2, [x0, #0x20] - stp x7, x12, [x0, #0x30] - stp x17, x22, [x0, #0x40] - stp x3, x8, [x0, #0x50] - stp x13, x28, [x0, #0x60] - stp x23, x4, [x0, #0x70] - stp x9, x14, [x0, #0x80] - stp x19, x24, [x0, #0x90] - stp x5, x10, [x0, #0xa0] - stp x15, x20, [x0, #0xb0] - str x25, [x0, #0xc0] - sub x0, x0, #0x258 - - add x2, x0, #0xc8 - - trn1 v25.2d, v0.2d, v1.2d - trn1 v26.2d, v2.2d, v3.2d - stp q25, q26, [x0] - trn2 v25.2d, v0.2d, v1.2d - trn2 v26.2d, v2.2d, v3.2d - stp q25, q26, [x2] - - trn1 v25.2d, v4.2d, v5.2d - trn1 v26.2d, v6.2d, v7.2d - stp q25, q26, [x0, #0x20] - trn2 v25.2d, v4.2d, v5.2d - trn2 v26.2d, v6.2d, v7.2d - stp q25, q26, [x2, #0x20] - - trn1 v25.2d, v8.2d, v9.2d - trn1 v26.2d, v10.2d, v11.2d - stp q25, q26, [x0, #0x40] - trn2 v25.2d, v8.2d, v9.2d - trn2 v26.2d, v10.2d, v11.2d - stp q25, q26, [x2, #0x40] - - trn1 v25.2d, v12.2d, v13.2d - trn1 v26.2d, v14.2d, v15.2d - stp q25, q26, [x0, #0x60] - trn2 v25.2d, v12.2d, v13.2d - trn2 v26.2d, v14.2d, v15.2d - stp q25, q26, [x2, #0x60] - - trn1 v25.2d, v16.2d, v17.2d - trn1 v26.2d, v18.2d, v19.2d - stp q25, q26, [x0, #0x80] - trn2 v25.2d, v16.2d, v17.2d - trn2 v26.2d, v18.2d, v19.2d - stp q25, q26, [x2, #0x80] - - trn1 v25.2d, v20.2d, v21.2d - trn1 v26.2d, v22.2d, v23.2d - stp q25, q26, [x0, #0xa0] - trn2 v25.2d, v20.2d, v21.2d - trn2 v26.2d, v22.2d, v23.2d - stp q25, q26, [x2, #0xa0] - - str d24, [x0, #0xc0] - trn2 v24.2d, v24.2d, v24.2d - str d24, [x2, #0xc0] - - CFI_STACKLOAD2(d14,d15,0xc0) - CFI_STACKLOAD2(d12,d13,0xb0) - CFI_STACKLOAD2(d10,d11,0xa0) - CFI_STACKLOAD2(d8,d9,0x90) - CFI_STACKLOAD2(x19,x20,0x30) - CFI_STACKLOAD2(x21,x22,0x40) - CFI_STACKLOAD2(x23,x24,0x50) - CFI_STACKLOAD2(x25,x26,0x60) - CFI_STACKLOAD2(x27,x28,0x70) - CFI_STACKLOAD2(x29,x30,0x80) - CFI_INC_SP(224) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sha3_keccak4_f1600) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/Makefile b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/Makefile deleted file mode 100644 index 216db41a3f8..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/Makefile +++ /dev/null @@ -1,58 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - -# If actually on an ARM8 machine, just use the GNU assembler (as). Otherwise -# use a cross-assembling version so that the code can still be assembled -# and the proofs checked against the object files (though you won't be able -# to run code without additional emulation infrastructure). The aarch64 -# cross-assembling version can be installed manually by something like: -# -# sudo apt-get install binutils-aarch64-linux-gnu - -UNAME_RESULT=$(shell uname -p) - -ifeq ($(UNAME_RESULT),aarch64) -GAS=as -else -GAS=aarch64-linux-gnu-as -endif - -# List of object files - -OBJ = bignum_add_sm2.o \ - bignum_cmul_sm2.o \ - bignum_deamont_sm2.o \ - bignum_demont_sm2.o \ - bignum_double_sm2.o \ - bignum_half_sm2.o \ - bignum_inv_sm2.o \ - bignum_mod_nsm2.o \ - bignum_mod_nsm2_4.o \ - bignum_mod_sm2.o \ - bignum_mod_sm2_4.o \ - bignum_montinv_sm2.o \ - bignum_montmul_sm2.o \ - bignum_montmul_sm2_alt.o \ - bignum_montsqr_sm2.o \ - bignum_montsqr_sm2_alt.o \ - bignum_neg_sm2.o \ - bignum_optneg_sm2.o \ - bignum_sub_sm2.o \ - bignum_tomont_sm2.o \ - bignum_triple_sm2.o \ - sm2_montjadd.o \ - sm2_montjadd_alt.o \ - sm2_montjdouble.o \ - sm2_montjdouble_alt.o \ - sm2_montjmixadd.o \ - sm2_montjmixadd_alt.o \ - sm2_montjscalarmul.o \ - sm2_montjscalarmul_alt.o - -%.o : %.S ; $(CC) -E -I../../include $< | $(GAS) -o $@ - - -default: $(OBJ); - -clean:; rm -f *.o *.correct diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_add_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_add_sm2.S deleted file mode 100644 index 05a99a91466..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_add_sm2.S +++ /dev/null @@ -1,78 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Add modulo p_sm2, z := (x + y) mod p_sm2, assuming x and y reduced -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_add_sm2(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_add_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_add_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_add_sm2) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 -#define c x3 -#define d0 x4 -#define d1 x5 -#define d2 x6 -#define d3 x7 -#define n0 x8 -#define n1 x9 -#define n2 x10 -#define n3 x11 - -S2N_BN_SYMBOL(bignum_add_sm2): - CFI_START - -// First just add the numbers as [c;d3;d2;d1;d0] - - ldp d0, d1, [x] - ldp n0, n1, [y] - adds d0, d0, n0 - adcs d1, d1, n1 - ldp d2, d3, [x, #16] - ldp n2, n3, [y, #16] - adcs d2, d2, n2 - adcs d3, d3, n3 - adc c, xzr, xzr - -// Now let [c;n3;n2;n1;n0] = [c;d3;d2;d1;d0] - p_sm2 - - subs n0, d0, #0xffffffffffffffff - mov n1, #0xffffffff00000000 - sbcs n1, d1, n1 - adcs n2, d2, xzr - mov n3, #0xfffffffeffffffff - sbcs n3, d3, n3 - sbcs c, c, xzr - -// Select result according to whether (x + y) - p_sm2 < 0 - - csel d0, d0, n0, cc - csel d1, d1, n1, cc - csel d2, d2, n2, cc - csel d3, d3, n3, cc - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_add_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_cmul_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_cmul_sm2.S deleted file mode 100644 index 72ea9ab87ef..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_cmul_sm2.S +++ /dev/null @@ -1,110 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_sm2, z := (c * x) mod p_sm2, assuming -// x reduced -// Inputs c, x[4]; output z[4] -// -// extern void bignum_cmul_sm2(uint64_t z[static 4], uint64_t c, -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = c, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_sm2) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_sm2_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_sm2_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_sm2_alt) - .text - .balign 4 - -#define z x0 -#define m x1 -#define x x2 - -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 -#define h x7 -#define q x8 -#define a1 x9 -#define a2 x10 -#define a3 x11 -#define a4 x12 - -S2N_BN_SYMBOL(bignum_cmul_sm2): -S2N_BN_SYMBOL(bignum_cmul_sm2_alt): - CFI_START - -// First do the multiply, straightforwardly to get [h;d3;d2;d1;d0] - - ldp a1, a2, [x] - ldp a3, a4, [x, #16] - mul d0, m, a1 - mul d1, m, a2 - mul d2, m, a3 - mul d3, m, a4 - umulh a1, m, a1 - umulh a2, m, a2 - umulh a3, m, a3 - umulh h, m, a4 - adds d1, d1, a1 - adcs d2, d2, a2 - adcs d3, d3, a3 - adc h, h, xzr - -// Quotient approximation is (h * (1 + 2^32 + 2^64) + d3 + 2^64) >> 64. -// Note that by hypothesis our product is <= (2^64 - 1) * (p_sm2 - 1), -// so there is no need to max this out to avoid wrapping, unlike in the -// more general case of bignum_mod_sm2. - - adds a3, d3, h - mov a2, #1 - adc a1, h, a2 - add a2, h, a3, lsr #32 - add q, a1, a2, lsr #32 - -// Let a3 = q<<32 and a4 = q>>32 then [a2;a1] = 2^32 * q - q - - lsl a3, q, #32 - subs a1, a3, q - lsr a4, q, #32 - sbc a2, a4, xzr - -// Do the basic correction as [h;d3;d2;d1;d0] := [h;d3;d2;d1;d0] - q * p_sm2 - - sub h, h, q - adds d0, d0, q - adcs d1, d1, a1 - adcs d2, d2, a2 - adcs d3, d3, a3 - adc h, h, a4 - -// Use top word (which will be all zeros or all ones) as a mask to correct - - adds d0, d0, h - and a1, h, #0xffffffff00000000 - adcs d1, d1, a1 - adcs d2, d2, h - and a3, h, #0xfffffffeffffffff - adc d3, d3, a3 - -// Finally store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_sm2) -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_sm2_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_deamont_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_deamont_sm2.S deleted file mode 100644 index b132573afcc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_deamont_sm2.S +++ /dev/null @@ -1,114 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from almost-Montgomery form, z := (x / 2^256) mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_deamont_sm2(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Convert a 4-digit bignum x out of its (optionally almost) Montgomery form, -// "almost" meaning any 4-digit input will work, with no range restriction. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_deamont_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_deamont_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_deamont_sm2) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1], and using t0, t1, t2 and t3 as -// temporaries. It is fine for d4 to be the same register as d0, -// and it often is. -// --------------------------------------------------------------------------- - -#define montreds(d4,d3,d2,d1,d0, t3,t2,t1,t0) \ -/* First let [t3;t2] = 2^32 * d0 and [t1;t0] = (2^32-1) * d0 */ \ - lsl t2, d0, #32 __LF \ - lsr t3, d0, #32 __LF \ - subs t0, t2, d0 __LF \ - sbc t1, t3, xzr __LF \ -/* Now [d4;d3;d2;d1] := [d0;d3;d2;d1] - [t3;t2;t1;t0] */ \ - subs d1, d1, t0 __LF \ - sbcs d2, d2, t1 __LF \ - sbcs d3, d3, t2 __LF \ - sbc d4, d0, t3 - -// Input parameters - -#define z x0 -#define x x1 - -// Rotating registers for the intermediate windows (with repetitions) - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 - -// Other temporaries - -#define t x6 -#define u x7 -#define v x8 -#define w x9 - -S2N_BN_SYMBOL(bignum_deamont_sm2): - CFI_START - -// Set up an initial window with the input x - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Systematically scroll left doing 1-step reductions. This process -// keeps things inside 4 digits (i.e. < 2^256) at each stage, since -// we have w * p_sm2 + x <= (2^64 - 1) * p_sm2 + (2 EXP 256 - 1) -// <= (2^64 - 1) * (2^256 - 1) + (2 EXP 256 - 1) <= 2^64 * (2^256 - 1) - - montreds(d0,d3,d2,d1,d0, t,u,v,w) - - montreds(d1,d0,d3,d2,d1, t,u,v,w) - - montreds(d2,d1,d0,d3,d2, t,u,v,w) - - montreds(d3,d2,d1,d0,d3, t,u,v,w) - -// Let [w;v;u;t] = [d3;d2;d1;d0] - p_sm2 - - subs t, d0, #-1 - mov u, #0xffffffff00000000 - sbcs u, d1, u - adcs v, d2, xzr - mov w, #0xfffffffeffffffff - sbcs w, d3, w - -// If [d3;d2;d1;d0] < p_sm2 then [d3;d2;d1;d0] is the final answer, -// being reduced mod p_sm2, otherwise [d3;d2;d1;d0] - p_sm2. - - csel d0, d0, t, cc - csel d1, d1, u, cc - csel d2, d2, v, cc - csel d3, d3, w, cc - -// Write back result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_deamont_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_demont_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_demont_sm2.S deleted file mode 100644 index 7d3a7f5c340..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_demont_sm2.S +++ /dev/null @@ -1,94 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^256) mod p_sm2, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_demont_sm2(uint64_t z[static 4], const uint64_t x[static 4]); -// -// This assumes the input is < p_sm2 for correctness. If this is not the case, -// use the variant "bignum_deamont_sm2" instead. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_sm2) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1], and using t0, t1, t2 and t3 as -// temporaries. It is fine for d4 to be the same register as d0, -// and it often is. -// --------------------------------------------------------------------------- - -#define montreds(d4,d3,d2,d1,d0, t3,t2,t1,t0) \ -/* First let [t3;t2] = 2^32 * d0 and [t1;t0] = (2^32-1) * d0 */ \ - lsl t2, d0, #32 __LF \ - lsr t3, d0, #32 __LF \ - subs t0, t2, d0 __LF \ - sbc t1, t3, xzr __LF \ -/* Now [d4;d3;d2;d1] := [d0;d3;d2;d1] - [t3;t2;t1;t0] */ \ - subs d1, d1, t0 __LF \ - sbcs d2, d2, t1 __LF \ - sbcs d3, d3, t2 __LF \ - sbc d4, d0, t3 - -// Input parameters - -#define z x0 -#define x x1 - -// Rotating registers for the intermediate windows (with repetitions) - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 - -// Other temporaries - -#define t x6 -#define u x7 -#define v x8 -#define w x9 - -S2N_BN_SYMBOL(bignum_demont_sm2): - CFI_START - -// Set up an initial window with the input x - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Systematically scroll left doing 1-step reductions. This process -// keeps things reduced < p_sm2 at each stage, since we have -// w * p_sm2 + x <= (2^64 - 1) * p_sm2 + (p_sm2 - 1) < 2^64 * p_sm2 - - montreds(d0,d3,d2,d1,d0, t,u,v,w) - - montreds(d1,d0,d3,d2,d1, t,u,v,w) - - montreds(d2,d1,d0,d3,d2, t,u,v,w) - - montreds(d3,d2,d1,d0,d3, t,u,v,w) - -// Write back result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_double_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_double_sm2.S deleted file mode 100644 index 0a61f18db8b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_double_sm2.S +++ /dev/null @@ -1,76 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo p_sm2, z := (2 * x) mod p_sm2, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_double_sm2(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_double_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_double_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_double_sm2) - .text - .balign 4 - -#define z x0 -#define x x1 -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define c x6 -#define n0 x7 -#define n1 x8 -#define n2 x9 -#define n3 x10 - -S2N_BN_SYMBOL(bignum_double_sm2): - CFI_START - -// Double the input number as 2 * x = c + [d3; d2; d1; d0] -// It's worth considering doing this with extr...63 instead - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - adds d0, d0, d0 - adcs d1, d1, d1 - adcs d2, d2, d2 - adcs d3, d3, d3 - adc c, xzr, xzr - -// Subtract p_sm2 to give 2 * x - p_sm2 = c + [n3; n2; n1; n0] - - subs n0, d0, #0xffffffffffffffff - mov n1, #0xffffffff00000000 - sbcs n1, d1, n1 - adcs n2, d2, xzr - mov n3, #0xfffffffeffffffff - sbcs n3, d3, n3 - sbcs c, c, xzr - -// Now CF is set (because of inversion) if 2 * x >= p_sm2, in which case the -// correct result is [n3; n2; n1; n0], otherwise [d3; d2; d1; d0] - - csel d0, d0, n0, cc - csel d1, d1, n1, cc - csel d2, d2, n2, cc - csel d3, d3, n3, cc - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_double_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_half_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_half_sm2.S deleted file mode 100644 index a868207da7e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_half_sm2.S +++ /dev/null @@ -1,76 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Halve modulo p_sm2, z := (x / 2) mod p_sm2, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_half_sm2(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_half_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_half_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_half_sm2) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define d4 x6 -#define m x7 -#define n x8 - - -S2N_BN_SYMBOL(bignum_half_sm2): - CFI_START - -// Load the 4 digits of x - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Get a bitmask corresponding to the lowest bit of the input - - and m, d0, #1 - neg m, m - -// Do a masked addition of p_sm2, catching carry in a 5th word - - adds d0, d0, m - and n, m, #0xffffffff00000000 - adcs d1, d1, n - adcs d2, d2, m - and n, m, #0xfffffffeffffffff - adcs d3, d3, n - adc d4, xzr, xzr - -// Now shift that sum right one place - - extr d0, d1, d0, #1 - extr d1, d2, d1, #1 - extr d2, d3, d2, #1 - extr d3, d4, d3, #1 - -// Store back - - stp d0, d1, [z] - stp d2, d3, [z, #16] - -// Return - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_half_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_inv_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_inv_sm2.S deleted file mode 100644 index afd35bb0117..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_inv_sm2.S +++ /dev/null @@ -1,1275 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Modular inverse modulo p_sm2 = 2^256 - 2^224 - 2^96 + 2^64 - 1 -// Input x[4]; output z[4] -// -// extern void bignum_inv_sm2(uint64_t z[static 4],const uint64_t x[static 4]); -// -// If the 4-digit input x is coprime to p_sm2, i.e. is not divisible -// by it, returns z < p_sm2 such that x * z == 1 (mod p_sm2). Note that -// x does not need to be reduced modulo p_sm2, but the output always is. -// If the input is divisible (i.e. is 0 or p_sm2), then there can be no -// modular inverse and z = 0 is returned. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_inv_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_inv_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_inv_sm2) - - .text - .balign 4 - -// Size in bytes of a 64-bit word - -#define N 8 - -// Used for the return pointer - -#define res x20 - -// Loop counter and d = 2 * delta value for divstep - -#define i x21 -#define d x22 - -// Registers used for matrix element magnitudes and signs - -#define m00 x10 -#define m01 x11 -#define m10 x12 -#define m11 x13 -#define s00 x14 -#define s01 x15 -#define s10 x16 -#define s11 x17 - -// Initial carries for combinations - -#define car0 x9 -#define car1 x19 - -// Input and output, plain registers treated according to pattern - -#define reg0 x0, #0 -#define reg1 x1, #0 -#define reg2 x2, #0 -#define reg3 x3, #0 -#define reg4 x4, #0 - -#define x x1, #0 -#define z x0, #0 - -// Pointer-offset pairs for temporaries on stack - -#define f sp, #0 -#define g sp, #(6*N) -#define u sp, #(12*N) -#define v sp, #(16*N) - -// Total size to reserve on the stack - -#define NSPACE 20*N - -// --------------------------------------------------------------------------- -// Core signed almost-Montgomery reduction macro. Takes input in -// [d4;d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to -// the existing [d4;d3;d2;d1], and re-using d0 as a temporary internally -// as well as t0, t1, t2, t3. This is almost-Montgomery, i.e. the result -// fits in 4 digits but is not necessarily strictly reduced mod p_sm2. -// --------------------------------------------------------------------------- - -#define amontred(d4,d3,d2,d1,d0, t3,t2,t1,t0) \ -/* We only know the input is -2^316 < x < 2^316. To do traditional */ \ -/* unsigned Montgomery reduction, start by adding 2^61 * p_sm2. */ \ - mov t0, #0xe000000000000000 __LF \ - adds d0, d0, t0 __LF \ - mov t1, #0x1fffffffffffffff __LF \ - adcs d1, d1, t1 __LF \ - mov t2, #0xffffffffe0000000 __LF \ - adcs d2, d2, t2 __LF \ - sbcs d3, d3, xzr __LF \ - and t0, t1, #0xffffffffdfffffff __LF \ - adc d4, d4, t0 __LF \ -/* First let [t3;t2] = 2^32 * d0 and [t1;t0] = (2^32-1) * d0 */ \ - lsl t2, d0, #32 __LF \ - lsr t3, d0, #32 __LF \ - subs t0, t2, d0 __LF \ - sbc t1, t3, xzr __LF \ -/* Now [d4;d3;d2;d1] := [d0;d3;d2;d1] - [t3;t2;t1;t0] */ \ - subs d1, d1, t0 __LF \ - sbcs d2, d2, t1 __LF \ - sbcs d3, d3, t2 __LF \ - sbc t0, d0, t3 __LF \ - adds d4, d4, t0 __LF \ -/* Now capture top carry and subtract p_sm2 if set (almost-Montgomery) */ \ - csetm t0, cs __LF \ - subs d1, d1, t0 __LF \ - and t1, t0, #0xffffffff00000000 __LF \ - sbcs d2, d2, t1 __LF \ - and t2, t0, #0xfffffffeffffffff __LF \ - sbcs d3, d3, t0 __LF \ - sbc d4, d4, t2 - -// Very similar to a subroutine call to the s2n-bignum word_divstep59. -// But different in register usage and returning the final matrix in -// registers as follows -// -// [ m00 m01] -// [ m10 m11] - -#define divstep59() \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x8, x4, #0x100, lsl #12 __LF \ - sbfx x8, x8, #21, #21 __LF \ - mov x11, #0x100000 __LF \ - add x11, x11, x11, lsl #21 __LF \ - add x9, x4, x11 __LF \ - asr x9, x9, #42 __LF \ - add x10, x5, #0x100, lsl #12 __LF \ - sbfx x10, x10, #21, #21 __LF \ - add x11, x5, x11 __LF \ - asr x11, x11, #42 __LF \ - mul x6, x8, x2 __LF \ - mul x7, x9, x3 __LF \ - mul x2, x10, x2 __LF \ - mul x3, x11, x3 __LF \ - add x4, x6, x7 __LF \ - add x5, x2, x3 __LF \ - asr x2, x4, #20 __LF \ - asr x3, x5, #20 __LF \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x12, x4, #0x100, lsl #12 __LF \ - sbfx x12, x12, #21, #21 __LF \ - mov x15, #0x100000 __LF \ - add x15, x15, x15, lsl #21 __LF \ - add x13, x4, x15 __LF \ - asr x13, x13, #42 __LF \ - add x14, x5, #0x100, lsl #12 __LF \ - sbfx x14, x14, #21, #21 __LF \ - add x15, x5, x15 __LF \ - asr x15, x15, #42 __LF \ - mul x6, x12, x2 __LF \ - mul x7, x13, x3 __LF \ - mul x2, x14, x2 __LF \ - mul x3, x15, x3 __LF \ - add x4, x6, x7 __LF \ - add x5, x2, x3 __LF \ - asr x2, x4, #20 __LF \ - asr x3, x5, #20 __LF \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - mul x2, x12, x8 __LF \ - mul x3, x12, x9 __LF \ - mul x6, x14, x8 __LF \ - mul x7, x14, x9 __LF \ - madd x8, x13, x10, x2 __LF \ - madd x9, x13, x11, x3 __LF \ - madd x16, x15, x10, x6 __LF \ - madd x17, x15, x11, x7 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x12, x4, #0x100, lsl #12 __LF \ - sbfx x12, x12, #22, #21 __LF \ - mov x15, #0x100000 __LF \ - add x15, x15, x15, lsl #21 __LF \ - add x13, x4, x15 __LF \ - asr x13, x13, #43 __LF \ - add x14, x5, #0x100, lsl #12 __LF \ - sbfx x14, x14, #22, #21 __LF \ - add x15, x5, x15 __LF \ - asr x15, x15, #43 __LF \ - mneg x2, x12, x8 __LF \ - mneg x3, x12, x9 __LF \ - mneg x4, x14, x8 __LF \ - mneg x5, x14, x9 __LF \ - msub m00, x13, x16, x2 __LF \ - msub m01, x13, x17, x3 __LF \ - msub m10, x15, x16, x4 __LF \ - msub m11, x15, x17, x5 - -S2N_BN_SYMBOL(bignum_inv_sm2): - CFI_START - -// Save registers and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_DEC_SP(NSPACE) - -// Save the return pointer for the end so we can overwrite x0 later - - mov res, x0 - -// Copy the prime and input into the main f and g variables respectively. -// Make sure x is reduced so that g <= f as assumed in the bound proof. - - mov x10, #0xffffffffffffffff - mov x11, #0xffffffff00000000 - mov x13, #0xfffffffeffffffff - stp x10, x11, [f] - stp x10, x13, [f+2*N] - str xzr, [f+4*N] - - ldp x2, x3, [x1] - subs x10, x2, #-1 - sbcs x11, x3, x11 - ldp x4, x5, [x1, #(2*N)] - adcs x12, x4, xzr - sbcs x13, x5, x13 - - csel x2, x2, x10, cc - csel x3, x3, x11, cc - csel x4, x4, x12, cc - csel x5, x5, x13, cc - - stp x2, x3, [g] - stp x4, x5, [g+2*N] - str xzr, [g+4*N] - -// Also maintain reduced < 2^256 vector [u,v] such that -// [f,g] == x * 2^{5*i-50} * [u,v] (mod p_sm2) -// starting with [p_sm2,x] == x * 2^{5*0-50} * [0,2^50] (mod p_sm2) -// The weird-looking 5*i modifications come in because we are doing -// 64-bit word-sized Montgomery reductions at each stage, which is -// 5 bits more than the 59-bit requirement to keep things stable. - - stp xzr, xzr, [u] - stp xzr, xzr, [u+2*N] - - mov x10, #0x0004000000000000 - stp x10, xzr, [v] - stp xzr, xzr, [v+2*N] - -// Start of main loop. We jump into the middle so that the divstep -// portion is common to the special tenth iteration after a uniform -// first 9. - - mov i, #10 - mov d, #1 - b Lbignum_inv_sm2_midloop - -Lbignum_inv_sm2_loop: - -// Separate the matrix elements into sign-magnitude pairs - - cmp m00, xzr - csetm s00, mi - cneg m00, m00, mi - - cmp m01, xzr - csetm s01, mi - cneg m01, m01, mi - - cmp m10, xzr - csetm s10, mi - cneg m10, m10, mi - - cmp m11, xzr - csetm s11, mi - cneg m11, m11, mi - -// Adjust the initial values to allow for complement instead of negation -// This initial offset is the same for [f,g] and [u,v] compositions. -// Save it in stable registers for the [u,v] part and do [f,g] first. - - and x0, m00, s00 - and x1, m01, s01 - add car0, x0, x1 - - and x0, m10, s10 - and x1, m11, s11 - add car1, x0, x1 - -// Now the computation of the updated f and g values. This maintains a -// 2-word carry between stages so we can conveniently insert the shift -// right by 59 before storing back, and not overwrite digits we need -// again of the old f and g values. -// -// Digit 0 of [f,g] - - ldr x7, [f] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [g] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - adc x2, x2, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x5, car1, x0 - adc x3, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x5, x5, x0 - adc x3, x3, x1 - -// Digit 1 of [f,g] - - ldr x7, [f+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [g+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [f] - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [g] - -// Digit 2 of [f,g] - - ldr x7, [f+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [g+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [f+N] - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [g+N] - -// Digits 3 and 4 of [f,g] - - ldr x7, [f+3*N] - eor x1, x7, s00 - ldr x23, [f+4*N] - eor x3, x23, s00 - and x3, x3, m00 - neg x3, x3 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [g+3*N] - eor x1, x8, s01 - ldr x24, [g+4*N] - eor x0, x24, s01 - and x0, x0, m01 - sub x3, x3, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [f+2*N] - extr x5, x3, x5, #59 - str x5, [f+3*N] - asr x3, x3, #59 - str x3, [f+4*N] - - eor x1, x7, s10 - eor x5, x23, s10 - and x5, x5, m10 - neg x5, x5 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, s11 - eor x0, x24, s11 - and x0, x0, m11 - sub x5, x5, x0 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x2, x2, x0 - adc x5, x5, x1 - extr x4, x2, x4, #59 - str x4, [g+2*N] - extr x2, x5, x2, #59 - str x2, [g+3*N] - asr x5, x5, #59 - str x5, [g+4*N] - -// Now the computation of the updated u and v values and their -// Montgomery reductions. A very similar accumulation except that -// the top words of u and v are unsigned and we don't shift. -// -// Digit 0 of [u,v] - - ldr x7, [u] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [v] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - str x4, [u] - adc x2, x2, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x5, car1, x0 - adc x3, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x5, x5, x0 - str x5, [v] - adc x3, x3, x1 - -// Digit 1 of [u,v] - - ldr x7, [u+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [v+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - str x2, [u+N] - adc x6, x6, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x3, x3, x0 - str x3, [v+N] - adc x4, x4, x1 - -// Digit 2 of [u,v] - - ldr x7, [u+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [v+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - str x6, [u+2*N] - adc x5, x5, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x4, x4, x0 - str x4, [v+2*N] - adc x2, x2, x1 - -// Digits 3 and 4 of u (top is unsigned) - - ldr x7, [u+3*N] - eor x1, x7, s00 - and x3, s00, m00 - neg x3, x3 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [v+3*N] - eor x1, x8, s01 - and x0, s01, m01 - sub x3, x3, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - -// Montgomery reduction of u - - ldp x0, x1, [u] - ldr x6, [u+2*N] - amontred(x3,x5,x6,x1,x0, x24,x10,x11,x14) - stp x1, x6, [u] - stp x5, x3, [u+16] - -// Digits 3 and 4 of v (top is unsigned) - - eor x1, x7, s10 - and x5, s10, m10 - neg x5, x5 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, s11 - and x0, s11, m11 - sub x5, x5, x0 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x2, x2, x0 - adc x5, x5, x1 - -// Montgomery reduction of v - - ldp x0, x1, [v] - ldr x3, [v+2*N] - amontred(x5,x2,x3,x1,x0, x24,x10,x11,x14) - stp x1, x3, [v] - stp x2, x5, [v+16] - -Lbignum_inv_sm2_midloop: - - mov x1, d - ldr x2, [f] - ldr x3, [g] - divstep59() - mov d, x1 - -// Next iteration - - subs i, i, #1 - bne Lbignum_inv_sm2_loop - -// The 10th and last iteration does not need anything except the -// u value and the sign of f; the latter can be obtained from the -// lowest word of f. So it's done differently from the main loop. -// Find the sign of the new f. For this we just need one digit -// since we know (for in-scope cases) that f is either +1 or -1. -// We don't explicitly shift right by 59 either, but looking at -// bit 63 (or any bit >= 60) of the unshifted result is enough -// to distinguish -1 from +1; this is then made into a mask. - - ldr x0, [f] - ldr x1, [g] - mul x0, x0, m00 - madd x1, x1, m01, x0 - asr x0, x1, #63 - -// Now separate out the matrix into sign-magnitude pairs -// and adjust each one based on the sign of f. -// -// Note that at this point we expect |f|=1 and we got its -// sign above, so then since [f,0] == x * [u,v] (mod p_sm2) -// we want to flip the sign of u according to that of f. - - cmp m00, xzr - csetm s00, mi - cneg m00, m00, mi - eor s00, s00, x0 - - cmp m01, xzr - csetm s01, mi - cneg m01, m01, mi - eor s01, s01, x0 - - cmp m10, xzr - csetm s10, mi - cneg m10, m10, mi - eor s10, s10, x0 - - cmp m11, xzr - csetm s11, mi - cneg m11, m11, mi - eor s11, s11, x0 - -// Adjust the initial value to allow for complement instead of negation - - and x0, m00, s00 - and x1, m01, s01 - add car0, x0, x1 - -// Digit 0 of [u] - - ldr x7, [u] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [v] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - str x4, [u] - adc x2, x2, x1 - -// Digit 1 of [u] - - ldr x7, [u+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [v+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - str x2, [u+N] - adc x6, x6, x1 - -// Digit 2 of [u] - - ldr x7, [u+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [v+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - str x6, [u+2*N] - adc x5, x5, x1 - -// Digits 3 and 4 of u (top is unsigned) - - ldr x7, [u+3*N] - eor x1, x7, s00 - and x3, s00, m00 - neg x3, x3 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [v+3*N] - eor x1, x8, s01 - and x0, s01, m01 - sub x3, x3, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - -// Montgomery reduction of u. This needs to be strict not "almost" -// so it is followed by an optional subtraction of p_sm2 - - ldp x0, x1, [u] - ldr x2, [u+2*N] - amontred(x3,x5,x2,x1,x0, x24,x10,x11,x14) - - mov x10, #0xffffffffffffffff - subs x10, x1, #-1 - mov x11, #0xffffffff00000000 - sbcs x11, x2, x11 - mov x13, #0xfffffffeffffffff - adcs x12, x5, xzr - sbcs x13, x3, x13 - - csel x10, x1, x10, cc - csel x11, x2, x11, cc - csel x12, x5, x12, cc - csel x13, x3, x13, cc - -// Store it back to the final output - - stp x10, x11, [res] - stp x12, x13, [res, #16] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_inv_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_nsm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_nsm2.S deleted file mode 100644 index e6ed79bbccb..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_nsm2.S +++ /dev/null @@ -1,181 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_sm2 -// Input x[k]; output z[4] -// -// extern void bignum_mod_nsm2(uint64_t z[static 4], uint64_t k, -// const uint64_t *x); -// -// Reduction is modulo the group order of the GM/T 0003-2012 curve SM2. -// -// Standard ARM ABI: X0 = z, X1 = k, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_nsm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_nsm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_nsm2) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_nsm2_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_nsm2_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_nsm2_alt) - .text - .balign 4 - -#define z x0 -#define k x1 -#define x x2 - -#define m0 x3 -#define m1 x4 -#define m2 x5 -#define m3 x6 - -#define t0 x7 -#define t1 x8 -#define t2 x9 -#define t3 x10 -#define t4 x11 - -#define n0 x12 -#define n1 x13 -#define n3 x14 - -// These two are aliased: we only load d when finished with q - -#define q x15 -#define d x15 - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(bignum_mod_nsm2): - -S2N_BN_SYMBOL(bignum_mod_nsm2_alt): - CFI_START - -// If the input is already <= 3 words long, go to a trivial "copy" path - - cmp k, #4 - bcc Lbignum_mod_nsm2_short - -// Otherwise load the top 4 digits (top-down) and reduce k by 4 - - sub k, k, #4 - lsl t0, k, #3 - add t0, t0, x - ldp m2, m3, [t0, #16] - ldp m0, m1, [t0] - -// Load the complicated three words of 2^256 - n_sm2 = [n3; 0; n1; n0] - - movbig(n0, #0xac44, #0x0bf6, #0xc62a, #0xbedd) - movbig(n1, #0x8dfc, #0x2094, #0xde39, #0xfad4) - mov n3, 0x0000000100000000 - -// Reduce the top 4 digits mod n_sm2 (a conditional subtraction of n_sm2) - - adds t0, m0, n0 - adcs t1, m1, n1 - adcs t2, m2, xzr - adcs t3, m3, n3 - csel m0, m0, t0, cc - csel m1, m1, t1, cc - csel m2, m2, t2, cc - csel m3, m3, t3, cc - -// Now do (k-4) iterations of 5->4 word modular reduction - - cbz k, Lbignum_mod_nsm2_writeback -Lbignum_mod_nsm2_loop: - -// Writing the input, with the new zeroth digit implicitly appended, as -// z = 2^256 * m3 + 2^192 * m2 + t, our intended quotient approximation is -// MIN ((m3 * (1 + 2^32 + 2^64) + m2 + 2^64) >> 64) (2^64 - 1) - - adds t0, m2, m3 - mov t2, #1 - adc t1, m3, t2 - add t2, m3, t0, lsr #32 - adds q, t1, t2, lsr #32 - cinv q, q, cs - -// [t4;t3;t2;t1;t0] = q * (2^256 - n_sm2) - - mul t0, n0, q - mul t1, n1, q - mul t3, n3, q - umulh t2, n0, q - adds t1, t1, t2 - umulh t2, n1, q - adc t2, t2, xzr // No carry: high of mul + {0,1} - umulh t4, n3, q - -// Compensate for 2^256 * q - - sub m3, m3, q - -// Decrement k and load the next digit (note that d aliases to q) - - sub k, k, #1 - ldr d, [x, k, lsl #3] - -// [t4;t3;t2;t1;t0] = [m3;m2;m1;m0;d] - q * n_sm2 - - adds t0, d, t0 - adcs t1, m0, t1 - adcs t2, m1, t2 - adcs t3, m2, t3 - adc t4, m3, t4 - -// Now our top word t4 is either zero or all 1s. Use it for a masked -// addition of n_sm2, which we can do by a *subtraction* of -// 2^256 - n_sm2 from our portion, re-using the constants - - and d, t4, n0 - subs m0, t0, d - and d, t4, n1 - sbcs m1, t1, d - sbcs m2, t2, xzr - and d, t4, n3 - sbc m3, t3, d - - cbnz k, Lbignum_mod_nsm2_loop - -// Finally write back [m3;m2;m1;m0] and return - -Lbignum_mod_nsm2_writeback: - stp m0, m1, [z] - stp m2, m3, [z, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_nsm2) - -// Short case: just copy the input with zero-padding - -Lbignum_mod_nsm2_short: - mov m0, xzr - mov m1, xzr - mov m2, xzr - mov m3, xzr - - cbz k, Lbignum_mod_nsm2_writeback - ldr m0, [x] - subs k, k, #1 - beq Lbignum_mod_nsm2_writeback - ldr m1, [x, #8] - subs k, k, #1 - beq Lbignum_mod_nsm2_writeback - ldr m2, [x, #16] - b Lbignum_mod_nsm2_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_nsm2_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_nsm2_4.S deleted file mode 100644 index eef183f874a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_nsm2_4.S +++ /dev/null @@ -1,85 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_mod_nsm2_4(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Reduction is modulo the group order of the GM/T 0003-2012 curve SM2. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_nsm2_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_nsm2_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_nsm2_4) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define n0 x2 -#define n1 x3 -#define n2 x4 -#define n3 x5 - -#define d0 x6 -#define d1 x7 -#define d2 x8 -#define d3 x9 - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(bignum_mod_nsm2_4): - CFI_START - -// Load the complicated three words of n_sm2, the other being all 1s - - movbig( n0, #0x53BB, #0xF409, #0x39D5, #0x4123) - movbig( n1, #0x7203, #0xDF6B, #0x21C6, #0x052B) - mov n3, #0xFFFFFFFEFFFFFFFF - -// Load the input number - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Do the subtraction. Since word 2 of n_sm2 is all 1s, that can be -// done by adding zero with carry, thanks to the inverted carry. - - subs n0, d0, n0 - sbcs n1, d1, n1 - adcs n2, d2, xzr - sbcs n3, d3, n3 - -// Now if the carry is *clear* (inversion at work) the subtraction carried -// and hence we should have done nothing, so we reset each n_i = d_i - - csel n0, d0, n0, cc - csel n1, d1, n1, cc - csel n2, d2, n2, cc - csel n3, d3, n3, cc - -// Store the end result - - stp n0, n1, [z] - stp n2, n3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_nsm2_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_sm2.S deleted file mode 100644 index 9822470b259..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_sm2.S +++ /dev/null @@ -1,154 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_sm2 -// Input x[k]; output z[4] -// -// extern void bignum_mod_sm2(uint64_t z[static 4], uint64_t k, const uint64_t *x); -// -// Standard ARM ABI: X0 = z, X1 = k, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_sm2) - .text - .balign 4 - -#define z x0 -#define k x1 -#define x x2 - -#define m0 x3 -#define m1 x4 -#define m2 x5 -#define m3 x6 - -#define t0 x7 -#define t1 x8 -#define t2 x9 -#define t3 x10 -#define t4 x11 - -#define n1 x12 -#define n3 x13 - -#define q x14 - - -S2N_BN_SYMBOL(bignum_mod_sm2): - CFI_START - -// If the input is already <= 3 words long, go to a trivial "copy" path - - cmp k, #4 - bcc Lbignum_mod_sm2_short - -// Otherwise load the top 4 digits (top-down) and reduce k by 4 - - sub k, k, #4 - lsl t0, k, #3 - add t0, t0, x - ldp m2, m3, [t0, #16] - ldp m0, m1, [t0] - -// Load the complicated words of p_sm2 = [n3;-1;n1;-1] - - mov n1, #0xffffffff00000000 - mov n3, #0xfffffffeffffffff - -// Reduce the top 4 digits mod p_sm2 (a conditional subtraction of p_sm2) - - subs t0, m0, #-1 - sbcs t1, m1, n1 - adcs t2, m2, xzr - sbcs t3, m3, n3 - - csel m0, m0, t0, cc - csel m1, m1, t1, cc - csel m2, m2, t2, cc - csel m3, m3, t3, cc - -// Now do (k-4) iterations of 5->4 word modular reduction - - cbz k, Lbignum_mod_sm2_writeback -Lbignum_mod_sm2_loop: - -// Decrement k and load the next digit as t0. We then want to reduce -// [m3;m2;m1;m0;t0] |-> [m3;m2;m1;m0]; the shuffling downwards is absorbed -// into the various ALU operations - - sub k, k, #1 - ldr t0, [x, k, lsl #3] - -// Writing the input, with the new zeroth digit t0 appended, as -// z = 2^256 * m3 + 2^192 * m2 + t, our intended quotient approximation is -// MIN ((m3 * (1 + 2^32 + 2^64) + m2 + 2^64) >> 64) (2^64 - 1) - - adds t3, m2, m3 - mov t2, #1 - adc t1, m3, t2 - add t2, m3, t3, lsr #32 - adds q, t1, t2, lsr #32 - cinv q, q, cs - -// Let t3 = q<<32 and t4 = q>>32 then [t2;t1] = 2^32 * q - q - - lsl t3, q, #32 - subs t1, t3, q - lsr t4, q, #32 - sbc t2, t4, xzr - -// Do the basic correction to get [t4;t2;t2;t1;t0] = [m3;m2;m1;m0;t0] - q * p - - adds t0, t0, q - adcs t1, t1, m0 - sub m3, m3, q - adcs t2, t2, m1 - adcs t3, t3, m2 - adc t4, t4, m3 - -// Use top word as mask to correct - - adds m0, t0, t4 - and t0, n1, t4 - adcs m1, t1, t0 - adcs m2, t2, t4 - and t0, n3, t4 - adc m3, t3, t0 - - cbnz k, Lbignum_mod_sm2_loop - -// Finally write back [m3;m2;m1;m0] and return - -Lbignum_mod_sm2_writeback: - stp m0, m1, [z] - stp m2, m3, [z, #16] - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_sm2) - -// Short case: just copy the input with zero-padding - -Lbignum_mod_sm2_short: - mov m0, xzr - mov m1, xzr - mov m2, xzr - mov m3, xzr - - cbz k, Lbignum_mod_sm2_writeback - ldr m0, [x] - subs k, k, #1 - beq Lbignum_mod_sm2_writeback - ldr m1, [x, #8] - subs k, k, #1 - beq Lbignum_mod_sm2_writeback - ldr m2, [x, #16] - b Lbignum_mod_sm2_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_sm2_4.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_sm2_4.S deleted file mode 100644 index 20dfbfac7bb..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_mod_sm2_4.S +++ /dev/null @@ -1,74 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_mod_sm2_4(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_sm2_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_sm2_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_sm2_4) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define n0 x2 -#define n1 x3 -#define n2 x4 -#define n3 x5 - -#define d0 x6 -#define d1 x7 -#define d2 x8 -#define d3 x9 - - -S2N_BN_SYMBOL(bignum_mod_sm2_4): - CFI_START - -// Load the non-trivial words of p_sm2 = [n3;-1;n2;-1] - - mov n1, #0xffffffff00000000 - mov n3, #0xfffffffeffffffff - -// Load the input number - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Do the subtraction. - - subs n0, d0, #-1 - sbcs n1, d1, n1 - adcs n2, d2, xzr - sbcs n3, d3, n3 - -// Now if the carry is *clear* (inversion at work) the subtraction carried -// and hence we should have done nothing, so we reset each n_i = d_i - - csel n0, d0, n0, cc - csel n1, d1, n1, cc - csel n2, d2, n2, cc - csel n3, d3, n3, cc - -// Store the end result - - stp n0, n1, [z] - stp n2, n3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_sm2_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montinv_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montinv_sm2.S deleted file mode 100644 index fb2d58ed41d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montinv_sm2.S +++ /dev/null @@ -1,1296 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery inverse modulo p_sm2 = 2^256 - 2^224 - 2^96 + 2^64 - 1 -// Input x[4]; output z[4] -// -// extern void bignum_montinv_sm2(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// If the 4-digit input x is coprime to p_sm2, i.e. is not divisible -// by it, returns z < p_sm2 such that x * z == 2^512 (mod p_sm2). This -// is effectively "Montgomery inverse" because if we consider x and z as -// Montgomery forms of X and Z, i.e. x == 2^256 * X and z == 2^256 * Z -// (both mod p_sm2) then X * Z == 1 (mod p_sm2). That is, this function -// gives the analog of the modular inverse bignum_inv_sm2 but with both -// input and output in the Montgomery domain. Note that x does not need -// to be reduced modulo p_sm2, but the output always is. If the input -// is divisible (i.e. is 0 or p_sm2), then there can be no solution to -// the congruence x * z == 2^512 (mod p_sm2), and z = 0 is returned. - -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montinv_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montinv_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montinv_sm2) - - .text - .balign 4 - -// Size in bytes of a 64-bit word - -#define N 8 - -// Used for the return pointer - -#define res x20 - -// Loop counter and d = 2 * delta value for divstep - -#define i x21 -#define d x22 - -// Registers used for matrix element magnitudes and signs - -#define m00 x10 -#define m01 x11 -#define m10 x12 -#define m11 x13 -#define s00 x14 -#define s01 x15 -#define s10 x16 -#define s11 x17 - -// Initial carries for combinations - -#define car0 x9 -#define car1 x19 - -// Input and output, plain registers treated according to pattern - -#define reg0 x0, #0 -#define reg1 x1, #0 -#define reg2 x2, #0 -#define reg3 x3, #0 -#define reg4 x4, #0 - -#define x x1, #0 -#define z x0, #0 - -// Pointer-offset pairs for temporaries on stack - -#define f sp, #0 -#define g sp, #(6*N) -#define u sp, #(12*N) -#define v sp, #(16*N) - -// Total size to reserve on the stack - -#define NSPACE 20*N - -// --------------------------------------------------------------------------- -// Core signed almost-Montgomery reduction macro. Takes input in -// [d4;d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to -// the existing [d4;d3;d2;d1], and re-using d0 as a temporary internally -// as well as t0, t1, t2, t3. This is almost-Montgomery, i.e. the result -// fits in 4 digits but is not necessarily strictly reduced mod p_sm2. -// --------------------------------------------------------------------------- - -#define amontred(d4,d3,d2,d1,d0, t3,t2,t1,t0) \ -/* We only know the input is -2^316 < x < 2^316. To do traditional */ \ -/* unsigned Montgomery reduction, start by adding 2^61 * p_sm2. */ \ - mov t0, #0xe000000000000000 __LF \ - adds d0, d0, t0 __LF \ - mov t1, #0x1fffffffffffffff __LF \ - adcs d1, d1, t1 __LF \ - mov t2, #0xffffffffe0000000 __LF \ - adcs d2, d2, t2 __LF \ - sbcs d3, d3, xzr __LF \ - and t0, t1, #0xffffffffdfffffff __LF \ - adc d4, d4, t0 __LF \ -/* First let [t3;t2] = 2^32 * d0 and [t1;t0] = (2^32-1) * d0 */ \ - lsl t2, d0, #32 __LF \ - lsr t3, d0, #32 __LF \ - subs t0, t2, d0 __LF \ - sbc t1, t3, xzr __LF \ -/* Now [d4;d3;d2;d1] := [d0;d3;d2;d1] - [t3;t2;t1;t0] */ \ - subs d1, d1, t0 __LF \ - sbcs d2, d2, t1 __LF \ - sbcs d3, d3, t2 __LF \ - sbc t0, d0, t3 __LF \ - adds d4, d4, t0 __LF \ -/* Now capture top carry and subtract p_sm2 if set (almost-Montgomery) */ \ - csetm t0, cs __LF \ - subs d1, d1, t0 __LF \ - and t1, t0, #0xffffffff00000000 __LF \ - sbcs d2, d2, t1 __LF \ - and t2, t0, #0xfffffffeffffffff __LF \ - sbcs d3, d3, t0 __LF \ - sbc d4, d4, t2 - -// Very similar to a subroutine call to the s2n-bignum word_divstep59. -// But different in register usage and returning the final matrix in -// registers as follows -// -// [ m00 m01] -// [ m10 m11] - -#define divstep59() \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x8, x4, #0x100, lsl #12 __LF \ - sbfx x8, x8, #21, #21 __LF \ - mov x11, #0x100000 __LF \ - add x11, x11, x11, lsl #21 __LF \ - add x9, x4, x11 __LF \ - asr x9, x9, #42 __LF \ - add x10, x5, #0x100, lsl #12 __LF \ - sbfx x10, x10, #21, #21 __LF \ - add x11, x5, x11 __LF \ - asr x11, x11, #42 __LF \ - mul x6, x8, x2 __LF \ - mul x7, x9, x3 __LF \ - mul x2, x10, x2 __LF \ - mul x3, x11, x3 __LF \ - add x4, x6, x7 __LF \ - add x5, x2, x3 __LF \ - asr x2, x4, #20 __LF \ - asr x3, x5, #20 __LF \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x12, x4, #0x100, lsl #12 __LF \ - sbfx x12, x12, #21, #21 __LF \ - mov x15, #0x100000 __LF \ - add x15, x15, x15, lsl #21 __LF \ - add x13, x4, x15 __LF \ - asr x13, x13, #42 __LF \ - add x14, x5, #0x100, lsl #12 __LF \ - sbfx x14, x14, #21, #21 __LF \ - add x15, x5, x15 __LF \ - asr x15, x15, #42 __LF \ - mul x6, x12, x2 __LF \ - mul x7, x13, x3 __LF \ - mul x2, x14, x2 __LF \ - mul x3, x15, x3 __LF \ - add x4, x6, x7 __LF \ - add x5, x2, x3 __LF \ - asr x2, x4, #20 __LF \ - asr x3, x5, #20 __LF \ - and x4, x2, #0xfffff __LF \ - orr x4, x4, #0xfffffe0000000000 __LF \ - and x5, x3, #0xfffff __LF \ - orr x5, x5, #0xc000000000000000 __LF \ - tst x5, #0x1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - mul x2, x12, x8 __LF \ - mul x3, x12, x9 __LF \ - mul x6, x14, x8 __LF \ - mul x7, x14, x9 __LF \ - madd x8, x13, x10, x2 __LF \ - madd x9, x13, x11, x3 __LF \ - madd x16, x15, x10, x6 __LF \ - madd x17, x15, x11, x7 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - tst x5, #0x2 __LF \ - asr x5, x5, #1 __LF \ - csel x6, x4, xzr, ne __LF \ - ccmp x1, xzr, #0x8, ne __LF \ - cneg x1, x1, ge __LF \ - cneg x6, x6, ge __LF \ - csel x4, x5, x4, ge __LF \ - add x5, x5, x6 __LF \ - add x1, x1, #0x2 __LF \ - asr x5, x5, #1 __LF \ - add x12, x4, #0x100, lsl #12 __LF \ - sbfx x12, x12, #22, #21 __LF \ - mov x15, #0x100000 __LF \ - add x15, x15, x15, lsl #21 __LF \ - add x13, x4, x15 __LF \ - asr x13, x13, #43 __LF \ - add x14, x5, #0x100, lsl #12 __LF \ - sbfx x14, x14, #22, #21 __LF \ - add x15, x5, x15 __LF \ - asr x15, x15, #43 __LF \ - mneg x2, x12, x8 __LF \ - mneg x3, x12, x9 __LF \ - mneg x4, x14, x8 __LF \ - mneg x5, x14, x9 __LF \ - msub m00, x13, x16, x2 __LF \ - msub m01, x13, x17, x3 __LF \ - msub m10, x15, x16, x4 __LF \ - msub m11, x15, x17, x5 - -S2N_BN_SYMBOL(bignum_montinv_sm2): - CFI_START - -// Save registers and make room for temporaries - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x22) - CFI_PUSH2(x23,x24) - CFI_DEC_SP(NSPACE) - -// Save the return pointer for the end so we can overwrite x0 later - - mov res, x0 - -// Copy the prime and input into the main f and g variables respectively. -// Make sure x is reduced so that g <= f as assumed in the bound proof. - - mov x10, #0xffffffffffffffff - mov x11, #0xffffffff00000000 - mov x13, #0xfffffffeffffffff - stp x10, x11, [f] - stp x10, x13, [f+2*N] - str xzr, [f+4*N] - - ldp x2, x3, [x1] - subs x10, x2, #-1 - sbcs x11, x3, x11 - ldp x4, x5, [x1, #(2*N)] - adcs x12, x4, xzr - sbcs x13, x5, x13 - - csel x2, x2, x10, cc - csel x3, x3, x11, cc - csel x4, x4, x12, cc - csel x5, x5, x13, cc - - stp x2, x3, [g] - stp x4, x5, [g+2*N] - str xzr, [g+4*N] - -// Also maintain reduced < 2^256 vector [u,v] such that -// [f,g] == x * 2^{5*i-50} * [u,v] (mod p_sm2) -// starting with [p_sm2,x] == x * 2^{5*0-562} * [0,2^562] (mod p_sm2) -// The weird-looking 5*i modifications come in because we are doing -// 64-bit word-sized Montgomery reductions at each stage, which is -// 5 bits more than the 59-bit requirement to keep things stable. -// After the 10th and last iteration and sign adjustment, when -// f == 1 for in-scope cases, we have x * 2^{50-562} * u == 1, i.e. -// x * u == 2^512 as required. - - stp xzr, xzr, [u] - stp xzr, xzr, [u+2*N] - -// The starting constant 2^562 mod p_sm2 is -// 0x0018000000040000:0x00040000000c0000:0x000bfffffff80000:0x000c000000100000 -// where colons separate 64-bit subwords, least significant at the right. -// These each need a couple of instructions to create on ARM - - mov x10, #0x0000000000100000 - orr x10, x10, #0x000c000000000000 - mov x11, #0x000c000000000000 - sub x11, x11, #0x80000 - stp x10, x11, [v] - mov x12, #0x0004000000000000 - orr x12, x12, #0x00000000000c0000 - mov x13, #0x0018000000000000 - orr x13, x13, #0x0000000000040000 - stp x12, x13, [v+2*N] - -// Start of main loop. We jump into the middle so that the divstep -// portion is common to the special tenth iteration after a uniform -// first 9. - - mov i, #10 - mov d, #1 - b Lbignum_montinv_sm2_midloop - -Lbignum_montinv_sm2_loop: - -// Separate the matrix elements into sign-magnitude pairs - - cmp m00, xzr - csetm s00, mi - cneg m00, m00, mi - - cmp m01, xzr - csetm s01, mi - cneg m01, m01, mi - - cmp m10, xzr - csetm s10, mi - cneg m10, m10, mi - - cmp m11, xzr - csetm s11, mi - cneg m11, m11, mi - -// Adjust the initial values to allow for complement instead of negation -// This initial offset is the same for [f,g] and [u,v] compositions. -// Save it in stable registers for the [u,v] part and do [f,g] first. - - and x0, m00, s00 - and x1, m01, s01 - add car0, x0, x1 - - and x0, m10, s10 - and x1, m11, s11 - add car1, x0, x1 - -// Now the computation of the updated f and g values. This maintains a -// 2-word carry between stages so we can conveniently insert the shift -// right by 59 before storing back, and not overwrite digits we need -// again of the old f and g values. -// -// Digit 0 of [f,g] - - ldr x7, [f] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [g] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - adc x2, x2, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x5, car1, x0 - adc x3, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x5, x5, x0 - adc x3, x3, x1 - -// Digit 1 of [f,g] - - ldr x7, [f+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [g+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - adc x6, x6, x1 - extr x4, x2, x4, #59 - str x4, [f] - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x3, x3, x0 - adc x4, x4, x1 - extr x5, x3, x5, #59 - str x5, [g] - -// Digit 2 of [f,g] - - ldr x7, [f+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [g+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - adc x5, x5, x1 - extr x2, x6, x2, #59 - str x2, [f+N] - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x4, x4, x0 - adc x2, x2, x1 - extr x3, x4, x3, #59 - str x3, [g+N] - -// Digits 3 and 4 of [f,g] - - ldr x7, [f+3*N] - eor x1, x7, s00 - ldr x23, [f+4*N] - eor x3, x23, s00 - and x3, x3, m00 - neg x3, x3 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [g+3*N] - eor x1, x8, s01 - ldr x24, [g+4*N] - eor x0, x24, s01 - and x0, x0, m01 - sub x3, x3, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - extr x6, x5, x6, #59 - str x6, [f+2*N] - extr x5, x3, x5, #59 - str x5, [f+3*N] - asr x3, x3, #59 - str x3, [f+4*N] - - eor x1, x7, s10 - eor x5, x23, s10 - and x5, x5, m10 - neg x5, x5 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, s11 - eor x0, x24, s11 - and x0, x0, m11 - sub x5, x5, x0 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x2, x2, x0 - adc x5, x5, x1 - extr x4, x2, x4, #59 - str x4, [g+2*N] - extr x2, x5, x2, #59 - str x2, [g+3*N] - asr x5, x5, #59 - str x5, [g+4*N] - -// Now the computation of the updated u and v values and their -// Montgomery reductions. A very similar accumulation except that -// the top words of u and v are unsigned and we don't shift. -// -// Digit 0 of [u,v] - - ldr x7, [u] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [v] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - str x4, [u] - adc x2, x2, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x5, car1, x0 - adc x3, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x5, x5, x0 - str x5, [v] - adc x3, x3, x1 - -// Digit 1 of [u,v] - - ldr x7, [u+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [v+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - str x2, [u+N] - adc x6, x6, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x3, x3, x0 - adc x4, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x3, x3, x0 - str x3, [v+N] - adc x4, x4, x1 - -// Digit 2 of [u,v] - - ldr x7, [u+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [v+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - str x6, [u+2*N] - adc x5, x5, x1 - - eor x1, x7, s10 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x4, x4, x0 - adc x2, xzr, x1 - eor x1, x8, s11 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x4, x4, x0 - str x4, [v+2*N] - adc x2, x2, x1 - -// Digits 3 and 4 of u (top is unsigned) - - ldr x7, [u+3*N] - eor x1, x7, s00 - and x3, s00, m00 - neg x3, x3 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [v+3*N] - eor x1, x8, s01 - and x0, s01, m01 - sub x3, x3, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - -// Montgomery reduction of u - - ldp x0, x1, [u] - ldr x6, [u+2*N] - amontred(x3,x5,x6,x1,x0, x24,x10,x11,x14) - stp x1, x6, [u] - stp x5, x3, [u+16] - -// Digits 3 and 4 of v (top is unsigned) - - eor x1, x7, s10 - and x5, s10, m10 - neg x5, x5 - mul x0, x1, m10 - umulh x1, x1, m10 - adds x2, x2, x0 - adc x5, x5, x1 - eor x1, x8, s11 - and x0, s11, m11 - sub x5, x5, x0 - mul x0, x1, m11 - umulh x1, x1, m11 - adds x2, x2, x0 - adc x5, x5, x1 - -// Montgomery reduction of v - - ldp x0, x1, [v] - ldr x3, [v+2*N] - amontred(x5,x2,x3,x1,x0, x24,x10,x11,x14) - stp x1, x3, [v] - stp x2, x5, [v+16] - -Lbignum_montinv_sm2_midloop: - - mov x1, d - ldr x2, [f] - ldr x3, [g] - divstep59() - mov d, x1 - -// Next iteration - - subs i, i, #1 - bne Lbignum_montinv_sm2_loop - -// The 10th and last iteration does not need anything except the -// u value and the sign of f; the latter can be obtained from the -// lowest word of f. So it's done differently from the main loop. -// Find the sign of the new f. For this we just need one digit -// since we know (for in-scope cases) that f is either +1 or -1. -// We don't explicitly shift right by 59 either, but looking at -// bit 63 (or any bit >= 60) of the unshifted result is enough -// to distinguish -1 from +1; this is then made into a mask. - - ldr x0, [f] - ldr x1, [g] - mul x0, x0, m00 - madd x1, x1, m01, x0 - asr x0, x1, #63 - -// Now separate out the matrix into sign-magnitude pairs -// and adjust each one based on the sign of f. -// -// Note that at this point we expect |f|=1 and we got its -// sign above, so then since [f,0] == x * 2^{-512} [u,v] (mod p_sm2) -// we want to flip the sign of u according to that of f. - - cmp m00, xzr - csetm s00, mi - cneg m00, m00, mi - eor s00, s00, x0 - - cmp m01, xzr - csetm s01, mi - cneg m01, m01, mi - eor s01, s01, x0 - - cmp m10, xzr - csetm s10, mi - cneg m10, m10, mi - eor s10, s10, x0 - - cmp m11, xzr - csetm s11, mi - cneg m11, m11, mi - eor s11, s11, x0 - -// Adjust the initial value to allow for complement instead of negation - - and x0, m00, s00 - and x1, m01, s01 - add car0, x0, x1 - -// Digit 0 of [u] - - ldr x7, [u] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x4, car0, x0 - adc x2, xzr, x1 - ldr x8, [v] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x4, x4, x0 - str x4, [u] - adc x2, x2, x1 - -// Digit 1 of [u] - - ldr x7, [u+N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x2, x2, x0 - adc x6, xzr, x1 - ldr x8, [v+N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x2, x2, x0 - str x2, [u+N] - adc x6, x6, x1 - -// Digit 2 of [u] - - ldr x7, [u+2*N] - eor x1, x7, s00 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x6, x6, x0 - adc x5, xzr, x1 - ldr x8, [v+2*N] - eor x1, x8, s01 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x6, x6, x0 - str x6, [u+2*N] - adc x5, x5, x1 - -// Digits 3 and 4 of u (top is unsigned) - - ldr x7, [u+3*N] - eor x1, x7, s00 - and x3, s00, m00 - neg x3, x3 - mul x0, x1, m00 - umulh x1, x1, m00 - adds x5, x5, x0 - adc x3, x3, x1 - ldr x8, [v+3*N] - eor x1, x8, s01 - and x0, s01, m01 - sub x3, x3, x0 - mul x0, x1, m01 - umulh x1, x1, m01 - adds x5, x5, x0 - adc x3, x3, x1 - -// Montgomery reduction of u. This needs to be strict not "almost" -// so it is followed by an optional subtraction of p_sm2 - - ldp x0, x1, [u] - ldr x2, [u+2*N] - amontred(x3,x5,x2,x1,x0, x24,x10,x11,x14) - - mov x10, #0xffffffffffffffff - subs x10, x1, #-1 - mov x11, #0xffffffff00000000 - sbcs x11, x2, x11 - mov x13, #0xfffffffeffffffff - adcs x12, x5, xzr - sbcs x13, x3, x13 - - csel x10, x1, x10, cc - csel x11, x2, x11, cc - csel x12, x5, x12, cc - csel x13, x3, x13, cc - -// Store it back to the final output - - stp x10, x11, [res] - stp x12, x13, [res, #16] - -// Restore stack and registers - - CFI_INC_SP(NSPACE) - CFI_POP2(x23,x24) - CFI_POP2(x21,x22) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montinv_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montmul_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montmul_sm2.S deleted file mode 100644 index d443f138fde..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montmul_sm2.S +++ /dev/null @@ -1,272 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_sm2 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_sm2(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_sm2, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_sm2 (in particular this is true if we are in -// the "usual" case x < p_sm2 and y < p_sm2). -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_sm2) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro returning (c,h,l) = 3-word 1s complement (x - y) * (w - z) -// c,h,l,t should all be different -// t,h should not overlap w,z -// --------------------------------------------------------------------------- - -#define muldiffn(c,h,l, t, x,y, w,z) \ - subs t, x, y __LF \ - cneg t, t, cc __LF \ - csetm c, cc __LF \ - subs h, w, z __LF \ - cneg h, h, cc __LF \ - mul l, t, h __LF \ - umulh h, t, h __LF \ - cinv c, c, cc __LF \ - eor l, l, c __LF \ - eor h, h, c - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1], and using t0, t1, t2 and t3 as -// temporaries. It is fine for d4 to be the same register as d0, -// and it often is. -// --------------------------------------------------------------------------- - -#define montreds(d4,d3,d2,d1,d0, t3,t2,t1,t0) \ -/* First let [t3;t2] = 2^32 * d0 and [t1;t0] = (2^32-1) * d0 */ \ - lsl t2, d0, #32 __LF \ - lsr t3, d0, #32 __LF \ - subs t0, t2, d0 __LF \ - sbc t1, t3, xzr __LF \ -/* Now [d4;d3;d2;d1] := [d0;d3;d2;d1] - [t3;t2;t1;t0] */ \ - subs d1, d1, t0 __LF \ - sbcs d2, d2, t1 __LF \ - sbcs d3, d3, t2 __LF \ - sbc d4, d0, t3 - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define b0 x7 -#define b1 x8 -#define b2 x9 -#define b3 x10 - -#define s0 x11 -#define s1 x12 -#define s2 x13 -#define s3 x14 -#define t0 x15 -#define t1 x16 -#define t2 x17 -#define t3 x1 -#define s4 x2 - -S2N_BN_SYMBOL(bignum_montmul_sm2): - CFI_START - -// Load in all words of both inputs - - ldp a0, a1, [x1] - ldp a2, a3, [x1, #16] - ldp b0, b1, [x2] - ldp b2, b3, [x2, #16] - -// Multiply low halves with a 2x2->4 ADK multiplier as L = [s3;s2;s1;s0] - - mul s0, a0, b0 - mul s2, a1, b1 - umulh s1, a0, b0 - adds t1, s0, s2 - umulh s3, a1, b1 - adcs t2, s1, s3 - adcs s3, s3, xzr - adds s1, s1, t1 - adcs s2, s2, t2 - adcs s3, s3, xzr - muldiffn(t3,t2,t1, t0, a0,a1, b1,b0) - adds xzr, t3, #1 - adcs s1, s1, t1 - adcs s2, s2, t2 - adc s3, s3, t3 - -// Perform two "short" Montgomery steps on the low product to -// get a modified low result L' = [s1;s0;s3;s2] -// This shifts it to an offset compatible with middle terms -// Stash the result L' temporarily in the output buffer to avoid -// using additional registers. - - montreds(s0,s3,s2,s1,s0, t0,t1,t2,t3) - montreds(s1,s0,s3,s2,s1, t0,t1,t2,t3) - - stp s2, s3, [x0] - stp s0, s1, [x0, #16] - -// Multiply high halves with a 2x2->4 ADK multiplier as H = [s3;s2;s1;s0] - - mul s0, a2, b2 - mul s2, a3, b3 - umulh s1, a2, b2 - adds t1, s0, s2 - umulh s3, a3, b3 - adcs t2, s1, s3 - adcs s3, s3, xzr - adds s1, s1, t1 - adcs s2, s2, t2 - adcs s3, s3, xzr - muldiffn(t3,t2,t1, t0, a2,a3, b3,b2) - adds xzr, t3, #1 - adcs s1, s1, t1 - adcs s2, s2, t2 - adc s3, s3, t3 - -// Compute sign-magnitude a2,[a1,a0] = x_hi - x_lo - - subs a0, a2, a0 - sbcs a1, a3, a1 - sbc a2, xzr, xzr - adds xzr, a2, #1 - eor a0, a0, a2 - adcs a0, a0, xzr - eor a1, a1, a2 - adcs a1, a1, xzr - -// Compute sign-magnitude b2,[b1,b0] = y_lo - y_hi - - subs b0, b0, b2 - sbcs b1, b1, b3 - sbc b2, xzr, xzr - adds xzr, b2, #1 - eor b0, b0, b2 - adcs b0, b0, xzr - eor b1, b1, b2 - adcs b1, b1, xzr - -// Save the correct sign for the sub-product in b3 - - eor b3, a2, b2 - -// Add the high H to the modified low term L' as H + L' = [s4;b2;a2;t3;t0] - - ldp t0, t3, [x0] - adds t0, s0, t0 - adcs t3, s1, t3 - ldp a2, b2, [x0, #16] - adcs a2, s2, a2 - adcs b2, s3, b2 - adc s4, xzr, xzr - -// Multiply with yet a third 2x2->4 ADK multiplier for complex mid-term M - - mul s0, a0, b0 - mul s2, a1, b1 - umulh s1, a0, b0 - adds t1, s0, s2 - umulh s3, a1, b1 - adcs t2, s1, s3 - adcs s3, s3, xzr - adds s1, s1, t1 - adcs s2, s2, t2 - adcs s3, s3, xzr - muldiffn(a1,t2,t1, a0, a0,a1, b1,b0) - adds xzr, a1, #1 - adcs s1, s1, t1 - adcs s2, s2, t2 - adc s3, s3, a1 - -// Set up a sign-modified version of the mid-product in a long accumulator -// as [b3;a1;a0;s3;s2;s1;s0], adding in the H + L' term once with -// zero offset as this signed value is created - - adds xzr, b3, #1 - eor s0, s0, b3 - adcs s0, s0, t0 - eor s1, s1, b3 - adcs s1, s1, t3 - eor s2, s2, b3 - adcs s2, s2, a2 - eor s3, s3, b3 - adcs s3, s3, b2 - adcs a0, s4, b3 - adcs a1, b3, xzr - adc b3, b3, xzr - -// Add in the stashed H + L' term an offset of 2 words as well - - adds s2, s2, t0 - adcs s3, s3, t3 - adcs a0, a0, a2 - adcs a1, a1, b2 - adc b3, b3, s4 - -// Do two more Montgomery steps on the composed term -// Net pre-reduct is in [b3;a1;a0;s3;s2] - - montreds(s0,s3,s2,s1,s0, t0,t1,t2,t3) - montreds(s1,s0,s3,s2,s1, t0,t1,t2,t3) - - adds a0, a0, s0 - adcs a1, a1, s1 - adc b3, b3, xzr - -// Because of the way we added L' in two places, we can overspill by -// more than usual in Montgomery, with the result being only known to -// be < 3 * p_sm2, not the usual < 2 * p_sm2. So now we do a more -// elaborate final correction in the style of bignum_cmul_sm2, though -// we can use much simpler quotient estimation logic (q = h + 1) and -// slightly more direct accumulation of p_sm2 * q. - -#define d0 s2 -#define d1 s3 -#define d2 a0 -#define d3 a1 -#define h b3 - -#define q s4 -#define c b0 - - add q, h, #1 - lsl t0, q, #32 - sub t1, t0, q - adds d0, d0, q - adcs d1, d1, t1 - adcs d2, d2, xzr - adcs d3, d3, t0 - csetm c, cc - adds d0, d0, c - and t1, c, #0xffffffff00000000 - adcs d1, d1, t1 - adcs d2, d2, c - and t0, c, #0xfffffffeffffffff - adc d3, d3, t0 - -// Finally store the result - - stp d0, d1, [x0] - stp d2, d3, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montmul_sm2_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montmul_sm2_alt.S deleted file mode 100644 index 73cd587aa9c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montmul_sm2_alt.S +++ /dev/null @@ -1,210 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_sm2 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_sm2_alt(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_sm2, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_sm2 (in particular this is true if we are in -// the "usual" case x < p_sm2 and y < p_sm2). -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_sm2_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_sm2_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_sm2_alt) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1], and using t0, t1, t2 and t3 as -// temporaries. It is fine for d4 to be the same register as d0, -// and it often is. -// --------------------------------------------------------------------------- - -#define montreds(d4,d3,d2,d1,d0, t3,t2,t1,t0) \ -/* First let [t3;t2] = 2^32 * d0 and [t1;t0] = (2^32-1) * d0 */ \ - lsl t2, d0, #32 __LF \ - lsr t3, d0, #32 __LF \ - subs t0, t2, d0 __LF \ - sbc t1, t3, xzr __LF \ -/* Now [d4;d3;d2;d1] := [d0;d3;d2;d1] - [t3;t2;t1;t0] */ \ - subs d1, d1, t0 __LF \ - sbcs d2, d2, t1 __LF \ - sbcs d3, d3, t2 __LF \ - sbc d4, d0, t3 - -#define z x0 -#define x x1 -#define y x2 - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 -#define b0 x7 -#define b1 x8 -#define b2 x9 -#define b3 x10 - -#define l x11 - -#define u0 x12 -#define u1 x13 -#define u2 x14 -#define u3 x15 -#define u4 x16 - -// These alias to the input arguments when no longer needed - -#define u5 a0 -#define u6 a1 -#define u7 a2 -#define h a3 - -S2N_BN_SYMBOL(bignum_montmul_sm2_alt): - CFI_START - -// Load operands and set up row 0 = [u4;...;u0] = a0 * [b3;...;b0] - - ldp a0, a1, [x] - ldp b0, b1, [y] - - mul u0, a0, b0 - umulh u1, a0, b0 - mul l, a0, b1 - umulh u2, a0, b1 - adds u1, u1, l - - ldp b2, b3, [y, #16] - - mul l, a0, b2 - umulh u3, a0, b2 - adcs u2, u2, l - - mul l, a0, b3 - umulh u4, a0, b3 - adcs u3, u3, l - adc u4, u4, xzr - - ldp a2, a3, [x, #16] - -// Row 1 = [u5;...;u0] = [a1;a0] * [b3;...;b0] - - mul l, a1, b0 - adds u1, u1, l - mul l, a1, b1 - adcs u2, u2, l - mul l, a1, b2 - adcs u3, u3, l - mul l, a1, b3 - adcs u4, u4, l - umulh u5, a1, b3 - adc u5, u5, xzr - - umulh l, a1, b0 - adds u2, u2, l - umulh l, a1, b1 - adcs u3, u3, l - umulh l, a1, b2 - adcs u4, u4, l - adc u5, u5, xzr - -// Row 2 = [u6;...;u0] = [a2;a1;a0] * [b3;...;b0] - - mul l, a2, b0 - adds u2, u2, l - mul l, a2, b1 - adcs u3, u3, l - mul l, a2, b2 - adcs u4, u4, l - mul l, a2, b3 - adcs u5, u5, l - umulh u6, a2, b3 - adc u6, u6, xzr - - umulh l, a2, b0 - adds u3, u3, l - umulh l, a2, b1 - adcs u4, u4, l - umulh l, a2, b2 - adcs u5, u5, l - adc u6, u6, xzr - -// Row 3 = [u7;...;u0] = [a3;...a0] * [b3;...;b0] - - mul l, a3, b0 - adds u3, u3, l - mul l, a3, b1 - adcs u4, u4, l - mul l, a3, b2 - adcs u5, u5, l - mul l, a3, b3 - adcs u6, u6, l - umulh u7, a3, b3 - adc u7, u7, xzr - - umulh l, a3, b0 - adds u4, u4, l - umulh l, a3, b1 - adcs u5, u5, l - umulh l, a3, b2 - adcs u6, u6, l - adc u7, u7, xzr - -// Perform 4 Montgomery steps to rotate the lower half - - montreds(u0,u3,u2,u1,u0, h,l,b0,b1) - montreds(u1,u0,u3,u2,u1, h,l,b0,b1) - montreds(u2,u1,u0,u3,u2, h,l,b0,b1) - montreds(u3,u2,u1,u0,u3, h,l,b0,b1) - -// Add high and low parts, catching carry in b1 - - adds u0, u0, u4 - adcs u1, u1, u5 - adcs u2, u2, u6 - adcs u3, u3, u7 - cset b1, cs - -// Set [h;-1;l;-1] = p_sm2 and form [u7,u6,u5,u4] = [b1;u3;u2;u1;u0] - p_sm2 - - mov l, #0xffffffff00000000 - mov h, #0xfffffffeffffffff - - subs u4, u0, #-1 - sbcs u5, u1, l - adcs u6, u2, xzr - sbcs u7, u3, h - sbcs xzr, b1, xzr - -// Now CF is clear if the comparison carried so the original was fine -// Otherwise take the form with p_sm2 subtracted. - - csel u0, u0, u4, cc - csel u1, u1, u5, cc - csel u2, u2, u6, cc - csel u3, u3, u7, cc - -// Store back final result - - stp u0, u1, [z] - stp u2, u3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_sm2_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montsqr_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montsqr_sm2.S deleted file mode 100644 index aeaf8f5f6db..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montsqr_sm2.S +++ /dev/null @@ -1,273 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_sm2(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_sm2, assuming x^2 <= 2^256 * p_sm2, which is -// guaranteed in particular if x < p_sm2 initially (the "intended" case). -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_sm2) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Macro returning (c,h,l) = 3-word 1s complement (x - y) * (w - z) -// c,h,l,t should all be different -// t,h should not overlap w,z -// --------------------------------------------------------------------------- - -#define muldiffn(c,h,l, t, x,y, w,z) \ - subs t, x, y __LF \ - cneg t, t, cc __LF \ - csetm c, cc __LF \ - subs h, w, z __LF \ - cneg h, h, cc __LF \ - mul l, t, h __LF \ - umulh h, t, h __LF \ - cinv c, c, cc __LF \ - eor l, l, c __LF \ - eor h, h, c - -// --------------------------------------------------------------------------- -// Core one-step "end" Montgomery reduction macro. Takes input in -// [d5;d4;d3;d2;d1;d0] and returns result in [d5;d4;d3;d2;d1], adding to -// the existing [d4;d3;d2;d1], re-using d0 as a temporary internally as well -// as t1, t2, t3, and initializing d5 from zero (hence "end"). -// --------------------------------------------------------------------------- - -#define montrede(d5, d4,d3,d2,d1,d0, t3,t2,t1,t0) \ -/* First let [t3;t2] = 2^32 * d0 and [t1;t0] = (2^32-1) * d0 */ \ - lsl t2, d0, #32 __LF \ - lsr t3, d0, #32 __LF \ - subs t0, t2, d0 __LF \ - sbc t1, t3, xzr __LF \ -/* Now [d4;d3;d2;d1] := [d0;d3;d2;d1] - [t3;t2;t1;t0] */ \ - subs d1, d1, t0 __LF \ - sbcs d2, d2, t1 __LF \ - sbcs d3, d3, t2 __LF \ - sbc t0, d0, t3 __LF \ - adds d4, d4, t0 __LF \ - adc d5, xzr, xzr - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1], and using t0, t1, t2 and t3 as -// temporaries. It is fine for d4 to be the same register as d0, -// and it often is. -// --------------------------------------------------------------------------- - -#define montreds(d4,d3,d2,d1,d0, t3,t2,t1,t0) \ -/* First let [t3;t2] = 2^32 * d0 and [t1;t0] = (2^32-1) * d0 */ \ - lsl t2, d0, #32 __LF \ - lsr t3, d0, #32 __LF \ - subs t0, t2, d0 __LF \ - sbc t1, t3, xzr __LF \ -/* Now [d4;d3;d2;d1] := [d0;d3;d2;d1] - [t3;t2;t1;t0] */ \ - subs d1, d1, t0 __LF \ - sbcs d2, d2, t1 __LF \ - sbcs d3, d3, t2 __LF \ - sbc d4, d0, t3 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 - -#define c0 x6 -#define c1 x7 -#define c2 x8 -#define c3 x9 -#define c4 x10 -#define d1 x11 -#define d2 x12 -#define d3 x13 -#define d4 x14 - -#define s0 x15 -#define s1 x16 -#define s2 x17 -#define s3 x1 - -#define a0short w2 -#define a1short w3 -#define d1short w11 - -S2N_BN_SYMBOL(bignum_montsqr_sm2): - CFI_START - -// Load in all words of the input - - ldp a0, a1, [x1] - ldp a2, a3, [x1, #16] - -// Square the low half, getting a result in [s3;s2;s1;s0] -// This uses 32x32->64 multiplications to reduce the number of UMULHs - - umull s0, a0short, a0short - lsr d1, a0, #32 - umull s1, d1short, d1short - umull d1, a0short, d1short - adds s0, s0, d1, lsl #33 - lsr d1, d1, #31 - adc s1, s1, d1 - umull s2, a1short, a1short - lsr d1, a1, #32 - umull s3, d1short, d1short - umull d1, a1short, d1short - mul d2, a0, a1 - umulh d3, a0, a1 - adds s2, s2, d1, lsl #33 - lsr d1, d1, #31 - adc s3, s3, d1 - adds d2, d2, d2 - adcs d3, d3, d3 - adc s3, s3, xzr - adds s1, s1, d2 - adcs s2, s2, d3 - adc s3, s3, xzr - -// Perform two "short" Montgomery steps on the low square -// This shifts it to an offset compatible with middle product - - montreds(s0,s3,s2,s1,s0, d1,d2,d3,d4) - - montreds(s1,s0,s3,s2,s1, d1,d2,d3,d4) - -// Compute cross-product with ADK 2x2->4 multiplier as [c3;c2;c1;c0] - - mul c0, a0, a2 - mul d4, a1, a3 - umulh c2, a0, a2 - muldiffn(d3,d2,d1, c4, a0,a1, a3,a2) - - adds c1, c0, c2 - adc c2, c2, xzr - - umulh c3, a1, a3 - - adds c1, c1, d4 - adcs c2, c2, c3 - adc c3, c3, xzr - adds c2, c2, d4 - adc c3, c3, xzr - - adds xzr, d3, #1 - adcs c1, c1, d1 - adcs c2, c2, d2 - adc c3, c3, d3 - -// Double it and add the Montgomerified low square - - adds c0, c0, c0 - adcs c1, c1, c1 - adcs c2, c2, c2 - adcs c3, c3, c3 - adc c4, xzr, xzr - - adds c0, c0, s2 - adcs c1, c1, s3 - adcs c2, c2, s0 - adcs c3, c3, s1 - adc c4, c4, xzr - -// Montgomery-reduce the combined low and middle term another twice - - montrede(c0,c4,c3,c2,c1,c0, d1,d2,d3,d4) - - montrede(c1,c0,c4,c3,c2,c1, d1,d2,d3,d4) - -// Our sum so far is in [c1,c0,c4,c3,c2]; choose more intuitive names - -#define r0 x8 -#define r1 x9 -#define r2 x10 -#define r3 x6 -#define c x7 - -// Remind ourselves what else we can't destroy - -#define a2 x4 -#define a3 x5 - -// So we can have these as temps - -#define t1 x11 -#define t2 x12 -#define t3 x13 - -// Add in the pure squares 22 + 33 - - mul t1, a2, a2 - adds r0, r0, t1 - mul t2, a3, a3 - umulh t1, a2, a2 - adcs r1, r1, t1 - adcs r2, r2, t2 - umulh t2, a3, a3 - adcs r3, r3, t2 - adc c, c, xzr - -// Construct the 23 term, double and add it in - - mul t1, a2, a3 - umulh t2, a2, a3 - adds t1, t1, t1 - adcs t2, t2, t2 - adc t3, xzr, xzr - - adds r1, r1, t1 - adcs r2, r2, t2 - adcs r3, r3, t3 - adcs c, c, xzr - -// We know, writing B = 2^{4*64} that the full implicit result is -// B^2 c <= z + (B - 1) * p < B * p + (B - 1) * p < 2 * B * p, -// so the top half is certainly < 2 * p. If c = 1 already, we know -// subtracting p will give the reduced modulus. But now we do a -// subtraction-comparison to catch cases where the residue is >= p. -// The constants are such that [t3;0;t1;-1] = p_256. - -#define t0 x5 - -// Set CF (because of inversion) iff (0,p_256) <= (c,r3,r2,r1,r0) - - mov t1, #0xffffffff00000000 - subs t0, r0, #-1 - sbcs t1, r1, t1 - mov t3, #0xfffffffeffffffff - adcs t2, r2, xzr - sbcs t3, r3, t3 - sbcs xzr, c, xzr - -// Select final output accordingly - - csel r0, t0, r0, cs - csel r1, t1, r1, cs - csel r2, t2, r2, cs - csel r3, t3, r3, cs - -// Store things back in place - - stp r0, r1, [x0] - stp r2, r3, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montsqr_sm2_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montsqr_sm2_alt.S deleted file mode 100644 index f92dcb3c3ab..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_montsqr_sm2_alt.S +++ /dev/null @@ -1,183 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_sm2_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_sm2, assuming x^2 <= 2^256 * p_sm2, which is -// guaranteed in particular if x < p_sm2 initially (the "intended" case). -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_sm2_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_sm2_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_sm2_alt) - .text - .balign 4 - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d4;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1], and using t0, t1, t2 and t3 as -// temporaries. It is fine for d4 to be the same register as d0, -// and it often is. -// --------------------------------------------------------------------------- - -#define montreds(d4,d3,d2,d1,d0, t3,t2,t1,t0) \ -/* First let [t3;t2] = 2^32 * d0 and [t1;t0] = (2^32-1) * d0 */ \ - lsl t2, d0, #32 __LF \ - lsr t3, d0, #32 __LF \ - subs t0, t2, d0 __LF \ - sbc t1, t3, xzr __LF \ -/* Now [d4;d3;d2;d1] := [d0;d3;d2;d1] - [t3;t2;t1;t0] */ \ - subs d1, d1, t0 __LF \ - sbcs d2, d2, t1 __LF \ - sbcs d3, d3, t2 __LF \ - sbc d4, d0, t3 - -#define z x0 -#define x x1 - -#define a0 x2 -#define a1 x3 -#define a2 x4 -#define a3 x5 - -#define l x6 -#define h x7 - -#define u0 x8 -#define u1 x9 -#define u2 x10 -#define u3 x11 -#define u4 x12 -#define u5 x13 -#define u6 x14 - -// This one is the same as h, which is safe with this computation sequence - -#define u7 h - -S2N_BN_SYMBOL(bignum_montsqr_sm2_alt): - CFI_START - -// Load all the elements, set up an initial window [u6;...u1] = [23;03;01] -// and chain in the addition of 02 + 12 + 13 (no carry-out is possible). -// This gives all the "heterogeneous" terms of the squaring ready to double - - ldp a0, a1, [x] - - mul u1, a0, a1 - umulh u2, a0, a1 - - ldp a2, a3, [x, #16] - - mul u3, a0, a3 - umulh u4, a0, a3 - - mul l, a0, a2 - umulh h, a0, a2 - adds u2, u2, l - - adcs u3, u3, h - mul l, a1, a2 - umulh h, a1, a2 - adc h, h, xzr - adds u3, u3, l - - mul u5, a2, a3 - umulh u6, a2, a3 - - adcs u4, u4, h - mul l, a1, a3 - umulh h, a1, a3 - adc h, h, xzr - adds u4, u4, l - - adcs u5, u5, h - adc u6, u6, xzr - -// Now just double it; this simple approach seems to work better than extr - - adds u1, u1, u1 - adcs u2, u2, u2 - adcs u3, u3, u3 - adcs u4, u4, u4 - adcs u5, u5, u5 - adcs u6, u6, u6 - cset u7, cs - -// Add the homogeneous terms 00 + 11 + 22 + 33 - - umulh l, a0, a0 - mul u0, a0, a0 - adds u1, u1, l - - mul l, a1, a1 - adcs u2, u2, l - umulh l, a1, a1 - adcs u3, u3, l - - mul l, a2, a2 - adcs u4, u4, l - umulh l, a2, a2 - adcs u5, u5, l - - mul l, a3, a3 - adcs u6, u6, l - umulh l, a3, a3 - adc u7, u7, l - -// Squaring complete. Perform 4 Montgomery steps to rotate the lower half - - montreds(u0,u3,u2,u1,u0, a3,a2,a1,a0) - montreds(u1,u0,u3,u2,u1, a3,a2,a1,a0) - montreds(u2,u1,u0,u3,u2, a3,a2,a1,a0) - montreds(u3,u2,u1,u0,u3, a3,a2,a1,a0) - -// Add high and low parts, catching carry in a0 - - adds u0, u0, u4 - adcs u1, u1, u5 - adcs u2, u2, u6 - adcs u3, u3, u7 - cset a0, cs - -// Set [a3;-1;a1;-1] = p_sm2 and form [u7,u6,u5,u4] = [a0;u3;u2;u1;u0] - p_sm2 - - mov a1, #0xffffffff00000000 - mov a3, #0xfffffffeffffffff - - subs u4, u0, #-1 - sbcs u5, u1, a1 - adcs u6, u2, xzr - sbcs u7, u3, a3 - sbcs xzr, a0, xzr - -// Now CF is clear if the comparison carried so the original was fine -// Otherwise take the form with p_sm2 subtracted. - - csel u0, u0, u4, cc - csel u1, u1, u5, cc - csel u2, u2, u6, cc - csel u3, u3, u7, cc - -// Store back final result - - stp u0, u1, [z] - stp u2, u3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_sm2_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_neg_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_neg_sm2.S deleted file mode 100644 index 4b6a0362214..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_neg_sm2.S +++ /dev/null @@ -1,71 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Negate modulo p_sm2, z := (-x) mod p_sm2, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_neg_sm2(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_neg_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_neg_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_neg_sm2) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define p x2 -#define t x3 - -#define d0 x4 -#define d1 x5 -#define d2 x6 -#define d3 x7 - -S2N_BN_SYMBOL(bignum_neg_sm2): - CFI_START - -// Load the 4 digits of x - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Set a bitmask p for the input being nonzero, so that we avoid doing -// -0 = p_sm2 and hence maintain strict modular reduction - - orr t, d0, d1 - orr p, d2, d3 - orr p, p, t - cmp p, #0 - csetm p, ne - -// Mask nontrivial words of p_sm2 = [n3;-1;n1;-1] and subtract - - subs d0, p, d0 - and t, p, #0xffffffff00000000 - sbcs d1, t, d1 - sbcs d2, p, d2 - and t, p, #0xfffffffeffffffff - sbc d3, t, d3 - -// Write back the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - -// Return - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_neg_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_optneg_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_optneg_sm2.S deleted file mode 100644 index 567c3fee83a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_optneg_sm2.S +++ /dev/null @@ -1,88 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo p_sm2, z := (-x) mod p_sm2 (if p nonzero) or -// z := x (if p zero), assuming x reduced -// Inputs p, x[4]; output z[4] -// -// extern void bignum_optneg_sm2(uint64_t z[static 4], uint64_t p, -// const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = p, X2 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg_sm2) - .text - .balign 4 - -#define z x0 -#define p x1 -#define x x2 - -#define d0 x3 -#define d1 x4 -#define d2 x5 -#define d3 x6 -#define n0 x7 -#define n1 x8 -#define n2 x9 -#define n3 x10 - -S2N_BN_SYMBOL(bignum_optneg_sm2): - CFI_START - -// Load the 4 digits of x - - ldp d0, d1, [x] - ldp d2, d3, [x, #16] - -// Adjust p by zeroing it if the input is zero (to avoid giving -0 = p, which -// is not strictly reduced even though it's correct modulo p) - - orr n0, d0, d1 - orr n1, d2, d3 - orr n2, n0, n1 - cmp n2, #0 - csel p, xzr, p, eq - -// Load the nontrivial words of p_sm2 = [n3;-1;n1;-1] - - mov n2, #0xffffffffffffffff - mov n1, #0xffffffff00000000 - mov n3, #0xfffffffeffffffff - -// Do the subtraction, which by hypothesis does not underflow - - subs n0, n2, d0 - sbcs n1, n1, d1 - sbcs n2, n2, d2 - sbc n3, n3, d3 - -// Set condition code if original x is nonzero and p was nonzero - - cmp p, #0 - -// Hence multiplex and write back - - csel n0, n0, d0, ne - csel n1, n1, d1, ne - csel n2, n2, d2, ne - csel n3, n3, d3, ne - - stp n0, n1, [z] - stp n2, n3, [z, #16] - -// Return - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_sub_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_sub_sm2.S deleted file mode 100644 index 589b9a4a36e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_sub_sm2.S +++ /dev/null @@ -1,72 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Subtract modulo p_sm2, z := (x - y) mod p_sm2 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_sub_sm2(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x, X2 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sub_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sub_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sub_sm2) - .text - .balign 4 - -#define z x0 -#define x x1 -#define y x2 -#define c x3 -#define l x4 -#define d0 x5 -#define d1 x6 -#define d2 x7 -#define d3 x8 - - -S2N_BN_SYMBOL(bignum_sub_sm2): - CFI_START - -// First just subtract the numbers as [d3; d2; d1; d0] -// Set a mask based on (inverted) carry indicating x < y = correction is needed - - ldp d0, d1, [x] - ldp l, c, [y] - subs d0, d0, l - sbcs d1, d1, c - ldp d2, d3, [x, #16] - ldp l, c, [y, #16] - sbcs d2, d2, l - sbcs d3, d3, c - -// Create a mask for the condition x < y, when we need to correct - - csetm c, cc - -// Now correct by adding masked p_sm2 - - adds d0, d0, c - and l, c, #0xffffffff00000000 - adcs d1, d1, l - adcs d2, d2, c - and l, c, #0xfffffffeffffffff - adc d3, d3, l - -// Store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sub_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_tomont_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_tomont_sm2.S deleted file mode 100644 index f9cd20fa4b7..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_tomont_sm2.S +++ /dev/null @@ -1,112 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert to Montgomery form z := (2^256 * x) mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_tomont_sm2(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tomont_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tomont_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tomont_sm2) - .text - .balign 4 - -// ---------------------------------------------------------------------------- -// Core "x |-> (2^64 * x) mod p_sm2" macro, with x assumed to be < p_sm2. -// We write it as a macro to be repeated instead of using .rep in assembler. -// The code here is very similar to the core of bignum_mod_sm2, just -// implicitly inserting zeros instead of fresh digits. -// ---------------------------------------------------------------------------- - -#define modstep_sm2() \ -/* Writing the input, with a lowest zero digit appended, as */ \ -/* z = 2^256 * d3 + 2^192 * d2 + t, quotient approximation is */ \ -/* MIN ((d3 * (1 + 2^32 + 2^64) + d2 + 2^64) >> 64) (2^64 - 1) */ \ - adds t3, d2, d3 __LF \ - mov t2, #1 __LF \ - adc t1, d3, t2 __LF \ - add t2, d3, t3, lsr #32 __LF \ - adds q, t1, t2, lsr #32 __LF \ - cinv q, q, cs __LF \ -/* Let t3 = q<<32 and t4 = q>>32 then [t2;t1] = 2^32 * q - q */ \ - lsl t3, q, #32 __LF \ - subs t1, t3, q __LF \ - lsr t4, q, #32 __LF \ - sbc t2, t4, xzr __LF \ -/* Do the basic correction [t4;t3;t2;t1;q] = 2^256 * x - q * p */ \ - adds t1, t1, d0 __LF \ - sub d3, d3, q __LF \ - adcs t2, t2, d1 __LF \ - adcs t3, t3, d2 __LF \ - adc t4, t4, d3 __LF \ -/* Use top word as mask to correct */ \ - adds d0, q, t4 __LF \ - and t0, t4, #0xffffffff00000000 __LF \ - adcs d1, t1, t0 __LF \ - adcs d2, t2, t4 __LF \ - and t0, t4, #0xfffffffeffffffff __LF \ - adc d3, t3, t0 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 - -#define t1 x6 -#define t2 x7 -#define t3 x8 - -#define t4 x9 - -#define q x1 -#define t0 x1 - -S2N_BN_SYMBOL(bignum_tomont_sm2): - CFI_START - -// Load the input - - ldp d0, d1, [x1] - ldp d2, d3, [x1, #16] - -// Do an initial reduction to make sure this is < p_sm2, using just -// a copy of the bignum_mod_sm2_4 code. This is needed to set up the -// invariant "input < p_sm2" for the main modular reduction steps. - - subs t0, d0, #-1 - mov t1, #0xffffffff00000000 - sbcs t1, d1, t1 - adcs t2, d2, xzr - mov t3, #0xfffffffeffffffff - sbcs t3, d3, t3 - csel d0, d0, t0, cc - csel d1, d1, t1, cc - csel d2, d2, t2, cc - csel d3, d3, t3, cc - -// Now do 4 iterations of a basic x |-> (2^64 * x) mod p_sm2 step. - - modstep_sm2() - modstep_sm2() - modstep_sm2() - modstep_sm2() - -// Store the result and return - - stp d0, d1, [x0] - stp d2, d3, [x0, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_tomont_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_triple_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_triple_sm2.S deleted file mode 100644 index abc4260a923..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/bignum_triple_sm2.S +++ /dev/null @@ -1,112 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_sm2, z := (3 * x) mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_triple_sm2(uint64_t z[static 4], const uint64_t x[static 4]); -// -// The input x can be any 4-digit bignum, not necessarily reduced modulo p_sm2, -// and the result is always fully reduced, i.e. z = (3 * x) mod p_sm2. -// -// Standard ARM ABI: X0 = z, X1 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_sm2) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_sm2_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_sm2_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_sm2_alt) - .text - .balign 4 - -#define z x0 -#define x x1 - -#define d0 x2 -#define d1 x3 -#define d2 x4 -#define d3 x5 -#define h x6 - -// Slightly offset aliases for the d_i for readability. - -#define a0 x3 -#define a1 x4 -#define a2 x5 -#define a3 x6 - -// More aliases for the same thing at different stages - -#define q x6 -#define c x6 - -// Other temporary variables - -#define t0 x7 -#define t1 x8 - -S2N_BN_SYMBOL(bignum_triple_sm2): - -S2N_BN_SYMBOL(bignum_triple_sm2_alt): - CFI_START - -// Load the inputs - - ldp a0, a1, [x] - ldp a2, a3, [x, #16] - -// First do the multiplication by 3, getting z = [h; d3; ...; d0] - - lsl d0, a0, #1 - adds d0, d0, a0 - extr d1, a1, a0, #63 - adcs d1, d1, a1 - extr d2, a2, a1, #63 - adcs d2, d2, a2 - extr d3, a3, a2, #63 - adcs d3, d3, a3 - lsr h, a3, #63 - adc h, h, xzr - -// For this limited range a simple quotient estimate of q = h + 1 works, where -// h = floor(z / 2^256). Then -p_sm2 <= z - q * p_sm2 < p_sm2, so we just need -// to subtract q * p_sm2 and then if that's negative, add back p_sm2. - - add q, h, #1 - -// Initial subtraction of z - q * p_sm2, with bitmask c for the carry - - lsl t0, q, #32 - sub t1, t0, q - adds d0, d0, q - adcs d1, d1, t1 - adcs d2, d2, xzr - adcs d3, d3, t0 - csetm c, cc - -// Use the bitmask c for final masked addition of p_sm2. - - adds d0, d0, c - and t1, c, #0xffffffff00000000 - adcs d1, d1, t1 - adcs d2, d2, c - and t0, c, #0xfffffffeffffffff - adc d3, d3, t0 - -// Finally store the result - - stp d0, d1, [z] - stp d2, d3, [z, #16] - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjadd.S deleted file mode 100644 index 96b00c494f0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjadd.S +++ /dev/null @@ -1,545 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on GM/T 0003-2012 curve SM2 in Montgomery-Jacobian coordinates -// -// extern void sm2_montjadd(uint64_t p3[static 12], const uint64_t p1[static 12], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_sm2. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjadd) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x17 -#define input_x x19 -#define input_y x20 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE -#define z_2 input_y, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define z1sq sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define x1a sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define z2sq sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define y1a sp, #(NUMSIZE*6) - -#define NSPACE NUMSIZE*7 - -// Corresponds to bignum_montmul_sm2 with x0 in place of x17 - -#define montmul_sm2(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2] __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x7 __LF \ - mul x13, x4, x8 __LF \ - umulh x12, x3, x7 __LF \ - adds x16, x11, x13 __LF \ - umulh x14, x4, x8 __LF \ - adcs x0, x12, x14 __LF \ - adcs x14, x14, xzr __LF \ - adds x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adcs x14, x14, xzr __LF \ - subs x15, x3, x4 __LF \ - cneg x15, x15, lo __LF \ - csetm x1, lo __LF \ - subs x0, x8, x7 __LF \ - cneg x0, x0, lo __LF \ - mul x16, x15, x0 __LF \ - umulh x0, x15, x0 __LF \ - cinv x1, x1, lo __LF \ - eor x16, x16, x1 __LF \ - eor x0, x0, x1 __LF \ - cmn x1, #1 __LF \ - adcs x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adc x14, x14, x1 __LF \ - lsl x16, x11, #32 __LF \ - lsr x15, x11, #32 __LF \ - subs x1, x16, x11 __LF \ - sbc x0, x15, xzr __LF \ - subs x12, x12, x1 __LF \ - sbcs x13, x13, x0 __LF \ - sbcs x14, x14, x16 __LF \ - sbc x11, x11, x15 __LF \ - lsl x16, x12, #32 __LF \ - lsr x15, x12, #32 __LF \ - subs x1, x16, x12 __LF \ - sbc x0, x15, xzr __LF \ - subs x13, x13, x1 __LF \ - sbcs x14, x14, x0 __LF \ - sbcs x11, x11, x16 __LF \ - sbc x12, x12, x15 __LF \ - stp x13, x14, [P0] __LF \ - stp x11, x12, [P0+16] __LF \ - mul x11, x5, x9 __LF \ - mul x13, x6, x10 __LF \ - umulh x12, x5, x9 __LF \ - adds x16, x11, x13 __LF \ - umulh x14, x6, x10 __LF \ - adcs x0, x12, x14 __LF \ - adcs x14, x14, xzr __LF \ - adds x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adcs x14, x14, xzr __LF \ - subs x15, x5, x6 __LF \ - cneg x15, x15, lo __LF \ - csetm x1, lo __LF \ - subs x0, x10, x9 __LF \ - cneg x0, x0, lo __LF \ - mul x16, x15, x0 __LF \ - umulh x0, x15, x0 __LF \ - cinv x1, x1, lo __LF \ - eor x16, x16, x1 __LF \ - eor x0, x0, x1 __LF \ - cmn x1, #1 __LF \ - adcs x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adc x14, x14, x1 __LF \ - subs x3, x5, x3 __LF \ - sbcs x4, x6, x4 __LF \ - ngc x5, xzr __LF \ - cmn x5, #1 __LF \ - eor x3, x3, x5 __LF \ - adcs x3, x3, xzr __LF \ - eor x4, x4, x5 __LF \ - adcs x4, x4, xzr __LF \ - subs x7, x7, x9 __LF \ - sbcs x8, x8, x10 __LF \ - ngc x9, xzr __LF \ - cmn x9, #1 __LF \ - eor x7, x7, x9 __LF \ - adcs x7, x7, xzr __LF \ - eor x8, x8, x9 __LF \ - adcs x8, x8, xzr __LF \ - eor x10, x5, x9 __LF \ - ldp x15, x1, [P0] __LF \ - adds x15, x11, x15 __LF \ - adcs x1, x12, x1 __LF \ - ldp x5, x9, [P0+16] __LF \ - adcs x5, x13, x5 __LF \ - adcs x9, x14, x9 __LF \ - adc x2, xzr, xzr __LF \ - mul x11, x3, x7 __LF \ - mul x13, x4, x8 __LF \ - umulh x12, x3, x7 __LF \ - adds x16, x11, x13 __LF \ - umulh x14, x4, x8 __LF \ - adcs x0, x12, x14 __LF \ - adcs x14, x14, xzr __LF \ - adds x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adcs x14, x14, xzr __LF \ - subs x3, x3, x4 __LF \ - cneg x3, x3, lo __LF \ - csetm x4, lo __LF \ - subs x0, x8, x7 __LF \ - cneg x0, x0, lo __LF \ - mul x16, x3, x0 __LF \ - umulh x0, x3, x0 __LF \ - cinv x4, x4, lo __LF \ - eor x16, x16, x4 __LF \ - eor x0, x0, x4 __LF \ - cmn x4, #1 __LF \ - adcs x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adc x14, x14, x4 __LF \ - cmn x10, #1 __LF \ - eor x11, x11, x10 __LF \ - adcs x11, x11, x15 __LF \ - eor x12, x12, x10 __LF \ - adcs x12, x12, x1 __LF \ - eor x13, x13, x10 __LF \ - adcs x13, x13, x5 __LF \ - eor x14, x14, x10 __LF \ - adcs x14, x14, x9 __LF \ - adcs x3, x2, x10 __LF \ - adcs x4, x10, xzr __LF \ - adc x10, x10, xzr __LF \ - adds x13, x13, x15 __LF \ - adcs x14, x14, x1 __LF \ - adcs x3, x3, x5 __LF \ - adcs x4, x4, x9 __LF \ - adc x10, x10, x2 __LF \ - lsl x16, x11, #32 __LF \ - lsr x15, x11, #32 __LF \ - subs x1, x16, x11 __LF \ - sbc x0, x15, xzr __LF \ - subs x12, x12, x1 __LF \ - sbcs x13, x13, x0 __LF \ - sbcs x14, x14, x16 __LF \ - sbc x11, x11, x15 __LF \ - lsl x16, x12, #32 __LF \ - lsr x15, x12, #32 __LF \ - subs x1, x16, x12 __LF \ - sbc x0, x15, xzr __LF \ - subs x13, x13, x1 __LF \ - sbcs x14, x14, x0 __LF \ - sbcs x11, x11, x16 __LF \ - sbc x12, x12, x15 __LF \ - adds x3, x3, x11 __LF \ - adcs x4, x4, x12 __LF \ - adc x10, x10, xzr __LF \ - add x2, x10, #1 __LF \ - lsl x15, x2, #32 __LF \ - sub x16, x15, x2 __LF \ - adds x13, x13, x2 __LF \ - adcs x14, x14, x16 __LF \ - adcs x3, x3, xzr __LF \ - adcs x4, x4, x15 __LF \ - csetm x7, lo __LF \ - adds x13, x13, x7 __LF \ - and x16, x7, #0xffffffff00000000 __LF \ - adcs x14, x14, x16 __LF \ - adcs x3, x3, x7 __LF \ - and x15, x7, #0xfffffffeffffffff __LF \ - adc x4, x4, x15 __LF \ - stp x13, x14, [P0] __LF \ - stp x3, x4, [P0+16] - -// Corresponds to bignum_montsqr_sm2 with x0 in place of x17 - -#define montsqr_sm2(P0,P1) \ - ldp x2, x3, [P1] __LF \ - ldp x4, x5, [P1+16] __LF \ - umull x15, w2, w2 __LF \ - lsr x11, x2, #32 __LF \ - umull x16, w11, w11 __LF \ - umull x11, w2, w11 __LF \ - adds x15, x15, x11, lsl #33 __LF \ - lsr x11, x11, #31 __LF \ - adc x16, x16, x11 __LF \ - umull x0, w3, w3 __LF \ - lsr x11, x3, #32 __LF \ - umull x1, w11, w11 __LF \ - umull x11, w3, w11 __LF \ - mul x12, x2, x3 __LF \ - umulh x13, x2, x3 __LF \ - adds x0, x0, x11, lsl #33 __LF \ - lsr x11, x11, #31 __LF \ - adc x1, x1, x11 __LF \ - adds x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adc x1, x1, xzr __LF \ - adds x16, x16, x12 __LF \ - adcs x0, x0, x13 __LF \ - adc x1, x1, xzr __LF \ - lsl x12, x15, #32 __LF \ - lsr x11, x15, #32 __LF \ - subs x14, x12, x15 __LF \ - sbc x13, x11, xzr __LF \ - subs x16, x16, x14 __LF \ - sbcs x0, x0, x13 __LF \ - sbcs x1, x1, x12 __LF \ - sbc x15, x15, x11 __LF \ - lsl x12, x16, #32 __LF \ - lsr x11, x16, #32 __LF \ - subs x14, x12, x16 __LF \ - sbc x13, x11, xzr __LF \ - subs x0, x0, x14 __LF \ - sbcs x1, x1, x13 __LF \ - sbcs x15, x15, x12 __LF \ - sbc x16, x16, x11 __LF \ - mul x6, x2, x4 __LF \ - mul x14, x3, x5 __LF \ - umulh x8, x2, x4 __LF \ - subs x10, x2, x3 __LF \ - cneg x10, x10, lo __LF \ - csetm x13, lo __LF \ - subs x12, x5, x4 __LF \ - cneg x12, x12, lo __LF \ - mul x11, x10, x12 __LF \ - umulh x12, x10, x12 __LF \ - cinv x13, x13, lo __LF \ - eor x11, x11, x13 __LF \ - eor x12, x12, x13 __LF \ - adds x7, x6, x8 __LF \ - adc x8, x8, xzr __LF \ - umulh x9, x3, x5 __LF \ - adds x7, x7, x14 __LF \ - adcs x8, x8, x9 __LF \ - adc x9, x9, xzr __LF \ - adds x8, x8, x14 __LF \ - adc x9, x9, xzr __LF \ - cmn x13, #1 __LF \ - adcs x7, x7, x11 __LF \ - adcs x8, x8, x12 __LF \ - adc x9, x9, x13 __LF \ - adds x6, x6, x6 __LF \ - adcs x7, x7, x7 __LF \ - adcs x8, x8, x8 __LF \ - adcs x9, x9, x9 __LF \ - adc x10, xzr, xzr __LF \ - adds x6, x6, x0 __LF \ - adcs x7, x7, x1 __LF \ - adcs x8, x8, x15 __LF \ - adcs x9, x9, x16 __LF \ - adc x10, x10, xzr __LF \ - lsl x12, x6, #32 __LF \ - lsr x11, x6, #32 __LF \ - subs x14, x12, x6 __LF \ - sbc x13, x11, xzr __LF \ - subs x7, x7, x14 __LF \ - sbcs x8, x8, x13 __LF \ - sbcs x9, x9, x12 __LF \ - sbc x14, x6, x11 __LF \ - adds x10, x10, x14 __LF \ - adc x6, xzr, xzr __LF \ - lsl x12, x7, #32 __LF \ - lsr x11, x7, #32 __LF \ - subs x14, x12, x7 __LF \ - sbc x13, x11, xzr __LF \ - subs x8, x8, x14 __LF \ - sbcs x9, x9, x13 __LF \ - sbcs x10, x10, x12 __LF \ - sbc x14, x7, x11 __LF \ - adds x6, x6, x14 __LF \ - adc x7, xzr, xzr __LF \ - mul x11, x4, x4 __LF \ - adds x8, x8, x11 __LF \ - mul x12, x5, x5 __LF \ - umulh x11, x4, x4 __LF \ - adcs x9, x9, x11 __LF \ - adcs x10, x10, x12 __LF \ - umulh x12, x5, x5 __LF \ - adcs x6, x6, x12 __LF \ - adc x7, x7, xzr __LF \ - mul x11, x4, x5 __LF \ - umulh x12, x4, x5 __LF \ - adds x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adc x13, xzr, xzr __LF \ - adds x9, x9, x11 __LF \ - adcs x10, x10, x12 __LF \ - adcs x6, x6, x13 __LF \ - adcs x7, x7, xzr __LF \ - mov x11, #-4294967296 __LF \ - adds x5, x8, #1 __LF \ - sbcs x11, x9, x11 __LF \ - mov x13, #-4294967297 __LF \ - adcs x12, x10, xzr __LF \ - sbcs x13, x6, x13 __LF \ - sbcs xzr, x7, xzr __LF \ - csel x8, x5, x8, hs __LF \ - csel x9, x11, x9, hs __LF \ - csel x10, x12, x10, hs __LF \ - csel x6, x13, x6, hs __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x6, [P0+16] - -// Corresponds exactly to bignum_sub_sm2 - -#define sub_sm2(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - csetm x3, cc __LF \ - adds x5, x5, x3 __LF \ - and x4, x3, #0xffffffff00000000 __LF \ - adcs x6, x6, x4 __LF \ - adcs x7, x7, x3 __LF \ - and x4, x3, #0xfffffffeffffffff __LF \ - adc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -S2N_BN_SYMBOL(sm2_montjadd): - CFI_START - -// Save regs and make room on stack for temporary variables - - CFI_PUSH2(x19,x20) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations -// 12 * multiply + 4 * square + 7 * subtract - - montsqr_sm2(z1sq,z_1) - montsqr_sm2(z2sq,z_2) - - montmul_sm2(y1a,z_2,y_1) - montmul_sm2(y2a,z_1,y_2) - - montmul_sm2(x2a,z1sq,x_2) - montmul_sm2(x1a,z2sq,x_1) - montmul_sm2(y2a,z1sq,y2a) - montmul_sm2(y1a,z2sq,y1a) - - sub_sm2(xd,x2a,x1a) - sub_sm2(yd,y2a,y1a) - - montsqr_sm2(zz,xd) - montsqr_sm2(ww,yd) - - montmul_sm2(zzx1,zz,x1a) - montmul_sm2(zzx2,zz,x2a) - - sub_sm2(resx,ww,zzx1) - sub_sm2(t1,zzx2,zzx1) - - montmul_sm2(xd,xd,z_1) - - sub_sm2(resx,resx,zzx2) - - sub_sm2(t2,zzx1,resx) - - montmul_sm2(t1,t1,y1a) - montmul_sm2(resz,xd,z_2) - montmul_sm2(t2,yd,t2) - - sub_sm2(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "HI" <=> CF /\ ~ZF <=> P1 = 0 /\ ~(P2 = 0) -// and "LO" <=> ~CF <=> ~(P1 = 0) /\ P2 = 0 - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - - orr x12, x0, x1 - orr x13, x2, x3 - orr x12, x12, x13 - cmp x12, xzr - cset x12, ne - - ldp x4, x5, [z_2] - ldp x6, x7, [z_2+16] - - orr x13, x4, x5 - orr x14, x6, x7 - orr x13, x13, x14 - cmp x13, xzr - cset x13, ne - - cmp x13, x12 - -// Multiplex the outputs accordingly, re-using the z's in registers - - ldp x8, x9, [resz] - csel x8, x0, x8, lo - csel x9, x1, x9, lo - csel x8, x4, x8, hi - csel x9, x5, x9, hi - ldp x10, x11, [resz+16] - csel x10, x2, x10, lo - csel x11, x3, x11, lo - csel x10, x6, x10, hi - csel x11, x7, x11, hi - - ldp x12, x13, [x_1] - ldp x0, x1, [resx] - csel x0, x12, x0, lo - csel x1, x13, x1, lo - ldp x12, x13, [x_2] - csel x0, x12, x0, hi - csel x1, x13, x1, hi - - ldp x12, x13, [x_1+16] - ldp x2, x3, [resx+16] - csel x2, x12, x2, lo - csel x3, x13, x3, lo - ldp x12, x13, [x_2+16] - csel x2, x12, x2, hi - csel x3, x13, x3, hi - - ldp x12, x13, [y_1] - ldp x4, x5, [resy] - csel x4, x12, x4, lo - csel x5, x13, x5, lo - ldp x12, x13, [y_2] - csel x4, x12, x4, hi - csel x5, x13, x5, hi - - ldp x12, x13, [y_1+16] - ldp x6, x7, [resy+16] - csel x6, x12, x6, lo - csel x7, x13, x7, lo - ldp x12, x13, [y_2+16] - csel x6, x12, x6, hi - csel x7, x13, x7, hi - -// Finally store back the multiplexed values - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [y_3] - stp x6, x7, [y_3+16] - stp x8, x9, [z_3] - stp x10, x11, [z_3+16] - -// Restore registers and return - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjadd_alt.S deleted file mode 100644 index a2a806de0b1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjadd_alt.S +++ /dev/null @@ -1,554 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on GM/T 0003-2012 curve SM2 in Montgomery-Jacobian coordinates -// -// extern void sm2_montjadd_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_sm2. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjadd_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x15 -#define input_x x16 -#define input_y x17 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE -#define z_2 input_y, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define z1sq sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define x1a sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define z2sq sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define y1a sp, #(NUMSIZE*6) - -#define NSPACE NUMSIZE*7 - -// Corresponds to bignum_montmul_sm2_alt except for registers - -#define montmul_sm2(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x0, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x1, x3, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x1, x1, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x1, x1, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x0, x0, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x1, x1, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x0, x0, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x1, x1, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x0, x0, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x1, x1, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - lsl x11, x12, #32 __LF \ - lsr x6, x12, #32 __LF \ - subs x8, x11, x12 __LF \ - sbc x7, x6, xzr __LF \ - subs x13, x13, x8 __LF \ - sbcs x14, x14, x7 __LF \ - sbcs x0, x0, x11 __LF \ - sbc x12, x12, x6 __LF \ - lsl x11, x13, #32 __LF \ - lsr x6, x13, #32 __LF \ - subs x8, x11, x13 __LF \ - sbc x7, x6, xzr __LF \ - subs x14, x14, x8 __LF \ - sbcs x0, x0, x7 __LF \ - sbcs x12, x12, x11 __LF \ - sbc x13, x13, x6 __LF \ - lsl x11, x14, #32 __LF \ - lsr x6, x14, #32 __LF \ - subs x8, x11, x14 __LF \ - sbc x7, x6, xzr __LF \ - subs x0, x0, x8 __LF \ - sbcs x12, x12, x7 __LF \ - sbcs x13, x13, x11 __LF \ - sbc x14, x14, x6 __LF \ - lsl x11, x0, #32 __LF \ - lsr x6, x0, #32 __LF \ - subs x8, x11, x0 __LF \ - sbc x7, x6, xzr __LF \ - subs x12, x12, x8 __LF \ - sbcs x13, x13, x7 __LF \ - sbcs x14, x14, x11 __LF \ - sbc x0, x0, x6 __LF \ - adds x12, x12, x1 __LF \ - adcs x13, x13, x3 __LF \ - adcs x14, x14, x4 __LF \ - adcs x0, x0, x5 __LF \ - cset x8, cs __LF \ - mov x11, #0xffffffff00000000 __LF \ - mov x6, #0xfffffffeffffffff __LF \ - adds x1, x12, #0x1 __LF \ - sbcs x3, x13, x11 __LF \ - adcs x4, x14, xzr __LF \ - sbcs x5, x0, x6 __LF \ - sbcs xzr, x8, xzr __LF \ - csel x12, x12, x1, cc __LF \ - csel x13, x13, x3, cc __LF \ - csel x14, x14, x4, cc __LF \ - csel x0, x0, x5, cc __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x0, [P0+16] - -// Corresponds to bignum_montsqr_sm2_alt exactly - -#define montsqr_sm2(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x6, x2, x4 __LF \ - umulh x7, x2, x4 __LF \ - adds x10, x10, x6 __LF \ - adcs x11, x11, x7 __LF \ - mul x6, x3, x4 __LF \ - umulh x7, x3, x4 __LF \ - adc x7, x7, xzr __LF \ - adds x11, x11, x6 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x7 __LF \ - mul x6, x3, x5 __LF \ - umulh x7, x3, x5 __LF \ - adc x7, x7, xzr __LF \ - adds x12, x12, x6 __LF \ - adcs x13, x13, x7 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x7, cs __LF \ - umulh x6, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x6 __LF \ - mul x6, x3, x3 __LF \ - adcs x10, x10, x6 __LF \ - umulh x6, x3, x3 __LF \ - adcs x11, x11, x6 __LF \ - mul x6, x4, x4 __LF \ - adcs x12, x12, x6 __LF \ - umulh x6, x4, x4 __LF \ - adcs x13, x13, x6 __LF \ - mul x6, x5, x5 __LF \ - adcs x14, x14, x6 __LF \ - umulh x6, x5, x5 __LF \ - adc x7, x7, x6 __LF \ - lsl x4, x8, #32 __LF \ - lsr x5, x8, #32 __LF \ - subs x2, x4, x8 __LF \ - sbc x3, x5, xzr __LF \ - subs x9, x9, x2 __LF \ - sbcs x10, x10, x3 __LF \ - sbcs x11, x11, x4 __LF \ - sbc x8, x8, x5 __LF \ - lsl x4, x9, #32 __LF \ - lsr x5, x9, #32 __LF \ - subs x2, x4, x9 __LF \ - sbc x3, x5, xzr __LF \ - subs x10, x10, x2 __LF \ - sbcs x11, x11, x3 __LF \ - sbcs x8, x8, x4 __LF \ - sbc x9, x9, x5 __LF \ - lsl x4, x10, #32 __LF \ - lsr x5, x10, #32 __LF \ - subs x2, x4, x10 __LF \ - sbc x3, x5, xzr __LF \ - subs x11, x11, x2 __LF \ - sbcs x8, x8, x3 __LF \ - sbcs x9, x9, x4 __LF \ - sbc x10, x10, x5 __LF \ - lsl x4, x11, #32 __LF \ - lsr x5, x11, #32 __LF \ - subs x2, x4, x11 __LF \ - sbc x3, x5, xzr __LF \ - subs x8, x8, x2 __LF \ - sbcs x9, x9, x3 __LF \ - sbcs x10, x10, x4 __LF \ - sbc x11, x11, x5 __LF \ - adds x8, x8, x12 __LF \ - adcs x9, x9, x13 __LF \ - adcs x10, x10, x14 __LF \ - adcs x11, x11, x7 __LF \ - cset x2, cs __LF \ - mov x3, #0xffffffff00000000 __LF \ - mov x5, #0xfffffffeffffffff __LF \ - adds x12, x8, #0x1 __LF \ - sbcs x13, x9, x3 __LF \ - adcs x14, x10, xzr __LF \ - sbcs x7, x11, x5 __LF \ - sbcs xzr, x2, xzr __LF \ - csel x8, x8, x12, cc __LF \ - csel x9, x9, x13, cc __LF \ - csel x10, x10, x14, cc __LF \ - csel x11, x11, x7, cc __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Almost-Montgomery variant which we use when an input to other muls -// with the other argument fully reduced (which is always safe). - -#define amontsqr_sm2(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x6, x2, x4 __LF \ - umulh x7, x2, x4 __LF \ - adds x10, x10, x6 __LF \ - adcs x11, x11, x7 __LF \ - mul x6, x3, x4 __LF \ - umulh x7, x3, x4 __LF \ - adc x7, x7, xzr __LF \ - adds x11, x11, x6 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x7 __LF \ - mul x6, x3, x5 __LF \ - umulh x7, x3, x5 __LF \ - adc x7, x7, xzr __LF \ - adds x12, x12, x6 __LF \ - adcs x13, x13, x7 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x7, cs __LF \ - umulh x6, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x6 __LF \ - mul x6, x3, x3 __LF \ - adcs x10, x10, x6 __LF \ - umulh x6, x3, x3 __LF \ - adcs x11, x11, x6 __LF \ - mul x6, x4, x4 __LF \ - adcs x12, x12, x6 __LF \ - umulh x6, x4, x4 __LF \ - adcs x13, x13, x6 __LF \ - mul x6, x5, x5 __LF \ - adcs x14, x14, x6 __LF \ - umulh x6, x5, x5 __LF \ - adc x7, x7, x6 __LF \ - lsl x4, x8, #32 __LF \ - lsr x5, x8, #32 __LF \ - subs x2, x4, x8 __LF \ - sbc x3, x5, xzr __LF \ - subs x9, x9, x2 __LF \ - sbcs x10, x10, x3 __LF \ - sbcs x11, x11, x4 __LF \ - sbc x8, x8, x5 __LF \ - lsl x4, x9, #32 __LF \ - lsr x5, x9, #32 __LF \ - subs x2, x4, x9 __LF \ - sbc x3, x5, xzr __LF \ - subs x10, x10, x2 __LF \ - sbcs x11, x11, x3 __LF \ - sbcs x8, x8, x4 __LF \ - sbc x9, x9, x5 __LF \ - lsl x4, x10, #32 __LF \ - lsr x5, x10, #32 __LF \ - subs x2, x4, x10 __LF \ - sbc x3, x5, xzr __LF \ - subs x11, x11, x2 __LF \ - sbcs x8, x8, x3 __LF \ - sbcs x9, x9, x4 __LF \ - sbc x10, x10, x5 __LF \ - lsl x4, x11, #32 __LF \ - lsr x5, x11, #32 __LF \ - subs x2, x4, x11 __LF \ - sbc x3, x5, xzr __LF \ - subs x8, x8, x2 __LF \ - sbcs x9, x9, x3 __LF \ - sbcs x10, x10, x4 __LF \ - sbc x11, x11, x5 __LF \ - adds x8, x8, x12 __LF \ - adcs x9, x9, x13 __LF \ - adcs x10, x10, x14 __LF \ - adcs x11, x11, x7 __LF \ - csetm x2, cs __LF \ - subs x8, x8, x2 __LF \ - and x3, x2, #0xffffffff00000000 __LF \ - sbcs x9, x9, x3 __LF \ - and x5, x2, #0xfffffffeffffffff __LF \ - sbcs x10, x10, x2 __LF \ - sbc x11, x11, x5 __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Corresponds exactly to bignum_sub_sm2 - -#define sub_sm2(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - csetm x3, cc __LF \ - adds x5, x5, x3 __LF \ - and x4, x3, #0xffffffff00000000 __LF \ - adcs x6, x6, x4 __LF \ - adcs x7, x7, x3 __LF \ - and x4, x3, #0xfffffffeffffffff __LF \ - adc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -S2N_BN_SYMBOL(sm2_montjadd_alt): - CFI_START - -// Make room on stack for temporary variables -// Move the input arguments to stable places - - CFI_DEC_SP(NSPACE) - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations -// 12 * multiply + 4 * square + 7 * subtract - - amontsqr_sm2(z1sq,z_1) - amontsqr_sm2(z2sq,z_2) - - montmul_sm2(y1a,z_2,y_1) - montmul_sm2(y2a,z_1,y_2) - - montmul_sm2(x2a,z1sq,x_2) - montmul_sm2(x1a,z2sq,x_1) - montmul_sm2(y2a,z1sq,y2a) - montmul_sm2(y1a,z2sq,y1a) - - sub_sm2(xd,x2a,x1a) - sub_sm2(yd,y2a,y1a) - - amontsqr_sm2(zz,xd) - montsqr_sm2(ww,yd) - - montmul_sm2(zzx1,zz,x1a) - montmul_sm2(zzx2,zz,x2a) - - sub_sm2(resx,ww,zzx1) - sub_sm2(t1,zzx2,zzx1) - - montmul_sm2(xd,xd,z_1) - - sub_sm2(resx,resx,zzx2) - - sub_sm2(t2,zzx1,resx) - - montmul_sm2(t1,t1,y1a) - montmul_sm2(resz,xd,z_2) - montmul_sm2(t2,yd,t2) - - sub_sm2(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "HI" <=> CF /\ ~ZF <=> P1 = 0 /\ ~(P2 = 0) -// and "LO" <=> ~CF <=> ~(P1 = 0) /\ P2 = 0 - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - - orr x12, x0, x1 - orr x13, x2, x3 - orr x12, x12, x13 - cmp x12, xzr - cset x12, ne - - ldp x4, x5, [z_2] - ldp x6, x7, [z_2+16] - - orr x13, x4, x5 - orr x14, x6, x7 - orr x13, x13, x14 - cmp x13, xzr - cset x13, ne - - cmp x13, x12 - -// Multiplex the outputs accordingly, re-using the z's in registers - - ldp x8, x9, [resz] - csel x8, x0, x8, lo - csel x9, x1, x9, lo - csel x8, x4, x8, hi - csel x9, x5, x9, hi - ldp x10, x11, [resz+16] - csel x10, x2, x10, lo - csel x11, x3, x11, lo - csel x10, x6, x10, hi - csel x11, x7, x11, hi - - ldp x12, x13, [x_1] - ldp x0, x1, [resx] - csel x0, x12, x0, lo - csel x1, x13, x1, lo - ldp x12, x13, [x_2] - csel x0, x12, x0, hi - csel x1, x13, x1, hi - - ldp x12, x13, [x_1+16] - ldp x2, x3, [resx+16] - csel x2, x12, x2, lo - csel x3, x13, x3, lo - ldp x12, x13, [x_2+16] - csel x2, x12, x2, hi - csel x3, x13, x3, hi - - ldp x12, x13, [y_1] - ldp x4, x5, [resy] - csel x4, x12, x4, lo - csel x5, x13, x5, lo - ldp x12, x13, [y_2] - csel x4, x12, x4, hi - csel x5, x13, x5, hi - - ldp x12, x13, [y_1+16] - ldp x6, x7, [resy+16] - csel x6, x12, x6, lo - csel x7, x13, x7, lo - ldp x12, x13, [y_2+16] - csel x6, x12, x6, hi - csel x7, x13, x7, hi - -// Finally store back the multiplexed values - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [y_3] - stp x6, x7, [y_3+16] - stp x8, x9, [z_3] - stp x10, x11, [z_3+16] - -// Restore stack and return - - CFI_INC_SP(NSPACE) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjdouble.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjdouble.S deleted file mode 100644 index b089538234d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjdouble.S +++ /dev/null @@ -1,668 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on GM/T 0003-2012 curve SM2 in Montgomery-Jacobian coordinates -// -// extern void sm2_montjdouble(uint64_t p3[static 12], -// const uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_sm2. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjdouble) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjdouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjdouble) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x19 -#define input_x x20 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define z2 sp, #(NUMSIZE*0) -#define y4 sp, #(NUMSIZE*0) - -#define y2 sp, #(NUMSIZE*1) - -#define t1 sp, #(NUMSIZE*2) - -#define t2 sp, #(NUMSIZE*3) -#define x2p sp, #(NUMSIZE*3) -#define dx2 sp, #(NUMSIZE*3) - -#define xy2 sp, #(NUMSIZE*4) - -#define x4p sp, #(NUMSIZE*5) -#define d_ sp, #(NUMSIZE*5) - -#define NSPACE NUMSIZE*6 - -// Corresponds to bignum_montmul_sm2 exactly - -#define montmul_sm2(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2] __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x7 __LF \ - mul x13, x4, x8 __LF \ - umulh x12, x3, x7 __LF \ - adds x16, x11, x13 __LF \ - umulh x14, x4, x8 __LF \ - adcs x17, x12, x14 __LF \ - adcs x14, x14, xzr __LF \ - adds x12, x12, x16 __LF \ - adcs x13, x13, x17 __LF \ - adcs x14, x14, xzr __LF \ - subs x15, x3, x4 __LF \ - cneg x15, x15, lo __LF \ - csetm x1, lo __LF \ - subs x17, x8, x7 __LF \ - cneg x17, x17, lo __LF \ - mul x16, x15, x17 __LF \ - umulh x17, x15, x17 __LF \ - cinv x1, x1, lo __LF \ - eor x16, x16, x1 __LF \ - eor x17, x17, x1 __LF \ - cmn x1, #1 __LF \ - adcs x12, x12, x16 __LF \ - adcs x13, x13, x17 __LF \ - adc x14, x14, x1 __LF \ - lsl x16, x11, #32 __LF \ - lsr x15, x11, #32 __LF \ - subs x1, x16, x11 __LF \ - sbc x17, x15, xzr __LF \ - subs x12, x12, x1 __LF \ - sbcs x13, x13, x17 __LF \ - sbcs x14, x14, x16 __LF \ - sbc x11, x11, x15 __LF \ - lsl x16, x12, #32 __LF \ - lsr x15, x12, #32 __LF \ - subs x1, x16, x12 __LF \ - sbc x17, x15, xzr __LF \ - subs x13, x13, x1 __LF \ - sbcs x14, x14, x17 __LF \ - sbcs x11, x11, x16 __LF \ - sbc x12, x12, x15 __LF \ - stp x13, x14, [P0] __LF \ - stp x11, x12, [P0+16] __LF \ - mul x11, x5, x9 __LF \ - mul x13, x6, x10 __LF \ - umulh x12, x5, x9 __LF \ - adds x16, x11, x13 __LF \ - umulh x14, x6, x10 __LF \ - adcs x17, x12, x14 __LF \ - adcs x14, x14, xzr __LF \ - adds x12, x12, x16 __LF \ - adcs x13, x13, x17 __LF \ - adcs x14, x14, xzr __LF \ - subs x15, x5, x6 __LF \ - cneg x15, x15, lo __LF \ - csetm x1, lo __LF \ - subs x17, x10, x9 __LF \ - cneg x17, x17, lo __LF \ - mul x16, x15, x17 __LF \ - umulh x17, x15, x17 __LF \ - cinv x1, x1, lo __LF \ - eor x16, x16, x1 __LF \ - eor x17, x17, x1 __LF \ - cmn x1, #1 __LF \ - adcs x12, x12, x16 __LF \ - adcs x13, x13, x17 __LF \ - adc x14, x14, x1 __LF \ - subs x3, x5, x3 __LF \ - sbcs x4, x6, x4 __LF \ - ngc x5, xzr __LF \ - cmn x5, #1 __LF \ - eor x3, x3, x5 __LF \ - adcs x3, x3, xzr __LF \ - eor x4, x4, x5 __LF \ - adcs x4, x4, xzr __LF \ - subs x7, x7, x9 __LF \ - sbcs x8, x8, x10 __LF \ - ngc x9, xzr __LF \ - cmn x9, #1 __LF \ - eor x7, x7, x9 __LF \ - adcs x7, x7, xzr __LF \ - eor x8, x8, x9 __LF \ - adcs x8, x8, xzr __LF \ - eor x10, x5, x9 __LF \ - ldp x15, x1, [P0] __LF \ - adds x15, x11, x15 __LF \ - adcs x1, x12, x1 __LF \ - ldp x5, x9, [P0+16] __LF \ - adcs x5, x13, x5 __LF \ - adcs x9, x14, x9 __LF \ - adc x2, xzr, xzr __LF \ - mul x11, x3, x7 __LF \ - mul x13, x4, x8 __LF \ - umulh x12, x3, x7 __LF \ - adds x16, x11, x13 __LF \ - umulh x14, x4, x8 __LF \ - adcs x17, x12, x14 __LF \ - adcs x14, x14, xzr __LF \ - adds x12, x12, x16 __LF \ - adcs x13, x13, x17 __LF \ - adcs x14, x14, xzr __LF \ - subs x3, x3, x4 __LF \ - cneg x3, x3, lo __LF \ - csetm x4, lo __LF \ - subs x17, x8, x7 __LF \ - cneg x17, x17, lo __LF \ - mul x16, x3, x17 __LF \ - umulh x17, x3, x17 __LF \ - cinv x4, x4, lo __LF \ - eor x16, x16, x4 __LF \ - eor x17, x17, x4 __LF \ - cmn x4, #1 __LF \ - adcs x12, x12, x16 __LF \ - adcs x13, x13, x17 __LF \ - adc x14, x14, x4 __LF \ - cmn x10, #1 __LF \ - eor x11, x11, x10 __LF \ - adcs x11, x11, x15 __LF \ - eor x12, x12, x10 __LF \ - adcs x12, x12, x1 __LF \ - eor x13, x13, x10 __LF \ - adcs x13, x13, x5 __LF \ - eor x14, x14, x10 __LF \ - adcs x14, x14, x9 __LF \ - adcs x3, x2, x10 __LF \ - adcs x4, x10, xzr __LF \ - adc x10, x10, xzr __LF \ - adds x13, x13, x15 __LF \ - adcs x14, x14, x1 __LF \ - adcs x3, x3, x5 __LF \ - adcs x4, x4, x9 __LF \ - adc x10, x10, x2 __LF \ - lsl x16, x11, #32 __LF \ - lsr x15, x11, #32 __LF \ - subs x1, x16, x11 __LF \ - sbc x17, x15, xzr __LF \ - subs x12, x12, x1 __LF \ - sbcs x13, x13, x17 __LF \ - sbcs x14, x14, x16 __LF \ - sbc x11, x11, x15 __LF \ - lsl x16, x12, #32 __LF \ - lsr x15, x12, #32 __LF \ - subs x1, x16, x12 __LF \ - sbc x17, x15, xzr __LF \ - subs x13, x13, x1 __LF \ - sbcs x14, x14, x17 __LF \ - sbcs x11, x11, x16 __LF \ - sbc x12, x12, x15 __LF \ - adds x3, x3, x11 __LF \ - adcs x4, x4, x12 __LF \ - adc x10, x10, xzr __LF \ - add x2, x10, #1 __LF \ - lsl x15, x2, #32 __LF \ - sub x16, x15, x2 __LF \ - adds x13, x13, x2 __LF \ - adcs x14, x14, x16 __LF \ - adcs x3, x3, xzr __LF \ - adcs x4, x4, x15 __LF \ - csetm x7, lo __LF \ - adds x13, x13, x7 __LF \ - and x16, x7, #0xffffffff00000000 __LF \ - adcs x14, x14, x16 __LF \ - adcs x3, x3, x7 __LF \ - and x15, x7, #0xfffffffeffffffff __LF \ - adc x4, x4, x15 __LF \ - stp x13, x14, [P0] __LF \ - stp x3, x4, [P0+16] - -// Corresponds to bignum_montsqr_sm2 exactly - -#define montsqr_sm2(P0,P1) \ - ldp x2, x3, [P1] __LF \ - ldp x4, x5, [P1+16] __LF \ - umull x15, w2, w2 __LF \ - lsr x11, x2, #32 __LF \ - umull x16, w11, w11 __LF \ - umull x11, w2, w11 __LF \ - adds x15, x15, x11, lsl #33 __LF \ - lsr x11, x11, #31 __LF \ - adc x16, x16, x11 __LF \ - umull x17, w3, w3 __LF \ - lsr x11, x3, #32 __LF \ - umull x1, w11, w11 __LF \ - umull x11, w3, w11 __LF \ - mul x12, x2, x3 __LF \ - umulh x13, x2, x3 __LF \ - adds x17, x17, x11, lsl #33 __LF \ - lsr x11, x11, #31 __LF \ - adc x1, x1, x11 __LF \ - adds x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adc x1, x1, xzr __LF \ - adds x16, x16, x12 __LF \ - adcs x17, x17, x13 __LF \ - adc x1, x1, xzr __LF \ - lsl x12, x15, #32 __LF \ - lsr x11, x15, #32 __LF \ - subs x14, x12, x15 __LF \ - sbc x13, x11, xzr __LF \ - subs x16, x16, x14 __LF \ - sbcs x17, x17, x13 __LF \ - sbcs x1, x1, x12 __LF \ - sbc x15, x15, x11 __LF \ - lsl x12, x16, #32 __LF \ - lsr x11, x16, #32 __LF \ - subs x14, x12, x16 __LF \ - sbc x13, x11, xzr __LF \ - subs x17, x17, x14 __LF \ - sbcs x1, x1, x13 __LF \ - sbcs x15, x15, x12 __LF \ - sbc x16, x16, x11 __LF \ - mul x6, x2, x4 __LF \ - mul x14, x3, x5 __LF \ - umulh x8, x2, x4 __LF \ - subs x10, x2, x3 __LF \ - cneg x10, x10, lo __LF \ - csetm x13, lo __LF \ - subs x12, x5, x4 __LF \ - cneg x12, x12, lo __LF \ - mul x11, x10, x12 __LF \ - umulh x12, x10, x12 __LF \ - cinv x13, x13, lo __LF \ - eor x11, x11, x13 __LF \ - eor x12, x12, x13 __LF \ - adds x7, x6, x8 __LF \ - adc x8, x8, xzr __LF \ - umulh x9, x3, x5 __LF \ - adds x7, x7, x14 __LF \ - adcs x8, x8, x9 __LF \ - adc x9, x9, xzr __LF \ - adds x8, x8, x14 __LF \ - adc x9, x9, xzr __LF \ - cmn x13, #1 __LF \ - adcs x7, x7, x11 __LF \ - adcs x8, x8, x12 __LF \ - adc x9, x9, x13 __LF \ - adds x6, x6, x6 __LF \ - adcs x7, x7, x7 __LF \ - adcs x8, x8, x8 __LF \ - adcs x9, x9, x9 __LF \ - adc x10, xzr, xzr __LF \ - adds x6, x6, x17 __LF \ - adcs x7, x7, x1 __LF \ - adcs x8, x8, x15 __LF \ - adcs x9, x9, x16 __LF \ - adc x10, x10, xzr __LF \ - lsl x12, x6, #32 __LF \ - lsr x11, x6, #32 __LF \ - subs x14, x12, x6 __LF \ - sbc x13, x11, xzr __LF \ - subs x7, x7, x14 __LF \ - sbcs x8, x8, x13 __LF \ - sbcs x9, x9, x12 __LF \ - sbc x14, x6, x11 __LF \ - adds x10, x10, x14 __LF \ - adc x6, xzr, xzr __LF \ - lsl x12, x7, #32 __LF \ - lsr x11, x7, #32 __LF \ - subs x14, x12, x7 __LF \ - sbc x13, x11, xzr __LF \ - subs x8, x8, x14 __LF \ - sbcs x9, x9, x13 __LF \ - sbcs x10, x10, x12 __LF \ - sbc x14, x7, x11 __LF \ - adds x6, x6, x14 __LF \ - adc x7, xzr, xzr __LF \ - mul x11, x4, x4 __LF \ - adds x8, x8, x11 __LF \ - mul x12, x5, x5 __LF \ - umulh x11, x4, x4 __LF \ - adcs x9, x9, x11 __LF \ - adcs x10, x10, x12 __LF \ - umulh x12, x5, x5 __LF \ - adcs x6, x6, x12 __LF \ - adc x7, x7, xzr __LF \ - mul x11, x4, x5 __LF \ - umulh x12, x4, x5 __LF \ - adds x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adc x13, xzr, xzr __LF \ - adds x9, x9, x11 __LF \ - adcs x10, x10, x12 __LF \ - adcs x6, x6, x13 __LF \ - adcs x7, x7, xzr __LF \ - mov x11, #-4294967296 __LF \ - adds x5, x8, #1 __LF \ - sbcs x11, x9, x11 __LF \ - mov x13, #-4294967297 __LF \ - adcs x12, x10, xzr __LF \ - sbcs x13, x6, x13 __LF \ - sbcs xzr, x7, xzr __LF \ - csel x8, x5, x8, hs __LF \ - csel x9, x11, x9, hs __LF \ - csel x10, x12, x10, hs __LF \ - csel x6, x13, x6, hs __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x6, [P0+16] - -// Corresponds exactly to bignum_sub_sm2 - -#define sub_sm2(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - csetm x3, cc __LF \ - adds x5, x5, x3 __LF \ - and x4, x3, #0xffffffff00000000 __LF \ - adcs x6, x6, x4 __LF \ - adcs x7, x7, x3 __LF \ - and x4, x3, #0xfffffffeffffffff __LF \ - adc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Corresponds exactly to bignum_add_sm2 - -#define add_sm2(P0,P1,P2) \ - ldp x4, x5, [P1] __LF \ - ldp x8, x9, [P2] __LF \ - adds x4, x4, x8 __LF \ - adcs x5, x5, x9 __LF \ - ldp x6, x7, [P1+16] __LF \ - ldp x10, x11, [P2+16] __LF \ - adcs x6, x6, x10 __LF \ - adcs x7, x7, x11 __LF \ - adc x3, xzr, xzr __LF \ - adds x8, x4, #0x1 __LF \ - mov x9, #0xffffffff00000000 __LF \ - sbcs x9, x5, x9 __LF \ - adcs x10, x6, xzr __LF \ - mov x11, #0xfffffffeffffffff __LF \ - sbcs x11, x7, x11 __LF \ - sbcs x3, x3, xzr __LF \ - csel x4, x4, x8, cc __LF \ - csel x5, x5, x9, cc __LF \ - csel x6, x6, x10, cc __LF \ - csel x7, x7, x11, cc __LF \ - stp x4, x5, [P0] __LF \ - stp x6, x7, [P0+16] - -// A weak version of add that only guarantees sum in 4 digits - -#define weakadd_sm2(P0,P1,P2) \ - ldp x4, x5, [P1] __LF \ - ldp x8, x9, [P2] __LF \ - adds x4, x4, x8 __LF \ - adcs x5, x5, x9 __LF \ - ldp x6, x7, [P1+16] __LF \ - ldp x10, x11, [P2+16] __LF \ - adcs x6, x6, x10 __LF \ - adcs x7, x7, x11 __LF \ - csetm x2, cs __LF \ - subs x4, x4, x2 __LF \ - and x3, x2, #0xffffffff00000000 __LF \ - sbcs x5, x5, x3 __LF \ - and x1, x2, #0xfffffffeffffffff __LF \ - sbcs x6, x6, x2 __LF \ - sbc x7, x7, x1 __LF \ - stp x4, x5, [P0] __LF \ - stp x6, x7, [P0+16] - -// P0 = C * P1 - D * P2 computed as D * (p_sm2 - P2) + C * P1 -// Quotient estimation is done just as q = h + 1 as in bignum_triple_sm2 -// This also applies to the other functions following. - -#define cmsub_sm2(P0,C,P1,D,P2) \ - mov x1, D __LF \ - mov x2, #-1 __LF \ - ldp x9, x10, [P2] __LF \ - subs x9, x2, x9 __LF \ - mov x3, #0xffffffff00000000 __LF \ - sbcs x10, x3, x10 __LF \ - ldp x11, x12, [P2+16] __LF \ - sbcs x11, x2, x11 __LF \ - mov x4, #0xfffffffeffffffff __LF \ - sbc x12, x4, x12 __LF \ - mul x3, x1, x9 __LF \ - mul x4, x1, x10 __LF \ - mul x5, x1, x11 __LF \ - mul x6, x1, x12 __LF \ - umulh x9, x1, x9 __LF \ - umulh x10, x1, x10 __LF \ - umulh x11, x1, x11 __LF \ - umulh x7, x1, x12 __LF \ - adds x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - adcs x6, x6, x11 __LF \ - adc x7, x7, xzr __LF \ - mov x1, C __LF \ - ldp x9, x10, [P1] __LF \ - mul x8, x9, x1 __LF \ - umulh x9, x9, x1 __LF \ - adds x3, x3, x8 __LF \ - mul x8, x10, x1 __LF \ - umulh x10, x10, x1 __LF \ - adcs x4, x4, x8 __LF \ - ldp x11, x12, [P1+16] __LF \ - mul x8, x11, x1 __LF \ - umulh x11, x11, x1 __LF \ - adcs x5, x5, x8 __LF \ - mul x8, x12, x1 __LF \ - umulh x12, x12, x1 __LF \ - adcs x6, x6, x8 __LF \ - adc x7, x7, xzr __LF \ - adds x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - adcs x6, x6, x11 __LF \ - adc x7, x7, x12 __LF \ - add x7, x7, #0x1 __LF \ - lsl x8, x7, #32 __LF \ - sub x9, x8, x7 __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, xzr __LF \ - adcs x6, x6, x8 __LF \ - csetm x7, cc __LF \ - adds x3, x3, x7 __LF \ - and x9, x7, #0xffffffff00000000 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, x7 __LF \ - and x8, x7, #0xfffffffeffffffff __LF \ - adc x6, x6, x8 __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -// P0 = 4 * P1 - P2, by direct subtraction of P2; the method -// in bignum_cmul_sm2 etc. for quotient estimation still -// works when the value to be reduced is negative, as -// long as it is > -p_sm2, which is the case here. - -#define cmsub41_sm2(P0,P1,P2) \ - ldp x1, x2, [P1] __LF \ - lsl x0, x1, #2 __LF \ - ldp x6, x7, [P2] __LF \ - subs x0, x0, x6 __LF \ - extr x1, x2, x1, #62 __LF \ - sbcs x1, x1, x7 __LF \ - ldp x3, x4, [P1+16] __LF \ - extr x2, x3, x2, #62 __LF \ - ldp x6, x7, [P2+16] __LF \ - sbcs x2, x2, x6 __LF \ - extr x3, x4, x3, #62 __LF \ - sbcs x3, x3, x7 __LF \ - lsr x4, x4, #62 __LF \ - sbc x4, x4, xzr __LF \ - add x4, x4, #0x1 __LF \ - lsl x5, x4, #32 __LF \ - sub x6, x5, x4 __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x6 __LF \ - adcs x2, x2, xzr __LF \ - adcs x3, x3, x5 __LF \ - csetm x4, cc __LF \ - adds x0, x0, x4 __LF \ - and x6, x4, #0xffffffff00000000 __LF \ - adcs x1, x1, x6 __LF \ - adcs x2, x2, x4 __LF \ - and x5, x4, #0xfffffffeffffffff __LF \ - adc x3, x3, x5 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -// P0 = 3 * P1 - 8 * P2, computed as (p_sm2 - P2) << 3 + 3 * P1 - -#define cmsub38_sm2(P0,P1,P2) \ - mov x1, 8 __LF \ - mov x2, #-1 __LF \ - ldp x9, x10, [P2] __LF \ - subs x9, x2, x9 __LF \ - mov x3, #0xffffffff00000000 __LF \ - sbcs x10, x3, x10 __LF \ - ldp x11, x12, [P2+16] __LF \ - sbcs x11, x2, x11 __LF \ - mov x4, #0xfffffffeffffffff __LF \ - sbc x12, x4, x12 __LF \ - lsl x3, x9, #3 __LF \ - extr x4, x10, x9, #61 __LF \ - extr x5, x11, x10, #61 __LF \ - extr x6, x12, x11, #61 __LF \ - lsr x7, x12, #61 __LF \ - mov x1, 3 __LF \ - ldp x9, x10, [P1] __LF \ - mul x8, x9, x1 __LF \ - umulh x9, x9, x1 __LF \ - adds x3, x3, x8 __LF \ - mul x8, x10, x1 __LF \ - umulh x10, x10, x1 __LF \ - adcs x4, x4, x8 __LF \ - ldp x11, x12, [P1+16] __LF \ - mul x8, x11, x1 __LF \ - umulh x11, x11, x1 __LF \ - adcs x5, x5, x8 __LF \ - mul x8, x12, x1 __LF \ - umulh x12, x12, x1 __LF \ - adcs x6, x6, x8 __LF \ - adc x7, x7, xzr __LF \ - adds x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - adcs x6, x6, x11 __LF \ - adc x7, x7, x12 __LF \ - add x7, x7, #0x1 __LF \ - lsl x8, x7, #32 __LF \ - sub x9, x8, x7 __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, xzr __LF \ - adcs x6, x6, x8 __LF \ - csetm x7, cc __LF \ - adds x3, x3, x7 __LF \ - and x9, x7, #0xffffffff00000000 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, x7 __LF \ - and x8, x7, #0xfffffffeffffffff __LF \ - adc x6, x6, x8 __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -S2N_BN_SYMBOL(sm2_montjdouble): - CFI_START - -// Save registers and make room on stack for temporary variables - - CFI_DEC_SP(NSPACE+16) - CFI_STACKSAVE2(x19,x20,NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - -// Main code, just a sequence of basic field operations - -// z2 = z^2 -// y2 = y^2 - - montsqr_sm2(z2,z_1) - montsqr_sm2(y2,y_1) - -// x2p = x^2 - z^4 = (x + z^2) * (x - z^2) - - sub_sm2(t2,x_1,z2) - weakadd_sm2(t1,x_1,z2) - montmul_sm2(x2p,t1,t2) - -// t1 = y + z -// xy2 = x * y^2 -// x4p = x2p^2 - - add_sm2(t1,y_1,z_1) - montmul_sm2(xy2,x_1,y2) - montsqr_sm2(x4p,x2p) - -// t1 = (y + z)^2 - - montsqr_sm2(t1,t1) - -// d = 12 * xy2 - 9 * x4p -// t1 = y^2 + 2 * y * z - - cmsub_sm2(d_,12,xy2,9,x4p) - sub_sm2(t1,t1,z2) - -// y4 = y^4 - - montsqr_sm2(y4,y2) - -// dx2 = d * x2p - - montmul_sm2(dx2,d_,x2p) - -// z_3' = 2 * y * z - - sub_sm2(z_3,t1,y2) - -// x' = 4 * xy2 - d - - cmsub41_sm2(x_3,xy2,d_) - -// y' = 3 * dx2 - 8 * y4 - - cmsub38_sm2(y_3,dx2,y4) - -// Restore registers and stack and return - - CFI_STACKLOAD2(x19,x20,NSPACE) - CFI_INC_SP((NSPACE+16)) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjdouble_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjdouble_alt.S deleted file mode 100644 index dc50d210305..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjdouble_alt.S +++ /dev/null @@ -1,582 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on GM/T 0003-2012 curve SM2 in Montgomery-Jacobian coordinates -// -// extern void sm2_montjdouble_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_sm2. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard ARM ABI: X0 = p3, X1 = p1 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjdouble_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjdouble_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjdouble_alt) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x15 -#define input_x x16 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define z2 sp, #(NUMSIZE*0) -#define y4 sp, #(NUMSIZE*0) - -#define y2 sp, #(NUMSIZE*1) - -#define t1 sp, #(NUMSIZE*2) - -#define t2 sp, #(NUMSIZE*3) -#define x2p sp, #(NUMSIZE*3) -#define dx2 sp, #(NUMSIZE*3) - -#define xy2 sp, #(NUMSIZE*4) - -#define x4p sp, #(NUMSIZE*5) -#define d sp, #(NUMSIZE*5) - -#define NSPACE NUMSIZE*6 - -// Corresponds to bignum_montmul_sm2_alt except for registers - -#define montmul_sm2(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x0, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x1, x3, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x1, x1, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x1, x1, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x0, x0, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x1, x1, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x0, x0, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x1, x1, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x0, x0, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x1, x1, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - lsl x11, x12, #32 __LF \ - lsr x6, x12, #32 __LF \ - subs x8, x11, x12 __LF \ - sbc x7, x6, xzr __LF \ - subs x13, x13, x8 __LF \ - sbcs x14, x14, x7 __LF \ - sbcs x0, x0, x11 __LF \ - sbc x12, x12, x6 __LF \ - lsl x11, x13, #32 __LF \ - lsr x6, x13, #32 __LF \ - subs x8, x11, x13 __LF \ - sbc x7, x6, xzr __LF \ - subs x14, x14, x8 __LF \ - sbcs x0, x0, x7 __LF \ - sbcs x12, x12, x11 __LF \ - sbc x13, x13, x6 __LF \ - lsl x11, x14, #32 __LF \ - lsr x6, x14, #32 __LF \ - subs x8, x11, x14 __LF \ - sbc x7, x6, xzr __LF \ - subs x0, x0, x8 __LF \ - sbcs x12, x12, x7 __LF \ - sbcs x13, x13, x11 __LF \ - sbc x14, x14, x6 __LF \ - lsl x11, x0, #32 __LF \ - lsr x6, x0, #32 __LF \ - subs x8, x11, x0 __LF \ - sbc x7, x6, xzr __LF \ - subs x12, x12, x8 __LF \ - sbcs x13, x13, x7 __LF \ - sbcs x14, x14, x11 __LF \ - sbc x0, x0, x6 __LF \ - adds x12, x12, x1 __LF \ - adcs x13, x13, x3 __LF \ - adcs x14, x14, x4 __LF \ - adcs x0, x0, x5 __LF \ - cset x8, cs __LF \ - mov x11, #0xffffffff00000000 __LF \ - mov x6, #0xfffffffeffffffff __LF \ - adds x1, x12, #0x1 __LF \ - sbcs x3, x13, x11 __LF \ - adcs x4, x14, xzr __LF \ - sbcs x5, x0, x6 __LF \ - sbcs xzr, x8, xzr __LF \ - csel x12, x12, x1, cc __LF \ - csel x13, x13, x3, cc __LF \ - csel x14, x14, x4, cc __LF \ - csel x0, x0, x5, cc __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x0, [P0+16] - -// Corresponds to bignum_montsqr_sm2_alt exactly - -#define montsqr_sm2(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x6, x2, x4 __LF \ - umulh x7, x2, x4 __LF \ - adds x10, x10, x6 __LF \ - adcs x11, x11, x7 __LF \ - mul x6, x3, x4 __LF \ - umulh x7, x3, x4 __LF \ - adc x7, x7, xzr __LF \ - adds x11, x11, x6 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x7 __LF \ - mul x6, x3, x5 __LF \ - umulh x7, x3, x5 __LF \ - adc x7, x7, xzr __LF \ - adds x12, x12, x6 __LF \ - adcs x13, x13, x7 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x7, cs __LF \ - umulh x6, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x6 __LF \ - mul x6, x3, x3 __LF \ - adcs x10, x10, x6 __LF \ - umulh x6, x3, x3 __LF \ - adcs x11, x11, x6 __LF \ - mul x6, x4, x4 __LF \ - adcs x12, x12, x6 __LF \ - umulh x6, x4, x4 __LF \ - adcs x13, x13, x6 __LF \ - mul x6, x5, x5 __LF \ - adcs x14, x14, x6 __LF \ - umulh x6, x5, x5 __LF \ - adc x7, x7, x6 __LF \ - lsl x4, x8, #32 __LF \ - lsr x5, x8, #32 __LF \ - subs x2, x4, x8 __LF \ - sbc x3, x5, xzr __LF \ - subs x9, x9, x2 __LF \ - sbcs x10, x10, x3 __LF \ - sbcs x11, x11, x4 __LF \ - sbc x8, x8, x5 __LF \ - lsl x4, x9, #32 __LF \ - lsr x5, x9, #32 __LF \ - subs x2, x4, x9 __LF \ - sbc x3, x5, xzr __LF \ - subs x10, x10, x2 __LF \ - sbcs x11, x11, x3 __LF \ - sbcs x8, x8, x4 __LF \ - sbc x9, x9, x5 __LF \ - lsl x4, x10, #32 __LF \ - lsr x5, x10, #32 __LF \ - subs x2, x4, x10 __LF \ - sbc x3, x5, xzr __LF \ - subs x11, x11, x2 __LF \ - sbcs x8, x8, x3 __LF \ - sbcs x9, x9, x4 __LF \ - sbc x10, x10, x5 __LF \ - lsl x4, x11, #32 __LF \ - lsr x5, x11, #32 __LF \ - subs x2, x4, x11 __LF \ - sbc x3, x5, xzr __LF \ - subs x8, x8, x2 __LF \ - sbcs x9, x9, x3 __LF \ - sbcs x10, x10, x4 __LF \ - sbc x11, x11, x5 __LF \ - adds x8, x8, x12 __LF \ - adcs x9, x9, x13 __LF \ - adcs x10, x10, x14 __LF \ - adcs x11, x11, x7 __LF \ - cset x2, cs __LF \ - mov x3, #0xffffffff00000000 __LF \ - mov x5, #0xfffffffeffffffff __LF \ - adds x12, x8, #0x1 __LF \ - sbcs x13, x9, x3 __LF \ - adcs x14, x10, xzr __LF \ - sbcs x7, x11, x5 __LF \ - sbcs xzr, x2, xzr __LF \ - csel x8, x8, x12, cc __LF \ - csel x9, x9, x13, cc __LF \ - csel x10, x10, x14, cc __LF \ - csel x11, x11, x7, cc __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Corresponds exactly to bignum_sub_sm2 - -#define sub_sm2(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - csetm x3, cc __LF \ - adds x5, x5, x3 __LF \ - and x4, x3, #0xffffffff00000000 __LF \ - adcs x6, x6, x4 __LF \ - adcs x7, x7, x3 __LF \ - and x4, x3, #0xfffffffeffffffff __LF \ - adc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -// Corresponds exactly to bignum_add_sm2 - -#define add_sm2(P0,P1,P2) \ - ldp x4, x5, [P1] __LF \ - ldp x8, x9, [P2] __LF \ - adds x4, x4, x8 __LF \ - adcs x5, x5, x9 __LF \ - ldp x6, x7, [P1+16] __LF \ - ldp x10, x11, [P2+16] __LF \ - adcs x6, x6, x10 __LF \ - adcs x7, x7, x11 __LF \ - adc x3, xzr, xzr __LF \ - adds x8, x4, #0x1 __LF \ - mov x9, #0xffffffff00000000 __LF \ - sbcs x9, x5, x9 __LF \ - adcs x10, x6, xzr __LF \ - mov x11, #0xfffffffeffffffff __LF \ - sbcs x11, x7, x11 __LF \ - sbcs x3, x3, xzr __LF \ - csel x4, x4, x8, cc __LF \ - csel x5, x5, x9, cc __LF \ - csel x6, x6, x10, cc __LF \ - csel x7, x7, x11, cc __LF \ - stp x4, x5, [P0] __LF \ - stp x6, x7, [P0+16] - -// A weak version of add that only guarantees sum in 4 digits - -#define weakadd_sm2(P0,P1,P2) \ - ldp x4, x5, [P1] __LF \ - ldp x8, x9, [P2] __LF \ - adds x4, x4, x8 __LF \ - adcs x5, x5, x9 __LF \ - ldp x6, x7, [P1+16] __LF \ - ldp x10, x11, [P2+16] __LF \ - adcs x6, x6, x10 __LF \ - adcs x7, x7, x11 __LF \ - csetm x2, cs __LF \ - subs x4, x4, x2 __LF \ - and x3, x2, #0xffffffff00000000 __LF \ - sbcs x5, x5, x3 __LF \ - and x1, x2, #0xfffffffeffffffff __LF \ - sbcs x6, x6, x2 __LF \ - sbc x7, x7, x1 __LF \ - stp x4, x5, [P0] __LF \ - stp x6, x7, [P0+16] - -// P0 = C * P1 - D * P2 computed as D * (p_sm2 - P2) + C * P1 -// Quotient estimation is done just as q = h + 1 as in bignum_triple_sm2 -// This also applies to the other functions following. - -#define cmsub_sm2(P0,C,P1,D,P2) \ - mov x1, D __LF \ - mov x2, #-1 __LF \ - ldp x9, x10, [P2] __LF \ - subs x9, x2, x9 __LF \ - mov x3, #0xffffffff00000000 __LF \ - sbcs x10, x3, x10 __LF \ - ldp x11, x12, [P2+16] __LF \ - sbcs x11, x2, x11 __LF \ - mov x4, #0xfffffffeffffffff __LF \ - sbc x12, x4, x12 __LF \ - mul x3, x1, x9 __LF \ - mul x4, x1, x10 __LF \ - mul x5, x1, x11 __LF \ - mul x6, x1, x12 __LF \ - umulh x9, x1, x9 __LF \ - umulh x10, x1, x10 __LF \ - umulh x11, x1, x11 __LF \ - umulh x7, x1, x12 __LF \ - adds x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - adcs x6, x6, x11 __LF \ - adc x7, x7, xzr __LF \ - mov x1, C __LF \ - ldp x9, x10, [P1] __LF \ - mul x8, x9, x1 __LF \ - umulh x9, x9, x1 __LF \ - adds x3, x3, x8 __LF \ - mul x8, x10, x1 __LF \ - umulh x10, x10, x1 __LF \ - adcs x4, x4, x8 __LF \ - ldp x11, x12, [P1+16] __LF \ - mul x8, x11, x1 __LF \ - umulh x11, x11, x1 __LF \ - adcs x5, x5, x8 __LF \ - mul x8, x12, x1 __LF \ - umulh x12, x12, x1 __LF \ - adcs x6, x6, x8 __LF \ - adc x7, x7, xzr __LF \ - adds x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - adcs x6, x6, x11 __LF \ - adc x7, x7, x12 __LF \ - add x7, x7, #0x1 __LF \ - lsl x8, x7, #32 __LF \ - sub x9, x8, x7 __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, xzr __LF \ - adcs x6, x6, x8 __LF \ - csetm x7, cc __LF \ - adds x3, x3, x7 __LF \ - and x9, x7, #0xffffffff00000000 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, x7 __LF \ - and x8, x7, #0xfffffffeffffffff __LF \ - adc x6, x6, x8 __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -// P0 = 4 * P1 - P2, by direct subtraction of P2; the method -// in bignum_cmul_sm2 etc. for quotient estimation still -// works when the value to be reduced is negative, as -// long as it is > -p_sm2, which is the case here. - -#define cmsub41_sm2(P0,P1,P2) \ - ldp x1, x2, [P1] __LF \ - lsl x0, x1, #2 __LF \ - ldp x6, x7, [P2] __LF \ - subs x0, x0, x6 __LF \ - extr x1, x2, x1, #62 __LF \ - sbcs x1, x1, x7 __LF \ - ldp x3, x4, [P1+16] __LF \ - extr x2, x3, x2, #62 __LF \ - ldp x6, x7, [P2+16] __LF \ - sbcs x2, x2, x6 __LF \ - extr x3, x4, x3, #62 __LF \ - sbcs x3, x3, x7 __LF \ - lsr x4, x4, #62 __LF \ - sbc x4, x4, xzr __LF \ - add x4, x4, #0x1 __LF \ - lsl x5, x4, #32 __LF \ - sub x6, x5, x4 __LF \ - adds x0, x0, x4 __LF \ - adcs x1, x1, x6 __LF \ - adcs x2, x2, xzr __LF \ - adcs x3, x3, x5 __LF \ - csetm x4, cc __LF \ - adds x0, x0, x4 __LF \ - and x6, x4, #0xffffffff00000000 __LF \ - adcs x1, x1, x6 __LF \ - adcs x2, x2, x4 __LF \ - and x5, x4, #0xfffffffeffffffff __LF \ - adc x3, x3, x5 __LF \ - stp x0, x1, [P0] __LF \ - stp x2, x3, [P0+16] - -// P0 = 3 * P1 - 8 * P2, computed as (p_sm2 - P2) << 3 + 3 * P1 - -#define cmsub38_sm2(P0,P1,P2) \ - mov x1, 8 __LF \ - mov x2, #-1 __LF \ - ldp x9, x10, [P2] __LF \ - subs x9, x2, x9 __LF \ - mov x3, #0xffffffff00000000 __LF \ - sbcs x10, x3, x10 __LF \ - ldp x11, x12, [P2+16] __LF \ - sbcs x11, x2, x11 __LF \ - mov x4, #0xfffffffeffffffff __LF \ - sbc x12, x4, x12 __LF \ - lsl x3, x9, #3 __LF \ - extr x4, x10, x9, #61 __LF \ - extr x5, x11, x10, #61 __LF \ - extr x6, x12, x11, #61 __LF \ - lsr x7, x12, #61 __LF \ - mov x1, 3 __LF \ - ldp x9, x10, [P1] __LF \ - mul x8, x9, x1 __LF \ - umulh x9, x9, x1 __LF \ - adds x3, x3, x8 __LF \ - mul x8, x10, x1 __LF \ - umulh x10, x10, x1 __LF \ - adcs x4, x4, x8 __LF \ - ldp x11, x12, [P1+16] __LF \ - mul x8, x11, x1 __LF \ - umulh x11, x11, x1 __LF \ - adcs x5, x5, x8 __LF \ - mul x8, x12, x1 __LF \ - umulh x12, x12, x1 __LF \ - adcs x6, x6, x8 __LF \ - adc x7, x7, xzr __LF \ - adds x4, x4, x9 __LF \ - adcs x5, x5, x10 __LF \ - adcs x6, x6, x11 __LF \ - adc x7, x7, x12 __LF \ - add x7, x7, #0x1 __LF \ - lsl x8, x7, #32 __LF \ - sub x9, x8, x7 __LF \ - adds x3, x3, x7 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, xzr __LF \ - adcs x6, x6, x8 __LF \ - csetm x7, cc __LF \ - adds x3, x3, x7 __LF \ - and x9, x7, #0xffffffff00000000 __LF \ - adcs x4, x4, x9 __LF \ - adcs x5, x5, x7 __LF \ - and x8, x7, #0xfffffffeffffffff __LF \ - adc x6, x6, x8 __LF \ - stp x3, x4, [P0] __LF \ - stp x5, x6, [P0+16] - -S2N_BN_SYMBOL(sm2_montjdouble_alt): - CFI_START - -// Make room on stack for temporary variables - - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - -// Main code, just a sequence of basic field operations - -// z2 = z^2 -// y2 = y^2 - - montsqr_sm2(z2,z_1) - montsqr_sm2(y2,y_1) - -// x2p = x^2 - z^4 = (x + z^2) * (x - z^2) - - sub_sm2(t2,x_1,z2) - weakadd_sm2(t1,x_1,z2) - montmul_sm2(x2p,t1,t2) - -// t1 = y + z -// xy2 = x * y^2 -// x4p = x2p^2 - - add_sm2(t1,y_1,z_1) - montmul_sm2(xy2,x_1,y2) - montsqr_sm2(x4p,x2p) - -// t1 = (y + z)^2 - - montsqr_sm2(t1,t1) - -// d = 12 * xy2 - 9 * x4p -// t1 = y^2 + 2 * y * z - - cmsub_sm2(d,12,xy2,9,x4p) - sub_sm2(t1,t1,z2) - -// y4 = y^4 - - montsqr_sm2(y4,y2) - -// dx2 = d * x2p - - montmul_sm2(dx2,d,x2p) - -// z_3' = 2 * y * z - - sub_sm2(z_3,t1,y2) - -// x' = 4 * xy2 - d - - cmsub41_sm2(x_3,xy2,d) - -// y' = 3 * dx2 - 8 * y4 - - cmsub38_sm2(y_3,dx2,y4) - -// Restore stack and return - - CFI_INC_SP(NSPACE) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjdouble_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjmixadd.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjmixadd.S deleted file mode 100644 index 1452798f01e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjmixadd.S +++ /dev/null @@ -1,507 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on GM/T 0003-2012 curve SM2 in Montgomery-Jacobian coordinates -// -// extern void sm2_montjmixadd(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 8]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_sm2. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjmixadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjmixadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjmixadd) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x17 -#define input_x x19 -#define input_y x20 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define zp2 sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define NSPACE NUMSIZE*6 - -// Corresponds to bignum_montmul_sm2 with x0 in place of x17 - -#define montmul_sm2(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x5, x6, [P1+16] __LF \ - ldp x7, x8, [P2] __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x7 __LF \ - mul x13, x4, x8 __LF \ - umulh x12, x3, x7 __LF \ - adds x16, x11, x13 __LF \ - umulh x14, x4, x8 __LF \ - adcs x0, x12, x14 __LF \ - adcs x14, x14, xzr __LF \ - adds x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adcs x14, x14, xzr __LF \ - subs x15, x3, x4 __LF \ - cneg x15, x15, lo __LF \ - csetm x1, lo __LF \ - subs x0, x8, x7 __LF \ - cneg x0, x0, lo __LF \ - mul x16, x15, x0 __LF \ - umulh x0, x15, x0 __LF \ - cinv x1, x1, lo __LF \ - eor x16, x16, x1 __LF \ - eor x0, x0, x1 __LF \ - cmn x1, #1 __LF \ - adcs x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adc x14, x14, x1 __LF \ - lsl x16, x11, #32 __LF \ - lsr x15, x11, #32 __LF \ - subs x1, x16, x11 __LF \ - sbc x0, x15, xzr __LF \ - subs x12, x12, x1 __LF \ - sbcs x13, x13, x0 __LF \ - sbcs x14, x14, x16 __LF \ - sbc x11, x11, x15 __LF \ - lsl x16, x12, #32 __LF \ - lsr x15, x12, #32 __LF \ - subs x1, x16, x12 __LF \ - sbc x0, x15, xzr __LF \ - subs x13, x13, x1 __LF \ - sbcs x14, x14, x0 __LF \ - sbcs x11, x11, x16 __LF \ - sbc x12, x12, x15 __LF \ - stp x13, x14, [P0] __LF \ - stp x11, x12, [P0+16] __LF \ - mul x11, x5, x9 __LF \ - mul x13, x6, x10 __LF \ - umulh x12, x5, x9 __LF \ - adds x16, x11, x13 __LF \ - umulh x14, x6, x10 __LF \ - adcs x0, x12, x14 __LF \ - adcs x14, x14, xzr __LF \ - adds x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adcs x14, x14, xzr __LF \ - subs x15, x5, x6 __LF \ - cneg x15, x15, lo __LF \ - csetm x1, lo __LF \ - subs x0, x10, x9 __LF \ - cneg x0, x0, lo __LF \ - mul x16, x15, x0 __LF \ - umulh x0, x15, x0 __LF \ - cinv x1, x1, lo __LF \ - eor x16, x16, x1 __LF \ - eor x0, x0, x1 __LF \ - cmn x1, #1 __LF \ - adcs x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adc x14, x14, x1 __LF \ - subs x3, x5, x3 __LF \ - sbcs x4, x6, x4 __LF \ - ngc x5, xzr __LF \ - cmn x5, #1 __LF \ - eor x3, x3, x5 __LF \ - adcs x3, x3, xzr __LF \ - eor x4, x4, x5 __LF \ - adcs x4, x4, xzr __LF \ - subs x7, x7, x9 __LF \ - sbcs x8, x8, x10 __LF \ - ngc x9, xzr __LF \ - cmn x9, #1 __LF \ - eor x7, x7, x9 __LF \ - adcs x7, x7, xzr __LF \ - eor x8, x8, x9 __LF \ - adcs x8, x8, xzr __LF \ - eor x10, x5, x9 __LF \ - ldp x15, x1, [P0] __LF \ - adds x15, x11, x15 __LF \ - adcs x1, x12, x1 __LF \ - ldp x5, x9, [P0+16] __LF \ - adcs x5, x13, x5 __LF \ - adcs x9, x14, x9 __LF \ - adc x2, xzr, xzr __LF \ - mul x11, x3, x7 __LF \ - mul x13, x4, x8 __LF \ - umulh x12, x3, x7 __LF \ - adds x16, x11, x13 __LF \ - umulh x14, x4, x8 __LF \ - adcs x0, x12, x14 __LF \ - adcs x14, x14, xzr __LF \ - adds x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adcs x14, x14, xzr __LF \ - subs x3, x3, x4 __LF \ - cneg x3, x3, lo __LF \ - csetm x4, lo __LF \ - subs x0, x8, x7 __LF \ - cneg x0, x0, lo __LF \ - mul x16, x3, x0 __LF \ - umulh x0, x3, x0 __LF \ - cinv x4, x4, lo __LF \ - eor x16, x16, x4 __LF \ - eor x0, x0, x4 __LF \ - cmn x4, #1 __LF \ - adcs x12, x12, x16 __LF \ - adcs x13, x13, x0 __LF \ - adc x14, x14, x4 __LF \ - cmn x10, #1 __LF \ - eor x11, x11, x10 __LF \ - adcs x11, x11, x15 __LF \ - eor x12, x12, x10 __LF \ - adcs x12, x12, x1 __LF \ - eor x13, x13, x10 __LF \ - adcs x13, x13, x5 __LF \ - eor x14, x14, x10 __LF \ - adcs x14, x14, x9 __LF \ - adcs x3, x2, x10 __LF \ - adcs x4, x10, xzr __LF \ - adc x10, x10, xzr __LF \ - adds x13, x13, x15 __LF \ - adcs x14, x14, x1 __LF \ - adcs x3, x3, x5 __LF \ - adcs x4, x4, x9 __LF \ - adc x10, x10, x2 __LF \ - lsl x16, x11, #32 __LF \ - lsr x15, x11, #32 __LF \ - subs x1, x16, x11 __LF \ - sbc x0, x15, xzr __LF \ - subs x12, x12, x1 __LF \ - sbcs x13, x13, x0 __LF \ - sbcs x14, x14, x16 __LF \ - sbc x11, x11, x15 __LF \ - lsl x16, x12, #32 __LF \ - lsr x15, x12, #32 __LF \ - subs x1, x16, x12 __LF \ - sbc x0, x15, xzr __LF \ - subs x13, x13, x1 __LF \ - sbcs x14, x14, x0 __LF \ - sbcs x11, x11, x16 __LF \ - sbc x12, x12, x15 __LF \ - adds x3, x3, x11 __LF \ - adcs x4, x4, x12 __LF \ - adc x10, x10, xzr __LF \ - add x2, x10, #1 __LF \ - lsl x15, x2, #32 __LF \ - sub x16, x15, x2 __LF \ - adds x13, x13, x2 __LF \ - adcs x14, x14, x16 __LF \ - adcs x3, x3, xzr __LF \ - adcs x4, x4, x15 __LF \ - csetm x7, lo __LF \ - adds x13, x13, x7 __LF \ - and x16, x7, #0xffffffff00000000 __LF \ - adcs x14, x14, x16 __LF \ - adcs x3, x3, x7 __LF \ - and x15, x7, #0xfffffffeffffffff __LF \ - adc x4, x4, x15 __LF \ - stp x13, x14, [P0] __LF \ - stp x3, x4, [P0+16] - -// Corresponds to bignum_montsqr_sm2 with x0 in place of x17 - -#define montsqr_sm2(P0,P1) \ - ldp x2, x3, [P1] __LF \ - ldp x4, x5, [P1+16] __LF \ - umull x15, w2, w2 __LF \ - lsr x11, x2, #32 __LF \ - umull x16, w11, w11 __LF \ - umull x11, w2, w11 __LF \ - adds x15, x15, x11, lsl #33 __LF \ - lsr x11, x11, #31 __LF \ - adc x16, x16, x11 __LF \ - umull x0, w3, w3 __LF \ - lsr x11, x3, #32 __LF \ - umull x1, w11, w11 __LF \ - umull x11, w3, w11 __LF \ - mul x12, x2, x3 __LF \ - umulh x13, x2, x3 __LF \ - adds x0, x0, x11, lsl #33 __LF \ - lsr x11, x11, #31 __LF \ - adc x1, x1, x11 __LF \ - adds x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adc x1, x1, xzr __LF \ - adds x16, x16, x12 __LF \ - adcs x0, x0, x13 __LF \ - adc x1, x1, xzr __LF \ - lsl x12, x15, #32 __LF \ - lsr x11, x15, #32 __LF \ - subs x14, x12, x15 __LF \ - sbc x13, x11, xzr __LF \ - subs x16, x16, x14 __LF \ - sbcs x0, x0, x13 __LF \ - sbcs x1, x1, x12 __LF \ - sbc x15, x15, x11 __LF \ - lsl x12, x16, #32 __LF \ - lsr x11, x16, #32 __LF \ - subs x14, x12, x16 __LF \ - sbc x13, x11, xzr __LF \ - subs x0, x0, x14 __LF \ - sbcs x1, x1, x13 __LF \ - sbcs x15, x15, x12 __LF \ - sbc x16, x16, x11 __LF \ - mul x6, x2, x4 __LF \ - mul x14, x3, x5 __LF \ - umulh x8, x2, x4 __LF \ - subs x10, x2, x3 __LF \ - cneg x10, x10, lo __LF \ - csetm x13, lo __LF \ - subs x12, x5, x4 __LF \ - cneg x12, x12, lo __LF \ - mul x11, x10, x12 __LF \ - umulh x12, x10, x12 __LF \ - cinv x13, x13, lo __LF \ - eor x11, x11, x13 __LF \ - eor x12, x12, x13 __LF \ - adds x7, x6, x8 __LF \ - adc x8, x8, xzr __LF \ - umulh x9, x3, x5 __LF \ - adds x7, x7, x14 __LF \ - adcs x8, x8, x9 __LF \ - adc x9, x9, xzr __LF \ - adds x8, x8, x14 __LF \ - adc x9, x9, xzr __LF \ - cmn x13, #1 __LF \ - adcs x7, x7, x11 __LF \ - adcs x8, x8, x12 __LF \ - adc x9, x9, x13 __LF \ - adds x6, x6, x6 __LF \ - adcs x7, x7, x7 __LF \ - adcs x8, x8, x8 __LF \ - adcs x9, x9, x9 __LF \ - adc x10, xzr, xzr __LF \ - adds x6, x6, x0 __LF \ - adcs x7, x7, x1 __LF \ - adcs x8, x8, x15 __LF \ - adcs x9, x9, x16 __LF \ - adc x10, x10, xzr __LF \ - lsl x12, x6, #32 __LF \ - lsr x11, x6, #32 __LF \ - subs x14, x12, x6 __LF \ - sbc x13, x11, xzr __LF \ - subs x7, x7, x14 __LF \ - sbcs x8, x8, x13 __LF \ - sbcs x9, x9, x12 __LF \ - sbc x14, x6, x11 __LF \ - adds x10, x10, x14 __LF \ - adc x6, xzr, xzr __LF \ - lsl x12, x7, #32 __LF \ - lsr x11, x7, #32 __LF \ - subs x14, x12, x7 __LF \ - sbc x13, x11, xzr __LF \ - subs x8, x8, x14 __LF \ - sbcs x9, x9, x13 __LF \ - sbcs x10, x10, x12 __LF \ - sbc x14, x7, x11 __LF \ - adds x6, x6, x14 __LF \ - adc x7, xzr, xzr __LF \ - mul x11, x4, x4 __LF \ - adds x8, x8, x11 __LF \ - mul x12, x5, x5 __LF \ - umulh x11, x4, x4 __LF \ - adcs x9, x9, x11 __LF \ - adcs x10, x10, x12 __LF \ - umulh x12, x5, x5 __LF \ - adcs x6, x6, x12 __LF \ - adc x7, x7, xzr __LF \ - mul x11, x4, x5 __LF \ - umulh x12, x4, x5 __LF \ - adds x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adc x13, xzr, xzr __LF \ - adds x9, x9, x11 __LF \ - adcs x10, x10, x12 __LF \ - adcs x6, x6, x13 __LF \ - adcs x7, x7, xzr __LF \ - mov x11, #-4294967296 __LF \ - adds x5, x8, #1 __LF \ - sbcs x11, x9, x11 __LF \ - mov x13, #-4294967297 __LF \ - adcs x12, x10, xzr __LF \ - sbcs x13, x6, x13 __LF \ - sbcs xzr, x7, xzr __LF \ - csel x8, x5, x8, hs __LF \ - csel x9, x11, x9, hs __LF \ - csel x10, x12, x10, hs __LF \ - csel x6, x13, x6, hs __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x6, [P0+16] - -// Corresponds exactly to bignum_sub_sm2 - -#define sub_sm2(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - csetm x3, cc __LF \ - adds x5, x5, x3 __LF \ - and x4, x3, #0xffffffff00000000 __LF \ - adcs x6, x6, x4 __LF \ - adcs x7, x7, x3 __LF \ - and x4, x3, #0xfffffffeffffffff __LF \ - adc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -S2N_BN_SYMBOL(sm2_montjmixadd): - CFI_START - -// Save regs and make room on stack for temporary variables - - CFI_PUSH2(x19,x20) - CFI_DEC_SP(NSPACE) - -// Move the input arguments to stable places - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - montsqr_sm2(zp2,z_1) - montmul_sm2(y2a,z_1,y_2) - - montmul_sm2(x2a,zp2,x_2) - montmul_sm2(y2a,zp2,y2a) - - sub_sm2(xd,x2a,x_1) - sub_sm2(yd,y2a,y_1) - - montsqr_sm2(zz,xd) - montsqr_sm2(ww,yd) - - montmul_sm2(zzx1,zz,x_1) - montmul_sm2(zzx2,zz,x2a) - - sub_sm2(resx,ww,zzx1) - sub_sm2(t1,zzx2,zzx1) - - montmul_sm2(resz,xd,z_1) - - sub_sm2(resx,resx,zzx2) - - sub_sm2(t2,zzx1,resx) - - montmul_sm2(t1,t1,y_1) - montmul_sm2(t2,yd,t2) - - sub_sm2(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - orr x4, x0, x1 - orr x5, x2, x3 - orr x4, x4, x5 - cmp x4, xzr - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with a z = 1 coordinate (in -// Montgomery form so not the simple constant 1 but rather 2^256 - p_sm2), -// hence giving 0 + p2 = p2 for the final result. - - ldp x0, x1, [resx] - ldp x12, x13, [x_2] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x2, x3, [resx+16] - ldp x12, x13, [x_2+16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - - ldp x4, x5, [resy] - ldp x12, x13, [y_2] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x6, x7, [resy+16] - ldp x12, x13, [y_2+16] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - - ldp x8, x9, [resz] - mov x12, #0x0000000000000001 - mov x13, #0x00000000ffffffff - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x10, x11, [resz+16] - mov x13, #0x0000000100000000 - csel x10, x10, xzr, ne - csel x11, x11, x13, ne - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [y_3] - stp x6, x7, [y_3+16] - stp x8, x9, [z_3] - stp x10, x11, [z_3+16] - -// Restore registers and return - - CFI_INC_SP(NSPACE) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjmixadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjmixadd_alt.S deleted file mode 100644 index c07e5a54fea..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjmixadd_alt.S +++ /dev/null @@ -1,515 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on GM/T 0003-2012 curve SM2 in Montgomery-Jacobian coordinates -// -// extern void sm2_montjmixadd_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 8]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_sm2. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. -// -// Standard ARM ABI: X0 = p3, X1 = p1, X2 = p2 -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjmixadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjmixadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjmixadd_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence - -#define input_z x15 -#define input_x x16 -#define input_y x17 - -// Pointer-offset pairs for inputs and outputs - -#define x_1 input_x, #0 -#define y_1 input_x, #NUMSIZE -#define z_1 input_x, #(2*NUMSIZE) - -#define x_2 input_y, #0 -#define y_2 input_y, #NUMSIZE - -#define x_3 input_z, #0 -#define y_3 input_z, #NUMSIZE -#define z_3 input_z, #(2*NUMSIZE) - -// Pointer-offset pairs for temporaries, with some aliasing -// #NSPACE is the total stack needed for these temporaries - -#define zp2 sp, #(NUMSIZE*0) -#define ww sp, #(NUMSIZE*0) -#define resx sp, #(NUMSIZE*0) - -#define yd sp, #(NUMSIZE*1) -#define y2a sp, #(NUMSIZE*1) - -#define x2a sp, #(NUMSIZE*2) -#define zzx2 sp, #(NUMSIZE*2) - -#define zz sp, #(NUMSIZE*3) -#define t1 sp, #(NUMSIZE*3) - -#define t2 sp, #(NUMSIZE*4) -#define zzx1 sp, #(NUMSIZE*4) -#define resy sp, #(NUMSIZE*4) - -#define xd sp, #(NUMSIZE*5) -#define resz sp, #(NUMSIZE*5) - -#define NSPACE NUMSIZE*6 - -// Corresponds to bignum_montmul_sm2_alt except for registers - -#define montmul_sm2(P0,P1,P2) \ - ldp x3, x4, [P1] __LF \ - ldp x7, x8, [P2] __LF \ - mul x12, x3, x7 __LF \ - umulh x13, x3, x7 __LF \ - mul x11, x3, x8 __LF \ - umulh x14, x3, x8 __LF \ - adds x13, x13, x11 __LF \ - ldp x9, x10, [P2+16] __LF \ - mul x11, x3, x9 __LF \ - umulh x0, x3, x9 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x3, x10 __LF \ - umulh x1, x3, x10 __LF \ - adcs x0, x0, x11 __LF \ - adc x1, x1, xzr __LF \ - ldp x5, x6, [P1+16] __LF \ - mul x11, x4, x7 __LF \ - adds x13, x13, x11 __LF \ - mul x11, x4, x8 __LF \ - adcs x14, x14, x11 __LF \ - mul x11, x4, x9 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x4, x10 __LF \ - adcs x1, x1, x11 __LF \ - umulh x3, x4, x10 __LF \ - adc x3, x3, xzr __LF \ - umulh x11, x4, x7 __LF \ - adds x14, x14, x11 __LF \ - umulh x11, x4, x8 __LF \ - adcs x0, x0, x11 __LF \ - umulh x11, x4, x9 __LF \ - adcs x1, x1, x11 __LF \ - adc x3, x3, xzr __LF \ - mul x11, x5, x7 __LF \ - adds x14, x14, x11 __LF \ - mul x11, x5, x8 __LF \ - adcs x0, x0, x11 __LF \ - mul x11, x5, x9 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x5, x10 __LF \ - adcs x3, x3, x11 __LF \ - umulh x4, x5, x10 __LF \ - adc x4, x4, xzr __LF \ - umulh x11, x5, x7 __LF \ - adds x0, x0, x11 __LF \ - umulh x11, x5, x8 __LF \ - adcs x1, x1, x11 __LF \ - umulh x11, x5, x9 __LF \ - adcs x3, x3, x11 __LF \ - adc x4, x4, xzr __LF \ - mul x11, x6, x7 __LF \ - adds x0, x0, x11 __LF \ - mul x11, x6, x8 __LF \ - adcs x1, x1, x11 __LF \ - mul x11, x6, x9 __LF \ - adcs x3, x3, x11 __LF \ - mul x11, x6, x10 __LF \ - adcs x4, x4, x11 __LF \ - umulh x5, x6, x10 __LF \ - adc x5, x5, xzr __LF \ - umulh x11, x6, x7 __LF \ - adds x1, x1, x11 __LF \ - umulh x11, x6, x8 __LF \ - adcs x3, x3, x11 __LF \ - umulh x11, x6, x9 __LF \ - adcs x4, x4, x11 __LF \ - adc x5, x5, xzr __LF \ - lsl x11, x12, #32 __LF \ - lsr x6, x12, #32 __LF \ - subs x8, x11, x12 __LF \ - sbc x7, x6, xzr __LF \ - subs x13, x13, x8 __LF \ - sbcs x14, x14, x7 __LF \ - sbcs x0, x0, x11 __LF \ - sbc x12, x12, x6 __LF \ - lsl x11, x13, #32 __LF \ - lsr x6, x13, #32 __LF \ - subs x8, x11, x13 __LF \ - sbc x7, x6, xzr __LF \ - subs x14, x14, x8 __LF \ - sbcs x0, x0, x7 __LF \ - sbcs x12, x12, x11 __LF \ - sbc x13, x13, x6 __LF \ - lsl x11, x14, #32 __LF \ - lsr x6, x14, #32 __LF \ - subs x8, x11, x14 __LF \ - sbc x7, x6, xzr __LF \ - subs x0, x0, x8 __LF \ - sbcs x12, x12, x7 __LF \ - sbcs x13, x13, x11 __LF \ - sbc x14, x14, x6 __LF \ - lsl x11, x0, #32 __LF \ - lsr x6, x0, #32 __LF \ - subs x8, x11, x0 __LF \ - sbc x7, x6, xzr __LF \ - subs x12, x12, x8 __LF \ - sbcs x13, x13, x7 __LF \ - sbcs x14, x14, x11 __LF \ - sbc x0, x0, x6 __LF \ - adds x12, x12, x1 __LF \ - adcs x13, x13, x3 __LF \ - adcs x14, x14, x4 __LF \ - adcs x0, x0, x5 __LF \ - cset x8, cs __LF \ - mov x11, #0xffffffff00000000 __LF \ - mov x6, #0xfffffffeffffffff __LF \ - adds x1, x12, #0x1 __LF \ - sbcs x3, x13, x11 __LF \ - adcs x4, x14, xzr __LF \ - sbcs x5, x0, x6 __LF \ - sbcs xzr, x8, xzr __LF \ - csel x12, x12, x1, cc __LF \ - csel x13, x13, x3, cc __LF \ - csel x14, x14, x4, cc __LF \ - csel x0, x0, x5, cc __LF \ - stp x12, x13, [P0] __LF \ - stp x14, x0, [P0+16] - -// Corresponds to bignum_montsqr_sm2_alt exactly - -#define montsqr_sm2(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x6, x2, x4 __LF \ - umulh x7, x2, x4 __LF \ - adds x10, x10, x6 __LF \ - adcs x11, x11, x7 __LF \ - mul x6, x3, x4 __LF \ - umulh x7, x3, x4 __LF \ - adc x7, x7, xzr __LF \ - adds x11, x11, x6 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x7 __LF \ - mul x6, x3, x5 __LF \ - umulh x7, x3, x5 __LF \ - adc x7, x7, xzr __LF \ - adds x12, x12, x6 __LF \ - adcs x13, x13, x7 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x7, cs __LF \ - umulh x6, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x6 __LF \ - mul x6, x3, x3 __LF \ - adcs x10, x10, x6 __LF \ - umulh x6, x3, x3 __LF \ - adcs x11, x11, x6 __LF \ - mul x6, x4, x4 __LF \ - adcs x12, x12, x6 __LF \ - umulh x6, x4, x4 __LF \ - adcs x13, x13, x6 __LF \ - mul x6, x5, x5 __LF \ - adcs x14, x14, x6 __LF \ - umulh x6, x5, x5 __LF \ - adc x7, x7, x6 __LF \ - lsl x4, x8, #32 __LF \ - lsr x5, x8, #32 __LF \ - subs x2, x4, x8 __LF \ - sbc x3, x5, xzr __LF \ - subs x9, x9, x2 __LF \ - sbcs x10, x10, x3 __LF \ - sbcs x11, x11, x4 __LF \ - sbc x8, x8, x5 __LF \ - lsl x4, x9, #32 __LF \ - lsr x5, x9, #32 __LF \ - subs x2, x4, x9 __LF \ - sbc x3, x5, xzr __LF \ - subs x10, x10, x2 __LF \ - sbcs x11, x11, x3 __LF \ - sbcs x8, x8, x4 __LF \ - sbc x9, x9, x5 __LF \ - lsl x4, x10, #32 __LF \ - lsr x5, x10, #32 __LF \ - subs x2, x4, x10 __LF \ - sbc x3, x5, xzr __LF \ - subs x11, x11, x2 __LF \ - sbcs x8, x8, x3 __LF \ - sbcs x9, x9, x4 __LF \ - sbc x10, x10, x5 __LF \ - lsl x4, x11, #32 __LF \ - lsr x5, x11, #32 __LF \ - subs x2, x4, x11 __LF \ - sbc x3, x5, xzr __LF \ - subs x8, x8, x2 __LF \ - sbcs x9, x9, x3 __LF \ - sbcs x10, x10, x4 __LF \ - sbc x11, x11, x5 __LF \ - adds x8, x8, x12 __LF \ - adcs x9, x9, x13 __LF \ - adcs x10, x10, x14 __LF \ - adcs x11, x11, x7 __LF \ - cset x2, cs __LF \ - mov x3, #0xffffffff00000000 __LF \ - mov x5, #0xfffffffeffffffff __LF \ - adds x12, x8, #0x1 __LF \ - sbcs x13, x9, x3 __LF \ - adcs x14, x10, xzr __LF \ - sbcs x7, x11, x5 __LF \ - sbcs xzr, x2, xzr __LF \ - csel x8, x8, x12, cc __LF \ - csel x9, x9, x13, cc __LF \ - csel x10, x10, x14, cc __LF \ - csel x11, x11, x7, cc __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Almost-Montgomery variant which we use when an input to other muls -// with the other argument fully reduced (which is always safe). - -#define amontsqr_sm2(P0,P1) \ - ldp x2, x3, [P1] __LF \ - mul x9, x2, x3 __LF \ - umulh x10, x2, x3 __LF \ - ldp x4, x5, [P1+16] __LF \ - mul x11, x2, x5 __LF \ - umulh x12, x2, x5 __LF \ - mul x6, x2, x4 __LF \ - umulh x7, x2, x4 __LF \ - adds x10, x10, x6 __LF \ - adcs x11, x11, x7 __LF \ - mul x6, x3, x4 __LF \ - umulh x7, x3, x4 __LF \ - adc x7, x7, xzr __LF \ - adds x11, x11, x6 __LF \ - mul x13, x4, x5 __LF \ - umulh x14, x4, x5 __LF \ - adcs x12, x12, x7 __LF \ - mul x6, x3, x5 __LF \ - umulh x7, x3, x5 __LF \ - adc x7, x7, xzr __LF \ - adds x12, x12, x6 __LF \ - adcs x13, x13, x7 __LF \ - adc x14, x14, xzr __LF \ - adds x9, x9, x9 __LF \ - adcs x10, x10, x10 __LF \ - adcs x11, x11, x11 __LF \ - adcs x12, x12, x12 __LF \ - adcs x13, x13, x13 __LF \ - adcs x14, x14, x14 __LF \ - cset x7, cs __LF \ - umulh x6, x2, x2 __LF \ - mul x8, x2, x2 __LF \ - adds x9, x9, x6 __LF \ - mul x6, x3, x3 __LF \ - adcs x10, x10, x6 __LF \ - umulh x6, x3, x3 __LF \ - adcs x11, x11, x6 __LF \ - mul x6, x4, x4 __LF \ - adcs x12, x12, x6 __LF \ - umulh x6, x4, x4 __LF \ - adcs x13, x13, x6 __LF \ - mul x6, x5, x5 __LF \ - adcs x14, x14, x6 __LF \ - umulh x6, x5, x5 __LF \ - adc x7, x7, x6 __LF \ - lsl x4, x8, #32 __LF \ - lsr x5, x8, #32 __LF \ - subs x2, x4, x8 __LF \ - sbc x3, x5, xzr __LF \ - subs x9, x9, x2 __LF \ - sbcs x10, x10, x3 __LF \ - sbcs x11, x11, x4 __LF \ - sbc x8, x8, x5 __LF \ - lsl x4, x9, #32 __LF \ - lsr x5, x9, #32 __LF \ - subs x2, x4, x9 __LF \ - sbc x3, x5, xzr __LF \ - subs x10, x10, x2 __LF \ - sbcs x11, x11, x3 __LF \ - sbcs x8, x8, x4 __LF \ - sbc x9, x9, x5 __LF \ - lsl x4, x10, #32 __LF \ - lsr x5, x10, #32 __LF \ - subs x2, x4, x10 __LF \ - sbc x3, x5, xzr __LF \ - subs x11, x11, x2 __LF \ - sbcs x8, x8, x3 __LF \ - sbcs x9, x9, x4 __LF \ - sbc x10, x10, x5 __LF \ - lsl x4, x11, #32 __LF \ - lsr x5, x11, #32 __LF \ - subs x2, x4, x11 __LF \ - sbc x3, x5, xzr __LF \ - subs x8, x8, x2 __LF \ - sbcs x9, x9, x3 __LF \ - sbcs x10, x10, x4 __LF \ - sbc x11, x11, x5 __LF \ - adds x8, x8, x12 __LF \ - adcs x9, x9, x13 __LF \ - adcs x10, x10, x14 __LF \ - adcs x11, x11, x7 __LF \ - csetm x2, cs __LF \ - subs x8, x8, x2 __LF \ - and x3, x2, #0xffffffff00000000 __LF \ - sbcs x9, x9, x3 __LF \ - and x5, x2, #0xfffffffeffffffff __LF \ - sbcs x10, x10, x2 __LF \ - sbc x11, x11, x5 __LF \ - stp x8, x9, [P0] __LF \ - stp x10, x11, [P0+16] - -// Corresponds exactly to bignum_sub_sm2 - -#define sub_sm2(P0,P1,P2) \ - ldp x5, x6, [P1] __LF \ - ldp x4, x3, [P2] __LF \ - subs x5, x5, x4 __LF \ - sbcs x6, x6, x3 __LF \ - ldp x7, x8, [P1+16] __LF \ - ldp x4, x3, [P2+16] __LF \ - sbcs x7, x7, x4 __LF \ - sbcs x8, x8, x3 __LF \ - csetm x3, cc __LF \ - adds x5, x5, x3 __LF \ - and x4, x3, #0xffffffff00000000 __LF \ - adcs x6, x6, x4 __LF \ - adcs x7, x7, x3 __LF \ - and x4, x3, #0xfffffffeffffffff __LF \ - adc x8, x8, x4 __LF \ - stp x5, x6, [P0] __LF \ - stp x7, x8, [P0+16] - -S2N_BN_SYMBOL(sm2_montjmixadd_alt): - CFI_START - -// Make room on stack for temporary variables -// Move the input arguments to stable places - - CFI_DEC_SP(NSPACE) - - mov input_z, x0 - mov input_x, x1 - mov input_y, x2 - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - amontsqr_sm2(zp2,z_1) - montmul_sm2(y2a,z_1,y_2) - - montmul_sm2(x2a,zp2,x_2) - montmul_sm2(y2a,zp2,y2a) - - sub_sm2(xd,x2a,x_1) - sub_sm2(yd,y2a,y_1) - - amontsqr_sm2(zz,xd) - montsqr_sm2(ww,yd) - - montmul_sm2(zzx1,zz,x_1) - montmul_sm2(zzx2,zz,x2a) - - sub_sm2(resx,ww,zzx1) - sub_sm2(t1,zzx2,zzx1) - - montmul_sm2(resz,xd,z_1) - - sub_sm2(resx,resx,zzx2) - - sub_sm2(t2,zzx1,resx) - - montmul_sm2(t1,t1,y_1) - montmul_sm2(t2,yd,t2) - - sub_sm2(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - ldp x0, x1, [z_1] - ldp x2, x3, [z_1+16] - orr x4, x0, x1 - orr x5, x2, x3 - orr x4, x4, x5 - cmp x4, xzr - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with a z = 1 coordinate (in -// Montgomery form so not the simple constant 1 but rather 2^256 - p_sm2), -// hence giving 0 + p2 = p2 for the final result. - - ldp x0, x1, [resx] - ldp x12, x13, [x_2] - csel x0, x0, x12, ne - csel x1, x1, x13, ne - ldp x2, x3, [resx+16] - ldp x12, x13, [x_2+16] - csel x2, x2, x12, ne - csel x3, x3, x13, ne - - ldp x4, x5, [resy] - ldp x12, x13, [y_2] - csel x4, x4, x12, ne - csel x5, x5, x13, ne - ldp x6, x7, [resy+16] - ldp x12, x13, [y_2+16] - csel x6, x6, x12, ne - csel x7, x7, x13, ne - - ldp x8, x9, [resz] - mov x12, #0x0000000000000001 - mov x13, #0x00000000ffffffff - csel x8, x8, x12, ne - csel x9, x9, x13, ne - ldp x10, x11, [resz+16] - mov x13, #0x0000000100000000 - csel x10, x10, xzr, ne - csel x11, x11, x13, ne - - stp x0, x1, [x_3] - stp x2, x3, [x_3+16] - stp x4, x5, [y_3] - stp x6, x7, [y_3+16] - stp x8, x9, [z_3] - stp x10, x11, [z_3+16] - -// Restore stack and return - - CFI_INC_SP(NSPACE) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjmixadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjscalarmul.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjscalarmul.S deleted file mode 100644 index 9e34c31a91c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjscalarmul.S +++ /dev/null @@ -1,4514 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery-Jacobian form scalar multiplication for GM/T 0003-2012 curve SM2 -// Input scalar[4], point[12]; output res[12] -// -// extern void sm2_montjscalarmul -// (uint64_t res[static 12], -// const uint64_t scalar[static 4], -// const uint64_t point[static 12]); -// -// This function is a variant of its affine point version sm2_scalarmul. -// Here, input and output points are assumed to be in Jacobian form with -// their coordinates in the Montgomery domain. Thus, if priming indicates -// Montgomery form, x' = (2^256 * x) mod p_sm2 etc., each point argument -// is a triple (x',y',z') representing the affine point (x/z^2,y/z^3) when -// z' is nonzero or the point at infinity (group identity) if z' = 0. -// -// Given scalar = n and point = P, assumed to be on the NIST elliptic -// curve SM2, returns a representation of n * P. If the result is the -// point at infinity (either because the input point was or because the -// scalar was a multiple of p_sm2) then the output is guaranteed to -// represent the point at infinity, i.e. to have its z coordinate zero. -// -// Standard ARM ABI: X0 = res, X1 = scalar, X2 = point -// ---------------------------------------------------------------------------- - - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjscalarmul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjscalarmul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjscalarmul) - - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Safe copies of inputs (res lasts the whole code, point not so long) -// and additional values in variables, with some aliasing - -#define res x19 -#define sgn x20 -#define j x20 -#define point x21 - -// Intermediate variables on the stack. - -#define scalarb sp, #(0*NUMSIZE) -#define acc sp, #(1*NUMSIZE) -#define tabent sp, #(4*NUMSIZE) - -#define tab sp, #(7*NUMSIZE) - -#define NSPACE 31*NUMSIZE - -// Avoid using .rep for the sake of the BoringSSL/AWS-LC delocator, -// which doesn't accept repetitions, assembler macros etc. - -#define selectblock(I) \ - cmp x14, #(1*I) __LF \ - ldp x12, x13, [x15] __LF \ - csel x0, x12, x0, eq __LF \ - csel x1, x13, x1, eq __LF \ - ldp x12, x13, [x15, #16] __LF \ - csel x2, x12, x2, eq __LF \ - csel x3, x13, x3, eq __LF \ - ldp x12, x13, [x15, #32] __LF \ - csel x4, x12, x4, eq __LF \ - csel x5, x13, x5, eq __LF \ - ldp x12, x13, [x15, #48] __LF \ - csel x6, x12, x6, eq __LF \ - csel x7, x13, x7, eq __LF \ - ldp x12, x13, [x15, #64] __LF \ - csel x8, x12, x8, eq __LF \ - csel x9, x13, x9, eq __LF \ - ldp x12, x13, [x15, #80] __LF \ - csel x10, x12, x10, eq __LF \ - csel x11, x13, x11, eq __LF \ - add x15, x15, #96 - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(sm2_montjscalarmul): - CFI_START - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x30) - CFI_DEC_SP(NSPACE) - -// Preserve the "res" and "point" input arguments. We load and process the -// scalar immediately so we don't bother preserving that input argument. -// Also, "point" is only needed early on and so its register gets re-used. - - mov res, x0 - mov point, x2 - -// Load the digits of group order n_sm2 = [x12;x13;x14;x15] - - movbig(x12, #0x53bb, #0xf409, #0x39d5, #0x4123) - movbig(x13, #0x7203, #0xdf6b, #0x21c6, #0x052b) - mov x14, #0xffffffffffffffff - mov x15, #0xfffffffeffffffff - -// First, reduce the input scalar mod n_sm2, i.e. conditionally subtract n_sm2 - - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - - subs x6, x2, x12 - sbcs x7, x3, x13 - sbcs x8, x4, x14 - sbcs x9, x5, x15 - - csel x2, x2, x6, cc - csel x3, x3, x7, cc - csel x4, x4, x8, cc - csel x5, x5, x9, cc - -// Now if the top bit of the reduced scalar is set, negate it mod n_sm2, -// i.e. do n |-> n_sm2 - n. Remember the sign as "sgn" so we can -// correspondingly negate the point below. - - subs x6, x12, x2 - sbcs x7, x13, x3 - sbcs x8, x14, x4 - sbc x9, x15, x5 - - tst x5, #0x8000000000000000 - csel x2, x2, x6, eq - csel x3, x3, x7, eq - csel x4, x4, x8, eq - csel x5, x5, x9, eq - cset sgn, ne - -// In either case then add the recoding constant 0x08888...888 to allow -// signed digits. - - mov x6, 0x8888888888888888 - adds x2, x2, x6 - adcs x3, x3, x6 - bic x7, x6, #0xF000000000000000 - adcs x4, x4, x6 - adc x5, x5, x7 - - stp x2, x3, [scalarb] - stp x4, x5, [scalarb+16] - -// Set the tab[0] table entry to the input point = 1 * P, except -// that we negate it if the top bit of the scalar was set. This -// negation takes care over the y = 0 case to maintain all the -// coordinates < p_sm2 throughout, even though triples (x,y,z) -// with y = 0 can only represent a point on the curve when z = 0 -// and it represents the point at infinity regardless of x and y. - - ldp x0, x1, [point] - stp x0, x1, [tab] - ldp x2, x3, [point, #16] - stp x2, x3, [tab+16] - - ldp x4, x5, [point, #32] - ldp x6, x7, [point, #48] - - mov x0, #0xffffffffffffffff - subs x0, x0, x4 - mov x1, #0xffffffff00000000 - sbcs x1, x1, x5 - mov x2, #0xffffffffffffffff - sbcs x2, x2, x6 - mov x3, #0xfffffffeffffffff - sbc x3, x3, x7 - - orr x8, x4, x5 - orr x9, x6, x7 - orr x8, x8, x9 - cmp x8, xzr - ccmp sgn, xzr, #4, ne - csel x4, x0, x4, ne - csel x5, x1, x5, ne - csel x6, x2, x6, ne - csel x7, x3, x7, ne - - stp x4, x5, [tab+32] - stp x6, x7, [tab+48] - - ldp x0, x1, [point, #64] - stp x0, x1, [tab+64] - ldp x2, x3, [point, #80] - stp x2, x3, [tab+80] - -// Compute and record tab[1] = 2 * p, ..., tab[7] = 8 * P - - add x0, tab+96*1 - add x1, tab - CFI_BL(Lsm2_montjscalarmul_sm2_montjdouble) - - add x0, tab+96*2 - add x1, tab+96*1 - add x2, tab - CFI_BL(Lsm2_montjscalarmul_sm2_montjadd) - - add x0, tab+96*3 - add x1, tab+96*1 - CFI_BL(Lsm2_montjscalarmul_sm2_montjdouble) - - add x0, tab+96*4 - add x1, tab+96*3 - add x2, tab - CFI_BL(Lsm2_montjscalarmul_sm2_montjadd) - - add x0, tab+96*5 - add x1, tab+96*2 - CFI_BL(Lsm2_montjscalarmul_sm2_montjdouble) - - add x0, tab+96*6 - add x1, tab+96*5 - add x2, tab - CFI_BL(Lsm2_montjscalarmul_sm2_montjadd) - - add x0, tab+96*7 - add x1, tab+96*3 - CFI_BL(Lsm2_montjscalarmul_sm2_montjdouble) - -// Initialize the accumulator as a table entry for top 4 bits (unrecoded) - - ldr x14, [scalarb+24] - lsr x14, x14, #60 - - mov x0, xzr - mov x1, xzr - mov x2, xzr - mov x3, xzr - mov x4, xzr - mov x5, xzr - mov x6, xzr - mov x7, xzr - mov x8, xzr - mov x9, xzr - mov x10, xzr - mov x11, xzr - add x15, tab - - selectblock(1) - selectblock(2) - selectblock(3) - selectblock(4) - selectblock(5) - selectblock(6) - selectblock(7) - selectblock(8) - - stp x0, x1, [acc] - stp x2, x3, [acc+16] - stp x4, x5, [acc+32] - stp x6, x7, [acc+48] - stp x8, x9, [acc+64] - stp x10, x11, [acc+80] - - mov j, #252 - -// Main loop over size-4 bitfields: double 4 times then add signed digit - -Lsm2_montjscalarmul_mainloop: - sub j, j, #4 - - add x0, acc - add x1, acc - CFI_BL(Lsm2_montjscalarmul_sm2_montjdouble) - - add x0, acc - add x1, acc - CFI_BL(Lsm2_montjscalarmul_sm2_montjdouble) - - add x0, acc - add x1, acc - CFI_BL(Lsm2_montjscalarmul_sm2_montjdouble) - - add x0, acc - add x1, acc - CFI_BL(Lsm2_montjscalarmul_sm2_montjdouble) - - lsr x2, j, #6 - ldr x14, [sp, x2, lsl #3] // Exploits scalarb = sp exactly - lsr x14, x14, j - and x14, x14, #15 - - subs x14, x14, #8 - cset x16, lo // x16 = sign of digit (1 = negative) - cneg x14, x14, lo // x14 = absolute value of digit - -// Conditionally select the table entry tab[i-1] = i * P in constant time - - mov x0, xzr - mov x1, xzr - mov x2, xzr - mov x3, xzr - mov x4, xzr - mov x5, xzr - mov x6, xzr - mov x7, xzr - mov x8, xzr - mov x9, xzr - mov x10, xzr - mov x11, xzr - add x15, tab - - selectblock(1) - selectblock(2) - selectblock(3) - selectblock(4) - selectblock(5) - selectblock(6) - selectblock(7) - selectblock(8) - -// Store it to "tabent" with the y coordinate optionally negated -// Again, do it carefully to give coordinates < p_sm2 even in -// the degenerate case y = 0 (when z = 0 for points on the curve). - - stp x0, x1, [tabent] - stp x2, x3, [tabent+16] - - mov x0, #0xffffffffffffffff - subs x0, x0, x4 - mov x1, #0xffffffff00000000 - sbcs x1, x1, x5 - mov x2, #0xffffffffffffffff - sbcs x2, x2, x6 - mov x3, #0xfffffffeffffffff - sbc x3, x3, x7 - - orr x12, x4, x5 - orr x13, x6, x7 - orr x12, x12, x13 - cmp x12, xzr - ccmp x16, xzr, #4, ne - csel x4, x0, x4, ne - csel x5, x1, x5, ne - csel x6, x2, x6, ne - csel x7, x3, x7, ne - - stp x4, x5, [tabent+32] - stp x6, x7, [tabent+48] - stp x8, x9, [tabent+64] - stp x10, x11, [tabent+80] - - add x0, acc - add x1, acc - add x2, tabent - CFI_BL(Lsm2_montjscalarmul_sm2_montjadd) - - cbnz j, Lsm2_montjscalarmul_mainloop - -// That's the end of the main loop, and we just need to copy the -// result in "acc" to the output. - - ldp x0, x1, [acc] - stp x0, x1, [res] - ldp x0, x1, [acc+16] - stp x0, x1, [res, #16] - ldp x0, x1, [acc+32] - stp x0, x1, [res, #32] - ldp x0, x1, [acc+48] - stp x0, x1, [res, #48] - ldp x0, x1, [acc+64] - stp x0, x1, [res, #64] - ldp x0, x1, [acc+80] - stp x0, x1, [res, #80] - -// Restore stack and registers and return - - CFI_INC_SP(NSPACE) - CFI_POP2(x21,x30) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjscalarmul) - -// Local copies of subroutines, complete clones at the moment - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lsm2_montjscalarmul_sm2_montjadd) - -Lsm2_montjscalarmul_sm2_montjadd: - CFI_START - CFI_PUSH2(x19,x20) - CFI_DEC_SP(224) - mov x17, x0 - mov x19, x1 - mov x20, x2 - ldp x2, x3, [x19, #0x40] - ldp x4, x5, [x19, #0x50] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x0, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x0, x0, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x0, x0, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - lsr x11, x15, #32 - subs x14, x12, x15 - sbc x13, x11, xzr - subs x16, x16, x14 - sbcs x0, x0, x13 - sbcs x1, x1, x12 - sbc x15, x15, x11 - lsl x12, x16, #32 - lsr x11, x16, #32 - subs x14, x12, x16 - sbc x13, x11, xzr - subs x0, x0, x14 - sbcs x1, x1, x13 - sbcs x15, x15, x12 - sbc x16, x16, x11 - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, lo - csetm x13, lo - subs x12, x5, x4 - cneg x12, x12, lo - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, lo - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x0 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - lsr x11, x6, #32 - subs x14, x12, x6 - sbc x13, x11, xzr - subs x7, x7, x14 - sbcs x8, x8, x13 - sbcs x9, x9, x12 - sbc x14, x6, x11 - adds x10, x10, x14 - adc x6, xzr, xzr - lsl x12, x7, #32 - lsr x11, x7, #32 - subs x14, x12, x7 - sbc x13, x11, xzr - subs x8, x8, x14 - sbcs x9, x9, x13 - sbcs x10, x10, x12 - sbc x14, x7, x11 - adds x6, x6, x14 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #-0x100000000 - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #-0x100000001 - adcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, hs - csel x9, x11, x9, hs - csel x10, x12, x10, hs - csel x6, x13, x6, hs - stp x8, x9, [sp] - stp x10, x6, [sp, #0x10] - ldp x2, x3, [x20, #0x40] - ldp x4, x5, [x20, #0x50] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x0, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x0, x0, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x0, x0, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - lsr x11, x15, #32 - subs x14, x12, x15 - sbc x13, x11, xzr - subs x16, x16, x14 - sbcs x0, x0, x13 - sbcs x1, x1, x12 - sbc x15, x15, x11 - lsl x12, x16, #32 - lsr x11, x16, #32 - subs x14, x12, x16 - sbc x13, x11, xzr - subs x0, x0, x14 - sbcs x1, x1, x13 - sbcs x15, x15, x12 - sbc x16, x16, x11 - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, lo - csetm x13, lo - subs x12, x5, x4 - cneg x12, x12, lo - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, lo - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x0 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - lsr x11, x6, #32 - subs x14, x12, x6 - sbc x13, x11, xzr - subs x7, x7, x14 - sbcs x8, x8, x13 - sbcs x9, x9, x12 - sbc x14, x6, x11 - adds x10, x10, x14 - adc x6, xzr, xzr - lsl x12, x7, #32 - lsr x11, x7, #32 - subs x14, x12, x7 - sbc x13, x11, xzr - subs x8, x8, x14 - sbcs x9, x9, x13 - sbcs x10, x10, x12 - sbc x14, x7, x11 - adds x6, x6, x14 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #-0x100000000 - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #-0x100000001 - adcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, hs - csel x9, x11, x9, hs - csel x10, x12, x10, hs - csel x6, x13, x6, hs - stp x8, x9, [sp, #0xa0] - stp x10, x6, [sp, #0xb0] - ldp x3, x4, [x20, #0x40] - ldp x5, x6, [x20, #0x50] - ldp x7, x8, [x19, #0x20] - ldp x9, x10, [x19, #0x30] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0xc0] - stp x11, x12, [sp, #0xd0] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x0, x10, x9 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0xc0] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0xd0] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, lo - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0xc0] - stp x3, x4, [sp, #0xd0] - ldp x3, x4, [x19, #0x40] - ldp x5, x6, [x19, #0x50] - ldp x7, x8, [x20, #0x20] - ldp x9, x10, [x20, #0x30] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0x20] - stp x11, x12, [sp, #0x30] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x0, x10, x9 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0x20] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0x30] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, lo - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0x20] - stp x3, x4, [sp, #0x30] - ldp x3, x4, [sp] - ldp x5, x6, [sp, #0x10] - ldp x7, x8, [x20] - ldp x9, x10, [x20, #0x10] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0x40] - stp x11, x12, [sp, #0x50] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x0, x10, x9 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0x40] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0x50] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, lo - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0x40] - stp x3, x4, [sp, #0x50] - ldp x3, x4, [sp, #0xa0] - ldp x5, x6, [sp, #0xb0] - ldp x7, x8, [x19] - ldp x9, x10, [x19, #0x10] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0x80] - stp x11, x12, [sp, #0x90] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x0, x10, x9 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0x80] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0x90] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, lo - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0x80] - stp x3, x4, [sp, #0x90] - ldp x3, x4, [sp] - ldp x5, x6, [sp, #0x10] - ldp x7, x8, [sp, #0x20] - ldp x9, x10, [sp, #0x30] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0x20] - stp x11, x12, [sp, #0x30] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x0, x10, x9 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0x20] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0x30] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, lo - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0x20] - stp x3, x4, [sp, #0x30] - ldp x3, x4, [sp, #0xa0] - ldp x5, x6, [sp, #0xb0] - ldp x7, x8, [sp, #0xc0] - ldp x9, x10, [sp, #0xd0] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0xc0] - stp x11, x12, [sp, #0xd0] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x0, x10, x9 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0xc0] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0xd0] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, lo - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0xc0] - stp x3, x4, [sp, #0xd0] - ldp x5, x6, [sp, #0x40] - ldp x4, x3, [sp, #0x80] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x50] - ldp x4, x3, [sp, #0x90] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0xa0] - stp x7, x8, [sp, #0xb0] - ldp x5, x6, [sp, #0x20] - ldp x4, x3, [sp, #0xc0] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x30] - ldp x4, x3, [sp, #0xd0] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0x20] - stp x7, x8, [sp, #0x30] - ldp x2, x3, [sp, #0xa0] - ldp x4, x5, [sp, #0xb0] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x0, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x0, x0, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x0, x0, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - lsr x11, x15, #32 - subs x14, x12, x15 - sbc x13, x11, xzr - subs x16, x16, x14 - sbcs x0, x0, x13 - sbcs x1, x1, x12 - sbc x15, x15, x11 - lsl x12, x16, #32 - lsr x11, x16, #32 - subs x14, x12, x16 - sbc x13, x11, xzr - subs x0, x0, x14 - sbcs x1, x1, x13 - sbcs x15, x15, x12 - sbc x16, x16, x11 - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, lo - csetm x13, lo - subs x12, x5, x4 - cneg x12, x12, lo - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, lo - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x0 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - lsr x11, x6, #32 - subs x14, x12, x6 - sbc x13, x11, xzr - subs x7, x7, x14 - sbcs x8, x8, x13 - sbcs x9, x9, x12 - sbc x14, x6, x11 - adds x10, x10, x14 - adc x6, xzr, xzr - lsl x12, x7, #32 - lsr x11, x7, #32 - subs x14, x12, x7 - sbc x13, x11, xzr - subs x8, x8, x14 - sbcs x9, x9, x13 - sbcs x10, x10, x12 - sbc x14, x7, x11 - adds x6, x6, x14 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #-0x100000000 - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #-0x100000001 - adcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, hs - csel x9, x11, x9, hs - csel x10, x12, x10, hs - csel x6, x13, x6, hs - stp x8, x9, [sp, #0x60] - stp x10, x6, [sp, #0x70] - ldp x2, x3, [sp, #0x20] - ldp x4, x5, [sp, #0x30] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x0, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x0, x0, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x0, x0, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - lsr x11, x15, #32 - subs x14, x12, x15 - sbc x13, x11, xzr - subs x16, x16, x14 - sbcs x0, x0, x13 - sbcs x1, x1, x12 - sbc x15, x15, x11 - lsl x12, x16, #32 - lsr x11, x16, #32 - subs x14, x12, x16 - sbc x13, x11, xzr - subs x0, x0, x14 - sbcs x1, x1, x13 - sbcs x15, x15, x12 - sbc x16, x16, x11 - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, lo - csetm x13, lo - subs x12, x5, x4 - cneg x12, x12, lo - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, lo - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x0 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - lsr x11, x6, #32 - subs x14, x12, x6 - sbc x13, x11, xzr - subs x7, x7, x14 - sbcs x8, x8, x13 - sbcs x9, x9, x12 - sbc x14, x6, x11 - adds x10, x10, x14 - adc x6, xzr, xzr - lsl x12, x7, #32 - lsr x11, x7, #32 - subs x14, x12, x7 - sbc x13, x11, xzr - subs x8, x8, x14 - sbcs x9, x9, x13 - sbcs x10, x10, x12 - sbc x14, x7, x11 - adds x6, x6, x14 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #-0x100000000 - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #-0x100000001 - adcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, hs - csel x9, x11, x9, hs - csel x10, x12, x10, hs - csel x6, x13, x6, hs - stp x8, x9, [sp] - stp x10, x6, [sp, #0x10] - ldp x3, x4, [sp, #0x60] - ldp x5, x6, [sp, #0x70] - ldp x7, x8, [sp, #0x80] - ldp x9, x10, [sp, #0x90] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0x80] - stp x11, x12, [sp, #0x90] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x0, x10, x9 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0x80] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0x90] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, lo - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0x80] - stp x3, x4, [sp, #0x90] - ldp x3, x4, [sp, #0x60] - ldp x5, x6, [sp, #0x70] - ldp x7, x8, [sp, #0x40] - ldp x9, x10, [sp, #0x50] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0x40] - stp x11, x12, [sp, #0x50] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x0, x10, x9 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0x40] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0x50] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, lo - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0x40] - stp x3, x4, [sp, #0x50] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #0x80] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x10] - ldp x4, x3, [sp, #0x90] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #0x10] - ldp x5, x6, [sp, #0x40] - ldp x4, x3, [sp, #0x80] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x50] - ldp x4, x3, [sp, #0x90] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0x60] - stp x7, x8, [sp, #0x70] - ldp x3, x4, [sp, #0xa0] - ldp x5, x6, [sp, #0xb0] - ldp x7, x8, [x19, #0x40] - ldp x9, x10, [x19, #0x50] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0xa0] - stp x11, x12, [sp, #0xb0] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x0, x10, x9 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0xa0] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0xb0] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, lo - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0xa0] - stp x3, x4, [sp, #0xb0] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #0x40] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x10] - ldp x4, x3, [sp, #0x50] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #0x10] - ldp x5, x6, [sp, #0x80] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x90] - ldp x4, x3, [sp, #0x10] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0x80] - stp x7, x8, [sp, #0x90] - ldp x3, x4, [sp, #0x60] - ldp x5, x6, [sp, #0x70] - ldp x7, x8, [sp, #0xc0] - ldp x9, x10, [sp, #0xd0] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0x60] - stp x11, x12, [sp, #0x70] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x0, x10, x9 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0x60] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0x70] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, lo - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0x60] - stp x3, x4, [sp, #0x70] - ldp x3, x4, [sp, #0xa0] - ldp x5, x6, [sp, #0xb0] - ldp x7, x8, [x20, #0x40] - ldp x9, x10, [x20, #0x50] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0xa0] - stp x11, x12, [sp, #0xb0] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x0, x10, x9 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0xa0] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0xb0] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, lo - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0xa0] - stp x3, x4, [sp, #0xb0] - ldp x3, x4, [sp, #0x20] - ldp x5, x6, [sp, #0x30] - ldp x7, x8, [sp, #0x80] - ldp x9, x10, [sp, #0x90] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0x80] - stp x11, x12, [sp, #0x90] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x0, x10, x9 - cneg x0, x0, lo - mul x16, x15, x0 - umulh x0, x15, x0 - cinv x1, x1, lo - eor x16, x16, x1 - eor x0, x0, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0x80] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0x90] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x0, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x0 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x0, x8, x7 - cneg x0, x0, lo - mul x16, x3, x0 - umulh x0, x3, x0 - cinv x4, x4, lo - eor x16, x16, x4 - eor x0, x0, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x0 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x0, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x0 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x0, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x0 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0x80] - stp x3, x4, [sp, #0x90] - ldp x5, x6, [sp, #0x80] - ldp x4, x3, [sp, #0x60] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x90] - ldp x4, x3, [sp, #0x70] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0x80] - stp x7, x8, [sp, #0x90] - ldp x0, x1, [x19, #0x40] - ldp x2, x3, [x19, #0x50] - orr x12, x0, x1 - orr x13, x2, x3 - orr x12, x12, x13 - cmp x12, xzr - cset x12, ne - ldp x4, x5, [x20, #0x40] - ldp x6, x7, [x20, #0x50] - orr x13, x4, x5 - orr x14, x6, x7 - orr x13, x13, x14 - cmp x13, xzr - cset x13, ne - cmp x13, x12 - ldp x8, x9, [sp, #0xa0] - csel x8, x0, x8, lo - csel x9, x1, x9, lo - csel x8, x4, x8, hi - csel x9, x5, x9, hi - ldp x10, x11, [sp, #0xb0] - csel x10, x2, x10, lo - csel x11, x3, x11, lo - csel x10, x6, x10, hi - csel x11, x7, x11, hi - ldp x12, x13, [x19] - ldp x0, x1, [sp] - csel x0, x12, x0, lo - csel x1, x13, x1, lo - ldp x12, x13, [x20] - csel x0, x12, x0, hi - csel x1, x13, x1, hi - ldp x12, x13, [x19, #0x10] - ldp x2, x3, [sp, #0x10] - csel x2, x12, x2, lo - csel x3, x13, x3, lo - ldp x12, x13, [x20, #0x10] - csel x2, x12, x2, hi - csel x3, x13, x3, hi - ldp x12, x13, [x19, #0x20] - ldp x4, x5, [sp, #0x80] - csel x4, x12, x4, lo - csel x5, x13, x5, lo - ldp x12, x13, [x20, #0x20] - csel x4, x12, x4, hi - csel x5, x13, x5, hi - ldp x12, x13, [x19, #0x30] - ldp x6, x7, [sp, #0x90] - csel x6, x12, x6, lo - csel x7, x13, x7, lo - ldp x12, x13, [x20, #0x30] - csel x6, x12, x6, hi - csel x7, x13, x7, hi - stp x0, x1, [x17] - stp x2, x3, [x17, #0x10] - stp x4, x5, [x17, #0x20] - stp x6, x7, [x17, #0x30] - stp x8, x9, [x17, #0x40] - stp x10, x11, [x17, #0x50] - CFI_INC_SP(224) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lsm2_montjscalarmul_sm2_montjadd) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lsm2_montjscalarmul_sm2_montjdouble) - -Lsm2_montjscalarmul_sm2_montjdouble: - CFI_START - CFI_DEC_SP(208) - stp x19, x20, [sp, #0xc0] - mov x19, x0 - mov x20, x1 - ldp x2, x3, [x20, #0x40] - ldp x4, x5, [x20, #0x50] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x17, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x17, x17, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x17, x17, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - lsr x11, x15, #32 - subs x14, x12, x15 - sbc x13, x11, xzr - subs x16, x16, x14 - sbcs x17, x17, x13 - sbcs x1, x1, x12 - sbc x15, x15, x11 - lsl x12, x16, #32 - lsr x11, x16, #32 - subs x14, x12, x16 - sbc x13, x11, xzr - subs x17, x17, x14 - sbcs x1, x1, x13 - sbcs x15, x15, x12 - sbc x16, x16, x11 - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, lo - csetm x13, lo - subs x12, x5, x4 - cneg x12, x12, lo - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, lo - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x17 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - lsr x11, x6, #32 - subs x14, x12, x6 - sbc x13, x11, xzr - subs x7, x7, x14 - sbcs x8, x8, x13 - sbcs x9, x9, x12 - sbc x14, x6, x11 - adds x10, x10, x14 - adc x6, xzr, xzr - lsl x12, x7, #32 - lsr x11, x7, #32 - subs x14, x12, x7 - sbc x13, x11, xzr - subs x8, x8, x14 - sbcs x9, x9, x13 - sbcs x10, x10, x12 - sbc x14, x7, x11 - adds x6, x6, x14 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #-0x100000000 - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #-0x100000001 - adcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, hs - csel x9, x11, x9, hs - csel x10, x12, x10, hs - csel x6, x13, x6, hs - stp x8, x9, [sp] - stp x10, x6, [sp, #0x10] - ldp x2, x3, [x20, #0x20] - ldp x4, x5, [x20, #0x30] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x17, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x17, x17, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x17, x17, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - lsr x11, x15, #32 - subs x14, x12, x15 - sbc x13, x11, xzr - subs x16, x16, x14 - sbcs x17, x17, x13 - sbcs x1, x1, x12 - sbc x15, x15, x11 - lsl x12, x16, #32 - lsr x11, x16, #32 - subs x14, x12, x16 - sbc x13, x11, xzr - subs x17, x17, x14 - sbcs x1, x1, x13 - sbcs x15, x15, x12 - sbc x16, x16, x11 - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, lo - csetm x13, lo - subs x12, x5, x4 - cneg x12, x12, lo - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, lo - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x17 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - lsr x11, x6, #32 - subs x14, x12, x6 - sbc x13, x11, xzr - subs x7, x7, x14 - sbcs x8, x8, x13 - sbcs x9, x9, x12 - sbc x14, x6, x11 - adds x10, x10, x14 - adc x6, xzr, xzr - lsl x12, x7, #32 - lsr x11, x7, #32 - subs x14, x12, x7 - sbc x13, x11, xzr - subs x8, x8, x14 - sbcs x9, x9, x13 - sbcs x10, x10, x12 - sbc x14, x7, x11 - adds x6, x6, x14 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #-0x100000000 - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #-0x100000001 - adcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, hs - csel x9, x11, x9, hs - csel x10, x12, x10, hs - csel x6, x13, x6, hs - stp x8, x9, [sp, #0x20] - stp x10, x6, [sp, #0x30] - ldp x5, x6, [x20] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [x20, #0x10] - ldp x4, x3, [sp, #0x10] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0x60] - stp x7, x8, [sp, #0x70] - ldp x4, x5, [x20] - ldp x8, x9, [sp] - adds x4, x4, x8 - adcs x5, x5, x9 - ldp x6, x7, [x20, #0x10] - ldp x10, x11, [sp, #0x10] - adcs x6, x6, x10 - adcs x7, x7, x11 - csetm x2, hs - subs x4, x4, x2 - and x3, x2, #0xffffffff00000000 - sbcs x5, x5, x3 - and x1, x2, #0xfffffffeffffffff - sbcs x6, x6, x2 - sbc x7, x7, x1 - stp x4, x5, [sp, #0x40] - stp x6, x7, [sp, #0x50] - ldp x3, x4, [sp, #0x40] - ldp x5, x6, [sp, #0x50] - ldp x7, x8, [sp, #0x60] - ldp x9, x10, [sp, #0x70] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x17, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x17 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x17, x8, x7 - cneg x17, x17, lo - mul x16, x15, x17 - umulh x17, x15, x17 - cinv x1, x1, lo - eor x16, x16, x1 - eor x17, x17, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x17 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x17, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x17 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x17, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x17 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0x60] - stp x11, x12, [sp, #0x70] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x17, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x17 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x17, x10, x9 - cneg x17, x17, lo - mul x16, x15, x17 - umulh x17, x15, x17 - cinv x1, x1, lo - eor x16, x16, x1 - eor x17, x17, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x17 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0x60] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0x70] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x17, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x17 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x17, x8, x7 - cneg x17, x17, lo - mul x16, x3, x17 - umulh x17, x3, x17 - cinv x4, x4, lo - eor x16, x16, x4 - eor x17, x17, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x17 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x17, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x17 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x17, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x17 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0x60] - stp x3, x4, [sp, #0x70] - ldp x4, x5, [x20, #0x20] - ldp x8, x9, [x20, #0x40] - adds x4, x4, x8 - adcs x5, x5, x9 - ldp x6, x7, [x20, #0x30] - ldp x10, x11, [x20, #0x50] - adcs x6, x6, x10 - adcs x7, x7, x11 - adc x3, xzr, xzr - adds x8, x4, #0x1 - mov x9, #-0x100000000 - sbcs x9, x5, x9 - adcs x10, x6, xzr - mov x11, #-0x100000001 - sbcs x11, x7, x11 - sbcs x3, x3, xzr - csel x4, x4, x8, lo - csel x5, x5, x9, lo - csel x6, x6, x10, lo - csel x7, x7, x11, lo - stp x4, x5, [sp, #0x40] - stp x6, x7, [sp, #0x50] - ldp x3, x4, [x20] - ldp x5, x6, [x20, #0x10] - ldp x7, x8, [sp, #0x20] - ldp x9, x10, [sp, #0x30] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x17, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x17 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x17, x8, x7 - cneg x17, x17, lo - mul x16, x15, x17 - umulh x17, x15, x17 - cinv x1, x1, lo - eor x16, x16, x1 - eor x17, x17, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x17 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x17, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x17 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x17, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x17 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0x80] - stp x11, x12, [sp, #0x90] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x17, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x17 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x17, x10, x9 - cneg x17, x17, lo - mul x16, x15, x17 - umulh x17, x15, x17 - cinv x1, x1, lo - eor x16, x16, x1 - eor x17, x17, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x17 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0x80] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0x90] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x17, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x17 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x17, x8, x7 - cneg x17, x17, lo - mul x16, x3, x17 - umulh x17, x3, x17 - cinv x4, x4, lo - eor x16, x16, x4 - eor x17, x17, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x17 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x17, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x17 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x17, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x17 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0x80] - stp x3, x4, [sp, #0x90] - ldp x2, x3, [sp, #0x60] - ldp x4, x5, [sp, #0x70] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x17, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x17, x17, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x17, x17, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - lsr x11, x15, #32 - subs x14, x12, x15 - sbc x13, x11, xzr - subs x16, x16, x14 - sbcs x17, x17, x13 - sbcs x1, x1, x12 - sbc x15, x15, x11 - lsl x12, x16, #32 - lsr x11, x16, #32 - subs x14, x12, x16 - sbc x13, x11, xzr - subs x17, x17, x14 - sbcs x1, x1, x13 - sbcs x15, x15, x12 - sbc x16, x16, x11 - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, lo - csetm x13, lo - subs x12, x5, x4 - cneg x12, x12, lo - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, lo - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x17 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - lsr x11, x6, #32 - subs x14, x12, x6 - sbc x13, x11, xzr - subs x7, x7, x14 - sbcs x8, x8, x13 - sbcs x9, x9, x12 - sbc x14, x6, x11 - adds x10, x10, x14 - adc x6, xzr, xzr - lsl x12, x7, #32 - lsr x11, x7, #32 - subs x14, x12, x7 - sbc x13, x11, xzr - subs x8, x8, x14 - sbcs x9, x9, x13 - sbcs x10, x10, x12 - sbc x14, x7, x11 - adds x6, x6, x14 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #-0x100000000 - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #-0x100000001 - adcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, hs - csel x9, x11, x9, hs - csel x10, x12, x10, hs - csel x6, x13, x6, hs - stp x8, x9, [sp, #0xa0] - stp x10, x6, [sp, #0xb0] - ldp x2, x3, [sp, #0x40] - ldp x4, x5, [sp, #0x50] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x17, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x17, x17, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x17, x17, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - lsr x11, x15, #32 - subs x14, x12, x15 - sbc x13, x11, xzr - subs x16, x16, x14 - sbcs x17, x17, x13 - sbcs x1, x1, x12 - sbc x15, x15, x11 - lsl x12, x16, #32 - lsr x11, x16, #32 - subs x14, x12, x16 - sbc x13, x11, xzr - subs x17, x17, x14 - sbcs x1, x1, x13 - sbcs x15, x15, x12 - sbc x16, x16, x11 - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, lo - csetm x13, lo - subs x12, x5, x4 - cneg x12, x12, lo - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, lo - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x17 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - lsr x11, x6, #32 - subs x14, x12, x6 - sbc x13, x11, xzr - subs x7, x7, x14 - sbcs x8, x8, x13 - sbcs x9, x9, x12 - sbc x14, x6, x11 - adds x10, x10, x14 - adc x6, xzr, xzr - lsl x12, x7, #32 - lsr x11, x7, #32 - subs x14, x12, x7 - sbc x13, x11, xzr - subs x8, x8, x14 - sbcs x9, x9, x13 - sbcs x10, x10, x12 - sbc x14, x7, x11 - adds x6, x6, x14 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #-0x100000000 - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #-0x100000001 - adcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, hs - csel x9, x11, x9, hs - csel x10, x12, x10, hs - csel x6, x13, x6, hs - stp x8, x9, [sp, #0x40] - stp x10, x6, [sp, #0x50] - mov x1, #0x9 - mov x2, #-0x1 - ldp x9, x10, [sp, #0xa0] - subs x9, x2, x9 - mov x3, #-0x100000000 - sbcs x10, x3, x10 - ldp x11, x12, [sp, #0xb0] - sbcs x11, x2, x11 - mov x4, #-0x100000001 - sbc x12, x4, x12 - mul x3, x1, x9 - mul x4, x1, x10 - mul x5, x1, x11 - mul x6, x1, x12 - umulh x9, x1, x9 - umulh x10, x1, x10 - umulh x11, x1, x11 - umulh x7, x1, x12 - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, xzr - mov x1, #0xc - ldp x9, x10, [sp, #0x80] - mul x8, x9, x1 - umulh x9, x9, x1 - adds x3, x3, x8 - mul x8, x10, x1 - umulh x10, x10, x1 - adcs x4, x4, x8 - ldp x11, x12, [sp, #0x90] - mul x8, x11, x1 - umulh x11, x11, x1 - adcs x5, x5, x8 - mul x8, x12, x1 - umulh x12, x12, x1 - adcs x6, x6, x8 - adc x7, x7, xzr - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, x12 - add x7, x7, #0x1 - lsl x8, x7, #32 - sub x9, x8, x7 - adds x3, x3, x7 - adcs x4, x4, x9 - adcs x5, x5, xzr - adcs x6, x6, x8 - csetm x7, lo - adds x3, x3, x7 - and x9, x7, #0xffffffff00000000 - adcs x4, x4, x9 - adcs x5, x5, x7 - and x8, x7, #0xfffffffeffffffff - adc x6, x6, x8 - stp x3, x4, [sp, #0xa0] - stp x5, x6, [sp, #0xb0] - ldp x5, x6, [sp, #0x40] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x50] - ldp x4, x3, [sp, #0x10] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0x40] - stp x7, x8, [sp, #0x50] - ldp x2, x3, [sp, #0x20] - ldp x4, x5, [sp, #0x30] - umull x15, w2, w2 - lsr x11, x2, #32 - umull x16, w11, w11 - umull x11, w2, w11 - adds x15, x15, x11, lsl #33 - lsr x11, x11, #31 - adc x16, x16, x11 - umull x17, w3, w3 - lsr x11, x3, #32 - umull x1, w11, w11 - umull x11, w3, w11 - mul x12, x2, x3 - umulh x13, x2, x3 - adds x17, x17, x11, lsl #33 - lsr x11, x11, #31 - adc x1, x1, x11 - adds x12, x12, x12 - adcs x13, x13, x13 - adc x1, x1, xzr - adds x16, x16, x12 - adcs x17, x17, x13 - adc x1, x1, xzr - lsl x12, x15, #32 - lsr x11, x15, #32 - subs x14, x12, x15 - sbc x13, x11, xzr - subs x16, x16, x14 - sbcs x17, x17, x13 - sbcs x1, x1, x12 - sbc x15, x15, x11 - lsl x12, x16, #32 - lsr x11, x16, #32 - subs x14, x12, x16 - sbc x13, x11, xzr - subs x17, x17, x14 - sbcs x1, x1, x13 - sbcs x15, x15, x12 - sbc x16, x16, x11 - mul x6, x2, x4 - mul x14, x3, x5 - umulh x8, x2, x4 - subs x10, x2, x3 - cneg x10, x10, lo - csetm x13, lo - subs x12, x5, x4 - cneg x12, x12, lo - mul x11, x10, x12 - umulh x12, x10, x12 - cinv x13, x13, lo - eor x11, x11, x13 - eor x12, x12, x13 - adds x7, x6, x8 - adc x8, x8, xzr - umulh x9, x3, x5 - adds x7, x7, x14 - adcs x8, x8, x9 - adc x9, x9, xzr - adds x8, x8, x14 - adc x9, x9, xzr - cmn x13, #0x1 - adcs x7, x7, x11 - adcs x8, x8, x12 - adc x9, x9, x13 - adds x6, x6, x6 - adcs x7, x7, x7 - adcs x8, x8, x8 - adcs x9, x9, x9 - adc x10, xzr, xzr - adds x6, x6, x17 - adcs x7, x7, x1 - adcs x8, x8, x15 - adcs x9, x9, x16 - adc x10, x10, xzr - lsl x12, x6, #32 - lsr x11, x6, #32 - subs x14, x12, x6 - sbc x13, x11, xzr - subs x7, x7, x14 - sbcs x8, x8, x13 - sbcs x9, x9, x12 - sbc x14, x6, x11 - adds x10, x10, x14 - adc x6, xzr, xzr - lsl x12, x7, #32 - lsr x11, x7, #32 - subs x14, x12, x7 - sbc x13, x11, xzr - subs x8, x8, x14 - sbcs x9, x9, x13 - sbcs x10, x10, x12 - sbc x14, x7, x11 - adds x6, x6, x14 - adc x7, xzr, xzr - mul x11, x4, x4 - adds x8, x8, x11 - mul x12, x5, x5 - umulh x11, x4, x4 - adcs x9, x9, x11 - adcs x10, x10, x12 - umulh x12, x5, x5 - adcs x6, x6, x12 - adc x7, x7, xzr - mul x11, x4, x5 - umulh x12, x4, x5 - adds x11, x11, x11 - adcs x12, x12, x12 - adc x13, xzr, xzr - adds x9, x9, x11 - adcs x10, x10, x12 - adcs x6, x6, x13 - adcs x7, x7, xzr - mov x11, #-0x100000000 - adds x5, x8, #0x1 - sbcs x11, x9, x11 - mov x13, #-0x100000001 - adcs x12, x10, xzr - sbcs x13, x6, x13 - sbcs xzr, x7, xzr - csel x8, x5, x8, hs - csel x9, x11, x9, hs - csel x10, x12, x10, hs - csel x6, x13, x6, hs - stp x8, x9, [sp] - stp x10, x6, [sp, #0x10] - ldp x3, x4, [sp, #0xa0] - ldp x5, x6, [sp, #0xb0] - ldp x7, x8, [sp, #0x60] - ldp x9, x10, [sp, #0x70] - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x17, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x17 - adcs x14, x14, xzr - subs x15, x3, x4 - cneg x15, x15, lo - csetm x1, lo - subs x17, x8, x7 - cneg x17, x17, lo - mul x16, x15, x17 - umulh x17, x15, x17 - cinv x1, x1, lo - eor x16, x16, x1 - eor x17, x17, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x17 - adc x14, x14, x1 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x17, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x17 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x17, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x17 - sbcs x11, x11, x16 - sbc x12, x12, x15 - stp x13, x14, [sp, #0x60] - stp x11, x12, [sp, #0x70] - mul x11, x5, x9 - mul x13, x6, x10 - umulh x12, x5, x9 - adds x16, x11, x13 - umulh x14, x6, x10 - adcs x17, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x17 - adcs x14, x14, xzr - subs x15, x5, x6 - cneg x15, x15, lo - csetm x1, lo - subs x17, x10, x9 - cneg x17, x17, lo - mul x16, x15, x17 - umulh x17, x15, x17 - cinv x1, x1, lo - eor x16, x16, x1 - eor x17, x17, x1 - cmn x1, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x17 - adc x14, x14, x1 - subs x3, x5, x3 - sbcs x4, x6, x4 - ngc x5, xzr - cmn x5, #0x1 - eor x3, x3, x5 - adcs x3, x3, xzr - eor x4, x4, x5 - adcs x4, x4, xzr - subs x7, x7, x9 - sbcs x8, x8, x10 - ngc x9, xzr - cmn x9, #0x1 - eor x7, x7, x9 - adcs x7, x7, xzr - eor x8, x8, x9 - adcs x8, x8, xzr - eor x10, x5, x9 - ldp x15, x1, [sp, #0x60] - adds x15, x11, x15 - adcs x1, x12, x1 - ldp x5, x9, [sp, #0x70] - adcs x5, x13, x5 - adcs x9, x14, x9 - adc x2, xzr, xzr - mul x11, x3, x7 - mul x13, x4, x8 - umulh x12, x3, x7 - adds x16, x11, x13 - umulh x14, x4, x8 - adcs x17, x12, x14 - adcs x14, x14, xzr - adds x12, x12, x16 - adcs x13, x13, x17 - adcs x14, x14, xzr - subs x3, x3, x4 - cneg x3, x3, lo - csetm x4, lo - subs x17, x8, x7 - cneg x17, x17, lo - mul x16, x3, x17 - umulh x17, x3, x17 - cinv x4, x4, lo - eor x16, x16, x4 - eor x17, x17, x4 - cmn x4, #0x1 - adcs x12, x12, x16 - adcs x13, x13, x17 - adc x14, x14, x4 - cmn x10, #0x1 - eor x11, x11, x10 - adcs x11, x11, x15 - eor x12, x12, x10 - adcs x12, x12, x1 - eor x13, x13, x10 - adcs x13, x13, x5 - eor x14, x14, x10 - adcs x14, x14, x9 - adcs x3, x2, x10 - adcs x4, x10, xzr - adc x10, x10, xzr - adds x13, x13, x15 - adcs x14, x14, x1 - adcs x3, x3, x5 - adcs x4, x4, x9 - adc x10, x10, x2 - lsl x16, x11, #32 - lsr x15, x11, #32 - subs x1, x16, x11 - sbc x17, x15, xzr - subs x12, x12, x1 - sbcs x13, x13, x17 - sbcs x14, x14, x16 - sbc x11, x11, x15 - lsl x16, x12, #32 - lsr x15, x12, #32 - subs x1, x16, x12 - sbc x17, x15, xzr - subs x13, x13, x1 - sbcs x14, x14, x17 - sbcs x11, x11, x16 - sbc x12, x12, x15 - adds x3, x3, x11 - adcs x4, x4, x12 - adc x10, x10, xzr - add x2, x10, #0x1 - lsl x15, x2, #32 - sub x16, x15, x2 - adds x13, x13, x2 - adcs x14, x14, x16 - adcs x3, x3, xzr - adcs x4, x4, x15 - csetm x7, lo - adds x13, x13, x7 - and x16, x7, #0xffffffff00000000 - adcs x14, x14, x16 - adcs x3, x3, x7 - and x15, x7, #0xfffffffeffffffff - adc x4, x4, x15 - stp x13, x14, [sp, #0x60] - stp x3, x4, [sp, #0x70] - ldp x5, x6, [sp, #0x40] - ldp x4, x3, [sp, #0x20] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x50] - ldp x4, x3, [sp, #0x30] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [x19, #0x40] - stp x7, x8, [x19, #0x50] - ldp x1, x2, [sp, #0x80] - lsl x0, x1, #2 - ldp x6, x7, [sp, #0xa0] - subs x0, x0, x6 - extr x1, x2, x1, #0x3e - sbcs x1, x1, x7 - ldp x3, x4, [sp, #0x90] - extr x2, x3, x2, #0x3e - ldp x6, x7, [sp, #0xb0] - sbcs x2, x2, x6 - extr x3, x4, x3, #0x3e - sbcs x3, x3, x7 - lsr x4, x4, #62 - sbc x4, x4, xzr - add x4, x4, #0x1 - lsl x5, x4, #32 - sub x6, x5, x4 - adds x0, x0, x4 - adcs x1, x1, x6 - adcs x2, x2, xzr - adcs x3, x3, x5 - csetm x4, lo - adds x0, x0, x4 - and x6, x4, #0xffffffff00000000 - adcs x1, x1, x6 - adcs x2, x2, x4 - and x5, x4, #0xfffffffeffffffff - adc x3, x3, x5 - stp x0, x1, [x19] - stp x2, x3, [x19, #0x10] - mov x1, #0x8 - mov x2, #-0x1 - ldp x9, x10, [sp] - subs x9, x2, x9 - mov x3, #-0x100000000 - sbcs x10, x3, x10 - ldp x11, x12, [sp, #0x10] - sbcs x11, x2, x11 - mov x4, #-0x100000001 - sbc x12, x4, x12 - lsl x3, x9, #3 - extr x4, x10, x9, #0x3d - extr x5, x11, x10, #0x3d - extr x6, x12, x11, #0x3d - lsr x7, x12, #61 - mov x1, #0x3 - ldp x9, x10, [sp, #0x60] - mul x8, x9, x1 - umulh x9, x9, x1 - adds x3, x3, x8 - mul x8, x10, x1 - umulh x10, x10, x1 - adcs x4, x4, x8 - ldp x11, x12, [sp, #0x70] - mul x8, x11, x1 - umulh x11, x11, x1 - adcs x5, x5, x8 - mul x8, x12, x1 - umulh x12, x12, x1 - adcs x6, x6, x8 - adc x7, x7, xzr - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, x12 - add x7, x7, #0x1 - lsl x8, x7, #32 - sub x9, x8, x7 - adds x3, x3, x7 - adcs x4, x4, x9 - adcs x5, x5, xzr - adcs x6, x6, x8 - csetm x7, lo - adds x3, x3, x7 - and x9, x7, #0xffffffff00000000 - adcs x4, x4, x9 - adcs x5, x5, x7 - and x8, x7, #0xfffffffeffffffff - adc x6, x6, x8 - stp x3, x4, [x19, #0x20] - stp x5, x6, [x19, #0x30] - ldp x19, x20, [sp, #0xc0] - CFI_INC_SP(208) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lsm2_montjscalarmul_sm2_montjdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjscalarmul_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjscalarmul_alt.S deleted file mode 100644 index eb08a2e1c03..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/sm2/sm2_montjscalarmul_alt.S +++ /dev/null @@ -1,3421 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery-Jacobian form scalar multiplication for GM/T 0003-2012 curve SM2 -// Input scalar[4], point[12]; output res[12] -// -// extern void sm2_montjscalarmul_alt -// (uint64_t res[static 12], -// const uint64_t scalar[static 4], -// const uint64_t point[static 12]); -// -// This function is a variant of its affine point version sm2_scalarmul_alt. -// Here, input and output points are assumed to be in Jacobian form with -// their coordinates in the Montgomery domain. Thus, if priming indicates -// Montgomery form, x' = (2^256 * x) mod p_sm2 etc., each point argument -// is a triple (x',y',z') representing the affine point (x/z^2,y/z^3) when -// z' is nonzero or the point at infinity (group identity) if z' = 0. -// -// Given scalar = n and point = P, assumed to be on the NIST elliptic -// curve SM2, returns a representation of n * P. If the result is the -// point at infinity (either because the input point was or because the -// scalar was a multiple of p_sm2) then the output is guaranteed to -// represent the point at infinity, i.e. to have its z coordinate zero. -// -// Standard ARM ABI: X0 = res, X1 = scalar, X2 = point -// ---------------------------------------------------------------------------- - - -#include "_internal_s2n_bignum_arm.h" - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjscalarmul_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjscalarmul_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjscalarmul_alt) - - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Safe copies of inputs (res lasts the whole code, point not so long) -// and additional values in variables, with some aliasing - -#define res x19 -#define sgn x20 -#define j x20 -#define point x21 - -// Intermediate variables on the stack. - -#define scalarb sp, #(0*NUMSIZE) -#define acc sp, #(1*NUMSIZE) -#define tabent sp, #(4*NUMSIZE) - -#define tab sp, #(7*NUMSIZE) - -#define NSPACE 31*NUMSIZE - -// Avoid using .rep for the sake of the BoringSSL/AWS-LC delocator, -// which doesn't accept repetitions, assembler macros etc. - -#define selectblock(I) \ - cmp x14, #(1*I) __LF \ - ldp x12, x13, [x15] __LF \ - csel x0, x12, x0, eq __LF \ - csel x1, x13, x1, eq __LF \ - ldp x12, x13, [x15, #16] __LF \ - csel x2, x12, x2, eq __LF \ - csel x3, x13, x3, eq __LF \ - ldp x12, x13, [x15, #32] __LF \ - csel x4, x12, x4, eq __LF \ - csel x5, x13, x5, eq __LF \ - ldp x12, x13, [x15, #48] __LF \ - csel x6, x12, x6, eq __LF \ - csel x7, x13, x7, eq __LF \ - ldp x12, x13, [x15, #64] __LF \ - csel x8, x12, x8, eq __LF \ - csel x9, x13, x9, eq __LF \ - ldp x12, x13, [x15, #80] __LF \ - csel x10, x12, x10, eq __LF \ - csel x11, x13, x11, eq __LF \ - add x15, x15, #96 - -// Loading large constants - -#define movbig(nn,n3,n2,n1,n0) \ - movz nn, n0 __LF \ - movk nn, n1, lsl #16 __LF \ - movk nn, n2, lsl #32 __LF \ - movk nn, n3, lsl #48 - -S2N_BN_SYMBOL(sm2_montjscalarmul_alt): - CFI_START - - CFI_PUSH2(x19,x20) - CFI_PUSH2(x21,x30) - CFI_DEC_SP(NSPACE) - -// Preserve the "res" and "point" input arguments. We load and process the -// scalar immediately so we don't bother preserving that input argument. -// Also, "point" is only needed early on and so its register gets re-used. - - mov res, x0 - mov point, x2 - -// Load the digits of group order n_sm2 = [x12;x13;x14;x15] - - movbig(x12, #0x53bb, #0xf409, #0x39d5, #0x4123) - movbig(x13, #0x7203, #0xdf6b, #0x21c6, #0x052b) - mov x14, #0xffffffffffffffff - mov x15, #0xfffffffeffffffff - -// First, reduce the input scalar mod n_sm2, i.e. conditionally subtract n_sm2 - - ldp x2, x3, [x1] - ldp x4, x5, [x1, #16] - - subs x6, x2, x12 - sbcs x7, x3, x13 - sbcs x8, x4, x14 - sbcs x9, x5, x15 - - csel x2, x2, x6, cc - csel x3, x3, x7, cc - csel x4, x4, x8, cc - csel x5, x5, x9, cc - -// Now if the top bit of the reduced scalar is set, negate it mod n_sm2, -// i.e. do n |-> n_sm2 - n. Remember the sign as "sgn" so we can -// correspondingly negate the point below. - - subs x6, x12, x2 - sbcs x7, x13, x3 - sbcs x8, x14, x4 - sbc x9, x15, x5 - - tst x5, #0x8000000000000000 - csel x2, x2, x6, eq - csel x3, x3, x7, eq - csel x4, x4, x8, eq - csel x5, x5, x9, eq - cset sgn, ne - -// In either case then add the recoding constant 0x08888...888 to allow -// signed digits. - - mov x6, 0x8888888888888888 - adds x2, x2, x6 - adcs x3, x3, x6 - bic x7, x6, #0xF000000000000000 - adcs x4, x4, x6 - adc x5, x5, x7 - - stp x2, x3, [scalarb] - stp x4, x5, [scalarb+16] - -// Set the tab[0] table entry to the input point = 1 * P, except -// that we negate it if the top bit of the scalar was set. This -// negation takes care over the y = 0 case to maintain all the -// coordinates < p_sm2 throughout, even though triples (x,y,z) -// with y = 0 can only represent a point on the curve when z = 0 -// and it represents the point at infinity regardless of x and y. - - ldp x0, x1, [point] - stp x0, x1, [tab] - ldp x2, x3, [point, #16] - stp x2, x3, [tab+16] - - ldp x4, x5, [point, #32] - ldp x6, x7, [point, #48] - - mov x0, #0xffffffffffffffff - subs x0, x0, x4 - mov x1, #0xffffffff00000000 - sbcs x1, x1, x5 - mov x2, #0xffffffffffffffff - sbcs x2, x2, x6 - mov x3, #0xfffffffeffffffff - sbc x3, x3, x7 - - orr x8, x4, x5 - orr x9, x6, x7 - orr x8, x8, x9 - cmp x8, xzr - ccmp sgn, xzr, #4, ne - csel x4, x0, x4, ne - csel x5, x1, x5, ne - csel x6, x2, x6, ne - csel x7, x3, x7, ne - - stp x4, x5, [tab+32] - stp x6, x7, [tab+48] - - ldp x0, x1, [point, #64] - stp x0, x1, [tab+64] - ldp x2, x3, [point, #80] - stp x2, x3, [tab+80] - -// Compute and record tab[1] = 2 * p, ..., tab[7] = 8 * P - - add x0, tab+96*1 - add x1, tab - CFI_BL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - add x0, tab+96*2 - add x1, tab+96*1 - add x2, tab - CFI_BL(Lsm2_montjscalarmul_alt_sm2_montjadd) - - add x0, tab+96*3 - add x1, tab+96*1 - CFI_BL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - add x0, tab+96*4 - add x1, tab+96*3 - add x2, tab - CFI_BL(Lsm2_montjscalarmul_alt_sm2_montjadd) - - add x0, tab+96*5 - add x1, tab+96*2 - CFI_BL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - add x0, tab+96*6 - add x1, tab+96*5 - add x2, tab - CFI_BL(Lsm2_montjscalarmul_alt_sm2_montjadd) - - add x0, tab+96*7 - add x1, tab+96*3 - CFI_BL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - -// Initialize the accumulator as a table entry for top 4 bits (unrecoded) - - ldr x14, [scalarb+24] - lsr x14, x14, #60 - - mov x0, xzr - mov x1, xzr - mov x2, xzr - mov x3, xzr - mov x4, xzr - mov x5, xzr - mov x6, xzr - mov x7, xzr - mov x8, xzr - mov x9, xzr - mov x10, xzr - mov x11, xzr - add x15, tab - - selectblock(1) - selectblock(2) - selectblock(3) - selectblock(4) - selectblock(5) - selectblock(6) - selectblock(7) - selectblock(8) - - stp x0, x1, [acc] - stp x2, x3, [acc+16] - stp x4, x5, [acc+32] - stp x6, x7, [acc+48] - stp x8, x9, [acc+64] - stp x10, x11, [acc+80] - - mov j, #252 - -// Main loop over size-4 bitfields: double 4 times then add signed digit - -Lsm2_montjscalarmul_alt_mainloop: - sub j, j, #4 - - add x0, acc - add x1, acc - CFI_BL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - add x0, acc - add x1, acc - CFI_BL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - add x0, acc - add x1, acc - CFI_BL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - add x0, acc - add x1, acc - CFI_BL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - lsr x2, j, #6 - ldr x14, [sp, x2, lsl #3] // Exploits scalarb = sp exactly - lsr x14, x14, j - and x14, x14, #15 - - subs x14, x14, #8 - cset x16, lo // x16 = sign of digit (1 = negative) - cneg x14, x14, lo // x14 = absolute value of digit - -// Conditionally select the table entry tab[i-1] = i * P in constant time - - mov x0, xzr - mov x1, xzr - mov x2, xzr - mov x3, xzr - mov x4, xzr - mov x5, xzr - mov x6, xzr - mov x7, xzr - mov x8, xzr - mov x9, xzr - mov x10, xzr - mov x11, xzr - add x15, tab - - selectblock(1) - selectblock(2) - selectblock(3) - selectblock(4) - selectblock(5) - selectblock(6) - selectblock(7) - selectblock(8) - -// Store it to "tabent" with the y coordinate optionally negated -// Again, do it carefully to give coordinates < p_sm2 even in -// the degenerate case y = 0 (when z = 0 for points on the curve). - - stp x0, x1, [tabent] - stp x2, x3, [tabent+16] - - mov x0, #0xffffffffffffffff - subs x0, x0, x4 - mov x1, #0xffffffff00000000 - sbcs x1, x1, x5 - mov x2, #0xffffffffffffffff - sbcs x2, x2, x6 - mov x3, #0xfffffffeffffffff - sbc x3, x3, x7 - - orr x12, x4, x5 - orr x13, x6, x7 - orr x12, x12, x13 - cmp x12, xzr - ccmp x16, xzr, #4, ne - csel x4, x0, x4, ne - csel x5, x1, x5, ne - csel x6, x2, x6, ne - csel x7, x3, x7, ne - - stp x4, x5, [tabent+32] - stp x6, x7, [tabent+48] - stp x8, x9, [tabent+64] - stp x10, x11, [tabent+80] - - add x0, acc - add x1, acc - add x2, tabent - CFI_BL(Lsm2_montjscalarmul_alt_sm2_montjadd) - - cbnz j, Lsm2_montjscalarmul_alt_mainloop - -// That's the end of the main loop, and we just need to copy the -// result in "acc" to the output. - - ldp x0, x1, [acc] - stp x0, x1, [res] - ldp x0, x1, [acc+16] - stp x0, x1, [res, #16] - ldp x0, x1, [acc+32] - stp x0, x1, [res, #32] - ldp x0, x1, [acc+48] - stp x0, x1, [res, #48] - ldp x0, x1, [acc+64] - stp x0, x1, [res, #64] - ldp x0, x1, [acc+80] - stp x0, x1, [res, #80] - -// Restore stack and registers and return - - CFI_INC_SP(NSPACE) - CFI_POP2(x21,x30) - CFI_POP2(x19,x20) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjscalarmul_alt) - -// Local copies of subroutines, complete clones at the moment - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lsm2_montjscalarmul_alt_sm2_montjadd) - -Lsm2_montjscalarmul_alt_sm2_montjadd: - CFI_START - CFI_DEC_SP(224) - mov x15, x0 - mov x16, x1 - mov x17, x2 - ldp x2, x3, [x16, #0x40] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [x16, #0x50] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, hs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - lsl x4, x8, #32 - lsr x5, x8, #32 - subs x2, x4, x8 - sbc x3, x5, xzr - subs x9, x9, x2 - sbcs x10, x10, x3 - sbcs x11, x11, x4 - sbc x8, x8, x5 - lsl x4, x9, #32 - lsr x5, x9, #32 - subs x2, x4, x9 - sbc x3, x5, xzr - subs x10, x10, x2 - sbcs x11, x11, x3 - sbcs x8, x8, x4 - sbc x9, x9, x5 - lsl x4, x10, #32 - lsr x5, x10, #32 - subs x2, x4, x10 - sbc x3, x5, xzr - subs x11, x11, x2 - sbcs x8, x8, x3 - sbcs x9, x9, x4 - sbc x10, x10, x5 - lsl x4, x11, #32 - lsr x5, x11, #32 - subs x2, x4, x11 - sbc x3, x5, xzr - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, x4 - sbc x11, x11, x5 - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - csetm x2, hs - subs x8, x8, x2 - and x3, x2, #0xffffffff00000000 - sbcs x9, x9, x3 - and x5, x2, #0xfffffffeffffffff - sbcs x10, x10, x2 - sbc x11, x11, x5 - stp x8, x9, [sp] - stp x10, x11, [sp, #0x10] - ldp x2, x3, [x17, #0x40] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [x17, #0x50] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, hs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - lsl x4, x8, #32 - lsr x5, x8, #32 - subs x2, x4, x8 - sbc x3, x5, xzr - subs x9, x9, x2 - sbcs x10, x10, x3 - sbcs x11, x11, x4 - sbc x8, x8, x5 - lsl x4, x9, #32 - lsr x5, x9, #32 - subs x2, x4, x9 - sbc x3, x5, xzr - subs x10, x10, x2 - sbcs x11, x11, x3 - sbcs x8, x8, x4 - sbc x9, x9, x5 - lsl x4, x10, #32 - lsr x5, x10, #32 - subs x2, x4, x10 - sbc x3, x5, xzr - subs x11, x11, x2 - sbcs x8, x8, x3 - sbcs x9, x9, x4 - sbc x10, x10, x5 - lsl x4, x11, #32 - lsr x5, x11, #32 - subs x2, x4, x11 - sbc x3, x5, xzr - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, x4 - sbc x11, x11, x5 - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - csetm x2, hs - subs x8, x8, x2 - and x3, x2, #0xffffffff00000000 - sbcs x9, x9, x3 - and x5, x2, #0xfffffffeffffffff - sbcs x10, x10, x2 - sbc x11, x11, x5 - stp x8, x9, [sp, #0xa0] - stp x10, x11, [sp, #0xb0] - ldp x3, x4, [x17, #0x40] - ldp x7, x8, [x16, #0x20] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x16, #0x30] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [x17, #0x50] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0xc0] - stp x14, x0, [sp, #0xd0] - ldp x3, x4, [x16, #0x40] - ldp x7, x8, [x17, #0x20] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x17, #0x30] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [x16, #0x50] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0x20] - stp x14, x0, [sp, #0x30] - ldp x3, x4, [sp] - ldp x7, x8, [x17] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x17, #0x10] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #0x10] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0x40] - stp x14, x0, [sp, #0x50] - ldp x3, x4, [sp, #0xa0] - ldp x7, x8, [x16] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x16, #0x10] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #0xb0] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0x80] - stp x14, x0, [sp, #0x90] - ldp x3, x4, [sp] - ldp x7, x8, [sp, #0x20] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #0x30] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #0x10] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0x20] - stp x14, x0, [sp, #0x30] - ldp x3, x4, [sp, #0xa0] - ldp x7, x8, [sp, #0xc0] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #0xd0] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #0xb0] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0xc0] - stp x14, x0, [sp, #0xd0] - ldp x5, x6, [sp, #0x40] - ldp x4, x3, [sp, #0x80] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x50] - ldp x4, x3, [sp, #0x90] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0xa0] - stp x7, x8, [sp, #0xb0] - ldp x5, x6, [sp, #0x20] - ldp x4, x3, [sp, #0xc0] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x30] - ldp x4, x3, [sp, #0xd0] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0x20] - stp x7, x8, [sp, #0x30] - ldp x2, x3, [sp, #0xa0] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #0xb0] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, hs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - lsl x4, x8, #32 - lsr x5, x8, #32 - subs x2, x4, x8 - sbc x3, x5, xzr - subs x9, x9, x2 - sbcs x10, x10, x3 - sbcs x11, x11, x4 - sbc x8, x8, x5 - lsl x4, x9, #32 - lsr x5, x9, #32 - subs x2, x4, x9 - sbc x3, x5, xzr - subs x10, x10, x2 - sbcs x11, x11, x3 - sbcs x8, x8, x4 - sbc x9, x9, x5 - lsl x4, x10, #32 - lsr x5, x10, #32 - subs x2, x4, x10 - sbc x3, x5, xzr - subs x11, x11, x2 - sbcs x8, x8, x3 - sbcs x9, x9, x4 - sbc x10, x10, x5 - lsl x4, x11, #32 - lsr x5, x11, #32 - subs x2, x4, x11 - sbc x3, x5, xzr - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, x4 - sbc x11, x11, x5 - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - csetm x2, hs - subs x8, x8, x2 - and x3, x2, #0xffffffff00000000 - sbcs x9, x9, x3 - and x5, x2, #0xfffffffeffffffff - sbcs x10, x10, x2 - sbc x11, x11, x5 - stp x8, x9, [sp, #0x60] - stp x10, x11, [sp, #0x70] - ldp x2, x3, [sp, #0x20] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #0x30] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, hs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - lsl x4, x8, #32 - lsr x5, x8, #32 - subs x2, x4, x8 - sbc x3, x5, xzr - subs x9, x9, x2 - sbcs x10, x10, x3 - sbcs x11, x11, x4 - sbc x8, x8, x5 - lsl x4, x9, #32 - lsr x5, x9, #32 - subs x2, x4, x9 - sbc x3, x5, xzr - subs x10, x10, x2 - sbcs x11, x11, x3 - sbcs x8, x8, x4 - sbc x9, x9, x5 - lsl x4, x10, #32 - lsr x5, x10, #32 - subs x2, x4, x10 - sbc x3, x5, xzr - subs x11, x11, x2 - sbcs x8, x8, x3 - sbcs x9, x9, x4 - sbc x10, x10, x5 - lsl x4, x11, #32 - lsr x5, x11, #32 - subs x2, x4, x11 - sbc x3, x5, xzr - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, x4 - sbc x11, x11, x5 - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, hs - mov x3, #-0x100000000 - mov x5, #-0x100000001 - adds x12, x8, #0x1 - sbcs x13, x9, x3 - adcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, lo - csel x9, x9, x13, lo - csel x10, x10, x14, lo - csel x11, x11, x7, lo - stp x8, x9, [sp] - stp x10, x11, [sp, #0x10] - ldp x3, x4, [sp, #0x60] - ldp x7, x8, [sp, #0x80] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #0x90] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #0x70] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0x80] - stp x14, x0, [sp, #0x90] - ldp x3, x4, [sp, #0x60] - ldp x7, x8, [sp, #0x40] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #0x50] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #0x70] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0x40] - stp x14, x0, [sp, #0x50] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #0x80] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x10] - ldp x4, x3, [sp, #0x90] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #0x10] - ldp x5, x6, [sp, #0x40] - ldp x4, x3, [sp, #0x80] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x50] - ldp x4, x3, [sp, #0x90] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0x60] - stp x7, x8, [sp, #0x70] - ldp x3, x4, [sp, #0xa0] - ldp x7, x8, [x16, #0x40] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x16, #0x50] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #0xb0] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0xa0] - stp x14, x0, [sp, #0xb0] - ldp x5, x6, [sp] - ldp x4, x3, [sp, #0x40] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x10] - ldp x4, x3, [sp, #0x50] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp] - stp x7, x8, [sp, #0x10] - ldp x5, x6, [sp, #0x80] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x90] - ldp x4, x3, [sp, #0x10] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0x80] - stp x7, x8, [sp, #0x90] - ldp x3, x4, [sp, #0x60] - ldp x7, x8, [sp, #0xc0] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #0xd0] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #0x70] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0x60] - stp x14, x0, [sp, #0x70] - ldp x3, x4, [sp, #0xa0] - ldp x7, x8, [x17, #0x40] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [x17, #0x50] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #0xb0] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0xa0] - stp x14, x0, [sp, #0xb0] - ldp x3, x4, [sp, #0x20] - ldp x7, x8, [sp, #0x80] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #0x90] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #0x30] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0x80] - stp x14, x0, [sp, #0x90] - ldp x5, x6, [sp, #0x80] - ldp x4, x3, [sp, #0x60] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x90] - ldp x4, x3, [sp, #0x70] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0x80] - stp x7, x8, [sp, #0x90] - ldp x0, x1, [x16, #0x40] - ldp x2, x3, [x16, #0x50] - orr x12, x0, x1 - orr x13, x2, x3 - orr x12, x12, x13 - cmp x12, xzr - cset x12, ne - ldp x4, x5, [x17, #0x40] - ldp x6, x7, [x17, #0x50] - orr x13, x4, x5 - orr x14, x6, x7 - orr x13, x13, x14 - cmp x13, xzr - cset x13, ne - cmp x13, x12 - ldp x8, x9, [sp, #0xa0] - csel x8, x0, x8, lo - csel x9, x1, x9, lo - csel x8, x4, x8, hi - csel x9, x5, x9, hi - ldp x10, x11, [sp, #0xb0] - csel x10, x2, x10, lo - csel x11, x3, x11, lo - csel x10, x6, x10, hi - csel x11, x7, x11, hi - ldp x12, x13, [x16] - ldp x0, x1, [sp] - csel x0, x12, x0, lo - csel x1, x13, x1, lo - ldp x12, x13, [x17] - csel x0, x12, x0, hi - csel x1, x13, x1, hi - ldp x12, x13, [x16, #0x10] - ldp x2, x3, [sp, #0x10] - csel x2, x12, x2, lo - csel x3, x13, x3, lo - ldp x12, x13, [x17, #0x10] - csel x2, x12, x2, hi - csel x3, x13, x3, hi - ldp x12, x13, [x16, #0x20] - ldp x4, x5, [sp, #0x80] - csel x4, x12, x4, lo - csel x5, x13, x5, lo - ldp x12, x13, [x17, #0x20] - csel x4, x12, x4, hi - csel x5, x13, x5, hi - ldp x12, x13, [x16, #0x30] - ldp x6, x7, [sp, #0x90] - csel x6, x12, x6, lo - csel x7, x13, x7, lo - ldp x12, x13, [x17, #0x30] - csel x6, x12, x6, hi - csel x7, x13, x7, hi - stp x0, x1, [x15] - stp x2, x3, [x15, #0x10] - stp x4, x5, [x15, #0x20] - stp x6, x7, [x15, #0x30] - stp x8, x9, [x15, #0x40] - stp x10, x11, [x15, #0x50] - CFI_INC_SP(224) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lsm2_montjscalarmul_alt_sm2_montjadd) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lsm2_montjscalarmul_alt_sm2_montjdouble) - -Lsm2_montjscalarmul_alt_sm2_montjdouble: - CFI_START - CFI_DEC_SP(192) - mov x15, x0 - mov x16, x1 - ldp x2, x3, [x16, #0x40] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [x16, #0x50] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, hs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - lsl x4, x8, #32 - lsr x5, x8, #32 - subs x2, x4, x8 - sbc x3, x5, xzr - subs x9, x9, x2 - sbcs x10, x10, x3 - sbcs x11, x11, x4 - sbc x8, x8, x5 - lsl x4, x9, #32 - lsr x5, x9, #32 - subs x2, x4, x9 - sbc x3, x5, xzr - subs x10, x10, x2 - sbcs x11, x11, x3 - sbcs x8, x8, x4 - sbc x9, x9, x5 - lsl x4, x10, #32 - lsr x5, x10, #32 - subs x2, x4, x10 - sbc x3, x5, xzr - subs x11, x11, x2 - sbcs x8, x8, x3 - sbcs x9, x9, x4 - sbc x10, x10, x5 - lsl x4, x11, #32 - lsr x5, x11, #32 - subs x2, x4, x11 - sbc x3, x5, xzr - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, x4 - sbc x11, x11, x5 - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, hs - mov x3, #-0x100000000 - mov x5, #-0x100000001 - adds x12, x8, #0x1 - sbcs x13, x9, x3 - adcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, lo - csel x9, x9, x13, lo - csel x10, x10, x14, lo - csel x11, x11, x7, lo - stp x8, x9, [sp] - stp x10, x11, [sp, #0x10] - ldp x2, x3, [x16, #0x20] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [x16, #0x30] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, hs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - lsl x4, x8, #32 - lsr x5, x8, #32 - subs x2, x4, x8 - sbc x3, x5, xzr - subs x9, x9, x2 - sbcs x10, x10, x3 - sbcs x11, x11, x4 - sbc x8, x8, x5 - lsl x4, x9, #32 - lsr x5, x9, #32 - subs x2, x4, x9 - sbc x3, x5, xzr - subs x10, x10, x2 - sbcs x11, x11, x3 - sbcs x8, x8, x4 - sbc x9, x9, x5 - lsl x4, x10, #32 - lsr x5, x10, #32 - subs x2, x4, x10 - sbc x3, x5, xzr - subs x11, x11, x2 - sbcs x8, x8, x3 - sbcs x9, x9, x4 - sbc x10, x10, x5 - lsl x4, x11, #32 - lsr x5, x11, #32 - subs x2, x4, x11 - sbc x3, x5, xzr - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, x4 - sbc x11, x11, x5 - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, hs - mov x3, #-0x100000000 - mov x5, #-0x100000001 - adds x12, x8, #0x1 - sbcs x13, x9, x3 - adcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, lo - csel x9, x9, x13, lo - csel x10, x10, x14, lo - csel x11, x11, x7, lo - stp x8, x9, [sp, #0x20] - stp x10, x11, [sp, #0x30] - ldp x5, x6, [x16] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [x16, #0x10] - ldp x4, x3, [sp, #0x10] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0x60] - stp x7, x8, [sp, #0x70] - ldp x4, x5, [x16] - ldp x8, x9, [sp] - adds x4, x4, x8 - adcs x5, x5, x9 - ldp x6, x7, [x16, #0x10] - ldp x10, x11, [sp, #0x10] - adcs x6, x6, x10 - adcs x7, x7, x11 - csetm x2, hs - subs x4, x4, x2 - and x3, x2, #0xffffffff00000000 - sbcs x5, x5, x3 - and x1, x2, #0xfffffffeffffffff - sbcs x6, x6, x2 - sbc x7, x7, x1 - stp x4, x5, [sp, #0x40] - stp x6, x7, [sp, #0x50] - ldp x3, x4, [sp, #0x40] - ldp x7, x8, [sp, #0x60] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #0x70] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #0x50] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0x60] - stp x14, x0, [sp, #0x70] - ldp x4, x5, [x16, #0x20] - ldp x8, x9, [x16, #0x40] - adds x4, x4, x8 - adcs x5, x5, x9 - ldp x6, x7, [x16, #0x30] - ldp x10, x11, [x16, #0x50] - adcs x6, x6, x10 - adcs x7, x7, x11 - adc x3, xzr, xzr - adds x8, x4, #0x1 - mov x9, #-0x100000000 - sbcs x9, x5, x9 - adcs x10, x6, xzr - mov x11, #-0x100000001 - sbcs x11, x7, x11 - sbcs x3, x3, xzr - csel x4, x4, x8, lo - csel x5, x5, x9, lo - csel x6, x6, x10, lo - csel x7, x7, x11, lo - stp x4, x5, [sp, #0x40] - stp x6, x7, [sp, #0x50] - ldp x3, x4, [x16] - ldp x7, x8, [sp, #0x20] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #0x30] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [x16, #0x10] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0x80] - stp x14, x0, [sp, #0x90] - ldp x2, x3, [sp, #0x60] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #0x70] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, hs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - lsl x4, x8, #32 - lsr x5, x8, #32 - subs x2, x4, x8 - sbc x3, x5, xzr - subs x9, x9, x2 - sbcs x10, x10, x3 - sbcs x11, x11, x4 - sbc x8, x8, x5 - lsl x4, x9, #32 - lsr x5, x9, #32 - subs x2, x4, x9 - sbc x3, x5, xzr - subs x10, x10, x2 - sbcs x11, x11, x3 - sbcs x8, x8, x4 - sbc x9, x9, x5 - lsl x4, x10, #32 - lsr x5, x10, #32 - subs x2, x4, x10 - sbc x3, x5, xzr - subs x11, x11, x2 - sbcs x8, x8, x3 - sbcs x9, x9, x4 - sbc x10, x10, x5 - lsl x4, x11, #32 - lsr x5, x11, #32 - subs x2, x4, x11 - sbc x3, x5, xzr - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, x4 - sbc x11, x11, x5 - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, hs - mov x3, #-0x100000000 - mov x5, #-0x100000001 - adds x12, x8, #0x1 - sbcs x13, x9, x3 - adcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, lo - csel x9, x9, x13, lo - csel x10, x10, x14, lo - csel x11, x11, x7, lo - stp x8, x9, [sp, #0xa0] - stp x10, x11, [sp, #0xb0] - ldp x2, x3, [sp, #0x40] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #0x50] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, hs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - lsl x4, x8, #32 - lsr x5, x8, #32 - subs x2, x4, x8 - sbc x3, x5, xzr - subs x9, x9, x2 - sbcs x10, x10, x3 - sbcs x11, x11, x4 - sbc x8, x8, x5 - lsl x4, x9, #32 - lsr x5, x9, #32 - subs x2, x4, x9 - sbc x3, x5, xzr - subs x10, x10, x2 - sbcs x11, x11, x3 - sbcs x8, x8, x4 - sbc x9, x9, x5 - lsl x4, x10, #32 - lsr x5, x10, #32 - subs x2, x4, x10 - sbc x3, x5, xzr - subs x11, x11, x2 - sbcs x8, x8, x3 - sbcs x9, x9, x4 - sbc x10, x10, x5 - lsl x4, x11, #32 - lsr x5, x11, #32 - subs x2, x4, x11 - sbc x3, x5, xzr - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, x4 - sbc x11, x11, x5 - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, hs - mov x3, #-0x100000000 - mov x5, #-0x100000001 - adds x12, x8, #0x1 - sbcs x13, x9, x3 - adcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, lo - csel x9, x9, x13, lo - csel x10, x10, x14, lo - csel x11, x11, x7, lo - stp x8, x9, [sp, #0x40] - stp x10, x11, [sp, #0x50] - mov x1, #0x9 - mov x2, #-0x1 - ldp x9, x10, [sp, #0xa0] - subs x9, x2, x9 - mov x3, #-0x100000000 - sbcs x10, x3, x10 - ldp x11, x12, [sp, #0xb0] - sbcs x11, x2, x11 - mov x4, #-0x100000001 - sbc x12, x4, x12 - mul x3, x1, x9 - mul x4, x1, x10 - mul x5, x1, x11 - mul x6, x1, x12 - umulh x9, x1, x9 - umulh x10, x1, x10 - umulh x11, x1, x11 - umulh x7, x1, x12 - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, xzr - mov x1, #0xc - ldp x9, x10, [sp, #0x80] - mul x8, x9, x1 - umulh x9, x9, x1 - adds x3, x3, x8 - mul x8, x10, x1 - umulh x10, x10, x1 - adcs x4, x4, x8 - ldp x11, x12, [sp, #0x90] - mul x8, x11, x1 - umulh x11, x11, x1 - adcs x5, x5, x8 - mul x8, x12, x1 - umulh x12, x12, x1 - adcs x6, x6, x8 - adc x7, x7, xzr - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, x12 - add x7, x7, #0x1 - lsl x8, x7, #32 - sub x9, x8, x7 - adds x3, x3, x7 - adcs x4, x4, x9 - adcs x5, x5, xzr - adcs x6, x6, x8 - csetm x7, lo - adds x3, x3, x7 - and x9, x7, #0xffffffff00000000 - adcs x4, x4, x9 - adcs x5, x5, x7 - and x8, x7, #0xfffffffeffffffff - adc x6, x6, x8 - stp x3, x4, [sp, #0xa0] - stp x5, x6, [sp, #0xb0] - ldp x5, x6, [sp, #0x40] - ldp x4, x3, [sp] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x50] - ldp x4, x3, [sp, #0x10] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [sp, #0x40] - stp x7, x8, [sp, #0x50] - ldp x2, x3, [sp, #0x20] - mul x9, x2, x3 - umulh x10, x2, x3 - ldp x4, x5, [sp, #0x30] - mul x11, x2, x5 - umulh x12, x2, x5 - mul x6, x2, x4 - umulh x7, x2, x4 - adds x10, x10, x6 - adcs x11, x11, x7 - mul x6, x3, x4 - umulh x7, x3, x4 - adc x7, x7, xzr - adds x11, x11, x6 - mul x13, x4, x5 - umulh x14, x4, x5 - adcs x12, x12, x7 - mul x6, x3, x5 - umulh x7, x3, x5 - adc x7, x7, xzr - adds x12, x12, x6 - adcs x13, x13, x7 - adc x14, x14, xzr - adds x9, x9, x9 - adcs x10, x10, x10 - adcs x11, x11, x11 - adcs x12, x12, x12 - adcs x13, x13, x13 - adcs x14, x14, x14 - cset x7, hs - umulh x6, x2, x2 - mul x8, x2, x2 - adds x9, x9, x6 - mul x6, x3, x3 - adcs x10, x10, x6 - umulh x6, x3, x3 - adcs x11, x11, x6 - mul x6, x4, x4 - adcs x12, x12, x6 - umulh x6, x4, x4 - adcs x13, x13, x6 - mul x6, x5, x5 - adcs x14, x14, x6 - umulh x6, x5, x5 - adc x7, x7, x6 - lsl x4, x8, #32 - lsr x5, x8, #32 - subs x2, x4, x8 - sbc x3, x5, xzr - subs x9, x9, x2 - sbcs x10, x10, x3 - sbcs x11, x11, x4 - sbc x8, x8, x5 - lsl x4, x9, #32 - lsr x5, x9, #32 - subs x2, x4, x9 - sbc x3, x5, xzr - subs x10, x10, x2 - sbcs x11, x11, x3 - sbcs x8, x8, x4 - sbc x9, x9, x5 - lsl x4, x10, #32 - lsr x5, x10, #32 - subs x2, x4, x10 - sbc x3, x5, xzr - subs x11, x11, x2 - sbcs x8, x8, x3 - sbcs x9, x9, x4 - sbc x10, x10, x5 - lsl x4, x11, #32 - lsr x5, x11, #32 - subs x2, x4, x11 - sbc x3, x5, xzr - subs x8, x8, x2 - sbcs x9, x9, x3 - sbcs x10, x10, x4 - sbc x11, x11, x5 - adds x8, x8, x12 - adcs x9, x9, x13 - adcs x10, x10, x14 - adcs x11, x11, x7 - cset x2, hs - mov x3, #-0x100000000 - mov x5, #-0x100000001 - adds x12, x8, #0x1 - sbcs x13, x9, x3 - adcs x14, x10, xzr - sbcs x7, x11, x5 - sbcs xzr, x2, xzr - csel x8, x8, x12, lo - csel x9, x9, x13, lo - csel x10, x10, x14, lo - csel x11, x11, x7, lo - stp x8, x9, [sp] - stp x10, x11, [sp, #0x10] - ldp x3, x4, [sp, #0xa0] - ldp x7, x8, [sp, #0x60] - mul x12, x3, x7 - umulh x13, x3, x7 - mul x11, x3, x8 - umulh x14, x3, x8 - adds x13, x13, x11 - ldp x9, x10, [sp, #0x70] - mul x11, x3, x9 - umulh x0, x3, x9 - adcs x14, x14, x11 - mul x11, x3, x10 - umulh x1, x3, x10 - adcs x0, x0, x11 - adc x1, x1, xzr - ldp x5, x6, [sp, #0xb0] - mul x11, x4, x7 - adds x13, x13, x11 - mul x11, x4, x8 - adcs x14, x14, x11 - mul x11, x4, x9 - adcs x0, x0, x11 - mul x11, x4, x10 - adcs x1, x1, x11 - umulh x3, x4, x10 - adc x3, x3, xzr - umulh x11, x4, x7 - adds x14, x14, x11 - umulh x11, x4, x8 - adcs x0, x0, x11 - umulh x11, x4, x9 - adcs x1, x1, x11 - adc x3, x3, xzr - mul x11, x5, x7 - adds x14, x14, x11 - mul x11, x5, x8 - adcs x0, x0, x11 - mul x11, x5, x9 - adcs x1, x1, x11 - mul x11, x5, x10 - adcs x3, x3, x11 - umulh x4, x5, x10 - adc x4, x4, xzr - umulh x11, x5, x7 - adds x0, x0, x11 - umulh x11, x5, x8 - adcs x1, x1, x11 - umulh x11, x5, x9 - adcs x3, x3, x11 - adc x4, x4, xzr - mul x11, x6, x7 - adds x0, x0, x11 - mul x11, x6, x8 - adcs x1, x1, x11 - mul x11, x6, x9 - adcs x3, x3, x11 - mul x11, x6, x10 - adcs x4, x4, x11 - umulh x5, x6, x10 - adc x5, x5, xzr - umulh x11, x6, x7 - adds x1, x1, x11 - umulh x11, x6, x8 - adcs x3, x3, x11 - umulh x11, x6, x9 - adcs x4, x4, x11 - adc x5, x5, xzr - lsl x11, x12, #32 - lsr x6, x12, #32 - subs x8, x11, x12 - sbc x7, x6, xzr - subs x13, x13, x8 - sbcs x14, x14, x7 - sbcs x0, x0, x11 - sbc x12, x12, x6 - lsl x11, x13, #32 - lsr x6, x13, #32 - subs x8, x11, x13 - sbc x7, x6, xzr - subs x14, x14, x8 - sbcs x0, x0, x7 - sbcs x12, x12, x11 - sbc x13, x13, x6 - lsl x11, x14, #32 - lsr x6, x14, #32 - subs x8, x11, x14 - sbc x7, x6, xzr - subs x0, x0, x8 - sbcs x12, x12, x7 - sbcs x13, x13, x11 - sbc x14, x14, x6 - lsl x11, x0, #32 - lsr x6, x0, #32 - subs x8, x11, x0 - sbc x7, x6, xzr - subs x12, x12, x8 - sbcs x13, x13, x7 - sbcs x14, x14, x11 - sbc x0, x0, x6 - adds x12, x12, x1 - adcs x13, x13, x3 - adcs x14, x14, x4 - adcs x0, x0, x5 - cset x8, hs - mov x11, #-0x100000000 - mov x6, #-0x100000001 - adds x1, x12, #0x1 - sbcs x3, x13, x11 - adcs x4, x14, xzr - sbcs x5, x0, x6 - sbcs xzr, x8, xzr - csel x12, x12, x1, lo - csel x13, x13, x3, lo - csel x14, x14, x4, lo - csel x0, x0, x5, lo - stp x12, x13, [sp, #0x60] - stp x14, x0, [sp, #0x70] - ldp x5, x6, [sp, #0x40] - ldp x4, x3, [sp, #0x20] - subs x5, x5, x4 - sbcs x6, x6, x3 - ldp x7, x8, [sp, #0x50] - ldp x4, x3, [sp, #0x30] - sbcs x7, x7, x4 - sbcs x8, x8, x3 - csetm x3, lo - adds x5, x5, x3 - and x4, x3, #0xffffffff00000000 - adcs x6, x6, x4 - adcs x7, x7, x3 - and x4, x3, #0xfffffffeffffffff - adc x8, x8, x4 - stp x5, x6, [x15, #0x40] - stp x7, x8, [x15, #0x50] - ldp x1, x2, [sp, #0x80] - lsl x0, x1, #2 - ldp x6, x7, [sp, #0xa0] - subs x0, x0, x6 - extr x1, x2, x1, #0x3e - sbcs x1, x1, x7 - ldp x3, x4, [sp, #0x90] - extr x2, x3, x2, #0x3e - ldp x6, x7, [sp, #0xb0] - sbcs x2, x2, x6 - extr x3, x4, x3, #0x3e - sbcs x3, x3, x7 - lsr x4, x4, #62 - sbc x4, x4, xzr - add x4, x4, #0x1 - lsl x5, x4, #32 - sub x6, x5, x4 - adds x0, x0, x4 - adcs x1, x1, x6 - adcs x2, x2, xzr - adcs x3, x3, x5 - csetm x4, lo - adds x0, x0, x4 - and x6, x4, #0xffffffff00000000 - adcs x1, x1, x6 - adcs x2, x2, x4 - and x5, x4, #0xfffffffeffffffff - adc x3, x3, x5 - stp x0, x1, [x15] - stp x2, x3, [x15, #0x10] - mov x1, #0x8 - mov x2, #-0x1 - ldp x9, x10, [sp] - subs x9, x2, x9 - mov x3, #-0x100000000 - sbcs x10, x3, x10 - ldp x11, x12, [sp, #0x10] - sbcs x11, x2, x11 - mov x4, #-0x100000001 - sbc x12, x4, x12 - lsl x3, x9, #3 - extr x4, x10, x9, #0x3d - extr x5, x11, x10, #0x3d - extr x6, x12, x11, #0x3d - lsr x7, x12, #61 - mov x1, #0x3 - ldp x9, x10, [sp, #0x60] - mul x8, x9, x1 - umulh x9, x9, x1 - adds x3, x3, x8 - mul x8, x10, x1 - umulh x10, x10, x1 - adcs x4, x4, x8 - ldp x11, x12, [sp, #0x70] - mul x8, x11, x1 - umulh x11, x11, x1 - adcs x5, x5, x8 - mul x8, x12, x1 - umulh x12, x12, x1 - adcs x6, x6, x8 - adc x7, x7, xzr - adds x4, x4, x9 - adcs x5, x5, x10 - adcs x6, x6, x11 - adc x7, x7, x12 - add x7, x7, #0x1 - lsl x8, x7, #32 - sub x9, x8, x7 - adds x3, x3, x7 - adcs x4, x4, x9 - adcs x5, x5, xzr - adcs x6, x6, x8 - csetm x7, lo - adds x3, x3, x7 - and x9, x7, #0xffffffff00000000 - adcs x4, x4, x9 - adcs x5, x5, x7 - and x8, x7, #0xfffffffeffffffff - adc x6, x6, x8 - stp x3, x4, [x15, #0x20] - stp x5, x6, [x15, #0x30] - CFI_INC_SP(192) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lsm2_montjscalarmul_alt_sm2_montjdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/README.md b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/README.md deleted file mode 100644 index 23697bc3b7c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/README.md +++ /dev/null @@ -1,23 +0,0 @@ -# Tutorials for s2n-bignum - -This directory includes examples for verifying Arm programs using s2n-bignum -and HOL Light. -To verify programs in x86, see `x86/tutorial`. - -### Unary reasoning - -1. `simple.ml`: Verifying a simple arithmetic property of a linear program. -2. `sequence.ml`: Verifying a program by splitting into smaller chunks. -3. `branch.ml`: Verifying a program that has a conditional branch. -4. `memory.ml`: Verifying a program that manipulates a memory. -5. `loop.ml`: Verifying a program that has a simple loop. -6. `bignum.ml`: Writing a specification of a program dealing with big numbers & proving it. -7. `rodata.ml`: Reading data from the read-only section. - -### Relational reasoning - -1. `rel_simp.ml`: Proving equivalence of two simple programs. -2. `rel_equivtac.ml`: Proving equivalence of two programs that have small differences. -3. `rel_reordertac.ml`: Proving equivalence of two programs where the second one has instructions reordered from that of the first one. -4. `rel_loop.ml`: Proving equivalence of two simple loops. -5. `rel_veceq.ml`: Proving equivalence of scalar vs. vectorized 128x128->256-bit squaring. diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/bignum.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/bignum.S deleted file mode 100644 index 0d72c06c338..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/bignum.S +++ /dev/null @@ -1,11 +0,0 @@ - ldp x2, x3, [x0] - ldp x4, x5, [x1] - cmp x2, x4 - bne bb_false - cmp x3, x5 - bne bb_false - mov x0, #1 - ret -bb_false: - mov x0, xzr - ret diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/bignum.ml b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/bignum.ml deleted file mode 100644 index a445b6d76ef..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/bignum.ml +++ /dev/null @@ -1,159 +0,0 @@ -(* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - *) - -(****************************************************************************** - An example that shows how to describe big numbers in a specification. -******************************************************************************) - -needs "arm/proofs/base.ml";; - -(* Let's prove that the following program - - 0: a9400c02 ldp x2, x3, [x0] - 4: a9401424 ldp x4, x5, [x1] - 8: eb04005f cmp x2, x4 - c: 540000a1 b.ne 20 // b.any - 10: eb05007f cmp x3, x5 - 14: 54000061 b.ne 20 // b.any - 18: d2800020 mov x0, #0x1 - 1c: d65f03c0 ret - -0000000000000020 : - 20: aa1f03e0 mov x0, xzr - 24: d65f03c0 ret - - .. returns 1 to x0 if a pair of 16-byte integers at buffer x0 and x1 - are equal, 0 otherwise. - Since this example uses 128 bit integers, we will use 'bignum_from_memory' - which will state that reading a memory buffer of a specified word number will - return some large natural number. -*) -let bignum_mc = define_assert_from_elf "bignum_mc" "arm/tutorial/bignum.o" [ - 0xa9400c02; (* arm_LDP X2 X3 X0 (Immediate_Offset (iword (&0))) *) - 0xa9401424; (* arm_LDP X4 X5 X1 (Immediate_Offset (iword (&0))) *) - 0xeb04005f; (* arm_CMP X2 X4 *) - 0x540000a1; (* arm_BNE (word 20) *) - 0xeb05007f; (* arm_CMP X3 X5 *) - 0x54000061; (* arm_BNE (word 12) *) - 0xd2800020; (* arm_MOV X0 (rvalue (word 1)) *) - 0xd65f03c0; (* arm_RET X30 *) - 0xaa1f03e0; (* arm_MOV X0 XZR *) - 0xd65f03c0 (* arm_RET X30 *) -];; - -(* -You can get the above OCaml list data structure from -`print_literal_from_elf "<.o file>"` or -`save_literal_from_elf "" "<.o file>"`. -*) - -(* ARM_MK_EXEC_RULE decodes the byte sequence into conjunction of - equalities between the bytes and instructions. *) -let EXEC = ARM_MK_EXEC_RULE bignum_mc;; - -let BIGNUM_SPEC = prove( - `forall pc retpc loc0 loc1 a b. - ensures arm - // Precondition - (\s. aligned_bytes_loaded s (word pc) bignum_mc /\ - read PC s = word pc /\ - read X30 s = word retpc /\ - read X0 s = word loc0 /\ - read X1 s = word loc1 /\ - // Read 2 words (=128bits) at loc0. It is equivalent to num a. - // Alternatively, this kind of condition can be written using - // bignum_of_wordlist which takes a list of 64-bit words. - bignum_from_memory (word loc0,2) s = a /\ - // Read 2 words (=128bits) at loc1. It is equivalent to num b. - bignum_from_memory (word loc1,2) s = b - ) - // Postcondition - (\s. read PC s = word retpc /\ - read X0 s = word (if a = b then 1 else 0)) - // Registers (and memory locations) that may change after execution - (MAYCHANGE [PC;X0;X2;X3;X4;X5] ,, MAYCHANGE SOME_FLAGS ,, - MAYCHANGE [events])`, - - REPEAT STRIP_TAC THEN - (* Convert 'bignum_from_memory' into 'memory :> bytes (..)'. - Also, expand SOME_FLAGS *) - REWRITE_TAC[BIGNUM_FROM_MEMORY_BYTES;SOME_FLAGS] THEN - (* Start symbolic execution with state 's0' *) - ENSURES_INIT_TAC "s0" THEN - (* Split the memory :> bytes .. into a pair of memory :> bytes64. - This is necessary to successfully encode the symbolic result of ldps. *) - BIGNUM_DIGITIZE_TAC "a_" `read (memory :> bytes (word loc0,8 * 2)) s0` THEN - BIGNUM_DIGITIZE_TAC "b_" `read (memory :> bytes (word loc1,8 * 2)) s0` THEN - - (* Symbolically run two ldp instructions *) - ARM_STEPS_TAC EXEC (1--2) THEN - (* Until first 'bne' *) - ARM_STEPS_TAC EXEC (3--4) THEN - - (* Recognize the if condition and create two subgoals . *) - FIRST_X_ASSUM MP_TAC THEN - COND_CASES_TAC THENL [ - (* The low 64 bits of a and b are different. *) - STRIP_TAC THEN - ARM_STEPS_TAC EXEC (5--6) THEN - (* Returned; Finalize symbolic execution. *) - ENSURES_FINAL_STATE_TAC THEN ASM_REWRITE_TAC[] THEN - (* From `~(val (word_sub a_0 b_0) = 0)` and `val a_0 + 2 EXP 64 * val a_1 = a`, - and `val b_0 + 2 EXP 64 * val b_1 = b`, - prove `~(a = b)`. *) - SUBGOAL_THEN `~(a:num = b)` (fun th -> REWRITE_TAC[th]) THEN - MAP_EVERY EXPAND_TAC ["a";"b"] THEN - (* VAL_WORD_SUB_EQ_0: |- !x y. val (word_sub x y) = 0 <=> val x = val y) *) - RULE_ASSUM_TAC (REWRITE_RULE [VAL_WORD_SUB_EQ_0]) THEN - (* EQ_DIVMOD: |- !p m n. m DIV p = n DIV p /\ m MOD p = n MOD p <=> m = n *) - ONCE_REWRITE_TAC[SPEC `2 EXP 64` (GSYM EQ_DIVMOD)] THEN - (* The first '.. DIV .. = .. DIV ..' part is irelevant. *) - MATCH_MP_TAC (TAUT (`~Q ==> ~(P /\ Q)`)) THEN - (* Simplfy! *) - SIMP_TAC[MOD_MULT_ADD;VAL_BOUND_64;ARITH_RULE`~(2 EXP 64 = 0)`] THEN - ASM_SIMP_TAC[MOD_LT;VAL_BOUND_64]; - - ALL_TAC - ] THEN - - (* The low 64 bits of a and b are equivalent. *) - (* Until the second 'bne' *) - STRIP_TAC THEN - ARM_STEPS_TAC EXEC (5--6) THEN - - (* Recognize the if condition and create two subgoals . *) - FIRST_X_ASSUM MP_TAC THEN - COND_CASES_TAC THENL [ - (* The high 64 bits of a and b are different. *) - STRIP_TAC THEN - ARM_STEPS_TAC EXEC (7--8) THEN - (* Returned; Finalize symbolic execution. *) - ENSURES_FINAL_STATE_TAC THEN ASM_REWRITE_TAC[] THEN - (* Proof pattern is similar to the first branch case *) - SUBGOAL_THEN `~(a:num = b)` (fun th -> REWRITE_TAC[th]) THEN - MAP_EVERY EXPAND_TAC ["a";"b"] THEN - (* VAL_WORD_SUB_EQ_0: |- !x y. val (word_sub x y) = 0 <=> val x = val y) *) - RULE_ASSUM_TAC (REWRITE_RULE [VAL_WORD_SUB_EQ_0]) THEN - (* EQ_DIVMOD: |- !p m n. m DIV p = n DIV p /\ m MOD p = n MOD p <=> m = n *) - ONCE_REWRITE_TAC[SPEC `2 EXP 64` (GSYM EQ_DIVMOD)] THEN - (* The second '.. MOD .. = .. MOD ..' part is irelevant. *) - MATCH_MP_TAC (TAUT (`~P ==> ~(P /\ Q)`)) THEN - (* Simplfy! *) - SIMP_TAC[DIV_MULT_ADD;VAL_BOUND_64;ARITH_RULE`~(2 EXP 64 = 0)`] THEN - ASM_SIMP_TAC[DIV_LT;VAL_BOUND_64;ADD_CLAUSES]; - - ALL_TAC - ] THEN - - (* Both limbs are equivalent! *) - STRIP_TAC THEN - ARM_STEPS_TAC EXEC (7--8) THEN - (* Try to prove the postcondition and frame as much as possible *) - ENSURES_FINAL_STATE_TAC THEN - (* Use ASM_REWRITE_TAC[] to rewrite the goal using equalities in assumptions. *) - ASM_REWRITE_TAC[] THEN - SUBGOAL_THEN `(a:num = b)` (fun th -> REWRITE_TAC[th]) THEN - RULE_ASSUM_TAC (REWRITE_RULE [VAL_WORD_SUB_EQ_0]) THEN - ASM_ARITH_TAC);; diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/branch.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/branch.S deleted file mode 100644 index 52f8d1f0ade..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/branch.S +++ /dev/null @@ -1,7 +0,0 @@ - cmp x1, x2 - b.hi BB2 - mov x0, x2 - ret -BB2: - mov x0, x1 - ret diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/branch.ml b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/branch.ml deleted file mode 100644 index 284cdfcc3f0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/branch.ml +++ /dev/null @@ -1,119 +0,0 @@ -(* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - *) - -(****************************************************************************** - Prove a property of a simple program that has a conditional branch. -******************************************************************************) - -needs "arm/proofs/base.ml";; - -(* The following program - 0: eb02003f cmp x1, x2 - 4: 54000068 b.hi 10 - 8: aa0203e0 mov x0, x2 - c: d65f03c0 ret - -0000000000000010 : - 10: aa0103e0 mov x0, x1 - 14: d65f03c0 ret - - .. copies max(x1,x2) to x0 and returns to the caller. - Let's prove this property. -*) - -let branch_mc = new_definition `branch_mc = [ - word 0x3f; word 0x00; word 0x02; word 0xeb; // cmp x1, x2 - word 0x68; word 0x00; word 0x00; word 0x54; // b.hi 10 - - word 0xe0; word 0x03; word 0x02; word 0xaa; // mov x0, x2 - word 0xc0; word 0x03; word 0x5f; word 0xd6; // ret - - // BB2: - word 0xe0; word 0x03; word 0x01; word 0xaa; // mov x0, x1 - word 0xc0; word 0x03; word 0x5f; word 0xd6 // ret - ]:((8)word)list`;; - -let EXEC = ARM_MK_EXEC_RULE branch_mc;; - -let branch_SPEC = prove( - `forall pc pcret a b. - ensures arm - // Precondition - (\s. aligned_bytes_loaded s (word pc) branch_mc /\ - read X30 s = word pcret /\ - read PC s = word pc /\ - read X1 s = word a /\ - read X2 s = word b) - // Postcondition - (\s. read PC s = word pcret /\ - read X0 s = word_umax (word a) (word b)) - // Registers (and memory locations) that may change after execution. - // ',,' is composition of relations. - (MAYCHANGE [PC;X0] ,, MAYCHANGE SOME_FLAGS ,, - // Branch instructions raise observable microarchitectural events! - MAYCHANGE [events])`, - (* Strips the outermost universal quantifier from the conclusion of a goal *) - REPEAT STRIP_TAC THEN - (* ENSURES_FINAL_STATE_TAC does not understand SOME_FLAGS in MAYCHANGE. Let's - unfold this in advance. *) - REWRITE_TAC [SOME_FLAGS] THEN - - (* Let's do symbolic execution until it hits the branch instruction. *) - ENSURES_INIT_TAC "s0" THEN - ARM_STEPS_TAC EXEC (1--2) THEN - - (* The PC has the following symbolic expression: - `read PC s2 = - (if val (word b) <= val (word a) /\ - ~(val (word_sub (word a) (word b)) = 0) - then word (pc + 16) - else word (pc + 8))` - Let's do case analysis on the condition of this if expression. - - First, move this assumption to the antecendent of the goal so the goal - becomes: - (read PC s2 = ...) ==> eventually arm ... - *) - FIRST_X_ASSUM MP_TAC THEN - - (* Recognize the if condition and create two subgoals . *) - COND_CASES_TAC THENL [ - (** Case 1: if the branch was taken! **) - (* Let's name the hypothesis first. *) - POP_ASSUM (LABEL_TAC "Hcond") THEN - DISCH_TAC THEN - - (* Do symbolic execution on the remaining two insts. *) - ARM_STEPS_TAC EXEC (3--4) THEN - ENSURES_FINAL_STATE_TAC THEN - ASM_REWRITE_TAC[] THEN - - (* The remaining goal is `word a = word (MAX a b).` *) - REMOVE_THEN "Hcond" MP_TAC THEN - (* WORD_UMAX: `!x y. word_umax x y = (if val x <= val y then y else x)` - VAL_WORD_SUB_EQ_0: `!x y. val (word_sub x y) = 0 <=> val x = val y` *) - REWRITE_TAC[WORD_UMAX;VAL_WORD_SUB_EQ_0] THEN - (* Let ARITH_TAC deal with reasoning on relational equations. *) - ARITH_TAC; - - - (** Case 2: if the branch was not taken! **) - (* Let's name the hypothesis first. *) - POP_ASSUM (LABEL_TAC "Hcond") THEN - DISCH_TAC THEN - - (* Do symbolic execution on the remaining two insts. *) - ARM_STEPS_TAC EXEC (3--4) THEN - ENSURES_FINAL_STATE_TAC THEN - ASM_REWRITE_TAC[] THEN - - (* The remaining goal is `word b = word (MAX a b).` *) - REMOVE_THEN "Hcond" MP_TAC THEN - (* WORD_UMAX: `!x y. word_umax x y = (if val x <= val y then y else x)` - VAL_WORD_SUB_EQ_0: `!x y. val (word_sub x y) = 0 <=> val x = val y` *) - REWRITE_TAC[WORD_UMAX;VAL_WORD_SUB_EQ_0] THEN - (* Let ARITH_TAC deal with reasoning on relational equations. *) - ARITH_TAC; - ]);; diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/loop.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/loop.S deleted file mode 100644 index 5872b164679..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/loop.S +++ /dev/null @@ -1,10 +0,0 @@ - mov x1, xzr - mov x0, xzr - -loop: - add x1, x1, #1 - add x0, x0, #2 - cmp x1, #10 - bne loop - - ret diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/loop.ml b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/loop.ml deleted file mode 100644 index 0fb56c44678..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/loop.ml +++ /dev/null @@ -1,123 +0,0 @@ -(* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - *) - -(****************************************************************************** - Prove a property of a simple program that has a loop. -******************************************************************************) - -needs "arm/proofs/base.ml";; - -(* The following program - 0: aa1f03e1 mov x1, xzr - 4: aa1f03e0 mov x0, xzr - -0000000000000008 : - 8: 91000421 add x1, x1, #0x1 - c: 91000800 add x0, x0, #0x2 - 10: f100283f cmp x1, #0xa - 14: 54ffffa1 b.ne 8 // b.any - 18: d65f03c0 ret - - increments x0 until its value is 20. - Let's prove that this function returns 20. -*) -let loop_mc = new_definition `loop_mc = [ - word 0xe1; word 0x03; word 0x1f; word 0xaa; // mov x1, xzr - word 0xe0; word 0x03; word 0x1f; word 0xaa; // mov x0, xzr - -// loop: - word 0x21; word 0x04; word 0x00; word 0x91; // add x1, x1, #0x1 - word 0x00; word 0x08; word 0x00; word 0x91; // add x0, x0, #0x2 - word 0x3f; word 0x28; word 0x00; word 0xf1; // cmp x1, #0xa - word 0xa1; word 0xff; word 0xff; word 0x54; // b.ne 8 - word 0xc0; word 0x03; word 0x5f; word 0xd6 // ret -]:((8)word)list`;; - -let EXEC = ARM_MK_EXEC_RULE loop_mc;; - -let loop_SPEC = prove( - `forall pc retpc. - ensures arm - // Precondition - (\s. aligned_bytes_loaded s (word pc) loop_mc /\ - read PC s = word pc /\ - read X30 s = word retpc) - // Postcondition - (\s. read PC s = word retpc /\ - read X0 s = word 20) - // Registers (and memory locations) that may change after execution - (MAYCHANGE [PC;X0;X1] ,, MAYCHANGE SOME_FLAGS ,, - // Branch instructions raise observable microarchitectural events! - MAYCHANGE [events])`, - (* Unravel ARM flag registers! *) - REWRITE_TAC[SOME_FLAGS] THEN - REPEAT STRIP_TAC THEN - - (* ENSURES_WHILE_PAUP_TAC is one of several tactics for declaring a hoare triple of a loop. - PAUP means: - - "P": The loop ends with a flag-setting instruction such as 'cmp' or 'adds'. - 'read ZF s <=> i = 10' in the below statement relates the flag with - the loop counter. - - "A": The loop counter starts from variable 'a', In this tactic, this is 0. - Actually, when a = 0, you can also use ENSURES_WHILE_PUP_TAC. - - "UP": The counter goes up. *) - ENSURES_WHILE_PAUP_TAC - `0` (* counter begin number *) - `10` (* counter end number *) - `pc + 8` (* loop body start PC *) - `pc + 0x14` (* loop backedge branch PC *) - `\i s. // loop invariant at the end of the loop - (read X1 s = word i /\ read X0 s = word (i*2) /\ read X30 s = word retpc) /\ - // loop backedge condition - (read ZF s <=> i = 10)` THEN - REPEAT CONJ_TAC THENL [ - (* counter begin < counter end *) - ARITH_TAC; - - (* entrance to the loop *) - (* Let's use ARM_SIM_TAC which is ENSURES_INIT_TAC + ARM_STEPS_TAC + - ENSURES_FINAL_STATE_TAC + some post-processing. *) - ARM_SIM_TAC EXEC (1--2) THEN - CONV_TAC WORD_RULE; - - (* The loop body. let's prove this later. *) - (* If you are interactively exploring this proof, try `r 1;;`. *) - ALL_TAC; - - (* Prove that backedge is taken if i != 10. *) - REPEAT STRIP_TAC THEN - ARM_SIM_TAC EXEC [1]; - - (* Loop exit to the end of the program *) - ARM_SIM_TAC EXEC (1--2) THEN - (* word (10*2) = word 20 *) - CONV_TAC WORD_RULE - ] THEN - - (* The loop body *) - REPEAT STRIP_TAC THEN - ARM_SIM_TAC EXEC (1--3) THEN - REPEAT CONJ_TAC THENL [ - (* `word_add (word i) (word 1) = word (i + 1)` *) - CONV_TAC WORD_RULE; - - (* `word_add (word (i * 2)) (word 2) = word ((i + 1) * 2)` *) - CONV_TAC WORD_RULE; - - (* `val (word_add (word i) (word 18446744073709551607)) = 0 <=> i + 1 = 10` *) - (* This goal is slightly complicated to prove using automatic solvers. - Let's manually attack this. *) - (* Yes, we also have 'WORD_BLAST' that works like bit-blasting. *) - REWRITE_TAC [WORD_BLAST `word_add x (word 18446744073709551607):int64 = - word_sub x (word 9)`] THEN - REWRITE_TAC[VAL_WORD_SUB_EQ_0] THEN - REWRITE_TAC[VAL_WORD;DIMINDEX_64] THEN - (* Rewrite all '_ MOD 2 EXP 64' to '_' because they are known to be less - than 2 EXP 64. *) - IMP_REWRITE_TAC[MOD_LT; ARITH_RULE`9 < 2 EXP 64`] THEN - CONJ_TAC THEN (* will create two arithmetic subgoals. *) - (* both goals can be solved using ASM_ARITH_TAC. *) - ASM_ARITH_TAC - ]);; diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/memory.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/memory.S deleted file mode 100644 index dd340152473..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/memory.S +++ /dev/null @@ -1,4 +0,0 @@ -ldr x2, [x0] -ldr x3, [x1] -str x2, [x1] -str x3, [x0] diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/memory.ml b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/memory.ml deleted file mode 100644 index 160298d71c1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/memory.ml +++ /dev/null @@ -1,75 +0,0 @@ -(* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - *) - -(****************************************************************************** - Prove a property of a simple program that reads from and writes to - the memory. -******************************************************************************) - -needs "arm/proofs/base.ml";; - -(* The following program - 0: f9400002 ldr x2, [x0] - 4: f9400023 ldr x3, [x1] - 8: f9000022 str x2, [x1] - c: f9000003 str x3, [x0] - - .. swaps the two words at address x0 and x1, of x0 and x1 do not alias. - Let's prove this. -*) - -let memory_mc = new_definition `memory_mc = [ - word 0x02; word 0x00; word 0x40; word 0xf9; // ldr x2, [x0] - word 0x23; word 0x00; word 0x40; word 0xf9; // ldr x3, [x1] - word 0x22; word 0x00; word 0x00; word 0xf9; // str x2, [x1] - word 0x03; word 0x00; word 0x00; word 0xf9 // str x3, [x0] -]:((8)word)list`;; - -let EXEC = ARM_MK_EXEC_RULE memory_mc;; - -let memory_SPEC = prove( - `forall pc loc0 loc1 a b. - // Assume that loc0 (=x0) and loc1(=x1) do not overlap within 8 bytes. - nonoverlapping (word loc0:int64, 8) (word loc1:int64, 8) /\ - // .. and the writing locations do not overlap with the loaded program. - nonoverlapping (word loc0:int64, 8) (word pc:int64, LENGTH memory_mc) /\ - nonoverlapping (word loc1:int64, 8) (word pc:int64, LENGTH memory_mc) - ==> ensures arm - // Precondition - (\s. aligned_bytes_loaded s (word pc) memory_mc /\ - read PC s = word pc /\ - read X0 s = word loc0 /\ - read X1 s = word loc1 /\ - read (memory :> bytes64 (word loc0)) s = word a /\ - read (memory :> bytes64 (word loc1)) s = word b) - // Postcondition - (\s. read PC s = word (pc + 16) /\ - read (memory :> bytes64 (word loc0)) s = word b /\ - read (memory :> bytes64 (word loc1)) s = word a) - // Registers (and memory locations) that may change after execution. - // ',,' is composition of relations. - (MAYCHANGE [PC;X2;X3] ,, - // The memory locations may change. Record this. - MAYCHANGE [memory :> bytes64 (word loc0); memory :> bytes64 (word loc1)] ,, - // Memory instructions raise observable microarchitectural events! - MAYCHANGE [events])`, - - (* Rewrite 'LENGTH memory_mc' with the concrete number. *) - REWRITE_TAC[fst EXEC] THEN - (* Strips the assumption and outermost universal quantifier from the conclusion of a goal *) - REPEAT STRIP_TAC THEN - - (* Let's do symbolic execution until it hits the branch instruction. *) - ENSURES_INIT_TAC "s0" THEN - ARM_STEPS_TAC EXEC (1--4) THEN - - ENSURES_FINAL_STATE_TAC THEN - ASM_REWRITE_TAC[]);; - -(* If the written nonoverlapping condition is not sufficient, existing assumptions - on memory loads may be erased after simulating store instructions. - To print which instructions are erased, set - components_print_log := true;; -*) diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_equivtac.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_equivtac.S deleted file mode 100644 index d1bbc0c2766..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_equivtac.S +++ /dev/null @@ -1,4 +0,0 @@ -ldp x11, x10, [x0] -add x12, x10, #1 -mul x12, x11, x12 // x11 * (x10 + 1) -str x12, [x1] diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_equivtac.ml b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_equivtac.ml deleted file mode 100644 index e12d7cd9881..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_equivtac.ml +++ /dev/null @@ -1,198 +0,0 @@ -(* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - *) - -(****************************************************************************** - An example that proves equivalence of two straight-line codes - accessing memory using EQUIV_STEPS_TAC. -******************************************************************************) - -(* Please copy this file to the root directory of - s2n-bignum, then follow the instructions. *) - -needs "arm/proofs/equiv.ml";; - -(* This example will define & prove the equivalence of two programs - using EQUIV_STEPS_TAC. - This tactic is useful if two programs are supposed to have many - equivalent parts. EQUIV_STEPS_TAC receives 'actions', which is an - OCaml list stating which lines are equivalent and which lines are diverging. - This 'actions' can be generated from, say, syntactic diff of - two assembly programs. s2n-bignum also has tools/gen-actions.py - which runs the `diff` linux tool on two assembly files. *) - -let mc = define_assert_from_elf "mc" "arm/tutorial/rel_equivtac.o" [ - 0xa940280b; (* arm_LDP X11 X10 X0 (Immediate_Offset (iword (&0))) *) - 0x9100054c; (* arm_ADD X12 X10 (rvalue (word 1)) *) - 0x9b0c7d6c; (* arm_MUL X12 X11 X12 *) - 0xf900002c (* arm_STR X12 X1 (Immediate_Offset (word 0)) *) -];; - -(* Note that the used registers are different between mc and mc2 - (X10,X11,X12 vs. X20,X21,X22). This is fine since EQUIV_STEPS_TAC - can smartly map differently used registers. *) -let mc2 = define_assert_from_elf "mc2" "arm/tutorial/rel_equivtac2.o" [ - 0xa9405015; (* arm_LDP X21 X20 X0 (Immediate_Offset (iword (&0))) *) - 0x9b147eb6; (* arm_MUL X22 X21 X20 *) - 0x8b1502d6; (* arm_ADD X22 X22 X21 *) - 0xf9000036 (* arm_STR X22 X1 (Immediate_Offset (word 0)) *) -];; - -let EXEC = ARM_MK_EXEC_RULE mc;; -let EXEC2 = ARM_MK_EXEC_RULE mc2;; - -(* Define the equality between the input states. *) -let eqin = new_definition - `forall s1 s1' inbuf outbuf. - (eqin:(armstate#armstate)->int64->int64->bool) (s1,s1') inbuf outbuf <=> - (// The values of buffer pointers, X0 and X1. - // Their values are symbolically defined as inbuf and outbuf. - // outbuf is also used for the nonoverlapping precondition between - // the output buffer and the program bytecode. - read X0 s1 = inbuf /\ - read X0 s1' = inbuf /\ - read X1 s1 = outbuf /\ - read X1 s1' = outbuf /\ - // The equal buffer contents at the input buffer. '2' stands for 2 words - // (and 1 word is 8 bytes, hence 2*8=16 bytes) - (exists n. - bignum_from_memory (inbuf,2) s1 = n /\ - bignum_from_memory (inbuf,2) s1' = n))`;; - -(* Define the equality between the output states. *) -let eqout = new_definition - `forall s1 s1' outbuf. - (eqout:(armstate#armstate)->int64->bool) (s1,s1') outbuf <=> - (read X1 s1 = outbuf /\ - read X1 s1' = outbuf /\ - (exists n. - bignum_from_memory (outbuf,1) s1 = n /\ - bignum_from_memory (outbuf,1) s1' = n))`;; - -(* Now, build the program equivalence statement using - 'mk_equiv_statement_simple'. - Its first argument states the assumption that will appear at - LHS of ' ==> ensures2 ..(equiv statement)..'. - - If it fails, please try `arm_print_log := true`. *) -let equiv_goal = mk_equiv_statement_simple - `ALL (nonoverlapping (outbuf,8)) [ - (word pc:int64, LENGTH mc); - (word pc2:int64, LENGTH mc2) - ]` - eqin (* Input state equivalence *) - eqout (* Output state equivalence *) - mc (* First program machine code *) - `MAYCHANGE [PC; X10; X11; X12] ,, MAYCHANGE [memory :> bytes (outbuf, 8)] ,, - MAYCHANGE [events]` - mc2 (* Second program machine code *) - `MAYCHANGE [PC; X20; X21; X22] ,, MAYCHANGE [memory :> bytes (outbuf, 8)] ,, - MAYCHANGE [events]`;; - -(* equiv_goal is: - `forall pc pc2 inbuf outbuf. - ALL (nonoverlapping (outbuf,8)) - [word pc,LENGTH mc; word pc2,LENGTH mc2] - ==> ensures2 arm - (\(s,s2). - aligned_bytes_loaded s (word pc) mc /\ - read PC s = word pc /\ - aligned_bytes_loaded s2 (word pc2) mc2 /\ - read PC s2 = word pc2 /\ - eqin (s,s2) inbuf outbuf) - (\(s,s2). - aligned_bytes_loaded s (word pc) mc /\ - read PC s = word (pc + 16) /\ - aligned_bytes_loaded s2 (word pc2) mc2 /\ - read PC s2 = word (pc2 + 16) /\ - eqout (s,s2) outbuf) - (\(s,s2) (s',s2'). - (MAYCHANGE [PC; X10; X11; X12] ,, - MAYCHANGE [memory :> bytes (outbuf,8)] ,, - MAYCHANGE [events]) - s - s' /\ - (MAYCHANGE [PC; X20; X21; X22] ,, - MAYCHANGE [memory :> bytes (outbuf,8)] ,, - MAYCHANGE [events]) - s2 - s2') - (\s. 4) - (\s. 4)` -*) - -(* Now, let's prove the program equivalence. *) -let EQUIV = prove(equiv_goal, - - (* Rewrite ALL and LENGTH * *) - REWRITE_TAC[ALL; fst EXEC; fst EXEC2] THEN - REPEAT STRIP_TAC THEN - - (** Initialize **) - EQUIV_INITIATE_TAC eqin THEN - RULE_ASSUM_TAC (REWRITE_RULE[BIGNUM_FROM_MEMORY_BYTES]) THEN - - (* Do symbolic simulations on the two programs using EQUIV_STEPS_TAC. - As explained before, the action is an OCaml list. - Each item describes: - - ("equal",begin line number of program 1 (start from 0), - end line number of program 1 (not inclusive), - begin line number of program 2, - end line number of program 2) - : means that these instructions in program 1 and program 2 must - yield sysmbolically equivalent output. Therefore, EQUIV_STEPS_TAC - uses a lock-step simulation for these. - If the symbolic outputs of the matching instructions are not having - equal expression, it will print an error message. - Actually, it tries to solve a simple bit-vector equality such as - 'x * (y + 1) = x * y + x', - and can succeed. This is exactly the example case here. - - ("replace",beign line number of program 1, - end line number of program 1 (not inclusive), - begin line number of program 2, - end line number of program 2) - : means that these instructions in program 1 and 2 differ. - EQUIV_STEPS_TAC uses stuttering simulations for each program. - *) - EQUIV_STEPS_TAC [ - ("equal",0,1,0,1); - ("replace",1,3,1,3); - ("equal",3,4,3,4) - ] EXEC EXEC2 THEN - - REPEAT_N 2 ENSURES_FINAL_STATE_TAC THEN - (* Prove remaining clauses from the postcondition *) - ASM_REWRITE_TAC[] THEN - (* This tactic below is typically fixed and probably you will want to reuse. :) *) - CONJ_TAC THENL [ - (** SUBGOAL 1. Outputs **) - ASM_REWRITE_TAC[eqout; - BIGNUM_EXPAND_CONV `bignum_from_memory (outbuf,1) s`] THEN - REPEAT (HINT_EXISTS_REFL_TAC THEN ASM_REWRITE_TAC[]); - - (** SUBGOAL 2. Maychange pair **) - MONOTONE_MAYCHANGE_CONJ_TAC - ]);; - -(* - If the EQUIV_STEPS_TAC fails to prove that instructions that are supposed - to be equivalent according to actions are yielding equal output expressions, - it will print a message like this: - - ARM_LOCKSTEP_TAC (4,4) - Running left... - Running right... - 1 basis elements and 0 critical pairs - - Error: WORD_RULE could not prove - ` = ` - - If you are certain that these expressions must be equal, you can improve - `extra_word_CONV` of symbolic simulator by adding a custom word equation - to extra_word_CONV. - - ``` - let org_convs = !extra_word_CONV;; - extra_word_CONV := (GEN_REWRITE_CONV I [])::org_convs;; - ``` -*) diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_equivtac2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_equivtac2.S deleted file mode 100644 index 39f772cf54b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_equivtac2.S +++ /dev/null @@ -1,4 +0,0 @@ -ldp x21, x20, [x0] -mul x22, x21, x20 -add x22, x22, x21 // x21 * x20 + x21 -str x22, [x1] diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_loop.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_loop.S deleted file mode 100644 index 46aac446e30..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_loop.S +++ /dev/null @@ -1,6 +0,0 @@ -loop: -add x2, x2, #2 -add x0, x0, #1 -cmp x0, x1 -bne loop - diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_loop.ml b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_loop.ml deleted file mode 100644 index 7d367c07f4e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_loop.ml +++ /dev/null @@ -1,151 +0,0 @@ -(* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - *) - -(****************************************************************************** - An example that proves equivalence of two loops. -******************************************************************************) - -needs "arm/proofs/equiv.ml";; - -(* Prove that these two loops are equivalent in the sense that the results of - two X2 are same. *) - -let loop_mc = define_assert_from_elf "loop_mc" "arm/tutorial/rel_loop.o" [ - 0x91000842; (* arm_ADD X2 X2 (rvalue (word 2)) *) - 0x91000400; (* arm_ADD X0 X0 (rvalue (word 1)) *) - 0xeb01001f; (* arm_CMP X0 X1 *) - 0x54ffffa1 (* arm_BNE (word 2097140) *) -];; - -let loop2_mc = define_assert_from_elf "loop2_mc" "arm/tutorial/rel_loop2.o" [ - 0x91000442; (* arm_ADD X2 X2 (rvalue (word 1)) *) - 0x91000442; (* arm_ADD X2 X2 (rvalue (word 1)) *) - 0x91000400; (* arm_ADD X0 X0 (rvalue (word 1)) *) - 0xeb01001f; (* arm_CMP X0 X1 *) - 0x54ffff81 (* arm_BNE (word 2097136) *) -];; - -let LOOP_EXEC = ARM_MK_EXEC_RULE loop_mc;; -let LOOP2_EXEC = ARM_MK_EXEC_RULE loop2_mc;; - -(* For relational reasoning, we use predicates and tactics that are slightly - different from those for unary reasoning. *) - -let LOOP_EQUIV = prove( - `forall pc1 pc2 n. - n > 0 /\ n < 2 EXP 64 ==> - // Relational hoare triple. - ensures2 arm - // Precondition - (\(s1,s2). aligned_bytes_loaded s1 (word pc1) loop_mc /\ - read PC s1 = word pc1 /\ - aligned_bytes_loaded s2 (word pc2) loop2_mc /\ - read PC s2 = word pc2 /\ - // X0 is the induction variable and X1 is n. - (read X0 s1 = word 0 /\ read X0 s2 = word 0 /\ - read X1 s1 = word n /\ read X1 s2 = word n /\ - // X2 must start equal. - (?k. read X2 s1 = k /\ read X2 s2 = k))) - // Postcondition - (\(s1,s2). aligned_bytes_loaded s1 (word pc1) loop_mc /\ - read PC s1 = word (pc1 + 12) /\ - aligned_bytes_loaded s2 (word pc2) loop2_mc /\ - read PC s2 = word (pc2 + 16) /\ - // They finish with an equal value. - (?k. read X2 s1 = k /\ read X2 s2 = k)) - // State components that may change. - (\(s1,s2) (s1',s2'). - (MAYCHANGE [PC;X0;X2] ,, MAYCHANGE SOME_FLAGS ,, MAYCHANGE [events]) s1 s1' /\ - (MAYCHANGE [PC;X0;X2] ,, MAYCHANGE SOME_FLAGS ,, MAYCHANGE [events]) s2 s2') - // The number of small steps of the 'left' program and 'right' program. - (\s. 4 * n - 1) (\s. 5 * n - 1)`, - - REPEAT STRIP_TAC THEN REWRITE_TAC[SOME_FLAGS] THEN - (* Look at the definition of ENSURES2_WHILE_PAUP_TAC in arm/proofs/equiv.ml - to understand the meanings of arguments. *) - ENSURES2_WHILE_PAUP_TAC `0:num` `n:num` `pc1:num` `pc1+12` `pc2:num` `pc2+16` - `\(i:num) s1 s2. - read X0 s1 = word i /\ read X0 s2 = word i /\ - read X1 s1 = word n /\ read X1 s2 = word n /\ - (?k. read X2 s1 = k /\ read X2 s2 = k)` - `\(i:num) s. read ZF s <=> (word i:int64) = word n` - `\(i:num) s. read ZF s <=> (word i:int64) = word n` - `\(i:num). 3` - `\(i:num). 4` - `0` `0` `0` `0` `1` `1` THEN - REPEAT CONJ_TAC THENL [ - (* # loop itrs > 0 *) - ASM_ARITH_TAC; - - (* pre *) - MATCH_MP_TAC ENSURES2_TRIVIAL THEN - REWRITE_TAC[FORALL_PAIR_THM] THEN - REPEAT GEN_TAC THEN - MONOTONE_MAYCHANGE_CONJ_TAC; - - (* now the main loop! *) - REPEAT STRIP_TAC THEN - (* Start symbolic execution of two programs. *) - ENSURES2_INIT_TAC "s0" "s0'" THEN - - FIRST_X_ASSUM (MP_TAC o (check (is_exists o concl))) THEN - STRIP_TAC THEN - REWRITE_TAC[GSYM CONJ_ASSOC] THEN - - (* Symbolically execute the left program only. *) - ARM_N_STUTTER_LEFT_TAC LOOP_EXEC (1--3) None THEN - (* Symbolically execute the right program only. *) - ARM_N_STUTTER_RIGHT_TAC LOOP2_EXEC (1--4) "'" None THEN - (* Let's prove the postcondition. *) - REPEAT_N 2 ENSURES_FINAL_STATE_TAC THEN - ASM_REWRITE_TAC[WORD_ADD] THEN - - CONJ_TAC THENL [ - CONJ_TAC THENL [ - META_EXISTS_TAC THEN UNIFY_REFL_TAC; - REWRITE_TAC[VAL_EQ_0] THEN CONV_TAC WORD_RULE; - ]; - - MONOTONE_MAYCHANGE_CONJ_TAC - ]; - - (* backedge *) - REPEAT STRIP_TAC THEN - ENSURES2_INIT_TAC "s0" "s0'" THEN - UNDISCH_TAC `?k. read X2 s0 = k /\ read X2 s0' = k` THEN - STRIP_TAC THEN - REWRITE_TAC[GSYM CONJ_ASSOC] THEN - - ARM_N_STUTTER_LEFT_TAC LOOP_EXEC (1--1) None THEN - ARM_N_STUTTER_RIGHT_TAC LOOP2_EXEC (1--1) "'" None THEN - REPEAT_N 2 ENSURES_FINAL_STATE_TAC THEN - ASM_REWRITE_TAC[WORD_ADD] THEN - - SUBGOAL_THEN `(word i:int64 = word n) <=> F` SUBST_ALL_TAC THENL [ - REWRITE_TAC[WORD_EQ;CONG;DIMINDEX_64] THEN - IMP_REWRITE_TAC[MOD_LT] THEN ASM_ARITH_TAC; - - ALL_TAC - ] THEN - REWRITE_TAC[] THEN - CONJ_TAC THENL [ - - META_EXISTS_TAC THEN UNIFY_REFL_TAC; - - MONOTONE_MAYCHANGE_CONJ_TAC - ]; - - (* postcond *) - MATCH_MP_TAC ENSURES2_TRIVIAL THEN - REWRITE_TAC[FORALL_PAIR_THM] THEN - CONJ_TAC THENL [MESON_TAC[]; ALL_TAC] THEN - REPEAT GEN_TAC THEN MONOTONE_MAYCHANGE_CONJ_TAC; - - (* counter 1 *) - REWRITE_TAC[NSUM_CONST_NUMSEG] THEN ASM_ARITH_TAC; - - (* counter 2 *) - REWRITE_TAC[NSUM_CONST_NUMSEG] THEN ASM_ARITH_TAC; - ]);; diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_loop2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_loop2.S deleted file mode 100644 index 60e78c5354d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_loop2.S +++ /dev/null @@ -1,7 +0,0 @@ -loop: -add x2, x2, #1 -add x2, x2, #1 -add x0, x0, #1 -cmp x0, x1 -bne loop - diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_reordertac.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_reordertac.S deleted file mode 100644 index ff10c42eef8..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_reordertac.S +++ /dev/null @@ -1,6 +0,0 @@ -ldr x10, [x0] -add x10, x10, #1 -str x10, [x1] -ldr x10, [x0, #8] -add x10, x10, #2 -str x10, [x1, #8] diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_reordertac.ml b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_reordertac.ml deleted file mode 100644 index 0689d95233a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_reordertac.ml +++ /dev/null @@ -1,187 +0,0 @@ -(* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - *) - -(****************************************************************************** - An example that proves equivalence of two straight-line codes - whose instructions are shuffled. -******************************************************************************) - -(* Please copy this file to the root directory of - s2n-bignum, then follow the instructions. *) - -needs "arm/proofs/equiv.ml";; - -(* This example will define & prove the equivalence of two programs - whose instructions are reordered, using ARM_N_STEPS_AND_ABBREV_TAC and - ARM_N_STEPS_AND_REWRITE_TAC. - These tactics receive the mapping between the lines of instructions - of the two programs (which is an OCaml integer list). - ARM_N_STEPS_AND_ABBREV_TAC symbolically simulates the "left" program, - introduces abbreviations of the output symbolic expressions of each - instruction, and stores it to an OCaml reference variable. - ARM_N_STEPS_AND_REWRITE_TAC symbolically simulates the "right" program, - finds the right abbreviation expression according to the line-number - mapping information, and rewrites the output expressions using the matched - abbreviation. *) - -let mc = define_assert_from_elf "mc" "arm/tutorial/rel_reordertac.o" [ - 0xf940000a; (* arm_LDR X10 X0 (Immediate_Offset (word 0)) *) - 0x9100054a; (* arm_ADD X10 X10 (rvalue (word 1)) *) - 0xf900002a; (* arm_STR X10 X1 (Immediate_Offset (word 0)) *) - 0xf940040a; (* arm_LDR X10 X0 (Immediate_Offset (word 8)) *) - 0x9100094a; (* arm_ADD X10 X10 (rvalue (word 2)) *) - 0xf900042a (* arm_STR X10 X1 (Immediate_Offset (word 8)) *) -];; - -(* Note that the used registers are different between mc and mc2 - (X10 vs. X10,X11). This is fine since the tactics can smartly - map the registers. - Also, this reordering is correct only of [X0, X0+16) is disjoint with - [X1, X1+16). We will have this as an assumption in the equivalence - goal. *) -let mc2 = define_assert_from_elf "mc2" "arm/tutorial/rel_reordertac2.o" [ - 0xf940000a; (* arm_LDR X10 X0 (Immediate_Offset (word 0)) *) - 0xf940040b; (* arm_LDR X11 X0 (Immediate_Offset (word 8)) *) - 0x9100054a; (* arm_ADD X10 X10 (rvalue (word 1)) *) - 0x9100096b; (* arm_ADD X11 X11 (rvalue (word 2)) *) - 0xf900002a; (* arm_STR X10 X1 (Immediate_Offset (word 0)) *) - 0xf900042b (* arm_STR X11 X1 (Immediate_Offset (word 8)) *) -];; - -let EXEC = ARM_MK_EXEC_RULE mc;; -let EXEC2 = ARM_MK_EXEC_RULE mc2;; - -(* Define the equality between the input states. *) -let eqin = new_definition - `forall s1 s1' inbuf outbuf. - (eqin:(armstate#armstate)->int64->int64->bool) (s1,s1') inbuf outbuf <=> - (// The values of buffer pointers, X0 and X1. - // Their values are symbolically defined as inbuf and outbuf. - // outbuf is also used for the nonoverlapping precondition between - // the output buffer and the program bytecode. - read X0 s1 = inbuf /\ - read X0 s1' = inbuf /\ - read X1 s1 = outbuf /\ - read X1 s1' = outbuf /\ - // The equal buffer contents at the input buffer. '2' stands for 2 words - // (and 1 word is 8 bytes, hence 2*8=16 bytes) - (exists n. - bignum_from_memory (inbuf,2) s1 = n /\ - bignum_from_memory (inbuf,2) s1' = n))`;; - -(* Define the equality between the output states. *) -let eqout = new_definition - `forall s1 s1' inbuf outbuf. - (eqout:(armstate#armstate)->int64->int64->bool) (s1,s1') inbuf outbuf <=> - (read X0 s1 = inbuf /\ - read X0 s1' = inbuf /\ - read X1 s1 = outbuf /\ - read X1 s1' = outbuf /\ - (exists n. - bignum_from_memory (inbuf,2) s1 = n /\ - bignum_from_memory (inbuf,2) s1' = n) /\ - (exists n. - bignum_from_memory (outbuf,2) s1 = n /\ - bignum_from_memory (outbuf,2) s1' = n))`;; - -(* Now, build the program equivalence statement using - 'mk_equiv_statement_simple'. - Its first argument states the assumption that will appear at - LHS of ' ==> ensures2 ..(equiv statement)..'. - - If it fails, please try `arm_print_log := true`. *) -let equiv_goal = mk_equiv_statement_simple - `ALL (nonoverlapping (outbuf,16)) [ - (word pc:int64, LENGTH mc); - (word pc2:int64, LENGTH mc2); - (inbuf:int64, 16) - ]` - eqin (* Input state equivalence *) - eqout (* Output state equivalence *) - mc (* First program machine code *) - `MAYCHANGE [PC; X10] ,, MAYCHANGE [memory :> bytes (outbuf, 16)] ,, MAYCHANGE [events]` - mc2 (* Second program machine code *) - `MAYCHANGE [PC; X10; X11] ,, MAYCHANGE [memory :> bytes (outbuf, 16)] ,, MAYCHANGE [events]`;; - -(* equiv_goal is: - `forall pc pc2 inbuf outbuf. - ALL (nonoverlapping (outbuf,16)) - [word pc,LENGTH mc; word pc2,LENGTH mc2; inbuf,16] - ==> ensures2 arm - (\(s,s2). - aligned_bytes_loaded s (word pc) mc /\ - read PC s = word pc /\ - aligned_bytes_loaded s2 (word pc2) mc2 /\ - read PC s2 = word pc2 /\ - eqin (s,s2) inbuf outbuf) - (\(s,s2). - aligned_bytes_loaded s (word pc) mc /\ - read PC s = word (pc + 24) /\ - aligned_bytes_loaded s2 (word pc2) mc2 /\ - read PC s2 = word (pc2 + 24) /\ - eqout (s,s2) inbuf outbuf) - (\(s,s2) (s',s2'). - (MAYCHANGE [PC; X10] ,, - MAYCHANGE [memory :> bytes (outbuf,16)] ,, - MAYCHANGE [events]) - s - s' /\ - (MAYCHANGE [PC; X10; X11] ,, - MAYCHANGE [memory :> bytes (outbuf,16)] ,, - MAYCHANGE [events]) - s2 - s2') - (\s. 6) - (\s. 6)` -*) - -(* Line numbers from the second program (mc2) to the first program (mc1). *) -let inst_map = [1;4;2;5;3;6];; - -(* (state number, (equation, fresh var)) *) -let state_to_abbrevs: (int * thm) list ref = ref [];; - -(* Now, let's prove the program equivalence. *) -let EQUIV = prove(equiv_goal, - - (* Rewrite ALL and LENGTH * *) - REWRITE_TAC[ALL; fst EXEC; fst EXEC2] THEN - REPEAT STRIP_TAC THEN - - (** Initialize **) - EQUIV_INITIATE_TAC eqin THEN - RULE_ASSUM_TAC (REWRITE_RULE[BIGNUM_FROM_MEMORY_BYTES]) THEN - - (* Left *) - ARM_N_STEPS_AND_ABBREV_TAC EXEC (1--(List.length inst_map)) - state_to_abbrevs None THEN - - (* Right *) - ARM_N_STEPS_AND_REWRITE_TAC EXEC2 (1--(List.length inst_map)) - inst_map state_to_abbrevs None THEN - - (* Running the statements above step by step will raise an error - message saying that the tactic is not VALID. You can temporarily - disable the message by redefining 'e' as follows: - - let e tac = refine(by(tac));; - - The whole proof ("prove(...)") will still run okay. - *) - - REPEAT_N 2 ENSURES_FINAL_STATE_TAC THEN - (* Prove remaining clauses from the postcondition *) - ASM_REWRITE_TAC[] THEN - (* This tactic below is typically fixed and probably you will want to reuse. :) *) - CONJ_TAC THENL [ - (** SUBGOAL 1. Outputs **) - ASM_REWRITE_TAC[eqout; - BIGNUM_EXPAND_CONV `bignum_from_memory (outbuf,2) s`] THEN - REPEAT CONJ_TAC THEN - REPEAT (HINT_EXISTS_REFL_TAC THEN ASM_REWRITE_TAC[]); - - (** SUBGOAL 2. Maychange pair **) - MONOTONE_MAYCHANGE_CONJ_TAC - ]);; diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_reordertac2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_reordertac2.S deleted file mode 100644 index a58c3e01ee7..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_reordertac2.S +++ /dev/null @@ -1,6 +0,0 @@ -ldr x10, [x0] -ldr x11, [x0, #8] -add x10, x10, #1 -add x11, x11, #2 -str x10, [x1] -str x11, [x1, #8] diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_simp.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_simp.S deleted file mode 100644 index 1d1d8f2b40c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_simp.S +++ /dev/null @@ -1,3 +0,0 @@ -add x0, x0, #1 -add x1, x1, #2 -add x0, x0, #3 diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_simp.ml b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_simp.ml deleted file mode 100644 index 10e537e1ebd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_simp.ml +++ /dev/null @@ -1,95 +0,0 @@ -(* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - *) - -(****************************************************************************** - An example that proves equivalence of two straight-line codes. -******************************************************************************) - -(* Please copy this file to the root directory of - s2n-bignum, then follow the instructions. *) - -needs "arm/proofs/equiv.ml";; - -(* Prove that given x0 and x1 are equal, their final results are also equal. *) - -let simp_mc = define_assert_from_elf "simp_mc" "arm/tutorial/rel_simp.o" [ - 0x91000400; (* arm_ADD X0 X0 (rvalue (word 1)) *) - 0x91000821; (* arm_ADD X1 X1 (rvalue (word 2)) *) - 0x91000c00 (* arm_ADD X0 X0 (rvalue (word 3)) *) -];; - -let simp2_mc = define_assert_from_elf "simp2_mc" "arm/tutorial/rel_simp2.o" [ - 0x91001000; (* arm_ADD X0 X0 (rvalue (word 4)) *) - 0x91000821 (* arm_ADD X1 X1 (rvalue (word 2)) *) -];; - -let SIMP_EXEC = ARM_MK_EXEC_RULE simp_mc;; -let SIMP2_EXEC = ARM_MK_EXEC_RULE simp2_mc;; - -(* For relational reasoning, we use predicates and tactics that are slightly - different from those for unary reasoning. *) - -let SIMP_EQUIV = prove( - `forall pc1 pc2 a b. - // Relational hoare triple. - ensures2 arm - // Precondition - (\(s1,s2). aligned_bytes_loaded s1 (word pc1) simp_mc /\ - read PC s1 = word pc1 /\ - aligned_bytes_loaded s2 (word pc2) simp2_mc /\ - read PC s2 = word pc2 /\ - // X0 and X1 start equal. - read X0 s1 = a /\ read X0 s2 = a /\ - read X1 s1 = b /\ read X1 s2 = b) - // Postcondition - (\(s1,s2). aligned_bytes_loaded s1 (word pc1) simp_mc /\ - read PC s1 = word (pc1 + 12) /\ - aligned_bytes_loaded s2 (word pc2) simp2_mc /\ - read PC s2 = word (pc2 + 8) /\ - // They finish with an equal value. - (?k. read X0 s1 = k /\ read X0 s2 = k) /\ - (?k2. read X1 s1 = k2 /\ read X1 s2 = k2)) - // State components that may change. - (\(s1,s2) (s1',s2'). - // PC,X0,X1 may change in the left program - MAYCHANGE [PC;X0;X1] s1 s1' /\ - // .. and in the right program as well. - MAYCHANGE [PC;X0;X1] s2 s2') - // The number of small steps of the 'left' program and 'right' program. - // 'ensures2' needs the number of small steps taken to reach at the - // postcondition. Similarly, 'ensures_n' is a unary predicate similar to - // 'ensures' but takes the number of steps too. 'ensures_n' will not - // appear in this example. - (\s. 3) (\s. 2)`, - - REPEAT STRIP_TAC THEN - (* Start symbolic execution of the two programs! The left program's initial - state is named as s0, and the right is s0'. *) - ENSURES2_INIT_TAC "s0" "s0'" THEN - - (* Symbolically execute the left program only. *) - ARM_N_STUTTER_LEFT_TAC SIMP_EXEC (1--3) None THEN - (* Symbolically execute the right program only. "'" is the suffix of the - state name. *) - ARM_N_STUTTER_RIGHT_TAC SIMP2_EXEC (1--2) "'" None THEN - - (* Let's prove the postcondition. *) - REPEAT_N 2 ENSURES_FINAL_STATE_TAC THEN - ASM_REWRITE_TAC[] THEN - - CONJ_TAC THENL [ - (* ((?k. word_add a (word 4) = k) - Actually, simplification procedure in symbolic execution tactic already - folded 'word_add (word_add a (word 1)) (word 3)' into - 'word_add a (word 4)'. *) - (* META_EXISTS_TAC is somewhat similar to eexists in Coq. *) - CONJ_TAC THENL [ - META_EXISTS_TAC THEN UNIFY_REFL_TAC; - META_EXISTS_TAC THEN UNIFY_REFL_TAC; - ]; - - (* Maychange pair *) - MONOTONE_MAYCHANGE_CONJ_TAC - ]);; diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_simp2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_simp2.S deleted file mode 100644 index f8d7753cc04..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_simp2.S +++ /dev/null @@ -1,2 +0,0 @@ -add x0, x0, #4 -add x1, x1, #2 diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_veceq.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_veceq.S deleted file mode 100644 index e60e6235da0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_veceq.S +++ /dev/null @@ -1,28 +0,0 @@ -#define a0 x10 -#define a1 x11 -#define res0 x20 -#define res1 x21 -#define res2 x22 -#define res3 x23 -#define res1t x27 -#define res2t x28 -#define res3t x29 -#define a0a0_hi x12 -#define a0a1_lo x13 -#define a0a1_hi x14 -#define a1a1_lo x15 -#define a1a1_hi x16 - -ldp a0, a1, [x1] -mul res0, a0, a0 -umulh a0a0_hi, a0, a0 -mul a0a1_lo, a0, a1 -umulh a0a1_hi, a0, a1 -mul a1a1_lo, a1, a1 -umulh a1a1_hi, a1, a1 -adds res1t, a0a0_hi, a0a1_lo -adcs res2t, a1a1_lo, a0a1_hi -adc res3t, a1a1_hi, xzr -adds res1, res1t, a0a1_lo -adcs res2, res2t, a0a1_hi -adc res3, res3t, xzr diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_veceq.ml b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_veceq.ml deleted file mode 100644 index fda11cd35c2..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_veceq.ml +++ /dev/null @@ -1,148 +0,0 @@ -(* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - *) - -(****************************************************************************** - An example that proves the equivalence of - two implementations of 128x128->256-bit squaring. -******************************************************************************) - -needs "arm/proofs/equiv.ml";; -(* neon_helper.ml has lemmas and tactics that are useful to prove programs - manipulating SIMD registers. *) -needs "arm/proofs/neon_helper.ml";; - -(* This is a realistic (and a bit 'dirty') example that shows how equivalence - of vectorization is proven using relational reasoning. - It is always welcome to clean this proof further. *) - -let veceq_mc = define_assert_from_elf "veceq_mc" "arm/tutorial/rel_veceq.o" [ - 0xa9402c2a; (* arm_LDP X10 X11 X1 (Immediate_Offset (iword (&0))) *) - 0x9b0a7d54; (* arm_MUL X20 X10 X10 *) - 0x9bca7d4c; (* arm_UMULH X12 X10 X10 *) - 0x9b0b7d4d; (* arm_MUL X13 X10 X11 *) - 0x9bcb7d4e; (* arm_UMULH X14 X10 X11 *) - 0x9b0b7d6f; (* arm_MUL X15 X11 X11 *) - 0x9bcb7d70; (* arm_UMULH X16 X11 X11 *) - 0xab0d019b; (* arm_ADDS X27 X12 X13 *) - 0xba0e01fc; (* arm_ADCS X28 X15 X14 *) - 0x9a1f021d; (* arm_ADC X29 X16 XZR *) - 0xab0d0375; (* arm_ADDS X21 X27 X13 *) - 0xba0e0396; (* arm_ADCS X22 X28 X14 *) - 0x9a1f03b7 (* arm_ADC X23 X29 XZR *) -];; - -let VECEQ_EXEC = ARM_MK_EXEC_RULE veceq_mc;; - -let veceq2_mc = define_assert_from_elf "veceq2_mc" "arm/tutorial/rel_veceq2.o" [ - 0xa9403c29; (* arm_LDP X9 X15 X1 (Immediate_Offset (iword (&0))) *) - 0x3dc0003e; (* arm_LDR Q30 X1 (Immediate_Offset (word 0)) *) - 0x2ebec3c0; (* arm_UMULL_VEC Q0 Q30 Q30 32 *) - 0x6ebec3c2; (* arm_UMULL2_VEC Q2 Q30 Q30 32 *) - 0x0ea12bd8; (* arm_XTN Q24 Q30 32 *) - 0x4e9e5bde; (* arm_UZP2 Q30 Q30 Q30 32 *) - 0x2eb8c3de; (* arm_UMULL_VEC Q30 Q30 Q24 32 *) - 0x4e083c07; (* arm_UMOV X7 Q0 0 8 *) - 0x4e183c0e; (* arm_UMOV X14 Q0 1 8 *) - 0x4e083c53; (* arm_UMOV X19 Q2 0 8 *) - 0x4e183c56; (* arm_UMOV X22 Q2 1 8 *) - 0x4e083fc4; (* arm_UMOV X4 Q30 0 8 *) - 0x4e183fcc; (* arm_UMOV X12 Q30 1 8 *) - 0xab0484f5; (* arm_ADDS X21 X7 (Shiftedreg X4 LSL 33) *) - 0xd35ffc84; (* arm_LSR X4 X4 31 *) - 0x9a0401ce; (* arm_ADC X14 X14 X4 *) - 0xab0c8673; (* arm_ADDS X19 X19 (Shiftedreg X12 LSL 33) *) - 0xd35ffd84; (* arm_LSR X4 X12 31 *) - 0x9a0402d6; (* arm_ADC X22 X22 X4 *) - 0x9b0f7d24; (* arm_MUL X4 X9 X15 *) - 0x9bcf7d2c; (* arm_UMULH X12 X9 X15 *) - 0xab0405d8; (* arm_ADDS X24 X14 (Shiftedreg X4 LSL 1) *) - 0x93c4fd84; (* arm_EXTR X4 X12 X4 63 *) - 0xba040273; (* arm_ADCS X19 X19 X4 *) - 0xd37ffd84; (* arm_LSR X4 X12 63 *) - 0x9a0402c4 (* arm_ADC X4 X22 X4 *) -];; - -let VECEQ2_EXEC = ARM_MK_EXEC_RULE veceq2_mc;; - - -(* Define the equivalence of input states and output states. *) - -let equiv_input_states = new_definition - `forall s1 s1' x. - (equiv_input_states:(armstate#armstate)->int64->bool) (s1,s1') x <=> - (read X1 s1 = x /\ read X1 s1' = x /\ - exists a. bignum_from_memory (x,2) s1 = a /\ - bignum_from_memory (x,2) s1' = a)`;; - -let equiv_output_states = new_definition - `forall s1 s1'. - (equiv_output_states:(armstate#armstate)->bool) (s1,s1') <=> - (exists a. read X20 s1 = a /\ read X21 s1' = a /\ - (exists b. read X21 s1 = b /\ read X24 s1' = b /\ - (exists c. read X22 s1 = c /\ read X19 s1' = c /\ - (exists d. read X23 s1 = d /\ read X4 s1' = d))))`;; - - -(* Define the equivalence statement which is ensures2 predicate. - Please look at the definition of mk_equiv_statement_simple for full - definitions of its parameters. *) - -let equiv_goal1 = mk_equiv_statement_simple - `T` (* assumption such as nonoverlapping; nothing here, so simply T. *) - equiv_input_states - equiv_output_states - veceq_mc - `MAYCHANGE_REGS_AND_FLAGS_PERMITTED_BY_ABI ,, - MAYCHANGE [X20;X21;X22;X23;X27;X28;X29]` - veceq2_mc - `MAYCHANGE_REGS_AND_FLAGS_PERMITTED_BY_ABI ,, - MAYCHANGE [X19;X21;X22;X24]`;; - -(* 'actions' is a list of line diffs between the two assembly files (textual - form). This isn't important in this example, but to understand when - it is useful you might want to look at proofs in s2n-bignum that use - EQUIV_STEPS_TAC. *) -let actions = [ - ("replace",0,13,0,26) -];; - -(* After every small step, simplify the symbolic expression using - a new custom rewrite rule that is WORD_BITMANIP_SIMP_LEMMAS. *) -extra_word_CONV := - [GEN_REWRITE_CONV I [WORD_BITMANIP_SIMP_LEMMAS]] - @ (!extra_word_CONV);; - - -let VECTORIZE_SQR_EQUIV = prove(equiv_goal1, - - REWRITE_TAC[MAYCHANGE_REGS_AND_FLAGS_PERMITTED_BY_ABI; - fst VECEQ_EXEC; fst VECEQ2_EXEC] THEN - REPEAT STRIP_TAC THEN - (** Initialize **) - EQUIV_INITIATE_TAC equiv_input_states THEN - RULE_ASSUM_TAC (REWRITE_RULE[BIGNUM_FROM_MEMORY_BYTES]) THEN - - (* Symbolically simulate each program, to the last instructions. *) - EQUIV_STEPS_TAC actions VECEQ_EXEC VECEQ2_EXEC THEN - - (* For some reason, using this additional RULE_ASSUME_TAC was necessary... - Adding these rules to extra_word_CONV didn't work. Yes, this is a 'dirty' - part of the current status (= manual rewrites are sometimes necessary). - Also, these rewrite rules (WORD_SQR128_DIGIT0, ...) are not succinct. - Would be great if their proofs are shorter at least. *) - RULE_ASSUM_TAC (REWRITE_RULE[WORD_SQR128_DIGIT0; - WORD_SQR128_DIGIT1;WORD_SQR128_DIGIT2; - WORD_SQR128_DIGIT3]) THEN - - REPEAT_N 2 ENSURES_FINAL_STATE_TAC THEN - (* Prove remaining clauses from the postcondition *) - ASM_REWRITE_TAC[] THEN - CONJ_TAC THENL [ - (* Prove the equivalence! *) - ASM_REWRITE_TAC[equiv_output_states;mk_equiv_regs;mk_equiv_bool_regs] THEN - REPEAT (HINT_EXISTS_REFL_TAC THEN ASM_REWRITE_TAC[]); - - MONOTONE_MAYCHANGE_CONJ_TAC - ]);; diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_veceq2.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_veceq2.S deleted file mode 100644 index 521374de054..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rel_veceq2.S +++ /dev/null @@ -1,26 +0,0 @@ -ldp x9, x15, [x1] -ldr q30, [x1] -umull v0.2D, v30.2S, v30.2S -umull2 v2.2D, v30.4S, v30.4S -xtn v24.2S, v30.2D -uzp2 v30.4S, v30.4S, v30.4S -umull v30.2D, v30.2S, v24.2S -mov x7, v0.d[0] -mov x14, v0.d[1] -mov x19, v2.d[0] -mov x22, v2.d[1] -mov x4, v30.d[0] -mov x12, v30.d[1] -adds x21, x7, x4, lsl #33 -lsr x4, x4, #31 -adc x14, x14, x4 -adds x19, x19, x12, lsl #33 -lsr x4, x12, #31 -adc x22, x22, x4 -mul x4, x9, x15 -umulh x12, x9, x15 -adds x24, x14, x4, lsl #1 -extr x4, x12, x4, #63 -adcs x19, x19, x4 -lsr x4, x12, #63 -adc x4, x22, x4 //x21,x24,x19,x4 diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rodata.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rodata.S deleted file mode 100644 index 50177ffa39e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rodata.S +++ /dev/null @@ -1,109 +0,0 @@ -/* - This assembly file is a cleaned (and less ABI-compliant) version of GCC - output of the following - C program: - - const int x[10] = {2, 4, 6, 8, 10, 12, 14, 16, 18, 20}; - const int y[10] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10}; - const int z = 1; - - int f(uint64_t i) { - return x[i] + y[i]; - } - - int g(int64_t i) { - return f(i + z); - } -*/ - -#if defined(__ELF__) -.section .rodata - .global x - .type x, %object - .size x, 40 -#elif defined(__APPLE__) -.const_data -#endif - .align 3 -x: - .word 2 - .word 4 - .word 6 - .word 8 - .word 10 - .word 12 - .word 14 - .word 16 - .word 18 - .word 20 - -#if defined(__ELF__) - .global y - .type y, %object - .size y, 40 -#endif - .align 3 -y: - .word 1 - .word 2 - .word 3 - .word 4 - .word 5 - .word 6 - .word 7 - .word 8 - .word 9 - .word 10 - -#if defined(__ELF__) - .global z - .type z, %object - .size z, 4 -#endif - .align 3 -z: - .word 1 - -.text - .align 2 -#if defined(__ELF__) - .type f, %function -#endif - -f: - mov x3, x0 -#if defined(__ELF__) - adrp x10, x - add x10, x10, :lo12:x -#else - adrp x10, x@PAGE - add x10, x10, x@PAGEOFF -#endif - mov x1, x3 - ldr w1, [x10, x1, lsl 2] -#if defined(__ELF__) - adrp x11, y - add x11, x11, :lo12:y -#else - adrp x11, y@PAGE - add x11, x11, y@PAGEOFF -#endif - mov x2, x3 - ldr w0, [x11, x2, lsl 2] - add w0, w1, w0 - ret - -#if defined(__ELF__) - .type g, %function -#endif -g: -#if defined(__ELF__) - adrp x10, z - add x10, x10, :lo12:z -#else - adrp x10, z@PAGE - add x10, x10, z@PAGEOFF -#endif - ldr w1, [x10] - add x0, x1, x0 - b f diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rodata.ml b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rodata.ml deleted file mode 100644 index f8a8bfc1689..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rodata.ml +++ /dev/null @@ -1,469 +0,0 @@ -(* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - *) - -(****************************************************************************** - Verifying a program that reads constant data from .rodata -******************************************************************************) - -needs "arm/proofs/base.ml";; - -(* The following command will print the assertion checker fn of - "arm/tutorial/rodata.o". - - print_literal_relocs_from_elf "arm/tutorial/rodata.o";; - - Or, you can also use - - save_literal_relocs_from_elf "out.txt" "arm/tutorial/rodata.o";; -*) - -let rodata_mc,rodata_constants_data = define_assert_relocs_from_elf - "rodata_mc" - "arm/tutorial/rodata.o" -(fun w BL ADR ADRP ADD_rri64 -> [ -(* int f(int) *) - w 0xaa0003e3; (* arm_MOV X3 X0 *) - - ADRP (mk_var("x_data",`:num`),0,4,10); - ADD_rri64 (mk_var("x_data",`:num`),0,10,10); - - w 0xaa0303e1; (* arm_MOV X1 X3 *) - w 0xb8617941; (* arm_LDR W1 X10 (Shiftreg_Offset X1 2) *) - - ADRP (mk_var("y_data",`:num`),0,20,11); - ADD_rri64 (mk_var("y_data",`:num`),0,11,11); - - w 0xaa0303e2; (* arm_MOV X2 X3 *) - w 0xb8627960; (* arm_LDR W0 X11 (Shiftreg_Offset X2 2) *) - w 0x0b000020; (* arm_ADD W0 W1 W0 *) - w 0xd65f03c0; (* arm_RET X30 *) - -(* int g(int) *) - ADRP (mk_var("z_data",`:num`),0,44,10); - ADD_rri64 (mk_var("z_data",`:num`),0,10,10); - w 0xb9400141; (* arm_LDR W1 X10 (Immediate_Offset (word 0)) *) - w 0x8b000020; (* arm_ADD X0 X1 X0 *) - w 0x17fffff1 (* arm_B (word 268435396) *) -]);; - -(* Compared to the result of define_asserts_from_elf, the return value of - define_assert_relocs_from_elf has the following differences: - - 1. It returns rodata_constants_data, which is a list of thm. - Each thm describes a definition of an object in a read-only section: - - # rodata_constants_data;; - - - : thm list = - [|- z_data = [word 30; word 0; word 0; word 0]; - |- y_data = [word 1; word 0; word 0; word 0; ...]; - |- x_data = [word 2; word 0; word 0; word 0; ...]; - |- WHOLE_READONLY_data = [word 2; word 0; word 0; word 0; ...]] - - 2. The returned rodata_mc is a function that takes the addresses of pc, x, - rodata, z (x and z are the addresses of the two constant arrays, and - rodata is the whole contents) and returns the corresponding machine code. - - # rodata_mc;; - - - : thm = - |- forall pc x_data rodata z_data. - rodata_mc pc x_data y_data z_data = CONS (word 227) (...) -*) - -let EXEC = ARM_MK_EXEC_RULE rodata_mc;; - -(* Two helper tactics (unrelevant to treating the readonly section, just for - proving the upcoming properties). - - 1. INTRO_READ_MEMORY_FROM_BYTES8_TAC t: - If t is `read (memory :> bytesN ...) sM`, prove a theorem - `read (memory :> bytesN ...) sM = ` and introduce it - as an assumption, from the existing `read (memory :> bytes8 ..) sM = ..` - assumptions. - - 2. EXPLODE_BYTELIST_ASSUM_TAC: - Find assumption `read (memory :> bytelist (...)) s = ..` and explode - it to a list of `read (memory :> bytes8 (...)) s = ..` and reintroduce - them as assumptions. -*) -let INTRO_READ_MEMORY_FROM_BYTES8_TAC (t:term) = - (* Convert t into word_joins of 1-byte reads. *) - let r = REWRITE_CONV [READ_MEMORY_BYTESIZED_SPLIT] t in - (* Offset canonicalization, and then rewrite using assumptions *) - let r = REWRITE_RULE[WORD_ADD_ASSOC_CONSTS;WORD_ADD_0;ARITH] r in - MP_TAC r THEN - ASM (GEN_REWRITE_TAC (LAND_CONV o ONCE_DEPTH_CONV)) [] THEN - CONV_TAC (LAND_CONV WORD_REDUCE_CONV) THEN - DISCH_TAC;; - -let EXPLODE_BYTELIST_ASSUM_TAC const_data = - FIRST_X_ASSUM (fun th -> - let _ = find_term (fun t -> name_of t = "bytelist") (concl th) in - (* Unfold the constant arrays! *) - let unfolded_bytes_loaded = REWRITE_RULE const_data th in - (* Fold LENGTH array, and explode arr using BYTELIST_EXPAND_CONV *) - MP_TAC (CONV_RULE (ONCE_DEPTH_CONV LENGTH_CONV THENC - LAND_CONV BYTELIST_EXPAND_CONV) - unfolded_bytes_loaded)) THEN - (* [a;b;..] = [x;y;..] is a = x /\ b = y /\ ... *) - REWRITE_TAC [CONS_11] THEN - STRIP_TAC;; - - -let F_SPEC = prove(`forall x y z i pc retpc. - // These two assumptions state that the distance between symbol x and pc+4 - // (which is the first adrp) do not overflow, and so does symbol y and - // pc+20. - adrp_within_bounds (word x) (word (pc + 4)) /\ - adrp_within_bounds (word y) (word (pc + 20)) /\ - val i < 10 - ==> - ensures arm - (\s. aligned_bytes_loaded s (word pc) (rodata_mc pc x y z) /\ - read (memory :> bytelist (word x, LENGTH x_data)) s = x_data /\ - read (memory :> bytelist (word y, LENGTH y_data)) s = y_data /\ - read PC s = word pc /\ - read X0 s = i /\ - read X30 s = retpc) - (\s. read W0 s = word (3 * (1 + val i)) /\ - read PC s = retpc) - (MAYCHANGE [X0; X1; X2; X3; X10; X11; PC] ,, MAYCHANGE [events])`, - - REPEAT STRIP_TAC THEN - ENSURES_INIT_TAC "s0" THEN - - (* Let's prove the constant array is storing some structured int sequence. *) - SUBGOAL_THEN - `read (memory :> bytes32 (word_add (word x) (word (4 * val (i:int64))))) - s0 = word (2 * (val i+1)) /\ - read (memory :> bytes32 (word_add (word y) (word (4 * val i)))) - s0 = word (val i+1)` - MP_TAC THENL [ - - (* Explode the 40-byte constant memory reads into 40 1-bytes! - Do it twice, one for x and one for y. *) - REPEAT_N 2 (EXPLODE_BYTELIST_ASSUM_TAC rodata_constants_data) THEN - - (* For each case where i < 10, concretely evaluate the values from the - exploded bytes, proving the equality. *) - ABBREV_TAC `i' = val (i:int64)` THEN - UNDISCH_TAC `i' < 10` THEN - SPEC_TAC (`i':num`,`i':num`) THEN - CONV_TAC EXPAND_CASES_CONV THEN - REWRITE_TAC[ARITH;WORD_ADD_0] THEN - - REPEAT CONJ_TAC THEN (fun (asl,w) -> - INTRO_READ_MEMORY_FROM_BYTES8_TAC (lhs w) (asl,w) - ) THEN ASM_REWRITE_TAC[]; - - ALL_TAC - ] THEN - - STRIP_TAC THEN - - ARM_STEPS_TAC EXEC (1--3) THEN - FIRST_X_ASSUM (fun th -> MP_TAC th THEN IMP_REWRITE_TAC[ADRP_ADD_FOLD] THEN DISCH_TAC) THEN - - ARM_STEPS_TAC EXEC (4--7) THEN - FIRST_X_ASSUM (fun th -> MP_TAC th THEN IMP_REWRITE_TAC[ADRP_ADD_FOLD] THEN DISCH_TAC) THEN - - ARM_STEPS_TAC EXEC (8--11) THEN - - (* Prove the postcondition. *) - ENSURES_FINAL_STATE_TAC THEN - - ASM_REWRITE_TAC[WREG_EXPAND_CLAUSES;READ_ZEROTOP_32] THEN - REWRITE_TAC[WORD_BLAST`word_zx (word_zx (x:(32)word):(64)word):(32)word = x`] THEN - CONV_TAC WORD_RULE);; - - -(* Proving the specification of function g(i) that calls f(i + z). *) - -let G_SPEC = prove(`forall x y z i pc retpc. - adrp_within_bounds (word x) (word (pc + 4)) /\ - adrp_within_bounds (word y) (word (pc + 20)) /\ - adrp_within_bounds (word z) (word (pc + 44)) /\ - val i < 9 - ==> - ensures arm - (\s. aligned_bytes_loaded s (word pc) (rodata_mc pc x y z) /\ - read (memory :> bytelist (word x, LENGTH x_data)) s = x_data /\ - read (memory :> bytelist (word y, LENGTH y_data)) s = y_data /\ - read (memory :> bytelist (word z, LENGTH z_data)) s = z_data /\ - read PC s = word (pc + 0x2c) /\ - read X0 s = i /\ - read X30 s = retpc) - (\s. read W0 s = word (3 * (2 + val i)) /\ - read PC s = retpc) - (MAYCHANGE [X0; X1; X2; X3; X10; X11; PC] ,, MAYCHANGE [events])`, - - REPEAT STRIP_TAC THEN - - ENSURES_INIT_TAC "s0" THEN - - ARM_STEPS_TAC EXEC (1--2) THEN - FIRST_X_ASSUM (fun th -> MP_TAC th THEN IMP_REWRITE_TAC[ADRP_ADD_FOLD] THEN DISCH_TAC) THEN - - (* Prepare load z. *) - EXPLODE_BYTELIST_ASSUM_TAC rodata_constants_data THEN - INTRO_READ_MEMORY_FROM_BYTES8_TAC - `read (memory :> bytes32 (word z)) s2` THEN - (* Expand read W0 to read X0. *) - RULE_ASSUM_TAC(REWRITE_RULE[WREG_EXPAND_CLAUSES;READ_ZEROTOP_32]) THEN - ARM_STEPS_TAC EXEC (3--4) THEN - - SUBGOAL_THEN `val (word_add (word 1) i:int64) < 10` ASSUME_TAC THENL [ - REWRITE_TAC[VAL_WORD_ADD;VAL_WORD;DIMINDEX_64] THEN ASM_ARITH_TAC; - ALL_TAC - ] THEN - ARM_STEPS_TAC EXEC [5] THEN - - (* Call ARM_SUBROUTINE_SIM_TAC with its arguments. *) - ARM_SUBROUTINE_SIM_TAC - (SPEC_ALL rodata_mc,EXEC,0,SPEC_ALL rodata_mc,F_SPEC) - [`x:num`;`y:num`;`z:num`;`read X0 s`; - `pc:num`; `read X30 s`] 6 THEN - - (* Prove the postcondition. *) - ENSURES_FINAL_STATE_TAC THEN - - ASM_REWRITE_TAC[VAL_WORD_ADD;DIMINDEX_64] THEN - AP_TERM_TAC THEN CONV_TAC WORD_REDUCE_CONV THEN - IMP_REWRITE_TAC[MOD_LT] THEN ASM_ARITH_TAC);; - - -(* The next example of this tutorial is rodata_local.S which has an identical - text to rodata.S but has all readonly symbols (x,y,z) defined as local. - When the symbols are local, their relocation table entries for the - instructions using x,y, and z do not directly point to the symbol table - entries of x,y,z. Instead, they use relative offsets from the beginning of - the readonly section (or __const section for MachO). - - Therefore, we must define a constant that holds all byte data in the readonly - section and use it. In fact, in the previous example, there was already - 'WHOLE_READONLY_data' which was exactly containing the whole readonly data. - We can use that, but the name wasn't pretty. - In this example, we will use the optional 'map_symbol_name' argument of - define_assert_relocs_from_elf to assign more meaningful name to it, like - this: - - define_assert_relocs_from_elf - ~map_symbol_name:(function - | "WHOLE_READONLY" -> "rodata" - | s -> "unused_" ^ s) - "rodata_local_mc" - "arm/tutorial/rodata_local.o" - - (Note that if this optional 'map_symbol_name' argument is not given, it will - unconditionally attach the "_data" suffix to the names of symbols and - use "WHOLE_READONLY_data" for the whole readonly data, as shown before.) - - To generate the assertion checker, you can use print_literal_relocs_from_elf - (and of course save_literal_relocs_from_elf) with the same argument: - - print_literal_relocs_from_elf - ~map_symbol_name:(function - | "WHOLE_READONLY" -> "rodata" - | s -> "unused_" ^ s) - "arm/tutorial/rodata_local.o";; -*) - -let rodata_local_mc,rodata_local_constants_data = define_assert_relocs_from_elf - ~map_symbol_name:(function - | "WHOLE_READONLY" -> "rodata" - (* Mapping ltmp1 is necessary for MachO; ltmp1 is an autogenerated name - by the MacOS assembler. *) - | "ltmp1" -> "rodata" - | s -> "unused_" ^ s) - "rodata_local_mc" - "arm/tutorial/rodata_local.o" -(fun w BL ADR ADRP ADD_rri64 -> [ - w 0xaa0003e3; (* arm_MOV X3 X0 *) - ADRP (mk_var("rodata",`:num`),0,4,10); - ADD_rri64 (mk_var("rodata",`:num`),0,10,10); - w 0xaa0303e1; (* arm_MOV X1 X3 *) - w 0xb8617941; (* arm_LDR W1 X10 (Shiftreg_Offset X1 2) *) - ADRP (mk_var("rodata",`:num`),40,20,11); - ADD_rri64 (mk_var("rodata",`:num`),40,11,11); - w 0xaa0303e2; (* arm_MOV X2 X3 *) - w 0xb8627960; (* arm_LDR W0 X11 (Shiftreg_Offset X2 2) *) - w 0x0b000020; (* arm_ADD W0 W1 W0 *) - w 0xd65f03c0; (* arm_RET X30 *) - ADRP (mk_var("rodata",`:num`),80,44,10); - ADD_rri64 (mk_var("rodata",`:num`),80,10,10); - w 0xb9400141; (* arm_LDR W1 X10 (Immediate_Offset (word 0)) *) - w 0x8b000020; (* arm_ADD X0 X1 X0 *) - w 0x17fffff1 (* arm_B (word 268435396) *) -]);; - -(* The new rodata_local_constants_data has a list of thm, each of which defines - the byte contents of local symbol with accordingly modified names: - - # rodata_local_constants_data;; - - - : thm list = - [|- unused_Lz = [word 1; word 0; word 0; word 0]; - |- unused_Ly = [word 1; word 0; word 0; word 0; ...]; - |- unused_Lx = [word 2; word 0; word 0; word 0; ...]; - |- rodata = [word 2; word 0; word 0; word 0; ...]] - - The above result is for ELF binaries. On Mac, you will only see the last - item. - - The definition of rodata_local_mc only receives two arguments: pc and - rodata. - - # rodata_local_mc;; - - - : thm = - |- forall pc rodata. rodata_local_mc pc rodata = ... -*) - -let EXEC = ARM_MK_EXEC_RULE rodata_local_mc;; - -(* - Now, let's prove the properties that are analogous to F_SPEC and G_SPEC - but for rodata_local.S. -*) - -let F_LOCAL_SPEC = prove(`forall rodata_addr i pc retpc. - adrp_within_bounds (word rodata_addr) (word (pc + 4)) /\ - adrp_within_bounds (word (rodata_addr + 40)) (word (pc + 20)) /\ - val i < 10 - ==> - ensures arm - (\s. aligned_bytes_loaded s (word pc) (rodata_local_mc pc rodata_addr) /\ - read (memory :> bytelist (word rodata_addr, LENGTH rodata)) s = - rodata /\ - read PC s = word pc /\ - read X0 s = i /\ - read X30 s = retpc) - (\s. read W0 s = word (3 * (1 + val i)) /\ - read PC s = retpc) - (MAYCHANGE [X0; X1; X2; X3; X10; X11; PC] ,, MAYCHANGE [events])`, - - REPEAT STRIP_TAC THEN - ENSURES_INIT_TAC "s0" THEN - - (* Let's prove the constant array is storing some structured int sequence. *) - SUBGOAL_THEN - `read (memory :> bytes32 - (word_add (word rodata_addr) (word (4 * val (i:int64))))) - s0 = word (2 * (val i+1)) /\ - read (memory :> bytes32 - (word_add (word (rodata_addr + 40)) (word (4 * val i)))) - s0 = word (val i+1)` - MP_TAC THENL [ - - (* Explode the 84-byte constant memory reads into 84 1-bytes! *) - EXPLODE_BYTELIST_ASSUM_TAC rodata_local_constants_data THEN - - (* For each case where i < 10, concretely evaluate the values from the - exploded bytes, proving the equality. *) - ABBREV_TAC `i' = val (i:int64)` THEN - UNDISCH_TAC `i' < 10` THEN - SPEC_TAC (`i':num`,`i':num`) THEN - CONV_TAC EXPAND_CASES_CONV THEN - REWRITE_TAC[ARITH;WORD_ADD_0; - WORD_RULE`word_add (word (x+40)) (word y):int64 = - word_add (word x) (word (40+y))`] THEN - - REPEAT CONJ_TAC THEN (fun (asl,w) -> - INTRO_READ_MEMORY_FROM_BYTES8_TAC (lhs w) (asl,w) - ) THEN ASM_REWRITE_TAC[]; - - ALL_TAC - ] THEN - - STRIP_TAC THEN - - ARM_STEPS_TAC EXEC (1--3) THEN - FIRST_X_ASSUM (fun th -> MP_TAC th THEN IMP_REWRITE_TAC[ADRP_ADD_FOLD] THEN DISCH_TAC) THEN - - ARM_STEPS_TAC EXEC (4--7) THEN - FIRST_X_ASSUM (fun th -> MP_TAC th THEN IMP_REWRITE_TAC[ADRP_ADD_FOLD] THEN DISCH_TAC) THEN - - ARM_STEPS_TAC EXEC (8--11) THEN - - (* Prove the postcondition. *) - ENSURES_FINAL_STATE_TAC THEN - - ASM_REWRITE_TAC[WREG_EXPAND_CLAUSES;READ_ZEROTOP_32] THEN - REWRITE_TAC[WORD_BLAST`word_zx (word_zx (x:(32)word):(64)word):(32)word = x`] THEN - CONV_TAC WORD_RULE);; - - -(* Proving the specification of function g(i) that calls f(i + z). *) - -let G_LOCAL_SPEC = prove(`forall rodata_addr i pc retpc. - adrp_within_bounds (word rodata_addr) (word (pc + 4)) /\ - adrp_within_bounds (word (rodata_addr + 40)) (word (pc + 20)) /\ - adrp_within_bounds (word (rodata_addr + 80)) (word (pc + 44)) /\ - val i < 9 - ==> - ensures arm - (\s. aligned_bytes_loaded s (word pc) (rodata_local_mc pc rodata_addr) /\ - read (memory :> bytelist (word rodata_addr, LENGTH rodata)) s = - rodata /\ - read PC s = word (pc + 0x2c) /\ - read X0 s = i /\ - read X30 s = retpc) - (\s. read W0 s = word (3 * (2 + val i)) /\ - read PC s = retpc) - (MAYCHANGE [X0; X1; X2; X3; X10; X11; PC] ,, MAYCHANGE [events])`, - - REPEAT STRIP_TAC THEN - - ENSURES_INIT_TAC "s0" THEN - - ARM_STEPS_TAC EXEC (1--2) THEN - FIRST_X_ASSUM (fun th -> MP_TAC th THEN IMP_REWRITE_TAC[ADRP_ADD_FOLD] THEN DISCH_TAC) THEN - - (* Prepare load z. *) - SUBGOAL_THEN `read (memory :> bytes32 (word (rodata_addr + 80))) s2 = word 1` - ASSUME_TAC THENL [ - EXPLODE_BYTELIST_ASSUM_TAC rodata_local_constants_data THEN - REPEAT_N 2 (CONV_TAC (ONCE_DEPTH_CONV (READ_MEMORY_SPLIT_CONV 1))) THEN - REWRITE_TAC (map WORD_RULE - [`word_add (word (x+80)) (word k) = word_add (word x) (word (80+k))`; - `word (x+80):int64 = word_add (word x) (word 80)`]) THEN - ASM_REWRITE_TAC[ARITH] THEN CONV_TAC WORD_REDUCE_CONV; - - ALL_TAC - ] THEN - - (* Expand read W0 to read X0. *) - RULE_ASSUM_TAC(REWRITE_RULE[WREG_EXPAND_CLAUSES;READ_ZEROTOP_32]) THEN - ARM_STEPS_TAC EXEC (3--4) THEN - - SUBGOAL_THEN `val (word_add (word 1) i:int64) < 10` ASSUME_TAC THENL [ - REWRITE_TAC[VAL_WORD_ADD;VAL_WORD;DIMINDEX_64] THEN ASM_ARITH_TAC; - ALL_TAC - ] THEN - ARM_STEPS_TAC EXEC [5] THEN - - (* Call ARM_SUBROUTINE_SIM_TAC with its arguments. *) - ARM_SUBROUTINE_SIM_TAC - (SPEC_ALL rodata_local_mc,EXEC,0,SPEC_ALL rodata_local_mc,F_LOCAL_SPEC) - [`rodata_addr:num`;`read X0 s`;`pc:num`; `read X30 s`] 6 THEN - - (* Prove the postcondition. *) - ENSURES_FINAL_STATE_TAC THEN - - ASM_REWRITE_TAC[VAL_WORD_ADD;DIMINDEX_64] THEN - AP_TERM_TAC THEN CONV_TAC WORD_REDUCE_CONV THEN - IMP_REWRITE_TAC[MOD_LT] THEN ASM_ARITH_TAC);; - -(* - It is also possible to think about a more complicated case where some symbols - are global and some are local, and actually s2n-bignum's ELF/Mach-O loader - can successfully deal with that. However, one hidden trickiness is that the - definition of machine code diverges between ELF and Mach-O, making the - specification of correctness and accordingly its proof diverge depending - on the object file type. - For simplicity, this tutorial deals with a case where all readonly symbols - are local, which does not exhibit this divergence problem. -*) \ No newline at end of file diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rodata_local.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rodata_local.S deleted file mode 100644 index 95f0739583a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/rodata_local.S +++ /dev/null @@ -1,106 +0,0 @@ -/* - This assembly file is a cleaned (and less ABI-compliant) version of GCC - output of the following - C program: - - static const int x[10] = {2, 4, 6, 8, 10, 12, 14, 16, 18, 20}; - static const int y[10] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10}; - static const int z = 1; - - int f(uint64_t i) { - return x[i] + y[i]; - } - - int g(int64_t i) { - return f(i + z); - } -*/ - -#if defined(__ELF__) -.section .rodata - .type Lx, %object - .size Lx, 40 -#elif defined(__APPLE__) -.const_data -#endif - .align 3 -Lx: - .word 2 - .word 4 - .word 6 - .word 8 - .word 10 - .word 12 - .word 14 - .word 16 - .word 18 - .word 20 - -#if defined(__ELF__) - .type Ly, %object - .size Ly, 40 -#endif - .align 3 -Ly: - .word 1 - .word 2 - .word 3 - .word 4 - .word 5 - .word 6 - .word 7 - .word 8 - .word 9 - .word 10 - -#if defined(__ELF__) - .type Lz, %object - .size Lz, 4 -#endif - .align 3 -Lz: - .word 1 - -.text - .align 2 -#if defined(__ELF__) - .type f, %function -#endif - -f: - mov x3, x0 -#if defined(__ELF__) - adrp x10, Lx - add x10, x10, :lo12:Lx -#else - adrp x10, Lx@PAGE - add x10, x10, Lx@PAGEOFF -#endif - mov x1, x3 - ldr w1, [x10, x1, lsl 2] -#if defined(__ELF__) - adrp x11, Ly - add x11, x11, :lo12:Ly -#else - adrp x11, Ly@PAGE - add x11, x11, Ly@PAGEOFF -#endif - mov x2, x3 - ldr w0, [x11, x2, lsl 2] - add w0, w1, w0 - ret - -#if defined(__ELF__) - .type g, %function -#endif -g: -#if defined(__ELF__) - adrp x10, Lz - add x10, x10, :lo12:Lz -#else - adrp x10, Lz@PAGE - add x10, x10, Lz@PAGEOFF -#endif - ldr w1, [x10] - add x0, x1, x0 - b f diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/sequence.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/sequence.S deleted file mode 100644 index c3a16766210..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/sequence.S +++ /dev/null @@ -1,4 +0,0 @@ -add x1, x1, x0 -add x2, x2, x0 -mov x3, #2 -mul x1, x1, x3 diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/sequence.ml b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/sequence.ml deleted file mode 100644 index 51dadf98bb1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/sequence.ml +++ /dev/null @@ -1,101 +0,0 @@ -(* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - *) - -(****************************************************************************** - Prove a property of a simple program by splitting into two sequential - chunks with an intermediate assertion. -******************************************************************************) - -(* Please copy this file to the root directory of s2n-bignum, then - follow the instructions. *) - -needs "arm/proofs/base.ml";; - -(* Given a program - 0: 8b000021 add x1, x1, x0 - 4: 8b000042 add x2, x2, x0 - 8: d2800043 mov x3, #0x2 - c: 9b037c21 mul x1, x1, x3 - - Let's prove that x1 in the final state is (x1 + x0) * 2. - As done in "simple.ml", this can be done using symbolic execution. However, - in this file, we will try a slightly different approach: - (1) The program will be splitted into two smaller programs: - - First prog: - 0: 8b000021 add x1, x1, x0 - 4: 8b000042 add x2, x2, x0 - - Second prog: - 8: d2800043 mov x3, #0x2 - c: 9b037c21 mul x1, x1, x3 - - (2) Each program will have its 'ensures' predicate specifying the pre and - postcondition. The postcondition of the first program will be equivalent to - the second one. - (3) By proving the two 'ensures' predicate, the specification of whole - program can be proven. -*) - -let sequence_mc = new_definition `sequence_mc = [ - word 0x21; word 0x00; word 0x00; word 0x8b; // add x2, x1, x0 - word 0x42; word 0x00; word 0x00; word 0x8b; // add x2, x2, x0 - word 0x43; word 0x00; word 0x80; word 0xd2; // mov x3, #0x2 - word 0x21; word 0x7c; word 0x03; word 0x9b // mul x1, x1, x3 - ]:((8)word)list`;; - -let EXEC = ARM_MK_EXEC_RULE sequence_mc;; - -let sequence_SPEC = prove( - `forall pc a b. - ensures arm - // Precondition - (\s. aligned_bytes_loaded s (word pc) sequence_mc /\ - read PC s = word pc /\ - read X0 s = word a /\ - read X1 s = word b /\ - read X2 s = word c) - // Postcondition - (\s. read PC s = word (pc+16) /\ - read X1 s = word ((a + b) * 2)) - // Registers (and memory locations) that may change after execution - (MAYCHANGE [PC;X1;X2;X3])`, - (* Strips the outermost universal quantifier from the conclusion of a goal *) - REPEAT STRIP_TAC THEN - - (* Use ENSURES_SEQUENCE_TAC to split the program into two chunks: - [pc, pc+8) and [pc+8, pc+16). The second argument of the tactic - `\s. read X1 s = word (a + b)` is a lambda function stating the - intermediate state at pc+8. - The result of this tactic will be a conjunction of two ensures, - the left clause of which is a spec of the first chunk and the - right clause is the right one. *) - ENSURES_SEQUENCE_TAC - `pc + 8` - `\s. read X1 s = word (a + b)` THEN - - (* Split the conjunction and create two subgoals. *) - CONJ_TAC THENL [ - (* The first subgoal. *) - (* Now we can use the symbolic execution tactics introduced in "simple.ml". *) - (* Start symbolic execution with state 's0' *) - ENSURES_INIT_TAC "s0" THEN - (* Symbolically run two instructions *) - ARM_STEPS_TAC EXEC (1--2) THEN - (* Try to prove the postcondition and frame as much as possible *) - ENSURES_FINAL_STATE_TAC THEN - (* Use ASM_REWRITE_TAC[] to rewrite the goal using equalities in assumptions. *) - ASM_REWRITE_TAC[] THEN - (* Prove: `word_add (word b) (word a) = word (a + b)` *) - CONV_TAC WORD_RULE; - - (* The second subgoal *) - ENSURES_INIT_TAC "s0" THEN - ARM_STEPS_TAC EXEC (1--2) THEN - ENSURES_FINAL_STATE_TAC THEN - ASM_REWRITE_TAC[] THEN - (* Prove: `word (0 + val (word (a + b)) * 2) = word ((a + b) * 2)` *) - CONV_TAC WORD_RULE; - ]);; diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/simple.S b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/simple.S deleted file mode 100644 index 9439996e1af..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/simple.S +++ /dev/null @@ -1,2 +0,0 @@ -add x2, x1, x0 -sub x2, x2, x1 diff --git a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/simple.ml b/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/simple.ml deleted file mode 100644 index 21bf47613ea..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/arm/tutorial/simple.ml +++ /dev/null @@ -1,120 +0,0 @@ -(* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - *) - -(****************************************************************************** - Proving a simple property about program 'simple.S' -******************************************************************************) - -(* Please copy this file to the root directory of s2n-bignum, then - follow the instructions. *) - -needs "arm/proofs/base.ml";; - -(* Let's prove a simple property of the following program: - - 0: 8b000022 add x2, x1, x0 - 4: cb010042 sub x2, x2, x1 - - Let's start with defining a byte sequence of a program 'simple.S' -*) -let simple_mc = new_definition `simple_mc = [ - word 0x22; word 0x00; word 0x00; word 0x8b; // add x2, x1, x0 - word 0x42; word 0x00; word 0x01; word 0xcb // sub x2, x2, x1 - ]:((8)word)list`;; - -(* Or, you can read .o file and store the byte list as follows: -let simple_mc = define_assert_from_elf "simple_mc" "arm/tutorial/simple.o" -[ - 0x8b000022; (* arm_ADD X2 X1 X0 *) - 0xcb010042 (* arm_SUB X2 X2 X1 *) -];; - -You can get the above OCaml list data structure from -`print_literal_from_elf "<.o file>"` or `save_literal_from_elf "" -"<.o file>"`. -*) - -(* ARM_MK_EXEC_RULE decodes the byte sequence into an OCaml array of - theorems describing the instruction decoded at each PC (only when - it is multiple of 4). *) -let EXEC = ARM_MK_EXEC_RULE simple_mc;; - -(* - In s2n-bignum, a specification (ensures) has three components: - 1. precondition: assume that a program starts from some program state satisfying the critera - 2. postcondition: the program must reach to a program state satisfying the criteria - 3. frame: the start program state and end program state must satisfy this relation - (e.g., this program only changes callee-save register) - In this file, - 1. precondition is: - - the 'simple' binary is loaded at some location in memory, say 'pc' - - the arm program counter register, PC, has value pc - - the arm register X0 has a symbolic value a and X1 has a symbolic value b - 2. postcondition is: - - the arm program counter register, PC, has value pc+8 - (meaning that two instructions have been executed) - - the arm register X2 has value b - 3. frame is: - - the register values of PC and X2 might have been changed - - If you are using the VSCode plugin of HOL Light, you can ctrl+click - (cmd+click for Mac) to jump to definitions. -*) -let SIMPLE_SPEC = prove( - `forall pc a b. - ensures arm - // Precondition - (\s. // aligned_bytes_loaded states that a byte sequence 'simple_mc' - // is loaded at memory location 'pc' in the state 's' and also - // 4-bytes aligned. - aligned_bytes_loaded s (word pc) simple_mc /\ - // 'word' is a bit-vector type in HOL Light. - // 'word a' means it is a bit-vector whose numeral (:num type) - // is 'a'. Its bit-width is inferred as 64 bits here, but it can - // be manually annotated as (word a:(64)word). - read PC s = word pc /\ - read X0 s = word a /\ - read X1 s = word b) - // Postcondition - (\s. read PC s = word (pc+8) /\ - read X2 s = word a) - // Registers (and memory locations) that may change after execution - (MAYCHANGE [PC;X2])`, - - (* Strips the outermost universal quantifier from the conclusion of a goal *) - REPEAT STRIP_TAC THEN - (* Start symbolic execution with state 's0' *) - ENSURES_INIT_TAC "s0" THEN - - (* Symbolically run two instructions *) - ARM_STEPS_TAC EXEC (1--2) THEN - (* Try to prove the postcondition and frame as much as possible *) - ENSURES_FINAL_STATE_TAC THEN - - (* Use ASM_REWRITE_TAC[] to rewrite the goal using equalities in assumptions. *) - ASM_REWRITE_TAC[] THEN - (* We need to prove this: - `word_sub (word_add (word b) (word a)) (word b) = word a` - Use an automated prover for words in HOL Light *) - CONV_TAC WORD_RULE);; - -(* Note that symbolic simulator will discard the output of instructions - if its inputs do not have their symbolic expressions defined in assumption. - To list which instructions are discarded by the simulation tactic. - set: - arm_print_log := true;; - This flag will also print helpful informations that are useful. - - Setting this flag to true will also print the executing instructions as well - as their PCs. - For the above example, it will print: - - Stepping to state s1 - Instruction at `pc + 0 (0)`: `arm_ADD X2 X1 X0` - CPU time (user): 0.006777 - Stepping to state s2 - Instruction at `pc + 4 (0x4)`: `arm_SUB X2 X2 X1` - CPU time (user): 0.00889600000002 -*) diff --git a/third_party/s2n-bignum/s2n-bignum-imported/doc/s2n_bignum_soundness.md b/third_party/s2n-bignum/s2n-bignum-imported/doc/s2n_bignum_soundness.md new file mode 100644 index 00000000000..f8e1b12b710 --- /dev/null +++ b/third_party/s2n-bignum/s2n-bignum-imported/doc/s2n_bignum_soundness.md @@ -0,0 +1 @@ +This document has moved to [SOUNDNESS.md](../SOUNDNESS.md) in the repository root. diff --git a/third_party/s2n-bignum/s2n-bignum-imported/doc/s2n_bignum_soundness.svg b/third_party/s2n-bignum/s2n-bignum-imported/doc/s2n_bignum_soundness.svg new file mode 100644 index 00000000000..a3034d9c550 --- /dev/null +++ b/third_party/s2n-bignum/s2n-bignum-imported/doc/s2n_bignum_soundness.svg @@ -0,0 +1,65 @@ + + + + + + + + + + + + + + + + Informal + Formal + + + + Desired behavior + What cryptographic applications + actually need the code to do + + + + Formal specification + HOL Light Hoare triple: + precondition, postcondition, frame + + + + + Gap A + + + + + Formal proof + (HOL Light) + + + + Gap C: prover trust + + + + Actual system + Compiled object code running + on real CPU hardware + + + + Formal model of code + Byte sequence from object file + + ISA semantics (x86.ml / arm.ml) + + + + + Gap B + + + The formal proof (green) links two formal objects (blue). Gaps A, B, C are where assumptions live. + diff --git a/third_party/s2n-bignum/s2n-bignum-imported/include/_internal_s2n_bignum.h b/third_party/s2n-bignum/s2n-bignum-imported/include/_internal_s2n_bignum.h index af7b783bd55..00e7f7b0b9d 100644 --- a/third_party/s2n-bignum/s2n-bignum-imported/include/_internal_s2n_bignum.h +++ b/third_party/s2n-bignum/s2n-bignum-imported/include/_internal_s2n_bignum.h @@ -46,4 +46,4 @@ # include #elif !defined(_CET_ENDBR) # define _CET_ENDBR .byte 0xf3,0x0f,0x1e,0xfa -#endif +#endif \ No newline at end of file diff --git a/third_party/s2n-bignum/s2n-bignum-imported/include/_internal_s2n_bignum_x86.h b/third_party/s2n-bignum/s2n-bignum-imported/include/_internal_s2n_bignum_x86.h index fddee5d5b7c..ec701403454 100644 --- a/third_party/s2n-bignum/s2n-bignum-imported/include/_internal_s2n_bignum_x86.h +++ b/third_party/s2n-bignum/s2n-bignum-imported/include/_internal_s2n_bignum_x86.h @@ -64,3 +64,8 @@ #define CFI_INC_RSP(offset) add rsp, offset ; .cfi_adjust_cfa_offset -offset #define CFI_DEC_RSP(offset) sub rsp, offset ; .cfi_adjust_cfa_offset offset + +#define CFI_STACKSAVE(reg,offset) mov [rsp+(offset)], reg ; .cfi_rel_offset reg, offset +#define CFI_STACKLOAD(reg,offset) mov reg, [rsp+(offset)] ; .cfi_restore reg +#define CFI_STACKSAVEU(reg,offset) movups [rsp+(offset)], reg ; .cfi_rel_offset reg, offset +#define CFI_STACKLOADU(reg,offset) movups reg, [rsp+(offset)] ; .cfi_restore reg diff --git a/third_party/s2n-bignum/s2n-bignum-imported/include/_internal_s2n_bignum_x86_att.h b/third_party/s2n-bignum/s2n-bignum-imported/include/_internal_s2n_bignum_x86_att.h index 169c8143f0b..c5cca1719c5 100644 --- a/third_party/s2n-bignum/s2n-bignum-imported/include/_internal_s2n_bignum_x86_att.h +++ b/third_party/s2n-bignum/s2n-bignum-imported/include/_internal_s2n_bignum_x86_att.h @@ -64,3 +64,8 @@ #define CFI_INC_RSP(offset) addq $offset, %rsp ; .cfi_adjust_cfa_offset -offset #define CFI_DEC_RSP(offset) subq $offset, %rsp ; .cfi_adjust_cfa_offset offset + +#define CFI_STACKSAVE(reg,offset) mov reg, offset(%rsp) ; .cfi_rel_offset reg, offset +#define CFI_STACKLOAD(reg,offset) mov offset(%rsp), reg ; .cfi_restore reg +#define CFI_STACKSAVEU(reg,offset) movups reg, offset(%rsp) ; .cfi_rel_offset reg, offset +#define CFI_STACKLOADU(reg,offset) movups offset(%rsp), reg ; .cfi_restore reg diff --git a/third_party/s2n-bignum/s2n-bignum-imported/include/s2n-bignum-c89.h b/third_party/s2n-bignum/s2n-bignum-imported/include/s2n-bignum-c89.h index 01491badf43..2ddf0aac314 100644 --- a/third_party/s2n-bignum/s2n-bignum-imported/include/s2n-bignum-c89.h +++ b/third_party/s2n-bignum/s2n-bignum-imported/include/s2n-bignum-c89.h @@ -25,135 +25,135 @@ * ---------------------------------------------------------------------------- */ -/* Add, z := x + y */ -/* Inputs x[m], y[n]; outputs function return (carry-out) and z[p] */ -extern uint64_t bignum_add (uint64_t p, uint64_t *z, uint64_t m, uint64_t *x, uint64_t n, uint64_t *y); - -/* Add modulo p_256, z := (x + y) mod p_256, assuming x and y reduced */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_add_p256 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); - -/* Add modulo p_25519, z := (x + y) mod p_25519, assuming x and y reduced */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_add_p25519 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); - -/* Add modulo p_256k1, z := (x + y) mod p_256k1, assuming x and y reduced */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_add_p256k1 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); - -/* Add modulo p_384, z := (x + y) mod p_384, assuming x and y reduced */ -/* Inputs x[6], y[6]; output z[6] */ -extern void bignum_add_p384 (uint64_t z[6], uint64_t x[6], uint64_t y[6]); - -/* Add modulo p_521, z := (x + y) mod p_521, assuming x and y reduced */ -/* Inputs x[9], y[9]; output z[9] */ -extern void bignum_add_p521 (uint64_t z[9], uint64_t x[9], uint64_t y[9]); - -/* Add modulo p_sm2, z := (x + y) mod p_sm2, assuming x and y reduced */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_add_sm2 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); - -/* Compute "amontification" constant z :== 2^{128k} (congruent mod m) */ -/* Input m[k]; output z[k]; temporary buffer t[>=k] */ -extern void bignum_amontifier (uint64_t k, uint64_t *z, uint64_t *m, uint64_t *t); - -/* Almost-Montgomery multiply, z :== (x * y / 2^{64k}) (congruent mod m) */ -/* Inputs x[k], y[k], m[k]; output z[k] */ -extern void bignum_amontmul (uint64_t k, uint64_t *z, uint64_t *x, uint64_t *y, uint64_t *m); - -/* Almost-Montgomery reduce, z :== (x' / 2^{64p}) (congruent mod m) */ -/* Inputs x[n], m[k], p; output z[k] */ -extern void bignum_amontredc (uint64_t k, uint64_t *z, uint64_t n, uint64_t *x, uint64_t *m, uint64_t p); - -/* Almost-Montgomery square, z :== (x^2 / 2^{64k}) (congruent mod m) */ -/* Inputs x[k], m[k]; output z[k] */ -extern void bignum_amontsqr (uint64_t k, uint64_t *z, uint64_t *x, uint64_t *m); - -/* Convert 4-digit (256-bit) bignum to/from big-endian form */ -/* Input x[4]; output z[4] */ -extern void bignum_bigendian_4 (uint64_t z[4], uint64_t x[4]); - -/* Convert 6-digit (384-bit) bignum to/from big-endian form */ -/* Input x[6]; output z[6] */ -extern void bignum_bigendian_6 (uint64_t z[6], uint64_t x[6]); - -/* Select bitfield starting at bit n with length l <= 64 */ -/* Inputs x[k], n, l; output function return */ -extern uint64_t bignum_bitfield (uint64_t k, uint64_t *x, uint64_t n, uint64_t l); - -/* Return size of bignum in bits */ -/* Input x[k]; output function return */ -extern uint64_t bignum_bitsize (uint64_t k, uint64_t *x); - -/* Divide by a single (nonzero) word, z := x / m and return x mod m */ -/* Inputs x[n], m; outputs function return (remainder) and z[k] */ -extern uint64_t bignum_cdiv (uint64_t k, uint64_t *z, uint64_t n, uint64_t *x, uint64_t m); - -/* Divide by a single word, z := x / m when known to be exact */ -/* Inputs x[n], m; output z[k] */ -extern void bignum_cdiv_exact (uint64_t k, uint64_t *z, uint64_t n, uint64_t *x, uint64_t m); - -/* Count leading zero digits (64-bit words) */ -/* Input x[k]; output function return */ -extern uint64_t bignum_cld (uint64_t k, uint64_t *x); - -/* Count leading zero bits */ -/* Input x[k]; output function return */ -extern uint64_t bignum_clz (uint64_t k, uint64_t *x); - -/* Multiply-add with single-word multiplier, z := z + c * y */ -/* Inputs c, y[n]; outputs function return (carry-out) and z[k] */ -extern uint64_t bignum_cmadd (uint64_t k, uint64_t *z, uint64_t c, uint64_t n, uint64_t *y); - -/* Negated multiply-add with single-word multiplier, z := z - c * y */ -/* Inputs c, y[n]; outputs function return (negative carry-out) and z[k] */ -extern uint64_t bignum_cmnegadd (uint64_t k, uint64_t *z, uint64_t c, uint64_t n, uint64_t *y); - -/* Find modulus of bignum w.r.t. single nonzero word m, returning x mod m */ -/* Input x[k], m; output function return */ -extern uint64_t bignum_cmod (uint64_t k, uint64_t *x, uint64_t m); - -/* Multiply by a single word, z := c * y */ -/* Inputs c, y[n]; outputs function return (carry-out) and z[k] */ -extern uint64_t bignum_cmul (uint64_t k, uint64_t *z, uint64_t c, uint64_t n, uint64_t *y); - -/* Multiply by a single word modulo p_25519, z := (c * x) mod p_25519, assuming x reduced */ -/* Inputs c, x[4]; output z[4] */ -extern void bignum_cmul_p25519 (uint64_t z[4], uint64_t c, uint64_t x[4]); -extern void bignum_cmul_p25519_alt (uint64_t z[4], uint64_t c, uint64_t x[4]); - -/* Multiply by a single word modulo p_256, z := (c * x) mod p_256, assuming x reduced */ -/* Inputs c, x[4]; output z[4] */ -extern void bignum_cmul_p256 (uint64_t z[4], uint64_t c, uint64_t x[4]); -extern void bignum_cmul_p256_alt (uint64_t z[4], uint64_t c, uint64_t x[4]); - -/* Multiply by a single word modulo p_256k1, z := (c * x) mod p_256k1, assuming x reduced */ -/* Inputs c, x[4]; output z[4] */ -extern void bignum_cmul_p256k1 (uint64_t z[4], uint64_t c, uint64_t x[4]); -extern void bignum_cmul_p256k1_alt (uint64_t z[4], uint64_t c, uint64_t x[4]); +/* Add, z := x + y */ +/* Inputs x[m], y[n]; outputs function return (carry-out) and z[p] */ +extern uint64_t bignum_add (uint64_t p, uint64_t *z, uint64_t m, const uint64_t *x, uint64_t n, const uint64_t *y); -/* Multiply by a single word modulo p_384, z := (c * x) mod p_384, assuming x reduced */ -/* Inputs c, x[6]; output z[6] */ -extern void bignum_cmul_p384 (uint64_t z[6], uint64_t c, uint64_t x[6]); -extern void bignum_cmul_p384_alt (uint64_t z[6], uint64_t c, uint64_t x[6]); +/* Add modulo p_25519, z := (x + y) mod p_25519, assuming x and y reduced */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_add_p25519 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); -/* Multiply by a single word modulo p_521, z := (c * x) mod p_521, assuming x reduced */ -/* Inputs c, x[9]; output z[9] */ -extern void bignum_cmul_p521 (uint64_t z[9], uint64_t c, uint64_t x[9]); -extern void bignum_cmul_p521_alt (uint64_t z[9], uint64_t c, uint64_t x[9]); +/* Add modulo p_256, z := (x + y) mod p_256, assuming x and y reduced */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_add_p256 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); + +/* Add modulo p_256k1, z := (x + y) mod p_256k1, assuming x and y reduced */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_add_p256k1 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); + +/* Add modulo p_384, z := (x + y) mod p_384, assuming x and y reduced */ +/* Inputs x[6], y[6]; output z[6] */ +extern void bignum_add_p384 (uint64_t z[6], const uint64_t x[6], const uint64_t y[6]); + +/* Add modulo p_521, z := (x + y) mod p_521, assuming x and y reduced */ +/* Inputs x[9], y[9]; output z[9] */ +extern void bignum_add_p521 (uint64_t z[9], const uint64_t x[9], const uint64_t y[9]); + +/* Add modulo p_sm2, z := (x + y) mod p_sm2, assuming x and y reduced */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_add_sm2 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); + +/* Compute "amontification" constant z :== 2^{128k} (congruent mod m) */ +/* Input m[k]; output z[k]; temporary buffer t[>=k] */ +extern void bignum_amontifier (uint64_t k, uint64_t *z, const uint64_t *m, uint64_t *t); + +/* Almost-Montgomery multiply, z :== (x * y / 2^{64k}) (congruent mod m) */ +/* Inputs x[k], y[k], m[k]; output z[k] */ +extern void bignum_amontmul (uint64_t k, uint64_t *z, const uint64_t *x, const uint64_t *y, const uint64_t *m); + +/* Almost-Montgomery reduce, z :== (x' / 2^{64p}) (congruent mod m) */ +/* Inputs x[n], m[k], p; output z[k] */ +extern void bignum_amontredc (uint64_t k, uint64_t *z, uint64_t n, const uint64_t *x, const uint64_t *m, uint64_t p); + +/* Almost-Montgomery square, z :== (x^2 / 2^{64k}) (congruent mod m) */ +/* Inputs x[k], m[k]; output z[k] */ +extern void bignum_amontsqr (uint64_t k, uint64_t *z, const uint64_t *x, const uint64_t *m); + +/* Convert 4-digit (256-bit) bignum to/from big-endian form */ +/* Input x[4]; output z[4] */ +extern void bignum_bigendian_4 (uint64_t z[4], const uint64_t x[4]); + +/* Convert 6-digit (384-bit) bignum to/from big-endian form */ +/* Input x[6]; output z[6] */ +extern void bignum_bigendian_6 (uint64_t z[6], const uint64_t x[6]); + +/* Select bitfield starting at bit n with length l <= 64 */ +/* Inputs x[k], n, l; output function return */ +extern uint64_t bignum_bitfield (uint64_t k, const uint64_t *x, uint64_t n, uint64_t l); + +/* Return size of bignum in bits */ +/* Input x[k]; output function return */ +extern uint64_t bignum_bitsize (uint64_t k, const uint64_t *x); + +/* Divide by a single (nonzero) word, z := x / m and return x mod m */ +/* Inputs x[n], m; outputs function return (remainder) and z[k] */ +extern uint64_t bignum_cdiv (uint64_t k, uint64_t *z, uint64_t n, const uint64_t *x, uint64_t m); + +/* Divide by a single word, z := x / m when known to be exact */ +/* Inputs x[n], m; output z[k] */ +extern void bignum_cdiv_exact (uint64_t k, uint64_t *z, uint64_t n, const uint64_t *x, uint64_t m); + +/* Count leading zero digits (64-bit words) */ +/* Input x[k]; output function return */ +extern uint64_t bignum_cld (uint64_t k, const uint64_t *x); + +/* Count leading zero bits */ +/* Input x[k]; output function return */ +extern uint64_t bignum_clz (uint64_t k, const uint64_t *x); + +/* Multiply-add with single-word multiplier, z := z + c * y */ +/* Inputs c, y[n]; outputs function return (carry-out) and z[k] */ +extern uint64_t bignum_cmadd (uint64_t k, uint64_t *z, uint64_t c, uint64_t n, const uint64_t *y); + +/* Negated multiply-add with single-word multiplier, z := z - c * y */ +/* Inputs c, y[n]; outputs function return (negative carry-out) and z[k] */ +extern uint64_t bignum_cmnegadd (uint64_t k, uint64_t *z, uint64_t c, uint64_t n, const uint64_t *y); + +/* Find modulus of bignum w.r.t. single nonzero word m, returning x mod m */ +/* Input x[k], m; output function return */ +extern uint64_t bignum_cmod (uint64_t k, const uint64_t *x, uint64_t m); + +/* Multiply by a single word, z := c * y */ +/* Inputs c, y[n]; outputs function return (carry-out) and z[k] */ +extern uint64_t bignum_cmul (uint64_t k, uint64_t *z, uint64_t c, uint64_t n, const uint64_t *y); + +/* Multiply by a single word modulo p_25519, z := (c * x) mod p_25519, assuming x reduced */ +/* Inputs c, x[4]; output z[4] */ +extern void bignum_cmul_p25519 (uint64_t z[4], uint64_t c, const uint64_t x[4]); +extern void bignum_cmul_p25519_alt (uint64_t z[4], uint64_t c, const uint64_t x[4]); + +/* Multiply by a single word modulo p_256, z := (c * x) mod p_256, assuming x reduced */ +/* Inputs c, x[4]; output z[4] */ +extern void bignum_cmul_p256 (uint64_t z[4], uint64_t c, const uint64_t x[4]); +extern void bignum_cmul_p256_alt (uint64_t z[4], uint64_t c, const uint64_t x[4]); + +/* Multiply by a single word modulo p_256k1, z := (c * x) mod p_256k1, assuming x reduced */ +/* Inputs c, x[4]; output z[4] */ +extern void bignum_cmul_p256k1 (uint64_t z[4], uint64_t c, const uint64_t x[4]); +extern void bignum_cmul_p256k1_alt (uint64_t z[4], uint64_t c, const uint64_t x[4]); + +/* Multiply by a single word modulo p_384, z := (c * x) mod p_384, assuming x reduced */ +/* Inputs c, x[6]; output z[6] */ +extern void bignum_cmul_p384 (uint64_t z[6], uint64_t c, const uint64_t x[6]); +extern void bignum_cmul_p384_alt (uint64_t z[6], uint64_t c, const uint64_t x[6]); + +/* Multiply by a single word modulo p_521, z := (c * x) mod p_521, assuming x reduced */ +/* Inputs c, x[9]; output z[9] */ +extern void bignum_cmul_p521 (uint64_t z[9], uint64_t c, const uint64_t x[9]); +extern void bignum_cmul_p521_alt (uint64_t z[9], uint64_t c, const uint64_t x[9]); /* Multiply by a single word modulo p_sm2, z := (c * x) mod p_sm2, assuming x reduced */ /* Inputs c, x[4]; output z[4] */ -extern void bignum_cmul_sm2 (uint64_t z[4], uint64_t c, uint64_t x[4]); -extern void bignum_cmul_sm2_alt (uint64_t z[4], uint64_t c, uint64_t x[4]); +extern void bignum_cmul_sm2 (uint64_t z[4], uint64_t c, const uint64_t x[4]); +extern void bignum_cmul_sm2_alt (uint64_t z[4], uint64_t c, const uint64_t x[4]); -/* Test bignums for coprimality, gcd(x,y) = 1 */ -/* Inputs x[m], y[n]; output function return; temporary buffer t[>=2*max(m,n)] */ -extern uint64_t bignum_coprime (uint64_t m, uint64_t *x, uint64_t n, uint64_t *y, uint64_t *t); +/* Test bignums for coprimality, gcd(x,y) = 1 */ +/* Inputs x[m], y[n]; output function return; temporary buffer t[>=2*max(m,n)] */ +extern uint64_t bignum_coprime (uint64_t m, const uint64_t *x, uint64_t n, const uint64_t *y, uint64_t *t); -/* Copy bignum with zero-extension or truncation, z := x */ -/* Input x[n]; output z[k] */ -extern void bignum_copy (uint64_t k, uint64_t *z, uint64_t n, uint64_t *x); +/* Copy bignum with zero-extension or truncation, z := x */ +/* Input x[n]; output z[k] */ +extern void bignum_copy (uint64_t k, uint64_t *z, uint64_t n, const uint64_t *x); /* Given table: uint64_t[height*width], copy table[idx*width...(idx+1)*width-1] */ /* into z[0..width-1]. */ @@ -161,7 +161,7 @@ extern void bignum_copy (uint64_t k, uint64_t *z, uint64_t n, uint64_t *x); /* achieved by reading the whole table and using the bit-masking to get the */ /* `idx`-th row. */ /* Input table[height*width]; output z[width] */ -extern void bignum_copy_row_from_table (uint64_t *z, uint64_t *table, uint64_t height, +extern void bignum_copy_row_from_table (uint64_t *z, const uint64_t *table, uint64_t height, uint64_t width, uint64_t idx); /* Given table: uint64_t[height*width], copy table[idx*width...(idx+1)*width-1] */ @@ -170,7 +170,7 @@ extern void bignum_copy_row_from_table (uint64_t *z, uint64_t *table, uint64_t h /* achieved by reading the whole table and using the bit-masking to get the */ /* `idx`-th row. */ /* Input table[height*width]; output z[width] */ -extern void bignum_copy_row_from_table_8n (uint64_t *z, uint64_t *table, +extern void bignum_copy_row_from_table_8n (uint64_t *z, const uint64_t *table, uint64_t height, uint64_t width, uint64_t idx); /* Given table: uint64_t[height*16], copy table[idx*16...(idx+1)*16-1] into z[0..row-1]. */ @@ -178,7 +178,7 @@ extern void bignum_copy_row_from_table_8n (uint64_t *z, uint64_t *table, /* achieved by reading the whole table and using the bit-masking to get the */ /* `idx`-th row. */ /* Input table[height*16]; output z[16] */ -extern void bignum_copy_row_from_table_16 (uint64_t *z, uint64_t *table, +extern void bignum_copy_row_from_table_16 (uint64_t *z, const uint64_t *table, uint64_t height, uint64_t idx); /* Given table: uint64_t[height*32], copy table[idx*32...(idx+1)*32-1] into z[0..row-1]. */ @@ -186,791 +186,808 @@ extern void bignum_copy_row_from_table_16 (uint64_t *z, uint64_t *table, /* achieved by reading the whole table and using the bit-masking to get the */ /* `idx`-th row. */ /* Input table[height*32]; output z[32] */ -extern void bignum_copy_row_from_table_32 (uint64_t *z, uint64_t *table, +extern void bignum_copy_row_from_table_32 (uint64_t *z, const uint64_t *table, uint64_t height, uint64_t idx); -/* Count trailing zero digits (64-bit words) */ -/* Input x[k]; output function return */ -extern uint64_t bignum_ctd (uint64_t k, uint64_t *x); +/* Count trailing zero digits (64-bit words) */ +/* Input x[k]; output function return */ +extern uint64_t bignum_ctd (uint64_t k, const uint64_t *x); -/* Count trailing zero bits */ -/* Input x[k]; output function return */ -extern uint64_t bignum_ctz (uint64_t k, uint64_t *x); +/* Count trailing zero bits */ +/* Input x[k]; output function return */ +extern uint64_t bignum_ctz (uint64_t k, const uint64_t *x); -/* Convert from almost-Montgomery form, z := (x / 2^256) mod p_256 */ -/* Input x[4]; output z[4] */ -extern void bignum_deamont_p256 (uint64_t z[4], uint64_t x[4]); -extern void bignum_deamont_p256_alt (uint64_t z[4], uint64_t x[4]); +/* Convert from almost-Montgomery form, z := (x / 2^256) mod p_256 */ +/* Input x[4]; output z[4] */ +extern void bignum_deamont_p256 (uint64_t z[4], const uint64_t x[4]); +extern void bignum_deamont_p256_alt (uint64_t z[4], const uint64_t x[4]); -/* Convert from almost-Montgomery form, z := (x / 2^256) mod p_256k1 */ -/* Input x[4]; output z[4] */ -extern void bignum_deamont_p256k1 (uint64_t z[4], uint64_t x[4]); +/* Convert from almost-Montgomery form, z := (x / 2^256) mod p_256k1 */ +/* Input x[4]; output z[4] */ +extern void bignum_deamont_p256k1 (uint64_t z[4], const uint64_t x[4]); -/* Convert from almost-Montgomery form, z := (x / 2^384) mod p_384 */ -/* Input x[6]; output z[6] */ -extern void bignum_deamont_p384 (uint64_t z[6], uint64_t x[6]); -extern void bignum_deamont_p384_alt (uint64_t z[6], uint64_t x[6]); +/* Convert from almost-Montgomery form, z := (x / 2^384) mod p_384 */ +/* Input x[6]; output z[6] */ +extern void bignum_deamont_p384 (uint64_t z[6], const uint64_t x[6]); +extern void bignum_deamont_p384_alt (uint64_t z[6], const uint64_t x[6]); -/* Convert from almost-Montgomery form z := (x / 2^576) mod p_521 */ -/* Input x[9]; output z[9] */ -extern void bignum_deamont_p521 (uint64_t z[9], uint64_t x[9]); +/* Convert from almost-Montgomery form z := (x / 2^576) mod p_521 */ +/* Input x[9]; output z[9] */ +extern void bignum_deamont_p521 (uint64_t z[9], const uint64_t x[9]); /* Convert from almost-Montgomery form z := (x / 2^256) mod p_sm2 */ /* Input x[4]; output z[4] */ -extern void bignum_deamont_sm2 (uint64_t z[4], uint64_t x[4]); +extern void bignum_deamont_sm2 (uint64_t z[4], const uint64_t x[4]); -/* Convert from (almost-)Montgomery form z := (x / 2^{64k}) mod m */ -/* Inputs x[k], m[k]; output z[k] */ -extern void bignum_demont (uint64_t k, uint64_t *z, uint64_t *x, uint64_t *m); +/* Convert from (almost-)Montgomery form z := (x / 2^{64k}) mod m */ +/* Inputs x[k], m[k]; output z[k] */ +extern void bignum_demont (uint64_t k, uint64_t *z, const uint64_t *x, const uint64_t *m); -/* Convert from Montgomery form z := (x / 2^256) mod p_256, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_demont_p256 (uint64_t z[4], uint64_t x[4]); -extern void bignum_demont_p256_alt (uint64_t z[4], uint64_t x[4]); +/* Convert from Montgomery form z := (x / 2^256) mod p_256, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_demont_p256 (uint64_t z[4], const uint64_t x[4]); +extern void bignum_demont_p256_alt (uint64_t z[4], const uint64_t x[4]); -/* Convert from Montgomery form z := (x / 2^256) mod p_256k1, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_demont_p256k1 (uint64_t z[4], uint64_t x[4]); +/* Convert from Montgomery form z := (x / 2^256) mod p_256k1, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_demont_p256k1 (uint64_t z[4], const uint64_t x[4]); -/* Convert from Montgomery form z := (x / 2^384) mod p_384, assuming x reduced */ -/* Input x[6]; output z[6] */ -extern void bignum_demont_p384 (uint64_t z[6], uint64_t x[6]); -extern void bignum_demont_p384_alt (uint64_t z[6], uint64_t x[6]); +/* Convert from Montgomery form z := (x / 2^384) mod p_384, assuming x reduced */ +/* Input x[6]; output z[6] */ +extern void bignum_demont_p384 (uint64_t z[6], const uint64_t x[6]); +extern void bignum_demont_p384_alt (uint64_t z[6], const uint64_t x[6]); -/* Convert from Montgomery form z := (x / 2^576) mod p_521, assuming x reduced */ -/* Input x[9]; output z[9] */ -extern void bignum_demont_p521 (uint64_t z[9], uint64_t x[9]); +/* Convert from Montgomery form z := (x / 2^576) mod p_521, assuming x reduced */ +/* Input x[9]; output z[9] */ +extern void bignum_demont_p521 (uint64_t z[9], const uint64_t x[9]); /* Convert from Montgomery form z := (x / 2^256) mod p_sm2, assuming x reduced */ /* Input x[4]; output z[4] */ -extern void bignum_demont_sm2 (uint64_t z[4], uint64_t x[4]); +extern void bignum_demont_sm2 (uint64_t z[4], const uint64_t x[4]); -/* Select digit x[n] */ -/* Inputs x[k], n; output function return */ -extern uint64_t bignum_digit (uint64_t k, uint64_t *x, uint64_t n); +/* Select digit x[n] */ +/* Inputs x[k], n; output function return */ +extern uint64_t bignum_digit (uint64_t k, const uint64_t *x, uint64_t n); -/* Return size of bignum in digits (64-bit word) */ -/* Input x[k]; output function return */ -extern uint64_t bignum_digitsize (uint64_t k, uint64_t *x); +/* Return size of bignum in digits (64-bit word) */ +/* Input x[k]; output function return */ +extern uint64_t bignum_digitsize (uint64_t k, const uint64_t *x); -/* Divide bignum by 10: z' := z div 10, returning remainder z mod 10 */ -/* Inputs z[k]; outputs function return (remainder) and z[k] */ +/* Divide bignum by 10: z' := z div 10, returning remainder z mod 10 */ +/* Inputs z[k]; outputs function return (remainder) and z[k] */ extern uint64_t bignum_divmod10 (uint64_t k, uint64_t *z); -/* Double modulo p_25519, z := (2 * x) mod p_25519, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_double_p25519 (uint64_t z[4], uint64_t x[4]); - -/* Double modulo p_256, z := (2 * x) mod p_256, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_double_p256 (uint64_t z[4], uint64_t x[4]); - -/* Double modulo p_256k1, z := (2 * x) mod p_256k1, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_double_p256k1 (uint64_t z[4], uint64_t x[4]); +/* Double modulo p_25519, z := (2 * x) mod p_25519, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_double_p25519 (uint64_t z[4], const uint64_t x[4]); -/* Double modulo p_384, z := (2 * x) mod p_384, assuming x reduced */ -/* Input x[6]; output z[6] */ -extern void bignum_double_p384 (uint64_t z[6], uint64_t x[6]); +/* Double modulo p_256, z := (2 * x) mod p_256, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_double_p256 (uint64_t z[4], const uint64_t x[4]); -/* Double modulo p_521, z := (2 * x) mod p_521, assuming x reduced */ -/* Input x[9]; output z[9] */ -extern void bignum_double_p521 (uint64_t z[9], uint64_t x[9]); +/* Double modulo p_256k1, z := (2 * x) mod p_256k1, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_double_p256k1 (uint64_t z[4], const uint64_t x[4]); -/* Double modulo p_sm2, z := (2 * x) mod p_sm2, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_double_sm2 (uint64_t z[4], uint64_t x[4]); +/* Double modulo p_384, z := (2 * x) mod p_384, assuming x reduced */ +/* Input x[6]; output z[6] */ +extern void bignum_double_p384 (uint64_t z[6], const uint64_t x[6]); -/* Extended Montgomery reduce, returning results in input-output buffer */ -/* Inputs z[2*k], m[k], w; outputs function return (extra result bit) and z[2*k] */ -extern uint64_t bignum_emontredc (uint64_t k, uint64_t *z, uint64_t *m, uint64_t w); +/* Double modulo p_521, z := (2 * x) mod p_521, assuming x reduced */ +/* Input x[9]; output z[9] */ +extern void bignum_double_p521 (uint64_t z[9], const uint64_t x[9]); -/* Extended Montgomery reduce in 8-digit blocks, results in input-output buffer */ -/* Inputs z[2*k], m[k], w; outputs function return (extra result bit) and z[2*k] */ -extern uint64_t bignum_emontredc_8n (uint64_t k, uint64_t *z, uint64_t *m, uint64_t w); -// Inputs z[2*k], m[k], w; outputs function return (extra result bit) and z[2*k] -// Temporary buffer m_precalc[12*(k/4-1)] -extern uint64_t bignum_emontredc_8n_cdiff (uint64_t k, uint64_t *z, uint64_t *m, +/* Double modulo p_sm2, z := (2 * x) mod p_sm2, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_double_sm2 (uint64_t z[4], const uint64_t x[4]); + +/* Extended Montgomery reduce, returning results in input-output buffer */ +/* Inputs z[2*k], m[k], w; outputs function return (extra result bit) and z[2*k] */ +extern uint64_t bignum_emontredc (uint64_t k, uint64_t *z, const uint64_t *m, uint64_t w); + +/* Extended Montgomery reduce in 8-digit blocks, results in input-output buffer */ +/* Inputs z[2*k], m[k], w; outputs function return (extra result bit) and z[2*k] */ +extern uint64_t bignum_emontredc_8n (uint64_t k, uint64_t *z, const uint64_t *m, uint64_t w); +/* Inputs z[2*k], m[k], w; outputs function return (extra result bit) and z[2*k] */ +/* Temporary buffer m_precalc[12*(k/4-1)] */ +extern uint64_t bignum_emontredc_8n_cdiff (uint64_t k, uint64_t *z, const uint64_t *m, uint64_t w, uint64_t *m_precalc); -/* Test bignums for equality, x = y */ -/* Inputs x[m], y[n]; output function return */ -extern uint64_t bignum_eq (uint64_t m, uint64_t *x, uint64_t n, uint64_t *y); -/* Test bignum for even-ness */ -/* Input x[k]; output function return */ -extern uint64_t bignum_even (uint64_t k, uint64_t *x); +/* Test bignums for equality, x = y */ +/* Inputs x[m], y[n]; output function return */ +extern uint64_t bignum_eq (uint64_t m, const uint64_t *x, uint64_t n, const uint64_t *y); + +/* Test bignum for even-ness */ +/* Input x[k]; output function return */ +extern uint64_t bignum_even (uint64_t k, const uint64_t *x); -/* Convert 4-digit (256-bit) bignum from big-endian bytes */ -/* Input x[32] (bytes); output z[4] */ -extern void bignum_frombebytes_4 (uint64_t z[4], uint8_t x[32]); +/* Convert 4-digit (256-bit) bignum from big-endian bytes */ +/* Input x[32] (bytes); output z[4] */ +extern void bignum_frombebytes_4 (uint64_t z[4], const uint8_t x[32]); -/* Convert 6-digit (384-bit) bignum from big-endian bytes */ -/* Input x[48] (bytes); output z[6] */ -extern void bignum_frombebytes_6 (uint64_t z[6], uint8_t x[48]); +/* Convert 6-digit (384-bit) bignum from big-endian bytes */ +/* Input x[48] (bytes); output z[6] */ +extern void bignum_frombebytes_6 (uint64_t z[6], const uint8_t x[48]); -/* Convert 4-digit (256-bit) bignum from little-endian bytes */ -/* Input x[32] (bytes); output z[4] */ -extern void bignum_fromlebytes_4 (uint64_t z[4], uint8_t x[32]); +/* Convert 4-digit (256-bit) bignum from little-endian bytes */ +/* Input x[32] (bytes); output z[4] */ +extern void bignum_fromlebytes_4 (uint64_t z[4], const uint8_t x[32]); -/* Convert 6-digit (384-bit) bignum from little-endian bytes */ -/* Input x[48] (bytes); output z[6] */ -extern void bignum_fromlebytes_6 (uint64_t z[6], uint8_t x[48]); +/* Convert 6-digit (384-bit) bignum from little-endian bytes */ +/* Input x[48] (bytes); output z[6] */ +extern void bignum_fromlebytes_6 (uint64_t z[6], const uint8_t x[48]); -/* Convert little-endian bytes to 9-digit 528-bit bignum */ +/* Convert little-endian bytes to 9-digit 528-bit bignum */ /* Input x[66] (bytes); output z[9] */ -extern void bignum_fromlebytes_p521 (uint64_t z[9],uint8_t x[66]); +extern void bignum_fromlebytes_p521 (uint64_t z[9],const uint8_t x[66]); -/* Compare bignums, x >= y */ -/* Inputs x[m], y[n]; output function return */ -extern uint64_t bignum_ge (uint64_t m, uint64_t *x, uint64_t n, uint64_t *y); +/* Compare bignums, x >= y */ +/* Inputs x[m], y[n]; output function return */ +extern uint64_t bignum_ge (uint64_t m, const uint64_t *x, uint64_t n, const uint64_t *y); -/* Compare bignums, x > y */ -/* Inputs x[m], y[n]; output function return */ -extern uint64_t bignum_gt (uint64_t m, uint64_t *x, uint64_t n, uint64_t *y); +/* Compare bignums, x > y */ +/* Inputs x[m], y[n]; output function return */ +extern uint64_t bignum_gt (uint64_t m, const uint64_t *x, uint64_t n, const uint64_t *y); -/* Halve modulo p_256, z := (x / 2) mod p_256, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_half_p256 (uint64_t z[4], uint64_t x[4]); +/* Halve modulo p_256, z := (x / 2) mod p_256, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_half_p256 (uint64_t z[4], const uint64_t x[4]); -/* Halve modulo p_256k1, z := (x / 2) mod p_256k1, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_half_p256k1 (uint64_t z[4], uint64_t x[4]); +/* Halve modulo p_256k1, z := (x / 2) mod p_256k1, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_half_p256k1 (uint64_t z[4], const uint64_t x[4]); -/* Halve modulo p_384, z := (x / 2) mod p_384, assuming x reduced */ -/* Input x[6]; output z[6] */ -extern void bignum_half_p384 (uint64_t z[6], uint64_t x[6]); +/* Halve modulo p_384, z := (x / 2) mod p_384, assuming x reduced */ +/* Input x[6]; output z[6] */ +extern void bignum_half_p384 (uint64_t z[6], const uint64_t x[6]); -/* Halve modulo p_521, z := (x / 2) mod p_521, assuming x reduced */ -/* Input x[9]; output z[9] */ -extern void bignum_half_p521 (uint64_t z[9], uint64_t x[9]); +/* Halve modulo p_521, z := (x / 2) mod p_521, assuming x reduced */ +/* Input x[9]; output z[9] */ +extern void bignum_half_p521 (uint64_t z[9], const uint64_t x[9]); -/* Halve modulo p_sm2, z := (x / 2) mod p_sm2, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_half_sm2 (uint64_t z[4], uint64_t x[4]); +/* Halve modulo p_sm2, z := (x / 2) mod p_sm2, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_half_sm2 (uint64_t z[4], const uint64_t x[4]); /* Modular inverse modulo p_25519 = 2^255 - 19 */ /* Input x[4]; output z[4] */ -extern void bignum_inv_p25519(uint64_t z[4],uint64_t x[4]); +extern void bignum_inv_p25519(uint64_t z[4],const uint64_t x[4]); /* Modular inverse modulo p_256 = 2^256 - 2^224 + 2^192 + 2^96 - 1 */ /* Input x[4]; output z[4] */ -extern void bignum_inv_p256(uint64_t z[4],uint64_t x[4]); +extern void bignum_inv_p256(uint64_t z[4],const uint64_t x[4]); /* Modular inverse modulo p_384 = 2^384 - 2^128 - 2^96 + 2^32 - 1 */ /* Input x[6]; output z[6] */ -extern void bignum_inv_p384(uint64_t z[6],uint64_t x[6]); +extern void bignum_inv_p384(uint64_t z[6],const uint64_t x[6]); /* Modular inverse modulo p_521 = 2^521 - 1 */ /* Input x[9]; output z[9] */ -extern void bignum_inv_p521(uint64_t z[9],uint64_t x[9]); +extern void bignum_inv_p521(uint64_t z[9],const uint64_t x[9]); /* Modular inverse modulo p_sm2 = 2^256 - 2^224 - 2^96 + 2^64 - 1 */ /* Input x[4]; output z[4] */ -extern void bignum_inv_sm2(uint64_t z[S2N_BIGNUM_STATIC 4],uint64_t x[S2N_BIGNUM_STATIC 4]); +extern void bignum_inv_sm2(uint64_t z[4],const uint64_t x[4]); /* Inverse square root modulo p_25519 */ /* Input x[4]; output function return (Legendre symbol) and z[4] */ -extern int64_t bignum_invsqrt_p25519(uint64_t z[4],uint64_t x[4]); -extern int64_t bignum_invsqrt_p25519_alt(uint64_t z[4],uint64_t x[4]); +extern int64_t bignum_invsqrt_p25519(uint64_t z[4],const uint64_t x[4]); +extern int64_t bignum_invsqrt_p25519_alt(uint64_t z[4],const uint64_t x[4]); -/* Test bignum for zero-ness, x = 0 */ -/* Input x[k]; output function return */ -extern uint64_t bignum_iszero (uint64_t k, uint64_t *x); +/* Test bignum for zero-ness, x = 0 */ +/* Input x[k]; output function return */ +extern uint64_t bignum_iszero (uint64_t k, const uint64_t *x); -/* Multiply z := x * y */ -/* Inputs x[16], y[16]; output z[32]; temporary buffer t[>=32] */ -extern void bignum_kmul_16_32 (uint64_t z[32], uint64_t x[16], uint64_t y[16], uint64_t t[32]); +/* Multiply z := x * y */ +/* Inputs x[16], y[16]; output z[32]; temporary buffer t[>=32] */ +extern void bignum_kmul_16_32 (uint64_t z[32], const uint64_t x[16], const uint64_t y[16], uint64_t t[32]); -/* Multiply z := x * y */ -/* Inputs x[32], y[32]; output z[64]; temporary buffer t[>=96] */ -extern void bignum_kmul_32_64 (uint64_t z[64], uint64_t x[32], uint64_t y[32], uint64_t t[96]); +/* Multiply z := x * y */ +/* Inputs x[32], y[32]; output z[64]; temporary buffer t[>=96] */ +extern void bignum_kmul_32_64 (uint64_t z[64], const uint64_t x[32], const uint64_t y[32], uint64_t t[96]); -/* Square, z := x^2 */ -/* Input x[16]; output z[32]; temporary buffer t[>=24] */ -extern void bignum_ksqr_16_32 (uint64_t z[32], uint64_t x[16], uint64_t t[24]); +/* Square, z := x^2 */ +/* Input x[16]; output z[32]; temporary buffer t[>=24] */ +extern void bignum_ksqr_16_32 (uint64_t z[32], const uint64_t x[16], uint64_t t[24]); -/* Square, z := x^2 */ -/* Input x[32]; output z[64]; temporary buffer t[>=72] */ -extern void bignum_ksqr_32_64 (uint64_t z[64], uint64_t x[32], uint64_t t[72]); +/* Square, z := x^2 */ +/* Input x[32]; output z[64]; temporary buffer t[>=72] */ +extern void bignum_ksqr_32_64 (uint64_t z[64], const uint64_t x[32], uint64_t t[72]); -/* Compare bignums, x <= y */ -/* Inputs x[m], y[n]; output function return */ -extern uint64_t bignum_le (uint64_t m, uint64_t *x, uint64_t n, uint64_t *y); +/* Compare bignums, x <= y */ +/* Inputs x[m], y[n]; output function return */ +extern uint64_t bignum_le (uint64_t m, const uint64_t *x, uint64_t n, const uint64_t *y); -/* Convert 4-digit (256-bit) bignum to/from little-endian form */ -/* Input x[4]; output z[4] */ -extern void bignum_littleendian_4 (uint64_t z[4], uint64_t x[4]); +/* Convert 4-digit (256-bit) bignum to/from little-endian form */ +/* Input x[4]; output z[4] */ +extern void bignum_littleendian_4 (uint64_t z[4], const uint64_t x[4]); -/* Convert 6-digit (384-bit) bignum to/from little-endian form */ -/* Input x[6]; output z[6] */ -extern void bignum_littleendian_6 (uint64_t z[6], uint64_t x[6]); +/* Convert 6-digit (384-bit) bignum to/from little-endian form */ +/* Input x[6]; output z[6] */ +extern void bignum_littleendian_6 (uint64_t z[6], const uint64_t x[6]); -/* Compare bignums, x < y */ -/* Inputs x[m], y[n]; output function return */ -extern uint64_t bignum_lt (uint64_t m, uint64_t *x, uint64_t n, uint64_t *y); +/* Compare bignums, x < y */ +/* Inputs x[m], y[n]; output function return */ +extern uint64_t bignum_lt (uint64_t m, const uint64_t *x, uint64_t n, const uint64_t *y); -/* Multiply-add, z := z + x * y */ -/* Inputs x[m], y[n]; outputs function return (carry-out) and z[k] */ -extern uint64_t bignum_madd (uint64_t k, uint64_t *z, uint64_t m, uint64_t *x, uint64_t n, uint64_t *y); +/* Multiply-add, z := z + x * y */ +/* Inputs x[m], y[n]; outputs function return (carry-out) and z[k] */ +extern uint64_t bignum_madd (uint64_t k, uint64_t *z, uint64_t m, const uint64_t *x, uint64_t n, const uint64_t *y); /* Multiply-add modulo the order of the curve25519/edwards25519 basepoint */ /* Inputs x[4], y[4], c[4]; output z[4] */ -extern void bignum_madd_n25519 (uint64_t z[4], uint64_t x[4], uint64_t y[4], uint64_t c[4]); -extern void bignum_madd_n25519_alt (uint64_t z[4], uint64_t x[4], uint64_t y[4], uint64_t c[4]); +extern void bignum_madd_n25519 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4], const uint64_t c[4]); +extern void bignum_madd_n25519_alt (uint64_t z[4], const uint64_t x[4], const uint64_t y[4], const uint64_t c[4]); -/* Reduce modulo group order, z := x mod m_25519 */ -/* Input x[4]; output z[4] */ -extern void bignum_mod_m25519_4 (uint64_t z[4], uint64_t x[4]); +/* Reduce modulo group order, z := x mod m_25519 */ +/* Input x[k]; output z[4] */ +extern void bignum_mod_m25519 (uint64_t z[4], uint64_t k, const uint64_t *x); + +/* Reduce modulo group order, z := x mod m_25519 */ +/* Input x[4]; output z[4] */ +extern void bignum_mod_m25519_4 (uint64_t z[4], const uint64_t x[4]); /* Reduce modulo basepoint order, z := x mod n_25519 */ /* Input x[k]; output z[4] */ -extern void bignum_mod_n25519 (uint64_t z[4], uint64_t k, uint64_t *x); - -/* Reduce modulo basepoint order, z := x mod n_25519 */ -/* Input x[4]; output z[4] */ -extern void bignum_mod_n25519_4 (uint64_t z[4], uint64_t x[4]); - -/* Reduce modulo group order, z := x mod n_256 */ -/* Input x[k]; output z[4] */ -extern void bignum_mod_n256 (uint64_t z[4], uint64_t k, uint64_t *x); -extern void bignum_mod_n256_alt (uint64_t z[4], uint64_t k, uint64_t *x); - -/* Reduce modulo group order, z := x mod n_256 */ -/* Input x[4]; output z[4] */ -extern void bignum_mod_n256_4 (uint64_t z[4], uint64_t x[4]); - -/* Reduce modulo group order, z := x mod n_256k1 */ -/* Input x[4]; output z[4] */ -extern void bignum_mod_n256k1_4 (uint64_t z[4], uint64_t x[4]); - -/* Reduce modulo group order, z := x mod n_384 */ -/* Input x[k]; output z[6] */ -extern void bignum_mod_n384 (uint64_t z[6], uint64_t k, uint64_t *x); -extern void bignum_mod_n384_alt (uint64_t z[6], uint64_t k, uint64_t *x); - -/* Reduce modulo group order, z := x mod n_384 */ -/* Input x[6]; output z[6] */ -extern void bignum_mod_n384_6 (uint64_t z[6], uint64_t x[6]); - -/* Reduce modulo group order, z := x mod n_521 */ -/* Input x[9]; output z[9] */ -extern void bignum_mod_n521_9 (uint64_t z[9], uint64_t x[9]); -extern void bignum_mod_n521_9_alt (uint64_t z[9], uint64_t x[9]); - -/* Reduce modulo group order, z := x mod n_sm2 */ -/* Input x[k]; output z[4] */ -extern void bignum_mod_nsm2 (uint64_t z[4], uint64_t k, uint64_t *x); -extern void bignum_mod_nsm2_alt (uint64_t z[4], uint64_t k, uint64_t *x); - -/* Reduce modulo group order, z := x mod n_sm2 */ -/* Input x[4]; output z[4] */ -extern void bignum_mod_nsm2_4 (uint64_t z[4], uint64_t x[4]); - -/* Reduce modulo field characteristic, z := x mod p_25519 */ -/* Input x[4]; output z[4] */ -extern void bignum_mod_p25519_4 (uint64_t z[4], uint64_t x[4]); - -/* Reduce modulo field characteristic, z := x mod p_256 */ -/* Input x[k]; output z[4] */ -extern void bignum_mod_p256 (uint64_t z[4], uint64_t k, uint64_t *x); -extern void bignum_mod_p256_alt (uint64_t z[4], uint64_t k, uint64_t *x); - -/* Reduce modulo field characteristic, z := x mod p_256 */ -/* Input x[4]; output z[4] */ -extern void bignum_mod_p256_4 (uint64_t z[4], uint64_t x[4]); - -/* Reduce modulo field characteristic, z := x mod p_256k1 */ -/* Input x[4]; output z[4] */ -extern void bignum_mod_p256k1_4 (uint64_t z[4], uint64_t x[4]); - -/* Reduce modulo field characteristic, z := x mod p_384 */ -/* Input x[k]; output z[6] */ -extern void bignum_mod_p384 (uint64_t z[6], uint64_t k, uint64_t *x); -extern void bignum_mod_p384_alt (uint64_t z[6], uint64_t k, uint64_t *x); - -/* Reduce modulo field characteristic, z := x mod p_384 */ -/* Input x[6]; output z[6] */ -extern void bignum_mod_p384_6 (uint64_t z[6], uint64_t x[6]); - -/* Reduce modulo field characteristic, z := x mod p_521 */ -/* Input x[9]; output z[9] */ -extern void bignum_mod_p521_9 (uint64_t z[9], uint64_t x[9]); +extern void bignum_mod_n25519 (uint64_t z[4], uint64_t k, const uint64_t *x); + +/* Reduce modulo basepoint order, z := x mod n_25519 */ +/* Input x[4]; output z[4] */ +extern void bignum_mod_n25519_4 (uint64_t z[4], const uint64_t x[4]); + +/* Reduce modulo group order, z := x mod n_256 */ +/* Input x[k]; output z[4] */ +extern void bignum_mod_n256 (uint64_t z[4], uint64_t k, const uint64_t *x); +extern void bignum_mod_n256_alt (uint64_t z[4], uint64_t k, const uint64_t *x); + +/* Reduce modulo group order, z := x mod n_256 */ +/* Input x[4]; output z[4] */ +extern void bignum_mod_n256_4 (uint64_t z[4], const uint64_t x[4]); + +/* Reduce modulo group order, z := x mod n_256k1 */ +/* Input x[4]; output z[4] */ +extern void bignum_mod_n256k1_4 (uint64_t z[4], const uint64_t x[4]); + +/* Reduce modulo group order, z := x mod n_384 */ +/* Input x[k]; output z[6] */ +extern void bignum_mod_n384 (uint64_t z[6], uint64_t k, const uint64_t *x); +extern void bignum_mod_n384_alt (uint64_t z[6], uint64_t k, const uint64_t *x); + +/* Reduce modulo group order, z := x mod n_384 */ +/* Input x[6]; output z[6] */ +extern void bignum_mod_n384_6 (uint64_t z[6], const uint64_t x[6]); + +/* Reduce modulo group order, z := x mod n_521 */ +/* Input x[9]; output z[9] */ +extern void bignum_mod_n521_9 (uint64_t z[9], const uint64_t x[9]); +extern void bignum_mod_n521_9_alt (uint64_t z[9], const uint64_t x[9]); + +/* Reduce modulo group order, z := x mod n_sm2 */ +/* Input x[k]; output z[4] */ +extern void bignum_mod_nsm2 (uint64_t z[4], uint64_t k, const uint64_t *x); +extern void bignum_mod_nsm2_alt (uint64_t z[4], uint64_t k, const uint64_t *x); + +/* Reduce modulo group order, z := x mod n_sm2 */ +/* Input x[4]; output z[4] */ +extern void bignum_mod_nsm2_4 (uint64_t z[4], const uint64_t x[4]); + +/* Reduce modulo field characteristic, z := x mod p_25519 */ +/* Input x[4]; output z[4] */ +extern void bignum_mod_p25519_4 (uint64_t z[4], const uint64_t x[4]); + +/* Reduce modulo field characteristic, z := x mod p_256 */ +/* Input x[k]; output z[4] */ +extern void bignum_mod_p256 (uint64_t z[4], uint64_t k, const uint64_t *x); +extern void bignum_mod_p256_alt (uint64_t z[4], uint64_t k, const uint64_t *x); + +/* Reduce modulo field characteristic, z := x mod p_256 */ +/* Input x[4]; output z[4] */ +extern void bignum_mod_p256_4 (uint64_t z[4], const uint64_t x[4]); + +/* Reduce modulo field characteristic, z := x mod p_256k1 */ +/* Input x[4]; output z[4] */ +extern void bignum_mod_p256k1_4 (uint64_t z[4], const uint64_t x[4]); + +/* Reduce modulo field characteristic, z := x mod p_384 */ +/* Input x[k]; output z[6] */ +extern void bignum_mod_p384 (uint64_t z[6], uint64_t k, const uint64_t *x); +extern void bignum_mod_p384_alt (uint64_t z[6], uint64_t k, const uint64_t *x); + +/* Reduce modulo field characteristic, z := x mod p_384 */ +/* Input x[6]; output z[6] */ +extern void bignum_mod_p384_6 (uint64_t z[6], const uint64_t x[6]); + +/* Reduce modulo field characteristic, z := x mod p_521 */ +/* Input x[9]; output z[9] */ +extern void bignum_mod_p521_9 (uint64_t z[9], const uint64_t x[9]); /* Reduce modulo field characteristic, z := x mod p_sm2 */ /* Input x[k]; output z[4] */ -extern void bignum_mod_sm2 (uint64_t z[4], uint64_t k, uint64_t *x); +extern void bignum_mod_sm2 (uint64_t z[4], uint64_t k, const uint64_t *x); /* Reduce modulo field characteristic, z := x mod p_sm2 */ /* Input x[4]; output z[4] */ -extern void bignum_mod_sm2_4 (uint64_t z[4], uint64_t x[4]); +extern void bignum_mod_sm2_4 (uint64_t z[4], const uint64_t x[4]); -/* Add modulo m, z := (x + y) mod m, assuming x and y reduced */ -/* Inputs x[k], y[k], m[k]; output z[k] */ -extern void bignum_modadd (uint64_t k, uint64_t *z, uint64_t *x, uint64_t *y, uint64_t *m); +/* Add modulo m, z := (x + y) mod m, assuming x and y reduced */ +/* Inputs x[k], y[k], m[k]; output z[k] */ +extern void bignum_modadd (uint64_t k, uint64_t *z, const uint64_t *x, const uint64_t *y, const uint64_t *m); -/* Double modulo m, z := (2 * x) mod m, assuming x reduced */ -/* Inputs x[k], m[k]; output z[k] */ -extern void bignum_moddouble (uint64_t k, uint64_t *z, uint64_t *x, uint64_t *m); +/* Double modulo m, z := (2 * x) mod m, assuming x reduced */ +/* Inputs x[k], m[k]; output z[k] */ +extern void bignum_moddouble (uint64_t k, uint64_t *z, const uint64_t *x, const uint64_t *m); /* Modular exponentiation for arbitrary odd modulus, z := (a^p) mod m */ -/* Inputs a[k], p[k], m[k]; output z[k], temporary buffer t[>=3*k] */ -extern void bignum_modexp(uint64_t k,uint64_t *z, uint64_t *a,uint64_t *p,uint64_t *m,uint64_t *t); +/* Inputs a[k], p[k], m[k]; output z[k]; temporary buffer t[>=3*k] */ +extern void bignum_modexp(uint64_t k,uint64_t *z, const uint64_t *a,const uint64_t *p,const uint64_t *m,uint64_t *t); -/* Compute "modification" constant z := 2^{64k} mod m */ -/* Input m[k]; output z[k]; temporary buffer t[>=k] */ -extern void bignum_modifier (uint64_t k, uint64_t *z, uint64_t *m, uint64_t *t); +/* Compute "modification" constant z := 2^{64k} mod m */ +/* Input m[k]; output z[k]; temporary buffer t[>=k] */ +extern void bignum_modifier (uint64_t k, uint64_t *z, const uint64_t *m, uint64_t *t); -/* Invert modulo m, z = (1/a) mod b, assuming b is an odd number > 1, a coprime to b */ -/* Inputs a[k], b[k]; output z[k]; temporary buffer t[>=3*k] */ -extern void bignum_modinv (uint64_t k, uint64_t *z, uint64_t *a, uint64_t *b, uint64_t *t); +/* Invert modulo m, z = (1/a) mod b, assuming b is an odd number > 1, a coprime to b */ +/* Inputs a[k], b[k]; output z[k]; temporary buffer t[>=3*k] */ +extern void bignum_modinv (uint64_t k, uint64_t *z, const uint64_t *a, const uint64_t *b, uint64_t *t); -/* Optionally negate modulo m, z := (-x) mod m (if p nonzero) or z := x (if p zero), assuming x reduced */ -/* Inputs p, x[k], m[k]; output z[k] */ -extern void bignum_modoptneg (uint64_t k, uint64_t *z, uint64_t p, uint64_t *x, uint64_t *m); +/* Optionally negate modulo m, z := (-x) mod m (if p nonzero) or z := x (if p zero), assuming x reduced */ +/* Inputs p, x[k], m[k]; output z[k] */ +extern void bignum_modoptneg (uint64_t k, uint64_t *z, uint64_t p, const uint64_t *x, const uint64_t *m); -/* Subtract modulo m, z := (x - y) mod m, assuming x and y reduced */ -/* Inputs x[k], y[k], m[k]; output z[k] */ -extern void bignum_modsub (uint64_t k, uint64_t *z, uint64_t *x, uint64_t *y, uint64_t *m); +/* Subtract modulo m, z := (x - y) mod m, assuming x and y reduced */ +/* Inputs x[k], y[k], m[k]; output z[k] */ +extern void bignum_modsub (uint64_t k, uint64_t *z, const uint64_t *x, const uint64_t *y, const uint64_t *m); -/* Compute "montification" constant z := 2^{128k} mod m */ -/* Input m[k]; output z[k]; temporary buffer t[>=k] */ -extern void bignum_montifier (uint64_t k, uint64_t *z, uint64_t *m, uint64_t *t); +/* Compute "montification" constant z := 2^{128k} mod m */ +/* Input m[k]; output z[k]; temporary buffer t[>=k] */ +extern void bignum_montifier (uint64_t k, uint64_t *z, const uint64_t *m, uint64_t *t); /* Montgomery inverse modulo p_256 = 2^256 - 2^224 + 2^192 + 2^96 - 1 */ /* Input x[4]; output z[4] */ -extern void bignum_montinv_p256(uint64_t z[4],uint64_t x[4]); +extern void bignum_montinv_p256(uint64_t z[4],const uint64_t x[4]); /* Montgomery inverse modulo p_384 = 2^384 - 2^128 - 2^96 + 2^32 - 1 */ /* Input x[6]; output z[6] */ -extern void bignum_montinv_p384(uint64_t z[S2N_BIGNUM_STATIC 6],uint64_t x[S2N_BIGNUM_STATIC 6]); +extern void bignum_montinv_p384(uint64_t z[6],const uint64_t x[6]); /* Montgomery inverse modulo p_sm2 = 2^256 - 2^224 - 2^96 + 2^64 - 1 */ /* Input x[4]; output z[4] */ -extern void bignum_montinv_sm2(uint64_t z[4],uint64_t x[4]); - -/* Montgomery multiply, z := (x * y / 2^{64k}) mod m */ -/* Inputs x[k], y[k], m[k]; output z[k] */ -extern void bignum_montmul (uint64_t k, uint64_t *z, uint64_t *x, uint64_t *y, uint64_t *m); - -/* Montgomery multiply, z := (x * y / 2^256) mod p_256 */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_montmul_p256 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); -extern void bignum_montmul_p256_alt (uint64_t z[4], uint64_t x[4], uint64_t y[4]); - -/* Montgomery multiply, z := (x * y / 2^256) mod p_256k1 */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_montmul_p256k1 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); -extern void bignum_montmul_p256k1_alt (uint64_t z[4], uint64_t x[4], uint64_t y[4]); - -/* Montgomery multiply, z := (x * y / 2^384) mod p_384 */ -/* Inputs x[6], y[6]; output z[6] */ -extern void bignum_montmul_p384 (uint64_t z[6], uint64_t x[6], uint64_t y[6]); -extern void bignum_montmul_p384_alt (uint64_t z[6], uint64_t x[6], uint64_t y[6]); - -/* Montgomery multiply, z := (x * y / 2^576) mod p_521 */ -/* Inputs x[9], y[9]; output z[9] */ -extern void bignum_montmul_p521 (uint64_t z[9], uint64_t x[9], uint64_t y[9]); -extern void bignum_montmul_p521_alt (uint64_t z[9], uint64_t x[9], uint64_t y[9]); - -/* Montgomery multiply, z := (x * y / 2^256) mod p_sm2 */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_montmul_sm2 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); -extern void bignum_montmul_sm2_alt (uint64_t z[4], uint64_t x[4], uint64_t y[4]); - -/* Montgomery reduce, z := (x' / 2^{64p}) MOD m */ -/* Inputs x[n], m[k], p; output z[k] */ -extern void bignum_montredc (uint64_t k, uint64_t *z, uint64_t n, uint64_t *x, uint64_t *m, uint64_t p); - -/* Montgomery square, z := (x^2 / 2^{64k}) mod m */ -/* Inputs x[k], m[k]; output z[k] */ -extern void bignum_montsqr (uint64_t k, uint64_t *z, uint64_t *x, uint64_t *m); - -/* Montgomery square, z := (x^2 / 2^256) mod p_256 */ -/* Input x[4]; output z[4] */ -extern void bignum_montsqr_p256 (uint64_t z[4], uint64_t x[4]); -extern void bignum_montsqr_p256_alt (uint64_t z[4], uint64_t x[4]); - -/* Montgomery square, z := (x^2 / 2^256) mod p_256k1 */ -/* Input x[4]; output z[4] */ -extern void bignum_montsqr_p256k1 (uint64_t z[4], uint64_t x[4]); -extern void bignum_montsqr_p256k1_alt (uint64_t z[4], uint64_t x[4]); - -/* Montgomery square, z := (x^2 / 2^384) mod p_384 */ -/* Input x[6]; output z[6] */ -extern void bignum_montsqr_p384 (uint64_t z[6], uint64_t x[6]); -extern void bignum_montsqr_p384_alt (uint64_t z[6], uint64_t x[6]); - -/* Montgomery square, z := (x^2 / 2^576) mod p_521 */ -/* Input x[9]; output z[9] */ -extern void bignum_montsqr_p521 (uint64_t z[9], uint64_t x[9]); -extern void bignum_montsqr_p521_alt (uint64_t z[9], uint64_t x[9]); - -/* Montgomery square, z := (x^2 / 2^256) mod p_sm2 */ -/* Input x[4]; output z[4] */ -extern void bignum_montsqr_sm2 (uint64_t z[4], uint64_t x[4]); -extern void bignum_montsqr_sm2_alt (uint64_t z[4], uint64_t x[4]); - -/* Multiply z := x * y */ -/* Inputs x[m], y[n]; output z[k] */ -extern void bignum_mul (uint64_t k, uint64_t *z, uint64_t m, uint64_t *x, uint64_t n, uint64_t *y); - -/* Multiply z := x * y */ -/* Inputs x[4], y[4]; output z[8] */ -extern void bignum_mul_4_8 (uint64_t z[8], uint64_t x[4], uint64_t y[4]); -extern void bignum_mul_4_8_alt (uint64_t z[8], uint64_t x[4], uint64_t y[4]); - -/* Multiply z := x * y */ -/* Inputs x[6], y[6]; output z[12] */ -extern void bignum_mul_6_12 (uint64_t z[12], uint64_t x[6], uint64_t y[6]); -extern void bignum_mul_6_12_alt (uint64_t z[12], uint64_t x[6], uint64_t y[6]); - -/* Multiply z := x * y */ -/* Inputs x[8], y[8]; output z[16] */ -extern void bignum_mul_8_16 (uint64_t z[16], uint64_t x[8], uint64_t y[8]); -extern void bignum_mul_8_16_alt (uint64_t z[16], uint64_t x[8], uint64_t y[8]); - -/* Multiply modulo p_25519, z := (x * y) mod p_25519 */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_mul_p25519 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); -extern void bignum_mul_p25519_alt (uint64_t z[4], uint64_t x[4], uint64_t y[4]); - -/* Multiply modulo p_256k1, z := (x * y) mod p_256k1 */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_mul_p256k1 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); -extern void bignum_mul_p256k1_alt (uint64_t z[4], uint64_t x[4], uint64_t y[4]); - -/* Multiply modulo p_521, z := (x * y) mod p_521, assuming x and y reduced */ -/* Inputs x[9], y[9]; output z[9] */ -extern void bignum_mul_p521 (uint64_t z[9], uint64_t x[9], uint64_t y[9]); -extern void bignum_mul_p521_alt (uint64_t z[9], uint64_t x[9], uint64_t y[9]); - -/* Multiply bignum by 10 and add word: z := 10 * z + d */ -/* Inputs z[k], d; outputs function return (carry) and z[k] */ +extern void bignum_montinv_sm2(uint64_t z[4],const uint64_t x[4]); + +/* Montgomery multiply, z := (x * y / 2^{64k}) mod m */ +/* Inputs x[k], y[k], m[k]; output z[k] */ +extern void bignum_montmul (uint64_t k, uint64_t *z, const uint64_t *x, const uint64_t *y, const uint64_t *m); + +/* Montgomery multiply, z := (x * y / 2^256) mod p_256 */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_montmul_p256 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); +extern void bignum_montmul_p256_alt (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); + +/* Montgomery multiply, z := (x * y / 2^256) mod p_256k1 */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_montmul_p256k1 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); +extern void bignum_montmul_p256k1_alt (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); + +/* Montgomery multiply, z := (x * y / 2^384) mod p_384 */ +/* Inputs x[6], y[6]; output z[6] */ +extern void bignum_montmul_p384 (uint64_t z[6], const uint64_t x[6], const uint64_t y[6]); +extern void bignum_montmul_p384_alt (uint64_t z[6], const uint64_t x[6], const uint64_t y[6]); + +/* Montgomery multiply, z := (x * y / 2^576) mod p_521 */ +/* Inputs x[9], y[9]; output z[9] */ +extern void bignum_montmul_p521 (uint64_t z[9], const uint64_t x[9], const uint64_t y[9]); +extern void bignum_montmul_p521_alt (uint64_t z[9], const uint64_t x[9], const uint64_t y[9]); + +/* Montgomery multiply, z := (x * y / 2^256) mod p_sm2 */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_montmul_sm2 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); +extern void bignum_montmul_sm2_alt (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); + +/* Montgomery reduce, z := (x' / 2^{64p}) MOD m */ +/* Inputs x[n], m[k], p; output z[k] */ +extern void bignum_montredc (uint64_t k, uint64_t *z, uint64_t n, const uint64_t *x, const uint64_t *m, uint64_t p); + +/* Montgomery square, z := (x^2 / 2^{64k}) mod m */ +/* Inputs x[k], m[k]; output z[k] */ +extern void bignum_montsqr (uint64_t k, uint64_t *z, const uint64_t *x, const uint64_t *m); + +/* Montgomery square, z := (x^2 / 2^256) mod p_256 */ +/* Input x[4]; output z[4] */ +extern void bignum_montsqr_p256 (uint64_t z[4], const uint64_t x[4]); +extern void bignum_montsqr_p256_alt (uint64_t z[4], const uint64_t x[4]); + +/* Montgomery square, z := (x^2 / 2^256) mod p_256k1 */ +/* Input x[4]; output z[4] */ +extern void bignum_montsqr_p256k1 (uint64_t z[4], const uint64_t x[4]); +extern void bignum_montsqr_p256k1_alt (uint64_t z[4], const uint64_t x[4]); + +/* Montgomery square, z := (x^2 / 2^384) mod p_384 */ +/* Input x[6]; output z[6] */ +extern void bignum_montsqr_p384 (uint64_t z[6], const uint64_t x[6]); +extern void bignum_montsqr_p384_alt (uint64_t z[6], const uint64_t x[6]); + +/* Montgomery square, z := (x^2 / 2^576) mod p_521 */ +/* Input x[9]; output z[9] */ +extern void bignum_montsqr_p521 (uint64_t z[9], const uint64_t x[9]); +extern void bignum_montsqr_p521_alt (uint64_t z[9], const uint64_t x[9]); + +/* Montgomery square, z := (x^2 / 2^256) mod p_sm2 */ +/* Input x[4]; output z[4] */ +extern void bignum_montsqr_sm2 (uint64_t z[4], const uint64_t x[4]); +extern void bignum_montsqr_sm2_alt (uint64_t z[4], const uint64_t x[4]); + +/* Multiply z := x * y */ +/* Inputs x[m], y[n]; output z[k] */ +extern void bignum_mul (uint64_t k, uint64_t *z, uint64_t m, const uint64_t *x, uint64_t n, const uint64_t *y); + +/* Multiply z := x * y */ +/* Inputs x[4], y[4]; output z[8] */ +extern void bignum_mul_4_8 (uint64_t z[8], const uint64_t x[4], const uint64_t y[4]); +extern void bignum_mul_4_8_alt (uint64_t z[8], const uint64_t x[4], const uint64_t y[4]); + +/* Multiply z := x * y */ +/* Inputs x[6], y[6]; output z[12] */ +extern void bignum_mul_6_12 (uint64_t z[12], const uint64_t x[6], const uint64_t y[6]); +extern void bignum_mul_6_12_alt (uint64_t z[12], const uint64_t x[6], const uint64_t y[6]); + +/* Multiply z := x * y */ +/* Inputs x[8], y[8]; output z[16] */ +extern void bignum_mul_8_16 (uint64_t z[16], const uint64_t x[8], const uint64_t y[8]); +extern void bignum_mul_8_16_alt (uint64_t z[16], const uint64_t x[8], const uint64_t y[8]); + +/* Multiply modulo p_25519, z := (x * y) mod p_25519 */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_mul_p25519 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); +extern void bignum_mul_p25519_alt (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); + +/* Multiply modulo p_256k1, z := (x * y) mod p_256k1 */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_mul_p256k1 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); +extern void bignum_mul_p256k1_alt (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); + +/* Multiply modulo p_521, z := (x * y) mod p_521, assuming x and y reduced */ +/* Inputs x[9], y[9]; output z[9] */ +extern void bignum_mul_p521 (uint64_t z[9], const uint64_t x[9], const uint64_t y[9]); +extern void bignum_mul_p521_alt (uint64_t z[9], const uint64_t x[9], const uint64_t y[9]); + +/* Multiply bignum by 10 and add word: z := 10 * z + d */ +/* Inputs z[k], d; outputs function return (carry) and z[k] */ extern uint64_t bignum_muladd10 (uint64_t k, uint64_t *z, uint64_t d); -/* Multiplex/select z := x (if p nonzero) or z := y (if p zero) */ -/* Inputs p, x[k], y[k]; output z[k] */ -extern void bignum_mux (uint64_t p, uint64_t k, uint64_t *z, uint64_t *x, uint64_t *y); +/* Multiplex/select z := x (if p nonzero) or z := y (if p zero) */ +/* Inputs p, x[k], y[k]; output z[k] */ +extern void bignum_mux (uint64_t p, uint64_t k, uint64_t *z, const uint64_t *x, const uint64_t *y); -/* 256-bit multiplex/select z := x (if p nonzero) or z := y (if p zero) */ -/* Inputs p, x[4], y[4]; output z[4] */ -extern void bignum_mux_4 (uint64_t p, uint64_t z[4],uint64_t x[4], uint64_t y[4]); +/* 256-bit multiplex/select z := x (if p nonzero) or z := y (if p zero) */ +/* Inputs p, x[4], y[4]; output z[4] */ +extern void bignum_mux_4 (uint64_t p, uint64_t z[4],const uint64_t x[4], const uint64_t y[4]); -/* 384-bit multiplex/select z := x (if p nonzero) or z := y (if p zero) */ -/* Inputs p, x[6], y[6]; output z[6] */ -extern void bignum_mux_6 (uint64_t p, uint64_t z[6],uint64_t x[6], uint64_t y[6]); +/* 384-bit multiplex/select z := x (if p nonzero) or z := y (if p zero) */ +/* Inputs p, x[6], y[6]; output z[6] */ +extern void bignum_mux_6 (uint64_t p, uint64_t z[6],const uint64_t x[6], const uint64_t y[6]); -/* Select element from 16-element table, z := xs[k*i] */ -/* Inputs xs[16*k], i; output z[k] */ -extern void bignum_mux16 (uint64_t k, uint64_t *z, uint64_t *xs, uint64_t i); +/* Select element from 16-element table, z := xs[k*i] */ +/* Inputs xs[16*k], i; output z[k] */ +extern void bignum_mux16 (uint64_t k, uint64_t *z, const uint64_t *xs, uint64_t i); -/* Negate modulo p_25519, z := (-x) mod p_25519, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_neg_p25519 (uint64_t z[4], uint64_t x[4]); +/* Negate modulo p_25519, z := (-x) mod p_25519, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_neg_p25519 (uint64_t z[4], const uint64_t x[4]); -/* Negate modulo p_256, z := (-x) mod p_256, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_neg_p256 (uint64_t z[4], uint64_t x[4]); +/* Negate modulo p_256, z := (-x) mod p_256, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_neg_p256 (uint64_t z[4], const uint64_t x[4]); -/* Negate modulo p_256k1, z := (-x) mod p_256k1, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_neg_p256k1 (uint64_t z[4], uint64_t x[4]); +/* Negate modulo p_256k1, z := (-x) mod p_256k1, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_neg_p256k1 (uint64_t z[4], const uint64_t x[4]); -/* Negate modulo p_384, z := (-x) mod p_384, assuming x reduced */ -/* Input x[6]; output z[6] */ -extern void bignum_neg_p384 (uint64_t z[6], uint64_t x[6]); +/* Negate modulo p_384, z := (-x) mod p_384, assuming x reduced */ +/* Input x[6]; output z[6] */ +extern void bignum_neg_p384 (uint64_t z[6], const uint64_t x[6]); -/* Negate modulo p_521, z := (-x) mod p_521, assuming x reduced */ -/* Input x[9]; output z[9] */ -extern void bignum_neg_p521 (uint64_t z[9], uint64_t x[9]); +/* Negate modulo p_521, z := (-x) mod p_521, assuming x reduced */ +/* Input x[9]; output z[9] */ +extern void bignum_neg_p521 (uint64_t z[9], const uint64_t x[9]); -/* Negate modulo p_sm2, z := (-x) mod p_sm2, assuming x reduced */ -/* Input x[4]; output z[4] */ -extern void bignum_neg_sm2 (uint64_t z[4], uint64_t x[4]); +/* Negate modulo p_sm2, z := (-x) mod p_sm2, assuming x reduced */ +/* Input x[4]; output z[4] */ +extern void bignum_neg_sm2 (uint64_t z[4], const uint64_t x[4]); -/* Negated modular inverse, z := (-1/x) mod 2^{64k} */ -/* Input x[k]; output z[k] */ -extern void bignum_negmodinv (uint64_t k, uint64_t *z, uint64_t *x); +/* Negated modular inverse, z := (-1/x) mod 2^{64k} */ +/* Input x[k]; output z[k] */ +extern void bignum_negmodinv (uint64_t k, uint64_t *z, const uint64_t *x); -/* Test bignum for nonzero-ness x =/= 0 */ -/* Input x[k]; output function return */ -extern uint64_t bignum_nonzero (uint64_t k, uint64_t *x); +/* Test bignum for nonzero-ness x =/= 0 */ +/* Input x[k]; output function return */ +extern uint64_t bignum_nonzero (uint64_t k, const uint64_t *x); -/* Test 256-bit bignum for nonzero-ness x =/= 0 */ -/* Input x[4]; output function return */ -extern uint64_t bignum_nonzero_4(uint64_t x[4]); +/* Test 256-bit bignum for nonzero-ness x =/= 0 */ +/* Input x[4]; output function return */ +extern uint64_t bignum_nonzero_4(const uint64_t x[4]); -/* Test 384-bit bignum for nonzero-ness x =/= 0 */ -/* Input x[6]; output function return */ -extern uint64_t bignum_nonzero_6(uint64_t x[6]); +/* Test 384-bit bignum for nonzero-ness x =/= 0 */ +/* Input x[6]; output function return */ +extern uint64_t bignum_nonzero_6(const uint64_t x[6]); -/* Normalize bignum in-place by shifting left till top bit is 1 */ -/* Input z[k]; outputs function return (bits shifted left) and z[k] */ +/* Normalize bignum in-place by shifting left till top bit is 1 */ +/* Input z[k]; outputs function return (bits shifted left) and z[k] */ extern uint64_t bignum_normalize (uint64_t k, uint64_t *z); -/* Test bignum for odd-ness */ -/* Input x[k]; output function return */ -extern uint64_t bignum_odd (uint64_t k, uint64_t *x); +/* Test bignum for odd-ness */ +/* Input x[k]; output function return */ +extern uint64_t bignum_odd (uint64_t k, const uint64_t *x); -/* Convert single digit to bignum, z := n */ -/* Input n; output z[k] */ +/* Convert single digit to bignum, z := n */ +/* Input n; output z[k] */ extern void bignum_of_word (uint64_t k, uint64_t *z, uint64_t n); -/* Optionally add, z := x + y (if p nonzero) or z := x (if p zero) */ -/* Inputs x[k], p, y[k]; outputs function return (carry-out) and z[k] */ -extern uint64_t bignum_optadd (uint64_t k, uint64_t *z, uint64_t *x, uint64_t p, uint64_t *y); +/* Optionally add, z := x + y (if p nonzero) or z := x (if p zero) */ +/* Inputs x[k], p, y[k]; outputs function return (carry-out) and z[k] */ +extern uint64_t bignum_optadd (uint64_t k, uint64_t *z, const uint64_t *x, uint64_t p, const uint64_t *y); -/* Optionally negate, z := -x (if p nonzero) or z := x (if p zero) */ -/* Inputs p, x[k]; outputs function return (nonzero input) and z[k] */ -extern uint64_t bignum_optneg (uint64_t k, uint64_t *z, uint64_t p, uint64_t *x); +/* Optionally negate, z := -x (if p nonzero) or z := x (if p zero) */ +/* Inputs p, x[k]; outputs function return (nonzero input) and z[k] */ +extern uint64_t bignum_optneg (uint64_t k, uint64_t *z, uint64_t p, const uint64_t *x); -/* Optionally negate modulo p_25519, z := (-x) mod p_25519 (if p nonzero) or z := x (if p zero), assuming x reduced */ -/* Inputs p, x[4]; output z[4] */ -extern void bignum_optneg_p25519 (uint64_t z[4], uint64_t p, uint64_t x[4]); +/* Optionally negate modulo p_25519, z := (-x) mod p_25519 (if p nonzero) or z := x (if p zero), assuming x reduced */ +/* Inputs p, x[4]; output z[4] */ +extern void bignum_optneg_p25519 (uint64_t z[4], uint64_t p, const uint64_t x[4]); -/* Optionally negate modulo p_256, z := (-x) mod p_256 (if p nonzero) or z := x (if p zero), assuming x reduced */ -/* Inputs p, x[4]; output z[4] */ -extern void bignum_optneg_p256 (uint64_t z[4], uint64_t p, uint64_t x[4]); +/* Optionally negate modulo p_256, z := (-x) mod p_256 (if p nonzero) or z := x (if p zero), assuming x reduced */ +/* Inputs p, x[4]; output z[4] */ +extern void bignum_optneg_p256 (uint64_t z[4], uint64_t p, const uint64_t x[4]); -/* Optionally negate modulo p_256k1, z := (-x) mod p_256k1 (if p nonzero) or z := x (if p zero), assuming x reduced */ -/* Inputs p, x[4]; output z[4] */ -extern void bignum_optneg_p256k1 (uint64_t z[4], uint64_t p, uint64_t x[4]); +/* Optionally negate modulo p_256k1, z := (-x) mod p_256k1 (if p nonzero) or z := x (if p zero), assuming x reduced */ +/* Inputs p, x[4]; output z[4] */ +extern void bignum_optneg_p256k1 (uint64_t z[4], uint64_t p, const uint64_t x[4]); -/* Optionally negate modulo p_384, z := (-x) mod p_384 (if p nonzero) or z := x (if p zero), assuming x reduced */ -/* Inputs p, x[6]; output z[6] */ -extern void bignum_optneg_p384 (uint64_t z[6], uint64_t p, uint64_t x[6]); +/* Optionally negate modulo p_384, z := (-x) mod p_384 (if p nonzero) or z := x (if p zero), assuming x reduced */ +/* Inputs p, x[6]; output z[6] */ +extern void bignum_optneg_p384 (uint64_t z[6], uint64_t p, const uint64_t x[6]); -/* Optionally negate modulo p_521, z := (-x) mod p_521 (if p nonzero) or z := x (if p zero), assuming x reduced */ -/* Inputs p, x[9]; output z[9] */ -extern void bignum_optneg_p521 (uint64_t z[9], uint64_t p, uint64_t x[9]); +/* Optionally negate modulo p_521, z := (-x) mod p_521 (if p nonzero) or z := x (if p zero), assuming x reduced */ +/* Inputs p, x[9]; output z[9] */ +extern void bignum_optneg_p521 (uint64_t z[9], uint64_t p, const uint64_t x[9]); -/* Optionally negate modulo p_sm2, z := (-x) mod p_sm2 (if p nonzero) or z := x (if p zero), assuming x reduced */ -/* Inputs p, x[4]; output z[4] */ -extern void bignum_optneg_sm2 (uint64_t z[4], uint64_t p, uint64_t x[4]); +/* Optionally negate modulo p_sm2, z := (-x) mod p_sm2 (if p nonzero) or z := x (if p zero), assuming x reduced */ +/* Inputs p, x[4]; output z[4] */ +extern void bignum_optneg_sm2 (uint64_t z[4], uint64_t p, const uint64_t x[4]); -/* Optionally subtract, z := x - y (if p nonzero) or z := x (if p zero) */ -/* Inputs x[k], p, y[k]; outputs function return (carry-out) and z[k] */ -extern uint64_t bignum_optsub (uint64_t k, uint64_t *z, uint64_t *x, uint64_t p, uint64_t *y); +/* Optionally subtract, z := x - y (if p nonzero) or z := x (if p zero) */ +/* Inputs x[k], p, y[k]; outputs function return (carry-out) and z[k] */ +extern uint64_t bignum_optsub (uint64_t k, uint64_t *z, const uint64_t *x, uint64_t p, const uint64_t *y); -/* Optionally subtract or add, z := x + sgn(p) * y interpreting p as signed */ -/* Inputs x[k], p, y[k]; outputs function return (carry-out) and z[k] */ -extern uint64_t bignum_optsubadd (uint64_t k, uint64_t *z, uint64_t *x, uint64_t p, uint64_t *y); +/* Optionally subtract or add, z := x + sgn(p) * y interpreting p as signed */ +/* Inputs x[k], p, y[k]; outputs function return (carry-out) and z[k] */ +extern uint64_t bignum_optsubadd (uint64_t k, uint64_t *z, const uint64_t *x, uint64_t p, const uint64_t *y); -/* Return bignum of power of 2, z := 2^n */ -/* Input n; output z[k] */ +/* Return bignum of power of 2, z := 2^n */ +/* Input n; output z[k] */ extern void bignum_pow2 (uint64_t k, uint64_t *z, uint64_t n); -/* Shift bignum left by c < 64 bits z := x * 2^c */ -/* Inputs x[n], c; outputs function return (carry-out) and z[k] */ -extern uint64_t bignum_shl_small (uint64_t k, uint64_t *z, uint64_t n, uint64_t *x, uint64_t c); +/* Shift bignum left by c < 64 bits z := x * 2^c */ +/* Inputs x[n], c; outputs function return (carry-out) and z[k] */ +extern uint64_t bignum_shl_small (uint64_t k, uint64_t *z, uint64_t n, const uint64_t *x, uint64_t c); -/* Shift bignum right by c < 64 bits z := floor(x / 2^c) */ -/* Inputs x[n], c; outputs function return (bits shifted out) and z[k] */ -extern uint64_t bignum_shr_small (uint64_t k, uint64_t *z, uint64_t n, uint64_t *x, uint64_t c); +/* Shift bignum right by c < 64 bits z := floor(x / 2^c) */ +/* Inputs x[n], c; outputs function return (bits shifted out) and z[k] */ +extern uint64_t bignum_shr_small (uint64_t k, uint64_t *z, uint64_t n, const uint64_t *x, uint64_t c); -/* Square, z := x^2 */ -/* Input x[n]; output z[k] */ -extern void bignum_sqr (uint64_t k, uint64_t *z, uint64_t n, uint64_t *x); +/* Square, z := x^2 */ +/* Input x[n]; output z[k] */ +extern void bignum_sqr (uint64_t k, uint64_t *z, uint64_t n, const uint64_t *x); -/* Square, z := x^2 */ -/* Input x[4]; output z[8] */ -extern void bignum_sqr_4_8 (uint64_t z[8], uint64_t x[4]); -extern void bignum_sqr_4_8_alt (uint64_t z[8], uint64_t x[4]); +/* Square, z := x^2 */ +/* Input x[4]; output z[8] */ +extern void bignum_sqr_4_8 (uint64_t z[8], const uint64_t x[4]); +extern void bignum_sqr_4_8_alt (uint64_t z[8], const uint64_t x[4]); -/* Square, z := x^2 */ -/* Input x[6]; output z[12] */ -extern void bignum_sqr_6_12 (uint64_t z[12], uint64_t x[6]); -extern void bignum_sqr_6_12_alt (uint64_t z[12], uint64_t x[6]); +/* Square, z := x^2 */ +/* Input x[6]; output z[12] */ +extern void bignum_sqr_6_12 (uint64_t z[12], const uint64_t x[6]); +extern void bignum_sqr_6_12_alt (uint64_t z[12], const uint64_t x[6]); -/* Square, z := x^2 */ -/* Input x[8]; output z[16] */ -extern void bignum_sqr_8_16 (uint64_t z[16], uint64_t x[8]); -extern void bignum_sqr_8_16_alt (uint64_t z[16], uint64_t x[8]); +/* Square, z := x^2 */ +/* Input x[8]; output z[16] */ +extern void bignum_sqr_8_16 (uint64_t z[16], const uint64_t x[8]); +extern void bignum_sqr_8_16_alt (uint64_t z[16], const uint64_t x[8]); -/* Square modulo p_25519, z := (x^2) mod p_25519 */ -/* Input x[4]; output z[4] */ -extern void bignum_sqr_p25519 (uint64_t z[4], uint64_t x[4]); -extern void bignum_sqr_p25519_alt (uint64_t z[4], uint64_t x[4]); +/* Square modulo p_25519, z := (x^2) mod p_25519 */ +/* Input x[4]; output z[4] */ +extern void bignum_sqr_p25519 (uint64_t z[4], const uint64_t x[4]); +extern void bignum_sqr_p25519_alt (uint64_t z[4], const uint64_t x[4]); -/* Square modulo p_256k1, z := (x^2) mod p_256k1 */ -/* Input x[4]; output z[4] */ -extern void bignum_sqr_p256k1 (uint64_t z[4], uint64_t x[4]); -extern void bignum_sqr_p256k1_alt (uint64_t z[4], uint64_t x[4]); +/* Square modulo p_256k1, z := (x^2) mod p_256k1 */ +/* Input x[4]; output z[4] */ +extern void bignum_sqr_p256k1 (uint64_t z[4], const uint64_t x[4]); +extern void bignum_sqr_p256k1_alt (uint64_t z[4], const uint64_t x[4]); -/* Square modulo p_521, z := (x^2) mod p_521, assuming x reduced */ -/* Input x[9]; output z[9] */ -extern void bignum_sqr_p521 (uint64_t z[9], uint64_t x[9]); -extern void bignum_sqr_p521_alt (uint64_t z[9], uint64_t x[9]); +/* Square modulo p_521, z := (x^2) mod p_521, assuming x reduced */ +/* Input x[9]; output z[9] */ +extern void bignum_sqr_p521 (uint64_t z[9], const uint64_t x[9]); +extern void bignum_sqr_p521_alt (uint64_t z[9], const uint64_t x[9]); /* Square root modulo p_25519 */ /* Input x[4]; output function return (Legendre symbol) and z[4] */ -extern int64_t bignum_sqrt_p25519(uint64_t z[4],uint64_t x[4]); -extern int64_t bignum_sqrt_p25519_alt(uint64_t z[4],uint64_t x[4]); +extern int64_t bignum_sqrt_p25519(uint64_t z[4],const uint64_t x[4]); +extern int64_t bignum_sqrt_p25519_alt(uint64_t z[4],const uint64_t x[4]); -/* Subtract, z := x - y */ -/* Inputs x[m], y[n]; outputs function return (carry-out) and z[p] */ -extern uint64_t bignum_sub (uint64_t p, uint64_t *z, uint64_t m, uint64_t *x, uint64_t n, uint64_t *y); +/* Subtract, z := x - y */ +/* Inputs x[m], y[n]; outputs function return (carry-out) and z[p] */ +extern uint64_t bignum_sub (uint64_t p, uint64_t *z, uint64_t m, const uint64_t *x, uint64_t n, const uint64_t *y); -/* Subtract modulo p_25519, z := (x - y) mod p_25519, assuming x and y reduced */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_sub_p25519 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); +/* Subtract modulo p_25519, z := (x - y) mod p_25519, assuming x and y reduced */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_sub_p25519 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); -/* Subtract modulo p_256, z := (x - y) mod p_256, assuming x and y reduced */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_sub_p256 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); +/* Subtract modulo p_256, z := (x - y) mod p_256, assuming x and y reduced */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_sub_p256 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); -/* Subtract modulo p_256k1, z := (x - y) mod p_256k1, assuming x and y reduced */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_sub_p256k1 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); +/* Subtract modulo p_256k1, z := (x - y) mod p_256k1, assuming x and y reduced */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_sub_p256k1 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); -/* Subtract modulo p_384, z := (x - y) mod p_384, assuming x and y reduced */ -/* Inputs x[6], y[6]; output z[6] */ -extern void bignum_sub_p384 (uint64_t z[6], uint64_t x[6], uint64_t y[6]); +/* Subtract modulo p_384, z := (x - y) mod p_384, assuming x and y reduced */ +/* Inputs x[6], y[6]; output z[6] */ +extern void bignum_sub_p384 (uint64_t z[6], const uint64_t x[6], const uint64_t y[6]); -/* Subtract modulo p_521, z := (x - y) mod p_521, assuming x and y reduced */ -/* Inputs x[9], y[9]; output z[9] */ -extern void bignum_sub_p521 (uint64_t z[9], uint64_t x[9], uint64_t y[9]); +/* Subtract modulo p_521, z := (x - y) mod p_521, assuming x and y reduced */ +/* Inputs x[9], y[9]; output z[9] */ +extern void bignum_sub_p521 (uint64_t z[9], const uint64_t x[9], const uint64_t y[9]); -/* Subtract modulo p_sm2, z := (x - y) mod p_sm2, assuming x and y reduced */ -/* Inputs x[4], y[4]; output z[4] */ -extern void bignum_sub_sm2 (uint64_t z[4], uint64_t x[4], uint64_t y[4]); +/* Subtract modulo p_sm2, z := (x - y) mod p_sm2, assuming x and y reduced */ +/* Inputs x[4], y[4]; output z[4] */ +extern void bignum_sub_sm2 (uint64_t z[4], const uint64_t x[4], const uint64_t y[4]); -/* Convert 4-digit (256-bit) bignum to big-endian bytes */ -/* Input x[4]; output z[32] (bytes) */ -extern void bignum_tobebytes_4 (uint8_t z[32], uint64_t x[4]); +/* Convert 4-digit (256-bit) bignum to big-endian bytes */ +/* Input x[4]; output z[32] (bytes) */ +extern void bignum_tobebytes_4 (uint8_t z[32], const uint64_t x[4]); -/* Convert 6-digit (384-bit) bignum to big-endian bytes */ -/* Input x[6]; output z[48] (bytes) */ -extern void bignum_tobebytes_6 (uint8_t z[48], uint64_t x[6]); +/* Convert 6-digit (384-bit) bignum to big-endian bytes */ +/* Input x[6]; output z[48] (bytes) */ +extern void bignum_tobebytes_6 (uint8_t z[48], const uint64_t x[6]); -/* Convert 4-digit (256-bit) bignum to little-endian bytes */ -/* Input x[4]; output z[32] (bytes) */ -extern void bignum_tolebytes_4 (uint8_t z[32], uint64_t x[4]); +/* Convert 4-digit (256-bit) bignum to little-endian bytes */ +/* Input x[4]; output z[32] (bytes) */ +extern void bignum_tolebytes_4 (uint8_t z[32], const uint64_t x[4]); -/* Convert 6-digit (384-bit) bignum to little-endian bytes */ -/* Input x[6]; output z[48] (bytes) */ -extern void bignum_tolebytes_6 (uint8_t z[48], uint64_t x[6]); +/* Convert 6-digit (384-bit) bignum to little-endian bytes */ +/* Input x[6]; output z[48] (bytes) */ +extern void bignum_tolebytes_6 (uint8_t z[48], const uint64_t x[6]); -/* Convert 9-digit 528-bit bignum to little-endian bytes */ -/* Input x[6]; output z[66] (bytes) */ -extern void bignum_tolebytes_p521 (uint8_t z[66], uint64_t x[9]); +/* Convert 9-digit 528-bit bignum to little-endian bytes */ +/* Input x[6]; output z[66] (bytes) */ +extern void bignum_tolebytes_p521 (uint8_t z[66], const uint64_t x[9]); -/* Convert to Montgomery form z := (2^256 * x) mod p_256 */ -/* Input x[4]; output z[4] */ -extern void bignum_tomont_p256 (uint64_t z[4], uint64_t x[4]); -extern void bignum_tomont_p256_alt (uint64_t z[4], uint64_t x[4]); +/* Convert to Montgomery form z := (2^256 * x) mod p_256 */ +/* Input x[4]; output z[4] */ +extern void bignum_tomont_p256 (uint64_t z[4], const uint64_t x[4]); +extern void bignum_tomont_p256_alt (uint64_t z[4], const uint64_t x[4]); -/* Convert to Montgomery form z := (2^256 * x) mod p_256k1 */ -/* Input x[4]; output z[4] */ -extern void bignum_tomont_p256k1 (uint64_t z[4], uint64_t x[4]); -extern void bignum_tomont_p256k1_alt (uint64_t z[4], uint64_t x[4]); +/* Convert to Montgomery form z := (2^256 * x) mod p_256k1 */ +/* Input x[4]; output z[4] */ +extern void bignum_tomont_p256k1 (uint64_t z[4], const uint64_t x[4]); +extern void bignum_tomont_p256k1_alt (uint64_t z[4], const uint64_t x[4]); -/* Convert to Montgomery form z := (2^384 * x) mod p_384 */ -/* Input x[6]; output z[6] */ -extern void bignum_tomont_p384 (uint64_t z[6], uint64_t x[6]); -extern void bignum_tomont_p384_alt (uint64_t z[6], uint64_t x[6]); +/* Convert to Montgomery form z := (2^384 * x) mod p_384 */ +/* Input x[6]; output z[6] */ +extern void bignum_tomont_p384 (uint64_t z[6], const uint64_t x[6]); +extern void bignum_tomont_p384_alt (uint64_t z[6], const uint64_t x[6]); -/* Convert to Montgomery form z := (2^576 * x) mod p_521 */ -/* Input x[9]; output z[9] */ -extern void bignum_tomont_p521 (uint64_t z[9], uint64_t x[9]); +/* Convert to Montgomery form z := (2^576 * x) mod p_521 */ +/* Input x[9]; output z[9] */ +extern void bignum_tomont_p521 (uint64_t z[9], const uint64_t x[9]); /* Convert to Montgomery form z := (2^256 * x) mod p_sm2 */ /* Input x[4]; output z[4] */ -extern void bignum_tomont_sm2 (uint64_t z[4], uint64_t x[4]); +extern void bignum_tomont_sm2 (uint64_t z[4], const uint64_t x[4]); -/* Triple modulo p_256, z := (3 * x) mod p_256 */ -/* Input x[4]; output z[4] */ -extern void bignum_triple_p256 (uint64_t z[4], uint64_t x[4]); -extern void bignum_triple_p256_alt (uint64_t z[4], uint64_t x[4]); +/* Triple modulo p_256, z := (3 * x) mod p_256 */ +/* Input x[4]; output z[4] */ +extern void bignum_triple_p256 (uint64_t z[4], const uint64_t x[4]); +extern void bignum_triple_p256_alt (uint64_t z[4], const uint64_t x[4]); -/* Triple modulo p_256k1, z := (3 * x) mod p_256k1 */ -/* Input x[4]; output z[4] */ -extern void bignum_triple_p256k1 (uint64_t z[4], uint64_t x[4]); -extern void bignum_triple_p256k1_alt (uint64_t z[4], uint64_t x[4]); +/* Triple modulo p_256k1, z := (3 * x) mod p_256k1 */ +/* Input x[4]; output z[4] */ +extern void bignum_triple_p256k1 (uint64_t z[4], const uint64_t x[4]); +extern void bignum_triple_p256k1_alt (uint64_t z[4], const uint64_t x[4]); -/* Triple modulo p_384, z := (3 * x) mod p_384 */ -/* Input x[6]; output z[6] */ -extern void bignum_triple_p384 (uint64_t z[6], uint64_t x[6]); -extern void bignum_triple_p384_alt (uint64_t z[6], uint64_t x[6]); +/* Triple modulo p_384, z := (3 * x) mod p_384 */ +/* Input x[6]; output z[6] */ +extern void bignum_triple_p384 (uint64_t z[6], const uint64_t x[6]); +extern void bignum_triple_p384_alt (uint64_t z[6], const uint64_t x[6]); -/* Triple modulo p_521, z := (3 * x) mod p_521, assuming x reduced */ -/* Input x[9]; output z[9] */ -extern void bignum_triple_p521 (uint64_t z[9], uint64_t x[9]); -extern void bignum_triple_p521_alt (uint64_t z[9], uint64_t x[9]); +/* Triple modulo p_521, z := (3 * x) mod p_521, assuming x reduced */ +/* Input x[9]; output z[9] */ +extern void bignum_triple_p521 (uint64_t z[9], const uint64_t x[9]); +extern void bignum_triple_p521_alt (uint64_t z[9], const uint64_t x[9]); -/* Triple modulo p_sm2, z := (3 * x) mod p_sm2 */ -/* Input x[4]; output z[4] */ -extern void bignum_triple_sm2 (uint64_t z[4], uint64_t x[4]); -extern void bignum_triple_sm2_alt (uint64_t z[4], uint64_t x[4]); +/* Triple modulo p_sm2, z := (3 * x) mod p_sm2 */ +/* Input x[4]; output z[4] */ +extern void bignum_triple_sm2 (uint64_t z[4], const uint64_t x[4]); +extern void bignum_triple_sm2_alt (uint64_t z[4], const uint64_t x[4]); /* Montgomery ladder step for curve25519 */ /* Inputs point[8], pp[16], b; output rr[16] */ -extern void curve25519_ladderstep(uint64_t rr[16],uint64_t point[8],uint64_t pp[16],uint64_t b); -extern void curve25519_ladderstep_alt(uint64_t rr[16],uint64_t point[8],uint64_t pp[16],uint64_t b); +extern void curve25519_ladderstep(uint64_t rr[16],const uint64_t point[8],const uint64_t pp[16],uint64_t b); +extern void curve25519_ladderstep_alt(uint64_t rr[16],const uint64_t point[8],const uint64_t pp[16],uint64_t b); /* Projective scalar multiplication, x coordinate only, for curve25519 */ /* Inputs scalar[4], point[4]; output res[8] */ -extern void curve25519_pxscalarmul(uint64_t res[8],uint64_t scalar[4],uint64_t point[4]); -extern void curve25519_pxscalarmul_alt(uint64_t res[8],uint64_t scalar[4],uint64_t point[4]); +extern void curve25519_pxscalarmul(uint64_t res[8],const uint64_t scalar[4],const uint64_t point[4]); +extern void curve25519_pxscalarmul_alt(uint64_t res[8],const uint64_t scalar[4],const uint64_t point[4]); /* x25519 function for curve25519 */ /* Inputs scalar[4], point[4]; output res[4] */ -extern void curve25519_x25519(uint64_t res[4],uint64_t scalar[4],uint64_t point[4]); -extern void curve25519_x25519_alt(uint64_t res[4],uint64_t scalar[4],uint64_t point[4]); +extern void curve25519_x25519(uint64_t res[4],const uint64_t scalar[4],const uint64_t point[4]); +extern void curve25519_x25519_alt(uint64_t res[4],const uint64_t scalar[4],const uint64_t point[4]); /* x25519 function for curve25519 (byte array arguments) */ /* Inputs scalar[32] (bytes), point[32] (bytes); output res[32] (bytes) */ -extern void curve25519_x25519_byte(uint8_t res[32],uint8_t scalar[32],uint8_t point[32]); -extern void curve25519_x25519_byte_alt(uint8_t res[32],uint8_t scalar[32],uint8_t point[32]); +extern void curve25519_x25519_byte(uint8_t res[32],const uint8_t scalar[32],const uint8_t point[32]); +extern void curve25519_x25519_byte_alt(uint8_t res[32],const uint8_t scalar[32],const uint8_t point[32]); /* x25519 function for curve25519 on base element 9 */ /* Input scalar[4]; output res[4] */ -extern void curve25519_x25519base(uint64_t res[4],uint64_t scalar[4]); -extern void curve25519_x25519base_alt(uint64_t res[4],uint64_t scalar[4]); +extern void curve25519_x25519base(uint64_t res[4],const uint64_t scalar[4]); +extern void curve25519_x25519base_alt(uint64_t res[4],const uint64_t scalar[4]); /* x25519 function for curve25519 on base element 9 (byte array arguments) */ /* Input scalar[32] (bytes); output res[32] (bytes) */ -extern void curve25519_x25519base_byte(uint8_t res[32],uint8_t scalar[32]); -extern void curve25519_x25519base_byte_alt(uint8_t res[32],uint8_t scalar[32]); +extern void curve25519_x25519base_byte(uint8_t res[32],const uint8_t scalar[32]); +extern void curve25519_x25519base_byte_alt(uint8_t res[32],const uint8_t scalar[32]); /* Decode compressed 256-bit form of edwards25519 point */ /* Input c[32] (bytes); output function return and z[8] */ -extern uint64_t edwards25519_decode(uint64_t z[8],uint8_t c[32]); -extern uint64_t edwards25519_decode_alt(uint64_t z[8],uint8_t c[32]); +extern uint64_t edwards25519_decode(uint64_t z[8], const uint8_t c[32]); +extern uint64_t edwards25519_decode_alt(uint64_t z[8], const uint8_t c[32]); /* Encode edwards25519 point into compressed form as 256-bit number */ /* Input p[8]; output z[32] (bytes) */ -extern void edwards25519_encode(uint8_t z[32], uint64_t p[8]); +extern void edwards25519_encode(uint8_t z[32], const uint64_t p[8]); /* Extended projective addition for edwards25519 */ /* Inputs p1[16], p2[16]; output p3[16] */ -extern void edwards25519_epadd(uint64_t p3[16],uint64_t p1[16],uint64_t p2[16]); -extern void edwards25519_epadd_alt(uint64_t p3[16],uint64_t p1[16],uint64_t p2[16]); +extern void edwards25519_epadd(uint64_t p3[16],const uint64_t p1[16],const uint64_t p2[16]); +extern void edwards25519_epadd_alt(uint64_t p3[16],const uint64_t p1[16],const uint64_t p2[16]); /* Extended projective doubling for edwards25519 */ /* Inputs p1[12]; output p3[16] */ -extern void edwards25519_epdouble(uint64_t p3[16],uint64_t p1[12]); -extern void edwards25519_epdouble_alt(uint64_t p3[16],uint64_t p1[12]); +extern void edwards25519_epdouble(uint64_t p3[16],const uint64_t p1[12]); +extern void edwards25519_epdouble_alt(uint64_t p3[16],const uint64_t p1[12]); /* Projective doubling for edwards25519 */ /* Inputs p1[12]; output p3[12] */ -extern void edwards25519_pdouble(uint64_t p3[12],uint64_t p1[12]); -extern void edwards25519_pdouble_alt(uint64_t p3[12],uint64_t p1[12]); +extern void edwards25519_pdouble(uint64_t p3[12],const uint64_t p1[12]); +extern void edwards25519_pdouble_alt(uint64_t p3[12],const uint64_t p1[12]); /* Extended projective + precomputed mixed addition for edwards25519 */ /* Inputs p1[16], p2[12]; output p3[16] */ -extern void edwards25519_pepadd(uint64_t p3[16],uint64_t p1[16],uint64_t p2[12]); -extern void edwards25519_pepadd_alt(uint64_t p3[16],uint64_t p1[16],uint64_t p2[12]); +extern void edwards25519_pepadd(uint64_t p3[16],const uint64_t p1[16],const uint64_t p2[12]); +extern void edwards25519_pepadd_alt(uint64_t p3[16],const uint64_t p1[16],const uint64_t p2[12]); /* Scalar multiplication by standard basepoint for edwards25519 (Ed25519) */ /* Input scalar[4]; output res[8] */ -extern void edwards25519_scalarmulbase(uint64_t res[8],uint64_t scalar[4]); -extern void edwards25519_scalarmulbase_alt(uint64_t res[8],uint64_t scalar[4]); +extern void edwards25519_scalarmulbase(uint64_t res[8],const uint64_t scalar[4]); +extern void edwards25519_scalarmulbase_alt(uint64_t res[8],const uint64_t scalar[4]); /* Double scalar multiplication for edwards25519, fresh and base point */ /* Input scalar[4], point[8], bscalar[4]; output res[8] */ -extern void edwards25519_scalarmuldouble(uint64_t res[8],uint64_t scalar[4], uint64_t point[8],uint64_t bscalar[4]); -extern void edwards25519_scalarmuldouble_alt(uint64_t res[8],uint64_t scalar[4], uint64_t point[8],uint64_t bscalar[4]); +extern void edwards25519_scalarmuldouble(uint64_t res[8],const uint64_t scalar[4], const uint64_t point[8],const uint64_t bscalar[4]); +extern void edwards25519_scalarmuldouble_alt(uint64_t res[8],const uint64_t scalar[4], const uint64_t point[8],const uint64_t bscalar[4]); + +// Inverse number-theoretic transform for ML-DSA +// Input a[256], zetas[624] (signed 32-bit words); output a[256] (signed 32-bit words) +extern void mldsa_intt(int32_t a[256], const int32_t zetas[624]); + +/* Forward number-theoretic transform for ML-DSA */ +/* Input a[256], zetas[624] (signed 32-bit words); output a[256] (signed 32-bit words) */ +extern void mldsa_ntt(int32_t a[256], const int32_t zetas[624]); + +/* Canonical reduction of polynomial coefficients for ML-DSA */ +/* Input a[256] (signed 32-bit words); output a[256] (signed 32-bit words) */ +extern void mldsa_reduce(int32_t a[256]); /* Scalar product of 2-element polynomial vectors in NTT domain, with mulcache */ /* Inputs a[512], b[512], bt[256] (signed 16-bit words); output r[256] (signed 16-bit words) */ @@ -986,15 +1003,15 @@ extern void mlkem_basemul_k4(int16_t r[256],const int16_t a[1024],const int16_t /* Inverse number-theoretic transform from ML-KEM */ /* Input a[256] (signed 16-bit words), z_01234[80] (signed 16-bit words), z_56[384] (signed 16-bit words); output a[256] (signed 16-bit words) */ -extern void mlkem_intt(int16_t a[256],int16_t z_01234[80],int16_t z_56[384]); +extern void mlkem_intt(int16_t a[256],const int16_t z_01234[80],const int16_t z_56[384]); /* Precompute the mulcache data for a polynomial in the NTT domain */ /* Inputs a[256], z[128] and t[128] (signed 16-bit words); output x[128] (signed 16-bit words) */ -extern void mlkem_mulcache_compute(int16_t x[128],int16_t a[256],int16_t z[128],int16_t t[128]); +extern void mlkem_mulcache_compute(int16_t x[128],const int16_t a[256],const int16_t z[128],const int16_t t[128]); /* Forward number-theoretic transform from ML-KEM */ /* Input a[256] (signed 16-bit words), z_01234[80] (signed 16-bit words), z_56[384] (signed 16-bit words); output a[256] (signed 16-bit words) */ -extern void mlkem_ntt(int16_t a[256],int16_t z_01234[80],int16_t z_56[384]); +extern void mlkem_ntt(int16_t a[256],const int16_t z_01234[80],const int16_t z_56[384]); /* Canonical modular reduction of polynomial coefficients for ML-KEM */ /* Input a[256] (signed 16-bit words); output a[256] (signed 16-bit words) */ @@ -1002,7 +1019,7 @@ extern void mlkem_reduce(int16_t a[256]); /* Pack ML-KEM polynomial coefficients as 12-bit numbers */ /* Input a[256] (signed 16-bit words); output r[384] (bytes) */ -extern void mlkem_tobytes(uint8_t r[384],int16_t a[256]); +extern void mlkem_tobytes(uint8_t r[384],const int16_t a[256]); /* Conversion of ML-KEM polynomial coefficients to Montgomery form */ /* Input a[256] (signed 16-bit words); output a[256] (signed 16-bit words) */ @@ -1010,161 +1027,162 @@ extern void mlkem_tomont(int16_t a[256]); /* Uniform rejection sampling for ML-KEM */ /* Inputs *buf (unsigned bytes), buflen, table (unsigned bytes); output r[256] (signed 16-bit words), return */ -extern uint64_t mlkem_rej_uniform_VARIABLE_TIME(int16_t r[256],uint8_t *buf,uint64_t buflen,uint8_t *table); +extern uint64_t mlkem_rej_uniform_VARIABLE_TIME(int16_t r[256],const uint8_t *buf,uint64_t buflen,const uint8_t *table); /* Point addition on NIST curve P-256 in Montgomery-Jacobian coordinates */ /* Inputs p1[12], p2[12]; output p3[12] */ -extern void p256_montjadd(uint64_t p3[12],uint64_t p1[12],uint64_t p2[12]); -extern void p256_montjadd_alt(uint64_t p3[12],uint64_t p1[12],uint64_t p2[12]); +extern void p256_montjadd(uint64_t p3[12],const uint64_t p1[12],const uint64_t p2[12]); +extern void p256_montjadd_alt(uint64_t p3[12],const uint64_t p1[12],const uint64_t p2[12]); /* Point doubling on NIST curve P-256 in Montgomery-Jacobian coordinates */ /* Inputs p1[12]; output p3[12] */ -extern void p256_montjdouble(uint64_t p3[12],uint64_t p1[12]); -extern void p256_montjdouble_alt(uint64_t p3[12],uint64_t p1[12]); +extern void p256_montjdouble(uint64_t p3[12],const uint64_t p1[12]); +extern void p256_montjdouble_alt(uint64_t p3[12],const uint64_t p1[12]); /* Point mixed addition on NIST curve P-256 in Montgomery-Jacobian coordinates */ /* Inputs p1[12], p2[8]; output p3[12] */ -extern void p256_montjmixadd(uint64_t p3[12],uint64_t p1[12],uint64_t p2[8]); -extern void p256_montjmixadd_alt(uint64_t p3[12],uint64_t p1[12],uint64_t p2[8]); +extern void p256_montjmixadd(uint64_t p3[12],const uint64_t p1[12],const uint64_t p2[8]); +extern void p256_montjmixadd_alt(uint64_t p3[12],const uint64_t p1[12],const uint64_t p2[8]); /* Montgomery-Jacobian form scalar multiplication for P-256 */ /* Input scalar[4], point[12]; output res[12] */ -extern void p256_montjscalarmul(uint64_t res[12],uint64_t scalar[4],uint64_t point[12]); -extern void p256_montjscalarmul_alt(uint64_t res[12],uint64_t scalar[4],uint64_t point[12]); +extern void p256_montjscalarmul(uint64_t res[12],const uint64_t scalar[4],const uint64_t point[12]); +extern void p256_montjscalarmul_alt(uint64_t res[12],const uint64_t scalar[4],const uint64_t point[12]); /* Scalar multiplication for NIST curve P-256 */ /* Input scalar[4], point[8]; output res[8] */ -extern void p256_scalarmul(uint64_t res[8],uint64_t scalar[4],uint64_t point[8]); -extern void p256_scalarmul_alt(uint64_t res[8],uint64_t scalar[4],uint64_t point[8]); +extern void p256_scalarmul(uint64_t res[8],const uint64_t scalar[4],const uint64_t point[8]); +extern void p256_scalarmul_alt(uint64_t res[8],const uint64_t scalar[4],const uint64_t point[8]); /* Scalar multiplication for precomputed point on NIST curve P-256 */ /* Input scalar[4], blocksize, table[]; output res[8] */ -extern void p256_scalarmulbase(uint64_t res[8],uint64_t scalar[4],uint64_t blocksize,uint64_t *table); -extern void p256_scalarmulbase_alt(uint64_t res[8],uint64_t scalar[4],uint64_t blocksize,uint64_t *table); +extern void p256_scalarmulbase(uint64_t res[8],const uint64_t scalar[4],uint64_t blocksize,const uint64_t *table); +extern void p256_scalarmulbase_alt(uint64_t res[8],const uint64_t scalar[4],uint64_t blocksize,const uint64_t *table); /* Point addition on NIST curve P-384 in Montgomery-Jacobian coordinates */ /* Inputs p1[18], p2[18]; output p3[18] */ -extern void p384_montjadd(uint64_t p3[18],uint64_t p1[18],uint64_t p2[18]); -extern void p384_montjadd_alt(uint64_t p3[18],uint64_t p1[18],uint64_t p2[18]); +extern void p384_montjadd(uint64_t p3[18],const uint64_t p1[18],const uint64_t p2[18]); +extern void p384_montjadd_alt(uint64_t p3[18],const uint64_t p1[18],const uint64_t p2[18]); /* Point doubling on NIST curve P-384 in Montgomery-Jacobian coordinates */ /* Inputs p1[18]; output p3[18] */ -extern void p384_montjdouble(uint64_t p3[18],uint64_t p1[18]); -extern void p384_montjdouble_alt(uint64_t p3[18],uint64_t p1[18]); +extern void p384_montjdouble(uint64_t p3[18],const uint64_t p1[18]); +extern void p384_montjdouble_alt(uint64_t p3[18],const uint64_t p1[18]); /* Point mixed addition on NIST curve P-384 in Montgomery-Jacobian coordinates */ /* Inputs p1[18], p2[12]; output p3[18] */ -extern void p384_montjmixadd(uint64_t p3[18],uint64_t p1[18],uint64_t p2[12]); -extern void p384_montjmixadd_alt(uint64_t p3[18],uint64_t p1[18],uint64_t p2[12]); +extern void p384_montjmixadd(uint64_t p3[18],const uint64_t p1[18],const uint64_t p2[12]); +extern void p384_montjmixadd_alt(uint64_t p3[18],const uint64_t p1[18],const uint64_t p2[12]); /* Montgomery-Jacobian form scalar multiplication for P-384 */ /* Input scalar[6], point[18]; output res[18] */ -extern void p384_montjscalarmul(uint64_t res[18],uint64_t scalar[6],uint64_t point[18]); -extern void p384_montjscalarmul_alt(uint64_t res[18],uint64_t scalar[6],uint64_t point[18]); +extern void p384_montjscalarmul(uint64_t res[18],const uint64_t scalar[6],const uint64_t point[18]); +extern void p384_montjscalarmul_alt(uint64_t res[18],const uint64_t scalar[6],const uint64_t point[18]); /* Point addition on NIST curve P-521 in Jacobian coordinates */ /* Inputs p1[27], p2[27]; output p3[27] */ -extern void p521_jadd(uint64_t p3[27],uint64_t p1[27],uint64_t p2[27]); -extern void p521_jadd_alt(uint64_t p3[27],uint64_t p1[27],uint64_t p2[27]); +extern void p521_jadd(uint64_t p3[27],const uint64_t p1[27],const uint64_t p2[27]); +extern void p521_jadd_alt(uint64_t p3[27],const uint64_t p1[27],const uint64_t p2[27]); /* Point doubling on NIST curve P-521 in Jacobian coordinates */ /* Input p1[27]; output p3[27] */ -extern void p521_jdouble(uint64_t p3[27],uint64_t p1[27]); -extern void p521_jdouble_alt(uint64_t p3[27],uint64_t p1[27]); +extern void p521_jdouble(uint64_t p3[27],const uint64_t p1[27]); +extern void p521_jdouble_alt(uint64_t p3[27],const uint64_t p1[27]); /* Point mixed addition on NIST curve P-521 in Jacobian coordinates */ /* Inputs p1[27], p2[18]; output p3[27] */ -extern void p521_jmixadd(uint64_t p3[27],uint64_t p1[27],uint64_t p2[18]); -extern void p521_jmixadd_alt(uint64_t p3[27],uint64_t p1[27],uint64_t p2[18]); +extern void p521_jmixadd(uint64_t p3[27],const uint64_t p1[27],const uint64_t p2[18]); +extern void p521_jmixadd_alt(uint64_t p3[27],const uint64_t p1[27],const uint64_t p2[18]); /* Jacobian form scalar multiplication for P-521 */ -/* Input scalar[9], point[27]; output res[27] */ -extern void p521_jscalarmul(uint64_t res[27],uint64_t scalar[9],uint64_t point[27]); -extern void p521_jscalarmul_alt(uint64_t res[27],uint64_t scalar[9],uint64_t point[27]); +/* Input scalar[9], point[27]; output res[27] */ +extern void p521_jscalarmul(uint64_t res[27],const uint64_t scalar[9],const uint64_t point[27]); +extern void p521_jscalarmul_alt(uint64_t res[27],const uint64_t scalar[9],const uint64_t point[27]); /* Point addition on SECG curve secp256k1 in Jacobian coordinates */ /* Inputs p1[12], p2[12]; output p3[12] */ -extern void secp256k1_jadd(uint64_t p3[12],uint64_t p1[12],uint64_t p2[12]); -extern void secp256k1_jadd_alt(uint64_t p3[12],uint64_t p1[12],uint64_t p2[12]); +extern void secp256k1_jadd(uint64_t p3[12],const uint64_t p1[12],const uint64_t p2[12]); +extern void secp256k1_jadd_alt(uint64_t p3[12],const uint64_t p1[12],const uint64_t p2[12]); /* Point doubling on SECG curve secp256k1 in Jacobian coordinates */ /* Input p1[12]; output p3[12] */ -extern void secp256k1_jdouble(uint64_t p3[12],uint64_t p1[12]); -extern void secp256k1_jdouble_alt(uint64_t p3[12],uint64_t p1[12]); +extern void secp256k1_jdouble(uint64_t p3[12],const uint64_t p1[12]); +extern void secp256k1_jdouble_alt(uint64_t p3[12],const uint64_t p1[12]); /* Point mixed addition on SECG curve secp256k1 in Jacobian coordinates */ /* Inputs p1[12], p2[8]; output p3[12] */ -extern void secp256k1_jmixadd(uint64_t p3[12],uint64_t p1[12],uint64_t p2[8]); -extern void secp256k1_jmixadd_alt(uint64_t p3[12],uint64_t p1[12],uint64_t p2[8]); +extern void secp256k1_jmixadd(uint64_t p3[12],const uint64_t p1[12],const uint64_t p2[8]); +extern void secp256k1_jmixadd_alt(uint64_t p3[12],const uint64_t p1[12],const uint64_t p2[8]); /* Keccak-f1600 permutation for SHA3 */ /* Inputs a[25], rc[24]; output a[25] */ -extern void sha3_keccak_f1600(uint64_t a[25],uint64_t rc[24]); -extern void sha3_keccak_f1600_alt(uint64_t a[25],uint64_t rc[24]); +extern void sha3_keccak_f1600(uint64_t a[25],const uint64_t rc[24]); +extern void sha3_keccak_f1600_alt(uint64_t a[25],const uint64_t rc[24]); +extern void sha3_keccak_f1600_alt2(uint64_t a[25],const uint64_t rc[24]); /* Batched 2-way Keccak-f1600 permutation for SHA3 */ /* Inputs a[50], rc[24]; output a[50] */ -extern void sha3_keccak2_f1600(uint64_t a[50],uint64_t rc[24]); -extern void sha3_keccak2_f1600_alt(uint64_t a[50],uint64_t rc[24]); +extern void sha3_keccak2_f1600(uint64_t a[50],const uint64_t rc[24]); +extern void sha3_keccak2_f1600_alt(uint64_t a[50],const uint64_t rc[24]); /* Batched 4-way Keccak-f1600 permutation for SHA3 */ /* Inputs a[100], rc[24]; output a[100] */ -extern void sha3_keccak4_f1600(uint64_t a[100],uint64_t rc[24]); -extern void sha3_keccak4_f1600_alt(uint64_t a[100],uint64_t rc[24]); -extern void sha3_keccak4_f1600_alt2(uint64_t a[100],uint64_t rc[24]); +extern void sha3_keccak4_f1600(uint64_t a[100],const uint64_t rc[24]); +extern void sha3_keccak4_f1600_alt(uint64_t a[100],const uint64_t rc[24]); +extern void sha3_keccak4_f1600_alt2(uint64_t a[100],const uint64_t rc[24]); /* Point addition on CC curve SM2 in Montgomery-Jacobian coordinates */ /* Inputs p1[12], p2[12]; output p3[12] */ -extern void sm2_montjadd(uint64_t p3[12],uint64_t p1[12],uint64_t p2[12]); -extern void sm2_montjadd_alt(uint64_t p3[12],uint64_t p1[12],uint64_t p2[12]); +extern void sm2_montjadd(uint64_t p3[12],const uint64_t p1[12],const uint64_t p2[12]); +extern void sm2_montjadd_alt(uint64_t p3[12],const uint64_t p1[12],const uint64_t p2[12]); /* Point doubling on CC curve SM2 in Montgomery-Jacobian coordinates */ /* Inputs p1[12]; output p3[12] */ -extern void sm2_montjdouble(uint64_t p3[12],uint64_t p1[12]); -extern void sm2_montjdouble_alt(uint64_t p3[12],uint64_t p1[12]); +extern void sm2_montjdouble(uint64_t p3[12],const uint64_t p1[12]); +extern void sm2_montjdouble_alt(uint64_t p3[12],const uint64_t p1[12]); /* Point mixed addition on CC curve SM2 in Montgomery-Jacobian coordinates */ /* Inputs p1[12], p2[8]; output p3[12] */ -extern void sm2_montjmixadd(uint64_t p3[12],uint64_t p1[12],uint64_t p2[8]); -extern void sm2_montjmixadd_alt(uint64_t p3[12],uint64_t p1[12],uint64_t p2[8]); +extern void sm2_montjmixadd(uint64_t p3[12],const uint64_t p1[12],const uint64_t p2[8]); +extern void sm2_montjmixadd_alt(uint64_t p3[12],const uint64_t p1[12],const uint64_t p2[8]); /* Montgomery-Jacobian form scalar multiplication for CC curve SM2 */ /* Input scalar[4], point[12]; output res[12] */ -extern void sm2_montjscalarmul(uint64_t res[12],uint64_t scalar[4],uint64_t point[12]); -extern void sm2_montjscalarmul_alt(uint64_t res[12],uint64_t scalar[4],uint64_t point[12]); +extern void sm2_montjscalarmul(uint64_t res[12],const uint64_t scalar[4],const uint64_t point[12]); +extern void sm2_montjscalarmul_alt(uint64_t res[12],const uint64_t scalar[4],const uint64_t point[12]); -/* Reverse the bytes in a single word */ -/* Input a; output function return */ +/* Reverse the bytes in a single word */ +/* Input a; output function return */ extern uint64_t word_bytereverse (uint64_t a); -/* Count leading zero bits in a single word */ -/* Input a; output function return */ +/* Count leading zero bits in a single word */ +/* Input a; output function return */ extern uint64_t word_clz (uint64_t a); -/* Count trailing zero bits in a single word */ -/* Input a; output function return */ +/* Count trailing zero bits in a single word */ +/* Input a; output function return */ extern uint64_t word_ctz (uint64_t a); /* Perform 59 "divstep" iterations and return signed matrix of updates */ /* Inputs d, f, g; output m[2][2] and function return */ extern int64_t word_divstep59(int64_t m[2][2],int64_t d,uint64_t f,uint64_t g); -/* Return maximum of two unsigned 64-bit words */ -/* Inputs a, b; output function return */ +/* Return maximum of two unsigned 64-bit words */ +/* Inputs a, b; output function return */ extern uint64_t word_max (uint64_t a, uint64_t b); -/* Return minimum of two unsigned 64-bit words */ -/* Inputs a, b; output function return */ +/* Return minimum of two unsigned 64-bit words */ +/* Inputs a, b; output function return */ extern uint64_t word_min (uint64_t a, uint64_t b); -/* Single-word negated modular inverse (-1/a) mod 2^64 */ -/* Input a; output function return */ +/* Single-word negated modular inverse (-1/a) mod 2^64 */ +/* Input a; output function return */ extern uint64_t word_negmodinv (uint64_t a); /* Count number of set bits in a single 64-bit word (population count) */ /* Input a; output function return */ extern uint64_t word_popcount (uint64_t a); -/* Single-word reciprocal, 2^64 + ret = ceil(2^128/a) - 1 if MSB of "a" is set */ -/* Input a; output function return */ +/* Single-word reciprocal, 2^64 + ret = ceil(2^128/a) - 1 if MSB of "a" is set */ +/* Input a; output function return */ extern uint64_t word_recip (uint64_t a); diff --git a/third_party/s2n-bignum/s2n-bignum-imported/include/s2n-bignum.h b/third_party/s2n-bignum/s2n-bignum-imported/include/s2n-bignum.h index d95e0d5203a..0658008fe51 100644 --- a/third_party/s2n-bignum/s2n-bignum-imported/include/s2n-bignum.h +++ b/third_party/s2n-bignum/s2n-bignum-imported/include/s2n-bignum.h @@ -424,6 +424,10 @@ extern uint64_t bignum_madd (uint64_t k, uint64_t *z, uint64_t m, const uint64_t extern void bignum_madd_n25519 (uint64_t z[S2N_BIGNUM_STATIC 4], const uint64_t x[S2N_BIGNUM_STATIC 4], const uint64_t y[S2N_BIGNUM_STATIC 4], const uint64_t c[S2N_BIGNUM_STATIC 4]); extern void bignum_madd_n25519_alt (uint64_t z[S2N_BIGNUM_STATIC 4], const uint64_t x[S2N_BIGNUM_STATIC 4], const uint64_t y[S2N_BIGNUM_STATIC 4], const uint64_t c[S2N_BIGNUM_STATIC 4]); +// Reduce modulo group order, z := x mod m_25519 +// Input x[k]; output z[4] +extern void bignum_mod_m25519 (uint64_t z[S2N_BIGNUM_STATIC 4], uint64_t k, const uint64_t *x); + // Reduce modulo group order, z := x mod m_25519 // Input x[4]; output z[4] extern void bignum_mod_m25519_4 (uint64_t z[S2N_BIGNUM_STATIC 4], const uint64_t x[S2N_BIGNUM_STATIC 4]); @@ -858,7 +862,7 @@ extern void bignum_tolebytes_4 (uint8_t z[S2N_BIGNUM_STATIC 32], const uint64_t extern void bignum_tolebytes_6 (uint8_t z[S2N_BIGNUM_STATIC 48], const uint64_t x[S2N_BIGNUM_STATIC 6]); // Convert 9-digit 528-bit bignum to little-endian bytes -// Input x[6]; output z[66] (bytes) +// Input x[9]; output z[66] (bytes) extern void bignum_tolebytes_p521 (uint8_t z[S2N_BIGNUM_STATIC 66], const uint64_t x[S2N_BIGNUM_STATIC 9]); // Convert to Montgomery form z := (2^256 * x) mod p_256 @@ -978,6 +982,18 @@ extern void edwards25519_scalarmulbase_alt(uint64_t res[S2N_BIGNUM_STATIC 8],con extern void edwards25519_scalarmuldouble(uint64_t res[S2N_BIGNUM_STATIC 8],const uint64_t scalar[S2N_BIGNUM_STATIC 4], const uint64_t point[S2N_BIGNUM_STATIC 8],const uint64_t bscalar[S2N_BIGNUM_STATIC 4]); extern void edwards25519_scalarmuldouble_alt(uint64_t res[S2N_BIGNUM_STATIC 8],const uint64_t scalar[S2N_BIGNUM_STATIC 4], const uint64_t point[S2N_BIGNUM_STATIC 8],const uint64_t bscalar[S2N_BIGNUM_STATIC 4]); +// Inverse number-theoretic transform for ML-DSA +// Input a[256], zetas[624] (signed 32-bit words); output a[256] (signed 32-bit words) +extern void mldsa_intt(int32_t a[S2N_BIGNUM_STATIC 256], const int32_t zetas[S2N_BIGNUM_STATIC 624]); + +// Forward number-theoretic transform for ML-DSA +// Input a[256], zetas[624] (signed 32-bit words); output a[256] (signed 32-bit words) +extern void mldsa_ntt(int32_t a[S2N_BIGNUM_STATIC 256], const int32_t zetas[S2N_BIGNUM_STATIC 624]); + +// Canonical reduction of polynomial coefficients for ML-DSA +// Input a[256] (signed 32-bit words); output a[256] (signed 32-bit words) +extern void mldsa_reduce(int32_t a[S2N_BIGNUM_STATIC 256]); + // Scalar product of 2-element polynomial vectors in NTT domain, with mulcache // Inputs a[512], b[512], bt[256] (signed 16-bit words); output r[256] (signed 16-bit words) extern void mlkem_basemul_k2(int16_t r[S2N_BIGNUM_STATIC 256],const int16_t a[S2N_BIGNUM_STATIC 512],const int16_t b[S2N_BIGNUM_STATIC 512],const int16_t bt[S2N_BIGNUM_STATIC 256]); @@ -994,10 +1010,22 @@ extern void mlkem_basemul_k4(int16_t r[S2N_BIGNUM_STATIC 256],const int16_t a[S2 // Input a[256] (signed 16-bit words), z_01234[80] (signed 16-bit words), z_56[384] (signed 16-bit words); output a[256] (signed 16-bit words) extern void mlkem_intt(int16_t a[S2N_BIGNUM_STATIC 256],const int16_t z_01234[S2N_BIGNUM_STATIC 80],const int16_t z_56[S2N_BIGNUM_STATIC 384]); +// Inverse number-theoretic transform from ML-KEM +// Input a[256] (signed 16-bit words), qdata[624]; output a[256] (signed 16-bit words) +extern void mlkem_intt_x86(int16_t a[S2N_BIGNUM_STATIC 256],const int16_t qdata[S2N_BIGNUM_STATIC 624]); + // Precompute the mulcache data for a polynomial in the NTT domain // Inputs a[256], z[128] and t[128] (signed 16-bit words); output x[128] (signed 16-bit words) extern void mlkem_mulcache_compute(int16_t x[S2N_BIGNUM_STATIC 128],const int16_t a[S2N_BIGNUM_STATIC 256],const int16_t z[S2N_BIGNUM_STATIC 128],const int16_t t[S2N_BIGNUM_STATIC 128]); +// Precompute the mulcache data for a polynomial in the NTT domain +// Inputs a[256], qdata[624] (signed 16-bit words); output x[128] (signed 16-bit words) +extern void mlkem_mulcache_compute_x86(int16_t x[S2N_BIGNUM_STATIC 128],const int16_t a[S2N_BIGNUM_STATIC 256],const int16_t qdata[S2N_BIGNUM_STATIC 624]); + +// Forward number-theoretic transform from ML-KEM x86 implementation +// Input a[256] (signed 16-bit words), qdata[624]; output a[256] (signed 16-bit words) +extern void mlkem_ntt_x86(int16_t a[S2N_BIGNUM_STATIC 256],const int16_t qdata[S2N_BIGNUM_STATIC 624]); + // Forward number-theoretic transform from ML-KEM // Input a[256] (signed 16-bit words), z_01234[80] (signed 16-bit words), z_56[384] (signed 16-bit words); output a[256] (signed 16-bit words) extern void mlkem_ntt(int16_t a[S2N_BIGNUM_STATIC 256],const int16_t z_01234[S2N_BIGNUM_STATIC 80],const int16_t z_56[S2N_BIGNUM_STATIC 384]); @@ -1006,6 +1034,10 @@ extern void mlkem_ntt(int16_t a[S2N_BIGNUM_STATIC 256],const int16_t z_01234[S2N // Input a[256] (signed 16-bit words); output a[256] (signed 16-bit words) extern void mlkem_reduce(int16_t a[S2N_BIGNUM_STATIC 256]); +// Unpack ML-KEM polynomial coefficients +// Input a[384] (bytes); output r[256] (signed 16-bit words) +extern void mlkem_frombytes(int16_t r[S2N_BIGNUM_STATIC 256],const uint8_t a[S2N_BIGNUM_STATIC 384]); + // Pack ML-KEM polynomial coefficients as 12-bit numbers // Input a[256] (signed 16-bit words); output r[384] (bytes) extern void mlkem_tobytes(uint8_t r[S2N_BIGNUM_STATIC 384],const int16_t a[S2N_BIGNUM_STATIC 256]); @@ -1018,6 +1050,10 @@ extern void mlkem_tomont(int16_t a[S2N_BIGNUM_STATIC 256]); // Inputs *buf (unsigned bytes), buflen, table (unsigned bytes); output r[256] (signed 16-bit words), return extern uint64_t mlkem_rej_uniform_VARIABLE_TIME(int16_t r[S2N_BIGNUM_STATIC 256],const uint8_t *buf,uint64_t buflen,const uint8_t *table); +// Reorders ML-KEM polynomial coefficients for x86 implementation +// Input a[256] (signed 16-bit words); output a[256] (signed 16-bit words) +extern void mlkem_unpack(int16_t a[S2N_BIGNUM_STATIC 256]); + // Point addition on NIST curve P-256 in Montgomery-Jacobian coordinates // Inputs p1[12], p2[12]; output p3[12] extern void p256_montjadd(uint64_t p3[S2N_BIGNUM_STATIC 12],const uint64_t p1[S2N_BIGNUM_STATIC 12],const uint64_t p2[S2N_BIGNUM_STATIC 12]); @@ -1107,6 +1143,7 @@ extern void secp256k1_jmixadd_alt(uint64_t p3[S2N_BIGNUM_STATIC 12],const uint64 // Inputs a[25], rc[24]; output a[25] extern void sha3_keccak_f1600(uint64_t a[S2N_BIGNUM_STATIC 25],const uint64_t rc[S2N_BIGNUM_STATIC 24]); extern void sha3_keccak_f1600_alt(uint64_t a[S2N_BIGNUM_STATIC 25],const uint64_t rc[S2N_BIGNUM_STATIC 24]); +extern void sha3_keccak_f1600_alt2(uint64_t a[S2N_BIGNUM_STATIC 25],const uint64_t rc[S2N_BIGNUM_STATIC 24]); // Batched 2-way Keccak-f1600 permutation for SHA3 // Inputs a[50], rc[24]; output a[50] @@ -1116,7 +1153,11 @@ extern void sha3_keccak2_f1600_alt(uint64_t a[S2N_BIGNUM_STATIC 50],const uint64 // Batched 4-way Keccak-f1600 permutation for SHA3 // Inputs a[100], rc[24]; output a[100] extern void sha3_keccak4_f1600(uint64_t a[S2N_BIGNUM_STATIC 100],const uint64_t rc[S2N_BIGNUM_STATIC 24]); +#ifdef __x86_64__ +extern void sha3_keccak4_f1600_alt(uint64_t a[S2N_BIGNUM_STATIC 100],const uint64_t rc[S2N_BIGNUM_STATIC 24],const uint64_t rho8[S2N_BIGNUM_STATIC 4],const uint64_t rho56[S2N_BIGNUM_STATIC 4]); +#else extern void sha3_keccak4_f1600_alt(uint64_t a[S2N_BIGNUM_STATIC 100],const uint64_t rc[S2N_BIGNUM_STATIC 24]); +#endif extern void sha3_keccak4_f1600_alt2(uint64_t a[S2N_BIGNUM_STATIC 100],const uint64_t rc[S2N_BIGNUM_STATIC 24]); // Point addition on CC curve SM2 in Montgomery-Jacobian coordinates diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/Makefile b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/Makefile deleted file mode 100644 index 91e312e2179..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/Makefile +++ /dev/null @@ -1,345 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - -# These are the object files corresponding to sources for translation - -OBJ = curve25519/bignum_add_p25519.o \ - curve25519/bignum_cmul_p25519.o \ - curve25519/bignum_cmul_p25519_alt.o \ - curve25519/bignum_double_p25519.o \ - curve25519/bignum_inv_p25519.o \ - curve25519/bignum_invsqrt_p25519.o \ - curve25519/bignum_invsqrt_p25519_alt.o \ - curve25519/bignum_madd_n25519.o \ - curve25519/bignum_madd_n25519_alt.o \ - curve25519/bignum_mod_m25519_4.o \ - curve25519/bignum_mod_n25519.o \ - curve25519/bignum_mod_n25519_4.o \ - curve25519/bignum_mod_p25519_4.o \ - curve25519/bignum_mul_p25519.o \ - curve25519/bignum_mul_p25519_alt.o \ - curve25519/bignum_neg_p25519.o \ - curve25519/bignum_optneg_p25519.o \ - curve25519/bignum_sqr_p25519.o \ - curve25519/bignum_sqr_p25519_alt.o \ - curve25519/bignum_sqrt_p25519.o \ - curve25519/bignum_sqrt_p25519_alt.o \ - curve25519/bignum_sub_p25519.o \ - curve25519/curve25519_ladderstep.o \ - curve25519/curve25519_ladderstep_alt.o \ - curve25519/curve25519_pxscalarmul.o \ - curve25519/curve25519_pxscalarmul_alt.o \ - curve25519/curve25519_x25519.o \ - curve25519/curve25519_x25519_alt.o \ - curve25519/curve25519_x25519base.o \ - curve25519/curve25519_x25519base_alt.o \ - curve25519/edwards25519_decode.o \ - curve25519/edwards25519_decode_alt.o \ - curve25519/edwards25519_encode.o \ - curve25519/edwards25519_epadd.o \ - curve25519/edwards25519_epadd_alt.o \ - curve25519/edwards25519_epdouble.o \ - curve25519/edwards25519_epdouble_alt.o \ - curve25519/edwards25519_pdouble.o \ - curve25519/edwards25519_pdouble_alt.o \ - curve25519/edwards25519_pepadd.o \ - curve25519/edwards25519_pepadd_alt.o \ - curve25519/edwards25519_scalarmulbase.o \ - curve25519/edwards25519_scalarmulbase_alt.o \ - curve25519/edwards25519_scalarmuldouble.o \ - curve25519/edwards25519_scalarmuldouble_alt.o \ - fastmul/bignum_emontredc_8n.o \ - fastmul/bignum_kmul_16_32.o \ - fastmul/bignum_kmul_32_64.o \ - fastmul/bignum_ksqr_16_32.o \ - fastmul/bignum_ksqr_32_64.o \ - fastmul/bignum_mul_4_8.o \ - fastmul/bignum_mul_4_8_alt.o \ - fastmul/bignum_mul_6_12.o \ - fastmul/bignum_mul_6_12_alt.o \ - fastmul/bignum_mul_8_16.o \ - fastmul/bignum_mul_8_16_alt.o \ - fastmul/bignum_sqr_4_8.o \ - fastmul/bignum_sqr_4_8_alt.o \ - fastmul/bignum_sqr_6_12.o \ - fastmul/bignum_sqr_6_12_alt.o \ - fastmul/bignum_sqr_8_16.o \ - fastmul/bignum_sqr_8_16_alt.o \ - generic/bignum_add.o \ - generic/bignum_amontifier.o \ - generic/bignum_amontmul.o \ - generic/bignum_amontredc.o \ - generic/bignum_amontsqr.o \ - generic/bignum_bitfield.o \ - generic/bignum_bitsize.o \ - generic/bignum_cdiv.o \ - generic/bignum_cdiv_exact.o \ - generic/bignum_cld.o \ - generic/bignum_clz.o \ - generic/bignum_cmadd.o \ - generic/bignum_cmnegadd.o \ - generic/bignum_cmod.o \ - generic/bignum_cmul.o \ - generic/bignum_coprime.o \ - generic/bignum_copy.o \ - generic/bignum_ctd.o \ - generic/bignum_ctz.o \ - generic/bignum_demont.o \ - generic/bignum_digit.o \ - generic/bignum_digitsize.o \ - generic/bignum_divmod10.o \ - generic/bignum_emontredc.o \ - generic/bignum_eq.o \ - generic/bignum_even.o \ - generic/bignum_ge.o \ - generic/bignum_gt.o \ - generic/bignum_iszero.o \ - generic/bignum_le.o \ - generic/bignum_lt.o \ - generic/bignum_madd.o \ - generic/bignum_modadd.o \ - generic/bignum_moddouble.o \ - generic/bignum_modexp.o \ - generic/bignum_modifier.o \ - generic/bignum_modinv.o \ - generic/bignum_modoptneg.o \ - generic/bignum_modsub.o \ - generic/bignum_montifier.o \ - generic/bignum_montmul.o \ - generic/bignum_montredc.o \ - generic/bignum_montsqr.o \ - generic/bignum_mul.o \ - generic/bignum_muladd10.o \ - generic/bignum_mux.o \ - generic/bignum_mux16.o \ - generic/bignum_negmodinv.o \ - generic/bignum_nonzero.o \ - generic/bignum_normalize.o \ - generic/bignum_odd.o \ - generic/bignum_of_word.o \ - generic/bignum_optadd.o \ - generic/bignum_optneg.o \ - generic/bignum_optsub.o \ - generic/bignum_optsubadd.o \ - generic/bignum_pow2.o \ - generic/bignum_shl_small.o \ - generic/bignum_shr_small.o \ - generic/bignum_sqr.o \ - generic/bignum_sub.o \ - generic/word_bytereverse.o \ - generic/word_clz.o \ - generic/word_ctz.o \ - generic/word_divstep59.o \ - generic/word_max.o \ - generic/word_min.o \ - generic/word_negmodinv.o \ - generic/word_popcount.o \ - generic/word_recip.o \ - p256/bignum_add_p256.o \ - p256/bignum_bigendian_4.o \ - p256/bignum_cmul_p256.o \ - p256/bignum_cmul_p256_alt.o \ - p256/bignum_deamont_p256.o \ - p256/bignum_deamont_p256_alt.o \ - p256/bignum_demont_p256.o \ - p256/bignum_demont_p256_alt.o \ - p256/bignum_double_p256.o \ - p256/bignum_half_p256.o \ - p256/bignum_inv_p256.o \ - p256/bignum_littleendian_4.o \ - p256/bignum_mod_n256.o \ - p256/bignum_mod_n256_alt.o \ - p256/bignum_mod_n256_4.o \ - p256/bignum_mod_p256.o \ - p256/bignum_mod_p256_alt.o \ - p256/bignum_mod_p256_4.o \ - p256/bignum_montinv_p256.o \ - p256/bignum_montmul_p256.o \ - p256/bignum_montmul_p256_alt.o \ - p256/bignum_montsqr_p256.o \ - p256/bignum_montsqr_p256_alt.o \ - p256/bignum_mux_4.o \ - p256/bignum_neg_p256.o \ - p256/bignum_nonzero_4.o \ - p256/bignum_optneg_p256.o \ - p256/bignum_sub_p256.o \ - p256/bignum_tomont_p256.o \ - p256/bignum_tomont_p256_alt.o \ - p256/bignum_triple_p256.o \ - p256/bignum_triple_p256_alt.o \ - p256/p256_montjadd.o \ - p256/p256_montjadd_alt.o \ - p256/p256_montjdouble.o \ - p256/p256_montjdouble_alt.o \ - p256/p256_montjmixadd.o \ - p256/p256_montjmixadd_alt.o \ - p256/p256_montjscalarmul.o \ - p256/p256_montjscalarmul_alt.o \ - p256/p256_scalarmul.o \ - p256/p256_scalarmul_alt.o \ - p256/p256_scalarmulbase.o \ - p256/p256_scalarmulbase_alt.o \ - p384/bignum_add_p384.o \ - p384/bignum_bigendian_6.o \ - p384/bignum_cmul_p384.o \ - p384/bignum_cmul_p384_alt.o \ - p384/bignum_deamont_p384.o \ - p384/bignum_deamont_p384_alt.o \ - p384/bignum_demont_p384.o \ - p384/bignum_demont_p384_alt.o \ - p384/bignum_double_p384.o \ - p384/bignum_half_p384.o \ - p384/bignum_inv_p384.o \ - p384/bignum_littleendian_6.o \ - p384/bignum_mod_n384_alt.o \ - p384/bignum_mod_n384.o \ - p384/bignum_mod_n384_6.o \ - p384/bignum_mod_p384.o \ - p384/bignum_mod_p384_alt.o \ - p384/bignum_mod_p384_6.o \ - p384/bignum_montinv_p384.o \ - p384/bignum_montmul_p384.o \ - p384/bignum_montmul_p384_alt.o \ - p384/bignum_montsqr_p384.o \ - p384/bignum_montsqr_p384_alt.o \ - p384/bignum_mux_6.o \ - p384/bignum_neg_p384.o \ - p384/bignum_nonzero_6.o \ - p384/bignum_optneg_p384.o \ - p384/bignum_sub_p384.o \ - p384/bignum_tomont_p384.o \ - p384/bignum_tomont_p384_alt.o \ - p384/bignum_triple_p384.o \ - p384/bignum_triple_p384_alt.o \ - p384/p384_montjadd.o \ - p384/p384_montjadd_alt.o \ - p384/p384_montjdouble.o \ - p384/p384_montjdouble_alt.o \ - p384/p384_montjmixadd.o \ - p384/p384_montjmixadd_alt.o \ - p384/p384_montjscalarmul.o \ - p384/p384_montjscalarmul_alt.o \ - p521/bignum_add_p521.o \ - p521/bignum_cmul_p521.o \ - p521/bignum_cmul_p521_alt.o \ - p521/bignum_deamont_p521.o \ - p521/bignum_demont_p521.o \ - p521/bignum_double_p521.o \ - p521/bignum_fromlebytes_p521.o \ - p521/bignum_half_p521.o \ - p521/bignum_inv_p521.o \ - p521/bignum_mod_n521_9.o \ - p521/bignum_mod_n521_9_alt.o \ - p521/bignum_mod_p521_9.o \ - p521/bignum_montmul_p521.o \ - p521/bignum_montmul_p521_alt.o \ - p521/bignum_montsqr_p521.o \ - p521/bignum_montsqr_p521_alt.o \ - p521/bignum_mul_p521.o \ - p521/bignum_mul_p521_alt.o \ - p521/bignum_neg_p521.o \ - p521/bignum_optneg_p521.o \ - p521/bignum_sqr_p521.o \ - p521/bignum_sqr_p521_alt.o \ - p521/bignum_sub_p521.o \ - p521/bignum_tolebytes_p521.o \ - p521/bignum_tomont_p521.o \ - p521/bignum_triple_p521.o \ - p521/bignum_triple_p521_alt.o \ - p521/p521_jadd.o \ - p521/p521_jadd_alt.o \ - p521/p521_jdouble.o \ - p521/p521_jdouble_alt.o \ - p521/p521_jmixadd.o \ - p521/p521_jmixadd_alt.o \ - p521/p521_jscalarmul.o \ - p521/p521_jscalarmul_alt.o \ - secp256k1/bignum_add_p256k1.o \ - secp256k1/bignum_cmul_p256k1.o \ - secp256k1/bignum_cmul_p256k1_alt.o \ - secp256k1/bignum_deamont_p256k1.o \ - secp256k1/bignum_demont_p256k1.o \ - secp256k1/bignum_double_p256k1.o \ - secp256k1/bignum_half_p256k1.o \ - secp256k1/bignum_mod_n256k1_4.o \ - secp256k1/bignum_mod_p256k1_4.o \ - secp256k1/bignum_montmul_p256k1.o \ - secp256k1/bignum_montmul_p256k1_alt.o \ - secp256k1/bignum_montsqr_p256k1.o \ - secp256k1/bignum_montsqr_p256k1_alt.o \ - secp256k1/bignum_mul_p256k1.o \ - secp256k1/bignum_mul_p256k1_alt.o \ - secp256k1/bignum_neg_p256k1.o \ - secp256k1/bignum_optneg_p256k1.o \ - secp256k1/bignum_sqr_p256k1.o \ - secp256k1/bignum_sqr_p256k1_alt.o \ - secp256k1/bignum_sub_p256k1.o \ - secp256k1/bignum_tomont_p256k1.o \ - secp256k1/bignum_tomont_p256k1_alt.o \ - secp256k1/bignum_triple_p256k1.o \ - secp256k1/bignum_triple_p256k1_alt.o \ - secp256k1/secp256k1_jadd.o \ - secp256k1/secp256k1_jadd_alt.o \ - secp256k1/secp256k1_jdouble.o \ - secp256k1/secp256k1_jdouble_alt.o \ - secp256k1/secp256k1_jmixadd.o \ - secp256k1/secp256k1_jmixadd_alt.o \ - sha3/sha3_keccak_f1600.o \ - sm2/bignum_add_sm2.o \ - sm2/bignum_cmul_sm2.o \ - sm2/bignum_cmul_sm2_alt.o \ - sm2/bignum_deamont_sm2.o \ - sm2/bignum_demont_sm2.o \ - sm2/bignum_double_sm2.o \ - sm2/bignum_half_sm2.o \ - sm2/bignum_inv_sm2.o \ - sm2/bignum_mod_nsm2.o \ - sm2/bignum_mod_nsm2_alt.o \ - sm2/bignum_mod_nsm2_4.o \ - sm2/bignum_mod_sm2.o \ - sm2/bignum_mod_sm2_4.o \ - sm2/bignum_montinv_sm2.o \ - sm2/bignum_montmul_sm2.o \ - sm2/bignum_montmul_sm2_alt.o \ - sm2/bignum_montsqr_sm2.o \ - sm2/bignum_montsqr_sm2_alt.o \ - sm2/bignum_neg_sm2.o \ - sm2/bignum_optneg_sm2.o \ - sm2/bignum_sub_sm2.o \ - sm2/bignum_tomont_sm2.o \ - sm2/bignum_triple_sm2.o \ - sm2/bignum_triple_sm2_alt.o \ - sm2/sm2_montjadd.o \ - sm2/sm2_montjadd_alt.o \ - sm2/sm2_montjdouble.o \ - sm2/sm2_montjdouble_alt.o \ - sm2/sm2_montjmixadd.o \ - sm2/sm2_montjmixadd_alt.o \ - sm2/sm2_montjscalarmul.o \ - sm2/sm2_montjscalarmul_alt.o - -# The AT&T syntax source files - -ATTSOURCES = $(OBJ:.o=.S) - -code: $(ATTSOURCES) - -all: $(OBJ); - -%.o : %.S ; ($(CC) -E -I../include $< | as -o $@ -); (cd ../x86; $(CC) -E -I../include $< | as -o /tmp/original_object.o); cmp -s $@ /tmp/original_object.o - -curve25519/%.S :: ../x86/curve25519/%.S ; (cat $< | sed -E -f ./attrofy.sed >$@) && ($(CC) -E -I../include -DWINDOWS_ABI=0 $@ | as -o /tmp/translated_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $@ | as -o /tmp/translated_object.obj) ; ($(CC) -E -I../include -DWINDOWS_ABI=0 $< | as -o /tmp/original_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $< | as -o /tmp/original_object.obj) ; (cmp -s /tmp/translated_object.o /tmp/original_object.o && cmp -s /tmp/translated_object.obj /tmp/original_object.obj) -fastmul/%.S :: ../x86/fastmul/%.S ; (cat $< | sed -E -f ./attrofy.sed >$@) && ($(CC) -E -I../include -DWINDOWS_ABI=0 $@ | as -o /tmp/translated_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $@ | as -o /tmp/translated_object.obj) ; ($(CC) -E -I../include -DWINDOWS_ABI=0 $< | as -o /tmp/original_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $< | as -o /tmp/original_object.obj) ; (cmp -s /tmp/translated_object.o /tmp/original_object.o && cmp -s /tmp/translated_object.obj /tmp/original_object.obj) -generic/%.S :: ../x86/generic/%.S ; (cat $< | sed -E -f ./attrofy.sed >$@) && ($(CC) -E -I../include -DWINDOWS_ABI=0 $@ | as -o /tmp/translated_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $@ | as -o /tmp/translated_object.obj) ; ($(CC) -E -I../include -DWINDOWS_ABI=0 $< | as -o /tmp/original_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $< | as -o /tmp/original_object.obj) ; (cmp -s /tmp/translated_object.o /tmp/original_object.o && cmp -s /tmp/translated_object.obj /tmp/original_object.obj) -p256/%.S :: ../x86/p256/%.S ; (cat $< | sed -E -f ./attrofy.sed >$@) && ($(CC) -E -I../include -DWINDOWS_ABI=0 $@ | as -o /tmp/translated_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $@ | as -o /tmp/translated_object.obj) ; ($(CC) -E -I../include -DWINDOWS_ABI=0 $< | as -o /tmp/original_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $< | as -o /tmp/original_object.obj) ; (cmp -s /tmp/translated_object.o /tmp/original_object.o && cmp -s /tmp/translated_object.obj /tmp/original_object.obj) -p384/%.S :: ../x86/p384/%.S ; (cat $< | sed -E -f ./attrofy.sed >$@) && ($(CC) -E -I../include -DWINDOWS_ABI=0 $@ | as -o /tmp/translated_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $@ | as -o /tmp/translated_object.obj) ; ($(CC) -E -I../include -DWINDOWS_ABI=0 $< | as -o /tmp/original_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $< | as -o /tmp/original_object.obj) ; (cmp -s /tmp/translated_object.o /tmp/original_object.o && cmp -s /tmp/translated_object.obj /tmp/original_object.obj) -p521/%.S :: ../x86/p521/%.S ; (cat $< | sed -E -f ./attrofy.sed >$@) && ($(CC) -E -I../include -DWINDOWS_ABI=0 $@ | as -o /tmp/translated_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $@ | as -o /tmp/translated_object.obj) ; ($(CC) -E -I../include -DWINDOWS_ABI=0 $< | as -o /tmp/original_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $< | as -o /tmp/original_object.obj) ; (cmp -s /tmp/translated_object.o /tmp/original_object.o && cmp -s /tmp/translated_object.obj /tmp/original_object.obj) -secp256k1/%.S :: ../x86/secp256k1/%.S ; (cat $< | sed -E -f ./attrofy.sed >$@) && ($(CC) -E -I../include -DWINDOWS_ABI=0 $@ | as -o /tmp/translated_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $@ | as -o /tmp/translated_object.obj) ; ($(CC) -E -I../include -DWINDOWS_ABI=0 $< | as -o /tmp/original_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $< | as -o /tmp/original_object.obj) ; (cmp -s /tmp/translated_object.o /tmp/original_object.o && cmp -s /tmp/translated_object.obj /tmp/original_object.obj) -sha3/%.S :: ../x86/sha3/%.S ; (cat $< | sed -E -f ./attrofy.sed >$@) && ($(CC) -E -I../include -DWINDOWS_ABI=0 $@ | as -o /tmp/translated_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $@ | as -o /tmp/translated_object.obj) ; ($(CC) -E -I../include -DWINDOWS_ABI=0 $< | as -o /tmp/original_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $< | as -o /tmp/original_object.obj) ; (cmp -s /tmp/translated_object.o /tmp/original_object.o && cmp -s /tmp/translated_object.obj /tmp/original_object.obj) -sm2/%.S :: ../x86/sm2/%.S ; (cat $< | sed -E -f ./attrofy.sed >$@) && ($(CC) -E -I../include -DWINDOWS_ABI=0 $@ | as -o /tmp/translated_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $@ | as -o /tmp/translated_object.obj) ; ($(CC) -E -I../include -DWINDOWS_ABI=0 $< | as -o /tmp/original_object.o) ; ($(CC) -E -I../include -DWINDOWS_ABI=1 $< | as -o /tmp/original_object.obj) ; (cmp -s /tmp/translated_object.o /tmp/original_object.o && cmp -s /tmp/translated_object.obj /tmp/original_object.obj) - -clean:; rm -f */*.o - -clobber:; rm -f */*.o */*.S diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/attrofy.sed b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/attrofy.sed deleted file mode 100644 index 1a127b215be..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/attrofy.sed +++ /dev/null @@ -1,137 +0,0 @@ -############################################################################# -# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 -############################################################################# - - ############################################################################ - # * * * NOTE * * * # - # # - # This is a primitive script to automate conversion of certain particular # - # x86 assembler files from Intel to AT&T syntax. It is *not* a general # - # conversion and is very tied to the specific limitations and conventions # - # in the intended targets. Even in that setting we only use it with an # - # additional sanity check that the object code generated is the same in # - # both original and translated code according to the GNU assembler. # - ############################################################################ - -s/\.intel_syntax *noprefix// -s/_internal_s2n_bignum_x86/_internal_s2n_bignum_x86_att/ - -# Don't make any transforms on lines with the argument-taking macros - -/ addrow .+,/b -/ mulpadd .+,/b -/ mulpadda .+,/b -/ mulpade .+,/b -/ mulrow .+,/b - -# Reverse the argument order for binary and ternary instructions - -s/^(([a-z_0-9]+\:)* +[a-z_0-9]+ +)([^ (][^,/]*), *([^ ][^/,;]*)([/;].*)*$/\1\4, \3 \5/ -s/^(([a-z_0-9]+\:)* +[a-z_0-9]+ +)([^ (][^,/]*), *([^ ][^/,]*), *([^ ][^/,;]*)([/;].*)*$/\1\5, \4, \3 \6/ - -# Fix up whitespace just in case - -s/ +,/,/ - -# Decorate literals with $ - -s/^(([a-z_0-9]+\:)* +[a-z_0-9]+ +)(([-~+*/()A-Z0-9]*(0x[a-zA-Z0-9]*)*)* *\,)/\1$\3/ - -# Translate relative addresses with uppercase base variable -# Turn defined offset fields into explicit indirections to match - -s/^([^/][^[]+)[[]([A-Z_0-9]+)[]]/\1\2/ -s/^([^/][^[]+)[[]([A-Z][A-Z_0-9]*) *\+ *([^]]+)[]]/\1\3\+\2/ - -s/^\#define *([a-z][a-z_0-9]*) *([a-z][a-z_0-9]*) *\+(.*)/\#define \1 \3\(\2\)/ - -# Translate relative addresses - -s/^([^/][^[]+)[[]([a-z_0-9]+)[]]/\1\(\2\)/ -s/^([^/][^[]+)[[]([a-z][a-z_0-9]*) *\+ *8\*([a-z][a-z_0-9]*) *\+ *([a-z_A-Z0-9]+)[]]/\1\4\(\2,\3,8\)/ -s/^([^/][^[]+)[[]([a-z][a-z_0-9]*) *\+ *([a-z][a-z_0-9]*) *\+ *([a-z_A-Z0-9]+)[]]/\1\4\(\2,\3,1\)/ -s/^([^/][^[]+)[[]([a-z][a-z_0-9]*) *\+ *8\*([a-z][a-z_0-9]*) *\- *([a-z_A-Z0-9]+)[]]/\1\-\4\(\2,\3,8\)/ -s/^([^/][^[]+)[[](rip) *\+ *([a-z_A-Z0-9* ]+)[]]/\1\3\(\2\)/ -s/^([^/][^[]+)[[]([a-z][a-z_0-9]*) *\+ *([A-Z0-9* ]+)[]]/\1\3\(\2\)/ -s/^([^/][^[]+)[[]([a-z][a-z_0-9]*) *\- *([A-Z0-9* ]+)[]]/\1\-\3\(\2\)/ -s/^([^/][^[]+)[[]([a-z][a-z_0-9]*) *\+ *8\*([a-z][a-z_0-9]*)[]]/\1\(\2,\3,8\)/ -s/^([^/][^[]+)[[]([a-z][a-z_0-9]*) *\+ *4\*([a-z][a-z_0-9]*)[]]/\1\(\2,\3,4\)/ -s/^([^/][^[]+)[[]([a-z][a-z_0-9]*) *\+ *2\*([a-z][a-z_0-9]*)[]]/\1\(\2,\3,2\)/ -s/^([^/][^[]+)[[]([a-z][a-z_0-9]*) *\+ *([a-z][a-z_0-9]*)[]]/\1\(\2,\3\)/ -s/^([^/][^[]+)[[]([a-z][a-z_0-9]*) *\+ *([^]]+)[]]/\1\3\(\2\)/ -s/^([^/][^[]+)[[]([a-z][a-z_0-9]*) *\- *([^]]+)[]]/\1-\3\(\2\)/ -s/^([^/][^[]+)[[]([^]]+)[]]/\1\(\2\)/ - -# Put % in front of register names - -s/ ax *$/ %ax/ -s/ ax,/ %ax,/ -s/ cl *$/ %cl/ -s/ cl,/ %cl,/ -s/([[(,.;: ])([re][abcd]x)/\1\%\2/g -s/([[(,.;: ])([re]sp)/\1\%\2/g -s/([[(,.;: ])([re]bp)/\1\%\2/g -s/([[(,.;: ])([re]si)/\1\%\2/g -s/([[(,.;: ])([re]di)/\1\%\2/g -s/([[(,.;: ])(r8d*)/\1\%\2/g -s/([[(,.;: ])(r9d*)/\1\%\2/g -s/([[(,.;: ])(r1[0-5]d*)/\1\%\2/g -s/([[(,.;: ])([re]ip)/\1\%\2/g - -# Add explicit sizes to instructions - -s/QWORD PTR//g - -s/ adc / adcq /g -s/ adcx / adcxq /g -s/ add / addq /g -s/ adox / adoxq /g -s/ and / andq /g -s/ bsf / bsfq /g -s/ bsr / bsrq /g -s/ bswap / bswapq /g -s/ bt / btq /g -s/ call / callq /g -s/ cmovae / cmovaeq /g -s/ cmovb / cmovbq /g -s/ cmovc / cmovcq /g -s/ cmove / cmoveq /g -s/ cmovnc / cmovncq /g -s/ cmovne / cmovneq /g -s/ cmovnz / cmovnzq /g -s/ cmovz / cmovzq /g -s/ cmp / cmpq /g -s/ dec / decq /g -s/ imul / imulq /g -s/ inc / incq /g -s/ lea / leaq /g -s/ mov / movq /g -s/ movabs / movabsq /g -s/ mul / mulq /g -s/ mulx / mulxq /g -s/ neg / negq /g -s/ not / notq /g -s/ or / orq /g -s/ pop / popq /g -s/ push / pushq /g -s/ sar / sarq /g -s/ sbb / sbbq /g -s/ shl / shlq /g -s/ shld / shldq /g -s/ shr / shrq /g -s/ shrd / shrdq /g -s/ sub / subq /g -s/ test / testq /g -s/ xor / xorq /g - -s/q( .*zeroe)/l\1/ -s/q( .*plus2e)/l\1/ -s/q( .*short)/l\1/ -s/q( .*%e)/l\1/ -s/q( .*%r[0-9]+d)/l\1/ -s/q( .*%ax)/w\1/ - -# Eliminate any trailing spaces, just to be tidy - -s/ +$// diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_add_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_add_p25519.S deleted file mode 100644 index 67edb86bccd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_add_p25519.S +++ /dev/null @@ -1,107 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Add modulo p_25519, z := (x + y) mod p_25519, assuming x and y reduced -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_add_p25519(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_add_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_add_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_add_p25519) - .text - -#define z %rdi -#define x %rsi -#define y %rdx - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -// These also re-use inputs x and y when safe to do so - -#define c0 %rax -#define c1 %rcx -#define c2 %rsi -#define c3 %rdx -#define c0short %eax -#define c1short %ecx -#define c2short %esi -#define c3short %edx - -S2N_BN_SYMBOL(bignum_add_p25519): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Add as [d3; d2; d1; d0] = x + y; since we assume x, y < 2^255 - 19 -// this sum fits in 256 bits. - - movq (x), d0 - addq (y), d0 - movq 8(x), d1 - adcq 8(y), d1 - movq 16(x), d2 - adcq 16(y), d2 - movq 24(x), d3 - adcq 24(y), d3 - -// Now x + y >= 2^255 - 19 <=> x + y + 19 >= 2^255. -// Form [c3; c2; c1; c0] = (x + y) + 19 - - movl $19, c0short - xorl c1short, c1short - xorl c2short, c2short - xorl c3short, c3short - - addq d0, c0 - adcq d1, c1 - adcq d2, c2 - adcq d3, c3 - -// Test the top bit to see if this is >= 2^255, and clear it as a masking -// so that in that case the result is exactly (x + y) - (2^255 - 19). -// Then select the output according to that top bit as that or just x + y. - - btr $63, c3 - cmovcq c0, d0 - cmovcq c1, d1 - cmovcq c2, d2 - cmovcq c3, d3 - -// Store the result - - movq d0, (z) - movq d1, 8(z) - movq d2, 16(z) - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_add_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_cmul_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_cmul_p25519.S deleted file mode 100644 index 0f54e5e9c50..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_cmul_p25519.S +++ /dev/null @@ -1,117 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_25519, z := (c * x) mod p_25519, assuming -// x reduced -// Inputs c, x[4]; output z[4] -// -// extern void bignum_cmul_p25519(uint64_t z[static 4], uint64_t c, -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = c, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = c, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p25519) - .text - -#define z %rdi - -// Temporarily moved here for initial multiply - -#define x %rcx -#define c %rcx -#define cshort %ecx - -// Used as a zero register after the initial move - -#define zero %rsi -#define zeroe %esi - -// Likewise this is thrown away after initial multiply - -#define d %rdx -#define a %rax -#define ashort %eax - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -S2N_BN_SYMBOL(bignum_cmul_p25519): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Shuffle inputs (since we want multiplier in %rdx) - - movq %rdx, x - movq %rsi, d - -// Multiply, accumulating the result as [d4;d3;d2;d1;d0] - - mulxq (x), d0, d1 - mulxq 8(x), a, d2 - addq a, d1 - mulxq 16(x), a, d3 - adcq a, d2 - mulxq 24(x), d, a - adcq d, d3 - adcq $0, a - -// Let [d4;d3;d2;d1;d0] = 2^255 * h + l, and use q = h + 1 as the initial -// quotient estimate, which is either right or 1 too big. - - shldq $1, d3, a - movl $19, cshort - incq a - bts $63, d3 - mulq c - xorl zeroe, zeroe - addq a, d0 - adcq d, d1 - adcq zero, d2 - adcq zero, d3 - -// Correct if CF = 0 by subtracting 19, either way masking to -// 255 bits, i.e. by effectively adding p_25519 to the "full" answer - - cmovcq zero, c - subq c, d0 - sbbq zero, d1 - sbbq zero, d2 - sbbq zero, d3 - btr $63, d3 - -// Write everything back - - movq d0, (z) - movq d1, 8(z) - movq d2, 16(z) - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_cmul_p25519_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_cmul_p25519_alt.S deleted file mode 100644 index 704d6a86707..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_cmul_p25519_alt.S +++ /dev/null @@ -1,131 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_25519, z := (c * x) mod p_25519, assuming -// x reduced -// Inputs c, x[4]; output z[4] -// -// extern void bignum_cmul_p25519_alt(uint64_t z[static 4], uint64_t c, -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = c, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = c, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p25519_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p25519_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p25519_alt) - .text - -#define z %rdi - -// Temporarily moved here for initial multiply - -#define x %rcx - -// Used as a zero register after the initial move - -#define zero %rsi -#define zeroe %esi - -// Likewise this is thrown away after initial multiply - -#define d %rdx -#define a %rax -#define ashort %eax - -#define c %rcx -#define cshort %ecx - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 -#define d4 %rdx - -S2N_BN_SYMBOL(bignum_cmul_p25519_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Shuffle inputs (since we want %rdx for the high parts of products) - - movq %rdx, x - -// Multiply, accumulating the result as [d4;d3;d2;d1;d0] - - movq (x), a - mulq %rsi - movq a, d0 - movq d, d1 - - movq 8(x), a - xorq d2, d2 - mulq %rsi - addq a, d1 - adcq d, d2 - - movq 16(x), a - mulq %rsi - addq a, d2 - adcq $0, d - - movq 24(x), a - movq d, d3 - mulq %rsi - xorl zeroe, zeroe - addq a, d3 - adcq zero, d4 - -// Let [d4;d3;d2;d1;d0] = 2^255 * h + l, and use q = h + 1 as the initial -// quotient estimate, which is either right or 1 too big. - - shldq $1, d3, d4 - movl $19, cshort - leaq 1(d4), a - bts $63, d3 - mulq c - addq a, d0 - adcq d, d1 - adcq zero, d2 - adcq zero, d3 - -// Correct if CF = 0 by subtracting 19, either way masking to -// 255 bits, i.e. by effectively adding p_25519 to the "full" answer - - cmovcq zero, c - subq c, d0 - sbbq zero, d1 - sbbq zero, d2 - sbbq zero, d3 - btr $63, d3 - -// Write everything back - - movq d0, (z) - movq d1, 8(z) - movq d2, 16(z) - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p25519_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_double_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_double_p25519.S deleted file mode 100644 index b4725528dfc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_double_p25519.S +++ /dev/null @@ -1,105 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo p_25519, z := (2 * x) mod p_25519, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_double_p25519(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_double_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_double_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_double_p25519) - .text - -#define z %rdi -#define x %rsi - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -// These also re-use input x when safe to do so - -#define c0 %rax -#define c1 %rcx -#define c2 %rsi -#define c3 %rdx -#define c0short %eax -#define c1short %ecx -#define c2short %esi -#define c3short %edx - -S2N_BN_SYMBOL(bignum_double_p25519): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Add as [d3; d2; d1; d0] = 2 * x; since we assume x < 2^255 - 19 -// this result fits in 256 bits. - - movq (x), d0 - addq d0, d0 - movq 8(x), d1 - adcq d1, d1 - movq 16(x), d2 - adcq d2, d2 - movq 24(x), d3 - adcq d3, d3 - -// Now 2 * x >= 2^255 - 19 <=> 2 * x + 19 >= 2^255. -// Form [c3; c2; c1; c0] = (2 * x) + 19 - - movl $19, c0short - xorl c1short, c1short - xorl c2short, c2short - xorl c3short, c3short - - addq d0, c0 - adcq d1, c1 - adcq d2, c2 - adcq d3, c3 - -// Test the top bit to see if this is >= 2^255, and clear it as a masking -// so that in that case the result is exactly (2 * x) - (2^255 - 19). -// Then select the output according to that top bit as that or just 2 * x. - - btr $63, c3 - cmovcq c0, d0 - cmovcq c1, d1 - cmovcq c2, d2 - cmovcq c3, d3 - -// Store the result - - movq d0, (z) - movq d1, 8(z) - movq d2, 16(z) - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_double_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_inv_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_inv_p25519.S deleted file mode 100644 index 23daac8500b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_inv_p25519.S +++ /dev/null @@ -1,1591 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Modular inverse modulo p_25519 = 2^255 - 19 -// Input x[4]; output z[4] -// -// extern void bignum_inv_p25519(uint64_t z[static 4],const uint64_t x[static 4]); -// -// Assuming the 4-digit input x is coprime to p_25519, i.e. is not divisible -// by it, returns z < p_25519 such that x * z == 1 (mod p_25519). The input -// x does not need to be reduced modulo p_25519, but the output always is. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_inv_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_inv_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_inv_p25519) - .text - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack - -#define f 0(%rsp) -#define g (4*N)(%rsp) -#define u (8*N)(%rsp) -#define v (12*N)(%rsp) -#define tmp (16*N)(%rsp) -#define tmp2 (17*N)(%rsp) -#define i (18*N)(%rsp) -#define d (19*N)(%rsp) - -#define mat (20*N)(%rsp) - -// Backup for the input pointer - -#define res (24*N)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 26*N - -// Syntactic variants to make x86_att version simpler to generate - -#define F 0 -#define G (4*N) -#define U (8*N) -#define V (12*N) -#define MAT (20*N) - -#define ff (%rsp) -#define gg (4*N)(%rsp) - -// Very similar to a subroutine call to the s2n-bignum word_divstep59. -// But different in register usage and returning the final matrix as -// -// [ %r8 %r10] -// [ %r12 %r14] -// -// and also returning the matrix still negated (which doesn't matter) - -#define divstep59(din,fin,gin) \ - movq din, %rsi ; \ - movq fin, %rdx ; \ - movq gin, %rcx ; \ - movq %rdx, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq $0xfffffffffffffffe, %rax ; \ - xorl %ebp, %ebp ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %rdx ; \ - leaq (%rcx,%rax), %rdi ; \ - shlq $0x16, %rdx ; \ - shlq $0x16, %rdi ; \ - sarq $0x2b, %rdx ; \ - sarq $0x2b, %rdi ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %rbx ; \ - leaq (%rcx,%rax), %rcx ; \ - sarq $0x2a, %rbx ; \ - sarq $0x2a, %rcx ; \ - movq %rdx, MAT(%rsp) ; \ - movq %rbx, MAT+0x8(%rsp) ; \ - movq %rdi, MAT+0x10(%rsp) ; \ - movq %rcx, MAT+0x18(%rsp) ; \ - movq fin, %r12 ; \ - imulq %r12, %rdi ; \ - imulq %rdx, %r12 ; \ - movq gin, %r13 ; \ - imulq %r13, %rbx ; \ - imulq %rcx, %r13 ; \ - addq %rbx, %r12 ; \ - addq %rdi, %r13 ; \ - sarq $0x14, %r12 ; \ - sarq $0x14, %r13 ; \ - movq %r12, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - movq %r13, %rcx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq $0xfffffffffffffffe, %rax ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %r8 ; \ - leaq (%rcx,%rax), %r10 ; \ - shlq $0x16, %r8 ; \ - shlq $0x16, %r10 ; \ - sarq $0x2b, %r8 ; \ - sarq $0x2b, %r10 ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %r15 ; \ - leaq (%rcx,%rax), %r11 ; \ - sarq $0x2a, %r15 ; \ - sarq $0x2a, %r11 ; \ - movq %r13, %rbx ; \ - movq %r12, %rcx ; \ - imulq %r8, %r12 ; \ - imulq %r15, %rbx ; \ - addq %rbx, %r12 ; \ - imulq %r11, %r13 ; \ - imulq %r10, %rcx ; \ - addq %rcx, %r13 ; \ - sarq $0x14, %r12 ; \ - sarq $0x14, %r13 ; \ - movq %r12, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - movq %r13, %rcx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq MAT(%rsp), %rax ; \ - imulq %r8, %rax ; \ - movq MAT+0x10(%rsp), %rdx ; \ - imulq %r15, %rdx ; \ - imulq MAT+0x8(%rsp), %r8 ; \ - imulq MAT+0x18(%rsp), %r15 ; \ - addq %r8, %r15 ; \ - leaq (%rax,%rdx), %r9 ; \ - movq MAT(%rsp), %rax ; \ - imulq %r10, %rax ; \ - movq MAT+0x10(%rsp), %rdx ; \ - imulq %r11, %rdx ; \ - imulq MAT+0x8(%rsp), %r10 ; \ - imulq MAT+0x18(%rsp), %r11 ; \ - addq %r10, %r11 ; \ - leaq (%rax,%rdx), %r13 ; \ - movq $0xfffffffffffffffe, %rax ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %r8 ; \ - leaq (%rcx,%rax), %r12 ; \ - shlq $0x15, %r8 ; \ - shlq $0x15, %r12 ; \ - sarq $0x2b, %r8 ; \ - sarq $0x2b, %r12 ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %r10 ; \ - leaq (%rcx,%rax), %r14 ; \ - sarq $0x2b, %r10 ; \ - sarq $0x2b, %r14 ; \ - movq %r9, %rax ; \ - imulq %r8, %rax ; \ - movq %r13, %rdx ; \ - imulq %r10, %rdx ; \ - imulq %r15, %r8 ; \ - imulq %r11, %r10 ; \ - addq %r8, %r10 ; \ - leaq (%rax,%rdx), %r8 ; \ - movq %r9, %rax ; \ - imulq %r12, %rax ; \ - movq %r13, %rdx ; \ - imulq %r14, %rdx ; \ - imulq %r15, %r12 ; \ - imulq %r11, %r14 ; \ - addq %r12, %r14 ; \ - leaq (%rax,%rdx), %r12 - -S2N_BN_SYMBOL(bignum_inv_p25519): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers and make room for temporaries - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Save the return pointer for the end so we can overwrite %rdi later - - movq %rdi, res - -// Copy the input and the prime into the main f and g variables. -// Make sure x is reduced so that g <= f as assumed in the bound proof. - - xorl %eax, %eax - leaq -19(%rax), %rcx - notq %rax - movq %rcx, F(%rsp) - movq %rax, F+8(%rsp) - movq %rax, F+16(%rsp) - btr $63, %rax - movq %rax, F+24(%rsp) - - movq (%rsi), %rdx - movq 0x8(%rsi), %rcx - movq 0x10(%rsi), %r8 - movq 0x18(%rsi), %r9 - movl $0x1, %eax - xorl %r10d, %r10d - bts $0x3f, %r9 - adcq %r10, %rax - imulq $19, %rax, %rax - addq %rax, %rdx - adcq %r10, %rcx - adcq %r10, %r8 - adcq %r10, %r9 - movl $0x13, %eax - cmovbq %r10, %rax - subq %rax, %rdx - sbbq %r10, %rcx - sbbq %r10, %r8 - sbbq %r10, %r9 - btr $0x3f, %r9 - movq %rdx, G(%rsp) - movq %rcx, G+0x8(%rsp) - movq %r8, G+0x10(%rsp) - movq %r9, G+0x18(%rsp) - -// Also maintain weakly reduced < 2*p_25519 vector [u,v] such that -// [f,g] == x * 2^{590-59*i} * [u,v] (mod p_25519) -// starting with [p_25519,x] == x * 2^{590-59*0} * [0,2^-590] (mod p_25519) - - xorl %eax, %eax - movq %rax, U(%rsp) - movq %rax, U+8(%rsp) - movq %rax, U+16(%rsp) - movq %rax, U+24(%rsp) - - movq $0xa0f99e2375022099, %rax - movq %rax, V(%rsp) - movq $0xa8c68f3f1d132595, %rax - movq %rax, V+8(%rsp) - movq $0x6c6c893805ac5242, %rax - movq %rax, V+16(%rsp) - movq $0x276508b241770615, %rax - movq %rax, V+24(%rsp) - -// Start of main loop. We jump into the middle so that the divstep -// portion is common to the special tenth iteration after a uniform -// first 9. - - movq $10, i - movq $1, d - jmp Lbignum_inv_p25519_midloop - -Lbignum_inv_p25519_loop: - -// Separate out the matrix into sign-magnitude pairs - - movq %r8, %r9 - sarq $63, %r9 - xorq %r9, %r8 - subq %r9, %r8 - - movq %r10, %r11 - sarq $63, %r11 - xorq %r11, %r10 - subq %r11, %r10 - - movq %r12, %r13 - sarq $63, %r13 - xorq %r13, %r12 - subq %r13, %r12 - - movq %r14, %r15 - sarq $63, %r15 - xorq %r15, %r14 - subq %r15, %r14 - -// Adjust the initial values to allow for complement instead of negation -// This initial offset is the same for [f,g] and [u,v] compositions. -// Save it in temporary storage for the [u,v] part and do [f,g] first. - - movq %r8, %rax - andq %r9, %rax - movq %r10, %rdi - andq %r11, %rdi - addq %rax, %rdi - movq %rdi, tmp - - movq %r12, %rax - andq %r13, %rax - movq %r14, %rsi - andq %r15, %rsi - addq %rax, %rsi - movq %rsi, tmp2 - -// Now the computation of the updated f and g values. This maintains a -// 2-word carry between stages so we can conveniently insert the shift -// right by 59 before storing back, and not overwrite digits we need -// again of the old f and g values. -// -// Digit 0 of [f,g] - - xorl %ebx, %ebx - movq F(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rdi - adcq %rdx, %rbx - movq G(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rdi - adcq %rdx, %rbx - - xorl %ebp, %ebp - movq F(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rbp - movq G(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - -// Digit 1 of [f,g] - - xorl %ecx, %ecx - movq F+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq G+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - shrdq $59, %rbx, %rdi - movq %rdi, F(%rsp) - - xorl %edi, %edi - movq F+N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rbp - adcq %rdx, %rdi - movq G+N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rdi - shrdq $59, %rbp, %rsi - movq %rsi, G(%rsp) - -// Digit 2 of [f,g] - - xorl %esi, %esi - movq F+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rsi - movq G+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rsi - shrdq $59, %rcx, %rbx - movq %rbx, F+N(%rsp) - - xorl %ebx, %ebx - movq F+2*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rdi - adcq %rdx, %rbx - movq G+2*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rdi - adcq %rdx, %rbx - shrdq $59, %rdi, %rbp - movq %rbp, G+N(%rsp) - -// Digits 3 and 4 of [f,g] - - movq F+3*N(%rsp), %rax - xorq %r9, %rax - movq %rax, %rbp - sarq $63, %rbp - andq %r8, %rbp - negq %rbp - mulq %r8 - addq %rax, %rsi - adcq %rdx, %rbp - movq G+3*N(%rsp), %rax - xorq %r11, %rax - movq %rax, %rdx - sarq $63, %rdx - andq %r10, %rdx - subq %rdx, %rbp - mulq %r10 - addq %rax, %rsi - adcq %rdx, %rbp - shrdq $59, %rsi, %rcx - movq %rcx, F+2*N(%rsp) - shrdq $59, %rbp, %rsi - - movq F+3*N(%rsp), %rax - movq %rsi, F+3*N(%rsp) - - xorq %r13, %rax - movq %rax, %rsi - sarq $63, %rsi - andq %r12, %rsi - negq %rsi - mulq %r12 - addq %rax, %rbx - adcq %rdx, %rsi - movq G+3*N(%rsp), %rax - xorq %r15, %rax - movq %rax, %rdx - sarq $63, %rdx - andq %r14, %rdx - subq %rdx, %rsi - mulq %r14 - addq %rax, %rbx - adcq %rdx, %rsi - shrdq $59, %rbx, %rdi - movq %rdi, G+2*N(%rsp) - shrdq $59, %rsi, %rbx - movq %rbx, G+3*N(%rsp) - -// Get the initial carries back from storage and do the [u,v] accumulation - - movq tmp, %rbx - movq tmp2, %rbp - -// Digit 0 of [u,v] - - xorl %ecx, %ecx - movq U(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq V(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - - xorl %esi, %esi - movq U(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, U(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq V(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, V(%rsp) - -// Digit 1 of [u,v] - - xorl %ebx, %ebx - movq U+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq V+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rbx - - xorl %ebp, %ebp - movq U+N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rcx, U+N(%rsp) - addq %rax, %rsi - adcq %rdx, %rbp - movq V+N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - movq %rsi, V+N(%rsp) - -// Digit 2 of [u,v] - - xorl %ecx, %ecx - movq U+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq V+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - - xorl %esi, %esi - movq U+2*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, U+2*N(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq V+2*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, V+2*N(%rsp) - -// Digits 3 and 4 of u (top is unsigned) - - movq U+3*N(%rsp), %rax - xorq %r9, %rax - movq %r9, %rbx - andq %r8, %rbx - negq %rbx - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq V+3*N(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbx - mulq %r10 - addq %rax, %rcx - adcq %rbx, %rdx - -// Modular reduction of u - - movq %rdx, %rbx - shldq $1, %rcx, %rdx - sarq $63, %rbx - addq %rbx, %rdx - movl $19, %eax - imulq %rdx - movq U(%rsp), %r8 - addq %rax, %r8 - movq %r8, U(%rsp) - movq U+N(%rsp), %r8 - adcq %rdx, %r8 - movq %r8, U+N(%rsp) - movq U+2*N(%rsp), %r8 - adcq %rbx, %r8 - movq %r8, U+2*N(%rsp) - adcq %rbx, %rcx - shlq $63, %rax - addq %rax, %rcx - -// Preload for last use of old u digit 3 - - movq U+3*N(%rsp), %rax - movq %rcx, U+3*N(%rsp) - -// Digits 3 and 4 of v (top is unsigned) - - xorq %r13, %rax - movq %r13, %rcx - andq %r12, %rcx - negq %rcx - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rcx - movq V+3*N(%rsp), %rax - xorq %r15, %rax - movq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rcx - mulq %r14 - addq %rax, %rsi - adcq %rcx, %rdx - -// Modular reduction of v - - movq %rdx, %rcx - shldq $1, %rsi, %rdx - sarq $63, %rcx - movl $19, %eax - addq %rcx, %rdx - imulq %rdx - movq V(%rsp), %r8 - addq %rax, %r8 - movq %r8, V(%rsp) - movq V+N(%rsp), %r8 - adcq %rdx, %r8 - movq %r8, V+N(%rsp) - movq V+2*N(%rsp), %r8 - adcq %rcx, %r8 - movq %r8, V+2*N(%rsp) - adcq %rcx, %rsi - shlq $63, %rax - addq %rax, %rsi - movq %rsi, V+3*N(%rsp) - -Lbignum_inv_p25519_midloop: - - divstep59(d,ff,gg) - movq %rsi, d - -// Next iteration - - decq i - jnz Lbignum_inv_p25519_loop - -// The 10th and last iteration does not need anything except the -// u value and the sign of f; the latter can be obtained from the -// lowest word of f. So it's done differently from the main loop. -// Find the sign of the new f. For this we just need one digit -// since we know (for in-scope cases) that f is either +1 or -1. -// We don't explicitly shift right by 59 either, but looking at -// bit 63 (or any bit >= 60) of the unshifted result is enough -// to distinguish -1 from +1; this is then made into a mask. - - movq F(%rsp), %rax - movq G(%rsp), %rcx - imulq %r8, %rax - imulq %r10, %rcx - addq %rcx, %rax - sarq $63, %rax - -// Now separate out the matrix into sign-magnitude pairs -// and adjust each one based on the sign of f. -// -// Note that at this point we expect |f|=1 and we got its -// sign above, so then since [f,0] == x * [u,v] (mod p_25519) -// we want to flip the sign of u according to that of f. - - movq %r8, %r9 - sarq $63, %r9 - xorq %r9, %r8 - subq %r9, %r8 - xorq %rax, %r9 - - movq %r10, %r11 - sarq $63, %r11 - xorq %r11, %r10 - subq %r11, %r10 - xorq %rax, %r11 - - movq %r12, %r13 - sarq $63, %r13 - xorq %r13, %r12 - subq %r13, %r12 - xorq %rax, %r13 - - movq %r14, %r15 - sarq $63, %r15 - xorq %r15, %r14 - subq %r15, %r14 - xorq %rax, %r15 - -// Adjust the initial value to allow for complement instead of negation - - movq %r8, %rax - andq %r9, %rax - movq %r10, %r12 - andq %r11, %r12 - addq %rax, %r12 - -// Digit 0 of [u] - - xorl %r13d, %r13d - movq U(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r12 - adcq %rdx, %r13 - movq V(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r12 - adcq %rdx, %r13 - -// Digit 1 of [u] - - xorl %r14d, %r14d - movq U+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r13 - adcq %rdx, %r14 - movq V+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r13 - adcq %rdx, %r14 - -// Digit 2 of [u] - - xorl %r15d, %r15d - movq U+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r14 - adcq %rdx, %r15 - movq V+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r14 - adcq %rdx, %r15 - -// Digits 3 and 4 of u (top is unsigned) - - movq U+3*N(%rsp), %rax - xorq %r9, %rax - andq %r8, %r9 - negq %r9 - mulq %r8 - addq %rax, %r15 - adcq %rdx, %r9 - movq V+3*N(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %r9 - mulq %r10 - addq %rax, %r15 - adcq %rdx, %r9 - -// Modular reduction of u, this time strictly 2^255-19. - - movq %r9, %rax - shldq $1, %r15, %rax - sarq $63, %r9 - movl $19, %ebx - leaq 1(%rax,%r9,1), %rax - imulq %rbx - xorl %ebp, %ebp - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r9, %r14 - adcq %r9, %r15 - shlq $63, %rax - addq %rax, %r15 - cmovns %rbp, %rbx - subq %rbx, %r12 - sbbq %rbp, %r13 - sbbq %rbp, %r14 - sbbq %rbp, %r15 - btr $0x3f, %r15 - -// Store it back to the final output - - movq res, %rdi - movq %r12, (%rdi) - movq %r13, N(%rdi) - movq %r14, 2*N(%rdi) - movq %r15, 3*N(%rdi) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_inv_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_invsqrt_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_invsqrt_p25519.S deleted file mode 100644 index 253a6e579b8..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_invsqrt_p25519.S +++ /dev/null @@ -1,620 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Inverse square root modulo p_25519 = 2^255 - 19 -// Input x[4]; output function return (Legendre symbol) and z[4] -// -// extern int64_t bignum_invsqrt_p25519(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Given a 4-digit input x, returns a modular inverse square root mod p_25519, -// i.e. a z such that x * z^2 == 1 (mod p_25519), whenever one exists. The -// inverse square root z is chosen so that its LSB is even (note that p_25519-z -// is another possibility). The function return is the Legendre/Jacobi symbol -// (x//p_25519), which indicates whether indeed x has a modular inverse square -// root and hence whether the result is meaningful: -// -// 0: x is divisible by p_25519 so trivially there is no inverse square root -// +1: x is coprime to p_25519 and z is indeed an inverse square root -// -1: x is coprime to p_25519 but there is no (inverse or direct) square root -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_invsqrt_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_invsqrt_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_invsqrt_p25519) - - - .text - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack - -#define a 0(%rsp) -#define b (4*N)(%rsp) -#define s (8*N)(%rsp) -#define t (12*N)(%rsp) -#define u (16*N)(%rsp) -#define res (20*N)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 22*N - -// Corrupted versions when stack is down 8 more - -#define u8 (17*N)(%rsp) - -// Syntactic variants to make x86_att version simpler to generate - -#define A 0 -#define B (4*N) -#define S (8*N) -#define T (12*N) -#define U (16*N) -#define U8 (17*N) - -S2N_BN_SYMBOL(bignum_invsqrt_p25519): - CFI_START - _CET_ENDBR - -// In this case the Windows form literally makes a subroutine call. -// This avoids hassle arising from subroutine offsets - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - CFI_CALL(Lbignum_invsqrt_p25519_standard) - CFI_POP(%rsi) - CFI_POP(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_invsqrt_p25519) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_invsqrt_p25519_standard) - -Lbignum_invsqrt_p25519_standard: - CFI_START -#endif - -// Save registers and make room for temporaries - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Save the return pointer for the end so we can overwrite %rdi later - - movq %rdi, res - -// Set up reduced version of the input argument a = x mod p_25519. Then -// get the candidate inverse square root s = a^{252-3} - - movq (%rsi), %rdx - movq 0x8(%rsi), %rcx - movq 0x10(%rsi), %r8 - movq 0x18(%rsi), %r9 - movl $0x1, %eax - xorl %r10d, %r10d - bts $0x3f, %r9 - adcq %r10, %rax - imulq $0x13, %rax, %rax - addq %rax, %rdx - adcq %r10, %rcx - adcq %r10, %r8 - adcq %r10, %r9 - movl $0x13, %eax - cmovbq %r10, %rax - subq %rax, %rdx - sbbq %r10, %rcx - sbbq %r10, %r8 - sbbq %r10, %r9 - btr $0x3f, %r9 - movq %rdx, A(%rsp) - movq %rcx, A+0x8(%rsp) - movq %r8, A+0x10(%rsp) - movq %r9, A+0x18(%rsp) - - // Power 2^2 - 1 = 3 - - leaq T(%rsp), %rdi - movq $1, %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq T(%rsp), %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - - // Power 2^4 - 1 = 15 - - leaq S(%rsp), %rdi - movq $2, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - - // Power 2^5 - 1 = 31 - - leaq S(%rsp), %rdi - movq $1, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - - // Power 2^10 - 1 - - leaq S(%rsp), %rdi - movq $5, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - - // Power 2^20 - 1 - - leaq S(%rsp), %rdi - movq $10, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - - // Power 2^25 - 1 - - leaq S(%rsp), %rdi - movq $5, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - - // Power 2^50 - 1 - - leaq S(%rsp), %rdi - movq $25, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - - // Power 2^100 - 1 - - leaq S(%rsp), %rdi - movq $50, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - - // Power 2^125 - 1 - - leaq S(%rsp), %rdi - movq $25, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - - // Power 2^250 - 1 - - leaq S(%rsp), %rdi - movq $125, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - - // Power 2^252 - 3 - - leaq S(%rsp), %rdi - movq $2, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq S(%rsp), %rdi - leaq S(%rsp), %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - -// s = a^{2^252-3} is now one candidate inverse square root. -// Generate the other one t = s * j_25519 where j_25519 = sqrt(-1) - - movq $0xc4ee1b274a0ea0b0, %rax - movq %rax, T(%rsp) - movq $0x2f431806ad2fe478, %rax - movq %rax, T+8(%rsp) - movq $0x2b4d00993dfbd7a7, %rax - movq %rax, T+16(%rsp) - movq $0x2b8324804fc1df0b, %rax - movq %rax, T+24(%rsp) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - -// Now multiplex between them according to whether a * s^2 = 1 - - leaq B(%rsp), %rdi - movq $1, %rsi - leaq S(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq A(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - - movq B(%rsp), %rax - xorq $1, %rax - movq B+8(%rsp), %rbx - orq %rbx, %rax - movq B+16(%rsp), %rcx - movq B+24(%rsp), %rdx - orq %rdx, %rcx - orq %rcx, %rax - - movq S(%rsp), %rax - movq T(%rsp), %rbx - cmovnzq %rbx, %rax - movq S+8(%rsp), %rbx - movq T+8(%rsp), %rcx - cmovnzq %rcx, %rbx - movq S+16(%rsp), %rcx - movq T+16(%rsp), %rdx - cmovnzq %rdx, %rcx - movq S+24(%rsp), %rbp - movq T+24(%rsp), %rdx - cmovnzq %rdx, %rbp - -// For definiteness, choose "positive" (LSB=0) inverse square root - - xorl %edx, %edx - leaq -19(%rdx), %r8 - leaq -1(%rdx), %r11 - movq %r11, %r9 - movq %r11, %r10 - btr $63, %r11 - - subq %rax, %r8 - sbbq %rbx, %r9 - sbbq %rcx, %r10 - sbbq %rbp, %r11 - - movq res, %rdx - testq $1, %rax - cmovnzq %r8, %rax - movq %rax, (%rdx) - cmovnzq %r9, %rbx - movq %rbx, 8(%rdx) - cmovnzq %r10, %rcx - movq %rcx, 16(%rdx) - cmovnzq %r11, %rbp - movq %rbp, 24(%rdx) - -// Determine if it is is indeed an inverse square root, also distinguishing -// the degenerate x * z^2 == 0 (mod p_25519) case, which is equivalent to -// x == 0 (mod p_25519). Hence return the Legendre-Jacobi symbol as required. - - leaq B(%rsp), %rdi - movq $1, %rsi - CFI_CALL(Lbignum_invsqrt_p25519_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq A(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_mul_p25519) - - movq $1, %rax - movq B(%rsp), %rbp - xorq %rbp, %rax - movq B+8(%rsp), %rbx - orq %rbx, %rax - orq %rbx, %rbp - movq B+16(%rsp), %rcx - movq B+24(%rsp), %rdx - orq %rdx, %rcx - orq %rcx, %rax - orq %rcx, %rbp - - negq %rax - sbbq %rax, %rax - leaq 1(%rax,%rax,1), %rax - - testq %rbp, %rbp - cmovzq %rbp, %rax - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -#if WINDOWS_ABI -S2N_BN_SIZE_DIRECTIVE(Lbignum_invsqrt_p25519_standard) -#else -S2N_BN_SIZE_DIRECTIVE(bignum_invsqrt_p25519) -#endif - -// ************************************************************* -// Local z = x * y -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_invsqrt_p25519_mul_p25519) - -Lbignum_invsqrt_p25519_mul_p25519: - CFI_START - movq %rdx, %rcx - xorl %ebp, %ebp - movq (%rcx), %rdx - mulxq (%rsi), %r8, %r9 - mulxq 0x8(%rsi), %rax, %r10 - addq %rax, %r9 - mulxq 0x10(%rsi), %rax, %r11 - adcq %rax, %r10 - mulxq 0x18(%rsi), %rax, %r12 - adcq %rax, %r11 - adcq %rbp, %r12 - xorl %ebp, %ebp - movq 0x8(%rcx), %rdx - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsi), %rax, %r13 - adcxq %rax, %r12 - adoxq %rbp, %r13 - adcq %rbp, %r13 - xorl %ebp, %ebp - movq 0x10(%rcx), %rdx - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x18(%rsi), %rax, %r14 - adcxq %rax, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - xorl %ebp, %ebp - movq 0x18(%rcx), %rdx - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsi), %rcx, %r15 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - movl $0x26, %edx - mulxq %r15, %rax, %rbx - adcxq %rcx, %r14 - adoxq %rbp, %r15 - adcq %rbp, %r15 - addq %r11, %rax - adcq %rbp, %rbx - btq $0x3f, %rax - adcq %rbx, %rbx - leaq 0x1(%rbx), %rcx - imulq $0x13, %rcx, %rcx - xorl %ebp, %ebp - adoxq %rcx, %r8 - mulxq %r12, %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq %r13, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r14, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq %r15, %rax, %rbx - adcq %rax, %r11 - shlq $0x3f, %rcx - cmpq %rcx, %r11 - movl $0x13, %eax - cmovns %rbp, %rax - subq %rax, %r8 - sbbq %rbp, %r9 - sbbq %rbp, %r10 - sbbq %rbp, %r11 - btr $0x3f, %r11 - movq %r8, (%rdi) - movq %r9, 0x8(%rdi) - movq %r10, 0x10(%rdi) - movq %r11, 0x18(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_invsqrt_p25519_mul_p25519) - -// ************************************************************* -// Local z = 2^n * x -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_invsqrt_p25519_nsqr_p25519) - -Lbignum_invsqrt_p25519_nsqr_p25519: - CFI_START - -// Copy input argument into u - - movq (%rdx), %rax - movq 8(%rdx), %rbx - movq 16(%rdx), %rcx - movq 24(%rdx), %rdx - movq %rax, U8(%rsp) - movq %rbx, U8+8(%rsp) - movq %rcx, U8+16(%rsp) - movq %rdx, U8+24(%rsp) - -// Main squaring loop, accumulating in u consistently and -// only ensuring the intermediates are < 2 * p_25519 = 2^256 - 38 - -Lbignum_invsqrt_p25519_loop: - movq U8(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq U8+0x8(%rsp), %r9, %r10 - mulxq U8+0x18(%rsp), %r11, %r12 - movq U8+0x10(%rsp), %rdx - mulxq U8+0x18(%rsp), %r13, %r14 - xorl %ebx, %ebx - mulxq U8(%rsp), %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - mulxq U8+0x8(%rsp), %rax, %rcx - adcxq %rax, %r11 - adoxq %rcx, %r12 - movq U8+0x18(%rsp), %rdx - mulxq U8+0x8(%rsp), %rax, %rcx - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rbx, %r13 - adoxq %rbx, %r14 - adcq %rbx, %r14 - xorl %ebx, %ebx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq U8+0x8(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq U8+0x10(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq U8+0x18(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rbx, %r15 - adoxq %rbx, %r15 - movl $0x26, %edx - xorl %ebx, %ebx - mulxq %r12, %rax, %rcx - adcxq %rax, %r8 - adoxq %rcx, %r9 - mulxq %r13, %rax, %rcx - adcxq %rax, %r9 - adoxq %rcx, %r10 - mulxq %r14, %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - mulxq %r15, %rax, %r12 - adcxq %rax, %r11 - adoxq %rbx, %r12 - adcxq %rbx, %r12 - shldq $0x1, %r11, %r12 - btr $0x3f, %r11 - movl $0x13, %edx - imulq %r12, %rdx - addq %rdx, %r8 - adcq %rbx, %r9 - adcq %rbx, %r10 - adcq %rbx, %r11 - movq %r8, U8(%rsp) - movq %r9, U8+0x8(%rsp) - movq %r10, U8+0x10(%rsp) - movq %r11, U8+0x18(%rsp) - -// Loop as applicable - - decq %rsi - jnz Lbignum_invsqrt_p25519_loop - -// We know the intermediate result x < 2^256 - 38, and now we do strict -// modular reduction mod 2^255 - 19. Note x < 2^255 - 19 <=> x + 19 < 2^255 -// which is equivalent to a "ns" condition. We just use the results where -// they were in registers [%r11;%r10;%r9;%r8] instead of re-loading them. - - movl $19, %eax - xorl %ebx, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - - cmovns %r8, %rax - cmovns %r9, %rbx - cmovns %r10, %rcx - cmovns %r11, %rdx - btr $63, %rdx - movq %rax, (%rdi) - movq %rbx, 8(%rdi) - movq %rcx, 16(%rdi) - movq %rdx, 24(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_invsqrt_p25519_nsqr_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_invsqrt_p25519_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_invsqrt_p25519_alt.S deleted file mode 100644 index 22b0eabc81e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_invsqrt_p25519_alt.S +++ /dev/null @@ -1,701 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Inverse square root modulo p_25519 = 2^255 - 19 -// Input x[4]; output function return (Legendre symbol) and z[4] -// -// extern int64_t bignum_invsqrt_p25519_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Given a 4-digit input x, returns a modular inverse square root mod p_25519, -// i.e. a z such that x * z^2 == 1 (mod p_25519), whenever one exists. The -// inverse square root z is chosen so that its LSB is even (note that p_25519-z -// is another possibility). The function return is the Legendre/Jacobi symbol -// (x//p_25519), which indicates whether indeed x has a modular inverse square -// root and hence whether the result is meaningful: -// -// 0: x is divisible by p_25519 so trivially there is no inverse square root -// +1: x is coprime to p_25519 and z is indeed an inverse square root -// -1: x is coprime to p_25519 but there is no (inverse or direct) square root -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_invsqrt_p25519_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_invsqrt_p25519_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_invsqrt_p25519_alt) - - - .text - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack - -#define a 0(%rsp) -#define b (4*N)(%rsp) -#define s (8*N)(%rsp) -#define t (12*N)(%rsp) -#define u (16*N)(%rsp) -#define res (20*N)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 22*N - -// Corrupted versions when stack is down 8 more - -#define u8 (17*N)(%rsp) - -// Syntactic variants to make x86_att version simpler to generate - -#define A 0 -#define B (4*N) -#define S (8*N) -#define T (12*N) -#define U (16*N) -#define U8 (17*N) - -S2N_BN_SYMBOL(bignum_invsqrt_p25519_alt): - CFI_START - _CET_ENDBR - -// In this case the Windows form literally makes a subroutine call. -// This avoids hassle arising from subroutine offsets - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - CFI_CALL(Lbignum_invsqrt_p25519_alt_standard) - CFI_POP(%rsi) - CFI_POP(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_invsqrt_p25519_alt) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_invsqrt_p25519_alt_standard) - -Lbignum_invsqrt_p25519_alt_standard: - CFI_START -#endif - -// Save registers and make room for temporaries - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Save the return pointer for the end so we can overwrite %rdi later - - movq %rdi, res - -// Set up reduced version of the input argument a = x mod p_25519. Then -// get the candidate inverse square root s = a^{252-3} - - movq (%rsi), %rdx - movq 0x8(%rsi), %rcx - movq 0x10(%rsi), %r8 - movq 0x18(%rsi), %r9 - movl $0x1, %eax - xorl %r10d, %r10d - bts $0x3f, %r9 - adcq %r10, %rax - imulq $0x13, %rax, %rax - addq %rax, %rdx - adcq %r10, %rcx - adcq %r10, %r8 - adcq %r10, %r9 - movl $0x13, %eax - cmovbq %r10, %rax - subq %rax, %rdx - sbbq %r10, %rcx - sbbq %r10, %r8 - sbbq %r10, %r9 - btr $0x3f, %r9 - movq %rdx, A(%rsp) - movq %rcx, A+0x8(%rsp) - movq %r8, A+0x10(%rsp) - movq %r9, A+0x18(%rsp) - - // Power 2^2 - 1 = 3 - - leaq T(%rsp), %rdi - movq $1, %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq T(%rsp), %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - - // Power 2^4 - 1 = 15 - - leaq S(%rsp), %rdi - movq $2, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - - // Power 2^5 - 1 = 31 - - leaq S(%rsp), %rdi - movq $1, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - - // Power 2^10 - 1 - - leaq S(%rsp), %rdi - movq $5, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - - // Power 2^20 - 1 - - leaq S(%rsp), %rdi - movq $10, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - - // Power 2^25 - 1 - - leaq S(%rsp), %rdi - movq $5, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - - // Power 2^50 - 1 - - leaq S(%rsp), %rdi - movq $25, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - - // Power 2^100 - 1 - - leaq S(%rsp), %rdi - movq $50, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - - // Power 2^125 - 1 - - leaq S(%rsp), %rdi - movq $25, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - - // Power 2^250 - 1 - - leaq S(%rsp), %rdi - movq $125, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - - // Power 2^252 - 3 - - leaq S(%rsp), %rdi - movq $2, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq S(%rsp), %rdi - leaq S(%rsp), %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - -// s = a^{2^252-3} is now one candidate inverse square root. -// Generate the other one t = s * j_25519 where j_25519 = sqrt(-1) - - movq $0xc4ee1b274a0ea0b0, %rax - movq %rax, T(%rsp) - movq $0x2f431806ad2fe478, %rax - movq %rax, T+8(%rsp) - movq $0x2b4d00993dfbd7a7, %rax - movq %rax, T+16(%rsp) - movq $0x2b8324804fc1df0b, %rax - movq %rax, T+24(%rsp) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - -// Now multiplex between them according to whether a * s^2 = 1 - - leaq B(%rsp), %rdi - movq $1, %rsi - leaq S(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq A(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - - movq B(%rsp), %rax - xorq $1, %rax - movq B+8(%rsp), %rbx - orq %rbx, %rax - movq B+16(%rsp), %rcx - movq B+24(%rsp), %rdx - orq %rdx, %rcx - orq %rcx, %rax - - movq S(%rsp), %rax - movq T(%rsp), %rbx - cmovnzq %rbx, %rax - movq S+8(%rsp), %rbx - movq T+8(%rsp), %rcx - cmovnzq %rcx, %rbx - movq S+16(%rsp), %rcx - movq T+16(%rsp), %rdx - cmovnzq %rdx, %rcx - movq S+24(%rsp), %rbp - movq T+24(%rsp), %rdx - cmovnzq %rdx, %rbp - -// For definiteness, choose "positive" (LSB=0) inverse square root - - xorl %edx, %edx - leaq -19(%rdx), %r8 - leaq -1(%rdx), %r11 - movq %r11, %r9 - movq %r11, %r10 - btr $63, %r11 - - subq %rax, %r8 - sbbq %rbx, %r9 - sbbq %rcx, %r10 - sbbq %rbp, %r11 - - movq res, %rdx - testq $1, %rax - cmovnzq %r8, %rax - movq %rax, (%rdx) - cmovnzq %r9, %rbx - movq %rbx, 8(%rdx) - cmovnzq %r10, %rcx - movq %rcx, 16(%rdx) - cmovnzq %r11, %rbp - movq %rbp, 24(%rdx) - -// Determine if it is is indeed an inverse square root, also distinguishing -// the degenerate x * z^2 == 0 (mod p_25519) case, which is equivalent to -// x == 0 (mod p_25519). Hence return the Legendre-Jacobi symbol as required. - - leaq B(%rsp), %rdi - movq $1, %rsi - CFI_CALL(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq A(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_invsqrt_p25519_alt_mul_p25519) - - movq $1, %rax - movq B(%rsp), %rbp - xorq %rbp, %rax - movq B+8(%rsp), %rbx - orq %rbx, %rax - orq %rbx, %rbp - movq B+16(%rsp), %rcx - movq B+24(%rsp), %rdx - orq %rdx, %rcx - orq %rcx, %rax - orq %rcx, %rbp - - negq %rax - sbbq %rax, %rax - leaq 1(%rax,%rax,1), %rax - - testq %rbp, %rbp - cmovzq %rbp, %rax - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -#if WINDOWS_ABI -S2N_BN_SIZE_DIRECTIVE(Lbignum_invsqrt_p25519_alt_standard) -#else -S2N_BN_SIZE_DIRECTIVE(bignum_invsqrt_p25519_alt) -#endif - -// ************************************************************* -// Local z = x * y -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_invsqrt_p25519_alt_mul_p25519) - -Lbignum_invsqrt_p25519_alt_mul_p25519: - CFI_START - movq %rdx, %rcx - movq (%rsi), %rax - mulq (%rcx) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq (%rsi), %rax - mulq 0x8(%rcx) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x8(%rsi), %rax - mulq (%rcx) - addq %rax, %r9 - adcq %rdx, %r10 - adcq $0x0, %r11 - xorq %r12, %r12 - movq (%rsi), %rax - mulq 0x10(%rcx) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0x8(%rsi), %rax - mulq 0x8(%rcx) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0x10(%rsi), %rax - mulq (%rcx) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq (%rsi), %rax - mulq 0x18(%rcx) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0x8(%rsi), %rax - mulq 0x10(%rcx) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x10(%rsi), %rax - mulq 0x8(%rcx) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x18(%rsi), %rax - mulq (%rcx) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0x8(%rsi), %rax - mulq 0x18(%rcx) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rsi), %rax - mulq 0x10(%rcx) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0x18(%rsi), %rax - mulq 0x8(%rcx) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0x10(%rsi), %rax - mulq 0x18(%rcx) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rsi), %rax - mulq 0x10(%rcx) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0x18(%rsi), %rax - mulq 0x18(%rcx) - addq %rax, %r14 - adcq %rdx, %r15 - movl $0x26, %esi - movq %r12, %rax - mulq %rsi - addq %rax, %r8 - adcq %rdx, %r9 - sbbq %rcx, %rcx - movq %r13, %rax - mulq %rsi - subq %rcx, %rdx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r14, %rax - mulq %rsi - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq %r15, %rax - mulq %rsi - subq %rcx, %rdx - xorq %rcx, %rcx - addq %rax, %r11 - movq %rdx, %r12 - adcq %rcx, %r12 - shldq $0x1, %r11, %r12 - leaq 0x1(%r12), %rax - movl $0x13, %esi - bts $0x3f, %r11 - imulq %rsi, %rax - addq %rax, %r8 - adcq %rcx, %r9 - adcq %rcx, %r10 - adcq %rcx, %r11 - sbbq %rax, %rax - notq %rax - andq %rsi, %rax - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rcx, %r10 - sbbq %rcx, %r11 - btr $0x3f, %r11 - movq %r8, (%rdi) - movq %r9, 0x8(%rdi) - movq %r10, 0x10(%rdi) - movq %r11, 0x18(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_invsqrt_p25519_alt_mul_p25519) - -// ************************************************************* -// Local z = 2^n * x -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - -Lbignum_invsqrt_p25519_alt_nsqr_p25519: - CFI_START - -// Copy input argument into u - - movq (%rdx), %rax - movq 8(%rdx), %rbx - movq 16(%rdx), %rcx - movq 24(%rdx), %rdx - movq %rax, U8(%rsp) - movq %rbx, U8+8(%rsp) - movq %rcx, U8+16(%rsp) - movq %rdx, U8+24(%rsp) - -// Main squaring loop, accumulating in u consistently and -// only ensuring the intermediates are < 2 * p_25519 = 2^256 - 38 - -Lbignum_invsqrt_p25519_alt_loop: - movq U8(%rsp), %rax - mulq %rax - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq U8(%rsp), %rax - mulq U8+0x8(%rsp) - addq %rax, %rax - adcq %rdx, %rdx - adcq $0x0, %r11 - addq %rax, %r9 - adcq %rdx, %r10 - adcq $0x0, %r11 - xorq %r12, %r12 - movq U8+0x8(%rsp), %rax - mulq %rax - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq U8(%rsp), %rax - mulq U8+0x10(%rsp) - addq %rax, %rax - adcq %rdx, %rdx - adcq $0x0, %r12 - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq U8(%rsp), %rax - mulq U8+0x18(%rsp) - addq %rax, %rax - adcq %rdx, %rdx - adcq $0x0, %r13 - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq U8+0x8(%rsp), %rax - mulq U8+0x10(%rsp) - addq %rax, %rax - adcq %rdx, %rdx - adcq $0x0, %r13 - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq U8+0x8(%rsp), %rax - mulq U8+0x18(%rsp) - addq %rax, %rax - adcq %rdx, %rdx - adcq $0x0, %r14 - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq U8+0x10(%rsp), %rax - mulq %rax - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq U8+0x10(%rsp), %rax - mulq U8+0x18(%rsp) - addq %rax, %rax - adcq %rdx, %rdx - adcq $0x0, %r15 - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq U8+0x18(%rsp), %rax - mulq %rax - addq %rax, %r14 - adcq %rdx, %r15 - movl $0x26, %ebx - movq %r12, %rax - mulq %rbx - addq %rax, %r8 - adcq %rdx, %r9 - sbbq %rcx, %rcx - movq %r13, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r14, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq %r15, %rax - mulq %rbx - subq %rcx, %rdx - xorq %rcx, %rcx - addq %rax, %r11 - movq %rdx, %r12 - adcq %rcx, %r12 - shldq $0x1, %r11, %r12 - btr $0x3f, %r11 - movl $0x13, %edx - imulq %r12, %rdx - addq %rdx, %r8 - adcq %rcx, %r9 - adcq %rcx, %r10 - adcq %rcx, %r11 - movq %r8, U8(%rsp) - movq %r9, U8+0x8(%rsp) - movq %r10, U8+0x10(%rsp) - movq %r11, U8+0x18(%rsp) - -// Loop as applicable - - decq %rsi - jnz Lbignum_invsqrt_p25519_alt_loop - -// We know the intermediate result x < 2^256 - 38, and now we do strict -// modular reduction mod 2^255 - 19. Note x < 2^255 - 19 <=> x + 19 < 2^255 -// which is equivalent to a "ns" condition. We just use the results where -// they were in registers [%r11;%r10;%r9;%r8] instead of re-loading them. - - movl $19, %eax - xorl %ebx, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - - cmovns %r8, %rax - cmovns %r9, %rbx - cmovns %r10, %rcx - cmovns %r11, %rdx - btr $63, %rdx - movq %rax, (%rdi) - movq %rbx, 8(%rdi) - movq %rcx, 16(%rdi) - movq %rdx, 24(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_invsqrt_p25519_alt_nsqr_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_m25519_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_m25519_4.S deleted file mode 100644 index c9fee69908d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_m25519_4.S +++ /dev/null @@ -1,100 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod m_25519 -// Input x[4]; output z[4] -// -// extern void bignum_mod_m25519_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Reduction is modulo the group order of curve25519/edwards25519. -// This is the full group order, 8 * the standard basepoint order. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_m25519_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_m25519_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_m25519_4) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n0 %rax -#define n1 %r10 -#define n3 %r11 - -// Can re-use this as a temporary once we've loaded the input - -#define c %rsi - -S2N_BN_SYMBOL(bignum_mod_m25519_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load a set of registers [n3; 0; n1; n0] = m_25519 - - movq $0xc09318d2e7ae9f68, n0 - movq $0xa6f7cef517bce6b2, n1 - movq $0x8000000000000000, n3 - -// Load the input and compute x - m_25519 - - movq (x), d0 - subq n0, d0 - movq 8(x), d1 - sbbq n1, d1 - movq 16(x), d2 - sbbq $0, d2 - movq 24(x), d3 - sbbq n3, d3 - -// Now CF is set iff x < m_25519. Create a mask for that condition and mask -// the three nontrivial digits ready to undo the previous subtraction with -// a compensating addition - - sbbq c, c - andq c, n0 - andq c, n1 - andq c, n3 - -// Now add mask * m_25519 again and store - - addq n0, d0 - movq d0, (z) - adcq n1, d1 - movq d1, 8(z) - adcq $0, d2 - movq d2, 16(z) - adcq n3, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_m25519_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_n25519.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_n25519.S index 1ede9a81060..bca07627639 100644 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_n25519.S +++ b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_n25519.S @@ -187,6 +187,24 @@ Lbignum_mod_n25519_loop: decq k jnz Lbignum_mod_n25519_loop + jmp Lbignum_mod_n25519_writeback + +Lbignum_mod_n25519_shortinput: + + xorq m0, m0 + xorq m1, m1 + xorq m2, m2 + xorq m3, m3 + + testq k, k + jz Lbignum_mod_n25519_writeback + movq (%rdx), m0 + decq k + jz Lbignum_mod_n25519_writeback + movq 8(%rdx), m1 + decq k + jz Lbignum_mod_n25519_writeback + movq 16(%rdx), m2 // Write back @@ -210,24 +228,6 @@ Lbignum_mod_n25519_writeback: S2N_BN_SIZE_DIRECTIVE(bignum_mod_n25519) -Lbignum_mod_n25519_shortinput: - - xorq m0, m0 - xorq m1, m1 - xorq m2, m2 - xorq m3, m3 - - testq k, k - jz Lbignum_mod_n25519_writeback - movq (%rdx), m0 - decq k - jz Lbignum_mod_n25519_writeback - movq 8(%rdx), m1 - decq k - jz Lbignum_mod_n25519_writeback - movq 16(%rdx), m2 - jmp Lbignum_mod_n25519_writeback - #if defined(__linux__) && defined(__ELF__) .section .note.GNU-stack,"",%progbits #endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_n25519_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_n25519_4.S deleted file mode 100644 index 1da461804ca..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_n25519_4.S +++ /dev/null @@ -1,113 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo basepoint order, z := x mod n_25519 -// Input x[4]; output z[4] -// -// extern void bignum_mod_n25519_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Reduction is modulo the order of the curve25519/edwards25519 basepoint. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n25519_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n25519_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n25519_4) - .text - -#define z %rdi -#define x %rsi - -#define q %rcx - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -S2N_BN_SYMBOL(bignum_mod_n25519_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the top digit first, get the quotient estimate q = floor(x/2^252) -// and delete it from that digit, in effect doing x' = x - q * 2^252. -// Now we only need x' - q * n_25519' where n_25519' = n_25519 - 2^252 - - movq 24(x), q - movq q, d3 - shrq $60, q - shlq $4, d3 - shrq $4, d3 - -// Compute [%rdx;d2;d1] = q * n_25519' - - movq $0x5812631a5cf5d3ed, %rax - mulq q - movq %rax, d1 - movq %rdx, d2 - - movq $0x14def9dea2f79cd6, %rax - mulq q - addq %rax, d2 - adcq $0, %rdx - -// Subtract to get [d3;d2;d1;d0] = x - q * n_25519 - - movq (x), d0 - subq d1, d0 - movq 8(x), d1 - sbbq d2, d1 - movq 16(x), d2 - sbbq %rdx, d2 - sbbq $0, d3 - -// Get a bitmask q for the borrow and create masked version of -// non-trivial digits of [%rcx;0;%rdx;%rax] = n_25519. Note that -// %rcx = q but we can get it from the corresponding bit of %rax. - - sbbq q, q - - movq $0x5812631a5cf5d3ed, %rax - andq q, %rax - movq $0x14def9dea2f79cd6, %rdx - andq q, %rdx - movq $0x1000000000000000, %rcx - andq %rax, %rcx - -// Do compensating addition (iff subtraction borrowed) and store - - addq %rax, d0 - movq d0, (z) - adcq %rdx, d1 - movq d1, 8(z) - adcq $0, d2 - movq d2, 16(z) - adcq %rcx, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) - -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n25519_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_p25519_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_p25519_4.S deleted file mode 100644 index ae858555e80..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mod_p25519_4.S +++ /dev/null @@ -1,101 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_25519 -// Input x[4]; output z[4] -// -// extern void bignum_mod_p25519_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p25519_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p25519_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p25519_4) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 -#define c %r10 - -#define q %rax - -#define qshort %eax -#define cshort %r10d - -S2N_BN_SYMBOL(bignum_mod_p25519_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the inputs as [d3;d2;d1;d0] - - movq (x), d0 - movq 8(x), d1 - movq 16(x), d2 - movq 24(x), d3 - -// Letting x = 2^255 * h + l where h is the top bit, the provisional quotient -// is q = h + 1, which is either correct or 1 too high. - - movl $1, qshort - xorl cshort, cshort - bts $63, d3 - adcq c, q - imulq $19, q - -// Writing the provisional remainder as r = x - (2^255 - 19) * q we -// compute r' = (2^255 + l) + 19 * q = r + 2^256 - - addq q, d0 - adcq c, d1 - adcq c, d2 - adcq c, d3 - -// Now r < 0 <=> r' < 2^256 <=> ~CF and in this case we correct by adding -// 2^255 - 19, or in fact subtracting 19 and masking to 255 bits. - - movl $19, qshort - cmovcq c, q - - subq q, d0 - sbbq c, d1 - sbbq c, d2 - sbbq c, d3 - btr $63, d3 - -// Store the end result - - movq d0, (z) - movq d1, 8(z) - movq d2, 16(z) - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p25519_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mul_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mul_p25519.S deleted file mode 100644 index c2136cf319b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mul_p25519.S +++ /dev/null @@ -1,206 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply modulo p_25519, z := (x * y) mod p_25519 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_mul_p25519(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_p25519) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// Copied in or set up - -#define y %rcx - -// A zero register - -#define zero %rbp -#define zeroe %ebp - -// mulpadd(high,low,m) adds %rdx * m to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rbx as temporaries. - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rbx ; \ - adcxq %rax, low ; \ - adoxq %rbx, high - -// mulpade(high,low,m) adds %rdx * m to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax as a temporary, assuming high created from scratch -// and that zero has value zero. - -#define mulpade(high,low,m) \ - mulxq m, %rax, high ; \ - adcxq %rax, low ; \ - adoxq zero, high - -S2N_BN_SYMBOL(bignum_mul_p25519): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Zero a register, which also makes sure we don't get a fake carry-in - - xorl zeroe, zeroe - -// Do the zeroth row, which is a bit different - - movq (y), %rdx - - mulxq (x), %r8, %r9 - mulxq 8(x), %rax, %r10 - addq %rax, %r9 - mulxq 16(x), %rax, %r11 - adcq %rax, %r10 - mulxq 24(x), %rax, %r12 - adcq %rax, %r11 - adcq zero, %r12 - -// Add row 1 - - xorl zeroe, zeroe - movq 8(y), %rdx - mulpadd(%r10,%r9,(x)) - mulpadd(%r11,%r10,8(x)) - mulpadd(%r12,%r11,16(x)) - mulpade(%r13,%r12,24(x)) - adcq zero, %r13 - -// Add row 2 - - xorl zeroe, zeroe - movq 16(y), %rdx - mulpadd(%r11,%r10,(x)) - mulpadd(%r12,%r11,8(x)) - mulpadd(%r13,%r12,16(x)) - mulpade(%r14,%r13,24(x)); - adcq zero, %r14 - -// Add row 3; also use an early 38*r15+r11 to get a quotient estimate q -// and then squeeze in a 19 * q computation to inject into the next -// double-carry chain. At the end %rcx = q and %rax = 19 * q. - - xorl zeroe, zeroe - movq 24(y), %rdx - - mulpadd(%r12,%r11,(x)) - - mulxq 24(x), %rcx, %r15 - - mulpadd(%r13,%r12,8(x)) - mulpadd(%r14,%r13,16(x)) - - movl $38, %edx - mulxq %r15, %rax, %rbx - - adcxq %rcx, %r14 - adoxq zero, %r15 - adcq zero, %r15 - - addq %r11, %rax - adcq zero, %rbx - btq $63, %rax - adcq %rbx, %rbx - leaq 1(%rbx), %rcx - imulq $19, %rcx - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [%r15,%r14,%r13,%r12] and l = [%r11,%r10,%r9,%r8] -// and this is == 38 * h + l (mod p_25519) -// We add in the precalculated 19 * q as well. -// This is kept in 4 words since we have enough information there. - - xorl zeroe, zeroe - adoxq %rcx, %r8 - mulpadd(%r9,%r8,%r12) - mulpadd(%r10,%r9,%r13) - mulpadd(%r11,%r10,%r14) - mulxq %r15, %rax, %rbx - adcq %rax, %r11 - -// We still haven't made the -2^255 * q contribution yet. Since we -// are now safely in 4 words we just need a single bit of q, and we -// can actually use the LSB of %rcx = 19 * q since 19 is odd. And we -// don't literally need to subtract, just to see whether we would -// have a top 1 bit if we did, meaning we need to correct in the -// last step by adding 2^255 - 19. - - shlq $63, %rcx - cmpq %rcx, %r11 - movl $19, %eax - cmovns zero, %rax - -// Now make that possible correction and finally mask to 255 bits - - subq %rax, %r8 - sbbq zero, %r9 - sbbq zero, %r10 - sbbq zero, %r11 - btr $63, %r11 - -// Write everything back - - movq %r8, (z) - movq %r9, 8(z) - movq %r10, 16(z) - movq %r11, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mul_p25519_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mul_p25519_alt.S deleted file mode 100644 index d3e8dc578ff..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_mul_p25519_alt.S +++ /dev/null @@ -1,222 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply modulo p_25519, z := (x * y) mod p_25519 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_mul_p25519_alt(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_p25519_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_p25519_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_p25519_alt) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// Copied in or set up - -#define y %rcx - -// Re-use input pointers later for constant and top carry - -#define d %rsi -#define c %rcx - -#define dshort %esi - -// Macro for the key "multiply and add to (c,h,l)" step - -#define combadd(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A minutely shorter form for when c = 0 initially - -#define combadz(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq c, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h - -S2N_BN_SYMBOL(bignum_mul_p25519_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Start the window as [%r10;%r9;%r8] with 00 product - - movq (x), %rax - mulq (y) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - -// Column 1 - - xorq %r11, %r11 - combads(%r10,%r9,(x),8(y)) - combadd(%r11,%r10,%r9,8(x),(y)) - -// Column 2 - - xorq %r12, %r12 - combadz(%r12,%r11,%r10,(x),16(y)) - combadd(%r12,%r11,%r10,8(x),8(y)) - combadd(%r12,%r11,%r10,16(x),(y)) - -// Column 3 - - xorq %r13, %r13 - combadz(%r13,%r12,%r11,(x),24(y)) - combadd(%r13,%r12,%r11,8(x),16(y)) - combadd(%r13,%r12,%r11,16(x),8(y)) - combadd(%r13,%r12,%r11,24(x),(y)) - -// Column 4 - - xorq %r14, %r14 - combadz(%r14,%r13,%r12,8(x),24(y)) - combadd(%r14,%r13,%r12,16(x),16(y)) - combadd(%r14,%r13,%r12,24(x),8(y)) - -// Column 5 - - xorq %r15, %r15 - combadz(%r15,%r14,%r13,16(x),24(y)) - combadd(%r15,%r14,%r13,24(x),16(y)) - -// Final work for columns 6 and 7 - - movq 24(x), %rax - mulq 24(y) - addq %rax, %r14 - adcq %rdx, %r15 - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [%r15,%r14,%r13,%r12] and l = [%r11,%r10,%r9,%r8] -// and this is == 38 * h + l (mod p_25519) - - movl $38, dshort - - movq %r12, %rax - mulq d - addq %rax, %r8 - adcq %rdx, %r9 - sbbq c, c - - movq %r13, %rax - mulq d - subq c, %rdx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq c, c - - movq %r14, %rax - mulq d - subq c, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq c, c - - movq %r15, %rax - mulq d - subq c, %rdx - xorq c, c - addq %rax, %r11 - movq %rdx, %r12 - adcq c, %r12 - -// Now we have reduced to 5 digits, 2^255 * h + l = [%r12,%r11,%r10,%r9,%r8] -// Use q = h + 1 as the initial quotient estimate, either right or 1 too big. - - shldq $1, %r11, %r12 - leaq 1(%r12), %rax - movl $19, dshort - bts $63, %r11 - imulq d, %rax - addq %rax, %r8 - adcq c, %r9 - adcq c, %r10 - adcq c, %r11 - -// Now the effective answer is 2^256 * (CF - 1) + [u3,u2,u1,u0] -// So we correct if CF = 0 by subtracting 19, either way masking to -// 255 bits, i.e. by effectively adding p_25519 to the "full" answer - - sbbq %rax, %rax - notq %rax - andq d, %rax - subq %rax, %r8 - sbbq c, %r9 - sbbq c, %r10 - sbbq c, %r11 - btr $63, %r11 - -// Write everything back - - movq %r8, (z) - movq %r9, 8(z) - movq %r10, 16(z) - movq %r11, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_p25519_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_optneg_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_optneg_p25519.S deleted file mode 100644 index e0d41b7923c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_optneg_p25519.S +++ /dev/null @@ -1,102 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo p_25519, z := (-x) mod p_25519 (if p nonzero) or -// z := x (if p zero), assuming x reduced -// Inputs p, x[4]; output z[4] -// -// extern void bignum_optneg_p25519(uint64_t z[static 4], uint64_t p, -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = p, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = p, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg_p25519) - .text - -#define z %rdi -#define q %rsi -#define x %rdx - -#define n0 %rax -#define n1 %rcx -#define n2 %r8 -#define n3 %r9 - -S2N_BN_SYMBOL(bignum_optneg_p25519): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Adjust q by zeroing it if the input is zero (to avoid giving -0 = p_25519, -// which is not strictly reduced even though it's correct modulo p_25519). - - movq (x), n0 - orq 8(x), n0 - movq 16(x), n1 - orq 24(x), n1 - orq n1, n0 - negq n0 - sbbq n0, n0 - andq n0, q - -// Turn q into a bitmask, all 1s for q=false, all 0s for q=true - - negq q - sbbq q, q - notq q - -// Let [n3;n2;n1;n0] = if q then p_25519 else -1 - - movq $0xffffffffffffffed, n0 - orq q, n0 - movq $0xffffffffffffffff, n1 - movq n1, n2 - movq $0x7fffffffffffffff, n3 - orq q, n3 - -// Subtract so [n3;n2;n1;n0] = if q then p_25519 - x else -1 - x - - subq (x), n0 - sbbq 8(x), n1 - sbbq 16(x), n2 - sbbq 24(x), n3 - -// XOR the words with the bitmask, which in the case q = false has the -// effect of restoring ~(-1 - x) = -(-1 - x) - 1 = 1 + x - 1 = x -// and write back the digits to the output - - xorq q, n0 - movq n0, (z) - xorq q, n1 - movq n1, 8(z) - xorq q, n2 - movq n2, 16(z) - xorq q, n3 - movq n3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqr_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqr_p25519.S deleted file mode 100644 index f6b530afe03..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqr_p25519.S +++ /dev/null @@ -1,189 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square modulo p_25519, z := (x^2) mod p_25519 -// Input x[4]; output z[4] -// -// extern void bignum_sqr_p25519(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_p25519) - .text - -#define z %rdi -#define x %rsi - -// Use this fairly consistently for a zero - -#define zero %rbx -#define zeroe %ebx - -// Add %rdx * m into a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rcx as temporaries - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rcx ; \ - adcxq %rax, low ; \ - adoxq %rcx, high - -// mulpade(high,low,m) adds %rdx * m to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax as a temporary, assuming high created from scratch -// and that zero has value zero. - -#define mulpade(high,low,m) \ - mulxq m, %rax, high ; \ - adcxq %rax, low ; \ - adoxq zero, high - -S2N_BN_SYMBOL(bignum_sqr_p25519): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Compute [%r15;%r8] = [00] which we use later, but mainly -// set up an initial window [%r14;...;%r9] = [23;03;01] - - movq (x), %rdx - mulxq %rdx, %r8, %r15 - mulxq 8(x), %r9, %r10 - mulxq 24(x), %r11, %r12 - movq 16(x), %rdx - mulxq 24(x), %r13, %r14 - -// Clear our zero register, and also initialize the flags for the carry chain - - xorl zeroe, zeroe - -// Chain in the addition of 02 + 12 + 13 to that window (no carry-out possible) -// This gives all the "heterogeneous" terms of the squaring ready to double - - mulpadd(%r11,%r10,(x)) - mulpadd(%r12,%r11,8(x)) - movq 24(x), %rdx - mulpadd(%r13,%r12,8(x)) - adcxq zero, %r13 - adoxq zero, %r14 - adcq zero, %r14 - -// Double and add to the 00 + 11 + 22 + 33 terms, while also -// pre-estimating the quotient from early results. - - xorl zeroe, zeroe - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 8(x), %rdx - mulxq %rdx, %rax, %rcx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rcx, %r11 - movq 16(x), %rdx - mulxq %rdx, %rax, %rcx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rcx, %r13 - movq 24(x), %rdx - mulxq %rdx, %rax, %r15 - - movl $38, %edx - mulxq %r15, %rdx, %rcx - - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq zero, %r15 - adoxq zero, %r15 - - addq %r11, %rdx - adcq zero, %rcx - shldq $1, %rdx, %rcx - leaq 1(%rcx), %rbx - imulq $19, %rbx - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [%r15,%r14,%r13,%r12] and l = [%r11,%r10,%r9,%r8] -// and this is == 38 * h + l (mod p_25519) -// We add in the precalculated 19 * q as well. -// This is kept in 4 words since we have enough information there. - - xorl %eax, %eax - adoxq %rbx, %r8 - movl $38, %edx - mulpadd(%r9,%r8,%r12) - mulpadd(%r10,%r9,%r13) - mulpadd(%r11,%r10,%r14) - mulxq %r15, %rax, %rcx - adcq %rax, %r11 - -// We still haven't made the -2^255 * q contribution yet. Since we -// are now safely in 4 words we just need a single bit of q, and we -// can actually use the LSB of %rcx = 19 * q since 19 is odd. And we -// don't literally need to subtract, just to see whether we would -// have a top 1 bit if we did, meaning we need to correct in the -// last step by adding 2^255 - 19. - - xorl %ecx, %ecx - shlq $63, %rbx - cmpq %rbx, %r11 - movl $19, %eax - cmovns %rcx, %rax - -// Now make that possible correction and finally mask to 255 bits - - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rcx, %r10 - sbbq %rcx, %r11 - btr $63, %r11 - -// Write everything back - - movq %r8, (z) - movq %r9, 8(z) - movq %r10, 16(z) - movq %r11, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqr_p25519_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqr_p25519_alt.S deleted file mode 100644 index 582c72e4f8f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqr_p25519_alt.S +++ /dev/null @@ -1,205 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square modulo p_25519, z := (x^2) mod p_25519 -// Input x[4]; output z[4] -// -// extern void bignum_sqr_p25519_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_p25519_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_p25519_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_p25519_alt) - .text - -#define z %rdi -#define x %rsi - -// Re-use input pointer later for constant - -#define d %rsi -#define c %rcx - -#define dshort %esi - -// Macro for the key "multiply and add to (c,h,l)" step, for square term - -#define combadd1(c,h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h - -// A version doubling before adding, for non-square terms - -#define combadd2(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0, c ; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -S2N_BN_SYMBOL(bignum_sqr_p25519_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Result term 0 - - movq (x), %rax - mulq %rax - - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - -// Result term 1 - - xorq %r11, %r11 - combadd2(%r11,%r10,%r9,(x),8(x)) - -// Result term 2 - - xorq %r12, %r12 - combadd1(%r12,%r11,%r10,8(x)) - combadd2(%r12,%r11,%r10,(x),16(x)) - -// Result term 3 - - xorq %r13, %r13 - combadd2(%r13,%r12,%r11,(x),24(x)) - combadd2(%r13,%r12,%r11,8(x),16(x)) - -// Result term 4 - - xorq %r14, %r14 - combadd2(%r14,%r13,%r12,8(x),24(x)) - combadd1(%r14,%r13,%r12,16(x)) - -// Result term 5 - - xorq %r15, %r15 - combadd2(%r15,%r14,%r13,16(x),24(x)) - -// Result term 6 - - combads(%r15,%r14,24(x)) - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [%r15,%r14,%r13,%r12] and l = [%r11,%r10,%r9,%r8] -// and this is == 38 * h + l (mod p_25519) - - movl $38, dshort - - movq %r12, %rax - mulq d - addq %rax, %r8 - adcq %rdx, %r9 - sbbq c, c - - movq %r13, %rax - mulq d - subq c, %rdx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq c, c - - movq %r14, %rax - mulq d - subq c, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq c, c - - movq %r15, %rax - mulq d - subq c, %rdx - xorq c, c - addq %rax, %r11 - movq %rdx, %r12 - adcq c, %r12 - -// Now we have reduced to 5 digits, 2^255 * h + l = [%r12,%r11,%r10,%r9,%r8] -// Use q = h + 1 as the initial quotient estimate, either right or 1 too big. - - shldq $1, %r11, %r12 - leaq 1(%r12), %rax - movl $19, dshort - bts $63, %r11 - imulq d, %rax - addq %rax, %r8 - adcq c, %r9 - adcq c, %r10 - adcq c, %r11 - -// Now the effective answer is 2^256 * (CF - 1) + [u3,u2,u1,u0] -// So we correct if CF = 0 by subtracting 19, either way masking to -// 255 bits, i.e. by effectively adding p_25519 to the "full" answer - - sbbq %rax, %rax - notq %rax - andq d, %rax - subq %rax, %r8 - sbbq c, %r9 - sbbq c, %r10 - sbbq c, %r11 - btr $63, %r11 - -// Write everything back - - movq %r8, (z) - movq %r9, 8(z) - movq %r10, 16(z) - movq %r11, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_p25519_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqrt_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqrt_p25519.S deleted file mode 100644 index 820ff08423b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqrt_p25519.S +++ /dev/null @@ -1,621 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square root modulo p_25519 = 2^255 - 19 -// Input x[4]; output function return (Legendre symbol) and z[4] -// -// extern int64_t bignum_sqrt_p25519(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Given a 4-digit input x, returns a modular square root mod p_25519, i.e. -// a z such that z^2 == x (mod p_25519), whenever one exists. The square -// root z is chosen so that its LSB is even (note that p_25519 - z is -// another square root). The function return is the Legendre/Jacobi symbol -// (x//p_25519), which indicates whether indeed x has a modular square root -// and hence whether the result is meaningful: -// -// 0: x is divisible by p_25519 and z is the square root 0 -// +1: x is coprime to p_25519 and z is a square root -// -1: x is coprime to p_25519 but not a quadratic residue -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqrt_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqrt_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqrt_p25519) - - - .text - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack - -#define a 0(%rsp) -#define b (4*N)(%rsp) -#define s (8*N)(%rsp) -#define t (12*N)(%rsp) -#define u (16*N)(%rsp) -#define res (20*N)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 22*N - -// Corrupted versions when stack is down 8 more - -#define u8 (17*N)(%rsp) - -// Syntactic variants to make x86_att version simpler to generate - -#define A 0 -#define B (4*N) -#define S (8*N) -#define T (12*N) -#define U (16*N) -#define U8 (17*N) - -S2N_BN_SYMBOL(bignum_sqrt_p25519): - CFI_START - _CET_ENDBR - -// In this case the Windows form literally makes a subroutine call. -// This avoids hassle arising from subroutine offsets - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - CFI_CALL(Lbignum_sqrt_p25519_standard) - CFI_POP(%rsi) - CFI_POP(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqrt_p25519) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_sqrt_p25519_standard) - -Lbignum_sqrt_p25519_standard: - CFI_START -#endif - -// Save registers and make room for temporaries - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Save the return pointer for the end so we can overwrite %rdi later - - movq %rdi, res - -// Set up reduced version of the input argument a = x mod p_25519. Then -// get the candidate square root s = a^{252-2} - - movq (%rsi), %rdx - movq 0x8(%rsi), %rcx - movq 0x10(%rsi), %r8 - movq 0x18(%rsi), %r9 - movl $0x1, %eax - xorl %r10d, %r10d - bts $0x3f, %r9 - adcq %r10, %rax - imulq $0x13, %rax, %rax - addq %rax, %rdx - adcq %r10, %rcx - adcq %r10, %r8 - adcq %r10, %r9 - movl $0x13, %eax - cmovbq %r10, %rax - subq %rax, %rdx - sbbq %r10, %rcx - sbbq %r10, %r8 - sbbq %r10, %r9 - btr $0x3f, %r9 - movq %rdx, A(%rsp) - movq %rcx, A+0x8(%rsp) - movq %r8, A+0x10(%rsp) - movq %r9, A+0x18(%rsp) - - // Power 2^2 - 1 = 3 - - leaq T(%rsp), %rdi - movq $1, %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq T(%rsp), %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_mul_p25519) - - // Power 2^4 - 1 = 15 - - leaq S(%rsp), %rdi - movq $2, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_mul_p25519) - - // Power 2^5 - 1 = 31 - - leaq S(%rsp), %rdi - movq $1, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_mul_p25519) - - // Power 2^10 - 1 - - leaq S(%rsp), %rdi - movq $5, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_mul_p25519) - - // Power 2^20 - 1 - - leaq S(%rsp), %rdi - movq $10, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_mul_p25519) - - // Power 2^25 - 1 - - leaq S(%rsp), %rdi - movq $5, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_mul_p25519) - - // Power 2^50 - 1 - - leaq S(%rsp), %rdi - movq $25, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_mul_p25519) - - // Power 2^100 - 1 - - leaq S(%rsp), %rdi - movq $50, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_mul_p25519) - - // Power 2^125 - 1 - - leaq S(%rsp), %rdi - movq $25, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_mul_p25519) - - // Power 2^250 - 1 - - leaq S(%rsp), %rdi - movq $125, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_mul_p25519) - - // Power 2^251 - 1 - - leaq S(%rsp), %rdi - movq $1, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_mul_p25519) - - // Power 2^252 - 2 - - leaq S(%rsp), %rdi - movq $1, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - -// s is now one candidate square root. Generate the other one t = s * j_25519 - - movq $0xc4ee1b274a0ea0b0, %rax - movq %rax, T(%rsp) - movq $0x2f431806ad2fe478, %rax - movq %rax, T+8(%rsp) - movq $0x2b4d00993dfbd7a7, %rax - movq %rax, T+16(%rsp) - movq $0x2b8324804fc1df0b, %rax - movq %rax, T+24(%rsp) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_mul_p25519) - -// Now multiplex between them according to whether s^2 = a - - leaq B(%rsp), %rdi - movq $1, %rsi - leaq S(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - movq A(%rsp), %rax - xorq B(%rsp), %rax - movq A+8(%rsp), %rbx - xorq B+8(%rsp), %rbx - orq %rbx, %rax - movq A+16(%rsp), %rcx - xorq B+16(%rsp), %rcx - movq A+24(%rsp), %rdx - xorq B+24(%rsp), %rdx - orq %rdx, %rcx - orq %rcx, %rax - - movq S(%rsp), %rax - movq T(%rsp), %rbx - cmovnzq %rbx, %rax - movq S+8(%rsp), %rbx - movq T+8(%rsp), %rcx - cmovnzq %rcx, %rbx - movq S+16(%rsp), %rcx - movq T+16(%rsp), %rdx - cmovnzq %rdx, %rcx - movq S+24(%rsp), %rbp - movq T+24(%rsp), %rdx - cmovnzq %rdx, %rbp - -// For definiteness, choose "positive" (LSB=0) square root - - xorl %edx, %edx - leaq -19(%rdx), %r8 - leaq -1(%rdx), %r11 - movq %r11, %r9 - movq %r11, %r10 - btr $63, %r11 - - subq %rax, %r8 - sbbq %rbx, %r9 - sbbq %rcx, %r10 - sbbq %rbp, %r11 - - movq res, %rdx - testq $1, %rax - cmovnzq %r8, %rax - movq %rax, (%rdx) - cmovnzq %r9, %rbx - movq %rbx, 8(%rdx) - cmovnzq %r10, %rcx - movq %rcx, 16(%rdx) - cmovnzq %r11, %rbp - movq %rbp, 24(%rdx) - -// Determine if it is is indeed a square root and also if a = 0 -// Hence return the Legendre-Jacobi symbol as required. - - leaq B(%rsp), %rdi - movq $1, %rsi - CFI_CALL(Lbignum_sqrt_p25519_nsqr_p25519) - - movq A(%rsp), %rax - movq %rax, %rbp - xorq B(%rsp), %rax - movq A+8(%rsp), %rbx - orq %rbx, %rbp - xorq B+8(%rsp), %rbx - orq %rbx, %rax - movq A+16(%rsp), %rcx - orq %rcx, %rbp - xorq B+16(%rsp), %rcx - movq A+24(%rsp), %rdx - orq %rdx, %rbp - xorq B+24(%rsp), %rdx - orq %rdx, %rcx - orq %rcx, %rax - negq %rax - sbbq %rax, %rax - leaq 1(%rax,%rax,1), %rax - - testq %rbp, %rbp - cmovzq %rbp, %rax - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -#if WINDOWS_ABI -S2N_BN_SIZE_DIRECTIVE(Lbignum_sqrt_p25519_standard) -#else -S2N_BN_SIZE_DIRECTIVE(bignum_sqrt_p25519) -#endif - -// ************************************************************* -// Local z = x * y -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_sqrt_p25519_mul_p25519) - -Lbignum_sqrt_p25519_mul_p25519: - CFI_START - movq %rdx, %rcx - xorl %ebp, %ebp - movq (%rcx), %rdx - mulxq (%rsi), %r8, %r9 - mulxq 0x8(%rsi), %rax, %r10 - addq %rax, %r9 - mulxq 0x10(%rsi), %rax, %r11 - adcq %rax, %r10 - mulxq 0x18(%rsi), %rax, %r12 - adcq %rax, %r11 - adcq %rbp, %r12 - xorl %ebp, %ebp - movq 0x8(%rcx), %rdx - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsi), %rax, %r13 - adcxq %rax, %r12 - adoxq %rbp, %r13 - adcq %rbp, %r13 - xorl %ebp, %ebp - movq 0x10(%rcx), %rdx - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x18(%rsi), %rax, %r14 - adcxq %rax, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - xorl %ebp, %ebp - movq 0x18(%rcx), %rdx - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsi), %rcx, %r15 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - movl $0x26, %edx - mulxq %r15, %rax, %rbx - adcxq %rcx, %r14 - adoxq %rbp, %r15 - adcq %rbp, %r15 - addq %r11, %rax - adcq %rbp, %rbx - btq $0x3f, %rax - adcq %rbx, %rbx - leaq 0x1(%rbx), %rcx - imulq $0x13, %rcx, %rcx - xorl %ebp, %ebp - adoxq %rcx, %r8 - mulxq %r12, %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq %r13, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r14, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq %r15, %rax, %rbx - adcq %rax, %r11 - shlq $0x3f, %rcx - cmpq %rcx, %r11 - movl $0x13, %eax - cmovns %rbp, %rax - subq %rax, %r8 - sbbq %rbp, %r9 - sbbq %rbp, %r10 - sbbq %rbp, %r11 - btr $0x3f, %r11 - movq %r8, (%rdi) - movq %r9, 0x8(%rdi) - movq %r10, 0x10(%rdi) - movq %r11, 0x18(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_sqrt_p25519_mul_p25519) - -// ************************************************************* -// Local z = 2^n * x -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_sqrt_p25519_nsqr_p25519) - -Lbignum_sqrt_p25519_nsqr_p25519: - CFI_START - -// Copy input argument into u - - movq (%rdx), %rax - movq 8(%rdx), %rbx - movq 16(%rdx), %rcx - movq 24(%rdx), %rdx - movq %rax, U8(%rsp) - movq %rbx, U8+8(%rsp) - movq %rcx, U8+16(%rsp) - movq %rdx, U8+24(%rsp) - -// Main squaring loop, accumulating in u consistently and -// only ensuring the intermediates are < 2 * p_25519 = 2^256 - 38 - -Lbignum_sqrt_p25519_loop: - movq U8(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq U8+0x8(%rsp), %r9, %r10 - mulxq U8+0x18(%rsp), %r11, %r12 - movq U8+0x10(%rsp), %rdx - mulxq U8+0x18(%rsp), %r13, %r14 - xorl %ebx, %ebx - mulxq U8(%rsp), %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - mulxq U8+0x8(%rsp), %rax, %rcx - adcxq %rax, %r11 - adoxq %rcx, %r12 - movq U8+0x18(%rsp), %rdx - mulxq U8+0x8(%rsp), %rax, %rcx - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rbx, %r13 - adoxq %rbx, %r14 - adcq %rbx, %r14 - xorl %ebx, %ebx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq U8+0x8(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq U8+0x10(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq U8+0x18(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rbx, %r15 - adoxq %rbx, %r15 - movl $0x26, %edx - xorl %ebx, %ebx - mulxq %r12, %rax, %rcx - adcxq %rax, %r8 - adoxq %rcx, %r9 - mulxq %r13, %rax, %rcx - adcxq %rax, %r9 - adoxq %rcx, %r10 - mulxq %r14, %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - mulxq %r15, %rax, %r12 - adcxq %rax, %r11 - adoxq %rbx, %r12 - adcxq %rbx, %r12 - shldq $0x1, %r11, %r12 - btr $0x3f, %r11 - movl $0x13, %edx - imulq %r12, %rdx - addq %rdx, %r8 - adcq %rbx, %r9 - adcq %rbx, %r10 - adcq %rbx, %r11 - movq %r8, U8(%rsp) - movq %r9, U8+0x8(%rsp) - movq %r10, U8+0x10(%rsp) - movq %r11, U8+0x18(%rsp) - -// Loop as applicable - - decq %rsi - jnz Lbignum_sqrt_p25519_loop - -// We know the intermediate result x < 2^256 - 38, and now we do strict -// modular reduction mod 2^255 - 19. Note x < 2^255 - 19 <=> x + 19 < 2^255 -// which is equivalent to a "ns" condition. We just use the results where -// they were in registers [%r11;%r10;%r9;%r8] instead of re-loading them. - - movl $19, %eax - xorl %ebx, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - - cmovns %r8, %rax - cmovns %r9, %rbx - cmovns %r10, %rcx - cmovns %r11, %rdx - btr $63, %rdx - movq %rax, (%rdi) - movq %rbx, 8(%rdi) - movq %rcx, 16(%rdi) - movq %rdx, 24(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_sqrt_p25519_nsqr_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqrt_p25519_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqrt_p25519_alt.S deleted file mode 100644 index 2b245d71588..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sqrt_p25519_alt.S +++ /dev/null @@ -1,701 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square root modulo p_25519 = 2^255 - 19 -// Input x[4]; output function return (Legendre symbol) and z[4] -// -// extern int64_t bignum_sqrt_p25519_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Given a 4-digit input x, returns a modular square root mod p_25519, i.e. -// a z such that z^2 == x (mod p_25519), whenever one exists. The square -// root z is chosen so that its LSB is even (note that p_25519 - z is -// another square root). The function return is the Legendre/Jacobi symbol -// (x//p_25519), which indicates whether indeed x has a modular square root -// and hence whether the result is meaningful: -// -// 0: x is divisible by p_25519 and z is the square root 0 -// +1: x is coprime to p_25519 and z is a square root -// -1: x is coprime to p_25519 but not a quadratic residue -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqrt_p25519_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqrt_p25519_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqrt_p25519_alt) - - .text - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack - -#define a 0(%rsp) -#define b (4*N)(%rsp) -#define s (8*N)(%rsp) -#define t (12*N)(%rsp) -#define u (16*N)(%rsp) -#define res (20*N)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 22*N - -// Corrupted versions when stack is down 8 more - -#define u8 (17*N)(%rsp) - -// Syntactic variants to make x86_att version simpler to generate - -#define A 0 -#define B (4*N) -#define S (8*N) -#define T (12*N) -#define U (16*N) -#define U8 (17*N) - -S2N_BN_SYMBOL(bignum_sqrt_p25519_alt): - CFI_START - _CET_ENDBR - -// In this case the Windows form literally makes a subroutine call. -// This avoids hassle arising from subroutine offsets - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - CFI_CALL(Lbignum_sqrt_p25519_alt_standard) - CFI_POP(%rsi) - CFI_POP(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqrt_p25519_alt) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_sqrt_p25519_alt_standard) - -Lbignum_sqrt_p25519_alt_standard: - CFI_START -#endif - -// Save registers and make room for temporaries - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Save the return pointer for the end so we can overwrite %rdi later - - movq %rdi, res - -// Set up reduced version of the input argument a = x mod p_25519. Then -// get the candidate square root s = a^{252-2} - - movq (%rsi), %rdx - movq 0x8(%rsi), %rcx - movq 0x10(%rsi), %r8 - movq 0x18(%rsi), %r9 - movl $0x1, %eax - xorl %r10d, %r10d - bts $0x3f, %r9 - adcq %r10, %rax - imulq $0x13, %rax, %rax - addq %rax, %rdx - adcq %r10, %rcx - adcq %r10, %r8 - adcq %r10, %r9 - movl $0x13, %eax - cmovbq %r10, %rax - subq %rax, %rdx - sbbq %r10, %rcx - sbbq %r10, %r8 - sbbq %r10, %r9 - btr $0x3f, %r9 - movq %rdx, A(%rsp) - movq %rcx, A+0x8(%rsp) - movq %r8, A+0x10(%rsp) - movq %r9, A+0x18(%rsp) - - // Power 2^2 - 1 = 3 - - leaq T(%rsp), %rdi - movq $1, %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq T(%rsp), %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_mul_p25519) - - // Power 2^4 - 1 = 15 - - leaq S(%rsp), %rdi - movq $2, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_mul_p25519) - - // Power 2^5 - 1 = 31 - - leaq S(%rsp), %rdi - movq $1, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_mul_p25519) - - // Power 2^10 - 1 - - leaq S(%rsp), %rdi - movq $5, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_mul_p25519) - - // Power 2^20 - 1 - - leaq S(%rsp), %rdi - movq $10, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_mul_p25519) - - // Power 2^25 - 1 - - leaq S(%rsp), %rdi - movq $5, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_mul_p25519) - - // Power 2^50 - 1 - - leaq S(%rsp), %rdi - movq $25, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_mul_p25519) - - // Power 2^100 - 1 - - leaq S(%rsp), %rdi - movq $50, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_mul_p25519) - - // Power 2^125 - 1 - - leaq S(%rsp), %rdi - movq $25, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_mul_p25519) - - // Power 2^250 - 1 - - leaq S(%rsp), %rdi - movq $125, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - leaq B(%rsp), %rdi - leaq S(%rsp), %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_mul_p25519) - - // Power 2^251 - 1 - - leaq S(%rsp), %rdi - movq $1, %rsi - leaq B(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq A(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_mul_p25519) - - // Power 2^252 - 2 - - leaq S(%rsp), %rdi - movq $1, %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - -// s is now one candidate square root. Generate the other one t = s * j_25519 - - movq $0xc4ee1b274a0ea0b0, %rax - movq %rax, T(%rsp) - movq $0x2f431806ad2fe478, %rax - movq %rax, T+8(%rsp) - movq $0x2b4d00993dfbd7a7, %rax - movq %rax, T+16(%rsp) - movq $0x2b8324804fc1df0b, %rax - movq %rax, T+24(%rsp) - - leaq T(%rsp), %rdi - leaq S(%rsp), %rsi - leaq T(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_mul_p25519) - -// Now multiplex between them according to whether s^2 = a - - leaq B(%rsp), %rdi - movq $1, %rsi - leaq S(%rsp), %rdx - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - movq A(%rsp), %rax - xorq B(%rsp), %rax - movq A+8(%rsp), %rbx - xorq B+8(%rsp), %rbx - orq %rbx, %rax - movq A+16(%rsp), %rcx - xorq B+16(%rsp), %rcx - movq A+24(%rsp), %rdx - xorq B+24(%rsp), %rdx - orq %rdx, %rcx - orq %rcx, %rax - - movq S(%rsp), %rax - movq T(%rsp), %rbx - cmovnzq %rbx, %rax - movq S+8(%rsp), %rbx - movq T+8(%rsp), %rcx - cmovnzq %rcx, %rbx - movq S+16(%rsp), %rcx - movq T+16(%rsp), %rdx - cmovnzq %rdx, %rcx - movq S+24(%rsp), %rbp - movq T+24(%rsp), %rdx - cmovnzq %rdx, %rbp - -// For definiteness, choose "positive" (LSB=0) square root - - xorl %edx, %edx - leaq -19(%rdx), %r8 - leaq -1(%rdx), %r11 - movq %r11, %r9 - movq %r11, %r10 - btr $63, %r11 - - subq %rax, %r8 - sbbq %rbx, %r9 - sbbq %rcx, %r10 - sbbq %rbp, %r11 - - movq res, %rdx - testq $1, %rax - cmovnzq %r8, %rax - movq %rax, (%rdx) - cmovnzq %r9, %rbx - movq %rbx, 8(%rdx) - cmovnzq %r10, %rcx - movq %rcx, 16(%rdx) - cmovnzq %r11, %rbp - movq %rbp, 24(%rdx) - -// Determine if it is is indeed a square root and also if a = 0 -// Hence return the Legendre-Jacobi symbol as required. - - leaq B(%rsp), %rdi - movq $1, %rsi - CFI_CALL(Lbignum_sqrt_p25519_alt_nsqr_p25519) - - movq A(%rsp), %rax - movq %rax, %rbp - xorq B(%rsp), %rax - movq A+8(%rsp), %rbx - orq %rbx, %rbp - xorq B+8(%rsp), %rbx - orq %rbx, %rax - movq A+16(%rsp), %rcx - orq %rcx, %rbp - xorq B+16(%rsp), %rcx - movq A+24(%rsp), %rdx - orq %rdx, %rbp - xorq B+24(%rsp), %rdx - orq %rdx, %rcx - orq %rcx, %rax - negq %rax - sbbq %rax, %rax - leaq 1(%rax,%rax,1), %rax - - testq %rbp, %rbp - cmovzq %rbp, %rax - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -#if WINDOWS_ABI -S2N_BN_SIZE_DIRECTIVE(Lbignum_sqrt_p25519_alt_standard) -#else -S2N_BN_SIZE_DIRECTIVE(bignum_sqrt_p25519_alt) -#endif - -// ************************************************************* -// Local z = x * y -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_sqrt_p25519_alt_mul_p25519) - -Lbignum_sqrt_p25519_alt_mul_p25519: - CFI_START - movq %rdx, %rcx - movq (%rsi), %rax - mulq (%rcx) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq (%rsi), %rax - mulq 0x8(%rcx) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x8(%rsi), %rax - mulq (%rcx) - addq %rax, %r9 - adcq %rdx, %r10 - adcq $0x0, %r11 - xorq %r12, %r12 - movq (%rsi), %rax - mulq 0x10(%rcx) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0x8(%rsi), %rax - mulq 0x8(%rcx) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0x10(%rsi), %rax - mulq (%rcx) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq (%rsi), %rax - mulq 0x18(%rcx) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0x8(%rsi), %rax - mulq 0x10(%rcx) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x10(%rsi), %rax - mulq 0x8(%rcx) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x18(%rsi), %rax - mulq (%rcx) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0x8(%rsi), %rax - mulq 0x18(%rcx) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rsi), %rax - mulq 0x10(%rcx) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0x18(%rsi), %rax - mulq 0x8(%rcx) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0x10(%rsi), %rax - mulq 0x18(%rcx) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rsi), %rax - mulq 0x10(%rcx) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0x18(%rsi), %rax - mulq 0x18(%rcx) - addq %rax, %r14 - adcq %rdx, %r15 - movl $0x26, %esi - movq %r12, %rax - mulq %rsi - addq %rax, %r8 - adcq %rdx, %r9 - sbbq %rcx, %rcx - movq %r13, %rax - mulq %rsi - subq %rcx, %rdx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r14, %rax - mulq %rsi - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq %r15, %rax - mulq %rsi - subq %rcx, %rdx - xorq %rcx, %rcx - addq %rax, %r11 - movq %rdx, %r12 - adcq %rcx, %r12 - shldq $0x1, %r11, %r12 - leaq 0x1(%r12), %rax - movl $0x13, %esi - bts $0x3f, %r11 - imulq %rsi, %rax - addq %rax, %r8 - adcq %rcx, %r9 - adcq %rcx, %r10 - adcq %rcx, %r11 - sbbq %rax, %rax - notq %rax - andq %rsi, %rax - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rcx, %r10 - sbbq %rcx, %r11 - btr $0x3f, %r11 - movq %r8, (%rdi) - movq %r9, 0x8(%rdi) - movq %r10, 0x10(%rdi) - movq %r11, 0x18(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_sqrt_p25519_alt_mul_p25519) - -// ************************************************************* -// Local z = 2^n * x -// ************************************************************* - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_sqrt_p25519_alt_nsqr_p25519) - -Lbignum_sqrt_p25519_alt_nsqr_p25519: - CFI_START - -// Copy input argument into u - - movq (%rdx), %rax - movq 8(%rdx), %rbx - movq 16(%rdx), %rcx - movq 24(%rdx), %rdx - movq %rax, U8(%rsp) - movq %rbx, U8+8(%rsp) - movq %rcx, U8+16(%rsp) - movq %rdx, U8+24(%rsp) - -// Main squaring loop, accumulating in u consistently and -// only ensuring the intermediates are < 2 * p_25519 = 2^256 - 38 - -Lbignum_sqrt_p25519_alt_loop: - movq U8(%rsp), %rax - mulq %rax - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq U8(%rsp), %rax - mulq U8+0x8(%rsp) - addq %rax, %rax - adcq %rdx, %rdx - adcq $0x0, %r11 - addq %rax, %r9 - adcq %rdx, %r10 - adcq $0x0, %r11 - xorq %r12, %r12 - movq U8+0x8(%rsp), %rax - mulq %rax - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq U8(%rsp), %rax - mulq U8+0x10(%rsp) - addq %rax, %rax - adcq %rdx, %rdx - adcq $0x0, %r12 - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq U8(%rsp), %rax - mulq U8+0x18(%rsp) - addq %rax, %rax - adcq %rdx, %rdx - adcq $0x0, %r13 - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq U8+0x8(%rsp), %rax - mulq U8+0x10(%rsp) - addq %rax, %rax - adcq %rdx, %rdx - adcq $0x0, %r13 - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq U8+0x8(%rsp), %rax - mulq U8+0x18(%rsp) - addq %rax, %rax - adcq %rdx, %rdx - adcq $0x0, %r14 - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq U8+0x10(%rsp), %rax - mulq %rax - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq U8+0x10(%rsp), %rax - mulq U8+0x18(%rsp) - addq %rax, %rax - adcq %rdx, %rdx - adcq $0x0, %r15 - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq U8+0x18(%rsp), %rax - mulq %rax - addq %rax, %r14 - adcq %rdx, %r15 - movl $0x26, %ebx - movq %r12, %rax - mulq %rbx - addq %rax, %r8 - adcq %rdx, %r9 - sbbq %rcx, %rcx - movq %r13, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r14, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq %r15, %rax - mulq %rbx - subq %rcx, %rdx - xorq %rcx, %rcx - addq %rax, %r11 - movq %rdx, %r12 - adcq %rcx, %r12 - shldq $0x1, %r11, %r12 - btr $0x3f, %r11 - movl $0x13, %edx - imulq %r12, %rdx - addq %rdx, %r8 - adcq %rcx, %r9 - adcq %rcx, %r10 - adcq %rcx, %r11 - movq %r8, U8(%rsp) - movq %r9, U8+0x8(%rsp) - movq %r10, U8+0x10(%rsp) - movq %r11, U8+0x18(%rsp) - -// Loop as applicable - - decq %rsi - jnz Lbignum_sqrt_p25519_alt_loop - -// We know the intermediate result x < 2^256 - 38, and now we do strict -// modular reduction mod 2^255 - 19. Note x < 2^255 - 19 <=> x + 19 < 2^255 -// which is equivalent to a "ns" condition. We just use the results where -// they were in registers [%r11;%r10;%r9;%r8] instead of re-loading them. - - movl $19, %eax - xorl %ebx, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - - cmovns %r8, %rax - cmovns %r9, %rbx - cmovns %r10, %rcx - cmovns %r11, %rdx - btr $63, %rdx - movq %rax, (%rdi) - movq %rbx, 8(%rdi) - movq %rcx, 16(%rdi) - movq %rdx, 24(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_sqrt_p25519_alt_nsqr_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sub_p25519.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sub_p25519.S deleted file mode 100644 index b16d1ba69fe..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/bignum_sub_p25519.S +++ /dev/null @@ -1,89 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Subtract modulo p_25519, z := (x - y) mod p_25519 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_sub_p25519(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sub_p25519) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sub_p25519) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sub_p25519) - .text - -#define z %rdi -#define x %rsi -#define y %rdx - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -#define zero %rax -#define zeroe %eax -#define c %rcx -#define cshort %ecx - -S2N_BN_SYMBOL(bignum_sub_p25519): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Load and subtract the two inputs as [d3;d2;d1;d0] = x - y (modulo 2^256) - - movq (x), d0 - subq (y), d0 - movq 8(x), d1 - sbbq 8(y), d1 - movq 16(x), d2 - sbbq 16(y), d2 - movq 24(x), d3 - sbbq 24(y), d3 - -// Now if x < y we want to add back p_25519, which staying within 4 digits -// means subtracting 19, since p_25519 = 2^255 - 19. -// Let c be that constant 19 when x < y, zero otherwise. - - sbbq c, c - xorl zeroe, zeroe - andq $19, c - -// Correct by adding the optional constant and masking to 255 bits - - subq c, d0 - movq d0, (z) - sbbq zero, d1 - movq d1, 8(z) - sbbq zero, d2 - movq d2, 16(z) - sbbq zero, d3 - btr $63, d3 - movq d3, 24(z) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sub_p25519) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_ladderstep.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_ladderstep.S deleted file mode 100644 index 5dc4f4233d5..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_ladderstep.S +++ /dev/null @@ -1,747 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery ladder step on pairs of (X,Z)-projective curve25519 points -// -// extern void curve25519_ladderstep -// (uint64_t rr[16],const uint64_t point[8],const uint64_t pp[16],uint64_t b); -// -// If point = (X,1) and pp = (n * (X,1),[n+1] * (X,1)) then the output -// rr = (n' * (X,1),[n'+1] * (X,1)) where n' = 2 * n + b, with input -// b assumed to be 0 or 1; in this setting, each pair (X,Z) is assumed to -// be a projective y-free representation of an affine curve25519 point -// (X/Z,y), with the initial "differential" point having Z = 1 and X its -// affine x coordinate. In other words, the ladderstep operation is a -// combination of doubling, differential addition and optional swapping. -// -// Standard x86-64 ABI: RDI = rr, RSI = point, RDX = pp, RCX = b -// Microsoft x64 ABI: RCX = rr, RDX = point, R8 = pp, R9 = b -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(curve25519_ladderstep) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(curve25519_ladderstep) - S2N_BN_SYM_PRIVACY_DIRECTIVE(curve25519_ladderstep) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// The single field of the input point used (z assumed 1) - -#define point_x 0(%rbp) - -// Pointer-offset pairs for pp fields -// These use the initial register %rdx as the offset. -// We then never need it again so it can be ephemeral - -#define xn 0(%rdx) -#define zn NUMSIZE(%rdx) -#define xm (2*NUMSIZE)(%rdx) -#define zm (3*NUMSIZE)(%rdx) - -// Result fields - -#define res0 0(%rbp) -#define res1 NUMSIZE(%rbp) -#define res2 (2*NUMSIZE)(%rbp) -#define res3 (3*NUMSIZE)(%rbp) - -// Pointer-offset pairs for temporaries on stack -// dmsn and dnsm need space for >= 5 digits, and we allocate 8 - -#define sm (0*NUMSIZE)(%rsp) -#define sn (1*NUMSIZE)(%rsp) -#define dm (2*NUMSIZE)(%rsp) -#define dn (3*NUMSIZE)(%rsp) -#define dmsn (4*NUMSIZE)(%rsp) -#define dnsm (6*NUMSIZE)(%rsp) -#define s (8*NUMSIZE)(%rsp) -#define d (9*NUMSIZE)(%rsp) -#define p (10*NUMSIZE)(%rsp) - -// Preserved inputs - -#define rr (12*NUMSIZE)(%rsp) -#define point (12*NUMSIZE)+8(%rsp) -#define pp (12*NUMSIZE)+16(%rsp) -#define bb (12*NUMSIZE)+24(%rsp) - -// More, but aliases to above - -#define sumx sm -#define sumz sn -#define dubx dm -#define dubz dn -#define e dubz -#define spro dnsm -#define dpro sumz - -// Total size to reserve on the stack - -#define NSPACE 13*NUMSIZE - -// Macros wrapping up the basic field operation calls -// bignum_mul_p25519 and bignum_sqr_p25519. -// These two are only trivially different from pure -// function calls to those subroutines. - -#define mul_p25519(P0,P1,P2) \ - xorl %edi, %edi ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rdi, %r12 ; \ - xorl %edi, %edi ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rdi, %r13 ; \ - adcxq %rdi, %r13 ; \ - xorl %edi, %edi ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rdi, %r14 ; \ - adcxq %rdi, %r14 ; \ - xorl %edi, %edi ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rdi, %r15 ; \ - adcxq %rdi, %r15 ; \ - movl $0x26, %edx ; \ - xorl %edi, %edi ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rdi, %r12 ; \ - adcxq %rdi, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - movl $0x13, %edx ; \ - incq %r12; \ - bts $63, %r11 ; \ - mulxq %r12, %rax, %rbx ; \ - addq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rdi, %r10 ; \ - adcq %rdi, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rdx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rdi, %r9 ; \ - sbbq %rdi, %r10 ; \ - sbbq %rdi, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -#define sqr_p25519(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ebx, %ebx ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rbx, %r13 ; \ - adoxq %rbx, %r14 ; \ - adcq %rbx, %r14 ; \ - xorl %ebx, %ebx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rbx, %r15 ; \ - adoxq %rbx, %r15 ; \ - movl $0x26, %edx ; \ - xorl %ebx, %ebx ; \ - mulxq %r12, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq %r13, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq %r14, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - adcxq %rbx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - movl $0x13, %edx ; \ - leaq 0x1(%r12), %rax ; \ - bts $0x3f, %r11 ; \ - imulq %rdx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - cmovbq %rbx, %rdx ; \ - subq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %r11 ; \ - btr $0x3f, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Multiplication just giving a 5-digit result (actually < 39 * p_25519) -// by not doing anything beyond the first stage of reduction - -#define mul_5(P0,P1,P2) \ - xorl %edi, %edi ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rdi, %r12 ; \ - xorl %edi, %edi ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rdi, %r13 ; \ - adcxq %rdi, %r13 ; \ - xorl %edi, %edi ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rdi, %r14 ; \ - adcxq %rdi, %r14 ; \ - xorl %edi, %edi ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rdi, %r15 ; \ - adcxq %rdi, %r15 ; \ - movl $0x26, %edx ; \ - xorl %edi, %edi ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rdi, %r12 ; \ - adcxq %rdi, %r12 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 ; \ - movq %r12, 0x20+P0 - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ebx, %ebx ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rbx, %r13 ; \ - adoxq %rbx, %r14 ; \ - adcq %rbx, %r14 ; \ - xorl %ebx, %ebx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rbx, %r15 ; \ - adoxq %rbx, %r15 ; \ - movl $0x26, %edx ; \ - xorl %ebx, %ebx ; \ - mulxq %r12, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq %r13, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq %r14, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - adcxq %rbx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Plain 4-digit add without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result - -#define add_4(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq 8+P2, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq 16+P2, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq 24+P2, %rax ; \ - movq %rax, 24+P0 - -// Add 5-digit inputs and normalize to 4 digits - -#define add5_4(P0,P1,P2) \ - movq P1, %r8 ; \ - addq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - adcq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - adcq 16+P2, %r10 ; \ - movq 24+P1, %r11 ; \ - adcq 24+P2, %r11 ; \ - movq 32+P1, %r12 ; \ - adcq 32+P2, %r12 ; \ - xorl %ebx, %ebx ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(P0,P1,P2) \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - subq $19, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq $0, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq $0, %rax ; \ - btc $63, %rax ; \ - movq %rax, 24+P0 - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ebx, %ebx ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movl $38, %ecx ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - cmovncq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %rax ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %rax, 24+P0 - -// 5-digit subtraction with upward bias to make it positive, adding -// 1000 * (2^255 - 19) = 2^256 * 500 - 19000, then normalizing to 4 digits - -#define sub5_4(P0,P1,P2) \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %r11 ; \ - sbbq 24+P2, %r11 ; \ - movq 32+P1, %r12 ; \ - sbbq 32+P2, %r12 ; \ - xorl %ebx, %ebx ; \ - subq $19000, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %r11 ; \ - sbbq %rbx, %r12 ; \ - addq $500, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Combined z = c * x + y with reduction only < 2 * p_25519 -// It is assumed that 19 * (c * x + y) < 2^60 * 2^256 so we -// don't need a high mul in the final part. - -#define cmadd_4(P0,C1,P2,P3) \ - movq P3, %r8 ; \ - movq 8+P3, %r9 ; \ - movq 16+P3, %r10 ; \ - movq 24+P3, %r11 ; \ - xorl %edi, %edi ; \ - movq $C1, %rdx ; \ - mulxq P2, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 8+P2, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 16+P2, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 24+P2, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rdi, %rbx ; \ - adcxq %rdi, %rbx ; \ - shldq $0x1, %r11, %rbx ; \ - btr $63, %r11 ; \ - movl $0x13, %edx ; \ - imulq %rdx, %rbx ; \ - addq %rbx, %r8 ; \ - adcq %rdi, %r9 ; \ - adcq %rdi, %r10 ; \ - adcq %rdi, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Multiplex: z := if NZ then x else y - -#define mux_4(P0,P1,P2) \ - movq P1, %rax ; \ - movq P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - movq 8+P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - movq 16+P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - movq 24+P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, 24+P0 - -// Paired multiplex: (w,z) := if NZ then (y,x) else (x,y) - -#define muxpair_4(P0,P1,P2,P3) \ - movq P2, %rax ; \ - movq P3, %rcx ; \ - movq %rax, %rdx ; \ - cmovnzq %rcx, %rax ; \ - cmovnzq %rdx, %rcx ; \ - movq %rax, P0 ; \ - movq %rcx, P1 ; \ - movq 8+P2, %rax ; \ - movq 8+P3, %rcx ; \ - movq %rax, %rdx ; \ - cmovnzq %rcx, %rax ; \ - cmovnzq %rdx, %rcx ; \ - movq %rax, 8+P0 ; \ - movq %rcx, 8+P1 ; \ - movq 16+P2, %rax ; \ - movq 16+P3, %rcx ; \ - movq %rax, %rdx ; \ - cmovnzq %rcx, %rax ; \ - cmovnzq %rdx, %rcx ; \ - movq %rax, 16+P0 ; \ - movq %rcx, 16+P1 ; \ - movq 24+P2, %rax ; \ - movq 24+P3, %rcx ; \ - movq %rax, %rdx ; \ - cmovnzq %rcx, %rax ; \ - cmovnzq %rdx, %rcx ; \ - movq %rax, 24+P0 ; \ - movq %rcx, 24+P1 - -S2N_BN_SYMBOL(curve25519_ladderstep): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Save registers, make room for temps, preserve input arguments. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdi, rr - movq %rsi, point - movq %rcx, bb - -// sm = xm + zm; sn = xn + zn; dm = xm - zm; dn = xn - zn -// The adds don't need any normalization as they're fed to muls -// Just make sure the subs fit in 4 digits. Keep pp in %rdx -// here, after which we can forget about it. - - sub_4(dm,xm,zm) - add_4(sn,xn,zn) - sub_4(dn,xn,zn) - add_4(sm,xm,zm) - -// ADDING: dmsn = dm * sn; dnsm = sm * dn -// DOUBLING: mux d = xt - zt and s = xt + zt for appropriate choice of (xt,zt) - - mul_5(dmsn,dm,sn) - - movq bb, %rax - testq %rax, %rax - mux_4(d,dm,dn) - mux_4(s,sm,sn) - - mul_5(dnsm,sm,dn) - -// DOUBLING: d = (xt - zt)^2 normalized only to 4 digits - - sqr_4(d,d) - -// ADDING: dpro = (dmsn - dnsm)^2, spro = (dmsn + dnsm)^2 -// DOUBLING: s = (xt + zt)^2, normalized only to 4 digits - - sub5_4(dpro,dmsn,dnsm) - sqr_4(s,s) - add5_4(spro,dmsn,dnsm) - sqr_4(dpro,dpro) - -// DOUBLING: p = 4 * xt * zt = s - d - - sub_twice4(p,s,d) - -// ADDING: sumx = (dmsn + dnsm)^2 - - sqr_p25519(sumx,spro) - -// DOUBLING: e = 121666 * p + d - - cmadd_4(e,0x1db42,p,d) - -// DOUBLING: dubx = (xt + zt)^2 * (xt - zt)^2 = s * d - - mul_p25519(dubx,s,d) - -// ADDING: sumz = x * (dmsn - dnsm)^2 - - movq point, %rbp - mul_p25519(sumz,dpro,point_x) - -// DOUBLING: dubz = (4 * xt * zt) * ((xt - zt)^2 + 121666 * (4 * xt * zt)) -// = p * (d + 121666 * p) - - mul_p25519(dubz,p,e) - -// Multiplex the outputs - - movq bb, %rax - movq rr, %rbp - testq %rax, %rax - muxpair_4(res0,res2,dubx,sumx) - muxpair_4(res1,res3,dubz,sumz) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(curve25519_ladderstep) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_ladderstep_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_ladderstep_alt.S deleted file mode 100644 index bfd2730bb8b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_ladderstep_alt.S +++ /dev/null @@ -1,913 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery ladder step on pairs of (X,Z)-projective curve25519 points -// -// extern void curve25519_ladderstep_alt -// (uint64_t rr[16],const uint64_t point[8],const uint64_t pp[16],uint64_t b); -// -// If point = (X,1) and pp = (n * (X,1),[n+1] * (X,1)) then the output -// rr = (n' * (X,1),[n'+1] * (X,1)) where n' = 2 * n + b, with input -// b assumed to be 0 or 1; in this setting, each pair (X,Z) is assumed to -// be a projective y-free representation of an affine curve25519 point -// (X/Z,y), with the initial "differential" point having Z = 1 and X its -// affine x coordinate. In other words, the ladderstep operation is a -// combination of doubling, differential addition and optional swapping. -// -// Standard x86-64 ABI: RDI = rr, RSI = point, RDX = pp, RCX = b -// Microsoft x64 ABI: RCX = rr, RDX = point, R8 = pp, R9 = b -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(curve25519_ladderstep_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(curve25519_ladderstep_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(curve25519_ladderstep_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// The single field of the input point used (z assumed 1) - -#define point_x 0(%rbp) - -// Pointer-offset pairs for pp fields -// These use the initial register %rdx as the offset. -// We then never need it again so it can be ephemeral - -#define xn 0(%rdx) -#define zn NUMSIZE(%rdx) -#define xm (2*NUMSIZE)(%rdx) -#define zm (3*NUMSIZE)(%rdx) - -// Result fields - -#define res0 0(%rbp) -#define res1 NUMSIZE(%rbp) -#define res2 (2*NUMSIZE)(%rbp) -#define res3 (3*NUMSIZE)(%rbp) - -// Pointer-offset pairs for temporaries on stack -// dmsn and dnsm need space for >= 5 digits, and we allocate 8 - -#define sm (0*NUMSIZE)(%rsp) -#define sn (1*NUMSIZE)(%rsp) -#define dm (2*NUMSIZE)(%rsp) -#define dn (3*NUMSIZE)(%rsp) -#define dmsn (4*NUMSIZE)(%rsp) -#define dnsm (6*NUMSIZE)(%rsp) -#define s (8*NUMSIZE)(%rsp) -#define d (9*NUMSIZE)(%rsp) -#define p (10*NUMSIZE)(%rsp) - -// Preserved inputs - -#define rr (12*NUMSIZE)(%rsp) -#define point (12*NUMSIZE)+8(%rsp) -#define pp (12*NUMSIZE)+16(%rsp) -#define bb (12*NUMSIZE)+24(%rsp) - -// More, but aliases to above - -#define sumx sm -#define sumz sn -#define dubx dm -#define dubz dn -#define e dubz -#define spro dnsm -#define dpro sumz - -// Total size to reserve on the stack - -#define NSPACE 13*NUMSIZE - -// Macros wrapping up the basic field operation calls -// bignum_mul_p25519_alt and bignum_sqr_p25519_alt. -// These two are only trivially different from pure -// function calls to those subroutines. - -#define mul_p25519(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %esi ; \ - movq %r12, %rax ; \ - mulq %rsi; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movl $0x13, %esi ; \ - bts $63, %r11 ; \ - imulq %rsi, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rsi, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -#define sqr_p25519(P0,P1) \ - movq P1, %rax ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r11 ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r12 ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r14 ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r15 ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %esi ; \ - movq %r12, %rax ; \ - mulq %rsi; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movl $0x13, %esi ; \ - bts $63, %r11 ; \ - imulq %rsi, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rsi, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Multiplication just giving a 5-digit result (actually < 39 * p_25519) -// by not doing anything beyond the first stage of reduction - -#define mul_5(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %esi ; \ - movq %r12, %rax ; \ - mulq %rsi; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 ; \ - movq %r12, 0x20+P0 - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - movq P1, %rax ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r11 ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r12 ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r14 ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r15 ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %esi ; \ - movq %r12, %rax ; \ - mulq %rsi; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Plain 4-digit add without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result - -#define add_4(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq 8+P2, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq 16+P2, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq 24+P2, %rax ; \ - movq %rax, 24+P0 - -// Add 5-digit inputs and normalize to 4 digits - -#define add5_4(P0,P1,P2) \ - movq P1, %r8 ; \ - addq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - adcq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - adcq 16+P2, %r10 ; \ - movq 24+P1, %r11 ; \ - adcq 24+P2, %r11 ; \ - movq 32+P1, %r12 ; \ - adcq 32+P2, %r12 ; \ - xorl %ebx, %ebx ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(P0,P1,P2) \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - subq $19, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq $0, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq $0, %rax ; \ - btc $63, %rax ; \ - movq %rax, 24+P0 - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ebx, %ebx ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movl $38, %ecx ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - cmovncq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %rax ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %rax, 24+P0 - -// 5-digit subtraction with upward bias to make it positive, adding -// 1000 * (2^255 - 19) = 2^256 * 500 - 19000, then normalizing to 4 digits - -#define sub5_4(P0,P1,P2) \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %r11 ; \ - sbbq 24+P2, %r11 ; \ - movq 32+P1, %r12 ; \ - sbbq 32+P2, %r12 ; \ - xorl %ebx, %ebx ; \ - subq $19000, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %r11 ; \ - sbbq %rbx, %r12 ; \ - addq $500, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Combined z = c * x + y with reduction only < 2 * p_25519 -// It is assumed that 19 * (c * x + y) < 2^60 * 2^256 so we -// don't need a high mul in the final part. - -#define cmadd_4(P0,C1,P2,P3) \ - movq $C1, %rsi ; \ - movq P2, %rax ; \ - mulq %rsi; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - movq 0x8+P2, %rax ; \ - xorq %r10, %r10 ; \ - mulq %rsi; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x10+P2, %rax ; \ - mulq %rsi; \ - addq %rax, %r10 ; \ - adcq $0x0, %rdx ; \ - movq 0x18+P2, %rax ; \ - movq %rdx, %r11 ; \ - mulq %rsi; \ - xorl %esi, %esi ; \ - addq %rax, %r11 ; \ - adcq %rsi, %rdx ; \ - addq P3, %r8 ; \ - adcq 0x8+P3, %r9 ; \ - adcq 0x10+P3, %r10 ; \ - adcq 0x18+P3, %r11 ; \ - adcq %rsi, %rdx ; \ - shldq $0x1, %r11, %rdx ; \ - btr $63, %r11 ; \ - movl $0x13, %ebx ; \ - imulq %rbx, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rsi, %r9 ; \ - adcq %rsi, %r10 ; \ - adcq %rsi, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Multiplex: z := if NZ then x else y - -#define mux_4(P0,P1,P2) \ - movq P1, %rax ; \ - movq P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - movq 8+P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - movq 16+P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - movq 24+P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, 24+P0 - -// Paired multiplex: (w,z) := if NZ then (y,x) else (x,y) - -#define muxpair_4(P0,P1,P2,P3) \ - movq P2, %rax ; \ - movq P3, %rcx ; \ - movq %rax, %rdx ; \ - cmovnzq %rcx, %rax ; \ - cmovnzq %rdx, %rcx ; \ - movq %rax, P0 ; \ - movq %rcx, P1 ; \ - movq 8+P2, %rax ; \ - movq 8+P3, %rcx ; \ - movq %rax, %rdx ; \ - cmovnzq %rcx, %rax ; \ - cmovnzq %rdx, %rcx ; \ - movq %rax, 8+P0 ; \ - movq %rcx, 8+P1 ; \ - movq 16+P2, %rax ; \ - movq 16+P3, %rcx ; \ - movq %rax, %rdx ; \ - cmovnzq %rcx, %rax ; \ - cmovnzq %rdx, %rcx ; \ - movq %rax, 16+P0 ; \ - movq %rcx, 16+P1 ; \ - movq 24+P2, %rax ; \ - movq 24+P3, %rcx ; \ - movq %rax, %rdx ; \ - cmovnzq %rcx, %rax ; \ - cmovnzq %rdx, %rcx ; \ - movq %rax, 24+P0 ; \ - movq %rcx, 24+P1 - -S2N_BN_SYMBOL(curve25519_ladderstep_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Save registers, make room for temps, preserve input arguments. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdi, rr - movq %rsi, point - movq %rcx, bb - -// sm = xm + zm; sn = xn + zn; dm = xm - zm; dn = xn - zn -// The adds don't need any normalization as they're fed to muls -// Just make sure the subs fit in 4 digits. Keep pp in %rdx -// here, after which we can forget about it. - - sub_4(dm,xm,zm) - add_4(sn,xn,zn) - sub_4(dn,xn,zn) - add_4(sm,xm,zm) - -// ADDING: dmsn = dm * sn; dnsm = sm * dn -// DOUBLING: mux d = xt - zt and s = xt + zt for appropriate choice of (xt,zt) - - mul_5(dmsn,dm,sn) - - movq bb, %rax - testq %rax, %rax - mux_4(d,dm,dn) - mux_4(s,sm,sn) - - mul_5(dnsm,sm,dn) - -// DOUBLING: d = (xt - zt)^2 normalized only to 4 digits - - sqr_4(d,d) - -// ADDING: dpro = (dmsn - dnsm)^2, spro = (dmsn + dnsm)^2 -// DOUBLING: s = (xt + zt)^2, normalized only to 4 digits - - sub5_4(dpro,dmsn,dnsm) - sqr_4(s,s) - add5_4(spro,dmsn,dnsm) - sqr_4(dpro,dpro) - -// DOUBLING: p = 4 * xt * zt = s - d - - sub_twice4(p,s,d) - -// ADDING: sumx = (dmsn + dnsm)^2 - - sqr_p25519(sumx,spro) - -// DOUBLING: e = 121666 * p + d - - cmadd_4(e,0x1db42,p,d) - -// DOUBLING: dubx = (xt + zt)^2 * (xt - zt)^2 = s * d - - mul_p25519(dubx,s,d) - -// ADDING: sumz = x * (dmsn - dnsm)^2 - - movq point, %rbp - mul_p25519(sumz,dpro,point_x) - -// DOUBLING: dubz = (4 * xt * zt) * ((xt - zt)^2 + 121666 * (4 * xt * zt)) -// = p * (d + 121666 * p) - - mul_p25519(dubz,p,e) - -// Multiplex the outputs - - movq bb, %rax - movq rr, %rbp - testq %rax, %rax - muxpair_4(res0,res2,dubx,sumx) - muxpair_4(res1,res3,dubz,sumz) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(curve25519_ladderstep_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_pxscalarmul.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_pxscalarmul.S deleted file mode 100644 index 804499416f3..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_pxscalarmul.S +++ /dev/null @@ -1,776 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Projective scalar multiplication, x coordinate only, for curve25519 -// Inputs scalar[4], point[4]; output res[8] -// -// extern void curve25519_pxscalarmul -// (uint64_t res[static 8],const uint64_t scalar[static 4], -// const uint64_t point[static 4]); -// -// Given the X coordinate of an input point = (X,Y) on curve25519, which -// could also be part of a projective representation (X,Y,1) of the same -// point, returns a projective representation (X,Z) = scalar * point, where -// scalar is a 256-bit number. The corresponding affine form is (X/Z,Y'), -// X/Z meaning division modulo 2^255-19, and Y' not being computed by -// this function (nor is any Y coordinate of the input point used). -// -// Standard x86-64 ABI: RDI = res, RSI = scalar, RDX = point -// Microsoft x64 ABI: RCX = res, RDX = scalar, R8 = point -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(curve25519_pxscalarmul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(curve25519_pxscalarmul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(curve25519_pxscalarmul) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence -// and additional registers for loop counter and swap flag - -#define res 10*NUMSIZE(%rsp) -#define point 10*NUMSIZE+8(%rsp) -#define scalar 10*NUMSIZE+16(%rsp) -#define i 10*NUMSIZE+24(%rsp) -#define swap 10*NUMSIZE+32(%rsp) - -// Pointers to input x coord (we don't use y or z) and output coords. -// These all assume the base address (point and res respectively) is -// currently in the %rbp register. - -#define x 0(%rbp) -#define resx 0(%rbp) -#define resz NUMSIZE(%rbp) - -// Pointer-offset pairs for temporaries on stack with some aliasing. -// Both dmsn and dnsm need space for >= 5 digits, and we allocate 8 - -#define zm (0*NUMSIZE)(%rsp) -#define sm (0*NUMSIZE)(%rsp) -#define dpro (0*NUMSIZE)(%rsp) - -#define sn (1*NUMSIZE)(%rsp) - -#define dm (2*NUMSIZE)(%rsp) - -#define zn (3*NUMSIZE)(%rsp) -#define dn (3*NUMSIZE)(%rsp) -#define e (3*NUMSIZE)(%rsp) - -#define dmsn (4*NUMSIZE)(%rsp) -#define p (4*NUMSIZE)(%rsp) - -#define xm (6*NUMSIZE)(%rsp) -#define dnsm (6*NUMSIZE)(%rsp) -#define spro (6*NUMSIZE)(%rsp) - -#define xn (8*NUMSIZE)(%rsp) -#define s (8*NUMSIZE)(%rsp) - -#define d (9*NUMSIZE)(%rsp) - -// Total size to reserve on the stack -// This includes space for the 5 other variables above - -#define NSPACE 360 - -// Macros wrapping up the basic field operation calls -// bignum_mul_p25519 and bignum_sqr_p25519. -// These two are only trivially different from pure -// function calls to those subroutines. - -#define mul_p25519(P0,P1,P2) \ - xorl %edi, %edi ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rdi, %r12 ; \ - xorl %edi, %edi ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rdi, %r13 ; \ - adcxq %rdi, %r13 ; \ - xorl %edi, %edi ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rdi, %r14 ; \ - adcxq %rdi, %r14 ; \ - xorl %edi, %edi ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rdi, %r15 ; \ - adcxq %rdi, %r15 ; \ - movl $0x26, %edx ; \ - xorl %edi, %edi ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rdi, %r12 ; \ - adcxq %rdi, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - movl $0x13, %edx ; \ - incq %r12; \ - bts $63, %r11 ; \ - mulxq %r12, %rax, %rbx ; \ - addq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rdi, %r10 ; \ - adcq %rdi, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rdx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rdi, %r9 ; \ - sbbq %rdi, %r10 ; \ - sbbq %rdi, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -#define sqr_p25519(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ebx, %ebx ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rbx, %r13 ; \ - adoxq %rbx, %r14 ; \ - adcq %rbx, %r14 ; \ - xorl %ebx, %ebx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rbx, %r15 ; \ - adoxq %rbx, %r15 ; \ - movl $0x26, %edx ; \ - xorl %ebx, %ebx ; \ - mulxq %r12, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq %r13, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq %r14, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - adcxq %rbx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - movl $0x13, %edx ; \ - leaq 0x1(%r12), %rax ; \ - bts $0x3f, %r11 ; \ - imulq %rdx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - cmovbq %rbx, %rdx ; \ - subq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %r11 ; \ - btr $0x3f, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Multiplication just giving a 5-digit result (actually < 39 * p_25519) -// by not doing anything beyond the first stage of reduction - -#define mul_5(P0,P1,P2) \ - xorl %edi, %edi ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rdi, %r12 ; \ - xorl %edi, %edi ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rdi, %r13 ; \ - adcxq %rdi, %r13 ; \ - xorl %edi, %edi ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rdi, %r14 ; \ - adcxq %rdi, %r14 ; \ - xorl %edi, %edi ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rdi, %r15 ; \ - adcxq %rdi, %r15 ; \ - movl $0x26, %edx ; \ - xorl %edi, %edi ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rdi, %r12 ; \ - adcxq %rdi, %r12 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 ; \ - movq %r12, 0x20+P0 - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ebx, %ebx ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rbx, %r13 ; \ - adoxq %rbx, %r14 ; \ - adcq %rbx, %r14 ; \ - xorl %ebx, %ebx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rbx, %r15 ; \ - adoxq %rbx, %r15 ; \ - movl $0x26, %edx ; \ - xorl %ebx, %ebx ; \ - mulxq %r12, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq %r13, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq %r14, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - adcxq %rbx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Plain 4-digit add without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result - -#define add_4(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq 8+P2, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq 16+P2, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq 24+P2, %rax ; \ - movq %rax, 24+P0 - -// Add 5-digit inputs and normalize to 4 digits - -#define add5_4(P0,P1,P2) \ - movq P1, %r8 ; \ - addq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - adcq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - adcq 16+P2, %r10 ; \ - movq 24+P1, %r11 ; \ - adcq 24+P2, %r11 ; \ - movq 32+P1, %r12 ; \ - adcq 32+P2, %r12 ; \ - xorl %ebx, %ebx ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(P0,P1,P2) \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - subq $19, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq $0, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq $0, %rax ; \ - btc $63, %rax ; \ - movq %rax, 24+P0 - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ebx, %ebx ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movl $38, %ecx ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - cmovncq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %rax ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %rax, 24+P0 - -// 5-digit subtraction with upward bias to make it positive, adding -// 1000 * (2^255 - 19) = 2^256 * 500 - 19000, then normalizing to 4 digits - -#define sub5_4(P0,P1,P2) \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %r11 ; \ - sbbq 24+P2, %r11 ; \ - movq 32+P1, %r12 ; \ - sbbq 32+P2, %r12 ; \ - xorl %ebx, %ebx ; \ - subq $19000, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %r11 ; \ - sbbq %rbx, %r12 ; \ - addq $500, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Combined z = c * x + y with reduction only < 2 * p_25519 -// It is assumed that 19 * (c * x + y) < 2^60 * 2^256 so we -// don't need a high mul in the final part. - -#define cmadd_4(P0,C1,P2,P3) \ - movq P3, %r8 ; \ - movq 8+P3, %r9 ; \ - movq 16+P3, %r10 ; \ - movq 24+P3, %r11 ; \ - xorl %edi, %edi ; \ - movq $C1, %rdx ; \ - mulxq P2, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 8+P2, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 16+P2, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 24+P2, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rdi, %rbx ; \ - adcxq %rdi, %rbx ; \ - shldq $0x1, %r11, %rbx ; \ - btr $63, %r11 ; \ - movl $0x13, %edx ; \ - imulq %rdx, %rbx ; \ - addq %rbx, %r8 ; \ - adcq %rdi, %r9 ; \ - adcq %rdi, %r10 ; \ - adcq %rdi, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Multiplex: z := if NZ then x else y - -#define mux_4(P0,P1,P2) \ - movq P1, %rax ; \ - movq P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - movq 8+P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - movq 16+P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - movq 24+P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, 24+P0 - -S2N_BN_SYMBOL(curve25519_pxscalarmul): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers, make room for temps, preserve input arguments. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(NSPACE) - -// Move the input arguments to stable places - - movq %rdi, res - movq %rsi, scalar - movq %rdx, point - -// Initialize (xn,zn) = (1,0) and (xm,zm) = (x,1) with swap = 0 - - movq $1, %rax - movq %rax, 256(%rsp) - movq %rax, (%rsp) - xorl %eax, %eax - movq %rax, swap - movq %rax, 96(%rsp) - movq %rax, 264(%rsp) - movq %rax, 8(%rsp) - movq %rax, 104(%rsp) - movq %rax, 272(%rsp) - movq %rax, 16(%rsp) - movq %rax, 112(%rsp) - movq %rax, 280(%rsp) - movq %rax, 24(%rsp) - movq %rax, 120(%rsp) - movq (%rdx), %rax - movq %rax, 192(%rsp) - movq 8(%rdx), %rax - movq %rax, 200(%rsp) - movq 16(%rdx), %rax - movq %rax, 208(%rsp) - movq 24(%rdx), %rax - movq %rax, 216(%rsp) - -// The outer loop from i = 255, ..., i = 0 (inclusive) - - movl $255, %eax - movq %rax, i - -Lcurve25519_pxscalarmul_loop: - -// sm = xm + zm; sn = xn + zn; dm = xm - zm; dn = xn - zn -// The adds don't need any normalization as they're fed to muls -// Just make sure the subs fit in 4 digits. - - sub_4(dm,xm,zm) - add_4(sn,xn,zn) - sub_4(dn,xn,zn) - add_4(sm,xm,zm) - -// ADDING: dmsn = dm * sn; dnsm = sm * dn -// DOUBLING: mux d = xt - zt and s = xt + zt for appropriate choice of (xt,zt) - - mul_5(dmsn,sn,dm) - - movq scalar, %rax - movq i, %rdx - movq %rdx, %rcx - shrq $6, %rdx - movq (%rax,%rdx,8), %rdx - shrq %cl, %rdx - andq $1, %rdx - cmpq swap, %rdx - movq %rdx, swap - - mux_4(d,dm,dn) - mux_4(s,sm,sn) - - mul_5(dnsm,sm,dn) - -// DOUBLING: d = (xt - zt)^2 normalized only to 4 digits - - sqr_4(d,d) - -// ADDING: dpro = (dmsn - dnsm)^2, spro = (dmsn + dnsm)^2 -// DOUBLING: s = (xt + zt)^2, normalized only to 4 digits - - sub5_4(dpro,dmsn,dnsm) - sqr_4(s,s) - add5_4(spro,dmsn,dnsm) - sqr_4(dpro,dpro) - -// DOUBLING: p = 4 * xt * zt = s - d - - sub_twice4(p,s,d) - -// ADDING: xm' = (dmsn + dnsm)^2 - - sqr_p25519(xm,spro) - -// DOUBLING: e = 121666 * p + d - - cmadd_4(e,0x1db42,p,d) - -// DOUBLING: xn' = (xt + zt)^2 * (xt - zt)^2 = s * d - - mul_p25519(xn,s,d) - -// ADDING: zm' = x * (dmsn - dnsm)^2 - - movq point, %rbp - mul_p25519(zm,dpro,x) - -// DOUBLING: zn' = (4 * xt * zt) * ((xt - zt)^2 + 121666 * (4 * xt * zt)) -// = p * (d + 121666 * p) - - mul_p25519(zn,p,e) - -// Loop down as far as 0 (inclusive) - - movq i, %rax - subq $1, %rax - movq %rax, i - jnc Lcurve25519_pxscalarmul_loop - -// The main loop does not handle the special input of the 2-torsion -// point = (0,0). In that case we may get a spurious (0,0) as output -// when we want (0,1) [for odd scalar] or (1,0) [for even scalar]. -// Test if x = 0 (this is equivalent for curve25519 to y = 0) and if -// so, patch zm = 1 [for odd multiple], xn = 1 [for even multiple]. - - movl $1, %ecx - movq point, %rbp - movq (%rbp), %rax - orq 8(%rbp), %rax - orq 16(%rbp), %rax - orq 24(%rbp), %rax - cmovnzq %rcx, %rax - xorq $1, %rax - orq %rax, (%rsp) - orq %rax, 256(%rsp) - -// Multiplex into the final outputs - - movq res, %rbp - movq swap, %rax - testq %rax, %rax - - mux_4(resx,xm,xn) - mux_4(resz,zm,zn) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(curve25519_pxscalarmul) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_pxscalarmul_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_pxscalarmul_alt.S deleted file mode 100644 index 3b304a32296..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/curve25519_pxscalarmul_alt.S +++ /dev/null @@ -1,942 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Projective scalar multiplication, x coordinate only, for curve25519 -// Inputs scalar[4], point[4]; output res[8] -// -// extern void curve25519_pxscalarmul_alt -// (uint64_t res[static 8],const uint64_t scalar[static 4], -// const uint64_t point[static 4]); -// -// Given the X coordinate of an input point = (X,Y) on curve25519, which -// could also be part of a projective representation (X,Y,1) of the same -// point, returns a projective representation (X,Z) = scalar * point, where -// scalar is a 256-bit number. The corresponding affine form is (X/Z,Y'), -// X/Z meaning division modulo 2^255-19, and Y' not being computed by -// this function (nor is any Y coordinate of the input point used). -// -// Standard x86-64 ABI: RDI = res, RSI = scalar, RDX = point -// Microsoft x64 ABI: RCX = res, RDX = scalar, R8 = point -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(curve25519_pxscalarmul_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(curve25519_pxscalarmul_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(curve25519_pxscalarmul_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Stable homes for input arguments during main code sequence -// and additional registers for loop counter and swap flag - -#define res 10*NUMSIZE(%rsp) -#define point 10*NUMSIZE+8(%rsp) -#define scalar 10*NUMSIZE+16(%rsp) -#define i 10*NUMSIZE+24(%rsp) -#define swap 10*NUMSIZE+32(%rsp) - -// Pointers to input x coord (we don't use y or z) and output coords. -// These all assume the base address (point and res respectively) is -// currently in the %rbp register. - -#define x 0(%rbp) -#define resx 0(%rbp) -#define resz NUMSIZE(%rbp) - -// Pointer-offset pairs for temporaries on stack with some aliasing. -// Both dmsn and dnsm need space for >= 5 digits, and we allocate 8 - -#define zm (0*NUMSIZE)(%rsp) -#define sm (0*NUMSIZE)(%rsp) -#define dpro (0*NUMSIZE)(%rsp) - -#define sn (1*NUMSIZE)(%rsp) - -#define dm (2*NUMSIZE)(%rsp) - -#define zn (3*NUMSIZE)(%rsp) -#define dn (3*NUMSIZE)(%rsp) -#define e (3*NUMSIZE)(%rsp) - -#define dmsn (4*NUMSIZE)(%rsp) -#define p (4*NUMSIZE)(%rsp) - -#define xm (6*NUMSIZE)(%rsp) -#define dnsm (6*NUMSIZE)(%rsp) -#define spro (6*NUMSIZE)(%rsp) - -#define xn (8*NUMSIZE)(%rsp) -#define s (8*NUMSIZE)(%rsp) - -#define d (9*NUMSIZE)(%rsp) - -// Total size to reserve on the stack -// This includes space for the 5 other variables above - -#define NSPACE 360 - -// Macros wrapping up the basic field operation calls -// bignum_mul_p25519_alt and bignum_sqr_p25519_alt. -// These two are only trivially different from pure -// function calls to those subroutines. - -#define mul_p25519(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %esi ; \ - movq %r12, %rax ; \ - mulq %rsi; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movl $0x13, %esi ; \ - bts $63, %r11 ; \ - imulq %rsi, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rsi, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -#define sqr_p25519(P0,P1) \ - movq P1, %rax ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r11 ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r12 ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r14 ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r15 ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %esi ; \ - movq %r12, %rax ; \ - mulq %rsi; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movl $0x13, %esi ; \ - bts $63, %r11 ; \ - imulq %rsi, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rsi, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Multiplication just giving a 5-digit result (actually < 39 * p_25519) -// by not doing anything beyond the first stage of reduction - -#define mul_5(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %esi ; \ - movq %r12, %rax ; \ - mulq %rsi; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 ; \ - movq %r12, 0x20+P0 - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - movq P1, %rax ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r11 ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r12 ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r14 ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r15 ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %esi ; \ - movq %r12, %rax ; \ - mulq %rsi; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Plain 4-digit add without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result - -#define add_4(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq 8+P2, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq 16+P2, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq 24+P2, %rax ; \ - movq %rax, 24+P0 - -// Add 5-digit inputs and normalize to 4 digits - -#define add5_4(P0,P1,P2) \ - movq P1, %r8 ; \ - addq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - adcq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - adcq 16+P2, %r10 ; \ - movq 24+P1, %r11 ; \ - adcq 24+P2, %r11 ; \ - movq 32+P1, %r12 ; \ - adcq 32+P2, %r12 ; \ - xorl %ebx, %ebx ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(P0,P1,P2) \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - subq $19, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq $0, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq $0, %rax ; \ - btc $63, %rax ; \ - movq %rax, 24+P0 - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ebx, %ebx ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movl $38, %ecx ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - cmovncq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %rax ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %rax, 24+P0 - -// 5-digit subtraction with upward bias to make it positive, adding -// 1000 * (2^255 - 19) = 2^256 * 500 - 19000, then normalizing to 4 digits - -#define sub5_4(P0,P1,P2) \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %r11 ; \ - sbbq 24+P2, %r11 ; \ - movq 32+P1, %r12 ; \ - sbbq 32+P2, %r12 ; \ - xorl %ebx, %ebx ; \ - subq $19000, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %r11 ; \ - sbbq %rbx, %r12 ; \ - addq $500, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Combined z = c * x + y with reduction only < 2 * p_25519 -// It is assumed that 19 * (c * x + y) < 2^60 * 2^256 so we -// don't need a high mul in the final part. - -#define cmadd_4(P0,C1,P2,P3) \ - movq $C1, %rsi ; \ - movq P2, %rax ; \ - mulq %rsi; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - movq 0x8+P2, %rax ; \ - xorq %r10, %r10 ; \ - mulq %rsi; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x10+P2, %rax ; \ - mulq %rsi; \ - addq %rax, %r10 ; \ - adcq $0x0, %rdx ; \ - movq 0x18+P2, %rax ; \ - movq %rdx, %r11 ; \ - mulq %rsi; \ - xorl %esi, %esi ; \ - addq %rax, %r11 ; \ - adcq %rsi, %rdx ; \ - addq P3, %r8 ; \ - adcq 0x8+P3, %r9 ; \ - adcq 0x10+P3, %r10 ; \ - adcq 0x18+P3, %r11 ; \ - adcq %rsi, %rdx ; \ - shldq $0x1, %r11, %rdx ; \ - btr $63, %r11 ; \ - movl $0x13, %ebx ; \ - imulq %rbx, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rsi, %r9 ; \ - adcq %rsi, %r10 ; \ - adcq %rsi, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Multiplex: z := if NZ then x else y - -#define mux_4(P0,P1,P2) \ - movq P1, %rax ; \ - movq P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - movq 8+P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - movq 16+P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - movq 24+P2, %rcx ; \ - cmovzq %rcx, %rax ; \ - movq %rax, 24+P0 - -S2N_BN_SYMBOL(curve25519_pxscalarmul_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers, make room for temps, preserve input arguments. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(NSPACE) - -// Move the input arguments to stable places - - movq %rdi, res - movq %rsi, scalar - movq %rdx, point - -// Initialize (xn,zn) = (1,0) and (xm,zm) = (x,1) with swap = 0 - - movq $1, %rax - movq %rax, 256(%rsp) - movq %rax, (%rsp) - xorl %eax, %eax - movq %rax, swap - movq %rax, 96(%rsp) - movq %rax, 264(%rsp) - movq %rax, 8(%rsp) - movq %rax, 104(%rsp) - movq %rax, 272(%rsp) - movq %rax, 16(%rsp) - movq %rax, 112(%rsp) - movq %rax, 280(%rsp) - movq %rax, 24(%rsp) - movq %rax, 120(%rsp) - movq (%rdx), %rax - movq %rax, 192(%rsp) - movq 8(%rdx), %rax - movq %rax, 200(%rsp) - movq 16(%rdx), %rax - movq %rax, 208(%rsp) - movq 24(%rdx), %rax - movq %rax, 216(%rsp) - -// The outer loop from i = 255, ..., i = 0 (inclusive) - - movl $255, %eax - movq %rax, i - -Lcurve25519_pxscalarmul_alt_loop: - -// sm = xm + zm; sn = xn + zn; dm = xm - zm; dn = xn - zn -// The adds don't need any normalization as they're fed to muls -// Just make sure the subs fit in 4 digits. - - sub_4(dm,xm,zm) - add_4(sn,xn,zn) - sub_4(dn,xn,zn) - add_4(sm,xm,zm) - -// ADDING: dmsn = dm * sn; dnsm = sm * dn -// DOUBLING: mux d = xt - zt and s = xt + zt for appropriate choice of (xt,zt) - - mul_5(dmsn,sn,dm) - - movq scalar, %rax - movq i, %rdx - movq %rdx, %rcx - shrq $6, %rdx - movq (%rax,%rdx,8), %rdx - shrq %cl, %rdx - andq $1, %rdx - cmpq swap, %rdx - movq %rdx, swap - - mux_4(d,dm,dn) - mux_4(s,sm,sn) - - mul_5(dnsm,sm,dn) - -// DOUBLING: d = (xt - zt)^2 normalized only to 4 digits - - sqr_4(d,d) - -// ADDING: dpro = (dmsn - dnsm)^2, spro = (dmsn + dnsm)^2 -// DOUBLING: s = (xt + zt)^2, normalized only to 4 digits - - sub5_4(dpro,dmsn,dnsm) - sqr_4(s,s) - add5_4(spro,dmsn,dnsm) - sqr_4(dpro,dpro) - -// DOUBLING: p = 4 * xt * zt = s - d - - sub_twice4(p,s,d) - -// ADDING: xm' = (dmsn + dnsm)^2 - - sqr_p25519(xm,spro) - -// DOUBLING: e = 121666 * p + d - - cmadd_4(e,0x1db42,p,d) - -// DOUBLING: xn' = (xt + zt)^2 * (xt - zt)^2 = s * d - - mul_p25519(xn,s,d) - -// ADDING: zm' = x * (dmsn - dnsm)^2 - - movq point, %rbp - mul_p25519(zm,dpro,x) - -// DOUBLING: zn' = (4 * xt * zt) * ((xt - zt)^2 + 121666 * (4 * xt * zt)) -// = p * (d + 121666 * p) - - mul_p25519(zn,p,e) - -// Loop down as far as 0 (inclusive) - - movq i, %rax - subq $1, %rax - movq %rax, i - jnc Lcurve25519_pxscalarmul_alt_loop - -// The main loop does not handle the special input of the 2-torsion -// point = (0,0). In that case we may get a spurious (0,0) as output -// when we want (0,1) [for odd scalar] or (1,0) [for even scalar]. -// Test if x = 0 (this is equivalent for curve25519 to y = 0) and if -// so, patch zm = 1 [for odd multiple], xn = 1 [for even multiple]. - - movl $1, %ecx - movq point, %rbp - movq (%rbp), %rax - orq 8(%rbp), %rax - orq 16(%rbp), %rax - orq 24(%rbp), %rax - cmovnzq %rcx, %rax - xorq $1, %rax - orq %rax, (%rsp) - orq %rax, 256(%rsp) - -// Multiplex into the final outputs - - movq res, %rbp - movq swap, %rax - testq %rax, %rax - - mux_4(resx,xm,xn) - mux_4(resz,zm,zn) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(curve25519_pxscalarmul_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epadd.S deleted file mode 100644 index 976d976d5a4..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epadd.S +++ /dev/null @@ -1,441 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended projective addition for edwards25519 -// Inputs p1[16], p2[16]; output p3[16] -// -// extern void edwards25519_epadd -// (uint64_t p3[static 16],const uint64_t p1[static 16], -// const uint64_t p2[static 16]); -// -// The output p3 and both inputs p1 and p2 are points (x,y) on -// edwards25519 represented in extended projective quadruples (X,Y,Z,T) -// where x = X / Z, y = Y / Z and x * y = T / Z. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_epadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_epadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_epadd) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Registers used for inputs and outputs within basic operations. -// Here p1 and p3 are where the parameters come in anyway; -// the p2 = %rbp assignment is set up at the beginning. - -#define p3 %rdi -#define p1 %rsi -#define p2 %rbp - -// Pointers to input and output coordinates - -#define x_1 0(p1) -#define y_1 NUMSIZE(p1) -#define z_1 (2*NUMSIZE)(p1) -#define w_1 (3*NUMSIZE)(p1) - -#define x_2 0(p2) -#define y_2 NUMSIZE(p2) -#define z_2 (2*NUMSIZE)(p2) -#define w_2 (3*NUMSIZE)(p2) - -#define x_3 0(p3) -#define y_3 NUMSIZE(p3) -#define z_3 (2*NUMSIZE)(p3) -#define w_3 (3*NUMSIZE)(p3) - -// Pointer-offset pairs for temporaries on stack - -#define t0 (0*NUMSIZE)(%rsp) -#define t1 (1*NUMSIZE)(%rsp) -#define t2 (2*NUMSIZE)(%rsp) -#define t3 (3*NUMSIZE)(%rsp) -#define t4 (4*NUMSIZE)(%rsp) -#define t5 (5*NUMSIZE)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 6*NUMSIZE - -// Macro wrapping up the basic field multiplication, only trivially -// different from a pure function call to bignum_mul_p25519. - -#define mul_p25519(P0,P1,P2) \ - xorl %esi, %esi ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rsi, %r12 ; \ - xorl %esi, %esi ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rsi, %r13 ; \ - adcxq %rsi, %r13 ; \ - xorl %esi, %esi ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rsi, %r14 ; \ - adcxq %rsi, %r14 ; \ - xorl %esi, %esi ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rsi, %r15 ; \ - adcxq %rsi, %r15 ; \ - movl $0x26, %edx ; \ - xorl %esi, %esi ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rsi, %r12 ; \ - adcxq %rsi, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - movl $0x13, %edx ; \ - incq %r12; \ - bts $63, %r11 ; \ - mulxq %r12, %rax, %rbx ; \ - addq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rsi, %r10 ; \ - adcq %rsi, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rdx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rsi, %r9 ; \ - sbbq %rsi, %r10 ; \ - sbbq %rsi, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - xorl %ecx, %ecx ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rcx, %r12 ; \ - xorl %ecx, %ecx ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rcx, %r13 ; \ - xorl %ecx, %ecx ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcxq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rcx, %r15 ; \ - adcxq %rcx, %r15 ; \ - movl $0x26, %edx ; \ - xorl %ecx, %ecx ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - adcxq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Plain 4-digit add and doubling without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq 8+P2, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq 16+P2, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq 24+P2, %rax ; \ - movq %rax, 24+P0 - -#define double_4(P0,P1) \ - movq P1, %rax ; \ - addq %rax, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq %rax, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq %rax, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq %rax, %rax ; \ - movq %rax, 24+P0 - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(P0,P1,P2) \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - subq $19, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq $0, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq $0, %rax ; \ - btc $63, %rax ; \ - movq %rax, 24+P0 - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ebx, %ebx ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movl $38, %ecx ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - cmovncq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %rax ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %rax, 24+P0 - -// Modular addition with inputs double modulus 2 * p_25519 = 2^256 - 38 -// and in general only guaranteeing a 4-digit result, not even < 2 * p_25519. - -#define add_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ecx, %ecx ; \ - addq P2, %r8 ; \ - movq 0x8+P1, %r9 ; \ - adcq 0x8+P2, %r9 ; \ - movq 0x10+P1, %r10 ; \ - adcq 0x10+P2, %r10 ; \ - movq 0x18+P1, %r11 ; \ - adcq 0x18+P2, %r11 ; \ - movl $38, %eax ; \ - cmovncq %rcx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Load the constant k_25519 = 2 * d_25519 using immediate operations - -#define load_k25519(P0) \ - movq $0xebd69b9426b2f159, %rax ; \ - movq %rax, P0 ; \ - movq $0x00e0149a8283b156, %rax ; \ - movq %rax, 8+P0 ; \ - movq $0x198e80f2eef3d130, %rax ; \ - movq %rax, 16+P0 ; \ - movq $0x2406d9dc56dffce7, %rax ; \ - movq %rax, 24+P0 - -S2N_BN_SYMBOL(edwards25519_epadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers, make room for temps, preserve input arguments. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main sequence of operations. after setting up p2 in its register - - movq %rdx, p2 - - mul_4(t0,w_1,w_2) - - sub_4(t1,y_1,x_1) - sub_4(t2,y_2,x_2) - add_4(t3,y_1,x_1) - add_4(t4,y_2,x_2) - double_4(t5,z_2) - - mul_4(t1,t1,t2) - mul_4(t3,t3,t4) - - load_k25519(t2) - mul_4(t2,t2,t0) - - mul_4(t4,z_1,t5) - - sub_twice4(t0,t3,t1) - add_twice4(t5,t3,t1) - sub_twice4(t1,t4,t2) - add_twice4(t3,t4,t2) - - mul_p25519(w_3,t0,t5) - mul_p25519(x_3,t0,t1) - mul_p25519(y_3,t3,t5) - mul_p25519(z_3,t1,t3) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_epadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epadd_alt.S deleted file mode 100644 index e0a6b4f470d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epadd_alt.S +++ /dev/null @@ -1,517 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended projective addition for edwards25519 -// Inputs p1[16], p2[16]; output p3[16] -// -// extern void edwards25519_epadd_alt -// (uint64_t p3[static 16],const uint64_t p1[static 16], -// const uint64_t p2[static 16]); -// -// The output p3 and both inputs p1 and p2 are points (x,y) on -// edwards25519 represented in extended projective quadruples (X,Y,Z,T) -// where x = X / Z, y = Y / Z and x * y = T / Z. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_epadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_epadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_epadd_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Registers used for inputs and outputs within basic operations. -// Here p1 and p3 are where the parameters come in anyway; -// the p2 = %rbp assignment is set up at the beginning. - -#define p3 %rdi -#define p1 %rsi -#define p2 %rbp - -// Pointers to input and output coordinates - -#define x_1 0(p1) -#define y_1 NUMSIZE(p1) -#define z_1 (2*NUMSIZE)(p1) -#define w_1 (3*NUMSIZE)(p1) - -#define x_2 0(p2) -#define y_2 NUMSIZE(p2) -#define z_2 (2*NUMSIZE)(p2) -#define w_2 (3*NUMSIZE)(p2) - -#define x_3 0(p3) -#define y_3 NUMSIZE(p3) -#define z_3 (2*NUMSIZE)(p3) -#define w_3 (3*NUMSIZE)(p3) - -// Pointer-offset pairs for temporaries on stack - -#define t0 (0*NUMSIZE)(%rsp) -#define t1 (1*NUMSIZE)(%rsp) -#define t2 (2*NUMSIZE)(%rsp) -#define t3 (3*NUMSIZE)(%rsp) -#define t4 (4*NUMSIZE)(%rsp) -#define t5 (5*NUMSIZE)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 6*NUMSIZE - -// Macro wrapping up the basic field multiplication, only trivially -// different from a pure function call to bignum_mul_p25519_alt. - -#define mul_p25519(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %esi ; \ - movq %r12, %rax ; \ - mulq %rsi; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movl $0x13, %esi ; \ - bts $63, %r11 ; \ - imulq %rsi, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rsi, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %ebx ; \ - movq %r12, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Plain 4-digit add and doubling without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq 8+P2, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq 16+P2, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq 24+P2, %rax ; \ - movq %rax, 24+P0 - -#define double_4(P0,P1) \ - movq P1, %rax ; \ - addq %rax, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq %rax, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq %rax, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq %rax, %rax ; \ - movq %rax, 24+P0 - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(P0,P1,P2) \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - subq $19, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq $0, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq $0, %rax ; \ - btc $63, %rax ; \ - movq %rax, 24+P0 - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ebx, %ebx ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movl $38, %ecx ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - cmovncq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %rax ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %rax, 24+P0 - -// Modular addition with inputs double modulus 2 * p_25519 = 2^256 - 38 -// and in general only guaranteeing a 4-digit result, not even < 2 * p_25519. - -#define add_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ecx, %ecx ; \ - addq P2, %r8 ; \ - movq 0x8+P1, %r9 ; \ - adcq 0x8+P2, %r9 ; \ - movq 0x10+P1, %r10 ; \ - adcq 0x10+P2, %r10 ; \ - movq 0x18+P1, %r11 ; \ - adcq 0x18+P2, %r11 ; \ - movl $38, %eax ; \ - cmovncq %rcx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Load the constant k_25519 = 2 * d_25519 using immediate operations - -#define load_k25519(P0) \ - movq $0xebd69b9426b2f159, %rax ; \ - movq %rax, P0 ; \ - movq $0x00e0149a8283b156, %rax ; \ - movq %rax, 8+P0 ; \ - movq $0x198e80f2eef3d130, %rax ; \ - movq %rax, 16+P0 ; \ - movq $0x2406d9dc56dffce7, %rax ; \ - movq %rax, 24+P0 - -S2N_BN_SYMBOL(edwards25519_epadd_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers, make room for temps, preserve input arguments. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main sequence of operations. after setting up p2 in its register - - movq %rdx, p2 - - mul_4(t0,w_1,w_2) - - sub_4(t1,y_1,x_1) - sub_4(t2,y_2,x_2) - add_4(t3,y_1,x_1) - add_4(t4,y_2,x_2) - double_4(t5,z_2) - - mul_4(t1,t1,t2) - mul_4(t3,t3,t4) - - load_k25519(t2) - mul_4(t2,t2,t0) - - mul_4(t4,z_1,t5) - - sub_twice4(t0,t3,t1) - add_twice4(t5,t3,t1) - sub_twice4(t1,t4,t2) - add_twice4(t3,t4,t2) - - mul_p25519(w_3,t0,t5) - mul_p25519(x_3,t0,t1) - mul_p25519(y_3,t3,t5) - mul_p25519(z_3,t1,t3) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_epadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epdouble.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epdouble.S deleted file mode 100644 index bceb30386fd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epdouble.S +++ /dev/null @@ -1,379 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended projective doubling for edwards25519 -// Input p1[12]; output p3[16] -// -// extern void edwards25519_epdouble -// (uint64_t p3[static 16],const uint64_t p1[static 12]); -// -// If p1 is a point on edwards25519, returns its double p3 = 2 * p1. -// The output p3 is in extended projective coordinates, representing -// affine (x,y) by a quadruple (X,Y,Z,T) where x = X / Z, y = Y / Z -// and x * y = T / Z. The input p1 may also be in the same extended -// projective representation, but the final T field is not used so -// a more basic projective triple (X,Y,Z) suffices. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1 -// Microsoft x64 ABI: RCX = p3, RDX = p1 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_epdouble) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_epdouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_epdouble) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Registers used for inputs and outputs within basic operations. -// Here p1 and p3 are where the parameters come in anyway. - -#define p3 %rdi -#define p1 %rsi - -// Pointers to input and output coordinates - -#define x_1 0(p1) -#define y_1 NUMSIZE(p1) -#define z_1 (2*NUMSIZE)(p1) - -#define x_3 0(p3) -#define y_3 NUMSIZE(p3) -#define z_3 (2*NUMSIZE)(p3) -#define w_3 (3*NUMSIZE)(p3) - -// Pointer-offset pairs for temporaries on stack - -#define t0 (0*NUMSIZE)(%rsp) -#define t1 (1*NUMSIZE)(%rsp) -#define t2 (2*NUMSIZE)(%rsp) -#define t3 (3*NUMSIZE)(%rsp) -#define t4 (4*NUMSIZE)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 5*NUMSIZE - -// Macro wrapping up the basic field multiplication, only trivially -// different from a pure function call to bignum_mul_p25519. - -#define mul_p25519(P0,P1,P2) \ - xorl %esi, %esi ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rsi, %r12 ; \ - xorl %esi, %esi ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rsi, %r13 ; \ - adcxq %rsi, %r13 ; \ - xorl %esi, %esi ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rsi, %r14 ; \ - adcxq %rsi, %r14 ; \ - xorl %esi, %esi ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rsi, %r15 ; \ - adcxq %rsi, %r15 ; \ - movl $0x26, %edx ; \ - xorl %esi, %esi ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rsi, %r12 ; \ - adcxq %rsi, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - movl $0x13, %edx ; \ - incq %r12; \ - bts $63, %r11 ; \ - mulxq %r12, %rax, %rbx ; \ - addq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rsi, %r10 ; \ - adcq %rsi, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rdx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rsi, %r9 ; \ - sbbq %rsi, %r10 ; \ - sbbq %rsi, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ebx, %ebx ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rbx, %r13 ; \ - adoxq %rbx, %r14 ; \ - adcq %rbx, %r14 ; \ - xorl %ebx, %ebx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rbx, %r15 ; \ - adoxq %rbx, %r15 ; \ - movl $0x26, %edx ; \ - xorl %ebx, %ebx ; \ - mulxq %r12, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq %r13, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq %r14, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - adcxq %rbx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Plain 4-digit add without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq 8+P2, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq 16+P2, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq 24+P2, %rax ; \ - movq %rax, 24+P0 - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ebx, %ebx ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movl $38, %ecx ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - cmovncq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %rax ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %rax, 24+P0 - -// Modular addition and doubling with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ecx, %ecx ; \ - addq P2, %r8 ; \ - movq 0x8+P1, %r9 ; \ - adcq 0x8+P2, %r9 ; \ - movq 0x10+P1, %r10 ; \ - adcq 0x10+P2, %r10 ; \ - movq 0x18+P1, %r11 ; \ - adcq 0x18+P2, %r11 ; \ - movl $38, %eax ; \ - cmovncq %rcx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -#define double_twice4(P0,P1) \ - movq P1, %r8 ; \ - xorl %ecx, %ecx ; \ - addq %r8, %r8 ; \ - movq 0x8+P1, %r9 ; \ - adcq %r9, %r9 ; \ - movq 0x10+P1, %r10 ; \ - adcq %r10, %r10 ; \ - movq 0x18+P1, %r11 ; \ - adcq %r11, %r11 ; \ - movl $38, %eax ; \ - cmovncq %rcx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -S2N_BN_SYMBOL(edwards25519_epdouble): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers, make room for temps, preserve input arguments. - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main sequence - - add_4(t0,x_1,y_1) - sqr_4(t1,z_1) - sqr_4(t2,x_1) - sqr_4(t3,y_1) - double_twice4(t1,t1) - sqr_4(t0,t0) - add_twice4(t4,t2,t3) - sub_twice4(t2,t2,t3) - add_twice4(t3,t1,t2) - sub_twice4(t1,t4,t0) - mul_p25519(y_3,t2,t4) - mul_p25519(z_3,t3,t2) - mul_p25519(w_3,t1,t4) - mul_p25519(x_3,t1,t3) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_epdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epdouble_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epdouble_alt.S deleted file mode 100644 index 92291429b77..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_epdouble_alt.S +++ /dev/null @@ -1,458 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended projective doubling for edwards25519 -// Input p1[12]; output p3[16] -// -// extern void edwards25519_epdouble_alt -// (uint64_t p3[static 16],const uint64_t p1[static 12]); -// -// If p1 is a point on edwards25519, returns its double p3 = 2 * p1. -// The output p3 is in extended projective coordinates, representing -// affine (x,y) by a quadruple (X,Y,Z,T) where x = X / Z, y = Y / Z -// and x * y = T / Z. The input p1 may also be in the same extended -// projective representation, but the final T field is not used so -// a more basic projective triple (X,Y,Z) suffices. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1 -// Microsoft x64 ABI: RCX = p3, RDX = p1 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_epdouble_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_epdouble_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_epdouble_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Registers used for inputs and outputs within basic operations. -// Here p1 and p3 are where the parameters come in anyway. - -#define p3 %rdi -#define p1 %rsi - -// Pointers to input and output coordinates - -#define x_1 0(p1) -#define y_1 NUMSIZE(p1) -#define z_1 (2*NUMSIZE)(p1) - -#define x_3 0(p3) -#define y_3 NUMSIZE(p3) -#define z_3 (2*NUMSIZE)(p3) -#define w_3 (3*NUMSIZE)(p3) - -// Pointer-offset pairs for temporaries on stack - -#define t0 (0*NUMSIZE)(%rsp) -#define t1 (1*NUMSIZE)(%rsp) -#define t2 (2*NUMSIZE)(%rsp) -#define t3 (3*NUMSIZE)(%rsp) -#define t4 (4*NUMSIZE)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 5*NUMSIZE - -// Macro wrapping up the basic field multiplication, only trivially -// different from a pure function call to bignum_mul_p25519_alt. - -#define mul_p25519(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %esi ; \ - movq %r12, %rax ; \ - mulq %rsi; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movl $0x13, %esi ; \ - bts $63, %r11 ; \ - imulq %rsi, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rsi, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - movq P1, %rax ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r11 ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r12 ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r14 ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r15 ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %ebx ; \ - movq %r12, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Plain 4-digit add without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq 8+P2, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq 16+P2, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq 24+P2, %rax ; \ - movq %rax, 24+P0 - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ebx, %ebx ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movl $38, %ecx ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - cmovncq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %rax ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %rax, 24+P0 - -// Modular addition and doubling with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ecx, %ecx ; \ - addq P2, %r8 ; \ - movq 0x8+P1, %r9 ; \ - adcq 0x8+P2, %r9 ; \ - movq 0x10+P1, %r10 ; \ - adcq 0x10+P2, %r10 ; \ - movq 0x18+P1, %r11 ; \ - adcq 0x18+P2, %r11 ; \ - movl $38, %eax ; \ - cmovncq %rcx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -#define double_twice4(P0,P1) \ - movq P1, %r8 ; \ - xorl %ecx, %ecx ; \ - addq %r8, %r8 ; \ - movq 0x8+P1, %r9 ; \ - adcq %r9, %r9 ; \ - movq 0x10+P1, %r10 ; \ - adcq %r10, %r10 ; \ - movq 0x18+P1, %r11 ; \ - adcq %r11, %r11 ; \ - movl $38, %eax ; \ - cmovncq %rcx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -S2N_BN_SYMBOL(edwards25519_epdouble_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers, make room for temps, preserve input arguments. - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main sequence - - add_4(t0,x_1,y_1) - sqr_4(t1,z_1) - sqr_4(t2,x_1) - sqr_4(t3,y_1) - double_twice4(t1,t1) - sqr_4(t0,t0) - add_twice4(t4,t2,t3) - sub_twice4(t2,t2,t3) - add_twice4(t3,t1,t2) - sub_twice4(t1,t4,t0) - mul_p25519(y_3,t2,t4) - mul_p25519(z_3,t3,t2) - mul_p25519(w_3,t1,t4) - mul_p25519(x_3,t1,t3) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_epdouble_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pdouble.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pdouble.S deleted file mode 100644 index ccfdcfe4b59..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pdouble.S +++ /dev/null @@ -1,374 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Projective doubling for edwards25519 -// Input p1[12]; output p3[12] -// -// extern void edwards25519_pdouble -// (uint64_t p3[static 12],const uint64_t p1[static 12]); -// -// If p1 is a point on edwards25519, returns its double p3 = 2 * p1. -// Input and output are in pure projective coordinates, representing -// an affine (x,y) by a triple (X,Y,Z) where x = X / Z, y = Y / Z. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1 -// Microsoft x64 ABI: RCX = p3, RDX = p1 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_pdouble) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_pdouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_pdouble) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Registers used for inputs and outputs within basic operations. -// Here p1 and p3 are where the parameters come in anyway. - -#define p3 %rdi -#define p1 %rsi - -// Pointers to input and output coordinates - -#define x_1 0(p1) -#define y_1 NUMSIZE(p1) -#define z_1 (2*NUMSIZE)(p1) - -#define x_3 0(p3) -#define y_3 NUMSIZE(p3) -#define z_3 (2*NUMSIZE)(p3) - -// Pointer-offset pairs for temporaries on stack - -#define t0 (0*NUMSIZE)(%rsp) -#define t1 (1*NUMSIZE)(%rsp) -#define t2 (2*NUMSIZE)(%rsp) -#define t3 (3*NUMSIZE)(%rsp) -#define t4 (4*NUMSIZE)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 5*NUMSIZE - -// Macro wrapping up the basic field multiplication, only trivially -// different from a pure function call to bignum_mul_p25519. - -#define mul_p25519(P0,P1,P2) \ - xorl %esi, %esi ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rsi, %r12 ; \ - xorl %esi, %esi ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rsi, %r13 ; \ - adcxq %rsi, %r13 ; \ - xorl %esi, %esi ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rsi, %r14 ; \ - adcxq %rsi, %r14 ; \ - xorl %esi, %esi ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rsi, %r15 ; \ - adcxq %rsi, %r15 ; \ - movl $0x26, %edx ; \ - xorl %esi, %esi ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rsi, %r12 ; \ - adcxq %rsi, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - movl $0x13, %edx ; \ - incq %r12; \ - bts $63, %r11 ; \ - mulxq %r12, %rax, %rbx ; \ - addq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rsi, %r10 ; \ - adcq %rsi, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rdx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rsi, %r9 ; \ - sbbq %rsi, %r10 ; \ - sbbq %rsi, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ebx, %ebx ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rbx, %r13 ; \ - adoxq %rbx, %r14 ; \ - adcq %rbx, %r14 ; \ - xorl %ebx, %ebx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rbx, %r15 ; \ - adoxq %rbx, %r15 ; \ - movl $0x26, %edx ; \ - xorl %ebx, %ebx ; \ - mulxq %r12, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq %r13, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq %r14, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - adcxq %rbx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Plain 4-digit add without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq 8+P2, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq 16+P2, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq 24+P2, %rax ; \ - movq %rax, 24+P0 - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ebx, %ebx ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movl $38, %ecx ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - cmovncq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %rax ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %rax, 24+P0 - -// Modular addition and doubling with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ecx, %ecx ; \ - addq P2, %r8 ; \ - movq 0x8+P1, %r9 ; \ - adcq 0x8+P2, %r9 ; \ - movq 0x10+P1, %r10 ; \ - adcq 0x10+P2, %r10 ; \ - movq 0x18+P1, %r11 ; \ - adcq 0x18+P2, %r11 ; \ - movl $38, %eax ; \ - cmovncq %rcx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -#define double_twice4(P0,P1) \ - movq P1, %r8 ; \ - xorl %ecx, %ecx ; \ - addq %r8, %r8 ; \ - movq 0x8+P1, %r9 ; \ - adcq %r9, %r9 ; \ - movq 0x10+P1, %r10 ; \ - adcq %r10, %r10 ; \ - movq 0x18+P1, %r11 ; \ - adcq %r11, %r11 ; \ - movl $38, %eax ; \ - cmovncq %rcx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -S2N_BN_SYMBOL(edwards25519_pdouble): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers, make room for temps, preserve input arguments. - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main sequence - - add_4(t0,x_1,y_1) - sqr_4(t1,z_1) - sqr_4(t2,x_1) - sqr_4(t3,y_1) - double_twice4(t1,t1) - sqr_4(t0,t0) - add_twice4(t4,t2,t3) - sub_twice4(t2,t2,t3) - add_twice4(t3,t1,t2) - sub_twice4(t1,t4,t0) - mul_p25519(y_3,t2,t4) - mul_p25519(z_3,t3,t2) - mul_p25519(x_3,t1,t3) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_pdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pdouble_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pdouble_alt.S deleted file mode 100644 index 2b4f995b194..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pdouble_alt.S +++ /dev/null @@ -1,453 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Projective doubling for edwards25519 -// Input p1[12]; output p3[12] -// -// extern void edwards25519_pdouble_alt -// (uint64_t p3[static 12],const uint64_t p1[static 12]); -// -// If p1 is a point on edwards25519, returns its double p3 = 2 * p1. -// Input and output are in pure projective coordinates, representing -// an affine (x,y) by a triple (X,Y,Z) where x = X / Z, y = Y / Z. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1 -// Microsoft x64 ABI: RCX = p3, RDX = p1 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_pdouble_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_pdouble_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_pdouble_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Registers used for inputs and outputs within basic operations. -// Here p1 and p3 are where the parameters come in anyway. - -#define p3 %rdi -#define p1 %rsi - -// Pointers to input and output coordinates - -#define x_1 0(p1) -#define y_1 NUMSIZE(p1) -#define z_1 (2*NUMSIZE)(p1) - -#define x_3 0(p3) -#define y_3 NUMSIZE(p3) -#define z_3 (2*NUMSIZE)(p3) - -// Pointer-offset pairs for temporaries on stack - -#define t0 (0*NUMSIZE)(%rsp) -#define t1 (1*NUMSIZE)(%rsp) -#define t2 (2*NUMSIZE)(%rsp) -#define t3 (3*NUMSIZE)(%rsp) -#define t4 (4*NUMSIZE)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 5*NUMSIZE - -// Macro wrapping up the basic field multiplication, only trivially -// different from a pure function call to bignum_mul_p25519_alt. - -#define mul_p25519(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %esi ; \ - movq %r12, %rax ; \ - mulq %rsi; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movl $0x13, %esi ; \ - bts $63, %r11 ; \ - imulq %rsi, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rsi, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Squaring just giving a result < 2 * p_25519, which is done by -// basically skipping the +1 in the quotient estimate and the final -// optional correction. - -#define sqr_4(P0,P1) \ - movq P1, %rax ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r11 ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r12 ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r14 ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r15 ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %ebx ; \ - movq %r12, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Plain 4-digit add without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq 8+P2, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq 16+P2, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq 24+P2, %rax ; \ - movq %rax, 24+P0 - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ebx, %ebx ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movl $38, %ecx ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - cmovncq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %rax ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %rax, 24+P0 - -// Modular addition and doubling with double modulus 2 * p_25519 = 2^256 - 38. -// This only ensures that the result fits in 4 digits, not that it is reduced -// even w.r.t. double modulus. The result is always correct modulo provided -// the sum of the inputs is < 2^256 + 2^256 - 38, so in particular provided -// at least one of them is reduced double modulo. - -#define add_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ecx, %ecx ; \ - addq P2, %r8 ; \ - movq 0x8+P1, %r9 ; \ - adcq 0x8+P2, %r9 ; \ - movq 0x10+P1, %r10 ; \ - adcq 0x10+P2, %r10 ; \ - movq 0x18+P1, %r11 ; \ - adcq 0x18+P2, %r11 ; \ - movl $38, %eax ; \ - cmovncq %rcx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -#define double_twice4(P0,P1) \ - movq P1, %r8 ; \ - xorl %ecx, %ecx ; \ - addq %r8, %r8 ; \ - movq 0x8+P1, %r9 ; \ - adcq %r9, %r9 ; \ - movq 0x10+P1, %r10 ; \ - adcq %r10, %r10 ; \ - movq 0x18+P1, %r11 ; \ - adcq %r11, %r11 ; \ - movl $38, %eax ; \ - cmovncq %rcx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -S2N_BN_SYMBOL(edwards25519_pdouble_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers, make room for temps, preserve input arguments. - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main sequence - - add_4(t0,x_1,y_1) - sqr_4(t1,z_1) - sqr_4(t2,x_1) - sqr_4(t3,y_1) - double_twice4(t1,t1) - sqr_4(t0,t0) - add_twice4(t4,t2,t3) - sub_twice4(t2,t2,t3) - add_twice4(t3,t1,t2) - sub_twice4(t1,t4,t0) - mul_p25519(y_3,t2,t4) - mul_p25519(z_3,t3,t2) - mul_p25519(x_3,t1,t3) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_pdouble_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pepadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pepadd.S deleted file mode 100644 index e0b04d28b98..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pepadd.S +++ /dev/null @@ -1,424 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended projective + precomputed mixed addition for edwards25519 -// Inputs p1[16], p2[12]; output p3[16] -// -// extern void edwards25519_pepadd -// (uint64_t p3[static 16],const uint64_t p1[static 16], -// const uint64_t p2[static 12]); -// -// The output p3 and the first input p1 are points (x,y) on edwards25519 -// represented in extended projective quadruples (X,Y,Z,T) where -// x = X / Z, y = Y / Z and x * y = T / Z. The second input p2 is a triple -// encoding its point (x,y) as (y - x,y + x,2 * d * x * y) where d is the -// usual Edwards curve parameter for edwards25519. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_pepadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_pepadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_pepadd) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Registers used for inputs and outputs within basic operations. -// Here p1 and p3 are where the parameters come in anyway; -// the p2 = %rbp assignment is set up at the beginning. - -#define p3 %rdi -#define p1 %rsi -#define p2 %rbp - -// Pointers to input and output coordinates - -#define x_1 0(p1) -#define y_1 NUMSIZE(p1) -#define z_1 (2*NUMSIZE)(p1) -#define w_1 (3*NUMSIZE)(p1) - -#define ymx_2 0(p2) -#define xpy_2 NUMSIZE(p2) -#define kxy_2 (2*NUMSIZE)(p2) - -#define x_3 0(p3) -#define y_3 NUMSIZE(p3) -#define z_3 (2*NUMSIZE)(p3) -#define w_3 (3*NUMSIZE)(p3) - -// Pointer-offset pairs for temporaries on stack - -#define t0 (0*NUMSIZE)(%rsp) -#define t1 (1*NUMSIZE)(%rsp) -#define t2 (2*NUMSIZE)(%rsp) -#define t3 (3*NUMSIZE)(%rsp) -#define t4 (4*NUMSIZE)(%rsp) -#define t5 (5*NUMSIZE)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 6*NUMSIZE - -// Macro wrapping up the basic field multiplication, only trivially -// different from a pure function call to bignum_mul_p25519. - -#define mul_p25519(P0,P1,P2) \ - xorl %esi, %esi ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rsi, %r12 ; \ - xorl %esi, %esi ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rsi, %r13 ; \ - adcxq %rsi, %r13 ; \ - xorl %esi, %esi ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rsi, %r14 ; \ - adcxq %rsi, %r14 ; \ - xorl %esi, %esi ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rsi, %r15 ; \ - adcxq %rsi, %r15 ; \ - movl $0x26, %edx ; \ - xorl %esi, %esi ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rsi, %r12 ; \ - adcxq %rsi, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - movl $0x13, %edx ; \ - incq %r12; \ - bts $63, %r11 ; \ - mulxq %r12, %rax, %rbx ; \ - addq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rsi, %r10 ; \ - adcq %rsi, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rdx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rsi, %r9 ; \ - sbbq %rsi, %r10 ; \ - sbbq %rsi, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - xorl %ecx, %ecx ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rcx, %r12 ; \ - xorl %ecx, %ecx ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rcx, %r13 ; \ - xorl %ecx, %ecx ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcxq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rcx, %r15 ; \ - adcxq %rcx, %r15 ; \ - movl $0x26, %edx ; \ - xorl %ecx, %ecx ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - adcxq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Plain 4-digit add and doubling without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq 8+P2, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq 16+P2, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq 24+P2, %rax ; \ - movq %rax, 24+P0 - -#define double_4(P0,P1) \ - movq P1, %rax ; \ - addq %rax, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq %rax, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq %rax, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq %rax, %rax ; \ - movq %rax, 24+P0 - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(P0,P1,P2) \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - subq $19, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq $0, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq $0, %rax ; \ - btc $63, %rax ; \ - movq %rax, 24+P0 - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ebx, %ebx ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movl $38, %ecx ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - cmovncq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %rax ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %rax, 24+P0 - -// Modular addition with inputs double modulus 2 * p_25519 = 2^256 - 38 -// and in general only guaranteeing a 4-digit result, not even < 2 * p_25519. - -#define add_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ecx, %ecx ; \ - addq P2, %r8 ; \ - movq 0x8+P1, %r9 ; \ - adcq 0x8+P2, %r9 ; \ - movq 0x10+P1, %r10 ; \ - adcq 0x10+P2, %r10 ; \ - movq 0x18+P1, %r11 ; \ - adcq 0x18+P2, %r11 ; \ - movl $38, %eax ; \ - cmovncq %rcx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -S2N_BN_SYMBOL(edwards25519_pepadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers, make room for temps, preserve input arguments. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main sequence of operations. after setting up p2 in its register - - movq %rdx, p2 - - double_4(t0,z_1); - - sub_4(t1,y_1,x_1); - add_4(t2,y_1,x_1); - - mul_4(t3,w_1,kxy_2); - - mul_4(t1,t1,ymx_2); - mul_4(t2,t2,xpy_2); - - sub_twice4(t4,t0,t3); - add_twice4(t0,t0,t3); - sub_twice4(t5,t2,t1); - add_twice4(t1,t2,t1); - - mul_p25519(z_3,t4,t0); - mul_p25519(x_3,t5,t4); - mul_p25519(y_3,t0,t1); - mul_p25519(w_3,t5,t1); - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_pepadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pepadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pepadd_alt.S deleted file mode 100644 index 9413a041a65..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/curve25519/edwards25519_pepadd_alt.S +++ /dev/null @@ -1,500 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended projective + precomputed mixed addition for edwards25519 -// Inputs p1[16], p2[12]; output p3[16] -// -// extern void edwards25519_pepadd_alt -// (uint64_t p3[static 16],const uint64_t p1[static 16], -// const uint64_t p2[static 12]); -// -// The output p3 and the first input p1 are points (x,y) on edwards25519 -// represented in extended projective quadruples (X,Y,Z,T) where -// x = X / Z, y = Y / Z and x * y = T / Z. The second input p2 is a triple -// encoding its point (x,y) as (y - x,y + x,2 * d * x * y) where d is the -// usual Edwards curve parameter for edwards25519. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(edwards25519_pepadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(edwards25519_pepadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(edwards25519_pepadd_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Registers used for inputs and outputs within basic operations. -// Here p1 and p3 are where the parameters come in anyway; -// the p2 = %rbp assignment is set up at the beginning. - -#define p3 %rdi -#define p1 %rsi -#define p2 %rbp - -// Pointers to input and output coordinates - -#define x_1 0(p1) -#define y_1 NUMSIZE(p1) -#define z_1 (2*NUMSIZE)(p1) -#define w_1 (3*NUMSIZE)(p1) - -#define ymx_2 0(p2) -#define xpy_2 NUMSIZE(p2) -#define kxy_2 (2*NUMSIZE)(p2) - -#define x_3 0(p3) -#define y_3 NUMSIZE(p3) -#define z_3 (2*NUMSIZE)(p3) -#define w_3 (3*NUMSIZE)(p3) - -// Pointer-offset pairs for temporaries on stack - -#define t0 (0*NUMSIZE)(%rsp) -#define t1 (1*NUMSIZE)(%rsp) -#define t2 (2*NUMSIZE)(%rsp) -#define t3 (3*NUMSIZE)(%rsp) -#define t4 (4*NUMSIZE)(%rsp) -#define t5 (5*NUMSIZE)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 6*NUMSIZE - -// Macro wrapping up the basic field multiplication, only trivially -// different from a pure function call to bignum_mul_p25519_alt. - -#define mul_p25519(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %esi ; \ - movq %r12, %rax ; \ - mulq %rsi; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rsi; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movl $0x13, %esi ; \ - bts $63, %r11 ; \ - imulq %rsi, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rsi, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - btr $63, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// A version of multiplication that only guarantees output < 2 * p_25519. -// This basically skips the +1 and final correction in quotient estimation. - -#define mul_4(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movl $0x26, %ebx ; \ - movq %r12, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - shldq $0x1, %r11, %r12 ; \ - btr $0x3f, %r11 ; \ - movl $0x13, %edx ; \ - imulq %r12, %rdx ; \ - addq %rdx, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Plain 4-digit add and doubling without any normalization -// With inputs < p_25519 (indeed < 2^255) it still gives a 4-digit result, -// indeed one < 2 * p_25519 for normalized inputs. - -#define add_4(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq 8+P2, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq 16+P2, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq 24+P2, %rax ; \ - movq %rax, 24+P0 - -#define double_4(P0,P1) \ - movq P1, %rax ; \ - addq %rax, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - adcq %rax, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - adcq %rax, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - adcq %rax, %rax ; \ - movq %rax, 24+P0 - -// Subtraction of a pair of numbers < p_25519 just sufficient -// to give a 4-digit result. It actually always does (x - z) + (2^255-19) -// which in turn is done by (x - z) - (2^255+19) discarding the 2^256 -// implicitly - -#define sub_4(P0,P1,P2) \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - subq $19, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq $0, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq $0, %rax ; \ - btc $63, %rax ; \ - movq %rax, 24+P0 - -// Modular subtraction with double modulus 2 * p_25519 = 2^256 - 38 - -#define sub_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ebx, %ebx ; \ - subq P2, %r8 ; \ - movq 8+P1, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movl $38, %ecx ; \ - movq 16+P1, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq 24+P1, %rax ; \ - sbbq 24+P2, %rax ; \ - cmovncq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %rax ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %rax, 24+P0 - -// Modular addition with inputs double modulus 2 * p_25519 = 2^256 - 38 -// and in general only guaranteeing a 4-digit result, not even < 2 * p_25519. - -#define add_twice4(P0,P1,P2) \ - movq P1, %r8 ; \ - xorl %ecx, %ecx ; \ - addq P2, %r8 ; \ - movq 0x8+P1, %r9 ; \ - adcq 0x8+P2, %r9 ; \ - movq 0x10+P1, %r10 ; \ - adcq 0x10+P2, %r10 ; \ - movq 0x18+P1, %r11 ; \ - adcq 0x18+P2, %r11 ; \ - movl $38, %eax ; \ - cmovncq %rcx, %rax ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -S2N_BN_SYMBOL(edwards25519_pepadd_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers, make room for temps, preserve input arguments. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main sequence of operations. after setting up p2 in its register - - movq %rdx, p2 - - double_4(t0,z_1); - - sub_4(t1,y_1,x_1); - add_4(t2,y_1,x_1); - - mul_4(t3,w_1,kxy_2); - - mul_4(t1,t1,ymx_2); - mul_4(t2,t2,xpy_2); - - sub_twice4(t4,t0,t3); - add_twice4(t0,t0,t3); - sub_twice4(t5,t2,t1); - add_twice4(t1,t2,t1); - - mul_p25519(z_3,t4,t0); - mul_p25519(x_3,t5,t4); - mul_p25519(y_3,t0,t1); - mul_p25519(w_3,t5,t1); - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(edwards25519_pepadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_emontredc_8n.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_emontredc_8n.S deleted file mode 100644 index 6770484f903..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_emontredc_8n.S +++ /dev/null @@ -1,426 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended Montgomery reduce in 8-digit blocks, results in input-output buffer -// Inputs z[2*k], m[k], w; outputs function return (extra result bit) and z[2*k] -// -// extern uint64_t bignum_emontredc_8n(uint64_t k, uint64_t *z, const uint64_t *m, -// uint64_t w); -// -// Functionally equivalent to bignum_emontredc (see that file for more detail). -// But in general assumes that the input k is a multiple of 8. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = m, RCX = w, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = m, R9 = w, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_emontredc_8n) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_emontredc_8n) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_emontredc_8n) - .text - -// Original input parameters are here - -#define z %rsi -#define w %rcx - -// This is copied in early once we stash away k - -#define m %rdi - -// A variable z pointer - -#define zz %rbp - -// Stack-based variables - -#define carry (%rsp) -#define innercount 8(%rsp) -#define outercount 16(%rsp) -#define k8m1 24(%rsp) - -// ----------------------------------------------------------------------------- -// Standard macros as used in pure multiplier arrays -// ----------------------------------------------------------------------------- - -// mulpadd i, j adds z[i] * rdx (now assumed = m[j]) into the window at i+j - -.macro mulpadd arg1,arg2 - mulxq 8*\arg1(z), %rax, %rbx -.if ((\arg1 + \arg2) % 8 == 0) - adcxq %rax, %r8 - adoxq %rbx, %r9 -.elseif ((\arg1 + \arg2) % 8 == 1) - adcxq %rax, %r9 - adoxq %rbx, %r10 -.elseif ((\arg1 + \arg2) % 8 == 2) - adcxq %rax, %r10 - adoxq %rbx, %r11 -.elseif ((\arg1 + \arg2) % 8 == 3) - adcxq %rax, %r11 - adoxq %rbx, %r12 -.elseif ((\arg1 + \arg2) % 8 == 4) - adcxq %rax, %r12 - adoxq %rbx, %r13 -.elseif ((\arg1 + \arg2) % 8 == 5) - adcxq %rax, %r13 - adoxq %rbx, %r14 -.elseif ((\arg1 + \arg2) % 8 == 6) - adcxq %rax, %r14 - adoxq %rbx, %r15 -.elseif ((\arg1 + \arg2) % 8 == 7) - adcxq %rax, %r15 - adoxq %rbx, %r8 -.endif - -.endm - -// addrow i adds z[i] + zz[0..7] * m[j] into the window - -.macro addrow arg1 - movq 8*\arg1(m), %rdx - xorl %eax, %eax // Get a known flag state - -.if (\arg1 % 8 == 0) - adoxq 8*\arg1(zz), %r8 -.elseif (\arg1 % 8 == 1) - adoxq 8*\arg1(zz), %r9 -.elseif (\arg1 % 8 == 2) - adoxq 8*\arg1(zz), %r10 -.elseif (\arg1 % 8 == 3) - adoxq 8*\arg1(zz), %r11 -.elseif (\arg1 % 8 == 4) - adoxq 8*\arg1(zz), %r12 -.elseif (\arg1 % 8 == 5) - adoxq 8*\arg1(zz), %r13 -.elseif (\arg1 % 8 == 6) - adoxq 8*\arg1(zz), %r14 -.elseif (\arg1 % 8 == 7) - adoxq 8*\arg1(zz), %r15 -.endif - - mulpadd 0, \arg1 - -.if (\arg1 % 8 == 0) - movq %r8, 8*\arg1(zz) - movl $0, %r8d -.elseif (\arg1 % 8 == 1) - movq %r9, 8*\arg1(zz) - movl $0, %r9d -.elseif (\arg1 % 8 == 2) - movq %r10, 8*\arg1(zz) - movl $0, %r10d -.elseif (\arg1 % 8 == 3) - movq %r11, 8*\arg1(zz) - movl $0, %r11d -.elseif (\arg1 % 8 == 4) - movq %r12, 8*\arg1(zz) - movl $0, %r12d -.elseif (\arg1 % 8 == 5) - movq %r13, 8*\arg1(zz) - movl $0, %r13d -.elseif (\arg1 % 8 == 6) - movq %r14, 8*\arg1(zz) - movl $0, %r14d -.elseif (\arg1 % 8 == 7) - movq %r15, 8*\arg1(zz) - movl $0, %r15d -.endif - - mulpadd 1, \arg1 - mulpadd 2, \arg1 - mulpadd 3, \arg1 - mulpadd 4, \arg1 - mulpadd 5, \arg1 - mulpadd 6, \arg1 - mulpadd 7, \arg1 - -.if (\arg1 % 8 == 0) - adcq $0, %r8 -.elseif (\arg1 % 8 == 1) - adcq $0, %r9 -.elseif (\arg1 % 8 == 2) - adcq $0, %r10 -.elseif (\arg1 % 8 == 3) - adcq $0, %r11 -.elseif (\arg1 % 8 == 4) - adcq $0, %r12 -.elseif (\arg1 % 8 == 5) - adcq $0, %r13 -.elseif (\arg1 % 8 == 6) - adcq $0, %r14 -.elseif (\arg1 % 8 == 7) - adcq $0, %r15 -.endif - - -.endm - -// ----------------------------------------------------------------------------- -// Anti-matter versions with z and m switched, and also not writing back the z -// words, but the inverses instead, *and* also adding in the z[0..7] at the -// beginning. The aim is to use this in Montgomery where we discover z[j] -// entries as we go along. -// ----------------------------------------------------------------------------- - -.macro mulpadda arg1,arg2 - mulxq 8*\arg1(m), %rax, %rbx -.if ((\arg1 + \arg2) % 8 == 0) - adcxq %rax, %r8 - adoxq %rbx, %r9 -.elseif ((\arg1 + \arg2) % 8 == 1) - adcxq %rax, %r9 - adoxq %rbx, %r10 -.elseif ((\arg1 + \arg2) % 8 == 2) - adcxq %rax, %r10 - adoxq %rbx, %r11 -.elseif ((\arg1 + \arg2) % 8 == 3) - adcxq %rax, %r11 - adoxq %rbx, %r12 -.elseif ((\arg1 + \arg2) % 8 == 4) - adcxq %rax, %r12 - adoxq %rbx, %r13 -.elseif ((\arg1 + \arg2) % 8 == 5) - adcxq %rax, %r13 - adoxq %rbx, %r14 -.elseif ((\arg1 + \arg2) % 8 == 6) - adcxq %rax, %r14 - adoxq %rbx, %r15 -.elseif ((\arg1 + \arg2) % 8 == 7) - adcxq %rax, %r15 - adoxq %rbx, %r8 -.endif - -.endm - -.macro adurowa arg1 - movq w, %rdx // Get the word-level modular inverse - xorl %eax, %eax // Get a known flag state -.if (\arg1 % 8 == 0) - mulxq %r8, %rdx, %rax -.elseif (\arg1 % 8 == 1) - mulxq %r9, %rdx, %rax -.elseif (\arg1 % 8 == 2) - mulxq %r10, %rdx, %rax -.elseif (\arg1 % 8 == 3) - mulxq %r11, %rdx, %rax -.elseif (\arg1 % 8 == 4) - mulxq %r12, %rdx, %rax -.elseif (\arg1 % 8 == 5) - mulxq %r13, %rdx, %rax -.elseif (\arg1 % 8 == 6) - mulxq %r14, %rdx, %rax -.elseif (\arg1 % 8 == 7) - mulxq %r15, %rdx, %rax -.endif - - movq %rdx, 8*\arg1(z) // Store multiplier word - - mulpadda 0, \arg1 - - // Note that the bottom reg of the window is zero by construction - // So it's safe just to use "mulpadda 7" here - - mulpadda 1, \arg1 - mulpadda 2, \arg1 - mulpadda 3, \arg1 - mulpadda 4, \arg1 - mulpadda 5, \arg1 - mulpadda 6, \arg1 - mulpadda 7, \arg1 // window lowest = 0 beforehand by construction - -.if (\arg1 % 8 == 0) - adcq $0, %r8 -.elseif (\arg1 % 8 == 1) - adcq $0, %r9 -.elseif (\arg1 % 8 == 2) - adcq $0, %r10 -.elseif (\arg1 % 8 == 3) - adcq $0, %r11 -.elseif (\arg1 % 8 == 4) - adcq $0, %r12 -.elseif (\arg1 % 8 == 5) - adcq $0, %r13 -.elseif (\arg1 % 8 == 6) - adcq $0, %r14 -.elseif (\arg1 % 8 == 7) - adcq $0, %r15 -.endif - -.endm - -.macro adurowza - movq w, %rdx // Get the word-level modular inverse - xorl %eax, %eax // Get a known flag state - - movq (z), %r8 // %r8 = zeroth word - mulxq %r8, %rdx, %rax // Compute multiplier word - movq %rdx, (z) // Store multiplier word - movq 8(z), %r9 - - mulpadda 0, 0 - movq 16(z), %r10 - mulpadda 1, 0 - movq 24(z), %r11 - mulpadda 2, 0 - movq 32(z), %r12 - mulpadda 3, 0 - movq 40(z), %r13 - mulpadda 4, 0 - movq 48(z), %r14 - mulpadda 5, 0 - movq 56(z), %r15 - mulpadda 6, 0 - mulpadda 7, 0 // r8 = 0 beforehand by construction - adcq $0, %r8 -.endm - -// ----------------------------------------------------------------------------- -// Hybrid top, doing an 8 block specially then multiple additional 8 blocks -// ----------------------------------------------------------------------------- - -// Multiply-add: z := z + x[i...i+7] * m - -.macro addrows - - adurowza - adurowa 1 - adurowa 2 - adurowa 3 - adurowa 4 - adurowa 5 - adurowa 6 - adurowa 7 - - movq z, zz - - movq k8m1, %rax - testq %rax, %rax - jz Lbignum_emontredc_8n_innerend - movq %rax, innercount -Lbignum_emontredc_8n_innerloop: - addq $64, zz - addq $64, m - addrow 0 - addrow 1 - addrow 2 - addrow 3 - addrow 4 - addrow 5 - addrow 6 - addrow 7 - subq $64, innercount - jnz Lbignum_emontredc_8n_innerloop - - movq k8m1, %rax -Lbignum_emontredc_8n_innerend: - subq %rax, m - - movq carry, %rbx - negq %rbx - adcq %r8, 64(z,%rax,1) - adcq %r9, 72(z,%rax,1) - adcq %r10, 80(z,%rax,1) - adcq %r11, 88(z,%rax,1) - adcq %r12, 96(z,%rax,1) - adcq %r13, 104(z,%rax,1) - adcq %r14, 112(z,%rax,1) - adcq %r15, 120(z,%rax,1) - movl $0, %eax - adcq $0, %rax - movq %rax, carry -.endm - -// ----------------------------------------------------------------------------- -// Main code. -// ----------------------------------------------------------------------------- - -S2N_BN_SYMBOL(bignum_emontredc_8n): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Pre-initialize the return value to 0 just in case of early exit below - - xorl %eax, %eax - -// Divide the input k by 8, and push k8m1 = (k/8 - 1)<<6 which is used as -// the scaled inner loop counter / pointer adjustment repeatedly. Also push -// k/8 itself which is here initializing the outer loop count. - - shrq $3, %rdi - jz Lbignum_emontredc_8n_end - - leaq -1(%rdi), %rbx - shlq $6, %rbx - CFI_PUSH(%rbx) - CFI_PUSH(%rdi) - -// Make space for two more variables, and set between-stages carry to 0 - - CFI_DEC_RSP(16) - movq $0, carry - -// Copy m into its main home - - movq %rdx, m - -// Now just systematically add in the rows - -Lbignum_emontredc_8n_outerloop: - addrows - addq $64, z - subq $1, outercount - jnz Lbignum_emontredc_8n_outerloop - -// Pop the carry-out "p", which was stored at [%rsp], put in %rax for return - - CFI_POP(%rax) - -// Adjust the stack - - CFI_INC_RSP(24) - -// Reset of epilog - -Lbignum_emontredc_8n_end: - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_emontredc_8n) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_kmul_16_32.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_kmul_16_32.S deleted file mode 100644 index d88725e6b16..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_kmul_16_32.S +++ /dev/null @@ -1,513 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[16], y[16]; output z[32]; temporary buffer t[>=32] -// -// extern void bignum_kmul_16_32(uint64_t z[static 32], -// const uint64_t x[static 16], -// const uint64_t y[static 16], -// uint64_t t[static 32]); -// -// In this x86 code the final temporary space argument t is unused, but -// it is retained in the prototype above for API consistency with ARM. -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y, RCX = t -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y, R9 = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_kmul_16_32) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_kmul_16_32) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_kmul_16_32) - .text - -// These parameters are kept where they come in - -#define z %rdi -#define x %rsi - -// This one gets moved to free up %rdx for muls - -#define y %rcx - -// Often used for zero - -#define zero %rbp -#define zeroe %ebp - -// mulpadd i, j adds x[i] * rdx (now assumed = y[j]) into the window at i+j - -.macro mulpadd arg1,arg2 - mulxq 8*\arg1(x), %rax, %rbx -.if ((\arg1 + \arg2) % 8 == 0) - adcxq %rax, %r8 - adoxq %rbx, %r9 -.elseif ((\arg1 + \arg2) % 8 == 1) - adcxq %rax, %r9 - adoxq %rbx, %r10 -.elseif ((\arg1 + \arg2) % 8 == 2) - adcxq %rax, %r10 - adoxq %rbx, %r11 -.elseif ((\arg1 + \arg2) % 8 == 3) - adcxq %rax, %r11 - adoxq %rbx, %r12 -.elseif ((\arg1 + \arg2) % 8 == 4) - adcxq %rax, %r12 - adoxq %rbx, %r13 -.elseif ((\arg1 + \arg2) % 8 == 5) - adcxq %rax, %r13 - adoxq %rbx, %r14 -.elseif ((\arg1 + \arg2) % 8 == 6) - adcxq %rax, %r14 - adoxq %rbx, %r15 -.elseif ((\arg1 + \arg2) % 8 == 7) - adcxq %rax, %r15 - adoxq %rbx, %r8 -.endif - -.endm - -// mulpade i, j adds x[i] * rdx (now assumed = y[j]) into the window at i+j -// but re-creates the top word assuming nothing to add there - -.macro mulpade arg1,arg2 -.if ((\arg1 + \arg2) % 8 == 0) - mulxq 8*\arg1(x), %rax, %r9 - adcxq %rax, %r8 - adoxq zero, %r9 -.elseif ((\arg1 + \arg2) % 8 == 1) - mulxq 8*\arg1(x), %rax, %r10 - adcxq %rax, %r9 - adoxq zero, %r10 -.elseif ((\arg1 + \arg2) % 8 == 2) - mulxq 8*\arg1(x), %rax, %r11 - adcxq %rax, %r10 - adoxq zero, %r11 -.elseif ((\arg1 + \arg2) % 8 == 3) - mulxq 8*\arg1(x), %rax, %r12 - adcxq %rax, %r11 - adoxq zero, %r12 -.elseif ((\arg1 + \arg2) % 8 == 4) - mulxq 8*\arg1(x), %rax, %r13 - adcxq %rax, %r12 - adoxq zero, %r13 -.elseif ((\arg1 + \arg2) % 8 == 5) - mulxq 8*\arg1(x), %rax, %r14 - adcxq %rax, %r13 - adoxq zero, %r14 -.elseif ((\arg1 + \arg2) % 8 == 6) - mulxq 8*\arg1(x), %rax, %r15 - adcxq %rax, %r14 - adoxq zero, %r15 -.elseif ((\arg1 + \arg2) % 8 == 7) - mulxq 8*\arg1(x), %rax, %r8 - adcxq %rax, %r15 - adoxq zero, %r8 -.endif - -.endm - -// addrow i adds z[i] + x[0..7] * y[i] into the window - -.macro addrow arg1 - movq 8*\arg1(y), %rdx - xorl zeroe, zeroe - -.if (\arg1 % 8 == 0) - adoxq 8*\arg1(z), %r8 -.elseif (\arg1 % 8 == 1) - adoxq 8*\arg1(z), %r9 -.elseif (\arg1 % 8 == 2) - adoxq 8*\arg1(z), %r10 -.elseif (\arg1 % 8 == 3) - adoxq 8*\arg1(z), %r11 -.elseif (\arg1 % 8 == 4) - adoxq 8*\arg1(z), %r12 -.elseif (\arg1 % 8 == 5) - adoxq 8*\arg1(z), %r13 -.elseif (\arg1 % 8 == 6) - adoxq 8*\arg1(z), %r14 -.elseif (\arg1 % 8 == 7) - adoxq 8*\arg1(z), %r15 -.endif - - mulpadd 0, \arg1 - -.if (\arg1 % 8 == 0) - movq %r8, 8*\arg1(z) -.elseif (\arg1 % 8 == 1) - movq %r9, 8*\arg1(z) -.elseif (\arg1 % 8 == 2) - movq %r10, 8*\arg1(z) -.elseif (\arg1 % 8 == 3) - movq %r11, 8*\arg1(z) -.elseif (\arg1 % 8 == 4) - movq %r12, 8*\arg1(z) -.elseif (\arg1 % 8 == 5) - movq %r13, 8*\arg1(z) -.elseif (\arg1 % 8 == 6) - movq %r14, 8*\arg1(z) -.elseif (\arg1 % 8 == 7) - movq %r15, 8*\arg1(z) -.endif - - mulpadd 1, \arg1 - mulpadd 2, \arg1 - mulpadd 3, \arg1 - mulpadd 4, \arg1 - mulpadd 5, \arg1 - mulpadd 6, \arg1 - mulpade 7, \arg1 - -.if (\arg1 % 8 == 0) - adcq zero, %r8 -.elseif (\arg1 % 8 == 1) - adcq zero, %r9 -.elseif (\arg1 % 8 == 2) - adcq zero, %r10 -.elseif (\arg1 % 8 == 3) - adcq zero, %r11 -.elseif (\arg1 % 8 == 4) - adcq zero, %r12 -.elseif (\arg1 % 8 == 5) - adcq zero, %r13 -.elseif (\arg1 % 8 == 6) - adcq zero, %r14 -.elseif (\arg1 % 8 == 7) - adcq zero, %r15 -.endif - -.endm - -// Special zero version of addrow, setting up the window from scratch - -.macro addrowz - movq (y), %rdx - xorl zeroe, zeroe - - mulxq (x), %rax, %r9 - adcq %rax, (z) - - mulxq 8(x), %rax, %r10 - adcq %rax, %r9 - - mulxq 16(x), %rax, %r11 - adcq %rax, %r10 - - mulxq 24(x), %rax, %r12 - adcq %rax, %r11 - - mulxq 32(x), %rax, %r13 - adcq %rax, %r12 - - mulxq 40(x), %rax, %r14 - adcq %rax, %r13 - - mulxq 48(x), %rax, %r15 - adcq %rax, %r14 - - mulxq 56(x), %rax, %r8 - adcq %rax, %r15 - - adcq zero, %r8 -.endm - -// This is a variant where we add the initial z[0..7] at the outset. -// This makes the initialization process a bit less wasteful. By doing -// a block of 8 we get the same effect except that we add z[0..7] -// -// adurow i adds 2^{7*64} * z[i+7] + x[0..7] * y[i] into the window - -.macro adurow arg1 - movq 8*\arg1(y), %rdx - xorl zeroe, zeroe - - mulpadd 0, \arg1 - -.if (\arg1 % 8 == 0) - movq %r8, 8*\arg1(z) -.elseif (\arg1 % 8 == 1) - movq %r9, 8*\arg1(z) -.elseif (\arg1 % 8 == 2) - movq %r10, 8*\arg1(z) -.elseif (\arg1 % 8 == 3) - movq %r11, 8*\arg1(z) -.elseif (\arg1 % 8 == 4) - movq %r12, 8*\arg1(z) -.elseif (\arg1 % 8 == 5) - movq %r13, 8*\arg1(z) -.elseif (\arg1 % 8 == 6) - movq %r14, 8*\arg1(z) -.elseif (\arg1 % 8 == 7) - movq %r15, 8*\arg1(z) -.endif - - mulpadd 1, \arg1 - mulpadd 2, \arg1 - mulpadd 3, \arg1 - mulpadd 4, \arg1 - mulpadd 5, \arg1 - mulpadd 6, \arg1 - mulpade 7, \arg1 - -.if (\arg1 % 8 == 0) - adcq zero, %r8 -.elseif (\arg1 % 8 == 1) - adcq zero, %r9 -.elseif (\arg1 % 8 == 2) - adcq zero, %r10 -.elseif (\arg1 % 8 == 3) - adcq zero, %r11 -.elseif (\arg1 % 8 == 4) - adcq zero, %r12 -.elseif (\arg1 % 8 == 5) - adcq zero, %r13 -.elseif (\arg1 % 8 == 6) - adcq zero, %r14 -.elseif (\arg1 % 8 == 7) - adcq zero, %r15 -.endif - -.endm - -// Special "adurow 0" case to do first stage - -.macro adurowz - movq (y), %rdx - xorl zeroe, zeroe - - movq (z), %r8 - movq 8(z), %r9 - - mulpadd 0, 0 - movq %r8, (z) - - movq 16(z), %r10 - mulpadd 1, 0 - movq 24(z), %r11 - mulpadd 2, 0 - movq 32(z), %r12 - mulpadd 3, 0 - movq 40(z), %r13 - mulpadd 4, 0 - movq 48(z), %r14 - mulpadd 5, 0 - movq 56(z), %r15 - mulpadd 6, 0 - - mulxq 56(x), %rax, %r8 - adcxq %rax, %r15 - adoxq zero, %r8 - adcxq zero, %r8 -.endm - -// Multiply-add: z := z + x[0..7] * y - -.macro addrows - adurowz - adurow 1 - adurow 2 - adurow 3 - adurow 4 - adurow 5 - adurow 6 - adurow 7 - addrow 8 - addrow 9 - addrow 10 - addrow 11 - addrow 12 - addrow 13 - addrow 14 - addrow 15 - - movq %r8, 128(z) - movq %r9, 136(z) - movq %r10, 144(z) - movq %r11, 152(z) - movq %r12, 160(z) - movq %r13, 168(z) - movq %r14, 176(z) - movq %r15, 184(z) - -.endm - -// mulrow i adds x[0..7] * y[i] into the window -// just like addrow but no addition of z[i] - -.macro mulrow arg1 - movq 8*\arg1(y), %rdx - xorl zeroe, zeroe - - mulpadd 0, \arg1 - -.if (\arg1 % 8 == 0) - movq %r8, 8*\arg1(z) -.elseif (\arg1 % 8 == 1) - movq %r9, 8*\arg1(z) -.elseif (\arg1 % 8 == 2) - movq %r10, 8*\arg1(z) -.elseif (\arg1 % 8 == 3) - movq %r11, 8*\arg1(z) -.elseif (\arg1 % 8 == 4) - movq %r12, 8*\arg1(z) -.elseif (\arg1 % 8 == 5) - movq %r13, 8*\arg1(z) -.elseif (\arg1 % 8 == 6) - movq %r14, 8*\arg1(z) -.elseif (\arg1 % 8 == 7) - movq %r15, 8*\arg1(z) -.endif - - mulpadd 1, \arg1 - mulpadd 2, \arg1 - mulpadd 3, \arg1 - mulpadd 4, \arg1 - mulpadd 5, \arg1 - mulpadd 6, \arg1 - mulpade 7, \arg1 - -.if (\arg1 % 8 == 0) - adcq zero, %r8 -.elseif (\arg1 % 8 == 1) - adcq zero, %r9 -.elseif (\arg1 % 8 == 2) - adcq zero, %r10 -.elseif (\arg1 % 8 == 3) - adcq zero, %r11 -.elseif (\arg1 % 8 == 4) - adcq zero, %r12 -.elseif (\arg1 % 8 == 5) - adcq zero, %r13 -.elseif (\arg1 % 8 == 6) - adcq zero, %r14 -.elseif (\arg1 % 8 == 7) - adcq zero, %r15 -.endif - - -.endm - -// Special zero version of mulrow, setting up the window from scratch - -.macro mulrowz - movq (y), %rdx - xorl zeroe, zeroe - - mulxq (x), %rax, %r9 - movq %rax, (z) - - mulxq 8(x), %rax, %r10 - adcxq %rax, %r9 - - mulxq 16(x), %rax, %r11 - adcxq %rax, %r10 - - mulxq 24(x), %rax, %r12 - adcxq %rax, %r11 - - mulxq 32(x), %rax, %r13 - adcxq %rax, %r12 - - mulxq 40(x), %rax, %r14 - adcxq %rax, %r13 - - mulxq 48(x), %rax, %r15 - adcxq %rax, %r14 - - mulxq 56(x), %rax, %r8 - adcxq %rax, %r15 - - adcq zero, %r8 -.endm - -// Multiply-add: z := x[0..7] * y plus window - -.macro mulrows - mulrowz - mulrow 1 - mulrow 2 - mulrow 3 - mulrow 4 - mulrow 5 - mulrow 6 - mulrow 7 - - mulrow 8 - mulrow 9 - mulrow 10 - mulrow 11 - mulrow 12 - mulrow 13 - mulrow 14 - mulrow 15 - - movq %r8, 128(z) - movq %r9, 136(z) - movq %r10, 144(z) - movq %r11, 152(z) - movq %r12, 160(z) - movq %r13, 168(z) - movq %r14, 176(z) - movq %r15, 184(z) - -.endm - - -S2N_BN_SYMBOL(bignum_kmul_16_32): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Move y into its permanent home, freeing up %rdx for its special role in muls - - movq %rdx, y - -// Do the zeroth row as a pure product then the next as multiply-add - - mulrows - - addq $64, z - addq $64, x - addrows - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_kmul_16_32) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_kmul_32_64.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_kmul_32_64.S deleted file mode 100644 index fcb73375b44..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_kmul_32_64.S +++ /dev/null @@ -1,1161 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[32], y[32]; output z[64]; temporary buffer t[>=96] -// -// extern void bignum_kmul_32_64(uint64_t z[static 64], -// const uint64_t x[static 32], -// const uint64_t y[static 32], -// uint64_t t[static 96]); -// -// This is a Karatsuba-style function multiplying half-sized results -// internally and using temporary buffer t for intermediate results. The size -// of 96 is an overstatement for compatibility with the ARM version; it -// actually only uses 65 elements of t (64 + 1 for a stashed sign). -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y, RCX = t -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y, R9 = t -// ----------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_kmul_32_64) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_kmul_32_64) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_kmul_32_64) - - - .text - -#define K 16 - -#define z %rdi -#define x %rsi -#define y %rcx - -#define s %r9 - -// We re-use the y variable to point at t later on, when this seems clearer - -#define t %rcx - -S2N_BN_SYMBOL(bignum_kmul_32_64): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Save callee-saved registers and also push t onto the stack; we'll -// use this space to back up both t and later z. Then move the y variable -// into its longer-term home for the first few stages. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_PUSH(%rcx) - movq %rdx, y - -// Multiply the low halves - - CFI_CALL(Lbignum_kmul_32_64_local_bignum_kmul_16_32) - -// Multiply the high halves - - leaq 16*K-0x40(%rdi), %rdi - leaq 8*K-0x40(%rsi), %rsi - leaq 8*K(%rcx), %rcx - CFI_CALL(Lbignum_kmul_32_64_local_bignum_kmul_16_32) - -// Establish %r8 as the t pointer and use the cell to back up z now - - movq (%rsp), %r8 - subq $16*K+0x40, %rdi - movq %rdi, (%rsp) - -// Form |x_lo - x_hi| starting at t - - movq -8*K-0x40(%rsi), %rax - subq -8*K-0x40+8*K(%rsi), %rax - movq %rax, (%r8) - .set I, 1 - .rep K-1 - movq -8*K-0x40+8*I(%rsi), %rax - sbbq -8*K-0x40+8*K+8*I(%rsi), %rax - movq %rax, 8*I(%r8) - .set I, (I+1) - .endr - - movl $0, %ebx - sbbq s, s // Maintain CF, set ZF for cmovs, record sign - - .set I, 0 - .rep K - movq 8*I(%r8), %rdx - movq %rdx, %rax - notq %rdx - cmovzq %rax, %rdx - adcxq %rbx, %rdx - movq %rdx, 8*I(%r8) - .set I, (I+1) - .endr - -// Form |y_hi - y_lo| (note opposite order) starting at t[K] - - movq -8*K+8*K(%rcx), %rax - subq -8*K(%rcx), %rax - movq %rax, 8*K(%r8) - .set I, 1 - .rep K-1 - movq -8*K+8*K+8*I(%rcx), %rax - sbbq -8*K+8*I(%rcx), %rax - movq %rax, 8*K+8*I(%r8) - .set I, (I+1) - .endr - - movl $0, %ebx - sbbq %rbp, %rbp // Maintain CF, set ZF for cmovs - - .set I, 0 - .rep K - movq 8*K+8*I(%r8), %rdx - movq %rdx, %rax - notq %rdx - cmovzq %rax, %rdx - adcxq %rbx, %rdx - movq %rdx, 8*K+8*I(%r8) - .set I, (I+1) - .endr - -// Stash the final sign with which to add things at t[4*K] - - xorq %rbp, s - movq s, 32*K(%r8) - -// Multiply the absolute differences, putting the result at t[2*K] -// This has the side-effect of putting t in the "right" register %rcx -// so after the load of z, we have both z and t pointers straight. - - movq %r8, %rcx - leaq 8*K(%r8), %rsi - leaq 16*K(%r8), %rdi - CFI_CALL(Lbignum_kmul_32_64_local_bignum_kmul_16_32) - movq (%rsp), z - -// Compose the middle parts [2,1] + [1,0] + [3,2], saving carry in %rbx. -// Put the sum at t, overwriting the absolute differences we no longer need. - - xorl %ebx, %ebx - .set I, 0 - .rep 2*K - movq 8*K+8*I(z), %rax - adcxq 8*I(z), %rax - adoxq 16*K+8*I(z), %rax - movq %rax, 8*I(t) - .set I, (I+1) - .endr - adoxq %rbx, %rbx - adcq $0, %rbx - -// Sign-aware addition or subtraction of the complicated term. -// We double-negate it to set CF/ZF while not spoiling its -// actual form: note that we eventually adcx to it below. - - movq 32*K(t), s - negq s - negq s - - .set I, 0 - .rep 2*K - movq 16*K+8*I(t), %rdx - movq %rdx, %rax - notq %rdx - cmovzq %rax, %rdx - adcxq 8*I(t), %rdx - movq %rdx, 8*K+8*I(z) - .set I, (I+1) - .endr - -// Bump the accumulated carry. This must end up >= 0 because it's the top -// word of a value of the form ... + h * h' + l * l' - (h - l) * (h' - l') >= 0 - - adcxq s, %rbx - -// Finally propagate the carry to the top part - - xorl %eax, %eax - addq %rbx, 24*K(z) - .set I, 1 - .rep K-1 - adcq %rax, 24*K+8*I(z) - .set I, (I+1) - .endr - -// Restore and return. The first pop is not needed for the ABI but -// we need to adjust the stack anyway so it seems reasonable. - - CFI_POP(%rcx) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -// Local copy of half-length subroutine. This has a slightly different -// interface, expecting y argument in %rcx directly, and not doing any -// save-restore of the other registers. It naturally moves z and x on by -// 0x40, which we compensate for when it is called by adjusting offsets. - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_kmul_32_64_local_bignum_kmul_16_32) - -Lbignum_kmul_32_64_local_bignum_kmul_16_32: - CFI_START - movq (%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %r9 - movq %rax, (%rdi) - mulxq 0x8(%rsi), %rax, %r10 - adcxq %rax, %r9 - mulxq 0x10(%rsi), %rax, %r11 - adcxq %rax, %r10 - mulxq 0x18(%rsi), %rax, %r12 - adcxq %rax, %r11 - mulxq 0x20(%rsi), %rax, %r13 - adcxq %rax, %r12 - mulxq 0x28(%rsi), %rax, %r14 - adcxq %rax, %r13 - mulxq 0x30(%rsi), %rax, %r15 - adcxq %rax, %r14 - mulxq 0x38(%rsi), %rax, %r8 - adcxq %rax, %r15 - adcq %rbp, %r8 - movq 0x8(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - movq %r9, 0x8(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x38(%rsi), %rax, %r9 - adcxq %rax, %r8 - adoxq %rbp, %r9 - adcq %rbp, %r9 - movq 0x10(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq %r10, 0x10(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x38(%rsi), %rax, %r10 - adcxq %rax, %r9 - adoxq %rbp, %r10 - adcq %rbp, %r10 - movq 0x18(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq %r11, 0x18(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x38(%rsi), %rax, %r11 - adcxq %rax, %r10 - adoxq %rbp, %r11 - adcq %rbp, %r11 - movq 0x20(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq %r12, 0x20(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x38(%rsi), %rax, %r12 - adcxq %rax, %r11 - adoxq %rbp, %r12 - adcq %rbp, %r12 - movq 0x28(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - movq %r13, 0x28(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x38(%rsi), %rax, %r13 - adcxq %rax, %r12 - adoxq %rbp, %r13 - adcq %rbp, %r13 - movq 0x30(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - movq %r14, 0x30(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x38(%rsi), %rax, %r14 - adcxq %rax, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - movq 0x38(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - movq %r15, 0x38(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x38(%rsi), %rax, %r15 - adcxq %rax, %r14 - adoxq %rbp, %r15 - adcq %rbp, %r15 - movq 0x40(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - movq %r8, 0x40(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x38(%rsi), %rax, %r8 - adcxq %rax, %r15 - adoxq %rbp, %r8 - adcq %rbp, %r8 - movq 0x48(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - movq %r9, 0x48(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x38(%rsi), %rax, %r9 - adcxq %rax, %r8 - adoxq %rbp, %r9 - adcq %rbp, %r9 - movq 0x50(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq %r10, 0x50(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x38(%rsi), %rax, %r10 - adcxq %rax, %r9 - adoxq %rbp, %r10 - adcq %rbp, %r10 - movq 0x58(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq %r11, 0x58(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x38(%rsi), %rax, %r11 - adcxq %rax, %r10 - adoxq %rbp, %r11 - adcq %rbp, %r11 - movq 0x60(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq %r12, 0x60(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x38(%rsi), %rax, %r12 - adcxq %rax, %r11 - adoxq %rbp, %r12 - adcq %rbp, %r12 - movq 0x68(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - movq %r13, 0x68(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x38(%rsi), %rax, %r13 - adcxq %rax, %r12 - adoxq %rbp, %r13 - adcq %rbp, %r13 - movq 0x70(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - movq %r14, 0x70(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x38(%rsi), %rax, %r14 - adcxq %rax, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - movq 0x78(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - movq %r15, 0x78(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x38(%rsi), %rax, %r15 - adcxq %rax, %r14 - adoxq %rbp, %r15 - adcq %rbp, %r15 - movq %r8, 0x80(%rdi) - movq %r9, 0x88(%rdi) - movq %r10, 0x90(%rdi) - movq %r11, 0x98(%rdi) - movq %r12, 0xa0(%rdi) - movq %r13, 0xa8(%rdi) - movq %r14, 0xb0(%rdi) - movq %r15, 0xb8(%rdi) - addq $0x40, %rdi - addq $0x40, %rsi - movq (%rcx), %rdx - xorl %ebp, %ebp - movq (%rdi), %r8 - movq 0x8(%rdi), %r9 - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - movq %r8, (%rdi) - movq 0x10(%rdi), %r10 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - movq 0x18(%rdi), %r11 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq 0x20(%rdi), %r12 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x28(%rdi), %r13 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq 0x30(%rdi), %r14 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - movq 0x38(%rdi), %r15 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x38(%rsi), %rax, %r8 - adcxq %rax, %r15 - adoxq %rbp, %r8 - adcxq %rbp, %r8 - movq 0x8(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - movq %r9, 0x8(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x38(%rsi), %rax, %r9 - adcxq %rax, %r8 - adoxq %rbp, %r9 - adcq %rbp, %r9 - movq 0x10(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq %r10, 0x10(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x38(%rsi), %rax, %r10 - adcxq %rax, %r9 - adoxq %rbp, %r10 - adcq %rbp, %r10 - movq 0x18(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq %r11, 0x18(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x38(%rsi), %rax, %r11 - adcxq %rax, %r10 - adoxq %rbp, %r11 - adcq %rbp, %r11 - movq 0x20(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq %r12, 0x20(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x38(%rsi), %rax, %r12 - adcxq %rax, %r11 - adoxq %rbp, %r12 - adcq %rbp, %r12 - movq 0x28(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - movq %r13, 0x28(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x38(%rsi), %rax, %r13 - adcxq %rax, %r12 - adoxq %rbp, %r13 - adcq %rbp, %r13 - movq 0x30(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - movq %r14, 0x30(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x38(%rsi), %rax, %r14 - adcxq %rax, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - movq 0x38(%rcx), %rdx - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - movq %r15, 0x38(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x38(%rsi), %rax, %r15 - adcxq %rax, %r14 - adoxq %rbp, %r15 - adcq %rbp, %r15 - movq 0x40(%rcx), %rdx - xorl %ebp, %ebp - adoxq 0x40(%rdi), %r8 - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - movq %r8, 0x40(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x38(%rsi), %rax, %r8 - adcxq %rax, %r15 - adoxq %rbp, %r8 - adcq %rbp, %r8 - movq 0x48(%rcx), %rdx - xorl %ebp, %ebp - adoxq 0x48(%rdi), %r9 - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - movq %r9, 0x48(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x38(%rsi), %rax, %r9 - adcxq %rax, %r8 - adoxq %rbp, %r9 - adcq %rbp, %r9 - movq 0x50(%rcx), %rdx - xorl %ebp, %ebp - adoxq 0x50(%rdi), %r10 - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq %r10, 0x50(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x38(%rsi), %rax, %r10 - adcxq %rax, %r9 - adoxq %rbp, %r10 - adcq %rbp, %r10 - movq 0x58(%rcx), %rdx - xorl %ebp, %ebp - adoxq 0x58(%rdi), %r11 - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq %r11, 0x58(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x38(%rsi), %rax, %r11 - adcxq %rax, %r10 - adoxq %rbp, %r11 - adcq %rbp, %r11 - movq 0x60(%rcx), %rdx - xorl %ebp, %ebp - adoxq 0x60(%rdi), %r12 - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq %r12, 0x60(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x38(%rsi), %rax, %r12 - adcxq %rax, %r11 - adoxq %rbp, %r12 - adcq %rbp, %r12 - movq 0x68(%rcx), %rdx - xorl %ebp, %ebp - adoxq 0x68(%rdi), %r13 - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - movq %r13, 0x68(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x38(%rsi), %rax, %r13 - adcxq %rax, %r12 - adoxq %rbp, %r13 - adcq %rbp, %r13 - movq 0x70(%rcx), %rdx - xorl %ebp, %ebp - adoxq 0x70(%rdi), %r14 - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - movq %r14, 0x70(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x38(%rsi), %rax, %r14 - adcxq %rax, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - movq 0x78(%rcx), %rdx - xorl %ebp, %ebp - adoxq 0x78(%rdi), %r15 - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - movq %r15, 0x78(%rdi) - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x30(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x38(%rsi), %rax, %r15 - adcxq %rax, %r14 - adoxq %rbp, %r15 - adcq %rbp, %r15 - movq %r8, 0x80(%rdi) - movq %r9, 0x88(%rdi) - movq %r10, 0x90(%rdi) - movq %r11, 0x98(%rdi) - movq %r12, 0xa0(%rdi) - movq %r13, 0xa8(%rdi) - movq %r14, 0xb0(%rdi) - movq %r15, 0xb8(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_kmul_32_64_local_bignum_kmul_16_32) - -S2N_BN_SIZE_DIRECTIVE(bignum_kmul_32_64) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_ksqr_16_32.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_ksqr_16_32.S deleted file mode 100644 index 6f92c71444a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_ksqr_16_32.S +++ /dev/null @@ -1,545 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[16]; output z[32]; temporary buffer t[>=24] -// -// extern void bignum_ksqr_16_32(uint64_t z[static 32], -// const uint64_t x[static 16], -// uint64_t t[static 24]); -// -// In this x86 code the final temporary space argument t is unused, but -// it is retained in the prototype above for API consistency with ARM. -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = t -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_ksqr_16_32) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_ksqr_16_32) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_ksqr_16_32) - .text - -#define z %rdi -#define x %rsi - -// A zero register - -#define zero %rbp -#define zeroe %ebp - -// ------------------------------------------------------------------------ -// mulpadd i, j adds rdx * x[i] into the window at the i+j point -// ------------------------------------------------------------------------ - -.macro mulpadd arg1,arg2 - mulxq 8*\arg1(x), %rax, %rcx -.if ((\arg1 + \arg2) % 8 == 0) - adcxq %rax, %r8 - adoxq %rcx, %r9 -.elseif ((\arg1 + \arg2) % 8 == 1) - adcxq %rax, %r9 - adoxq %rcx, %r10 -.elseif ((\arg1 + \arg2) % 8 == 2) - adcxq %rax, %r10 - adoxq %rcx, %r11 -.elseif ((\arg1 + \arg2) % 8 == 3) - adcxq %rax, %r11 - adoxq %rcx, %r12 -.elseif ((\arg1 + \arg2) % 8 == 4) - adcxq %rax, %r12 - adoxq %rcx, %r13 -.elseif ((\arg1 + \arg2) % 8 == 5) - adcxq %rax, %r13 - adoxq %rcx, %r14 -.elseif ((\arg1 + \arg2) % 8 == 6) - adcxq %rax, %r14 - adoxq %rcx, %r15 -.elseif ((\arg1 + \arg2) % 8 == 7) - adcxq %rax, %r15 - adoxq %rcx, %r8 -.endif - -.endm - -// ------------------------------------------------------------------------ -// mulpade i, j adds rdx * x[i] into the window at i+j -// but re-creates the top word assuming nothing to add there -// ------------------------------------------------------------------------ - -.macro mulpade arg1,arg2 -.if ((\arg1 + \arg2) % 8 == 0) - mulxq 8*\arg1(x), %rax, %r9 - adcxq %rax, %r8 - adoxq zero, %r9 -.elseif ((\arg1 + \arg2) % 8 == 1) - mulxq 8*\arg1(x), %rax, %r10 - adcxq %rax, %r9 - adoxq zero, %r10 -.elseif ((\arg1 + \arg2) % 8 == 2) - mulxq 8*\arg1(x), %rax, %r11 - adcxq %rax, %r10 - adoxq zero, %r11 -.elseif ((\arg1 + \arg2) % 8 == 3) - mulxq 8*\arg1(x), %rax, %r12 - adcxq %rax, %r11 - adoxq zero, %r12 -.elseif ((\arg1 + \arg2) % 8 == 4) - mulxq 8*\arg1(x), %rax, %r13 - adcxq %rax, %r12 - adoxq zero, %r13 -.elseif ((\arg1 + \arg2) % 8 == 5) - mulxq 8*\arg1(x), %rax, %r14 - adcxq %rax, %r13 - adoxq zero, %r14 -.elseif ((\arg1 + \arg2) % 8 == 6) - mulxq 8*\arg1(x), %rax, %r15 - adcxq %rax, %r14 - adoxq zero, %r15 -.elseif ((\arg1 + \arg2) % 8 == 7) - mulxq 8*\arg1(x), %rax, %r8 - adcxq %rax, %r15 - adoxq zero, %r8 -.endif - -.endm - -// ------------------------------------------------------------------------ -// addrow i,j adds z[i+j] + x[i..i+7] * x[j] into the window -// ------------------------------------------------------------------------ - -.macro addrow arg1,arg2 - movq 8*\arg2(x), %rdx - xorl zeroe, zeroe // Get a known flag state and give a zero reg - -.if ((\arg1 + \arg2) % 8 == 0) - adoxq 8*(\arg1+\arg2)(z), %r8 -.elseif ((\arg1 + \arg2) % 8 == 1) - adoxq 8*(\arg1+\arg2)(z), %r9 -.elseif ((\arg1 + \arg2) % 8 == 2) - adoxq 8*(\arg1+\arg2)(z), %r10 -.elseif ((\arg1 + \arg2) % 8 == 3) - adoxq 8*(\arg1+\arg2)(z), %r11 -.elseif ((\arg1 + \arg2) % 8 == 4) - adoxq 8*(\arg1+\arg2)(z), %r12 -.elseif ((\arg1 + \arg2) % 8 == 5) - adoxq 8*(\arg1+\arg2)(z), %r13 -.elseif ((\arg1 + \arg2) % 8 == 6) - adoxq 8*(\arg1+\arg2)(z), %r14 -.elseif ((\arg1 + \arg2) % 8 == 7) - adoxq 8*(\arg1+\arg2)(z), %r15 -.endif - - mulpadd \arg1, \arg2 - -.if ((\arg1 + \arg2) % 8 == 0) - movq %r8, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 1) - movq %r9, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 2) - movq %r10, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 3) - movq %r11, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 4) - movq %r12, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 5) - movq %r13, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 6) - movq %r14, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 7) - movq %r15, 8*(\arg1+\arg2)(z) -.endif - - mulpadd (\arg1+1), \arg2 - mulpadd (\arg1+2), \arg2 - mulpadd (\arg1+3), \arg2 - mulpadd (\arg1+4), \arg2 - mulpadd (\arg1+5), \arg2 - mulpade (\arg1+6), \arg2 - mulpade (\arg1+7), \arg2 - -.if ((\arg1 + \arg2) % 8 == 0) - adcxq zero, %r8 -.elseif ((\arg1 + \arg2) % 8 == 1) - adcxq zero, %r9 -.elseif ((\arg1 + \arg2) % 8 == 2) - adcxq zero, %r10 -.elseif ((\arg1 + \arg2) % 8 == 3) - adcxq zero, %r11 -.elseif ((\arg1 + \arg2) % 8 == 4) - adcxq zero, %r12 -.elseif ((\arg1 + \arg2) % 8 == 5) - adcxq zero, %r13 -.elseif ((\arg1 + \arg2) % 8 == 6) - adcxq zero, %r14 -.elseif ((\arg1 + \arg2) % 8 == 7) - adcxq zero, %r15 -.endif - - -.endm - - -// ------------------------------------------------------------------------ -// Adds off-diagonal part of x[i..i+7]^2 into the window, writes 0..7 back -// ------------------------------------------------------------------------ - -.macro sqr arg1 - - xorl zeroe, zeroe - -// Set up the initial window - - movq 16*\arg1+8(z), %r9 - movq 16*\arg1+16(z), %r10 - movq 16*\arg1+24(z), %r11 - movq 16*\arg1+32(z), %r12 - movq 16*\arg1+40(z), %r13 - movq 16*\arg1+48(z), %r14 - movq 16*\arg1+56(z), %r15 - -// Add in the first diagonal [%r8..%r10] + 2 wb = 10 + 20 + 30 + 40 + 50 + 60 + 70 - - movq 8*\arg1(x), %rdx - mulpadd (\arg1+1), (\arg1+0) - movq %r9, 16*\arg1+8(z) - mulpadd (\arg1+2), (\arg1+0) - movq %r10, 16*\arg1+16(z) - mulpadd (\arg1+3), (\arg1+0) - mulpadd (\arg1+4), (\arg1+0) - mulpadd (\arg1+5), (\arg1+0) - mulpadd (\arg1+6), (\arg1+0) - mulpade (\arg1+7), (\arg1+0) - adcxq zero, %r8 - -// Add in the next diagonal = 21 + 31 + 41 + 51 + 61 + 71 + 54 - - xorl zeroe, zeroe - movq 8*\arg1+8(x), %rdx - mulpadd (\arg1+2), (\arg1+1) - movq %r11, 16*\arg1+24(z) - mulpadd (\arg1+3), (\arg1+1) - movq %r12, 16*\arg1+32(z) - mulpadd (\arg1+4), (\arg1+1) - mulpadd (\arg1+5), (\arg1+1) - mulpadd (\arg1+6), (\arg1+1) - mulpade (\arg1+7), (\arg1+1) - movq 8*\arg1+32(x), %rdx - mulpade (\arg1+5), (\arg1+4) - adcxq zero, %r10 - -// And the next one = 32 + 42 + 52 + 62 + 72 + 64 + 65 - - xorl zeroe, zeroe - movq 8*\arg1+16(x), %rdx - mulpadd (\arg1+3), (\arg1+2) - movq %r13, 16*\arg1+40(z) - mulpadd (\arg1+4), (\arg1+2) - movq %r14, 16*\arg1+48(z) - mulpadd (\arg1+5), (\arg1+2) - mulpadd (\arg1+6), (\arg1+2) - mulpadd (\arg1+7), (\arg1+2) - movq 8*\arg1+48(x), %rdx - mulpade (\arg1+4), (\arg1+6) - mulpade (\arg1+5), (\arg1+6) - adcxq zero, %r12 - -// And the final one = 43 + 53 + 63 + 73 + 74 + 75 + 76 - - xorl zeroe, zeroe - movq 8*\arg1+24(x), %rdx - mulpadd (\arg1+4), (\arg1+3) - movq %r15, 16*\arg1+56(z) - mulpadd (\arg1+5), (\arg1+3) - mulpadd (\arg1+6), (\arg1+3) - mulpadd (\arg1+7), (\arg1+3) - movq 8*\arg1+56(x), %rdx - mulpadd (\arg1+4), (\arg1+7) - mulpade (\arg1+5), (\arg1+7) - mulpade (\arg1+6), (\arg1+7) - adcxq zero, %r14 -.endm - -// ------------------------------------------------------------------------ -// Multiply-add: z := z + x[i...i+7] * x -// ------------------------------------------------------------------------ - -.macro addrows arg1 - - sqr \arg1 - - .set I, (\arg1+8) -.rep (8-\arg1) - addrow \arg1, I - .set I, (I+1) -.endr - - movq %r8, 8*(16+\arg1)(z) - movq %r9, 8*(17+\arg1)(z) - movq %r10, 8*(18+\arg1)(z) - movq %r11, 8*(19+\arg1)(z) - movq %r12, 8*(20+\arg1)(z) - movq %r13, 8*(21+\arg1)(z) - movq %r14, 8*(22+\arg1)(z) -.endm - - -// ------------------------------------------------------------------------ -// mulrow i,j adds x[i..i+7] * x[j] into the window -// just like addrow but no addition of z[i+j] -// ------------------------------------------------------------------------ - -.macro mulrow arg1,arg2 - movq 8*\arg2(x), %rdx - xorl zeroe, zeroe // Get a known flag state and give a zero reg - - mulpadd \arg1, \arg2 - -.if ((\arg1 + \arg2) % 8 == 0) - movq %r8, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 1) - movq %r9, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 2) - movq %r10, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 3) - movq %r11, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 4) - movq %r12, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 5) - movq %r13, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 6) - movq %r14, 8*(\arg1+\arg2)(z) -.elseif ((\arg1 + \arg2) % 8 == 7) - movq %r15, 8*(\arg1+\arg2)(z) -.endif - - mulpadd (\arg1+1), \arg2 - mulpadd (\arg1+2), \arg2 - mulpadd (\arg1+3), \arg2 - mulpadd (\arg1+4), \arg2 - mulpadd (\arg1+5), \arg2 -.if ((\arg1 + \arg2) % 8 == 0) - mulpade (\arg1+6), \arg2 -.else - mulpadd (\arg1+6), \arg2 -.endif - - mulpade (\arg1+7), \arg2 - -.if ((\arg1 + \arg2) % 8 == 0) - adcxq zero, %r8 -.elseif ((\arg1 + \arg2) % 8 == 1) - adcxq zero, %r9 -.elseif ((\arg1 + \arg2) % 8 == 2) - adcxq zero, %r10 -.elseif ((\arg1 + \arg2) % 8 == 3) - adcxq zero, %r11 -.elseif ((\arg1 + \arg2) % 8 == 4) - adcxq zero, %r12 -.elseif ((\arg1 + \arg2) % 8 == 5) - adcxq zero, %r13 -.elseif ((\arg1 + \arg2) % 8 == 6) - adcxq zero, %r14 -.elseif ((\arg1 + \arg2) % 8 == 7) - adcxq zero, %r15 -.endif - - -.endm - -// ------------------------------------------------------------------------ -// Compute off-diagonal part of x[0..7]^2, write back 1..7 elements and -// set up the high part in the standard register window. DOES NOT WRITE z[0]! -// ------------------------------------------------------------------------ - -.macro sqrz - - xorl zeroe, zeroe - -// Set initial window [%r8..%r10] + 2 wb = 10 + 20 + 30 + 40 + 50 + 60 + 70 - - movq (x), %rdx - mulxq 8(x), %r9, %rax - movq %r9, 8(z) - mulxq 16(x), %r10, %rcx - adcxq %rax, %r10 - movq %r10, 16(z) - mulxq 24(x), %r11, %rax - adcxq %rcx, %r11 - mulxq 32(x), %r12, %rcx - adcxq %rax, %r12 - mulxq 40(x), %r13, %rax - adcxq %rcx, %r13 - mulxq 48(x), %r14, %rcx - adcxq %rax, %r14 - mulxq 56(x), %r15, %r8 - adcxq %rcx, %r15 - adcxq zero, %r8 - -// Add in the next diagonal = 21 + 31 + 41 + 51 + 61 + 71 + 54 - - xorl zeroe, zeroe - movq 8(x), %rdx - mulpadd 2, 1 - movq %r11, 24(z) - mulpadd 3, 1 - movq %r12, 32(z) - mulpadd 4, 1 - mulpadd 5, 1 - mulpadd 6, 1 - mulpade 7, 1 - movq 32(x), %rdx - mulpade 5, 4 - adcxq zero, %r10 - -// And the next one = 32 + 42 + 52 + 62 + 72 + 64 + 65 - - xorl zeroe, zeroe - movq 16(x), %rdx - mulpadd 3, 2 - movq %r13, 40(z) - mulpadd 4, 2 - movq %r14, 48(z) - mulpadd 5, 2 - mulpadd 6, 2 - mulpadd 7, 2 - movq 48(x), %rdx - mulpade 4, 6 - mulpade 5, 6 - adcxq zero, %r12 - -// And the final one = 43 + 53 + 63 + 73 + 74 + 75 + 76 - - xorl zeroe, zeroe - movq 24(x), %rdx - mulpadd 4, 3 - movq %r15, 56(z) - mulpadd 5, 3 - mulpadd 6, 3 - mulpadd 7, 3 - movq 56(x), %rdx - mulpadd 4, 7 - mulpade 5, 7 - mulpade 6, 7 - adcxq zero, %r14 -.endm - -// ------------------------------------------------------------------------ -// Multiply-add: z := x[0...7] * x off-diagonal elements -// ------------------------------------------------------------------------ - -.macro mulrows - sqrz - - .set I, 8 -.rep 8 - mulrow 0, I - .set I, (I+1) -.endr - - movq %r8, 128(z) - movq %r9, 136(z) - movq %r10, 144(z) - movq %r11, 152(z) - movq %r12, 160(z) - movq %r13, 168(z) - movq %r14, 176(z) - movq %r15, 184(z) -.endm - -// ------------------------------------------------------------------------ -// The actual code -// ------------------------------------------------------------------------ - - - -S2N_BN_SYMBOL(bignum_ksqr_16_32): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Now just systematically add in the rows to get all off-diagonal elements - - mulrows - addrows 8 - -// Double and add the diagonal elements. Note that z[0] was never written above - - xorl zeroe, zeroe - movq (x), %rdx - mulxq %rdx, %rax, %rcx - movq %rax, (z) - - movq 8(z), %rdx - adcxq %rdx, %rdx - adoxq %rcx, %rdx - movq %rdx, 8(z) - - .set I, 1 -.rep 14 - movq 8*I(x), %rdx - mulxq %rdx, %rax, %rcx - - movq 8*(2*I)(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 8*(2*I)(z) - - movq 8*(2*I+1)(z), %rdx - adcxq %rdx, %rdx - adoxq %rcx, %rdx - movq %rdx, 8*(2*I+1)(z) - .set I, (I+1) -.endr - - movq 8*I(x), %rdx - mulxq %rdx, %rax, %rcx - - movq 8*(2*I)(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 8*(2*I)(z) - - adcxq zero, %rcx - adoxq zero, %rcx - movq %rcx, 8*(2*I+1)(z) - .set I, (I+1) - - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_ksqr_16_32) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_ksqr_32_64.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_ksqr_32_64.S deleted file mode 100644 index 894601c8f1d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_ksqr_32_64.S +++ /dev/null @@ -1,809 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[32]; output z[64]; temporary buffer t[>=72] -// -// extern void bignum_ksqr_32_64(uint64_t z[static 64], -// const uint64_t x[static 32], -// uint64_t t[static 72]); -// -// This is a Karatsuba-style function squaring half-sized results -// and using temporary buffer t for intermediate results. The size of 72 -// is an overstatement for compatibility with the ARM version; it actually -// only uses 65 elements of t (64 + 1 for a suspended carry). -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = t -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_ksqr_32_64) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_ksqr_32_64) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_ksqr_32_64) - - .text - -#define K 16 - -#define z %rdi -#define x %rsi -#define t %rcx - -S2N_BN_SYMBOL(bignum_ksqr_32_64): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save callee-preserved registers once and for all at the outset -// Later we further reshuffle the input arguments to avoid extra saves - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Move the temp space pointer since we need %rdx for multiplications - - movq %rdx, t - -// Square the low half - - CFI_CALL(Lbignum_ksqr_32_64_local_bignum_sqr_16_32) - -// Square the high half; from here on x and z are modified - - leaq 8*K(x), x // input at x+8*K - leaq 16*K(z), z // result at z+16*K - CFI_CALL(Lbignum_ksqr_32_64_local_bignum_sqr_16_32) - -// Form |x_lo - x_hi|, stored at t - - movq -8*K(x), %rax - subq (x), %rax - movq %rax, (t) - .set I, 1 - .rep K-1 - movq -8*K+8*I(x), %rax - sbbq 8*I(x), %rax - movq %rax, 8*I(t) - .set I, (I+1) - .endr - - movl $0, %ebx - sbbq %rax, %rax // Maintain CF, set ZF for cmovs - - .set I, 0 - .rep K - movq 8*I(t), %rdx - movq %rdx, %rax - notq %rdx - adcxq %rbx, %rdx - cmovzq %rax, %rdx - movq %rdx, 8*I(t) - .set I, (I+1) - .endr - -// Compose the middle parts [2,1] + [1,0] + [3,2] -// Put the low half of this at t[K] and the top half in place at z[2*K]; a -// fully in-place version is awkward with the otherwise beneficial double -// carry chain. Stash the carry suspended from the 3k position at the end of -// the temp buffer t[4*K]. - - xorl %edx, %edx - .set I, 0 - .rep K - movq -16*K+8*K+8*I(z), %rax - adcxq -16*K+8*I(z), %rax - adoxq -16*K+16*K+8*I(z), %rax - movq %rax, 8*K+8*I(t) - .set I, (I+1) - .endr - - .rep K - movq -16*K+8*K+8*I(z), %rax - adcxq -16*K+8*I(z), %rax - adoxq -16*K+16*K+8*I(z), %rax - movq %rax, -16*K+8*K+8*I(z) - .set I, (I+1) - .endr - - adoxq %rdx, %rdx - adcq $0, %rdx - movq %rdx, 32*K(t) - -// Square the absolute difference, putting the result M at t[2*K]. -// This involves another shuffle so now t' = z_orig and x' = t_orig -// while z' points within the temp buffer to the product M itself - - movq t, x - leaq -16*K(z), t - leaq 16*K(x), z - CFI_CALL(Lbignum_ksqr_32_64_local_bignum_sqr_16_32) - -// Subtract M, pausing at the 3k position to bump down accumulated carry. -// The carry cannot go negative since it's the top word of a value -// of the form ... + h^2 + l^2 - (h - l)^2 >= 0 - - movq 8*K(x), %rax - subq (z), %rax - movq %rax, 8*K(t) - - .set I, 1 - - .rep (K-1) - movq 8*K+8*I(x), %rax - sbbq 8*I(z), %rax - movq %rax, 8*K+8*I(t) - .set I, (I+1) - .endr - - .rep K - movq 8*K+8*I(t), %rax - sbbq 8*I(z), %rax - movq %rax, 8*K+8*I(t) - .set I, (I+1) - .endr - - movq 32*K(x), %rdx - sbbq $0, %rdx - -// Finally propagate the carry to the top quarter - - xorl %eax, %eax - addq %rdx, 24*K(t) - .set I, 1 - .rep K-1 - adcq %rax, 24*K+8*I(t) - .set I, (I+1) - .endr - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -// Local copy of the half-length subroutine - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_ksqr_32_64_local_bignum_sqr_16_32) - -Lbignum_ksqr_32_64_local_bignum_sqr_16_32: - CFI_START - xorl %ebp, %ebp - movq (x), %rdx - mulxq 0x8(x), %r9, %rax - movq %r9, 0x8(z) - mulxq 0x10(x), %r10, %rbx - adcxq %rax, %r10 - movq %r10, 0x10(z) - mulxq 0x18(x), %r11, %rax - adcxq %rbx, %r11 - mulxq 0x20(x), %r12, %rbx - adcxq %rax, %r12 - mulxq 0x28(x), %r13, %rax - adcxq %rbx, %r13 - mulxq 0x30(x), %r14, %rbx - adcxq %rax, %r14 - mulxq 0x38(x), %r15, %r8 - adcxq %rbx, %r15 - adcxq %rbp, %r8 - xorl %ebp, %ebp - movq 0x8(x), %rdx - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq %r11, 0x18(z) - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq %r12, 0x20(z) - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x38(x), %rax, %r9 - adcxq %rax, %r8 - adoxq %rbp, %r9 - movq 0x20(x), %rdx - mulxq 0x28(x), %rax, %r10 - adcxq %rax, %r9 - adoxq %rbp, %r10 - adcxq %rbp, %r10 - xorl %ebp, %ebp - movq 0x10(x), %rdx - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - movq %r13, 0x28(z) - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - movq %r14, 0x30(z) - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x38(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - movq 0x30(x), %rdx - mulxq 0x20(x), %rax, %r11 - adcxq %rax, %r10 - adoxq %rbp, %r11 - mulxq 0x28(x), %rax, %r12 - adcxq %rax, %r11 - adoxq %rbp, %r12 - adcxq %rbp, %r12 - xorl %ebp, %ebp - movq 0x18(x), %rdx - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - movq %r15, 0x38(z) - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x38(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq 0x38(x), %rdx - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x28(x), %rax, %r13 - adcxq %rax, %r12 - adoxq %rbp, %r13 - mulxq 0x30(x), %rax, %r14 - adcxq %rax, %r13 - adoxq %rbp, %r14 - adcxq %rbp, %r14 - movq 0x40(x), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - movq %r8, 0x40(z) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x30(x), %rax, %r15 - adcxq %rax, %r14 - adoxq %rbp, %r15 - mulxq 0x38(x), %rax, %r8 - adcxq %rax, %r15 - adoxq %rbp, %r8 - adcxq %rbp, %r8 - movq 0x48(x), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - movq %r9, 0x48(z) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x38(x), %rax, %r9 - adcxq %rax, %r8 - adoxq %rbp, %r9 - adcxq %rbp, %r9 - movq 0x50(x), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq %r10, 0x50(z) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x38(x), %rax, %r10 - adcxq %rax, %r9 - adoxq %rbp, %r10 - adcxq %rbp, %r10 - movq 0x58(x), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq %r11, 0x58(z) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x38(x), %rax, %r11 - adcxq %rax, %r10 - adoxq %rbp, %r11 - adcxq %rbp, %r11 - movq 0x60(x), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq %r12, 0x60(z) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x38(x), %rax, %r12 - adcxq %rax, %r11 - adoxq %rbp, %r12 - adcxq %rbp, %r12 - movq 0x68(x), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - movq %r13, 0x68(z) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x38(x), %rax, %r13 - adcxq %rax, %r12 - adoxq %rbp, %r13 - adcxq %rbp, %r13 - movq 0x70(x), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - movq %r14, 0x70(z) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x38(x), %rax, %r14 - adcxq %rax, %r13 - adoxq %rbp, %r14 - adcxq %rbp, %r14 - movq 0x78(x), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - movq %r15, 0x78(z) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x38(x), %rax, %r15 - adcxq %rax, %r14 - adoxq %rbp, %r15 - adcxq %rbp, %r15 - movq %r8, 0x80(z) - movq %r9, 0x88(z) - movq %r10, 0x90(z) - movq %r11, 0x98(z) - movq %r12, 0xa0(z) - movq %r13, 0xa8(z) - movq %r14, 0xb0(z) - movq %r15, 0xb8(z) - xorl %ebp, %ebp - movq 0x88(z), %r9 - movq 0x90(z), %r10 - movq 0x98(z), %r11 - movq 0xa0(z), %r12 - movq 0xa8(z), %r13 - movq 0xb0(z), %r14 - movq 0xb8(z), %r15 - movq 0x40(x), %rdx - mulxq 0x48(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - movq %r9, 0x88(z) - mulxq 0x50(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq %r10, 0x90(z) - mulxq 0x58(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x60(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x68(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x70(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x78(x), %rax, %r8 - adcxq %rax, %r15 - adoxq %rbp, %r8 - adcxq %rbp, %r8 - xorl %ebp, %ebp - movq 0x48(x), %rdx - mulxq 0x50(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq %r11, 0x98(z) - mulxq 0x58(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq %r12, 0xa0(z) - mulxq 0x60(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x68(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x70(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x78(x), %rax, %r9 - adcxq %rax, %r8 - adoxq %rbp, %r9 - movq 0x60(x), %rdx - mulxq 0x68(x), %rax, %r10 - adcxq %rax, %r9 - adoxq %rbp, %r10 - adcxq %rbp, %r10 - xorl %ebp, %ebp - movq 0x50(x), %rdx - mulxq 0x58(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - movq %r13, 0xa8(z) - mulxq 0x60(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - movq %r14, 0xb0(z) - mulxq 0x68(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x70(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x78(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - movq 0x70(x), %rdx - mulxq 0x60(x), %rax, %r11 - adcxq %rax, %r10 - adoxq %rbp, %r11 - mulxq 0x68(x), %rax, %r12 - adcxq %rax, %r11 - adoxq %rbp, %r12 - adcxq %rbp, %r12 - xorl %ebp, %ebp - movq 0x58(x), %rdx - mulxq 0x60(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - movq %r15, 0xb8(z) - mulxq 0x68(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x70(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x78(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq 0x78(x), %rdx - mulxq 0x60(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(x), %rax, %r13 - adcxq %rax, %r12 - adoxq %rbp, %r13 - mulxq 0x70(x), %rax, %r14 - adcxq %rax, %r13 - adoxq %rbp, %r14 - adcxq %rbp, %r14 - movq %r8, 0xc0(z) - movq %r9, 0xc8(z) - movq %r10, 0xd0(z) - movq %r11, 0xd8(z) - movq %r12, 0xe0(z) - movq %r13, 0xe8(z) - movq %r14, 0xf0(z) - xorl %ebp, %ebp - movq (x), %rdx - mulxq %rdx, %rax, %rbx - movq %rax, (z) - movq 0x8(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0x8(z) - movq 0x8(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0x10(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0x10(z) - movq 0x18(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0x18(z) - movq 0x10(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0x20(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0x20(z) - movq 0x28(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0x28(z) - movq 0x18(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0x30(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0x30(z) - movq 0x38(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0x38(z) - movq 0x20(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0x40(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0x40(z) - movq 0x48(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0x48(z) - movq 0x28(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0x50(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0x50(z) - movq 0x58(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0x58(z) - movq 0x30(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0x60(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0x60(z) - movq 0x68(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0x68(z) - movq 0x38(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0x70(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0x70(z) - movq 0x78(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0x78(z) - movq 0x40(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0x80(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0x80(z) - movq 0x88(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0x88(z) - movq 0x48(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0x90(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0x90(z) - movq 0x98(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0x98(z) - movq 0x50(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0xa0(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0xa0(z) - movq 0xa8(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0xa8(z) - movq 0x58(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0xb0(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0xb0(z) - movq 0xb8(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0xb8(z) - movq 0x60(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0xc0(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0xc0(z) - movq 0xc8(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0xc8(z) - movq 0x68(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0xd0(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0xd0(z) - movq 0xd8(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0xd8(z) - movq 0x70(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0xe0(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0xe0(z) - movq 0xe8(z), %rdx - adcxq %rdx, %rdx - adoxq %rbx, %rdx - movq %rdx, 0xe8(z) - movq 0x78(x), %rdx - mulxq %rdx, %rax, %rbx - movq 0xf0(z), %rdx - adcxq %rdx, %rdx - adoxq %rax, %rdx - movq %rdx, 0xf0(z) - adcxq %rbp, %rbx - adoxq %rbp, %rbx - movq %rbx, 0xf8(z) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_ksqr_32_64_local_bignum_sqr_16_32) - -S2N_BN_SIZE_DIRECTIVE(bignum_ksqr_32_64) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_4_8.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_4_8.S deleted file mode 100644 index 81212cc0d66..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_4_8.S +++ /dev/null @@ -1,178 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[4], y[4]; output z[8] -// -// extern void bignum_mul_4_8(uint64_t z[static 8], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_4_8) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_4_8) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_4_8) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// Copied in or set up - -#define y %rcx - -// A zero register - -#define zero %rbp -#define zeroe %ebp - -// Add in x[i] * %rdx to the (i,i+1) position with the register window -// Would be nice to have conditional expressions reg[i], reg[i+1] ... - -.macro mulpadd arg1,arg2 - mulxq 8*\arg2(x), %rax, %rbx -.if ((\arg1 + \arg2) % 4 == 0) - adcxq %rax, %r8 - adoxq %rbx, %r9 -.elseif ((\arg1 + \arg2) % 4 == 1) - adcxq %rax, %r9 - adoxq %rbx, %r10 -.elseif ((\arg1 + \arg2) % 4 == 2) - adcxq %rax, %r10 - adoxq %rbx, %r11 -.elseif ((\arg1 + \arg2) % 4 == 3) - adcxq %rax, %r11 - adoxq %rbx, %r8 -.endif - -.endm - - -// Add in the whole j'th row - -.macro addrow arg1 - movq 8*\arg1(y), %rdx - xorl zeroe, zeroe - - mulpadd \arg1, 0 - -.if (\arg1 % 4 == 0) - movq %r8, 8*\arg1(z) -.elseif (\arg1 % 4 == 1) - movq %r9, 8*\arg1(z) -.elseif (\arg1 % 4 == 2) - movq %r10, 8*\arg1(z) -.elseif (\arg1 % 4 == 3) - movq %r11, 8*\arg1(z) -.endif - - mulpadd \arg1, 1 - mulpadd \arg1, 2 - -.if (\arg1 % 4 == 0) - mulxq 24(x), %rax, %r8 - adcxq %rax, %r11 - adoxq zero, %r8 - adcxq zero, %r8 -.elseif (\arg1 % 4 == 1) - mulxq 24(x), %rax, %r9 - adcxq %rax, %r8 - adoxq zero, %r9 - adcxq zero, %r9 -.elseif (\arg1 % 4 == 2) - mulxq 24(x), %rax, %r10 - adcxq %rax, %r9 - adoxq zero, %r10 - adcxq zero, %r10 -.elseif (\arg1 % 4 == 3) - mulxq 24(x), %rax, %r11 - adcxq %rax, %r10 - adoxq zero, %r11 - adcxq zero, %r11 -.endif - -.endm - - - -S2N_BN_SYMBOL(bignum_mul_4_8): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Zero a register, which also makes sure we don't get a fake carry-in - - xorl zeroe, zeroe - -// Do the zeroth row, which is a bit different -// Write back the zero-zero product and then accumulate -// %r8,%r11,%r10,%r9 as y[0] * x from 1..4 - - movq (y), %rdx - - mulxq (x), %r8, %r9 - movq %r8, (z) - - mulxq 8(x), %rbx, %r10 - adcxq %rbx, %r9 - - mulxq 16(x), %rbx, %r11 - adcxq %rbx, %r10 - - mulxq 24(x), %rbx, %r8 - adcxq %rbx, %r11 - adcxq zero, %r8 - -// Now all the other rows in a uniform pattern - - addrow 1 - addrow 2 - addrow 3 - -// Now write back the additional columns - - movq %r8, 32(z) - movq %r9, 40(z) - movq %r10, 48(z) - movq %r11, 56(z) - -// Restore registers and return - - CFI_POP(%rbx) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_4_8) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_4_8_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_4_8_alt.S deleted file mode 100644 index b7617601e72..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_4_8_alt.S +++ /dev/null @@ -1,150 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[4], y[4]; output z[8] -// -// extern void bignum_mul_4_8_alt(uint64_t z[static 8], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_4_8_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_4_8_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_4_8_alt) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// This is moved from %rdx to free it for muls - -#define y %rcx - -// Other variables used as a rotating 3-word window to add terms to - -#define t0 %r8 -#define t1 %r9 -#define t2 %r10 - -// Macro for the key "multiply and add to (c,h,l)" step - -#define combadd(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A minutely shorter form for when c = 0 initially - -#define combadz(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq c, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h - -S2N_BN_SYMBOL(bignum_mul_4_8_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Copy y into a safe register to start with - - movq %rdx, y - -// Result term 0 - - movq (x), %rax - mulq (y) - - movq %rax, (z) - movq %rdx, t0 - xorq t1, t1 - -// Result term 1 - - xorq t2, t2 - combads(t1,t0,(x),8(y)) - combadz(t2,t1,t0,8(x),(y)) - movq t0, 8(z) - -// Result term 2 - - xorq t0, t0 - combadz(t0,t2,t1,(x),16(y)) - combadd(t0,t2,t1,8(x),8(y)) - combadd(t0,t2,t1,16(x),(y)) - movq t1, 16(z) - -// Result term 3 - - xorq t1, t1 - combadz(t1,t0,t2,(x),24(y)) - combadd(t1,t0,t2,8(x),16(y)) - combadd(t1,t0,t2,16(x),8(y)) - combadd(t1,t0,t2,24(x),(y)) - movq t2, 24(z) - -// Result term 4 - - xorq t2, t2 - combadz(t2,t1,t0,8(x),24(y)) - combadd(t2,t1,t0,16(x),16(y)) - combadd(t2,t1,t0,24(x),8(y)) - movq t0, 32(z) - -// Result term 5 - - xorq t0, t0 - combadz(t0,t2,t1,16(x),24(y)) - combadd(t0,t2,t1,24(x),16(y)) - movq t1, 40(z) - -// Result term 6 - - xorq t1, t1 - combads(t0,t2,24(x),24(y)) - movq t2, 48(z) - -// Result term 7 - - movq t0, 56(z) - -// Return - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_4_8_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_6_12.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_6_12.S deleted file mode 100644 index a4dc1690d5d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_6_12.S +++ /dev/null @@ -1,214 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[6], y[6]; output z[12] -// -// extern void bignum_mul_6_12(uint64_t z[static 12], const uint64_t x[static 6], -// const uint64_t y[static 6]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_6_12) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_6_12) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_6_12) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// Copied in or set up - -#define y %rcx - -// A zero register - -#define zero %rbp -#define zeroe %ebp - -// Add in x[i] * %rdx to the (i,i+1) position with the register window -// Would be nice to have conditional expressions reg[i], reg[i+1] ... - -.macro mulpadd arg1,arg2 - mulxq 8*\arg2(x), %rax, %rbx -.if ((\arg1 + \arg2) % 6 == 0) - adcxq %rax, %r8 - adoxq %rbx, %r9 -.elseif ((\arg1 + \arg2) % 6 == 1) - adcxq %rax, %r9 - adoxq %rbx, %r10 -.elseif ((\arg1 + \arg2) % 6 == 2) - adcxq %rax, %r10 - adoxq %rbx, %r11 -.elseif ((\arg1 + \arg2) % 6 == 3) - adcxq %rax, %r11 - adoxq %rbx, %r12 -.elseif ((\arg1 + \arg2) % 6 == 4) - adcxq %rax, %r12 - adoxq %rbx, %r13 -.elseif ((\arg1 + \arg2) % 6 == 5) - adcxq %rax, %r13 - adoxq %rbx, %r8 -.endif - -.endm - - -// Add in the whole j'th row - -.macro addrow arg1 - movq 8*\arg1(y), %rdx - xorl zeroe, zeroe - - mulpadd \arg1, 0 - -.if (\arg1 % 6 == 0) - movq %r8, 8*\arg1(z) -.elseif (\arg1 % 6 == 1) - movq %r9, 8*\arg1(z) -.elseif (\arg1 % 6 == 2) - movq %r10, 8*\arg1(z) -.elseif (\arg1 % 6 == 3) - movq %r11, 8*\arg1(z) -.elseif (\arg1 % 6 == 4) - movq %r12, 8*\arg1(z) -.elseif (\arg1 % 6 == 5) - movq %r13, 8*\arg1(z) -.endif - - mulpadd \arg1, 1 - mulpadd \arg1, 2 - mulpadd \arg1, 3 - mulpadd \arg1, 4 - -.if (\arg1 % 6 == 0) - mulxq 40(x), %rax, %r8 - adcxq %rax, %r13 - adoxq zero, %r8 - adcxq zero, %r8 -.elseif (\arg1 % 6 == 1) - mulxq 40(x), %rax, %r9 - adcxq %rax, %r8 - adoxq zero, %r9 - adcxq zero, %r9 -.elseif (\arg1 % 6 == 2) - mulxq 40(x), %rax, %r10 - adcxq %rax, %r9 - adoxq zero, %r10 - adcxq zero, %r10 -.elseif (\arg1 % 6 == 3) - mulxq 40(x), %rax, %r11 - adcxq %rax, %r10 - adoxq zero, %r11 - adcxq zero, %r11 -.elseif (\arg1 % 6 == 4) - mulxq 40(x), %rax, %r12 - adcxq %rax, %r11 - adoxq zero, %r12 - adcxq zero, %r12 -.elseif (\arg1 % 6 == 5) - mulxq 40(x), %rax, %r13 - adcxq %rax, %r12 - adoxq zero, %r13 - adcxq zero, %r13 -.endif - -.endm - - - -S2N_BN_SYMBOL(bignum_mul_6_12): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Zero a register, which also makes sure we don't get a fake carry-in - - xorl zeroe, zeroe - -// Do the zeroth row, which is a bit different -// Write back the zero-zero product and then accumulate -// %r8,%r13,%r12,%r11,%r10,%r9 as y[0] * x from 1..6 - - movq (y), %rdx - - mulxq (x), %r8, %r9 - movq %r8, (z) - - mulxq 8(x), %rbx, %r10 - adcxq %rbx, %r9 - - mulxq 16(x), %rbx, %r11 - adcxq %rbx, %r10 - - mulxq 24(x), %rbx, %r12 - adcxq %rbx, %r11 - - mulxq 32(x), %rbx, %r13 - adcxq %rbx, %r12 - - mulxq 40(x), %rbx, %r8 - adcxq %rbx, %r13 - adcxq zero, %r8 - -// Now all the other rows in a uniform pattern - - addrow 1 - addrow 2 - addrow 3 - addrow 4 - addrow 5 - -// Now write back the additional columns - - movq %r8, 48(z) - movq %r9, 56(z) - movq %r10, 64(z) - movq %r11, 72(z) - movq %r12, 80(z) - movq %r13, 88(z) - -// Restore registers and return - - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_6_12) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_6_12_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_6_12_alt.S deleted file mode 100644 index 1357eaa50ab..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_6_12_alt.S +++ /dev/null @@ -1,190 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[6], y[6]; output z[12] -// -// extern void bignum_mul_6_12_alt(uint64_t z[static 12], -// const uint64_t x[static 6], -// const uint64_t y[static 6]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_6_12_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_6_12_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_6_12_alt) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// This is moved from %rdx to free it for muls - -#define y %rcx - -// Other variables used as a rotating 3-word window to add terms to - -#define t0 %r8 -#define t1 %r9 -#define t2 %r10 - -// Macro for the key "multiply and add to (c,h,l)" step - -#define combadd(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A minutely shorter form for when c = 0 initially - -#define combadz(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq c, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h - -S2N_BN_SYMBOL(bignum_mul_6_12_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Copy y into a safe register to start with - - movq %rdx, y - -// Result term 0 - - movq (x), %rax - mulq (y) - - movq %rax, (z) - movq %rdx, t0 - xorq t1, t1 - -// Result term 1 - - xorq t2, t2 - combads(t1,t0,(x),8(y)) - combadz(t2,t1,t0,8(x),(y)) - movq t0, 8(z) - -// Result term 2 - - xorq t0, t0 - combadz(t0,t2,t1,(x),16(y)) - combadd(t0,t2,t1,8(x),8(y)) - combadd(t0,t2,t1,16(x),(y)) - movq t1, 16(z) - -// Result term 3 - - xorq t1, t1 - combadz(t1,t0,t2,(x),24(y)) - combadd(t1,t0,t2,8(x),16(y)) - combadd(t1,t0,t2,16(x),8(y)) - combadd(t1,t0,t2,24(x),(y)) - movq t2, 24(z) - -// Result term 4 - - xorq t2, t2 - combadz(t2,t1,t0,(x),32(y)) - combadd(t2,t1,t0,8(x),24(y)) - combadd(t2,t1,t0,16(x),16(y)) - combadd(t2,t1,t0,24(x),8(y)) - combadd(t2,t1,t0,32(x),(y)) - movq t0, 32(z) - -// Result term 5 - - xorq t0, t0 - combadz(t0,t2,t1,(x),40(y)) - combadd(t0,t2,t1,8(x),32(y)) - combadd(t0,t2,t1,16(x),24(y)) - combadd(t0,t2,t1,24(x),16(y)) - combadd(t0,t2,t1,32(x),8(y)) - combadd(t0,t2,t1,40(x),(y)) - movq t1, 40(z) - -// Result term 6 - - xorq t1, t1 - combadz(t1,t0,t2,8(x),40(y)) - combadd(t1,t0,t2,16(x),32(y)) - combadd(t1,t0,t2,24(x),24(y)) - combadd(t1,t0,t2,32(x),16(y)) - combadd(t1,t0,t2,40(x),8(y)) - movq t2, 48(z) - -// Result term 7 - - xorq t2, t2 - combadz(t2,t1,t0,16(x),40(y)) - combadd(t2,t1,t0,24(x),32(y)) - combadd(t2,t1,t0,32(x),24(y)) - combadd(t2,t1,t0,40(x),16(y)) - movq t0, 56(z) - -// Result term 8 - - xorq t0, t0 - combadz(t0,t2,t1,24(x),40(y)) - combadd(t0,t2,t1,32(x),32(y)) - combadd(t0,t2,t1,40(x),24(y)) - movq t1, 64(z) - -// Result term 9 - - xorq t1, t1 - combadz(t1,t0,t2,32(x),40(y)) - combadd(t1,t0,t2,40(x),32(y)) - movq t2, 72(z) - -// Result term 10 - - combads(t1,t0,40(x),40(y)) - movq t0, 80(z) - -// Result term 11 - - movq t1, 88(z) - -// Return - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_6_12_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_8_16.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_8_16.S deleted file mode 100644 index abecd0d638d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_8_16.S +++ /dev/null @@ -1,264 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[8], y[8]; output z[16] -// -// extern void bignum_mul_8_16(uint64_t z[static 16], const uint64_t x[static 8], -// const uint64_t y[static 8]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_8_16) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_8_16) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_8_16) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// Copied in or set up - -#define y %rcx - -// A zero register - -#define zero %rbp -#define zeroe %ebp - -// mulpadd i, j adds x[i] * rdx (now assumed = y[j]) into the window at i+j - -.macro mulpadd arg1,arg2 - mulxq 8*\arg1(x), %rax, %rbx -.if ((\arg1 + \arg2) % 8 == 0) - adcxq %rax, %r8 - adoxq %rbx, %r9 -.elseif ((\arg1 + \arg2) % 8 == 1) - adcxq %rax, %r9 - adoxq %rbx, %r10 -.elseif ((\arg1 + \arg2) % 8 == 2) - adcxq %rax, %r10 - adoxq %rbx, %r11 -.elseif ((\arg1 + \arg2) % 8 == 3) - adcxq %rax, %r11 - adoxq %rbx, %r12 -.elseif ((\arg1 + \arg2) % 8 == 4) - adcxq %rax, %r12 - adoxq %rbx, %r13 -.elseif ((\arg1 + \arg2) % 8 == 5) - adcxq %rax, %r13 - adoxq %rbx, %r14 -.elseif ((\arg1 + \arg2) % 8 == 6) - adcxq %rax, %r14 - adoxq %rbx, %r15 -.elseif ((\arg1 + \arg2) % 8 == 7) - adcxq %rax, %r15 - adoxq %rbx, %r8 -.endif - -.endm - -// mulpade i, j adds x[i] * rdx (now assumed = y[j]) into the window at i+j -// but re-creates the top word assuming nothing to add there - -.macro mulpade arg1,arg2 -.if ((\arg1 + \arg2) % 8 == 0) - mulxq 8*\arg1(x), %rax, %r9 - adcxq %rax, %r8 - adoxq zero, %r9 -.elseif ((\arg1 + \arg2) % 8 == 1) - mulxq 8*\arg1(x), %rax, %r10 - adcxq %rax, %r9 - adoxq zero, %r10 -.elseif ((\arg1 + \arg2) % 8 == 2) - mulxq 8*\arg1(x), %rax, %r11 - adcxq %rax, %r10 - adoxq zero, %r11 -.elseif ((\arg1 + \arg2) % 8 == 3) - mulxq 8*\arg1(x), %rax, %r12 - adcxq %rax, %r11 - adoxq zero, %r12 -.elseif ((\arg1 + \arg2) % 8 == 4) - mulxq 8*\arg1(x), %rax, %r13 - adcxq %rax, %r12 - adoxq zero, %r13 -.elseif ((\arg1 + \arg2) % 8 == 5) - mulxq 8*\arg1(x), %rax, %r14 - adcxq %rax, %r13 - adoxq zero, %r14 -.elseif ((\arg1 + \arg2) % 8 == 6) - mulxq 8*\arg1(x), %rax, %r15 - adcxq %rax, %r14 - adoxq zero, %r15 -.elseif ((\arg1 + \arg2) % 8 == 7) - mulxq 8*\arg1(x), %rax, %r8 - adcxq %rax, %r15 - adoxq zero, %r8 -.endif - -.endm - -// Add in the whole j'th row - -.macro addrow arg1 - movq 8*\arg1(y), %rdx - xorl zeroe, zeroe - - mulpadd 0, \arg1 - -.if (\arg1 % 8 == 0) - movq %r8, 8*\arg1(z) -.elseif (\arg1 % 8 == 1) - movq %r9, 8*\arg1(z) -.elseif (\arg1 % 8 == 2) - movq %r10, 8*\arg1(z) -.elseif (\arg1 % 8 == 3) - movq %r11, 8*\arg1(z) -.elseif (\arg1 % 8 == 4) - movq %r12, 8*\arg1(z) -.elseif (\arg1 % 8 == 5) - movq %r13, 8*\arg1(z) -.elseif (\arg1 % 8 == 6) - movq %r14, 8*\arg1(z) -.elseif (\arg1 % 8 == 7) - movq %r15, 8*\arg1(z) -.endif - - mulpadd 1, \arg1 - mulpadd 2, \arg1 - mulpadd 3, \arg1 - mulpadd 4, \arg1 - mulpadd 5, \arg1 - mulpadd 6, \arg1 - mulpade 7, \arg1 - -.if (\arg1 % 8 == 0) - adcq zero, %r8 -.elseif (\arg1 % 8 == 1) - adcq zero, %r9 -.elseif (\arg1 % 8 == 2) - adcq zero, %r10 -.elseif (\arg1 % 8 == 3) - adcq zero, %r11 -.elseif (\arg1 % 8 == 4) - adcq zero, %r12 -.elseif (\arg1 % 8 == 5) - adcq zero, %r13 -.elseif (\arg1 % 8 == 6) - adcq zero, %r14 -.elseif (\arg1 % 8 == 7) - adcq zero, %r15 -.endif - -.endm - - -S2N_BN_SYMBOL(bignum_mul_8_16): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Zero a register, which also makes sure we don't get a fake carry-in - - xorl zeroe, zeroe - -// Do the zeroth row, which is a bit different -// Write back the zero-zero product and then accumulate -// %r8,%r15,%r14,%r13,%r12,%r11,%r10,%r9 as y[0] * x from 1..8 - - movq (y), %rdx - - mulxq (x), %r8, %r9 - movq %r8, (z) - - mulxq 8(x), %rbx, %r10 - adcq %rbx, %r9 - - mulxq 16(x), %rbx, %r11 - adcq %rbx, %r10 - - mulxq 24(x), %rbx, %r12 - adcq %rbx, %r11 - - mulxq 32(x), %rbx, %r13 - adcq %rbx, %r12 - - mulxq 40(x), %rbx, %r14 - adcq %rbx, %r13 - - mulxq 48(x), %rbx, %r15 - adcq %rbx, %r14 - - mulxq 56(x), %rbx, %r8 - adcq %rbx, %r15 - adcq zero, %r8 - -// Now all the other rows in a uniform pattern - - addrow 1 - addrow 2 - addrow 3 - addrow 4 - addrow 5 - addrow 6 - addrow 7 - -// Now write back the additional columns - - movq %r8, 64(z) - movq %r9, 72(z) - movq %r10, 80(z) - movq %r11, 88(z) - movq %r12, 96(z) - movq %r13, 104(z) - movq %r14, 112(z) - movq %r15, 120(z) - -// Real epilog - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_8_16) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_8_16_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_8_16_alt.S deleted file mode 100644 index 72ba4192b26..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_mul_8_16_alt.S +++ /dev/null @@ -1,238 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[8], y[8]; output z[16] -// -// extern void bignum_mul_8_16_alt(uint64_t z[static 16], -// const uint64_t x[static 8], -// const uint64_t y[static 8]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_8_16_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_8_16_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_8_16_alt) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// This is moved from %rdx to free it for muls - -#define y %rcx - -// Other variables used as a rotating 3-word window to add terms to - -#define t0 %r8 -#define t1 %r9 -#define t2 %r10 - -// Macro for the key "multiply and add to (c,h,l)" step - -#define combadd(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A minutely shorter form for when c = 0 initially - -#define combadz(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq c, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h - -S2N_BN_SYMBOL(bignum_mul_8_16_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Copy y into a safe register to start with - - movq %rdx, y - -// Result term 0 - - movq (x), %rax - mulq (y) - - movq %rax, (z) - movq %rdx, t0 - xorq t1, t1 - -// Result term 1 - - xorq t2, t2 - combads(t1,t0,(x),8(y)) - combadz(t2,t1,t0,8(x),(y)) - movq t0, 8(z) - -// Result term 2 - - xorq t0, t0 - combadz(t0,t2,t1,(x),16(y)) - combadd(t0,t2,t1,8(x),8(y)) - combadd(t0,t2,t1,16(x),(y)) - movq t1, 16(z) - -// Result term 3 - - xorq t1, t1 - combadz(t1,t0,t2,(x),24(y)) - combadd(t1,t0,t2,8(x),16(y)) - combadd(t1,t0,t2,16(x),8(y)) - combadd(t1,t0,t2,24(x),(y)) - movq t2, 24(z) - -// Result term 4 - - xorq t2, t2 - combadz(t2,t1,t0,(x),32(y)) - combadd(t2,t1,t0,8(x),24(y)) - combadd(t2,t1,t0,16(x),16(y)) - combadd(t2,t1,t0,24(x),8(y)) - combadd(t2,t1,t0,32(x),(y)) - movq t0, 32(z) - -// Result term 5 - - xorq t0, t0 - combadz(t0,t2,t1,(x),40(y)) - combadd(t0,t2,t1,8(x),32(y)) - combadd(t0,t2,t1,16(x),24(y)) - combadd(t0,t2,t1,24(x),16(y)) - combadd(t0,t2,t1,32(x),8(y)) - combadd(t0,t2,t1,40(x),(y)) - movq t1, 40(z) - -// Result term 6 - - xorq t1, t1 - combadz(t1,t0,t2,(x),48(y)) - combadd(t1,t0,t2,8(x),40(y)) - combadd(t1,t0,t2,16(x),32(y)) - combadd(t1,t0,t2,24(x),24(y)) - combadd(t1,t0,t2,32(x),16(y)) - combadd(t1,t0,t2,40(x),8(y)) - combadd(t1,t0,t2,48(x),(y)) - movq t2, 48(z) - -// Result term 7 - - xorq t2, t2 - combadz(t2,t1,t0,(x),56(y)) - combadd(t2,t1,t0,8(x),48(y)) - combadd(t2,t1,t0,16(x),40(y)) - combadd(t2,t1,t0,24(x),32(y)) - combadd(t2,t1,t0,32(x),24(y)) - combadd(t2,t1,t0,40(x),16(y)) - combadd(t2,t1,t0,48(x),8(y)) - combadd(t2,t1,t0,56(x),(y)) - movq t0, 56(z) - -// Result term 8 - - xorq t0, t0 - combadz(t0,t2,t1,8(x),56(y)) - combadd(t0,t2,t1,16(x),48(y)) - combadd(t0,t2,t1,24(x),40(y)) - combadd(t0,t2,t1,32(x),32(y)) - combadd(t0,t2,t1,40(x),24(y)) - combadd(t0,t2,t1,48(x),16(y)) - combadd(t0,t2,t1,56(x),8(y)) - movq t1, 64(z) - -// Result term 9 - - xorq t1, t1 - combadz(t1,t0,t2,16(x),56(y)) - combadd(t1,t0,t2,24(x),48(y)) - combadd(t1,t0,t2,32(x),40(y)) - combadd(t1,t0,t2,40(x),32(y)) - combadd(t1,t0,t2,48(x),24(y)) - combadd(t1,t0,t2,56(x),16(y)) - movq t2, 72(z) - -// Result term 10 - - xorq t2, t2 - combadz(t2,t1,t0,24(x),56(y)) - combadd(t2,t1,t0,32(x),48(y)) - combadd(t2,t1,t0,40(x),40(y)) - combadd(t2,t1,t0,48(x),32(y)) - combadd(t2,t1,t0,56(x),24(y)) - movq t0, 80(z) - -// Result term 11 - - xorq t0, t0 - combadz(t0,t2,t1,32(x),56(y)) - combadd(t0,t2,t1,40(x),48(y)) - combadd(t0,t2,t1,48(x),40(y)) - combadd(t0,t2,t1,56(x),32(y)) - movq t1, 88(z) - -// Result term 12 - - xorq t1, t1 - combadz(t1,t0,t2,40(x),56(y)) - combadd(t1,t0,t2,48(x),48(y)) - combadd(t1,t0,t2,56(x),40(y)) - movq t2, 96(z) - -// Result term 13 - - xorq t2, t2 - combadz(t2,t1,t0,48(x),56(y)) - combadd(t2,t1,t0,56(x),48(y)) - movq t0, 104(z) - -// Result term 14 - - combads(t2,t1,56(x),56(y)) - movq t1, 112(z) - -// Result term 11 - - movq t2, 120(z) - -// Return - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_8_16_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_4_8.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_4_8.S deleted file mode 100644 index b014613adea..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_4_8.S +++ /dev/null @@ -1,149 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[4]; output z[8] -// -// extern void bignum_sqr_4_8(uint64_t z[static 8], const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_4_8) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_4_8) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_4_8) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// A zero register - -#define zero %rbp -#define zeroe %ebp - -// Other registers - -#define d1 %r8 -#define d2 %r9 -#define d3 %r10 -#define d4 %r11 -#define d5 %r12 -#define d6 %r13 - - - -S2N_BN_SYMBOL(bignum_sqr_4_8): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - -// Set up an initial window [d6;...d1] = [23;03;01] - - movq (x), %rdx - mulxq 8(x), d1, d2 - mulxq 24(x), d3, d4 - movq 16(x), %rdx - mulxq 24(x), d5, d6 - -// Clear our zero register, and also initialize the flags for the carry chain - - xorl zeroe, zeroe - -// Chain in the addition of 02 + 12 + 13 to that window (no carry-out possible) -// This gives all the "heterogeneous" terms of the squaring ready to double - - mulxq (x), %rax, %rcx - adcxq %rax, d2 - adoxq %rcx, d3 - mulxq 8(x), %rax, %rcx - adcxq %rax, d3 - adoxq %rcx, d4 - movq 24(x), %rdx - mulxq 8(x), %rax, %rcx - adcxq %rax, d4 - adoxq %rcx, d5 - adcxq zero, d5 - adoxq zero, d6 - adcxq zero, d6 - -// In principle this is otiose as CF and OF carries are absorbed at this point -// However it seems helpful for the OOO engine to be told it's a fresh start - - xorl zeroe, zeroe - -// Double and add to the 00 + 11 + 22 + 33 terms -// -// We could use shift-double but this seems tidier and in larger squarings -// it was actually more efficient. I haven't experimented with this small -// case to see how much that matters. Note: the writeback here is sprinkled -// into the sequence in such a way that things still work if z = x, i.e. if -// the output overwrites the input buffer and beyond. - - movq (x), %rdx - mulxq %rdx, %rax, %rdx - movq %rax, (z) - adcxq d1, d1 - adoxq %rdx, d1 - movq 8(x), %rdx - movq d1, 8(z) - mulxq %rdx, %rax, %rdx - adcxq d2, d2 - adoxq %rax, d2 - adcxq d3, d3 - adoxq %rdx, d3 - movq 16(x), %rdx - movq d2, 16(z) - mulxq %rdx, %rax, %rdx - adcxq d4, d4 - adoxq %rax, d4 - adcxq d5, d5 - adoxq %rdx, d5 - movq 24(x), %rdx - movq d3, 24(z) - mulxq %rdx, %rax, %rdx - movq d4, 32(z) - adcxq d6, d6 - movq d5, 40(z) - adoxq %rax, d6 - movq d6, 48(z) - adcxq zero, %rdx - adoxq zero, %rdx - movq %rdx, 56(z) - -// Restore saved registers and return - - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_4_8) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_4_8_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_4_8_alt.S deleted file mode 100644 index 746f45d29eb..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_4_8_alt.S +++ /dev/null @@ -1,138 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[4]; output z[8] -// -// extern void bignum_sqr_4_8_alt(uint64_t z[static 8], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_4_8_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_4_8_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_4_8_alt) - .text - -// Input arguments - -#define z %rdi -#define x %rsi - -// Other variables used as a rotating 3-word window to add terms to - -#define t0 %rcx -#define t1 %r8 -#define t2 %r9 - -// Macro for the key "multiply and add to (c,h,l)" step, for square term - -#define combadd1(c,h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h - -// A version doubling before adding, for non-square terms - -#define combadd2(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0, c ; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -S2N_BN_SYMBOL(bignum_sqr_4_8_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Result term 0 - - movq (x), %rax - mulq %rax - - movq %rax, (z) - movq %rdx, t0 - xorq t1, t1 - -// Result term 1 - - xorq t2, t2 - combadd2(t2,t1,t0,(x),8(x)) - movq t0, 8(z) - -// Result term 2 - - xorq t0, t0 - combadd1(t0,t2,t1,8(x)) - combadd2(t0,t2,t1,(x),16(x)) - movq t1, 16(z) - -// Result term 3 - - xorq t1, t1 - combadd2(t1,t0,t2,(x),24(x)) - combadd2(t1,t0,t2,8(x),16(x)) - movq t2, 24(z) - -// Result term 4 - - xorq t2, t2 - combadd2(t2,t1,t0,8(x),24(x)) - combadd1(t2,t1,t0,16(x)) - movq t0, 32(z) - -// Result term 5 - - xorq t0, t0 - combadd2(t0,t2,t1,16(x),24(x)) - movq t1, 40(z) - -// Result term 6 - - xorq t1, t1 - combads(t0,t2,24(x)) - movq t2, 48(z) - -// Result term 7 - - movq t0, 56(z) - -// Return - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_4_8_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_6_12.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_6_12.S deleted file mode 100644 index 73a32510ab0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_6_12.S +++ /dev/null @@ -1,218 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[6]; output z[12] -// -// extern void bignum_sqr_6_12(uint64_t z[static 12], const uint64_t x[static 6]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_6_12) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_6_12) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_6_12) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// A zero register - -#define zero %rbp -#define zeroe %ebp - -// Other registers - -#define d1 %r8 -#define d2 %r9 -#define d3 %r10 -#define d4 %r11 -#define d5 %r12 -#define d6 %r13 -#define d7 %r14 -#define d8 %r15 -#define d9 %rbx - -// Care is needed: re-using the zero register - -#define d10 %rbp - - -S2N_BN_SYMBOL(bignum_sqr_6_12): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Set up an initial window [d8;...d1] = [34;05;03;01] - - movq (x), %rdx - mulxq 8(x), d1, d2 - mulxq 24(x), d3, d4 - mulxq 40(x), d5, d6 - movq 24(x), %rdx - mulxq 32(x), d7, d8 - -// Clear our zero register, and also initialize the flags for the carry chain - - xorl zeroe, zeroe - -// Chain in the addition of 02 + 12 + 13 + 14 + 15 to that window -// (no carry-out possible since we add it to the top of a product) - - movq 16(x), %rdx - mulxq (x), %rax, %rcx - adcxq %rax, d2 - adoxq %rcx, d3 - mulxq 8(x), %rax, %rcx - adcxq %rax, d3 - adoxq %rcx, d4 - movq 8(x), %rdx - mulxq 24(x), %rax, %rcx - adcxq %rax, d4 - adoxq %rcx, d5 - mulxq 32(x), %rax, %rcx - adcxq %rax, d5 - adoxq %rcx, d6 - mulxq 40(x), %rax, %rcx - adcxq %rax, d6 - adoxq %rcx, d7 - adcxq zero, d7 - adoxq zero, d8 - adcxq zero, d8 - -// Again zero out the flags. Actually they are already cleared but it may -// help decouple these in the OOO engine not to wait for the chain above - - xorl zeroe, zeroe - -// Now chain in the 04 + 23 + 24 + 25 + 35 + 45 terms -// We are running out of registers and here our zero register is not zero! - - movq 32(x), %rdx - mulxq (x), %rax, %rcx - adcxq %rax, d4 - adoxq %rcx, d5 - movq 16(x), %rdx - mulxq 24(x), %rax, %rcx - adcxq %rax, d5 - adoxq %rcx, d6 - mulxq 32(x), %rax, %rcx - adcxq %rax, d6 - adoxq %rcx, d7 - mulxq 40(x), %rax, %rcx - adcxq %rax, d7 - adoxq %rcx, d8 - movq 24(x), %rdx - mulxq 40(x), %rax, d9 - adcxq %rax, d8 - adoxq zero, d9 - movq 32(x), %rdx - mulxq 40(x), %rax, d10 - adcxq %rax, d9 - movl $0, %eax - adoxq %rax, d10 - adcxq %rax, d10 - -// Again, just for a clear fresh start for the flags - - xorl %eax, %eax - -// Double and add to the 00 + 11 + 22 + 33 + 44 + 55 terms -// -// We could use shift-double but this seems tidier and in larger squarings -// it was actually more efficient. I haven't experimented with this small -// case to see how much that matters. Note: the writeback here is sprinkled -// into the sequence in such a way that things still work if z = x, i.e. if -// the output overwrites the input buffer and beyond. - - movq (x), %rdx - mulxq %rdx, %rax, %rdx - movq %rax, (z) - adcxq d1, d1 - adoxq %rdx, d1 - movq 8(x), %rdx - movq d1, 8(z) - mulxq %rdx, %rax, %rdx - adcxq d2, d2 - adoxq %rax, d2 - adcxq d3, d3 - adoxq %rdx, d3 - movq 16(x), %rdx - movq d2, 16(z) - mulxq %rdx, %rax, %rdx - adcxq d4, d4 - adoxq %rax, d4 - adcxq d5, d5 - adoxq %rdx, d5 - movq 24(x), %rdx - movq d3, 24(z) - mulxq %rdx, %rax, %rdx - adcxq d6, d6 - adoxq %rax, d6 - adcxq d7, d7 - adoxq %rdx, d7 - movq 32(x), %rdx - movq d4, 32(z) - mulxq %rdx, %rax, %rdx - adcxq d8, d8 - adoxq %rax, d8 - adcxq d9, d9 - adoxq %rdx, d9 - movq 40(x), %rdx - movq d5, 40(z) - mulxq %rdx, %rax, %rdx - movq d6, 48(z) - adcxq d10, d10 - movq d7, 56(z) - adoxq %rax, d10 - movq d8, 64(z) - movl $0, %eax - movq d9, 72(z) - adcxq %rax, %rdx - movq d10, 80(z) - adoxq %rax, %rdx - movq %rdx, 88(z) - -// Restore saved registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_6_12) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_6_12_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_6_12_alt.S deleted file mode 100644 index c11445dac95..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_6_12_alt.S +++ /dev/null @@ -1,201 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[6]; output z[12] -// -// extern void bignum_sqr_6_12_alt(uint64_t z[static 12], -// const uint64_t x[static 6]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_6_12_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_6_12_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_6_12_alt) - .text - -// Input arguments - -#define z %rdi -#define x %rsi - -// Other variables used as a rotating 3-word window to add terms to - -#define t0 %r8 -#define t1 %r9 -#define t2 %r10 - -// Additional temporaries for local windows to share doublings - -#define u0 %rcx -#define u1 %r11 - -// Macro for the key "multiply and add to (c,h,l)" step - -#define combadd(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// Set up initial window (c,h,l) = numa * numb - -#define combaddz(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - xorq c, c ; \ - movq %rax, l ; \ - movq %rdx, h - -// Doubling step (c,h,l) = 2 * (c,hh,ll) + (0,h,l) - -#define doubladd(c,h,l,hh,ll) \ - addq ll, ll ; \ - adcq hh, hh ; \ - adcq c, c ; \ - addq ll, l ; \ - adcq hh, h ; \ - adcq $0, c - -// Square term incorporation (c,h,l) += numba^2 - -#define combadd1(c,h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h - -// A version doubling directly before adding, for single non-square terms - -#define combadd2(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0, c ; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -S2N_BN_SYMBOL(bignum_sqr_6_12_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Result term 0 - - movq (x), %rax - mulq %rax - - movq %rax, (z) - movq %rdx, t0 - xorq t1, t1 - -// Result term 1 - - xorq t2, t2 - combadd2(t2,t1,t0,(x),8(x)) - movq t0, 8(z) - -// Result term 2 - - xorq t0, t0 - combadd1(t0,t2,t1,8(x)) - combadd2(t0,t2,t1,(x),16(x)) - movq t1, 16(z) - -// Result term 3 - - combaddz(t1,u1,u0,(x),24(x)) - combadd(t1,u1,u0,8(x),16(x)) - doubladd(t1,t0,t2,u1,u0) - movq t2, 24(z) - -// Result term 4 - - combaddz(t2,u1,u0,(x),32(x)) - combadd(t2,u1,u0,8(x),24(x)) - doubladd(t2,t1,t0,u1,u0) - combadd1(t2,t1,t0,16(x)) - movq t0, 32(z) - -// Result term 5 - - combaddz(t0,u1,u0,(x),40(x)) - combadd(t0,u1,u0,8(x),32(x)) - combadd(t0,u1,u0,16(x),24(x)) - doubladd(t0,t2,t1,u1,u0) - movq t1, 40(z) - -// Result term 6 - - combaddz(t1,u1,u0,8(x),40(x)) - combadd(t1,u1,u0,16(x),32(x)) - doubladd(t1,t0,t2,u1,u0) - combadd1(t1,t0,t2,24(x)) - movq t2, 48(z) - -// Result term 7 - - combaddz(t2,u1,u0,16(x),40(x)) - combadd(t2,u1,u0,24(x),32(x)) - doubladd(t2,t1,t0,u1,u0) - movq t0, 56(z) - -// Result term 8 - - xorq t0, t0 - combadd2(t0,t2,t1,24(x),40(x)) - combadd1(t0,t2,t1,32(x)) - movq t1, 64(z) - -// Result term 9 - - xorq t1, t1 - combadd2(t1,t0,t2,32(x),40(x)) - movq t2, 72(z) - -// Result term 10 - - combads(t1,t0,40(x)) - movq t0, 80(z) - -// Result term 11 - - movq t1, 88(z) - -// Return - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_6_12_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_8_16.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_8_16.S deleted file mode 100644 index 2f95edd953f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_8_16.S +++ /dev/null @@ -1,302 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[8]; output z[16] -// -// extern void bignum_sqr_8_16(uint64_t z[static 16], const uint64_t x[static 8]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_8_16) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_8_16) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_8_16) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// A zero register - -#define zero %rbp -#define zeroe %ebp - -// mulpadd i, j adds rdx * x[i] into the window at the i+j point - -.macro mulpadd arg1,arg2 - mulxq 8*\arg1(x), %rax, %rcx -.if ((\arg1 + \arg2) % 8 == 0) - adcxq %rax, %r8 - adoxq %rcx, %r9 -.elseif ((\arg1 + \arg2) % 8 == 1) - adcxq %rax, %r9 - adoxq %rcx, %r10 -.elseif ((\arg1 + \arg2) % 8 == 2) - adcxq %rax, %r10 - adoxq %rcx, %r11 -.elseif ((\arg1 + \arg2) % 8 == 3) - adcxq %rax, %r11 - adoxq %rcx, %r12 -.elseif ((\arg1 + \arg2) % 8 == 4) - adcxq %rax, %r12 - adoxq %rcx, %r13 -.elseif ((\arg1 + \arg2) % 8 == 5) - adcxq %rax, %r13 - adoxq %rcx, %r14 -.elseif ((\arg1 + \arg2) % 8 == 6) - adcxq %rax, %r14 - adoxq %rcx, %r15 -.elseif ((\arg1 + \arg2) % 8 == 7) - adcxq %rax, %r15 - adoxq %rcx, %r8 -.endif - -.endm - -// mulpade i, j adds rdx * x[i] into the window at i+j -// but re-creates the top word assuming nothing to add there - -.macro mulpade arg1,arg2 -.if ((\arg1 + \arg2) % 8 == 0) - mulxq 8*\arg1(x), %rax, %r9 - adcxq %rax, %r8 - adoxq zero, %r9 -.elseif ((\arg1 + \arg2) % 8 == 1) - mulxq 8*\arg1(x), %rax, %r10 - adcxq %rax, %r9 - adoxq zero, %r10 -.elseif ((\arg1 + \arg2) % 8 == 2) - mulxq 8*\arg1(x), %rax, %r11 - adcxq %rax, %r10 - adoxq zero, %r11 -.elseif ((\arg1 + \arg2) % 8 == 3) - mulxq 8*\arg1(x), %rax, %r12 - adcxq %rax, %r11 - adoxq zero, %r12 -.elseif ((\arg1 + \arg2) % 8 == 4) - mulxq 8*\arg1(x), %rax, %r13 - adcxq %rax, %r12 - adoxq zero, %r13 -.elseif ((\arg1 + \arg2) % 8 == 5) - mulxq 8*\arg1(x), %rax, %r14 - adcxq %rax, %r13 - adoxq zero, %r14 -.elseif ((\arg1 + \arg2) % 8 == 6) - mulxq 8*\arg1(x), %rax, %r15 - adcxq %rax, %r14 - adoxq zero, %r15 -.elseif ((\arg1 + \arg2) % 8 == 7) - mulxq 8*\arg1(x), %rax, %r8 - adcxq %rax, %r15 - adoxq zero, %r8 -.endif - -.endm - -.macro diagonals - - xorl zeroe, zeroe - -// Set initial window [%r8..%r10] + 2 wb = 10 + 20 + 30 + 40 + 50 + 60 + 70 - - movq (x), %rdx - mulxq 8(x), %r9, %rax - movq %r9, 8(z) - mulxq 16(x), %r10, %rcx - adcxq %rax, %r10 - movq %r10, 16(z) - mulxq 24(x), %r11, %rax - adcxq %rcx, %r11 - mulxq 32(x), %r12, %rcx - adcxq %rax, %r12 - mulxq 40(x), %r13, %rax - adcxq %rcx, %r13 - mulxq 48(x), %r14, %rcx - adcxq %rax, %r14 - mulxq 56(x), %r15, %r8 - adcxq %rcx, %r15 - adcxq zero, %r8 - -// Add in the next diagonal = 21 + 31 + 41 + 51 + 61 + 71 + 54 - - xorl zeroe, zeroe - movq 8(x), %rdx - mulpadd 2, 1 - movq %r11, 24(z) - mulpadd 3, 1 - movq %r12, 32(z) - mulpadd 4, 1 - mulpadd 5, 1 - mulpadd 6, 1 - mulpade 7, 1 - movq 32(x), %rdx - mulpade 5, 4 - adcxq zero, %r10 - -// And the next one = 32 + 42 + 52 + 62 + 72 + 64 + 65 - - xorl zeroe, zeroe - movq 16(x), %rdx - mulpadd 3, 2 - movq %r13, 40(z) - mulpadd 4, 2 - movq %r14, 48(z) - mulpadd 5, 2 - mulpadd 6, 2 - mulpadd 7, 2 - movq 48(x), %rdx - mulpade 4, 6 - mulpade 5, 6 - adcxq zero, %r12 - -// And the final one = 43 + 53 + 63 + 73 + 74 + 75 + 76 - - xorl zeroe, zeroe - movq 24(x), %rdx - mulpadd 4, 3 - movq %r15, 56(z) - mulpadd 5, 3 - movq %r8, 64(z) - mulpadd 6, 3 - mulpadd 7, 3 - movq 56(x), %rdx - mulpadd 4, 7 - mulpade 5, 7 - mulpade 6, 7 - adcxq zero, %r14 - -// Double and add things; use z[1]..z[8] and thereafter the registers -// %r9..%r15 which haven't been written back yet - - xorl zeroe, zeroe - movq (x), %rdx - mulxq %rdx, %rax, %rcx - movq %rax, (z) - movq 8(z), %rax - adcxq %rax, %rax - adoxq %rcx, %rax - movq %rax, 8(z) - - movq 16(z), %rax - movq 8(x), %rdx - mulxq %rdx, %rdx, %rcx - adcxq %rax, %rax - adoxq %rdx, %rax - movq %rax, 16(z) - movq 24(z), %rax - adcxq %rax, %rax - adoxq %rcx, %rax - movq %rax, 24(z) - - movq 32(z), %rax - movq 16(x), %rdx - mulxq %rdx, %rdx, %rcx - adcxq %rax, %rax - adoxq %rdx, %rax - movq %rax, 32(z) - movq 40(z), %rax - adcxq %rax, %rax - adoxq %rcx, %rax - movq %rax, 40(z) - - movq 48(z), %rax - movq 24(x), %rdx - mulxq %rdx, %rdx, %rcx - adcxq %rax, %rax - adoxq %rdx, %rax - movq %rax, 48(z) - movq 56(z), %rax - adcxq %rax, %rax - adoxq %rcx, %rax - movq %rax, 56(z) - - movq 64(z), %rax - movq 32(x), %rdx - mulxq %rdx, %rdx, %rcx - adcxq %rax, %rax - adoxq %rdx, %rax - movq %rax, 64(z) - adcxq %r9, %r9 - adoxq %rcx, %r9 - movq %r9, 72(z) - - movq 40(x), %rdx - mulxq %rdx, %rdx, %rcx - adcxq %r10, %r10 - adoxq %rdx, %r10 - movq %r10, 80(z) - adcxq %r11, %r11 - adoxq %rcx, %r11 - movq %r11, 88(z) - - movq 48(x), %rdx - mulxq %rdx, %rdx, %rcx - adcxq %r12, %r12 - adoxq %rdx, %r12 - movq %r12, 96(z) - adcxq %r13, %r13 - adoxq %rcx, %r13 - movq %r13, 104(z) - - movq 56(x), %rdx - mulxq %rdx, %rdx, %r15 - adcxq %r14, %r14 - adoxq %rdx, %r14 - movq %r14, 112(z) - adcxq zero, %r15 - adoxq zero, %r15 - movq %r15, 120(z) - -.endm - - -S2N_BN_SYMBOL(bignum_sqr_8_16): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Do the multiplication - - diagonals - -// Real epilog - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_8_16) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_8_16_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_8_16_alt.S deleted file mode 100644 index f880fdc005f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/fastmul/bignum_sqr_8_16_alt.S +++ /dev/null @@ -1,236 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square, z := x^2 -// Input x[8]; output z[16] -// -// extern void bignum_sqr_8_16_alt(uint64_t z[static 16], -// const uint64_t x[static 8]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_8_16_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_8_16_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_8_16_alt) - .text - -// Input arguments - -#define z %rdi -#define x %rsi - -// Other variables used as a rotating 3-word window to add terms to - -#define t0 %r8 -#define t1 %r9 -#define t2 %r10 - -// Additional temporaries for local windows to share doublings - -#define u0 %rcx -#define u1 %r11 - -// Macro for the key "multiply and add to (c,h,l)" step - -#define combadd(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// Set up initial window (c,h,l) = numa * numb - -#define combaddz(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - xorq c, c ; \ - movq %rax, l ; \ - movq %rdx, h - -// Doubling step (c,h,l) = 2 * (c,hh,ll) + (0,h,l) - -#define doubladd(c,h,l,hh,ll) \ - addq ll, ll ; \ - adcq hh, hh ; \ - adcq c, c ; \ - addq ll, l ; \ - adcq hh, h ; \ - adcq $0, c - -// Square term incorporation (c,h,l) += numba^2 - -#define combadd1(c,h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h - -// A version doubling directly before adding, for single non-square terms - -#define combadd2(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0, c ; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -S2N_BN_SYMBOL(bignum_sqr_8_16_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Result term 0 - - movq (x), %rax - mulq %rax - - movq %rax, (z) - movq %rdx, t0 - xorq t1, t1 - -// Result term 1 - - xorq t2, t2 - combadd2(t2,t1,t0,(x),8(x)) - movq t0, 8(z) - -// Result term 2 - - xorq t0, t0 - combadd1(t0,t2,t1,8(x)) - combadd2(t0,t2,t1,(x),16(x)) - movq t1, 16(z) - -// Result term 3 - - combaddz(t1,u1,u0,(x),24(x)) - combadd(t1,u1,u0,8(x),16(x)) - doubladd(t1,t0,t2,u1,u0) - movq t2, 24(z) - -// Result term 4 - - combaddz(t2,u1,u0,(x),32(x)) - combadd(t2,u1,u0,8(x),24(x)) - doubladd(t2,t1,t0,u1,u0) - combadd1(t2,t1,t0,16(x)) - movq t0, 32(z) - -// Result term 5 - - combaddz(t0,u1,u0,(x),40(x)) - combadd(t0,u1,u0,8(x),32(x)) - combadd(t0,u1,u0,16(x),24(x)) - doubladd(t0,t2,t1,u1,u0) - movq t1, 40(z) - -// Result term 6 - - combaddz(t1,u1,u0,(x),48(x)) - combadd(t1,u1,u0,8(x),40(x)) - combadd(t1,u1,u0,16(x),32(x)) - doubladd(t1,t0,t2,u1,u0) - combadd1(t1,t0,t2,24(x)) - movq t2, 48(z) - -// Result term 7 - - combaddz(t2,u1,u0,(x),56(x)) - combadd(t2,u1,u0,8(x),48(x)) - combadd(t2,u1,u0,16(x),40(x)) - combadd(t2,u1,u0,24(x),32(x)) - doubladd(t2,t1,t0,u1,u0) - movq t0, 56(z) - -// Result term 8 - - combaddz(t0,u1,u0,8(x),56(x)) - combadd(t0,u1,u0,16(x),48(x)) - combadd(t0,u1,u0,24(x),40(x)) - doubladd(t0,t2,t1,u1,u0) - combadd1(t0,t2,t1,32(x)) - movq t1, 64(z) - -// Result term 9 - - combaddz(t1,u1,u0,16(x),56(x)) - combadd(t1,u1,u0,24(x),48(x)) - combadd(t1,u1,u0,32(x),40(x)) - doubladd(t1,t0,t2,u1,u0) - movq t2, 72(z) - -// Result term 10 - - combaddz(t2,u1,u0,24(x),56(x)) - combadd(t2,u1,u0,32(x),48(x)) - doubladd(t2,t1,t0,u1,u0) - combadd1(t2,t1,t0,40(x)) - movq t0, 80(z) - -// Result term 11 - - combaddz(t0,u1,u0,32(x),56(x)) - combadd(t0,u1,u0,40(x),48(x)) - doubladd(t0,t2,t1,u1,u0) - movq t1, 88(z) - -// Result term 12 - - xorq t1, t1 - combadd2(t1,t0,t2,40(x),56(x)) - combadd1(t1,t0,t2,48(x)) - movq t2, 96(z) - -// Result term 13 - - xorq t2, t2 - combadd2(t2,t1,t0,48(x),56(x)) - movq t0, 104(z) - -// Result term 14 - - combads(t2,t1,56(x)) - movq t1, 112(z) - -// Result term 15 - - movq t2, 120(z) - -// Return - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_8_16_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_add.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_add.S deleted file mode 100644 index d770c1bd8fd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_add.S +++ /dev/null @@ -1,162 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Add, z := x + y -// Inputs x[m], y[n]; outputs function return (carry-out) and z[p] -// -// extern uint64_t bignum_add(uint64_t p, uint64_t *z, uint64_t m, -// const uint64_t *x, uint64_t n, const uint64_t *y); -// -// Does the z := x + y operation, truncating modulo p words in general and -// returning a top carry (0 or 1) in the p'th place, only adding the input -// words below p (as well as m and n respectively) to get the sum and carry. -// -// Standard x86-64 ABI: RDI = p, RSI = z, RDX = m, RCX = x, R8 = n, R9 = y, returns RAX -// Microsoft x64 ABI: RCX = p, RDX = z, R8 = m, R9 = x, [RSP+40] = n, [RSP+48] = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_add) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_add) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_add) - .text - -#define p %rdi -#define z %rsi -#define m %rdx -#define x %rcx -#define n %r8 -#define y %r9 -#define i %r10 -#define a %rax - -#define ashort %eax - - - -S2N_BN_SYMBOL(bignum_add): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 - movq 64(%rsp), %r9 -#endif - -// Zero the main index counter for both branches - - xorq i, i - -// First clamp the two input sizes m := min(p,m) and n := min(p,n) since -// we'll never need words past the p'th. Can now assume m <= p and n <= p. -// Then compare the modified m and n and branch accordingly - - cmpq m, p - cmovcq p, m - cmpq n, p - cmovcq p, n - cmpq n, m - jc Lbignum_add_ylonger - -// The case where x is longer or of the same size (p >= m >= n) - - subq m, p - subq n, m - incq m - testq n, n - jz Lbignum_add_xtest -Lbignum_add_xmainloop: - movq (x,i,8), a - adcq (y,i,8), a - movq a, (z,i,8) - incq i - decq n - jnz Lbignum_add_xmainloop - jmp Lbignum_add_xtest -Lbignum_add_xtoploop: - movq (x,i,8), a - adcq $0, a - movq a, (z,i,8) - incq i -Lbignum_add_xtest: - decq m - jnz Lbignum_add_xtoploop - movl $0, ashort - adcq $0, a - testq p, p - jnz Lbignum_add_tails -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - ret - -// The case where y is longer (p >= n > m) - -#if WINDOWS_ABI - .cfi_def_cfa %rsp, 24 -#else - .cfi_def_cfa %rsp, 8 -#endif - -Lbignum_add_ylonger: - subq n, p - subq m, n - testq m, m - jz Lbignum_add_ytoploop -Lbignum_add_ymainloop: - movq (x,i,8), a - adcq (y,i,8), a - movq a, (z,i,8) - incq i - decq m - jnz Lbignum_add_ymainloop -Lbignum_add_ytoploop: - movq (y,i,8), a - adcq $0, a - movq a, (z,i,8) - incq i - decq n - jnz Lbignum_add_ytoploop - movl $0, ashort - adcq $0, a - testq p, p - jnz Lbignum_add_tails -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - ret - -// Adding a non-trivial tail, when p > max(m,n) - -Lbignum_add_tails: - movq a, (z,i,8) - xorq a, a - jmp Lbignum_add_tail -Lbignum_add_tailloop: - movq a, (z,i,8) -Lbignum_add_tail: - incq i - decq p - jnz Lbignum_add_tailloop -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_add) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontifier.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontifier.S deleted file mode 100644 index 46e6da97e5f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontifier.S +++ /dev/null @@ -1,469 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compute "amontification" constant z :== 2^{128k} (congruent mod m) -// Input m[k]; output z[k]; temporary buffer t[>=k] -// -// extern void bignum_amontifier(uint64_t k, uint64_t *z, const uint64_t *m, -// uint64_t *t); -// -// This is called "amontifier" because any other value x can now be mapped into -// the almost-Montgomery domain with an almost-Montgomery multiplication by z. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = m, RCX = t -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = m, R9 = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_amontifier) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_amontifier) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_amontifier) - .text - -#define k %rdi -#define z %rsi - -// These two inputs get moved to different places since RCX and RDX are special - -#define m %r12 -#define t %r13 - -// Other variables -// Matters that c is RCX as CL=lo(c) is assumed in shifts - -#define i %rbx -#define j %rbp -#define a %rax -#define c %rcx -#define h %r11 -#define l %r10 -#define b %r9 -#define n %r8 - -// Some aliases for the values b and n - -#define q %r8 -#define r %r9 - -#define ashort %eax -#define ishort %ebx -#define jshort %ebp -#define qshort %r8d - - -S2N_BN_SYMBOL(bignum_amontifier): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Save some additional registers for use, copy args out of RCX and RDX - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - - movq %rdx, m - movq %rcx, t - -// If k = 0 the whole operation is trivial - - testq k, k - jz Lbignum_amontifier_end - -// Copy the input m into the temporary buffer t. The temporary register -// c matters since we want it to hold the highest digit, ready for the -// normalization phase. - - xorq i, i -Lbignum_amontifier_copyinloop: - movq (m,i,8), c - movq c, (t,i,8) - incq i - cmpq k, i - jc Lbignum_amontifier_copyinloop - -// Do a rather stupid but constant-time digit normalization, conditionally -// shifting left (k-1) times based on whether the top word is zero. -// With careful binary striding this could be O(k*log(k)) instead of O(k^2) -// while still retaining the constant-time style. -// The "neg c" sets the zeroness predicate (~CF) for the entire inner loop - - movq k, i - decq i - jz Lbignum_amontifier_normalized -Lbignum_amontifier_normloop: - xorq j, j - movq k, h - negq c - movl $0, ashort -Lbignum_amontifier_shufloop: - movq a, c - movq (t,j,8), a - cmovcq a, c - movq c, (t,j,8) - incq j - decq h - jnz Lbignum_amontifier_shufloop - decq i - jnz Lbignum_amontifier_normloop - -// We now have the top digit nonzero, assuming the input was nonzero, -// and as per the invariant of the loop above, c holds that digit. So -// now just count c's leading zeros and shift t bitwise that many bits. -// Note that we don't care about the result of bsr for zero inputs so -// the simple xor-ing with 63 is safe. - -Lbignum_amontifier_normalized: - - bsrq c, c - xorq $63, c - - xorq b, b - xorq i, i -Lbignum_amontifier_bitloop: - movq (t,i,8), a - movq a, j - shldq %cl, b, a - movq a, (t,i,8) - movq j, b - incq i - cmpq k, i - jc Lbignum_amontifier_bitloop - -// Let h be the high word of n, which in all the in-scope cases is >= 2^63. -// Now successively form q = 2^i div h and r = 2^i mod h as i goes from -// 64 to 126. We avoid just using division out of constant-time concerns -// (at the least we would need to fix up h = 0 for out-of-scope inputs) and -// don't bother with Newton-Raphson, since this stupid simple loop doesn't -// contribute much of the overall runtime at typical sizes. - - movq -8(t,k,8), h - movl $1, qshort - movq h, r - negq r - movl $62, ishort -Lbignum_amontifier_estloop: - - addq q, q - movq h, a - subq r, a - cmpq a, r // CF <=> r < h - r <=> 2 * r < h - sbbq a, a - notq a // a = bitmask(2 * r >= h) - subq a, q - addq r, r - andq h, a - subq a, r - decq i - jnz Lbignum_amontifier_estloop - -// Strictly speaking the above loop doesn't quite give the true remainder -// and quotient in the special case r = h = 2^63, so fix it up. We get -// q = 2^63 - 1 and r = 2^63 and really want q = 2^63 and r = 0. This is -// supererogatory, because the main property of q used below still holds -// in this case unless the initial m = 1, and then anyway the overall -// specification (congruence modulo m) holds degenerately. But it seems -// nicer to get a "true" quotient and remainder. - - incq r - cmpq r, h - adcq $0, q - -// So now we have q and r with 2^126 = q * h + r (imagining r = 0 in the -// fixed-up case above: note that we never actually use the computed -// value of r below and so didn't adjust it). And we can assume the ranges -// q <= 2^63 and r < h < 2^64. -// -// The idea is to use q as a first quotient estimate for a remainder -// of 2^{p+62} mod n, where p = 64 * k. We have, splitting n into the -// high and low parts h and l: -// -// 2^{p+62} - q * n = 2^{p+62} - q * (2^{p-64} * h + l) -// = 2^{p+62} - (2^{p-64} * (q * h) + q * l) -// = 2^{p+62} - 2^{p-64} * (2^126 - r) - q * l -// = 2^{p-64} * r - q * l -// -// Note that 2^{p-64} * r < 2^{p-64} * h <= n -// and also q * l < 2^63 * 2^{p-64} = 2^{p-1} <= n -// so |diff| = |2^{p-64} * r - q * l| < n. -// -// If in fact diff >= 0 then it is already 2^{p+62} mod n. -// otherwise diff + n is the right answer. -// -// To (maybe?) make the computation slightly easier we actually flip -// the sign and compute d = q * n - 2^{p+62}. Then the answer is either -// -d (when negative) or n - d; in either case we effectively negate d. -// This negating tweak in fact spoils the result for cases where -// 2^{p+62} mod n = 0, when we get n instead. However the only case -// where this can happen is m = 1, when the whole spec holds trivially, -// and actually the remainder of the logic below works anyway since -// the latter part of the code only needs a congruence for the k-digit -// result, not strict modular reduction (the doublings will maintain -// the non-strict inequality). - - xorq c, c - xorq i, i -Lbignum_amontifier_mulloop: - movq (t,i,8), %rax - mulq q - addq c, %rax - adcq $0, %rdx - movq %rax, (z,i,8) - movq %rdx, c - incq i - cmpq k, i - jc Lbignum_amontifier_mulloop - -// Now c is the high word of the product, so subtract 2^62 -// and then turn it into a bitmask in q = h - - movq $0x4000000000000000, %rax - subq a, c - sbbq q, q - notq q - -// Now do [c] * n - d for our final answer - - xorq c, c - xorq i, i -Lbignum_amontifier_remloop: - movq (t,i,8), a - andq q, a - negq c - sbbq (z,i,8), a - sbbq c, c - movq a, (z,i,8) - incq i - cmpq k, i - jc Lbignum_amontifier_remloop - -// Now still need to do a couple of modular doublings to get us all the -// way up to 2^{p+64} == r from initial 2^{p+62} == r (mod n). - - xorq c, c - xorq j, j - xorq b, b -Lbignum_amontifier_dubloop1: - movq (z,j,8), a - shrdq $63, a, c - negq b - sbbq (t,j,8), c - sbbq b, b - movq c, (z,j,8) - movq a, c - incq j - cmpq k, j - jc Lbignum_amontifier_dubloop1 - shrq $63, c - addq b, c - xorq j, j - xorq b, b -Lbignum_amontifier_corrloop1: - movq (t,j,8), a - andq c, a - negq b - adcq (z,j,8), a - sbbq b, b - movq a, (z,j,8) - incq j - cmpq k, j - jc Lbignum_amontifier_corrloop1 - -// This is not exactly the same: we also copy output to t giving the -// initialization t_1 = r == 2^{p+64} mod n for the main loop next. - - xorq c, c - xorq j, j - xorq b, b -Lbignum_amontifier_dubloop2: - movq (z,j,8), a - shrdq $63, a, c - negq b - sbbq (t,j,8), c - sbbq b, b - movq c, (z,j,8) - movq a, c - incq j - cmpq k, j - jc Lbignum_amontifier_dubloop2 - shrq $63, c - addq b, c - xorq j, j - xorq b, b -Lbignum_amontifier_corrloop2: - movq (t,j,8), a - andq c, a - negq b - adcq (z,j,8), a - sbbq b, b - movq a, (z,j,8) - movq a, (t,j,8) - incq j - cmpq k, j - jc Lbignum_amontifier_corrloop2 - -// We then successively generate (k+1)-digit values satisfying -// t_i == 2^{p+64*i} mod n, each of which is stored in h::t. Finish -// initialization by zeroing h initially - - xorq h, h - -// Then if t_i = 2^{p} * h + l -// we have t_{i+1} == 2^64 * t_i -// = (2^{p+64} * h) + (2^64 * l) -// == r * h + l<<64 -// Do this k more times so we end up == 2^{128*k+64}, one more than we want -// -// Writing B = 2^{64k}, the possible correction of adding r, which for -// a (k+1)-digit result is equivalent to subtracting q = 2^{64*(k+1)} - r -// would give the overall worst-case value minus q of -// [ B * (B^k - 1) + (B - 1) * r ] - [B^{k+1} - r] -// = B * (r - 1) < B^{k+1} so we keep inside k+1 digits as required. -// -// This implementation makes the shift implicit by starting b with the -// "previous" digit (initially 0) to offset things by 1. - - movq k, i -Lbignum_amontifier_modloop: - xorq b, b - movq k, n - xorq j, j - xorq c, c -Lbignum_amontifier_cmaloop: - adcq b, c - sbbq l, l - movq (z,j,8), %rax - mulq h - subq l, %rdx - addq c, %rax - movq (t,j,8), b - movq %rax, (t,j,8) - movq %rdx, c - incq j - decq n - jnz Lbignum_amontifier_cmaloop - adcq c, b - movq b, h - - sbbq l, l - - xorq j, j - xorq c, c -Lbignum_amontifier_oaloop: - movq (t,j,8), a - movq (z,j,8), b - andq l, b - negq c - adcq b, a - sbbq c, c - movq a, (t,j,8) - incq j - cmpq k, j - jc Lbignum_amontifier_oaloop - subq c, h - - decq i - jnz Lbignum_amontifier_modloop - -// Now do one almost-Montgomery reduction w.r.t. the original m -// which lops off one 2^64 from the congruence and, with the usual -// almost-Montgomery correction, gets us back inside k digits for -// the end result. - - movq (m), a - movq a, c - movq a, b - shlq $2, c - subq c, b - xorq $2, b - movq b, c - imulq a, c - movl $2, ashort - addq c, a - addq $1, c - imulq a, b - imulq c, c - movl $1, ashort - addq c, a - imulq a, b - imulq c, c - movl $1, ashort - addq c, a - imulq a, b - imulq c, c - movl $1, ashort - addq c, a - imulq a, b - - movq (t), c - imulq c, b - - movq (m), %rax - mulq b - addq c, %rax - movq %rdx, c - movl $1, jshort - movq k, n - decq n - jz Lbignum_amontifier_montend - -Lbignum_amontifier_montloop: - adcq (t,j,8), c - sbbq l, l - movq (m,j,8), %rax - mulq b - subq l, %rdx - addq c, %rax - movq %rax, -8(t,j,8) - movq %rdx, c - incq j - decq n - jnz Lbignum_amontifier_montloop -Lbignum_amontifier_montend: - adcq c, h - sbbq l, l - movq h, -8(t,k,8) - - xorq j, j - xorq c, c -Lbignum_amontifier_osloop: - movq (t,j,8), a - movq (m,j,8), b - andq l, b - negq c - sbbq b, a - sbbq c, c - movq a, (z,j,8) - incq j - cmpq k, j - jc Lbignum_amontifier_osloop - -Lbignum_amontifier_end: - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_amontifier) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontmul.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontmul.S deleted file mode 100644 index f03c30f9acd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontmul.S +++ /dev/null @@ -1,253 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Almost-Montgomery multiply, z :== (x * y / 2^{64k}) (congruent mod m) -// Inputs x[k], y[k], m[k]; output z[k] -// -// extern void bignum_amontmul(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *y, const uint64_t *m); -// -// Does z :== (x * y / 2^{64k}) mod m, meaning that the result, in the native -// size k, is congruent modulo m, but might not be fully reduced mod m. This -// is why it is called *almost* Montgomery multiplication. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = x, RCX = y, R8 = m -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = x, R9 = y, [RSP+40] = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_amontmul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_amontmul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_amontmul) - .text - -// We copy x into %r9 but it comes in in %rdx originally - -#define k %rdi -#define z %rsi -#define x %r9 -#define y %rcx -#define m %r8 - -// General temp, low part of product and mul input -#define a %rax -// General temp, High part of product -#define b %rdx -// Inner loop counter -#define j %rbx -// Home for i'th digit or Montgomery multiplier -#define d %rbp -#define h %r10 -#define e %r11 -#define n %r12 -#define i %r13 -#define c0 %r14 -#define c1 %r15 - -// This one variable we store on the stack as we are a register short. -// At least it's only used once per iteration of the outer loop (k times) -// and with a single read each time, after one initial write. The variable -// is the word-level negated modular inverse - -#define w (%rsp) - -// Some more intuitive names for temp regs in initial word-level negmodinv. - -#define t1 %rbx -#define t2 %rdx - -#define ashort %eax -#define jshort %ebx - - -S2N_BN_SYMBOL(bignum_amontmul): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// Save registers and allocate space on stack for non-register variable w - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(8) - -// If k = 0 the whole operation is trivial - - testq k, k - jz Lbignum_amontmul_end - -// Move x input into its permanent home, since we need %rdx for multiplications - - movq %rdx, x - -// Compute word-level negated modular inverse w for m == m[0]. - - movq (m), a - - movq a, t2 - movq a, t1 - shlq $2, t2 - subq t2, t1 - xorq $2, t1 - - movq t1, t2 - imulq a, t2 - movl $2, ashort - addq t2, a - addq $1, t2 - - imulq a, t1 - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, t1 - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, t1 - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, t1 - - movq t1, w - -// Initialize the output c0::z to zero so we can then consistently add rows. -// It would be a bit more efficient to special-case the zeroth row, but -// this keeps the code slightly simpler. - - xorq i, i // Also initializes i for main loop - xorq j, j -Lbignum_amontmul_zoop: - movq i, (z,j,8) - incq j - cmpq k, j - jc Lbignum_amontmul_zoop - - xorq c0, c0 - -// Outer loop pulling down digits d=x[i], multiplying by y and reducing - -Lbignum_amontmul_outerloop: - -// Multiply-add loop where we always have CF + previous high part h to add in. -// Note that in general we do need yet one more carry in this phase and hence -// initialize c1 with the top carry. - - movq (x,i,8), d - xorq j, j - xorq h, h - xorq c1, c1 - movq k, n - -Lbignum_amontmul_maddloop: - adcq (z,j,8), h - sbbq e, e - movq (y,j,8), a - mulq d - subq e, %rdx - addq h, a - movq a, (z,j,8) - movq %rdx, h - incq j - decq n - jnz Lbignum_amontmul_maddloop - adcq h, c0 - adcq c1, c1 - -// Montgomery reduction loop, similar but offsetting writebacks - - movq (z), e - movq w, d - imulq e, d - movq (m), a - mulq d - addq e, a // Will be zero but want the carry - movq %rdx, h - movl $1, jshort - movq k, n - decq n - jz Lbignum_amontmul_montend - -Lbignum_amontmul_montloop: - adcq (z,j,8), h - sbbq e, e - movq (m,j,8), a - mulq d - subq e, %rdx - addq h, a - movq a, -8(z,j,8) - movq %rdx, h - incq j - decq n - jnz Lbignum_amontmul_montloop - -Lbignum_amontmul_montend: - adcq c0, h - adcq $0, c1 - movq c1, c0 - movq h, -8(z,j,8) - -// End of outer loop. - - incq i - cmpq k, i - jc Lbignum_amontmul_outerloop - -// Now convert carry word, which is always in {0,1}, into a mask "d" -// and do a masked subtraction of m for the final almost-Montgomery result. - - xorq d, d - subq c0, d - xorq e, e - xorq j, j -Lbignum_amontmul_corrloop: - movq (m,j,8), a - andq d, a - negq e - sbbq a, (z,j,8) - sbbq e, e - incq j - cmpq k, j - jc Lbignum_amontmul_corrloop - -Lbignum_amontmul_end: - - CFI_INC_RSP(8) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_amontmul) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontredc.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontredc.S deleted file mode 100644 index ade103bf51b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontredc.S +++ /dev/null @@ -1,249 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Almost-Montgomery reduce, z :== (x' / 2^{64p}) (congruent mod m) -// Inputs x[n], m[k], p; output z[k] -// -// extern void bignum_amontredc(uint64_t k, uint64_t *z, uint64_t n, -// const uint64_t *x, const uint64_t *m, uint64_t p); -// -// Does a :== (x' / 2^{64p}) mod m where x' = x if n <= p + k and in general -// is the lowest (p+k) digits of x. That is, p-fold almost-Montgomery reduction -// w.r.t. a k-digit modulus m giving a k-digit answer. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = n, RCX = x, R8 = m, R9 = p -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = n, R9 = x, [RSP+40] = m, [RSP+48] = p -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_amontredc) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_amontredc) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_amontredc) - .text - -// We copy x into %r10 but it comes in in %rdx originally - -#define k %rdi -#define z %rsi -#define n %r10 -#define x %rcx -#define m %r8 -#define p %r9 - -// General temp, low part of product and mul input -#define a %rax -// General temp, High part of product -#define b %rdx -// Negated modular inverse -#define w (%rsp) -// Inner loop counter -#define j %rbx -// Home for i'th digit or Montgomery multiplier -#define d %rbp -#define h %r11 -#define e %r12 -#define t %r13 -#define i %r14 -#define c %r15 - -// Some more intuitive names for temp regs in initial word-level negmodinv. - -#define t1 %rbx -#define t2 %r14 - -#define ashort %eax -#define cshort %r15d -#define jshort %ebx - - -S2N_BN_SYMBOL(bignum_amontredc): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 - movq 64(%rsp), %r9 -#endif - -// Save registers and allocate space on stack for non-register variable w - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(8) - -// If k = 0 the whole operation is trivial - - testq k, k - jz Lbignum_amontredc_end - -// Move n input into its permanent home, since we need %rdx for multiplications - - movq %rdx, n - -// Compute word-level negated modular inverse w for m == m[0]. - - movq (m), a - - movq a, t2 - movq a, t1 - shlq $2, t2 - subq t2, t1 - xorq $2, t1 - - movq t1, t2 - imulq a, t2 - movl $2, ashort - addq t2, a - addq $1, t2 - - imulq a, t1 - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, t1 - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, t1 - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, t1 - - movq t1, w - -// Initialize z to the lowest k digits of the input, zero-padding if n < k. - - movq k, j - cmpq k, n - cmovcq n, j - xorq i, i - testq j, j - jz Lbignum_amontredc_padloop -Lbignum_amontredc_copyloop: - movq (x,i,8), a - movq a, (z,i,8) - incq i - cmpq j, i - jc Lbignum_amontredc_copyloop - - cmpq k, i - jnc Lbignum_amontredc_initialized - - xorq j, j -Lbignum_amontredc_padloop: - movq j, (z,i,8) - incq i - cmpq k, i - jc Lbignum_amontredc_padloop - -Lbignum_amontredc_initialized: - xorq c, c - -// Now if p = 0 that's the end of the operation - - testq p, p - jz Lbignum_amontredc_end - -// Outer loop, just doing a standard Montgomery reduction on z - - xorq i, i -Lbignum_amontredc_outerloop: - movq (z), e - movq w, d - imulq e, d - movq (m), a - mulq d - addq e, a // Will be zero but want the carry - movq %rdx, h - movl $1, jshort - movq k, t - decq t - jz Lbignum_amontredc_montend - -Lbignum_amontredc_montloop: - adcq (z,j,8), h - sbbq e, e - movq (m,j,8), a - mulq d - subq e, %rdx - addq h, a - movq a, -8(z,j,8) - movq %rdx, h - incq j - decq t - jnz Lbignum_amontredc_montloop - -Lbignum_amontredc_montend: - adcq c, h - movl $0, cshort - adcq $0, c - - addq i, j - cmpq n, j - jnc Lbignum_amontredc_offtheend - movq (x,j,8), a - addq a, h - adcq $0, c -Lbignum_amontredc_offtheend: - movq h, -8(z,k,8) - -// End of outer loop. - - incq i - cmpq p, i - jc Lbignum_amontredc_outerloop - -// Now convert carry word, which is always in {0,1}, into a mask "d" -// and do a masked subtraction of m for the final almost-Montgomery result. - - xorq d, d - subq c, d - xorq e, e - xorq j, j -Lbignum_amontredc_corrloop: - movq (m,j,8), a - andq d, a - negq e - sbbq a, (z,j,8) - sbbq e, e - incq j - cmpq k, j - jc Lbignum_amontredc_corrloop - -Lbignum_amontredc_end: - CFI_INC_RSP(8) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_amontredc) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontsqr.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontsqr.S deleted file mode 100644 index d350337ac48..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_amontsqr.S +++ /dev/null @@ -1,240 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Almost-Montgomery square, z :== (x^2 / 2^{64k}) (congruent mod m) -// Inputs x[k], m[k]; output z[k] -// -// extern void bignum_amontsqr(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *m); -// -// Does z :== (x^2 / 2^{64k}) mod m, meaning that the result, in the native -// size k, is congruent modulo m, but might not be fully reduced mod m. This -// is why it is called *almost* Montgomery squaring. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = x, RCX = m -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = x, R9 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_amontsqr) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_amontsqr) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_amontsqr) - .text - -// We copy x into %r9 but it comes in in %rdx originally - -#define k %rdi -#define z %rsi -#define x %r9 -#define m %rcx - -// General temp, low part of product and mul input -#define a %rax -// General temp, High part of product -#define b %rdx -// Negated modular inverse -#define w %r8 -// Inner loop counter -#define j %rbx -// Home for i'th digit or Montgomery multiplier -#define d %rbp -#define h %r10 -#define e %r11 -#define n %r12 -#define i %r13 -#define c0 %r14 -#define c1 %r15 - -// A temp reg in the initial word-level negmodinv. - -#define t2 %rdx - -#define ashort %eax -#define jshort %ebx - - -S2N_BN_SYMBOL(bignum_amontsqr): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Save registers - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// If k = 0 the whole operation is trivial - - testq k, k - jz Lbignum_amontsqr_end - -// Move x input into its permanent home, since we need %rdx for multiplications - - movq %rdx, x - -// Compute word-level negated modular inverse w for m == m[0]. - - movq (m), a - - movq a, t2 - movq a, w - shlq $2, t2 - subq t2, w - xorq $2, w - - movq w, t2 - imulq a, t2 - movl $2, ashort - addq t2, a - addq $1, t2 - - imulq a, w - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, w - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, w - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, w - -// Initialize the output c0::z to zero so we can then consistently add rows. -// It would be a bit more efficient to special-case the zeroth row, but -// this keeps the code slightly simpler. - - xorq i, i // Also initializes i for main loop - xorq j, j -Lbignum_amontsqr_zoop: - movq i, (z,j,8) - incq j - cmpq k, j - jc Lbignum_amontsqr_zoop - - xorq c0, c0 - -// Outer loop pulling down digits d=x[i], multiplying by x and reducing - -Lbignum_amontsqr_outerloop: - -// Multiply-add loop where we always have CF + previous high part h to add in. -// Note that in general we do need yet one more carry in this phase and hence -// initialize c1 with the top carry. - - movq (x,i,8), d - xorq j, j - xorq h, h - xorq c1, c1 - movq k, n - -Lbignum_amontsqr_maddloop: - adcq (z,j,8), h - sbbq e, e - movq (x,j,8), a - mulq d - subq e, %rdx - addq h, a - movq a, (z,j,8) - movq %rdx, h - incq j - decq n - jnz Lbignum_amontsqr_maddloop - adcq h, c0 - adcq c1, c1 - -// Montgomery reduction loop, similar but offsetting writebacks - - movq (z), e - movq w, d - imulq e, d - movq (m), a - mulq d - addq e, a // Will be zero but want the carry - movq %rdx, h - movl $1, jshort - movq k, n - decq n - jz Lbignum_amontsqr_montend - -Lbignum_amontsqr_montloop: - adcq (z,j,8), h - sbbq e, e - movq (m,j,8), a - mulq d - subq e, %rdx - addq h, a - movq a, -8(z,j,8) - movq %rdx, h - incq j - decq n - jnz Lbignum_amontsqr_montloop - -Lbignum_amontsqr_montend: - adcq c0, h - adcq $0, c1 - movq c1, c0 - movq h, -8(z,j,8) - -// End of outer loop. - - incq i - cmpq k, i - jc Lbignum_amontsqr_outerloop - -// Now convert carry word, which is always in {0,1}, into a mask "d" -// and do a masked subtraction of m for the final almost-Montgomery result. - - xorq d, d - subq c0, d - xorq e, e - xorq j, j -Lbignum_amontsqr_corrloop: - movq (m,j,8), a - andq d, a - negq e - sbbq a, (z,j,8) - sbbq e, e - incq j - cmpq k, j - jc Lbignum_amontsqr_corrloop - -Lbignum_amontsqr_end: - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_amontsqr) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_bitfield.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_bitfield.S deleted file mode 100644 index 3040346713c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_bitfield.S +++ /dev/null @@ -1,128 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Select bitfield starting at bit n with length l <= 64 -// Inputs x[k], n, l; output function return -// -// extern uint64_t bignum_bitfield(uint64_t k, const uint64_t *x, uint64_t n, -// uint64_t l); -// -// One-word bitfield from a k-digit (digit=64 bits) bignum, in constant-time -// style. Bitfield starts at bit n and has length l, indexing from 0 (=LSB). -// Digits above the top are treated uniformly as zero, as usual. Since the -// result is returned in a single word, effectively we use l' = min(64,l) -// for the length. -// -// Standard x86-64 ABI: RDI = k, RSI = x, RDX = n, RCX = l, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, R8 = n, R9 = l, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_bitfield) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_bitfield) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_bitfield) - .text - -#define k %rdi -#define x %rsi -#define n %rdx -#define l %rcx - -#define d %r8 -#define e %rax -#define i %r9 -#define a %r10 -#define m %r11 - -#define mshort %r11d - - - -S2N_BN_SYMBOL(bignum_bitfield): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Initialize second of digit pair to zero and if length is zero finish -// immediately; the digit e is also the return value in RAX - - xorq e, e - testq k, k - jz Lbignum_bitfield_end - -// Decompose the index into n = 64 * n + m, then increment n for next part - - movl $63, mshort - andq n, m - shrq $6, n - incq n - -// Run over the digits setting d = n'th and e = (n+1)'th - - xorq i, i -Lbignum_bitfield_loop: - movq (x,i,8), a - cmpq n, i - cmovcq a, d - cmovzq a, e - incq i - cmpq k, i - jc Lbignum_bitfield_loop - -// Put zero in a register, for several purposes - - xorq a, a - -// Override d with 0 if we ran off the end (e will retain original 0). - - cmpq n, i - cmovcq a, d - -// Override e if we have m = 0 (i.e. original n was divisible by 64) -// This is because then we want to shift it right by 64 below. - - testq m, m - cmovzq a, e - -// Create a size-l bitmask first (while the shift is conveniently in CL) - - cmpq $64, l - adcq a, a - shlq %cl, a - decq a - -// Combine shifted digits to get the bitfield(n,64) - - movq m, l - shrq %cl, d - negq %rcx - shlq %cl, e - orq d, e - -// Now mask it down to get bitfield (n,l) - - andq a, e - -Lbignum_bitfield_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_bitfield) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_bitsize.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_bitsize.S deleted file mode 100644 index 53ecc10d637..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_bitsize.S +++ /dev/null @@ -1,92 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Return size of bignum in bits -// Input x[k]; output function return -// -// extern uint64_t bignum_bitsize(uint64_t k, const uint64_t *x); -// -// In the case of a zero bignum as input the result is 0 -// -// In principle this has a precondition k < 2^58, but obviously that -// is always true in practice because of address space limitations. -// -// Standard x86-64 ABI: RDI = k, RSI = x, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_bitsize) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_bitsize) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_bitsize) - .text - -#define k %rdi -#define x %rsi -#define i %rax -#define w %rdx -#define a %rcx -#define j %r8 - - - -S2N_BN_SYMBOL(bignum_bitsize): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Initialize the index i and also prepare default return value of 0 (i = %rax) - - xorq i, i - -// If the bignum is zero-length, just return 0 - - testq k, k - jz Lbignum_bitsize_end - -// Use w = a[i-1] to store nonzero words in a bottom-up sweep -// Set the initial default to be as if we had a 11...11 word directly below - - movq $-1, w - xorq j, j -Lbignum_bitsize_loop: - movq (x,j,8), a - incq j - testq a, a - cmovnzq j, i - cmovnzq a, w - cmpq k, j - jnz Lbignum_bitsize_loop - -// Now w = a[i-1] is the highest nonzero word, or in the zero case the -// default of the "extra" 11...11 = a[0-1]. We now want 64* i - clz(w) = -// 64 * i - (63 - bsr(w)) = (64 * i - 63) + bsr(w). Note that this code -// does not rely on the behavior of the bsr instruction for zero inputs, -// which is undefined. - - shlq $6, i - subq $63, i - bsrq w, w - addq w, %rax - -Lbignum_bitsize_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_bitsize) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cdiv.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cdiv.S deleted file mode 100644 index 70890db490b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cdiv.S +++ /dev/null @@ -1,340 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Divide by a single (nonzero) word, z := x / m and return x mod m -// Inputs x[n], m; outputs function return (remainder) and z[k] -// -// extern uint64_t bignum_cdiv(uint64_t k, uint64_t *z, uint64_t n, -// const uint64_t *x, uint64_t m); -// -// Does the "z := x / m" operation where x is n digits, result z is k. -// Truncates the quotient in general, but always (for nonzero m) returns -// the true remainder x mod m. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = n, RCX = x, R8 = m -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = n, R9 = x, [RSP+40] = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cdiv) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cdiv) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cdiv) - .text - -#define k %rdi -#define z %rsi -#define m %r8 - -// These parameters get moved because of special uses for %rcx, %rdx - -#define n %r9 -#define x %r10 - -// This needs to be in %rcx for variable shifts with %cl - -#define e %rcx - -// Other variables - -#define w %r11 -#define d %r12 -#define i %rbx -#define c %r13 -#define l %r14 - -#define a %rax -#define h %rdx - -#define ashort %eax -#define ishort %ebx -#define hshort %edx - -// The remainder - -#define r %r15 - -S2N_BN_SYMBOL(bignum_cdiv): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Move parameters that need a new home - - movq %rdx, n - movq %rcx, x - -// First do a modulus computation, slightly tweaked from bignum_cmod, -// changing variables and avoiding modification of the size parameter. -// Initialize l = 0 now for convenience (we eventually need to do it). -// If the bignum is zero-length, l is already the right answer of 0 - - xorq l, l - testq n, n - jz Lbignum_cdiv_nomodulus - - bsrq m, e - xorq $63, e - shlq %cl, m - - movq m, r - movq $0x1FFFFFFFFFFFF, w - shrq $16, r - xorq r, w - incq r - shrq $32, w - movq r, h - imulq w, h - negq h - movq h, a - shrq $49, a - imulq a, a - shrq $34, h - addq a, h - orq $0x40000000, a - imulq h, a - shrq $30, a - imulq w, a - shlq $30, w - addq a, w - shrq $30, w - movq r, h - imulq w, h - negq h - shrq $24, h - imulq w, h - shlq $16, w - shrq $24, h - addq h, w - movq r, h - imulq w, h - negq h - shrq $32, h - imulq w, h - shlq $31, w - shrq $17, h - addq h, w - movq m, a - mulq w - shrdq $60, h, a - movq w, h - shrq $33, h - notq a - imulq h, a - shlq $1, w - shrq $33, a - addq a, w - addq $1, w - movq m, a - sbbq $0, w - mulq w - addq m, h - sbbq $0, w - - movq m, r - imulq w, r - negq r - - xorl hshort, hshort - movq n, i -Lbignum_cdiv_modloop: - movq h, a - mulq r - addq -8(x,i,8), a - adcq l, h - movq a, l - sbbq a, a - andq r, a - addq a, l - adcq $0, h - decq i - jnz Lbignum_cdiv_modloop - - movq h, i - movq w, a - mulq h - addq i, h - sbbq r, r - andq m, r - - movq h, a - mulq m - addq r, h - xorq r, r - subq a, l - sbbq h, i - - cmovnzq m, r - xorl ashort, ashort - subq r, l - sbbq a, i - - cmovnzq m, a - subq a, l - - movq w, a - mulq l - addq l, h - rcr $1, h - - shrq %cl, m - xorq $63, e - shrq %cl, h - - imulq m, h - subq h, l - - movq l, r - subq m, l -Lbignum_cdiv_nomodulus: - cmovncq l, r - -// If k = 0 then there's no more to be done - - testq k, k - jz Lbignum_cdiv_end - -// Let e be the number of trailing zeros in m (we can ignore m = 0) - - bsfq m, e - -// Now just shift m right by e bits. So hereafter we can assume m is odd -// but we first need to shift the input right by e bits then divide by m. - - shrq %cl, m - -// Compute the negated modular inverse w with w * m + 1 == 0 (mod 2^64) -// This is essentially the same as word_negmodinv. - - movq m, a - movq m, w - shlq $2, a - subq a, w - xorq $2, w - movq w, a - imulq m, a - movl $2, hshort - addq a, h - addq $1, a - imulq h, w - imulq a, a - movl $1, hshort - addq a, h - imulq h, w - imulq a, a - movl $1, hshort - addq a, h - imulq h, w - imulq a, a - movl $1, hshort - addq a, h - imulq h, w - -// We have the remainder r, so now x = m * y + r for some quotient y -// to be computed. Consider x' = x + (m - r) = m * (y + 1) and do a -// Montgomery reduction, keeping the cofactor z. This gives us -// x' + m * z = 2^{64k} * c where c <= m. Thus since x' = m * (y + 1) -// we have -// -// m * (y + z + 1) = 2^{64k} * c -// -// This means m * (y + z + 1) == 0 (mod 2^{64k}), even when we truncate -// x to k digits (if in fact k < n). Since m is odd, it's coprime to -// 2^{64k} so we can cancel and get y + z + 1 == 0 (mod 2^{64k}), and -// hence using logical complement y == ~z (mod 2^{64k}). Thus we can -// write back the logical complements of the cofactor as the answer. -// Start with carry word c = m - r/2^e to make the initial tweak -// x' = x + (m - r); since we've shifted everything initially by e -// we need to shift the remainder too before subtracting from the -// shifted m. - - movq r, d - shrq %cl, d - movq m, c - subq d, c - xorl ishort, ishort - -// Unless n = 0, preload the zeroth digit and bump up the x pointer by -// 8 and n down by 1, to ease indexing and comparison using the same -// variable i in the main loop. When n = 0 we leave it alone, as the -// comparison i < n will always fail and the x pointer is unused. - - xorq d, d - testq n, n - jz Lbignum_cdiv_loop - movq (x), d - addq $8, x - decq n - -Lbignum_cdiv_loop: - -// Load the next digit up to get [l,d] then shift right e places - - xorq l, l - cmpq n, i - jnc Lbignum_cdiv_noload - movq (x,i,8), l -Lbignum_cdiv_noload: - shrdq %cl, l, d - addq c, d - sbbq c, c - negq c - -// Now the effective sum is [c,a] where the carry-in has been absorbed. -// Do the main Montgomery step with the (odd) m, writing back ~q. Finally -// set d to the next digit ready for the following iteration. - - movq w, a - imulq d, a - notq a - movq a, (z,i,8) - notq a - - mulq m - addq d, a - adcq h, c - - movq l, d - - incq i - cmpq k, i - jc Lbignum_cdiv_loop - -// Return the modulus - -Lbignum_cdiv_end: - movq r, %rax - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cdiv) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cdiv_exact.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cdiv_exact.S deleted file mode 100644 index 0ad262fbffb..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cdiv_exact.S +++ /dev/null @@ -1,197 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Divide by a single word, z := x / m *when known to be exact* -// Inputs x[n], m; output z[k] -// -// extern void bignum_cdiv_exact(uint64_t k, uint64_t *z, uint64_t n, -// const uint64_t *x, uint64_t m); -// -// Does the "z := x / m" operation where x is n digits and result z is k, -// *assuming* that m is nonzero and that the input x is in fact an -// exact multiple of m. (If this isn't known, use the general bignum_cdiv -// function instead.) In general the result is truncated to k digits. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = n, RCX = x, R8 = m -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = n, R9 = x, [RSP+40] = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cdiv_exact) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cdiv_exact) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cdiv_exact) - .text - -#define k %rdi -#define z %rsi -#define m %r8 - -// These parameters get moved because of special uses for %rcx, %rdx - -#define n %r9 -#define x %r10 - -// This needs to be in %rcx for variable shifts with %cl - -#define e %rcx - -// Other variables - -#define w %r11 -#define d %r12 -#define i %rbx -#define c %r13 -#define t %r14 - -#define a %rax -#define h %rdx - -#define ishort %ebx -#define hshort %edx - -S2N_BN_SYMBOL(bignum_cdiv_exact): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - -// If k = 0 then there's nothing to be done - - testq k, k - jz Lbignum_cdiv_exact_end - -// Move parameters that need a new home - - movq %rdx, n - movq %rcx, x - -// Let e be the number of trailing zeros in m (we can ignore m = 0) - - bsfq m, e - -// Now just shift m right by e bits. So hereafter we can assume m is odd -// but we first need to shift the input right by e bits then divide by m. - - shrq %cl, m - -// Compute the negated modular inverse w with w * m + 1 == 0 (mod 2^64) -// This is essentially the same as word_negmodinv. - - movq m, a - movq m, w - shlq $2, a - subq a, w - xorq $2, w - movq w, a - imulq m, a - movl $2, hshort - addq a, h - addq $1, a - imulq h, w - imulq a, a - movl $1, hshort - addq a, h - imulq h, w - imulq a, a - movl $1, hshort - addq a, h - imulq h, w - imulq a, a - movl $1, hshort - addq a, h - imulq h, w - -// Consider x' = x + m and do a Montgomery reduction, keeping the cofactor z. -// This gives us x' + m * z = 2^{64k} * c where c <= m. Assuming x = m * y -// we then have m * y + m + m * z = 2^{64k} * c, i.e. -// -// m * (y + z + 1) = 2^{64k} * c -// -// This means m * (y + z + 1) == 0 (mod 2^{64k}), even when we truncate -// x to k digits (if in fact k < n). Since m is odd, it's coprime to -// 2^{64k} so we can cancel and get y + z + 1 == 0 (mod 2^{64k}), and -// hence using logical complement y == ~z (mod 2^{64k}). Thus we can -// write back the logical complements of the cofactor as the answer. -// Start with carry word c = m to make the initial tweak x' = x + m. - - movq m, c - xorl ishort, ishort - -// Unless n = 0, preload the zeroth digit and bump up the x pointer by -// 8 and n down by 1, to ease indexing and comparison using the same -// variable i in the main loop. When n = 0 we leave it alone, as the -// comparison i < n will always fail and the x pointer is unused. - - xorq d, d - testq n, n - jz Lbignum_cdiv_exact_loop - movq (x), d - addq $8, x - decq n - -Lbignum_cdiv_exact_loop: - -// Load the next digit up to get [t,d] then shift right e places - - xorq t, t - cmpq n, i - jnc Lbignum_cdiv_exact_noload - movq (x,i,8), t -Lbignum_cdiv_exact_noload: - shrdq %cl, t, d - addq c, d - sbbq c, c - negq c - -// Now the effective sum is [c,a] where the carry-in has been absorbed. -// Do the main Montgomery step with the (odd) m, writing back ~q. Finally -// set d to the next digit ready for the following iteration. - - movq w, a - imulq d, a - notq a - movq a, (z,i,8) - notq a - - mulq m - addq d, a - adcq h, c - - movq t, d - - incq i - cmpq k, i - jc Lbignum_cdiv_exact_loop - -Lbignum_cdiv_exact_end: - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cdiv_exact) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cld.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cld.S deleted file mode 100644 index 63c5121edbc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cld.S +++ /dev/null @@ -1,77 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count leading zero digits (64-bit words) -// Input x[k]; output function return -// -// extern uint64_t bignum_cld(uint64_t k, const uint64_t *x); -// -// In the case of a zero bignum as input the result is k -// -// Standard x86-64 ABI: RDI = k, RSI = x, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cld) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cld) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cld) - .text - -#define k %rdi -#define x %rsi -#define i %rax -#define a %rcx -#define j %rdx - - - -S2N_BN_SYMBOL(bignum_cld): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Initialize the index i and also prepare default return value of 0 (i = %rax) - - xorq i, i - -// If the bignum is zero-length, just return k = 0 - - testq k, k - jz Lbignum_cld_end - -// Run over the words j = 0..i-1, and set i := j + 1 when hitting nonzero a[j] - - xorq j, j -Lbignum_cld_loop: - movq (x,j,8), a - incq j - testq a, a - cmovnzq j, i - cmpq k, j - jnz Lbignum_cld_loop - - negq %rax - addq %rdi, %rax - -Lbignum_cld_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cld) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_clz.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_clz.S deleted file mode 100644 index 077bc204b89..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_clz.S +++ /dev/null @@ -1,92 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count leading zero bits -// Input x[k]; output function return -// -// extern uint64_t bignum_clz(uint64_t k, const uint64_t *x); -// -// In the case of a zero bignum as input the result is 64 * k -// -// In principle this has a precondition k < 2^58, but obviously that -// is always true in practice because of address space limitations -// -// Standard x86-64 ABI: RDI = k, RSI = x, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_clz) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_clz) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_clz) - .text - -#define k %rdi -#define x %rsi -#define i %rax -#define w %rdx -#define a %rcx -#define j %r8 - - - -S2N_BN_SYMBOL(bignum_clz): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Initialize the index i and also prepare default return value of 0 (i = %rax) - - xorq i, i - -// If the bignum is zero-length, just return 0 - - testq k, k - jz Lbignum_clz_end - -// Use w = a[i-1] to store nonzero words in a bottom-up sweep -// Set the initial default to be as if we had a 11...11 word directly below - - movq $-1, w - xorq j, j -Lbignum_clz_loop: - movq (x,j,8), a - incq j - testq a, a - cmovnzq j, i - cmovnzq a, w - cmpq k, j - jnz Lbignum_clz_loop - -// Now w = a[i-1] is the highest nonzero word, or in the zero case the -// default of the "extra" 11...11 = a[0-1]. We now want 64*(k - i) + clz(w) = -// 64*(k - i) + (63 - bsr(w)). Note that this code does not rely on the -// behavior of the bsr instruction for zero inputs, where it is undefined - - subq i, k - shlq $6, k - bsrq w, %rax - xorq $63, %rax - addq k, %rax - -Lbignum_clz_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_clz) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmadd.S deleted file mode 100644 index 3654b63f7f4..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmadd.S +++ /dev/null @@ -1,148 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply-add with single-word multiplier, z := z + c * y -// Inputs c, y[n]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_cmadd(uint64_t k, uint64_t *z, uint64_t c, uint64_t n, -// const uint64_t *y); -// -// Does the "z := z + c * y" operation where y is n digits, result z is p. -// Truncates the result in general. -// -// The return value is a high/carry word that is meaningful when p = n + 1, or -// more generally when n <= p and the result fits in p + 1 digits. In these -// cases it gives the top digit of the (p + 1)-digit result. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = c, RCX = n, R8 = y, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = c, R9 = n, [RSP+40] = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmadd) - .text - -#define p %rdi -#define z %rsi -#define c %r9 -#define n %rcx -#define x %r8 - -#define i %r10 -#define h %r11 - -#define r %rbx - -#define hshort %r11d -#define ishort %r10d - - - -S2N_BN_SYMBOL(bignum_cmadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// Seems hard to avoid one more register - - CFI_PUSH(%rbx) - -// First clamp the input size n := min(p,n) since we can never need to read -// past the p'th term of the input to generate p-digit output. -// Subtract p := p - min(n,p) so it holds the size of the extra tail needed - - cmpq n, p - cmovcq p, n - subq n, p - -// Initialize high part h = 0; if n = 0 do nothing but return that zero - - xorq h, h - testq n, n - jz Lbignum_cmadd_end - -// Move c into a safer register as multiplies overwrite %rdx - - movq %rdx, c - -// Initialization of the loop: 2^64 * CF + [h,z_0'] = z_0 + c * x_0 - - movq (x), %rax - mulq c - addq %rax, (z) - movq %rdx, h - movl $1, ishort - decq n - jz Lbignum_cmadd_hightail - -// Main loop, where we always have CF + previous high part h to add in - -Lbignum_cmadd_loop: - adcq (z,i,8), h - sbbq r, r - movq (x,i,8), %rax - mulq c - subq r, %rdx - addq h, %rax - movq %rax, (z,i,8) - movq %rdx, h - incq i - decq n - jnz Lbignum_cmadd_loop - -Lbignum_cmadd_hightail: - adcq $0, h - -// Propagate the carry all the way to the end with h as extra carry word - -Lbignum_cmadd_tail: - testq p, p - jz Lbignum_cmadd_end - - addq h, (z,i,8) - movl $0, hshort - incq i - decq p - jz Lbignum_cmadd_highend - -Lbignum_cmadd_tloop: - adcq h, (z,i,8) - incq i - decq p - jnz Lbignum_cmadd_tloop - -Lbignum_cmadd_highend: - - adcq $0, h - -// Return the high/carry word - -Lbignum_cmadd_end: - movq h, %rax - - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmnegadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmnegadd.S deleted file mode 100644 index 8872a9f73f1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmnegadd.S +++ /dev/null @@ -1,158 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Negated multiply-add with single-word multiplier, z := z - c * y -// Inputs c, y[n]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_cmnegadd(uint64_t k, uint64_t *z, uint64_t c, uint64_t n, -// const uint64_t *y); -// -// Does the "z := z - c * y" operation where y is n digits, result z is p. -// Truncates the result in general. -// -// The return value is a high/carry word that is meaningful when n <= p. -// It is interpreted negatively as z' - 2^{64k} * return = z - c * y. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = c, RCX = n, R8 = y, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = c, R9 = n, [RSP+40] = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmnegadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmnegadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmnegadd) - .text - -#define p %rdi -#define z %rsi -#define c %r9 -#define n %rcx -#define x %r8 - -#define i %r10 -#define h %r11 - -#define r %rbx - -#define hshort %r11d -#define ishort %r10d - - - -S2N_BN_SYMBOL(bignum_cmnegadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// Seems hard to avoid one more register - - CFI_PUSH(%rbx) - -// First clamp the input size n := min(p,n) since we can never need to read -// past the p'th term of the input to generate p-digit output. -// Subtract p := p - min(n,p) so it holds the size of the extra tail needed - - cmpq n, p - cmovcq p, n - subq n, p - -// Initialize high part h = 0; if n = 0 do nothing but return that zero - - xorq h, h - testq n, n - jz Lbignum_cmnegadd_end - -// Move c into a safer register as multiplies overwrite %rdx - - movq %rdx, c - -// Initialization of the loop: 2^64 * CF + [h,z_0'] = z_0 + c * ~x_0 + c - - movq (x), %rax - notq %rax - mulq c - addq c, %rax - adcq $0, %rdx - addq %rax, (z) - movq %rdx, h - movl $1, ishort - decq n - jz Lbignum_cmnegadd_tail - -// Main loop, where we always have CF + previous high part h to add in - -Lbignum_cmnegadd_loop: - adcq (z,i,8), h - sbbq r, r - movq (x,i,8), %rax - notq %rax - mulq c - subq r, %rdx - addq h, %rax - movq %rax, (z,i,8) - movq %rdx, h - incq i - decq n - jnz Lbignum_cmnegadd_loop - -// At this point we have 2^{64n} * (h + CF) + z' = z + c * (2^{64n} - x) -// so z' - 2^{64n} * (c - (h + CF)) = z - c * x. -// Since z - c * x < 2^{64n} we must have c - (h + CF) >= 0. -// Accumulate the negative carry in h for consistency with trivial cases. - -Lbignum_cmnegadd_tail: - sbbq h, c - movq c, h - -// Propagate the carry all the way to the end with h as extra carry word - - testq p, p - jz Lbignum_cmnegadd_end - - subq h, (z,i,8) - movl $0, hshort - incq i - decq p - jz Lbignum_cmnegadd_highend - -Lbignum_cmnegadd_tloop: - sbbq h, (z,i,8) - incq i - decq p - jnz Lbignum_cmnegadd_tloop - -Lbignum_cmnegadd_highend: - -// Adjust the high word with the carry from subtraction - - adcq $0, h - -// Return the high/carry word - -Lbignum_cmnegadd_end: - movq h, %rax - - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmnegadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmod.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmod.S deleted file mode 100644 index a2c1acb3972..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmod.S +++ /dev/null @@ -1,227 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Find bignum modulo a single word -// Input x[k], m; output function return -// -// extern uint64_t bignum_cmod(uint64_t k, const uint64_t *x, uint64_t m); -// -// Returns x mod m, assuming m is nonzero. -// -// Standard x86-64 ABI: RDI = k, RSI = x, RDX = m, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, R8 = m, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmod) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmod) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmod) - .text - -#define k %rdi -#define x %rsi - -// This has to be %rcx for variable shifts - -#define e %rcx - -// We share the same variable for m and n, just shifting left then right. -// And h is kept in %rdx which does work despite the special operands of mul. - -#define m %r8 -#define n %r8 - -#define w %r9 -#define a %rax -#define r %r10 -#define h %rdx -#define l %r11 - -#define ashort %eax -#define hshort %edx - -S2N_BN_SYMBOL(bignum_cmod): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Initialize l = 0 now for convenience (we eventually need to do it). -// If the bignum is zero-length, l is already the right answer of 0 - - xorq l, l - testq k, k - jz Lbignum_cmod_end - -// Move m into its permanent home (also used for n). -// Find number of leading zeros of m and let n = 2^e m so that for an -// in-scope (nonzero) input m we have n >= 2^63, e <= 63. - - movq %rdx, m - bsrq m, e - xorq $63, e - shlq %cl, m - -// A near-clone of word_recip so 2^64 + w = ceil(2^128 / n) - 1 - - movq n, r - movq $0x1FFFFFFFFFFFF, w - shrq $16, r - xorq r, w - incq r - shrq $32, w - movq r, h - imulq w, h - negq h - movq h, a - shrq $49, a - imulq a, a - shrq $34, h - addq a, h - orq $0x40000000, a - imulq h, a - shrq $30, a - imulq w, a - shlq $30, w - addq a, w - shrq $30, w - movq r, h - imulq w, h - negq h - shrq $24, h - imulq w, h - shlq $16, w - shrq $24, h - addq h, w - movq r, h - imulq w, h - negq h - shrq $32, h - imulq w, h - shlq $31, w - shrq $17, h - addq h, w - movq n, a - mulq w - shrdq $60, h, a - movq w, h - shrq $33, h - notq a - imulq h, a - shlq $1, w - shrq $33, a - addq a, w - addq $1, w - movq n, a - sbbq $0, w - mulq w - addq n, h - sbbq $0, w - -// Take the residue r = 2^128 - (2^64 + w) * n, which by the above bound -// we know fits in 64 bits. We know 2^128 == r (mod n) and hence (mod m). - - movq n, r - imulq w, r - negq r - -// Now just go down through the digits accumulating [h;l] == x (mod n) -// by 2^64 * [h;l] + d = 2^128 * h + [l;d] == r * h + [l; d]. That addition -// may overflow with a carry, say 2^128 + [h';l'] = r * h + [l; d], in -// which case we subtract 2^128 - r (which is divisible by m and keeping -// things in 128 bits we just add r). Thus the overall bound when we initially -// overflow is r * h + [l; d] - (2^128 - r) = r * (h + 1) + [l; d] - 2^128 -// < 2^128 so we stay inside 2 words - - xorl hshort, hshort -Lbignum_cmod_loop: - movq h, a - mulq r - addq -8(x,k,8), a - adcq l, h - movq a, l - sbbq a, a - andq r, a - addq a, l - adcq $0, h - decq k - jnz Lbignum_cmod_loop - -// Now do reciprocal multiplication to reduce the 2-word modular equivalent -// [h;l] to the single word l. If we assume the truncations are as follows -// 2^64 + w = 2^128 / n - epsilon (0 <= epsilon <= 1) -// q = (w * h / 2^64) - delta (0 <= delta <= 1) -// the net remainder is l + (h/2^64 * epsilon + delta) * n < l + 2 * n. -// In general this needs two rounds of comparison to guarantee getting -// into a single word (though one more mul could be used instead). -// Also, the quotient estimate can overflow so we use r as extra addend -// 2^64 * n when the initial addition overflows. The overall multiple -// of n can't itself overflow, since we know it's an underestimate of -// the initial residue. - - movq h, k // back up h for muls - movq w, a - mulq h - addq k, h - sbbq r, r - andq n, r // So q = (r;h) - - movq h, a - mulq n - addq r, h - xorq r, r - subq a, l - sbbq h, k // (k,l) = first reduction - - cmovnzq n, r - xorl ashort, ashort - subq r, l - sbbq a, k - - cmovnzq n, a - subq a, l - -// One more reciprocal multiplication to do a modular reduction, but now in -// one word and in terms of the original m. For the quotient estimate we want -// q = ((2^64 + w) * l) / 2^{128-e} = ((2^64 + w) * l) / 2^65 / 2^{63-e}. - - movq w, a - mulq l - addq l, h - rcr $1, h - - shrq %cl, m - xorq $63, e - shrq %cl, h - - imulq m, h - subq h, l - -// Note that since there is no neglected "low" part of the single word, -// one round of correction suffices; in the analog of the above l = 0 -// and hence the residue so far is already < 2 * m. - - movq l, a - subq m, l -Lbignum_cmod_end: - cmovncq l, a -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmod) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmul.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmul.S deleted file mode 100644 index 44af2768a41..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_cmul.S +++ /dev/null @@ -1,131 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word, z := c * y -// Inputs c, y[n]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_cmul(uint64_t k, uint64_t *z, uint64_t c, uint64_t n, -// const uint64_t *y); -// -// Does the "z := c * y" operation where y is n digits, result z is p. -// Truncates the result in general unless p >= n + 1. -// -// The return value is a high/carry word that is meaningful when p >= n as -// giving the high part of the result. Since this is always zero if p > n, -// it is mainly of interest in the special case p = n, i.e. where the source -// and destination have the same nominal size, when it gives the extra word -// of the full result. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = c, RCX = n, R8 = y, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = c, R9 = n, [RSP+40] = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul) - .text - -#define p %rdi -#define z %rsi -#define c %r9 -#define n %rcx -#define x %r8 - -#define i %r10 -#define h %r11 - - - -S2N_BN_SYMBOL(bignum_cmul): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// First clamp the input size n := min(p,n) since we can never need to read -// past the p'th term of the input to generate p-digit output. Now we can -// assume that n <= p - - cmpq n, p - cmovcq p, n - -// Initialize current input/output pointer offset i and high part h. -// But then if n = 0 skip the multiplication and go to the tail part - - xorq h, h - xorq i, i - testq n, n - jz Lbignum_cmul_tail - -// Move c into a safer register as multiplies overwrite %rdx - - movq %rdx, c - -// Initialization of the loop: [h,l] = c * x_0 - - movq (x), %rax - mulq c - movq %rax, (z) - movq %rdx, h - incq i - cmpq n, i - jz Lbignum_cmul_tail - -// Main loop doing the multiplications - -Lbignum_cmul_loop: - movq (x,i,8), %rax - mulq c - addq h, %rax - adcq $0, %rdx - movq %rax, (z,i,8) - movq %rdx, h - incq i - cmpq n, i - jc Lbignum_cmul_loop - -// Add a tail when the destination is longer - -Lbignum_cmul_tail: - cmpq p, i - jnc Lbignum_cmul_end - movq h, (z,i,8) - xorq h, h - incq i - cmpq p, i - jnc Lbignum_cmul_end - -Lbignum_cmul_tloop: - movq h, (z,i,8) - incq i - cmpq p, i - jc Lbignum_cmul_tloop - -// Return the high/carry word - -Lbignum_cmul_end: - movq h, %rax - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_coprime.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_coprime.S deleted file mode 100644 index af8312757c0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_coprime.S +++ /dev/null @@ -1,522 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Test bignums for coprimality, gcd(x,y) = 1 -// Inputs x[m], y[n]; output function return; temporary buffer t[>=2*max(m,n)] -// -// extern uint64_t bignum_coprime(uint64_t m, const uint64_t *x, uint64_t n, -// const uint64_t *y, uint64_t *t); -// -// Test for whether two bignums are coprime (no common factor besides 1). -// This is equivalent to testing if their gcd is 1, but a bit faster than -// doing those two computations separately. -// -// Here bignum x is m digits long, y is n digits long and the temporary -// buffer t needs to be 2 * max(m,n) digits long. The return value is -// 1 if coprime(x,y) and 0 otherwise. -// -// Standard x86-64 ABI: RDI = m, RSI = x, RDX = n, RCX = y, R8 = t, returns RAX -// Microsoft x64 ABI: RCX = m, RDX = x, R8 = n, R9 = y, [RSP+40] = t, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_coprime) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_coprime) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_coprime) - .text - -// We get CHUNKSIZE bits per outer iteration, 64 minus a bit for proxy errors - -#define CHUNKSIZE 58 - -// These variables are so fundamental we keep them consistently in registers. -// m is in fact the temporary buffer argument w so use the same register - -#define m %r8 -#define n %r15 -#define k %r14 -#define l %r13 - -// These are kept on the stack since there aren't enough registers - -#define mat_mm (%rsp) -#define mat_mn 8(%rsp) -#define mat_nm 16(%rsp) -#define mat_nn 24(%rsp) -#define t 32(%rsp) -#define evenor 40(%rsp) - -#define STACKVARSIZE 48 - -// These are shorthands for common temporary register - -#define a %rax -#define b %rbx -#define c %rcx -#define d %rdx -#define i %r9 - -// Temporaries for the top proxy selection part - -#define c1 %r10 -#define c2 %r11 -#define h1 %r12 -#define h2 %rbp -#define l1 %rdi -#define l2 %rsi - -// Re-use for the actual proxies; m_hi = h1 and n_hi = h2 are assumed - -#define m_hi %r12 -#define n_hi %rbp -#define m_lo %rdi -#define n_lo %rsi - -// Re-use for the matrix entries in the inner loop, though they -// get spilled to the corresponding memory locations mat_... - -#define m_m %r10 -#define m_n %r11 -#define n_m %rcx -#define n_n %rdx - -#define ishort %r9d -#define m_mshort %r10d -#define m_nshort %r11d -#define n_mshort %ecx -#define n_nshort %edx - -// Because they are so unmemorable - -#define arg1 %rdi -#define arg2 %rsi -#define arg3 %rdx -#define arg4 %rcx - -S2N_BN_SYMBOL(bignum_coprime): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// Save all required registers and make room on stack for all the above vars - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(STACKVARSIZE) - -// Compute k = max(m,n), and if this is zero skip to the end. Note that -// in this case k is also in %rax so serves as the right answer of "false" - - movq arg1, %rax - cmpq arg3, %rax - cmovcq arg3, %rax - movq %rax, k - - testq %rax, %rax - jz Lbignum_coprime_end - -// Set up inside w two size-k buffers m and n - - leaq (m,k,8), n - -// Copy the input x into the buffer m, padding with zeros as needed - - xorq i, i - testq arg1, arg1 - jz Lbignum_coprime_xpadloop -Lbignum_coprime_xloop: - movq (arg2,i,8), a - movq a, (m,i,8) - incq i - cmpq arg1, i - jc Lbignum_coprime_xloop - cmpq k, i - jnc Lbignum_coprime_xskip -Lbignum_coprime_xpadloop: - movq $0, (m,i,8) - incq i - cmpq k, i - jc Lbignum_coprime_xpadloop -Lbignum_coprime_xskip: - -// Copy the input y into the buffer n, padding with zeros as needed - - xorq i, i - testq arg3, arg3 - jz Lbignum_coprime_ypadloop -Lbignum_coprime_yloop: - movq (arg4,i,8), a - movq a, (n,i,8) - incq i - cmpq arg3, i - jc Lbignum_coprime_yloop - cmpq k, i - jnc Lbignum_coprime_yskip -Lbignum_coprime_ypadloop: - movq $0, (n,i,8) - incq i - cmpq k, i - jc Lbignum_coprime_ypadloop -Lbignum_coprime_yskip: - -// Set up the outer loop count of 64 * sum of input sizes. -// The invariant is that m * n < 2^t at all times. - - leaq (arg1,arg3), a - shlq $6, a - movq a, t - -// Record for the very end the OR of the lowest words. -// If the bottom bit is zero we know both are even so the answer is false. -// But since this is constant-time code we still execute all the main part. - - movq (m), a - movq (n), b - orq b, a - movq a, evenor - -// Now if n is even trigger a swap of m and n. This ensures that if -// one or other of m and n is odd then we make sure now that n is, -// as expected by our invariant later on. - - andq $1, b - subq $1, b - - xorq i, i -Lbignum_coprime_swaploop: - movq (m,i,8), a - movq (n,i,8), c - movq a, d - xorq c, d - andq b, d - xorq d, a - xorq d, c - movq a, (m,i,8) - movq c, (n,i,8) - incq i - cmpq k, i - jnz Lbignum_coprime_swaploop - -// Start of the main outer loop iterated t / CHUNKSIZE times - -Lbignum_coprime_outerloop: - -// We need only bother with sharper l = min k (ceil(t/64)) digits -// Either both m and n fit in l digits, or m has become zero and so -// nothing happens in the loop anyway and this makes no difference. - - movq t, l - addq $63, l - shrq $6, l - cmpq k, l - cmovncq k, l - -// Select upper and lower proxies for both m and n to drive the inner -// loop. The lower proxies are simply the lowest digits themselves, -// m_lo = m[0] and n_lo = n[0], while the upper proxies are bitfields -// of the two inputs selected so their top bit (63) aligns with the -// most significant bit of *either* of the two inputs. - - xorq h1, h1 // Previous high and low for m - xorq l1, l1 - xorq h2, h2 // Previous high and low for n - xorq l2, l2 - xorq c2, c2 // Mask flag: previous word of one was nonzero - // and in this case h1 and h2 are those words - - xorq i, i -Lbignum_coprime_toploop: - movq (m,i,8), b - movq (n,i,8), c - movq c2, c1 - andq h1, c1 - andq h2, c2 - movq b, a - orq c, a - negq a - cmovcq c1, l1 - cmovcq c2, l2 - cmovcq b, h1 - cmovcq c, h2 - sbbq c2, c2 - incq i - cmpq l, i - jc Lbignum_coprime_toploop - - movq h1, a - orq h2, a - bsrq a, c - xorq $63, c - shldq %cl, l1, h1 - shldq %cl, l2, h2 - -// m_lo = m[0], n_lo = n[0]; - - movq (m), %rax - movq %rax, m_lo - - movq (n), %rax - movq %rax, n_lo - -// Now the inner loop, with i as loop counter from CHUNKSIZE down. -// This records a matrix of updates to apply to the initial -// values of m and n with, at stage j: -// -// sgn * m' = (m_m * m - m_n * n) / 2^j -// -sgn * n' = (n_m * m - n_n * n) / 2^j -// -// where "sgn" is either +1 or -1, and we lose track of which except -// that both instance above are the same. This throwing away the sign -// costs nothing (since we have to correct in general anyway because -// of the proxied comparison) and makes things a bit simpler. But it -// is simply the parity of the number of times the first condition, -// used as the swapping criterion, fires in this loop. - - movl $1, m_mshort - movl $0, m_nshort - movl $0, n_mshort - movl $1, n_nshort - movl $CHUNKSIZE, ishort - -// Stash more variables over the inner loop to free up regs - - movq k, mat_mn - movq l, mat_nm - movq m, mat_mm - movq n, mat_nn - -// Conceptually in the inner loop we follow these steps: -// -// * If m_lo is odd and m_hi < n_hi, then swap the four pairs -// (m_hi,n_hi); (m_lo,n_lo); (m_m,n_m); (m_n,n_n) -// -// * Now, if m_lo is odd (old or new, doesn't matter as initial n_lo is odd) -// m_hi := m_hi - n_hi, m_lo := m_lo - n_lo -// m_m := m_m + n_m, m_n := m_n + n_n -// -// * Halve and double them -// m_hi := m_hi / 2, m_lo := m_lo / 2 -// n_m := n_m * 2, n_n := n_n * 2 -// -// The actual computation computes updates before actually swapping and -// then corrects as needed. - -Lbignum_coprime_innerloop: - - xorl %eax, %eax - xorl %ebx, %ebx - xorq m, m - xorq n, n - btq $0, m_lo - - cmovcq n_hi, %rax - cmovcq n_lo, %rbx - cmovcq n_m, m - cmovcq n_n, n - - movq m_lo, l - subq %rbx, m_lo - subq l, %rbx - movq m_hi, k - subq %rax, k - cmovcq m_hi, n_hi - leaq -1(k), m_hi - cmovcq %rbx, m_lo - cmovcq l, n_lo - notq m_hi - cmovcq m_m, n_m - cmovcq m_n, n_n - cmovncq k, m_hi - - shrq $1, m_lo - addq m, m_m - addq n, m_n - shrq $1, m_hi - addq n_m, n_m - addq n_n, n_n - -// End of the inner for-loop - - decq i - jnz Lbignum_coprime_innerloop - -// Unstash the temporary variables - - movq mat_mn, k - movq mat_nm, l - movq mat_mm, m - movq mat_nn, n - -// Put the matrix entries in memory since we're out of registers -// We pull them out repeatedly in the next loop - - movq m_m, mat_mm - movq m_n, mat_mn - movq n_m, mat_nm - movq n_n, mat_nn - -// Now actually compute the updates to m and n corresponding to that matrix, -// and correct the signs if they have gone negative. First we compute the -// (k+1)-sized updates with the following invariant (here h1 and h2 are in -// fact carry bitmasks, either 0 or -1): -// -// h1::l1::m = m_m * m - m_n * n -// h2::l2::n = n_m * m - n_n * n - - xorq i, i - xorq h1, h1 - xorq l1, l1 - xorq h2, h2 - xorq l2, l2 -Lbignum_coprime_crossloop: - - movq (m,i,8), c - movq mat_mm, a - mulq c - addq a, l1 - adcq $0, d - movq d, c1 // Now c1::l1 is +ve part 1 - - movq mat_nm, a - mulq c - addq a, l2 - adcq $0, d - movq d, c2 // Now c2::l2 is +ve part 2 - - movq (n,i,8), c - movq mat_mn, a - mulq c - subq h1, d // Now d::a is -ve part 1 - - subq a, l1 - sbbq d, c1 - sbbq h1, h1 - movq l1, (m,i,8) - movq c1, l1 - - movq mat_nn, a - mulq c - subq h2, d // Now d::a is -ve part 2 - - subq a, l2 - sbbq d, c2 - sbbq h2, h2 - movq l2, (n,i,8) - movq c2, l2 - - incq i - cmpq l, i - jc Lbignum_coprime_crossloop - -// Now fix the signs of m and n if they have gone negative - - xorq i, i - movq h1, c1 // carry-in coded up as well - movq h2, c2 // carry-in coded up as well - xorq h1, l1 // for the Lbignum_coprime_end digit - xorq h2, l2 // for the Lbignum_coprime_end digit -Lbignum_coprime_optnegloop: - movq (m,i,8), a - xorq h1, a - negq c1 - adcq $0, a - sbbq c1, c1 - movq a, (m,i,8) - movq (n,i,8), a - xorq h2, a - negq c2 - adcq $0, a - sbbq c2, c2 - movq a, (n,i,8) - incq i - cmpq l, i - jc Lbignum_coprime_optnegloop - subq c1, l1 - subq c2, l2 - -// Now shift them right CHUNKSIZE bits - - movq l, i -Lbignum_coprime_shiftloop: - movq -8(m,i,8), a - movq a, h1 - shrdq $CHUNKSIZE, l1, a - movq a, -8(m,i,8) - movq h1, l1 - movq -8(n,i,8), a - movq a, h2 - shrdq $CHUNKSIZE, l2, a - movq a, -8(n,i,8) - movq h2, l2 - decq i - jnz Lbignum_coprime_shiftloop - -// End of main loop. We can stop if t' <= 0 since then m * n < 2^0, which -// since n is odd (in the main cases where we had one or other input odd) -// means that m = 0 and n is the final gcd. Moreover we do in fact need to -// maintain strictly t > 0 in the main loop, or the computation of the -// optimized digit bound l could collapse to 0. - - subq $CHUNKSIZE, t - jnbe Lbignum_coprime_outerloop - -// Now compare n with 1 (OR of the XORs in a) - - movq (n), a - xorq $1, a - cmpq $1, k - jz Lbignum_coprime_finalcomb - movl $1, ishort -Lbignum_coprime_compareloop: - orq (n,i,8), a - incq i - cmpq k, i - jc Lbignum_coprime_compareloop - -// Now combine that with original "evenor" oddness flag -// The final condition is lsb(evenor) = 1 AND a = 0 - -Lbignum_coprime_finalcomb: - negq a - sbbq a, a - incq a - andq evenor, a - -// The end - -Lbignum_coprime_end: - CFI_INC_RSP(STACKVARSIZE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_coprime) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_copy.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_copy.S deleted file mode 100644 index b47640b30bb..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_copy.S +++ /dev/null @@ -1,86 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Copy bignum with zero-extension or truncation, z := x -// Input x[n]; output z[k] -// -// extern void bignum_copy(uint64_t k, uint64_t *z, uint64_t n, const uint64_t *x); -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = n, RCX = x -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = n, R9 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_copy) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_copy) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_copy) - .text - -#define k %rdi -#define z %rsi -#define n %rdx -#define x %rcx - -#define i %r8 -#define a %rax - - - -S2N_BN_SYMBOL(bignum_copy): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Replace RDX = n with RDX = min(k,n) so we are definitely safe copying those -// Initialize the element counter to 0 - - cmpq n, k - cmovcq k, n - xorq i, i - -// If min(k,n) = 0 jump to the padding stage - - testq n, n - jz Lbignum_copy_padding - -Lbignum_copy_copyloop: - movq (x,i,8), a - movq a, (z,i,8) - incq i - cmpq n, i - jc Lbignum_copy_copyloop - -Lbignum_copy_padding: - cmpq k, i - jnc Lbignum_copy_end - xorq a, a - -Lbignum_copy_padloop: - movq a, (z,i,8) - incq i - cmpq k, i - jc Lbignum_copy_padloop - -Lbignum_copy_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_copy) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_ctd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_ctd.S deleted file mode 100644 index 97a3e9ac01d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_ctd.S +++ /dev/null @@ -1,75 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count trailing zero digits (64-bit words) -// Input x[k]; output function return -// -// extern uint64_t bignum_ctd(uint64_t k, const uint64_t *x); -// -// In the case of a zero bignum as input the result is k -// -// Standard x86-64 ABI: RDI = k, RSI = x, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_ctd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_ctd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_ctd) - .text - -#define k %rdi -#define x %rsi -#define i %rdx -#define a %rax - - - -S2N_BN_SYMBOL(bignum_ctd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// If the bignum is zero-length, just return 0 - - xorq %rax, %rax - testq k, k - jz Lbignum_ctd_end - -// Record in i that the lowest nonzero word is i - 1, where i = k + 1 means -// that the bignum was entirely zero - - movq k, i - incq i -Lbignum_ctd_loop: - movq -8(x,k,8), a - testq a, a - cmovneq k, i - decq k - jnz Lbignum_ctd_loop - -// We now want to return i - 1 - - decq i - movq i, %rax -Lbignum_ctd_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_ctd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_ctz.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_ctz.S deleted file mode 100644 index a6b7e592943..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_ctz.S +++ /dev/null @@ -1,91 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count trailing zero bits -// Input x[k]; output function return -// -// extern uint64_t bignum_ctz(uint64_t k, const uint64_t *x); -// -// -// In the case of a zero bignum as input the result is 64 * k -// -// In principle this has a precondition k < 2^58, but obviously that -// is always true in practice because of address space limitations -// -// Standard x86-64 ABI: RDI = k, RSI = x, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_ctz) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_ctz) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_ctz) - .text - -#define k %rdi -#define x %rsi -#define i %rdx -#define w %rcx -#define a %rax - -#define wshort %ecx - - - -S2N_BN_SYMBOL(bignum_ctz): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// If the bignum is zero-length, just return 0 - - xorq %rax, %rax - testq k, k - jz Lbignum_ctz_end - -// Use w = a[i-1] to store nonzero words in a top-down sweep -// Set the initial default to be as if we had a 1 word directly above - - movq k, i - incq i - movl $1, wshort - -Lbignum_ctz_loop: - movq -8(x,k,8), a - testq a, a - cmovneq k, i - cmovneq a, w - decq k - jnz Lbignum_ctz_loop - -// Now w = a[i-1] is the lowest nonzero word, or in the zero case the -// default of the "extra" 1 = a[k]. We now want 64*(i-1) + ctz(w). -// Note that this code does not rely on the behavior of the BSF instruction -// for zero inputs, which is undefined according to the manual. - - decq i - shlq $6, i - bsfq w, %rax - addq i, %rax - -Lbignum_ctz_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_ctz) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_demont.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_demont.S deleted file mode 100644 index a75aaa00ee1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_demont.S +++ /dev/null @@ -1,208 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from (almost-)Montgomery form z := (x / 2^{64k}) mod m -// Inputs x[k], m[k]; output z[k] -// -// extern void bignum_demont(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *m); -// -// Does z := (x / 2^{64k}) mod m, hence mapping out of Montgomery domain. -// In other words, this is a k-fold Montgomery reduction with same-size input. -// This can handle almost-Montgomery inputs, i.e. any k-digit bignum. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = x, RCX = m -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = x, R9 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont) - .text - -#define k %rdi -#define z %rsi -#define x %rdx -#define m %rcx - -// General temp, low part of product and mul input -#define a %rax -// General temp, high part of product (no longer x) -#define b %rdx -// Negated modular inverse -#define w %r8 -// Outer loop counter -#define i %r9 -// Inner loop counter -#define j %rbx -// Home for Montgomery multiplier -#define d %rbp -#define h %r10 -#define e %r11 -#define n %r12 - -// A temp reg in the initial word-level negmodinv, same as j - -#define t %rbx - -#define ashort %eax -#define jshort %ebx - - -S2N_BN_SYMBOL(bignum_demont): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Save registers - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - -// If k = 0 the whole operation is trivial - - testq k, k - jz Lbignum_demont_end - -// Compute word-level negated modular inverse w for m == m[0]. - - movq (m), a - - movq a, t - movq a, w - shlq $2, t - subq t, w - xorq $2, w - - movq w, t - imulq a, t - movl $2, ashort - addq t, a - addq $1, t - - imulq a, w - - imulq t, t - movl $1, ashort - addq t, a - imulq a, w - - imulq t, t - movl $1, ashort - addq t, a - imulq a, w - - imulq t, t - movl $1, ashort - addq t, a - imulq a, w - -// Initially just copy the input to the output. It would be a little more -// efficient but somewhat fiddlier to tweak the zeroth iteration below instead. -// After this we never use x again and can safely recycle RDX for muls - - xorq j, j -Lbignum_demont_iloop: - movq (x,j,8), a - movq a, (z,j,8) - incq j - cmpq k, j - jc Lbignum_demont_iloop - -// Outer loop, just doing a standard Montgomery reduction on z - - xorq i, i - -Lbignum_demont_outerloop: - movq (z), e - movq w, d - imulq e, d - movq (m), a - mulq d - addq e, a // Will be zero but want the carry - movq %rdx, h - movl $1, jshort - movq k, n - decq n - jz Lbignum_demont_montend - -Lbignum_demont_montloop: - adcq (z,j,8), h - sbbq e, e - movq (m,j,8), a - mulq d - subq e, %rdx - addq h, a - movq a, -8(z,j,8) - movq %rdx, h - incq j - decq n - jnz Lbignum_demont_montloop - -Lbignum_demont_montend: - adcq $0, h - movq h, -8(z,j,8) - -// End of outer loop. - - incq i - cmpq k, i - jc Lbignum_demont_outerloop - -// Now do a comparison of z with m to set a final correction mask -// indicating that z >= m and so we need to subtract m. - - xorq j, j - movq k, n -Lbignum_demont_cmploop: - movq (z,j,8), a - sbbq (m,j,8), a - incq j - decq n - jnz Lbignum_demont_cmploop - sbbq d, d - notq d - -// Now do a masked subtraction of m for the final reduced result. - - xorq e, e - xorq j, j -Lbignum_demont_corrloop: - movq (m,j,8), a - andq d, a - negq e - sbbq a, (z,j,8) - sbbq e, e - incq j - cmpq k, j - jc Lbignum_demont_corrloop - -Lbignum_demont_end: - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_digit.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_digit.S deleted file mode 100644 index c89ec1e0433..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_digit.S +++ /dev/null @@ -1,76 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Select digit x[n] -// Inputs x[k], n; output function return -// -// extern uint64_t bignum_digit(uint64_t k, const uint64_t *x, uint64_t n); -// -// n'th digit of a k-digit (digit=64 bits) bignum, in constant-time style. -// Indexing starts at 0, which is the least significant digit (little-endian). -// Returns zero if n >= k, i.e. we read a digit off the end of the bignum. -// -// Standard x86-64 ABI: RDI = k, RSI = x, RDX = n, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, R8 = n, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_digit) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_digit) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_digit) - .text - -#define k %rdi -#define x %rsi -#define n %rdx - -#define d %rax -#define i %rcx -#define a %r8 - -S2N_BN_SYMBOL(bignum_digit): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Set the default digit to 0, and for length zero finish immediately - - xorq d, d - testq k, k - jz Lbignum_digit_end - -// Main loop: run over all the digits and take note of the n'th one - - xorq i, i -Lbignum_digit_loop: - movq (x,i,8), a - cmpq n, i - cmovzq a, d - incq i - cmpq k, i - jc Lbignum_digit_loop - -// Return - -Lbignum_digit_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_digit) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_digitsize.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_digitsize.S deleted file mode 100644 index 3eaa0065669..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_digitsize.S +++ /dev/null @@ -1,74 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Return size of bignum in digits (64-bit word) -// Input x[k]; output function return -// -// extern uint64_t bignum_digitsize(uint64_t k, const uint64_t *x); -// -// In the case of a zero bignum as input the result is 0 -// -// Standard x86-64 ABI: RDI = k, RSI = x, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_digitsize) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_digitsize) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_digitsize) - .text - -#define k %rdi -#define x %rsi -#define i %rax -#define a %rcx -#define j %rdx - - - -S2N_BN_SYMBOL(bignum_digitsize): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Initialize the index i and also prepare default return value of 0 (i = %rax) - - xorq i, i - -// If the bignum is zero-length, just return 0 - - testq k, k - jz Lbignum_digitsize_end - -// Run over the words j = 0..i-1, and set i := j + 1 when hitting nonzero a[j] - - xorq j, j -Lbignum_digitsize_loop: - movq (x,j,8), a - incq j - testq a, a - cmovnzq j, i - cmpq k, j - jnz Lbignum_digitsize_loop - -Lbignum_digitsize_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_digitsize) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_divmod10.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_divmod10.S deleted file mode 100644 index f5321a88ccc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_divmod10.S +++ /dev/null @@ -1,102 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Divide bignum by 10: z' := z div 10, returning remainder z mod 10 -// Inputs z[k]; outputs function return (remainder) and z[k] -// -// extern uint64_t bignum_divmod10(uint64_t k, uint64_t *z); -// -// Standard x86-64 ABI: RDI = k, RSI = z, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_divmod10) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_divmod10) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_divmod10) - .text - -#define k %rdi -#define z %rsi - -#define d %rcx - -#define l %rdx -#define r %rax - -#define q %r8 -#define h %r8 - -#define s %r9 -#define w %r10 - -#define rshort %eax -#define wshort %r10d - -S2N_BN_SYMBOL(bignum_divmod10): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Initialize remainder to 0 and if k = 0 return - - xorl rshort, rshort - testq k, k - jz Lbignum_divmod10_end - -// Straightforward top-down loop doing 10 * q + r' := 2^64 * r + d - - movq $0x3333333333333334, s - movl $0x3333333, wshort - -Lbignum_divmod10_divloop: - movq -8(z,k,8), d - -// First re-split and shift so 2^28 * h + l = (2^64 * r + d) / 2 -// Then (2^64 * r + d) / 10 = [(2^28 - 1) / 5] * h + (h + l) / 5 - - movq d, l - shlq $35, l - shldq $35, d, r - shrq $36, l - movq r, h - - addq l, r - mulq s - imulq w, h - addq l, q - movq q, -8(z,k,8) - -// Generate the new remainder r = d - 10 * q -// Since r <= 9 we only need the low part computation ignoring carries - - leaq (q,q,4), q - negq q - leaq (d,q,2), r - - decq k - jnz Lbignum_divmod10_divloop - -// Return %rax = r as the final remainder - -Lbignum_divmod10_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_divmod10) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_emontredc.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_emontredc.S deleted file mode 100644 index 6be65a34557..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_emontredc.S +++ /dev/null @@ -1,159 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Extended Montgomery reduce, returning results in input-output buffer -// Inputs z[2*k], m[k], w; outputs function return (extra result bit) and z[2*k] -// -// extern uint64_t bignum_emontredc(uint64_t k, uint64_t *z, const uint64_t *m, -// uint64_t w); -// -// Assumes that z initially holds a 2k-digit bignum z_0, m is a k-digit odd -// bignum and m * w == -1 (mod 2^64). This function also uses z for the output -// as well as returning a carry c of 0 or 1. This encodes two numbers: in the -// lower half of the z buffer we have q = z[0..k-1], while the upper half -// together with the carry gives r = 2^{64k}*c + z[k..2k-1]. These values -// satisfy z_0 + q * m = 2^{64k} * r, i.e. r gives a raw (unreduced) Montgomery -// reduction while q gives the multiplier that was used. Another way of -// thinking of it is that if z' is the output z with the lower half replaced -// with zeros, then z_0 + q * m = 2^{128k} * c + z'. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = m, RCX = w, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = m, R9 = w, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_emontredc) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_emontredc) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_emontredc) - .text - -// Argument m comes in in %rdx but we copy it to %r8 - -#define k %rdi -#define z %rsi -#define m %r8 -#define w %rcx - -// General temp, low part of product and mul input -#define a %rax -// General temp, High part of product -#define b %rdx -// Home for i'th digit or Montgomery multiplier -#define d %rbx - -// Outer loop counter -#define i %r9 -// Inner loop counter -#define j %r10 - -#define h %r11 -#define e %r12 -#define t %r13 -#define c %r14 - -#define cshort %r14d -#define jshort %r10d - - -S2N_BN_SYMBOL(bignum_emontredc): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Save registers - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - -// Initialize top carry to zero immediately to catch the k = 0 case - - xorq c, c - -// If k = 0 the whole operation is trivial - - testq k, k - jz Lbignum_emontredc_end - -// Move m into its permanent home since we need RDX for muls - - movq %rdx, m - -// Launch into the outer loop - - xorq i, i -Lbignum_emontredc_outerloop: - movq (z), e - movq w, d - imulq e, d - movq (m), a - mulq d - movq d, (z) - addq e, a // Will be zero but want the carry - movq %rdx, h - movl $1, jshort - movq k, t - decq t - jz Lbignum_emontredc_montend - -Lbignum_emontredc_montloop: - adcq (z,j,8), h - sbbq e, e - movq (m,j,8), a - mulq d - subq e, %rdx - addq h, a - movq a, (z,j,8) - movq %rdx, h - incq j - decq t - jnz Lbignum_emontredc_montloop - -Lbignum_emontredc_montend: - adcq c, h - movl $0, cshort - adcq $0, c - movq (z,k,8), a - addq h, a - movq a, (z,k,8) - adcq $0, c - -// End of outer loop. - - addq $8, z // For simple indexing, z pointer moves - incq i - cmpq k, i - jc Lbignum_emontredc_outerloop - -Lbignum_emontredc_end: - -// Put the top carry in the expected place, restore registers and return - - movq c, %rax - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_emontredc) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_eq.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_eq.S deleted file mode 100644 index d8b58d6fbcf..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_eq.S +++ /dev/null @@ -1,101 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Test bignums for equality, x = y -// Inputs x[m], y[n]; output function return -// -// extern uint64_t bignum_eq(uint64_t m, const uint64_t *x, uint64_t n, -// const uint64_t *y); -// -// Standard x86-64 ABI: RDI = m, RSI = x, RDX = n, RCX = y, returns RAX -// Microsoft x64 ABI: RCX = m, RDX = x, R8 = n, R9 = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_eq) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_eq) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_eq) - .text - -#define m %rdi -#define x %rsi -#define n %rdx -#define y %rcx -#define c %rax -// We can re-use n for this, not needed when d appears -#define d %rdx - -S2N_BN_SYMBOL(bignum_eq): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Initialize the accumulated OR of differences to zero - - xorq c, c - -// If m >= n jump into the m > n loop at the final equality test -// This will drop through for m = n - - cmpq n, m - jnc Lbignum_eq_mtest - -// Toploop for the case n > m - -Lbignum_eq_nloop: - decq n - orq (y,n,8), c - cmpq n, m - jnz Lbignum_eq_nloop - jmp Lbignum_eq_mmain - -// Toploop for the case m > n (or n = m which enters at "mtest") - -Lbignum_eq_mloop: - decq m - orq (x,m,8), c - cmpq n, m -Lbignum_eq_mtest: - jnz Lbignum_eq_mloop - -// Combined main loop for the min(m,n) lower words - -Lbignum_eq_mmain: - testq m, m - jz Lbignum_eq_end - -Lbignum_eq_loop: - movq -8(x,m,8), d - xorq -8(y,m,8), d - orq d, c - decq m - jnz Lbignum_eq_loop - -// Set a standard C condition based on whether c is nonzero - -Lbignum_eq_end: - negq c - sbbq c, c - incq c -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_eq) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_even.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_even.S deleted file mode 100644 index e6024355122..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_even.S +++ /dev/null @@ -1,56 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Test bignum for even-ness -// Input x[k]; output function return -// -// extern uint64_t bignum_even(uint64_t k, const uint64_t *x); -// -// Standard x86-64 ABI: RDI = k, RSI = x, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_even) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_even) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_even) - .text - -S2N_BN_SYMBOL(bignum_even): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Set default return value of 1 and finish if k = 0 (trivially even) - - movl $1, %eax - testq %rdi, %rdi - jz Lbignum_even_end - -// Otherwise XOR that initial 1 with the lowest bit of the input - - xorq (%rsi), %rax - andq $1, %rax - -Lbignum_even_end: - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_even) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_ge.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_ge.S deleted file mode 100644 index a7d1db97e15..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_ge.S +++ /dev/null @@ -1,115 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compare bignums, x >= y -// Inputs x[m], y[n]; output function return -// -// extern uint64_t bignum_ge(uint64_t m, const uint64_t *x, uint64_t n, -// const uint64_t *y); -// -// Standard x86-64 ABI: RDI = m, RSI = x, RDX = n, RCX = y, returns RAX -// Microsoft x64 ABI: RCX = m, RDX = x, R8 = n, R9 = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_ge) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_ge) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_ge) - .text - -#define m %rdi -#define x %rsi -#define n %rdx -#define y %rcx -#define i %r8 -#define a %rax - -#define ashort %eax - - - -S2N_BN_SYMBOL(bignum_ge): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Zero the main index counter for both branches - - xorq i, i - -// Speculatively form m := m - n and do case split - - subq n, m - jc Lbignum_ge_ylonger - -// The case where x is longer or of the same size (m >= n) - - incq m - testq n, n - jz Lbignum_ge_xtest -Lbignum_ge_xmainloop: - movq (x,i,8), a - sbbq (y,i,8), a - incq i - decq n - jnz Lbignum_ge_xmainloop - jmp Lbignum_ge_xtest -Lbignum_ge_xtoploop: - movq (x,i,8), a - sbbq $0, a - incq i -Lbignum_ge_xtest: - decq m - jnz Lbignum_ge_xtoploop - sbbq a, a - incq a -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - ret - -// The case where y is longer (n > m) - -Lbignum_ge_ylonger: - addq n, m - subq m, n - testq m, m - jz Lbignum_ge_ytoploop -Lbignum_ge_ymainloop: - movq (x,i,8), a - sbbq (y,i,8), a - incq i - decq m - jnz Lbignum_ge_ymainloop -Lbignum_ge_ytoploop: - movl $0, ashort - sbbq (y,i,8), a - incq i - decq n - jnz Lbignum_ge_ytoploop - - sbbq a, a - incq a -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_ge) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_gt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_gt.S deleted file mode 100644 index 1ca7a0878ba..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_gt.S +++ /dev/null @@ -1,115 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compare bignums, x > y -// Inputs x[m], y[n]; output function return -// -// extern uint64_t bignum_gt(uint64_t m, const uint64_t *x, uint64_t n, -// const uint64_t *y); -// -// Standard x86-64 ABI: RDI = m, RSI = x, RDX = n, RCX = y, returns RAX -// Microsoft x64 ABI: RCX = m, RDX = x, R8 = n, R9 = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_gt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_gt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_gt) - .text - -#define m %rdi -#define x %rsi -#define n %rdx -#define y %rcx -#define i %r8 -#define a %rax - -#define ashort %eax - - - -S2N_BN_SYMBOL(bignum_gt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Zero the main index counter for both branches - - xorq i, i - -// Speculatively form n := n - m and do case split - - subq m, n - jc Lbignum_gt_ylonger - -// The case where y is longer or of the same size (n >= m) - - incq n - testq m, m - jz Lbignum_gt_xtest -Lbignum_gt_xmainloop: - movq (y,i,8), a - sbbq (x,i,8), a - incq i - decq m - jnz Lbignum_gt_xmainloop - jmp Lbignum_gt_xtest -Lbignum_gt_xtoploop: - movq (y,i,8), a - sbbq $0, a - incq i -Lbignum_gt_xtest: - decq n - jnz Lbignum_gt_xtoploop - sbbq a, a - negq a -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - ret - -// The case where x is longer (m > n) - -Lbignum_gt_ylonger: - addq m, n - subq n, m - testq n, n - jz Lbignum_gt_ytoploop -Lbignum_gt_ymainloop: - movq (y,i,8), a - sbbq (x,i,8), a - incq i - decq n - jnz Lbignum_gt_ymainloop -Lbignum_gt_ytoploop: - movl $0, ashort - sbbq (x,i,8), a - incq i - decq m - jnz Lbignum_gt_ytoploop - - sbbq a, a - negq a -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_gt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_iszero.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_iszero.S deleted file mode 100644 index 48eca0a7b32..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_iszero.S +++ /dev/null @@ -1,62 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Test bignum for zero-ness, x = 0 -// Input x[k]; output function return -// -// extern uint64_t bignum_iszero(uint64_t k, const uint64_t *x); -// -// Standard x86-64 ABI: RDI = k, RSI = x, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_iszero) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_iszero) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_iszero) - .text - -#define a %rax -#define k %rdi -#define x %rsi - -S2N_BN_SYMBOL(bignum_iszero): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - xorq a, a - testq k, k - jz Lbignum_iszero_end - -Lbignum_iszero_loop: - orq -8(x,k,8), a - decq k - jnz Lbignum_iszero_loop - -// Set a standard C condition based on whether a is nonzero - - negq a - sbbq a, a - -Lbignum_iszero_end: - incq a -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_iszero) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_le.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_le.S deleted file mode 100644 index f8c9adbc906..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_le.S +++ /dev/null @@ -1,115 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compare bignums, x <= y -// Inputs x[m], y[n]; output function return -// -// extern uint64_t bignum_le(uint64_t m, const uint64_t *x, uint64_t n, -// const uint64_t *y); -// -// Standard x86-64 ABI: RDI = m, RSI = x, RDX = n, RCX = y, returns RAX -// Microsoft x64 ABI: RCX = m, RDX = x, R8 = n, R9 = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_le) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_le) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_le) - .text - -#define m %rdi -#define x %rsi -#define n %rdx -#define y %rcx -#define i %r8 -#define a %rax - -#define ashort %eax - - - -S2N_BN_SYMBOL(bignum_le): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Zero the main index counter for both branches - - xorq i, i - -// Speculatively form n := n - m and do case split - - subq m, n - jc Lbignum_le_ylonger - -// The case where y is longer or of the same size (n >= m) - - incq n - testq m, m - jz Lbignum_le_xtest -Lbignum_le_xmainloop: - movq (y,i,8), a - sbbq (x,i,8), a - incq i - decq m - jnz Lbignum_le_xmainloop - jmp Lbignum_le_xtest -Lbignum_le_xtoploop: - movq (y,i,8), a - sbbq $0, a - incq i -Lbignum_le_xtest: - decq n - jnz Lbignum_le_xtoploop - sbbq a, a - incq a -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - ret - -// The case where x is longer (m > n) - -Lbignum_le_ylonger: - addq m, n - subq n, m - testq n, n - jz Lbignum_le_ytoploop -Lbignum_le_ymainloop: - movq (y,i,8), a - sbbq (x,i,8), a - incq i - decq n - jnz Lbignum_le_ymainloop -Lbignum_le_ytoploop: - movl $0, ashort - sbbq (x,i,8), a - incq i - decq m - jnz Lbignum_le_ytoploop - - sbbq a, a - incq a -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_le) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_lt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_lt.S deleted file mode 100644 index cd39e57c87f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_lt.S +++ /dev/null @@ -1,115 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compare bignums, x < y -// Inputs x[m], y[n]; output function return -// -// extern uint64_t bignum_lt(uint64_t m, const uint64_t *x, uint64_t n, -// const uint64_t *y); -// -// Standard x86-64 ABI: RDI = m, RSI = x, RDX = n, RCX = y, returns RAX -// Microsoft x64 ABI: RCX = m, RDX = x, R8 = n, R9 = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_lt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_lt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_lt) - .text - -#define m %rdi -#define x %rsi -#define n %rdx -#define y %rcx -#define i %r8 -#define a %rax - -#define ashort %eax - - - -S2N_BN_SYMBOL(bignum_lt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Zero the main index counter for both branches - - xorq i, i - -// Speculatively form m := m - n and do case split - - subq n, m - jc Lbignum_lt_ylonger - -// The case where x is longer or of the same size (m >= n) - - incq m - testq n, n - jz Lbignum_lt_xtest -Lbignum_lt_xmainloop: - movq (x,i,8), a - sbbq (y,i,8), a - incq i - decq n - jnz Lbignum_lt_xmainloop - jmp Lbignum_lt_xtest -Lbignum_lt_xtoploop: - movq (x,i,8), a - sbbq $0, a - incq i -Lbignum_lt_xtest: - decq m - jnz Lbignum_lt_xtoploop - sbbq a, a - negq a -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - ret - -// The case where y is longer (n > m) - -Lbignum_lt_ylonger: - addq n, m - subq m, n - testq m, m - jz Lbignum_lt_ytoploop -Lbignum_lt_ymainloop: - movq (x,i,8), a - sbbq (y,i,8), a - incq i - decq m - jnz Lbignum_lt_ymainloop -Lbignum_lt_ytoploop: - movl $0, ashort - sbbq (y,i,8), a - incq i - decq n - jnz Lbignum_lt_ytoploop - - sbbq a, a - negq a -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_lt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_madd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_madd.S deleted file mode 100644 index a821923865c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_madd.S +++ /dev/null @@ -1,165 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply-add, z := z + x * y -// Inputs x[m], y[n]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_madd(uint64_t k, uint64_t *z, uint64_t m, -// const uint64_t *x, uint64_t n, const uint64_t *y); -// -// Does the "z := x * y + z" operation, while also returning a "next" or -// "carry" word. In the case where m + n <= p (i.e. the pure product would -// fit in the destination) this is the remainder for the exact result. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = m, RCX = x, R8 = n, R9 = y, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = m, R9 = x, [RSP+40] = n, [RSP+48] = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_madd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_madd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_madd) - .text - -// These are actually right - -#define p %rdi -#define z %rsi -#define n %r8 - -// These are not - -#define c %r15 -#define h %r14 -#define l %r13 -#define x %r12 -#define y %r11 -#define i %rbx -#define k %r10 -#define m %rbp - -// These are always local scratch since multiplier result is in these - -#define a %rax -#define d %rdx - - - -S2N_BN_SYMBOL(bignum_madd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 - movq 64(%rsp), %r9 -#endif - -// We use too many registers, and also we need %rax:%rdx for multiplications - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - movq %rdx, m - -// If the result size is zero, just return %rax = 0 -// We could also do this if either input is size 0. - - xorq %rax, %rax - testq p, p - jz Lbignum_madd_end - -// Set initial 2-part sum to zero (we zero c inside the body) - - xorq h, h - xorq l, l - -// Otherwise do outer loop k = 0 ... k = p - 1 - - xorq k, k - -Lbignum_madd_outerloop: - -// Zero our carry term first; we eventually want it and a zero is useful now -// Set a = max 0 (k + 1 - n), i = min (k + 1) m -// This defines the range a <= j < i for the inner summation -// Note that since k < p < 2^64 we can assume k + 1 doesn't overflow -// And since we want to increment it anyway, we might as well do it now - - xorq c, c // c = 0 - incq k // k = k + 1 - - movq k, a // a = k + 1 - subq n, a // a = k + 1 - n - cmovcq c, a // a = max 0 (k + 1 - n) - - movq m, i // i = m - cmpq m, k // CF <=> k + 1 < m - cmovcq k, i // i = min (k + 1) m - -// Turn i into a loop count, and skip things if it's <= 0 -// Otherwise set up initial pointers x -> x0[a] and y -> y0[k - a] -// and then launch into the main inner loop, postdecrementing i - - movq k, d - subq i, d - subq a, i - jbe Lbignum_madd_innerend - leaq (%rcx,a,8), x - leaq -8(%r9,d,8), y - -Lbignum_madd_innerloop: - movq (y,i,8), %rax - mulq (x) - addq $8, x - addq %rax, l - adcq %rdx, h - adcq $0, c - decq i - jnz Lbignum_madd_innerloop - -Lbignum_madd_innerend: - - addq l, (z) - adcq $0, h - adcq $0, c - movq h, l - movq c, h - addq $8, z - - cmpq p, k - jc Lbignum_madd_outerloop - -// Move the carry term into the return value - - movq l, %rax - -Lbignum_madd_end: - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_madd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modadd.S deleted file mode 100644 index 27290c03e1d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modadd.S +++ /dev/null @@ -1,103 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Add modulo m, z := (x + y) mod m, assuming x and y reduced -// Inputs x[k], y[k], m[k]; output z[k] -// -// extern void bignum_modadd(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *y, const uint64_t *m); -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = x, RCX = y, R8 = m -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = x, R9 = y, [RSP+40] = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_modadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_modadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_modadd) - .text - -#define k %rdi -#define z %rsi -#define x %rdx -#define y %rcx -#define m %r8 -#define i %r9 -#define j %r10 -#define a %rax -#define c %r11 - -S2N_BN_SYMBOL(bignum_modadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// If k = 0 do nothing - - testq k, k - jz Lbignum_modadd_end - -// First just add (c::z) := x + y - - xorq c, c - movq k, j - xorq i, i -Lbignum_modadd_addloop: - movq (x,i,8), a - adcq (y,i,8), a - movq a, (z,i,8) - incq i - decq j - jnz Lbignum_modadd_addloop - adcq $0, c - -// Now do a comparison subtraction (c::z) - m, recording mask for (c::z) >= m - - movq k, j - xorq i, i -Lbignum_modadd_cmploop: - movq (z,i,8), a - sbbq (m,i,8), a - incq i - decq j - jnz Lbignum_modadd_cmploop - sbbq $0, c - notq c - -// Now do a masked subtraction z := z - [c] * m - - xorq i, i -Lbignum_modadd_subloop: - movq (m,i,8), a - andq c, a - negq j - sbbq a, (z,i,8) - sbbq j, j - incq i - cmpq k, i - jc Lbignum_modadd_subloop - -Lbignum_modadd_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_modadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_moddouble.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_moddouble.S deleted file mode 100644 index a87a42e19bd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_moddouble.S +++ /dev/null @@ -1,97 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo m, z := (2 * x) mod m, assuming x reduced -// Inputs x[k], m[k]; output z[k] -// -// extern void bignum_moddouble(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *m); -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = x, RCX = m -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = x, R9 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_moddouble) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_moddouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_moddouble) - .text - -#define k %rdi -#define z %rsi -#define x %rdx -#define m %rcx -#define i %r8 -#define a %r9 -#define c %rax -#define b %r10 - -S2N_BN_SYMBOL(bignum_moddouble): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// If k = 0 do nothing - - testq k, k - jz Lbignum_moddouble_end - -// Do (_::z) = 2 * x - m and generate a mask in c for 2 * x < m - - xorq c, c - xorq i, i - xorq b, b - -Lbignum_moddouble_dubloop: - movq (x,i,8), a - shrdq $63, a, c - negq b - sbbq (m,i,8), c - sbbq b, b - movq c, (z,i,8) - movq a, c - incq i - cmpq k, i - jc Lbignum_moddouble_dubloop - shrq $63, c - - addq b, c - -// Now do a corrective masked addition z := z + [c] * m - - xorq i, i - xorq b, b -Lbignum_moddouble_corrloop: - movq (m,i,8), a - andq c, a - negq b - adcq (z,i,8), a - sbbq b, b - movq a, (z,i,8) - incq i - cmpq k, i - jc Lbignum_moddouble_corrloop - -Lbignum_moddouble_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_moddouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modexp.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modexp.S deleted file mode 100644 index 378adfa15e4..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modexp.S +++ /dev/null @@ -1,707 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Modular exponentiation for arbitrary odd modulus -// Inputs a[k], p[k], m[k]; output z[k], temporary buffer t[>=3*k] -// -// extern void bignum_modexp -// (uint64_t k,uint64_t *z, const uint64_t *a,const uint64_t *p, -// const uint64_t *m,uint64_t *t); -// -// Does z := (a^p) mod m where all numbers are k-digit and m is odd -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = a, RCX = p, R8 = m, R9 = t -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = a, R9 = p, [RSP+40] = m, [RSP+48] = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_modexp) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_modexp) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_modexp) - - - .text - -// Local variables, all kept on the stack - -#define k (%rsp) -#define res 8(%rsp) -#define a 16(%rsp) -#define p 24(%rsp) -#define m 32(%rsp) -#define x 40(%rsp) -#define i 48(%rsp) -#define y 56(%rsp) -#define z 64(%rsp) - -#define VARSIZE 72 - -S2N_BN_SYMBOL(bignum_modexp): - CFI_START - _CET_ENDBR - -// The Windows version literally calls the standard ABI version. -// This simplifies the proofs since subroutine offsets are fixed. - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 - movq 64(%rsp), %r9 - CFI_CALL(Lbignum_modexp_standard) - CFI_POP(%rsi) - CFI_POP(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_modexp) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_modexp_standard) - -Lbignum_modexp_standard: - CFI_START -#endif - -// Real start of the standard ABI code. -// Bump down the stack to make room for local variables - - CFI_DEC_RSP(VARSIZE) - -// If size is zero (which falsifies the oddness condition) do nothing - - testq %rdi, %rdi - jz Lbignum_modexp_end - -// Set up local variables based on input parameters - - movq %rdi, k - movq %rsi, res - movq %rdx, a - movq %rcx, p - movq %r8, m - movq %r9, x - leaq (%r9,%rdi,8), %rax - movq %rax, y - leaq (%rax,%rdi,8), %rax - movq %rax, z - -// Let x == 2^64k * a (mod m) and initialize z == 2^64k * 1 (mod m) - - movq k, %rdi - movq z, %rsi - movq m, %rdx - movq y, %rcx - CFI_CALL(Lbignum_modexp_local_amontifier) - - movq k, %rdi - movq x, %rsi - movq z, %rdx - movq a, %rcx - movq m, %r8 - CFI_CALL(Lbignum_modexp_local_amontmul) - - movq k, %rdi - movq z, %rsi - movq z, %rdx - movq m, %rcx - CFI_CALL(Lbignum_modexp_local_demont) - -// Main loop with z == 2^64k * a^(p >> 2^i) (mod m) - - movq k, %rax - shlq $6, %rax - movq %rax, i - -Lbignum_modexp_loop: - subq $1, %rax - movq %rax, i - - movq k, %rdi - movq y, %rsi - movq z, %rdx - movq z, %rcx - movq m, %r8 - CFI_CALL(Lbignum_modexp_local_amontmul) - - movq k, %rdi - movq z, %rsi - movq x, %rdx - movq y, %rcx - movq m, %r8 - CFI_CALL(Lbignum_modexp_local_amontmul) - - movq i, %rdx - movq %rdx, %rcx - shrq $6, %rdx - movq p, %rsi - movq (%rsi,%rdx,8), %rdi - shrq %cl, %rdi - andq $1, %rdi - - movq k, %rsi - movq z, %rdx - movq z, %rcx - movq y, %r8 - CFI_CALL(Lbignum_modexp_local_mux) - - movq i, %rax - testq %rax, %rax - jnz Lbignum_modexp_loop - -// Convert back from Montgomery representation and copy the result -// (via a degenerate case of multiplexing) into the output buffer - - movq k, %rdi - movq z, %rsi - movq z, %rdx - movq m, %rcx - CFI_CALL(Lbignum_modexp_local_demont) - - xorl %edi, %edi - movq k, %rsi - movq res, %rdx - movq z, %rcx - movq z, %r8 - CFI_CALL(Lbignum_modexp_local_mux) - -// Restore the stack pointer and return - -Lbignum_modexp_end: - CFI_INC_RSP(VARSIZE) - CFI_RET - -#if WINDOWS_ABI -S2N_BN_SIZE_DIRECTIVE(Lbignum_modexp_standard) -#else -S2N_BN_SIZE_DIRECTIVE(bignum_modexp) -#endif - -// Local copy of bignum_amontifier - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_modexp_local_amontifier) - -Lbignum_modexp_local_amontifier: - CFI_START - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - movq %rdx, %r12 - movq %rcx, %r13 - testq %rdi, %rdi - je Lbignum_modexp_amontifier_end - xorq %rbx, %rbx -Lbignum_modexp_copyinloop: - movq (%r12,%rbx,8), %rcx - movq %rcx, (%r13,%rbx,8) - incq %rbx - cmpq %rdi, %rbx - jb Lbignum_modexp_copyinloop - movq %rdi, %rbx - decq %rbx - je Lbignum_modexp_normalized -Lbignum_modexp_normloop: - xorq %rbp, %rbp - movq %rdi, %r11 - negq %rcx - movl $0x0, %eax -Lbignum_modexp_shufloop: - movq %rax, %rcx - movq (%r13,%rbp,8), %rax - cmovbq %rax, %rcx - movq %rcx, (%r13,%rbp,8) - incq %rbp - decq %r11 - jne Lbignum_modexp_shufloop - decq %rbx - jne Lbignum_modexp_normloop -Lbignum_modexp_normalized: - bsrq %rcx, %rcx - xorq $0x3f, %rcx - xorq %r9, %r9 - xorq %rbx, %rbx -Lbignum_modexp_bitloop: - movq (%r13,%rbx,8), %rax - movq %rax, %rbp - shldq %cl, %r9, %rax - movq %rax, (%r13,%rbx,8) - movq %rbp, %r9 - incq %rbx - cmpq %rdi, %rbx - jb Lbignum_modexp_bitloop - movq -0x8(%r13,%rdi,8), %r11 - movl $0x1, %r8d - movq %r11, %r9 - negq %r9 - movl $0x3e, %ebx -Lbignum_modexp_estloop: - addq %r8, %r8 - movq %r11, %rax - subq %r9, %rax - cmpq %rax, %r9 - sbbq %rax, %rax - notq %rax - subq %rax, %r8 - addq %r9, %r9 - andq %r11, %rax - subq %rax, %r9 - decq %rbx - jne Lbignum_modexp_estloop - incq %r9 - cmpq %r9, %r11 - adcq $0x0, %r8 - xorq %rcx, %rcx - xorq %rbx, %rbx -Lbignum_modexp_mulloop: - movq (%r13,%rbx,8), %rax - mulq %r8 - addq %rcx, %rax - adcq $0x0, %rdx - movq %rax, (%rsi,%rbx,8) - movq %rdx, %rcx - incq %rbx - cmpq %rdi, %rbx - jb Lbignum_modexp_mulloop - movabs $0x4000000000000000, %rax - subq %rax, %rcx - sbbq %r8, %r8 - notq %r8 - xorq %rcx, %rcx - xorq %rbx, %rbx -Lbignum_modexp_remloop: - movq (%r13,%rbx,8), %rax - andq %r8, %rax - negq %rcx - sbbq (%rsi,%rbx,8), %rax - sbbq %rcx, %rcx - movq %rax, (%rsi,%rbx,8) - incq %rbx - cmpq %rdi, %rbx - jb Lbignum_modexp_remloop - xorq %rcx, %rcx - xorq %rbp, %rbp - xorq %r9, %r9 -Lbignum_modexp_dubloop1: - movq (%rsi,%rbp,8), %rax - shrdq $0x3f, %rax, %rcx - negq %r9 - sbbq (%r13,%rbp,8), %rcx - sbbq %r9, %r9 - movq %rcx, (%rsi,%rbp,8) - movq %rax, %rcx - incq %rbp - cmpq %rdi, %rbp - jb Lbignum_modexp_dubloop1 - shrq $0x3f, %rcx - addq %r9, %rcx - xorq %rbp, %rbp - xorq %r9, %r9 -Lbignum_modexp_corrloop1: - movq (%r13,%rbp,8), %rax - andq %rcx, %rax - negq %r9 - adcq (%rsi,%rbp,8), %rax - sbbq %r9, %r9 - movq %rax, (%rsi,%rbp,8) - incq %rbp - cmpq %rdi, %rbp - jb Lbignum_modexp_corrloop1 - xorq %rcx, %rcx - xorq %rbp, %rbp - xorq %r9, %r9 -Lbignum_modexp_dubloop2: - movq (%rsi,%rbp,8), %rax - shrdq $0x3f, %rax, %rcx - negq %r9 - sbbq (%r13,%rbp,8), %rcx - sbbq %r9, %r9 - movq %rcx, (%rsi,%rbp,8) - movq %rax, %rcx - incq %rbp - cmpq %rdi, %rbp - jb Lbignum_modexp_dubloop2 - shrq $0x3f, %rcx - addq %r9, %rcx - xorq %rbp, %rbp - xorq %r9, %r9 -Lbignum_modexp_corrloop2: - movq (%r13,%rbp,8), %rax - andq %rcx, %rax - negq %r9 - adcq (%rsi,%rbp,8), %rax - sbbq %r9, %r9 - movq %rax, (%rsi,%rbp,8) - movq %rax, (%r13,%rbp,8) - incq %rbp - cmpq %rdi, %rbp - jb Lbignum_modexp_corrloop2 - xorq %r11, %r11 - movq %rdi, %rbx -Lbignum_modexp_modloop: - xorq %r9, %r9 - movq %rdi, %r8 - xorq %rbp, %rbp - xorq %rcx, %rcx -Lbignum_modexp_cmaloop: - adcq %r9, %rcx - sbbq %r10, %r10 - movq (%rsi,%rbp,8), %rax - mulq %r11 - subq %r10, %rdx - addq %rcx, %rax - movq (%r13,%rbp,8), %r9 - movq %rax, (%r13,%rbp,8) - movq %rdx, %rcx - incq %rbp - decq %r8 - jne Lbignum_modexp_cmaloop - adcq %rcx, %r9 - movq %r9, %r11 - sbbq %r10, %r10 - xorq %rbp, %rbp - xorq %rcx, %rcx -Lbignum_modexp_oaloop: - movq (%r13,%rbp,8), %rax - movq (%rsi,%rbp,8), %r9 - andq %r10, %r9 - negq %rcx - adcq %r9, %rax - sbbq %rcx, %rcx - movq %rax, (%r13,%rbp,8) - incq %rbp - cmpq %rdi, %rbp - jb Lbignum_modexp_oaloop - subq %rcx, %r11 - decq %rbx - jne Lbignum_modexp_modloop - movq (%r12), %rax - movq %rax, %rcx - movq %rax, %r9 - shlq $0x2, %rcx - subq %rcx, %r9 - xorq $0x2, %r9 - movq %r9, %rcx - imulq %rax, %rcx - movl $0x2, %eax - addq %rcx, %rax - addq $0x1, %rcx - imulq %rax, %r9 - imulq %rcx, %rcx - movl $0x1, %eax - addq %rcx, %rax - imulq %rax, %r9 - imulq %rcx, %rcx - movl $0x1, %eax - addq %rcx, %rax - imulq %rax, %r9 - imulq %rcx, %rcx - movl $0x1, %eax - addq %rcx, %rax - imulq %rax, %r9 - movq (%r13), %rcx - imulq %rcx, %r9 - movq (%r12), %rax - mulq %r9 - addq %rcx, %rax - movq %rdx, %rcx - movl $0x1, %ebp - movq %rdi, %r8 - decq %r8 - je Lbignum_modexp_montifend -Lbignum_modexp_montifloop: - adcq (%r13,%rbp,8), %rcx - sbbq %r10, %r10 - movq (%r12,%rbp,8), %rax - mulq %r9 - subq %r10, %rdx - addq %rcx, %rax - movq %rax, -0x8(%r13,%rbp,8) - movq %rdx, %rcx - incq %rbp - decq %r8 - jne Lbignum_modexp_montifloop -Lbignum_modexp_montifend: - adcq %rcx, %r11 - sbbq %r10, %r10 - movq %r11, -0x8(%r13,%rdi,8) - xorq %rbp, %rbp - xorq %rcx, %rcx -Lbignum_modexp_osloop: - movq (%r13,%rbp,8), %rax - movq (%r12,%rbp,8), %r9 - andq %r10, %r9 - negq %rcx - sbbq %r9, %rax - sbbq %rcx, %rcx - movq %rax, (%rsi,%rbp,8) - incq %rbp - cmpq %rdi, %rbp - jb Lbignum_modexp_osloop -Lbignum_modexp_amontifier_end: - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_modexp_local_amontifier) - -// Local copy of bignum_amontmul - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_modexp_local_amontmul) - -Lbignum_modexp_local_amontmul: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(8) - testq %rdi, %rdi - je Lbignum_modexp_amont_end - movq %rdx, %r9 - movq (%r8), %rax - movq %rax, %rdx - movq %rax, %rbx - shlq $0x2, %rdx - subq %rdx, %rbx - xorq $0x2, %rbx - movq %rbx, %rdx - imulq %rax, %rdx - movl $0x2, %eax - addq %rdx, %rax - addq $0x1, %rdx - imulq %rax, %rbx - imulq %rdx, %rdx - movl $0x1, %eax - addq %rdx, %rax - imulq %rax, %rbx - imulq %rdx, %rdx - movl $0x1, %eax - addq %rdx, %rax - imulq %rax, %rbx - imulq %rdx, %rdx - movl $0x1, %eax - addq %rdx, %rax - imulq %rax, %rbx - movq %rbx, (%rsp) - xorq %r13, %r13 - xorq %rbx, %rbx -Lbignum_modexp_zoop: - movq %r13, (%rsi,%rbx,8) - incq %rbx - cmpq %rdi, %rbx - jb Lbignum_modexp_zoop - xorq %r14, %r14 -Lbignum_modexp_outeramontloop: - movq (%r9,%r13,8), %rbp - xorq %rbx, %rbx - xorq %r10, %r10 - xorq %r15, %r15 - movq %rdi, %r12 -Lbignum_modexp_maddloop: - adcq (%rsi,%rbx,8), %r10 - sbbq %r11, %r11 - movq (%rcx,%rbx,8), %rax - mulq %rbp - subq %r11, %rdx - addq %r10, %rax - movq %rax, (%rsi,%rbx,8) - movq %rdx, %r10 - incq %rbx - decq %r12 - jne Lbignum_modexp_maddloop - adcq %r10, %r14 - adcq %r15, %r15 - movq (%rsi), %r11 - movq (%rsp), %rbp - imulq %r11, %rbp - movq (%r8), %rax - mulq %rbp - addq %r11, %rax - movq %rdx, %r10 - movl $0x1, %ebx - movq %rdi, %r12 - decq %r12 - je Lbignum_modexp_montend -Lbignum_modexp_montloop: - adcq (%rsi,%rbx,8), %r10 - sbbq %r11, %r11 - movq (%r8,%rbx,8), %rax - mulq %rbp - subq %r11, %rdx - addq %r10, %rax - movq %rax, -0x8(%rsi,%rbx,8) - movq %rdx, %r10 - incq %rbx - decq %r12 - jne Lbignum_modexp_montloop -Lbignum_modexp_montend: - adcq %r14, %r10 - adcq $0x0, %r15 - movq %r15, %r14 - movq %r10, -0x8(%rsi,%rbx,8) - incq %r13 - cmpq %rdi, %r13 - jb Lbignum_modexp_outeramontloop - xorq %rbp, %rbp - subq %r14, %rbp - xorq %r11, %r11 - xorq %rbx, %rbx -Lbignum_modexp_acorrloop: - movq (%r8,%rbx,8), %rax - andq %rbp, %rax - negq %r11 - sbbq %rax, (%rsi,%rbx,8) - sbbq %r11, %r11 - incq %rbx - cmpq %rdi, %rbx - jb Lbignum_modexp_acorrloop -Lbignum_modexp_amont_end: - CFI_INC_RSP(8) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_modexp_local_amontmul) - -// Local copy of bignum_demont - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_modexp_local_demont) - -Lbignum_modexp_local_demont: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - testq %rdi, %rdi - je Lbignum_modexp_demont_end - movq (%rcx), %rax - movq %rax, %rbx - movq %rax, %r8 - shlq $0x2, %rbx - subq %rbx, %r8 - xorq $0x2, %r8 - movq %r8, %rbx - imulq %rax, %rbx - movl $0x2, %eax - addq %rbx, %rax - addq $0x1, %rbx - imulq %rax, %r8 - imulq %rbx, %rbx - movl $0x1, %eax - addq %rbx, %rax - imulq %rax, %r8 - imulq %rbx, %rbx - movl $0x1, %eax - addq %rbx, %rax - imulq %rax, %r8 - imulq %rbx, %rbx - movl $0x1, %eax - addq %rbx, %rax - imulq %rax, %r8 - xorq %rbx, %rbx -Lbignum_modexp_iloop: - movq (%rdx,%rbx,8), %rax - movq %rax, (%rsi,%rbx,8) - incq %rbx - cmpq %rdi, %rbx - jb Lbignum_modexp_iloop - xorq %r9, %r9 -Lbignum_modexp_outerdemontloop: - movq (%rsi), %r11 - movq %r8, %rbp - imulq %r11, %rbp - movq (%rcx), %rax - mulq %rbp - addq %r11, %rax - movq %rdx, %r10 - movl $0x1, %ebx - movq %rdi, %r12 - decq %r12 - je Lbignum_modexp_demontend -Lbignum_modexp_demontloop: - adcq (%rsi,%rbx,8), %r10 - sbbq %r11, %r11 - movq (%rcx,%rbx,8), %rax - mulq %rbp - subq %r11, %rdx - addq %r10, %rax - movq %rax, -0x8(%rsi,%rbx,8) - movq %rdx, %r10 - incq %rbx - decq %r12 - jne Lbignum_modexp_demontloop -Lbignum_modexp_demontend: - adcq $0x0, %r10 - movq %r10, -0x8(%rsi,%rbx,8) - incq %r9 - cmpq %rdi, %r9 - jb Lbignum_modexp_outerdemontloop - xorq %rbx, %rbx - movq %rdi, %r12 -Lbignum_modexp_cmploop: - movq (%rsi,%rbx,8), %rax - sbbq (%rcx,%rbx,8), %rax - incq %rbx - decq %r12 - jne Lbignum_modexp_cmploop - sbbq %rbp, %rbp - notq %rbp - xorq %r11, %r11 - xorq %rbx, %rbx -Lbignum_modexp_dcorrloop: - movq (%rcx,%rbx,8), %rax - andq %rbp, %rax - negq %r11 - sbbq %rax, (%rsi,%rbx,8) - sbbq %r11, %r11 - incq %rbx - cmpq %rdi, %rbx - jb Lbignum_modexp_dcorrloop -Lbignum_modexp_demont_end: - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_modexp_local_demont) - -// Local copy of bignum_mux - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lbignum_modexp_local_mux) - -Lbignum_modexp_local_mux: - CFI_START - testq %rsi, %rsi - je Lbignum_modexp_muxend - xorq %r9, %r9 - negq %rdi -Lbignum_modexp_muxloop: - movq (%rcx,%r9,8), %rax - movq (%r8,%r9,8), %rdi - cmovae %rdi, %rax - movq %rax, (%rdx,%r9,8) - incq %r9 - decq %rsi - jne Lbignum_modexp_muxloop -Lbignum_modexp_muxend: - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lbignum_modexp_local_mux) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modifier.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modifier.S deleted file mode 100644 index f26948a73bb..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modifier.S +++ /dev/null @@ -1,545 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compute "modification" constant z := 2^{64k} mod m -// Input m[k]; output z[k]; temporary buffer t[>=k] -// -// extern void bignum_modifier(uint64_t k, uint64_t *z, const uint64_t *m, -// uint64_t *t); -// -// The last argument points to a temporary buffer t that should have size >= k. -// This is called "mod-ifier" because given any other k-digit number x we can -// get x MOD m simply and reasonably efficiently just by Montgomery -// multiplication of x and z. But one can also consider it the identity for -// Montgomery multiplication, assuming you have a reduced multiplier already. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = m, RCX = t -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = m, R9 = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_modifier) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_modifier) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_modifier) - .text - -#define k %rdi -#define z %rsi - -// These two inputs get moved to different places since RCX and RDX are special - -#define m %r12 -#define t %r13 - -// Other variables - -#define i %rbx -// Modular inverse; aliased to i, but we never use them together -#define w %rbx -#define j %rbp -// Matters that this is RAX for special use in multiplies -#define a %rax -// Matters that this is RDX for special use in multiplies -#define d %rdx -// Matters that this is RCX as CL=lo(c) is assumed in shifts -#define c %rcx -#define h %r11 -#define l %r10 -#define b %r9 -#define n %r8 - -// Some aliases for the values b and n - -#define q %r8 -#define r %r9 - -#define ashort %eax -#define ishort %ebx -#define jshort %ebp -#define qshort %r8d - - -S2N_BN_SYMBOL(bignum_modifier): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Save some additional registers for use, copy args out of RCX and RDX - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - - movq %rdx, m - movq %rcx, t - -// If k = 0 the whole operation is trivial - - testq k, k - jz Lbignum_modifier_end - -// Copy the input m into the temporary buffer t. The temporary register -// c matters since we want it to hold the highest digit, ready for the -// normalization phase. - - xorq i, i -Lbignum_modifier_copyinloop: - movq (m,i,8), c - movq c, (t,i,8) - incq i - cmpq k, i - jc Lbignum_modifier_copyinloop - -// Do a rather stupid but constant-time digit normalization, conditionally -// shifting left (k-1) times based on whether the top word is zero. -// With careful binary striding this could be O(k*log(k)) instead of O(k^2) -// while still retaining the constant-time style. -// The "neg c" sets the zeroness predicate (~CF) for the entire inner loop - - movq k, i - decq i - jz Lbignum_modifier_normalized -Lbignum_modifier_normloop: - xorq j, j - movq k, h - negq c - movl $0, ashort -Lbignum_modifier_shufloop: - movq a, c - movq (t,j,8), a - cmovcq a, c - movq c, (t,j,8) - incq j - decq h - jnz Lbignum_modifier_shufloop - decq i - jnz Lbignum_modifier_normloop - -// We now have the top digit nonzero, assuming the input was nonzero, -// and as per the invariant of the loop above, c holds that digit. So -// now just count c's leading zeros and shift t bitwise that many bits. -// Note that we don't care about the result of bsr for zero inputs so -// the simple xor-ing with 63 is safe. - -Lbignum_modifier_normalized: - - bsrq c, c - xorq $63, c - - xorq b, b - xorq i, i -Lbignum_modifier_bitloop: - movq (t,i,8), a - movq a, j - shldq %cl, b, a - movq a, (t,i,8) - movq j, b - incq i - cmpq k, i - jc Lbignum_modifier_bitloop - -// Let h be the high word of n, which in all the in-scope cases is >= 2^63. -// Now successively form q = 2^i div h and r = 2^i mod h as i goes from -// 64 to 126. We avoid just using division out of constant-time concerns -// (at the least we would need to fix up h = 0 for out-of-scope inputs) and -// don't bother with Newton-Raphson, since this stupid simple loop doesn't -// contribute much of the overall runtime at typical sizes. - - movq -8(t,k,8), h - movl $1, qshort - movq h, r - negq r - movl $62, ishort -Lbignum_modifier_estloop: - - addq q, q - movq h, a - subq r, a - cmpq a, r // CF <=> r < h - r <=> 2 * r < h - sbbq a, a - notq a // a = bitmask(2 * r >= h) - subq a, q - addq r, r - andq h, a - subq a, r - decq i - jnz Lbignum_modifier_estloop - -// Strictly speaking the above loop doesn't quite give the true remainder -// and quotient in the special case r = h = 2^63, so fix it up. We get -// q = 2^63 - 1 and r = 2^63 and really want q = 2^63 and r = 0. This is -// supererogatory, because the main property of q used below still holds -// in this case unless the initial m = 1, and then anyway the overall -// specification (congruence modulo m) holds degenerately. But it seems -// nicer to get a "true" quotient and remainder. - - incq r - cmpq r, h - adcq $0, q - -// So now we have q and r with 2^126 = q * h + r (imagining r = 0 in the -// fixed-up case above: note that we never actually use the computed -// value of r below and so didn't adjust it). And we can assume the ranges -// q <= 2^63 and r < h < 2^64. -// -// The idea is to use q as a first quotient estimate for a remainder -// of 2^{p+62} mod n, where p = 64 * k. We have, splitting n into the -// high and low parts h and l: -// -// 2^{p+62} - q * n = 2^{p+62} - q * (2^{p-64} * h + l) -// = 2^{p+62} - (2^{p-64} * (q * h) + q * l) -// = 2^{p+62} - 2^{p-64} * (2^126 - r) - q * l -// = 2^{p-64} * r - q * l -// -// Note that 2^{p-64} * r < 2^{p-64} * h <= n -// and also q * l < 2^63 * 2^{p-64} = 2^{p-1} <= n -// so |diff| = |2^{p-64} * r - q * l| < n. -// -// If in fact diff >= 0 then it is already 2^{p+62} mod n. -// otherwise diff + n is the right answer. -// -// To (maybe?) make the computation slightly easier we actually flip -// the sign and compute d = q * n - 2^{p+62}. Then the answer is either -// -d (when negative) or n - d; in either case we effectively negate d. -// This negating tweak in fact spoils the result for cases where -// 2^{p+62} mod n = 0, when we get n instead. However the only case -// where this can happen is m = 1, when the whole spec holds trivially, -// and actually the remainder of the logic below works anyway since -// the latter part of the code only needs a congruence for the k-digit -// result, not strict modular reduction (the doublings will maintain -// the non-strict inequality). - - xorq c, c - xorq i, i -Lbignum_modifier_mulloop: - movq (t,i,8), a - mulq q - addq c, a - adcq $0, d - movq a, (z,i,8) - movq d, c - incq i - cmpq k, i - jc Lbignum_modifier_mulloop - -// Now c is the high word of the product, so subtract 2^62 -// and then turn it into a bitmask in q = h - - movq $0x4000000000000000, a - subq a, c - sbbq q, q - notq q - -// Now do [c] * n - d for our final answer - - xorq c, c - xorq i, i -Lbignum_modifier_remloop: - movq (t,i,8), a - andq q, a - negq c - sbbq (z,i,8), a - sbbq c, c - movq a, (z,i,8) - incq i - cmpq k, i - jc Lbignum_modifier_remloop - -// Now still need to do a couple of modular doublings to get us all the -// way up to 2^{p+64} == r from initial 2^{p+62} == r (mod n). - - xorq c, c - xorq j, j - xorq b, b -Lbignum_modifier_dubloop1: - movq (z,j,8), a - shrdq $63, a, c - negq b - sbbq (t,j,8), c - sbbq b, b - movq c, (z,j,8) - movq a, c - incq j - cmpq k, j - jc Lbignum_modifier_dubloop1 - shrq $63, c - addq b, c - xorq j, j - xorq b, b -Lbignum_modifier_corrloop1: - movq (t,j,8), a - andq c, a - negq b - adcq (z,j,8), a - sbbq b, b - movq a, (z,j,8) - incq j - cmpq k, j - jc Lbignum_modifier_corrloop1 - -// This is not exactly the same: we also copy output to t giving the -// initialization t_1 = r == 2^{p+64} mod n for the main loop next. - - xorq c, c - xorq j, j - xorq b, b -Lbignum_modifier_dubloop2: - movq (z,j,8), a - shrdq $63, a, c - negq b - sbbq (t,j,8), c - sbbq b, b - movq c, (z,j,8) - movq a, c - incq j - cmpq k, j - jc Lbignum_modifier_dubloop2 - shrq $63, c - addq b, c - xorq j, j - xorq b, b -Lbignum_modifier_corrloop2: - movq (t,j,8), a - andq c, a - negq b - adcq (z,j,8), a - sbbq b, b - movq a, (z,j,8) - movq a, (t,j,8) - incq j - cmpq k, j - jc Lbignum_modifier_corrloop2 - -// We then successively generate (k+1)-digit values satisfying -// t_i == 2^{p+64*i} mod n, each of which is stored in h::t. Finish -// initialization by zeroing h initially - - xorq h, h - -// Then if t_i = 2^{p} * h + l -// we have t_{i+1} == 2^64 * t_i -// = (2^{p+64} * h) + (2^64 * l) -// == r * h + l<<64 -// Do this k more times so we end up == 2^{128*k+64}, one more than we want -// -// Writing B = 2^{64k}, the possible correction of adding r, which for -// a (k+1)-digit result is equivalent to subtracting q = 2^{64*(k+1)} - r -// would give the overall worst-case value minus q of -// [ B * (B^k - 1) + (B - 1) * r ] - [B^{k+1} - r] -// = B * (r - 1) < B^{k+1} so we keep inside k+1 digits as required. -// -// This implementation makes the shift implicit by starting b with the -// "previous" digit (initially 0) to offset things by 1. - - movq k, i -Lbignum_modifier_modloop: - xorq b, b - movq k, n - xorq j, j - xorq c, c -Lbignum_modifier_cmaloop: - adcq b, c - sbbq l, l - movq (z,j,8), a - mulq h - subq l, d - addq c, a - movq (t,j,8), b - movq a, (t,j,8) - movq d, c - incq j - decq n - jnz Lbignum_modifier_cmaloop - adcq c, b - movq b, h - - sbbq l, l - - xorq j, j - xorq c, c -Lbignum_modifier_oaloop: - movq (t,j,8), a - movq (z,j,8), b - andq l, b - negq c - adcq b, a - sbbq c, c - movq a, (t,j,8) - incq j - cmpq k, j - jc Lbignum_modifier_oaloop - subq c, h - - decq i - jnz Lbignum_modifier_modloop - -// Compute the negated modular inverse w (same register as i, not used again). - - movq (m), a - movq a, c - movq a, w - shlq $2, c - subq c, w - xorq $2, w - movq w, c - imulq a, c - movl $2, ashort - addq c, a - addq $1, c - imulq a, w - imulq c, c - movl $1, ashort - addq c, a - imulq a, w - imulq c, c - movl $1, ashort - addq c, a - imulq a, w - imulq c, c - movl $1, ashort - addq c, a - imulq a, w - -// Now do one almost-Montgomery reduction w.r.t. the original m -// which lops off one 2^64 from the congruence and, with the usual -// almost-Montgomery correction, gets us back inside k digits - - movq (t), c - movq w, b - imulq c, b - - movq (m), a - mulq b - addq c, a - movq d, c - movl $1, jshort - movq k, n - decq n - jz Lbignum_modifier_amontend -Lbignum_modifier_amontloop: - adcq (t,j,8), c - sbbq l, l - movq (m,j,8), a - mulq b - subq l, d - addq c, a - movq a, -8(t,j,8) - movq d, c - incq j - decq n - jnz Lbignum_modifier_amontloop -Lbignum_modifier_amontend: - adcq c, h - sbbq l, l - movq h, -8(t,k,8) - - xorq j, j - xorq c, c -Lbignum_modifier_aosloop: - movq (t,j,8), a - movq (m,j,8), b - andq l, b - negq c - sbbq b, a - sbbq c, c - movq a, (z,j,8) - incq j - cmpq k, j - jc Lbignum_modifier_aosloop - -// So far, the code (basically the same as bignum_amontifier) has produced -// a k-digit value z == 2^{128k} (mod m), not necessarily fully reduced mod m. -// We now do a short Montgomery reduction (similar to bignum_demont) so that -// we achieve full reduction mod m while lopping 2^{64k} off the congruence. -// We recycle h as the somewhat strangely-named outer loop counter. - - movq k, h - -Lbignum_modifier_montouterloop: - movq (z), c - movq w, b - imulq c, b - movq (m), a - mulq b - addq c, a - movq d, c - movl $1, jshort - movq k, n - decq n - jz Lbignum_modifier_montend -Lbignum_modifier_montloop: - adcq (z,j,8), c - sbbq l, l - movq (m,j,8), a - mulq b - subq l, d - addq c, a - movq a, -8(z,j,8) - movq d, c - incq j - decq n - jnz Lbignum_modifier_montloop -Lbignum_modifier_montend: - adcq $0, c - movq c, -8(z,k,8) - - decq h - jnz Lbignum_modifier_montouterloop - -// Now do a comparison of z with m to set a final correction mask -// indicating that z >= m and so we need to subtract m. - - xorq j, j - movq k, n -Lbignum_modifier_cmploop: - movq (z,j,8), a - sbbq (m,j,8), a - incq j - decq n - jnz Lbignum_modifier_cmploop - sbbq d, d - notq d - -// Now do a masked subtraction of m for the final reduced result. - - xorq l, l - xorq j, j -Lbignum_modifier_corrloop: - movq (m,j,8), a - andq d, a - negq l - sbbq a, (z,j,8) - sbbq l, l - incq j - cmpq k, j - jc Lbignum_modifier_corrloop - -Lbignum_modifier_end: - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_modifier) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modinv.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modinv.S deleted file mode 100644 index f1c3dccb4c6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modinv.S +++ /dev/null @@ -1,713 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Invert modulo m, z = (1/a) mod b, assuming b is an odd number > 1, coprime a -// Inputs a[k], b[k]; output z[k]; temporary buffer t[>=3*k] -// -// extern void bignum_modinv(uint64_t k, uint64_t *z, const uint64_t *a, -// const uint64_t *b, uint64_t *t); -// -// k-digit (digit=64 bits) "z := a^-1 mod b" (modular inverse of a modulo b) -// using t as a temporary buffer (t at least 3*k words = 24*k bytes), and -// assuming that a and b are coprime *and* that b is an odd number > 1. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = a, RCX = b, R8 = t -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = a, R9 = b, [RSP+40] = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_modinv) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_modinv) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_modinv) - .text - -// We get CHUNKSIZE bits per outer iteration, 64 minus a few for proxy errors - -#define CHUNKSIZE 58 - -// These variables are so fundamental we keep them consistently in registers. -// k actually stays where it was at the beginning, while l gets set up later - -#define k %rdi -#define l %r13 - -// These are kept on the stack since there aren't enough registers - -#define mat_mm (%rsp) -#define mat_mn 8(%rsp) -#define mat_nm 16(%rsp) -#define mat_nn 24(%rsp) -#define t 32(%rsp) -// Modular inverse -#define v 40(%rsp) -// We reconstruct n as m + 8*k as needed -#define m 48(%rsp) -#define w 56(%rsp) -#define z 64(%rsp) -// Original b pointer, not b the temp -#define bm 72(%rsp) - -#define STACKVARSIZE 80 - -// These get set to m/n or w/z during the cross-multiplications etc. -// Otherwise they can be used as additional temporaries - -#define p1 %r8 -#define p2 %r15 - -// These are shorthands for common temporary registers - -#define a %rax -#define b %rbx -#define c %rcx -#define d %rdx -#define i %r9 - -// Temporaries for the top proxy selection part - -#define c1 %r10 -#define c2 %r11 -#define h1 %r12 -#define h2 %rbp -#define l1 %r14 -#define l2 %rsi - -// Re-use for the actual proxies; m_hi = h1 and n_hi = h2 are assumed - -#define m_hi %r12 -#define n_hi %rbp -#define m_lo %r14 -#define n_lo %rsi - -// Re-use for the matrix entries in the inner loop, though they -// get spilled to the corresponding memory locations mat_... - -#define m_m %r10 -#define m_n %r11 -#define n_m %rcx -#define n_n %rdx - -#define ashort %eax -#define ishort %r9d -#define m_mshort %r10d -#define m_nshort %r11d -#define n_mshort %ecx -#define n_nshort %edx - -S2N_BN_SYMBOL(bignum_modinv): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// Save all required registers and make room on stack for all the above vars - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(STACKVARSIZE) - -// If k = 0 then do nothing (this is out of scope anyway) - - testq k, k - jz Lbignum_modinv_end - -// Set up the additional two buffers m and n beyond w in temp space -// and record all pointers m, n, w and z in stack-based variables - - movq %rsi, z - movq %r8, w - movq %rcx, bm - leaq (%r8,k,8), %r10 - movq %r10, m - leaq (%r10,k,8), p2 - -// Initialize the main buffers with their starting values: -// m = a, n = b, w = b (to be tweaked to b - 1) and z = 0 - - xorq %r11, %r11 - xorq i, i -Lbignum_modinv_copyloop: - movq (%rdx,i,8), a - movq (%rcx,i,8), b - movq a, (%r10,i,8) - movq b, (p2,i,8) - movq b, (%r8,i,8) - movq %r11, (%rsi,i,8) - incq i - cmpq k, i - jc Lbignum_modinv_copyloop - -// Tweak down w to b - 1 (this crude approach is safe as b needs to be odd -// for it to be in scope). We have then established the congruence invariant: -// -// a * w == -m (mod b) -// a * z == n (mod b) -// -// This, with the bounds w <= b and z <= b, is maintained round the outer loop - - movq (%r8), a - movq a, b - decq b - movq b, (%r8) - -// Compute v = negated modular inverse of b mod 2^64, reusing a from above -// This is used for Montgomery reduction operations each time round the loop - - movq a, h2 - movq a, h1 - shlq $2, h2 - subq h2, h1 - xorq $2, h1 - - movq h1, h2 - imulq a, h2 - movl $2, ashort - addq h2, a - addq $1, h2 - - imulq a, h1 - - imulq h2, h2 - movl $1, ashort - addq h2, a - imulq a, h1 - - imulq h2, h2 - movl $1, ashort - addq h2, a - imulq a, h1 - - imulq h2, h2 - movl $1, ashort - addq h2, a - imulq a, h1 - - movq h1, v - -// Set up the outer loop count of 128 * k -// The invariant is that m * n < 2^t at all times. - - movq k, a - shlq $7, a - movq a, t - -// Start of the main outer loop iterated t / CHUNKSIZE times - -Lbignum_modinv_outerloop: - -// We need only bother with sharper l = min k (ceil(t/64)) digits -// for the computations on m and n (but we still need k for w and z). -// Either both m and n fit in l digits, or m has become zero and so -// nothing happens in the loop anyway and this makes no difference. - - movq t, l - addq $63, l - shrq $6, l - cmpq k, l - cmovncq k, l - -// Select upper and lower proxies for both m and n to drive the inner -// loop. The lower proxies are simply the lowest digits themselves, -// m_lo = m[0] and n_lo = n[0], while the upper proxies are bitfields -// of the two inputs selected so their top bit (63) aligns with the -// most significant bit of *either* of the two inputs. - - xorq h1, h1 // Previous high and low for m - xorq l1, l1 - xorq h2, h2 // Previous high and low for n - xorq l2, l2 - xorq c2, c2 // Mask flag: previous word of one was nonzero - // and in this case h1 and h2 are those words - - movq m, p1 - leaq (p1,k,8), p2 - xorq i, i -Lbignum_modinv_toploop: - movq (p1,i,8), b - movq (p2,i,8), c - movq c2, c1 - andq h1, c1 - andq h2, c2 - movq b, a - orq c, a - negq a - cmovcq c1, l1 - cmovcq c2, l2 - cmovcq b, h1 - cmovcq c, h2 - sbbq c2, c2 - incq i - cmpq l, i - jc Lbignum_modinv_toploop - - movq h1, a - orq h2, a - bsrq a, c - xorq $63, c - shldq %cl, l1, h1 - shldq %cl, l2, h2 - -// m_lo = m[0], n_lo = n[0]; - - movq (p1), %rax - movq %rax, m_lo - - movq (p2), %rax - movq %rax, n_lo - -// Now the inner loop, with i as loop counter from CHUNKSIZE down. -// This records a matrix of updates to apply to the initial -// values of m and n with, at stage j: -// -// sgn * m' = (m_m * m - m_n * n) / 2^j -// -sgn * n' = (n_m * m - n_n * n) / 2^j -// -// where "sgn" is either +1 or -1, and we lose track of which except -// that both instance above are the same. This throwing away the sign -// costs nothing (since we have to correct in general anyway because -// of the proxied comparison) and makes things a bit simpler. But it -// is simply the parity of the number of times the first condition, -// used as the swapping criterion, fires in this loop. - - movl $1, m_mshort - movl $0, m_nshort - movl $0, n_mshort - movl $1, n_nshort - movl $CHUNKSIZE, ishort - -// Stash more variables over the inner loop to free up regs - - movq k, mat_mn - movq l, mat_nm - movq p1, mat_mm - movq p2, mat_nn - -// Conceptually in the inner loop we follow these steps: -// -// * If m_lo is odd and m_hi < n_hi, then swap the four pairs -// (m_hi,n_hi); (m_lo,n_lo); (m_m,n_m); (m_n,n_n) -// -// * Now, if m_lo is odd (old or new, doesn't matter as initial n_lo is odd) -// m_hi := m_hi - n_hi, m_lo := m_lo - n_lo -// m_m := m_m + n_m, m_n := m_n + n_n -// -// * Halve and double them -// m_hi := m_hi / 2, m_lo := m_lo / 2 -// n_m := n_m * 2, n_n := n_n * 2 -// -// The actual computation computes updates before actually swapping and -// then corrects as needed. - -Lbignum_modinv_innerloop: - - xorl %eax, %eax - xorl %ebx, %ebx - xorq p1, p1 - xorq p2, p2 - btq $0, m_lo - - cmovcq n_hi, %rax - cmovcq n_lo, %rbx - cmovcq n_m, p1 - cmovcq n_n, p2 - - movq m_lo, l - subq %rbx, m_lo - subq l, %rbx - movq m_hi, k - subq %rax, k - cmovcq m_hi, n_hi - leaq -1(k), m_hi - cmovcq %rbx, m_lo - cmovcq l, n_lo - notq m_hi - cmovcq m_m, n_m - cmovcq m_n, n_n - cmovncq k, m_hi - - shrq $1, m_lo - addq p1, m_m - addq p2, m_n - shrq $1, m_hi - addq n_m, n_m - addq n_n, n_n - -// End of the inner for-loop - - decq i - jnz Lbignum_modinv_innerloop - -// Unstash the temporary variables - - movq mat_mn, k - movq mat_nm, l - movq mat_mm, p1 - movq mat_nn, p2 - -// Put the matrix entries in memory since we're out of registers -// We pull them out repeatedly in the next loop - - movq m_m, mat_mm - movq m_n, mat_mn - movq n_m, mat_nm - movq n_n, mat_nn - -// Apply the update to w and z, using addition in this case, and also take -// the chance to shift an additional 6 = 64-CHUNKSIZE bits to be ready for a -// Montgomery multiplication. Because we know that m_m + m_n <= 2^58 and -// w, z <= b < 2^{64k}, we know that both of these fit in k+1 words. -// We do this before the m-n update to allow us to play with c1 and c2 here. -// -// l1::w = 2^6 * (m_m * w + m_n * z) -// l2::z = 2^6 * (n_m * w + n_n * z) -// -// with c1 and c2 recording previous words for the shifting part - - movq w, p1 - movq z, p2 - xorq l1, l1 - xorq l2, l2 - xorq c1, c1 - xorq c2, c2 - xorq i, i -Lbignum_modinv_congloop: - - movq (p1,i,8), c - movq mat_mm, a - mulq c - addq a, l1 - adcq $0, d - movq d, h1 // Now h1::l1 := m_m * w + l1_in - - movq mat_nm, a - mulq c - addq a, l2 - adcq $0, d - movq d, h2 // Now h2::l2 := n_m * w + l2_in - - movq (p2,i,8), c - movq mat_mn, a - mulq c - addq a, l1 - adcq d, h1 // h1::l1 := m_m * w + m_n * z + l1_in - shrdq $CHUNKSIZE, l1, c1 - movq c1, (p1,i,8) - movq l1, c1 - movq h1, l1 - - movq mat_nn, a - mulq c - addq a, l2 - adcq d, h2 // h2::l2 := n_m * w + n_n * z + l2_in - shrdq $CHUNKSIZE, l2, c2 - movq c2, (p2,i,8) - movq l2, c2 - movq h2, l2 - - incq i - cmpq k, i - jc Lbignum_modinv_congloop - - shldq $64-CHUNKSIZE, c1, l1 - shldq $64-CHUNKSIZE, c2, l2 - -// Do a Montgomery reduction of l1::w - - movq bm, p2 - - movq (p1), b - movq v, h1 - imulq b, h1 - movq (p2), a - mulq h1 - addq b, a // Will be zero but want the carry - movq %rdx, c1 - movl $1, ishort - movq k, c - decq c - jz Lbignum_modinv_wmontend - -Lbignum_modinv_wmontloop: - adcq (p1,i,8), c1 - sbbq b, b - movq (p2,i,8), a - mulq h1 - subq b, %rdx - addq c1, a - movq a, -8(p1,i,8) - movq %rdx, c1 - incq i - decq c - jnz Lbignum_modinv_wmontloop - -Lbignum_modinv_wmontend: - adcq l1, c1 - movq c1, -8(p1,k,8) - sbbq c1, c1 - negq c1 - - movq k, c - xorq i, i -Lbignum_modinv_wcmploop: - movq (p1,i,8), a - sbbq (p2,i,8), a - incq i - decq c - jnz Lbignum_modinv_wcmploop - sbbq $0, c1 - sbbq c1, c1 - notq c1 - - xorq c, c - xorq i, i -Lbignum_modinv_wcorrloop: - movq (p1,i,8), a - movq (p2,i,8), b - andq c1, b - negq c - sbbq b, a - sbbq c, c - movq a, (p1,i,8) - incq i - cmpq k, i - jc Lbignum_modinv_wcorrloop - -// Do a Montgomery reduction of l2::z - - movq z, p1 - - movq (p1), b - movq v, h2 - imulq b, h2 - movq (p2), a - mulq h2 - addq b, a // Will be zero but want the carry - movq %rdx, c2 - movl $1, ishort - movq k, c - decq c - jz Lbignum_modinv_zmontend - -Lbignum_modinv_zmontloop: - adcq (p1,i,8), c2 - sbbq b, b - movq (p2,i,8), a - mulq h2 - subq b, %rdx - addq c2, a - movq a, -8(p1,i,8) - movq %rdx, c2 - incq i - decq c - jnz Lbignum_modinv_zmontloop - -Lbignum_modinv_zmontend: - adcq l2, c2 - movq c2, -8(p1,k,8) - sbbq c2, c2 - negq c2 - - movq k, c - xorq i, i -Lbignum_modinv_zcmploop: - movq (p1,i,8), a - sbbq (p2,i,8), a - incq i - decq c - jnz Lbignum_modinv_zcmploop - sbbq $0, c2 - sbbq c2, c2 - notq c2 - - xorq c, c - xorq i, i -Lbignum_modinv_zcorrloop: - movq (p1,i,8), a - movq (p2,i,8), b - andq c2, b - negq c - sbbq b, a - sbbq c, c - movq a, (p1,i,8) - incq i - cmpq k, i - jc Lbignum_modinv_zcorrloop - -// Now actually compute the updates to m and n corresponding to the matrix, -// and correct the signs if they have gone negative. First we compute the -// (k+1)-sized updates with the following invariant (here h1 and h2 are in -// fact carry bitmasks, either 0 or -1): -// -// h1::l1::m = m_m * m - m_n * n -// h2::l2::n = n_m * m - n_n * n - - movq m, p1 - leaq (p1,k,8), p2 - xorq i, i - xorq h1, h1 - xorq l1, l1 - xorq h2, h2 - xorq l2, l2 -Lbignum_modinv_crossloop: - - movq (p1,i,8), c - movq mat_mm, a - mulq c - addq a, l1 - adcq $0, d - movq d, c1 // Now c1::l1 is +ve part 1 - - movq mat_nm, a - mulq c - addq a, l2 - adcq $0, d - movq d, c2 // Now c2::l2 is +ve part 2 - - movq (p2,i,8), c - movq mat_mn, a - mulq c - subq h1, d // Now d::a is -ve part 1 - - subq a, l1 - sbbq d, c1 - sbbq h1, h1 - movq l1, (p1,i,8) - movq c1, l1 - - movq mat_nn, a - mulq c - subq h2, d // Now d::a is -ve part 2 - - subq a, l2 - sbbq d, c2 - sbbq h2, h2 - movq l2, (p2,i,8) - movq c2, l2 - - incq i - cmpq l, i - jc Lbignum_modinv_crossloop - -// Now fix the signs of m and n if they have gone negative - - xorq i, i - movq h1, c1 // carry-in coded up as well - movq h2, c2 // carry-in coded up as well - xorq h1, l1 // for the Lbignum_modinv_end digit - xorq h2, l2 // for the Lbignum_modinv_end digit -Lbignum_modinv_optnegloop: - movq (p1,i,8), a - xorq h1, a - negq c1 - adcq $0, a - sbbq c1, c1 - movq a, (p1,i,8) - movq (p2,i,8), a - xorq h2, a - negq c2 - adcq $0, a - sbbq c2, c2 - movq a, (p2,i,8) - incq i - cmpq l, i - jc Lbignum_modinv_optnegloop - subq c1, l1 - subq c2, l2 - -// Now shift them right CHUNKSIZE bits - - movq l, i -Lbignum_modinv_shiftloop: - movq -8(p1,i,8), a - movq a, c1 - shrdq $CHUNKSIZE, l1, a - movq a, -8(p1,i,8) - movq c1, l1 - movq -8(p2,i,8), a - movq a, c2 - shrdq $CHUNKSIZE, l2, a - movq a, -8(p2,i,8) - movq c2, l2 - decq i - jnz Lbignum_modinv_shiftloop - -// Finally, use the signs h1 and h2 to do optional modular negations of -// w and z respectively, flipping h2 to make signs work. We don't make -// any checks for zero values, but we certainly retain w <= b and z <= b. -// This is enough for the Montgomery step in the next iteration to give -// strict reduction w < b amd z < b, and anyway when we terminate we -// could not have z = b since it violates the coprimality assumption for -// in-scope cases. - - notq h2 - movq bm, c - movq w, p1 - movq z, p2 - movq h1, c1 - movq h2, c2 - xorq i, i -Lbignum_modinv_fliploop: - movq h2, d - movq (c,i,8), a - andq a, d - andq h1, a - movq (p1,i,8), b - xorq h1, b - negq c1 - adcq b, a - sbbq c1, c1 - movq a, (p1,i,8) - movq (p2,i,8), b - xorq h2, b - negq c2 - adcq b, d - sbbq c2, c2 - movq d, (p2,i,8) - incq i - cmpq k, i - jc Lbignum_modinv_fliploop - -// End of main loop. We can stop if t' <= 0 since then m * n < 2^0, which -// since n is odd and m and n are coprime (in the in-scope cases) means -// m = 0, n = 1 and hence from the congruence invariant a * z == 1 (mod b). -// Moreover we do in fact need to maintain strictly t > 0 in the main loop, -// or the computation of the optimized digit bound l could collapse to 0. - - subq $CHUNKSIZE, t - jnbe Lbignum_modinv_outerloop - -Lbignum_modinv_end: - CFI_INC_RSP(STACKVARSIZE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_modinv) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modoptneg.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modoptneg.S deleted file mode 100644 index da7cf96ea40..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modoptneg.S +++ /dev/null @@ -1,101 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo m, z := (-x) mod m (if p nonzero) or z := x -// (if p zero), assuming x reduced -// Inputs p, x[k], m[k]; output z[k] -// -// extern void bignum_modoptneg(uint64_t k, uint64_t *z, uint64_t p, -// const uint64_t *x, const uint64_t *m); -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = p, RCX = x, R8 = m -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = p, R9 = x, [RSP+40] = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_modoptneg) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_modoptneg) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_modoptneg) - .text - -#define k %rdi -#define z %rsi -#define p %rdx -#define x %rcx -#define m %r8 - -#define a %r9 -#define c %rax -#define b %r10 -#define i %r11 - -S2N_BN_SYMBOL(bignum_modoptneg): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// Do nothing if k = 0 - - testq k, k - jz Lbignum_modoptneg_end - -// Make an additional check for zero input, and force p to zero in this case. -// This can be skipped if the input is known not to be zero a priori. - - xorq i, i - xorq a, a -Lbignum_modoptneg_cmploop: - orq (x,i,8), a - incq i - cmpq k, i - jc Lbignum_modoptneg_cmploop - - cmpq $0, a - cmovzq a, p - -// Turn the input p into a strict bitmask - - negq p - sbbq p, p - -// Main loop - - xorq i, i - movq p, c -Lbignum_modoptneg_mainloop: - movq (m,i,8), a - andq p, a - movq (x,i,8), b - xorq p, b - negq c - adcq b, a - sbbq c, c - movq a, (z,i,8) - incq i - cmpq k, i - jc Lbignum_modoptneg_mainloop - -Lbignum_modoptneg_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_modoptneg) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modsub.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modsub.S deleted file mode 100644 index 2e07896de92..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_modsub.S +++ /dev/null @@ -1,90 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Subtract modulo m, z := (x - y) mod m, assuming x and y reduced -// Inputs x[k], y[k], m[k]; output z[k] -// -// extern void bignum_modsub(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *y, const uint64_t *m); -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = x, RCX = y, R8 = m -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = x, R9 = y, [RSP+40] = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_modsub) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_modsub) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_modsub) - .text - -#define k %rdi -#define z %rsi -#define x %rdx -#define y %rcx -#define m %r8 -#define i %r9 -#define j %r10 -#define a %rax -#define c %r11 - -S2N_BN_SYMBOL(bignum_modsub): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// If k = 0 do nothing - - testq k, k - jz Lbignum_modsub_end - -// Subtract z := x - y and record a mask for the carry x - y < 0 - - xorq c, c - movq k, j - xorq i, i -Lbignum_modsub_subloop: - movq (x,i,8), a - sbbq (y,i,8), a - movq a, (z,i,8) - incq i - decq j - jnz Lbignum_modsub_subloop - sbbq c, c - -// Now do a masked addition z := z + [c] * m - - xorq i, i -Lbignum_modsub_addloop: - movq (m,i,8), a - andq c, a - negq j - adcq a, (z,i,8) - sbbq j, j - incq i - cmpq k, i - jc Lbignum_modsub_addloop - -Lbignum_modsub_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_modsub) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montifier.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montifier.S deleted file mode 100644 index 095c19ca9c1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montifier.S +++ /dev/null @@ -1,544 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Compute "montification" constant z := 2^{128k} mod m -// Input m[k]; output z[k]; temporary buffer t[>=k] -// -// extern void bignum_montifier(uint64_t k, uint64_t *z, const uint64_t *m, -// uint64_t *t); -// -// The last argument points to a temporary buffer t that should have size >= k. -// This is called "montifier" because given any other k-digit number x, -// whether or not it's reduced modulo m, it can be mapped to its Montgomery -// representation (2^{64k} * x) mod m just by Montgomery multiplication by z. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = m, RCX = t -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = m, R9 = t -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montifier) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montifier) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montifier) - .text - -#define k %rdi -#define z %rsi - -// These two inputs get moved to different places since RCX and RDX are special - -#define m %r12 -#define t %r13 - -// Other variables - -#define i %rbx -// Modular inverse; aliased to i, but we never use them together -#define w %rbx -#define j %rbp -// Matters that this is RAX for special use in multiplies -#define a %rax -// Matters that this is RDX for special use in multiplies -#define d %rdx -// Matters that this is RCX as CL=lo(c) is assumed in shifts -#define c %rcx -#define h %r11 -#define l %r10 -#define b %r9 -#define n %r8 - -// Some aliases for the values b and n - -#define q %r8 -#define r %r9 - -#define ashort %eax -#define ishort %ebx -#define jshort %ebp -#define qshort %r8d - - -S2N_BN_SYMBOL(bignum_montifier): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Save some additional registers for use, copy args out of RCX and RDX - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - - movq %rdx, m - movq %rcx, t - -// If k = 0 the whole operation is trivial - - testq k, k - jz Lbignum_montifier_end - -// Copy the input m into the temporary buffer t. The temporary register -// c matters since we want it to hold the highest digit, ready for the -// normalization phase. - - xorq i, i -Lbignum_montifier_copyinloop: - movq (m,i,8), c - movq c, (t,i,8) - incq i - cmpq k, i - jc Lbignum_montifier_copyinloop - -// Do a rather stupid but constant-time digit normalization, conditionally -// shifting left (k-1) times based on whether the top word is zero. -// With careful binary striding this could be O(k*log(k)) instead of O(k^2) -// while still retaining the constant-time style. -// The "neg c" sets the zeroness predicate (~CF) for the entire inner loop - - movq k, i - decq i - jz Lbignum_montifier_normalized -Lbignum_montifier_normloop: - xorq j, j - movq k, h - negq c - movl $0, ashort -Lbignum_montifier_shufloop: - movq a, c - movq (t,j,8), a - cmovcq a, c - movq c, (t,j,8) - incq j - decq h - jnz Lbignum_montifier_shufloop - decq i - jnz Lbignum_montifier_normloop - -// We now have the top digit nonzero, assuming the input was nonzero, -// and as per the invariant of the loop above, c holds that digit. So -// now just count c's leading zeros and shift t bitwise that many bits. -// Note that we don't care about the result of bsr for zero inputs so -// the simple xor-ing with 63 is safe. - -Lbignum_montifier_normalized: - - bsrq c, c - xorq $63, c - - xorq b, b - xorq i, i -Lbignum_montifier_bitloop: - movq (t,i,8), a - movq a, j - shldq %cl, b, a - movq a, (t,i,8) - movq j, b - incq i - cmpq k, i - jc Lbignum_montifier_bitloop - -// Let h be the high word of n, which in all the in-scope cases is >= 2^63. -// Now successively form q = 2^i div h and r = 2^i mod h as i goes from -// 64 to 126. We avoid just using division out of constant-time concerns -// (at the least we would need to fix up h = 0 for out-of-scope inputs) and -// don't bother with Newton-Raphson, since this stupid simple loop doesn't -// contribute much of the overall runtime at typical sizes. - - movq -8(t,k,8), h - movl $1, qshort - movq h, r - negq r - movl $62, ishort -Lbignum_montifier_estloop: - - addq q, q - movq h, a - subq r, a - cmpq a, r // CF <=> r < h - r <=> 2 * r < h - sbbq a, a - notq a // a = bitmask(2 * r >= h) - subq a, q - addq r, r - andq h, a - subq a, r - decq i - jnz Lbignum_montifier_estloop - -// Strictly speaking the above loop doesn't quite give the true remainder -// and quotient in the special case r = h = 2^63, so fix it up. We get -// q = 2^63 - 1 and r = 2^63 and really want q = 2^63 and r = 0. This is -// supererogatory, because the main property of q used below still holds -// in this case unless the initial m = 1, and then anyway the overall -// specification (congruence modulo m) holds degenerately. But it seems -// nicer to get a "true" quotient and remainder. - - incq r - cmpq r, h - adcq $0, q - -// So now we have q and r with 2^126 = q * h + r (imagining r = 0 in the -// fixed-up case above: note that we never actually use the computed -// value of r below and so didn't adjust it). And we can assume the ranges -// q <= 2^63 and r < h < 2^64. -// -// The idea is to use q as a first quotient estimate for a remainder -// of 2^{p+62} mod n, where p = 64 * k. We have, splitting n into the -// high and low parts h and l: -// -// 2^{p+62} - q * n = 2^{p+62} - q * (2^{p-64} * h + l) -// = 2^{p+62} - (2^{p-64} * (q * h) + q * l) -// = 2^{p+62} - 2^{p-64} * (2^126 - r) - q * l -// = 2^{p-64} * r - q * l -// -// Note that 2^{p-64} * r < 2^{p-64} * h <= n -// and also q * l < 2^63 * 2^{p-64} = 2^{p-1} <= n -// so |diff| = |2^{p-64} * r - q * l| < n. -// -// If in fact diff >= 0 then it is already 2^{p+62} mod n. -// otherwise diff + n is the right answer. -// -// To (maybe?) make the computation slightly easier we actually flip -// the sign and compute d = q * n - 2^{p+62}. Then the answer is either -// -d (when negative) or n - d; in either case we effectively negate d. -// This negating tweak in fact spoils the result for cases where -// 2^{p+62} mod n = 0, when we get n instead. However the only case -// where this can happen is m = 1, when the whole spec holds trivially, -// and actually the remainder of the logic below works anyway since -// the latter part of the code only needs a congruence for the k-digit -// result, not strict modular reduction (the doublings will maintain -// the non-strict inequality). - - xorq c, c - xorq i, i -Lbignum_montifier_mulloop: - movq (t,i,8), a - mulq q - addq c, a - adcq $0, d - movq a, (z,i,8) - movq d, c - incq i - cmpq k, i - jc Lbignum_montifier_mulloop - -// Now c is the high word of the product, so subtract 2^62 -// and then turn it into a bitmask in q = h - - movq $0x4000000000000000, a - subq a, c - sbbq q, q - notq q - -// Now do [c] * n - d for our final answer - - xorq c, c - xorq i, i -Lbignum_montifier_remloop: - movq (t,i,8), a - andq q, a - negq c - sbbq (z,i,8), a - sbbq c, c - movq a, (z,i,8) - incq i - cmpq k, i - jc Lbignum_montifier_remloop - -// Now still need to do a couple of modular doublings to get us all the -// way up to 2^{p+64} == r from initial 2^{p+62} == r (mod n). - - xorq c, c - xorq j, j - xorq b, b -Lbignum_montifier_dubloop1: - movq (z,j,8), a - shrdq $63, a, c - negq b - sbbq (t,j,8), c - sbbq b, b - movq c, (z,j,8) - movq a, c - incq j - cmpq k, j - jc Lbignum_montifier_dubloop1 - shrq $63, c - addq b, c - xorq j, j - xorq b, b -Lbignum_montifier_corrloop1: - movq (t,j,8), a - andq c, a - negq b - adcq (z,j,8), a - sbbq b, b - movq a, (z,j,8) - incq j - cmpq k, j - jc Lbignum_montifier_corrloop1 - -// This is not exactly the same: we also copy output to t giving the -// initialization t_1 = r == 2^{p+64} mod n for the main loop next. - - xorq c, c - xorq j, j - xorq b, b -Lbignum_montifier_dubloop2: - movq (z,j,8), a - shrdq $63, a, c - negq b - sbbq (t,j,8), c - sbbq b, b - movq c, (z,j,8) - movq a, c - incq j - cmpq k, j - jc Lbignum_montifier_dubloop2 - shrq $63, c - addq b, c - xorq j, j - xorq b, b -Lbignum_montifier_corrloop2: - movq (t,j,8), a - andq c, a - negq b - adcq (z,j,8), a - sbbq b, b - movq a, (z,j,8) - movq a, (t,j,8) - incq j - cmpq k, j - jc Lbignum_montifier_corrloop2 - -// We then successively generate (k+1)-digit values satisfying -// t_i == 2^{p+64*i} mod n, each of which is stored in h::t. Finish -// initialization by zeroing h initially - - xorq h, h - -// Then if t_i = 2^{p} * h + l -// we have t_{i+1} == 2^64 * t_i -// = (2^{p+64} * h) + (2^64 * l) -// == r * h + l<<64 -// Do this 2*k more times so we end up == 2^{192*k+64}, one more than we want -// -// Writing B = 2^{64k}, the possible correction of adding r, which for -// a (k+1)-digit result is equivalent to subtracting q = 2^{64*(k+1)} - r -// would give the overall worst-case value minus q of -// [ B * (B^k - 1) + (B - 1) * r ] - [B^{k+1} - r] -// = B * (r - 1) < B^{k+1} so we keep inside k+1 digits as required. -// -// This implementation makes the shift implicit by starting b with the -// "previous" digit (initially 0) to offset things by 1. - - leaq (k,k), i -Lbignum_montifier_modloop: - xorq b, b - movq k, n - xorq j, j - xorq c, c -Lbignum_montifier_cmaloop: - adcq b, c - sbbq l, l - movq (z,j,8), a - mulq h - subq l, d - addq c, a - movq (t,j,8), b - movq a, (t,j,8) - movq d, c - incq j - decq n - jnz Lbignum_montifier_cmaloop - adcq c, b - movq b, h - - sbbq l, l - - xorq j, j - xorq c, c -Lbignum_montifier_oaloop: - movq (t,j,8), a - movq (z,j,8), b - andq l, b - negq c - adcq b, a - sbbq c, c - movq a, (t,j,8) - incq j - cmpq k, j - jc Lbignum_montifier_oaloop - subq c, h - - decq i - jnz Lbignum_montifier_modloop - -// Compute the negated modular inverse w (same register as i, not used again). - - movq (m), a - movq a, c - movq a, w - shlq $2, c - subq c, w - xorq $2, w - movq w, c - imulq a, c - movl $2, ashort - addq c, a - addq $1, c - imulq a, w - imulq c, c - movl $1, ashort - addq c, a - imulq a, w - imulq c, c - movl $1, ashort - addq c, a - imulq a, w - imulq c, c - movl $1, ashort - addq c, a - imulq a, w - -// Now do one almost-Montgomery reduction w.r.t. the original m -// which lops off one 2^64 from the congruence and, with the usual -// almost-Montgomery correction, gets us back inside k digits - - movq (t), c - movq w, b - imulq c, b - - movq (m), a - mulq b - addq c, a - movq d, c - movl $1, jshort - movq k, n - decq n - jz Lbignum_montifier_amontend -Lbignum_montifier_amontloop: - adcq (t,j,8), c - sbbq l, l - movq (m,j,8), a - mulq b - subq l, d - addq c, a - movq a, -8(t,j,8) - movq d, c - incq j - decq n - jnz Lbignum_montifier_amontloop -Lbignum_montifier_amontend: - adcq c, h - sbbq l, l - movq h, -8(t,k,8) - - xorq j, j - xorq c, c -Lbignum_montifier_aosloop: - movq (t,j,8), a - movq (m,j,8), b - andq l, b - negq c - sbbq b, a - sbbq c, c - movq a, (z,j,8) - incq j - cmpq k, j - jc Lbignum_montifier_aosloop - -// So far, the code (basically a variant of bignum_amontifier) has produced -// a k-digit value z == 2^{192k} (mod m), not necessarily fully reduced mod m. -// We now do a short Montgomery reduction (similar to bignum_demont) so that -// we achieve full reduction mod m while lopping 2^{64k} off the congruence. -// We recycle h as the somewhat strangely-named outer loop counter. - - movq k, h - -Lbignum_montifier_montouterloop: - movq (z), c - movq w, b - imulq c, b - movq (m), a - mulq b - addq c, a - movq d, c - movl $1, jshort - movq k, n - decq n - jz Lbignum_montifier_montend -Lbignum_montifier_montloop: - adcq (z,j,8), c - sbbq l, l - movq (m,j,8), a - mulq b - subq l, d - addq c, a - movq a, -8(z,j,8) - movq d, c - incq j - decq n - jnz Lbignum_montifier_montloop -Lbignum_montifier_montend: - adcq $0, c - movq c, -8(z,k,8) - - decq h - jnz Lbignum_montifier_montouterloop - -// Now do a comparison of z with m to set a final correction mask -// indicating that z >= m and so we need to subtract m. - - xorq j, j - movq k, n -Lbignum_montifier_cmploop: - movq (z,j,8), a - sbbq (m,j,8), a - incq j - decq n - jnz Lbignum_montifier_cmploop - sbbq d, d - notq d - -// Now do a masked subtraction of m for the final reduced result. - - xorq l, l - xorq j, j -Lbignum_montifier_corrloop: - movq (m,j,8), a - andq d, a - negq l - sbbq a, (z,j,8) - sbbq l, l - incq j - cmpq k, j - jc Lbignum_montifier_corrloop - -Lbignum_montifier_end: - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montifier) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montmul.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montmul.S deleted file mode 100644 index 1cf659ab695..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montmul.S +++ /dev/null @@ -1,264 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^{64k}) mod m -// Inputs x[k], y[k], m[k]; output z[k] -// -// extern void bignum_montmul(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *y, const uint64_t *m); -// -// Does z := (x * y / 2^{64k}) mod m, assuming x * y <= 2^{64k} * m, which is -// guaranteed in particular if x < m, y < m initially (the "intended" case). -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = x, RCX = y, R8 = m -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = x, R9 = y, [RSP+40] = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul) - .text - -// We copy x to %r9 but it comes in in %rdx originally - -#define k %rdi -#define z %rsi -#define x %r9 -#define y %rcx -#define m %r8 - -// General temp, low part of product and mul input -#define a %rax -// General temp, High part of product -#define b %rdx -// Inner loop counter -#define j %rbx -// Home for i'th digit or Montgomery multiplier -#define d %rbp -#define h %r10 -#define e %r11 -#define n %r12 -#define i %r13 -#define c0 %r14 -#define c1 %r15 - -// This one variable we store on the stack as we are a register short. -// At least it's only used once per iteration of the outer loop (k times) -// and with a single read each time, after one initial write. It's the -// word-level negated modular inverse. - -#define w (%rsp) - -// Some more intuitive names for temp regs in initial word-level negmodinv. - -#define t1 %rbx -#define t2 %rdx - -#define ashort %eax -#define jshort %ebx - - -S2N_BN_SYMBOL(bignum_montmul): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// Save registers and allocate space on stack for non-register variable w - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(8) - -// If k = 0 the whole operation is trivial - - testq k, k - jz Lbignum_montmul_end - -// Move x input into its permanent home, since we need %rdx for multiplications - - movq %rdx, x - -// Compute word-level negated modular inverse w for m == m[0]. - - movq (m), a - - movq a, t2 - movq a, t1 - shlq $2, t2 - subq t2, t1 - xorq $2, t1 - - movq t1, t2 - imulq a, t2 - movl $2, ashort - addq t2, a - addq $1, t2 - - imulq a, t1 - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, t1 - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, t1 - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, t1 - - movq t1, w - -// Initialize the output c0::z to zero so we can then consistently add rows. -// It would be a bit more efficient to special-case the zeroth row, but -// this keeps the code slightly simpler. - - xorq i, i // Also initializes i for main loop - xorq j, j -Lbignum_montmul_zoop: - movq i, (z,j,8) - incq j - cmpq k, j - jc Lbignum_montmul_zoop - - xorq c0, c0 - -// Outer loop pulling down digits d=x[i], multiplying by y and reducing - -Lbignum_montmul_outerloop: - -// Multiply-add loop where we always have CF + previous high part h to add in. -// Note that in general we do need yet one more carry in this phase and hence -// initialize c1 with the top carry. - - movq (x,i,8), d - xorq j, j - xorq h, h - xorq c1, c1 - movq k, n - -Lbignum_montmul_maddloop: - adcq (z,j,8), h - sbbq e, e - movq (y,j,8), a - mulq d - subq e, %rdx - addq h, a - movq a, (z,j,8) - movq %rdx, h - incq j - decq n - jnz Lbignum_montmul_maddloop - adcq h, c0 - adcq c1, c1 - -// Montgomery reduction loop, similar but offsetting writebacks - - movq (z), e - movq w, d - imulq e, d - movq (m), a - mulq d - addq e, a // Will be zero but want the carry - movq %rdx, h - movl $1, jshort - movq k, n - decq n - jz Lbignum_montmul_montend - -Lbignum_montmul_montloop: - adcq (z,j,8), h - sbbq e, e - movq (m,j,8), a - mulq d - subq e, %rdx - addq h, a - movq a, -8(z,j,8) - movq %rdx, h - incq j - decq n - jnz Lbignum_montmul_montloop - -Lbignum_montmul_montend: - adcq c0, h - adcq $0, c1 - movq c1, c0 - movq h, -8(z,j,8) - -// End of outer loop. - - incq i - cmpq k, i - jc Lbignum_montmul_outerloop - -// Now do a comparison of (c0::z) with (0::m) to set a final correction mask -// indicating that (c0::z) >= m and so we need to subtract m. - - xorq j, j - movq k, n -Lbignum_montmul_cmploop: - movq (z,j,8), a - sbbq (m,j,8), a - incq j - decq n - jnz Lbignum_montmul_cmploop - - sbbq $0, c0 - sbbq d, d - notq d - -// Now do a masked subtraction of m for the final reduced result. - - xorq e, e - xorq j, j -Lbignum_montmul_corrloop: - movq (m,j,8), a - andq d, a - negq e - sbbq a, (z,j,8) - sbbq e, e - incq j - cmpq k, j - jc Lbignum_montmul_corrloop - -Lbignum_montmul_end: - CFI_INC_RSP(8) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montredc.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montredc.S deleted file mode 100644 index 74cbd668051..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montredc.S +++ /dev/null @@ -1,267 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery reduce, z := (x' / 2^{64p}) MOD m -// Inputs x[n], m[k], p; output z[k] -// -// extern void bignum_montredc(uint64_t k, uint64_t *z, uint64_t n, -// const uint64_t *x, const uint64_t *m, uint64_t p); -// -// Does a := (x' / 2^{64p}) mod m where x' = x if n <= p + k and in general -// is the lowest (p+k) digits of x, assuming x' <= 2^{64p} * m. That is, -// p-fold Montgomery reduction w.r.t. a k-digit modulus m giving a k-digit -// answer. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = n, RCX = x, R8 = m, R9 = p -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = n, R9 = x, [RSP+40] = m, [RSP+48] = p -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montredc) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montredc) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montredc) - .text - - // We copy n into %r10 but it comes in in %rdx originally - -#define k %rdi -#define z %rsi -#define n %r10 -#define x %rcx -#define m %r8 -#define p %r9 - -// General temp, low part of product and mul input -#define a %rax -// General temp, High part of product -#define b %rdx -// Negated modular inverse -#define w (%rsp) -// Inner loop counter -#define j %rbx -// Home for i'th digit or Montgomery multiplier -#define d %rbp -#define h %r11 -#define e %r12 -#define t %r13 -#define i %r14 -#define c %r15 - -// Some more intuitive names for temp regs in initial word-level negmodinv. - -#define t1 %rbx -#define t2 %r14 - -#define ashort %eax -#define cshort %r15d -#define jshort %ebx - - -S2N_BN_SYMBOL(bignum_montredc): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 - movq 64(%rsp), %r9 -#endif - -// Save registers and allocate space on stack for non-register variable w - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(8) - -// If k = 0 the whole operation is trivial - - testq k, k - jz Lbignum_montredc_end - -// Move n input into its permanent home, since we need %rdx for multiplications - - movq %rdx, n - -// Compute word-level negated modular inverse w for m == m[0]. - - movq (m), a - - movq a, t2 - movq a, t1 - shlq $2, t2 - subq t2, t1 - xorq $2, t1 - - movq t1, t2 - imulq a, t2 - movl $2, ashort - addq t2, a - addq $1, t2 - - imulq a, t1 - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, t1 - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, t1 - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, t1 - - movq t1, w - -// Initialize z to the lowest k digits of the input, zero-padding if n < k. - - movq k, j - cmpq k, n - cmovcq n, j - xorq i, i - testq j, j - jz Lbignum_montredc_padloop -Lbignum_montredc_copyloop: - movq (x,i,8), a - movq a, (z,i,8) - incq i - cmpq j, i - jc Lbignum_montredc_copyloop - - cmpq k, i - jnc Lbignum_montredc_initialized - - xorq j, j -Lbignum_montredc_padloop: - movq j, (z,i,8) - incq i - cmpq k, i - jc Lbignum_montredc_padloop - -Lbignum_montredc_initialized: - xorq c, c - -// Now if p = 0 we just need the corrective tail, and even that is -// only needed for the case when the input is exactly the modulus, -// to maintain the <= 2^64p * n precondition - - testq p, p - jz Lbignum_montredc_corrective - -// Outer loop, just doing a standard Montgomery reduction on z - - xorq i, i -Lbignum_montredc_outerloop: - movq (z), e - movq w, d - imulq e, d - movq (m), a - mulq d - addq e, a // Will be zero but want the carry - movq %rdx, h - movl $1, jshort - movq k, t - decq t - jz Lbignum_montredc_montend - -Lbignum_montredc_montloop: - adcq (z,j,8), h - sbbq e, e - movq (m,j,8), a - mulq d - subq e, %rdx - addq h, a - movq a, -8(z,j,8) - movq %rdx, h - incq j - decq t - jnz Lbignum_montredc_montloop - -Lbignum_montredc_montend: - adcq c, h - movl $0, cshort - adcq $0, c - - addq i, j - cmpq n, j - jnc Lbignum_montredc_offtheend - movq (x,j,8), a - addq a, h - adcq $0, c -Lbignum_montredc_offtheend: - movq h, -8(z,k,8) - -// End of outer loop. - - incq i - cmpq p, i - jc Lbignum_montredc_outerloop - -// Now do a comparison of (c::z) with (0::m) to set a final correction mask -// indicating that (c::z) >= m and so we need to subtract m. - -Lbignum_montredc_corrective: - - xorq j, j - movq k, n -Lbignum_montredc_cmploop: - movq (z,j,8), a - sbbq (m,j,8), a - incq j - decq n - jnz Lbignum_montredc_cmploop - - sbbq $0, c - sbbq d, d - notq d - -// Now do a masked subtraction of m for the final reduced result. - - xorq e, e - xorq j, j -Lbignum_montredc_corrloop: - movq (m,j,8), a - andq d, a - negq e - sbbq a, (z,j,8) - sbbq e, e - incq j - cmpq k, j - jc Lbignum_montredc_corrloop - -Lbignum_montredc_end: - CFI_INC_RSP(8) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montredc) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montsqr.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montsqr.S deleted file mode 100644 index 6a5c84cc055..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_montsqr.S +++ /dev/null @@ -1,252 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^{64k}) mod m -// Inputs x[k], m[k]; output z[k] -// -// extern void bignum_montsqr(uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *m); -// -// Does z := (x^2 / 2^{64k}) mod m, assuming x^2 <= 2^{64k} * m, which is -// guaranteed in particular if x < m initially (the "intended" case). -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = x, RCX = m -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = x, R9 = m -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr) - .text - -// We copy x into %r9 but it comes in in %rdx originally - -#define k %rdi -#define z %rsi -#define x %r9 -#define m %rcx - -// General temp, low part of product and mul input -#define a %rax -// General temp, High part of product -#define b %rdx -// Negated modular inverse -#define w %r8 -// Inner loop counter -#define j %rbx -// Home for i'th digit or Montgomery multiplier -#define d %rbp -#define h %r10 -#define e %r11 -#define n %r12 -#define i %r13 -#define c0 %r14 -#define c1 %r15 - -// A temp reg in the initial word-level negmodinv. - -#define t2 %rdx - -#define ashort %eax -#define jshort %ebx - - -S2N_BN_SYMBOL(bignum_montsqr): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Save registers - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// If k = 0 the whole operation is trivial - - testq k, k - jz Lbignum_montsqr_end - -// Move x input into its permanent home, since we need %rdx for multiplications - - movq %rdx, x - -// Compute word-level negated modular inverse w for m == m[0]. - - movq (m), a - - movq a, t2 - movq a, w - shlq $2, t2 - subq t2, w - xorq $2, w - - movq w, t2 - imulq a, t2 - movl $2, ashort - addq t2, a - addq $1, t2 - - imulq a, w - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, w - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, w - - imulq t2, t2 - movl $1, ashort - addq t2, a - imulq a, w - -// Initialize the output c0::z to zero so we can then consistently add rows. -// It would be a bit more efficient to special-case the zeroth row, but -// this keeps the code slightly simpler. - - xorq i, i // Also initializes i for main loop - xorq j, j -Lbignum_montsqr_zoop: - movq i, (z,j,8) - incq j - cmpq k, j - jc Lbignum_montsqr_zoop - - xorq c0, c0 - -// Outer loop pulling down digits d=x[i], multiplying by x and reducing - -Lbignum_montsqr_outerloop: - -// Multiply-add loop where we always have CF + previous high part h to add in. -// Note that in general we do need yet one more carry in this phase and hence -// initialize c1 with the top carry. - - movq (x,i,8), d - xorq j, j - xorq h, h - xorq c1, c1 - movq k, n - -Lbignum_montsqr_maddloop: - adcq (z,j,8), h - sbbq e, e - movq (x,j,8), a - mulq d - subq e, %rdx - addq h, a - movq a, (z,j,8) - movq %rdx, h - incq j - decq n - jnz Lbignum_montsqr_maddloop - adcq h, c0 - adcq c1, c1 - -// Montgomery reduction loop, similar but offsetting writebacks - - movq (z), e - movq w, d - imulq e, d - movq (m), a - mulq d - addq e, a // Will be zero but want the carry - movq %rdx, h - movl $1, jshort - movq k, n - decq n - jz Lbignum_montsqr_montend - -Lbignum_montsqr_montloop: - adcq (z,j,8), h - sbbq e, e - movq (m,j,8), a - mulq d - subq e, %rdx - addq h, a - movq a, -8(z,j,8) - movq %rdx, h - incq j - decq n - jnz Lbignum_montsqr_montloop - -Lbignum_montsqr_montend: - adcq c0, h - adcq $0, c1 - movq c1, c0 - movq h, -8(z,j,8) - -// End of outer loop. - - incq i - cmpq k, i - jc Lbignum_montsqr_outerloop - -// Now do a comparison of (c0::z) with (0::m) to set a final correction mask -// indicating that (c0::z) >= m and so we need to subtract m. - - xorq j, j - movq k, n -Lbignum_montsqr_cmploop: - movq (z,j,8), a - sbbq (m,j,8), a - incq j - decq n - jnz Lbignum_montsqr_cmploop - - sbbq $0, c0 - sbbq d, d - notq d - -// Now do a masked subtraction of m for the final reduced result. - - xorq e, e - xorq j, j -Lbignum_montsqr_corrloop: - movq (m,j,8), a - andq d, a - negq e - sbbq a, (z,j,8) - sbbq e, e - incq j - cmpq k, j - jc Lbignum_montsqr_corrloop - -Lbignum_montsqr_end: - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_mul.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_mul.S deleted file mode 100644 index 260777db7e5..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_mul.S +++ /dev/null @@ -1,159 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply z := x * y -// Inputs x[m], y[n]; output z[k] -// -// extern void bignum_mul(uint64_t k, uint64_t *z, uint64_t m, const uint64_t *x, -// uint64_t n, const uint64_t *y); -// -// Does the "z := x * y" operation where x is m digits, y is n, result z is k. -// Truncates the result in general unless k >= m + n -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = m, RCX = x, R8 = n, R9 = y -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = m, R9 = x, [RSP+40] = n, [RSP+48] = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul) - .text - -// These are actually right - -#define p %rdi -#define z %rsi -#define n %r8 - -// These are not - -#define c %r15 -#define h %r14 -#define l %r13 -#define x %r12 -#define y %r11 -#define i %rbx -#define k %r10 -#define m %rbp - -// These are always local scratch since multiplier result is in these - -#define a %rax -#define d %rdx - - - -S2N_BN_SYMBOL(bignum_mul): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 - movq 64(%rsp), %r9 -#endif - -// We use too many registers, and also we need %rax:%rdx for multiplications - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - movq %rdx, m - -// If the result size is zero, do nothing -// Note that even if either or both inputs has size zero, we can't -// just give up because we at least need to zero the output array -// If we did a multiply-add variant, however, then we could - - testq p, p - jz Lbignum_mul_end - -// Set initial 2-part sum to zero (we zero c inside the body) - - xorq h, h - xorq l, l - -// Otherwise do outer loop k = 0 ... k = p - 1 - - xorq k, k - -Lbignum_mul_outerloop: - -// Zero our carry term first; we eventually want it and a zero is useful now -// Set a = max 0 (k + 1 - n), i = min (k + 1) m -// This defines the range a <= j < i for the inner summation -// Note that since k < p < 2^64 we can assume k + 1 doesn't overflow -// And since we want to increment it anyway, we might as well do it now - - xorq c, c // c = 0 - incq k // k = k + 1 - - movq k, a // a = k + 1 - subq n, a // a = k + 1 - n - cmovcq c, a // a = max 0 (k + 1 - n) - - movq m, i // i = m - cmpq m, k // CF <=> k + 1 < m - cmovcq k, i // i = min (k + 1) m - -// Turn i into a loop count, and skip things if it's <= 0 -// Otherwise set up initial pointers x -> x0[a] and y -> y0[k - a] -// and then launch into the main inner loop, postdecrementing i - - movq k, d - subq i, d - subq a, i - jbe Lbignum_mul_innerend - leaq (%rcx,a,8), x - leaq -8(%r9,d,8), y - -Lbignum_mul_innerloop: - movq (y,i,8), %rax - mulq (x) - addq $8, x - addq %rax, l - adcq %rdx, h - adcq $0, c - decq i - jnz Lbignum_mul_innerloop - -Lbignum_mul_innerend: - - movq l, (z) - movq h, l - movq c, h - addq $8, z - - cmpq p, k - jc Lbignum_mul_outerloop - -Lbignum_mul_end: - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_muladd10.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_muladd10.S deleted file mode 100644 index 9d6e06141b8..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_muladd10.S +++ /dev/null @@ -1,83 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply bignum by 10 and add word: z := 10 * z + d -// Inputs z[k], d; outputs function return (carry) and z[k] -// -// extern uint64_t bignum_muladd10(uint64_t k, uint64_t *z, uint64_t d); -// -// Although typically the input d < 10, this is not actually required. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = d, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = d, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_muladd10) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_muladd10) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_muladd10) - .text - -#define k %rdi -#define z %rsi -#define d %rcx - -#define a %rax -#define l %rax - -#define h %rdx -#define i %r8 -#define ten %r9 -#define tenshort %r9d - -S2N_BN_SYMBOL(bignum_muladd10): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Move carry input to permanent home, and if k = 0 skip the main loop - - movq %rdx, d - testq k, k - jz Lbignum_muladd10_end - -// Simple loop - - xorq i, i - movl $10, tenshort -Lbignum_muladd10_loop: - movq (z,i,8), a - mulq ten - addq d, l - movq l, (z,i,8) - adcq $0, h - movq h, d - incq i - cmpq k, i - jc Lbignum_muladd10_loop - -// Return the final carry - -Lbignum_muladd10_end: - movq d, %rax -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_muladd10) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_mux.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_mux.S deleted file mode 100644 index 27d8daba894..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_mux.S +++ /dev/null @@ -1,72 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiplex/select z := x (if p nonzero) or z := y (if p zero) -// Inputs p, x[k], y[k]; output z[k] -// -// extern void bignum_mux(uint64_t p, uint64_t k, uint64_t *z, const uint64_t *x, -// const uint64_t *y); -// -// It is assumed that all numbers x, y and z have the same size k digits. -// -// Standard x86-64 ABI: RDI = p, RSI = k, RDX = z, RCX = x, R8 = y -// Microsoft x64 ABI: RCX = p, RDX = k, R8 = z, R9 = x, [RSP+40] = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mux) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mux) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mux) - .text - -#define b %rdi -#define k %rsi -#define z %rdx -#define x %rcx -#define y %r8 -#define i %r9 -#define a %rax - - - -S2N_BN_SYMBOL(bignum_mux): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - testq k, k - jz Lbignum_mux_end // If length = 0 do nothing - - xorq i, i - negq b // CF <=> (b != 0) -Lbignum_mux_loop: - movq (x,i,8), a - movq (y,i,8), b - cmovncq b, a // CF ? a : b - movq a, (z,i,8) - incq i - decq k - jnz Lbignum_mux_loop -Lbignum_mux_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mux) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_mux16.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_mux16.S deleted file mode 100644 index 905ceb3b178..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_mux16.S +++ /dev/null @@ -1,97 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Select element from 16-element table, z := xs[k*i] -// Inputs xs[16*k], i; output z[k] -// -// extern void bignum_mux16(uint64_t k, uint64_t *z, const uint64_t *xs, -// uint64_t i); -// -// It is assumed that all numbers xs[16] and the target z have the same size k -// The pointer xs is to a contiguous array of size 16, elements size-k bignums -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = xs, RCX = i -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = xs, R9 = i -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mux16) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mux16) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mux16) - .text - -#define k %rdi -#define z %rsi - -// These get moved from original registers - -#define x %rcx -#define i %rax - -// Other registers - -#define a %rdx -#define b %r8 -#define j %r9 -#define n %r10 - - - -S2N_BN_SYMBOL(bignum_mux16): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - - -// Copy size into decrementable counter, or skip everything if k = 0 - - testq k, k - jz Lbignum_mux16_end // If length = 0 do nothing - movq k, n - -// Multiply i by k so we can compare pointer offsets directly with it - - movq %rcx, %rax - movq %rdx, %rcx - mulq k - -// Main loop - -Lbignum_mux16_loop: - movq (x), a - movq k, j -.rep 15 - movq (x,j,8), b - cmpq i, j - cmoveq b, a - addq k, j -.endr - movq a, (z) - addq $8, z - addq $8, x - decq n - jnz Lbignum_mux16_loop - -Lbignum_mux16_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mux16) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_negmodinv.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_negmodinv.S deleted file mode 100644 index 7eb5bc17e58..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_negmodinv.S +++ /dev/null @@ -1,189 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Negated modular inverse, z := (-1/x) mod 2^{64k} -// Input x[k]; output z[k] -// -// extern void bignum_negmodinv(uint64_t k, uint64_t *z, const uint64_t *x); -// -// Assuming x is odd (otherwise nothing makes sense) the result satisfies -// -// x * z + 1 == 0 (mod 2^{64 * k}) -// -// but is not necessarily reduced mod x. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = x -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_negmodinv) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_negmodinv) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_negmodinv) - .text - -#define k %rdi -#define z %rsi -// Moved from initial location to free %rdx -#define x %rcx - -#define a %rax -#define d %rdx -#define i %r8 -#define m %r9 -#define h %r10 -#define w %r11 -#define t %r12 -#define e %rbx - -#define ashort %eax -#define ishort %r8d - -S2N_BN_SYMBOL(bignum_negmodinv): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - -// If k = 0 do nothing (actually we could have avoiding the pushes and pops) - - testq k, k - jz Lbignum_negmodinv_end - -// Move the x pointer into its permanent home (%rdx is needed for muls) - - movq %rdx, x - -// Compute word-level negated modular inverse w for x[0]. - - movq (x), a - - movq a, d - movq a, w - shlq $2, d - subq d, w - xorq $2, w - - movq w, d - imulq a, d - movl $2, ashort - addq d, a - addq $1, d - - imulq a, w - - imulq d, d - movl $1, ashort - addq d, a - imulq a, w - - imulq d, d - movl $1, ashort - addq d, a - imulq a, w - - imulq d, d - movl $1, ashort - addq d, a - imulq a, w - -// Write that as lowest word of the output, then if k = 1 we're finished - - movq w, (z) - cmpq $1, k - jz Lbignum_negmodinv_end - -// Otherwise compute and write the other digits (1..k-1) of w * x + 1 - - movq (x), a - xorq h, h - mulq w - addq $1, a - adcq d, h - movl $1, ishort -Lbignum_negmodinv_initloop: - movq (x,i,8), a - mulq w - addq h, a - adcq $0, d - movq a, (z,i,8) - movq d, h - incq i - cmpq k, i - jc Lbignum_negmodinv_initloop - -// For simpler indexing, z := z + 8 and k := k - 1 per outer iteration -// Then we can use the same index for x and for z and effective size k. -// -// But we also offset k by 1 so the "real" size is k + 1; after doing -// the special zeroth bit we count with t through k more digits, so -// getting k + 1 total as required. -// -// This lets us avoid some special cases inside the loop at the cost -// of needing the additional "finale" tail for the final iteration -// since we do one outer loop iteration too few. - - subq $2, k - jz Lbignum_negmodinv_finale - -Lbignum_negmodinv_outerloop: - addq $8, z - - movq (z), h - movq w, m - imulq h, m - movq m, (z) - movq (x), a - mulq m - addq h, a - adcq $0, d - movq d, h - movl $1, ishort - movq k, t -Lbignum_negmodinv_innerloop: - adcq (z,i,8), h - sbbq e, e - movq (x,i,8), a - mulq m - subq e, d - addq h, a - movq a, (z,i,8) - movq d, h - incq i - decq t - jnz Lbignum_negmodinv_innerloop - - decq k - jnz Lbignum_negmodinv_outerloop - -Lbignum_negmodinv_finale: - movq 8(z), a - imulq w, a - movq a, 8(z) - -Lbignum_negmodinv_end: - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_negmodinv) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_nonzero.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_nonzero.S deleted file mode 100644 index f6b0d77c858..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_nonzero.S +++ /dev/null @@ -1,62 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Test bignum for nonzero-ness x =/= 0 -// Input x[k]; output function return -// -// extern uint64_t bignum_nonzero(uint64_t k, const uint64_t *x); -// -// Standard x86-64 ABI: RDI = k, RSI = x, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_nonzero) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_nonzero) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_nonzero) - .text - -#define a %rax -#define k %rdi -#define x %rsi - -S2N_BN_SYMBOL(bignum_nonzero): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - xorq a, a - testq k, k - jz Lbignum_nonzero_end - -Lbignum_nonzero_loop: - orq -8(x,k,8), a - decq k - jnz Lbignum_nonzero_loop - -// Set a standard C condition based on whether a is nonzero - - negq a - sbbq a, a - negq a - -Lbignum_nonzero_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_nonzero) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_normalize.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_normalize.S deleted file mode 100644 index 0076b5e9e62..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_normalize.S +++ /dev/null @@ -1,128 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Normalize bignum in-place by shifting left till top bit is 1 -// Input z[k]; outputs function return (bits shifted left) and z[k] -// -// extern uint64_t bignum_normalize(uint64_t k, uint64_t *z); -// -// Given a k-digit bignum z, this function shifts it left by its number of -// leading zero bits, to give result with top bit 1, unless the input number -// was 0. The return is the same as the output of bignum_clz, i.e. the number -// of bits shifted (nominally 64 * k in the case of zero input). -// -// Standard x86-64 ABI: RDI = k, RSI = z, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_normalize) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_normalize) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_normalize) - .text - -#define k %rdi -#define z %rsi - -// Return value, which we put in %rax to save a move or two - -#define r %rax - -// Other variables -// Matters that c is RCX as CL=lo(c) is assumed in shifts - -#define b %r9 -#define c %rcx -#define d %rdx -#define i %r8 -#define j %r10 - -#define dshort %edx - - -S2N_BN_SYMBOL(bignum_normalize): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Initialize shift count r = 0 and i = k - 1 but return immediately if k = 0. -// Otherwise load top digit c, but then if k = 1 skip the digitwise part - - xorq r, r - movq k, i - subq $1, i - jc Lbignum_normalize_end - movq (z,i,8), c - jz Lbignum_normalize_bitpart - -// Do d rather stupid but constant-time digit normalization, conditionally -// shifting left (k-1) times based on whether the top word is zero. -// With careful binary striding this could be O(k*log(k)) instead of O(k^2) -// while still retaining the constant-time style. - -Lbignum_normalize_normloop: - xorq j, j - movq k, b - movq r, d - incq r - negq c - cmovneq d, r - movl $0, dshort -Lbignum_normalize_shufloop: - movq d, c - movq (z,j,8), d - cmovcq d, c - movq c, (z,j,8) - incq j - decq b - jnz Lbignum_normalize_shufloop - decq i - jnz Lbignum_normalize_normloop - -// We now have the top digit nonzero, assuming the input was nonzero, -// and as per the invariant of the loop above, c holds that digit. So -// now just count c's leading zeros and shift z bitwise that many bits. -// We need to patch the bsr result for the undefined case of zero input - -Lbignum_normalize_bitpart: - movl $127, dshort - bsrq c, c - cmovzq d, c - xorq $63, c - - shlq $6, r - addq c, r - - xorq b, b - xorq i, i -Lbignum_normalize_bitloop: - movq (z,i,8), d - movq d, j - shldq %cl, b, d - movq d, (z,i,8) - movq j, b - incq i - cmpq k, i - jc Lbignum_normalize_bitloop - -Lbignum_normalize_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_normalize) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_odd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_odd.S deleted file mode 100644 index da47ab88756..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_odd.S +++ /dev/null @@ -1,56 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Test bignum for odd-ness -// Input x[k]; output function return -// -// extern uint64_t bignum_odd(uint64_t k, const uint64_t *x); -// -// Standard x86-64 ABI: RDI = k, RSI = x, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = x, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_odd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_odd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_odd) - .text - -S2N_BN_SYMBOL(bignum_odd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Set default return value of 0 and finish if k = 0 (trivially not odd) - - xorl %eax, %eax - testq %rdi, %rdi - jz Lbignum_odd_end - -// Otherwise return lowest bit of the input - - movl $1, %eax - andq (%rsi), %rax - -Lbignum_odd_end: - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_odd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_of_word.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_of_word.S deleted file mode 100644 index ff378b284cc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_of_word.S +++ /dev/null @@ -1,73 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert single digit to bignum, z := n -// Input n; output z[k] -// -// extern void bignum_of_word(uint64_t k, uint64_t *z, uint64_t n); -// -// Create a k-digit (digit=64 bits) bignum at z with value n (mod 2^k) -// where n is a word. The "mod 2^k" only matters in the degenerate k = 0 case. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = n -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = n -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_of_word) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_of_word) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_of_word) - .text - -S2N_BN_SYMBOL(bignum_of_word): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// If k = 0 do nothing - - testq %rdi, %rdi - jz Lbignum_of_word_end - -Lbignum_of_word_nontrivial: - -// Write lowest word and jump to end if k = 1 - - movq %rdx, (%rsi) - decq %rdi - jz Lbignum_of_word_end - -// Zero %rdx and write it to all z[i] for i = k-1 down to 1 -// It's a bit more compact to iterate "high to low" like this. -// But at the cost of bumping up %rsi by lea %rsi, [%rsi+8] -// each time round the loop (which also modifies one more reg) -// we could go "low to high" if it helps with prefetch etc. - - xorq %rdx, %rdx -Lbignum_of_word_loop: - movq %rdx, (%rsi,%rdi,8) - decq %rdi - jnz Lbignum_of_word_loop - -Lbignum_of_word_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_of_word) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optadd.S deleted file mode 100644 index dd2960e5c0e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optadd.S +++ /dev/null @@ -1,96 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally add, z := x + y (if p nonzero) or z := x (if p zero) -// Inputs x[k], p, y[k]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_optadd(uint64_t k, uint64_t *z, const uint64_t *x, -// uint64_t p, const uint64_t *y); -// -// It is assumed that all numbers x, y and z have the same size k digits. -// Returns carry-out as per usual addition, always 0 if p was zero. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = x, RCX = p, R8 = y, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = x, R9 = p, [RSP+40] = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optadd) - .text - -#define k %rdi -#define z %rsi -#define x %rdx -#define p %rcx -#define y %r8 - -#define c %rax -#define i %r9 -#define b %r10 -#define a %r11 - - -S2N_BN_SYMBOL(bignum_optadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// Initialize top carry to zero in all cases (also return value) - - xorq c, c - -// If k = 0 do nothing - - testq k, k - jz Lbignum_optadd_end - -// Convert the nonzero/zero status of p into an all-1s or all-0s mask - - negq p - sbbq p, p - -// Now go round the loop for i=0...k-1, saving the carry in c each iteration - - xorq i, i -Lbignum_optadd_loop: - movq (x,i,8), a - movq (y,i,8), b - andq p, b - negq c - adcq b, a - sbbq c, c - movq a, (z,i,8) - incq i - cmpq k, i - jc Lbignum_optadd_loop - -// Return top carry - - negq %rax - -Lbignum_optadd_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optneg.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optneg.S deleted file mode 100644 index f5640144bfd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optneg.S +++ /dev/null @@ -1,93 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate, z := -x (if p nonzero) or z := x (if p zero) -// Inputs p, x[k]; outputs function return (nonzero input) and z[k] -// -// extern uint64_t bignum_optneg(uint64_t k, uint64_t *z, uint64_t p, -// const uint64_t *x); -// -// It is assumed that both numbers x and z have the same size k digits. -// Returns a carry, which is equivalent to "x is nonzero". -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = p, RCX = x, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = p, R9 = x, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg) - .text - -#define k %rdi -#define z %rsi -#define p %rdx -#define x %rcx - -#define c %rax -#define a %r8 -#define i %r9 - -#define cshort %eax - -S2N_BN_SYMBOL(bignum_optneg): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// If k = 0 do nothing, but need to set zero return for the carry (c = %rax) - - xorq c, c - testq k, k - jz Lbignum_optneg_end - -// Convert p into a strict bitmask and set initial carry-in in c - - negq p - sbbq p, p - subq p, c - -// Main loop - - xorq i, i -Lbignum_optneg_loop: - - movq (x,i,8), a - xorq p, a - addq c, a - movl $0, cshort - movq a, (z,i,8) - adcq $0, c - incq i - cmpq k, i - jc Lbignum_optneg_loop - -// Return carry flag, fixing up inversion for negative case - - xorq p, %rax - andq $1, %rax - -Lbignum_optneg_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optsub.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optsub.S deleted file mode 100644 index f0ccafa562e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optsub.S +++ /dev/null @@ -1,96 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally subtract, z := x - y (if p nonzero) or z := x (if p zero) -// Inputs x[k], p, y[k]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_optsub(uint64_t k, uint64_t *z, const uint64_t *x, -// uint64_t p, const uint64_t *y); -// -// It is assumed that all numbers x, y and z have the same size k digits. -// Returns carry-out as per usual subtraction, always 0 if p was zero. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = x, RCX = p, R8 = y, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = x, R9 = p, [RSP+40] = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optsub) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optsub) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optsub) - .text - -#define k %rdi -#define z %rsi -#define x %rdx -#define p %rcx -#define y %r8 - -#define i %r9 -#define b %r10 -#define c %rax -#define a %r11 - - -S2N_BN_SYMBOL(bignum_optsub): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// Initialize top carry to zero in all cases (also return value) - - xorq c, c - -// If k = 0 do nothing - - testq k, k - jz Lbignum_optsub_end - -// Convert the nonzero/zero status of p into an all-1s or all-0s mask - - negq p - sbbq p, p - -// Now go round the loop for i=0...k-1, saving the carry in c each iteration - - xorq i, i -Lbignum_optsub_loop: - movq (x,i,8), a - movq (y,i,8), b - andq p, b - negq c - sbbq b, a - sbbq c, c - movq a, (z,i,8) - incq i - cmpq k, i - jc Lbignum_optsub_loop - -// Return top carry - - negq %rax - -Lbignum_optsub_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optsub) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optsubadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optsubadd.S deleted file mode 100644 index 37b0f4aeccd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_optsubadd.S +++ /dev/null @@ -1,113 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally subtract or add, z := x + sgn(p) * y interpreting p as signed -// Inputs x[k], p, y[k]; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_optsubadd(uint64_t k, uint64_t *z, const uint64_t *x, -// uint64_t p, const uint64_t *y); -// -// If p has top bit set (i.e. is negative as a signed int) return z := x - y -// Else if p is nonzero (i.e. is positive as a signed int) return z := x + y -// Otherwise (i.e. p is zero) return z := x -// -// Return in RDI = the top carry, which will be 0 or 1, and appropriate for -// addition or subtraction respectively (and always zero for p = 0) -// -// 2^{64*k} * -carryout + z = x - y [for subtraction] -// 2^{64*k} * carryout + z = x + y [for addition] -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = x, RCX = p, R8 = y, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = x, R9 = p, [RSP+40] = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optsubadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optsubadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optsubadd) - .text - -#define k %rdi -#define z %rsi -#define x %rdx -#define p %rcx -#define y %r8 - -#define c %rax -#define i %r9 -#define m %rcx -#define q %r10 -#define a %r11 - - -S2N_BN_SYMBOL(bignum_optsubadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// Initialize top carry to zero in all cases (also return value) - - xorq c, c - -// If k = 0 do nothing - - testq k, k - jz Lbignum_optsubadd_end - -// Turn the input p into two bitmasks, m indicating to use the y input at -// all (same register as p) and q indicating a sign-flip - - movq p, q - sarq $63, q - negq p - sbbq m, m - -// Generate an initial carry-in for the negating case only to add 1; this -// is because we are actually going to do complements of the words of y - - movq q, c - -// Now go round the loop for i=0...k-1, saving the carry in c each iteration - - xorq i, i -Lbignum_optsubadd_loop: - movq (y,i,8), a - xorq q, a - andq m, a - negq c - adcq (x,i,8), a - sbbq c, c - movq a, (z,i,8) - incq i - cmpq k, i - jc Lbignum_optsubadd_loop - -// Return carry flag, fixing up inversion for negative case - - xorq q, %rax - negq %rax - -Lbignum_optsubadd_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optsubadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_pow2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_pow2.S deleted file mode 100644 index 5548eddf320..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_pow2.S +++ /dev/null @@ -1,85 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Return bignum of power of 2, z := 2^n -// Input n; output z[k] -// -// extern void bignum_pow2(uint64_t k, uint64_t *z, uint64_t n); -// -// The result is as usual mod 2^{64*k}, so will be zero if n >= 64*k. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = n -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = n -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_pow2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_pow2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_pow2) - .text - -#define k %rdi -#define z %rsi -#define n %rdx - -#define i %rcx -#define w %rax -#define a %r8 - -#define wshort %eax - - - -S2N_BN_SYMBOL(bignum_pow2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// If k = 0 do nothing - - testq k, k - jz Lbignum_pow2_end - -// Create the index n at which to write the nonzero word and the word w itself -// Note that the x86 manual explicitly says that shift counts are taken modulo -// the datasize, so we don't need to mask the lower 6 bits of n ourselves. - - movl $1, wshort - movq n, %rcx - shlq %cl, w - shrq $6, n - -// Now in a constant-time fashion set the n'th word to w and others to zero - - xorq i, i -Lbignum_pow2_loop: - xorq a, a - cmpq n, i - cmovzq w, a - movq a, (z,i,8) - incq i - cmpq k, i - jc Lbignum_pow2_loop - -Lbignum_pow2_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_pow2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_shl_small.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_shl_small.S deleted file mode 100644 index aeb4b491e5b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_shl_small.S +++ /dev/null @@ -1,128 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Shift bignum left by c < 64 bits z := x * 2^c -// Inputs x[n], c; outputs function return (carry-out) and z[k] -// -// extern uint64_t bignum_shl_small(uint64_t k, uint64_t *z, uint64_t n, -// const uint64_t *x, uint64_t c); -// -// Does the "z := x << c" operation where x is n digits, result z is p. -// The shift count c is masked to 6 bits so it actually uses c' = c mod 64. -// The return value is the "next word" of a p+1 bit result, if n <= p. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = n, RCX = x, R8 = c, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = n, R9 = x, [RSP+40] = c, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_shl_small) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_shl_small) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_shl_small) - .text - -#define p %rdi -#define z %rsi -#define n %rdx - -// These get moved from their initial positions - -#define c %rcx -#define x %r9 - -// Other variables - -#define b %rax -#define t %r8 -#define a %r10 -#define i %r11 - - - -S2N_BN_SYMBOL(bignum_shl_small): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// First clamp the input size n := min(p,n) since we can never need to read -// past the p'th term of the input to generate p-digit output. - - cmpq n, p - cmovcq p, n - -// Initialize "previous word" carry b to zero and main index i also to zero. -// Then just skip the main loop if n = 0 - - xorq b, b - xorq i, i - - testq n, n - jz Lbignum_shl_small_tail - -// Reshuffle registers to put the shift count into CL - - movq %rcx, x - movq %r8, c - -// Now the main loop - -Lbignum_shl_small_loop: - movq (x,i,8), a - movq a, t - shldq %cl, b, a - movq a, (z,i,8) - movq t, b - incq i - cmpq n, i - jc Lbignum_shl_small_loop - -// Shift the top word correspondingly. Using shld one more time is easier -// than carefully producing a complementary shift with care over the zero case - - xorq a, a - shldq %cl, b, a - movq a, b - -// If we are at the end, finish, otherwise write carry word then zeros - -Lbignum_shl_small_tail: - cmpq p, i - jnc Lbignum_shl_small_end - movq b, (z,i,8) - xorq b, b - incq i - cmpq p, i - jnc Lbignum_shl_small_end - -Lbignum_shl_small_tloop: - movq b, (z,i,8) - incq i - cmpq p, i - jc Lbignum_shl_small_tloop - -// Return, with RAX = b as the top word - -Lbignum_shl_small_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_shl_small) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_shr_small.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_shr_small.S deleted file mode 100644 index 6fa8028d11a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_shr_small.S +++ /dev/null @@ -1,118 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Shift bignum right by c < 64 bits z := floor(x / 2^c) -// Inputs x[n], c; outputs function return (bits shifted out) and z[k] -// -// extern uint64_t bignum_shr_small(uint64_t k, uint64_t *z, uint64_t n, -// const uint64_t *x, uint64_t c); -// -// Does the "z := x >> c" operation where x is n digits, result z is p. -// The shift count c is masked to 6 bits so it actually uses c' = c mod 64. -// The return value is the inout mod 2^c'. -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = n, RCX = x, R8 = c, returns RAX -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = n, R9 = x, [RSP+40] = c, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_shr_small) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_shr_small) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_shr_small) - .text - -#define p %rdi -#define z %rsi -#define n %rdx - -// These get moved from their initial positions - -#define c %rcx -#define x %r9 - -// Other variables - -#define b %rax -#define t %r8 -#define a %r10 - -#define ashort %r10d - - - -S2N_BN_SYMBOL(bignum_shr_small): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 -#endif - -// Reshuffle registers to put the shift count into CL - - movq %rcx, x - movq %r8, c - -// Set default carry-in word to 0, useful for other things too - - xorq b, b - -// First, if p > n then pad output on the left with p-n zeros - - cmpq p, n - jnc Lbignum_shr_small_nopad -Lbignum_shr_small_padloop: - decq p - movq b, (z,p,8) - cmpq p, n - jc Lbignum_shr_small_padloop -Lbignum_shr_small_nopad: - -// We now know that p <= n. If in fact p < n let carry word = x[p] instead of 0 - - jz Lbignum_shr_small_shiftstart - movq (x,p,8), b -Lbignum_shr_small_shiftstart: - testq p, p - jz Lbignum_shr_small_trivial - -// Now the main loop - -Lbignum_shr_small_loop: - movq -8(x,p,8), a - movq a, t - shrdq %cl, b, a - movq a, -8(z,p,8) - movq t, b - decq p - jnz Lbignum_shr_small_loop - -// Mask the carry word and return with that as RAX = b - -Lbignum_shr_small_trivial: - movl $1, ashort - shlq %cl, a - decq a - andq a, b - -Lbignum_shr_small_end: -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_shr_small) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_sqr.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_sqr.S deleted file mode 100644 index b8e92f72907..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_sqr.S +++ /dev/null @@ -1,189 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square z := x^2 -// Input x[n]; output z[k] -// -// extern void bignum_sqr(uint64_t k, uint64_t *z, uint64_t n, const uint64_t *x); -// -// Does the "z := x^2" operation where x is n digits and result z is k. -// Truncates the result in general unless k >= 2 * n -// -// Standard x86-64 ABI: RDI = k, RSI = z, RDX = n, RCX = x -// Microsoft x64 ABI: RCX = k, RDX = z, R8 = n, R9 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr) - .text - -// First three are where arguments come in, but n is moved. - -#define p %rdi -#define z %rsi -#define x %rcx -#define n %r8 - -// These are always local scratch since multiplier result is in these - -#define a %rax -#define d %rdx - -// Other variables - -#define i %rbx -#define ll %rbp -#define hh %r9 -#define k %r10 -#define y %r11 -#define htop %r12 -#define l %r13 -#define h %r14 -#define c %r15 - -// Short versions - -#define llshort %ebp - -S2N_BN_SYMBOL(bignum_sqr): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// We use too many registers, and also we need %rax:%rdx for multiplications - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - movq %rdx, n - -// If p = 0 the result is trivial and nothing needs doing - - testq p, p - jz Lbignum_sqr_end - -// initialize (hh,ll) = 0 - - xorl llshort, llshort - xorq hh, hh - -// Iterate outer loop from k = 0 ... k = p - 1 producing result digits - - xorq k, k - -Lbignum_sqr_outerloop: - -// First let bot = MAX 0 (k + 1 - n) and top = MIN (k + 1) n -// We want to accumulate all x[i] * x[k - i] for bot <= i < top -// For the optimization of squaring we avoid duplication and do -// 2 * x[i] * x[k - i] for i < htop, where htop = MIN ((k+1)/2) n -// Initialize i = bot; in fact just compute bot as i directly. - - xorq c, c - leaq 1(k), i - movq i, htop - shrq $1, htop - subq n, i - cmovcq c, i - cmpq n, htop - cmovncq n, htop - -// Initialize the three-part local sum (c,h,l); c was already done above - - xorq l, l - xorq h, h - -// If htop <= bot then main doubled part of the sum is empty - - cmpq htop, i - jnc Lbignum_sqr_nosumming - -// Use a moving pointer for [y] = x[k-i] for the cofactor - - movq k, a - subq i, a - leaq (x,a,8), y - -// Do the main part of the sum x[i] * x[k - i] for 2 * i < k - -Lbignum_sqr_innerloop: - movq (x,i,8), a - mulq (y) - addq a, l - adcq d, h - adcq $0, c - subq $8, y - incq i - cmpq htop, i - jc Lbignum_sqr_innerloop - -// Now double it - - addq l, l - adcq h, h - adcq c, c - -// If k is even (which means 2 * i = k) and i < n add the extra x[i]^2 term - -Lbignum_sqr_nosumming: - testq $1, k - jnz Lbignum_sqr_innerend - cmpq n, i - jnc Lbignum_sqr_innerend - - movq (x,i,8), a - mulq a - addq a, l - adcq d, h - adcq $0, c - -// Now add the local sum into the global sum, store and shift - -Lbignum_sqr_innerend: - addq ll, l - movq l, (z,k,8) - adcq hh, h - movq h, ll - adcq $0, c - movq c, hh - - incq k - cmpq p, k - jc Lbignum_sqr_outerloop - -// Restore registers and return - -Lbignum_sqr_end: - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_sub.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_sub.S deleted file mode 100644 index 0d7c06c6ae0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/bignum_sub.S +++ /dev/null @@ -1,145 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Subtract, z := x - y -// Inputs x[m], y[n]; outputs function return (carry-out) and z[p] -// -// extern uint64_t bignum_sub(uint64_t p, uint64_t *z, uint64_t m, -// const uint64_t *x, uint64_t n, const uint64_t *y); -// -// Does the z := x - y operation, truncating modulo p words in general and -// returning a top borrow (0 or 1) in the p'th place, only subtracting input -// words below p (as well as m and n respectively) to get the diff and borrow. -// -// Standard x86-64 ABI: RDI = p, RSI = z, RDX = m, RCX = x, R8 = n, R9 = y, returns RAX -// Microsoft x64 ABI: RCX = p, RDX = z, R8 = m, R9 = x, [RSP+40] = n, [RSP+48] = y, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sub) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sub) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sub) - .text - -#define p %rdi -#define z %rsi -#define m %rdx -#define x %rcx -#define n %r8 -#define y %r9 -#define i %r10 -#define a %rax - -#define ashort %eax - - - -S2N_BN_SYMBOL(bignum_sub): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - movq 56(%rsp), %r8 - movq 64(%rsp), %r9 -#endif - -// Zero the main index counter for both branches - - xorq i, i - -// First clamp the two input sizes m := min(p,m) and n := min(p,n) since -// we'll never need words past the p'th. Can now assume m <= p and n <= p. -// Then compare the modified m and n and branch accordingly - - cmpq m, p - cmovcq p, m - cmpq n, p - cmovcq p, n - cmpq n, m - jc Lbignum_sub_ylonger - -// The case where x is longer or of the same size (p >= m >= n) - - subq m, p - subq n, m - incq m - testq n, n - jz Lbignum_sub_xtest -Lbignum_sub_xmainloop: - movq (x,i,8), a - sbbq (y,i,8), a - movq a, (z,i,8) - incq i - decq n - jnz Lbignum_sub_xmainloop - jmp Lbignum_sub_xtest -Lbignum_sub_xtoploop: - movq (x,i,8), a - sbbq $0, a - movq a, (z,i,8) - incq i -Lbignum_sub_xtest: - decq m - jnz Lbignum_sub_xtoploop - sbbq a, a - testq p, p - jz Lbignum_sub_tailskip -Lbignum_sub_tailloop: - movq a, (z,i,8) - incq i - decq p - jnz Lbignum_sub_tailloop -Lbignum_sub_tailskip: - negq a -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - ret - -// The case where y is longer (p >= n > m) - -Lbignum_sub_ylonger: - - subq n, p - subq m, n - testq m, m - jz Lbignum_sub_ytoploop -Lbignum_sub_ymainloop: - movq (x,i,8), a - sbbq (y,i,8), a - movq a, (z,i,8) - incq i - decq m - jnz Lbignum_sub_ymainloop -Lbignum_sub_ytoploop: - movl $0, ashort - sbbq (y,i,8), a - movq a, (z,i,8) - incq i - decq n - jnz Lbignum_sub_ytoploop - sbbq a, a - testq p, p - jnz Lbignum_sub_tailloop - negq a -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sub) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_bytereverse.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_bytereverse.S deleted file mode 100644 index 2965f840ac6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_bytereverse.S +++ /dev/null @@ -1,45 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reverse the order of bytes in a 64-bit word -// -// extern uint64_t word_bytereverse(uint64_t a); -// -// Standard x86-64 ABI: RDI = a, returns RAX -// Microsoft x64 ABI: RCX = a, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_bytereverse) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_bytereverse) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_bytereverse) - .text - -// Just uses the x86 BSWAP instruction, which does the job directly - -S2N_BN_SYMBOL(word_bytereverse): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi -#endif - - movq %rdi, %rax - bswapq %rax -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_bytereverse) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_clz.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_clz.S deleted file mode 100644 index 90a73011b62..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_clz.S +++ /dev/null @@ -1,53 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count leading zero bits in a single word -// Input a; output function return -// -// extern uint64_t word_clz(uint64_t a); -// -// Standard x86-64 ABI: RDI = a, returns RAX -// Microsoft x64 ABI: RCX = a, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_clz) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_clz) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_clz) - .text - -S2N_BN_SYMBOL(word_clz): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi -#endif - -// First do %rax = 63 - bsr(a), which is right except (maybe) for zero inputs - - bsrq %rdi, %rax - xorq $63, %rax - -// Force return of 64 in the zero-input case - - movl $64, %edx - testq %rdi, %rdi - cmoveq %rdx, %rax - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_clz) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_ctz.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_ctz.S deleted file mode 100644 index 4dc28288893..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_ctz.S +++ /dev/null @@ -1,52 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count trailing zero bits in a single word -// Input a; output function return -// -// extern uint64_t word_ctz(uint64_t a); -// -// Standard x86-64 ABI: RDI = a, returns RAX -// Microsoft x64 ABI: RCX = a, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_ctz) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_ctz) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_ctz) - .text - -S2N_BN_SYMBOL(word_ctz): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi -#endif - -// First just do %rax = bsf(a), which is right except (maybe) for zero inputs - - bsfq %rdi, %rax - -// Force return of 64 in the zero-input case - - movl $64, %edx - testq %rdi, %rdi - cmoveq %rdx, %rax - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_ctz) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_divstep59.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_divstep59.S deleted file mode 100644 index 81db80b92c5..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_divstep59.S +++ /dev/null @@ -1,406 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Perform 59 "divstep" iterations and return signed matrix of updates -// Inputs d, f, g; output m[2][2] and function return -// -// extern int64_t word_divstep59 -// (int64_t m[2][2],int64_t d,uint64_t f,uint64_t g); -// -// Standard x86-64 ABI: RDI = m, RSI = d, RDX = f, RCX = g, returns RAX -// Microsoft x64 ABI: RCX = m, RDX = d, R8 = f, R9 = g, returns RAX -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_divstep59) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_divstep59) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_divstep59) - .text - -#define mat %rdi - -#define d %rsi -#define fuv %rbx -#define grs %rcx - -#define f %r12 -#define g %r13 - -#define m %r8 -#define t %r9 - -#define zero %rbp -#define zeroe %ebp -#define minus2 %rax -#define minus2e %eax -#define plus2 %rdx -#define plus2e %edx - -#define m00 %r8 -#define m01 %r9 -#define m10 %r10 -#define m11 %r11 - -S2N_BN_SYMBOL(word_divstep59): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - -// Save extra registers - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - -// Pack f and g into single registers with (negated) update matrices, -// initially the identity matrix. The f_lo and g_lo are initially -// the 20 lowest bits of f and g. -// -// fuv = f_lo - 2^41 * 1 - 2^62 * 0 -// grs = g_lo - 2^41 * 0 - 2^62 * 1 - - movq %rdx, fuv - movq %rdx, f - andq $0xFFFFF, fuv - movq $0xFFFFFE0000000000, %rax - orq %rax, fuv - - movq %rcx, g - andq $0xFFFFF, grs - movq $0xc000000000000000, %rax - orq %rax, grs - -// Now do 20 divsteps on that packed format. -// -// At the i'th iteration (starting at i = 0, ending at i = 20) -// the intermediate packed values are of the form -// -// fuv = f_lo - 2^{41-i} * m00 - 2^{62-i} * m01 -// grs = g_lo - 2^{41-i} * m10 - 2^{62-i} * m11 -// -// where the following matrix indicates the updates to apply -// to the original (full-sized) f and g for those iterations. -// -// [m00 m01] * [f_0] = [f_i] -// [m10 m11] [g_0] [g_i] - - movq $-2, minus2 - xorl zeroe, zeroe - movl $2, plus2e - movq fuv, t - movq minus2, m - testq d, d - cmovs zero, m - testq $1, grs -.set i, 0 -.rep 20 - cmovzq zero, m - cmovzq zero, t -.if (i != 0) - sarq $1, grs -.endif - xorq m, t - xorq m, d - btq $63, m - cmovcq grs, fuv - movq minus2, m - addq plus2, d - leaq (grs,t), grs -.if (i != 19) - cmovs zero, m - movq fuv, t - testq plus2, grs -.endif -.set i, (i+1) -.endr - sarq $1, grs - -// Extract the matrix entries, but keep them in negated form. -// Store them in the output buffer temporarily. - - movl $1048576, %eax - leaq (fuv,%rax), m00 - leaq (grs,%rax), m10 - shlq $22, m00 - shlq $22, m10 - sarq $43, m00 - sarq $43, m10 - - movq $2199024304128, %rax - leaq (fuv,%rax), m01 - leaq (grs,%rax), m11 - sarq $42, m01 - sarq $42, m11 - - movq m00, (mat) - movq m01, 8(mat) - movq m10, 16(mat) - movq m11, 24(mat) - -// Compute updated f and g using the negated matrix entries; -// this flips the signs of f and g but it doesn't matter. -// -// f = (m00 * f + m01 * g) / 2^20 -// g = (m10 * f + m11 * g) / 2^20 -// -// Since we only need another 40 bits, we can do all of that -// computation naively using (implicitly signed) 64-bit words. - - imulq f, m10 - imulq m00, f - imulq g, m01 - imulq m11, g - addq m01, f - addq m10, g - sarq $20, f - sarq $20, g - -// Re-pack for 20 more rounds - - movq f, fuv - andq $0xFFFFF, fuv - movq $0xFFFFFE0000000000, %rax - orq %rax, fuv - - movq g, grs - andq $0xFFFFF, grs - movq $0xc000000000000000, %rax - orq %rax, grs - -// Second block of 20 divsteps in the same style - - movq $-2, minus2 - movl $2, plus2e - movq fuv, t - movq minus2, m - testq d, d - cmovs zero, m - testq $1, grs -.set i, 0 -.rep 20 - cmovzq zero, m - cmovzq zero, t -.if (i != 0) - sarq $1, grs -.endif - xorq m, t - xorq m, d - btq $63, m - cmovcq grs, fuv - movq minus2, m - addq plus2, d - leaq (grs,t), grs -.if (i != 19) - cmovs zero, m - movq fuv, t - testq plus2, grs -.endif -.set i, (i+1) -.endr - sarq $1, grs - -// Extract the next matrix entries, in negated form again - - movl $1048576, %eax - leaq (fuv,%rax), m00 - leaq (grs,%rax), m10 - shlq $22, m00 - shlq $22, m10 - sarq $43, m00 - sarq $43, m10 - - movq $2199024304128, %rax - leaq (fuv,%rax), m01 - leaq (grs,%rax), m11 - sarq $42, m01 - sarq $42, m11 - -// Compute updated f and g using the negated matrix entries, -// and so again flipping (thus actually restoring) the signs. -// -// f = (n00 * f + n01 * g) / 2^20 -// g = (n10 * f + n11 * g) / 2^20 - - movq g, fuv - movq f, grs - imulq m00, f - imulq m01, fuv - addq fuv, f - imulq m11, g - imulq m10, grs - addq grs, g - sarq $20, f - sarq $20, g - -// Re-pack for 20 more rounds - - movq f, fuv - andq $0xFFFFF, fuv - movq $0xFFFFFE0000000000, %rax - orq %rax, fuv - - movq g, grs - andq $0xFFFFF, grs - movq $0xc000000000000000, %rax - orq %rax, grs - -// Multiply the first two matrices, and re-store in the output buffer. -// -// [m00_new m01_new] = [m00 m01] * [m00_prev m01_prev] -// [m10_new m11_new] [m10 m11] [m10_prev m11_prev] -// -// The resulting matrix entries are: -// -// m00_new = m00 * m00_prev + m01 * m10_prev -// m01_new = m00 * m01_prev + m01 * m11_prev -// m10_new = m10 * m00_prev + m11 * m10_prev -// m11_new = m10 * m01_prev + m11 * m11_prev -// -// At this point the sign is right since both matrices were negated. - - movq (mat), %rax - imulq m00, %rax - movq 16(mat), %rdx - imulq m01, %rdx - imulq 8(mat), m00 - imulq 24(mat), m01 - addq m00, m01 - leaq (%rax,%rdx), m00 - - movq (mat), %rax - imulq m10, %rax - movq 16(mat), %rdx - imulq m11, %rdx - imulq 8(mat), m10 - imulq 24(mat), m11 - addq m10, m11 - leaq (%rax,%rdx), m10 - - movq m00, (mat) - movq m01, 8(mat) - movq m10, 16(mat) - movq m11, 24(mat) - -// Third block of divsteps, same style but a total of 19 not 20 - - movq $-2, minus2 - movl $2, plus2e - movq fuv, t - movq minus2, m - testq d, d - cmovs zero, m - testq $1, grs -.set i, 0 -.rep 19 - cmovzq zero, m - cmovzq zero, t -.if (i != 0) - sarq $1, grs -.endif - xorq m, t - xorq m, d - btq $63, m - cmovcq grs, fuv - movq minus2, m - addq plus2, d - leaq (grs,t), grs -.if (i != 18) - cmovs zero, m - movq fuv, t - testq plus2, grs -.endif -.set i, (i+1) -.endr - sarq $1, grs - -// Extract the matrix entries from the final 19 divsteps - - movl $1048576, %eax - leaq (fuv,%rax), m00 - leaq (grs,%rax), m10 - shlq $21, m00 - shlq $21, m10 - sarq $43, m00 - sarq $43, m10 - - movq $2199024304128, %rax - leaq (fuv,%rax), m01 - leaq (grs,%rax), m11 - sarq $43, m01 - sarq $43, m11 - -// Multiply by this new matrix -// -// [m00_new m01_new] = [m00 m01] * [m00_prev m01_prev] -// [m10_new m11_new] [m10 m11] [m10_prev m11_prev] -// -// The resulting matrix entries are: -// -// m00_new = m00 * m00_prev + m01 * m10_prev -// m01_new = m00 * m01_prev + m01 * m11_prev -// m10_new = m10 * m00_prev + m11 * m10_prev -// m11_new = m10 * m01_prev + m11 * m11_prev -// -// Since we didn't negate the n matrix, all products are negated -// and so we insert negations - - movq (mat), %rax - imulq m00, %rax - movq 16(mat), %rdx - imulq m01, %rdx - imulq 8(mat), m00 - imulq 24(mat), m01 - addq m00, m01 - leaq (%rax,%rdx), m00 - negq m01 - negq m00 - - movq (mat), %rax - imulq m10, %rax - movq 16(mat), %rdx - imulq m11, %rdx - imulq 8(mat), m10 - imulq 24(mat), m11 - addq m10, m11 - leaq (%rax,%rdx), m10 - negq m11 - negq m10 - -// Now write back the final matrix and d for the whole 59 steps - - movq m00, (mat) - movq m01, 8(mat) - movq m10, 16(mat) - movq m11, 24(mat) - movq d, %rax - -// Restore registers and return - - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_divstep59) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_max.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_max.S deleted file mode 100644 index e58103f6819..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_max.S +++ /dev/null @@ -1,49 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Return maximum of two unsigned 64-bit words -// Inputs a, b; output function return -// -// extern uint64_t word_max(uint64_t a, uint64_t b); -// -// Standard x86-64 ABI: RDI = a, RSI = b, returns RAX -// Microsoft x64 ABI: RCX = a, RDX = b, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_max) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_max) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_max) - .text - -#define a %rdi -#define b %rsi - -S2N_BN_SYMBOL(word_max): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - - movq a, %rax - cmpq b, a - cmovcq b, %rax -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_max) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_min.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_min.S deleted file mode 100644 index 0c5480e5b4a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_min.S +++ /dev/null @@ -1,49 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Return minimum of two unsigned 64-bit words -// Inputs a, b; output function return -// -// extern uint64_t word_min(uint64_t a, uint64_t b); -// -// Standard x86-64 ABI: RDI = a, RSI = b, returns RAX -// Microsoft x64 ABI: RCX = a, RDX = b, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_min) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_min) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_min) - .text - -#define a %rdi -#define b %rsi - -S2N_BN_SYMBOL(word_min): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - - movq a, %rax - cmpq b, a - cmovncq b, %rax -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_min) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_negmodinv.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_negmodinv.S deleted file mode 100644 index 940b0d10d3d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_negmodinv.S +++ /dev/null @@ -1,80 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Single-word negated modular inverse (-1/a) mod 2^64 -// Input a; output function return -// -// extern uint64_t word_negmodinv(uint64_t a); -// -// A 64-bit function that returns a negated multiplicative inverse mod 2^64 -// of its input, assuming that input is odd. Given odd input a, the result z -// will satisfy a * z + 1 == 0 (mod 2^64), i.e. a 64-bit word multiplication -// a * z will give -1. -// -// Standard x86-64 ABI: RDI = a, returns RAX -// Microsoft x64 ABI: RCX = a, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_negmodinv) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_negmodinv) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_negmodinv) - .text - -S2N_BN_SYMBOL(word_negmodinv): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi -#endif - -// Initial magical 5-bit approximation x = (a - a<<2) xor 2 - - movq %rdi, %rcx - movq %rdi, %rax - shlq $2, %rcx - subq %rcx, %rax - xorq $2, %rax - -// Now refine to 64-bit congruence - - movq %rax, %rcx // %rcx = x - imulq %rdi, %rcx // %rcx = a * x - movl $2, %edx - addq %rcx, %rdx // %rdx = 1 + e = 2 + a * x - addq $1, %rcx // %rcx = e = a * x + 1 - - imulq %rdx, %rax // %rax = x * (1 + e) - - imulq %rcx, %rcx // %rcx = e^2 - movl $1, %edx - addq %rcx, %rdx - imulq %rdx, %rax // %rax = x * (1 + e) * (1 + e^2) - - imulq %rcx, %rcx // %rcx = e^4 - movl $1, %edx - addq %rcx, %rdx - imulq %rdx, %rax // %rax = x * (1 + e) * (1 + e^2) * (1 + e^4) - - imulq %rcx, %rcx // %rcx = e^8 - movl $1, %edx - addq %rcx, %rdx - imulq %rdx, %rax // %rax = x * (1 + e) * ... * * (1 + e^8) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_negmodinv) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_popcount.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_popcount.S deleted file mode 100644 index ac360d887e0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_popcount.S +++ /dev/null @@ -1,74 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Count number of set bits in a single 64-bit word (population count) -// Input a; output function return -// -// extern uint64_t word_popcount(uint64_t a); -// -// Standard x86-64 ABI: RDI = a, returns RAX -// Microsoft x64 ABI: RCX = a, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_popcount) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_popcount) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_popcount) - .text - -S2N_BN_SYMBOL(word_popcount): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi -#endif - -// The code is generated by gcc -O3 (version 11.4.0) from -// -// uint64_t word_popcount(uint64_t x) -// { uint64_t x2 = x - ((x & UINT64_C(0xAAAAAAAAAAAAAAAA))>>1); -// uint64_t x4 = (x2 & UINT64_C(0x3333333333333333)) + -// ((x2 & UINT64_C(0xCCCCCCCCCCCCCCCC))>>2); -// uint64_t x8 = (x4 + (x4>>4)) & UINT64_C(0x0F0F0F0F0F0F0F0F); -// uint64_t x64 = x8 * UINT64_C(0x101010101010101); -// uint64_t y = x64>>56; -// return y; -// } - - movabsq $0x5555555555555555, %rdx - movq %rdi, %rax - shrq $1, %rax - andq %rdx, %rax - subq %rax, %rdi - movabsq $0x3333333333333333, %rax - movq %rdi, %rdx - andq %rax, %rdi - shrq $0x2, %rdx - andq %rax, %rdx - addq %rdi, %rdx - movq %rdx, %rax - shrq $0x4, %rax - addq %rdx, %rax - movabsq $0xf0f0f0f0f0f0f0f, %rdx - andq %rdx, %rax - movabsq $0x101010101010101, %rdx - imulq %rdx, %rax - shrq $0x38, %rax - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_popcount) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_recip.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_recip.S deleted file mode 100644 index 50ca069d012..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/generic/word_recip.S +++ /dev/null @@ -1,148 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Single-word reciprocal, underestimate of 2^128 / a with implicit 1 added -// Input a; output function return -// -// extern uint64_t word_recip(uint64_t a); -// -// Given an input word "a" with its top bit set (i.e. 2^63 <= a < 2^64), the -// result "x" is implicitly augmented with a leading 1 giving x' = 2^64 + x. -// The result is x' = ceil(2^128 / a) - 1, which except for the single -// special case a = 2^63 is the same thing as x' = floor(2^128 / a). -// -// Standard x86-64 ABI: RDI = a, returns RAX -// Microsoft x64 ABI: RCX = a, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(word_recip) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(word_recip) - S2N_BN_SYM_PRIVACY_DIRECTIVE(word_recip) - .text - -#define a %rdi -#define x %rcx -#define b %rsi - -# Some aliasing here - -#define t %rax -#define l %rax - -#define d %rdx -#define h %rdx - -S2N_BN_SYMBOL(word_recip): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi -#endif - -// Scale the input down: b overestimates a/2^16 with b <= 2^48 and -// x underestimates 2^64/b with b * x =~= 2^64, accurate to ~2 bits. - - movq a, b - movq $0x1FFFFFFFFFFFF, x - shrq $16, b - xorq b, x - incq b - shrq $32, x - -// Suppose x = 2^64/b * (1 - e). and get scaled error d = 2^64 * e - - movq b, d - imulq x, d - negq d - -// Rescale to give c = 2^15 * e (so c <= 2^13) and compute -// e + e^2 + e^3 + e^4 = (1 + e^2) (e + e^2) -// = (2^30 + c^2) * (2^15 * c + c^2) / 2^60 -// and then x * (1 + e + e^2 + e^3 + e^4) -// = (2^30 * x + x * (2^30 + c^2) * (2^30 * c + c^2) / 2^30) / 2^30 - - movq d, t - shrq $49, t - imulq t, t - shrq $34, d - addq t, d - orq $0x40000000, t - imulq d, t - shrq $30, t - imulq x, t - shlq $30, x - addq t, x - shrq $30, x - -// Now b * x =~= 2^64, accurate to ~10 bits. -// Do a 64-bit Newton step, scaling up x by 16 bits in the process. - - movq b, d - imulq x, d - negq d - shrq $24, d - imulq x, d - shlq $16, x - shrq $24, d - addq d, x - -// Now b * x =~= 2^80, accurate to ~20 bits. -// Do a 64-bit Newton step, scaling up x by 31 bits in the process - - movq b, d - imulq x, d - negq d - shrq $32, d - imulq x, d - shlq $31, x - shrq $17, d - addq d, x - -// Now a * x =~= 2^127, accurate to ~40 bits. Do a Newton step at full size. -// Instead of literally negating the product (h,l) we complement bits in -// the extracted bitfield, which is close enough and a bit faster. -// At the end we also shift x one more bit left, losing the known-1 top bit -// so that a * (2^64 + x) =~= 2^128. - - movq a, l - mulq x - shrdq $60, h, l - movq x, h - shrq $33, h - notq l - imulq h, l - shlq $1, x - shrq $33, l - addq l, x - -// Test if (x' + 1) * a < 2^128 where x' = 2^64 + x, catching the special -// case where x + 1 would wrap, corresponding to input a = 2^63. - - addq $1, x - movq a, l - sbbq $0, x - mulq x - movq x, %rax - addq a, h - -// Select either x or x + 1 accordingly as the final answer - - sbbq $0, %rax -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(word_recip) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_add_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_add_p256.S deleted file mode 100644 index 0531b809fff..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_add_p256.S +++ /dev/null @@ -1,104 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Add modulo p_256, z := (x + y) mod p_256, assuming x and y reduced -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_add_p256(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_add_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_add_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_add_p256) - .text - -#define z %rdi -#define x %rsi -#define y %rdx - -#define d0 %rax -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n1 %r10 -#define n3 %rdx -#define c %r11 - -#define n1short %r10d - - - -S2N_BN_SYMBOL(bignum_add_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Load and add the two inputs as 2^256 * c + [d3;d2;d1;d0] = x + y - - xorq c, c - movq (x), d0 - addq (y), d0 - movq 8(x), d1 - adcq 8(y), d1 - movq 16(x), d2 - adcq 16(y), d2 - movq 24(x), d3 - adcq 24(y), d3 - adcq c, c - -// Now subtract 2^256 * c + [d3;d3;d1;d1] = x + y - p_256 -// The constants n1 and n3 in [n3; 0; n1; -1] = p_256 are saved for later - - subq $-1, d0 - movl $0x00000000ffffffff, n1short - sbbq n1, d1 - sbbq $0, d2 - movq $0xffffffff00000001, n3 - sbbq n3, d3 - -// Since by hypothesis x < p_256 we know x + y - p_256 < 2^256, so the top -// carry c actually gives us a bitmask for x + y - p_256 < 0, which we -// now use to make a masked p_256' = [n3; 0; n1; c] - - sbbq $0, c - andq c, n1 - andq c, n3 - -// Do the corrective addition and copy to output - - addq c, d0 - movq d0, (z) - adcq n1, d1 - movq d1, 8(z) - adcq $0, d2 - movq d2, 16(z) - adcq n3, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_add_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_bigendian_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_bigendian_4.S deleted file mode 100644 index 8f210a40625..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_bigendian_4.S +++ /dev/null @@ -1,96 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert 4-digit (256-bit) bignum to/from big-endian form -// Input x[4]; output z[4] -// -// extern void bignum_bigendian_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// The same function is given two other prototypes whose names reflect the -// treatment of one or other argument as a byte array rather than word array: -// -// extern void bignum_frombebytes_4(uint64_t z[static 4], -// const uint8_t x[static 32]); -// -// extern void bignum_tobebytes_4(uint8_t z[static 32], -// const uint64_t x[static 4]); -// -// Since x86 is little-endian, and bignums are stored with little-endian -// word order, this is simply byte reversal and is implemented as such. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_bigendian_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_bigendian_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_bigendian_4) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_frombebytes_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_frombebytes_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_frombebytes_4) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tobebytes_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tobebytes_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tobebytes_4) - - .text - -#define z %rdi -#define x %rsi -#define a %rax -#define b %rdx - -// All loads and stores are word-sized, then we use BSWAP to -// reverse the byte order, as well as switching round the word order -// when writing back. The reads and writes are organized in mirror-image -// pairs (0-3 and 1-2) to allow x and z to point to the same buffer -// without using more intermediate registers. - -S2N_BN_SYMBOL(bignum_bigendian_4): -S2N_BN_SYMBOL(bignum_frombebytes_4): -S2N_BN_SYMBOL(bignum_tobebytes_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// 0 and 3 words - - movq (x), a - movq 24(x), b - bswapq a - bswapq b - movq a, 24(z) - movq b, (z) - -// 1 and 2 words - - movq 8(x), a - movq 16(x), b - bswapq a - bswapq b - movq a, 16(z) - movq b, 8(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_bigendian_4) -S2N_BN_SIZE_DIRECTIVE(bignum_frombebytes_4) -S2N_BN_SIZE_DIRECTIVE(bignum_tobebytes_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_cmul_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_cmul_p256.S deleted file mode 100644 index 4f14667368e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_cmul_p256.S +++ /dev/null @@ -1,133 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_256, z := (c * x) mod p_256, assuming -// x reduced -// Inputs c, x[4]; output z[4] -// -// extern void bignum_cmul_p256(uint64_t z[static 4], uint64_t c, -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = c, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = c, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p256) - .text - -#define z %rdi - -// Temporarily moved here for initial multiply -#define x %rcx -// Likewise this is thrown away after initial multiply -#define m %rdx - -#define a %rax -#define c %rcx - -#define d0 %rsi -#define d1 %r8 -#define d2 %r9 -#define d3 %r10 -#define h %r11 - -#define ashort %eax - -// Multiplier again for second stage -#define q %rdx - - -S2N_BN_SYMBOL(bignum_cmul_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Shuffle inputs (since we want multiplier in %rdx) - - movq %rdx, x - movq %rsi, m - -// Multiply, accumulating the result as 2^256 * h + [d3;d2;d1;d0] - - mulxq (x), d0, d1 - mulxq 8(x), a, d2 - addq a, d1 - mulxq 16(x), a, d3 - adcq a, d2 - mulxq 24(x), a, h - adcq a, d3 - adcq $0, h - -// Writing the product as z = 2^256 * h + 2^192 * d3 + t = 2^192 * hl + t, our -// intended quotient approximation is (hl + hl>>32 + 1)>>64. Note that by -// hypothesis our product is <= (2^64 - 1) * (p_256 - 1), so there is no need -// to max this out to avoid wrapping. - - movq h, a - shldq $32, d3, a - movq h, q - shrq $32, q - - xorq c, c - subq $1, c - - adcq d3, a - adcq h, q - -// Now compute the initial pre-reduced result z - p_256 * q -// = z - (2^256 - 2^224 + 2^192 + 2^96 - 1) * q -// = z - 2^192 * 0xffffffff00000001 * q - 2^64 * 0x0000000100000000 * q + q - - addq q, d0 - movq $0x0000000100000000, a - mulxq a, a, c - sbbq $0, a - sbbq $0, c - subq a, d1 - sbbq c, d2 - movq $0xffffffff00000001, a - mulxq a, a, c - sbbq a, d3 - sbbq c, h - -// Now our top word h is either zero or all 1s, and we use this to discriminate -// whether a correction is needed because our result is negative, as a bitmask -// Do a masked addition of p_256 and write back - - movl $0x00000000ffffffff, ashort - andq h, a - xorq c, c - subq a, c - addq h, d0 - movq d0, (z) - adcq a, d1 - movq d1, 8(z) - adcq $0, d2 - movq d2, 16(z) - adcq c, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_cmul_p256_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_cmul_p256_alt.S deleted file mode 100644 index c57d09a1f2d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_cmul_p256_alt.S +++ /dev/null @@ -1,150 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_256, z := (c * x) mod p_256, assuming -// x reduced -// Inputs c, x[4]; output z[4] -// -// extern void bignum_cmul_p256_alt(uint64_t z[static 4], uint64_t c, -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = c, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = c, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p256_alt) - .text - -#define z %rdi - -// Temporarily moved here for initial multiply then thrown away - -#define x %rcx -#define m %rsi - -// Other variables - -#define d %rdx -#define a %rax -#define c %rcx - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 -#define h %rsi - -#define ashort %eax -#define hshort %esi - -// Multiplier again for second stage - -#define q %rcx - -S2N_BN_SYMBOL(bignum_cmul_p256_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Shuffle inputs (since we want %rdx for the high parts of products) - - movq %rdx, x - -// Multiply, accumulating the result as 2^256 * h + [d3;d2;d1;d0] - - movq (x), a - mulq m - movq a, d0 - movq d, d1 - - movq 8(x), a - mulq m - xorq d2, d2 - addq a, d1 - adcq d, d2 - - movq 16(x), a - mulq m - xorq d3, d3 - addq a, d2 - adcq d, d3 - - movq 24(x), a - mulq m - xorl hshort, hshort - addq a, d3 - adcq d, h - -// Writing the product as z = 2^256 * h + 2^192 * d3 + t = 2^192 * hl + t, our -// intended quotient approximation is (hl + hl>>32 + 1)>>64. Note that by -// hypothesis our product is <= (2^64 - 1) * (p_256 - 1), so there is no need -// to max this out to avoid wrapping. - - movq h, a - shldq $32, d3, a - movq h, q - shrq $32, q - xorq d, d - subq $1, d - adcq d3, a - adcq h, q - -// Now compute the initial pre-reduced result z - p_256 * q -// = z - (2^256 - 2^224 + 2^192 + 2^96 - 1) * q -// = z - 2^192 * 0xffffffff00000001 * q - 2^64 * 0x0000000100000000 * q + q - - movq $0x0000000100000000, a - mulq q - addq q, d0 - sbbq $0, a - sbbq $0, d - subq a, d1 - sbbq d, d2 - sbbq $0, d3 - sbbq $0, h - movq $0xffffffff00000001, a - mulq q - subq a, d3 - sbbq d, h - -// Now our top word h is either zero or all 1s, and we use this to discriminate -// whether a correction is needed because our result is negative, as a bitmask -// Do a masked addition of p_256 and write back - - movl $0x00000000ffffffff, ashort - andq h, a - xorq c, c - subq a, c - addq h, d0 - movq d0, (z) - adcq a, d1 - movq d1, 8(z) - adcq $0, d2 - movq d2, 16(z) - adcq c, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p256_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_deamont_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_deamont_p256.S deleted file mode 100644 index ecab5837f00..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_deamont_p256.S +++ /dev/null @@ -1,149 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from almost-Montgomery form, z := (x / 2^256) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_deamont_p256(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Convert a 4-digit bignum x out of its (optionally almost) Montgomery form, -// "almost" meaning any 4-digit input will work, with no range restriction. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_deamont_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_deamont_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_deamont_p256) - .text - -#define z %rdi -#define x %rsi - -// Re-use these as temporaries in the correction phase - -#define d %rdx -#define u %r10 -#define v %r11 - -#define dshort %edx -#define ushort %r10d - -// Add %rdx * m into a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rcx as temporaries - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rcx ; \ - adcxq %rax, low ; \ - adoxq %rcx, high - -S2N_BN_SYMBOL(bignum_deamont_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save one more register to play with - - CFI_PUSH(%rbx) - -// Set up an initial 4-word window [%r11,%r10,%r9,%r8] = x - - movq (x), %r8 - movq 8(x), %r9 - movq 16(x), %r10 - movq 24(x), %r11 - -// Fill in two zeros to the left - - xorq %rbx, %rbx - xorq %rsi, %rsi - -// Montgomery reduce windows 0 and 1 together - - movq $0x0000000100000000, %rdx - mulpadd(%r10,%r9,%r8) - mulpadd(%r11,%r10,%r9) - movq $0xffffffff00000001, %rdx - mulpadd(%rbx,%r11,%r8) - mulpadd(%rsi,%rbx,%r9) - movl $0, %r8d - adcxq %r8, %rsi - -// Append just one more leading zero (by the above %r8 = 0 already). - - xorq %r9, %r9 - -// Montgomery reduce windows 2 and 3 together - - movq $0x0000000100000000, %rdx - mulpadd(%rbx,%r11,%r10) - mulpadd(%rsi,%rbx,%r11) - movq $0xffffffff00000001, %rdx - mulpadd(%r8,%rsi,%r10) - mulpadd(%r9,%r8,%r11) - movl $0, %r10d - adcxq %r10, %r9 - -// We now have a pre-reduced dd = [%r9;%r8;%rsi;%rbx]. Load non-trivial digits -// of p_256 = [v; 0; u; -1] - - movl $0x00000000ffffffff, ushort - movq $0xffffffff00000001, v - -// Now do the subtraction (p_256-1) - (%r9;%r8;%rsi;%rbx) to get the carry - - movq $-2, d - subq %rbx, d - movq u, d - sbbq %rsi, d - movl $0, dshort - sbbq %r8, d - movq v, d - sbbq %r9, d - -// Convert the carry CF <=> dd >= p_256 to a bitmask and do a masked subtraction - - sbbq d, d - andq d, u - andq d, v - - subq d, %rbx - sbbq u, %rsi - sbbq $0, %r8 - sbbq v, %r9 - -// Write back - - movq %rbx, (z) - movq %rsi, 8(z) - movq %r8, 16(z) - movq %r9, 24(z) - -// Restore saved register and return - - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_deamont_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_deamont_p256_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_deamont_p256_alt.S deleted file mode 100644 index 21e89aab0e3..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_deamont_p256_alt.S +++ /dev/null @@ -1,162 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from almost-Montgomery form, z := (x / 2^256) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_deamont_p256_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Convert a 4-digit bignum x out of its (optionally almost) Montgomery form, -// "almost" meaning any 4-digit input will work, with no range restriction. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_deamont_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_deamont_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_deamont_p256_alt) - .text - -#define z %rdi -#define x %rsi - -// Re-use these as temporaries in the correction phase - -#define d %rdx -#define u %rax -#define v %rcx - -#define dshort %edx -#define ushort %eax - -// Add %rdx * m into a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rcx as temporaries - -#define mulpado(high,low,m) \ - mulxq m, %rax, %rcx ; \ - adcxq %rax, low ; \ - adoxq %rcx, high - -// Add %rcx * m into a register-pair (high,low) maintaining consistent -// carry-catching with carry (negated, as bitmask) and using %rax and %rdx -// as temporaries - -#define mulpadd(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rcx; \ - subq carry, %rdx ; \ - addq %rax, low ; \ - adcq %rdx, high ; \ - sbbq carry, carry - -// Initial version assuming no carry-in - -#define mulpadi(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rcx; \ - addq %rax, low ; \ - adcq %rdx, high ; \ - sbbq carry, carry - -// Version with no carry in or out - -#define mulpadn(high,low,m) \ - movq m, %rax ; \ - mulq %rcx; \ - addq %rax, low ; \ - adcq %rdx, high - -S2N_BN_SYMBOL(bignum_deamont_p256_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Set up an initial 4-word window [%r11,%r10,%r9,%r8] = x - - movq (x), %r8 - movq 8(x), %r9 - movq 16(x), %r10 - movq 24(x), %r11 - -// Load constant 2^32; %rcx toggles between this and (1 - %rcx) below - - movq $0x0000000100000000, %rcx - -// Montgomery reduce windows 0 and 1 together as [%r8;%rsi;%r11;%r10] - - mulpadi(%rsi,%r10,%r9,%r8) - mulpadd(%rsi,%r11,%r10,%r9) - negq %rcx - negq %rsi - incq %rcx - mulpadi(%r8,%rsi,%r11,%r8) - negq %r8 - mulpadn(%r8,%rsi,%r9) - -// Montgomery reduce windows 2 and 3 together as [%r10;%r9;%r8;%rsi] - - negq %rcx - incq %rcx - mulpadi(%r9,%rsi,%r11,%r10) - mulpadd(%r9,%r8,%rsi,%r11) - negq %rcx - negq %r9 - incq %rcx - mulpadi(%r10,%r9,%r8,%r10) - negq %r10 - mulpadn(%r10,%r9,%r11) - -// We now have a pre-reduced result z = [%r10;%r9;%r8;%rsi]. -// From the above we have %rcx = 0xffffffff00000001, which we use to generate -// [0x00000000fffffffe; -1; 0xffffffff00000000; 1] = 2^256 - p_256 and -// then compute [%rcx;%rdx;%r11;%rax] = z + (2^256 - p_256) - - xorl %edx, %edx - leaq 1(%rdx), %rax - addq %rsi, %rax - leaq -1(%rcx), %r11 - adcq %r8, %r11 - notq %rdx - adcq %r9, %rdx - notq %rcx - adcq %r10, %rcx - -// CF is set iff z + (2^256 - p_256) >= 2^256, i.e. if z >= p_256. -// If so we want the result of the subtraction (in 4 words) - - cmovcq %rax, %rsi - cmovcq %r11, %r8 - cmovcq %rdx, %r9 - cmovcq %rcx, %r10 - -// Write back - - movq %rsi, (z) - movq %r8, 8(z) - movq %r9, 16(z) - movq %r10, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_deamont_p256_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_demont_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_demont_p256.S deleted file mode 100644 index a5ce4ce86df..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_demont_p256.S +++ /dev/null @@ -1,116 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^256) mod p_256, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_demont_p256(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// This assumes the input is < p_256 for correctness. If this is not the case, -// use the variant "bignum_deamont_p256" instead. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_p256) - .text - -#define z %rdi -#define x %rsi - -// Add %rdx * m into a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rcx as temporaries - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rcx ; \ - adcxq %rax, low ; \ - adoxq %rcx, high - -S2N_BN_SYMBOL(bignum_demont_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save one more register to play with - - CFI_PUSH(%rbx) - -// Set up an initial 4-word window [%r11,%r10,%r9,%r8] = x - - movq (x), %r8 - movq 8(x), %r9 - movq 16(x), %r10 - movq 24(x), %r11 - -// Fill in two zeros to the left - - xorq %rbx, %rbx - xorq %rsi, %rsi - -// Montgomery reduce windows 0 and 1 together - - movq $0x0000000100000000, %rdx - mulpadd(%r10,%r9,%r8) - mulpadd(%r11,%r10,%r9) - movq $0xffffffff00000001, %rdx - mulpadd(%rbx,%r11,%r8) - mulpadd(%rsi,%rbx,%r9) - movl $0, %r8d - adcxq %r8, %rsi - -// Append just one more leading zero (by the above %r8 = 0 already). - - xorq %r9, %r9 - -// Montgomery reduce windows 2 and 3 together - - movq $0x0000000100000000, %rdx - mulpadd(%rbx,%r11,%r10) - mulpadd(%rsi,%rbx,%r11) - movq $0xffffffff00000001, %rdx - mulpadd(%r8,%rsi,%r10) - mulpadd(%r9,%r8,%r11) - movl $0, %r10d - adcxq %r10, %r9 - -// Since the input was assumed reduced modulo, i.e. < p, we actually know that -// 2^256 * [carries; %r9;%r8;%rsi;%rbx] is <= (p - 1) + (2^256 - 1) p -// and hence [carries; %r9;%r8;%rsi;%rbx] < p. This means in fact carries = 0 -// and [%r9;%r8;%rsi;%rbx] is already our answer, without further correction. -// Write that back. - - movq %rbx, (z) - movq %rsi, 8(z) - movq %r8, 16(z) - movq %r9, 24(z) - -// Restore saved register and return - - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_demont_p256_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_demont_p256_alt.S deleted file mode 100644 index 49136e18b6f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_demont_p256_alt.S +++ /dev/null @@ -1,134 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^256) mod p_256, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_demont_p256_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// This assumes the input is < p_256 for correctness. If this is not the case, -// use the variant "bignum_deamont_p256" instead. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_p256_alt) - .text - -#define z %rdi -#define x %rsi - -// Add %rdx * m into a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rcx as temporaries - -#define mulpado(high,low,m) \ - mulxq m, %rax, %rcx ; \ - adcxq %rax, low ; \ - adoxq %rcx, high - -// Add %rcx * m into a register-pair (high,low) maintaining consistent -// carry-catching with carry (negated, as bitmask) and using %rax and %rdx -// as temporaries - -#define mulpadd(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rcx; \ - subq carry, %rdx ; \ - addq %rax, low ; \ - adcq %rdx, high ; \ - sbbq carry, carry - -// Initial version assuming no carry-in - -#define mulpadi(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rcx; \ - addq %rax, low ; \ - adcq %rdx, high ; \ - sbbq carry, carry - -// Version with no carry in or out - -#define mulpadn(high,low,m) \ - movq m, %rax ; \ - mulq %rcx; \ - addq %rax, low ; \ - adcq %rdx, high - -S2N_BN_SYMBOL(bignum_demont_p256_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Set up an initial 4-word window [%r11,%r10,%r9,%r8] = x - - movq (x), %r8 - movq 8(x), %r9 - movq 16(x), %r10 - movq 24(x), %r11 - -// Load constant 2^32; %rcx toggles between this and (1 - %rcx) below - - movq $0x0000000100000000, %rcx - -// Montgomery reduce windows 0 and 1 together as [%r8;%rsi;%r11;%r10] - - mulpadi(%rsi,%r10,%r9,%r8) - mulpadd(%rsi,%r11,%r10,%r9) - negq %rcx - negq %rsi - incq %rcx - mulpadi(%r8,%rsi,%r11,%r8) - negq %r8 - mulpadn(%r8,%rsi,%r9) - -// Montgomery reduce windows 2 and 3 together as [%r10;%r9;%r8;%rsi] - - negq %rcx - incq %rcx - mulpadi(%r9,%rsi,%r11,%r10) - mulpadd(%r9,%r8,%rsi,%r11) - negq %rcx - negq %r9 - incq %rcx - mulpadi(%r10,%r9,%r8,%r10) - negq %r10 - mulpadn(%r10,%r9,%r11) - -// Since the input was assumed reduced modulo, i.e. < p, we actually know that -// 2^256 * [carries; %r10;%r9;%r8;%rsi] is <= (p - 1) + (2^256 - 1) p -// and hence [carries; %r10;%r9;%r8;%rsi] < p. This means in fact carries = 0 -// and [%r10;%r9;%r8;%rsi] is already our answer, without further correction. -// Write that back. - - movq %rsi, (z) - movq %r8, 8(z) - movq %r9, 16(z) - movq %r10, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont_p256_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_double_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_double_p256.S deleted file mode 100644 index ee33d9c2fbe..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_double_p256.S +++ /dev/null @@ -1,103 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo p_256, z := (2 * x) mod p_256, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_double_p256(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_double_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_double_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_double_p256) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n1 %r10 -#define n3 %r11 -#define c %rax - -#define n1short %r10d - - - -S2N_BN_SYMBOL(bignum_double_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the input and double it so that 2^256 * c + [d3;d2;d1;d0] = 2 * x -// Could also consider using shld to decouple carries - - xorq c, c - movq (x), d0 - addq d0, d0 - movq 8(x), d1 - adcq d1, d1 - movq 16(x), d2 - adcq d2, d2 - movq 24(x), d3 - adcq d3, d3 - adcq c, c - -// Now subtract 2^256 * c + [d3;d3;d1;d1] = 2 * x - p_256 -// The constants n1 and n3 in [n3; 0; n1; -1] = p_256 are saved for later - - subq $-1, d0 - movl $0x00000000ffffffff, n1short - sbbq n1, d1 - sbbq $0, d2 - movq $0xffffffff00000001, n3 - sbbq n3, d3 - -// Since by hypothesis x < p_256 we know 2 * x - p_256 < 2^256, so the top -// carry c actually gives us a bitmask for 2 * x - p_256 < 0, which we -// now use to make a masked p_256' = [n3; 0; n1; c] - - sbbq $0, c - andq c, n1 - andq c, n3 - -// Do the corrective addition and copy to output - - addq c, d0 - movq d0, (z) - adcq n1, d1 - movq d1, 8(z) - adcq $0, d2 - movq d2, 16(z) - adcq n3, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_double_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_half_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_half_p256.S deleted file mode 100644 index dde2fecee64..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_half_p256.S +++ /dev/null @@ -1,94 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Halve modulo p_256, z := (x / 2) mod p_256, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_half_p256(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_half_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_half_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_half_p256) - .text - -#define z %rdi -#define x %rsi - -#define a %rax -#define d0 %rcx -#define d1 %rdx -#define d2 %r8 -#define d3 %r9 - -#define d0short %ecx -#define d1short %edx - - - -S2N_BN_SYMBOL(bignum_half_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load lowest digit and get a mask for its lowest bit in d0 - - movq (x), a - movl $1, d0short - andq a, d0 - negq d0 - -// Create a masked version of p_256 - - movl $0x00000000ffffffff, d1short - xorq d3, d3 - andq d0, d1 - subq d1, d3 - xorq d2, d2 - -// Perform addition with masked p_256. Catch the carry in a, as a bitmask -// for convenience though we only use its LSB below with SHRD - - addq a, d0 - adcq 8(x), d1 - adcq 16(x), d2 - adcq 24(x), d3 - sbbq a, a - -// Shift right, pushing the carry back down, and store back - - shrdq $1, d1, d0 - movq d0, (z) - shrdq $1, d2, d1 - movq d1, 8(z) - shrdq $1, d3, d2 - movq d2, 16(z) - shrdq $1, a, d3 - movq d3, 24(z) - -// Return - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_half_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_inv_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_inv_p256.S deleted file mode 100644 index 5a7f6537b58..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_inv_p256.S +++ /dev/null @@ -1,1627 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Modular inverse modulo p_256 = 2^256 - 2^224 + 2^192 + 2^96 - 1 -// Input x[4]; output z[4] -// -// extern void bignum_inv_p256(uint64_t z[static 4],const uint64_t x[static 4]); -// -// If the 4-digit input x is coprime to p_256, i.e. is not divisible -// by it, returns z < p_256 such that x * z == 1 (mod p_256). Note that -// x does not need to be reduced modulo p_256, but the output always is. -// If the input is divisible (i.e. is 0 or p_256), then there can be no -// modular inverse and z = 0 is returned. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_inv_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_inv_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_inv_p256) - .text - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack - -#define f 0(%rsp) -#define g (5*N)(%rsp) -#define u (10*N)(%rsp) -#define v (15*N)(%rsp) -#define tmp (20*N)(%rsp) -#define tmp2 (21*N)(%rsp) -#define i (22*N)(%rsp) -#define d (23*N)(%rsp) - -#define mat (24*N)(%rsp) - -// Backup for the input pointer - -#define res (28*N)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 30*N - -// Syntactic variants to make x86_att version simpler to generate - -#define F 0 -#define G (5*N) -#define U (10*N) -#define V (15*N) -#define MAT (24*N) - -#define ff (%rsp) -#define gg (5*N)(%rsp) - -// --------------------------------------------------------------------------- -// Core signed almost-Montgomery reduction macro from u[4..0] to u[3..0]. -// --------------------------------------------------------------------------- - -#define amontred(P) \ -/* We only know the input is -2^316 < x < 2^316. To do traditional */ \ -/* unsigned Montgomery reduction, start by adding 2^61 * p_256. */ \ - movq $0xe000000000000000, %r8 ; \ - addq P, %r8 ; \ - movq $0xffffffffffffffff, %r9 ; \ - adcq 8+P, %r9 ; \ - movq $0x000000001fffffff, %r10 ; \ - adcq 16+P, %r10 ; \ - movq $0x2000000000000000, %r11 ; \ - adcq 24+P, %r11 ; \ - movq $0x1fffffffe0000000, %r12 ; \ - adcq 32+P, %r12 ; \ -/* Let [%r8;%rbx] = 2^32 * w and [%rdx;%rax] = (2^64 - 2^32 + 1) * w */ \ -/* where w is the lowest word */ \ - movq %r8, %rbx ; \ - shlq $32, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %r8; \ - shrq $32, %r8 ; \ -/* Hence basic addition of (2^256 - 2^224 + 2^192 + 2^96) * w */ \ - addq %rbx, %r9 ; \ - adcq %r8, %r10 ; \ - adcq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ -/* Now capture carry and subtract p_256 if set (almost-Montgomery) */ \ - sbbq %rax, %rax ; \ - movl $0x00000000ffffffff, %ebx ; \ - andq %rax, %rbx ; \ - movq $0xffffffff00000001, %rdx ; \ - andq %rax, %rdx ; \ - subq %rax, %r9 ; \ - movq %r9, P ; \ - sbbq %rbx, %r10 ; \ - movq %r10, 8+P ; \ - sbbq $0, %r11 ; \ - movq %r11, 16+P ; \ - sbbq %rdx, %r12 ; \ - movq %r12, 24+P - -// Very similar to a subroutine call to the s2n-bignum word_divstep59. -// But different in register usage and returning the final matrix as -// -// [ %r8 %r10] -// [ %r12 %r14] -// -// and also returning the matrix still negated (which doesn't matter) - -#define divstep59(din,fin,gin) \ - movq din, %rsi ; \ - movq fin, %rdx ; \ - movq gin, %rcx ; \ - movq %rdx, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq $0xfffffffffffffffe, %rax ; \ - xorl %ebp, %ebp ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %rdx ; \ - leaq (%rcx,%rax), %rdi ; \ - shlq $0x16, %rdx ; \ - shlq $0x16, %rdi ; \ - sarq $0x2b, %rdx ; \ - sarq $0x2b, %rdi ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %rbx ; \ - leaq (%rcx,%rax), %rcx ; \ - sarq $0x2a, %rbx ; \ - sarq $0x2a, %rcx ; \ - movq %rdx, MAT(%rsp) ; \ - movq %rbx, MAT+0x8(%rsp) ; \ - movq %rdi, MAT+0x10(%rsp) ; \ - movq %rcx, MAT+0x18(%rsp) ; \ - movq fin, %r12 ; \ - imulq %r12, %rdi ; \ - imulq %rdx, %r12 ; \ - movq gin, %r13 ; \ - imulq %r13, %rbx ; \ - imulq %rcx, %r13 ; \ - addq %rbx, %r12 ; \ - addq %rdi, %r13 ; \ - sarq $0x14, %r12 ; \ - sarq $0x14, %r13 ; \ - movq %r12, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - movq %r13, %rcx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq $0xfffffffffffffffe, %rax ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %r8 ; \ - leaq (%rcx,%rax), %r10 ; \ - shlq $0x16, %r8 ; \ - shlq $0x16, %r10 ; \ - sarq $0x2b, %r8 ; \ - sarq $0x2b, %r10 ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %r15 ; \ - leaq (%rcx,%rax), %r11 ; \ - sarq $0x2a, %r15 ; \ - sarq $0x2a, %r11 ; \ - movq %r13, %rbx ; \ - movq %r12, %rcx ; \ - imulq %r8, %r12 ; \ - imulq %r15, %rbx ; \ - addq %rbx, %r12 ; \ - imulq %r11, %r13 ; \ - imulq %r10, %rcx ; \ - addq %rcx, %r13 ; \ - sarq $0x14, %r12 ; \ - sarq $0x14, %r13 ; \ - movq %r12, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - movq %r13, %rcx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq MAT(%rsp), %rax ; \ - imulq %r8, %rax ; \ - movq MAT+0x10(%rsp), %rdx ; \ - imulq %r15, %rdx ; \ - imulq MAT+0x8(%rsp), %r8 ; \ - imulq MAT+0x18(%rsp), %r15 ; \ - addq %r8, %r15 ; \ - leaq (%rax,%rdx), %r9 ; \ - movq MAT(%rsp), %rax ; \ - imulq %r10, %rax ; \ - movq MAT+0x10(%rsp), %rdx ; \ - imulq %r11, %rdx ; \ - imulq MAT+0x8(%rsp), %r10 ; \ - imulq MAT+0x18(%rsp), %r11 ; \ - addq %r10, %r11 ; \ - leaq (%rax,%rdx), %r13 ; \ - movq $0xfffffffffffffffe, %rax ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %r8 ; \ - leaq (%rcx,%rax), %r12 ; \ - shlq $0x15, %r8 ; \ - shlq $0x15, %r12 ; \ - sarq $0x2b, %r8 ; \ - sarq $0x2b, %r12 ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %r10 ; \ - leaq (%rcx,%rax), %r14 ; \ - sarq $0x2b, %r10 ; \ - sarq $0x2b, %r14 ; \ - movq %r9, %rax ; \ - imulq %r8, %rax ; \ - movq %r13, %rdx ; \ - imulq %r10, %rdx ; \ - imulq %r15, %r8 ; \ - imulq %r11, %r10 ; \ - addq %r8, %r10 ; \ - leaq (%rax,%rdx), %r8 ; \ - movq %r9, %rax ; \ - imulq %r12, %rax ; \ - movq %r13, %rdx ; \ - imulq %r14, %rdx ; \ - imulq %r15, %r12 ; \ - imulq %r11, %r14 ; \ - addq %r12, %r14 ; \ - leaq (%rax,%rdx), %r12 - -S2N_BN_SYMBOL(bignum_inv_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers and make room for temporaries - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Save the return pointer for the end so we can overwrite %rdi later - - movq %rdi, res - -// Create constant [%rdx;%rcx;%rbx;%rax] = p_256 and copy it into the variable f -// including the 5th zero digit - - xorl %ecx, %ecx - movl $0x00000000ffffffff, %edx - movq %rdx, %rbx - leaq -1(%rcx), %rax - negq %rdx - movq %rax, F(%rsp) - movq %rbx, F+8(%rsp) - movq %rcx, F+16(%rsp) - movq %rdx, F+24(%rsp) - movq %rcx, F+32(%rsp) - -// Now reduce the input modulo p_256, first negating the constant to get -// [%rdx;%rcx;%rbx;%rax] = 2^256 - p_256, adding it to x and hence getting -// the comparison x < p_256 <=> (2^256 - p_256) + x < 2^256 and choosing -// g accordingly. - - movq (%rsi), %r8 - movq 8(%rsi), %r9 - movq 16(%rsi), %r10 - movq 24(%rsi), %r11 - - leaq 1(%rcx), %rax - addq %r8, %rax - leaq -1(%rdx), %rbx - adcq %r9, %rbx - notq %rcx - adcq %r10, %rcx - notq %rdx - adcq %r11, %rdx - - cmovncq %r8, %rax - cmovncq %r9, %rbx - cmovncq %r10, %rcx - cmovncq %r11, %rdx - - movq %rax, G(%rsp) - movq %rbx, G+8(%rsp) - movq %rcx, G+16(%rsp) - movq %rdx, G+24(%rsp) - xorl %eax, %eax - movq %rax, G+32(%rsp) - -// Also maintain reduced < 2^256 vector [u,v] such that -// [f,g] == x * 2^{5*i-50} * [u,v] (mod p_256) -// starting with [p_256,x] == x * 2^{5*0-50} * [0,2^50] (mod p_256) -// The weird-looking 5*i modifications come in because we are doing -// 64-bit word-sized Montgomery reductions at each stage, which is -// 5 bits more than the 59-bit requirement to keep things stable. - - xorl %eax, %eax - movq %rax, U(%rsp) - movq %rax, U+8(%rsp) - movq %rax, U+16(%rsp) - movq %rax, U+24(%rsp) - - movq $0x0004000000000000, %rcx - movq %rcx, V(%rsp) - movq %rax, V+8(%rsp) - movq %rax, V+16(%rsp) - movq %rax, V+24(%rsp) - -// Start of main loop. We jump into the middle so that the divstep -// portion is common to the special tenth iteration after a uniform -// first 9. - - movq $10, i - movq $1, d - jmp Lbignum_inv_p256_midloop - -Lbignum_inv_p256_loop: - -// Separate out the matrix into sign-magnitude pairs - - movq %r8, %r9 - sarq $63, %r9 - xorq %r9, %r8 - subq %r9, %r8 - - movq %r10, %r11 - sarq $63, %r11 - xorq %r11, %r10 - subq %r11, %r10 - - movq %r12, %r13 - sarq $63, %r13 - xorq %r13, %r12 - subq %r13, %r12 - - movq %r14, %r15 - sarq $63, %r15 - xorq %r15, %r14 - subq %r15, %r14 - -// Adjust the initial values to allow for complement instead of negation -// This initial offset is the same for [f,g] and [u,v] compositions. -// Save it in temporary storage for the [u,v] part and do [f,g] first. - - movq %r8, %rax - andq %r9, %rax - movq %r10, %rdi - andq %r11, %rdi - addq %rax, %rdi - movq %rdi, tmp - - movq %r12, %rax - andq %r13, %rax - movq %r14, %rsi - andq %r15, %rsi - addq %rax, %rsi - movq %rsi, tmp2 - -// Now the computation of the updated f and g values. This maintains a -// 2-word carry between stages so we can conveniently insert the shift -// right by 59 before storing back, and not overwrite digits we need -// again of the old f and g values. -// -// Digit 0 of [f,g] - - xorl %ebx, %ebx - movq F(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rdi - adcq %rdx, %rbx - movq G(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rdi - adcq %rdx, %rbx - - xorl %ebp, %ebp - movq F(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rbp - movq G(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - -// Digit 1 of [f,g] - - xorl %ecx, %ecx - movq F+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq G+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - shrdq $59, %rbx, %rdi - movq %rdi, F(%rsp) - - xorl %edi, %edi - movq F+N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rbp - adcq %rdx, %rdi - movq G+N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rdi - shrdq $59, %rbp, %rsi - movq %rsi, G(%rsp) - -// Digit 2 of [f,g] - - xorl %esi, %esi - movq F+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rsi - movq G+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rsi - shrdq $59, %rcx, %rbx - movq %rbx, F+N(%rsp) - - xorl %ebx, %ebx - movq F+2*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rdi - adcq %rdx, %rbx - movq G+2*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rdi - adcq %rdx, %rbx - shrdq $59, %rdi, %rbp - movq %rbp, G+N(%rsp) - -// Digits 3 and 4 of [f,g] - - movq F+3*N(%rsp), %rax - xorq %r9, %rax - movq F+4*N(%rsp), %rbp - xorq %r9, %rbp - andq %r8, %rbp - negq %rbp - mulq %r8 - addq %rax, %rsi - adcq %rdx, %rbp - movq G+3*N(%rsp), %rax - xorq %r11, %rax - movq G+4*N(%rsp), %rdx - xorq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbp - mulq %r10 - addq %rax, %rsi - adcq %rdx, %rbp - shrdq $59, %rsi, %rcx - movq %rcx, F+2*N(%rsp) - shrdq $59, %rbp, %rsi - sarq $59, %rbp - - movq F+3*N(%rsp), %rax - movq %rsi, F+3*N(%rsp) - - movq F+4*N(%rsp), %rsi - movq %rbp, F+4*N(%rsp) - - xorq %r13, %rax - xorq %r13, %rsi - andq %r12, %rsi - negq %rsi - mulq %r12 - addq %rax, %rbx - adcq %rdx, %rsi - movq G+3*N(%rsp), %rax - xorq %r15, %rax - movq G+4*N(%rsp), %rdx - xorq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rsi - mulq %r14 - addq %rax, %rbx - adcq %rdx, %rsi - shrdq $59, %rbx, %rdi - movq %rdi, G+2*N(%rsp) - shrdq $59, %rsi, %rbx - movq %rbx, G+3*N(%rsp) - sarq $59, %rsi - movq %rsi, G+4*N(%rsp) - -// Get the initial carries back from storage and do the [u,v] accumulation - - movq tmp, %rbx - movq tmp2, %rbp - -// Digit 0 of [u,v] - - xorl %ecx, %ecx - movq U(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq V(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - - xorl %esi, %esi - movq U(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, U(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq V(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, V(%rsp) - -// Digit 1 of [u,v] - - xorl %ebx, %ebx - movq U+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq V+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rbx - - xorl %ebp, %ebp - movq U+N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rcx, U+N(%rsp) - addq %rax, %rsi - adcq %rdx, %rbp - movq V+N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - movq %rsi, V+N(%rsp) - -// Digit 2 of [u,v] - - xorl %ecx, %ecx - movq U+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq V+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - - xorl %esi, %esi - movq U+2*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, U+2*N(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq V+2*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, V+2*N(%rsp) - -// Digits 3 and 4 of u (top is unsigned) - - movq U+3*N(%rsp), %rax - xorq %r9, %rax - movq %r9, %rbx - andq %r8, %rbx - negq %rbx - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq V+3*N(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbx - mulq %r10 - addq %rax, %rcx - adcq %rbx, %rdx - -// Preload for last use of old u digit 3 - - movq U+3*N(%rsp), %rax - movq %rcx, U+3*N(%rsp) - movq %rdx, U+4*N(%rsp) - -// Digits 3 and 4 of v (top is unsigned) - - xorq %r13, %rax - movq %r13, %rcx - andq %r12, %rcx - negq %rcx - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rcx - movq V+3*N(%rsp), %rax - xorq %r15, %rax - movq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rcx - mulq %r14 - addq %rax, %rsi - adcq %rcx, %rdx - movq %rsi, V+3*N(%rsp) - movq %rdx, V+4*N(%rsp) - -// Montgomery reduction of u - - amontred(u) - -// Montgomery reduction of v - - amontred(v) - -Lbignum_inv_p256_midloop: - - divstep59(d,ff,gg) - movq %rsi, d - -// Next iteration - - decq i - jnz Lbignum_inv_p256_loop - -// The 10th and last iteration does not need anything except the -// u value and the sign of f; the latter can be obtained from the -// lowest word of f. So it's done differently from the main loop. -// Find the sign of the new f. For this we just need one digit -// since we know (for in-scope cases) that f is either +1 or -1. -// We don't explicitly shift right by 59 either, but looking at -// bit 63 (or any bit >= 60) of the unshifted result is enough -// to distinguish -1 from +1; this is then made into a mask. - - movq F(%rsp), %rax - movq G(%rsp), %rcx - imulq %r8, %rax - imulq %r10, %rcx - addq %rcx, %rax - sarq $63, %rax - -// Now separate out the matrix into sign-magnitude pairs -// and adjust each one based on the sign of f. -// -// Note that at this point we expect |f|=1 and we got its -// sign above, so then since [f,0] == x * [u,v] (mod p_256) -// we want to flip the sign of u according to that of f. - - movq %r8, %r9 - sarq $63, %r9 - xorq %r9, %r8 - subq %r9, %r8 - xorq %rax, %r9 - - movq %r10, %r11 - sarq $63, %r11 - xorq %r11, %r10 - subq %r11, %r10 - xorq %rax, %r11 - - movq %r12, %r13 - sarq $63, %r13 - xorq %r13, %r12 - subq %r13, %r12 - xorq %rax, %r13 - - movq %r14, %r15 - sarq $63, %r15 - xorq %r15, %r14 - subq %r15, %r14 - xorq %rax, %r15 - -// Adjust the initial value to allow for complement instead of negation - - movq %r8, %rax - andq %r9, %rax - movq %r10, %r12 - andq %r11, %r12 - addq %rax, %r12 - -// Digit 0 of [u] - - xorl %r13d, %r13d - movq U(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r12 - adcq %rdx, %r13 - movq V(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r12 - adcq %rdx, %r13 - -// Digit 1 of [u] - - xorl %r14d, %r14d - movq U+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r13 - adcq %rdx, %r14 - movq V+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r13 - adcq %rdx, %r14 - -// Digit 2 of [u] - - xorl %r15d, %r15d - movq U+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r14 - adcq %rdx, %r15 - movq V+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r14 - adcq %rdx, %r15 - -// Digits 3 and 4 of u (top is unsigned) - - movq U+3*N(%rsp), %rax - xorq %r9, %rax - andq %r8, %r9 - negq %r9 - mulq %r8 - addq %rax, %r15 - adcq %rdx, %r9 - movq V+3*N(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %r9 - mulq %r10 - addq %rax, %r15 - adcq %rdx, %r9 - -// Store back and Montgomery reduce u - - movq %r12, U(%rsp) - movq %r13, U+N(%rsp) - movq %r14, U+2*N(%rsp) - movq %r15, U+3*N(%rsp) - movq %r9, U+4*N(%rsp) - - amontred(u) - -// Perform final strict reduction mod p_256 and copy to output - - movq U(%rsp), %r8 - movq U+N(%rsp), %r9 - movq U+2*N(%rsp), %r10 - movq U+3*N(%rsp), %r11 - - movl $1, %eax - movl $0xffffffff, %ebx - leaq -2(%rax), %rcx - leaq -1(%rbx), %rdx - notq %rbx - - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - - cmovncq %r8, %rax - cmovncq %r9, %rbx - cmovncq %r10, %rcx - cmovncq %r11, %rdx - - movq res, %rdi - movq %rax, (%rdi) - movq %rbx, N(%rdi) - movq %rcx, 2*N(%rdi) - movq %rdx, 3*N(%rdi) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_inv_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_littleendian_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_littleendian_4.S deleted file mode 100644 index 91d1a3bc1b9..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_littleendian_4.S +++ /dev/null @@ -1,82 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert 4-digit (256-bit) bignum to/from little-endian form -// Input x[4]; output z[4] -// -// extern void bignum_littleendian_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// The same function is given two other prototypes whose names reflect the -// treatment of one or other argument as a byte array rather than word array: -// -// extern void bignum_fromlebytes_4(uint64_t z[static 4], -// const uint8_t x[static 32]); -// -// extern void bignum_tolebytes_4(uint8_t z[static 32], -// const uint64_t x[static 4]); -// -// Since x86 is little-endian, this is just copying. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_littleendian_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_littleendian_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_littleendian_4) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_fromlebytes_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_fromlebytes_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_fromlebytes_4) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tolebytes_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tolebytes_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tolebytes_4) - - .text - -#define z %rdi -#define x %rsi -#define a %rax - -S2N_BN_SYMBOL(bignum_littleendian_4): -S2N_BN_SYMBOL(bignum_fromlebytes_4): -S2N_BN_SYMBOL(bignum_tolebytes_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - - movq (x), a - movq a, (z) - - movq 8(x), a - movq a, 8(z) - - movq 16(x), a - movq a, 16(z) - - movq 24(x), a - movq a, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_littleendian_4) -S2N_BN_SIZE_DIRECTIVE(bignum_fromlebytes_4) -S2N_BN_SIZE_DIRECTIVE(bignum_tolebytes_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_n256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_n256.S deleted file mode 100644 index e445396a6f5..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_n256.S +++ /dev/null @@ -1,209 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_256 -// Input x[k]; output z[4] -// -// extern void bignum_mod_n256(uint64_t z[static 4], uint64_t k, -// const uint64_t *x); -// -// Reduction is modulo the group order of the NIST curve P-256. -// -// Standard x86-64 ABI: RDI = z, RSI = k, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = k, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n256) - .text - -#define z %rdi -#define k %rsi -#define x %rcx - -#define m0 %r8 -#define m1 %r9 -#define m2 %r10 -#define m3 %r11 -#define d %r12 - -#define n0 %rax -#define n1 %rbx -#define n3 %rdx -#define q %rdx - -#define n0short %eax -#define n3short %edx - - -S2N_BN_SYMBOL(bignum_mod_n256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save extra registers - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - -// If the input is already <= 3 words long, go to a trivial "copy" path - - cmpq $4, k - jc Lbignum_mod_n256_shortinput - -// Otherwise load the top 4 digits (top-down) and reduce k by 4 - - subq $4, k - movq 24(%rdx,k,8), m3 - movq 16(%rdx,k,8), m2 - movq 8(%rdx,k,8), m1 - movq (%rdx,k,8), m0 - -// Move x into another register to leave %rdx free for multiplies and use of n3 - - movq %rdx, x - -// Reduce the top 4 digits mod n_256 (a conditional subtraction of n_256) - - movq $0x0c46353d039cdaaf, n0 - movq $0x4319055258e8617b, n1 - movl $0x00000000ffffffff, n3short - - addq n0, m0 - adcq n1, m1 - adcq $0, m2 - adcq n3, m3 - sbbq d, d - notq d - andq d, n0 - andq d, n1 - andq d, n3 - subq n0, m0 - sbbq n1, m1 - sbbq $0, m2 - sbbq n3, m3 - -// Now do (k-4) iterations of 5->4 word modular reduction - - testq k, k - jz Lbignum_mod_n256_writeback - -Lbignum_mod_n256_loop: - -// Writing the input as z = 2^256 * m3 + 2^192 * m2 + t = 2^192 * h + t, our -// intended quotient approximation is MIN ((h + h>>32 + 1)>>64) (2^64 - 1). - - movq m3, n0 - shldq $32, m2, n0 - movq m3, q - shrq $32, q - - xorq n1, n1 - subq $1, n1 - - adcq m2, n0 - adcq m3, q - sbbq n0, n0 - orq n0, q - -// Load the next digit so current m to reduce = [m3;m2;m1;m0;d] - - movq -8(x,k,8), d - -// Now form [m3;m2;m1;m0;d] = m - q * n_256 - - subq q, m3 - movq $0x0c46353d039cdaaf, n0 - mulxq n0, n0, n1 - addq n0, d - adcq n1, m0 - movq $0x4319055258e8617b, n0 - mulxq n0, n0, n1 - adcq $0, n1 - addq n0, m0 - adcq n1, m1 - movl $0x00000000ffffffff, n0short - mulxq n0, n0, n1 - adcq n0, m2 - adcq n1, m3 - -// Now our top word m3 is either zero or all 1s. Use it for a masked -// addition of n_256, which we can do by a *subtraction* of -// 2^256 - n_256 from our portion - - movq $0x0c46353d039cdaaf, n0 - andq m3, n0 - movq $0x4319055258e8617b, n1 - andq m3, n1 - movl $0x00000000ffffffff, n3short - andq m3, n3 - - subq n0, d - sbbq n1, m0 - sbbq $0, m1 - sbbq n3, m2 - -// Now shuffle registers up and loop - - movq m2, m3 - movq m1, m2 - movq m0, m1 - movq d, m0 - - decq k - jnz Lbignum_mod_n256_loop - -// Write back - -Lbignum_mod_n256_writeback: - - movq m0, (z) - movq m1, 8(z) - movq m2, 16(z) - movq m3, 24(z) - -// Restore registers and return - - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n256) - -Lbignum_mod_n256_shortinput: - - xorq m0, m0 - xorq m1, m1 - xorq m2, m2 - xorq m3, m3 - - testq k, k - jz Lbignum_mod_n256_writeback - movq (%rdx), m0 - decq k - jz Lbignum_mod_n256_writeback - movq 8(%rdx), m1 - decq k - jz Lbignum_mod_n256_writeback - movq 16(%rdx), m2 - jmp Lbignum_mod_n256_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_n256_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_n256_4.S deleted file mode 100644 index d217d528fbd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_n256_4.S +++ /dev/null @@ -1,103 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_256 -// Input x[4]; output z[4] -// -// extern void bignum_mod_n256_4(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Reduction is modulo the group order of the NIST curve P-256. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n256_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n256_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n256_4) - .text - -#define z %rdi -#define x %rsi - - - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n0 %rax -#define n1 %r10 -#define n3 %r11 - -#define n3short %r11d - -// Can re-use this as a temporary once we've loaded the input - -#define c %rsi - -S2N_BN_SYMBOL(bignum_mod_n256_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load a set of registers [n3; 0; n1; n0] = 2^256 - n_256 - - movq $0x0c46353d039cdaaf, n0 - movq $0x4319055258e8617b, n1 - movl $0x00000000ffffffff, n3short - -// Load the input and compute x + (2^256 - n_256) - - movq (x), d0 - addq n0, d0 - movq 8(x), d1 - adcq n1, d1 - movq 16(x), d2 - adcq $0, d2 - movq 24(x), d3 - adcq n3, d3 - -// Now CF is set iff 2^256 <= x + (2^256 - n_256), i.e. iff n_256 <= x. -// Create a mask for the condition x < n, and mask the three nontrivial digits -// ready to undo the previous addition with a compensating subtraction - - sbbq c, c - notq c - andq c, n0 - andq c, n1 - andq c, n3 - -// Now subtract mask * (2^256 - n_256) again and store - - subq n0, d0 - movq d0, (z) - sbbq n1, d1 - movq d1, 8(z) - sbbq $0, d2 - movq d2, 16(z) - sbbq n3, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n256_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_n256_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_n256_alt.S deleted file mode 100644 index af2cd1f1488..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_n256_alt.S +++ /dev/null @@ -1,217 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_256 -// Input x[k]; output z[4] -// -// extern void bignum_mod_n256_alt(uint64_t z[static 4], uint64_t k, -// const uint64_t *x); -// -// Reduction is modulo the group order of the NIST curve P-256. -// -// Standard x86-64 ABI: RDI = z, RSI = k, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = k, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n256_alt) - .text - -#define z %rdi -#define k %rsi -#define x %rcx - -#define m0 %r8 -#define m1 %r9 -#define m2 %r10 -#define m3 %r11 -#define d %r12 - -#define n0 %rax -#define n1 %rbx -#define n3 %rdx - -#define q %rbx - -#define n0short %eax -#define n3short %edx - - -S2N_BN_SYMBOL(bignum_mod_n256_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save extra registers - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - -// If the input is already <= 3 words long, go to a trivial "copy" path - - cmpq $4, k - jc Lbignum_mod_n256_alt_shortinput - -// Otherwise load the top 4 digits (top-down) and reduce k by 4 - - subq $4, k - movq 24(%rdx,k,8), m3 - movq 16(%rdx,k,8), m2 - movq 8(%rdx,k,8), m1 - movq (%rdx,k,8), m0 - -// Move x into another register to leave %rdx free for multiplies and use of n3 - - movq %rdx, x - -// Reduce the top 4 digits mod n_256 (a conditional subtraction of n_256) - - movq $0x0c46353d039cdaaf, n0 - movq $0x4319055258e8617b, n1 - movl $0x00000000ffffffff, n3short - - addq n0, m0 - adcq n1, m1 - adcq $0, m2 - adcq n3, m3 - sbbq d, d - notq d - andq d, n0 - andq d, n1 - andq d, n3 - subq n0, m0 - sbbq n1, m1 - sbbq $0, m2 - sbbq n3, m3 - -// Now do (k-4) iterations of 5->4 word modular reduction - - testq k, k - jz Lbignum_mod_n256_alt_writeback - -Lbignum_mod_n256_alt_loop: - -// Writing the input as z = 2^256 * m3 + 2^192 * m2 + t = 2^192 * h + t, our -// intended quotient approximation is MIN ((h + h>>32 + 1)>>64) (2^64 - 1). - - movq m3, n0 - shldq $32, m2, n0 - movq m3, q - shrq $32, q - - xorq %rdx, %rdx - subq $1, %rdx - - adcq m2, n0 - adcq m3, q - sbbq n0, n0 - orq n0, q - -// Load the next digit so current m to reduce = [m3;m2;m1;m0;d] - - movq -8(x,k,8), d - -// Now form [m3;m2;m1;m0;d] = m - q * n_256 - - subq q, m3 - - movq $0x0c46353d039cdaaf, %rax - mulq q - addq %rax, d - adcq %rdx, m0 - adcq $0, m1 - adcq $0, m2 - adcq $0, m3 - - movq $0x4319055258e8617b, %rax - mulq q - addq %rax, m0 - adcq %rdx, m1 - adcq $0, m2 - adcq $0, m3 - - movq $0x00000000ffffffff, %rax - mulq q - addq %rax, m2 - adcq %rdx, m3 - -// Now our top word m3 is either zero or all 1s. Use it for a masked -// addition of n_256, which we can do by a *subtraction* of -// 2^256 - n_256 from our portion - - movq $0x0c46353d039cdaaf, n0 - andq m3, n0 - movq $0x4319055258e8617b, n1 - andq m3, n1 - movl $0x00000000ffffffff, n3short - andq m3, n3 - - subq n0, d - sbbq n1, m0 - sbbq $0, m1 - sbbq n3, m2 - -// Now shuffle registers up and loop - - movq m2, m3 - movq m1, m2 - movq m0, m1 - movq d, m0 - - decq k - jnz Lbignum_mod_n256_alt_loop - -// Write back - -Lbignum_mod_n256_alt_writeback: - - movq m0, (z) - movq m1, 8(z) - movq m2, 16(z) - movq m3, 24(z) - -// Restore registers and return - - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n256_alt) - -Lbignum_mod_n256_alt_shortinput: - - xorq m0, m0 - xorq m1, m1 - xorq m2, m2 - xorq m3, m3 - - testq k, k - jz Lbignum_mod_n256_alt_writeback - movq (%rdx), m0 - decq k - jz Lbignum_mod_n256_alt_writeback - movq 8(%rdx), m1 - decq k - jz Lbignum_mod_n256_alt_writeback - movq 16(%rdx), m2 - jmp Lbignum_mod_n256_alt_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_p256.S deleted file mode 100644 index 6ac940d4bf7..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_p256.S +++ /dev/null @@ -1,202 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_256 -// Input x[k]; output z[4] -// -// extern void bignum_mod_p256(uint64_t z[static 4], uint64_t k, -// const uint64_t *x); -// -// Standard x86-64 ABI: RDI = z, RSI = k, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = k, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p256) - .text - -#define z %rdi -#define k %rsi -#define x %rcx - -#define m0 %r8 -#define m1 %r9 -#define m2 %r10 -#define m3 %r11 -#define d %r12 - -#define n0 %rax -#define n1 %rbx -#define n3 %rdx -#define q %rdx - -#define n0short %eax -#define n1short %ebx - - -S2N_BN_SYMBOL(bignum_mod_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save extra registers - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - -// If the input is already <= 3 words long, go to a trivial "copy" path - - cmpq $4, k - jc Lbignum_mod_p256_shortinput - -// Otherwise load the top 4 digits (top-down) and reduce k by 4 - - subq $4, k - movq 24(%rdx,k,8), m3 - movq 16(%rdx,k,8), m2 - movq 8(%rdx,k,8), m1 - movq (%rdx,k,8), m0 - -// Move x into another register to leave %rdx free for multiplies and use of n3 - - movq %rdx, x - -// Load non-trivial digits [n3; 0; n1; -1] = p_256 and do a conditional -// subtraction to reduce the four starting digits [m3;m2;m1;m0] modulo p_256 - - subq $-1, m0 - movl $0x00000000ffffffff, n1short - sbbq n1, m1 - movq $0xffffffff00000001, n3 - sbbq $0, m2 - sbbq n3, m3 - - sbbq n0, n0 - - andq n0, n1 - andq n0, n3 - addq n0, m0 - adcq n1, m1 - adcq $0, m2 - adcq n3, m3 - -// Now do (k-4) iterations of 5->4 word modular reduction - - testq k, k - jz Lbignum_mod_p256_writeback - -Lbignum_mod_p256_loop: - -// Writing the input as z = 2^256 * m3 + 2^192 * m2 + t = 2^192 * h + t, our -// intended quotient approximation is MIN ((h + h>>32 + 1)>>64) (2^64 - 1). - - movq m3, n0 - shldq $32, m2, n0 - movq m3, q - shrq $32, q - - xorq n1, n1 - subq $1, n1 - - adcq m2, n0 - adcq m3, q - sbbq n0, n0 - orq n0, q - -// Load the next digit so current m to reduce = [m3;m2;m1;m0;d] - - movq -8(x,k,8), d - -// Now compute the initial pre-reduced [m3;m2;m1;m0;d] = m - p_256 * q -// = z - (2^256 - 2^224 + 2^192 + 2^96 - 1) * q -// = z - 2^192 * 0xffffffff00000001 * q - 2^64 * 0x0000000100000000 * q + q - - addq q, d - movq $0x0000000100000000, n0 - mulxq n0, n0, n1 - sbbq $0, n0 - sbbq $0, n1 - subq n0, m0 - sbbq n1, m1 - movq $0xffffffff00000001, n0 - mulxq n0, n0, n1 - sbbq n0, m2 - sbbq n1, m3 - -// Now our top word m3 is either zero or all 1s, and we use this to discriminate -// whether a correction is needed because our result is negative, as a bitmask -// Do a masked addition of p_256 - - movl $0x00000000ffffffff, n0short - andq m3, n0 - xorq n1, n1 - subq n0, n1 - addq m3, d - adcq n0, m0 - adcq $0, m1 - adcq n1, m2 - -// Shuffle registers up and loop - - movq m2, m3 - movq m1, m2 - movq m0, m1 - movq d, m0 - - decq k - jnz Lbignum_mod_p256_loop - -// Write back - -Lbignum_mod_p256_writeback: - - movq m0, (z) - movq m1, 8(z) - movq m2, 16(z) - movq m3, 24(z) - -// Restore registers and return - - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p256) - -Lbignum_mod_p256_shortinput: - - xorq m0, m0 - xorq m1, m1 - xorq m2, m2 - xorq m3, m3 - - testq k, k - jz Lbignum_mod_p256_writeback - movq (%rdx), m0 - decq k - jz Lbignum_mod_p256_writeback - movq 8(%rdx), m1 - decq k - jz Lbignum_mod_p256_writeback - movq 16(%rdx), m2 - jmp Lbignum_mod_p256_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_p256_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_p256_4.S deleted file mode 100644 index e64fa969e88..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_p256_4.S +++ /dev/null @@ -1,91 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_mod_p256_4(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p256_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p256_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p256_4) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n1 %r10 -#define n3 %r11 -#define c %rax - -#define n1short %r10d - - - -S2N_BN_SYMBOL(bignum_mod_p256_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the input and subtract to get [d3;d3;d1;d1] = x - p_256 (modulo 2^256) -// The constants n1 and n3 in [n3; 0; n1; -1] = p_256 are saved for later - - movq (x), d0 - subq $-1, d0 - movq 8(x), d1 - movl $0x00000000ffffffff, n1short - sbbq n1, d1 - movq 16(x), d2 - sbbq $0, d2 - movq $0xffffffff00000001, n3 - movq 24(x), d3 - sbbq n3, d3 - -// Capture the carry to determine whether to add back p_256, and use -// it to create a masked p_256' = [n3; 0; n1; c] - - sbbq c, c - andq c, n1 - andq c, n3 - -// Do the corrective addition and copy to output - - addq c, d0 - movq d0, (z) - adcq n1, d1 - movq d1, 8(z) - adcq $0, d2 - movq d2, 16(z) - adcq n3, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p256_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_p256_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_p256_alt.S deleted file mode 100644 index b7e74e2205b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mod_p256_alt.S +++ /dev/null @@ -1,206 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_256 -// Input x[k]; output z[4] -// -// extern void bignum_mod_p256_alt(uint64_t z[static 4], uint64_t k, -// const uint64_t *x); -// -// Standard x86-64 ABI: RDI = z, RSI = k, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = k, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p256_alt) - .text - -#define z %rdi -#define k %rsi -#define x %rcx - -#define m0 %r8 -#define m1 %r9 -#define m2 %r10 -#define m3 %r11 -#define d %r12 - -#define n0 %rax - -#define n1 %rbx -#define q %rbx - -#define n3 %rdx - -#define n0short %eax -#define n1short %ebx - - -S2N_BN_SYMBOL(bignum_mod_p256_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save extra registers - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - -// If the input is already <= 3 words long, go to a trivial "copy" path - - cmpq $4, k - jc Lbignum_mod_p256_alt_shortinput - -// Otherwise load the top 4 digits (top-down) and reduce k by 4 - - subq $4, k - movq 24(%rdx,k,8), m3 - movq 16(%rdx,k,8), m2 - movq 8(%rdx,k,8), m1 - movq (%rdx,k,8), m0 - -// Move x into another register to leave %rdx free for multiplies and use of n3 - - movq %rdx, x - -// Load non-trivial digits [n3; 0; n1; -1] = p_256 and do a conditional -// subtraction to reduce the four starting digits [m3;m2;m1;m0] modulo p_256 - - subq $-1, m0 - movl $0x00000000ffffffff, n1short - sbbq n1, m1 - movq $0xffffffff00000001, n3 - sbbq $0, m2 - sbbq n3, m3 - - sbbq n0, n0 - - andq n0, n1 - andq n0, n3 - addq n0, m0 - adcq n1, m1 - adcq $0, m2 - adcq n3, m3 - -// Now do (k-4) iterations of 5->4 word modular reduction - - testq k, k - jz Lbignum_mod_p256_alt_writeback - -Lbignum_mod_p256_alt_loop: - -// Writing the input as z = 2^256 * m3 + 2^192 * m2 + t = 2^192 * h + t, our -// intended quotient approximation is MIN ((h + h>>32 + 1)>>64) (2^64 - 1). - - movq m3, n0 - shldq $32, m2, n0 - movq m3, q - shrq $32, q - - xorq n3, n3 - subq $1, n3 - - adcq m2, n0 - adcq m3, q - sbbq n0, n0 - orq n0, q - -// Load the next digit so current m to reduce = [m3;m2;m1;m0;d] - - movq -8(x,k,8), d - -// Now compute the initial pre-reduced [m3;m2;m1;m0;d] = m - p_256 * q -// = z - (2^256 - 2^224 + 2^192 + 2^96 - 1) * q -// = z - 2^192 * 0xffffffff00000001 * q - 2^64 * 0x0000000100000000 * q + q - - movq $0x0000000100000000, %rax - mulq q - addq q, d - sbbq $0, %rax - sbbq $0, %rdx - subq %rax, m0 - sbbq %rdx, m1 - sbbq $0, m2 - sbbq $0, m3 - movq $0xffffffff00000001, %rax - mulq q - subq %rax, m2 - sbbq %rdx, m3 - -// Now our top word m3 is either zero or all 1s, and we use this to discriminate -// whether a correction is needed because our result is negative, as a bitmask -// Do a masked addition of p_256 - - movl $0x00000000ffffffff, n0short - andq m3, n0 - xorq n1, n1 - subq n0, n1 - addq m3, d - adcq n0, m0 - adcq $0, m1 - adcq n1, m2 - -// Shuffle registers up and loop - - movq m2, m3 - movq m1, m2 - movq m0, m1 - movq d, m0 - - decq k - jnz Lbignum_mod_p256_alt_loop - -// Write back - -Lbignum_mod_p256_alt_writeback: - - movq m0, (z) - movq m1, 8(z) - movq m2, 16(z) - movq m3, 24(z) - -// Restore registers and return - - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p256_alt) - -Lbignum_mod_p256_alt_shortinput: - - xorq m0, m0 - xorq m1, m1 - xorq m2, m2 - xorq m3, m3 - - testq k, k - jz Lbignum_mod_p256_alt_writeback - movq (%rdx), m0 - decq k - jz Lbignum_mod_p256_alt_writeback - movq 8(%rdx), m1 - decq k - jz Lbignum_mod_p256_alt_writeback - movq 16(%rdx), m2 - jmp Lbignum_mod_p256_alt_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montmul_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montmul_p256.S deleted file mode 100644 index 370b2075977..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montmul_p256.S +++ /dev/null @@ -1,196 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_256 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_p256(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_256, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_256 (in particular this is true if we are in -// the "usual" case x < p_256 and y < p_256). -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p256) - .text - -#define z %rdi -#define x %rsi - -// We move the y argument here so we can use %rdx for multipliers - -#define y %rcx - -// Add %rdx * m into a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rbx as temporaries - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rbx ; \ - adcxq %rax, low ; \ - adoxq %rbx, high - -S2N_BN_SYMBOL(bignum_montmul_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Do row 0 computation, which is a bit different: -// set up initial window [%r12,%r11,%r10,%r9,%r8] = y[0] * x -// Unlike later, we only need a single carry chain - - xorl %r13d, %r13d - movq (y), %rdx - mulxq (x), %r8, %r9 - mulxq 8(x), %rbx, %r10 - adcq %rbx, %r9 - mulxq 16(x), %rbx, %r11 - adcq %rbx, %r10 - mulxq 24(x), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - -// Add row 1 - - movq 8(y), %rdx - xorl %r14d, %r14d - mulpadd(%r10,%r9,(x)) - mulpadd(%r11,%r10,8(x)) - mulpadd(%r12,%r11,16(x)) - mulpadd(%r13,%r12,24(x)) - adcq %r14, %r13 - -// Montgomery reduce windows 0 and 1 together - - xorl %r15d, %r15d - movq $0x0000000100000000, %rdx - mulpadd(%r10,%r9,%r8) - mulpadd(%r11,%r10,%r9) - notq %rdx - leaq 2(%rdx), %rdx - mulpadd(%r12,%r11,%r8) - mulpadd(%r13,%r12,%r9) - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - -// Add row 2 - - movq 16(y), %rdx - xorl %r8d, %r8d - mulpadd(%r11,%r10,(x)) - mulpadd(%r12,%r11,8(x)) - mulpadd(%r13,%r12,16(x)) - adoxq %r8, %r14 - mulxq 24(x), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - -// Add row 3 - - movq 24(y), %rdx - xorl %r9d, %r9d - mulpadd(%r12,%r11,(x)) - mulpadd(%r13,%r12,8(x)) - mulpadd(%r14,%r13,16(x)) - adoxq %r9, %r15 - mulxq 24(x), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - -// Montgomery reduce windows 2 and 3 together - - xorl %r9d, %r9d - movq $0x0000000100000000, %rdx - mulpadd(%r12,%r11,%r10) - mulpadd(%r13,%r12,%r11) - notq %rdx - leaq 2(%rdx), %rdx - mulpadd(%r14,%r13,%r10) - mulpadd(%r15,%r14,%r11) - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - -// We now have a pre-reduced 5-word form [%r8; %r15;%r14;%r13;%r12] -// Load [%rax;%r11;%rbx;%rdx;%rcx] = 2^320 - p_256, re-using earlier numbers a bit -// Do [%rax;%r11;%rbx;%rdx;%rcx] = [%r8;%r15;%r14;%r13;%r12] + (2^320 - p_256) - - movl $1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0x00000000fffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - -// Now carry is set if r + (2^320 - p_256) >= 2^320, i.e. r >= p_256 -// where r is the pre-reduced form. So conditionally select the -// output accordingly. - - cmovcq %rcx, %r12 - cmovcq %rdx, %r13 - cmovcq %r9, %r14 - cmovcq %r11, %r15 - -// Write back reduced value - - movq %r12, (z) - movq %r13, 8(z) - movq %r14, 16(z) - movq %r15, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montmul_p256_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montmul_p256_alt.S deleted file mode 100644 index 5aef49a22e5..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montmul_p256_alt.S +++ /dev/null @@ -1,219 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_256 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_p256_alt(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_256, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_256 (in particular this is true if we are in -// the "usual" case x < p_256 and y < p_256). -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p256_alt) - .text - -#define z %rdi -#define x %rsi - -// We move the y argument here so we can use %rdx for multipliers - -#define y %rcx - -// Add %rbx * m into a register-pair (high,low) maintaining consistent -// carry-catching with carry (negated, as bitmask) and using %rax and %rdx -// as temporaries - -#define mulpadd(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rbx; \ - subq carry, %rdx ; \ - addq %rax, low ; \ - adcq %rdx, high ; \ - sbbq carry, carry - -// Initial version assuming no carry-in - -#define mulpadi(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rbx; \ - addq %rax, low ; \ - adcq %rdx, high ; \ - sbbq carry, carry - -// End version not catching the top carry-out - -#define mulpade(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rbx; \ - subq carry, %rdx ; \ - addq %rax, low ; \ - adcq %rdx, high - -S2N_BN_SYMBOL(bignum_montmul_p256_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Do row 0 computation, which is a bit different: -// set up initial window [%r12,%r11,%r10,%r9,%r8] = y[0] * x -// Unlike later, we only need a single carry chain - - movq (y), %rbx - movq (x), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - - movq 8(x), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - - movq 16(x), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - - movq 24(x), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - -// Add row 1 - - movq 8(y), %rbx - xorl %r13d, %r13d - mulpadi(%r14,%r10,%r9,(x)) - mulpadd(%r14,%r11,%r10,8(x)) - mulpadd(%r14,%r12,%r11,16(x)) - mulpade(%r14,%r13,%r12,24(x)) - -// Montgomery reduce windows 0 and 1 together - - xorl %r14d, %r14d - movq $0x0000000100000000, %rbx - mulpadi(%r15,%r10,%r9,%r8) - mulpadd(%r15,%r11,%r10,%r9) - notq %rbx - leaq 2(%rbx), %rbx - mulpadd(%r15,%r12,%r11,%r8) - mulpade(%r15,%r13,%r12,%r9) - adcq %r14, %r14 - -// Add row 2 - - movq 16(y), %rbx - xorl %r15d, %r15d - mulpadi(%r8,%r11,%r10,(x)) - mulpadd(%r8,%r12,%r11,8(x)) - mulpadd(%r8,%r13,%r12,16(x)) - mulpade(%r8,%r14,%r13,24(x)) - adcq %r15, %r15 - -// Add row 3 - - movq 24(y), %rbx - xorl %r8d, %r8d - mulpadi(%r9,%r12,%r11,(x)) - mulpadd(%r9,%r13,%r12,8(x)) - mulpadd(%r9,%r14,%r13,16(x)) - mulpade(%r9,%r15,%r14,24(x)) - adcq %r8, %r8 - -// Montgomery reduce windows 2 and 3 together - - xorl %r9d, %r9d - movq $0x0000000100000000, %rbx - mulpadi(%rcx,%r12,%r11,%r10) - mulpadd(%rcx,%r13,%r12,%r11) - notq %rbx - leaq 2(%rbx), %rbx - mulpadd(%rcx,%r14,%r13,%r10) - mulpade(%rcx,%r15,%r14,%r11) - adcq %r9, %r8 - -// We now have a pre-reduced 5-word form [%r8; %r15;%r14;%r13;%r12] -// Load [%rax;%r11;%r9;%rbx;%rcx] = 2^320 - p_256, re-using earlier numbers a bit -// Do [%rax;%r11;%r9;%rbx;%rcx] = [%r8;%r15;%r14;%r13;%r12] + (2^320 - p_256) - - movl $1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0x00000000fffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - -// Now carry is set if r + (2^320 - p_256) >= 2^320, i.e. r >= p_256 -// where r is the pre-reduced form. So conditionally select the -// output accordingly. - - cmovcq %rcx, %r12 - cmovcq %rbx, %r13 - cmovcq %r9, %r14 - cmovcq %r11, %r15 - -// Write back reduced value - - movq %r12, (z) - movq %r13, 8(z) - movq %r14, 16(z) - movq %r15, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_p256_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montsqr_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montsqr_p256.S deleted file mode 100644 index dc7825bcd89..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montsqr_p256.S +++ /dev/null @@ -1,193 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_p256(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_256, assuming x^2 <= 2^256 * p_256, which is -// guaranteed in particular if x < p_256 initially (the "intended" case). -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p256) - .text - -#define z %rdi -#define x %rsi - -// Use this fairly consistently for a zero - -#define zero %rbp -#define zeroe %ebp - -// Add %rdx * m into a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rbx as temporaries - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rbx ; \ - adcxq %rax, low ; \ - adoxq %rbx, high - -S2N_BN_SYMBOL(bignum_montsqr_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Compute [%r15;%r8] = [00] which we use later, but mainly -// set up an initial window [%r14;...;%r9] = [23;03;01] - - movq (x), %rdx - mulxq %rdx, %r8, %r15 - mulxq 8(x), %r9, %r10 - mulxq 24(x), %r11, %r12 - movq 16(x), %rdx - mulxq 24(x), %r13, %r14 - -// Clear our zero register, and also initialize the flags for the carry chain - - xorl zeroe, zeroe - -// Chain in the addition of 02 + 12 + 13 to that window (no carry-out possible) -// This gives all the "heterogeneous" terms of the squaring ready to double - - mulpadd(%r11,%r10,(x)) - mulpadd(%r12,%r11,8(x)) - movq 24(x), %rdx - mulpadd(%r13,%r12,8(x)) - adcxq zero, %r13 - adoxq zero, %r14 - adcq zero, %r14 - -// Double and add to the 00 + 11 + 22 + 33 terms - - xorl zeroe, zeroe - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 8(x), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 16(x), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 24(x), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq zero, %r15 - adoxq zero, %r15 - -// First two waves of Montgomery reduction. Consolidate the double carries -// in %r9 and propagate up to the top in %r8, which is no longer needed otherwise. - - xorl zeroe, zeroe - movq $0x0000000100000000, %rdx - mulpadd(%r10,%r9,%r8) - mulpadd(%r11,%r10,%r9) - movq $0xffffffff00000001, %rdx - mulpadd(%r12,%r11,%r8) - mulpadd(%r13,%r12,%r9) - adcxq zero, %r13 - movl zeroe, %r9d - adoxq zero, %r9 - adcxq zero, %r9 - addq %r9, %r14 - adcq zero, %r15 - movl zeroe, %r8d - adcq zero, %r8 - -// Now two more steps of Montgomery reduction, again with %r8 = top carry - - xorl zeroe, zeroe - movq $0x0000000100000000, %rdx - mulpadd(%r12,%r11,%r10) - mulpadd(%r13,%r12,%r11) - movq $0xffffffff00000001, %rdx - mulpadd(%r14,%r13,%r10) - mulpadd(%r15,%r14,%r11) - adcxq zero, %r15 - adoxq zero, %r8 - adcq zero, %r8 - -// Load [%rax;%r11;%rbp;%rdx;%rcx] = 2^320 - p_256, re-using earlier numbers a bit -// Do [%rax;%r11;%rbp;%rdx;%rcx] = [%r8;%r15;%r14;%r13;%r12] + (2^320 - p_256) - - movl $1, %ecx - addq %r12, %rcx - leaq -1(%rdx), %rdx - adcq %r13, %rdx - leaq -1(%rbp), %rbp - movq %rbp, %rax - adcq %r14, %rbp - movl $0x00000000fffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - -// Now carry is set if r + (2^320 - p_256) >= 2^320, i.e. r >= p_256 -// where r is the pre-reduced form. So conditionally select the -// output accordingly. - - cmovcq %rcx, %r12 - cmovcq %rdx, %r13 - cmovcq %rbp, %r14 - cmovcq %r11, %r15 - -// Write back reduced value - - movq %r12, (z) - movq %r13, 8(z) - movq %r14, 16(z) - movq %r15, 24(z) - -// Restore saved registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montsqr_p256_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montsqr_p256_alt.S deleted file mode 100644 index 3815382d1d6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_montsqr_p256_alt.S +++ /dev/null @@ -1,216 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_p256_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_256, assuming x^2 <= 2^256 * p_256, which is -// guaranteed in particular if x < p_256 initially (the "intended" case). -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p256_alt) - .text - -#define z %rdi -#define x %rsi - -// Add %rbx * m into a register-pair (high,low) maintaining consistent -// carry-catching with carry (negated, as bitmask) and using %rax and %rdx -// as temporaries - -#define mulpadd(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rbx; \ - subq carry, %rdx ; \ - addq %rax, low ; \ - adcq %rdx, high ; \ - sbbq carry, carry - -// Initial version assuming no carry-in - -#define mulpadi(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rbx; \ - addq %rax, low ; \ - adcq %rdx, high ; \ - sbbq carry, carry - -// End version not catching the top carry-out - -#define mulpade(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rbx; \ - subq carry, %rdx ; \ - addq %rax, low ; \ - adcq %rdx, high - -S2N_BN_SYMBOL(bignum_montsqr_p256_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Compute [%r15;%r8] = [00] which we use later, but mainly -// set up an initial window [%r14;...;%r9] = [23;03;01] - - movq (x), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 8(x), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 24(x), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 16(x), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - -// Chain in the addition of 02 + 12 + 13 to that window (no carry-out possible) -// This gives all the "heterogeneous" terms of the squaring ready to double - - mulpadi(%rcx,%r11,%r10,(x)) - mulpadd(%rcx,%r12,%r11,8(x)) - movq 24(x), %rbx - mulpade(%rcx,%r13,%r12,8(x)) - adcq $0, %r14 - -// Double the window [%r14;...;%r9], catching top carry in %rcx - - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - -// Add to the 00 + 11 + 22 + 33 terms - - movq 8(x), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 16(x), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 24(x), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - -// First two waves of Montgomery reduction, now re-using %r8 for top carry - - movq $0x0000000100000000, %rbx - mulpadi(%rcx,%r10,%r9,%r8) - mulpadd(%rcx,%r11,%r10,%r9) - notq %rbx - leaq 2(%rbx), %rbx - mulpadd(%rcx,%r12,%r11,%r8) - xorl %r8d, %r8d - mulpade(%rcx,%r13,%r12,%r9) - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - -// Now two more steps of Montgomery reduction, again with %r8 = top carry - - movq $0x0000000100000000, %rbx - mulpadi(%rcx,%r12,%r11,%r10) - mulpadd(%rcx,%r13,%r12,%r11) - notq %rbx - leaq 2(%rbx), %rbx - mulpadd(%rcx,%r14,%r13,%r10) - xorl %r9d, %r9d - mulpade(%rcx,%r15,%r14,%r11) - adcq %r9, %r8 - -// Load [%rax;%r11;%r9;%rbx;%rcx] = 2^320 - p_256, re-using earlier numbers a bit -// Do [%rax;%r11;%r9;%rbx;%rcx] = [%r8;%r15;%r14;%r13;%r12] + (2^320 - p_256) - - movl $1, %ecx - addq %r12, %rcx - leaq -1(%rbx), %rbx - adcq %r13, %rbx - leaq -1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0x00000000fffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - -// Now carry is set if r + (2^320 - p_256) >= 2^320, i.e. r >= p_256 -// where r is the pre-reduced form. So conditionally select the -// output accordingly. - - cmovcq %rcx, %r12 - cmovcq %rbx, %r13 - cmovcq %r9, %r14 - cmovcq %r11, %r15 - -// Write back reduced value - - movq %r12, (z) - movq %r13, 8(z) - movq %r14, 16(z) - movq %r15, 24(z) - -// Restore saved registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_p256_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mux_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mux_4.S deleted file mode 100644 index 9061bc013fb..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_mux_4.S +++ /dev/null @@ -1,78 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// 256-bit multiplex/select z := x (if p nonzero) or z := y (if p zero) -// Inputs p, x[4], y[4]; output z[4] -// -// extern void bignum_mux_4(uint64_t p, uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// It is assumed that all numbers x, y and z have the same size 4 digits. -// -// Standard x86-64 ABI: RDI = p, RSI = z, RDX = x, RCX = y -// Microsoft x64 ABI: RCX = p, RDX = z, R8 = x, R9 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mux_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mux_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mux_4) - .text - -#define p %rdi -#define z %rsi -#define x %rdx -#define y %rcx -#define a %rax -#define b %r8 - - -S2N_BN_SYMBOL(bignum_mux_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - testq p, p - - movq (x), a - movq (y), b - cmovzq b, a - movq a, (z) - - movq 8(x), a - movq 8(y), b - cmovzq b, a - movq a, 8(z) - - movq 16(x), a - movq 16(y), b - cmovzq b, a - movq a, 16(z) - - movq 24(x), a - movq 24(y), b - cmovzq b, a - movq a, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mux_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_neg_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_neg_p256.S deleted file mode 100644 index be4b77b6c9d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_neg_p256.S +++ /dev/null @@ -1,97 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Negate modulo p_256, z := (-x) mod p_256, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_neg_p256(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_neg_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_neg_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_neg_p256) - .text - -#define z %rdi -#define x %rsi - -#define q %rdx - -#define d0 %rax -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n1 %r10 -#define n3 %r11 - -#define d0short %eax -#define n1short %r10d - -S2N_BN_SYMBOL(bignum_neg_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the input digits as [d3;d2;d1;d0] and also set a bitmask q -// for the input being nonzero, so that we avoid doing -0 = p_256 -// and hence maintain strict modular reduction - - movq (x), d0 - movq 8(x), d1 - movq d0, n1 - orq d1, n1 - movq 16(x), d2 - movq 24(x), d3 - movq d2, n3 - orq d3, n3 - orq n1, n3 - negq n3 - sbbq q, q - -// Load the non-trivial words of p_256 = [n3;0;n1;-1] and mask them with q - - movl $0x00000000ffffffff, n1short - movq $0xffffffff00000001, n3 - andq q, n1 - andq q, n3 - -// Do the subtraction, getting it as [n3;d0;n1;q] to avoid moves - - subq d0, q - movl $0, d0short - sbbq d1, n1 - sbbq d2, d0 - sbbq d3, n3 - -// Write back - - movq q, (z) - movq n1, 8(z) - movq d0, 16(z) - movq n3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_neg_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_nonzero_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_nonzero_4.S deleted file mode 100644 index 0b7dee3dda4..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_nonzero_4.S +++ /dev/null @@ -1,62 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// 256-bit nonzeroness test, returning 1 if x is nonzero, 0 if x is zero -// Input x[4]; output function return -// -// extern uint64_t bignum_nonzero_4(const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = x, returns RAX -// Microsoft x64 ABI: RCX = x, returns RAX -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_nonzero_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_nonzero_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_nonzero_4) - .text - -#define x %rdi -#define a %rax -#define d %rdx -#define dshort %edx - - - -S2N_BN_SYMBOL(bignum_nonzero_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi -#endif - -// Generate a = an OR of all the words in the bignum - - movq (x), a - movq 8(x), d - orq 16(x), a - orq 24(x), d - orq d, a - -// Set a standard C condition based on whether a is nonzero - - movl $1, dshort - cmovnzq d, a - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_nonzero_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_optneg_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_optneg_p256.S deleted file mode 100644 index 538d7242dfa..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_optneg_p256.S +++ /dev/null @@ -1,106 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo p_256, z := (-x) mod p_256 (if p nonzero) or -// z := x (if p zero), assuming x reduced -// Inputs p, x[4]; output z[4] -// -// extern void bignum_optneg_p256(uint64_t z[static 4], uint64_t p, -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = p, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = p, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg_p256) - .text - -#define z %rdi -#define q %rsi -#define x %rdx - -#define n0 %rax -#define n1 %rcx -#define n2 %r8 -#define n3 %r9 - -#define n1short %ecx - -S2N_BN_SYMBOL(bignum_optneg_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Adjust q by zeroing it if the input is zero (to avoid giving -0 = p_256, -// which is not strictly reduced even though it's correct modulo p_256). -// This step is redundant if we know a priori that the input is nonzero, which -// is the case for the y coordinate of points on the P-256 curve, for example. - - movq (x), n0 - orq 8(x), n0 - movq 16(x), n1 - orq 24(x), n1 - orq n1, n0 - negq n0 - sbbq n0, n0 - andq n0, q - -// Turn q into a bitmask, all 1s for q=false, all 0s for q=true - - negq q - sbbq q, q - notq q - -// Let [n3;n2;n1;n0] = if q then p_256 else -1 - - movq $0xffffffffffffffff, n0 - movl $0x00000000ffffffff, n1short - orq q, n1 - movq q, n2 - movq $0xffffffff00000001, n3 - orq q, n3 - -// Subtract so [n3;n2;n1;n0] = if q then p_256 - x else -1 - x - - subq (x), n0 - sbbq 8(x), n1 - sbbq 16(x), n2 - sbbq 24(x), n3 - -// XOR the words with the bitmask, which in the case q = false has the -// effect of restoring ~(-1 - x) = -(-1 - x) - 1 = 1 + x - 1 = x -// and write back the digits to the output - - xorq q, n0 - movq n0, (z) - xorq q, n1 - movq n1, 8(z) - xorq q, n2 - movq n2, 16(z) - xorq q, n3 - movq n3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_sub_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_sub_p256.S deleted file mode 100644 index d526fa3de15..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_sub_p256.S +++ /dev/null @@ -1,93 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Subtract modulo p_256, z := (x - y) mod p_256 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_sub_p256(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sub_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sub_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sub_p256) - .text - -#define z %rdi -#define x %rsi -#define y %rdx - -#define d0 %rax -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n1 %r10 -#define n3 %rdx -#define c %r11 - -#define n1short %r10d - - - -S2N_BN_SYMBOL(bignum_sub_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Load and subtract the two inputs as [d3;d2;d1;d0] = x - y (modulo 2^256) - - movq (x), d0 - subq (y), d0 - movq 8(x), d1 - sbbq 8(y), d1 - movq 16(x), d2 - sbbq 16(y), d2 - movq 24(x), d3 - sbbq 24(y), d3 - -// Capture the carry, which indicates x < y, and create corresponding masked -// correction p_256' = [n3; 0; n1; c] to add - - movl $0x00000000ffffffff, n1short - sbbq c, c - xorq n3, n3 - andq c, n1 - subq n1, n3 - -// Do the corrective addition and copy to output - - addq c, d0 - movq d0, (z) - adcq n1, d1 - movq d1, 8(z) - adcq $0, d2 - movq d2, 16(z) - adcq n3, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sub_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_tomont_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_tomont_p256.S deleted file mode 100644 index 9316e43b727..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_tomont_p256.S +++ /dev/null @@ -1,195 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert to Montgomery form z := (2^256 * x) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_tomont_p256(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tomont_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tomont_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tomont_p256) - .text - -#define z %rdi -#define x %rsi - -// Some temp registers for the last correction stage - -#define d %rax -#define u %rdx -#define v %rcx - -#define dshort %eax -#define ushort %edx - -// Add %rdx * m into a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rbx as temporaries - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rcx ; \ - adcxq %rax, low ; \ - adoxq %rcx, high - -S2N_BN_SYMBOL(bignum_tomont_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// We are essentially just doing a Montgomery multiplication of x and the -// precomputed constant y = 2^512 mod p, so the code is almost the same -// modulo a few registers and the change from loading y[i] to using constants. -// Because there is no y pointer to keep, we use one register less. - - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Do row 0 computation, which is a bit different: -// set up initial window [%r12,%r11,%r10,%r9,%r8] = y[0] * x -// Unlike later, we only need a single carry chain - - xorq %r13, %r13 - movl $0x0000000000000003, %edx - mulxq (x), %r8, %r9 - mulxq 8(x), %rcx, %r10 - adcxq %rcx, %r9 - mulxq 16(x), %rcx, %r11 - adcxq %rcx, %r10 - mulxq 24(x), %rcx, %r12 - adcxq %rcx, %r11 - adcxq %r13, %r12 - -// Add row 1 - - movq $0xfffffffbffffffff, %rdx - xorq %r14, %r14 - mulpadd(%r10,%r9,(x)) - mulpadd(%r11,%r10,8(x)) - mulpadd(%r12,%r11,16(x)) - mulpadd(%r13,%r12,24(x)) - adcq %r14, %r13 - -// Montgomery reduce windows 0 and 1 together - - xorq %r15, %r15 - movq $0x0000000100000000, %rdx - mulpadd(%r10,%r9,%r8) - mulpadd(%r11,%r10,%r9) - movq $0xffffffff00000001, %rdx - mulpadd(%r12,%r11,%r8) - mulpadd(%r13,%r12,%r9) - adcxq %r15, %r13 - adoxq %r15, %r14 - adcxq %r15, %r14 - -// Add row 2 - - movq $0xfffffffffffffffe, %rdx - xorq %r8, %r8 - mulpadd(%r11,%r10,(x)) - mulpadd(%r12,%r11,8(x)) - mulpadd(%r13,%r12,16(x)) - mulpadd(%r14,%r13,24(x)) - adcxq %r8, %r14 - adoxq %r8, %r15 - adcxq %r8, %r15 - -// Add row 3 - - movq $0x00000004fffffffd, %rdx - xorq %r9, %r9 - mulpadd(%r12,%r11,(x)) - mulpadd(%r13,%r12,8(x)) - mulpadd(%r14,%r13,16(x)) - mulpadd(%r15,%r14,24(x)) - adcxq %r9, %r15 - adoxq %r9, %r8 - adcxq %r9, %r8 - -// Montgomery reduce windows 2 and 3 together - - xorq %r9, %r9 - movq $0x0000000100000000, %rdx - mulpadd(%r12,%r11,%r10) - mulpadd(%r13,%r12,%r11) - movq $0xffffffff00000001, %rdx - mulpadd(%r14,%r13,%r10) - mulpadd(%r15,%r14,%r11) - adcxq %r9, %r15 - adoxq %r9, %r8 - adcxq %r9, %r8 - -// We now have a pre-reduced 5-word form [%r8; %r15;%r14;%r13;%r12] -// Load non-trivial digits of p_256 = [v; 0; u; -1] - - movl $0x00000000ffffffff, ushort - movq $0xffffffff00000001, v - -// Now do the subtraction (0,p_256-1) - (%r8,%r15,%r14,%r13,%r12) to get the carry - - movq $-2, d - subq %r12, d - movq u, d - sbbq %r13, d - movl $0, dshort - sbbq %r14, d - movq v, d - sbbq %r15, d - -// This last last comparison in the chain will actually even set the mask -// for us, so we don't need to separately create it from the carry. -// This means p_256 - 1 < (c,d1,d0,d5,d4), i.e. we are so far >= p_256 - - movl $0, dshort - sbbq %r8, d - andq d, u - andq d, v - -// Do a masked subtraction of p_256 and write back - - subq d, %r12 - sbbq u, %r13 - sbbq $0, %r14 - sbbq v, %r15 - - movq %r12, (z) - movq %r13, 8(z) - movq %r14, 16(z) - movq %r15, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_tomont_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_tomont_p256_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_tomont_p256_alt.S deleted file mode 100644 index 6e5719a730a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_tomont_p256_alt.S +++ /dev/null @@ -1,203 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert to Montgomery form z := (2^256 * x) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_tomont_p256_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tomont_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tomont_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tomont_p256_alt) - .text - -#define z %rdi -#define x %rsi - -// Add %rcx * m into a register-pair (high,low) maintaining consistent -// carry-catching with carry (negated, as bitmask) and using %rax and %rdx -// as temporaries - -#define mulpadd(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rcx; \ - subq carry, %rdx ; \ - addq %rax, low ; \ - adcq %rdx, high ; \ - sbbq carry, carry - -// Initial version assuming no carry-in - -#define mulpadi(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rcx; \ - addq %rax, low ; \ - adcq %rdx, high ; \ - sbbq carry, carry - -// End version not catching the top carry-out - -#define mulpade(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rcx; \ - subq carry, %rdx ; \ - addq %rax, low ; \ - adcq %rdx, high - -S2N_BN_SYMBOL(bignum_tomont_p256_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Do row 0 computation, which is a bit different: -// set up initial window [%r12,%r11,%r10,%r9,%r8] = y[0] * x -// Unlike later, we only need a single carry chain - - movl $0x0000000000000003, %ecx - movq (x), %rax - mulq %rcx - movq %rax, %r8 - movq %rdx, %r9 - - movq 8(x), %rax - mulq %rcx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - - movq 16(x), %rax - mulq %rcx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - - movq 24(x), %rax - mulq %rcx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - -// Add row 1 - - movq $0xfffffffbffffffff, %rcx - xorl %r13d, %r13d - mulpadi(%r14,%r10,%r9,(x)) - mulpadd(%r14,%r11,%r10,8(x)) - mulpadd(%r14,%r12,%r11,16(x)) - mulpade(%r14,%r13,%r12,24(x)) - -// Montgomery reduce windows 0 and 1 together - - xorl %r14d, %r14d - movq $0x0000000100000000, %rcx - mulpadi(%r15,%r10,%r9,%r8) - mulpadd(%r15,%r11,%r10,%r9) - notq %rcx - leaq 2(%rcx), %rcx - mulpadd(%r15,%r12,%r11,%r8) - mulpade(%r15,%r13,%r12,%r9) - adcq %r14, %r14 - -// Add row 2 - - movq $0xfffffffffffffffe, %rcx - xorl %r15d, %r15d - mulpadi(%r8,%r11,%r10,(x)) - mulpadd(%r8,%r12,%r11,8(x)) - mulpadd(%r8,%r13,%r12,16(x)) - mulpade(%r8,%r14,%r13,24(x)) - adcq %r15, %r15 - -// Add row 3 - - movq $0x00000004fffffffd, %rcx - xorl %r8d, %r8d - mulpadi(%r9,%r12,%r11,(x)) - mulpadd(%r9,%r13,%r12,8(x)) - mulpadd(%r9,%r14,%r13,16(x)) - mulpade(%r9,%r15,%r14,24(x)) - adcq %r8, %r8 - -// Montgomery reduce windows 2 and 3 together - - movq $0x0000000100000000, %rcx - mulpadi(%r9,%r12,%r11,%r10) - mulpadd(%r9,%r13,%r12,%r11) - notq %rcx - leaq 2(%rcx), %rcx - mulpadd(%r9,%r14,%r13,%r10) - mulpadd(%r9,%r15,%r14,%r11) - subq %r9, %r8 - -// We now have a pre-reduced 5-word form [%r8; %r15;%r14;%r13;%r12] -// Load [%rax;%r11;%r9;%rcx;%rdx] = 2^320 - p_256, re-using earlier numbers a bit -// Do [%rax;%r11;%r9;%rcx;%rdx] = [%r8;%r15;%r14;%r13;%r12] + (2^320 - p_256) - - xorl %edx, %edx - leaq -1(%rdx), %r9 - incq %rdx - addq %r12, %rdx - decq %rcx - adcq %r13, %rcx - movq %r9, %rax - adcq %r14, %r9 - movl $0x00000000fffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - -// Now carry is set if r + (2^320 - p_256) >= 2^320, i.e. r >= p_256 -// where r is the pre-reduced form. So conditionally select the -// output accordingly. - - cmovcq %rdx, %r12 - cmovcq %rcx, %r13 - cmovcq %r9, %r14 - cmovcq %r11, %r15 - -// Write back reduced value - - movq %r12, (z) - movq %r13, 8(z) - movq %r14, 16(z) - movq %r15, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_tomont_p256_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_triple_p256.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_triple_p256.S deleted file mode 100644 index 3fe7dc87823..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_triple_p256.S +++ /dev/null @@ -1,136 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_256, z := (3 * x) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_triple_p256(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// The input x can be any 4-digit bignum, not necessarily reduced modulo p_256, -// and the result is always fully reduced, i.e. z = (3 * x) mod p_256. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p256) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p256) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p256) - .text - -#define z %rdi -#define x %rsi - -// Main digits of intermediate results - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -// Quotient estimate = top of product + 1 - -#define q %rdx - -// Other temporary variables and their short version - -#define a %rax -#define c %rcx - -#define ashort %eax -#define cshort %ecx -#define qshort %edx - -S2N_BN_SYMBOL(bignum_triple_p256): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// First do the multiplication by 3, getting z = [h; d3; ...; d0] -// but immediately form the quotient estimate q = h + 1 - - xorl ashort, ashort - - movq (x), q - movq q, d0 - adcxq q, q - adoxq q, d0 - movq 8(x), q - movq q, d1 - adcxq q, q - adoxq q, d1 - movq 16(x), q - movq q, d2 - adcxq q, q - adoxq q, d2 - movq 24(x), q - movq q, d3 - adcxq q, q - adoxq q, d3 - -// For this limited range a simple quotient estimate of q = h + 1 works, where -// h = floor(z / 2^256). Then -p_256 <= z - q * p_256 < p_256, so we just need -// to subtract q * p_256 and then if that's negative, add back p_256. - - movl $1, qshort - adcxq a, q - adoxq a, q - -// Now compute the initial pre-reduced result z - p_256 * q -// = z - (2^256 - 2^224 + 2^192 + 2^96 - 1) * q -// = z - 2^192 * 0xffffffff00000001 * q - 2^64 * 0x0000000100000000 * q + q - - addq q, d0 - movq $0x0000000100000000, a - mulxq a, a, c - sbbq $0, a - sbbq $0, c - subq a, d1 - sbbq c, d2 - movq $0xffffffff00000001, a - mulxq a, a, c - sbbq a, d3 - sbbq c, q - -// q is now effectively the top word of the 5-digits result; this step -// compensates for q = h + 1 - - decq q - -// Use that as a bitmask for a masked addition of p_256 and write back - - movl $0x00000000ffffffff, ashort - andq q, a - xorl cshort, cshort - subq a, c - addq q, d0 - movq d0, (z) - adcq a, d1 - movq d1, 8(z) - adcq $0, d2 - movq d2, 16(z) - adcq c, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p256) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_triple_p256_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_triple_p256_alt.S deleted file mode 100644 index 5827b02f37f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/bignum_triple_p256_alt.S +++ /dev/null @@ -1,141 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_256, z := (3 * x) mod p_256 -// Input x[4]; output z[4] -// -// extern void bignum_triple_p256_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// The input x can be any 4-digit bignum, not necessarily reduced modulo p_256, -// and the result is always fully reduced, i.e. z = (3 * x) mod p_256. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p256_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p256_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p256_alt) - .text - -#define z %rdi -#define x %rsi - -// Main digits of intermediate results - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -// Quotient estimate = top of product + 1 - -#define q %rcx - -// Other temporary variables and their short version - -#define a %rax -#define c %rcx -#define d %rdx - -#define ashort %eax -#define cshort %ecx -#define qshort %ecx -#define dshort %edx - -S2N_BN_SYMBOL(bignum_triple_p256_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// First do the multiplication by 3, getting z = [h; d3; ...; d0] -// but immediately form the quotient estimate q = h + 1 - - movl $3, cshort - - movq (x), a - mulq c - movq a, d0 - movq d, d1 - - movq 8(x), a - xorq d2, d2 - mulq c - addq a, d1 - adcq d, d2 - - movq 16(x), a - xorq d3, d3 - mulq c - addq a, d2 - adcq d, d3 - - movq 24(x), a - mulq c - addq a, d3 - -// For this limited range a simple quotient estimate of q = h + 1 works, where -// h = floor(z / 2^256). Then -p_256 <= z - q * p_256 < p_256, so we just need -// to subtract q * p_256 and then if that's negative, add back p_256. - - movl $1, qshort - adcq d, q - -// Now compute the initial pre-reduced result z - p_256 * q -// = z - (2^256 - 2^224 + 2^192 + 2^96 - 1) * q -// = z - 2^192 * 0xffffffff00000001 * q - 2^64 * 0x0000000100000000 * q + q -// Since q is small just use q<<32 for 0x0000000100000000 * q. - - movq $0xffffffff00000001, a - mulq q - movq q, x - shlq $32, x - addq q, d0 - sbbq $0, x - subq x, d1 - sbbq $0, d2 - sbbq a, d3 - sbbq d, q - -// q is now effectively the top word of the 5-digit result; this step -// compensates for q = h + 1 - - decq q - -// Use that as a bitmask for a masked addition of p_256 and write back - - movl $0x00000000ffffffff, ashort - andq q, a - xorl dshort, dshort - subq a, d - addq q, d0 - movq d0, (z) - adcq a, d1 - movq d1, 8(z) - adcq $0, d2 - movq d2, 16(z) - adcq d, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p256_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjadd.S deleted file mode 100644 index a5f7d30ada5..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjadd.S +++ /dev/null @@ -1,593 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjadd(uint64_t p3[static 12], const uint64_t p1[static 12], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_montjadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjadd) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rbp = p2, -// which needs to be set up explicitly before use. -// The first two hold initially, and the second is -// set up by copying the initial %rdx input to %rbp. -// Thereafter, no code macro modifies any of them. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rbp) -#define y_2 NUMSIZE(%rbp) -#define z_2 (2*NUMSIZE)(%rbp) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z1sq (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define x1a (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define z2sq (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define y1a (NUMSIZE*6)(%rsp) - -#define NSPACE NUMSIZE*7 - -// Corresponds exactly to bignum_montmul_p256 - -#define montmul_p256(P0,P1,P2) \ - xorl %r13d, %r13d ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rbx, %r10 ; \ - adcq %rbx, %r9 ; \ - mulxq 0x10+P1, %rbx, %r11 ; \ - adcq %rbx, %r10 ; \ - mulxq 0x18+P1, %rbx, %r12 ; \ - adcq %rbx, %r11 ; \ - adcq %r13, %r12 ; \ - movq 0x8+P2, %rdx ; \ - xorl %r14d, %r14d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcq %r14, %r13 ; \ - xorl %r15d, %r15d ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - notq %rdx; \ - leaq 0x2(%rdx), %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %r15, %r13 ; \ - adoxq %r15, %r14 ; \ - adcq %r15, %r14 ; \ - movq 0x10+P2, %rdx ; \ - xorl %r8d, %r8d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adoxq %r8, %r14 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcq %rax, %r13 ; \ - adcq %rbx, %r14 ; \ - adcq %r8, %r15 ; \ - movq 0x18+P2, %rdx ; \ - xorl %r9d, %r9d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - adoxq %r9, %r15 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcq %rax, %r14 ; \ - adcq %rbx, %r15 ; \ - adcq %r9, %r8 ; \ - xorl %r9d, %r9d ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - notq %rdx; \ - leaq 0x2(%rdx), %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adcxq %r9, %r15 ; \ - adoxq %r9, %r8 ; \ - adcq %r9, %r8 ; \ - movl $0x1, %ecx ; \ - addq %r12, %rcx ; \ - decq %rdx; \ - adcq %r13, %rdx ; \ - decq %r9; \ - movq %r9, %rax ; \ - adcq %r14, %r9 ; \ - movl $0xfffffffe, %r11d ; \ - adcq %r15, %r11 ; \ - adcq %r8, %rax ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %r9, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_montsqr_p256 except for -// register tweaks to avoid modifying %rbp. - -#define montsqr_p256(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ecx, %ecx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r15 ; \ - xorl %ecx, %ecx ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - movabsq $0xffffffff00000001, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - movl %ecx, %r9d ; \ - adoxq %rcx, %r9 ; \ - adcxq %rcx, %r9 ; \ - addq %r9, %r14 ; \ - adcq %rcx, %r15 ; \ - movl %ecx, %r8d ; \ - adcq %rcx, %r8 ; \ - xorl %ecx, %ecx ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movabsq $0xffffffff00000001, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r8 ; \ - adcq %rcx, %r8 ; \ - movl $0x1, %ebx ; \ - addq %r12, %rbx ; \ - leaq -0x1(%rdx), %rdx ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rcx), %rcx ; \ - movq %rcx, %rax ; \ - adcq %r14, %rcx ; \ - movl $0xfffffffe, %r11d ; \ - adcq %r15, %r11 ; \ - adcq %r8, %rax ; \ - cmovbq %rbx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rcx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Almost-Montgomery variant which we use when an input to other muls -// with the other argument fully reduced (which is always safe). -// Again, the basic squaring code is tweaked to avoid modifying %rbp. - -#define amontsqr_p256(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ecx, %ecx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r15 ; \ - xorl %ecx, %ecx ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - movabsq $0xffffffff00000001, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - movl %ecx, %r9d ; \ - adoxq %rcx, %r9 ; \ - adcxq %rcx, %r9 ; \ - addq %r9, %r14 ; \ - adcq %rcx, %r15 ; \ - movl %ecx, %r8d ; \ - adcq %rcx, %r8 ; \ - xorl %ecx, %ecx ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movabsq $0xffffffff00000001, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r8 ; \ - adcq %rcx, %r8 ; \ - movl $0x1, %r8d ; \ - leaq -0x1(%rdx), %rdx ; \ - leaq -0x1(%rcx), %rax ; \ - movl $0xfffffffe, %r11d ; \ - cmovzq %rcx, %r8 ; \ - cmovzq %rcx, %rdx ; \ - cmovzq %rcx, %rax ; \ - cmovzq %rcx, %r11 ; \ - addq %r8, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %rax, %r14 ; \ - adcq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_sub_p256 - -#define sub_p256(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - sbbq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movl $0xffffffff, %r10d ; \ - sbbq %r11, %r11 ; \ - xorq %rdx, %rdx ; \ - andq %r11, %r10 ; \ - subq %r10, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// Additional macros to help with final multiplexing - -#define load4(r0,r1,r2,r3,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 - -#define store4(P,r0,r1,r2,r3) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P - -#define czload4(r0,r1,r2,r3,P) \ - cmovzq P, r0 ; \ - cmovzq 8+P, r1 ; \ - cmovzq 16+P, r2 ; \ - cmovzq 24+P, r3 - -#define muxload4(r0,r1,r2,r3,P0,P1,P2) \ - movq P0, r0 ; \ - cmovbq P1, r0 ; \ - cmovnbe P2, r0 ; \ - movq 8+P0, r1 ; \ - cmovbq 8+P1, r1 ; \ - cmovnbe 8+P2, r1 ; \ - movq 16+P0, r2 ; \ - cmovbq 16+P1, r2 ; \ - cmovnbe 16+P2, r2 ; \ - movq 24+P0, r3 ; \ - cmovbq 24+P1, r3 ; \ - cmovnbe 24+P2, r3 - -S2N_BN_SYMBOL(p256_montjadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input y in %rbp where it lasts as long as it's needed. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdx, %rbp - -// Main code, just a sequence of basic field operations -// 12 * multiply + 4 * square + 7 * subtract - - amontsqr_p256(z1sq,z_1) - amontsqr_p256(z2sq,z_2) - - montmul_p256(y1a,z_2,y_1) - montmul_p256(y2a,z_1,y_2) - - montmul_p256(x2a,z1sq,x_2) - montmul_p256(x1a,z2sq,x_1) - montmul_p256(y2a,z1sq,y2a) - montmul_p256(y1a,z2sq,y1a) - - sub_p256(xd,x2a,x1a) - sub_p256(yd,y2a,y1a) - - amontsqr_p256(zz,xd) - montsqr_p256(ww,yd) - - montmul_p256(zzx1,zz,x1a) - montmul_p256(zzx2,zz,x2a) - - sub_p256(resx,ww,zzx1) - sub_p256(t1,zzx2,zzx1) - - montmul_p256(xd,xd,z_1) - - sub_p256(resx,resx,zzx2) - - sub_p256(t2,zzx1,resx) - - montmul_p256(t1,t1,y1a) - - montmul_p256(resz,xd,z_2) - montmul_p256(t2,yd,t2) - - sub_p256(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "NBE" <=> ~(CF \/ ZF) <=> P1 = 0 /\ ~(P2 = 0) -// and "B" <=> CF <=> ~(P1 = 0) /\ P2 = 0 -// and "Z" <=> ZF <=> (P1 = 0 <=> P2 = 0) - - load4(%r8,%r9,%r10,%r11,z_1) - - movq %r8, %rax - movq %r9, %rdx - orq %r10, %rax - orq %r11, %rdx - orq %rdx, %rax - negq %rax - sbbq %rax, %rax - - load4(%r12,%r13,%r14,%r15,z_2) - - movq %r12, %rbx - movq %r13, %rdx - orq %r14, %rbx - orq %r15, %rdx - orq %rdx, %rbx - negq %rbx - sbbq %rbx, %rbx - - cmpq %rax, %rbx - -// Multiplex the outputs accordingly, re-using the z's in registers - - cmovbq %r8, %r12 - cmovbq %r9, %r13 - cmovbq %r10, %r14 - cmovbq %r11, %r15 - - czload4(%r12,%r13,%r14,%r15,resz) - - muxload4(%rax,%rbx,%rcx,%rdx,resx,x_1,x_2) - muxload4(%r8,%r9,%r10,%r11,resy,y_1,y_2) - -// Finally store back the multiplexed values - - store4(x_3,%rax,%rbx,%rcx,%rdx) - store4(y_3,%r8,%r9,%r10,%r11) - store4(z_3,%r12,%r13,%r14,%r15) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_montjadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjadd_alt.S deleted file mode 100644 index 0297e6d3633..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjadd_alt.S +++ /dev/null @@ -1,579 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjadd_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_montjadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjadd_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rbp = p2, -// which needs to be set up explicitly before use. -// The first two hold initially, and the second is -// set up by copying the initial %rdx input to %rbp. -// Thereafter, no code macro modifies any of them. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rbp) -#define y_2 NUMSIZE(%rbp) -#define z_2 (2*NUMSIZE)(%rbp) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z1sq (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define x1a (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define z2sq (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define y1a (NUMSIZE*6)(%rsp) - -#define NSPACE NUMSIZE*7 - -// Corresponds exactly to bignum_montmul_p256_alt - -#define montmul_p256(P0,P1,P2) \ - movq P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - xorl %r10d, %r10d ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - xorl %r11d, %r11d ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - xorl %r12d, %r12d ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - movq 0x8+P2, %rbx ; \ - xorl %r13d, %r13d ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r14, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r14, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r14, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r14, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - xorl %r14d, %r14d ; \ - movq $0x100000000, %rbx ; \ - movq %r8, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %r15, %r15 ; \ - movq %r9, %rax ; \ - mulq %rbx; \ - subq %r15, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r15, %r15 ; \ - notq %rbx; \ - leaq 0x2(%rbx), %rbx ; \ - movq %r8, %rax ; \ - mulq %rbx; \ - subq %r15, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r15, %r15 ; \ - movq %r9, %rax ; \ - mulq %rbx; \ - subq %r15, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P2, %rbx ; \ - xorl %r15d, %r15d ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r8, %r8 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r8, %r8 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r8, %r8 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P2, %rbx ; \ - xorl %r8d, %r8d ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r9, %r9 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r9, %r9 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r9, %r9 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r8, %r8 ; \ - xorl %r9d, %r9d ; \ - movq $0x100000000, %rbx ; \ - movq %r10, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - movq %r11, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %rcx, %rcx ; \ - notq %rbx; \ - leaq 0x2(%rbx), %rbx ; \ - movq %r10, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %rcx, %rcx ; \ - movq %r11, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r9, %r8 ; \ - movl $0x1, %ecx ; \ - addq %r12, %rcx ; \ - decq %rbx; \ - adcq %r13, %rbx ; \ - decq %r9; \ - movq %r9, %rax ; \ - adcq %r14, %r9 ; \ - movl $0xfffffffe, %r11d ; \ - adcq %r15, %r11 ; \ - adcq %r8, %rax ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rbx, %r13 ; \ - cmovbq %r9, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_montsqr_p256_alt - -#define montsqr_p256(P0,P1) \ - movq P1, %rax ; \ - movq %rax, %rbx ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r15 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r9 ; \ - movq %rdx, %r10 ; \ - movq 0x18+P1, %rax ; \ - movq %rax, %r13 ; \ - mulq %rbx; \ - movq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - movq 0x10+P1, %rax ; \ - movq %rax, %rbx ; \ - mulq %r13; \ - movq %rax, %r13 ; \ - movq %rdx, %r14 ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - movq 0x18+P1, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorl %ecx, %ecx ; \ - addq %r9, %r9 ; \ - adcq %r10, %r10 ; \ - adcq %r11, %r11 ; \ - adcq %r12, %r12 ; \ - adcq %r13, %r13 ; \ - adcq %r14, %r14 ; \ - adcq %rcx, %rcx ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %r15, %r9 ; \ - adcq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - negq %r15; \ - adcq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - negq %r15; \ - adcq %rax, %r14 ; \ - adcq %rcx, %rdx ; \ - movq %rdx, %r15 ; \ - movq $0x100000000, %rbx ; \ - movq %r8, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r9, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - notq %rbx; \ - leaq 0x2(%rbx), %rbx ; \ - movq %r8, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - xorl %r8d, %r8d ; \ - movq %r9, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r8, %r14 ; \ - adcq %r8, %r15 ; \ - adcq %r8, %r8 ; \ - movq $0x100000000, %rbx ; \ - movq %r10, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - movq %r11, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %rcx, %rcx ; \ - notq %rbx; \ - leaq 0x2(%rbx), %rbx ; \ - movq %r10, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %rcx, %rcx ; \ - xorl %r9d, %r9d ; \ - movq %r11, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r9, %r8 ; \ - movl $0x1, %ecx ; \ - addq %r12, %rcx ; \ - leaq -0x1(%rbx), %rbx ; \ - adcq %r13, %rbx ; \ - leaq -0x1(%r9), %r9 ; \ - movq %r9, %rax ; \ - adcq %r14, %r9 ; \ - movl $0xfffffffe, %r11d ; \ - adcq %r15, %r11 ; \ - adcq %r8, %rax ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rbx, %r13 ; \ - cmovbq %r9, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_sub_p256 - -#define sub_p256(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - sbbq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movl $0xffffffff, %r10d ; \ - sbbq %r11, %r11 ; \ - xorq %rdx, %rdx ; \ - andq %r11, %r10 ; \ - subq %r10, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// Additional macros to help with final multiplexing - -#define load4(r0,r1,r2,r3,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 - -#define store4(P,r0,r1,r2,r3) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P - -#define czload4(r0,r1,r2,r3,P) \ - cmovzq P, r0 ; \ - cmovzq 8+P, r1 ; \ - cmovzq 16+P, r2 ; \ - cmovzq 24+P, r3 - -#define muxload4(r0,r1,r2,r3,P0,P1,P2) \ - movq P0, r0 ; \ - cmovbq P1, r0 ; \ - cmovnbe P2, r0 ; \ - movq 8+P0, r1 ; \ - cmovbq 8+P1, r1 ; \ - cmovnbe 8+P2, r1 ; \ - movq 16+P0, r2 ; \ - cmovbq 16+P1, r2 ; \ - cmovnbe 16+P2, r2 ; \ - movq 24+P0, r3 ; \ - cmovbq 24+P1, r3 ; \ - cmovnbe 24+P2, r3 - -S2N_BN_SYMBOL(p256_montjadd_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input y in %rbp where it lasts as long as it's needed. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdx, %rbp - -// Main code, just a sequence of basic field operations -// 12 * multiply + 4 * square + 7 * subtract - - montsqr_p256(z1sq,z_1) - montsqr_p256(z2sq,z_2) - - montmul_p256(y1a,z_2,y_1) - montmul_p256(y2a,z_1,y_2) - - montmul_p256(x2a,z1sq,x_2) - montmul_p256(x1a,z2sq,x_1) - montmul_p256(y2a,z1sq,y2a) - montmul_p256(y1a,z2sq,y1a) - - sub_p256(xd,x2a,x1a) - sub_p256(yd,y2a,y1a) - - montsqr_p256(zz,xd) - montsqr_p256(ww,yd) - - montmul_p256(zzx1,zz,x1a) - montmul_p256(zzx2,zz,x2a) - - sub_p256(resx,ww,zzx1) - sub_p256(t1,zzx2,zzx1) - - montmul_p256(xd,xd,z_1) - - sub_p256(resx,resx,zzx2) - - sub_p256(t2,zzx1,resx) - - montmul_p256(t1,t1,y1a) - - montmul_p256(resz,xd,z_2) - montmul_p256(t2,yd,t2) - - sub_p256(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "NBE" <=> ~(CF \/ ZF) <=> P1 = 0 /\ ~(P2 = 0) -// and "B" <=> CF <=> ~(P1 = 0) /\ P2 = 0 -// and "Z" <=> ZF <=> (P1 = 0 <=> P2 = 0) - - load4(%r8,%r9,%r10,%r11,z_1) - - movq %r8, %rax - movq %r9, %rdx - orq %r10, %rax - orq %r11, %rdx - orq %rdx, %rax - negq %rax - sbbq %rax, %rax - - load4(%r12,%r13,%r14,%r15,z_2) - - movq %r12, %rbx - movq %r13, %rdx - orq %r14, %rbx - orq %r15, %rdx - orq %rdx, %rbx - negq %rbx - sbbq %rbx, %rbx - - cmpq %rax, %rbx - -// Multiplex the outputs accordingly, re-using the z's in registers - - cmovbq %r8, %r12 - cmovbq %r9, %r13 - cmovbq %r10, %r14 - cmovbq %r11, %r15 - - czload4(%r12,%r13,%r14,%r15,resz) - - muxload4(%rax,%rbx,%rcx,%rdx,resx,x_1,x_2) - muxload4(%r8,%r9,%r10,%r11,resy,y_1,y_2) - -// Finally store back the multiplexed values - - store4(x_3,%rax,%rbx,%rcx,%rdx) - store4(y_3,%r8,%r9,%r10,%r11) - store4(z_3,%r12,%r13,%r14,%r15) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_montjadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjdouble.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjdouble.S deleted file mode 100644 index 78f2886ccfa..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjdouble.S +++ /dev/null @@ -1,634 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjdouble(uint64_t p3[static 12], -// const uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard x86-64 ABI: RDI = p3, RSI = p1 -// Microsoft x64 ABI: RCX = p3, RDX = p1 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjdouble) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_montjdouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjdouble) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1, which is true when the -// arguments come in initially and is not disturbed throughout. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z2 (NUMSIZE*0)(%rsp) -#define y4 (NUMSIZE*0)(%rsp) - -#define y2 (NUMSIZE*1)(%rsp) - -#define t1 (NUMSIZE*2)(%rsp) - -#define t2 (NUMSIZE*3)(%rsp) -#define x2p (NUMSIZE*3)(%rsp) -#define dx2 (NUMSIZE*3)(%rsp) - -#define xy2 (NUMSIZE*4)(%rsp) - -#define x4p (NUMSIZE*5)(%rsp) -#define d (NUMSIZE*5)(%rsp) - -#define NSPACE NUMSIZE*6 - -// Corresponds exactly to bignum_montmul_p256 - -#define montmul_p256(P0,P1,P2) \ - xorl %r13d, %r13d ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rbx, %r10 ; \ - adcq %rbx, %r9 ; \ - mulxq 0x10+P1, %rbx, %r11 ; \ - adcq %rbx, %r10 ; \ - mulxq 0x18+P1, %rbx, %r12 ; \ - adcq %rbx, %r11 ; \ - adcq %r13, %r12 ; \ - movq 0x8+P2, %rdx ; \ - xorl %r14d, %r14d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcq %r14, %r13 ; \ - xorl %r15d, %r15d ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - notq %rdx; \ - leaq 0x2(%rdx), %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %r15, %r13 ; \ - adoxq %r15, %r14 ; \ - adcq %r15, %r14 ; \ - movq 0x10+P2, %rdx ; \ - xorl %r8d, %r8d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adoxq %r8, %r14 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcq %rax, %r13 ; \ - adcq %rbx, %r14 ; \ - adcq %r8, %r15 ; \ - movq 0x18+P2, %rdx ; \ - xorl %r9d, %r9d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - adoxq %r9, %r15 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcq %rax, %r14 ; \ - adcq %rbx, %r15 ; \ - adcq %r9, %r8 ; \ - xorl %r9d, %r9d ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - notq %rdx; \ - leaq 0x2(%rdx), %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adcxq %r9, %r15 ; \ - adoxq %r9, %r8 ; \ - adcq %r9, %r8 ; \ - movl $0x1, %ecx ; \ - addq %r12, %rcx ; \ - decq %rdx; \ - adcq %r13, %rdx ; \ - decq %r9; \ - movq %r9, %rax ; \ - adcq %r14, %r9 ; \ - movl $0xfffffffe, %r11d ; \ - adcq %r15, %r11 ; \ - adcq %r8, %rax ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %r9, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_montsqr_p256 - -#define montsqr_p256(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rbp, %r13 ; \ - adoxq %rbp, %r14 ; \ - adcq %rbp, %r14 ; \ - xorl %ebp, %ebp ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rbp, %r15 ; \ - adoxq %rbp, %r15 ; \ - xorl %ebp, %ebp ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - movabsq $0xffffffff00000001, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rbp, %r13 ; \ - movl %ebp, %r9d ; \ - adoxq %rbp, %r9 ; \ - adcxq %rbp, %r9 ; \ - addq %r9, %r14 ; \ - adcq %rbp, %r15 ; \ - movl %ebp, %r8d ; \ - adcq %rbp, %r8 ; \ - xorl %ebp, %ebp ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movabsq $0xffffffff00000001, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adcxq %rbp, %r15 ; \ - adoxq %rbp, %r8 ; \ - adcq %rbp, %r8 ; \ - movl $0x1, %ecx ; \ - addq %r12, %rcx ; \ - leaq -0x1(%rdx), %rdx ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbp), %rbp ; \ - movq %rbp, %rax ; \ - adcq %r14, %rbp ; \ - movl $0xfffffffe, %r11d ; \ - adcq %r15, %r11 ; \ - adcq %r8, %rax ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbp, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_sub_p256 - -#define sub_p256(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - sbbq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movl $0xffffffff, %r10d ; \ - sbbq %r11, %r11 ; \ - xorq %rdx, %rdx ; \ - andq %r11, %r10 ; \ - subq %r10, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// Corresponds exactly to bignum_add_p256 - -#define add_p256(P0,P1,P2) \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - adcq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - adcq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - adcq 0x18+P2, %r9 ; \ - adcq %r11, %r11 ; \ - subq $0xffffffffffffffff, %rax ; \ - movl $0xffffffff, %r10d ; \ - sbbq %r10, %rcx ; \ - sbbq $0x0, %r8 ; \ - movq $0xffffffff00000001, %rdx ; \ - sbbq %rdx, %r9 ; \ - sbbq $0x0, %r11 ; \ - andq %r11, %r10 ; \ - andq %r11, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// A weak version of add that only guarantees sum in 4 digits - -#define weakadd_p256(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - adcq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - adcq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - adcq 0x18+P2, %r9 ; \ - movl $0xffffffff, %r10d ; \ - sbbq %r11, %r11 ; \ - xorq %rdx, %rdx ; \ - andq %r11, %r10 ; \ - subq %r10, %rdx ; \ - subq %r11, %rax ; \ - movq %rax, P0 ; \ - sbbq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - sbbq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - sbbq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// P0 = C * P1 - D * P2 computed as d * (p_256 - P2) + c * P1 -// Quotient estimation is done just as q = h + 1 as in bignum_triple_p256 -// This also applies to the other functions following. - -#define cmsub_p256(P0,C,P1,D,P2) \ - /* First (%r11;%r10;%r9;%r8) = p_256 - P2 */ \ - movq $0xffffffffffffffff, %r8 ; \ - xorl %r10d, %r10d ; \ - subq P2, %r8 ; \ - movq $0x00000000ffffffff, %r9 ; \ - sbbq 0x8+P2, %r9 ; \ - sbbq 0x10+P2, %r10 ; \ - movq $0xffffffff00000001, %r11 ; \ - sbbq 0x18+P2, %r11 ; \ - /* (%r12;%r11;%r10;%r9;%r8) = D * (p_256 - P2) */ \ - xorl %r12d, %r12d ; \ - movq $D, %rdx ; \ - mulxq %r8, %r8, %rax ; \ - mulxq %r9, %r9, %rcx ; \ - addq %rax, %r9 ; \ - mulxq %r10, %r10, %rax ; \ - adcq %rcx, %r10 ; \ - mulxq %r11, %r11, %rcx ; \ - adcq %rax, %r11 ; \ - adcq %rcx, %r12 ; \ - /* (%rdx;%r11;%r10;%r9;%r8) = 2^256 + C * P1 + D * (p_256 - P2) */ \ - movq $C, %rdx ; \ - xorl %eax, %eax ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq 0x10+P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x18+P1, %rax, %rdx ; \ - adcxq %rax, %r11 ; \ - adoxq %r12, %rdx ; \ - adcq $1, %rdx ; \ - /* Now the tail for modular reduction from tripling */ \ - addq %rdx, %r8 ; \ - movq $0x100000000, %rax ; \ - mulxq %rax, %rax, %rcx ; \ - sbbq $0x0, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rax, %rcx ; \ - sbbq %rax, %r11 ; \ - sbbq %rcx, %rdx ; \ - decq %rdx; \ - movl $0xffffffff, %eax ; \ - andq %rdx, %rax ; \ - xorl %ecx, %ecx ; \ - subq %rax, %rcx ; \ - addq %rdx, %r8 ; \ - movq %r8, P0 ; \ - adcq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - adcq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - adcq %rcx, %r11 ; \ - movq %r11, 0x18+P0 - -// P0 = 3 * P1 - 8 * P2, computed as (p_256 - P2) << 3 + 3 * P1 - -#define cmsub38_p256(P0,P1,P2) \ - /* First (%r11;%r10;%r9;%r8) = p_256 - P2 */ \ - movq $0xffffffffffffffff, %r8 ; \ - xorl %r10d, %r10d ; \ - subq P2, %r8 ; \ - movq $0x00000000ffffffff, %r9 ; \ - sbbq 0x8+P2, %r9 ; \ - sbbq 0x10+P2, %r10 ; \ - movq $0xffffffff00000001, %r11 ; \ - sbbq 0x18+P2, %r11 ; \ - /* (%r12;%r11;%r10;%r9;%r8) = (p_256 - P2) << 3 */ \ - movq %r11, %r12 ; \ - shldq $3, %r10, %r11 ; \ - shldq $3, %r9, %r10 ; \ - shldq $3, %r8, %r9 ; \ - shlq $3, %r8 ; \ - shrq $61, %r12 ; \ - /* (%rdx;%r11;%r10;%r9;%r8) = 2^256 + 3 * P1 + 8 * (p_256 - P2) */ \ - movq $3, %rdx ; \ - xorl %eax, %eax ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq 0x10+P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x18+P1, %rax, %rdx ; \ - adcxq %rax, %r11 ; \ - adoxq %r12, %rdx ; \ - adcq $1, %rdx ; \ - /* Now the tail for modular reduction from tripling */ \ - addq %rdx, %r8 ; \ - movq $0x100000000, %rax ; \ - mulxq %rax, %rax, %rcx ; \ - sbbq $0x0, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rax, %rcx ; \ - sbbq %rax, %r11 ; \ - sbbq %rcx, %rdx ; \ - decq %rdx; \ - movl $0xffffffff, %eax ; \ - andq %rdx, %rax ; \ - xorl %ecx, %ecx ; \ - subq %rax, %rcx ; \ - addq %rdx, %r8 ; \ - movq %r8, P0 ; \ - adcq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - adcq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - adcq %rcx, %r11 ; \ - movq %r11, 0x18+P0 - -// P0 = 4 * P1 - P2, by direct subtraction of P2, -// since the quotient estimate still works safely -// for initial value > -p_256 - -#define cmsub41_p256(P0,P1,P2) \ - movq 0x18+P1, %r11 ; \ - movq %r11, %rdx ; \ - movq 0x10+P1, %r10 ; \ - shldq $2, %r10, %r11 ; \ - movq 0x8+P1, %r9 ; \ - shldq $2, %r9, %r10 ; \ - movq P1, %r8 ; \ - shldq $2, %r8, %r9 ; \ - shlq $2, %r8 ; \ - shrq $62, %rdx ; \ - addq $1, %rdx ; \ - subq P2, %r8 ; \ - sbbq 0x8+P2, %r9 ; \ - sbbq 0x10+P2, %r10 ; \ - sbbq 0x18+P2, %r11 ; \ - sbbq $0, %rdx ; \ - /* Now the tail for modular reduction from tripling */ \ - addq %rdx, %r8 ; \ - movq $0x100000000, %rax ; \ - mulxq %rax, %rax, %rcx ; \ - sbbq $0x0, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rax, %rcx ; \ - sbbq %rax, %r11 ; \ - sbbq %rcx, %rdx ; \ - decq %rdx; \ - movl $0xffffffff, %eax ; \ - andq %rdx, %rax ; \ - xorl %ecx, %ecx ; \ - subq %rax, %rcx ; \ - addq %rdx, %r8 ; \ - movq %r8, P0 ; \ - adcq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - adcq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - adcq %rcx, %r11 ; \ - movq %r11, 0x18+P0 - -S2N_BN_SYMBOL(p256_montjdouble): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers and make room on stack for temporary variables - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main code, just a sequence of basic field operations - -// z2 = z^2 -// y2 = y^2 - - montsqr_p256(z2,z_1) - montsqr_p256(y2,y_1) - -// x2p = x^2 - z^4 = (x + z^2) * (x - z^2) - - sub_p256(t2,x_1,z2) - weakadd_p256(t1,x_1,z2) - montmul_p256(x2p,t1,t2) - -// t1 = y + z -// xy2 = x * y^2 -// x4p = x2p^2 - - add_p256(t1,y_1,z_1) - montmul_p256(xy2,x_1,y2) - montsqr_p256(x4p,x2p) - -// t1 = (y + z)^2 - - montsqr_p256(t1,t1) - -// d = 12 * xy2 - 9 * x4p -// t1 = y^2 + 2 * y * z - - cmsub_p256(d,12,xy2,9,x4p) - sub_p256(t1,t1,z2) - -// y4 = y^4 - - montsqr_p256(y4,y2) - -// dx2 = d * x2p - - montmul_p256(dx2,d,x2p) - -// z_3' = 2 * y * z - - sub_p256(z_3,t1,y2) - -// x' = 4 * xy2 - d - - cmsub41_p256(x_3,xy2,d) - -// y' = 3 * dx2 - 8 * y4 - - cmsub38_p256(y_3,dx2,y4) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_montjdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjdouble_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjdouble_alt.S deleted file mode 100644 index 79a58a1eb71..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjdouble_alt.S +++ /dev/null @@ -1,747 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjdouble_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard x86-64 ABI: RDI = p3, RSI = p1 -// Microsoft x64 ABI: RCX = p3, RDX = p1 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjdouble_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_montjdouble_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjdouble_alt) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1, which is true when the -// arguments come in initially and is not disturbed throughout. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z2 (NUMSIZE*0)(%rsp) -#define y4 (NUMSIZE*0)(%rsp) - -#define y2 (NUMSIZE*1)(%rsp) - -#define t1 (NUMSIZE*2)(%rsp) - -#define t2 (NUMSIZE*3)(%rsp) -#define x2p (NUMSIZE*3)(%rsp) -#define dx2 (NUMSIZE*3)(%rsp) - -#define xy2 (NUMSIZE*4)(%rsp) - -#define x4p (NUMSIZE*5)(%rsp) -#define d (NUMSIZE*5)(%rsp) - -#define NSPACE NUMSIZE*6 - -// Corresponds exactly to bignum_montmul_p256_alt - -#define montmul_p256(P0,P1,P2) \ - movq P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - xorl %r10d, %r10d ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - xorl %r11d, %r11d ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - xorl %r12d, %r12d ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - movq 0x8+P2, %rbx ; \ - xorl %r13d, %r13d ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r14, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r14, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r14, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r14, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - xorl %r14d, %r14d ; \ - movq $0x100000000, %rbx ; \ - movq %r8, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %r15, %r15 ; \ - movq %r9, %rax ; \ - mulq %rbx; \ - subq %r15, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r15, %r15 ; \ - notq %rbx; \ - leaq 0x2(%rbx), %rbx ; \ - movq %r8, %rax ; \ - mulq %rbx; \ - subq %r15, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r15, %r15 ; \ - movq %r9, %rax ; \ - mulq %rbx; \ - subq %r15, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P2, %rbx ; \ - xorl %r15d, %r15d ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r8, %r8 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r8, %r8 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r8, %r8 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P2, %rbx ; \ - xorl %r8d, %r8d ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r9, %r9 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r9, %r9 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r9, %r9 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r8, %r8 ; \ - xorl %r9d, %r9d ; \ - movq $0x100000000, %rbx ; \ - movq %r10, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - movq %r11, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %rcx, %rcx ; \ - notq %rbx; \ - leaq 0x2(%rbx), %rbx ; \ - movq %r10, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %rcx, %rcx ; \ - movq %r11, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r9, %r8 ; \ - movl $0x1, %ecx ; \ - addq %r12, %rcx ; \ - decq %rbx; \ - adcq %r13, %rbx ; \ - decq %r9; \ - movq %r9, %rax ; \ - adcq %r14, %r9 ; \ - movl $0xfffffffe, %r11d ; \ - adcq %r15, %r11 ; \ - adcq %r8, %rax ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rbx, %r13 ; \ - cmovbq %r9, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_montsqr_p256_alt - -#define montsqr_p256(P0,P1) \ - movq P1, %rax ; \ - movq %rax, %rbx ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r15 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r9 ; \ - movq %rdx, %r10 ; \ - movq 0x18+P1, %rax ; \ - movq %rax, %r13 ; \ - mulq %rbx; \ - movq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - movq 0x10+P1, %rax ; \ - movq %rax, %rbx ; \ - mulq %r13; \ - movq %rax, %r13 ; \ - movq %rdx, %r14 ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - movq 0x18+P1, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorl %ecx, %ecx ; \ - addq %r9, %r9 ; \ - adcq %r10, %r10 ; \ - adcq %r11, %r11 ; \ - adcq %r12, %r12 ; \ - adcq %r13, %r13 ; \ - adcq %r14, %r14 ; \ - adcq %rcx, %rcx ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %r15, %r9 ; \ - adcq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - negq %r15; \ - adcq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - negq %r15; \ - adcq %rax, %r14 ; \ - adcq %rcx, %rdx ; \ - movq %rdx, %r15 ; \ - movq $0x100000000, %rbx ; \ - movq %r8, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r9, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - notq %rbx; \ - leaq 0x2(%rbx), %rbx ; \ - movq %r8, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - xorl %r8d, %r8d ; \ - movq %r9, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r8, %r14 ; \ - adcq %r8, %r15 ; \ - adcq %r8, %r8 ; \ - movq $0x100000000, %rbx ; \ - movq %r10, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - movq %r11, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %rcx, %rcx ; \ - notq %rbx; \ - leaq 0x2(%rbx), %rbx ; \ - movq %r10, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %rcx, %rcx ; \ - xorl %r9d, %r9d ; \ - movq %r11, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r9, %r8 ; \ - movl $0x1, %ecx ; \ - addq %r12, %rcx ; \ - leaq -0x1(%rbx), %rbx ; \ - adcq %r13, %rbx ; \ - leaq -0x1(%r9), %r9 ; \ - movq %r9, %rax ; \ - adcq %r14, %r9 ; \ - movl $0xfffffffe, %r11d ; \ - adcq %r15, %r11 ; \ - adcq %r8, %rax ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rbx, %r13 ; \ - cmovbq %r9, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_sub_p256 - -#define sub_p256(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - sbbq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movl $0xffffffff, %r10d ; \ - sbbq %r11, %r11 ; \ - xorq %rdx, %rdx ; \ - andq %r11, %r10 ; \ - subq %r10, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// Corresponds exactly to bignum_add_p256 - -#define add_p256(P0,P1,P2) \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - adcq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - adcq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - adcq 0x18+P2, %r9 ; \ - adcq %r11, %r11 ; \ - subq $0xffffffffffffffff, %rax ; \ - movl $0xffffffff, %r10d ; \ - sbbq %r10, %rcx ; \ - sbbq $0x0, %r8 ; \ - movq $0xffffffff00000001, %rdx ; \ - sbbq %rdx, %r9 ; \ - sbbq $0x0, %r11 ; \ - andq %r11, %r10 ; \ - andq %r11, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// A weak version of add that only guarantees sum in 4 digits - -#define weakadd_p256(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - adcq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - adcq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - adcq 0x18+P2, %r9 ; \ - movl $0xffffffff, %r10d ; \ - sbbq %r11, %r11 ; \ - xorq %rdx, %rdx ; \ - andq %r11, %r10 ; \ - subq %r10, %rdx ; \ - subq %r11, %rax ; \ - movq %rax, P0 ; \ - sbbq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - sbbq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - sbbq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// P0 = C * P1 - D * P2 computed as d * (p_256 - P2) + c * P1 -// Quotient estimation is done just as q = h + 1 as in bignum_triple_p256_alt. -// This also applies to the other functions following. - -#define cmsub_p256(P0,C,P1,D,P2) \ - /* First (%r12;%r11;%r10;%r9) = p_256 - P2 */ \ - movq $0xffffffffffffffff, %r9 ; \ - xorl %r11d, %r11d ; \ - subq P2, %r9 ; \ - movq $0x00000000ffffffff, %r10 ; \ - sbbq 0x8+P2, %r10 ; \ - sbbq 0x10+P2, %r11 ; \ - movq $0xffffffff00000001, %r12 ; \ - sbbq 0x18+P2, %r12 ; \ - /* (%r12;%r11;%r10;%r9;%r8) = D * (p_256 - P2) */ \ - movq $D, %rcx ; \ - movq %r9, %rax ; \ - mulq %rcx; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - movq %r10, %rax ; \ - xorl %r10d, %r10d ; \ - mulq %rcx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq %r11, %rax ; \ - xorl %r11d, %r11d ; \ - mulq %rcx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - movq %r12, %rax ; \ - xorl %r12d, %r12d ; \ - mulq %rcx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - /* (%rcx;%r11;%r10;%r9;%r8) = 2^256 + C * P1 + D * (p_256 - P2) */ \ - movl $C, %ecx ; \ - movq P1, %rax ; \ - mulq %rcx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rbx, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rbx, %rbx ; \ - movq 0x10+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rbx, %rbx ; \ - movq 0x18+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - leaq 1(%r12), %rcx ; \ - /* Now the tail for modular reduction from tripling */ \ - movq $0xffffffff00000001, %rax ; \ - mulq %rcx; \ - movq %rcx, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %rcx, %r8 ; \ - sbbq $0x0, %rbx ; \ - subq %rbx, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq %rax, %r11 ; \ - sbbq %rdx, %rcx ; \ - decq %rcx; \ - movl $0xffffffff, %eax ; \ - andq %rcx, %rax ; \ - xorl %edx, %edx ; \ - subq %rax, %rdx ; \ - addq %rcx, %r8 ; \ - movq %r8, P0 ; \ - adcq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - adcq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - adcq %rdx, %r11 ; \ - movq %r11, 0x18+P0 - -// P0 = 3 * P1 - 8 * P2, computed as (p_256 - P2) << 3 + 3 * P1 - -#define cmsub38_p256(P0,P1,P2) \ - /* First (%r11;%r10;%r9;%r8) = p_256 - P2 */ \ - movq $0xffffffffffffffff, %r8 ; \ - xorl %r10d, %r10d ; \ - subq P2, %r8 ; \ - movq $0x00000000ffffffff, %r9 ; \ - sbbq 0x8+P2, %r9 ; \ - sbbq 0x10+P2, %r10 ; \ - movq $0xffffffff00000001, %r11 ; \ - sbbq 0x18+P2, %r11 ; \ - /* (%r12;%r11;%r10;%r9;%r8) = (p_256 - P2) << 3 */ \ - movq %r11, %r12 ; \ - shldq $3, %r10, %r11 ; \ - shldq $3, %r9, %r10 ; \ - shldq $3, %r8, %r9 ; \ - shlq $3, %r8 ; \ - shrq $61, %r12 ; \ - /* (%rcx;%r11;%r10;%r9;%r8) = 2^256 + 3 * P1 + 8 * (p_256 - P2) */ \ - movl $3, %ecx ; \ - movq P1, %rax ; \ - mulq %rcx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rbx, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rbx, %rbx ; \ - movq 0x10+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rbx, %rbx ; \ - movq 0x18+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - leaq 1(%r12), %rcx ; \ - /* Now the tail for modular reduction from tripling */ \ - movq $0xffffffff00000001, %rax ; \ - mulq %rcx; \ - movq %rcx, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %rcx, %r8 ; \ - sbbq $0x0, %rbx ; \ - subq %rbx, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq %rax, %r11 ; \ - sbbq %rdx, %rcx ; \ - decq %rcx; \ - movl $0xffffffff, %eax ; \ - andq %rcx, %rax ; \ - xorl %edx, %edx ; \ - subq %rax, %rdx ; \ - addq %rcx, %r8 ; \ - movq %r8, P0 ; \ - adcq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - adcq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - adcq %rdx, %r11 ; \ - movq %r11, 0x18+P0 - -// P0 = 4 * P1 - P2, by direct subtraction of P2, -// since the quotient estimate still works safely -// for initial value > -p_256 - -#define cmsub41_p256(P0,P1,P2) \ - movq 0x18+P1, %r11 ; \ - movq %r11, %rcx ; \ - movq 0x10+P1, %r10 ; \ - shldq $2, %r10, %r11 ; \ - movq 0x8+P1, %r9 ; \ - shldq $2, %r9, %r10 ; \ - movq P1, %r8 ; \ - shldq $2, %r8, %r9 ; \ - shlq $2, %r8 ; \ - shrq $62, %rcx ; \ - addq $1, %rcx ; \ - subq P2, %r8 ; \ - sbbq 0x8+P2, %r9 ; \ - sbbq 0x10+P2, %r10 ; \ - sbbq 0x18+P2, %r11 ; \ - sbbq $0, %rcx ; \ - /* Now the tail for modular reduction from tripling */ \ - movq $0xffffffff00000001, %rax ; \ - mulq %rcx; \ - movq %rcx, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %rcx, %r8 ; \ - sbbq $0x0, %rbx ; \ - subq %rbx, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq %rax, %r11 ; \ - sbbq %rdx, %rcx ; \ - decq %rcx; \ - movl $0xffffffff, %eax ; \ - andq %rcx, %rax ; \ - xorl %edx, %edx ; \ - subq %rax, %rdx ; \ - addq %rcx, %r8 ; \ - movq %r8, P0 ; \ - adcq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - adcq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - adcq %rdx, %r11 ; \ - movq %r11, 0x18+P0 - -S2N_BN_SYMBOL(p256_montjdouble_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers and make room on stack for temporary variables - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main code, just a sequence of basic field operations - -// z2 = z^2 -// y2 = y^2 - - montsqr_p256(z2,z_1) - montsqr_p256(y2,y_1) - -// x2p = x^2 - z^4 = (x + z^2) * (x - z^2) - - sub_p256(t2,x_1,z2) - weakadd_p256(t1,x_1,z2) - montmul_p256(x2p,t1,t2) - -// t1 = y + z -// xy2 = x * y^2 -// x4p = x2p^2 - - add_p256(t1,y_1,z_1) - montmul_p256(xy2,x_1,y2) - montsqr_p256(x4p,x2p) - -// t1 = (y + z)^2 - - montsqr_p256(t1,t1) - -// d = 12 * xy2 - 9 * x4p -// t1 = y^2 + 2 * y * z - - cmsub_p256(d,12,xy2,9,x4p) - sub_p256(t1,t1,z2) - -// y4 = y^4 - - montsqr_p256(y4,y2) - -// dx2 = d * x2p - - montmul_p256(dx2,d,x2p) - -// z_3' = 2 * y * z - - sub_p256(z_3,t1,y2) - -// x' = 4 * xy2 - d - - cmsub41_p256(x_3,xy2,d) - -// y' = 3 * dx2 - 8 * y4 - - cmsub38_p256(y_3,dx2,y4) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_montjdouble_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjmixadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjmixadd.S deleted file mode 100644 index 259ded8b5f6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjmixadd.S +++ /dev/null @@ -1,567 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjmixadd(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 8]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjmixadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_montjmixadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjmixadd) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs. -// These assume %rdi = p3, %rsi = p1 and %rbp = p2, -// which needs to be set up explicitly before use. -// The first two hold initially, and the second is -// set up by copying the initial %rdx input to %rbp. -// Thereafter, no code macro modifies any of them. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rbp) -#define y_2 NUMSIZE(%rbp) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing. -// NSPACE is the total stack needed for all temporaries. - -#define zp2 (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define NSPACE NUMSIZE*6 - -// Corresponds exactly to bignum_montmul_p256 - -#define montmul_p256(P0,P1,P2) \ - xorl %r13d, %r13d ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rbx, %r10 ; \ - adcq %rbx, %r9 ; \ - mulxq 0x10+P1, %rbx, %r11 ; \ - adcq %rbx, %r10 ; \ - mulxq 0x18+P1, %rbx, %r12 ; \ - adcq %rbx, %r11 ; \ - adcq %r13, %r12 ; \ - movq 0x8+P2, %rdx ; \ - xorl %r14d, %r14d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcq %r14, %r13 ; \ - xorl %r15d, %r15d ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - notq %rdx; \ - leaq 0x2(%rdx), %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %r15, %r13 ; \ - adoxq %r15, %r14 ; \ - adcq %r15, %r14 ; \ - movq 0x10+P2, %rdx ; \ - xorl %r8d, %r8d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adoxq %r8, %r14 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcq %rax, %r13 ; \ - adcq %rbx, %r14 ; \ - adcq %r8, %r15 ; \ - movq 0x18+P2, %rdx ; \ - xorl %r9d, %r9d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - adoxq %r9, %r15 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcq %rax, %r14 ; \ - adcq %rbx, %r15 ; \ - adcq %r9, %r8 ; \ - xorl %r9d, %r9d ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - notq %rdx; \ - leaq 0x2(%rdx), %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adcxq %r9, %r15 ; \ - adoxq %r9, %r8 ; \ - adcq %r9, %r8 ; \ - movl $0x1, %ecx ; \ - addq %r12, %rcx ; \ - decq %rdx; \ - adcq %r13, %rdx ; \ - decq %r9; \ - movq %r9, %rax ; \ - adcq %r14, %r9 ; \ - movl $0xfffffffe, %r11d ; \ - adcq %r15, %r11 ; \ - adcq %r8, %rax ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %r9, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_montsqr_p256 except for -// register tweaks to avoid modifying %rbp. - -#define montsqr_p256(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ecx, %ecx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r15 ; \ - xorl %ecx, %ecx ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - movabsq $0xffffffff00000001, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - movl %ecx, %r9d ; \ - adoxq %rcx, %r9 ; \ - adcxq %rcx, %r9 ; \ - addq %r9, %r14 ; \ - adcq %rcx, %r15 ; \ - movl %ecx, %r8d ; \ - adcq %rcx, %r8 ; \ - xorl %ecx, %ecx ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movabsq $0xffffffff00000001, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r8 ; \ - adcq %rcx, %r8 ; \ - movl $0x1, %ebx ; \ - addq %r12, %rbx ; \ - leaq -0x1(%rdx), %rdx ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rcx), %rcx ; \ - movq %rcx, %rax ; \ - adcq %r14, %rcx ; \ - movl $0xfffffffe, %r11d ; \ - adcq %r15, %r11 ; \ - adcq %r8, %rax ; \ - cmovbq %rbx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rcx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Almost-Montgomery variant which we use when an input to other muls -// with the other argument fully reduced (which is always safe). -// Again, the basic squaring code is tweaked to avoid modifying %rbp. - -#define amontsqr_p256(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ecx, %ecx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r15 ; \ - xorl %ecx, %ecx ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - movabsq $0xffffffff00000001, %rdx ; \ - mulxq %r8, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r9, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - movl %ecx, %r9d ; \ - adoxq %rcx, %r9 ; \ - adcxq %rcx, %r9 ; \ - addq %r9, %r14 ; \ - adcq %rcx, %r15 ; \ - movl %ecx, %r8d ; \ - adcq %rcx, %r8 ; \ - xorl %ecx, %ecx ; \ - movabsq $0x100000000, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movabsq $0xffffffff00000001, %rdx ; \ - mulxq %r10, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq %r11, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r8 ; \ - adcq %rcx, %r8 ; \ - movl $0x1, %r8d ; \ - leaq -0x1(%rdx), %rdx ; \ - leaq -0x1(%rcx), %rax ; \ - movl $0xfffffffe, %r11d ; \ - cmovzq %rcx, %r8 ; \ - cmovzq %rcx, %rdx ; \ - cmovzq %rcx, %rax ; \ - cmovzq %rcx, %r11 ; \ - addq %r8, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %rax, %r14 ; \ - adcq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_sub_p256 - -#define sub_p256(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - sbbq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movl $0xffffffff, %r10d ; \ - sbbq %r11, %r11 ; \ - xorq %rdx, %rdx ; \ - andq %r11, %r10 ; \ - subq %r10, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// Additional macros to help with final multiplexing - -#define testzero4(P) \ - movq P, %rax ; \ - movq 8+P, %rdx ; \ - orq 16+P, %rax ; \ - orq 24+P, %rdx ; \ - orq %rdx, %rax - -#define mux4(r0,r1,r2,r3,PNE,PEQ) \ - movq PNE, r0 ; \ - movq PEQ, %rax ; \ - cmovzq %rax, r0 ; \ - movq 8+PNE, r1 ; \ - movq 8+PEQ, %rax ; \ - cmovzq %rax, r1 ; \ - movq 16+PNE, r2 ; \ - movq 16+PEQ, %rax ; \ - cmovzq %rax, r2 ; \ - movq 24+PNE, r3 ; \ - movq 24+PEQ, %rax ; \ - cmovzq %rax, r3 - -#define load4(r0,r1,r2,r3,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 - -#define store4(P,r0,r1,r2,r3) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P - -S2N_BN_SYMBOL(p256_montjmixadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input y in %rbp where it lasts as long as it's needed. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdx, %rbp - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - amontsqr_p256(zp2,z_1) - - montmul_p256(y2a,z_1,y_2) - montmul_p256(x2a,zp2,x_2) - montmul_p256(y2a,zp2,y2a) - - sub_p256(xd,x2a,x_1) - - sub_p256(yd,y2a,y_1) - - amontsqr_p256(zz,xd) - montsqr_p256(ww,yd) - - montmul_p256(zzx1,zz,x_1) - montmul_p256(zzx2,zz,x2a) - - sub_p256(resx,ww,zzx1) - sub_p256(t1,zzx2,zzx1) - - montmul_p256(resz,xd,z_1) - - sub_p256(resx,resx,zzx2) - - sub_p256(t2,zzx1,resx) - - montmul_p256(t1,t1,y_1) - montmul_p256(t2,yd,t2) - - sub_p256(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - testzero4(z_1) - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with a z = 1 coordinate (in -// Montgomery form so not the simple constant 1 but rather 2^256 - p_256), -// hence giving 0 + p2 = p2 for the final result. - - mux4(%r8,%r9,%r10,%r11,resx,x_2) - mux4(%r12,%r13,%r14,%r15,resy,y_2) - - store4(x_3,%r8,%r9,%r10,%r11) - store4(y_3,%r12,%r13,%r14,%r15) - - load4(%r8,%r9,%r10,%r11,resz) - movl $1, %eax - cmovzq %rax, %r8 - movq $0xffffffff00000000, %rax - cmovzq %rax, %r9 - movq $0xffffffffffffffff, %rax - cmovzq %rax, %r10 - movl $0x00000000fffffffe, %eax - cmovzq %rax, %r11 - - store4(z_3,%r8,%r9,%r10,%r11) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_montjmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjmixadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjmixadd_alt.S deleted file mode 100644 index ff3301a8804..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_montjmixadd_alt.S +++ /dev/null @@ -1,552 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on NIST curve P-256 in Montgomery-Jacobian coordinates -// -// extern void p256_montjmixadd_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 8]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_256. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_montjmixadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_montjmixadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_montjmixadd_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs. -// These assume %rdi = p3, %rsi = p1 and %rbp = p2, -// which needs to be set up explicitly before use. -// The first two hold initially, and the second is -// set up by copying the initial %rdx input to %rbp. -// Thereafter, no code macro modifies any of them. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rbp) -#define y_2 NUMSIZE(%rbp) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing. -// NSPACE is the total stack needed for all temporaries. - -#define zp2 (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define NSPACE NUMSIZE*6 - -// Corresponds exactly to bignum_montmul_p256_alt - -#define montmul_p256(P0,P1,P2) \ - movq P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - xorl %r10d, %r10d ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - xorl %r11d, %r11d ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - xorl %r12d, %r12d ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - movq 0x8+P2, %rbx ; \ - xorl %r13d, %r13d ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r14, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r14, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r14, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r14, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - xorl %r14d, %r14d ; \ - movq $0x100000000, %rbx ; \ - movq %r8, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %r15, %r15 ; \ - movq %r9, %rax ; \ - mulq %rbx; \ - subq %r15, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r15, %r15 ; \ - notq %rbx; \ - leaq 0x2(%rbx), %rbx ; \ - movq %r8, %rax ; \ - mulq %rbx; \ - subq %r15, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r15, %r15 ; \ - movq %r9, %rax ; \ - mulq %rbx; \ - subq %r15, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P2, %rbx ; \ - xorl %r15d, %r15d ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r8, %r8 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r8, %r8 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r8, %r8 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P2, %rbx ; \ - xorl %r8d, %r8d ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r9, %r9 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r9, %r9 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r9, %r9 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r8, %r8 ; \ - xorl %r9d, %r9d ; \ - movq $0x100000000, %rbx ; \ - movq %r10, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - movq %r11, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %rcx, %rcx ; \ - notq %rbx; \ - leaq 0x2(%rbx), %rbx ; \ - movq %r10, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %rcx, %rcx ; \ - movq %r11, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r9, %r8 ; \ - movl $0x1, %ecx ; \ - addq %r12, %rcx ; \ - decq %rbx; \ - adcq %r13, %rbx ; \ - decq %r9; \ - movq %r9, %rax ; \ - adcq %r14, %r9 ; \ - movl $0xfffffffe, %r11d ; \ - adcq %r15, %r11 ; \ - adcq %r8, %rax ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rbx, %r13 ; \ - cmovbq %r9, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_montsqr_p256_alt - -#define montsqr_p256(P0,P1) \ - movq P1, %rax ; \ - movq %rax, %rbx ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r15 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r9 ; \ - movq %rdx, %r10 ; \ - movq 0x18+P1, %rax ; \ - movq %rax, %r13 ; \ - mulq %rbx; \ - movq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - movq 0x10+P1, %rax ; \ - movq %rax, %rbx ; \ - mulq %r13; \ - movq %rax, %r13 ; \ - movq %rdx, %r14 ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - movq 0x18+P1, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorl %ecx, %ecx ; \ - addq %r9, %r9 ; \ - adcq %r10, %r10 ; \ - adcq %r11, %r11 ; \ - adcq %r12, %r12 ; \ - adcq %r13, %r13 ; \ - adcq %r14, %r14 ; \ - adcq %rcx, %rcx ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %r15, %r9 ; \ - adcq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - negq %r15; \ - adcq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - negq %r15; \ - adcq %rax, %r14 ; \ - adcq %rcx, %rdx ; \ - movq %rdx, %r15 ; \ - movq $0x100000000, %rbx ; \ - movq %r8, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r9, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - notq %rbx; \ - leaq 0x2(%rbx), %rbx ; \ - movq %r8, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - xorl %r8d, %r8d ; \ - movq %r9, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r8, %r14 ; \ - adcq %r8, %r15 ; \ - adcq %r8, %r8 ; \ - movq $0x100000000, %rbx ; \ - movq %r10, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - movq %r11, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %rcx, %rcx ; \ - notq %rbx; \ - leaq 0x2(%rbx), %rbx ; \ - movq %r10, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %rcx, %rcx ; \ - xorl %r9d, %r9d ; \ - movq %r11, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r9, %r8 ; \ - movl $0x1, %ecx ; \ - addq %r12, %rcx ; \ - leaq -0x1(%rbx), %rbx ; \ - adcq %r13, %rbx ; \ - leaq -0x1(%r9), %r9 ; \ - movq %r9, %rax ; \ - adcq %r14, %r9 ; \ - movl $0xfffffffe, %r11d ; \ - adcq %r15, %r11 ; \ - adcq %r8, %rax ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rbx, %r13 ; \ - cmovbq %r9, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_sub_p256 - -#define sub_p256(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - sbbq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movl $0xffffffff, %r10d ; \ - sbbq %r11, %r11 ; \ - xorq %rdx, %rdx ; \ - andq %r11, %r10 ; \ - subq %r10, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// Additional macros to help with final multiplexing - -#define testzero4(P) \ - movq P, %rax ; \ - movq 8+P, %rdx ; \ - orq 16+P, %rax ; \ - orq 24+P, %rdx ; \ - orq %rdx, %rax - -#define mux4(r0,r1,r2,r3,PNE,PEQ) \ - movq PNE, r0 ; \ - movq PEQ, %rax ; \ - cmovzq %rax, r0 ; \ - movq 8+PNE, r1 ; \ - movq 8+PEQ, %rax ; \ - cmovzq %rax, r1 ; \ - movq 16+PNE, r2 ; \ - movq 16+PEQ, %rax ; \ - cmovzq %rax, r2 ; \ - movq 24+PNE, r3 ; \ - movq 24+PEQ, %rax ; \ - cmovzq %rax, r3 - -#define load4(r0,r1,r2,r3,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 - -#define store4(P,r0,r1,r2,r3) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P - -S2N_BN_SYMBOL(p256_montjmixadd_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input y in %rbp where it lasts as long as it's needed. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdx, %rbp - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - montsqr_p256(zp2,z_1) - - montmul_p256(y2a,z_1,y_2) - montmul_p256(x2a,zp2,x_2) - montmul_p256(y2a,zp2,y2a) - - sub_p256(xd,x2a,x_1) - - sub_p256(yd,y2a,y_1) - - montsqr_p256(zz,xd) - montsqr_p256(ww,yd) - - montmul_p256(zzx1,zz,x_1) - montmul_p256(zzx2,zz,x2a) - - sub_p256(resx,ww,zzx1) - sub_p256(t1,zzx2,zzx1) - - montmul_p256(resz,xd,z_1) - - sub_p256(resx,resx,zzx2) - - sub_p256(t2,zzx1,resx) - - montmul_p256(t1,t1,y_1) - montmul_p256(t2,yd,t2) - - sub_p256(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - testzero4(z_1) - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with a z = 1 coordinate (in -// Montgomery form so not the simple constant 1 but rather 2^256 - p_256), -// hence giving 0 + p2 = p2 for the final result. - - mux4(%r8,%r9,%r10,%r11,resx,x_2) - mux4(%r12,%r13,%r14,%r15,resy,y_2) - - store4(x_3,%r8,%r9,%r10,%r11) - store4(y_3,%r12,%r13,%r14,%r15) - - load4(%r8,%r9,%r10,%r11,resz) - movl $1, %eax - cmovzq %rax, %r8 - movq $0xffffffff00000000, %rax - cmovzq %rax, %r9 - movq $0xffffffffffffffff, %rax - cmovzq %rax, %r10 - movl $0x00000000fffffffe, %eax - cmovzq %rax, %r11 - - store4(z_3,%r8,%r9,%r10,%r11) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_montjmixadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmul.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmul.S deleted file mode 100644 index f5d937b7422..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmul.S +++ /dev/null @@ -1,6823 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Scalar multiplication for P-256 -// Input scalar[4], point[8]; output res[8] -// -// extern void p256_scalarmul -// (uint64_t res[static 8],const uint64_t scalar[static 4], -// const uint64_t point[static 8]); -// -// Given scalar = n and point = P, assumed to be on the NIST elliptic -// curve P-256, returns the point (X,Y) = n * P. The input and output -// are affine points, and in the case of the point at infinity as -// the result, (0,0) is returned. -// -// Standard x86-64 ABI: RDI = res, RSI = scalar, RDX = point -// Microsoft x64 ABI: RCX = res, RDX = scalar, R8 = point -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_scalarmul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_scalarmul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_scalarmul) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Intermediate variables on the stack. The last z2, z3 values can -// safely be overlaid on the table, which is no longer needed at the end. -// Uppercase syntactic variants make x86_att version simpler to generate - -#define SCALARB (0*NUMSIZE) -#define scalarb (0*NUMSIZE)(%rsp) -#define ACC (1*NUMSIZE) -#define acc (1*NUMSIZE)(%rsp) -#define TABENT (4*NUMSIZE) -#define tabent (4*NUMSIZE)(%rsp) - -#define TAB (7*NUMSIZE) -#define tab (7*NUMSIZE)(%rsp) - -#define Z2 (7*NUMSIZE) -#define z2 (7*NUMSIZE)(%rsp) -#define Z3 (8*NUMSIZE) -#define z3 (8*NUMSIZE)(%rsp) - -#define res (31*NUMSIZE)(%rsp) - -#define NSPACE 32*NUMSIZE - -S2N_BN_SYMBOL(p256_scalarmul): - CFI_START - _CET_ENDBR - -// The Windows version literally calls the standard ABI version. -// This simplifies the proofs since subroutine offsets are fixed. - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - CFI_CALL(Lp256_scalarmul_standard) - CFI_POP(%rsi) - CFI_POP(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_scalarmul) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_standard) - -Lp256_scalarmul_standard: - CFI_START -#endif - -// Real start of the standard ABI code. - - CFI_PUSH(%r15) - CFI_PUSH(%r14) - CFI_PUSH(%r13) - CFI_PUSH(%r12) - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - - CFI_DEC_RSP(NSPACE) - -// Preserve the "res" and "point" input arguments. We load and process the -// scalar immediately so we don't bother preserving that input argument. -// Also, "point" is only needed early on and so its register gets re-used. - - movq %rdx, %rbx - movq %rdi, res - -// Load the digits of group order n_256 = [%r15;%r14;%r13;%r12] - - movq $0xf3b9cac2fc632551, %r12 - movq $0xbce6faada7179e84, %r13 - movq $0xffffffffffffffff, %r14 - movq $0xffffffff00000000, %r15 - -// First, reduce the input scalar mod n_256, i.e. conditionally subtract n_256 - - movq (%rsi), %r8 - subq %r12, %r8 - movq 8(%rsi), %r9 - sbbq %r13, %r9 - movq 16(%rsi), %r10 - sbbq %r14, %r10 - movq 24(%rsi), %r11 - sbbq %r15, %r11 - - cmovcq (%rsi), %r8 - cmovcq 8(%rsi), %r9 - cmovcq 16(%rsi), %r10 - cmovcq 24(%rsi), %r11 - -// Now if the top bit of the reduced scalar is set, negate it mod n_256, -// i.e. do n |-> n_256 - n. Remember the sign in %rbp so we can -// correspondingly negate the point below. - - subq %r8, %r12 - sbbq %r9, %r13 - sbbq %r10, %r14 - sbbq %r11, %r15 - - movq %r11, %rbp - shrq $63, %rbp - cmovnzq %r12, %r8 - cmovnzq %r13, %r9 - cmovnzq %r14, %r10 - cmovnzq %r15, %r11 - -// In either case then add the recoding constant 0x08888...888 to allow -// signed digits. - - movq $0x8888888888888888, %rax - addq %rax, %r8 - adcq %rax, %r9 - adcq %rax, %r10 - adcq %rax, %r11 - btc $63, %r11 - - movq %r8, SCALARB(%rsp) - movq %r9, SCALARB+8(%rsp) - movq %r10, SCALARB+16(%rsp) - movq %r11, SCALARB+24(%rsp) - -// Set the tab[0] table entry to Montgomery-Jacobian point = 1 * P -// The z coordinate is just the Montgomery form of the constant 1. - - leaq TAB(%rsp), %rdi - movq %rbx, %rsi - CFI_CALL(Lp256_scalarmul_local_tomont_p256) - - leaq 32(%rbx), %rsi - leaq TAB+32(%rsp), %rdi - CFI_CALL(Lp256_scalarmul_local_tomont_p256) - - movl $1, %eax - movq %rax, TAB+64(%rsp) - movq $0xffffffff00000000, %rdx - movq %rdx, TAB+72(%rsp) - subq $2, %rax - movq %rax, TAB+80(%rsp) - movq $0x00000000fffffffe, %rax - movq %rax, TAB+88(%rsp) - -// If the top bit of the scalar was set, negate (y coordinate of) the point - - movq TAB+32(%rsp), %r12 - movq TAB+40(%rsp), %r13 - movq TAB+48(%rsp), %r14 - movq TAB+56(%rsp), %r15 - - xorl %r10d, %r10d - leaq -1(%r10), %r8 - movq $0x00000000ffffffff, %r11 - movq %r11, %r9 - negq %r11 - - subq %r12, %r8 - sbbq %r13, %r9 - sbbq %r14, %r10 - sbbq %r15, %r11 - - testq %rbp, %rbp - cmovzq %r12, %r8 - cmovzq %r13, %r9 - cmovzq %r14, %r10 - cmovzq %r15, %r11 - - movq %r8, TAB+32(%rsp) - movq %r9, TAB+40(%rsp) - movq %r10, TAB+48(%rsp) - movq %r11, TAB+56(%rsp) - -// Compute and record tab[1] = 2 * p, ..., tab[7] = 8 * P - - leaq TAB+96*1(%rsp), %rdi - leaq TAB(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_local_p256_montjdouble) - - leaq TAB+96*2(%rsp), %rdi - leaq TAB+96*1(%rsp), %rsi - leaq TAB(%rsp), %rdx - CFI_CALL(Lp256_scalarmul_local_p256_montjmixadd) - - leaq TAB+96*3(%rsp), %rdi - leaq TAB+96*1(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_local_p256_montjdouble) - - leaq TAB+96*4(%rsp), %rdi - leaq TAB+96*3(%rsp), %rsi - leaq TAB(%rsp), %rdx - CFI_CALL(Lp256_scalarmul_local_p256_montjmixadd) - - leaq TAB+96*5(%rsp), %rdi - leaq TAB+96*2(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_local_p256_montjdouble) - - leaq TAB+96*6(%rsp), %rdi - leaq TAB+96*5(%rsp), %rsi - leaq TAB(%rsp), %rdx - CFI_CALL(Lp256_scalarmul_local_p256_montjmixadd) - - leaq TAB+96*7(%rsp), %rdi - leaq TAB+96*3(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_local_p256_montjdouble) - -// Set up accumulator as table entry for top 4 bits (constant-time indexing) - - movq SCALARB+24(%rsp), %rdi - shrq $60, %rdi - - xorl %eax, %eax - xorl %ebx, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - xorl %r8d, %r8d - xorl %r9d, %r9d - xorl %r10d, %r10d - xorl %r11d, %r11d - xorl %r12d, %r12d - xorl %r13d, %r13d - xorl %r14d, %r14d - xorl %r15d, %r15d - - .set I, 1 -.rep 8 - cmpq $I, %rdi - - cmovzq TAB+96*(I-1)(%rsp), %rax - cmovzq TAB+96*(I-1)+8(%rsp), %rbx - cmovzq TAB+96*(I-1)+16(%rsp), %rcx - cmovzq TAB+96*(I-1)+24(%rsp), %rdx - cmovzq TAB+96*(I-1)+32(%rsp), %r8 - cmovzq TAB+96*(I-1)+40(%rsp), %r9 - cmovzq TAB+96*(I-1)+48(%rsp), %r10 - cmovzq TAB+96*(I-1)+56(%rsp), %r11 - cmovzq TAB+96*(I-1)+64(%rsp), %r12 - cmovzq TAB+96*(I-1)+72(%rsp), %r13 - cmovzq TAB+96*(I-1)+80(%rsp), %r14 - cmovzq TAB+96*(I-1)+88(%rsp), %r15 - .set I, (I+1) -.endr - movq %rax, ACC(%rsp) - movq %rbx, ACC+8(%rsp) - movq %rcx, ACC+16(%rsp) - movq %rdx, ACC+24(%rsp) - movq %r8, ACC+32(%rsp) - movq %r9, ACC+40(%rsp) - movq %r10, ACC+48(%rsp) - movq %r11, ACC+56(%rsp) - movq %r12, ACC+64(%rsp) - movq %r13, ACC+72(%rsp) - movq %r14, ACC+80(%rsp) - movq %r15, ACC+88(%rsp) - -// Main loop over size-4 bitfield - - movl $252, %ebp - -Lp256_scalarmul_loop: - subq $4, %rbp - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lp256_scalarmul_local_p256_montjdouble) - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lp256_scalarmul_local_p256_montjdouble) - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lp256_scalarmul_local_p256_montjdouble) - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lp256_scalarmul_local_p256_montjdouble) - - movq %rbp, %rax - shrq $6, %rax - movq (%rsp,%rax,8), %rdi - movq %rbp, %rcx - shrq %cl, %rdi - andq $15, %rdi - - subq $8, %rdi - sbbq %rsi, %rsi // %rsi = sign of digit (-1 = negative) - xorq %rsi, %rdi - subq %rsi, %rdi // %rdi = absolute value of digit - - xorl %eax, %eax - xorl %ebx, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - xorl %r8d, %r8d - xorl %r9d, %r9d - xorl %r10d, %r10d - xorl %r11d, %r11d - xorl %r12d, %r12d - xorl %r13d, %r13d - xorl %r14d, %r14d - xorl %r15d, %r15d - - .set I, 1 -.rep 8 - cmpq $I, %rdi - - cmovzq TAB+96*(I-1)(%rsp), %rax - cmovzq TAB+96*(I-1)+8(%rsp), %rbx - cmovzq TAB+96*(I-1)+16(%rsp), %rcx - cmovzq TAB+96*(I-1)+24(%rsp), %rdx - cmovzq TAB+96*(I-1)+32(%rsp), %r8 - cmovzq TAB+96*(I-1)+40(%rsp), %r9 - cmovzq TAB+96*(I-1)+48(%rsp), %r10 - cmovzq TAB+96*(I-1)+56(%rsp), %r11 - cmovzq TAB+96*(I-1)+64(%rsp), %r12 - cmovzq TAB+96*(I-1)+72(%rsp), %r13 - cmovzq TAB+96*(I-1)+80(%rsp), %r14 - cmovzq TAB+96*(I-1)+88(%rsp), %r15 - .set I, (I+1) -.endr - - movq %r12, TABENT+64(%rsp) - movq %r13, TABENT+72(%rsp) - movq %r14, TABENT+80(%rsp) - movq %r15, TABENT+88(%rsp) - - xorl %r14d, %r14d - leaq -1(%r14), %r12 - movq $0x00000000ffffffff, %r15 - movq %r15, %r13 - negq %r15 - - subq %r8, %r12 - sbbq %r9, %r13 - sbbq %r10, %r14 - sbbq %r11, %r15 - - testq %rsi, %rsi - cmovnzq %r12, %r8 - cmovnzq %r13, %r9 - cmovnzq %r14, %r10 - cmovnzq %r15, %r11 - - movq %rax, TABENT(%rsp) - movq %rbx, TABENT+8(%rsp) - movq %rcx, TABENT+16(%rsp) - movq %rdx, TABENT+24(%rsp) - - movq %r8, TABENT+32(%rsp) - movq %r9, TABENT+40(%rsp) - movq %r10, TABENT+48(%rsp) - movq %r11, TABENT+56(%rsp) - - leaq TABENT(%rsp), %rdx - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lp256_scalarmul_local_p256_montjadd) - - testq %rbp, %rbp - jne Lp256_scalarmul_loop - -// Let z2 = 1/z^2 and z3 = 1/z^3, both without Montgomery form - - leaq Z2(%rsp), %rdi - leaq ACC+64(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_local_montsqr_p256) - - leaq Z3(%rsp), %rdi - leaq ACC+64(%rsp), %rsi - leaq Z2(%rsp), %rdx - CFI_CALL(Lp256_scalarmul_local_montmul_p256) - - leaq Z2(%rsp), %rdi - leaq Z3(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_local_demont_p256) - - leaq Z3(%rsp), %rdi - leaq Z2(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_local_inv_p256) - - leaq Z2(%rsp), %rdi - leaq ACC+64(%rsp), %rsi - leaq Z3(%rsp), %rdx - CFI_CALL(Lp256_scalarmul_local_montmul_p256) - -// Convert back from Jacobian (X, Y, Z) |-> (X/Z^2, Y/Z^3) - - movq res, %rdi - leaq ACC(%rsp), %rsi - leaq Z2(%rsp), %rdx - movq %rdi, %rbx - CFI_CALL(Lp256_scalarmul_local_montmul_p256) - - leaq 32(%rbx), %rdi - leaq ACC+32(%rsp), %rsi - leaq Z3(%rsp), %rdx - CFI_CALL(Lp256_scalarmul_local_montmul_p256) - -// Restore stack and registers and return - - CFI_INC_RSP(NSPACE) - CFI_POP(%rbx) - CFI_POP(%rbp) - CFI_POP(%r12) - CFI_POP(%r13) - CFI_POP(%r14) - CFI_POP(%r15) - CFI_RET - -#if WINDOWS_ABI -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_standard) -#else -S2N_BN_SIZE_DIRECTIVE(p256_scalarmul) -#endif - -// Local copies of subroutines, complete clones at the moment - -Lp256_scalarmul_local_demont_p256: - CFI_START - CFI_PUSH(%rbx) - movq (%rsi), %r8 - movq 0x8(%rsi), %r9 - movq 0x10(%rsi), %r10 - movq 0x18(%rsi), %r11 - xorq %rbx, %rbx - xorq %rsi, %rsi - movq $0x100000000, %rdx - mulxq %r8, %rax, %rcx - adcxq %rax, %r9 - adoxq %rcx, %r10 - mulxq %r9, %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rcx - adcxq %rax, %r11 - adoxq %rcx, %rbx - mulxq %r9, %rax, %rcx - adcxq %rax, %rbx - adoxq %rcx, %rsi - movl $0x0, %r8d - adcxq %r8, %rsi - xorq %r9, %r9 - movq $0x100000000, %rdx - mulxq %r10, %rax, %rcx - adcxq %rax, %r11 - adoxq %rcx, %rbx - mulxq %r11, %rax, %rcx - adcxq %rax, %rbx - adoxq %rcx, %rsi - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rcx - adcxq %rax, %rsi - adoxq %rcx, %r8 - mulxq %r11, %rax, %rcx - adcxq %rax, %r8 - adoxq %rcx, %r9 - movl $0x0, %r10d - adcxq %r10, %r9 - movq %rbx, (%rdi) - movq %rsi, 0x8(%rdi) - movq %r8, 0x10(%rdi) - movq %r9, 0x18(%rdi) - CFI_POP(%rbx) - CFI_RET - -Lp256_scalarmul_local_inv_p256: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(240) - movq %rdi, 0xe0(%rsp) - xorl %ecx, %ecx - movl $0xffffffff, %edx - movq %rdx, %rbx - leaq -0x1(%rcx), %rax - negq %rdx - movq %rax, (%rsp) - movq %rbx, 0x8(%rsp) - movq %rcx, 0x10(%rsp) - movq %rdx, 0x18(%rsp) - movq %rcx, 0x20(%rsp) - movq (%rsi), %r8 - movq 0x8(%rsi), %r9 - movq 0x10(%rsi), %r10 - movq 0x18(%rsi), %r11 - leaq 0x1(%rcx), %rax - addq %r8, %rax - leaq -0x1(%rdx), %rbx - adcq %r9, %rbx - notq %rcx - adcq %r10, %rcx - notq %rdx - adcq %r11, %rdx - cmovaeq %r8, %rax - cmovaeq %r9, %rbx - cmovaeq %r10, %rcx - cmovaeq %r11, %rdx - movq %rax, 0x28(%rsp) - movq %rbx, 0x30(%rsp) - movq %rcx, 0x38(%rsp) - movq %rdx, 0x40(%rsp) - xorl %eax, %eax - movq %rax, 0x48(%rsp) - xorl %eax, %eax - movq %rax, 0x50(%rsp) - movq %rax, 0x58(%rsp) - movq %rax, 0x60(%rsp) - movq %rax, 0x68(%rsp) - movq $0x4000000000000, %rcx - movq %rcx, 0x78(%rsp) - movq %rax, 0x80(%rsp) - movq %rax, 0x88(%rsp) - movq %rax, 0x90(%rsp) - movq $0xa, 0xb0(%rsp) - movq $0x1, 0xb8(%rsp) - jmp Lp256_scalarmul_inv_midloop -Lp256_scalarmul_inv_loop: - movq %r8, %r9 - sarq $0x3f, %r9 - xorq %r9, %r8 - subq %r9, %r8 - movq %r10, %r11 - sarq $0x3f, %r11 - xorq %r11, %r10 - subq %r11, %r10 - movq %r12, %r13 - sarq $0x3f, %r13 - xorq %r13, %r12 - subq %r13, %r12 - movq %r14, %r15 - sarq $0x3f, %r15 - xorq %r15, %r14 - subq %r15, %r14 - movq %r8, %rax - andq %r9, %rax - movq %r10, %rdi - andq %r11, %rdi - addq %rax, %rdi - movq %rdi, 0xa0(%rsp) - movq %r12, %rax - andq %r13, %rax - movq %r14, %rsi - andq %r15, %rsi - addq %rax, %rsi - movq %rsi, 0xa8(%rsp) - xorl %ebx, %ebx - movq (%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rdi - adcq %rdx, %rbx - movq 0x28(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rdi - adcq %rdx, %rbx - xorl %ebp, %ebp - movq (%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rbp - movq 0x28(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - xorl %ecx, %ecx - movq 0x8(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq 0x30(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - shrdq $0x3b, %rbx, %rdi - movq %rdi, (%rsp) - xorl %edi, %edi - movq 0x8(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rbp - adcq %rdx, %rdi - movq 0x30(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rdi - shrdq $0x3b, %rbp, %rsi - movq %rsi, 0x28(%rsp) - xorl %esi, %esi - movq 0x10(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rsi - movq 0x38(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rsi - shrdq $0x3b, %rcx, %rbx - movq %rbx, 0x8(%rsp) - xorl %ebx, %ebx - movq 0x10(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rdi - adcq %rdx, %rbx - movq 0x38(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rdi - adcq %rdx, %rbx - shrdq $0x3b, %rdi, %rbp - movq %rbp, 0x30(%rsp) - movq 0x18(%rsp), %rax - xorq %r9, %rax - movq 0x20(%rsp), %rbp - xorq %r9, %rbp - andq %r8, %rbp - negq %rbp - mulq %r8 - addq %rax, %rsi - adcq %rdx, %rbp - movq 0x40(%rsp), %rax - xorq %r11, %rax - movq 0x48(%rsp), %rdx - xorq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbp - mulq %r10 - addq %rax, %rsi - adcq %rdx, %rbp - shrdq $0x3b, %rsi, %rcx - movq %rcx, 0x10(%rsp) - shrdq $0x3b, %rbp, %rsi - sarq $0x3b, %rbp - movq 0x18(%rsp), %rax - movq %rsi, 0x18(%rsp) - movq 0x20(%rsp), %rsi - movq %rbp, 0x20(%rsp) - xorq %r13, %rax - xorq %r13, %rsi - andq %r12, %rsi - negq %rsi - mulq %r12 - addq %rax, %rbx - adcq %rdx, %rsi - movq 0x40(%rsp), %rax - xorq %r15, %rax - movq 0x48(%rsp), %rdx - xorq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rsi - mulq %r14 - addq %rax, %rbx - adcq %rdx, %rsi - shrdq $0x3b, %rbx, %rdi - movq %rdi, 0x38(%rsp) - shrdq $0x3b, %rsi, %rbx - movq %rbx, 0x40(%rsp) - sarq $0x3b, %rsi - movq %rsi, 0x48(%rsp) - movq 0xa0(%rsp), %rbx - movq 0xa8(%rsp), %rbp - xorl %ecx, %ecx - movq 0x50(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq 0x78(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - xorl %esi, %esi - movq 0x50(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, 0x50(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq 0x78(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, 0x78(%rsp) - xorl %ebx, %ebx - movq 0x58(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq 0x80(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rbx - xorl %ebp, %ebp - movq 0x58(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rcx, 0x58(%rsp) - addq %rax, %rsi - adcq %rdx, %rbp - movq 0x80(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - movq %rsi, 0x80(%rsp) - xorl %ecx, %ecx - movq 0x60(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq 0x88(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - xorl %esi, %esi - movq 0x60(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, 0x60(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq 0x88(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, 0x88(%rsp) - movq 0x68(%rsp), %rax - xorq %r9, %rax - movq %r9, %rbx - andq %r8, %rbx - negq %rbx - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq 0x90(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbx - mulq %r10 - addq %rax, %rcx - adcq %rbx, %rdx - movq 0x68(%rsp), %rax - movq %rcx, 0x68(%rsp) - movq %rdx, 0x70(%rsp) - xorq %r13, %rax - movq %r13, %rcx - andq %r12, %rcx - negq %rcx - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rcx - movq 0x90(%rsp), %rax - xorq %r15, %rax - movq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rcx - mulq %r14 - addq %rax, %rsi - adcq %rcx, %rdx - movq %rsi, 0x90(%rsp) - movq %rdx, 0x98(%rsp) - movq $0xe000000000000000, %r8 - addq 0x50(%rsp), %r8 - movq $0xffffffffffffffff, %r9 - adcq 0x58(%rsp), %r9 - movq $0x1fffffff, %r10 - adcq 0x60(%rsp), %r10 - movq $0x2000000000000000, %r11 - adcq 0x68(%rsp), %r11 - movq $0x1fffffffe0000000, %r12 - adcq 0x70(%rsp), %r12 - movq %r8, %rbx - shlq $0x20, %rbx - movq $0xffffffff00000001, %rax - mulq %r8 - shrq $0x20, %r8 - addq %rbx, %r9 - adcq %r8, %r10 - adcq %rax, %r11 - adcq %rdx, %r12 - sbbq %rax, %rax - movl $0xffffffff, %ebx - andq %rax, %rbx - movq $0xffffffff00000001, %rdx - andq %rax, %rdx - subq %rax, %r9 - movq %r9, 0x50(%rsp) - sbbq %rbx, %r10 - movq %r10, 0x58(%rsp) - sbbq $0x0, %r11 - movq %r11, 0x60(%rsp) - sbbq %rdx, %r12 - movq %r12, 0x68(%rsp) - movq $0xe000000000000000, %r8 - addq 0x78(%rsp), %r8 - movq $0xffffffffffffffff, %r9 - adcq 0x80(%rsp), %r9 - movq $0x1fffffff, %r10 - adcq 0x88(%rsp), %r10 - movq $0x2000000000000000, %r11 - adcq 0x90(%rsp), %r11 - movq $0x1fffffffe0000000, %r12 - adcq 0x98(%rsp), %r12 - movq %r8, %rbx - shlq $0x20, %rbx - movq $0xffffffff00000001, %rax - mulq %r8 - shrq $0x20, %r8 - addq %rbx, %r9 - adcq %r8, %r10 - adcq %rax, %r11 - adcq %rdx, %r12 - sbbq %rax, %rax - movl $0xffffffff, %ebx - andq %rax, %rbx - movq $0xffffffff00000001, %rdx - andq %rax, %rdx - subq %rax, %r9 - movq %r9, 0x78(%rsp) - sbbq %rbx, %r10 - movq %r10, 0x80(%rsp) - sbbq $0x0, %r11 - movq %r11, 0x88(%rsp) - sbbq %rdx, %r12 - movq %r12, 0x90(%rsp) -Lp256_scalarmul_inv_midloop: - movq 0xb8(%rsp), %rsi - movq (%rsp), %rdx - movq 0x28(%rsp), %rcx - movq %rdx, %rbx - andq $0xfffff, %rbx - movq $0xfffffe0000000000, %rax - orq %rax, %rbx - andq $0xfffff, %rcx - movq $0xc000000000000000, %rax - orq %rax, %rcx - movq $0xfffffffffffffffe, %rax - xorl %ebp, %ebp - movl $0x2, %edx - movq %rbx, %rdi - movq %rax, %r8 - testq %rsi, %rsi - cmovs %rbp, %r8 - testq $0x1, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - sarq $1, %rcx - movl $0x100000, %eax - leaq (%rbx,%rax), %rdx - leaq (%rcx,%rax), %rdi - shlq $0x16, %rdx - shlq $0x16, %rdi - sarq $0x2b, %rdx - sarq $0x2b, %rdi - movq $0x20000100000, %rax - leaq (%rbx,%rax), %rbx - leaq (%rcx,%rax), %rcx - sarq $0x2a, %rbx - sarq $0x2a, %rcx - movq %rdx, 0xc0(%rsp) - movq %rbx, 0xc8(%rsp) - movq %rdi, 0xd0(%rsp) - movq %rcx, 0xd8(%rsp) - movq (%rsp), %r12 - imulq %r12, %rdi - imulq %rdx, %r12 - movq 0x28(%rsp), %r13 - imulq %r13, %rbx - imulq %rcx, %r13 - addq %rbx, %r12 - addq %rdi, %r13 - sarq $0x14, %r12 - sarq $0x14, %r13 - movq %r12, %rbx - andq $0xfffff, %rbx - movq $0xfffffe0000000000, %rax - orq %rax, %rbx - movq %r13, %rcx - andq $0xfffff, %rcx - movq $0xc000000000000000, %rax - orq %rax, %rcx - movq $0xfffffffffffffffe, %rax - movl $0x2, %edx - movq %rbx, %rdi - movq %rax, %r8 - testq %rsi, %rsi - cmovs %rbp, %r8 - testq $0x1, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - sarq $1, %rcx - movl $0x100000, %eax - leaq (%rbx,%rax), %r8 - leaq (%rcx,%rax), %r10 - shlq $0x16, %r8 - shlq $0x16, %r10 - sarq $0x2b, %r8 - sarq $0x2b, %r10 - movq $0x20000100000, %rax - leaq (%rbx,%rax), %r15 - leaq (%rcx,%rax), %r11 - sarq $0x2a, %r15 - sarq $0x2a, %r11 - movq %r13, %rbx - movq %r12, %rcx - imulq %r8, %r12 - imulq %r15, %rbx - addq %rbx, %r12 - imulq %r11, %r13 - imulq %r10, %rcx - addq %rcx, %r13 - sarq $0x14, %r12 - sarq $0x14, %r13 - movq %r12, %rbx - andq $0xfffff, %rbx - movq $0xfffffe0000000000, %rax - orq %rax, %rbx - movq %r13, %rcx - andq $0xfffff, %rcx - movq $0xc000000000000000, %rax - orq %rax, %rcx - movq 0xc0(%rsp), %rax - imulq %r8, %rax - movq 0xd0(%rsp), %rdx - imulq %r15, %rdx - imulq 0xc8(%rsp), %r8 - imulq 0xd8(%rsp), %r15 - addq %r8, %r15 - leaq (%rax,%rdx), %r9 - movq 0xc0(%rsp), %rax - imulq %r10, %rax - movq 0xd0(%rsp), %rdx - imulq %r11, %rdx - imulq 0xc8(%rsp), %r10 - imulq 0xd8(%rsp), %r11 - addq %r10, %r11 - leaq (%rax,%rdx), %r13 - movq $0xfffffffffffffffe, %rax - movl $0x2, %edx - movq %rbx, %rdi - movq %rax, %r8 - testq %rsi, %rsi - cmovs %rbp, %r8 - testq $0x1, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - sarq $1, %rcx - movl $0x100000, %eax - leaq (%rbx,%rax), %r8 - leaq (%rcx,%rax), %r12 - shlq $0x15, %r8 - shlq $0x15, %r12 - sarq $0x2b, %r8 - sarq $0x2b, %r12 - movq $0x20000100000, %rax - leaq (%rbx,%rax), %r10 - leaq (%rcx,%rax), %r14 - sarq $0x2b, %r10 - sarq $0x2b, %r14 - movq %r9, %rax - imulq %r8, %rax - movq %r13, %rdx - imulq %r10, %rdx - imulq %r15, %r8 - imulq %r11, %r10 - addq %r8, %r10 - leaq (%rax,%rdx), %r8 - movq %r9, %rax - imulq %r12, %rax - movq %r13, %rdx - imulq %r14, %rdx - imulq %r15, %r12 - imulq %r11, %r14 - addq %r12, %r14 - leaq (%rax,%rdx), %r12 - movq %rsi, 0xb8(%rsp) - decq 0xb0(%rsp) - jne Lp256_scalarmul_inv_loop - movq (%rsp), %rax - movq 0x28(%rsp), %rcx - imulq %r8, %rax - imulq %r10, %rcx - addq %rcx, %rax - sarq $0x3f, %rax - movq %r8, %r9 - sarq $0x3f, %r9 - xorq %r9, %r8 - subq %r9, %r8 - xorq %rax, %r9 - movq %r10, %r11 - sarq $0x3f, %r11 - xorq %r11, %r10 - subq %r11, %r10 - xorq %rax, %r11 - movq %r12, %r13 - sarq $0x3f, %r13 - xorq %r13, %r12 - subq %r13, %r12 - xorq %rax, %r13 - movq %r14, %r15 - sarq $0x3f, %r15 - xorq %r15, %r14 - subq %r15, %r14 - xorq %rax, %r15 - movq %r8, %rax - andq %r9, %rax - movq %r10, %r12 - andq %r11, %r12 - addq %rax, %r12 - xorl %r13d, %r13d - movq 0x50(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r12 - adcq %rdx, %r13 - movq 0x78(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movq 0x58(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r13 - adcq %rdx, %r14 - movq 0x80(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r13 - adcq %rdx, %r14 - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r14 - adcq %rdx, %r15 - movq 0x88(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r14 - adcq %rdx, %r15 - movq 0x68(%rsp), %rax - xorq %r9, %rax - andq %r8, %r9 - negq %r9 - mulq %r8 - addq %rax, %r15 - adcq %rdx, %r9 - movq 0x90(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %r9 - mulq %r10 - addq %rax, %r15 - adcq %rdx, %r9 - movq %r12, 0x50(%rsp) - movq %r13, 0x58(%rsp) - movq %r14, 0x60(%rsp) - movq %r15, 0x68(%rsp) - movq %r9, 0x70(%rsp) - movq $0xe000000000000000, %r8 - addq 0x50(%rsp), %r8 - movq $0xffffffffffffffff, %r9 - adcq 0x58(%rsp), %r9 - movq $0x1fffffff, %r10 - adcq 0x60(%rsp), %r10 - movq $0x2000000000000000, %r11 - adcq 0x68(%rsp), %r11 - movq $0x1fffffffe0000000, %r12 - adcq 0x70(%rsp), %r12 - movq %r8, %rbx - shlq $0x20, %rbx - movq $0xffffffff00000001, %rax - mulq %r8 - shrq $0x20, %r8 - addq %rbx, %r9 - adcq %r8, %r10 - adcq %rax, %r11 - adcq %rdx, %r12 - sbbq %rax, %rax - movl $0xffffffff, %ebx - andq %rax, %rbx - movq $0xffffffff00000001, %rdx - andq %rax, %rdx - subq %rax, %r9 - movq %r9, 0x50(%rsp) - sbbq %rbx, %r10 - movq %r10, 0x58(%rsp) - sbbq $0x0, %r11 - movq %r11, 0x60(%rsp) - sbbq %rdx, %r12 - movq %r12, 0x68(%rsp) - movq 0x50(%rsp), %r8 - movq 0x58(%rsp), %r9 - movq 0x60(%rsp), %r10 - movq 0x68(%rsp), %r11 - movl $0x1, %eax - movl $0xffffffff, %ebx - leaq -0x2(%rax), %rcx - leaq -0x1(%rbx), %rdx - notq %rbx - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - cmovaeq %r8, %rax - cmovaeq %r9, %rbx - cmovaeq %r10, %rcx - cmovaeq %r11, %rdx - movq 0xe0(%rsp), %rdi - movq %rax, (%rdi) - movq %rbx, 0x8(%rdi) - movq %rcx, 0x10(%rdi) - movq %rdx, 0x18(%rdi) - CFI_INC_RSP(240) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -Lp256_scalarmul_local_montmul_p256: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - movq %rdx, %rcx - xorl %r13d, %r13d - movq (%rcx), %rdx - mulxq (%rsi), %r8, %r9 - mulxq 0x8(%rsi), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x10(%rsi), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x18(%rsi), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x8(%rcx), %rdx - xorl %r14d, %r14d - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x10(%rcx), %rdx - xorl %r8d, %r8d - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x18(%rsi), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x18(%rcx), %rdx - xorl %r9d, %r9d - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x18(%rsi), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rdi) - movq %r13, 0x8(%rdi) - movq %r14, 0x10(%rdi) - movq %r15, 0x18(%rdi) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_RET - -Lp256_scalarmul_local_montsqr_p256: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - movq (%rsi), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x8(%rsi), %r9, %r10 - mulxq 0x18(%rsi), %r11, %r12 - movq 0x10(%rsi), %rdx - mulxq 0x18(%rsi), %r13, %r14 - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x18(%rsi), %rdx - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - xorl %ebp, %ebp - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x8(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x10(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x18(%rsi), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rbp, %r15 - adoxq %rbp, %r15 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - movl %ebp, %r9d - adoxq %rbp, %r9 - adcxq %rbp, %r9 - addq %r9, %r14 - adcq %rbp, %r15 - movl %ebp, %r8d - adcq %rbp, %r8 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rbp, %r15 - adoxq %rbp, %r8 - adcq %rbp, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rdx), %rdx - adcq %r13, %rdx - leaq -0x1(%rbp), %rbp - movq %rbp, %rax - adcq %r14, %rbp - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbp, %r14 - cmovbq %r11, %r15 - movq %r12, (%rdi) - movq %r13, 0x8(%rdi) - movq %r14, 0x10(%rdi) - movq %r15, 0x18(%rdi) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -Lp256_scalarmul_local_tomont_p256: - CFI_START - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - xorq %r13, %r13 - movl $0x3, %edx - mulxq (%rsi), %r8, %r9 - mulxq 0x8(%rsi), %rcx, %r10 - adcxq %rcx, %r9 - mulxq 0x10(%rsi), %rcx, %r11 - adcxq %rcx, %r10 - mulxq 0x18(%rsi), %rcx, %r12 - adcxq %rcx, %r11 - adcxq %r13, %r12 - movq $0xfffffffbffffffff, %rdx - xorq %r14, %r14 - mulxq (%rsi), %rax, %rcx - adcxq %rax, %r9 - adoxq %rcx, %r10 - mulxq 0x8(%rsi), %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - mulxq 0x10(%rsi), %rax, %rcx - adcxq %rax, %r11 - adoxq %rcx, %r12 - mulxq 0x18(%rsi), %rax, %rcx - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcq %r14, %r13 - xorq %r15, %r15 - movq $0x100000000, %rdx - mulxq %r8, %rax, %rcx - adcxq %rax, %r9 - adoxq %rcx, %r10 - mulxq %r9, %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rcx - adcxq %rax, %r11 - adoxq %rcx, %r12 - mulxq %r9, %rax, %rcx - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcxq %r15, %r14 - movq $0xfffffffffffffffe, %rdx - xorq %r8, %r8 - mulxq (%rsi), %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - mulxq 0x8(%rsi), %rax, %rcx - adcxq %rax, %r11 - adoxq %rcx, %r12 - mulxq 0x10(%rsi), %rax, %rcx - adcxq %rax, %r12 - adoxq %rcx, %r13 - mulxq 0x18(%rsi), %rax, %rcx - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %r8, %r14 - adoxq %r8, %r15 - adcxq %r8, %r15 - movq $0x4fffffffd, %rdx - xorq %r9, %r9 - mulxq (%rsi), %rax, %rcx - adcxq %rax, %r11 - adoxq %rcx, %r12 - mulxq 0x8(%rsi), %rax, %rcx - adcxq %rax, %r12 - adoxq %rcx, %r13 - mulxq 0x10(%rsi), %rax, %rcx - adcxq %rax, %r13 - adoxq %rcx, %r14 - mulxq 0x18(%rsi), %rax, %rcx - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcxq %r9, %r8 - xorq %r9, %r9 - movq $0x100000000, %rdx - mulxq %r10, %rax, %rcx - adcxq %rax, %r11 - adoxq %rcx, %r12 - mulxq %r11, %rax, %rcx - adcxq %rax, %r12 - adoxq %rcx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rcx - adcxq %rax, %r13 - adoxq %rcx, %r14 - mulxq %r11, %rax, %rcx - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcxq %r9, %r8 - movl $0xffffffff, %edx - movq $0xffffffff00000001, %rcx - movq $0xfffffffffffffffe, %rax - subq %r12, %rax - movq %rdx, %rax - sbbq %r13, %rax - movl $0x0, %eax - sbbq %r14, %rax - movq %rcx, %rax - sbbq %r15, %rax - movl $0x0, %eax - sbbq %r8, %rax - andq %rax, %rdx - andq %rax, %rcx - subq %rax, %r12 - sbbq %rdx, %r13 - sbbq $0x0, %r14 - sbbq %rcx, %r15 - movq %r12, (%rdi) - movq %r13, 0x8(%rdi) - movq %r14, 0x10(%rdi) - movq %r15, 0x18(%rdi) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_RET - -Lp256_scalarmul_local_p256_montjadd: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(224) - movq %rdx, %rbp - movq 0x40(%rsi), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x48(%rsi), %r9, %r10 - mulxq 0x58(%rsi), %r11, %r12 - movq 0x50(%rsi), %rdx - mulxq 0x58(%rsi), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x58(%rsi), %rdx - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x48(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x50(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x58(%rsi), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - movl %ecx, %r9d - adoxq %rcx, %r9 - adcxq %rcx, %r9 - addq %r9, %r14 - adcq %rcx, %r15 - movl %ecx, %r8d - adcq %rcx, %r8 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rcx, %r15 - adoxq %rcx, %r8 - adcq %rcx, %r8 - movl $0x1, %r8d - leaq -0x1(%rdx), %rdx - leaq -0x1(%rcx), %rax - movl $0xfffffffe, %r11d - cmoveq %rcx, %r8 - cmoveq %rcx, %rdx - cmoveq %rcx, %rax - cmoveq %rcx, %r11 - addq %r8, %r12 - adcq %rdx, %r13 - adcq %rax, %r14 - adcq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x40(%rbp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x48(%rbp), %r9, %r10 - mulxq 0x58(%rbp), %r11, %r12 - movq 0x50(%rbp), %rdx - mulxq 0x58(%rbp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x40(%rbp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rbp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x58(%rbp), %rdx - mulxq 0x48(%rbp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x48(%rbp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x50(%rbp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x58(%rbp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - movl %ecx, %r9d - adoxq %rcx, %r9 - adcxq %rcx, %r9 - addq %r9, %r14 - adcq %rcx, %r15 - movl %ecx, %r8d - adcq %rcx, %r8 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rcx, %r15 - adoxq %rcx, %r8 - adcq %rcx, %r8 - movl $0x1, %r8d - leaq -0x1(%rdx), %rdx - leaq -0x1(%rcx), %rax - movl $0xfffffffe, %r11d - cmoveq %rcx, %r8 - cmoveq %rcx, %rdx - cmoveq %rcx, %rax - cmoveq %rcx, %r11 - addq %r8, %r12 - adcq %rdx, %r13 - adcq %rax, %r14 - adcq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - xorl %r13d, %r13d - movq 0x20(%rsi), %rdx - mulxq 0x40(%rbp), %r8, %r9 - mulxq 0x48(%rbp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x50(%rbp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x58(%rbp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x28(%rsi), %rdx - xorl %r14d, %r14d - mulxq 0x40(%rbp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x48(%rbp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x50(%rbp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x58(%rbp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x30(%rsi), %rdx - xorl %r8d, %r8d - mulxq 0x40(%rbp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rbp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x50(%rbp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x58(%rbp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x38(%rsi), %rdx - xorl %r9d, %r9d - mulxq 0x40(%rbp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x48(%rbp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x50(%rbp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x58(%rbp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xc0(%rsp) - movq %r13, 0xc8(%rsp) - movq %r14, 0xd0(%rsp) - movq %r15, 0xd8(%rsp) - xorl %r13d, %r13d - movq 0x20(%rbp), %rdx - mulxq 0x40(%rsi), %r8, %r9 - mulxq 0x48(%rsi), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x50(%rsi), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x58(%rsi), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x28(%rbp), %rdx - xorl %r14d, %r14d - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x50(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x58(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x30(%rbp), %rdx - xorl %r8d, %r8d - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x50(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x58(%rsi), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x38(%rbp), %rdx - xorl %r9d, %r9d - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x50(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x58(%rsi), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - xorl %r13d, %r13d - movq 0x0(%rbp), %rdx - mulxq (%rsp), %r8, %r9 - mulxq 0x8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x10(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x18(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x8(%rbp), %rdx - xorl %r14d, %r14d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x10(%rbp), %rdx - xorl %r8d, %r8d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x18(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x18(%rbp), %rdx - xorl %r9d, %r9d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x18(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - xorl %r13d, %r13d - movq (%rsi), %rdx - mulxq 0xa0(%rsp), %r8, %r9 - mulxq 0xa8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0xb0(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0xb8(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x8(%rsi), %rdx - xorl %r14d, %r14d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x10(%rsi), %rdx - xorl %r8d, %r8d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x18(%rsi), %rdx - xorl %r9d, %r9d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - xorl %r13d, %r13d - movq 0x20(%rsp), %rdx - mulxq (%rsp), %r8, %r9 - mulxq 0x8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x10(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x18(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x28(%rsp), %rdx - xorl %r14d, %r14d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x30(%rsp), %rdx - xorl %r8d, %r8d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x18(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x38(%rsp), %rdx - xorl %r9d, %r9d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x18(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - xorl %r13d, %r13d - movq 0xc0(%rsp), %rdx - mulxq 0xa0(%rsp), %r8, %r9 - mulxq 0xa8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0xb0(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0xb8(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0xc8(%rsp), %rdx - xorl %r14d, %r14d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0xd0(%rsp), %rdx - xorl %r8d, %r8d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0xd8(%rsp), %rdx - xorl %r9d, %r9d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xc0(%rsp) - movq %r13, 0xc8(%rsp) - movq %r14, 0xd0(%rsp) - movq %r15, 0xd8(%rsp) - movq 0x40(%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0xa0(%rsp) - adcq %r10, %rcx - movq %rcx, 0xa8(%rsp) - adcq $0x0, %r8 - movq %r8, 0xb0(%rsp) - adcq %rdx, %r9 - movq %r9, 0xb8(%rsp) - movq 0x20(%rsp), %rax - subq 0xc0(%rsp), %rax - movq 0x28(%rsp), %rcx - sbbq 0xc8(%rsp), %rcx - movq 0x30(%rsp), %r8 - sbbq 0xd0(%rsp), %r8 - movq 0x38(%rsp), %r9 - sbbq 0xd8(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x20(%rsp) - adcq %r10, %rcx - movq %rcx, 0x28(%rsp) - adcq $0x0, %r8 - movq %r8, 0x30(%rsp) - adcq %rdx, %r9 - movq %r9, 0x38(%rsp) - movq 0xa0(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0xa8(%rsp), %r9, %r10 - mulxq 0xb8(%rsp), %r11, %r12 - movq 0xb0(%rsp), %rdx - mulxq 0xb8(%rsp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0xb8(%rsp), %rdx - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0xa8(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0xb0(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0xb8(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - movl %ecx, %r9d - adoxq %rcx, %r9 - adcxq %rcx, %r9 - addq %r9, %r14 - adcq %rcx, %r15 - movl %ecx, %r8d - adcq %rcx, %r8 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rcx, %r15 - adoxq %rcx, %r8 - adcq %rcx, %r8 - movl $0x1, %r8d - leaq -0x1(%rdx), %rdx - leaq -0x1(%rcx), %rax - movl $0xfffffffe, %r11d - cmoveq %rcx, %r8 - cmoveq %rcx, %rdx - cmoveq %rcx, %rax - cmoveq %rcx, %r11 - addq %r8, %r12 - adcq %rdx, %r13 - adcq %rax, %r14 - adcq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x20(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x28(%rsp), %r9, %r10 - mulxq 0x38(%rsp), %r11, %r12 - movq 0x30(%rsp), %rdx - mulxq 0x38(%rsp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x38(%rsp), %rdx - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x28(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x30(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x38(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - movl %ecx, %r9d - adoxq %rcx, %r9 - adcxq %rcx, %r9 - addq %r9, %r14 - adcq %rcx, %r15 - movl %ecx, %r8d - adcq %rcx, %r8 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rcx, %r15 - adoxq %rcx, %r8 - adcq %rcx, %r8 - movl $0x1, %ebx - addq %r12, %rbx - leaq -0x1(%rdx), %rdx - adcq %r13, %rdx - leaq -0x1(%rcx), %rcx - movq %rcx, %rax - adcq %r14, %rcx - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rbx, %r12 - cmovbq %rdx, %r13 - cmovbq %rcx, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - xorl %r13d, %r13d - movq 0x80(%rsp), %rdx - mulxq 0x60(%rsp), %r8, %r9 - mulxq 0x68(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x70(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x78(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x88(%rsp), %rdx - xorl %r14d, %r14d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x78(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x90(%rsp), %rdx - xorl %r8d, %r8d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x98(%rsp), %rdx - xorl %r9d, %r9d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - xorl %r13d, %r13d - movq 0x40(%rsp), %rdx - mulxq 0x60(%rsp), %r8, %r9 - mulxq 0x68(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x70(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x78(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x48(%rsp), %rdx - xorl %r14d, %r14d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x78(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x50(%rsp), %rdx - xorl %r8d, %r8d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x58(%rsp), %rdx - xorl %r9d, %r9d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq (%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq $0x0, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x40(%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x60(%rsp) - adcq %r10, %rcx - movq %rcx, 0x68(%rsp) - adcq $0x0, %r8 - movq %r8, 0x70(%rsp) - adcq %rdx, %r9 - movq %r9, 0x78(%rsp) - xorl %r13d, %r13d - movq 0x40(%rsi), %rdx - mulxq 0xa0(%rsp), %r8, %r9 - mulxq 0xa8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0xb0(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0xb8(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x48(%rsi), %rdx - xorl %r14d, %r14d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x50(%rsi), %rdx - xorl %r8d, %r8d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x58(%rsi), %rdx - xorl %r9d, %r9d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq (%rsp), %rax - subq 0x40(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x48(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x50(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x58(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq $0x0, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x80(%rsp), %rax - subq (%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x18(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq $0x0, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - xorl %r13d, %r13d - movq 0xc0(%rsp), %rdx - mulxq 0x60(%rsp), %r8, %r9 - mulxq 0x68(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x70(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x78(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0xc8(%rsp), %rdx - xorl %r14d, %r14d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x78(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0xd0(%rsp), %rdx - xorl %r8d, %r8d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0xd8(%rsp), %rdx - xorl %r9d, %r9d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - xorl %r13d, %r13d - movq 0x40(%rbp), %rdx - mulxq 0xa0(%rsp), %r8, %r9 - mulxq 0xa8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0xb0(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0xb8(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x48(%rbp), %rdx - xorl %r14d, %r14d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x50(%rbp), %rdx - xorl %r8d, %r8d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x58(%rbp), %rdx - xorl %r9d, %r9d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - xorl %r13d, %r13d - movq 0x80(%rsp), %rdx - mulxq 0x20(%rsp), %r8, %r9 - mulxq 0x28(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x30(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x38(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x88(%rsp), %rdx - xorl %r14d, %r14d - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x30(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x38(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x90(%rsp), %rdx - xorl %r8d, %r8d - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x30(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x38(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x98(%rsp), %rdx - xorl %r9d, %r9d - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x30(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x38(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x80(%rsp), %rax - subq 0x60(%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x68(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x70(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x78(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq $0x0, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - movq 0x40(%rsi), %r8 - movq 0x48(%rsi), %r9 - movq 0x50(%rsi), %r10 - movq 0x58(%rsi), %r11 - movq %r8, %rax - movq %r9, %rdx - orq %r10, %rax - orq %r11, %rdx - orq %rdx, %rax - negq %rax - sbbq %rax, %rax - movq 0x40(%rbp), %r12 - movq 0x48(%rbp), %r13 - movq 0x50(%rbp), %r14 - movq 0x58(%rbp), %r15 - movq %r12, %rbx - movq %r13, %rdx - orq %r14, %rbx - orq %r15, %rdx - orq %rdx, %rbx - negq %rbx - sbbq %rbx, %rbx - cmpq %rax, %rbx - cmovbq %r8, %r12 - cmovbq %r9, %r13 - cmovbq %r10, %r14 - cmovbq %r11, %r15 - cmoveq 0xa0(%rsp), %r12 - cmoveq 0xa8(%rsp), %r13 - cmoveq 0xb0(%rsp), %r14 - cmoveq 0xb8(%rsp), %r15 - movq (%rsp), %rax - cmovbq (%rsi), %rax - cmova 0x0(%rbp), %rax - movq 0x8(%rsp), %rbx - cmovbq 0x8(%rsi), %rbx - cmova 0x8(%rbp), %rbx - movq 0x10(%rsp), %rcx - cmovbq 0x10(%rsi), %rcx - cmova 0x10(%rbp), %rcx - movq 0x18(%rsp), %rdx - cmovbq 0x18(%rsi), %rdx - cmova 0x18(%rbp), %rdx - movq 0x80(%rsp), %r8 - cmovbq 0x20(%rsi), %r8 - cmova 0x20(%rbp), %r8 - movq 0x88(%rsp), %r9 - cmovbq 0x28(%rsi), %r9 - cmova 0x28(%rbp), %r9 - movq 0x90(%rsp), %r10 - cmovbq 0x30(%rsi), %r10 - cmova 0x30(%rbp), %r10 - movq 0x98(%rsp), %r11 - cmovbq 0x38(%rsi), %r11 - cmova 0x38(%rbp), %r11 - movq %rax, (%rdi) - movq %rbx, 0x8(%rdi) - movq %rcx, 0x10(%rdi) - movq %rdx, 0x18(%rdi) - movq %r8, 0x20(%rdi) - movq %r9, 0x28(%rdi) - movq %r10, 0x30(%rdi) - movq %r11, 0x38(%rdi) - movq %r12, 0x40(%rdi) - movq %r13, 0x48(%rdi) - movq %r14, 0x50(%rdi) - movq %r15, 0x58(%rdi) - CFI_INC_RSP(224) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -Lp256_scalarmul_local_p256_montjdouble: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(192) - movq 0x40(%rsi), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x48(%rsi), %r9, %r10 - mulxq 0x58(%rsi), %r11, %r12 - movq 0x50(%rsi), %rdx - mulxq 0x58(%rsi), %r13, %r14 - xorl %ebp, %ebp - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x58(%rsi), %rdx - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - xorl %ebp, %ebp - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x48(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x50(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x58(%rsi), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rbp, %r15 - adoxq %rbp, %r15 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - movl %ebp, %r9d - adoxq %rbp, %r9 - adcxq %rbp, %r9 - addq %r9, %r14 - adcq %rbp, %r15 - movl %ebp, %r8d - adcq %rbp, %r8 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rbp, %r15 - adoxq %rbp, %r8 - adcq %rbp, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rdx), %rdx - adcq %r13, %rdx - leaq -0x1(%rbp), %rbp - movq %rbp, %rax - adcq %r14, %rbp - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbp, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x20(%rsi), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x28(%rsi), %r9, %r10 - mulxq 0x38(%rsi), %r11, %r12 - movq 0x30(%rsi), %rdx - mulxq 0x38(%rsi), %r13, %r14 - xorl %ebp, %ebp - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x38(%rsi), %rdx - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - xorl %ebp, %ebp - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x28(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x30(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x38(%rsi), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rbp, %r15 - adoxq %rbp, %r15 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - movl %ebp, %r9d - adoxq %rbp, %r9 - adcxq %rbp, %r9 - addq %r9, %r14 - adcq %rbp, %r15 - movl %ebp, %r8d - adcq %rbp, %r8 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rbp, %r15 - adoxq %rbp, %r8 - adcq %rbp, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rdx), %rdx - adcq %r13, %rdx - leaq -0x1(%rbp), %rbp - movq %rbp, %rax - adcq %r14, %rbp - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbp, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq (%rsi), %rax - subq (%rsp), %rax - movq 0x8(%rsi), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x10(%rsi), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x18(%rsi), %r9 - sbbq 0x18(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x60(%rsp) - adcq %r10, %rcx - movq %rcx, 0x68(%rsp) - adcq $0x0, %r8 - movq %r8, 0x70(%rsp) - adcq %rdx, %r9 - movq %r9, 0x78(%rsp) - movq (%rsi), %rax - addq (%rsp), %rax - movq 0x8(%rsi), %rcx - adcq 0x8(%rsp), %rcx - movq 0x10(%rsi), %r8 - adcq 0x10(%rsp), %r8 - movq 0x18(%rsi), %r9 - adcq 0x18(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - subq %r11, %rax - movq %rax, 0x40(%rsp) - sbbq %r10, %rcx - movq %rcx, 0x48(%rsp) - sbbq $0x0, %r8 - movq %r8, 0x50(%rsp) - sbbq %rdx, %r9 - movq %r9, 0x58(%rsp) - xorl %r13d, %r13d - movq 0x60(%rsp), %rdx - mulxq 0x40(%rsp), %r8, %r9 - mulxq 0x48(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x50(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x58(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x68(%rsp), %rdx - xorl %r14d, %r14d - mulxq 0x40(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x48(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x50(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x58(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x70(%rsp), %rdx - xorl %r8d, %r8d - mulxq 0x40(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x50(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x58(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x78(%rsp), %rdx - xorl %r9d, %r9d - mulxq 0x40(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x48(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x50(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x58(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - xorq %r11, %r11 - movq 0x20(%rsi), %rax - addq 0x40(%rsi), %rax - movq 0x28(%rsi), %rcx - adcq 0x48(%rsi), %rcx - movq 0x30(%rsi), %r8 - adcq 0x50(%rsi), %r8 - movq 0x38(%rsi), %r9 - adcq 0x58(%rsi), %r9 - adcq %r11, %r11 - subq $0xffffffffffffffff, %rax - movl $0xffffffff, %r10d - sbbq %r10, %rcx - sbbq $0x0, %r8 - movq $0xffffffff00000001, %rdx - sbbq %rdx, %r9 - sbbq $0x0, %r11 - andq %r11, %r10 - andq %r11, %rdx - addq %r11, %rax - movq %rax, 0x40(%rsp) - adcq %r10, %rcx - movq %rcx, 0x48(%rsp) - adcq $0x0, %r8 - movq %r8, 0x50(%rsp) - adcq %rdx, %r9 - movq %r9, 0x58(%rsp) - xorl %r13d, %r13d - movq 0x20(%rsp), %rdx - mulxq (%rsi), %r8, %r9 - mulxq 0x8(%rsi), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x10(%rsi), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x18(%rsi), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x28(%rsp), %rdx - xorl %r14d, %r14d - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x30(%rsp), %rdx - xorl %r8d, %r8d - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x18(%rsi), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x38(%rsp), %rdx - xorl %r9d, %r9d - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x18(%rsi), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x60(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x68(%rsp), %r9, %r10 - mulxq 0x78(%rsp), %r11, %r12 - movq 0x70(%rsp), %rdx - mulxq 0x78(%rsp), %r13, %r14 - xorl %ebp, %ebp - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x78(%rsp), %rdx - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - xorl %ebp, %ebp - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x68(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x70(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x78(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rbp, %r15 - adoxq %rbp, %r15 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - movl %ebp, %r9d - adoxq %rbp, %r9 - adcxq %rbp, %r9 - addq %r9, %r14 - adcq %rbp, %r15 - movl %ebp, %r8d - adcq %rbp, %r8 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rbp, %r15 - adoxq %rbp, %r8 - adcq %rbp, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rdx), %rdx - adcq %r13, %rdx - leaq -0x1(%rbp), %rbp - movq %rbp, %rax - adcq %r14, %rbp - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbp, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq 0x40(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x48(%rsp), %r9, %r10 - mulxq 0x58(%rsp), %r11, %r12 - movq 0x50(%rsp), %rdx - mulxq 0x58(%rsp), %r13, %r14 - xorl %ebp, %ebp - mulxq 0x40(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x58(%rsp), %rdx - mulxq 0x48(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - xorl %ebp, %ebp - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x48(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x50(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x58(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rbp, %r15 - adoxq %rbp, %r15 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - movl %ebp, %r9d - adoxq %rbp, %r9 - adcxq %rbp, %r9 - addq %r9, %r14 - adcq %rbp, %r15 - movl %ebp, %r8d - adcq %rbp, %r8 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rbp, %r15 - adoxq %rbp, %r8 - adcq %rbp, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rdx), %rdx - adcq %r13, %rdx - leaq -0x1(%rbp), %rbp - movq %rbp, %rax - adcq %r14, %rbp - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbp, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq $0xffffffffffffffff, %r8 - xorl %r10d, %r10d - subq 0xa0(%rsp), %r8 - movq $0xffffffff, %r9 - sbbq 0xa8(%rsp), %r9 - sbbq 0xb0(%rsp), %r10 - movq $0xffffffff00000001, %r11 - sbbq 0xb8(%rsp), %r11 - xorl %r12d, %r12d - movq $0x9, %rdx - mulxq %r8, %r8, %rax - mulxq %r9, %r9, %rcx - addq %rax, %r9 - mulxq %r10, %r10, %rax - adcq %rcx, %r10 - mulxq %r11, %r11, %rcx - adcq %rax, %r11 - adcq %rcx, %r12 - movq $0xc, %rdx - xorl %eax, %eax - mulxq 0x80(%rsp), %rax, %rcx - adcxq %rax, %r8 - adoxq %rcx, %r9 - mulxq 0x88(%rsp), %rax, %rcx - adcxq %rax, %r9 - adoxq %rcx, %r10 - mulxq 0x90(%rsp), %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - mulxq 0x98(%rsp), %rax, %rdx - adcxq %rax, %r11 - adoxq %r12, %rdx - adcq $0x1, %rdx - addq %rdx, %r8 - movq $0x100000000, %rax - mulxq %rax, %rax, %rcx - sbbq $0x0, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - movq $0xffffffff00000001, %rax - mulxq %rax, %rax, %rcx - sbbq %rax, %r11 - sbbq %rcx, %rdx - decq %rdx - movl $0xffffffff, %eax - andq %rdx, %rax - xorl %ecx, %ecx - subq %rax, %rcx - addq %rdx, %r8 - movq %r8, 0xa0(%rsp) - adcq %rax, %r9 - movq %r9, 0xa8(%rsp) - adcq $0x0, %r10 - movq %r10, 0xb0(%rsp) - adcq %rcx, %r11 - movq %r11, 0xb8(%rsp) - movq 0x40(%rsp), %rax - subq (%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x18(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x40(%rsp) - adcq %r10, %rcx - movq %rcx, 0x48(%rsp) - adcq $0x0, %r8 - movq %r8, 0x50(%rsp) - adcq %rdx, %r9 - movq %r9, 0x58(%rsp) - movq 0x20(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x28(%rsp), %r9, %r10 - mulxq 0x38(%rsp), %r11, %r12 - movq 0x30(%rsp), %rdx - mulxq 0x38(%rsp), %r13, %r14 - xorl %ebp, %ebp - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x38(%rsp), %rdx - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - xorl %ebp, %ebp - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x28(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x30(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x38(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rbp, %r15 - adoxq %rbp, %r15 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - movl %ebp, %r9d - adoxq %rbp, %r9 - adcxq %rbp, %r9 - addq %r9, %r14 - adcq %rbp, %r15 - movl %ebp, %r8d - adcq %rbp, %r8 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rbp, %r15 - adoxq %rbp, %r8 - adcq %rbp, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rdx), %rdx - adcq %r13, %rdx - leaq -0x1(%rbp), %rbp - movq %rbp, %rax - adcq %r14, %rbp - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbp, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - xorl %r13d, %r13d - movq 0x60(%rsp), %rdx - mulxq 0xa0(%rsp), %r8, %r9 - mulxq 0xa8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0xb0(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0xb8(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x68(%rsp), %rdx - xorl %r14d, %r14d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x70(%rsp), %rdx - xorl %r8d, %r8d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x78(%rsp), %rdx - xorl %r9d, %r9d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x40(%rsp), %rax - subq 0x20(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x28(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x30(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x38(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x40(%rdi) - adcq %r10, %rcx - movq %rcx, 0x48(%rdi) - adcq $0x0, %r8 - movq %r8, 0x50(%rdi) - adcq %rdx, %r9 - movq %r9, 0x58(%rdi) - movq 0x98(%rsp), %r11 - movq %r11, %rdx - movq 0x90(%rsp), %r10 - shldq $0x2, %r10, %r11 - movq 0x88(%rsp), %r9 - shldq $0x2, %r9, %r10 - movq 0x80(%rsp), %r8 - shldq $0x2, %r8, %r9 - shlq $0x2, %r8 - shrq $0x3e, %rdx - addq $0x1, %rdx - subq 0xa0(%rsp), %r8 - sbbq 0xa8(%rsp), %r9 - sbbq 0xb0(%rsp), %r10 - sbbq 0xb8(%rsp), %r11 - sbbq $0x0, %rdx - addq %rdx, %r8 - movq $0x100000000, %rax - mulxq %rax, %rax, %rcx - sbbq $0x0, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - movq $0xffffffff00000001, %rax - mulxq %rax, %rax, %rcx - sbbq %rax, %r11 - sbbq %rcx, %rdx - decq %rdx - movl $0xffffffff, %eax - andq %rdx, %rax - xorl %ecx, %ecx - subq %rax, %rcx - addq %rdx, %r8 - movq %r8, (%rdi) - adcq %rax, %r9 - movq %r9, 0x8(%rdi) - adcq $0x0, %r10 - movq %r10, 0x10(%rdi) - adcq %rcx, %r11 - movq %r11, 0x18(%rdi) - movq $0xffffffffffffffff, %r8 - xorl %r10d, %r10d - subq (%rsp), %r8 - movq $0xffffffff, %r9 - sbbq 0x8(%rsp), %r9 - sbbq 0x10(%rsp), %r10 - movq $0xffffffff00000001, %r11 - sbbq 0x18(%rsp), %r11 - movq %r11, %r12 - shldq $0x3, %r10, %r11 - shldq $0x3, %r9, %r10 - shldq $0x3, %r8, %r9 - shlq $0x3, %r8 - shrq $0x3d, %r12 - movq $0x3, %rdx - xorl %eax, %eax - mulxq 0x60(%rsp), %rax, %rcx - adcxq %rax, %r8 - adoxq %rcx, %r9 - mulxq 0x68(%rsp), %rax, %rcx - adcxq %rax, %r9 - adoxq %rcx, %r10 - mulxq 0x70(%rsp), %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - mulxq 0x78(%rsp), %rax, %rdx - adcxq %rax, %r11 - adoxq %r12, %rdx - adcq $0x1, %rdx - addq %rdx, %r8 - movq $0x100000000, %rax - mulxq %rax, %rax, %rcx - sbbq $0x0, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - movq $0xffffffff00000001, %rax - mulxq %rax, %rax, %rcx - sbbq %rax, %r11 - sbbq %rcx, %rdx - decq %rdx - movl $0xffffffff, %eax - andq %rdx, %rax - xorl %ecx, %ecx - subq %rax, %rcx - addq %rdx, %r8 - movq %r8, 0x20(%rdi) - adcq %rax, %r9 - movq %r9, 0x28(%rdi) - adcq $0x0, %r10 - movq %r10, 0x30(%rdi) - adcq %rcx, %r11 - movq %r11, 0x38(%rdi) - CFI_INC_RSP(192) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -Lp256_scalarmul_local_p256_montjmixadd: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(192) - movq %rdx, %rbp - movq 0x40(%rsi), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x48(%rsi), %r9, %r10 - mulxq 0x58(%rsi), %r11, %r12 - movq 0x50(%rsi), %rdx - mulxq 0x58(%rsi), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x58(%rsi), %rdx - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x48(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x50(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x58(%rsi), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - movl %ecx, %r9d - adoxq %rcx, %r9 - adcxq %rcx, %r9 - addq %r9, %r14 - adcq %rcx, %r15 - movl %ecx, %r8d - adcq %rcx, %r8 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rcx, %r15 - adoxq %rcx, %r8 - adcq %rcx, %r8 - movl $0x1, %r8d - leaq -0x1(%rdx), %rdx - leaq -0x1(%rcx), %rax - movl $0xfffffffe, %r11d - cmoveq %rcx, %r8 - cmoveq %rcx, %rdx - cmoveq %rcx, %rax - cmoveq %rcx, %r11 - addq %r8, %r12 - adcq %rdx, %r13 - adcq %rax, %r14 - adcq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - xorl %r13d, %r13d - movq 0x20(%rbp), %rdx - mulxq 0x40(%rsi), %r8, %r9 - mulxq 0x48(%rsi), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x50(%rsi), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x58(%rsi), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x28(%rbp), %rdx - xorl %r14d, %r14d - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x50(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x58(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x30(%rbp), %rdx - xorl %r8d, %r8d - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x50(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x58(%rsi), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x38(%rbp), %rdx - xorl %r9d, %r9d - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x50(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x58(%rsi), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - xorl %r13d, %r13d - movq 0x0(%rbp), %rdx - mulxq (%rsp), %r8, %r9 - mulxq 0x8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x10(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x18(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x8(%rbp), %rdx - xorl %r14d, %r14d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x10(%rbp), %rdx - xorl %r8d, %r8d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x18(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x18(%rbp), %rdx - xorl %r9d, %r9d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x18(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - xorl %r13d, %r13d - movq 0x20(%rsp), %rdx - mulxq (%rsp), %r8, %r9 - mulxq 0x8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x10(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x18(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x28(%rsp), %rdx - xorl %r14d, %r14d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x30(%rsp), %rdx - xorl %r8d, %r8d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x18(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x38(%rsp), %rdx - xorl %r9d, %r9d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x18(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq 0x40(%rsp), %rax - subq (%rsi), %rax - movq 0x48(%rsp), %rcx - sbbq 0x8(%rsi), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x10(%rsi), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x18(%rsi), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0xa0(%rsp) - adcq %r10, %rcx - movq %rcx, 0xa8(%rsp) - adcq $0x0, %r8 - movq %r8, 0xb0(%rsp) - adcq %rdx, %r9 - movq %r9, 0xb8(%rsp) - movq 0x20(%rsp), %rax - subq 0x20(%rsi), %rax - movq 0x28(%rsp), %rcx - sbbq 0x28(%rsi), %rcx - movq 0x30(%rsp), %r8 - sbbq 0x30(%rsi), %r8 - movq 0x38(%rsp), %r9 - sbbq 0x38(%rsi), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x20(%rsp) - adcq %r10, %rcx - movq %rcx, 0x28(%rsp) - adcq $0x0, %r8 - movq %r8, 0x30(%rsp) - adcq %rdx, %r9 - movq %r9, 0x38(%rsp) - movq 0xa0(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0xa8(%rsp), %r9, %r10 - mulxq 0xb8(%rsp), %r11, %r12 - movq 0xb0(%rsp), %rdx - mulxq 0xb8(%rsp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0xb8(%rsp), %rdx - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0xa8(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0xb0(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0xb8(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - movl %ecx, %r9d - adoxq %rcx, %r9 - adcxq %rcx, %r9 - addq %r9, %r14 - adcq %rcx, %r15 - movl %ecx, %r8d - adcq %rcx, %r8 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rcx, %r15 - adoxq %rcx, %r8 - adcq %rcx, %r8 - movl $0x1, %r8d - leaq -0x1(%rdx), %rdx - leaq -0x1(%rcx), %rax - movl $0xfffffffe, %r11d - cmoveq %rcx, %r8 - cmoveq %rcx, %rdx - cmoveq %rcx, %rax - cmoveq %rcx, %r11 - addq %r8, %r12 - adcq %rdx, %r13 - adcq %rax, %r14 - adcq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x20(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x28(%rsp), %r9, %r10 - mulxq 0x38(%rsp), %r11, %r12 - movq 0x30(%rsp), %rdx - mulxq 0x38(%rsp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x38(%rsp), %rdx - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x28(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x30(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x38(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - movl %ecx, %r9d - adoxq %rcx, %r9 - adcxq %rcx, %r9 - addq %r9, %r14 - adcq %rcx, %r15 - movl %ecx, %r8d - adcq %rcx, %r8 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rcx, %r15 - adoxq %rcx, %r8 - adcq %rcx, %r8 - movl $0x1, %ebx - addq %r12, %rbx - leaq -0x1(%rdx), %rdx - adcq %r13, %rdx - leaq -0x1(%rcx), %rcx - movq %rcx, %rax - adcq %r14, %rcx - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rbx, %r12 - cmovbq %rdx, %r13 - cmovbq %rcx, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - xorl %r13d, %r13d - movq (%rsi), %rdx - mulxq 0x60(%rsp), %r8, %r9 - mulxq 0x68(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x70(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x78(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x8(%rsi), %rdx - xorl %r14d, %r14d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x78(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x10(%rsi), %rdx - xorl %r8d, %r8d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x18(%rsi), %rdx - xorl %r9d, %r9d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - xorl %r13d, %r13d - movq 0x40(%rsp), %rdx - mulxq 0x60(%rsp), %r8, %r9 - mulxq 0x68(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x70(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x78(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x48(%rsp), %rdx - xorl %r14d, %r14d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x78(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x50(%rsp), %rdx - xorl %r8d, %r8d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x58(%rsp), %rdx - xorl %r9d, %r9d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq (%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq $0x0, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x40(%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x60(%rsp) - adcq %r10, %rcx - movq %rcx, 0x68(%rsp) - adcq $0x0, %r8 - movq %r8, 0x70(%rsp) - adcq %rdx, %r9 - movq %r9, 0x78(%rsp) - xorl %r13d, %r13d - movq 0x40(%rsi), %rdx - mulxq 0xa0(%rsp), %r8, %r9 - mulxq 0xa8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0xb0(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0xb8(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x48(%rsi), %rdx - xorl %r14d, %r14d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x50(%rsi), %rdx - xorl %r8d, %r8d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x58(%rsi), %rdx - xorl %r9d, %r9d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq (%rsp), %rax - subq 0x40(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x48(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x50(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x58(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq $0x0, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x80(%rsp), %rax - subq (%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x18(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq $0x0, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - xorl %r13d, %r13d - movq 0x20(%rsi), %rdx - mulxq 0x60(%rsp), %r8, %r9 - mulxq 0x68(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x70(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x78(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x28(%rsi), %rdx - xorl %r14d, %r14d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x78(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x30(%rsi), %rdx - xorl %r8d, %r8d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x38(%rsi), %rdx - xorl %r9d, %r9d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - xorl %r13d, %r13d - movq 0x80(%rsp), %rdx - mulxq 0x20(%rsp), %r8, %r9 - mulxq 0x28(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x30(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x38(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x88(%rsp), %rdx - xorl %r14d, %r14d - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x30(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x38(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x90(%rsp), %rdx - xorl %r8d, %r8d - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x30(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x38(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x98(%rsp), %rdx - xorl %r9d, %r9d - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x30(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x38(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x80(%rsp), %rax - subq 0x60(%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x68(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x70(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x78(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq $0x0, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - movq 0x40(%rsi), %rax - movq 0x48(%rsi), %rdx - orq 0x50(%rsi), %rax - orq 0x58(%rsi), %rdx - orq %rdx, %rax - movq (%rsp), %r8 - movq 0x0(%rbp), %rax - cmoveq %rax, %r8 - movq 0x8(%rsp), %r9 - movq 0x8(%rbp), %rax - cmoveq %rax, %r9 - movq 0x10(%rsp), %r10 - movq 0x10(%rbp), %rax - cmoveq %rax, %r10 - movq 0x18(%rsp), %r11 - movq 0x18(%rbp), %rax - cmoveq %rax, %r11 - movq 0x80(%rsp), %r12 - movq 0x20(%rbp), %rax - cmoveq %rax, %r12 - movq 0x88(%rsp), %r13 - movq 0x28(%rbp), %rax - cmoveq %rax, %r13 - movq 0x90(%rsp), %r14 - movq 0x30(%rbp), %rax - cmoveq %rax, %r14 - movq 0x98(%rsp), %r15 - movq 0x38(%rbp), %rax - cmoveq %rax, %r15 - movq %r8, (%rdi) - movq %r9, 0x8(%rdi) - movq %r10, 0x10(%rdi) - movq %r11, 0x18(%rdi) - movq %r12, 0x20(%rdi) - movq %r13, 0x28(%rdi) - movq %r14, 0x30(%rdi) - movq %r15, 0x38(%rdi) - movq 0xa0(%rsp), %r8 - movq 0xa8(%rsp), %r9 - movq 0xb0(%rsp), %r10 - movq 0xb8(%rsp), %r11 - movl $0x1, %eax - cmoveq %rax, %r8 - movq $0xffffffff00000000, %rax - cmoveq %rax, %r9 - movq $0xffffffffffffffff, %rax - cmoveq %rax, %r10 - movl $0xfffffffe, %eax - cmoveq %rax, %r11 - movq %r8, 0x40(%rdi) - movq %r9, 0x48(%rdi) - movq %r10, 0x50(%rdi) - movq %r11, 0x58(%rdi) - CFI_INC_RSP(192) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmul_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmul_alt.S deleted file mode 100644 index 0e06f1b229a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmul_alt.S +++ /dev/null @@ -1,8672 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Scalar multiplication for P-256 -// Input scalar[4], point[8]; output res[8] -// -// extern void p256_scalarmul_alt -// (uint64_t res[static 8],const uint64_t scalar[static 4], -// const uint64_t point[static 8]); -// -// Given scalar = n and point = P, assumed to be on the NIST elliptic -// curve P-256, returns the point (X,Y) = n * P. The input and output -// are affine points, and in the case of the point at infinity as -// the result, (0,0) is returned. -// -// Standard x86-64 ABI: RDI = res, RSI = scalar, RDX = point -// Microsoft x64 ABI: RCX = res, RDX = scalar, R8 = point -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_scalarmul_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_scalarmul_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_scalarmul_alt) - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Intermediate variables on the stack. The last z2, z3 values can -// safely be overlaid on the table, which is no longer needed at the end. -// Uppercase syntactic variants make x86_att version simpler to generate - -#define SCALARB (0*NUMSIZE) -#define scalarb (0*NUMSIZE)(%rsp) -#define ACC (1*NUMSIZE) -#define acc (1*NUMSIZE)(%rsp) -#define TABENT (4*NUMSIZE) -#define tabent (4*NUMSIZE)(%rsp) - -#define TAB (7*NUMSIZE) -#define tab (7*NUMSIZE)(%rsp) - -#define Z2 (7*NUMSIZE) -#define z2 (7*NUMSIZE)(%rsp) -#define Z3 (8*NUMSIZE) -#define z3 (8*NUMSIZE)(%rsp) - -#define res (31*NUMSIZE)(%rsp) - -#define NSPACE 32*NUMSIZE - -S2N_BN_SYMBOL(p256_scalarmul_alt): - CFI_START - _CET_ENDBR - -// The Windows version literally calls the standard ABI version. -// This simplifies the proofs since subroutine offsets are fixed. - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - CFI_CALL(Lp256_scalarmul_alt_standard) - CFI_POP(%rsi) - CFI_POP(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_scalarmul_alt) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmul_alt_standard) - -Lp256_scalarmul_alt_standard: - CFI_START -#endif - -// Real start of the standard ABI code. - - CFI_PUSH(%r15) - CFI_PUSH(%r14) - CFI_PUSH(%r13) - CFI_PUSH(%r12) - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - - CFI_DEC_RSP(NSPACE) - -// Preserve the "res" and "point" input arguments. We load and process the -// scalar immediately so we don't bother preserving that input argument. -// Also, "point" is only needed early on and so its register gets re-used. - - movq %rdx, %rbx - movq %rdi, res - -// Load the digits of group order n_256 = [%r15;%r14;%r13;%r12] - - movq $0xf3b9cac2fc632551, %r12 - movq $0xbce6faada7179e84, %r13 - movq $0xffffffffffffffff, %r14 - movq $0xffffffff00000000, %r15 - -// First, reduce the input scalar mod n_256, i.e. conditionally subtract n_256 - - movq (%rsi), %r8 - subq %r12, %r8 - movq 8(%rsi), %r9 - sbbq %r13, %r9 - movq 16(%rsi), %r10 - sbbq %r14, %r10 - movq 24(%rsi), %r11 - sbbq %r15, %r11 - - cmovcq (%rsi), %r8 - cmovcq 8(%rsi), %r9 - cmovcq 16(%rsi), %r10 - cmovcq 24(%rsi), %r11 - -// Now if the top bit of the reduced scalar is set, negate it mod n_256, -// i.e. do n |-> n_256 - n. Remember the sign in %rbp so we can -// correspondingly negate the point below. - - subq %r8, %r12 - sbbq %r9, %r13 - sbbq %r10, %r14 - sbbq %r11, %r15 - - movq %r11, %rbp - shrq $63, %rbp - cmovnzq %r12, %r8 - cmovnzq %r13, %r9 - cmovnzq %r14, %r10 - cmovnzq %r15, %r11 - -// In either case then add the recoding constant 0x08888...888 to allow -// signed digits. - - movq $0x8888888888888888, %rax - addq %rax, %r8 - adcq %rax, %r9 - adcq %rax, %r10 - adcq %rax, %r11 - btc $63, %r11 - - movq %r8, SCALARB(%rsp) - movq %r9, SCALARB+8(%rsp) - movq %r10, SCALARB+16(%rsp) - movq %r11, SCALARB+24(%rsp) - -// Set the tab[0] table entry to Montgomery-Jacobian point = 1 * P -// The z coordinate is just the Montgomery form of the constant 1. - - leaq TAB(%rsp), %rdi - movq %rbx, %rsi - CFI_CALL(Lp256_scalarmul_alt_local_tomont_p256) - - leaq 32(%rbx), %rsi - leaq TAB+32(%rsp), %rdi - CFI_CALL(Lp256_scalarmul_alt_local_tomont_p256) - - movl $1, %eax - movq %rax, TAB+64(%rsp) - movq $0xffffffff00000000, %rdx - movq %rdx, TAB+72(%rsp) - subq $2, %rax - movq %rax, TAB+80(%rsp) - movq $0x00000000fffffffe, %rax - movq %rax, TAB+88(%rsp) - -// If the top bit of the scalar was set, negate (y coordinate of) the point - - movq TAB+32(%rsp), %r12 - movq TAB+40(%rsp), %r13 - movq TAB+48(%rsp), %r14 - movq TAB+56(%rsp), %r15 - - xorl %r10d, %r10d - leaq -1(%r10), %r8 - movq $0x00000000ffffffff, %r11 - movq %r11, %r9 - negq %r11 - - subq %r12, %r8 - sbbq %r13, %r9 - sbbq %r14, %r10 - sbbq %r15, %r11 - - testq %rbp, %rbp - cmovzq %r12, %r8 - cmovzq %r13, %r9 - cmovzq %r14, %r10 - cmovzq %r15, %r11 - - movq %r8, TAB+32(%rsp) - movq %r9, TAB+40(%rsp) - movq %r10, TAB+48(%rsp) - movq %r11, TAB+56(%rsp) - -// Compute and record tab[1] = 2 * p, ..., tab[7] = 8 * P - - leaq TAB+96*1(%rsp), %rdi - leaq TAB(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_alt_local_p256_montjdouble) - - leaq TAB+96*2(%rsp), %rdi - leaq TAB+96*1(%rsp), %rsi - leaq TAB(%rsp), %rdx - CFI_CALL(Lp256_scalarmul_alt_local_p256_montjmixadd) - - leaq TAB+96*3(%rsp), %rdi - leaq TAB+96*1(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_alt_local_p256_montjdouble) - - leaq TAB+96*4(%rsp), %rdi - leaq TAB+96*3(%rsp), %rsi - leaq TAB(%rsp), %rdx - CFI_CALL(Lp256_scalarmul_alt_local_p256_montjmixadd) - - leaq TAB+96*5(%rsp), %rdi - leaq TAB+96*2(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_alt_local_p256_montjdouble) - - leaq TAB+96*6(%rsp), %rdi - leaq TAB+96*5(%rsp), %rsi - leaq TAB(%rsp), %rdx - CFI_CALL(Lp256_scalarmul_alt_local_p256_montjmixadd) - - leaq TAB+96*7(%rsp), %rdi - leaq TAB+96*3(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_alt_local_p256_montjdouble) - -// Set up accumulator as table entry for top 4 bits (constant-time indexing) - - movq SCALARB+24(%rsp), %rdi - shrq $60, %rdi - - xorl %eax, %eax - xorl %ebx, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - xorl %r8d, %r8d - xorl %r9d, %r9d - xorl %r10d, %r10d - xorl %r11d, %r11d - xorl %r12d, %r12d - xorl %r13d, %r13d - xorl %r14d, %r14d - xorl %r15d, %r15d - - .set I, 1 -.rep 8 - cmpq $I, %rdi - - cmovzq TAB+96*(I-1)(%rsp), %rax - cmovzq TAB+96*(I-1)+8(%rsp), %rbx - cmovzq TAB+96*(I-1)+16(%rsp), %rcx - cmovzq TAB+96*(I-1)+24(%rsp), %rdx - cmovzq TAB+96*(I-1)+32(%rsp), %r8 - cmovzq TAB+96*(I-1)+40(%rsp), %r9 - cmovzq TAB+96*(I-1)+48(%rsp), %r10 - cmovzq TAB+96*(I-1)+56(%rsp), %r11 - cmovzq TAB+96*(I-1)+64(%rsp), %r12 - cmovzq TAB+96*(I-1)+72(%rsp), %r13 - cmovzq TAB+96*(I-1)+80(%rsp), %r14 - cmovzq TAB+96*(I-1)+88(%rsp), %r15 - .set I, (I+1) -.endr - movq %rax, ACC(%rsp) - movq %rbx, ACC+8(%rsp) - movq %rcx, ACC+16(%rsp) - movq %rdx, ACC+24(%rsp) - movq %r8, ACC+32(%rsp) - movq %r9, ACC+40(%rsp) - movq %r10, ACC+48(%rsp) - movq %r11, ACC+56(%rsp) - movq %r12, ACC+64(%rsp) - movq %r13, ACC+72(%rsp) - movq %r14, ACC+80(%rsp) - movq %r15, ACC+88(%rsp) - -// Main loop over size-4 bitfield - - movl $252, %ebp - -Lp256_scalarmul_alt_loop: - subq $4, %rbp - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lp256_scalarmul_alt_local_p256_montjdouble) - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lp256_scalarmul_alt_local_p256_montjdouble) - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lp256_scalarmul_alt_local_p256_montjdouble) - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lp256_scalarmul_alt_local_p256_montjdouble) - - movq %rbp, %rax - shrq $6, %rax - movq (%rsp,%rax,8), %rdi - movq %rbp, %rcx - shrq %cl, %rdi - andq $15, %rdi - - subq $8, %rdi - sbbq %rsi, %rsi // %rsi = sign of digit (-1 = negative) - xorq %rsi, %rdi - subq %rsi, %rdi // %rdi = absolute value of digit - - xorl %eax, %eax - xorl %ebx, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - xorl %r8d, %r8d - xorl %r9d, %r9d - xorl %r10d, %r10d - xorl %r11d, %r11d - xorl %r12d, %r12d - xorl %r13d, %r13d - xorl %r14d, %r14d - xorl %r15d, %r15d - - .set I, 1 -.rep 8 - cmpq $I, %rdi - - cmovzq TAB+96*(I-1)(%rsp), %rax - cmovzq TAB+96*(I-1)+8(%rsp), %rbx - cmovzq TAB+96*(I-1)+16(%rsp), %rcx - cmovzq TAB+96*(I-1)+24(%rsp), %rdx - cmovzq TAB+96*(I-1)+32(%rsp), %r8 - cmovzq TAB+96*(I-1)+40(%rsp), %r9 - cmovzq TAB+96*(I-1)+48(%rsp), %r10 - cmovzq TAB+96*(I-1)+56(%rsp), %r11 - cmovzq TAB+96*(I-1)+64(%rsp), %r12 - cmovzq TAB+96*(I-1)+72(%rsp), %r13 - cmovzq TAB+96*(I-1)+80(%rsp), %r14 - cmovzq TAB+96*(I-1)+88(%rsp), %r15 - .set I, (I+1) -.endr - - movq %r12, TABENT+64(%rsp) - movq %r13, TABENT+72(%rsp) - movq %r14, TABENT+80(%rsp) - movq %r15, TABENT+88(%rsp) - - xorl %r14d, %r14d - leaq -1(%r14), %r12 - movq $0x00000000ffffffff, %r15 - movq %r15, %r13 - negq %r15 - - subq %r8, %r12 - sbbq %r9, %r13 - sbbq %r10, %r14 - sbbq %r11, %r15 - - testq %rsi, %rsi - cmovnzq %r12, %r8 - cmovnzq %r13, %r9 - cmovnzq %r14, %r10 - cmovnzq %r15, %r11 - - movq %rax, TABENT(%rsp) - movq %rbx, TABENT+8(%rsp) - movq %rcx, TABENT+16(%rsp) - movq %rdx, TABENT+24(%rsp) - - movq %r8, TABENT+32(%rsp) - movq %r9, TABENT+40(%rsp) - movq %r10, TABENT+48(%rsp) - movq %r11, TABENT+56(%rsp) - - leaq TABENT(%rsp), %rdx - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lp256_scalarmul_alt_local_p256_montjadd) - - testq %rbp, %rbp - jne Lp256_scalarmul_alt_loop - -// Let z2 = 1/z^2 and z3 = 1/z^3, both without Montgomery form - - leaq Z2(%rsp), %rdi - leaq ACC+64(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_alt_local_montsqr_p256) - - leaq Z3(%rsp), %rdi - leaq ACC+64(%rsp), %rsi - leaq Z2(%rsp), %rdx - CFI_CALL(Lp256_scalarmul_alt_local_montmul_p256) - - leaq Z2(%rsp), %rdi - leaq Z3(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_alt_local_demont_p256) - - leaq Z3(%rsp), %rdi - leaq Z2(%rsp), %rsi - CFI_CALL(Lp256_scalarmul_alt_local_inv_p256) - - leaq Z2(%rsp), %rdi - leaq ACC+64(%rsp), %rsi - leaq Z3(%rsp), %rdx - CFI_CALL(Lp256_scalarmul_alt_local_montmul_p256) - -// Convert back from Jacobian (X, Y, Z) |-> (X/Z^2, Y/Z^3) - - movq res, %rdi - leaq ACC(%rsp), %rsi - leaq Z2(%rsp), %rdx - movq %rdi, %rbx - CFI_CALL(Lp256_scalarmul_alt_local_montmul_p256) - - leaq 32(%rbx), %rdi - leaq ACC+32(%rsp), %rsi - leaq Z3(%rsp), %rdx - CFI_CALL(Lp256_scalarmul_alt_local_montmul_p256) - -// Restore stack and registers and return - - CFI_INC_RSP(NSPACE) - CFI_POP(%rbx) - CFI_POP(%rbp) - CFI_POP(%r12) - CFI_POP(%r13) - CFI_POP(%r14) - CFI_POP(%r15) - CFI_RET - -#if WINDOWS_ABI -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmul_alt_standard) -#else -S2N_BN_SIZE_DIRECTIVE(p256_scalarmul_alt) -#endif - -// Local copies of subroutines, complete clones at the moment - -Lp256_scalarmul_alt_local_demont_p256: - CFI_START - movq (%rsi), %r8 - movq 0x8(%rsi), %r9 - movq 0x10(%rsi), %r10 - movq 0x18(%rsi), %r11 - movabsq $0x100000000, %rcx - movq %r8, %rax - mulq %rcx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rsi, %rsi - movq %r9, %rax - mulq %rcx - subq %rsi, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rsi, %rsi - negq %rcx - negq %rsi - incq %rcx - movq %r8, %rax - mulq %rcx - addq %rax, %r11 - adcq %rdx, %rsi - sbbq %r8, %r8 - negq %r8 - movq %r9, %rax - mulq %rcx - addq %rax, %rsi - adcq %rdx, %r8 - negq %rcx - incq %rcx - movq %r10, %rax - mulq %rcx - addq %rax, %r11 - adcq %rdx, %rsi - sbbq %r9, %r9 - movq %r11, %rax - mulq %rcx - subq %r9, %rdx - addq %rax, %rsi - adcq %rdx, %r8 - sbbq %r9, %r9 - negq %rcx - negq %r9 - incq %rcx - movq %r10, %rax - mulq %rcx - addq %rax, %r8 - adcq %rdx, %r9 - sbbq %r10, %r10 - negq %r10 - movq %r11, %rax - mulq %rcx - addq %rax, %r9 - adcq %rdx, %r10 - movq %rsi, (%rdi) - movq %r8, 0x8(%rdi) - movq %r9, 0x10(%rdi) - movq %r10, 0x18(%rdi) - CFI_RET - -Lp256_scalarmul_alt_local_inv_p256: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(240) - movq %rdi, 0xe0(%rsp) - xorl %ecx, %ecx - movl $0xffffffff, %edx - movq %rdx, %rbx - leaq -0x1(%rcx), %rax - negq %rdx - movq %rax, (%rsp) - movq %rbx, 0x8(%rsp) - movq %rcx, 0x10(%rsp) - movq %rdx, 0x18(%rsp) - movq %rcx, 0x20(%rsp) - movq (%rsi), %r8 - movq 0x8(%rsi), %r9 - movq 0x10(%rsi), %r10 - movq 0x18(%rsi), %r11 - leaq 0x1(%rcx), %rax - addq %r8, %rax - leaq -0x1(%rdx), %rbx - adcq %r9, %rbx - notq %rcx - adcq %r10, %rcx - notq %rdx - adcq %r11, %rdx - cmovaeq %r8, %rax - cmovaeq %r9, %rbx - cmovaeq %r10, %rcx - cmovaeq %r11, %rdx - movq %rax, 0x28(%rsp) - movq %rbx, 0x30(%rsp) - movq %rcx, 0x38(%rsp) - movq %rdx, 0x40(%rsp) - xorl %eax, %eax - movq %rax, 0x48(%rsp) - xorl %eax, %eax - movq %rax, 0x50(%rsp) - movq %rax, 0x58(%rsp) - movq %rax, 0x60(%rsp) - movq %rax, 0x68(%rsp) - movabsq $0x4000000000000, %rcx - movq %rcx, 0x78(%rsp) - movq %rax, 0x80(%rsp) - movq %rax, 0x88(%rsp) - movq %rax, 0x90(%rsp) - movq $0xa, 0xb0(%rsp) - movq $0x1, 0xb8(%rsp) - jmp Lp256_scalarmul_alt_inv_midloop -Lp256_scalarmul_alt_inv_loop: - movq %r8, %r9 - sarq $0x3f, %r9 - xorq %r9, %r8 - subq %r9, %r8 - movq %r10, %r11 - sarq $0x3f, %r11 - xorq %r11, %r10 - subq %r11, %r10 - movq %r12, %r13 - sarq $0x3f, %r13 - xorq %r13, %r12 - subq %r13, %r12 - movq %r14, %r15 - sarq $0x3f, %r15 - xorq %r15, %r14 - subq %r15, %r14 - movq %r8, %rax - andq %r9, %rax - movq %r10, %rdi - andq %r11, %rdi - addq %rax, %rdi - movq %rdi, 0xa0(%rsp) - movq %r12, %rax - andq %r13, %rax - movq %r14, %rsi - andq %r15, %rsi - addq %rax, %rsi - movq %rsi, 0xa8(%rsp) - xorl %ebx, %ebx - movq (%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rdi - adcq %rdx, %rbx - movq 0x28(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rdi - adcq %rdx, %rbx - xorl %ebp, %ebp - movq (%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rbp - movq 0x28(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - xorl %ecx, %ecx - movq 0x8(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq 0x30(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - shrdq $0x3b, %rbx, %rdi - movq %rdi, (%rsp) - xorl %edi, %edi - movq 0x8(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rbp - adcq %rdx, %rdi - movq 0x30(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rdi - shrdq $0x3b, %rbp, %rsi - movq %rsi, 0x28(%rsp) - xorl %esi, %esi - movq 0x10(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rsi - movq 0x38(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rsi - shrdq $0x3b, %rcx, %rbx - movq %rbx, 0x8(%rsp) - xorl %ebx, %ebx - movq 0x10(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rdi - adcq %rdx, %rbx - movq 0x38(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rdi - adcq %rdx, %rbx - shrdq $0x3b, %rdi, %rbp - movq %rbp, 0x30(%rsp) - movq 0x18(%rsp), %rax - xorq %r9, %rax - movq 0x20(%rsp), %rbp - xorq %r9, %rbp - andq %r8, %rbp - negq %rbp - mulq %r8 - addq %rax, %rsi - adcq %rdx, %rbp - movq 0x40(%rsp), %rax - xorq %r11, %rax - movq 0x48(%rsp), %rdx - xorq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbp - mulq %r10 - addq %rax, %rsi - adcq %rdx, %rbp - shrdq $0x3b, %rsi, %rcx - movq %rcx, 0x10(%rsp) - shrdq $0x3b, %rbp, %rsi - sarq $0x3b, %rbp - movq 0x18(%rsp), %rax - movq %rsi, 0x18(%rsp) - movq 0x20(%rsp), %rsi - movq %rbp, 0x20(%rsp) - xorq %r13, %rax - xorq %r13, %rsi - andq %r12, %rsi - negq %rsi - mulq %r12 - addq %rax, %rbx - adcq %rdx, %rsi - movq 0x40(%rsp), %rax - xorq %r15, %rax - movq 0x48(%rsp), %rdx - xorq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rsi - mulq %r14 - addq %rax, %rbx - adcq %rdx, %rsi - shrdq $0x3b, %rbx, %rdi - movq %rdi, 0x38(%rsp) - shrdq $0x3b, %rsi, %rbx - movq %rbx, 0x40(%rsp) - sarq $0x3b, %rsi - movq %rsi, 0x48(%rsp) - movq 0xa0(%rsp), %rbx - movq 0xa8(%rsp), %rbp - xorl %ecx, %ecx - movq 0x50(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq 0x78(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - xorl %esi, %esi - movq 0x50(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, 0x50(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq 0x78(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, 0x78(%rsp) - xorl %ebx, %ebx - movq 0x58(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq 0x80(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rbx - xorl %ebp, %ebp - movq 0x58(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rcx, 0x58(%rsp) - addq %rax, %rsi - adcq %rdx, %rbp - movq 0x80(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - movq %rsi, 0x80(%rsp) - xorl %ecx, %ecx - movq 0x60(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq 0x88(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - xorl %esi, %esi - movq 0x60(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, 0x60(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq 0x88(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, 0x88(%rsp) - movq 0x68(%rsp), %rax - xorq %r9, %rax - movq %r9, %rbx - andq %r8, %rbx - negq %rbx - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq 0x90(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbx - mulq %r10 - addq %rax, %rcx - adcq %rbx, %rdx - movq 0x68(%rsp), %rax - movq %rcx, 0x68(%rsp) - movq %rdx, 0x70(%rsp) - xorq %r13, %rax - movq %r13, %rcx - andq %r12, %rcx - negq %rcx - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rcx - movq 0x90(%rsp), %rax - xorq %r15, %rax - movq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rcx - mulq %r14 - addq %rax, %rsi - adcq %rcx, %rdx - movq %rsi, 0x90(%rsp) - movq %rdx, 0x98(%rsp) - movabsq $0xe000000000000000, %r8 - addq 0x50(%rsp), %r8 - movq $0xffffffffffffffff, %r9 - adcq 0x58(%rsp), %r9 - movq $0x1fffffff, %r10 - adcq 0x60(%rsp), %r10 - movabsq $0x2000000000000000, %r11 - adcq 0x68(%rsp), %r11 - movabsq $0x1fffffffe0000000, %r12 - adcq 0x70(%rsp), %r12 - movq %r8, %rbx - shlq $0x20, %rbx - movabsq $0xffffffff00000001, %rax - mulq %r8 - shrq $0x20, %r8 - addq %rbx, %r9 - adcq %r8, %r10 - adcq %rax, %r11 - adcq %rdx, %r12 - sbbq %rax, %rax - movl $0xffffffff, %ebx - andq %rax, %rbx - movabsq $0xffffffff00000001, %rdx - andq %rax, %rdx - subq %rax, %r9 - movq %r9, 0x50(%rsp) - sbbq %rbx, %r10 - movq %r10, 0x58(%rsp) - sbbq $0x0, %r11 - movq %r11, 0x60(%rsp) - sbbq %rdx, %r12 - movq %r12, 0x68(%rsp) - movabsq $0xe000000000000000, %r8 - addq 0x78(%rsp), %r8 - movq $0xffffffffffffffff, %r9 - adcq 0x80(%rsp), %r9 - movq $0x1fffffff, %r10 - adcq 0x88(%rsp), %r10 - movabsq $0x2000000000000000, %r11 - adcq 0x90(%rsp), %r11 - movabsq $0x1fffffffe0000000, %r12 - adcq 0x98(%rsp), %r12 - movq %r8, %rbx - shlq $0x20, %rbx - movabsq $0xffffffff00000001, %rax - mulq %r8 - shrq $0x20, %r8 - addq %rbx, %r9 - adcq %r8, %r10 - adcq %rax, %r11 - adcq %rdx, %r12 - sbbq %rax, %rax - movl $0xffffffff, %ebx - andq %rax, %rbx - movabsq $0xffffffff00000001, %rdx - andq %rax, %rdx - subq %rax, %r9 - movq %r9, 0x78(%rsp) - sbbq %rbx, %r10 - movq %r10, 0x80(%rsp) - sbbq $0x0, %r11 - movq %r11, 0x88(%rsp) - sbbq %rdx, %r12 - movq %r12, 0x90(%rsp) -Lp256_scalarmul_alt_inv_midloop: - movq 0xb8(%rsp), %rsi - movq (%rsp), %rdx - movq 0x28(%rsp), %rcx - movq %rdx, %rbx - andq $0xfffff, %rbx - movabsq $0xfffffe0000000000, %rax - orq %rax, %rbx - andq $0xfffff, %rcx - movabsq $0xc000000000000000, %rax - orq %rax, %rcx - movq $0xfffffffffffffffe, %rax - xorl %ebp, %ebp - movl $0x2, %edx - movq %rbx, %rdi - movq %rax, %r8 - testq %rsi, %rsi - cmovs %rbp, %r8 - testq $0x1, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - sarq $1, %rcx - movl $0x100000, %eax - leaq (%rbx,%rax), %rdx - leaq (%rcx,%rax), %rdi - shlq $0x16, %rdx - shlq $0x16, %rdi - sarq $0x2b, %rdx - sarq $0x2b, %rdi - movabsq $0x20000100000, %rax - leaq (%rbx,%rax), %rbx - leaq (%rcx,%rax), %rcx - sarq $0x2a, %rbx - sarq $0x2a, %rcx - movq %rdx, 0xc0(%rsp) - movq %rbx, 0xc8(%rsp) - movq %rdi, 0xd0(%rsp) - movq %rcx, 0xd8(%rsp) - movq (%rsp), %r12 - imulq %r12, %rdi - imulq %rdx, %r12 - movq 0x28(%rsp), %r13 - imulq %r13, %rbx - imulq %rcx, %r13 - addq %rbx, %r12 - addq %rdi, %r13 - sarq $0x14, %r12 - sarq $0x14, %r13 - movq %r12, %rbx - andq $0xfffff, %rbx - movabsq $0xfffffe0000000000, %rax - orq %rax, %rbx - movq %r13, %rcx - andq $0xfffff, %rcx - movabsq $0xc000000000000000, %rax - orq %rax, %rcx - movq $0xfffffffffffffffe, %rax - movl $0x2, %edx - movq %rbx, %rdi - movq %rax, %r8 - testq %rsi, %rsi - cmovs %rbp, %r8 - testq $0x1, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - sarq $1, %rcx - movl $0x100000, %eax - leaq (%rbx,%rax), %r8 - leaq (%rcx,%rax), %r10 - shlq $0x16, %r8 - shlq $0x16, %r10 - sarq $0x2b, %r8 - sarq $0x2b, %r10 - movabsq $0x20000100000, %rax - leaq (%rbx,%rax), %r15 - leaq (%rcx,%rax), %r11 - sarq $0x2a, %r15 - sarq $0x2a, %r11 - movq %r13, %rbx - movq %r12, %rcx - imulq %r8, %r12 - imulq %r15, %rbx - addq %rbx, %r12 - imulq %r11, %r13 - imulq %r10, %rcx - addq %rcx, %r13 - sarq $0x14, %r12 - sarq $0x14, %r13 - movq %r12, %rbx - andq $0xfffff, %rbx - movabsq $0xfffffe0000000000, %rax - orq %rax, %rbx - movq %r13, %rcx - andq $0xfffff, %rcx - movabsq $0xc000000000000000, %rax - orq %rax, %rcx - movq 0xc0(%rsp), %rax - imulq %r8, %rax - movq 0xd0(%rsp), %rdx - imulq %r15, %rdx - imulq 0xc8(%rsp), %r8 - imulq 0xd8(%rsp), %r15 - addq %r8, %r15 - leaq (%rax,%rdx), %r9 - movq 0xc0(%rsp), %rax - imulq %r10, %rax - movq 0xd0(%rsp), %rdx - imulq %r11, %rdx - imulq 0xc8(%rsp), %r10 - imulq 0xd8(%rsp), %r11 - addq %r10, %r11 - leaq (%rax,%rdx), %r13 - movq $0xfffffffffffffffe, %rax - movl $0x2, %edx - movq %rbx, %rdi - movq %rax, %r8 - testq %rsi, %rsi - cmovs %rbp, %r8 - testq $0x1, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - sarq $1, %rcx - movl $0x100000, %eax - leaq (%rbx,%rax), %r8 - leaq (%rcx,%rax), %r12 - shlq $0x15, %r8 - shlq $0x15, %r12 - sarq $0x2b, %r8 - sarq $0x2b, %r12 - movabsq $0x20000100000, %rax - leaq (%rbx,%rax), %r10 - leaq (%rcx,%rax), %r14 - sarq $0x2b, %r10 - sarq $0x2b, %r14 - movq %r9, %rax - imulq %r8, %rax - movq %r13, %rdx - imulq %r10, %rdx - imulq %r15, %r8 - imulq %r11, %r10 - addq %r8, %r10 - leaq (%rax,%rdx), %r8 - movq %r9, %rax - imulq %r12, %rax - movq %r13, %rdx - imulq %r14, %rdx - imulq %r15, %r12 - imulq %r11, %r14 - addq %r12, %r14 - leaq (%rax,%rdx), %r12 - movq %rsi, 0xb8(%rsp) - decq 0xb0(%rsp) - jne Lp256_scalarmul_alt_inv_loop - movq (%rsp), %rax - movq 0x28(%rsp), %rcx - imulq %r8, %rax - imulq %r10, %rcx - addq %rcx, %rax - sarq $0x3f, %rax - movq %r8, %r9 - sarq $0x3f, %r9 - xorq %r9, %r8 - subq %r9, %r8 - xorq %rax, %r9 - movq %r10, %r11 - sarq $0x3f, %r11 - xorq %r11, %r10 - subq %r11, %r10 - xorq %rax, %r11 - movq %r12, %r13 - sarq $0x3f, %r13 - xorq %r13, %r12 - subq %r13, %r12 - xorq %rax, %r13 - movq %r14, %r15 - sarq $0x3f, %r15 - xorq %r15, %r14 - subq %r15, %r14 - xorq %rax, %r15 - movq %r8, %rax - andq %r9, %rax - movq %r10, %r12 - andq %r11, %r12 - addq %rax, %r12 - xorl %r13d, %r13d - movq 0x50(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r12 - adcq %rdx, %r13 - movq 0x78(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movq 0x58(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r13 - adcq %rdx, %r14 - movq 0x80(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r13 - adcq %rdx, %r14 - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r14 - adcq %rdx, %r15 - movq 0x88(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r14 - adcq %rdx, %r15 - movq 0x68(%rsp), %rax - xorq %r9, %rax - andq %r8, %r9 - negq %r9 - mulq %r8 - addq %rax, %r15 - adcq %rdx, %r9 - movq 0x90(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %r9 - mulq %r10 - addq %rax, %r15 - adcq %rdx, %r9 - movq %r12, 0x50(%rsp) - movq %r13, 0x58(%rsp) - movq %r14, 0x60(%rsp) - movq %r15, 0x68(%rsp) - movq %r9, 0x70(%rsp) - movabsq $0xe000000000000000, %r8 - addq 0x50(%rsp), %r8 - movq $0xffffffffffffffff, %r9 - adcq 0x58(%rsp), %r9 - movq $0x1fffffff, %r10 - adcq 0x60(%rsp), %r10 - movabsq $0x2000000000000000, %r11 - adcq 0x68(%rsp), %r11 - movabsq $0x1fffffffe0000000, %r12 - adcq 0x70(%rsp), %r12 - movq %r8, %rbx - shlq $0x20, %rbx - movabsq $0xffffffff00000001, %rax - mulq %r8 - shrq $0x20, %r8 - addq %rbx, %r9 - adcq %r8, %r10 - adcq %rax, %r11 - adcq %rdx, %r12 - sbbq %rax, %rax - movl $0xffffffff, %ebx - andq %rax, %rbx - movabsq $0xffffffff00000001, %rdx - andq %rax, %rdx - subq %rax, %r9 - movq %r9, 0x50(%rsp) - sbbq %rbx, %r10 - movq %r10, 0x58(%rsp) - sbbq $0x0, %r11 - movq %r11, 0x60(%rsp) - sbbq %rdx, %r12 - movq %r12, 0x68(%rsp) - movq 0x50(%rsp), %r8 - movq 0x58(%rsp), %r9 - movq 0x60(%rsp), %r10 - movq 0x68(%rsp), %r11 - movl $0x1, %eax - movl $0xffffffff, %ebx - leaq -0x2(%rax), %rcx - leaq -0x1(%rbx), %rdx - notq %rbx - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - cmovaeq %r8, %rax - cmovaeq %r9, %rbx - cmovaeq %r10, %rcx - cmovaeq %r11, %rdx - movq 0xe0(%rsp), %rdi - movq %rax, (%rdi) - movq %rbx, 0x8(%rdi) - movq %rcx, 0x10(%rdi) - movq %rdx, 0x18(%rdi) - CFI_INC_RSP(240) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -Lp256_scalarmul_alt_local_montmul_p256: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - movq %rdx, %rcx - movq (%rcx), %rbx - movq (%rsi), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x8(%rsi), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x10(%rsi), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x18(%rsi), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x8(%rcx), %rbx - xorl %r13d, %r13d - movq (%rsi), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x8(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x10(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x18(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rcx), %rbx - xorl %r15d, %r15d - movq (%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x8(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x10(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x18(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rcx), %rbx - xorl %r8d, %r8d - movq (%rsi), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x8(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x10(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x18(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rdi) - movq %r13, 0x8(%rdi) - movq %r14, 0x10(%rdi) - movq %r15, 0x18(%rdi) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_RET - -Lp256_scalarmul_alt_local_montsqr_p256: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - movq (%rsi), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x8(%rsi), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x18(%rsi), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x10(%rsi), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq (%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x8(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x18(%rsi), %rbx - movq 0x8(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x8(%rsi), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x10(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x18(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rdi) - movq %r13, 0x8(%rdi) - movq %r14, 0x10(%rdi) - movq %r15, 0x18(%rdi) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_RET - - -Lp256_scalarmul_alt_local_tomont_p256: - CFI_START - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - movl $0x3, %ecx - movq (%rsi), %rax - mulq %rcx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x8(%rsi), %rax - mulq %rcx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x10(%rsi), %rax - mulq %rcx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x18(%rsi), %rax - mulq %rcx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movabsq $0xfffffffbffffffff, %rcx - xorl %r13d, %r13d - movq (%rsi), %rax - mulq %rcx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x8(%rsi), %rax - mulq %rcx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x10(%rsi), %rax - mulq %rcx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x18(%rsi), %rax - mulq %rcx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rcx - movq %r8, %rax - mulq %rcx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rcx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rcx - leaq 0x2(%rcx), %rcx - movq %r8, %rax - mulq %rcx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rcx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq $0xfffffffffffffffe, %rcx - xorl %r15d, %r15d - movq (%rsi), %rax - mulq %rcx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x8(%rsi), %rax - mulq %rcx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x10(%rsi), %rax - mulq %rcx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x18(%rsi), %rax - mulq %rcx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movabsq $0x4fffffffd, %rcx - xorl %r8d, %r8d - movq (%rsi), %rax - mulq %rcx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x8(%rsi), %rax - mulq %rcx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x10(%rsi), %rax - mulq %rcx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x18(%rsi), %rax - mulq %rcx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rcx - movq %r10, %rax - mulq %rcx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq %r11, %rax - mulq %rcx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - notq %rcx - leaq 0x2(%rcx), %rcx - movq %r10, %rax - mulq %rcx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq %r11, %rax - mulq %rcx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - sbbq %r9, %r9 - subq %r9, %r8 - xorl %edx, %edx - leaq -0x1(%rdx), %r9 - incq %rdx - addq %r12, %rdx - decq %rcx - adcq %r13, %rcx - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rdx, %r12 - cmovbq %rcx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rdi) - movq %r13, 0x8(%rdi) - movq %r14, 0x10(%rdi) - movq %r15, 0x18(%rdi) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_RET - -Lp256_scalarmul_alt_local_p256_montjadd: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(224) - movq %rdx, %rbp - movq 0x40(%rsi), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x48(%rsi), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x58(%rsi), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x50(%rsi), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x48(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x58(%rsi), %rbx - movq 0x48(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x48(%rsi), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x50(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x58(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x40(%rbp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x48(%rbp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x58(%rbp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x50(%rbp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x40(%rbp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x48(%rbp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x58(%rbp), %rbx - movq 0x48(%rbp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x48(%rbp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x50(%rbp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x58(%rbp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq 0x20(%rsi), %rbx - movq 0x40(%rbp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x48(%rbp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x50(%rbp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x58(%rbp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x28(%rsi), %rbx - xorl %r13d, %r13d - movq 0x40(%rbp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x48(%rbp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x50(%rbp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x58(%rbp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x30(%rsi), %rbx - xorl %r15d, %r15d - movq 0x40(%rbp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x48(%rbp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x50(%rbp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x58(%rbp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x38(%rsi), %rbx - xorl %r8d, %r8d - movq 0x40(%rbp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x48(%rbp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x50(%rbp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x58(%rbp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xc0(%rsp) - movq %r13, 0xc8(%rsp) - movq %r14, 0xd0(%rsp) - movq %r15, 0xd8(%rsp) - movq 0x20(%rbp), %rbx - movq 0x40(%rsi), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x48(%rsi), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x50(%rsi), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x58(%rsi), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x28(%rbp), %rbx - xorl %r13d, %r13d - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x48(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x50(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x58(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x30(%rbp), %rbx - xorl %r15d, %r15d - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x48(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x50(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x58(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x38(%rbp), %rbx - xorl %r8d, %r8d - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x48(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x50(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x58(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq 0x0(%rbp), %rbx - movq (%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x10(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x18(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x8(%rbp), %rbx - xorl %r13d, %r13d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rbp), %rbx - xorl %r15d, %r15d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rbp), %rbx - xorl %r8d, %r8d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq (%rsi), %rbx - movq 0xa0(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0xb0(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0xb8(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x8(%rsi), %rbx - xorl %r13d, %r13d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rsi), %rbx - xorl %r15d, %r15d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rsi), %rbx - xorl %r8d, %r8d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x20(%rsp), %rbx - movq (%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x10(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x18(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x28(%rsp), %rbx - xorl %r13d, %r13d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x30(%rsp), %rbx - xorl %r15d, %r15d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x38(%rsp), %rbx - xorl %r8d, %r8d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq 0xc0(%rsp), %rbx - movq 0xa0(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0xb0(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0xb8(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0xc8(%rsp), %rbx - xorl %r13d, %r13d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0xd0(%rsp), %rbx - xorl %r15d, %r15d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0xd8(%rsp), %rbx - xorl %r8d, %r8d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xc0(%rsp) - movq %r13, 0xc8(%rsp) - movq %r14, 0xd0(%rsp) - movq %r15, 0xd8(%rsp) - movq 0x40(%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0xa0(%rsp) - adcq %r10, %rcx - movq %rcx, 0xa8(%rsp) - adcq $0x0, %r8 - movq %r8, 0xb0(%rsp) - adcq %rdx, %r9 - movq %r9, 0xb8(%rsp) - movq 0x20(%rsp), %rax - subq 0xc0(%rsp), %rax - movq 0x28(%rsp), %rcx - sbbq 0xc8(%rsp), %rcx - movq 0x30(%rsp), %r8 - sbbq 0xd0(%rsp), %r8 - movq 0x38(%rsp), %r9 - sbbq 0xd8(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x20(%rsp) - adcq %r10, %rcx - movq %rcx, 0x28(%rsp) - adcq $0x0, %r8 - movq %r8, 0x30(%rsp) - adcq %rdx, %r9 - movq %r9, 0x38(%rsp) - movq 0xa0(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0xa8(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0xb8(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0xb0(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0xa8(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0xb8(%rsp), %rbx - movq 0xa8(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0xa8(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0xb0(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0xb8(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x20(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x28(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x38(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x30(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x28(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x38(%rsp), %rbx - movq 0x28(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x28(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x30(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x38(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x80(%rsp), %rbx - movq 0x60(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x70(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x78(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x88(%rsp), %rbx - xorl %r13d, %r13d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x90(%rsp), %rbx - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x98(%rsp), %rbx - xorl %r8d, %r8d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x40(%rsp), %rbx - movq 0x60(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x70(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x78(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x48(%rsp), %rbx - xorl %r13d, %r13d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x50(%rsp), %rbx - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x58(%rsp), %rbx - xorl %r8d, %r8d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq (%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq $0x0, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x40(%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x60(%rsp) - adcq %r10, %rcx - movq %rcx, 0x68(%rsp) - adcq $0x0, %r8 - movq %r8, 0x70(%rsp) - adcq %rdx, %r9 - movq %r9, 0x78(%rsp) - movq 0x40(%rsi), %rbx - movq 0xa0(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0xb0(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0xb8(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x48(%rsi), %rbx - xorl %r13d, %r13d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x50(%rsi), %rbx - xorl %r15d, %r15d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x58(%rsi), %rbx - xorl %r8d, %r8d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq (%rsp), %rax - subq 0x40(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x48(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x50(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x58(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq $0x0, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x80(%rsp), %rax - subq (%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x18(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq $0x0, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - movq 0xc0(%rsp), %rbx - movq 0x60(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x70(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x78(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0xc8(%rsp), %rbx - xorl %r13d, %r13d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0xd0(%rsp), %rbx - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0xd8(%rsp), %rbx - xorl %r8d, %r8d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x40(%rbp), %rbx - movq 0xa0(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0xb0(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0xb8(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x48(%rbp), %rbx - xorl %r13d, %r13d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x50(%rbp), %rbx - xorl %r15d, %r15d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x58(%rbp), %rbx - xorl %r8d, %r8d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq 0x80(%rsp), %rbx - movq 0x20(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x28(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x30(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x38(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x88(%rsp), %rbx - xorl %r13d, %r13d - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x28(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x30(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x38(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x90(%rsp), %rbx - xorl %r15d, %r15d - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x28(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x30(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x38(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x98(%rsp), %rbx - xorl %r8d, %r8d - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x28(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x30(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x38(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x80(%rsp), %rax - subq 0x60(%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x68(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x70(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x78(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq $0x0, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - movq 0x40(%rsi), %r8 - movq 0x48(%rsi), %r9 - movq 0x50(%rsi), %r10 - movq 0x58(%rsi), %r11 - movq %r8, %rax - movq %r9, %rdx - orq %r10, %rax - orq %r11, %rdx - orq %rdx, %rax - negq %rax - sbbq %rax, %rax - movq 0x40(%rbp), %r12 - movq 0x48(%rbp), %r13 - movq 0x50(%rbp), %r14 - movq 0x58(%rbp), %r15 - movq %r12, %rbx - movq %r13, %rdx - orq %r14, %rbx - orq %r15, %rdx - orq %rdx, %rbx - negq %rbx - sbbq %rbx, %rbx - cmpq %rax, %rbx - cmovbq %r8, %r12 - cmovbq %r9, %r13 - cmovbq %r10, %r14 - cmovbq %r11, %r15 - cmoveq 0xa0(%rsp), %r12 - cmoveq 0xa8(%rsp), %r13 - cmoveq 0xb0(%rsp), %r14 - cmoveq 0xb8(%rsp), %r15 - movq (%rsp), %rax - cmovbq (%rsi), %rax - cmova 0x0(%rbp), %rax - movq 0x8(%rsp), %rbx - cmovbq 0x8(%rsi), %rbx - cmova 0x8(%rbp), %rbx - movq 0x10(%rsp), %rcx - cmovbq 0x10(%rsi), %rcx - cmova 0x10(%rbp), %rcx - movq 0x18(%rsp), %rdx - cmovbq 0x18(%rsi), %rdx - cmova 0x18(%rbp), %rdx - movq 0x80(%rsp), %r8 - cmovbq 0x20(%rsi), %r8 - cmova 0x20(%rbp), %r8 - movq 0x88(%rsp), %r9 - cmovbq 0x28(%rsi), %r9 - cmova 0x28(%rbp), %r9 - movq 0x90(%rsp), %r10 - cmovbq 0x30(%rsi), %r10 - cmova 0x30(%rbp), %r10 - movq 0x98(%rsp), %r11 - cmovbq 0x38(%rsi), %r11 - cmova 0x38(%rbp), %r11 - movq %rax, (%rdi) - movq %rbx, 0x8(%rdi) - movq %rcx, 0x10(%rdi) - movq %rdx, 0x18(%rdi) - movq %r8, 0x20(%rdi) - movq %r9, 0x28(%rdi) - movq %r10, 0x30(%rdi) - movq %r11, 0x38(%rdi) - movq %r12, 0x40(%rdi) - movq %r13, 0x48(%rdi) - movq %r14, 0x50(%rdi) - movq %r15, 0x58(%rdi) - CFI_INC_RSP(224) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -Lp256_scalarmul_alt_local_p256_montjdouble: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(192) - movq 0x40(%rsi), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x48(%rsi), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x58(%rsi), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x50(%rsi), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x48(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x58(%rsi), %rbx - movq 0x48(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x48(%rsi), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x50(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x58(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x20(%rsi), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x28(%rsi), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x38(%rsi), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x30(%rsi), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x20(%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x28(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x38(%rsi), %rbx - movq 0x28(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x28(%rsi), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x30(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x38(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq (%rsi), %rax - subq (%rsp), %rax - movq 0x8(%rsi), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x10(%rsi), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x18(%rsi), %r9 - sbbq 0x18(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x60(%rsp) - adcq %r10, %rcx - movq %rcx, 0x68(%rsp) - adcq $0x0, %r8 - movq %r8, 0x70(%rsp) - adcq %rdx, %r9 - movq %r9, 0x78(%rsp) - movq (%rsi), %rax - addq (%rsp), %rax - movq 0x8(%rsi), %rcx - adcq 0x8(%rsp), %rcx - movq 0x10(%rsi), %r8 - adcq 0x10(%rsp), %r8 - movq 0x18(%rsi), %r9 - adcq 0x18(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - subq %r11, %rax - movq %rax, 0x40(%rsp) - sbbq %r10, %rcx - movq %rcx, 0x48(%rsp) - sbbq $0x0, %r8 - movq %r8, 0x50(%rsp) - sbbq %rdx, %r9 - movq %r9, 0x58(%rsp) - movq 0x60(%rsp), %rbx - movq 0x40(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x48(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x50(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x58(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x68(%rsp), %rbx - xorl %r13d, %r13d - movq 0x40(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x48(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x50(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x58(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x70(%rsp), %rbx - xorl %r15d, %r15d - movq 0x40(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x48(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x50(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x58(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x78(%rsp), %rbx - xorl %r8d, %r8d - movq 0x40(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x48(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x50(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x58(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - xorq %r11, %r11 - movq 0x20(%rsi), %rax - addq 0x40(%rsi), %rax - movq 0x28(%rsi), %rcx - adcq 0x48(%rsi), %rcx - movq 0x30(%rsi), %r8 - adcq 0x50(%rsi), %r8 - movq 0x38(%rsi), %r9 - adcq 0x58(%rsi), %r9 - adcq %r11, %r11 - subq $0xffffffffffffffff, %rax - movl $0xffffffff, %r10d - sbbq %r10, %rcx - sbbq $0x0, %r8 - movabsq $0xffffffff00000001, %rdx - sbbq %rdx, %r9 - sbbq $0x0, %r11 - andq %r11, %r10 - andq %r11, %rdx - addq %r11, %rax - movq %rax, 0x40(%rsp) - adcq %r10, %rcx - movq %rcx, 0x48(%rsp) - adcq $0x0, %r8 - movq %r8, 0x50(%rsp) - adcq %rdx, %r9 - movq %r9, 0x58(%rsp) - movq 0x20(%rsp), %rbx - movq (%rsi), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x8(%rsi), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x10(%rsi), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x18(%rsi), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x28(%rsp), %rbx - xorl %r13d, %r13d - movq (%rsi), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x8(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x10(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x18(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x30(%rsp), %rbx - xorl %r15d, %r15d - movq (%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x8(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x10(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x18(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x38(%rsp), %rbx - xorl %r8d, %r8d - movq (%rsi), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x8(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x10(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x18(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x60(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x68(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x78(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x70(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x68(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x78(%rsp), %rbx - movq 0x68(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x68(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x70(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x78(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq 0x40(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x48(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x58(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x50(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x40(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x48(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x58(%rsp), %rbx - movq 0x48(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x48(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x50(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x58(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq $0xffffffffffffffff, %r9 - xorl %r11d, %r11d - subq 0xa0(%rsp), %r9 - movabsq $0xffffffff, %r10 - sbbq 0xa8(%rsp), %r10 - sbbq 0xb0(%rsp), %r11 - movabsq $0xffffffff00000001, %r12 - sbbq 0xb8(%rsp), %r12 - movq $0x9, %rcx - movq %r9, %rax - mulq %rcx - movq %rax, %r8 - movq %rdx, %r9 - movq %r10, %rax - xorl %r10d, %r10d - mulq %rcx - addq %rax, %r9 - adcq %rdx, %r10 - movq %r11, %rax - xorl %r11d, %r11d - mulq %rcx - addq %rax, %r10 - adcq %rdx, %r11 - movq %r12, %rax - xorl %r12d, %r12d - mulq %rcx - addq %rax, %r11 - adcq %rdx, %r12 - movl $0xc, %ecx - movq 0x80(%rsp), %rax - mulq %rcx - addq %rax, %r8 - adcq %rdx, %r9 - sbbq %rbx, %rbx - movq 0x88(%rsp), %rax - mulq %rcx - subq %rbx, %rdx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rbx, %rbx - movq 0x90(%rsp), %rax - mulq %rcx - subq %rbx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rbx, %rbx - movq 0x98(%rsp), %rax - mulq %rcx - subq %rbx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - leaq 0x1(%r12), %rcx - movabsq $0xffffffff00000001, %rax - mulq %rcx - movq %rcx, %rbx - shlq $0x20, %rbx - addq %rcx, %r8 - sbbq $0x0, %rbx - subq %rbx, %r9 - sbbq $0x0, %r10 - sbbq %rax, %r11 - sbbq %rdx, %rcx - decq %rcx - movl $0xffffffff, %eax - andq %rcx, %rax - xorl %edx, %edx - subq %rax, %rdx - addq %rcx, %r8 - movq %r8, 0xa0(%rsp) - adcq %rax, %r9 - movq %r9, 0xa8(%rsp) - adcq $0x0, %r10 - movq %r10, 0xb0(%rsp) - adcq %rdx, %r11 - movq %r11, 0xb8(%rsp) - movq 0x40(%rsp), %rax - subq (%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x18(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x40(%rsp) - adcq %r10, %rcx - movq %rcx, 0x48(%rsp) - adcq $0x0, %r8 - movq %r8, 0x50(%rsp) - adcq %rdx, %r9 - movq %r9, 0x58(%rsp) - movq 0x20(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x28(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x38(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x30(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x28(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x38(%rsp), %rbx - movq 0x28(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x28(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x30(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x38(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x60(%rsp), %rbx - movq 0xa0(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0xb0(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0xb8(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x68(%rsp), %rbx - xorl %r13d, %r13d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x70(%rsp), %rbx - xorl %r15d, %r15d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x78(%rsp), %rbx - xorl %r8d, %r8d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x40(%rsp), %rax - subq 0x20(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x28(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x30(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x38(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x40(%rdi) - adcq %r10, %rcx - movq %rcx, 0x48(%rdi) - adcq $0x0, %r8 - movq %r8, 0x50(%rdi) - adcq %rdx, %r9 - movq %r9, 0x58(%rdi) - movq 0x98(%rsp), %r11 - movq %r11, %rcx - movq 0x90(%rsp), %r10 - shldq $0x2, %r10, %r11 - movq 0x88(%rsp), %r9 - shldq $0x2, %r9, %r10 - movq 0x80(%rsp), %r8 - shldq $0x2, %r8, %r9 - shlq $0x2, %r8 - shrq $0x3e, %rcx - addq $0x1, %rcx - subq 0xa0(%rsp), %r8 - sbbq 0xa8(%rsp), %r9 - sbbq 0xb0(%rsp), %r10 - sbbq 0xb8(%rsp), %r11 - sbbq $0x0, %rcx - movabsq $0xffffffff00000001, %rax - mulq %rcx - movq %rcx, %rbx - shlq $0x20, %rbx - addq %rcx, %r8 - sbbq $0x0, %rbx - subq %rbx, %r9 - sbbq $0x0, %r10 - sbbq %rax, %r11 - sbbq %rdx, %rcx - decq %rcx - movl $0xffffffff, %eax - andq %rcx, %rax - xorl %edx, %edx - subq %rax, %rdx - addq %rcx, %r8 - movq %r8, (%rdi) - adcq %rax, %r9 - movq %r9, 0x8(%rdi) - adcq $0x0, %r10 - movq %r10, 0x10(%rdi) - adcq %rdx, %r11 - movq %r11, 0x18(%rdi) - movq $0xffffffffffffffff, %r8 - xorl %r10d, %r10d - subq (%rsp), %r8 - movabsq $0xffffffff, %r9 - sbbq 0x8(%rsp), %r9 - sbbq 0x10(%rsp), %r10 - movabsq $0xffffffff00000001, %r11 - sbbq 0x18(%rsp), %r11 - movq %r11, %r12 - shldq $0x3, %r10, %r11 - shldq $0x3, %r9, %r10 - shldq $0x3, %r8, %r9 - shlq $0x3, %r8 - shrq $0x3d, %r12 - movl $0x3, %ecx - movq 0x60(%rsp), %rax - mulq %rcx - addq %rax, %r8 - adcq %rdx, %r9 - sbbq %rbx, %rbx - movq 0x68(%rsp), %rax - mulq %rcx - subq %rbx, %rdx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rbx, %rbx - movq 0x70(%rsp), %rax - mulq %rcx - subq %rbx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rbx, %rbx - movq 0x78(%rsp), %rax - mulq %rcx - subq %rbx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - leaq 0x1(%r12), %rcx - movabsq $0xffffffff00000001, %rax - mulq %rcx - movq %rcx, %rbx - shlq $0x20, %rbx - addq %rcx, %r8 - sbbq $0x0, %rbx - subq %rbx, %r9 - sbbq $0x0, %r10 - sbbq %rax, %r11 - sbbq %rdx, %rcx - decq %rcx - movl $0xffffffff, %eax - andq %rcx, %rax - xorl %edx, %edx - subq %rax, %rdx - addq %rcx, %r8 - movq %r8, 0x20(%rdi) - adcq %rax, %r9 - movq %r9, 0x28(%rdi) - adcq $0x0, %r10 - movq %r10, 0x30(%rdi) - adcq %rdx, %r11 - movq %r11, 0x38(%rdi) - CFI_INC_RSP(192) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_RET - -Lp256_scalarmul_alt_local_p256_montjmixadd: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(192) - movq %rdx, %rbp - movq 0x40(%rsi), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x48(%rsi), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x58(%rsi), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x50(%rsi), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x48(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x58(%rsi), %rbx - movq 0x48(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x48(%rsi), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x50(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x58(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x20(%rbp), %rbx - movq 0x40(%rsi), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x48(%rsi), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x50(%rsi), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x58(%rsi), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x28(%rbp), %rbx - xorl %r13d, %r13d - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x48(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x50(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x58(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x30(%rbp), %rbx - xorl %r15d, %r15d - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x48(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x50(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x58(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x38(%rbp), %rbx - xorl %r8d, %r8d - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x48(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x50(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x58(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq 0x0(%rbp), %rbx - movq (%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x10(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x18(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x8(%rbp), %rbx - xorl %r13d, %r13d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rbp), %rbx - xorl %r15d, %r15d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rbp), %rbx - xorl %r8d, %r8d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq 0x20(%rsp), %rbx - movq (%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x10(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x18(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x28(%rsp), %rbx - xorl %r13d, %r13d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x30(%rsp), %rbx - xorl %r15d, %r15d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x38(%rsp), %rbx - xorl %r8d, %r8d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq 0x40(%rsp), %rax - subq (%rsi), %rax - movq 0x48(%rsp), %rcx - sbbq 0x8(%rsi), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x10(%rsi), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x18(%rsi), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0xa0(%rsp) - adcq %r10, %rcx - movq %rcx, 0xa8(%rsp) - adcq $0x0, %r8 - movq %r8, 0xb0(%rsp) - adcq %rdx, %r9 - movq %r9, 0xb8(%rsp) - movq 0x20(%rsp), %rax - subq 0x20(%rsi), %rax - movq 0x28(%rsp), %rcx - sbbq 0x28(%rsi), %rcx - movq 0x30(%rsp), %r8 - sbbq 0x30(%rsi), %r8 - movq 0x38(%rsp), %r9 - sbbq 0x38(%rsi), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x20(%rsp) - adcq %r10, %rcx - movq %rcx, 0x28(%rsp) - adcq $0x0, %r8 - movq %r8, 0x30(%rsp) - adcq %rdx, %r9 - movq %r9, 0x38(%rsp) - movq 0xa0(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0xa8(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0xb8(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0xb0(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0xa8(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0xb8(%rsp), %rbx - movq 0xa8(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0xa8(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0xb0(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0xb8(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x20(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x28(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x38(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x30(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x28(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x38(%rsp), %rbx - movq 0x28(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x28(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x30(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x38(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq (%rsi), %rbx - movq 0x60(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x70(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x78(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x8(%rsi), %rbx - xorl %r13d, %r13d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rsi), %rbx - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rsi), %rbx - xorl %r8d, %r8d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x40(%rsp), %rbx - movq 0x60(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x70(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x78(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x48(%rsp), %rbx - xorl %r13d, %r13d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x50(%rsp), %rbx - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x58(%rsp), %rbx - xorl %r8d, %r8d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq (%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq $0x0, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x40(%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x60(%rsp) - adcq %r10, %rcx - movq %rcx, 0x68(%rsp) - adcq $0x0, %r8 - movq %r8, 0x70(%rsp) - adcq %rdx, %r9 - movq %r9, 0x78(%rsp) - movq 0x40(%rsi), %rbx - movq 0xa0(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0xb0(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0xb8(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x48(%rsi), %rbx - xorl %r13d, %r13d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x50(%rsi), %rbx - xorl %r15d, %r15d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x58(%rsi), %rbx - xorl %r8d, %r8d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq (%rsp), %rax - subq 0x40(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x48(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x50(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x58(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq $0x0, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x80(%rsp), %rax - subq (%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x18(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq $0x0, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - movq 0x20(%rsi), %rbx - movq 0x60(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x70(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x78(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x28(%rsi), %rbx - xorl %r13d, %r13d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x30(%rsi), %rbx - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x38(%rsi), %rbx - xorl %r8d, %r8d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x80(%rsp), %rbx - movq 0x20(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x28(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x30(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x38(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x88(%rsp), %rbx - xorl %r13d, %r13d - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x28(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x30(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x38(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x90(%rsp), %rbx - xorl %r15d, %r15d - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x28(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x30(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x38(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x98(%rsp), %rbx - xorl %r8d, %r8d - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x28(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x30(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x38(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x80(%rsp), %rax - subq 0x60(%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x68(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x70(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x78(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq $0x0, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - movq 0x40(%rsi), %rax - movq 0x48(%rsi), %rdx - orq 0x50(%rsi), %rax - orq 0x58(%rsi), %rdx - orq %rdx, %rax - movq (%rsp), %r8 - movq 0x0(%rbp), %rax - cmoveq %rax, %r8 - movq 0x8(%rsp), %r9 - movq 0x8(%rbp), %rax - cmoveq %rax, %r9 - movq 0x10(%rsp), %r10 - movq 0x10(%rbp), %rax - cmoveq %rax, %r10 - movq 0x18(%rsp), %r11 - movq 0x18(%rbp), %rax - cmoveq %rax, %r11 - movq 0x80(%rsp), %r12 - movq 0x20(%rbp), %rax - cmoveq %rax, %r12 - movq 0x88(%rsp), %r13 - movq 0x28(%rbp), %rax - cmoveq %rax, %r13 - movq 0x90(%rsp), %r14 - movq 0x30(%rbp), %rax - cmoveq %rax, %r14 - movq 0x98(%rsp), %r15 - movq 0x38(%rbp), %rax - cmoveq %rax, %r15 - movq %r8, (%rdi) - movq %r9, 0x8(%rdi) - movq %r10, 0x10(%rdi) - movq %r11, 0x18(%rdi) - movq %r12, 0x20(%rdi) - movq %r13, 0x28(%rdi) - movq %r14, 0x30(%rdi) - movq %r15, 0x38(%rdi) - movq 0xa0(%rsp), %r8 - movq 0xa8(%rsp), %r9 - movq 0xb0(%rsp), %r10 - movq 0xb8(%rsp), %r11 - movl $0x1, %eax - cmoveq %rax, %r8 - movabsq $0xffffffff00000000, %rax - cmoveq %rax, %r9 - movq $0xffffffffffffffff, %rax - cmoveq %rax, %r10 - movl $0xfffffffe, %eax - cmoveq %rax, %r11 - movq %r8, 0x40(%rdi) - movq %r9, 0x48(%rdi) - movq %r10, 0x50(%rdi) - movq %r11, 0x58(%rdi) - CFI_INC_RSP(192) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmulbase.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmulbase.S deleted file mode 100644 index f6eb52b3ac5..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmulbase.S +++ /dev/null @@ -1,3571 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Scalar multiplication for precomputed point on NIST curve P-256 -// Input scalar[4], blocksize, table[]; output res[8] -// -// extern void p256_scalarmulbase -// (uint64_t res[static 8], -// const uint64_t scalar[static 4], -// uint64_t blocksize, -// const uint64_t *table); -// -// Given scalar = n and point = P, assumed to be on the NIST elliptic -// curve P-256, the input argument "table" is expected to be a table of -// multiples of the point P in Montgomery-affine form, with each block -// corresponding to "blocksize" bits of the scalar as follows, where -// B = 2^{blocksize-1} (e.g. B = 8 for blocksize = 4): -// -// For each i,j with blocksize * i <= 256 and 1 <= j <= B -// the multiple 2^{blocksize * i} * j * P is stored at -// tab[8 * (B * i + (j - 1))], considered as uint64_t pointers -// or tab + 64 * (B * i + (j - 1)) as byte pointers. -// -// Standard x86-64 ABI: RDI = res, RSI = scalar, RDX = blocksize, RCX = table -// Microsoft x64 ABI: RCX = res, RDX = scalar, R8 = blocksize, R9 = table -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_scalarmulbase) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_scalarmulbase) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_scalarmulbase) - - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Intermediate variables on the stack. The last z2, z3 values can -// safely be overlaid on "nacc", which is no longer needed at the end. -// Uppercase syntactic variants make x86_att version simpler to generate - -#define RSCALAR (0*NUMSIZE) -#define ACC (1*NUMSIZE) -#define NACC (4*NUMSIZE) -#define TABENT (7*NUMSIZE) -#define Z2 (4*NUMSIZE) -#define Z3 (5*NUMSIZE) - -#define rscalar RSCALAR(%rsp) -#define acc ACC(%rsp) -#define nacc NACC(%rsp) -#define tabent TABENT(%rsp) - -#define z2 Z2(%rsp) -#define z3 Z3(%rsp) - -#define res (9*NUMSIZE)(%rsp) -#define blocksize (9*NUMSIZE+8)(%rsp) -#define table (9*NUMSIZE+16)(%rsp) -#define i (9*NUMSIZE+24)(%rsp) -#define bf (9*NUMSIZE+32)(%rsp) -#define cf (9*NUMSIZE+40)(%rsp) -#define j (9*NUMSIZE+48)(%rsp) - -#define NSPACE 11*NUMSIZE - -S2N_BN_SYMBOL(p256_scalarmulbase): - CFI_START - _CET_ENDBR - -// The Windows version literally calls the standard ABI version. -// This simplifies the proofs since subroutine offsets are fixed. - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - CFI_CALL(Lp256_scalarmulbase_standard) - CFI_POP(%rsi) - CFI_POP(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_scalarmulbase) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_standard) - -Lp256_scalarmulbase_standard: - CFI_START -#endif - -// Real start of the standard ABI code. - - CFI_PUSH(%r15) - CFI_PUSH(%r14) - CFI_PUSH(%r13) - CFI_PUSH(%r12) - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - - CFI_DEC_RSP(NSPACE) - -// Preserve the input arguments except the scalar, since that gets absorbed -// immediately. The "table" value subsequently gets shifted up each iteration -// of the loop, while "res" and "blocksize" are static throughout. - - movq %rdi, res - movq %rdx, blocksize - movq %rcx, table - -// Load the digits of group order n_256 = [%r15;%r14;%r13;%r12] - - movq $0xf3b9cac2fc632551, %r12 - movq $0xbce6faada7179e84, %r13 - movq $0xffffffffffffffff, %r14 - movq $0xffffffff00000000, %r15 - -// First, reduce the input scalar mod n_256, i.e. conditionally subtract n_256 -// Store it to "rscalar" (reduced scalar) - - movq (%rsi), %r8 - subq %r12, %r8 - movq 8(%rsi), %r9 - sbbq %r13, %r9 - movq 16(%rsi), %r10 - sbbq %r14, %r10 - movq 24(%rsi), %r11 - sbbq %r15, %r11 - - cmovcq (%rsi), %r8 - cmovcq 8(%rsi), %r9 - cmovcq 16(%rsi), %r10 - cmovcq 24(%rsi), %r11 - - movq %r8, RSCALAR(%rsp) - movq %r9, RSCALAR+8(%rsp) - movq %r10, RSCALAR+16(%rsp) - movq %r11, RSCALAR+24(%rsp) - -// Initialize the accumulator to all zeros and the "carry flag" cf to 0 - - xorl %eax, %eax - - movq %rax, ACC(%rsp) - movq %rax, ACC+8(%rsp) - movq %rax, ACC+16(%rsp) - movq %rax, ACC+24(%rsp) - movq %rax, ACC+32(%rsp) - movq %rax, ACC+40(%rsp) - movq %rax, ACC+48(%rsp) - movq %rax, ACC+56(%rsp) - movq %rax, ACC+64(%rsp) - movq %rax, ACC+72(%rsp) - movq %rax, ACC+80(%rsp) - movq %rax, ACC+88(%rsp) - - movq %rax, cf - -// Main loop over {i >= 0 | blocksize * i <= 256}. Note the non-strict -// inequality, to allow top carry for any choices of blocksize. - - movq %rax, i - -Lp256_scalarmulbase_loop: - -// The next raw bitfield is bf = bitfield(blocksize * i,blocksize) + cf, -// adding in the deferred carry cf. We then shift the whole scalar right -// by blocksize so we can keep picking bitfield(0,blocksize). - - movq RSCALAR(%rsp), %r8 - movq RSCALAR+8(%rsp), %r9 - movq RSCALAR+16(%rsp), %r10 - movq RSCALAR+24(%rsp), %r11 - - movq blocksize, %rcx - movl $1, %eax - shlq %cl, %rax - decq %rax - andq %r8, %rax - - shrdq %cl, %r9, %r8 - shrdq %cl, %r10, %r9 - shrdq %cl, %r11, %r10 - shrq %cl, %r11 - - addq cf, %rax - movq %rax, bf - - movq %r8, RSCALAR(%rsp) - movq %r9, RSCALAR+8(%rsp) - movq %r10, RSCALAR+16(%rsp) - movq %r11, RSCALAR+24(%rsp) - -// Now if bf <= B we just select entry j, unnegated and set cf = 0. -// If bf > B we set j = 2 * B - bf and negate the j'th entry, setting cf = 1. -// In either case we ultimately add bf, in the latter case with deferred -// carry as 2 * B - (2 * B - bf) = bf. - - movl $1, %eax - movq blocksize, %rcx - shlq %cl, %rax - movq %rax, %rbx - shrq $1, %rax - - subq bf, %rbx - cmpq bf, %rax - - cmovncq bf, %rbx - sbbq %rax, %rax - movq %rbx, j - negq %rax - movq %rax, cf - -// Load table entry j - 1 for nonzero j in constant-time style. - - movq blocksize, %rcx - decq %rcx - movl $1, %esi - shlq %cl, %rsi - movq j, %r12 - movq table, %rbp - -Lp256_scalarmulbase_tabloop: - subq $1, %r12 - cmovzq (%rbp), %rax - cmovzq 8(%rbp), %rbx - cmovzq 16(%rbp), %rcx - cmovzq 24(%rbp), %rdx - cmovzq 32(%rbp), %r8 - cmovzq 40(%rbp), %r9 - cmovzq 48(%rbp), %r10 - cmovzq 56(%rbp), %r11 - - addq $64, %rbp - decq %rsi - jnz Lp256_scalarmulbase_tabloop - - movq %rbp, table - -// Before storing back, optionally negate the y coordinate of the table entry - - xorl %r14d, %r14d - leaq -1(%r14), %r12 - movq $0x00000000ffffffff, %r15 - movq %r15, %r13 - negq %r15 - - subq %r8, %r12 - sbbq %r9, %r13 - sbbq %r10, %r14 - sbbq %r11, %r15 - - movq %rax, TABENT(%rsp) - movq %rbx, TABENT+8(%rsp) - movq %rcx, TABENT+16(%rsp) - movq %rdx, TABENT+24(%rsp) - - movq cf, %rax - testq %rax, %rax - cmovnzq %r12, %r8 - cmovnzq %r13, %r9 - cmovnzq %r14, %r10 - cmovnzq %r15, %r11 - - movq %r8, TABENT+32(%rsp) - movq %r9, TABENT+40(%rsp) - movq %r10, TABENT+48(%rsp) - movq %r11, TABENT+56(%rsp) - -// Add the adjusted table point to the accumulator - - leaq NACC(%rsp), %rdi - leaq ACC(%rsp), %rsi - leaq TABENT(%rsp), %rdx - CFI_CALL(Lp256_scalarmulbase_local_p256_montjmixadd) - -// However, only commit that update to the accumulator if j is nonzero, -// because the mixed addition function does not handle this case directly, -// and in any case we didn't choose the table entry appropriately. - - movq j, %rax - testq %rax, %rax - - movq ACC(%rsp), %rax - cmovnzq NACC(%rsp), %rax - movq %rax, ACC(%rsp) - - movq ACC+8(%rsp), %rax - cmovnzq NACC+8(%rsp), %rax - movq %rax, ACC+8(%rsp) - - movq ACC+16(%rsp), %rax - cmovnzq NACC+16(%rsp), %rax - movq %rax, ACC+16(%rsp) - - movq ACC+24(%rsp), %rax - cmovnzq NACC+24(%rsp), %rax - movq %rax, ACC+24(%rsp) - - movq ACC+32(%rsp), %rax - cmovnzq NACC+32(%rsp), %rax - movq %rax, ACC+32(%rsp) - - movq ACC+40(%rsp), %rax - cmovnzq NACC+40(%rsp), %rax - movq %rax, ACC+40(%rsp) - - movq ACC+48(%rsp), %rax - cmovnzq NACC+48(%rsp), %rax - movq %rax, ACC+48(%rsp) - - movq ACC+56(%rsp), %rax - cmovnzq NACC+56(%rsp), %rax - movq %rax, ACC+56(%rsp) - - movq ACC+64(%rsp), %rax - cmovnzq NACC+64(%rsp), %rax - movq %rax, ACC+64(%rsp) - - movq ACC+72(%rsp), %rax - cmovnzq NACC+72(%rsp), %rax - movq %rax, ACC+72(%rsp) - - movq ACC+80(%rsp), %rax - cmovnzq NACC+80(%rsp), %rax - movq %rax, ACC+80(%rsp) - - movq ACC+88(%rsp), %rax - cmovnzq NACC+88(%rsp), %rax - movq %rax, ACC+88(%rsp) - -// Loop while blocksize * i <= 256 - - movq i, %rax - incq %rax - movq %rax, i - - imulq blocksize, %rax - cmpq $257, %rax - jc Lp256_scalarmulbase_loop - -// That's the end of the main loop, and we just need to translate -// back from the Jacobian representation to affine. First of all, -// let z2 = 1/z^2 and z3 = 1/z^3, both without Montgomery form - - leaq Z2(%rsp), %rdi - leaq ACC+64(%rsp), %rsi - CFI_CALL(Lp256_scalarmulbase_local_montsqr_p256) - - leaq Z3(%rsp), %rdi - leaq ACC+64(%rsp), %rsi - leaq Z2(%rsp), %rdx - CFI_CALL(Lp256_scalarmulbase_local_montmul_p256) - - leaq Z2(%rsp), %rdi - leaq Z3(%rsp), %rsi - CFI_CALL(Lp256_scalarmulbase_local_demont_p256) - - leaq Z3(%rsp), %rdi - leaq Z2(%rsp), %rsi - CFI_CALL(Lp256_scalarmulbase_local_inv_p256) - - leaq Z2(%rsp), %rdi - leaq ACC+64(%rsp), %rsi - leaq Z3(%rsp), %rdx - CFI_CALL(Lp256_scalarmulbase_local_montmul_p256) - -// Convert back from Jacobian (X, Y, Z) |-> (X/Z^2, Y/Z^3) - - movq res, %rdi - leaq ACC(%rsp), %rsi - leaq Z2(%rsp), %rdx - movq %rdi, %rbx - CFI_CALL(Lp256_scalarmulbase_local_montmul_p256) - - leaq 32(%rbx), %rdi - leaq ACC+32(%rsp), %rsi - leaq Z3(%rsp), %rdx - CFI_CALL(Lp256_scalarmulbase_local_montmul_p256) - -// Restore stack and registers and return - - CFI_INC_RSP(NSPACE) - CFI_POP(%rbx) - CFI_POP(%rbp) - CFI_POP(%r12) - CFI_POP(%r13) - CFI_POP(%r14) - CFI_POP(%r15) - CFI_RET - -#if WINDOWS_ABI -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_standard) -#else -S2N_BN_SIZE_DIRECTIVE(p256_scalarmulbase) -#endif - -// Local copies of subroutines, complete clones at the moment - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_local_demont_p256) - -Lp256_scalarmulbase_local_demont_p256: - CFI_START - CFI_PUSH(%rbx) - movq (%rsi), %r8 - movq 0x8(%rsi), %r9 - movq 0x10(%rsi), %r10 - movq 0x18(%rsi), %r11 - xorq %rbx, %rbx - xorq %rsi, %rsi - movq $0x100000000, %rdx - mulxq %r8, %rax, %rcx - adcxq %rax, %r9 - adoxq %rcx, %r10 - mulxq %r9, %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rcx - adcxq %rax, %r11 - adoxq %rcx, %rbx - mulxq %r9, %rax, %rcx - adcxq %rax, %rbx - adoxq %rcx, %rsi - movl $0x0, %r8d - adcxq %r8, %rsi - xorq %r9, %r9 - movq $0x100000000, %rdx - mulxq %r10, %rax, %rcx - adcxq %rax, %r11 - adoxq %rcx, %rbx - mulxq %r11, %rax, %rcx - adcxq %rax, %rbx - adoxq %rcx, %rsi - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rcx - adcxq %rax, %rsi - adoxq %rcx, %r8 - mulxq %r11, %rax, %rcx - adcxq %rax, %r8 - adoxq %rcx, %r9 - movl $0x0, %r10d - adcxq %r10, %r9 - movq %rbx, (%rdi) - movq %rsi, 0x8(%rdi) - movq %r8, 0x10(%rdi) - movq %r9, 0x18(%rdi) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_local_demont_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_local_inv_p256) - -Lp256_scalarmulbase_local_inv_p256: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(240) - movq %rdi, 0xe0(%rsp) - xorl %ecx, %ecx - movl $0xffffffff, %edx - movq %rdx, %rbx - leaq -0x1(%rcx), %rax - negq %rdx - movq %rax, (%rsp) - movq %rbx, 0x8(%rsp) - movq %rcx, 0x10(%rsp) - movq %rdx, 0x18(%rsp) - movq %rcx, 0x20(%rsp) - movq (%rsi), %r8 - movq 0x8(%rsi), %r9 - movq 0x10(%rsi), %r10 - movq 0x18(%rsi), %r11 - leaq 0x1(%rcx), %rax - addq %r8, %rax - leaq -0x1(%rdx), %rbx - adcq %r9, %rbx - notq %rcx - adcq %r10, %rcx - notq %rdx - adcq %r11, %rdx - cmovaeq %r8, %rax - cmovaeq %r9, %rbx - cmovaeq %r10, %rcx - cmovaeq %r11, %rdx - movq %rax, 0x28(%rsp) - movq %rbx, 0x30(%rsp) - movq %rcx, 0x38(%rsp) - movq %rdx, 0x40(%rsp) - xorl %eax, %eax - movq %rax, 0x48(%rsp) - xorl %eax, %eax - movq %rax, 0x50(%rsp) - movq %rax, 0x58(%rsp) - movq %rax, 0x60(%rsp) - movq %rax, 0x68(%rsp) - movq $0x4000000000000, %rcx - movq %rcx, 0x78(%rsp) - movq %rax, 0x80(%rsp) - movq %rax, 0x88(%rsp) - movq %rax, 0x90(%rsp) - movq $0xa, 0xb0(%rsp) - movq $0x1, 0xb8(%rsp) - jmp Lp256_scalarmulbase_inv_midloop -Lp256_scalarmulbase_inv_loop: - movq %r8, %r9 - sarq $0x3f, %r9 - xorq %r9, %r8 - subq %r9, %r8 - movq %r10, %r11 - sarq $0x3f, %r11 - xorq %r11, %r10 - subq %r11, %r10 - movq %r12, %r13 - sarq $0x3f, %r13 - xorq %r13, %r12 - subq %r13, %r12 - movq %r14, %r15 - sarq $0x3f, %r15 - xorq %r15, %r14 - subq %r15, %r14 - movq %r8, %rax - andq %r9, %rax - movq %r10, %rdi - andq %r11, %rdi - addq %rax, %rdi - movq %rdi, 0xa0(%rsp) - movq %r12, %rax - andq %r13, %rax - movq %r14, %rsi - andq %r15, %rsi - addq %rax, %rsi - movq %rsi, 0xa8(%rsp) - xorl %ebx, %ebx - movq (%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rdi - adcq %rdx, %rbx - movq 0x28(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rdi - adcq %rdx, %rbx - xorl %ebp, %ebp - movq (%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rbp - movq 0x28(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - xorl %ecx, %ecx - movq 0x8(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq 0x30(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - shrdq $0x3b, %rbx, %rdi - movq %rdi, (%rsp) - xorl %edi, %edi - movq 0x8(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rbp - adcq %rdx, %rdi - movq 0x30(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rdi - shrdq $0x3b, %rbp, %rsi - movq %rsi, 0x28(%rsp) - xorl %esi, %esi - movq 0x10(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rsi - movq 0x38(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rsi - shrdq $0x3b, %rcx, %rbx - movq %rbx, 0x8(%rsp) - xorl %ebx, %ebx - movq 0x10(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rdi - adcq %rdx, %rbx - movq 0x38(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rdi - adcq %rdx, %rbx - shrdq $0x3b, %rdi, %rbp - movq %rbp, 0x30(%rsp) - movq 0x18(%rsp), %rax - xorq %r9, %rax - movq 0x20(%rsp), %rbp - xorq %r9, %rbp - andq %r8, %rbp - negq %rbp - mulq %r8 - addq %rax, %rsi - adcq %rdx, %rbp - movq 0x40(%rsp), %rax - xorq %r11, %rax - movq 0x48(%rsp), %rdx - xorq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbp - mulq %r10 - addq %rax, %rsi - adcq %rdx, %rbp - shrdq $0x3b, %rsi, %rcx - movq %rcx, 0x10(%rsp) - shrdq $0x3b, %rbp, %rsi - sarq $0x3b, %rbp - movq 0x18(%rsp), %rax - movq %rsi, 0x18(%rsp) - movq 0x20(%rsp), %rsi - movq %rbp, 0x20(%rsp) - xorq %r13, %rax - xorq %r13, %rsi - andq %r12, %rsi - negq %rsi - mulq %r12 - addq %rax, %rbx - adcq %rdx, %rsi - movq 0x40(%rsp), %rax - xorq %r15, %rax - movq 0x48(%rsp), %rdx - xorq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rsi - mulq %r14 - addq %rax, %rbx - adcq %rdx, %rsi - shrdq $0x3b, %rbx, %rdi - movq %rdi, 0x38(%rsp) - shrdq $0x3b, %rsi, %rbx - movq %rbx, 0x40(%rsp) - sarq $0x3b, %rsi - movq %rsi, 0x48(%rsp) - movq 0xa0(%rsp), %rbx - movq 0xa8(%rsp), %rbp - xorl %ecx, %ecx - movq 0x50(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq 0x78(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - xorl %esi, %esi - movq 0x50(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, 0x50(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq 0x78(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, 0x78(%rsp) - xorl %ebx, %ebx - movq 0x58(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq 0x80(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rbx - xorl %ebp, %ebp - movq 0x58(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rcx, 0x58(%rsp) - addq %rax, %rsi - adcq %rdx, %rbp - movq 0x80(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - movq %rsi, 0x80(%rsp) - xorl %ecx, %ecx - movq 0x60(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq 0x88(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - xorl %esi, %esi - movq 0x60(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, 0x60(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq 0x88(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, 0x88(%rsp) - movq 0x68(%rsp), %rax - xorq %r9, %rax - movq %r9, %rbx - andq %r8, %rbx - negq %rbx - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq 0x90(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbx - mulq %r10 - addq %rax, %rcx - adcq %rbx, %rdx - movq 0x68(%rsp), %rax - movq %rcx, 0x68(%rsp) - movq %rdx, 0x70(%rsp) - xorq %r13, %rax - movq %r13, %rcx - andq %r12, %rcx - negq %rcx - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rcx - movq 0x90(%rsp), %rax - xorq %r15, %rax - movq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rcx - mulq %r14 - addq %rax, %rsi - adcq %rcx, %rdx - movq %rsi, 0x90(%rsp) - movq %rdx, 0x98(%rsp) - movq $0xe000000000000000, %r8 - addq 0x50(%rsp), %r8 - movq $0xffffffffffffffff, %r9 - adcq 0x58(%rsp), %r9 - movq $0x1fffffff, %r10 - adcq 0x60(%rsp), %r10 - movq $0x2000000000000000, %r11 - adcq 0x68(%rsp), %r11 - movq $0x1fffffffe0000000, %r12 - adcq 0x70(%rsp), %r12 - movq %r8, %rbx - shlq $0x20, %rbx - movq $0xffffffff00000001, %rax - mulq %r8 - shrq $0x20, %r8 - addq %rbx, %r9 - adcq %r8, %r10 - adcq %rax, %r11 - adcq %rdx, %r12 - sbbq %rax, %rax - movl $0xffffffff, %ebx - andq %rax, %rbx - movq $0xffffffff00000001, %rdx - andq %rax, %rdx - subq %rax, %r9 - movq %r9, 0x50(%rsp) - sbbq %rbx, %r10 - movq %r10, 0x58(%rsp) - sbbq $0x0, %r11 - movq %r11, 0x60(%rsp) - sbbq %rdx, %r12 - movq %r12, 0x68(%rsp) - movq $0xe000000000000000, %r8 - addq 0x78(%rsp), %r8 - movq $0xffffffffffffffff, %r9 - adcq 0x80(%rsp), %r9 - movq $0x1fffffff, %r10 - adcq 0x88(%rsp), %r10 - movq $0x2000000000000000, %r11 - adcq 0x90(%rsp), %r11 - movq $0x1fffffffe0000000, %r12 - adcq 0x98(%rsp), %r12 - movq %r8, %rbx - shlq $0x20, %rbx - movq $0xffffffff00000001, %rax - mulq %r8 - shrq $0x20, %r8 - addq %rbx, %r9 - adcq %r8, %r10 - adcq %rax, %r11 - adcq %rdx, %r12 - sbbq %rax, %rax - movl $0xffffffff, %ebx - andq %rax, %rbx - movq $0xffffffff00000001, %rdx - andq %rax, %rdx - subq %rax, %r9 - movq %r9, 0x78(%rsp) - sbbq %rbx, %r10 - movq %r10, 0x80(%rsp) - sbbq $0x0, %r11 - movq %r11, 0x88(%rsp) - sbbq %rdx, %r12 - movq %r12, 0x90(%rsp) -Lp256_scalarmulbase_inv_midloop: - movq 0xb8(%rsp), %rsi - movq (%rsp), %rdx - movq 0x28(%rsp), %rcx - movq %rdx, %rbx - andq $0xfffff, %rbx - movq $0xfffffe0000000000, %rax - orq %rax, %rbx - andq $0xfffff, %rcx - movq $0xc000000000000000, %rax - orq %rax, %rcx - movq $0xfffffffffffffffe, %rax - xorl %ebp, %ebp - movl $0x2, %edx - movq %rbx, %rdi - movq %rax, %r8 - testq %rsi, %rsi - cmovs %rbp, %r8 - testq $0x1, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - sarq $1, %rcx - movl $0x100000, %eax - leaq (%rbx,%rax), %rdx - leaq (%rcx,%rax), %rdi - shlq $0x16, %rdx - shlq $0x16, %rdi - sarq $0x2b, %rdx - sarq $0x2b, %rdi - movq $0x20000100000, %rax - leaq (%rbx,%rax), %rbx - leaq (%rcx,%rax), %rcx - sarq $0x2a, %rbx - sarq $0x2a, %rcx - movq %rdx, 0xc0(%rsp) - movq %rbx, 0xc8(%rsp) - movq %rdi, 0xd0(%rsp) - movq %rcx, 0xd8(%rsp) - movq (%rsp), %r12 - imulq %r12, %rdi - imulq %rdx, %r12 - movq 0x28(%rsp), %r13 - imulq %r13, %rbx - imulq %rcx, %r13 - addq %rbx, %r12 - addq %rdi, %r13 - sarq $0x14, %r12 - sarq $0x14, %r13 - movq %r12, %rbx - andq $0xfffff, %rbx - movq $0xfffffe0000000000, %rax - orq %rax, %rbx - movq %r13, %rcx - andq $0xfffff, %rcx - movq $0xc000000000000000, %rax - orq %rax, %rcx - movq $0xfffffffffffffffe, %rax - movl $0x2, %edx - movq %rbx, %rdi - movq %rax, %r8 - testq %rsi, %rsi - cmovs %rbp, %r8 - testq $0x1, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - sarq $1, %rcx - movl $0x100000, %eax - leaq (%rbx,%rax), %r8 - leaq (%rcx,%rax), %r10 - shlq $0x16, %r8 - shlq $0x16, %r10 - sarq $0x2b, %r8 - sarq $0x2b, %r10 - movq $0x20000100000, %rax - leaq (%rbx,%rax), %r15 - leaq (%rcx,%rax), %r11 - sarq $0x2a, %r15 - sarq $0x2a, %r11 - movq %r13, %rbx - movq %r12, %rcx - imulq %r8, %r12 - imulq %r15, %rbx - addq %rbx, %r12 - imulq %r11, %r13 - imulq %r10, %rcx - addq %rcx, %r13 - sarq $0x14, %r12 - sarq $0x14, %r13 - movq %r12, %rbx - andq $0xfffff, %rbx - movq $0xfffffe0000000000, %rax - orq %rax, %rbx - movq %r13, %rcx - andq $0xfffff, %rcx - movq $0xc000000000000000, %rax - orq %rax, %rcx - movq 0xc0(%rsp), %rax - imulq %r8, %rax - movq 0xd0(%rsp), %rdx - imulq %r15, %rdx - imulq 0xc8(%rsp), %r8 - imulq 0xd8(%rsp), %r15 - addq %r8, %r15 - leaq (%rax,%rdx), %r9 - movq 0xc0(%rsp), %rax - imulq %r10, %rax - movq 0xd0(%rsp), %rdx - imulq %r11, %rdx - imulq 0xc8(%rsp), %r10 - imulq 0xd8(%rsp), %r11 - addq %r10, %r11 - leaq (%rax,%rdx), %r13 - movq $0xfffffffffffffffe, %rax - movl $0x2, %edx - movq %rbx, %rdi - movq %rax, %r8 - testq %rsi, %rsi - cmovs %rbp, %r8 - testq $0x1, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - sarq $1, %rcx - movl $0x100000, %eax - leaq (%rbx,%rax), %r8 - leaq (%rcx,%rax), %r12 - shlq $0x15, %r8 - shlq $0x15, %r12 - sarq $0x2b, %r8 - sarq $0x2b, %r12 - movq $0x20000100000, %rax - leaq (%rbx,%rax), %r10 - leaq (%rcx,%rax), %r14 - sarq $0x2b, %r10 - sarq $0x2b, %r14 - movq %r9, %rax - imulq %r8, %rax - movq %r13, %rdx - imulq %r10, %rdx - imulq %r15, %r8 - imulq %r11, %r10 - addq %r8, %r10 - leaq (%rax,%rdx), %r8 - movq %r9, %rax - imulq %r12, %rax - movq %r13, %rdx - imulq %r14, %rdx - imulq %r15, %r12 - imulq %r11, %r14 - addq %r12, %r14 - leaq (%rax,%rdx), %r12 - movq %rsi, 0xb8(%rsp) - decq 0xb0(%rsp) - jne Lp256_scalarmulbase_inv_loop - movq (%rsp), %rax - movq 0x28(%rsp), %rcx - imulq %r8, %rax - imulq %r10, %rcx - addq %rcx, %rax - sarq $0x3f, %rax - movq %r8, %r9 - sarq $0x3f, %r9 - xorq %r9, %r8 - subq %r9, %r8 - xorq %rax, %r9 - movq %r10, %r11 - sarq $0x3f, %r11 - xorq %r11, %r10 - subq %r11, %r10 - xorq %rax, %r11 - movq %r12, %r13 - sarq $0x3f, %r13 - xorq %r13, %r12 - subq %r13, %r12 - xorq %rax, %r13 - movq %r14, %r15 - sarq $0x3f, %r15 - xorq %r15, %r14 - subq %r15, %r14 - xorq %rax, %r15 - movq %r8, %rax - andq %r9, %rax - movq %r10, %r12 - andq %r11, %r12 - addq %rax, %r12 - xorl %r13d, %r13d - movq 0x50(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r12 - adcq %rdx, %r13 - movq 0x78(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movq 0x58(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r13 - adcq %rdx, %r14 - movq 0x80(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r13 - adcq %rdx, %r14 - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r14 - adcq %rdx, %r15 - movq 0x88(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r14 - adcq %rdx, %r15 - movq 0x68(%rsp), %rax - xorq %r9, %rax - andq %r8, %r9 - negq %r9 - mulq %r8 - addq %rax, %r15 - adcq %rdx, %r9 - movq 0x90(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %r9 - mulq %r10 - addq %rax, %r15 - adcq %rdx, %r9 - movq %r12, 0x50(%rsp) - movq %r13, 0x58(%rsp) - movq %r14, 0x60(%rsp) - movq %r15, 0x68(%rsp) - movq %r9, 0x70(%rsp) - movq $0xe000000000000000, %r8 - addq 0x50(%rsp), %r8 - movq $0xffffffffffffffff, %r9 - adcq 0x58(%rsp), %r9 - movq $0x1fffffff, %r10 - adcq 0x60(%rsp), %r10 - movq $0x2000000000000000, %r11 - adcq 0x68(%rsp), %r11 - movq $0x1fffffffe0000000, %r12 - adcq 0x70(%rsp), %r12 - movq %r8, %rbx - shlq $0x20, %rbx - movq $0xffffffff00000001, %rax - mulq %r8 - shrq $0x20, %r8 - addq %rbx, %r9 - adcq %r8, %r10 - adcq %rax, %r11 - adcq %rdx, %r12 - sbbq %rax, %rax - movl $0xffffffff, %ebx - andq %rax, %rbx - movq $0xffffffff00000001, %rdx - andq %rax, %rdx - subq %rax, %r9 - movq %r9, 0x50(%rsp) - sbbq %rbx, %r10 - movq %r10, 0x58(%rsp) - sbbq $0x0, %r11 - movq %r11, 0x60(%rsp) - sbbq %rdx, %r12 - movq %r12, 0x68(%rsp) - movq 0x50(%rsp), %r8 - movq 0x58(%rsp), %r9 - movq 0x60(%rsp), %r10 - movq 0x68(%rsp), %r11 - movl $0x1, %eax - movl $0xffffffff, %ebx - leaq -0x2(%rax), %rcx - leaq -0x1(%rbx), %rdx - notq %rbx - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - cmovaeq %r8, %rax - cmovaeq %r9, %rbx - cmovaeq %r10, %rcx - cmovaeq %r11, %rdx - movq 0xe0(%rsp), %rdi - movq %rax, (%rdi) - movq %rbx, 0x8(%rdi) - movq %rcx, 0x10(%rdi) - movq %rdx, 0x18(%rdi) - CFI_INC_RSP(240) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_local_inv_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_local_montmul_p256) - -Lp256_scalarmulbase_local_montmul_p256: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - movq %rdx, %rcx - xorl %r13d, %r13d - movq (%rcx), %rdx - mulxq (%rsi), %r8, %r9 - mulxq 0x8(%rsi), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x10(%rsi), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x18(%rsi), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x8(%rcx), %rdx - xorl %r14d, %r14d - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x10(%rcx), %rdx - xorl %r8d, %r8d - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x18(%rsi), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x18(%rcx), %rdx - xorl %r9d, %r9d - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x18(%rsi), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rdi) - movq %r13, 0x8(%rdi) - movq %r14, 0x10(%rdi) - movq %r15, 0x18(%rdi) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_local_montmul_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_local_montsqr_p256) - -Lp256_scalarmulbase_local_montsqr_p256: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - movq (%rsi), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x8(%rsi), %r9, %r10 - mulxq 0x18(%rsi), %r11, %r12 - movq 0x10(%rsi), %rdx - mulxq 0x18(%rsi), %r13, %r14 - xorl %ebp, %ebp - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x18(%rsi), %rdx - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - xorl %ebp, %ebp - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x8(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x10(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x18(%rsi), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rbp, %r15 - adoxq %rbp, %r15 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rbp, %r13 - movl %ebp, %r9d - adoxq %rbp, %r9 - adcxq %rbp, %r9 - addq %r9, %r14 - adcq %rbp, %r15 - movl %ebp, %r8d - adcq %rbp, %r8 - xorl %ebp, %ebp - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rbp, %r15 - adoxq %rbp, %r8 - adcq %rbp, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rdx), %rdx - adcq %r13, %rdx - leaq -0x1(%rbp), %rbp - movq %rbp, %rax - adcq %r14, %rbp - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbp, %r14 - cmovbq %r11, %r15 - movq %r12, (%rdi) - movq %r13, 0x8(%rdi) - movq %r14, 0x10(%rdi) - movq %r15, 0x18(%rdi) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_local_montsqr_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_local_p256_montjmixadd) - -Lp256_scalarmulbase_local_p256_montjmixadd: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(192) - movq %rdx, %rbp - movq 0x40(%rsi), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x48(%rsi), %r9, %r10 - mulxq 0x58(%rsi), %r11, %r12 - movq 0x50(%rsi), %rdx - mulxq 0x58(%rsi), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x58(%rsi), %rdx - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x48(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x50(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x58(%rsi), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - movl %ecx, %r9d - adoxq %rcx, %r9 - adcxq %rcx, %r9 - addq %r9, %r14 - adcq %rcx, %r15 - movl %ecx, %r8d - adcq %rcx, %r8 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rcx, %r15 - adoxq %rcx, %r8 - adcq %rcx, %r8 - movl $0x1, %r8d - leaq -0x1(%rdx), %rdx - leaq -0x1(%rcx), %rax - movl $0xfffffffe, %r11d - cmoveq %rcx, %r8 - cmoveq %rcx, %rdx - cmoveq %rcx, %rax - cmoveq %rcx, %r11 - addq %r8, %r12 - adcq %rdx, %r13 - adcq %rax, %r14 - adcq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - xorl %r13d, %r13d - movq 0x20(%rbp), %rdx - mulxq 0x40(%rsi), %r8, %r9 - mulxq 0x48(%rsi), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x50(%rsi), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x58(%rsi), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x28(%rbp), %rdx - xorl %r14d, %r14d - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x50(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x58(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x30(%rbp), %rdx - xorl %r8d, %r8d - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x50(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x58(%rsi), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x38(%rbp), %rdx - xorl %r9d, %r9d - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x50(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x58(%rsi), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - xorl %r13d, %r13d - movq 0x0(%rbp), %rdx - mulxq (%rsp), %r8, %r9 - mulxq 0x8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x10(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x18(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x8(%rbp), %rdx - xorl %r14d, %r14d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x10(%rbp), %rdx - xorl %r8d, %r8d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x18(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x18(%rbp), %rdx - xorl %r9d, %r9d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x18(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - xorl %r13d, %r13d - movq 0x20(%rsp), %rdx - mulxq (%rsp), %r8, %r9 - mulxq 0x8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x10(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x18(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x28(%rsp), %rdx - xorl %r14d, %r14d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x30(%rsp), %rdx - xorl %r8d, %r8d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x18(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x38(%rsp), %rdx - xorl %r9d, %r9d - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x18(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq 0x40(%rsp), %rax - subq (%rsi), %rax - movq 0x48(%rsp), %rcx - sbbq 0x8(%rsi), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x10(%rsi), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x18(%rsi), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0xa0(%rsp) - adcq %r10, %rcx - movq %rcx, 0xa8(%rsp) - adcq $0x0, %r8 - movq %r8, 0xb0(%rsp) - adcq %rdx, %r9 - movq %r9, 0xb8(%rsp) - movq 0x20(%rsp), %rax - subq 0x20(%rsi), %rax - movq 0x28(%rsp), %rcx - sbbq 0x28(%rsi), %rcx - movq 0x30(%rsp), %r8 - sbbq 0x30(%rsi), %r8 - movq 0x38(%rsp), %r9 - sbbq 0x38(%rsi), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x20(%rsp) - adcq %r10, %rcx - movq %rcx, 0x28(%rsp) - adcq $0x0, %r8 - movq %r8, 0x30(%rsp) - adcq %rdx, %r9 - movq %r9, 0x38(%rsp) - movq 0xa0(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0xa8(%rsp), %r9, %r10 - mulxq 0xb8(%rsp), %r11, %r12 - movq 0xb0(%rsp), %rdx - mulxq 0xb8(%rsp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0xb8(%rsp), %rdx - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0xa8(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0xb0(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0xb8(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - movl %ecx, %r9d - adoxq %rcx, %r9 - adcxq %rcx, %r9 - addq %r9, %r14 - adcq %rcx, %r15 - movl %ecx, %r8d - adcq %rcx, %r8 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rcx, %r15 - adoxq %rcx, %r8 - adcq %rcx, %r8 - movl $0x1, %r8d - leaq -0x1(%rdx), %rdx - leaq -0x1(%rcx), %rax - movl $0xfffffffe, %r11d - cmoveq %rcx, %r8 - cmoveq %rcx, %rdx - cmoveq %rcx, %rax - cmoveq %rcx, %r11 - addq %r8, %r12 - adcq %rdx, %r13 - adcq %rax, %r14 - adcq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x20(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x28(%rsp), %r9, %r10 - mulxq 0x38(%rsp), %r11, %r12 - movq 0x30(%rsp), %rdx - mulxq 0x38(%rsp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x38(%rsp), %rdx - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x28(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x30(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x38(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq $0xffffffff00000001, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - movl %ecx, %r9d - adoxq %rcx, %r9 - adcxq %rcx, %r9 - addq %r9, %r14 - adcq %rcx, %r15 - movl %ecx, %r8d - adcq %rcx, %r8 - xorl %ecx, %ecx - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq $0xffffffff00000001, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %rcx, %r15 - adoxq %rcx, %r8 - adcq %rcx, %r8 - movl $0x1, %ebx - addq %r12, %rbx - leaq -0x1(%rdx), %rdx - adcq %r13, %rdx - leaq -0x1(%rcx), %rcx - movq %rcx, %rax - adcq %r14, %rcx - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rbx, %r12 - cmovbq %rdx, %r13 - cmovbq %rcx, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - xorl %r13d, %r13d - movq (%rsi), %rdx - mulxq 0x60(%rsp), %r8, %r9 - mulxq 0x68(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x70(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x78(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x8(%rsi), %rdx - xorl %r14d, %r14d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x78(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x10(%rsi), %rdx - xorl %r8d, %r8d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x18(%rsi), %rdx - xorl %r9d, %r9d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - xorl %r13d, %r13d - movq 0x40(%rsp), %rdx - mulxq 0x60(%rsp), %r8, %r9 - mulxq 0x68(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x70(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x78(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x48(%rsp), %rdx - xorl %r14d, %r14d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x78(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x50(%rsp), %rdx - xorl %r8d, %r8d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x58(%rsp), %rdx - xorl %r9d, %r9d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq (%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq $0x0, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x40(%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x60(%rsp) - adcq %r10, %rcx - movq %rcx, 0x68(%rsp) - adcq $0x0, %r8 - movq %r8, 0x70(%rsp) - adcq %rdx, %r9 - movq %r9, 0x78(%rsp) - xorl %r13d, %r13d - movq 0x40(%rsi), %rdx - mulxq 0xa0(%rsp), %r8, %r9 - mulxq 0xa8(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0xb0(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0xb8(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x48(%rsi), %rdx - xorl %r14d, %r14d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x50(%rsi), %rdx - xorl %r8d, %r8d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x58(%rsi), %rdx - xorl %r9d, %r9d - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0xb8(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq (%rsp), %rax - subq 0x40(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x48(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x50(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x58(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq $0x0, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x80(%rsp), %rax - subq (%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x18(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq $0x0, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - xorl %r13d, %r13d - movq 0x20(%rsi), %rdx - mulxq 0x60(%rsp), %r8, %r9 - mulxq 0x68(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x70(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x78(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x28(%rsi), %rdx - xorl %r14d, %r14d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x78(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x30(%rsi), %rdx - xorl %r8d, %r8d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x38(%rsi), %rdx - xorl %r9d, %r9d - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x78(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - xorl %r13d, %r13d - movq 0x80(%rsp), %rdx - mulxq 0x20(%rsp), %r8, %r9 - mulxq 0x28(%rsp), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x30(%rsp), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x38(%rsp), %rbx, %r12 - adcq %rbx, %r11 - adcq %r13, %r12 - movq 0x88(%rsp), %rdx - xorl %r14d, %r14d - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x30(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x38(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcq %r14, %r13 - xorl %r15d, %r15d - movq $0x100000000, %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq %r9, %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r8, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r9, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %r15, %r13 - adoxq %r15, %r14 - adcq %r15, %r14 - movq 0x90(%rsp), %rdx - xorl %r8d, %r8d - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x30(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adoxq %r8, %r14 - mulxq 0x38(%rsp), %rax, %rbx - adcq %rax, %r13 - adcq %rbx, %r14 - adcq %r8, %r15 - movq 0x98(%rsp), %rdx - xorl %r9d, %r9d - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x30(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - adoxq %r9, %r15 - mulxq 0x38(%rsp), %rax, %rbx - adcq %rax, %r14 - adcq %rbx, %r15 - adcq %r9, %r8 - xorl %r9d, %r9d - movq $0x100000000, %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq %r11, %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - notq %rdx - leaq 0x2(%rdx), %rdx - mulxq %r10, %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq %r11, %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - adcxq %r9, %r15 - adoxq %r9, %r8 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rdx - adcq %r13, %rdx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x80(%rsp), %rax - subq 0x60(%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x68(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x70(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x78(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq $0x0, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - movq 0x40(%rsi), %rax - movq 0x48(%rsi), %rdx - orq 0x50(%rsi), %rax - orq 0x58(%rsi), %rdx - orq %rdx, %rax - movq (%rsp), %r8 - movq 0x0(%rbp), %rax - cmoveq %rax, %r8 - movq 0x8(%rsp), %r9 - movq 0x8(%rbp), %rax - cmoveq %rax, %r9 - movq 0x10(%rsp), %r10 - movq 0x10(%rbp), %rax - cmoveq %rax, %r10 - movq 0x18(%rsp), %r11 - movq 0x18(%rbp), %rax - cmoveq %rax, %r11 - movq 0x80(%rsp), %r12 - movq 0x20(%rbp), %rax - cmoveq %rax, %r12 - movq 0x88(%rsp), %r13 - movq 0x28(%rbp), %rax - cmoveq %rax, %r13 - movq 0x90(%rsp), %r14 - movq 0x30(%rbp), %rax - cmoveq %rax, %r14 - movq 0x98(%rsp), %r15 - movq 0x38(%rbp), %rax - cmoveq %rax, %r15 - movq %r8, (%rdi) - movq %r9, 0x8(%rdi) - movq %r10, 0x10(%rdi) - movq %r11, 0x18(%rdi) - movq %r12, 0x20(%rdi) - movq %r13, 0x28(%rdi) - movq %r14, 0x30(%rdi) - movq %r15, 0x38(%rdi) - movq 0xa0(%rsp), %r8 - movq 0xa8(%rsp), %r9 - movq 0xb0(%rsp), %r10 - movq 0xb8(%rsp), %r11 - movl $0x1, %eax - cmoveq %rax, %r8 - movq $0xffffffff00000000, %rax - cmoveq %rax, %r9 - movq $0xffffffffffffffff, %rax - cmoveq %rax, %r10 - movl $0xfffffffe, %eax - cmoveq %rax, %r11 - movq %r8, 0x40(%rdi) - movq %r9, 0x48(%rdi) - movq %r10, 0x50(%rdi) - movq %r11, 0x58(%rdi) - CFI_INC_RSP(192) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_local_p256_montjmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmulbase_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmulbase_alt.S deleted file mode 100644 index 95562b38009..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p256/p256_scalarmulbase_alt.S +++ /dev/null @@ -1,4212 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Scalar multiplication for precomputed point on NIST curve P-256 -// Input scalar[4], blocksize, table[]; output res[8] -// -// extern void p256_scalarmulbase_alt -// (uint64_t res[static 8], -// const uint64_t scalar[static 4], -// uint64_t blocksize, -// const uint64_t *table); -// -// Given scalar = n and point = P, assumed to be on the NIST elliptic -// curve P-256, the input argument "table" is expected to be a table of -// multiples of the point P in Montgomery-affine form, with each block -// corresponding to "blocksize" bits of the scalar as follows, where -// B = 2^{blocksize-1} (e.g. B = 8 for blocksize = 4): -// -// For each i,j with blocksize * i <= 256 and 1 <= j <= B -// the multiple 2^{blocksize * i} * j * P is stored at -// tab[8 * (B * i + (j - 1))], considered as uint64_t pointers -// or tab + 64 * (B * i + (j - 1)) as byte pointers. -// -// Standard x86-64 ABI: RDI = res, RSI = scalar, RDX = blocksize, RCX = table -// Microsoft x64 ABI: RCX = res, RDX = scalar, R8 = blocksize, R9 = table -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p256_scalarmulbase_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p256_scalarmulbase_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p256_scalarmulbase_alt) - - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Intermediate variables on the stack. The last z2, z3 values can -// safely be overlaid on "nacc", which is no longer needed at the end. -// Uppercase syntactic variants make x86_att version simpler to generate - -#define RSCALAR (0*NUMSIZE) -#define ACC (1*NUMSIZE) -#define NACC (4*NUMSIZE) -#define TABENT (7*NUMSIZE) -#define Z2 (4*NUMSIZE) -#define Z3 (5*NUMSIZE) - -#define rscalar RSCALAR(%rsp) -#define acc ACC(%rsp) -#define nacc NACC(%rsp) -#define tabent TABENT(%rsp) - -#define z2 Z2(%rsp) -#define z3 Z3(%rsp) - -#define res (9*NUMSIZE)(%rsp) -#define blocksize (9*NUMSIZE+8)(%rsp) -#define table (9*NUMSIZE+16)(%rsp) -#define i (9*NUMSIZE+24)(%rsp) -#define bf (9*NUMSIZE+32)(%rsp) -#define cf (9*NUMSIZE+40)(%rsp) -#define j (9*NUMSIZE+48)(%rsp) - -#define NSPACE 11*NUMSIZE - -S2N_BN_SYMBOL(p256_scalarmulbase_alt): - CFI_START - _CET_ENDBR - -// The Windows version literally calls the standard ABI version. -// This simplifies the proofs since subroutine offsets are fixed. - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx - CFI_CALL(Lp256_scalarmulbase_alt_standard) - CFI_POP(%rsi) - CFI_POP(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p256_scalarmulbase_alt) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_alt_standard) - -Lp256_scalarmulbase_alt_standard: - CFI_START -#endif - -// Real start of the standard ABI code. - - CFI_PUSH(%r15) - CFI_PUSH(%r14) - CFI_PUSH(%r13) - CFI_PUSH(%r12) - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - - CFI_DEC_RSP(NSPACE) - -// Preserve the input arguments except the scalar, since that gets absorbed -// immediately. The "table" value subsequently gets shifted up each iteration -// of the loop, while "res" and "blocksize" are static throughout. - - movq %rdi, res - movq %rdx, blocksize - movq %rcx, table - -// Load the digits of group order n_256 = [%r15;%r14;%r13;%r12] - - movq $0xf3b9cac2fc632551, %r12 - movq $0xbce6faada7179e84, %r13 - movq $0xffffffffffffffff, %r14 - movq $0xffffffff00000000, %r15 - -// First, reduce the input scalar mod n_256, i.e. conditionally subtract n_256 -// Store it to "rscalar" (reduced scalar) - - movq (%rsi), %r8 - subq %r12, %r8 - movq 8(%rsi), %r9 - sbbq %r13, %r9 - movq 16(%rsi), %r10 - sbbq %r14, %r10 - movq 24(%rsi), %r11 - sbbq %r15, %r11 - - cmovcq (%rsi), %r8 - cmovcq 8(%rsi), %r9 - cmovcq 16(%rsi), %r10 - cmovcq 24(%rsi), %r11 - - movq %r8, RSCALAR(%rsp) - movq %r9, RSCALAR+8(%rsp) - movq %r10, RSCALAR+16(%rsp) - movq %r11, RSCALAR+24(%rsp) - -// Initialize the accumulator to all zeros and the "carry flag" cf to 0 - - xorl %eax, %eax - - movq %rax, ACC(%rsp) - movq %rax, ACC+8(%rsp) - movq %rax, ACC+16(%rsp) - movq %rax, ACC+24(%rsp) - movq %rax, ACC+32(%rsp) - movq %rax, ACC+40(%rsp) - movq %rax, ACC+48(%rsp) - movq %rax, ACC+56(%rsp) - movq %rax, ACC+64(%rsp) - movq %rax, ACC+72(%rsp) - movq %rax, ACC+80(%rsp) - movq %rax, ACC+88(%rsp) - - movq %rax, cf - -// Main loop over {i >= 0 | blocksize * i <= 256}. Note the non-strict -// inequality, to allow top carry for any choices of blocksize. - - movq %rax, i - -Lp256_scalarmulbase_alt_loop: - -// The next raw bitfield is bf = bitfield(blocksize * i,blocksize) + cf, -// adding in the deferred carry cf. We then shift the whole scalar right -// by blocksize so we can keep picking bitfield(0,blocksize). - - movq RSCALAR(%rsp), %r8 - movq RSCALAR+8(%rsp), %r9 - movq RSCALAR+16(%rsp), %r10 - movq RSCALAR+24(%rsp), %r11 - - movq blocksize, %rcx - movl $1, %eax - shlq %cl, %rax - decq %rax - andq %r8, %rax - - shrdq %cl, %r9, %r8 - shrdq %cl, %r10, %r9 - shrdq %cl, %r11, %r10 - shrq %cl, %r11 - - addq cf, %rax - movq %rax, bf - - movq %r8, RSCALAR(%rsp) - movq %r9, RSCALAR+8(%rsp) - movq %r10, RSCALAR+16(%rsp) - movq %r11, RSCALAR+24(%rsp) - -// Now if bf <= B we just select entry j, unnegated and set cf = 0. -// If bf > B we set j = 2 * B - bf and negate the j'th entry, setting cf = 1. -// In either case we ultimately add bf, in the latter case with deferred -// carry as 2 * B - (2 * B - bf) = bf. - - movl $1, %eax - movq blocksize, %rcx - shlq %cl, %rax - movq %rax, %rbx - shrq $1, %rax - - subq bf, %rbx - cmpq bf, %rax - - cmovncq bf, %rbx - sbbq %rax, %rax - movq %rbx, j - negq %rax - movq %rax, cf - -// Load table entry j - 1 for nonzero j in constant-time style. - - movq blocksize, %rcx - decq %rcx - movl $1, %esi - shlq %cl, %rsi - movq j, %r12 - movq table, %rbp - -Lp256_scalarmulbase_alt_tabloop: - subq $1, %r12 - cmovzq (%rbp), %rax - cmovzq 8(%rbp), %rbx - cmovzq 16(%rbp), %rcx - cmovzq 24(%rbp), %rdx - cmovzq 32(%rbp), %r8 - cmovzq 40(%rbp), %r9 - cmovzq 48(%rbp), %r10 - cmovzq 56(%rbp), %r11 - - addq $64, %rbp - decq %rsi - jnz Lp256_scalarmulbase_alt_tabloop - - movq %rbp, table - -// Before storing back, optionally negate the y coordinate of the table entry - - xorl %r14d, %r14d - leaq -1(%r14), %r12 - movq $0x00000000ffffffff, %r15 - movq %r15, %r13 - negq %r15 - - subq %r8, %r12 - sbbq %r9, %r13 - sbbq %r10, %r14 - sbbq %r11, %r15 - - movq %rax, TABENT(%rsp) - movq %rbx, TABENT+8(%rsp) - movq %rcx, TABENT+16(%rsp) - movq %rdx, TABENT+24(%rsp) - - movq cf, %rax - testq %rax, %rax - cmovnzq %r12, %r8 - cmovnzq %r13, %r9 - cmovnzq %r14, %r10 - cmovnzq %r15, %r11 - - movq %r8, TABENT+32(%rsp) - movq %r9, TABENT+40(%rsp) - movq %r10, TABENT+48(%rsp) - movq %r11, TABENT+56(%rsp) - -// Add the adjusted table point to the accumulator - - leaq NACC(%rsp), %rdi - leaq ACC(%rsp), %rsi - leaq TABENT(%rsp), %rdx - CFI_CALL(Lp256_scalarmulbase_alt_local_p256_montjmixadd) - -// However, only commit that update to the accumulator if j is nonzero, -// because the mixed addition function does not handle this case directly, -// and in any case we didn't choose the table entry appropriately. - - movq j, %rax - testq %rax, %rax - - movq ACC(%rsp), %rax - cmovnzq NACC(%rsp), %rax - movq %rax, ACC(%rsp) - - movq ACC+8(%rsp), %rax - cmovnzq NACC+8(%rsp), %rax - movq %rax, ACC+8(%rsp) - - movq ACC+16(%rsp), %rax - cmovnzq NACC+16(%rsp), %rax - movq %rax, ACC+16(%rsp) - - movq ACC+24(%rsp), %rax - cmovnzq NACC+24(%rsp), %rax - movq %rax, ACC+24(%rsp) - - movq ACC+32(%rsp), %rax - cmovnzq NACC+32(%rsp), %rax - movq %rax, ACC+32(%rsp) - - movq ACC+40(%rsp), %rax - cmovnzq NACC+40(%rsp), %rax - movq %rax, ACC+40(%rsp) - - movq ACC+48(%rsp), %rax - cmovnzq NACC+48(%rsp), %rax - movq %rax, ACC+48(%rsp) - - movq ACC+56(%rsp), %rax - cmovnzq NACC+56(%rsp), %rax - movq %rax, ACC+56(%rsp) - - movq ACC+64(%rsp), %rax - cmovnzq NACC+64(%rsp), %rax - movq %rax, ACC+64(%rsp) - - movq ACC+72(%rsp), %rax - cmovnzq NACC+72(%rsp), %rax - movq %rax, ACC+72(%rsp) - - movq ACC+80(%rsp), %rax - cmovnzq NACC+80(%rsp), %rax - movq %rax, ACC+80(%rsp) - - movq ACC+88(%rsp), %rax - cmovnzq NACC+88(%rsp), %rax - movq %rax, ACC+88(%rsp) - -// Loop while blocksize * i <= 256 - - movq i, %rax - incq %rax - movq %rax, i - - imulq blocksize, %rax - cmpq $257, %rax - jc Lp256_scalarmulbase_alt_loop - -// That's the end of the main loop, and we just need to translate -// back from the Jacobian representation to affine. First of all, -// let z2 = 1/z^2 and z3 = 1/z^3, both without Montgomery form - - leaq Z2(%rsp), %rdi - leaq ACC+64(%rsp), %rsi - CFI_CALL(Lp256_scalarmulbase_alt_local_montsqr_p256) - - leaq Z3(%rsp), %rdi - leaq ACC+64(%rsp), %rsi - leaq Z2(%rsp), %rdx - CFI_CALL(Lp256_scalarmulbase_alt_local_montmul_p256) - - leaq Z2(%rsp), %rdi - leaq Z3(%rsp), %rsi - CFI_CALL(Lp256_scalarmulbase_alt_local_demont_p256) - - leaq Z3(%rsp), %rdi - leaq Z2(%rsp), %rsi - CFI_CALL(Lp256_scalarmulbase_alt_local_inv_p256) - - leaq Z2(%rsp), %rdi - leaq ACC+64(%rsp), %rsi - leaq Z3(%rsp), %rdx - CFI_CALL(Lp256_scalarmulbase_alt_local_montmul_p256) - -// Convert back from Jacobian (X, Y, Z) |-> (X/Z^2, Y/Z^3) - - movq res, %rdi - leaq ACC(%rsp), %rsi - leaq Z2(%rsp), %rdx - movq %rdi, %rbx - CFI_CALL(Lp256_scalarmulbase_alt_local_montmul_p256) - - leaq 32(%rbx), %rdi - leaq ACC+32(%rsp), %rsi - leaq Z3(%rsp), %rdx - CFI_CALL(Lp256_scalarmulbase_alt_local_montmul_p256) - -// Restore stack and registers and return - - CFI_INC_RSP(NSPACE) - CFI_POP(%rbx) - CFI_POP(%rbp) - CFI_POP(%r12) - CFI_POP(%r13) - CFI_POP(%r14) - CFI_POP(%r15) - CFI_RET - -#if WINDOWS_ABI -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_alt_standard) -#else -S2N_BN_SIZE_DIRECTIVE(p256_scalarmulbase_alt) -#endif - -// Local copies of subroutines, complete clones at the moment - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_alt_local_demont_p256) - -Lp256_scalarmulbase_alt_local_demont_p256: - CFI_START - movq (%rsi), %r8 - movq 0x8(%rsi), %r9 - movq 0x10(%rsi), %r10 - movq 0x18(%rsi), %r11 - movabsq $0x100000000, %rcx - movq %r8, %rax - mulq %rcx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rsi, %rsi - movq %r9, %rax - mulq %rcx - subq %rsi, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rsi, %rsi - negq %rcx - negq %rsi - incq %rcx - movq %r8, %rax - mulq %rcx - addq %rax, %r11 - adcq %rdx, %rsi - sbbq %r8, %r8 - negq %r8 - movq %r9, %rax - mulq %rcx - addq %rax, %rsi - adcq %rdx, %r8 - negq %rcx - incq %rcx - movq %r10, %rax - mulq %rcx - addq %rax, %r11 - adcq %rdx, %rsi - sbbq %r9, %r9 - movq %r11, %rax - mulq %rcx - subq %r9, %rdx - addq %rax, %rsi - adcq %rdx, %r8 - sbbq %r9, %r9 - negq %rcx - negq %r9 - incq %rcx - movq %r10, %rax - mulq %rcx - addq %rax, %r8 - adcq %rdx, %r9 - sbbq %r10, %r10 - negq %r10 - movq %r11, %rax - mulq %rcx - addq %rax, %r9 - adcq %rdx, %r10 - movq %rsi, (%rdi) - movq %r8, 0x8(%rdi) - movq %r9, 0x10(%rdi) - movq %r10, 0x18(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_alt_local_demont_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_alt_local_inv_p256) - -Lp256_scalarmulbase_alt_local_inv_p256: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(240) - movq %rdi, 0xe0(%rsp) - xorl %ecx, %ecx - movl $0xffffffff, %edx - movq %rdx, %rbx - leaq -0x1(%rcx), %rax - negq %rdx - movq %rax, (%rsp) - movq %rbx, 0x8(%rsp) - movq %rcx, 0x10(%rsp) - movq %rdx, 0x18(%rsp) - movq %rcx, 0x20(%rsp) - movq (%rsi), %r8 - movq 0x8(%rsi), %r9 - movq 0x10(%rsi), %r10 - movq 0x18(%rsi), %r11 - leaq 0x1(%rcx), %rax - addq %r8, %rax - leaq -0x1(%rdx), %rbx - adcq %r9, %rbx - notq %rcx - adcq %r10, %rcx - notq %rdx - adcq %r11, %rdx - cmovaeq %r8, %rax - cmovaeq %r9, %rbx - cmovaeq %r10, %rcx - cmovaeq %r11, %rdx - movq %rax, 0x28(%rsp) - movq %rbx, 0x30(%rsp) - movq %rcx, 0x38(%rsp) - movq %rdx, 0x40(%rsp) - xorl %eax, %eax - movq %rax, 0x48(%rsp) - xorl %eax, %eax - movq %rax, 0x50(%rsp) - movq %rax, 0x58(%rsp) - movq %rax, 0x60(%rsp) - movq %rax, 0x68(%rsp) - movabsq $0x4000000000000, %rcx - movq %rcx, 0x78(%rsp) - movq %rax, 0x80(%rsp) - movq %rax, 0x88(%rsp) - movq %rax, 0x90(%rsp) - movq $0xa, 0xb0(%rsp) - movq $0x1, 0xb8(%rsp) - jmp Lp256_scalarmulbase_alt_inv_midloop -Lp256_scalarmulbase_alt_inv_loop: - movq %r8, %r9 - sarq $0x3f, %r9 - xorq %r9, %r8 - subq %r9, %r8 - movq %r10, %r11 - sarq $0x3f, %r11 - xorq %r11, %r10 - subq %r11, %r10 - movq %r12, %r13 - sarq $0x3f, %r13 - xorq %r13, %r12 - subq %r13, %r12 - movq %r14, %r15 - sarq $0x3f, %r15 - xorq %r15, %r14 - subq %r15, %r14 - movq %r8, %rax - andq %r9, %rax - movq %r10, %rdi - andq %r11, %rdi - addq %rax, %rdi - movq %rdi, 0xa0(%rsp) - movq %r12, %rax - andq %r13, %rax - movq %r14, %rsi - andq %r15, %rsi - addq %rax, %rsi - movq %rsi, 0xa8(%rsp) - xorl %ebx, %ebx - movq (%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rdi - adcq %rdx, %rbx - movq 0x28(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rdi - adcq %rdx, %rbx - xorl %ebp, %ebp - movq (%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rbp - movq 0x28(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - xorl %ecx, %ecx - movq 0x8(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq 0x30(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - shrdq $0x3b, %rbx, %rdi - movq %rdi, (%rsp) - xorl %edi, %edi - movq 0x8(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rbp - adcq %rdx, %rdi - movq 0x30(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rdi - shrdq $0x3b, %rbp, %rsi - movq %rsi, 0x28(%rsp) - xorl %esi, %esi - movq 0x10(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rsi - movq 0x38(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rsi - shrdq $0x3b, %rcx, %rbx - movq %rbx, 0x8(%rsp) - xorl %ebx, %ebx - movq 0x10(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rdi - adcq %rdx, %rbx - movq 0x38(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rdi - adcq %rdx, %rbx - shrdq $0x3b, %rdi, %rbp - movq %rbp, 0x30(%rsp) - movq 0x18(%rsp), %rax - xorq %r9, %rax - movq 0x20(%rsp), %rbp - xorq %r9, %rbp - andq %r8, %rbp - negq %rbp - mulq %r8 - addq %rax, %rsi - adcq %rdx, %rbp - movq 0x40(%rsp), %rax - xorq %r11, %rax - movq 0x48(%rsp), %rdx - xorq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbp - mulq %r10 - addq %rax, %rsi - adcq %rdx, %rbp - shrdq $0x3b, %rsi, %rcx - movq %rcx, 0x10(%rsp) - shrdq $0x3b, %rbp, %rsi - sarq $0x3b, %rbp - movq 0x18(%rsp), %rax - movq %rsi, 0x18(%rsp) - movq 0x20(%rsp), %rsi - movq %rbp, 0x20(%rsp) - xorq %r13, %rax - xorq %r13, %rsi - andq %r12, %rsi - negq %rsi - mulq %r12 - addq %rax, %rbx - adcq %rdx, %rsi - movq 0x40(%rsp), %rax - xorq %r15, %rax - movq 0x48(%rsp), %rdx - xorq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rsi - mulq %r14 - addq %rax, %rbx - adcq %rdx, %rsi - shrdq $0x3b, %rbx, %rdi - movq %rdi, 0x38(%rsp) - shrdq $0x3b, %rsi, %rbx - movq %rbx, 0x40(%rsp) - sarq $0x3b, %rsi - movq %rsi, 0x48(%rsp) - movq 0xa0(%rsp), %rbx - movq 0xa8(%rsp), %rbp - xorl %ecx, %ecx - movq 0x50(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq 0x78(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - xorl %esi, %esi - movq 0x50(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, 0x50(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq 0x78(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, 0x78(%rsp) - xorl %ebx, %ebx - movq 0x58(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq 0x80(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rbx - xorl %ebp, %ebp - movq 0x58(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rcx, 0x58(%rsp) - addq %rax, %rsi - adcq %rdx, %rbp - movq 0x80(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - movq %rsi, 0x80(%rsp) - xorl %ecx, %ecx - movq 0x60(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq 0x88(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - xorl %esi, %esi - movq 0x60(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, 0x60(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq 0x88(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, 0x88(%rsp) - movq 0x68(%rsp), %rax - xorq %r9, %rax - movq %r9, %rbx - andq %r8, %rbx - negq %rbx - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq 0x90(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbx - mulq %r10 - addq %rax, %rcx - adcq %rbx, %rdx - movq 0x68(%rsp), %rax - movq %rcx, 0x68(%rsp) - movq %rdx, 0x70(%rsp) - xorq %r13, %rax - movq %r13, %rcx - andq %r12, %rcx - negq %rcx - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rcx - movq 0x90(%rsp), %rax - xorq %r15, %rax - movq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rcx - mulq %r14 - addq %rax, %rsi - adcq %rcx, %rdx - movq %rsi, 0x90(%rsp) - movq %rdx, 0x98(%rsp) - movabsq $0xe000000000000000, %r8 - addq 0x50(%rsp), %r8 - movq $0xffffffffffffffff, %r9 - adcq 0x58(%rsp), %r9 - movq $0x1fffffff, %r10 - adcq 0x60(%rsp), %r10 - movabsq $0x2000000000000000, %r11 - adcq 0x68(%rsp), %r11 - movabsq $0x1fffffffe0000000, %r12 - adcq 0x70(%rsp), %r12 - movq %r8, %rbx - shlq $0x20, %rbx - movabsq $0xffffffff00000001, %rax - mulq %r8 - shrq $0x20, %r8 - addq %rbx, %r9 - adcq %r8, %r10 - adcq %rax, %r11 - adcq %rdx, %r12 - sbbq %rax, %rax - movl $0xffffffff, %ebx - andq %rax, %rbx - movabsq $0xffffffff00000001, %rdx - andq %rax, %rdx - subq %rax, %r9 - movq %r9, 0x50(%rsp) - sbbq %rbx, %r10 - movq %r10, 0x58(%rsp) - sbbq $0x0, %r11 - movq %r11, 0x60(%rsp) - sbbq %rdx, %r12 - movq %r12, 0x68(%rsp) - movabsq $0xe000000000000000, %r8 - addq 0x78(%rsp), %r8 - movq $0xffffffffffffffff, %r9 - adcq 0x80(%rsp), %r9 - movq $0x1fffffff, %r10 - adcq 0x88(%rsp), %r10 - movabsq $0x2000000000000000, %r11 - adcq 0x90(%rsp), %r11 - movabsq $0x1fffffffe0000000, %r12 - adcq 0x98(%rsp), %r12 - movq %r8, %rbx - shlq $0x20, %rbx - movabsq $0xffffffff00000001, %rax - mulq %r8 - shrq $0x20, %r8 - addq %rbx, %r9 - adcq %r8, %r10 - adcq %rax, %r11 - adcq %rdx, %r12 - sbbq %rax, %rax - movl $0xffffffff, %ebx - andq %rax, %rbx - movabsq $0xffffffff00000001, %rdx - andq %rax, %rdx - subq %rax, %r9 - movq %r9, 0x78(%rsp) - sbbq %rbx, %r10 - movq %r10, 0x80(%rsp) - sbbq $0x0, %r11 - movq %r11, 0x88(%rsp) - sbbq %rdx, %r12 - movq %r12, 0x90(%rsp) -Lp256_scalarmulbase_alt_inv_midloop: - movq 0xb8(%rsp), %rsi - movq (%rsp), %rdx - movq 0x28(%rsp), %rcx - movq %rdx, %rbx - andq $0xfffff, %rbx - movabsq $0xfffffe0000000000, %rax - orq %rax, %rbx - andq $0xfffff, %rcx - movabsq $0xc000000000000000, %rax - orq %rax, %rcx - movq $0xfffffffffffffffe, %rax - xorl %ebp, %ebp - movl $0x2, %edx - movq %rbx, %rdi - movq %rax, %r8 - testq %rsi, %rsi - cmovs %rbp, %r8 - testq $0x1, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - sarq $1, %rcx - movl $0x100000, %eax - leaq (%rbx,%rax), %rdx - leaq (%rcx,%rax), %rdi - shlq $0x16, %rdx - shlq $0x16, %rdi - sarq $0x2b, %rdx - sarq $0x2b, %rdi - movabsq $0x20000100000, %rax - leaq (%rbx,%rax), %rbx - leaq (%rcx,%rax), %rcx - sarq $0x2a, %rbx - sarq $0x2a, %rcx - movq %rdx, 0xc0(%rsp) - movq %rbx, 0xc8(%rsp) - movq %rdi, 0xd0(%rsp) - movq %rcx, 0xd8(%rsp) - movq (%rsp), %r12 - imulq %r12, %rdi - imulq %rdx, %r12 - movq 0x28(%rsp), %r13 - imulq %r13, %rbx - imulq %rcx, %r13 - addq %rbx, %r12 - addq %rdi, %r13 - sarq $0x14, %r12 - sarq $0x14, %r13 - movq %r12, %rbx - andq $0xfffff, %rbx - movabsq $0xfffffe0000000000, %rax - orq %rax, %rbx - movq %r13, %rcx - andq $0xfffff, %rcx - movabsq $0xc000000000000000, %rax - orq %rax, %rcx - movq $0xfffffffffffffffe, %rax - movl $0x2, %edx - movq %rbx, %rdi - movq %rax, %r8 - testq %rsi, %rsi - cmovs %rbp, %r8 - testq $0x1, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - sarq $1, %rcx - movl $0x100000, %eax - leaq (%rbx,%rax), %r8 - leaq (%rcx,%rax), %r10 - shlq $0x16, %r8 - shlq $0x16, %r10 - sarq $0x2b, %r8 - sarq $0x2b, %r10 - movabsq $0x20000100000, %rax - leaq (%rbx,%rax), %r15 - leaq (%rcx,%rax), %r11 - sarq $0x2a, %r15 - sarq $0x2a, %r11 - movq %r13, %rbx - movq %r12, %rcx - imulq %r8, %r12 - imulq %r15, %rbx - addq %rbx, %r12 - imulq %r11, %r13 - imulq %r10, %rcx - addq %rcx, %r13 - sarq $0x14, %r12 - sarq $0x14, %r13 - movq %r12, %rbx - andq $0xfffff, %rbx - movabsq $0xfffffe0000000000, %rax - orq %rax, %rbx - movq %r13, %rcx - andq $0xfffff, %rcx - movabsq $0xc000000000000000, %rax - orq %rax, %rcx - movq 0xc0(%rsp), %rax - imulq %r8, %rax - movq 0xd0(%rsp), %rdx - imulq %r15, %rdx - imulq 0xc8(%rsp), %r8 - imulq 0xd8(%rsp), %r15 - addq %r8, %r15 - leaq (%rax,%rdx), %r9 - movq 0xc0(%rsp), %rax - imulq %r10, %rax - movq 0xd0(%rsp), %rdx - imulq %r11, %rdx - imulq 0xc8(%rsp), %r10 - imulq 0xd8(%rsp), %r11 - addq %r10, %r11 - leaq (%rax,%rdx), %r13 - movq $0xfffffffffffffffe, %rax - movl $0x2, %edx - movq %rbx, %rdi - movq %rax, %r8 - testq %rsi, %rsi - cmovs %rbp, %r8 - testq $0x1, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - cmovs %rbp, %r8 - movq %rbx, %rdi - testq %rdx, %rcx - cmoveq %rbp, %r8 - cmoveq %rbp, %rdi - sarq $1, %rcx - xorq %r8, %rdi - xorq %r8, %rsi - btq $0x3f, %r8 - cmovbq %rcx, %rbx - movq %rax, %r8 - subq %rax, %rsi - leaq (%rcx,%rdi), %rcx - sarq $1, %rcx - movl $0x100000, %eax - leaq (%rbx,%rax), %r8 - leaq (%rcx,%rax), %r12 - shlq $0x15, %r8 - shlq $0x15, %r12 - sarq $0x2b, %r8 - sarq $0x2b, %r12 - movabsq $0x20000100000, %rax - leaq (%rbx,%rax), %r10 - leaq (%rcx,%rax), %r14 - sarq $0x2b, %r10 - sarq $0x2b, %r14 - movq %r9, %rax - imulq %r8, %rax - movq %r13, %rdx - imulq %r10, %rdx - imulq %r15, %r8 - imulq %r11, %r10 - addq %r8, %r10 - leaq (%rax,%rdx), %r8 - movq %r9, %rax - imulq %r12, %rax - movq %r13, %rdx - imulq %r14, %rdx - imulq %r15, %r12 - imulq %r11, %r14 - addq %r12, %r14 - leaq (%rax,%rdx), %r12 - movq %rsi, 0xb8(%rsp) - decq 0xb0(%rsp) - jne Lp256_scalarmulbase_alt_inv_loop - movq (%rsp), %rax - movq 0x28(%rsp), %rcx - imulq %r8, %rax - imulq %r10, %rcx - addq %rcx, %rax - sarq $0x3f, %rax - movq %r8, %r9 - sarq $0x3f, %r9 - xorq %r9, %r8 - subq %r9, %r8 - xorq %rax, %r9 - movq %r10, %r11 - sarq $0x3f, %r11 - xorq %r11, %r10 - subq %r11, %r10 - xorq %rax, %r11 - movq %r12, %r13 - sarq $0x3f, %r13 - xorq %r13, %r12 - subq %r13, %r12 - xorq %rax, %r13 - movq %r14, %r15 - sarq $0x3f, %r15 - xorq %r15, %r14 - subq %r15, %r14 - xorq %rax, %r15 - movq %r8, %rax - andq %r9, %rax - movq %r10, %r12 - andq %r11, %r12 - addq %rax, %r12 - xorl %r13d, %r13d - movq 0x50(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r12 - adcq %rdx, %r13 - movq 0x78(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movq 0x58(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r13 - adcq %rdx, %r14 - movq 0x80(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r13 - adcq %rdx, %r14 - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r14 - adcq %rdx, %r15 - movq 0x88(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r14 - adcq %rdx, %r15 - movq 0x68(%rsp), %rax - xorq %r9, %rax - andq %r8, %r9 - negq %r9 - mulq %r8 - addq %rax, %r15 - adcq %rdx, %r9 - movq 0x90(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %r9 - mulq %r10 - addq %rax, %r15 - adcq %rdx, %r9 - movq %r12, 0x50(%rsp) - movq %r13, 0x58(%rsp) - movq %r14, 0x60(%rsp) - movq %r15, 0x68(%rsp) - movq %r9, 0x70(%rsp) - movabsq $0xe000000000000000, %r8 - addq 0x50(%rsp), %r8 - movq $0xffffffffffffffff, %r9 - adcq 0x58(%rsp), %r9 - movq $0x1fffffff, %r10 - adcq 0x60(%rsp), %r10 - movabsq $0x2000000000000000, %r11 - adcq 0x68(%rsp), %r11 - movabsq $0x1fffffffe0000000, %r12 - adcq 0x70(%rsp), %r12 - movq %r8, %rbx - shlq $0x20, %rbx - movabsq $0xffffffff00000001, %rax - mulq %r8 - shrq $0x20, %r8 - addq %rbx, %r9 - adcq %r8, %r10 - adcq %rax, %r11 - adcq %rdx, %r12 - sbbq %rax, %rax - movl $0xffffffff, %ebx - andq %rax, %rbx - movabsq $0xffffffff00000001, %rdx - andq %rax, %rdx - subq %rax, %r9 - movq %r9, 0x50(%rsp) - sbbq %rbx, %r10 - movq %r10, 0x58(%rsp) - sbbq $0x0, %r11 - movq %r11, 0x60(%rsp) - sbbq %rdx, %r12 - movq %r12, 0x68(%rsp) - movq 0x50(%rsp), %r8 - movq 0x58(%rsp), %r9 - movq 0x60(%rsp), %r10 - movq 0x68(%rsp), %r11 - movl $0x1, %eax - movl $0xffffffff, %ebx - leaq -0x2(%rax), %rcx - leaq -0x1(%rbx), %rdx - notq %rbx - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - cmovaeq %r8, %rax - cmovaeq %r9, %rbx - cmovaeq %r10, %rcx - cmovaeq %r11, %rdx - movq 0xe0(%rsp), %rdi - movq %rax, (%rdi) - movq %rbx, 0x8(%rdi) - movq %rcx, 0x10(%rdi) - movq %rdx, 0x18(%rdi) - CFI_INC_RSP(240) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_alt_local_inv_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_alt_local_montmul_p256) - -Lp256_scalarmulbase_alt_local_montmul_p256: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - movq %rdx, %rcx - movq (%rcx), %rbx - movq (%rsi), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x8(%rsi), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x10(%rsi), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x18(%rsi), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x8(%rcx), %rbx - xorl %r13d, %r13d - movq (%rsi), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x8(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x10(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x18(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rcx), %rbx - xorl %r15d, %r15d - movq (%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x8(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x10(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x18(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rcx), %rbx - xorl %r8d, %r8d - movq (%rsi), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x8(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x10(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x18(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rdi) - movq %r13, 0x8(%rdi) - movq %r14, 0x10(%rdi) - movq %r15, 0x18(%rdi) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_alt_local_montmul_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_alt_local_montsqr_p256) - -Lp256_scalarmulbase_alt_local_montsqr_p256: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - movq (%rsi), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x8(%rsi), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x18(%rsi), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x10(%rsi), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq (%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x8(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x18(%rsi), %rbx - movq 0x8(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x8(%rsi), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x10(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x18(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rdi) - movq %r13, 0x8(%rdi) - movq %r14, 0x10(%rdi) - movq %r15, 0x18(%rdi) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_alt_local_montsqr_p256) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lp256_scalarmulbase_alt_local_p256_montjmixadd) - -Lp256_scalarmulbase_alt_local_p256_montjmixadd: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(192) - movq %rdx, %rbp - movq 0x40(%rsi), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x48(%rsi), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x58(%rsi), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x50(%rsi), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x48(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x58(%rsi), %rbx - movq 0x48(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x48(%rsi), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x50(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x58(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x20(%rbp), %rbx - movq 0x40(%rsi), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x48(%rsi), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x50(%rsi), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x58(%rsi), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x28(%rbp), %rbx - xorl %r13d, %r13d - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x48(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x50(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x58(%rsi), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x30(%rbp), %rbx - xorl %r15d, %r15d - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x48(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x50(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x58(%rsi), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x38(%rbp), %rbx - xorl %r8d, %r8d - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x48(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x50(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x58(%rsi), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq 0x0(%rbp), %rbx - movq (%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x10(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x18(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x8(%rbp), %rbx - xorl %r13d, %r13d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rbp), %rbx - xorl %r15d, %r15d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rbp), %rbx - xorl %r8d, %r8d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq 0x20(%rsp), %rbx - movq (%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x10(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x18(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x28(%rsp), %rbx - xorl %r13d, %r13d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x30(%rsp), %rbx - xorl %r15d, %r15d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x38(%rsp), %rbx - xorl %r8d, %r8d - movq (%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x10(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x18(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq 0x40(%rsp), %rax - subq (%rsi), %rax - movq 0x48(%rsp), %rcx - sbbq 0x8(%rsi), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x10(%rsi), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x18(%rsi), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0xa0(%rsp) - adcq %r10, %rcx - movq %rcx, 0xa8(%rsp) - adcq $0x0, %r8 - movq %r8, 0xb0(%rsp) - adcq %rdx, %r9 - movq %r9, 0xb8(%rsp) - movq 0x20(%rsp), %rax - subq 0x20(%rsi), %rax - movq 0x28(%rsp), %rcx - sbbq 0x28(%rsi), %rcx - movq 0x30(%rsp), %r8 - sbbq 0x30(%rsi), %r8 - movq 0x38(%rsp), %r9 - sbbq 0x38(%rsi), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x20(%rsp) - adcq %r10, %rcx - movq %rcx, 0x28(%rsp) - adcq $0x0, %r8 - movq %r8, 0x30(%rsp) - adcq %rdx, %r9 - movq %r9, 0x38(%rsp) - movq 0xa0(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0xa8(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0xb8(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0xb0(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0xa8(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0xb8(%rsp), %rbx - movq 0xa8(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0xa8(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0xb0(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0xb8(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x20(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x28(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x38(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x30(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x28(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x38(%rsp), %rbx - movq 0x28(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x28(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x30(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x38(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rcx, %rcx - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - xorl %r8d, %r8d - movq %r9, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r8, %r14 - adcq %r8, %r15 - adcq %r8, %r8 - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - xorl %r9d, %r9d - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - leaq -0x1(%rbx), %rbx - adcq %r13, %rbx - leaq -0x1(%r9), %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq (%rsi), %rbx - movq 0x60(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x70(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x78(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x8(%rsi), %rbx - xorl %r13d, %r13d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rsi), %rbx - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rsi), %rbx - xorl %r8d, %r8d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x40(%rsp), %rbx - movq 0x60(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x70(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x78(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x48(%rsp), %rbx - xorl %r13d, %r13d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x50(%rsp), %rbx - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x58(%rsp), %rbx - xorl %r8d, %r8d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq (%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq $0x0, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x40(%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x60(%rsp) - adcq %r10, %rcx - movq %rcx, 0x68(%rsp) - adcq $0x0, %r8 - movq %r8, 0x70(%rsp) - adcq %rdx, %r9 - movq %r9, 0x78(%rsp) - movq 0x40(%rsi), %rbx - movq 0xa0(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0xb0(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0xb8(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x48(%rsi), %rbx - xorl %r13d, %r13d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x50(%rsi), %rbx - xorl %r15d, %r15d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x58(%rsi), %rbx - xorl %r8d, %r8d - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0xa8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0xb0(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0xb8(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq (%rsp), %rax - subq 0x40(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x48(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x50(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x58(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq $0x0, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x80(%rsp), %rax - subq (%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x18(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq $0x0, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - movq 0x20(%rsi), %rbx - movq 0x60(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x70(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x78(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x28(%rsi), %rbx - xorl %r13d, %r13d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x30(%rsi), %rbx - xorl %r15d, %r15d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x38(%rsi), %rbx - xorl %r8d, %r8d - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x68(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x70(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x78(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x80(%rsp), %rbx - movq 0x20(%rsp), %rax - mulq %rbx - movq %rax, %r8 - movq %rdx, %r9 - movq 0x28(%rsp), %rax - mulq %rbx - xorl %r10d, %r10d - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x30(%rsp), %rax - mulq %rbx - xorl %r11d, %r11d - addq %rax, %r10 - adcq %rdx, %r11 - movq 0x38(%rsp), %rax - mulq %rbx - xorl %r12d, %r12d - addq %rax, %r11 - adcq %rdx, %r12 - movq 0x88(%rsp), %rbx - xorl %r13d, %r13d - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r14, %r14 - movq 0x28(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r14, %r14 - movq 0x30(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r14, %r14 - movq 0x38(%rsp), %rax - mulq %rbx - subq %r14, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - xorl %r14d, %r14d - movabsq $0x100000000, %rbx - movq %r8, %rax - mulq %rbx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r8, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r15, %r15 - movq %r9, %rax - mulq %rbx - subq %r15, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x90(%rsp), %rbx - xorl %r15d, %r15d - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %r8, %r8 - movq 0x28(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r8, %r8 - movq 0x30(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r8, %r8 - movq 0x38(%rsp), %rax - mulq %rbx - subq %r8, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x98(%rsp), %rbx - xorl %r8d, %r8d - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %r9, %r9 - movq 0x28(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %r9, %r9 - movq 0x30(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %r9, %r9 - movq 0x38(%rsp), %rax - mulq %rbx - subq %r9, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r8, %r8 - xorl %r9d, %r9d - movabsq $0x100000000, %rbx - movq %r10, %rax - mulq %rbx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - sbbq %rcx, %rcx - notq %rbx - leaq 0x2(%rbx), %rbx - movq %r10, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r13 - adcq %rdx, %r14 - sbbq %rcx, %rcx - movq %r11, %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r14 - adcq %rdx, %r15 - adcq %r9, %r8 - movl $0x1, %ecx - addq %r12, %rcx - decq %rbx - adcq %r13, %rbx - decq %r9 - movq %r9, %rax - adcq %r14, %r9 - movl $0xfffffffe, %r11d - adcq %r15, %r11 - adcq %r8, %rax - cmovbq %rcx, %r12 - cmovbq %rbx, %r13 - cmovbq %r9, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x80(%rsp), %rax - subq 0x60(%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x68(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x70(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x78(%rsp), %r9 - movl $0xffffffff, %r10d - sbbq %r11, %r11 - xorq %rdx, %rdx - andq %r11, %r10 - subq %r10, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq $0x0, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - movq 0x40(%rsi), %rax - movq 0x48(%rsi), %rdx - orq 0x50(%rsi), %rax - orq 0x58(%rsi), %rdx - orq %rdx, %rax - movq (%rsp), %r8 - movq 0x0(%rbp), %rax - cmoveq %rax, %r8 - movq 0x8(%rsp), %r9 - movq 0x8(%rbp), %rax - cmoveq %rax, %r9 - movq 0x10(%rsp), %r10 - movq 0x10(%rbp), %rax - cmoveq %rax, %r10 - movq 0x18(%rsp), %r11 - movq 0x18(%rbp), %rax - cmoveq %rax, %r11 - movq 0x80(%rsp), %r12 - movq 0x20(%rbp), %rax - cmoveq %rax, %r12 - movq 0x88(%rsp), %r13 - movq 0x28(%rbp), %rax - cmoveq %rax, %r13 - movq 0x90(%rsp), %r14 - movq 0x30(%rbp), %rax - cmoveq %rax, %r14 - movq 0x98(%rsp), %r15 - movq 0x38(%rbp), %rax - cmoveq %rax, %r15 - movq %r8, (%rdi) - movq %r9, 0x8(%rdi) - movq %r10, 0x10(%rdi) - movq %r11, 0x18(%rdi) - movq %r12, 0x20(%rdi) - movq %r13, 0x28(%rdi) - movq %r14, 0x30(%rdi) - movq %r15, 0x38(%rdi) - movq 0xa0(%rsp), %r8 - movq 0xa8(%rsp), %r9 - movq 0xb0(%rsp), %r10 - movq 0xb8(%rsp), %r11 - movl $0x1, %eax - cmoveq %rax, %r8 - movabsq $0xffffffff00000000, %rax - cmoveq %rax, %r9 - movq $0xffffffffffffffff, %rax - cmoveq %rax, %r10 - movl $0xfffffffe, %eax - cmoveq %rax, %r11 - movq %r8, 0x40(%rdi) - movq %r9, 0x48(%rdi) - movq %r10, 0x50(%rdi) - movq %r11, 0x58(%rdi) - CFI_INC_RSP(192) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lp256_scalarmulbase_alt_local_p256_montjmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_bigendian_6.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_bigendian_6.S deleted file mode 100644 index 3b56d35b6a1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_bigendian_6.S +++ /dev/null @@ -1,105 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert 6-digit (384-bit) bignum to/from big-endian form -// Input x[6]; output z[6] -// -// extern void bignum_bigendian_6(uint64_t z[static 6], -// const uint64_t x[static 6]); -// -// The same function is given two other prototypes whose names reflect the -// treatment of one or other argument as a byte array rather than word array: -// -// extern void bignum_frombebytes_6(uint64_t z[static 6], -// const uint8_t x[static 48]); -// -// extern void bignum_tobebytes_6(uint8_t z[static 48], -// const uint64_t x[static 6]); -// -// Since x86 is little-endian, and bignums are stored with little-endian -// word order, this is simply byte reversal and is implemented as such. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_bigendian_6) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_bigendian_6) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_bigendian_6) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_frombebytes_6) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_frombebytes_6) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_frombebytes_6) - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tobebytes_6) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tobebytes_6) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tobebytes_6) - - .text - -#define z %rdi -#define x %rsi -#define a %rax -#define b %rdx - -// All loads and stores are word-sized, then we use BSWAP to -// reverse the byte order, as well as switching round the word order -// when writing back. The reads and writes are organized in mirror-image -// pairs (0-5, 1-4, 2-3) to allow x and z to point to the same buffer -// without using more intermediate registers. - -S2N_BN_SYMBOL(bignum_bigendian_6): -S2N_BN_SYMBOL(bignum_frombebytes_6): -S2N_BN_SYMBOL(bignum_tobebytes_6): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// 0 and 5 words - - movq (x), a - movq 40(x), b - bswapq a - bswapq b - movq a, 40(z) - movq b, (z) - -// 1 and 4 words - - movq 8(x), a - movq 32(x), b - bswapq a - bswapq b - movq a, 32(z) - movq b, 8(z) - -// 2 and 3 words - - movq 16(x), a - movq 24(x), b - bswapq a - bswapq b - movq a, 24(z) - movq b, 16(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_bigendian_6) -S2N_BN_SIZE_DIRECTIVE(bignum_frombebytes_6) -S2N_BN_SIZE_DIRECTIVE(bignum_tobebytes_6) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_cmul_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_cmul_p384.S deleted file mode 100644 index 96b0fbe3f60..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_cmul_p384.S +++ /dev/null @@ -1,155 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_384, z := (c * x) mod p_384, assuming -// x reduced -// Inputs c, x[6]; output z[6] -// -// extern void bignum_cmul_p384(uint64_t z[static 6], uint64_t c, -// const uint64_t x[static 6]); -// -// Standard x86-64 ABI: RDI = z, RSI = c, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = c, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p384) - .text - -#define z %rdi - -// Temporarily moved here for initial multiply -#define x %rcx -// Likewise this is thrown away after initial multiply -#define m %rdx - -#define a %rax -#define c %rcx - -#define d0 %rsi -#define d1 %r8 -#define d2 %r9 -#define d3 %r10 -#define d4 %r11 -#define d5 %r12 -// Multiplier again for second stage -#define q %rdx - -#define ashort %eax -#define cshort %ecx -#define qshort %edx - - -S2N_BN_SYMBOL(bignum_cmul_p384): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// We seem to need (just!) one extra register, which we need to save and restore - - CFI_PUSH(%r12) - -// Shuffle inputs (since we want multiplier in %rdx) - - movq %rdx, x - movq %rsi, m - -// Multiply, accumulating the result as 2^384 * h + [d5;d4;d3;d2;d1;d0] -// but actually immediately producing q = h + 1, our quotient approximation, -// by adding 1 to it. Note that by hypothesis x is reduced mod p_384, so our -// product is <= (2^64 - 1) * (p_384 - 1) and hence h <= 2^64 - 2, meaning -// there is no danger this addition of 1 could wrap. - - mulxq (x), d0, d1 - mulxq 8(x), a, d2 - addq a, d1 - mulxq 16(x), a, d3 - adcq a, d2 - mulxq 24(x), a, d4 - adcq a, d3 - mulxq 32(x), a, d5 - adcq a, d4 - mulxq 40(x), a, q - adcq a, d5 - adcq $1, q - -// It's easy to see -p_384 <= z - q * p_384 < p_384, so we just need to -// subtract q * p_384 and then correct if that is negative by adding p_384. -// -// Write p_384 = 2^384 - r where r = 2^128 + 2^96 - 2^32 + 1 -// -// We want z - q * (2^384 - r) -// = (2^384 * h + l) - q * (2^384 - r) -// = 2^384 * (h - q) + (l + q * r) -// = 2^384 * (-1) + (l + q * r) - - xorq c, c - movq $0xffffffff00000001, a - mulxq a, a, c - adcxq a, d0 - adoxq c, d1 - movl $0x00000000ffffffff, ashort - mulxq a, a, c - adcxq a, d1 - adoxq c, d2 - adcxq q, d2 - movl $0, ashort - movl $0, cshort - adoxq a, a - adcq a, d3 - adcq c, d4 - adcq c, d5 - adcq c, c - subq $1, c - -// The net c value is now the top word of the 7-word answer, hence will -// be -1 if we need a corrective addition, 0 otherwise, usable as a mask. -// Now use that mask for a masked addition of p_384, which again is in -// fact done by a masked subtraction of 2^384 - p_384, so that we only -// have three nonzero digits and so can avoid using another register. - - movl $0x00000000ffffffff, qshort - xorq a, a - andq c, q - subq q, a - andq $1, c - - subq a, d0 - movq d0, (z) - sbbq q, d1 - movq d1, 8(z) - sbbq c, d2 - movq d2, 16(z) - sbbq $0, d3 - movq d3, 24(z) - sbbq $0, d4 - movq d4, 32(z) - sbbq $0, d5 - movq d5, 40(z) - -// Return - - CFI_POP(%r12) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_cmul_p384_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_cmul_p384_alt.S deleted file mode 100644 index aa6a1733373..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_cmul_p384_alt.S +++ /dev/null @@ -1,180 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_384, z := (c * x) mod p_384, assuming -// x reduced -// Inputs c, x[6]; output z[6] -// -// extern void bignum_cmul_p384_alt(uint64_t z[static 6], uint64_t c, -// const uint64_t x[static 6]); -// -// Standard x86-64 ABI: RDI = z, RSI = c, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = c, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p384_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p384_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p384_alt) - .text - -#define z %rdi - -// Temporarily moved here for initial multiply -#define x %rcx - -// Likewise this is thrown away after initial multiply -#define m %rsi - -#define a %rax -#define c %rcx -#define d %rdx - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 -#define d4 %r12 -#define d5 %rsi - -// Multiplier again for second stage -#define q %rcx - -#define ashort %eax -#define dshort %edx - -#define cshort %ecx -#define qshort %ecx - -S2N_BN_SYMBOL(bignum_cmul_p384_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// We seem to need (just!) one extra register, which we need to save and restore - - CFI_PUSH(%r12) - -// Shuffle inputs (since we want %rdx for the high parts of products) - - movq %rdx, x - -// Multiply, accumulating the result as 2^384 * h + [d5;d4;d3;d2;d1;d0] -// but actually immediately producing q = h + 1, our quotient approximation, -// by adding 1 to it. Note that by hypothesis x is reduced mod p_384, so our -// product is <= (2^64 - 1) * (p_384 - 1) and hence h <= 2^64 - 2, meaning -// there is no danger this addition of 1 could wrap. - - movq (x), a - mulq m - movq a, d0 - movq d, d1 - - movq 8(x), a - mulq m - xorq d2, d2 - addq a, d1 - adcq d, d2 - - movq 16(x), a - mulq m - xorq d3, d3 - addq a, d2 - adcq d, d3 - - movq 24(x), a - mulq m - xorq d4, d4 - addq a, d3 - adcq d, d4 - - movq 32(x), a - mulq m - addq a, d4 - adcq $0, d - - movq m, a - movq d, d5 - mulq 40(x) - movl $1, qshort - - addq a, d5 - adcq d, q - -// It's easy to see -p_384 <= z - q * p_384 < p_384, so we just need to -// subtract q * p_384 and then correct if that is negative by adding p_384. -// -// Write p_384 = 2^384 - r where r = 2^128 + 2^96 - 2^32 + 1 -// -// We want z - q * (2^384 - r) -// = (2^384 * h + l) - q * (2^384 - r) -// = 2^384 * (h - q) + (l + q * r) -// = 2^384 * (-1) + (l + q * r) - - movq $0xffffffff00000001, a - mulq q - addq a, d0 - adcq d, d1 - adcq q, d2 - movq q, a - sbbq c, c - movl $0x00000000ffffffff, dshort - negq c - mulq d - addq a, d1 - adcq d, d2 - adcq c, d3 - adcq $0, d4 - adcq $0, d5 - sbbq c, c - notq c - -// The net c value is now the top word of the 7-word answer, hence will -// be -1 if we need a corrective addition, 0 otherwise, usable as a mask. -// Now use that mask for a masked addition of p_384, which again is in -// fact done by a masked subtraction of 2^384 - p_384, so that we only -// have three nonzero digits and so can avoid using another register. - - movl $0x00000000ffffffff, dshort - xorq a, a - andq c, d - subq d, a - andq $1, c - - subq a, d0 - movq d0, (z) - sbbq d, d1 - movq d1, 8(z) - sbbq c, d2 - movq d2, 16(z) - sbbq $0, d3 - movq d3, 24(z) - sbbq $0, d4 - movq d4, 32(z) - sbbq $0, d5 - movq d5, 40(z) - -// Return - - CFI_POP(%r12) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p384_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_demont_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_demont_p384.S deleted file mode 100644 index e3c8f5ba8ce..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_demont_p384.S +++ /dev/null @@ -1,139 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^384) mod p_384, assuming x reduced -// Input x[6]; output z[6] -// -// extern void bignum_demont_p384(uint64_t z[static 6], -// const uint64_t x[static 6]); -// -// This assumes the input is < p_384 for correctness. If this is not the case, -// use the variant "bignum_deamont_p384" instead. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_p384) - .text - -#define z %rdi -#define x %rsi - -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d5;d4;d3;d2;d1;d0] and returns result in [d6;d5;d4;d3;d2;d1], -// adding to the existing contents of [d5;d4;d3;d2;d1;d0]. This -// is intended only for 6-word inputs as in mapping out of Montgomery, -// not for the general case of Montgomery multiplication. It is fine -// for d6 to be the same register as d0. -// -// Parms: montreds(d6,d5,d4,d3,d2,d1,d0) -// -// We want to add (2^384 - 2^128 - 2^96 + 2^32 - 1) * w -// where w = [d0 + (d0<<32)] mod 2^64 - -#define montreds(d6,d5,d4,d3,d2,d1,d0) \ -/* Our correction multiplier is w = [d0 + (d0<<32)] mod 2^64 */ \ - movq d0, %rdx ; \ - shlq $32, %rdx ; \ - addq d0, %rdx ; \ -/* Construct [%rsi;%rcx;%rax;-] = (2^384 - p_384) * w */ \ -/* We know the lowest word will cancel so we can re-use d0 */ \ -/* as a temp. */ \ - xorq %rsi, %rsi ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rcx, %rax ; \ - movl $0x00000000ffffffff, %ecx ; \ - mulxq %rcx, d0, %rcx ; \ - adcq d0, %rax ; \ - adcq %rdx, %rcx ; \ - adcq $0, %rsi ; \ -/* Now subtract that and add 2^384 * w */ \ - subq %rax, d1 ; \ - sbbq %rcx, d2 ; \ - sbbq %rsi, d3 ; \ - sbbq $0, d4 ; \ - sbbq $0, d5 ; \ - movq %rdx, d6 ; \ - sbbq $0, d6 - -S2N_BN_SYMBOL(bignum_demont_p384): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%r12) - CFI_PUSH(%r13) - -// Set up an initial window [%r13,%r12,%r11,%r10,%r9,%r8] = x - - movq (x), %r8 - movq 8(x), %r9 - movq 16(x), %r10 - movq 24(x), %r11 - movq 32(x), %r12 - movq 40(x), %r13 - -// Montgomery reduce window 0 - - montreds(%r8,%r13,%r12,%r11,%r10,%r9,%r8) - -// Montgomery reduce window 1 - - montreds(%r9,%r8,%r13,%r12,%r11,%r10,%r9) - -// Montgomery reduce window 2 - - montreds(%r10,%r9,%r8,%r13,%r12,%r11,%r10) - -// Montgomery reduce window 3 - - montreds(%r11,%r10,%r9,%r8,%r13,%r12,%r11) - -// Montgomery reduce window 4 - - montreds(%r12,%r11,%r10,%r9,%r8,%r13,%r12) - -// Montgomery reduce window 5 - - montreds(%r13,%r12,%r11,%r10,%r9,%r8,%r13) - -// Write back the result - - movq %r8, (z) - movq %r9, 8(z) - movq %r10, 16(z) - movq %r11, 24(z) - movq %r12, 32(z) - movq %r13, 40(z) - -// Restore registers and return - - CFI_POP(%r13) - CFI_POP(%r12) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_demont_p384_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_demont_p384_alt.S deleted file mode 100644 index 698dc5894a2..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_demont_p384_alt.S +++ /dev/null @@ -1,139 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^384) mod p_384, assuming x reduced -// Input x[6]; output z[6] -// -// extern void bignum_demont_p384_alt(uint64_t z[static 6], -// const uint64_t x[static 6]); -// -// This assumes the input is < p_384 for correctness. If this is not the case, -// use the variant "bignum_deamont_p384" instead. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_p384_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_p384_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_p384_alt) - .text - -#define z %rdi -#define x %rsi - -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d5;d4;d3;d2;d1;d0] and returns result in [d6;d5;d4;d3;d2;d1], -// adding to the existing [d5;d4;d3;d2;d1] and re-using d0 as a -// temporary internally, as well as %rax, %rcx and %rdx. -// It is OK for d6 and d0 to be the same register (they often are) -// -// We want to add (2^384 - 2^128 - 2^96 + 2^32 - 1) * w -// where w = [d0 + (d0<<32)] mod 2^64 -// -// montreds(d6,d5,d4,d3,d2,d1,d0) - -#define montreds(d6,d5,d4,d3,d2,d1,d0) \ -/* Our correction multiplier is w = [d0 + (d0<<32)] mod 2^64 */ \ - movq d0, %rcx ; \ - shlq $32, %rcx ; \ - addq d0, %rcx ; \ -/* Construct [%rax;%rdx;d0;-] = (2^384 - p_384) * w */ \ -/* We know the lowest word will cancel so we can re-use d0 */ \ -/* and %rcx as temps. */ \ - movq $0xffffffff00000001, %rax ; \ - mulq %rcx; \ - movq %rdx, d0 ; \ - movq $0x00000000ffffffff, %rax ; \ - mulq %rcx; \ - addq %rax, d0 ; \ - movl $0, %eax ; \ - adcq %rcx, %rdx ; \ - adcl %eax, %eax ; \ -/* Now subtract that and add 2^384 * w */ \ - subq d0, d1 ; \ - sbbq %rdx, d2 ; \ - sbbq %rax, d3 ; \ - sbbq $0, d4 ; \ - sbbq $0, d5 ; \ - movq %rcx, d6 ; \ - sbbq $0, d6 - -S2N_BN_SYMBOL(bignum_demont_p384_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%r12) - CFI_PUSH(%r13) - -// Set up an initial window [%r13,%r12,%r11,%r10,%r9,%r8] = x - - movq (x), %r8 - movq 8(x), %r9 - movq 16(x), %r10 - movq 24(x), %r11 - movq 32(x), %r12 - movq 40(x), %r13 - -// Montgomery reduce window 0 - - montreds(%r8,%r13,%r12,%r11,%r10,%r9,%r8) - -// Montgomery reduce window 1 - - montreds(%r9,%r8,%r13,%r12,%r11,%r10,%r9) - -// Montgomery reduce window 2 - - montreds(%r10,%r9,%r8,%r13,%r12,%r11,%r10) - -// Montgomery reduce window 3 - - montreds(%r11,%r10,%r9,%r8,%r13,%r12,%r11) - -// Montgomery reduce window 4 - - montreds(%r12,%r11,%r10,%r9,%r8,%r13,%r12) - -// Montgomery reduce window 5 - - montreds(%r13,%r12,%r11,%r10,%r9,%r8,%r13) - -// Write back the result - - movq %r8, (z) - movq %r9, 8(z) - movq %r10, 16(z) - movq %r11, 24(z) - movq %r12, 32(z) - movq %r13, 40(z) - -// Restore registers and return - - CFI_POP(%r13) - CFI_POP(%r12) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont_p384_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_double_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_double_p384.S deleted file mode 100644 index b247591a279..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_double_p384.S +++ /dev/null @@ -1,131 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo p_384, z := (2 * x) mod p_384, assuming x reduced -// Input x[6]; output z[6] -// -// extern void bignum_double_p384(uint64_t z[static 6], -// const uint64_t x[static 6]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_double_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_double_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_double_p384) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 -#define d4 %r10 -#define d5 %r11 -#define c %rax - -// Re-use the input pointer as a temporary once we're done - -#define a %rsi - -#define ashort %esi - - - -S2N_BN_SYMBOL(bignum_double_p384): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the input and double it so that 2^384 * c + [d5;d4;d3;d2;d1;d0] = 2 * x -// Could also consider using shld to decouple carries *or* combining this -// and the next block into a double carry chain with ADCX and ADOX. - - xorq c, c - movq (x), d0 - addq d0, d0 - movq 8(x), d1 - adcq d1, d1 - movq 16(x), d2 - adcq d2, d2 - movq 24(x), d3 - adcq d3, d3 - movq 32(x), d4 - adcq d4, d4 - movq 40(x), d5 - adcq d5, d5 - adcq c, c - -// Now subtract p_384 from 2^384 * c + [d5;d4;d3;d2;d1;d0] to get 2 * x - p_384 -// This is actually done by *adding* the 7-word negation r_384 = 2^448 - p_384 -// where r_384 = [-1; 0; 0; 0; 1; 0x00000000ffffffff; 0xffffffff00000001] - - movq $0xffffffff00000001, a - addq a, d0 - movl $0x00000000ffffffff, ashort - adcq a, d1 - adcq $1, d2 - adcq $0, d3 - adcq $0, d4 - adcq $0, d5 - adcq $-1, c - -// Since by hypothesis x < p_384 we know 2 * x - p_384 < 2^384, so the top -// carry c actually gives us a bitmask for 2 * x - p_384 < 0, which we -// now use to make r' = mask * (2^384 - p_384) for a compensating subtraction. -// We don't quite have enough ABI-modifiable registers to create all three -// nonzero digits of r while maintaining d0..d5, but make the first two now. - - andq a, c // c = masked 0x00000000ffffffff - xorq a, a - subq c, a // a = masked 0xffffffff00000001 - -// Do the first two digits of addition and writeback - - subq a, d0 - movq d0, (z) - sbbq c, d1 - movq d1, 8(z) - -// Preserve the carry chain while creating the extra masked digit since -// the logical operation will clear CF - - sbbq d0, d0 - andq a, c // c = masked 0x0000000000000001 - negq d0 - -// Do the rest of the addition and writeback - - sbbq c, d2 - movq d2, 16(z) - sbbq $0, d3 - movq d3, 24(z) - sbbq $0, d4 - movq d4, 32(z) - sbbq $0, d5 - movq d5, 40(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_double_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_half_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_half_p384.S deleted file mode 100644 index 4d00fd8e4bb..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_half_p384.S +++ /dev/null @@ -1,106 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Halve modulo p_384, z := (x / 2) mod p_384, assuming x reduced -// Input x[6]; output z[6] -// -// extern void bignum_half_p384(uint64_t z[static 6], const uint64_t x[static 6]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_half_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_half_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_half_p384) - .text - -#define z %rdi -#define x %rsi - -#define a %rax -#define d0 %rcx -#define d1 %rdx -#define d2 %r8 -#define d3 %r9 -#define d4 %r10 -#define d5 %r11 - -#define d0short %ecx -#define d3short %r9d - - - -S2N_BN_SYMBOL(bignum_half_p384): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load lowest digit and get a mask for its lowest bit in d3 - - movq (x), a - movl $1, d3short - andq a, d3 - negq d3 - -// Create a masked version of p_384 (top 3 words = the mask itself) - - movl $0x00000000ffffffff, d0short - andq d3, d0 - movq d0, d1 - xorq d3, d1 - movq d3, d2 - addq d2, d2 - andq d3, d2 - movq d3, d4 - movq d3, d5 - -// Perform addition with masked p_384. Catch the carry in a, as a bitmask -// for convenience though we only use its LSB below with SHRD - - addq a, d0 - adcq 8(x), d1 - adcq 16(x), d2 - adcq 24(x), d3 - adcq 32(x), d4 - adcq 40(x), d5 - sbbq a, a - -// Shift right, pushing the carry back down, and store back - - shrdq $1, d1, d0 - movq d0, (z) - shrdq $1, d2, d1 - movq d1, 8(z) - shrdq $1, d3, d2 - movq d2, 16(z) - shrdq $1, d4, d3 - movq d3, 24(z) - shrdq $1, d5, d4 - movq d4, 32(z) - shrdq $1, a, d5 - movq d5, 40(z) - -// Return - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_half_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_inv_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_inv_p384.S deleted file mode 100644 index 3fdeb200c3d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_inv_p384.S +++ /dev/null @@ -1,1815 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Modular inverse modulo p_384 = 2^384 - 2^128 - 2^96 + 2^32 - 1 -// Input x[6]; output z[6] -// -// extern void bignum_inv_p384(uint64_t z[static 6],const uint64_t x[static 6]); -// -// If the 6-digit input x is coprime to p_384, i.e. is not divisible -// by it, returns z < p_384 such that x * z == 1 (mod p_384). Note that -// x does not need to be reduced modulo p_384, but the output always is. -// If the input is divisible (i.e. is 0 or p_384), then there can be no -// modular inverse and z = 0 is returned. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_inv_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_inv_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_inv_p384) - .text - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack -// The u and v variables are 6 words each as expected, but the f and g -// variables are 8 words each -- they need to have at least one extra -// word for a sign word, and to preserve alignment we "round up" to 8. -// In fact, we currently keep an extra word in u and v as well. - -#define f 0(%rsp) -#define g (8*N)(%rsp) -#define u (16*N)(%rsp) -#define v (24*N)(%rsp) -#define tmp (32*N)(%rsp) -#define tmp2 (33*N)(%rsp) -#define i (34*N)(%rsp) -#define d (35*N)(%rsp) - -#define mat (36*N)(%rsp) - -// Backup for the input pointer - -#define res (40*N)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 42*N - -// Syntactic variants to make x86_att version simpler to generate - -#define F 0 -#define G (8*N) -#define U (16*N) -#define V (24*N) -#define MAT (36*N) - -#define ff (%rsp) -#define gg (8*N)(%rsp) - -// --------------------------------------------------------------------------- -// Core signed almost-Montgomery reduction macro from P[6..0] to P[5..0]. -// --------------------------------------------------------------------------- - -#define amontred(P) \ -/* We only know the input is -2^444 < x < 2^444. To do traditional */ \ -/* unsigned Montgomery reduction, start by adding 2^61 * p_384. */ \ - movq $0xe000000000000000, %r8 ; \ - xorl %eax, %eax ; \ - addq P, %r8 ; \ - movq $0x000000001fffffff, %r9 ; \ - leaq -1(%rax), %rax ; \ - adcq N+P, %r9 ; \ - movq $0xdfffffffe0000000, %r10 ; \ - adcq 2*N+P, %r10 ; \ - movq 3*N+P, %r11 ; \ - adcq %rax, %r11 ; \ - movq 4*N+P, %r12 ; \ - adcq %rax, %r12 ; \ - movq 5*N+P, %r13 ; \ - adcq %rax, %r13 ; \ - movq $0x1fffffffffffffff, %r14 ; \ - adcq 6*N+P, %r14 ; \ -/* Correction multiplier is %rbx = w = [d0 + (d0<<32)] mod 2^64 */ \ - movq %r8, %rbx ; \ - shlq $32, %rbx ; \ - addq %r8, %rbx ; \ -/* Construct [%rbp;%rdx;%rax;-] = (2^384 - p_384) * w */ \ -/* We know lowest word will cancel so can re-use %r8 as a temp */ \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r8 ; \ - movq $0x00000000ffffffff, %rax ; \ - mulq %rbx; \ - addq %r8, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ -/* Now subtract that and add 2^384 * w, catching carry in %rax */ \ - subq %rax, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbp, %r11 ; \ - sbbq $0, %r12 ; \ - sbbq $0, %r13 ; \ - sbbq $0, %r14 ; \ - sbbq %rax, %rax ; \ - addq %rbx, %r14 ; \ - adcq $0, %rax ; \ -/* Now if top is nonzero we subtract p_384 (almost-Montgomery) */ \ - negq %rax; \ - movq $0x00000000ffffffff, %rbx ; \ - andq %rax, %rbx ; \ - movq $0xffffffff00000000, %rcx ; \ - andq %rax, %rcx ; \ - movq $0xfffffffffffffffe, %rdx ; \ - andq %rax, %rdx ; \ - subq %rbx, %r9 ; \ - movq %r9, P ; \ - sbbq %rcx, %r10 ; \ - movq %r10, N+P ; \ - sbbq %rdx, %r11 ; \ - movq %r11, 2*N+P ; \ - sbbq %rax, %r12 ; \ - movq %r12, 3*N+P ; \ - sbbq %rax, %r13 ; \ - movq %r13, 4*N+P ; \ - sbbq %rax, %r14 ; \ - movq %r14, 5*N+P - -// Very similar to a subroutine call to the s2n-bignum word_divstep59. -// But different in register usage and returning the final matrix as -// -// [ %r8 %r10] -// [ %r12 %r14] -// -// and also returning the matrix still negated (which doesn't matter) - -#define divstep59(din,fin,gin) \ - movq din, %rsi ; \ - movq fin, %rdx ; \ - movq gin, %rcx ; \ - movq %rdx, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq $0xfffffffffffffffe, %rax ; \ - xorl %ebp, %ebp ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %rdx ; \ - leaq (%rcx,%rax), %rdi ; \ - shlq $0x16, %rdx ; \ - shlq $0x16, %rdi ; \ - sarq $0x2b, %rdx ; \ - sarq $0x2b, %rdi ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %rbx ; \ - leaq (%rcx,%rax), %rcx ; \ - sarq $0x2a, %rbx ; \ - sarq $0x2a, %rcx ; \ - movq %rdx, MAT(%rsp) ; \ - movq %rbx, MAT+0x8(%rsp) ; \ - movq %rdi, MAT+0x10(%rsp) ; \ - movq %rcx, MAT+0x18(%rsp) ; \ - movq fin, %r12 ; \ - imulq %r12, %rdi ; \ - imulq %rdx, %r12 ; \ - movq gin, %r13 ; \ - imulq %r13, %rbx ; \ - imulq %rcx, %r13 ; \ - addq %rbx, %r12 ; \ - addq %rdi, %r13 ; \ - sarq $0x14, %r12 ; \ - sarq $0x14, %r13 ; \ - movq %r12, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - movq %r13, %rcx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq $0xfffffffffffffffe, %rax ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %r8 ; \ - leaq (%rcx,%rax), %r10 ; \ - shlq $0x16, %r8 ; \ - shlq $0x16, %r10 ; \ - sarq $0x2b, %r8 ; \ - sarq $0x2b, %r10 ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %r15 ; \ - leaq (%rcx,%rax), %r11 ; \ - sarq $0x2a, %r15 ; \ - sarq $0x2a, %r11 ; \ - movq %r13, %rbx ; \ - movq %r12, %rcx ; \ - imulq %r8, %r12 ; \ - imulq %r15, %rbx ; \ - addq %rbx, %r12 ; \ - imulq %r11, %r13 ; \ - imulq %r10, %rcx ; \ - addq %rcx, %r13 ; \ - sarq $0x14, %r12 ; \ - sarq $0x14, %r13 ; \ - movq %r12, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - movq %r13, %rcx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq MAT(%rsp), %rax ; \ - imulq %r8, %rax ; \ - movq MAT+0x10(%rsp), %rdx ; \ - imulq %r15, %rdx ; \ - imulq MAT+0x8(%rsp), %r8 ; \ - imulq MAT+0x18(%rsp), %r15 ; \ - addq %r8, %r15 ; \ - leaq (%rax,%rdx), %r9 ; \ - movq MAT(%rsp), %rax ; \ - imulq %r10, %rax ; \ - movq MAT+0x10(%rsp), %rdx ; \ - imulq %r11, %rdx ; \ - imulq MAT+0x8(%rsp), %r10 ; \ - imulq MAT+0x18(%rsp), %r11 ; \ - addq %r10, %r11 ; \ - leaq (%rax,%rdx), %r13 ; \ - movq $0xfffffffffffffffe, %rax ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %r8 ; \ - leaq (%rcx,%rax), %r12 ; \ - shlq $0x15, %r8 ; \ - shlq $0x15, %r12 ; \ - sarq $0x2b, %r8 ; \ - sarq $0x2b, %r12 ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %r10 ; \ - leaq (%rcx,%rax), %r14 ; \ - sarq $0x2b, %r10 ; \ - sarq $0x2b, %r14 ; \ - movq %r9, %rax ; \ - imulq %r8, %rax ; \ - movq %r13, %rdx ; \ - imulq %r10, %rdx ; \ - imulq %r15, %r8 ; \ - imulq %r11, %r10 ; \ - addq %r8, %r10 ; \ - leaq (%rax,%rdx), %r8 ; \ - movq %r9, %rax ; \ - imulq %r12, %rax ; \ - movq %r13, %rdx ; \ - imulq %r14, %rdx ; \ - imulq %r15, %r12 ; \ - imulq %r11, %r14 ; \ - addq %r12, %r14 ; \ - leaq (%rax,%rdx), %r12 - -S2N_BN_SYMBOL(bignum_inv_p384): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers and make room for temporaries - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Save the return pointer for the end so we can overwrite %rdi later - - movq %rdi, res - -// Copy the constant p_384 into f including the 7th zero digit - - movl $0xffffffff, %eax - movq %rax, F(%rsp) - movq %rax, %rbx - notq %rbx - movq %rbx, F+N(%rsp) - xorl %ebp, %ebp - leaq -2(%rbp), %rcx - movq %rcx, F+2*N(%rsp) - leaq -1(%rbp), %rdx - movq %rdx, F+3*N(%rsp) - movq %rdx, F+4*N(%rsp) - movq %rdx, F+5*N(%rsp) - movq %rbp, F+6*N(%rsp) - -// Copy input but to g, reduced mod p_384 so that g <= f as assumed -// in the divstep bound proof. - - movq (%rsi), %r8 - subq %rax, %r8 - movq N(%rsi), %r9 - sbbq %rbx, %r9 - movq 2*N(%rsi), %r10 - sbbq %rcx, %r10 - movq 3*N(%rsi), %r11 - sbbq %rdx, %r11 - movq 4*N(%rsi), %r12 - sbbq %rdx, %r12 - movq 5*N(%rsi), %r13 - sbbq %rdx, %r13 - - cmovcq (%rsi), %r8 - cmovcq N(%rsi), %r9 - cmovcq 2*N(%rsi), %r10 - cmovcq 3*N(%rsi), %r11 - cmovcq 4*N(%rsi), %r12 - cmovcq 5*N(%rsi), %r13 - - movq %r8, G(%rsp) - movq %r9, G+N(%rsp) - movq %r10, G+2*N(%rsp) - movq %r11, G+3*N(%rsp) - movq %r12, G+4*N(%rsp) - movq %r13, G+5*N(%rsp) - movq %rbp, G+6*N(%rsp) - -// Also maintain reduced < 2^384 vector [u,v] such that -// [f,g] == x * 2^{5*i-75} * [u,v] (mod p_384) -// starting with [p_384,x] == x * 2^{5*0-75} * [0,2^75] (mod p_384) -// The weird-looking 5*i modifications come in because we are doing -// 64-bit word-sized Montgomery reductions at each stage, which is -// 5 bits more than the 59-bit requirement to keep things stable. - - xorl %eax, %eax - movq %rax, U(%rsp) - movq %rax, U+N(%rsp) - movq %rax, U+2*N(%rsp) - movq %rax, U+3*N(%rsp) - movq %rax, U+4*N(%rsp) - movq %rax, U+5*N(%rsp) - - movl $2048, %ecx - movq %rax, V(%rsp) - movq %rcx, V+N(%rsp) - movq %rax, V+2*N(%rsp) - movq %rax, V+3*N(%rsp) - movq %rax, V+4*N(%rsp) - movq %rax, V+5*N(%rsp) - -// Start of main loop. We jump into the middle so that the divstep -// portion is common to the special fifteenth iteration after a uniform -// first 14. - - movq $15, i - movq $1, d - jmp Lbignum_inv_p384_midloop - -Lbignum_inv_p384_loop: - -// Separate out the matrix into sign-magnitude pairs - - movq %r8, %r9 - sarq $63, %r9 - xorq %r9, %r8 - subq %r9, %r8 - - movq %r10, %r11 - sarq $63, %r11 - xorq %r11, %r10 - subq %r11, %r10 - - movq %r12, %r13 - sarq $63, %r13 - xorq %r13, %r12 - subq %r13, %r12 - - movq %r14, %r15 - sarq $63, %r15 - xorq %r15, %r14 - subq %r15, %r14 - -// Adjust the initial values to allow for complement instead of negation -// This initial offset is the same for [f,g] and [u,v] compositions. -// Save it in temporary storage for the [u,v] part and do [f,g] first. - - movq %r8, %rax - andq %r9, %rax - movq %r10, %rdi - andq %r11, %rdi - addq %rax, %rdi - movq %rdi, tmp - - movq %r12, %rax - andq %r13, %rax - movq %r14, %rsi - andq %r15, %rsi - addq %rax, %rsi - movq %rsi, tmp2 - -// Now the computation of the updated f and g values. This maintains a -// 2-word carry between stages so we can conveniently insert the shift -// right by 59 before storing back, and not overwrite digits we need -// again of the old f and g values. -// -// Digit 0 of [f,g] - - xorl %ebx, %ebx - movq F(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rdi - adcq %rdx, %rbx - movq G(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rdi - adcq %rdx, %rbx - - xorl %ebp, %ebp - movq F(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rbp - movq G(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - -// Digit 1 of [f,g] - - xorl %ecx, %ecx - movq F+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq G+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - shrdq $59, %rbx, %rdi - movq %rdi, F(%rsp) - - xorl %edi, %edi - movq F+N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rbp - adcq %rdx, %rdi - movq G+N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rdi - shrdq $59, %rbp, %rsi - movq %rsi, G(%rsp) - -// Digit 2 of [f,g] - - xorl %esi, %esi - movq F+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rsi - movq G+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rsi - shrdq $59, %rcx, %rbx - movq %rbx, F+N(%rsp) - - xorl %ebx, %ebx - movq F+2*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rdi - adcq %rdx, %rbx - movq G+2*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rdi - adcq %rdx, %rbx - shrdq $59, %rdi, %rbp - movq %rbp, G+N(%rsp) - -// Digit 3 of [f,g] - - xorl %ebp, %ebp - movq F+3*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rsi - adcq %rdx, %rbp - movq G+3*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rsi - adcq %rdx, %rbp - shrdq $59, %rsi, %rcx - movq %rcx, F+2*N(%rsp) - - xorl %ecx, %ecx - movq F+3*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rbx - adcq %rdx, %rcx - movq G+3*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbx - adcq %rdx, %rcx - shrdq $59, %rbx, %rdi - movq %rdi, G+2*N(%rsp) - -// Digit 4 of [f,g] - - xorl %edi, %edi - movq F+4*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbp - adcq %rdx, %rdi - movq G+4*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbp - adcq %rdx, %rdi - shrdq $59, %rbp, %rsi - movq %rsi, F+3*N(%rsp) - - xorl %esi, %esi - movq F+4*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rcx - adcq %rdx, %rsi - movq G+4*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rcx - adcq %rdx, %rsi - shrdq $59, %rcx, %rbx - movq %rbx, G+3*N(%rsp) - -// Digits 5 and 6 of [f,g] - - movq F+5*N(%rsp), %rax - xorq %r9, %rax - movq F+6*N(%rsp), %rbx - xorq %r9, %rbx - andq %r8, %rbx - negq %rbx - mulq %r8 - addq %rax, %rdi - adcq %rdx, %rbx - movq G+5*N(%rsp), %rax - xorq %r11, %rax - movq G+6*N(%rsp), %rdx - xorq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbx - mulq %r10 - addq %rax, %rdi - adcq %rdx, %rbx - shrdq $59, %rdi, %rbp - movq %rbp, F+4*N(%rsp) - shrdq $59, %rbx, %rdi - sarq $59, %rbx - - movq F+5*N(%rsp), %rax - movq %rdi, F+5*N(%rsp) - - movq F+6*N(%rsp), %rdi - movq %rbx, F+6*N(%rsp) - - xorq %r13, %rax - xorq %r13, %rdi - andq %r12, %rdi - negq %rdi - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rdi - movq G+5*N(%rsp), %rax - xorq %r15, %rax - movq G+6*N(%rsp), %rdx - xorq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rdi - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rdi - shrdq $59, %rsi, %rcx - movq %rcx, G+4*N(%rsp) - shrdq $59, %rdi, %rsi - movq %rsi, G+5*N(%rsp) - sarq $59, %rdi - movq %rdi, G+6*N(%rsp) - -// Get the initial carries back from storage and do the [u,v] accumulation - - movq tmp, %rbx - movq tmp2, %rbp - -// Digit 0 of [u,v] - - xorl %ecx, %ecx - movq U(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq V(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - - xorl %esi, %esi - movq U(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, U(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq V(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, V(%rsp) - -// Digit 1 of [u,v] - - xorl %ebx, %ebx - movq U+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq V+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rbx - - xorl %ebp, %ebp - movq U+N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rcx, U+N(%rsp) - addq %rax, %rsi - adcq %rdx, %rbp - movq V+N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - movq %rsi, V+N(%rsp) - -// Digit 2 of [u,v] - - xorl %ecx, %ecx - movq U+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq V+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - - xorl %esi, %esi - movq U+2*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, U+2*N(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq V+2*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, V+2*N(%rsp) - -// Digit 3 of [u,v] - - xorl %ebx, %ebx - movq U+3*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq V+3*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rbx - - xorl %ebp, %ebp - movq U+3*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rcx, U+3*N(%rsp) - addq %rax, %rsi - adcq %rdx, %rbp - movq V+3*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - movq %rsi, V+3*N(%rsp) - -// Digit 4 of [u,v] - - xorl %ecx, %ecx - movq U+4*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq V+4*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - - xorl %esi, %esi - movq U+4*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, U+4*N(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq V+4*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, V+4*N(%rsp) - -// Digits 5 and 6 of u (top is unsigned) - - movq U+5*N(%rsp), %rax - xorq %r9, %rax - movq %r9, %rbx - andq %r8, %rbx - negq %rbx - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq V+5*N(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbx - mulq %r10 - addq %rax, %rcx - adcq %rbx, %rdx - -// Preload for last use of old u digit 3 - - movq U+5*N(%rsp), %rax - movq %rcx, U+5*N(%rsp) - movq %rdx, U+6*N(%rsp) - -// Digits 5 and 6 of v (top is unsigned) - - xorq %r13, %rax - movq %r13, %rcx - andq %r12, %rcx - negq %rcx - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rcx - movq V+5*N(%rsp), %rax - xorq %r15, %rax - movq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rcx - mulq %r14 - addq %rax, %rsi - adcq %rcx, %rdx - movq %rsi, V+5*N(%rsp) - movq %rdx, V+6*N(%rsp) - -// Montgomery reduction of u - - amontred(u) - -// Montgomery reduction of v - - amontred(v) - -Lbignum_inv_p384_midloop: - - divstep59(d,ff,gg) - movq %rsi, d - -// Next iteration - - decq i - jnz Lbignum_inv_p384_loop - -// The 15th and last iteration does not need anything except the -// u value and the sign of f; the latter can be obtained from the -// lowest word of f. So it's done differently from the main loop. -// Find the sign of the new f. For this we just need one digit -// since we know (for in-scope cases) that f is either +1 or -1. -// We don't explicitly shift right by 59 either, but looking at -// bit 63 (or any bit >= 60) of the unshifted result is enough -// to distinguish -1 from +1; this is then made into a mask. - - movq F(%rsp), %rax - movq G(%rsp), %rcx - imulq %r8, %rax - imulq %r10, %rcx - addq %rcx, %rax - sarq $63, %rax - -// Now separate out the matrix into sign-magnitude pairs -// and adjust each one based on the sign of f. -// -// Note that at this point we expect |f|=1 and we got its -// sign above, so then since [f,0] == x * [u,v] (mod p_384) -// we want to flip the sign of u according to that of f. - - movq %r8, %r9 - sarq $63, %r9 - xorq %r9, %r8 - subq %r9, %r8 - xorq %rax, %r9 - - movq %r10, %r11 - sarq $63, %r11 - xorq %r11, %r10 - subq %r11, %r10 - xorq %rax, %r11 - - movq %r12, %r13 - sarq $63, %r13 - xorq %r13, %r12 - subq %r13, %r12 - xorq %rax, %r13 - - movq %r14, %r15 - sarq $63, %r15 - xorq %r15, %r14 - subq %r15, %r14 - xorq %rax, %r15 - -// Adjust the initial value to allow for complement instead of negation - - movq %r8, %rax - andq %r9, %rax - movq %r10, %r12 - andq %r11, %r12 - addq %rax, %r12 - -// Digit 0 of [u] - - xorl %r13d, %r13d - movq U(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r12 - adcq %rdx, %r13 - movq V(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r12 - movq %r12, U(%rsp) - adcq %rdx, %r13 - -// Digit 1 of [u] - - xorl %r14d, %r14d - movq U+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r13 - adcq %rdx, %r14 - movq V+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r13 - movq %r13, U+N(%rsp) - adcq %rdx, %r14 - -// Digit 2 of [u] - - xorl %r15d, %r15d - movq U+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r14 - adcq %rdx, %r15 - movq V+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r14 - movq %r14, U+2*N(%rsp) - adcq %rdx, %r15 - -// Digit 3 of [u] - - xorl %r14d, %r14d - movq U+3*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r15 - adcq %rdx, %r14 - movq V+3*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r15 - movq %r15, U+3*N(%rsp) - adcq %rdx, %r14 - -// Digit 4 of [u] - - xorl %r15d, %r15d - movq U+4*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r14 - adcq %rdx, %r15 - movq V+4*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r14 - movq %r14, U+4*N(%rsp) - adcq %rdx, %r15 - -// Digits 5 and 6 of u (top is unsigned) - - movq U+5*N(%rsp), %rax - xorq %r9, %rax - andq %r8, %r9 - negq %r9 - mulq %r8 - addq %rax, %r15 - adcq %rdx, %r9 - movq V+5*N(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %r9 - mulq %r10 - addq %rax, %r15 - movq %r15, U+5*N(%rsp) - adcq %rdx, %r9 - movq %r9, U+6*N(%rsp) - -// Montgomery reduce u - - amontred(u) - -// Perform final strict reduction mod p_384 and copy to output - - movl $0xffffffff, %eax - movq %rax, %rbx - notq %rbx - xorl %ebp, %ebp - leaq -2(%rbp), %rcx - leaq -1(%rbp), %rdx - - movq U(%rsp), %r8 - subq %rax, %r8 - movq U+N(%rsp), %r9 - sbbq %rbx, %r9 - movq U+2*N(%rsp), %r10 - sbbq %rcx, %r10 - movq U+3*N(%rsp), %r11 - sbbq %rdx, %r11 - movq U+4*N(%rsp), %r12 - sbbq %rdx, %r12 - movq U+5*N(%rsp), %r13 - sbbq %rdx, %r13 - - cmovcq U(%rsp), %r8 - cmovcq U+N(%rsp), %r9 - cmovcq U+2*N(%rsp), %r10 - cmovcq U+3*N(%rsp), %r11 - cmovcq U+4*N(%rsp), %r12 - cmovcq U+5*N(%rsp), %r13 - - movq res, %rdi - movq %r8, (%rdi) - movq %r9, N(%rdi) - movq %r10, 2*N(%rdi) - movq %r11, 3*N(%rdi) - movq %r12, 4*N(%rdi) - movq %r13, 5*N(%rdi) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_inv_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_n384.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_n384.S deleted file mode 100644 index 6f5cb005da4..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_n384.S +++ /dev/null @@ -1,231 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_384 -// Input x[k]; output z[6] -// -// extern void bignum_mod_n384(uint64_t z[static 6], uint64_t k, -// const uint64_t *x); -// -// Reduction is modulo the group order of the NIST curve P-384. -// -// Standard x86-64 ABI: RDI = z, RSI = k, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = k, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n384) - .text - -#define z %rdi -#define k %rsi -#define x %rcx - -#define m0 %r8 -#define m1 %r9 -#define m2 %r10 -#define m3 %r11 -#define m4 %r12 -#define m5 %r13 -#define d %r14 - -#define n0 %rax -#define n1 %rbx -#define n2 %rdx -#define q %rdx - -#define n0short %eax -#define qshort %edx - - -S2N_BN_SYMBOL(bignum_mod_n384): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save extra registers - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - -// If the input is already <= 5 words long, go to a trivial "copy" path - - cmpq $6, k - jc Lbignum_mod_n384_shortinput - -// Otherwise load the top 6 digits (top-down) and reduce k by 6 - - subq $6, k - movq 40(%rdx,k,8), m5 - movq 32(%rdx,k,8), m4 - movq 24(%rdx,k,8), m3 - movq 16(%rdx,k,8), m2 - movq 8(%rdx,k,8), m1 - movq (%rdx,k,8), m0 - -// Move x into another register to leave %rdx free for multiplies and use of n2 - - movq %rdx, x - -// Reduce the top 6 digits mod n_384 (a conditional subtraction of n_384) - - movq $0x1313e695333ad68d, n0 - movq $0xa7e5f24db74f5885, n1 - movq $0x389cb27e0bc8d220, n2 - - addq n0, m0 - adcq n1, m1 - adcq n2, m2 - adcq $0, m3 - adcq $0, m4 - adcq $0, m5 - sbbq d, d - notq d - andq d, n0 - andq d, n1 - andq d, n2 - subq n0, m0 - sbbq n1, m1 - sbbq n2, m2 - sbbq $0, m3 - sbbq $0, m4 - sbbq $0, m5 - -// Now do (k-6) iterations of 7->6 word modular reduction - - testq k, k - jz Lbignum_mod_n384_writeback - -Lbignum_mod_n384_loop: - -// Compute q = min (m5 + 1) (2^64 - 1) - - movl $1, qshort - addq m5, q - sbbq d, d - orq d, q - -// Load the next digit so current m to reduce = [m5;m4;m3;m2;m1;m0;d] - - movq -8(x,k,8), d - -// Now form [m5;m4;m3;m2;m1;m0;d] = m - q * n_384 - - subq q, m5 - xorq n0, n0 - movq $0x1313e695333ad68d, n0 - mulxq n0, n0, n1 - adcxq n0, d - adoxq n1, m0 - movq $0xa7e5f24db74f5885, n0 - mulxq n0, n0, n1 - adcxq n0, m0 - adoxq n1, m1 - movq $0x389cb27e0bc8d220, n0 - mulxq n0, n0, n1 - adcxq n0, m1 - movl $0, n0short - adoxq n0, n1 - adcxq n1, m2 - adcq $0, m3 - adcq $0, m4 - adcq $0, m5 - -// Now our top word m5 is either zero or all 1s. Use it for a masked -// addition of n_384, which we can do by a *subtraction* of -// 2^384 - n_384 from our portion - - movq $0x1313e695333ad68d, n0 - andq m5, n0 - movq $0xa7e5f24db74f5885, n1 - andq m5, n1 - movq $0x389cb27e0bc8d220, n2 - andq m5, n2 - - subq n0, d - sbbq n1, m0 - sbbq n2, m1 - sbbq $0, m2 - sbbq $0, m3 - sbbq $0, m4 - -// Now shuffle registers up and loop - - movq m4, m5 - movq m3, m4 - movq m2, m3 - movq m1, m2 - movq m0, m1 - movq d, m0 - - decq k - jnz Lbignum_mod_n384_loop - -// Write back - -Lbignum_mod_n384_writeback: - - movq m0, (z) - movq m1, 8(z) - movq m2, 16(z) - movq m3, 24(z) - movq m4, 32(z) - movq m5, 40(z) - -// Restore registers and return - - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n384) - -Lbignum_mod_n384_shortinput: - - xorq m0, m0 - xorq m1, m1 - xorq m2, m2 - xorq m3, m3 - xorq m4, m4 - xorq m5, m5 - - testq k, k - jz Lbignum_mod_n384_writeback - movq (%rdx), m0 - decq k - jz Lbignum_mod_n384_writeback - movq 8(%rdx), m1 - decq k - jz Lbignum_mod_n384_writeback - movq 16(%rdx), m2 - decq k - jz Lbignum_mod_n384_writeback - movq 24(%rdx), m3 - decq k - jz Lbignum_mod_n384_writeback - movq 32(%rdx), m4 - jmp Lbignum_mod_n384_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_n384_6.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_n384_6.S deleted file mode 100644 index 7347df8a4df..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_n384_6.S +++ /dev/null @@ -1,118 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_384 -// Input x[6]; output z[6] -// -// extern void bignum_mod_n384_6(uint64_t z[static 6], const uint64_t x[static 6]); -// -// Reduction is modulo the group order of the NIST curve P-384. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n384_6) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n384_6) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n384_6) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 -#define d4 %r10 -#define d5 %r11 - -#define a %rax - -// Re-use the input pointer as a temporary once we're done - -#define c %rsi - - - -S2N_BN_SYMBOL(bignum_mod_n384_6): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the input and compute x + (2^384 - n_384) - - movq $0x1313e695333ad68d, a - movq (x), d0 - addq a, d0 - movq $0xa7e5f24db74f5885, d1 - adcq 8(x), d1 - movq $0x389cb27e0bc8d220, d2 - adcq 16(x), d2 - movq 24(x), d3 - adcq $0, d3 - movq 32(x), d4 - adcq $0, d4 - movq 40(x), d5 - adcq $0, d5 - -// Now CF is set iff 2^384 <= x + (2^384 - n_384), i.e. iff n_384 <= x. -// Create a mask for the condition x < n. We now want to subtract the -// masked (2^384 - n_384), but because we're running out of registers -// without using a save-restore sequence, we need some contortions. -// Create the lowest digit (re-using a kept from above) - - sbbq c, c - notq c - andq c, a - -// Do the first digit of addition and writeback - - subq a, d0 - movq d0, (z) - -// Preserve carry chain and do the next digit - - sbbq d0, d0 - movq $0xa7e5f24db74f5885, a - andq c, a - negq d0 - sbbq a, d1 - movq d1, 8(z) - -// Preserve carry chain once more and do remaining digits - - sbbq d0, d0 - movq $0x389cb27e0bc8d220, a - andq c, a - negq d0 - sbbq a, d2 - movq d2, 16(z) - sbbq $0, d3 - movq d3, 24(z) - sbbq $0, d4 - movq d4, 32(z) - sbbq $0, d5 - movq d5, 40(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n384_6) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_n384_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_n384_alt.S deleted file mode 100644 index 3c998c4765a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_n384_alt.S +++ /dev/null @@ -1,235 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_384 -// Input x[k]; output z[6] -// -// extern void bignum_mod_n384_alt(uint64_t z[static 6], uint64_t k, -// const uint64_t *x); -// -// Reduction is modulo the group order of the NIST curve P-384. -// -// Standard x86-64 ABI: RDI = z, RSI = k, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = k, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n384_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n384_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n384_alt) - .text - -#define z %rdi -#define k %rsi -#define x %rcx - -#define m0 %r8 -#define m1 %r9 -#define m2 %r10 -#define m3 %r11 -#define m4 %r12 -#define m5 %r13 -#define d %r14 - -#define n0 %rax -#define n1 %rbx -#define n2 %rdx - -#define q %rbp -#define c %rbx - -#define n0short %eax -#define qshort %ebp - -S2N_BN_SYMBOL(bignum_mod_n384_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save extra registers - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - -// If the input is already <= 5 words long, go to a trivial "copy" path - - cmpq $6, k - jc Lbignum_mod_n384_alt_shortinput - -// Otherwise load the top 6 digits (top-down) and reduce k by 6 - - subq $6, k - movq 40(%rdx,k,8), m5 - movq 32(%rdx,k,8), m4 - movq 24(%rdx,k,8), m3 - movq 16(%rdx,k,8), m2 - movq 8(%rdx,k,8), m1 - movq (%rdx,k,8), m0 - -// Move x into another register to leave %rdx free for multiplies and use of n2 - - movq %rdx, x - -// Reduce the top 6 digits mod n_384 (a conditional subtraction of n_384) - - movq $0x1313e695333ad68d, n0 - movq $0xa7e5f24db74f5885, n1 - movq $0x389cb27e0bc8d220, n2 - - addq n0, m0 - adcq n1, m1 - adcq n2, m2 - adcq $0, m3 - adcq $0, m4 - adcq $0, m5 - sbbq d, d - notq d - andq d, n0 - andq d, n1 - andq d, n2 - subq n0, m0 - sbbq n1, m1 - sbbq n2, m2 - sbbq $0, m3 - sbbq $0, m4 - sbbq $0, m5 - -// Now do (k-6) iterations of 7->6 word modular reduction - - testq k, k - jz Lbignum_mod_n384_alt_writeback - -Lbignum_mod_n384_alt_loop: - -// Compute q = min (m5 + 1) (2^64 - 1) - - movl $1, qshort - addq m5, q - sbbq d, d - orq d, q - -// Load the next digit so current m to reduce = [m5;m4;m3;m2;m1;m0;d] - - movq -8(x,k,8), d - -// Now form [m5;m4;m3;m2;m1;m0;d] = m - q * n_384 - - subq q, m5 - movq $0x1313e695333ad68d, %rax - mulq q - addq %rax, d - adcq %rdx, m0 - sbbq c, c - movq $0xa7e5f24db74f5885, %rax - mulq q - subq c, %rdx - addq %rax, m0 - adcq %rdx, m1 - sbbq c, c - movq $0x389cb27e0bc8d220, n0 - mulq q - subq c, %rdx - addq %rax, m1 - adcq %rdx, m2 - adcq $0, m3 - adcq $0, m4 - adcq $0, m5 - -// Now our top word m5 is either zero or all 1s. Use it for a masked -// addition of n_384, which we can do by a *subtraction* of -// 2^384 - n_384 from our portion - - movq $0x1313e695333ad68d, n0 - andq m5, n0 - movq $0xa7e5f24db74f5885, n1 - andq m5, n1 - movq $0x389cb27e0bc8d220, n2 - andq m5, n2 - - subq n0, d - sbbq n1, m0 - sbbq n2, m1 - sbbq $0, m2 - sbbq $0, m3 - sbbq $0, m4 - -// Now shuffle registers up and loop - - movq m4, m5 - movq m3, m4 - movq m2, m3 - movq m1, m2 - movq m0, m1 - movq d, m0 - - decq k - jnz Lbignum_mod_n384_alt_loop - -// Write back - -Lbignum_mod_n384_alt_writeback: - - movq m0, (z) - movq m1, 8(z) - movq m2, 16(z) - movq m3, 24(z) - movq m4, 32(z) - movq m5, 40(z) - -// Restore registers and return - - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n384_alt) - -Lbignum_mod_n384_alt_shortinput: - - xorq m0, m0 - xorq m1, m1 - xorq m2, m2 - xorq m3, m3 - xorq m4, m4 - xorq m5, m5 - - testq k, k - jz Lbignum_mod_n384_alt_writeback - movq (%rdx), m0 - decq k - jz Lbignum_mod_n384_alt_writeback - movq 8(%rdx), m1 - decq k - jz Lbignum_mod_n384_alt_writeback - movq 16(%rdx), m2 - decq k - jz Lbignum_mod_n384_alt_writeback - movq 24(%rdx), m3 - decq k - jz Lbignum_mod_n384_alt_writeback - movq 32(%rdx), m4 - jmp Lbignum_mod_n384_alt_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_p384.S deleted file mode 100644 index 97590bdaaab..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_p384.S +++ /dev/null @@ -1,230 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_384 -// Input x[k]; output z[6] -// -// extern void bignum_mod_p384(uint64_t z[static 6], uint64_t k, -// const uint64_t *x); -// -// Standard x86-64 ABI: RDI = z, RSI = k, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = k, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p384) - .text - -#define z %rdi -#define k %rsi -#define x %rcx - -#define m0 %r8 -#define m1 %r9 -#define m2 %r10 -#define m3 %r11 -#define m4 %r12 -#define m5 %r13 -#define d %r14 - -#define n0 %rax -#define n1 %rbx -#define n2 %rdx -#define q %rdx - -#define n0short %eax -#define n1short %ebx -#define qshort %edx - - -S2N_BN_SYMBOL(bignum_mod_p384): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save extra registers - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - -// If the input is already <= 5 words long, go to a trivial "copy" path - - cmpq $6, k - jc Lbignum_mod_p384_shortinput - -// Otherwise load the top 6 digits (top-down) and reduce k by 6 - - subq $6, k - movq 40(%rdx,k,8), m5 - movq 32(%rdx,k,8), m4 - movq 24(%rdx,k,8), m3 - movq 16(%rdx,k,8), m2 - movq 8(%rdx,k,8), m1 - movq (%rdx,k,8), m0 - -// Move x into another register to leave %rdx free for multiplies and use of n2 - - movq %rdx, x - -// Reduce the top 6 digits mod p_384 (a conditional subtraction of p_384) - - movl $0x00000000ffffffff, n0short - movq $0xffffffff00000000, n1 - movq $0xfffffffffffffffe, n2 - - subq n0, m0 - sbbq n1, m1 - sbbq n2, m2 - sbbq $-1, m3 - sbbq $-1, m4 - sbbq $-1, m5 - - sbbq d, d - andq d, n0 - andq d, n1 - andq d, n2 - addq n0, m0 - adcq n1, m1 - adcq n2, m2 - adcq d, m3 - adcq d, m4 - adcq d, m5 - -// Now do (k-6) iterations of 7->6 word modular reduction - - testq k, k - jz Lbignum_mod_p384_writeback - -Lbignum_mod_p384_loop: - -// Compute q = min (m5 + 1) (2^64 - 1) - - movl $1, qshort - addq m5, q - sbbq d, d - orq d, q - -// Load the next digit so current m to reduce = [m5;m4;m3;m2;m1;m0;d] - - movq -8(x,k,8), d - -// Now form [m5;m4;m3;m2;m1;m0;d] = m - q * p_384. To use an addition for -// the main calculation we do (m - 2^384 * q) + q * (2^384 - p_384) -// where 2^384 - p_384 = [0;0;0;1;0x00000000ffffffff;0xffffffff00000001]. -// The extra subtraction of 2^384 * q is the first instruction. - - subq q, m5 - xorq n0, n0 - movq $0xffffffff00000001, n0 - mulxq n0, n0, n1 - adcxq n0, d - adoxq n1, m0 - movl $0x00000000ffffffff, n0short - mulxq n0, n0, n1 - adcxq n0, m0 - adoxq n1, m1 - adcxq q, m1 - movl $0, n0short - adoxq n0, n0 - adcxq n0, m2 - adcq $0, m3 - adcq $0, m4 - adcq $0, m5 - -// Now our top word m5 is either zero or all 1s. Use it for a masked -// addition of p_384, which we can do by a *subtraction* of -// 2^384 - p_384 from our portion - - movq $0xffffffff00000001, n0 - andq m5, n0 - movl $0x00000000ffffffff, n1short - andq m5, n1 - andq $1, m5 - - subq n0, d - sbbq n1, m0 - sbbq m5, m1 - sbbq $0, m2 - sbbq $0, m3 - sbbq $0, m4 - -// Now shuffle registers up and loop - - movq m4, m5 - movq m3, m4 - movq m2, m3 - movq m1, m2 - movq m0, m1 - movq d, m0 - - decq k - jnz Lbignum_mod_p384_loop - -// Write back - -Lbignum_mod_p384_writeback: - - movq m0, (z) - movq m1, 8(z) - movq m2, 16(z) - movq m3, 24(z) - movq m4, 32(z) - movq m5, 40(z) - -// Restore registers and return - - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p384) - -Lbignum_mod_p384_shortinput: - - xorq m0, m0 - xorq m1, m1 - xorq m2, m2 - xorq m3, m3 - xorq m4, m4 - xorq m5, m5 - - testq k, k - jz Lbignum_mod_p384_writeback - movq (%rdx), m0 - decq k - jz Lbignum_mod_p384_writeback - movq 8(%rdx), m1 - decq k - jz Lbignum_mod_p384_writeback - movq 16(%rdx), m2 - decq k - jz Lbignum_mod_p384_writeback - movq 24(%rdx), m3 - decq k - jz Lbignum_mod_p384_writeback - movq 32(%rdx), m4 - jmp Lbignum_mod_p384_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_p384_6.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_p384_6.S deleted file mode 100644 index 04927a8d698..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_p384_6.S +++ /dev/null @@ -1,116 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_384 -// Input x[6]; output z[6] -// -// extern void bignum_mod_p384_6(uint64_t z[static 6], const uint64_t x[static 6]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p384_6) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p384_6) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p384_6) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 -#define d4 %r10 -#define d5 %r11 -#define c %rax - -#define cshort %eax - -// Re-use the input pointer as a temporary once we're done - -#define a %rsi - - - -S2N_BN_SYMBOL(bignum_mod_p384_6): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the input and subtract p_384 from it - - movq (x), d0 - movl $0x00000000ffffffff, cshort - subq c, d0 - movq 8(x), d1 - notq c - sbbq c, d1 - movq 16(x), d2 - sbbq $-2, d2 - movq 24(x), d3 - sbbq $-1, d3 - movq 32(x), d4 - sbbq $-1, d4 - movq 40(x), d5 - sbbq $-1, d5 - -// Capture the top carry as a bitmask to indicate we need to add p_384 back on, -// which we actually do in a more convenient way by subtracting r_384 -// where r_384 = [-1; 0; 0; 0; 1; 0x00000000ffffffff; 0xffffffff00000001] -// We don't quite have enough ABI-modifiable registers to create all three -// nonzero digits of r while maintaining d0..d5, but make the first two now. - - notq c - sbbq a, a - andq a, c // c = masked 0x00000000ffffffff - xorq a, a - subq c, a // a = masked 0xffffffff00000001 - -// Do the first two digits of addition and writeback - - subq a, d0 - movq d0, (z) - sbbq c, d1 - movq d1, 8(z) - -// Preserve the carry chain while creating the extra masked digit since -// the logical operation will clear CF - - sbbq d0, d0 - andq a, c // c = masked 0x0000000000000001 - negq d0 - -// Do the rest of the addition and writeback - - sbbq c, d2 - movq d2, 16(z) - sbbq $0, d3 - movq d3, 24(z) - sbbq $0, d4 - movq d4, 32(z) - sbbq $0, d5 - movq d5, 40(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p384_6) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_p384_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_p384_alt.S deleted file mode 100644 index ffca11b149e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mod_p384_alt.S +++ /dev/null @@ -1,234 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_384 -// Input x[k]; output z[6] -// -// extern void bignum_mod_p384_alt(uint64_t z[static 6], uint64_t k, -// const uint64_t *x); -// -// Standard x86-64 ABI: RDI = z, RSI = k, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = k, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p384_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p384_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p384_alt) - .text - -#define z %rdi -#define k %rsi -#define x %rcx - -#define m0 %r8 -#define m1 %r9 -#define m2 %r10 -#define m3 %r11 -#define m4 %r12 -#define m5 %r13 -#define d %r14 - -#define n0 %rax -#define n1 %rbx -#define n2 %rdx - -// Both alias n1 - -#define q %rbx -#define c %rbx - -#define n0short %eax -#define n1short %ebx -#define qshort %ebx - - -S2N_BN_SYMBOL(bignum_mod_p384_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save extra registers - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - -// If the input is already <= 5 words long, go to a trivial "copy" path - - cmpq $6, k - jc Lbignum_mod_p384_alt_shortinput - -// Otherwise load the top 6 digits (top-down) and reduce k by 6 - - subq $6, k - movq 40(%rdx,k,8), m5 - movq 32(%rdx,k,8), m4 - movq 24(%rdx,k,8), m3 - movq 16(%rdx,k,8), m2 - movq 8(%rdx,k,8), m1 - movq (%rdx,k,8), m0 - -// Move x into another register to leave %rdx free for multiplies and use of n2 - - movq %rdx, x - -// Reduce the top 6 digits mod p_384 (a conditional subtraction of p_384) - - movl $0x00000000ffffffff, n0short - movq $0xffffffff00000000, n1 - movq $0xfffffffffffffffe, n2 - - subq n0, m0 - sbbq n1, m1 - sbbq n2, m2 - sbbq $-1, m3 - sbbq $-1, m4 - sbbq $-1, m5 - - sbbq d, d - andq d, n0 - andq d, n1 - andq d, n2 - addq n0, m0 - adcq n1, m1 - adcq n2, m2 - adcq d, m3 - adcq d, m4 - adcq d, m5 - -// Now do (k-6) iterations of 7->6 word modular reduction - - testq k, k - jz Lbignum_mod_p384_alt_writeback - -Lbignum_mod_p384_alt_loop: - -// Compute q = min (m5 + 1) (2^64 - 1) - - movl $1, qshort - addq m5, q - sbbq d, d - orq d, q - -// Load the next digit so current m to reduce = [m5;m4;m3;m2;m1;m0;d] - - movq -8(x,k,8), d - -// Now form [m5;m4;m3;m2;m1;m0;d] = m - q * p_384. To use an addition for -// the main calculation we do (m - 2^384 * q) + q * (2^384 - p_384) -// where 2^384 - p_384 = [0;0;0;1;0x00000000ffffffff;0xffffffff00000001]. -// The extra subtraction of 2^384 * q is the first instruction. - - subq q, m5 - movq $0xffffffff00000001, %rax - mulq q - addq %rax, d - adcq %rdx, m0 - adcq q, m1 - movq q, %rax - sbbq c, c - movl $0x00000000ffffffff, %edx - negq c - mulq %rdx - addq %rax, m0 - adcq %rdx, m1 - adcq c, m2 - adcq $0, m3 - adcq $0, m4 - adcq $0, m5 - -// Now our top word m5 is either zero or all 1s. Use it for a masked -// addition of p_384, which we can do by a *subtraction* of -// 2^384 - p_384 from our portion - - movq $0xffffffff00000001, n0 - andq m5, n0 - movl $0x00000000ffffffff, n1short - andq m5, n1 - andq $1, m5 - - subq n0, d - sbbq n1, m0 - sbbq m5, m1 - sbbq $0, m2 - sbbq $0, m3 - sbbq $0, m4 - -// Now shuffle registers up and loop - - movq m4, m5 - movq m3, m4 - movq m2, m3 - movq m1, m2 - movq m0, m1 - movq d, m0 - - decq k - jnz Lbignum_mod_p384_alt_loop - -// Write back - -Lbignum_mod_p384_alt_writeback: - - movq m0, (z) - movq m1, 8(z) - movq m2, 16(z) - movq m3, 24(z) - movq m4, 32(z) - movq m5, 40(z) - -// Restore registers and return - - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p384_alt) - -Lbignum_mod_p384_alt_shortinput: - - xorq m0, m0 - xorq m1, m1 - xorq m2, m2 - xorq m3, m3 - xorq m4, m4 - xorq m5, m5 - - testq k, k - jz Lbignum_mod_p384_alt_writeback - movq (%rdx), m0 - decq k - jz Lbignum_mod_p384_alt_writeback - movq 8(%rdx), m1 - decq k - jz Lbignum_mod_p384_alt_writeback - movq 16(%rdx), m2 - decq k - jz Lbignum_mod_p384_alt_writeback - movq 24(%rdx), m3 - decq k - jz Lbignum_mod_p384_alt_writeback - movq 32(%rdx), m4 - jmp Lbignum_mod_p384_alt_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mux_6.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mux_6.S deleted file mode 100644 index 80fd5f8c226..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_mux_6.S +++ /dev/null @@ -1,88 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// 384-bit multiplex/select z := x (if p nonzero) or z := y (if p zero) -// Inputs p, x[6], y[6]; output z[6] -// -// extern void bignum_mux_6(uint64_t p, uint64_t z[static 6], -// const uint64_t x[static 6], -// const uint64_t y[static 6]); -// -// It is assumed that all numbers x, y and z have the same size 6 digits. -// -// Standard x86-64 ABI: RDI = p, RSI = z, RDX = x, RCX = y -// Microsoft x64 ABI: RCX = p, RDX = z, R8 = x, R9 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mux_6) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mux_6) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mux_6) - .text - -#define p %rdi -#define z %rsi -#define x %rdx -#define y %rcx -#define a %rax -#define b %r8 - - -S2N_BN_SYMBOL(bignum_mux_6): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - movq %r9, %rcx -#endif - testq p, p - - movq (x), a - movq (y), b - cmovzq b, a - movq a, (z) - - movq 8(x), a - movq 8(y), b - cmovzq b, a - movq a, 8(z) - - movq 16(x), a - movq 16(y), b - cmovzq b, a - movq a, 16(z) - - movq 24(x), a - movq 24(y), b - cmovzq b, a - movq a, 24(z) - - movq 32(x), a - movq 32(y), b - cmovzq b, a - movq a, 32(z) - - movq 40(x), a - movq 40(y), b - cmovzq b, a - movq a, 40(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mux_6) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_optneg_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_optneg_p384.S deleted file mode 100644 index 6ce5130c190..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_optneg_p384.S +++ /dev/null @@ -1,120 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo p_384, z := (-x) mod p_384 (if p nonzero) or -// z := x (if p zero), assuming x reduced -// Inputs p, x[6]; output z[6] -// -// extern void bignum_optneg_p384(uint64_t z[static 6], uint64_t p, -// const uint64_t x[static 6]); -// -// Standard x86-64 ABI: RDI = z, RSI = p, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = p, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg_p384) - .text - -#define z %rdi -#define q %rsi -#define x %rdx - -#define n0 %rax -#define n1 %rcx -#define n2 %r8 -#define n3 %r9 -#define n4 %r10 -#define n5 %r11 - -#define n0short %eax - -S2N_BN_SYMBOL(bignum_optneg_p384): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Adjust q by zeroing it if the input is zero (to avoid giving -0 = p_384, -// which is not strictly reduced even though it's correct modulo p_384). -// This step is redundant if we know a priori that the input is nonzero, which -// is the case for the y coordinate of points on the P-384 curve, for example. - - movq (x), n0 - orq 8(x), n0 - movq 16(x), n1 - orq 24(x), n1 - movq 32(x), n2 - orq 40(x), n2 - orq n1, n0 - orq n2, n0 - negq n0 - sbbq n0, n0 - andq n0, q - -// Turn q into a bitmask, all 1s for q=false, all 0s for q=true - - negq q - sbbq q, q - notq q - -// Let [n5;n4;n3;n2;n1] = if q then p_384 else -1 - - movl $0x00000000ffffffff, n0short - orq q, n0 - movq $0xffffffff00000000, n1 - orq q, n1 - movq $0xfffffffffffffffe, n2 - orq q, n2 - movq $0xffffffffffffffff, n3 - movq n3, n4 - movq n3, n5 - -// Subtract so [n5;n4;n3;n2;n1;n0] = if q then p_384 - x else -1 - x - - subq (x), n0 - sbbq 8(x), n1 - sbbq 16(x), n2 - sbbq 24(x), n3 - sbbq 32(x), n4 - sbbq 40(x), n5 - -// XOR the words with the bitmask, which in the case q = false has the -// effect of restoring ~(-1 - x) = -(-1 - x) - 1 = 1 + x - 1 = x -// and write back the digits to the output - - xorq q, n0 - movq n0, (z) - xorq q, n1 - movq n1, 8(z) - xorq q, n2 - movq n2, 16(z) - xorq q, n3 - movq n3, 24(z) - xorq q, n4 - movq n4, 32(z) - xorq q, n5 - movq n5, 40(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_triple_p384.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_triple_p384.S deleted file mode 100644 index 0f35b64849b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_triple_p384.S +++ /dev/null @@ -1,149 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_384, z := (3 * x) mod p_384 -// Input x[6]; output z[6] -// -// extern void bignum_triple_p384(uint64_t z[static 6], -// const uint64_t x[static 6]); -// -// The input x can be any 6-digit bignum, not necessarily reduced modulo p_384, -// and the result is always fully reduced, i.e. z = (3 * x) mod p_384. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p384) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p384) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p384) - .text - -#define z %rdi -#define x %rsi - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 -#define d4 %rbx -#define d5 %rsi - -#define a %rax -#define c %rcx -#define q %rdx - -#define ashort %eax -#define qshort %edx - -S2N_BN_SYMBOL(bignum_triple_p384): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// We seem to need (just!) one extra register, which we need to save and restore - - CFI_PUSH(%rbx) - -// Multiply, accumulating the result as 2^384 * h + [d5;d4;d3;d2;d1;d0] -// but actually immediately producing q = h + 1, our quotient approximation, -// by adding 1 to it. - - xorl ashort, ashort - - movq (x), q - movq q, d0 - adcxq q, q - adoxq q, d0 - movq 8(x), q - movq q, d1 - adcxq q, q - adoxq q, d1 - movq 16(x), q - movq q, d2 - adcxq q, q - adoxq q, d2 - movq 24(x), q - movq q, d3 - adcxq q, q - adoxq q, d3 - movq 32(x), q - movq q, d4 - adcxq q, q - adoxq q, d4 - movq 40(x), q - movq q, d5 - adcxq q, q - adoxq q, d5 - - movl $1, qshort - adcxq a, q - adoxq a, q - -// Initial subtraction of z - q * p_384, with bitmask c for the carry -// Actually done as an addition of (z - 2^384 * h) + q * (2^384 - p_384) -// which, because q = h + 1, is exactly 2^384 + (z - q * p_384), and -// therefore CF <=> 2^384 + (z - q * p_384) >= 2^384 <=> z >= q * p_384. - - movq q, c - shlq $32, c - movq q, a - subq c, a - sbbq $0, c - - addq a, d0 - adcq c, d1 - adcq q, d2 - adcq $0, d3 - adcq $0, d4 - adcq $0, d5 - sbbq c, c - notq c - -// Now use that mask for a masked addition of p_384, which again is in -// fact done by a masked subtraction of 2^384 - p_384, so that we only -// have three nonzero digits and so can avoid using another register. - - movl $0x00000000ffffffff, qshort - xorl ashort, ashort - andq c, q - subq q, a - negq c - - subq a, d0 - movq d0, (z) - sbbq q, d1 - movq d1, 8(z) - sbbq c, d2 - movq d2, 16(z) - sbbq $0, d3 - movq d3, 24(z) - sbbq $0, d4 - movq d4, 32(z) - sbbq $0, d5 - movq d5, 40(z) - -// Return - - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p384) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_triple_p384_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_triple_p384_alt.S deleted file mode 100644 index 5d18885d702..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/bignum_triple_p384_alt.S +++ /dev/null @@ -1,159 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_384, z := (3 * x) mod p_384 -// Input x[6]; output z[6] -// -// extern void bignum_triple_p384_alt(uint64_t z[static 6], -// const uint64_t x[static 6]); -// -// The input x can be any 6-digit bignum, not necessarily reduced modulo p_384, -// and the result is always fully reduced, i.e. z = (3 * x) mod p_384. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p384_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p384_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p384_alt) - .text - -#define z %rdi -#define x %rsi - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 -#define d4 %rbx -#define d5 %rsi - -#define a %rax -#define c %rcx -#define q %rcx -#define d %rdx - -#define ashort %eax -#define cshort %ecx -#define qshort %ecx -#define dshort %edx - -S2N_BN_SYMBOL(bignum_triple_p384_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// We seem to need (just!) one extra register, which we need to save and restore - - CFI_PUSH(%rbx) - -// Multiply, accumulating the result as 2^384 * h + [d5;d4;d3;d2;d1;d0] -// but actually immediately producing q = h + 1, our quotient approximation, -// by adding 1 to it. - - movl $3, cshort - - movq (x), a - mulq c - movq a, d0 - movq d, d1 - - movq 8(x), a - xorq d2, d2 - mulq c - addq a, d1 - adcq d, d2 - - movq 16(x), a - xorq d3, d3 - mulq c - addq a, d2 - adcq d, d3 - - movq 24(x), a - xorq d4, d4 - mulq c - addq a, d3 - adcq d, d4 - - movq 32(x), a - mulq c - addq a, d4 - adcq $0, d - - movq 40(x), a - movq d, d5 - mulq c - addq a, d5 - - movl $1, qshort - adcq d, q - -// Initial subtraction of z - q * p_384, with bitmask c for the carry -// Actually done as an addition of (z - 2^384 * h) + q * (2^384 - p_384) -// which, because q = h + 1, is exactly 2^384 + (z - q * p_384), and -// therefore CF <=> 2^384 + (z - q * p_384) >= 2^384 <=> z >= q * p_384. - - movq q, d - shlq $32, d - movq q, a - subq d, a - sbbq $0, d - - addq a, d0 - adcq d, d1 - adcq q, d2 - adcq $0, d3 - adcq $0, d4 - adcq $0, d5 - sbbq d, d - notq d - -// Now use that mask for a masked addition of p_384, which again is in -// fact done by a masked subtraction of 2^384 - p_384, so that we only -// have three nonzero digits and so can avoid using another register. - - movl $0x00000000ffffffff, qshort - xorl ashort, ashort - andq d, q - subq q, a - negq d - - subq a, d0 - movq d0, (z) - sbbq q, d1 - movq d1, 8(z) - sbbq d, d2 - movq d2, 16(z) - sbbq $0, d3 - movq d3, 24(z) - sbbq $0, d4 - movq d4, 32(z) - sbbq $0, d5 - movq d5, 40(z) - -// Return - - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p384_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjadd.S deleted file mode 100644 index 3a1d2077d72..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjadd.S +++ /dev/null @@ -1,1045 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-384 in Montgomery-Jacobian coordinates -// -// extern void p384_montjadd(uint64_t p3[static 18], const uint64_t p1[static 18], -// const uint64_t p2[static 18]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^384 * x) mod p_384. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p384_montjadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p384_montjadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p384_montjadd) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 48 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rcx = p2, -// which needs to be set up explicitly before use. -// The %rdi value never changes, however. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rcx) -#define y_2 NUMSIZE(%rcx) -#define z_2 (2*NUMSIZE)(%rcx) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// In one place it's convenient to use another register -// since the squaring function overwrites %rcx - -#define z_2_alt (2*NUMSIZE)(%rsi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z1sq (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define x1a (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define z2sq (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define y1a (NUMSIZE*6)(%rsp) - -// Temporaries for the actual input pointers - -#define input_x (NUMSIZE*7)(%rsp) -#define input_y (NUMSIZE*7+8)(%rsp) - -#define NSPACE 352 - -// Corresponds exactly to bignum_montmul_p384 - -#define montmul_p384(P0,P1,P2) \ - movq P2, %rdx ; \ - xorl %r15d, %r15d ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rbx, %r10 ; \ - addq %rbx, %r9 ; \ - mulxq 0x10+P1, %rbx, %r11 ; \ - adcq %rbx, %r10 ; \ - mulxq 0x18+P1, %rbx, %r12 ; \ - adcq %rbx, %r11 ; \ - mulxq 0x20+P1, %rbx, %r13 ; \ - adcq %rbx, %r12 ; \ - mulxq 0x28+P1, %rbx, %r14 ; \ - adcq %rbx, %r13 ; \ - adcq %r15, %r14 ; \ - movq %r8, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r8, %rdx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rbx, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %r8, %rbx ; \ - adcq %r8, %rax ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbp, %r11 ; \ - sbbq $0x0, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %rdx ; \ - addq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x8+P2, %rdx ; \ - xorl %r8d, %r8d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - adoxq %r8, %r15 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcq %rax, %r14 ; \ - adcq %rbx, %r15 ; \ - adcq %r8, %r8 ; \ - movq %r9, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r9, %rdx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rbx, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %r9, %rbx ; \ - adcq %r9, %rax ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r10 ; \ - sbbq %rbx, %r11 ; \ - sbbq %rbp, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %r14 ; \ - sbbq $0x0, %rdx ; \ - addq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x10+P2, %rdx ; \ - xorl %r9d, %r9d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adoxq %r9, %r8 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcq %rax, %r15 ; \ - adcq %rbx, %r8 ; \ - adcq %r9, %r9 ; \ - movq %r10, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r10, %rdx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rbx, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %r10, %rbx ; \ - adcq %r10, %rax ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r11 ; \ - sbbq %rbx, %r12 ; \ - sbbq %rbp, %r13 ; \ - sbbq $0x0, %r14 ; \ - sbbq $0x0, %r15 ; \ - sbbq $0x0, %rdx ; \ - addq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x18+P2, %rdx ; \ - xorl %r10d, %r10d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - adoxq %r10, %r9 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %r10, %r10 ; \ - movq %r11, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r11, %rdx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rbx, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %r11, %rbx ; \ - adcq %r11, %rax ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r12 ; \ - sbbq %rbx, %r13 ; \ - sbbq %rbp, %r14 ; \ - sbbq $0x0, %r15 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %rdx ; \ - addq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x20+P2, %rdx ; \ - xorl %r11d, %r11d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - adoxq %r11, %r10 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcq %rax, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %r11, %r11 ; \ - movq %r12, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r12, %rdx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rbx, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %r12, %rbx ; \ - adcq %r12, %rax ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r13 ; \ - sbbq %rbx, %r14 ; \ - sbbq %rbp, %r15 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %rdx ; \ - addq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x28+P2, %rdx ; \ - xorl %r12d, %r12d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - adoxq %r12, %r11 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcq %rax, %r10 ; \ - adcq %rbx, %r11 ; \ - adcq %r12, %r12 ; \ - movq %r13, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r13, %rdx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rbx, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %r13, %rbx ; \ - adcq %r13, %rax ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r14 ; \ - sbbq %rbx, %r15 ; \ - sbbq %rbp, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq $0x0, %rdx ; \ - addq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorl %edx, %edx ; \ - xorl %ebp, %ebp ; \ - xorl %r13d, %r13d ; \ - movq $0xffffffff00000001, %rax ; \ - addq %r14, %rax ; \ - movl $0xffffffff, %ebx ; \ - adcq %r15, %rbx ; \ - movl $0x1, %ecx ; \ - adcq %r8, %rcx ; \ - adcq %r9, %rdx ; \ - adcq %r10, %rbp ; \ - adcq %r11, %r13 ; \ - adcq $0x0, %r12 ; \ - cmovne %rax, %r14 ; \ - cmovne %rbx, %r15 ; \ - cmovne %rcx, %r8 ; \ - cmovne %rdx, %r9 ; \ - cmovne %rbp, %r10 ; \ - cmovne %r13, %r11 ; \ - movq %r14, P0 ; \ - movq %r15, 0x8+P0 ; \ - movq %r8, 0x10+P0 ; \ - movq %r9, 0x18+P0 ; \ - movq %r10, 0x20+P0 ; \ - movq %r11, 0x28+P0 - -// Corresponds exactly to bignum_montsqr_p384 - -#define montsqr_p384(P0,P1) \ - movq P1, %rdx ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - mulxq 0x28+P1, %r13, %r14 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x20+P1, %r15, %rcx ; \ - xorl %ebp, %ebp ; \ - movq 0x10+P1, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x8+P1, %rdx ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adcxq %rbp, %r15 ; \ - adoxq %rbp, %rcx ; \ - adcq %rbp, %rcx ; \ - xorl %ebp, %ebp ; \ - movq 0x20+P1, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x28+P1, %rax, %rdx ; \ - adcxq %rax, %r15 ; \ - adoxq %rdx, %rcx ; \ - movq 0x28+P1, %rdx ; \ - mulxq 0x20+P1, %rbx, %rbp ; \ - mulxq 0x18+P1, %rax, %rdx ; \ - adcxq %rax, %rcx ; \ - adoxq %rdx, %rbx ; \ - movl $0x0, %eax ; \ - adcxq %rax, %rbx ; \ - adoxq %rax, %rbp ; \ - adcq %rax, %rbp ; \ - xorq %rax, %rax ; \ - movq P1, %rdx ; \ - mulxq P1, %r8, %rax ; \ - adcxq %r9, %r9 ; \ - adoxq %rax, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %r15, %r15 ; \ - adoxq %rdx, %r15 ; \ - movq 0x20+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %rcx, %rcx ; \ - adoxq %rax, %rcx ; \ - adcxq %rbx, %rbx ; \ - adoxq %rdx, %rbx ; \ - movq 0x28+P1, %rdx ; \ - mulxq %rdx, %rax, %rsi ; \ - adcxq %rbp, %rbp ; \ - adoxq %rax, %rbp ; \ - movl $0x0, %eax ; \ - adcxq %rax, %rsi ; \ - adoxq %rax, %rsi ; \ - movq %rbx, P0 ; \ - movq %r8, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r8, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r8, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r8 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r8 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r9 ; \ - sbbq %r8, %r10 ; \ - sbbq %rbx, %r11 ; \ - sbbq $0x0, %r12 ; \ - sbbq $0x0, %r13 ; \ - movq %rdx, %r8 ; \ - sbbq $0x0, %r8 ; \ - movq %r9, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r9, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r9, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r9 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r9 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r10 ; \ - sbbq %r9, %r11 ; \ - sbbq %rbx, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %r8 ; \ - movq %rdx, %r9 ; \ - sbbq $0x0, %r9 ; \ - movq %r10, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r10, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r10, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r10 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r10 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r11 ; \ - sbbq %r10, %r12 ; \ - sbbq %rbx, %r13 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %r9 ; \ - movq %rdx, %r10 ; \ - sbbq $0x0, %r10 ; \ - movq %r11, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r11, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r11, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r11 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r11 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r12 ; \ - sbbq %r11, %r13 ; \ - sbbq %rbx, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %r10 ; \ - movq %rdx, %r11 ; \ - sbbq $0x0, %r11 ; \ - movq %r12, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r12, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r12, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r12 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r12 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r13 ; \ - sbbq %r12, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq $0x0, %r11 ; \ - movq %rdx, %r12 ; \ - sbbq $0x0, %r12 ; \ - movq %r13, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r13, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r13, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r13 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r13 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r8 ; \ - sbbq %r13, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq $0x0, %r11 ; \ - sbbq $0x0, %r12 ; \ - movq %rdx, %r13 ; \ - sbbq $0x0, %r13 ; \ - movq P0, %rbx ; \ - addq %r8, %r14 ; \ - adcq %r9, %r15 ; \ - adcq %r10, %rcx ; \ - adcq %r11, %rbx ; \ - adcq %r12, %rbp ; \ - adcq %r13, %rsi ; \ - movl $0x0, %r8d ; \ - adcq %r8, %r8 ; \ - xorq %r11, %r11 ; \ - xorq %r12, %r12 ; \ - xorq %r13, %r13 ; \ - movq $0xffffffff00000001, %rax ; \ - addq %r14, %rax ; \ - movl $0xffffffff, %r9d ; \ - adcq %r15, %r9 ; \ - movl $0x1, %r10d ; \ - adcq %rcx, %r10 ; \ - adcq %rbx, %r11 ; \ - adcq %rbp, %r12 ; \ - adcq %rsi, %r13 ; \ - adcq $0x0, %r8 ; \ - cmovne %rax, %r14 ; \ - cmovne %r9, %r15 ; \ - cmovne %r10, %rcx ; \ - cmovne %r11, %rbx ; \ - cmovne %r12, %rbp ; \ - cmovne %r13, %rsi ; \ - movq %r14, P0 ; \ - movq %r15, 0x8+P0 ; \ - movq %rcx, 0x10+P0 ; \ - movq %rbx, 0x18+P0 ; \ - movq %rbp, 0x20+P0 ; \ - movq %rsi, 0x28+P0 - -// Almost-Montgomery variant which we use when an input to other muls -// with the other argument fully reduced (which is always safe). - -#define amontsqr_p384(P0,P1) \ - movq P1, %rdx ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - mulxq 0x28+P1, %r13, %r14 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x20+P1, %r15, %rcx ; \ - xorl %ebp, %ebp ; \ - movq 0x10+P1, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x8+P1, %rdx ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adcxq %rbp, %r15 ; \ - adoxq %rbp, %rcx ; \ - adcq %rbp, %rcx ; \ - xorl %ebp, %ebp ; \ - movq 0x20+P1, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x28+P1, %rax, %rdx ; \ - adcxq %rax, %r15 ; \ - adoxq %rdx, %rcx ; \ - movq 0x28+P1, %rdx ; \ - mulxq 0x20+P1, %rbx, %rbp ; \ - mulxq 0x18+P1, %rax, %rdx ; \ - adcxq %rax, %rcx ; \ - adoxq %rdx, %rbx ; \ - movl $0x0, %eax ; \ - adcxq %rax, %rbx ; \ - adoxq %rax, %rbp ; \ - adcq %rax, %rbp ; \ - xorq %rax, %rax ; \ - movq P1, %rdx ; \ - mulxq P1, %r8, %rax ; \ - adcxq %r9, %r9 ; \ - adoxq %rax, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %r15, %r15 ; \ - adoxq %rdx, %r15 ; \ - movq 0x20+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %rcx, %rcx ; \ - adoxq %rax, %rcx ; \ - adcxq %rbx, %rbx ; \ - adoxq %rdx, %rbx ; \ - movq 0x28+P1, %rdx ; \ - mulxq %rdx, %rax, %rsi ; \ - adcxq %rbp, %rbp ; \ - adoxq %rax, %rbp ; \ - movl $0x0, %eax ; \ - adcxq %rax, %rsi ; \ - adoxq %rax, %rsi ; \ - movq %rbx, P0 ; \ - movq %r8, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r8, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r8, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r8 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r8 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r9 ; \ - sbbq %r8, %r10 ; \ - sbbq %rbx, %r11 ; \ - sbbq $0x0, %r12 ; \ - sbbq $0x0, %r13 ; \ - movq %rdx, %r8 ; \ - sbbq $0x0, %r8 ; \ - movq %r9, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r9, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r9, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r9 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r9 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r10 ; \ - sbbq %r9, %r11 ; \ - sbbq %rbx, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %r8 ; \ - movq %rdx, %r9 ; \ - sbbq $0x0, %r9 ; \ - movq %r10, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r10, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r10, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r10 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r10 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r11 ; \ - sbbq %r10, %r12 ; \ - sbbq %rbx, %r13 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %r9 ; \ - movq %rdx, %r10 ; \ - sbbq $0x0, %r10 ; \ - movq %r11, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r11, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r11, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r11 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r11 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r12 ; \ - sbbq %r11, %r13 ; \ - sbbq %rbx, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %r10 ; \ - movq %rdx, %r11 ; \ - sbbq $0x0, %r11 ; \ - movq %r12, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r12, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r12, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r12 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r12 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r13 ; \ - sbbq %r12, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq $0x0, %r11 ; \ - movq %rdx, %r12 ; \ - sbbq $0x0, %r12 ; \ - movq %r13, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r13, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r13, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r13 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r13 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r8 ; \ - sbbq %r13, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq $0x0, %r11 ; \ - sbbq $0x0, %r12 ; \ - movq %rdx, %r13 ; \ - sbbq $0x0, %r13 ; \ - movq P0, %rbx ; \ - addq %r8, %r14 ; \ - adcq %r9, %r15 ; \ - adcq %r10, %rcx ; \ - adcq %r11, %rbx ; \ - adcq %r12, %rbp ; \ - adcq %r13, %rsi ; \ - movl $0x0, %r8d ; \ - movq $0xffffffff00000001, %rax ; \ - movl $0xffffffff, %r9d ; \ - movl $0x1, %r10d ; \ - cmovnc %r8, %rax ; \ - cmovnc %r8, %r9 ; \ - cmovnc %r8, %r10 ; \ - addq %rax, %r14 ; \ - adcq %r9, %r15 ; \ - adcq %r10, %rcx ; \ - adcq %r8, %rbx ; \ - adcq %r8, %rbp ; \ - adcq %r8, %rsi ; \ - movq %r14, P0 ; \ - movq %r15, 0x8+P0 ; \ - movq %rcx, 0x10+P0 ; \ - movq %rbx, 0x18+P0 ; \ - movq %rbp, 0x20+P0 ; \ - movq %rsi, 0x28+P0 - -// Corresponds exactly to bignum_sub_p384 - -#define sub_p384(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rdx ; \ - sbbq 0x8+P2, %rdx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq 0x20+P1, %r10 ; \ - sbbq 0x20+P2, %r10 ; \ - movq 0x28+P1, %r11 ; \ - sbbq 0x28+P2, %r11 ; \ - sbbq %rcx, %rcx ; \ - movl $0xffffffff, %esi ; \ - andq %rsi, %rcx ; \ - xorq %rsi, %rsi ; \ - subq %rcx, %rsi ; \ - subq %rsi, %rax ; \ - movq %rax, P0 ; \ - sbbq %rcx, %rdx ; \ - movq %rdx, 0x8+P0 ; \ - sbbq %rax, %rax ; \ - andq %rsi, %rcx ; \ - negq %rax; \ - sbbq %rcx, %r8 ; \ - movq %r8, 0x10+P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x18+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x20+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x28+P0 - -// Additional macros to help with final multiplexing - -#define load6(r0,r1,r2,r3,r4,r5,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 ; \ - movq 32+P, r4 ; \ - movq 40+P, r5 - -#define store6(P,r0,r1,r2,r3,r4,r5) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P ; \ - movq r4, 32+P ; \ - movq r5, 40+P ; \ - -#define czload6(r0,r1,r2,r3,r4,r5,P) \ - cmovzq P, r0 ; \ - cmovzq 8+P, r1 ; \ - cmovzq 16+P, r2 ; \ - cmovzq 24+P, r3 ; \ - cmovzq 32+P, r4 ; \ - cmovzq 40+P, r5 - -#define muxload6(r0,r1,r2,r3,r4,r5,P0,P1,P2) \ - movq P0, r0 ; \ - cmovbq P1, r0 ; \ - cmovnbe P2, r0 ; \ - movq 8+P0, r1 ; \ - cmovbq 8+P1, r1 ; \ - cmovnbe 8+P2, r1 ; \ - movq 16+P0, r2 ; \ - cmovbq 16+P1, r2 ; \ - cmovnbe 16+P2, r2 ; \ - movq 24+P0, r3 ; \ - cmovbq 24+P1, r3 ; \ - cmovnbe 24+P2, r3 ; \ - movq 32+P0, r4 ; \ - cmovbq 32+P1, r4 ; \ - cmovnbe 32+P2, r4 ; \ - movq 40+P0, r5 ; \ - cmovbq 40+P1, r5 ; \ - cmovnbe 40+P2, r5 - -S2N_BN_SYMBOL(p384_montjadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input arguments in non-volatile places on the stack - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rsi, input_x - movq %rdx, input_y - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - amontsqr_p384(z1sq,z_1) - movq input_y, %rsi - amontsqr_p384(z2sq,z_2_alt) - - movq input_x, %rsi - movq input_y, %rcx - montmul_p384(y1a,z_2,y_1) - movq input_x, %rsi - movq input_y, %rcx - montmul_p384(y2a,z_1,y_2) - - movq input_y, %rcx - montmul_p384(x2a,z1sq,x_2) - movq input_x, %rsi - montmul_p384(x1a,z2sq,x_1) - montmul_p384(y2a,z1sq,y2a) - montmul_p384(y1a,z2sq,y1a) - - sub_p384(xd,x2a,x1a) - sub_p384(yd,y2a,y1a) - - amontsqr_p384(zz,xd) - montsqr_p384(ww,yd) - - montmul_p384(zzx1,zz,x1a) - montmul_p384(zzx2,zz,x2a) - - sub_p384(resx,ww,zzx1) - sub_p384(t1,zzx2,zzx1) - - movq input_x, %rsi - montmul_p384(xd,xd,z_1) - - sub_p384(resx,resx,zzx2) - - sub_p384(t2,zzx1,resx) - - montmul_p384(t1,t1,y1a) - - movq input_y, %rcx - montmul_p384(resz,xd,z_2) - montmul_p384(t2,yd,t2) - - sub_p384(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "NBE" <=> ~(CF \/ ZF) <=> P1 = 0 /\ ~(P2 = 0) -// and "B" <=> CF <=> ~(P1 = 0) /\ P2 = 0 -// and "Z" <=> ZF <=> (P1 = 0 <=> P2 = 0) -// Multiplex the z outputs accordingly and re-store in resz - - movq input_y, %rcx - load6(%r8,%r9,%r10,%r11,%rbx,%rbp,z_2) - movq %r8, %rax - movq %r9, %rdx - orq %r10, %rax - orq %r11, %rdx - orq %rbx, %rax - orq %rbp, %rdx - orq %rdx, %rax - negq %rax - sbbq %rax, %rax - - movq input_x, %rsi - load6(%r12,%r13,%r14,%r15,%rdx,%rcx,z_1) - cmovzq %r12, %r8 - cmovzq %r13, %r9 - cmovzq %r14, %r10 - cmovzq %r15, %r11 - cmovzq %rdx, %rbx - cmovzq %rcx, %rbp - orq %r13, %r12 - orq %r15, %r14 - orq %rcx, %rdx - orq %r14, %r12 - orq %r12, %rdx - negq %rdx - sbbq %rdx, %rdx - - cmpq %rdx, %rax - - czload6(%r8,%r9,%r10,%r11,%rbx,%rbp,resz) - store6(resz,%r8,%r9,%r10,%r11,%rbx,%rbp) - -// Multiplex the x and y outputs too, keeping the results in registers - - movq input_y, %rcx - movq input_x, %rsi - muxload6(%r8,%r9,%r10,%r11,%rbx,%rbp,resx,x_1,x_2) - muxload6(%r12,%r13,%r14,%r15,%rdx,%rax,resy,y_1,y_2) - -// Finally store back the multiplexed values - - store6(x_3,%r8,%r9,%r10,%r11,%rbx,%rbp) - load6(%r8,%r9,%r10,%r11,%rbx,%rbp,resz) - store6(y_3,%r12,%r13,%r14,%r15,%rdx,%rax) - store6(z_3,%r8,%r9,%r10,%r11,%rbx,%rbp) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p384_montjadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjadd_alt.S deleted file mode 100644 index cd02249263c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjadd_alt.S +++ /dev/null @@ -1,971 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-384 in Montgomery-Jacobian coordinates -// -// extern void p384_montjadd_alt(uint64_t p3[static 18], -// const uint64_t p1[static 18], -// const uint64_t p2[static 18]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^384 * x) mod p_384. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p384_montjadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p384_montjadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p384_montjadd_alt) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 48 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rcx = p2, -// which needs to be set up explicitly before use. -// The %rdi value never changes, however. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rcx) -#define y_2 NUMSIZE(%rcx) -#define z_2 (2*NUMSIZE)(%rcx) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// In one place it's convenient to use another register -// since the squaring function overwrites %rcx - -#define z_2_alt (2*NUMSIZE)(%rsi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z1sq (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define x1a (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define z2sq (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define y1a (NUMSIZE*6)(%rsp) - -// Temporaries for the actual input pointers - -#define input_x (NUMSIZE*7)(%rsp) -#define input_y (NUMSIZE*7+8)(%rsp) - -#define NSPACE 352 - -// Corresponds exactly to bignum_montmul_p384_alt - -#define montmul_p384(P0,P1,P2) \ - movq P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - xorl %r10d, %r10d ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - xorl %r11d, %r11d ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - xorl %r12d, %r12d ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - xorl %r13d, %r13d ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - xorl %r14d, %r14d ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - xorl %r15d, %r15d ; \ - movq %r8, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r8, %rbx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r8 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %r8, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbp, %r11 ; \ - sbbq $0x0, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %rbx ; \ - addq %rbx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x8+P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %r8, %r8 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r8, %r8 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r8, %r8 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r8, %r8 ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r8, %r8 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %r8, %r8 ; \ - negq %r8; \ - movq %r9, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r9, %rbx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r9 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %r9, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbp, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %r14 ; \ - sbbq $0x0, %rbx ; \ - addq %rbx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x10+P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r9, %r9 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r9, %r9 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r9, %r9 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r9, %r9 ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %r9, %r9 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - sbbq %r9, %r9 ; \ - negq %r9; \ - movq %r10, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r10, %rbx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r10 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %r10, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r11 ; \ - sbbq %rdx, %r12 ; \ - sbbq %rbp, %r13 ; \ - sbbq $0x0, %r14 ; \ - sbbq $0x0, %r15 ; \ - sbbq $0x0, %rbx ; \ - addq %rbx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x18+P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r10, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r10, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r10, %r10 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r10, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r10, %r10 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r10, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %r10, %r10 ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %r10, %rdx ; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - sbbq %r10, %r10 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %r10, %rdx ; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %r10, %r10 ; \ - negq %r10; \ - movq %r11, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r11, %rbx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r11 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %r11, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r12 ; \ - sbbq %rdx, %r13 ; \ - sbbq %rbp, %r14 ; \ - sbbq $0x0, %r15 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %rbx ; \ - addq %rbx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x20+P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r11, %r11 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r11, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r11, %r11 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r11, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %r11, %r11 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r11, %rdx ; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - sbbq %r11, %r11 ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %r11, %rdx ; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %r11, %r11 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %r11, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %r11, %r11 ; \ - negq %r11; \ - movq %r12, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r12, %rbx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r12 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %r12, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r13 ; \ - sbbq %rdx, %r14 ; \ - sbbq %rbp, %r15 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %rbx ; \ - addq %rbx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x28+P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r12, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %r12, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r12, %rdx ; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - sbbq %r12, %r12 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r12, %rdx ; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %r12, %r12 ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %r12, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %r12, %r12 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %r12, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r12, %r12 ; \ - negq %r12; \ - movq %r13, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r13, %rbx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r13 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %r13, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r14 ; \ - sbbq %rdx, %r15 ; \ - sbbq %rbp, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq $0x0, %rbx ; \ - addq %rbx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorl %edx, %edx ; \ - xorl %ebp, %ebp ; \ - xorl %r13d, %r13d ; \ - movq $0xffffffff00000001, %rax ; \ - addq %r14, %rax ; \ - movl $0xffffffff, %ebx ; \ - adcq %r15, %rbx ; \ - movl $0x1, %ecx ; \ - adcq %r8, %rcx ; \ - adcq %r9, %rdx ; \ - adcq %r10, %rbp ; \ - adcq %r11, %r13 ; \ - adcq $0x0, %r12 ; \ - cmovneq %rax, %r14 ; \ - cmovneq %rbx, %r15 ; \ - cmovneq %rcx, %r8 ; \ - cmovneq %rdx, %r9 ; \ - cmovneq %rbp, %r10 ; \ - cmovneq %r13, %r11 ; \ - movq %r14, P0 ; \ - movq %r15, 0x8+P0 ; \ - movq %r8, 0x10+P0 ; \ - movq %r9, 0x18+P0 ; \ - movq %r10, 0x20+P0 ; \ - movq %r11, 0x28+P0 - -// Corresponds exactly to bignum_montsqr_p384_alt - -#define montsqr_p384(P0,P1) \ - movq P1, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r9 ; \ - movq %rdx, %r10 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r13 ; \ - movq %rdx, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x20+P1; \ - movq %rax, %r15 ; \ - movq %rdx, %rcx ; \ - movq 0x10+P1, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rbp, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rbp, %rbp ; \ - movq 0x8+P1, %rbx ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %rbp, %rbp ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %rbp, %rbp ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %rcx ; \ - movq 0x20+P1, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %rbp, %rbp ; \ - movq 0x10+P1, %rbx ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %rbp, %rbp ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %rbp, %rbp ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r15 ; \ - adcq %rdx, %rcx ; \ - sbbq %rbp, %rbp ; \ - xorl %ebx, %ebx ; \ - movq 0x18+P1, %rax ; \ - mulq 0x28+P1; \ - subq %rbp, %rdx ; \ - xorl %ebp, %ebp ; \ - addq %rax, %rcx ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - movq 0x20+P1, %rax ; \ - mulq 0x28+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - xorl %r8d, %r8d ; \ - addq %r9, %r9 ; \ - adcq %r10, %r10 ; \ - adcq %r11, %r11 ; \ - adcq %r12, %r12 ; \ - adcq %r13, %r13 ; \ - adcq %r14, %r14 ; \ - adcq %r15, %r15 ; \ - adcq %rcx, %rcx ; \ - adcq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcl %r8d, %r8d ; \ - movq P1, %rax ; \ - mulq %rax; \ - movq %r8, P0 ; \ - movq %rax, %r8 ; \ - movq 0x8+P1, %rax ; \ - movq %rbp, 0x8+P0 ; \ - addq %rdx, %r9 ; \ - sbbq %rbp, %rbp ; \ - mulq %rax; \ - negq %rbp; \ - adcq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rbp, %rbp ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - negq %rbp; \ - adcq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %rbp, %rbp ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - negq %rbp; \ - adcq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %rbp, %rbp ; \ - movq 0x20+P1, %rax ; \ - mulq %rax; \ - negq %rbp; \ - adcq %rax, %rcx ; \ - adcq %rdx, %rbx ; \ - sbbq %rbp, %rbp ; \ - movq 0x28+P1, %rax ; \ - mulq %rax; \ - negq %rbp; \ - adcq 0x8+P0, %rax ; \ - adcq P0, %rdx ; \ - movq %rax, %rbp ; \ - movq %rdx, %rsi ; \ - movq %rbx, P0 ; \ - movq %r8, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r8, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r8 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - movl $0x0, %eax ; \ - adcq %rbx, %rdx ; \ - adcl %eax, %eax ; \ - subq %r8, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rax, %r11 ; \ - sbbq $0x0, %r12 ; \ - sbbq $0x0, %r13 ; \ - movq %rbx, %r8 ; \ - sbbq $0x0, %r8 ; \ - movq %r9, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r9, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r9 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - movl $0x0, %eax ; \ - adcq %rbx, %rdx ; \ - adcl %eax, %eax ; \ - subq %r9, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rax, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %r8 ; \ - movq %rbx, %r9 ; \ - sbbq $0x0, %r9 ; \ - movq %r10, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r10, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r10 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - movl $0x0, %eax ; \ - adcq %rbx, %rdx ; \ - adcl %eax, %eax ; \ - subq %r10, %r11 ; \ - sbbq %rdx, %r12 ; \ - sbbq %rax, %r13 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %r9 ; \ - movq %rbx, %r10 ; \ - sbbq $0x0, %r10 ; \ - movq %r11, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r11, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r11 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - movl $0x0, %eax ; \ - adcq %rbx, %rdx ; \ - adcl %eax, %eax ; \ - subq %r11, %r12 ; \ - sbbq %rdx, %r13 ; \ - sbbq %rax, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %r10 ; \ - movq %rbx, %r11 ; \ - sbbq $0x0, %r11 ; \ - movq %r12, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r12, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r12 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %rax, %r12 ; \ - movl $0x0, %eax ; \ - adcq %rbx, %rdx ; \ - adcl %eax, %eax ; \ - subq %r12, %r13 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rax, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq $0x0, %r11 ; \ - movq %rbx, %r12 ; \ - sbbq $0x0, %r12 ; \ - movq %r13, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r13, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r13 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %rax, %r13 ; \ - movl $0x0, %eax ; \ - adcq %rbx, %rdx ; \ - adcl %eax, %eax ; \ - subq %r13, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rax, %r10 ; \ - sbbq $0x0, %r11 ; \ - sbbq $0x0, %r12 ; \ - movq %rbx, %r13 ; \ - sbbq $0x0, %r13 ; \ - movq P0, %rbx ; \ - addq %r8, %r14 ; \ - adcq %r9, %r15 ; \ - adcq %r10, %rcx ; \ - adcq %r11, %rbx ; \ - adcq %r12, %rbp ; \ - adcq %r13, %rsi ; \ - movl $0x0, %r8d ; \ - adcq %r8, %r8 ; \ - xorq %r11, %r11 ; \ - xorq %r12, %r12 ; \ - xorq %r13, %r13 ; \ - movq $0xffffffff00000001, %rax ; \ - addq %r14, %rax ; \ - movl $0xffffffff, %r9d ; \ - adcq %r15, %r9 ; \ - movl $0x1, %r10d ; \ - adcq %rcx, %r10 ; \ - adcq %rbx, %r11 ; \ - adcq %rbp, %r12 ; \ - adcq %rsi, %r13 ; \ - adcq $0x0, %r8 ; \ - cmovneq %rax, %r14 ; \ - cmovneq %r9, %r15 ; \ - cmovneq %r10, %rcx ; \ - cmovneq %r11, %rbx ; \ - cmovneq %r12, %rbp ; \ - cmovneq %r13, %rsi ; \ - movq %r14, P0 ; \ - movq %r15, 0x8+P0 ; \ - movq %rcx, 0x10+P0 ; \ - movq %rbx, 0x18+P0 ; \ - movq %rbp, 0x20+P0 ; \ - movq %rsi, 0x28+P0 - -// Corresponds exactly to bignum_sub_p384 - -#define sub_p384(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rdx ; \ - sbbq 0x8+P2, %rdx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq 0x20+P1, %r10 ; \ - sbbq 0x20+P2, %r10 ; \ - movq 0x28+P1, %r11 ; \ - sbbq 0x28+P2, %r11 ; \ - sbbq %rcx, %rcx ; \ - movl $0xffffffff, %esi ; \ - andq %rsi, %rcx ; \ - xorq %rsi, %rsi ; \ - subq %rcx, %rsi ; \ - subq %rsi, %rax ; \ - movq %rax, P0 ; \ - sbbq %rcx, %rdx ; \ - movq %rdx, 0x8+P0 ; \ - sbbq %rax, %rax ; \ - andq %rsi, %rcx ; \ - negq %rax; \ - sbbq %rcx, %r8 ; \ - movq %r8, 0x10+P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x18+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x20+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x28+P0 - -// Additional macros to help with final multiplexing - -#define load6(r0,r1,r2,r3,r4,r5,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 ; \ - movq 32+P, r4 ; \ - movq 40+P, r5 - -#define store6(P,r0,r1,r2,r3,r4,r5) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P ; \ - movq r4, 32+P ; \ - movq r5, 40+P ; \ - -#define czload6(r0,r1,r2,r3,r4,r5,P) \ - cmovzq P, r0 ; \ - cmovzq 8+P, r1 ; \ - cmovzq 16+P, r2 ; \ - cmovzq 24+P, r3 ; \ - cmovzq 32+P, r4 ; \ - cmovzq 40+P, r5 - -#define muxload6(r0,r1,r2,r3,r4,r5,P0,P1,P2) \ - movq P0, r0 ; \ - cmovbq P1, r0 ; \ - cmovnbe P2, r0 ; \ - movq 8+P0, r1 ; \ - cmovbq 8+P1, r1 ; \ - cmovnbe 8+P2, r1 ; \ - movq 16+P0, r2 ; \ - cmovbq 16+P1, r2 ; \ - cmovnbe 16+P2, r2 ; \ - movq 24+P0, r3 ; \ - cmovbq 24+P1, r3 ; \ - cmovnbe 24+P2, r3 ; \ - movq 32+P0, r4 ; \ - cmovbq 32+P1, r4 ; \ - cmovnbe 32+P2, r4 ; \ - movq 40+P0, r5 ; \ - cmovbq 40+P1, r5 ; \ - cmovnbe 40+P2, r5 - -S2N_BN_SYMBOL(p384_montjadd_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input arguments in non-volatile places on the stack - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rsi, input_x - movq %rdx, input_y - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - montsqr_p384(z1sq,z_1) - movq input_y, %rsi - montsqr_p384(z2sq,z_2_alt) - - movq input_x, %rsi - movq input_y, %rcx - montmul_p384(y1a,z_2,y_1) - movq input_x, %rsi - movq input_y, %rcx - montmul_p384(y2a,z_1,y_2) - - movq input_y, %rcx - montmul_p384(x2a,z1sq,x_2) - movq input_x, %rsi - montmul_p384(x1a,z2sq,x_1) - montmul_p384(y2a,z1sq,y2a) - montmul_p384(y1a,z2sq,y1a) - - sub_p384(xd,x2a,x1a) - sub_p384(yd,y2a,y1a) - - montsqr_p384(zz,xd) - montsqr_p384(ww,yd) - - montmul_p384(zzx1,zz,x1a) - montmul_p384(zzx2,zz,x2a) - - sub_p384(resx,ww,zzx1) - sub_p384(t1,zzx2,zzx1) - - movq input_x, %rsi - montmul_p384(xd,xd,z_1) - - sub_p384(resx,resx,zzx2) - - sub_p384(t2,zzx1,resx) - - montmul_p384(t1,t1,y1a) - - movq input_y, %rcx - montmul_p384(resz,xd,z_2) - montmul_p384(t2,yd,t2) - - sub_p384(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "NBE" <=> ~(CF \/ ZF) <=> P1 = 0 /\ ~(P2 = 0) -// and "B" <=> CF <=> ~(P1 = 0) /\ P2 = 0 -// and "Z" <=> ZF <=> (P1 = 0 <=> P2 = 0) -// Multiplex the z outputs accordingly and re-store in resz - - movq input_y, %rcx - load6(%r8,%r9,%r10,%r11,%rbx,%rbp,z_2) - movq %r8, %rax - movq %r9, %rdx - orq %r10, %rax - orq %r11, %rdx - orq %rbx, %rax - orq %rbp, %rdx - orq %rdx, %rax - negq %rax - sbbq %rax, %rax - - movq input_x, %rsi - load6(%r12,%r13,%r14,%r15,%rdx,%rcx,z_1) - cmovzq %r12, %r8 - cmovzq %r13, %r9 - cmovzq %r14, %r10 - cmovzq %r15, %r11 - cmovzq %rdx, %rbx - cmovzq %rcx, %rbp - orq %r13, %r12 - orq %r15, %r14 - orq %rcx, %rdx - orq %r14, %r12 - orq %r12, %rdx - negq %rdx - sbbq %rdx, %rdx - - cmpq %rdx, %rax - - czload6(%r8,%r9,%r10,%r11,%rbx,%rbp,resz) - store6(resz,%r8,%r9,%r10,%r11,%rbx,%rbp) - -// Multiplex the x and y outputs too, keeping the results in registers - - movq input_y, %rcx - movq input_x, %rsi - muxload6(%r8,%r9,%r10,%r11,%rbx,%rbp,resx,x_1,x_2) - muxload6(%r12,%r13,%r14,%r15,%rdx,%rax,resy,y_1,y_2) - -// Finally store back the multiplexed values - - store6(x_3,%r8,%r9,%r10,%r11,%rbx,%rbp) - load6(%r8,%r9,%r10,%r11,%rbx,%rbp,resz) - store6(y_3,%r12,%r13,%r14,%r15,%rdx,%rax) - store6(z_3,%r8,%r9,%r10,%r11,%rbx,%rbp) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p384_montjadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjmixadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjmixadd.S deleted file mode 100644 index c42c8357f37..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjmixadd.S +++ /dev/null @@ -1,1010 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on NIST curve P-384 in Montgomery-Jacobian coordinates -// -// extern void p384_montjmixadd(uint64_t p3[static 18], -// const uint64_t p1[static 18], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^384 * x) mod p_384. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p384_montjmixadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p384_montjmixadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p384_montjmixadd) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 48 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rcx = p2, -// which needs to be set up explicitly before use. -// However the %rdi value never changes. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rcx) -#define y_2 NUMSIZE(%rcx) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define zp2 (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -// Temporaries for the actual input pointers - -#define input_x (NUMSIZE*6)(%rsp) -#define input_y (NUMSIZE*6+8)(%rsp) - -#define NSPACE 304 - -// Corresponds exactly to bignum_montmul_p384 - -#define montmul_p384(P0,P1,P2) \ - movq P2, %rdx ; \ - xorl %r15d, %r15d ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rbx, %r10 ; \ - addq %rbx, %r9 ; \ - mulxq 0x10+P1, %rbx, %r11 ; \ - adcq %rbx, %r10 ; \ - mulxq 0x18+P1, %rbx, %r12 ; \ - adcq %rbx, %r11 ; \ - mulxq 0x20+P1, %rbx, %r13 ; \ - adcq %rbx, %r12 ; \ - mulxq 0x28+P1, %rbx, %r14 ; \ - adcq %rbx, %r13 ; \ - adcq %r15, %r14 ; \ - movq %r8, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r8, %rdx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rbx, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %r8, %rbx ; \ - adcq %r8, %rax ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbp, %r11 ; \ - sbbq $0x0, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %rdx ; \ - addq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x8+P2, %rdx ; \ - xorl %r8d, %r8d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - adoxq %r8, %r15 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcq %rax, %r14 ; \ - adcq %rbx, %r15 ; \ - adcq %r8, %r8 ; \ - movq %r9, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r9, %rdx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rbx, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %r9, %rbx ; \ - adcq %r9, %rax ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r10 ; \ - sbbq %rbx, %r11 ; \ - sbbq %rbp, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %r14 ; \ - sbbq $0x0, %rdx ; \ - addq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x10+P2, %rdx ; \ - xorl %r9d, %r9d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adoxq %r9, %r8 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcq %rax, %r15 ; \ - adcq %rbx, %r8 ; \ - adcq %r9, %r9 ; \ - movq %r10, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r10, %rdx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rbx, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %r10, %rbx ; \ - adcq %r10, %rax ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r11 ; \ - sbbq %rbx, %r12 ; \ - sbbq %rbp, %r13 ; \ - sbbq $0x0, %r14 ; \ - sbbq $0x0, %r15 ; \ - sbbq $0x0, %rdx ; \ - addq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x18+P2, %rdx ; \ - xorl %r10d, %r10d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - adoxq %r10, %r9 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %r10, %r10 ; \ - movq %r11, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r11, %rdx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rbx, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %r11, %rbx ; \ - adcq %r11, %rax ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r12 ; \ - sbbq %rbx, %r13 ; \ - sbbq %rbp, %r14 ; \ - sbbq $0x0, %r15 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %rdx ; \ - addq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x20+P2, %rdx ; \ - xorl %r11d, %r11d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - adoxq %r11, %r10 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcq %rax, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %r11, %r11 ; \ - movq %r12, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r12, %rdx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rbx, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %r12, %rbx ; \ - adcq %r12, %rax ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r13 ; \ - sbbq %rbx, %r14 ; \ - sbbq %rbp, %r15 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %rdx ; \ - addq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x28+P2, %rdx ; \ - xorl %r12d, %r12d ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - adoxq %r12, %r11 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcq %rax, %r10 ; \ - adcq %rbx, %r11 ; \ - adcq %r12, %r12 ; \ - movq %r13, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r13, %rdx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %rbx, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %r13, %rbx ; \ - adcq %r13, %rax ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r14 ; \ - sbbq %rbx, %r15 ; \ - sbbq %rbp, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq $0x0, %rdx ; \ - addq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorl %edx, %edx ; \ - xorl %ebp, %ebp ; \ - xorl %r13d, %r13d ; \ - movq $0xffffffff00000001, %rax ; \ - addq %r14, %rax ; \ - movl $0xffffffff, %ebx ; \ - adcq %r15, %rbx ; \ - movl $0x1, %ecx ; \ - adcq %r8, %rcx ; \ - adcq %r9, %rdx ; \ - adcq %r10, %rbp ; \ - adcq %r11, %r13 ; \ - adcq $0x0, %r12 ; \ - cmovne %rax, %r14 ; \ - cmovne %rbx, %r15 ; \ - cmovne %rcx, %r8 ; \ - cmovne %rdx, %r9 ; \ - cmovne %rbp, %r10 ; \ - cmovne %r13, %r11 ; \ - movq %r14, P0 ; \ - movq %r15, 0x8+P0 ; \ - movq %r8, 0x10+P0 ; \ - movq %r9, 0x18+P0 ; \ - movq %r10, 0x20+P0 ; \ - movq %r11, 0x28+P0 - -// Corresponds exactly to bignum_montsqr_p384 - -#define montsqr_p384(P0,P1) \ - movq P1, %rdx ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - mulxq 0x28+P1, %r13, %r14 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x20+P1, %r15, %rcx ; \ - xorl %ebp, %ebp ; \ - movq 0x10+P1, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x8+P1, %rdx ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adcxq %rbp, %r15 ; \ - adoxq %rbp, %rcx ; \ - adcq %rbp, %rcx ; \ - xorl %ebp, %ebp ; \ - movq 0x20+P1, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x28+P1, %rax, %rdx ; \ - adcxq %rax, %r15 ; \ - adoxq %rdx, %rcx ; \ - movq 0x28+P1, %rdx ; \ - mulxq 0x20+P1, %rbx, %rbp ; \ - mulxq 0x18+P1, %rax, %rdx ; \ - adcxq %rax, %rcx ; \ - adoxq %rdx, %rbx ; \ - movl $0x0, %eax ; \ - adcxq %rax, %rbx ; \ - adoxq %rax, %rbp ; \ - adcq %rax, %rbp ; \ - xorq %rax, %rax ; \ - movq P1, %rdx ; \ - mulxq P1, %r8, %rax ; \ - adcxq %r9, %r9 ; \ - adoxq %rax, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %r15, %r15 ; \ - adoxq %rdx, %r15 ; \ - movq 0x20+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %rcx, %rcx ; \ - adoxq %rax, %rcx ; \ - adcxq %rbx, %rbx ; \ - adoxq %rdx, %rbx ; \ - movq 0x28+P1, %rdx ; \ - mulxq %rdx, %rax, %rsi ; \ - adcxq %rbp, %rbp ; \ - adoxq %rax, %rbp ; \ - movl $0x0, %eax ; \ - adcxq %rax, %rsi ; \ - adoxq %rax, %rsi ; \ - movq %rbx, P0 ; \ - movq %r8, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r8, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r8, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r8 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r8 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r9 ; \ - sbbq %r8, %r10 ; \ - sbbq %rbx, %r11 ; \ - sbbq $0x0, %r12 ; \ - sbbq $0x0, %r13 ; \ - movq %rdx, %r8 ; \ - sbbq $0x0, %r8 ; \ - movq %r9, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r9, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r9, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r9 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r9 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r10 ; \ - sbbq %r9, %r11 ; \ - sbbq %rbx, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %r8 ; \ - movq %rdx, %r9 ; \ - sbbq $0x0, %r9 ; \ - movq %r10, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r10, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r10, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r10 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r10 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r11 ; \ - sbbq %r10, %r12 ; \ - sbbq %rbx, %r13 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %r9 ; \ - movq %rdx, %r10 ; \ - sbbq $0x0, %r10 ; \ - movq %r11, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r11, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r11, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r11 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r11 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r12 ; \ - sbbq %r11, %r13 ; \ - sbbq %rbx, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %r10 ; \ - movq %rdx, %r11 ; \ - sbbq $0x0, %r11 ; \ - movq %r12, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r12, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r12, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r12 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r12 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r13 ; \ - sbbq %r12, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq $0x0, %r11 ; \ - movq %rdx, %r12 ; \ - sbbq $0x0, %r12 ; \ - movq %r13, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r13, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r13, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r13 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r13 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r8 ; \ - sbbq %r13, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq $0x0, %r11 ; \ - sbbq $0x0, %r12 ; \ - movq %rdx, %r13 ; \ - sbbq $0x0, %r13 ; \ - movq P0, %rbx ; \ - addq %r8, %r14 ; \ - adcq %r9, %r15 ; \ - adcq %r10, %rcx ; \ - adcq %r11, %rbx ; \ - adcq %r12, %rbp ; \ - adcq %r13, %rsi ; \ - movl $0x0, %r8d ; \ - adcq %r8, %r8 ; \ - xorq %r11, %r11 ; \ - xorq %r12, %r12 ; \ - xorq %r13, %r13 ; \ - movq $0xffffffff00000001, %rax ; \ - addq %r14, %rax ; \ - movl $0xffffffff, %r9d ; \ - adcq %r15, %r9 ; \ - movl $0x1, %r10d ; \ - adcq %rcx, %r10 ; \ - adcq %rbx, %r11 ; \ - adcq %rbp, %r12 ; \ - adcq %rsi, %r13 ; \ - adcq $0x0, %r8 ; \ - cmovne %rax, %r14 ; \ - cmovne %r9, %r15 ; \ - cmovne %r10, %rcx ; \ - cmovne %r11, %rbx ; \ - cmovne %r12, %rbp ; \ - cmovne %r13, %rsi ; \ - movq %r14, P0 ; \ - movq %r15, 0x8+P0 ; \ - movq %rcx, 0x10+P0 ; \ - movq %rbx, 0x18+P0 ; \ - movq %rbp, 0x20+P0 ; \ - movq %rsi, 0x28+P0 - -// Almost-Montgomery variant which we use when an input to other muls -// with the other argument fully reduced (which is always safe). - -#define amontsqr_p384(P0,P1) \ - movq P1, %rdx ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - mulxq 0x28+P1, %r13, %r14 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x20+P1, %r15, %rcx ; \ - xorl %ebp, %ebp ; \ - movq 0x10+P1, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x8+P1, %rdx ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - adcxq %rbp, %r15 ; \ - adoxq %rbp, %rcx ; \ - adcq %rbp, %rcx ; \ - xorl %ebp, %ebp ; \ - movq 0x20+P1, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x28+P1, %rax, %rdx ; \ - adcxq %rax, %r15 ; \ - adoxq %rdx, %rcx ; \ - movq 0x28+P1, %rdx ; \ - mulxq 0x20+P1, %rbx, %rbp ; \ - mulxq 0x18+P1, %rax, %rdx ; \ - adcxq %rax, %rcx ; \ - adoxq %rdx, %rbx ; \ - movl $0x0, %eax ; \ - adcxq %rax, %rbx ; \ - adoxq %rax, %rbp ; \ - adcq %rax, %rbp ; \ - xorq %rax, %rax ; \ - movq P1, %rdx ; \ - mulxq P1, %r8, %rax ; \ - adcxq %r9, %r9 ; \ - adoxq %rax, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %r15, %r15 ; \ - adoxq %rdx, %r15 ; \ - movq 0x20+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %rcx, %rcx ; \ - adoxq %rax, %rcx ; \ - adcxq %rbx, %rbx ; \ - adoxq %rdx, %rbx ; \ - movq 0x28+P1, %rdx ; \ - mulxq %rdx, %rax, %rsi ; \ - adcxq %rbp, %rbp ; \ - adoxq %rax, %rbp ; \ - movl $0x0, %eax ; \ - adcxq %rax, %rsi ; \ - adoxq %rax, %rsi ; \ - movq %rbx, P0 ; \ - movq %r8, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r8, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r8, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r8 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r8 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r9 ; \ - sbbq %r8, %r10 ; \ - sbbq %rbx, %r11 ; \ - sbbq $0x0, %r12 ; \ - sbbq $0x0, %r13 ; \ - movq %rdx, %r8 ; \ - sbbq $0x0, %r8 ; \ - movq %r9, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r9, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r9, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r9 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r9 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r10 ; \ - sbbq %r9, %r11 ; \ - sbbq %rbx, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %r8 ; \ - movq %rdx, %r9 ; \ - sbbq $0x0, %r9 ; \ - movq %r10, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r10, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r10, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r10 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r10 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r11 ; \ - sbbq %r10, %r12 ; \ - sbbq %rbx, %r13 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %r9 ; \ - movq %rdx, %r10 ; \ - sbbq $0x0, %r10 ; \ - movq %r11, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r11, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r11, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r11 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r11 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r12 ; \ - sbbq %r11, %r13 ; \ - sbbq %rbx, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %r10 ; \ - movq %rdx, %r11 ; \ - sbbq $0x0, %r11 ; \ - movq %r12, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r12, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r12, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r12 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r12 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r13 ; \ - sbbq %r12, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq $0x0, %r11 ; \ - movq %rdx, %r12 ; \ - sbbq $0x0, %r12 ; \ - movq %r13, %rdx ; \ - shlq $0x20, %rdx ; \ - addq %r13, %rdx ; \ - movq $0xffffffff00000001, %rax ; \ - mulxq %rax, %r13, %rax ; \ - movl $0xffffffff, %ebx ; \ - mulxq %rbx, %rbx, %r13 ; \ - addq %rbx, %rax ; \ - adcq %rdx, %r13 ; \ - movl $0x0, %ebx ; \ - adcq %rbx, %rbx ; \ - subq %rax, %r8 ; \ - sbbq %r13, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq $0x0, %r11 ; \ - sbbq $0x0, %r12 ; \ - movq %rdx, %r13 ; \ - sbbq $0x0, %r13 ; \ - movq P0, %rbx ; \ - addq %r8, %r14 ; \ - adcq %r9, %r15 ; \ - adcq %r10, %rcx ; \ - adcq %r11, %rbx ; \ - adcq %r12, %rbp ; \ - adcq %r13, %rsi ; \ - movl $0x0, %r8d ; \ - movq $0xffffffff00000001, %rax ; \ - movl $0xffffffff, %r9d ; \ - movl $0x1, %r10d ; \ - cmovnc %r8, %rax ; \ - cmovnc %r8, %r9 ; \ - cmovnc %r8, %r10 ; \ - addq %rax, %r14 ; \ - adcq %r9, %r15 ; \ - adcq %r10, %rcx ; \ - adcq %r8, %rbx ; \ - adcq %r8, %rbp ; \ - adcq %r8, %rsi ; \ - movq %r14, P0 ; \ - movq %r15, 0x8+P0 ; \ - movq %rcx, 0x10+P0 ; \ - movq %rbx, 0x18+P0 ; \ - movq %rbp, 0x20+P0 ; \ - movq %rsi, 0x28+P0 - -// Corresponds exactly to bignum_sub_p384 - -#define sub_p384(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rdx ; \ - sbbq 0x8+P2, %rdx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq 0x20+P1, %r10 ; \ - sbbq 0x20+P2, %r10 ; \ - movq 0x28+P1, %r11 ; \ - sbbq 0x28+P2, %r11 ; \ - sbbq %rcx, %rcx ; \ - movl $0xffffffff, %esi ; \ - andq %rsi, %rcx ; \ - xorq %rsi, %rsi ; \ - subq %rcx, %rsi ; \ - subq %rsi, %rax ; \ - movq %rax, P0 ; \ - sbbq %rcx, %rdx ; \ - movq %rdx, 0x8+P0 ; \ - sbbq %rax, %rax ; \ - andq %rsi, %rcx ; \ - negq %rax; \ - sbbq %rcx, %r8 ; \ - movq %r8, 0x10+P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x18+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x20+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x28+P0 - -// Additional macros to help with final multiplexing - -#define testzero6(P) \ - movq P, %rax ; \ - movq 8+P, %rdx ; \ - orq 16+P, %rax ; \ - orq 24+P, %rdx ; \ - orq 32+P, %rax ; \ - orq 40+P, %rdx ; \ - orq %rdx, %rax - -#define mux6(r0,r1,r2,r3,r4,r5,PNE,PEQ) \ - movq PEQ, %rax ; \ - movq PNE, r0 ; \ - cmovzq %rax, r0 ; \ - movq 8+PEQ, %rax ; \ - movq 8+PNE, r1 ; \ - cmovzq %rax, r1 ; \ - movq 16+PEQ, %rax ; \ - movq 16+PNE, r2 ; \ - cmovzq %rax, r2 ; \ - movq 24+PEQ, %rax ; \ - movq 24+PNE, r3 ; \ - cmovzq %rax, r3 ; \ - movq 32+PEQ, %rax ; \ - movq 32+PNE, r4 ; \ - cmovzq %rax, r4 ; \ - movq 40+PEQ, %rax ; \ - movq 40+PNE, r5 ; \ - cmovzq %rax, r5 - -#define load6(r0,r1,r2,r3,r4,r5,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 ; \ - movq 32+P, r4 ; \ - movq 40+P, r5 - -#define store6(P,r0,r1,r2,r3,r4,r5) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P ; \ - movq r4, 32+P ; \ - movq r5, 40+P - -S2N_BN_SYMBOL(p384_montjmixadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input arguments in non-volatile places on the stack - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rsi, input_x - movq %rdx, input_y - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - amontsqr_p384(zp2,z_1) - - movq input_x, %rsi - movq input_y, %rcx - montmul_p384(y2a,z_1,y_2) - - movq input_y, %rcx - montmul_p384(x2a,zp2,x_2) - - montmul_p384(y2a,zp2,y2a) - - movq input_x, %rsi - sub_p384(xd,x2a,x_1) - movq input_x, %rsi - sub_p384(yd,y2a,y_1) - - amontsqr_p384(zz,xd) - montsqr_p384(ww,yd) - - movq input_x, %rsi - montmul_p384(zzx1,zz,x_1) - montmul_p384(zzx2,zz,x2a) - - sub_p384(resx,ww,zzx1) - sub_p384(t1,zzx2,zzx1) - - movq input_x, %rsi - montmul_p384(resz,xd,z_1) - - sub_p384(resx,resx,zzx2) - - sub_p384(t2,zzx1,resx) - - movq input_x, %rsi - montmul_p384(t1,t1,y_1) - montmul_p384(t2,yd,t2) - - sub_p384(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - movq input_x, %rsi - testzero6(z_1) - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with a z = 1 coordinate (in -// Montgomery form so not the simple constant 1 but rather 2^384 - p_384), -// hence giving 0 + p2 = p2 for the final result. - - movq input_y, %rcx - mux6(%r8,%r9,%r10,%r11,%rbx,%rbp,resx,x_2) - mux6(%r12,%r13,%r14,%r15,%rdx,%rcx,resy,y_2) - - store6(x_3,%r8,%r9,%r10,%r11,%rbx,%rbp) - store6(y_3,%r12,%r13,%r14,%r15,%rdx,%rcx) - - load6(%r8,%r9,%r10,%r11,%rbx,%rbp,resz) - movq $0xffffffff00000001, %rax - cmovzq %rax, %r8 - movl $0x00000000ffffffff, %eax - cmovzq %rax, %r9 - movq $1, %rax - cmovzq %rax, %r10 - movl $0, %eax - cmovzq %rax, %r11 - cmovzq %rax, %rbx - cmovzq %rax, %rbp - - store6(z_3,%r8,%r9,%r10,%r11,%rbx,%rbp) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p384_montjmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjmixadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjmixadd_alt.S deleted file mode 100644 index b4db521215b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p384/p384_montjmixadd_alt.S +++ /dev/null @@ -1,935 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on NIST curve P-384 in Montgomery-Jacobian coordinates -// -// extern void p384_montjmixadd_alt(uint64_t p3[static 18], -// const uint64_t p1[static 18], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^384 * x) mod p_384. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p384_montjmixadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p384_montjmixadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p384_montjmixadd_alt) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 48 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rcx = p2, -// which needs to be set up explicitly before use. -// However the %rdi value never changes. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rcx) -#define y_2 NUMSIZE(%rcx) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define zp2 (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -// Temporaries for the actual input pointers - -#define input_x (NUMSIZE*6)(%rsp) -#define input_y (NUMSIZE*6+8)(%rsp) - -#define NSPACE 304 - -// Corresponds exactly to bignum_montmul_p384_alt - -#define montmul_p384(P0,P1,P2) \ - movq P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - xorl %r10d, %r10d ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - xorl %r11d, %r11d ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - xorl %r12d, %r12d ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - xorl %r13d, %r13d ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - xorl %r14d, %r14d ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - xorl %r15d, %r15d ; \ - movq %r8, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r8, %rbx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r8 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %r8, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbp, %r11 ; \ - sbbq $0x0, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %rbx ; \ - addq %rbx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x8+P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %r8, %r8 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r8, %r8 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r8, %r8 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r8, %r8 ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r8, %r8 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %r8, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %r8, %r8 ; \ - negq %r8; \ - movq %r9, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r9, %rbx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r9 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %r9, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbp, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %r14 ; \ - sbbq $0x0, %rbx ; \ - addq %rbx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x10+P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r9, %r9 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r9, %r9 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r9, %r9 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r9, %r9 ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %r9, %r9 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %r9, %rdx ; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - sbbq %r9, %r9 ; \ - negq %r9; \ - movq %r10, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r10, %rbx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r10 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %r10, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r11 ; \ - sbbq %rdx, %r12 ; \ - sbbq %rbp, %r13 ; \ - sbbq $0x0, %r14 ; \ - sbbq $0x0, %r15 ; \ - sbbq $0x0, %rbx ; \ - addq %rbx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x18+P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %r10, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r10, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r10, %r10 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r10, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r10, %r10 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r10, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %r10, %r10 ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %r10, %rdx ; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - sbbq %r10, %r10 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %r10, %rdx ; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %r10, %r10 ; \ - negq %r10; \ - movq %r11, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r11, %rbx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r11 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %r11, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r12 ; \ - sbbq %rdx, %r13 ; \ - sbbq %rbp, %r14 ; \ - sbbq $0x0, %r15 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %rbx ; \ - addq %rbx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x20+P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r11, %r11 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r11, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r11, %r11 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r11, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %r11, %r11 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r11, %rdx ; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - sbbq %r11, %r11 ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %r11, %rdx ; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %r11, %r11 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %r11, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %r11, %r11 ; \ - negq %r11; \ - movq %r12, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r12, %rbx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r12 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %r12, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r13 ; \ - sbbq %rdx, %r14 ; \ - sbbq %rbp, %r15 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %rbx ; \ - addq %rbx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x28+P2, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %r12, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %r12, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq %rbx; \ - subq %r12, %rdx ; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - sbbq %r12, %r12 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %r12, %rdx ; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %r12, %r12 ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %r12, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %r12, %r12 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %r12, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r12, %r12 ; \ - negq %r12; \ - movq %r13, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r13, %rbx ; \ - xorl %ebp, %ebp ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r13 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %r13, %rax ; \ - adcq %rbx, %rdx ; \ - adcl %ebp, %ebp ; \ - subq %rax, %r14 ; \ - sbbq %rdx, %r15 ; \ - sbbq %rbp, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq $0x0, %rbx ; \ - addq %rbx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorl %edx, %edx ; \ - xorl %ebp, %ebp ; \ - xorl %r13d, %r13d ; \ - movq $0xffffffff00000001, %rax ; \ - addq %r14, %rax ; \ - movl $0xffffffff, %ebx ; \ - adcq %r15, %rbx ; \ - movl $0x1, %ecx ; \ - adcq %r8, %rcx ; \ - adcq %r9, %rdx ; \ - adcq %r10, %rbp ; \ - adcq %r11, %r13 ; \ - adcq $0x0, %r12 ; \ - cmovneq %rax, %r14 ; \ - cmovneq %rbx, %r15 ; \ - cmovneq %rcx, %r8 ; \ - cmovneq %rdx, %r9 ; \ - cmovneq %rbp, %r10 ; \ - cmovneq %r13, %r11 ; \ - movq %r14, P0 ; \ - movq %r15, 0x8+P0 ; \ - movq %r8, 0x10+P0 ; \ - movq %r9, 0x18+P0 ; \ - movq %r10, 0x20+P0 ; \ - movq %r11, 0x28+P0 - -// Corresponds exactly to bignum_montsqr_p384_alt - -#define montsqr_p384(P0,P1) \ - movq P1, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r9 ; \ - movq %rdx, %r10 ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r13 ; \ - movq %rdx, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x20+P1; \ - movq %rax, %r15 ; \ - movq %rdx, %rcx ; \ - movq 0x10+P1, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rbp, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rbp, %rbp ; \ - movq 0x8+P1, %rbx ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %rbp, %rbp ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %rbp, %rbp ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %rcx ; \ - movq 0x20+P1, %rbx ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %rbp, %rbp ; \ - movq 0x10+P1, %rbx ; \ - movq 0x18+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - sbbq %rbp, %rbp ; \ - movq 0x20+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %rbp, %rbp ; \ - movq 0x28+P1, %rax ; \ - mulq %rbx; \ - subq %rbp, %rdx ; \ - addq %rax, %r15 ; \ - adcq %rdx, %rcx ; \ - sbbq %rbp, %rbp ; \ - xorl %ebx, %ebx ; \ - movq 0x18+P1, %rax ; \ - mulq 0x28+P1; \ - subq %rbp, %rdx ; \ - xorl %ebp, %ebp ; \ - addq %rax, %rcx ; \ - adcq %rdx, %rbx ; \ - adcl %ebp, %ebp ; \ - movq 0x20+P1, %rax ; \ - mulq 0x28+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - xorl %r8d, %r8d ; \ - addq %r9, %r9 ; \ - adcq %r10, %r10 ; \ - adcq %r11, %r11 ; \ - adcq %r12, %r12 ; \ - adcq %r13, %r13 ; \ - adcq %r14, %r14 ; \ - adcq %r15, %r15 ; \ - adcq %rcx, %rcx ; \ - adcq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcl %r8d, %r8d ; \ - movq P1, %rax ; \ - mulq %rax; \ - movq %r8, P0 ; \ - movq %rax, %r8 ; \ - movq 0x8+P1, %rax ; \ - movq %rbp, 0x8+P0 ; \ - addq %rdx, %r9 ; \ - sbbq %rbp, %rbp ; \ - mulq %rax; \ - negq %rbp; \ - adcq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rbp, %rbp ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - negq %rbp; \ - adcq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %rbp, %rbp ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - negq %rbp; \ - adcq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - sbbq %rbp, %rbp ; \ - movq 0x20+P1, %rax ; \ - mulq %rax; \ - negq %rbp; \ - adcq %rax, %rcx ; \ - adcq %rdx, %rbx ; \ - sbbq %rbp, %rbp ; \ - movq 0x28+P1, %rax ; \ - mulq %rax; \ - negq %rbp; \ - adcq 0x8+P0, %rax ; \ - adcq P0, %rdx ; \ - movq %rax, %rbp ; \ - movq %rdx, %rsi ; \ - movq %rbx, P0 ; \ - movq %r8, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r8, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r8 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - movl $0x0, %eax ; \ - adcq %rbx, %rdx ; \ - adcl %eax, %eax ; \ - subq %r8, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rax, %r11 ; \ - sbbq $0x0, %r12 ; \ - sbbq $0x0, %r13 ; \ - movq %rbx, %r8 ; \ - sbbq $0x0, %r8 ; \ - movq %r9, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r9, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r9 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %rax, %r9 ; \ - movl $0x0, %eax ; \ - adcq %rbx, %rdx ; \ - adcl %eax, %eax ; \ - subq %r9, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rax, %r12 ; \ - sbbq $0x0, %r13 ; \ - sbbq $0x0, %r8 ; \ - movq %rbx, %r9 ; \ - sbbq $0x0, %r9 ; \ - movq %r10, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r10, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r10 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - movl $0x0, %eax ; \ - adcq %rbx, %rdx ; \ - adcl %eax, %eax ; \ - subq %r10, %r11 ; \ - sbbq %rdx, %r12 ; \ - sbbq %rax, %r13 ; \ - sbbq $0x0, %r8 ; \ - sbbq $0x0, %r9 ; \ - movq %rbx, %r10 ; \ - sbbq $0x0, %r10 ; \ - movq %r11, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r11, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r11 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %rax, %r11 ; \ - movl $0x0, %eax ; \ - adcq %rbx, %rdx ; \ - adcl %eax, %eax ; \ - subq %r11, %r12 ; \ - sbbq %rdx, %r13 ; \ - sbbq %rax, %r8 ; \ - sbbq $0x0, %r9 ; \ - sbbq $0x0, %r10 ; \ - movq %rbx, %r11 ; \ - sbbq $0x0, %r11 ; \ - movq %r12, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r12, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r12 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %rax, %r12 ; \ - movl $0x0, %eax ; \ - adcq %rbx, %rdx ; \ - adcl %eax, %eax ; \ - subq %r12, %r13 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rax, %r9 ; \ - sbbq $0x0, %r10 ; \ - sbbq $0x0, %r11 ; \ - movq %rbx, %r12 ; \ - sbbq $0x0, %r12 ; \ - movq %r13, %rbx ; \ - shlq $0x20, %rbx ; \ - addq %r13, %rbx ; \ - movq $0xffffffff00000001, %rax ; \ - mulq %rbx; \ - movq %rdx, %r13 ; \ - movq $0xffffffff, %rax ; \ - mulq %rbx; \ - addq %rax, %r13 ; \ - movl $0x0, %eax ; \ - adcq %rbx, %rdx ; \ - adcl %eax, %eax ; \ - subq %r13, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rax, %r10 ; \ - sbbq $0x0, %r11 ; \ - sbbq $0x0, %r12 ; \ - movq %rbx, %r13 ; \ - sbbq $0x0, %r13 ; \ - movq P0, %rbx ; \ - addq %r8, %r14 ; \ - adcq %r9, %r15 ; \ - adcq %r10, %rcx ; \ - adcq %r11, %rbx ; \ - adcq %r12, %rbp ; \ - adcq %r13, %rsi ; \ - movl $0x0, %r8d ; \ - adcq %r8, %r8 ; \ - xorq %r11, %r11 ; \ - xorq %r12, %r12 ; \ - xorq %r13, %r13 ; \ - movq $0xffffffff00000001, %rax ; \ - addq %r14, %rax ; \ - movl $0xffffffff, %r9d ; \ - adcq %r15, %r9 ; \ - movl $0x1, %r10d ; \ - adcq %rcx, %r10 ; \ - adcq %rbx, %r11 ; \ - adcq %rbp, %r12 ; \ - adcq %rsi, %r13 ; \ - adcq $0x0, %r8 ; \ - cmovneq %rax, %r14 ; \ - cmovneq %r9, %r15 ; \ - cmovneq %r10, %rcx ; \ - cmovneq %r11, %rbx ; \ - cmovneq %r12, %rbp ; \ - cmovneq %r13, %rsi ; \ - movq %r14, P0 ; \ - movq %r15, 0x8+P0 ; \ - movq %rcx, 0x10+P0 ; \ - movq %rbx, 0x18+P0 ; \ - movq %rbp, 0x20+P0 ; \ - movq %rsi, 0x28+P0 - -// Corresponds exactly to bignum_sub_p384 - -#define sub_p384(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rdx ; \ - sbbq 0x8+P2, %rdx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq 0x20+P1, %r10 ; \ - sbbq 0x20+P2, %r10 ; \ - movq 0x28+P1, %r11 ; \ - sbbq 0x28+P2, %r11 ; \ - sbbq %rcx, %rcx ; \ - movl $0xffffffff, %esi ; \ - andq %rsi, %rcx ; \ - xorq %rsi, %rsi ; \ - subq %rcx, %rsi ; \ - subq %rsi, %rax ; \ - movq %rax, P0 ; \ - sbbq %rcx, %rdx ; \ - movq %rdx, 0x8+P0 ; \ - sbbq %rax, %rax ; \ - andq %rsi, %rcx ; \ - negq %rax; \ - sbbq %rcx, %r8 ; \ - movq %r8, 0x10+P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x18+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x20+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x28+P0 - -// Additional macros to help with final multiplexing - -#define testzero6(P) \ - movq P, %rax ; \ - movq 8+P, %rdx ; \ - orq 16+P, %rax ; \ - orq 24+P, %rdx ; \ - orq 32+P, %rax ; \ - orq 40+P, %rdx ; \ - orq %rdx, %rax - -#define mux6(r0,r1,r2,r3,r4,r5,PNE,PEQ) \ - movq PEQ, %rax ; \ - movq PNE, r0 ; \ - cmovzq %rax, r0 ; \ - movq 8+PEQ, %rax ; \ - movq 8+PNE, r1 ; \ - cmovzq %rax, r1 ; \ - movq 16+PEQ, %rax ; \ - movq 16+PNE, r2 ; \ - cmovzq %rax, r2 ; \ - movq 24+PEQ, %rax ; \ - movq 24+PNE, r3 ; \ - cmovzq %rax, r3 ; \ - movq 32+PEQ, %rax ; \ - movq 32+PNE, r4 ; \ - cmovzq %rax, r4 ; \ - movq 40+PEQ, %rax ; \ - movq 40+PNE, r5 ; \ - cmovzq %rax, r5 - -#define load6(r0,r1,r2,r3,r4,r5,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 ; \ - movq 32+P, r4 ; \ - movq 40+P, r5 - -#define store6(P,r0,r1,r2,r3,r4,r5) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P ; \ - movq r4, 32+P ; \ - movq r5, 40+P - -S2N_BN_SYMBOL(p384_montjmixadd_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input arguments in non-volatile places on the stack - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rsi, input_x - movq %rdx, input_y - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - montsqr_p384(zp2,z_1) - - movq input_x, %rsi - movq input_y, %rcx - montmul_p384(y2a,z_1,y_2) - - movq input_y, %rcx - montmul_p384(x2a,zp2,x_2) - - montmul_p384(y2a,zp2,y2a) - - movq input_x, %rsi - sub_p384(xd,x2a,x_1) - movq input_x, %rsi - sub_p384(yd,y2a,y_1) - - montsqr_p384(zz,xd) - montsqr_p384(ww,yd) - - movq input_x, %rsi - montmul_p384(zzx1,zz,x_1) - montmul_p384(zzx2,zz,x2a) - - sub_p384(resx,ww,zzx1) - sub_p384(t1,zzx2,zzx1) - - movq input_x, %rsi - montmul_p384(resz,xd,z_1) - - sub_p384(resx,resx,zzx2) - - sub_p384(t2,zzx1,resx) - - movq input_x, %rsi - montmul_p384(t1,t1,y_1) - montmul_p384(t2,yd,t2) - - sub_p384(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - movq input_x, %rsi - testzero6(z_1) - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with a z = 1 coordinate (in -// Montgomery form so not the simple constant 1 but rather 2^384 - p_384), -// hence giving 0 + p2 = p2 for the final result. - - movq input_y, %rcx - mux6(%r8,%r9,%r10,%r11,%rbx,%rbp,resx,x_2) - mux6(%r12,%r13,%r14,%r15,%rdx,%rcx,resy,y_2) - - store6(x_3,%r8,%r9,%r10,%r11,%rbx,%rbp) - store6(y_3,%r12,%r13,%r14,%r15,%rdx,%rcx) - - load6(%r8,%r9,%r10,%r11,%rbx,%rbp,resz) - movq $0xffffffff00000001, %rax - cmovzq %rax, %r8 - movl $0x00000000ffffffff, %eax - cmovzq %rax, %r9 - movq $1, %rax - cmovzq %rax, %r10 - movl $0, %eax - cmovzq %rax, %r11 - cmovzq %rax, %rbx - cmovzq %rax, %rbp - - store6(z_3,%r8,%r9,%r10,%r11,%rbx,%rbp) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p384_montjmixadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_cmul_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_cmul_p521.S deleted file mode 100644 index 5335c032a60..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_cmul_p521.S +++ /dev/null @@ -1,176 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_521, z := (c * x) mod p_521, assuming -// x reduced -// Inputs c, x[9]; output z[9] -// -// extern void bignum_cmul_p521(uint64_t z[static 9], uint64_t c, -// const uint64_t x[static 9]); -// -// Standard x86-64 ABI: RDI = z, RSI = c, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = c, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p521) - .text - -#define z %rdi - -// Temporarily moved here for initial multiply - -#define x %rcx - -// Likewise this is thrown away after initial multiply - -#define c %rdx -#define cshort %edx - -#define a %rax -#define dd %rax - -// Digits: last one aliased to the local x pointer that's no longer needed - -#define d0 %rsi -#define d1 %r8 -#define d2 %r9 -#define d3 %r10 -#define d4 %r11 -#define d5 %rbx -#define d6 %rbp -#define d7 %r12 -#define d8 %r13 -#define d9 %rcx - -// Same as d9 - -#define h d9 - -S2N_BN_SYMBOL(bignum_cmul_p521): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save additional registers to use - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - -// Shuffle inputs (since we want the multiplier in %rdx) - - movq %rdx, x - movq %rsi, c - -// Multiply as [d9; ...; d0] = c * x. - - mulxq (x), d0, d1 - mulxq 8(x), a, d2 - addq a, d1 - mulxq 16(x), a, d3 - adcq a, d2 - mulxq 24(x), a, d4 - adcq a, d3 - mulxq 32(x), a, d5 - adcq a, d4 - mulxq 40(x), a, d6 - adcq a, d5 - mulxq 48(x), a, d7 - adcq a, d6 - mulxq 56(x), a, d8 - adcq a, d7 - mulxq 64(x), a, d9 - adcq a, d8 - adcq $0, d9 - -// Create an AND "dd" of digits d7,...,d1, a computation we hope will -// get nicely interleaved with the multiplication chain above. -// From the point of view of architectural dependencies we have to -// bunch it up here since AND destroys the flags and we overwrite the -// register used as a stage temporary variable for the multiplications. - - movq d1, dd - andq d2, dd - andq d3, dd - andq d4, dd - andq d5, dd - andq d6, dd - andq d7, dd - -// Extract the high part h==d9 and mask off the low part l = [d8;d7;...;d0] -// but stuff d8 with 1 bits at the left to ease a comparison below - - shldq $55, d8, h - orq $~0x1FF, d8 - -// Decide whether h + l >= p_521 <=> h + l + 1 >= 2^521. Since this can only -// happen if digits d7,...d1 are all 1s, we use the AND of them "dd" to -// condense the carry chain, and since we stuffed 1 bits into d8 we get -// the result in CF without an additional comparison. Hereafter we use c = 0. -// Since x was assumed reduced, h cannot be maximal, so the "lea" is safe, -// i.e. does not carry or wrap round. - - leaq 1(h), c - addq d0, c - movl $0, cshort - adcq c, dd - movq d8, a - adcq c, a - -// Now if CF is set we want (h + l) - p_521 = (h + l + 1) - 2^521 -// while otherwise we want just h + l. So mask h + l + CF to 521 bits. -// This masking also gets rid of the stuffing with 1s we did above. -// Write back the digits as they are generated. - - adcq h, d0 - movq d0, (z) - adcq c, d1 - movq d1, 8(z) - adcq c, d2 - movq d2, 16(z) - adcq c, d3 - movq d3, 24(z) - adcq c, d4 - movq d4, 32(z) - adcq c, d5 - movq d5, 40(z) - adcq c, d6 - movq d6, 48(z) - adcq c, d7 - movq d7, 56(z) - adcq c, d8 - andq $0x1FF, d8 - movq d8, 64(z) - -// Restore registers and return - - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_cmul_p521_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_cmul_p521_alt.S deleted file mode 100644 index 6e251e7efe6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_cmul_p521_alt.S +++ /dev/null @@ -1,210 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_521, z := (c * x) mod p_521, assuming -// x reduced -// Inputs c, x[9]; output z[9] -// -// extern void bignum_cmul_p521_alt(uint64_t z[static 9], uint64_t c, -// const uint64_t x[static 9]); -// -// Standard x86-64 ABI: RDI = z, RSI = c, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = c, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p521_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p521_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p521_alt) - .text - -#define z %rdi - -// Temporarily moved here for initial multiply - -#define x %rcx - -// Likewise this is thrown away after initial multiply - -#define m %rsi - -#define c %rdx -#define cshort %edx - -#define a %rax -#define d %rdx - -#define dd %rax - -// Digits: last ones aliased to inputs that are no longer used then - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 -#define d4 %rbx -#define d5 %rbp -#define d6 %r12 -#define d7 %r13 -#define d8 %rcx -#define d9 %rsi - -// Same as d9 - -#define h d9 - -S2N_BN_SYMBOL(bignum_cmul_p521_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save additional registers to use - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - -// Shuffle inputs (since we want %rdx for the high parts of products) - - movq %rdx, x - -// Multiply as [d9; ...; d0] = c * x. - - movq (x), a - mulq m - movq a, d0 - movq d, d1 - - movq 8(x), a - mulq m - xorq d2, d2 - addq a, d1 - adcq d, d2 - - movq 16(x), a - mulq m - xorq d3, d3 - addq a, d2 - adcq d, d3 - - movq 24(x), a - mulq m - xorq d4, d4 - addq a, d3 - adcq d, d4 - - movq 32(x), a - mulq m - xorq d5, d5 - addq a, d4 - adcq d, d5 - - movq 40(x), a - mulq m - xorq d6, d6 - addq a, d5 - adcq d, d6 - - movq 48(x), a - mulq m - xorq d7, d7 - addq a, d6 - adcq d, d7 - - movq 56(x), a - mulq m - addq a, d7 - movq 64(x), a - movq $0, d8 - adcq d, d8 - mulq m - xorq d9, d9 - addq a, d8 - adcq d, d9 - -// Create an AND "dd" of digits d7,...,d1, a computation we hope will -// get nicely interleaved with the multiplication chain above, though -// we can't do so directly as we are using the same register %rax. - - movq d1, dd - andq d2, dd - andq d3, dd - andq d4, dd - andq d5, dd - andq d6, dd - andq d7, dd - -// Extract the high part h==d9 and mask off the low part l = [d8;d7;...;d0] -// but stuff d8 with 1 bits at the left to ease a comparison below - - shldq $55, d8, h - orq $~0x1FF, d8 - -// Decide whether h + l >= p_521 <=> h + l + 1 >= 2^521. Since this can only -// happen if digits d7,...d1 are all 1s, we use the AND of them "dd" to -// condense the carry chain, and since we stuffed 1 bits into d8 we get -// the result in CF without an additional comparison. Hereafter we use c = 0. -// Since x was assumed reduced, h cannot be maximal, so the "lea" is safe, -// i.e. does not carry or wrap round. - - leaq 1(h), c - addq d0, c - movl $0, cshort - adcq c, dd - movq d8, a - adcq c, a - -// Now if CF is set we want (h + l) - p_521 = (h + l + 1) - 2^521 -// while otherwise we want just h + l. So mask h + l + CF to 521 bits. -// This masking also gets rid of the stuffing with 1s we did above. -// Write back the digits as they are generated. - - adcq h, d0 - movq d0, (z) - adcq c, d1 - movq d1, 8(z) - adcq c, d2 - movq d2, 16(z) - adcq c, d3 - movq d3, 24(z) - adcq c, d4 - movq d4, 32(z) - adcq c, d5 - movq d5, 40(z) - adcq c, d6 - movq d6, 48(z) - adcq c, d7 - movq d7, 56(z) - adcq c, d8 - andq $0x1FF, d8 - movq d8, 64(z) - -// Restore registers and return - - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p521_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_deamont_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_deamont_p521.S deleted file mode 100644 index f9643f5c40d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_deamont_p521.S +++ /dev/null @@ -1,147 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^576) mod p_521 -// Input x[9]; output z[9] -// -// extern void bignum_deamont_p521(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Convert a 9-digit bignum x out of its (optionally almost) Montgomery form, -// "almost" meaning any 9-digit input will work, with no range restriction. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_deamont_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_deamont_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_deamont_p521) - .text - -#define z %rdi -#define x %rsi - -#define c %rax -#define h %rax -#define l %rbx - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 -#define d4 %r10 -#define d5 %r11 -#define d6 %r12 -#define d7 %r13 -#define d8 %rbp - -S2N_BN_SYMBOL(bignum_deamont_p521): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%rbp) - -// Stash the lowest 55 bits at the top of c, then shift the whole 576-bit -// input right by 9*64 - 521 = 576 - 521 = 55 bits. - - movq (x), d0 - movq d0, c - shlq $9, c - movq 8(x), d1 - shrdq $55, d1, d0 - movq 16(x), d2 - shrdq $55, d2, d1 - movq 24(x), d3 - shrdq $55, d3, d2 - movq 32(x), d4 - shrdq $55, d4, d3 - movq 40(x), d5 - shrdq $55, d5, d4 - movq 48(x), d6 - shrdq $55, d6, d5 - movq 56(x), d7 - shrdq $55, d7, d6 - movq 64(x), d8 - shrdq $55, d8, d7 - shrq $55, d8 - -// Now writing x = 2^55 * h + l (so here [d8;..d0] = h and c = 2^9 * l) -// we want (h + 2^{521-55} * l) mod p_521 = s mod p_521. Since s < 2 * p_521 -// this is just "if s >= p_521 then s - p_521 else s". First get -// s + 1, but pad up the top to get a top-bit carry-out from it, so now -// CF <=> s + 1 >= 2^521 <=> s >= p_521, while the digits [d8;...d0] are -// now s + 1 except for bits above 521. - - movq c, l - shrq $55, h - shlq $9, l - orq $~0x1FF, d8 - addq $1, d0 - adcq $0, d1 - adcq $0, d2 - adcq $0, d3 - adcq $0, d4 - adcq $0, d5 - adcq $0, d6 - adcq l, d7 - adcq h, d8 - -// We want "if CF then (s + 1) - 2^521 else (s + 1) - 1" so subtract ~CF -// and mask to 521 bits, writing digits back as they are created. - - cmc - sbbq $0, d0 - movq d0, (z) - sbbq $0, d1 - movq d1, 8(z) - sbbq $0, d2 - movq d2, 16(z) - sbbq $0, d3 - movq d3, 24(z) - sbbq $0, d4 - movq d4, 32(z) - sbbq $0, d5 - movq d5, 40(z) - sbbq $0, d6 - movq d6, 48(z) - sbbq $0, d7 - movq d7, 56(z) - sbbq $0, d8 - andq $0x1FF, d8 - movq d8, 64(z) - -// Restore registers and return - - CFI_POP(%rbp) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_deamont_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_demont_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_demont_p521.S deleted file mode 100644 index 4a73114af02..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_demont_p521.S +++ /dev/null @@ -1,96 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^576) mod p_521, assuming x reduced -// Input x[9]; output z[9] -// -// extern void bignum_demont_p521(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// This assumes the input is < p_521 for correctness. If this is not the case, -// use the variant "bignum_deamont_p521" instead. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_p521) - .text - -#define z %rdi -#define x %rsi - -// Rotating (aliased) registers for the digits - -#define c %rax -#define d0 %rdx -#define d1 %rcx - -#define d2 %rdx -#define d3 %rcx -#define d4 %rdx -#define d5 %rcx -#define d6 %rdx -#define d7 %rcx -#define d8 %rdx - -S2N_BN_SYMBOL(bignum_demont_p521): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Rotate, as a 521-bit quantity, by 9*64 - 521 = 55 bits right. - - movq (x), d0 - movq d0, c - movq 8(x), d1 - shrdq $55, d1, d0 - movq d0, (z) - movq 16(x), d2 - shrdq $55, d2, d1 - movq d1, 8(z) - movq 24(x), d3 - shrdq $55, d3, d2 - shlq $9, c - movq d2, 16(z) - movq 32(x), d4 - shrdq $55, d4, d3 - movq d3, 24(z) - movq 40(x), d5 - shrdq $55, d5, d4 - movq d4, 32(z) - movq 48(x), d6 - shrdq $55, d6, d5 - movq d5, 40(z) - movq 56(x), d7 - shrdq $55, d7, d6 - movq d6, 48(z) - movq 64(x), d8 - orq c, d8 - shrdq $55, d8, d7 - movq d7, 56(z) - shrq $55, d8 - movq d8, 64(z) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_double_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_double_p521.S deleted file mode 100644 index 5d39dcb2c37..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_double_p521.S +++ /dev/null @@ -1,98 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo p_521, z := (2 * x) mod p_521, assuming x reduced -// Input x[9]; output z[9] -// -// extern void bignum_double_p521(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_double_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_double_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_double_p521) - .text - -#define z %rdi -#define x %rsi - -#define a %rax -#define c %rcx - - - -S2N_BN_SYMBOL(bignum_double_p521): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// We can decide whether 2 * x >= p_521 just by 2 * x >= 2^521, which -// as we assume x < p_521 amounts to looking at bit 8 of the top word - - movq 64(x), c - btq $8, c - -// Now if 2 * x >= p_521 we want 2 * x - p_521 = (2 * x + 1) - 2^521 -// and otherwise just 2 * x. Feed in the condition as the carry bit -// to get 2 * x + [2 * x >= p_521] then just mask it off to 521 bits. - - movq (x), a - adcq a, a - movq a, (z) - - movq 8(x), a - adcq a, a - movq a, 8(z) - - movq 16(x), a - adcq a, a - movq a, 16(z) - - movq 24(x), a - adcq a, a - movq a, 24(z) - - movq 32(x), a - adcq a, a - movq a, 32(z) - - movq 40(x), a - adcq a, a - movq a, 40(z) - - movq 48(x), a - adcq a, a - movq a, 48(z) - - movq 56(x), a - adcq a, a - movq a, 56(z) - - adcq c, c - andq $0x1FF, c - movq c, 64(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_double_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_half_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_half_p521.S deleted file mode 100644 index d149621ba2c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_half_p521.S +++ /dev/null @@ -1,106 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Halve modulo p_521, z := (x / 2) mod p_521, assuming x reduced -// Input x[9]; output z[9] -// -// extern void bignum_half_p521(uint64_t z[static 9], const uint64_t x[static 9]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_half_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_half_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_half_p521) - .text - -#define z %rdi -#define x %rsi - -// We use distinct variables for clarity, but these are heavily aliased - -#define d0 %rcx -#define d1 %rdx -#define d2 %rcx -#define d3 %rdx -#define d4 %rcx -#define d5 %rdx -#define d6 %rcx -#define d7 %rdx -#define d8 %rcx -#define a %rax -#define ashort %eax - - - -S2N_BN_SYMBOL(bignum_half_p521): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// We do a 521-bit rotation one bit right, since 2^521 == 1 (mod p_521) - - movq (x), d0 - movl $1, ashort - andq d0, a - - movq 8(x), d1 - shrdq $1, d1, d0 - movq d0, (z) - - movq 16(x), d2 - shrdq $1, d2, d1 - movq d1, 8(z) - - movq 24(x), d3 - shrdq $1, d3, d2 - movq d2, 16(z) - - movq 32(x), d4 - shrdq $1, d4, d3 - movq d3, 24(z) - - movq 40(x), d5 - shrdq $1, d5, d4 - movq d4, 32(z) - - movq 48(x), d6 - shrdq $1, d6, d5 - movq d5, 40(z) - - movq 56(x), d7 - shrdq $1, d7, d6 - movq d6, 48(z) - - movq 64(x), d8 - shrdq $1, d8, d7 - movq d7, 56(z) - - shlq $55, d8 - shrdq $56, a, d8 - movq d8, 64(z) - -// Return - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_half_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_mod_n521_9.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_mod_n521_9.S deleted file mode 100644 index 2323d7eb7e1..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_mod_n521_9.S +++ /dev/null @@ -1,151 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_521 -// Input x[9]; output z[9] -// -// extern void bignum_mod_n521_9(uint64_t z[static 9], const uint64_t x[static 9]); -// -// Reduction is modulo the group order of the NIST curve P-521. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n521_9) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n521_9) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n521_9) - .text - -#define z %rdi -#define x %rsi - -#define q %rdx -#define a %rax - -#define c %rcx -#define d %r8 - -#define n0 %r9 -#define n1 %r10 -#define n2 %r11 -#define n3 d - -#define ashort %eax -#define cshort %ecx -#define qshort %edx - -S2N_BN_SYMBOL(bignum_mod_n521_9): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the top digit, putting a bit-stuffed version in output buffer. -// The initial quotient estimate is q = h + 1 where x = 2^521 * h + t -// The last add also clears the CF and OF flags ready for the carry chain. - - movq 64(x), q - movq $~0x1FF, a - orq q, a - movq a, 64(z) - shrq $9, q - addq $1, q - -// Now load other digits and form r = x - q * n_521 = (q * r_521 + t) - 2^521, -// which is stored in the output buffer. Thanks to the bit-stuffing at the -// start, we get r' = (q * r_521 + t) + (2^576 - 2^521) = r + 2^576 as the -// computed result including the top carry. Hence CF <=> r >= 0, while -// r' == r (mod 2^521) because things below bit 521 are uncorrupted. We -// keep the top word in the register c since we at least have that one free. - - movq $0x449048e16ec79bf7, n0 - mulxq n0, a, c - adcxq (x), a - movq a, (z) - - movq $0xc44a36477663b851, n1 - mulxq n1, a, d - adcxq 8(x), a - adoxq c, a - movq a, 8(z) - - movq $0x8033feb708f65a2f, n2 - mulxq n2, a, c - adcxq 16(x), a - adoxq d, a - movq a, 16(z) - - movq $0xae79787c40d06994, a - mulxq a, a, d - adcxq 24(x), a - adoxq c, a - movq a, 24(z) - - movl $5, ashort - mulxq a, a, c - adcxq 32(x), a - adoxq d, a - movq a, 32(z) - - movq c, a // a is now used for zero hereafter - adoxq c, c - adcq 40(x), c - movq c, 40(z) - - movq 48(x), c - adcq a, c - movq c, 48(z) - - movq 56(x), c - adcq a, c - movq c, 56(z) - - movq 64(z), c - adcq a, c - -// We already know r < n_521, but if it actually went negative then -// we need to add back n_521 again. Recycle q as a bitmask for r < n_521, -// and just subtract r_521 and mask rather than literally adding 2^521. -// This also gets rid of the bit-stuffing above. - - cmc - sbbq q, q - andq q, n0 - andq q, n1 - andq q, n2 - movq $0xae79787c40d06994, n3 - andq q, n3 - andl $5, qshort - subq n0, (z) - sbbq n1, 8(z) - sbbq n2, 16(z) - sbbq n3, 24(z) - sbbq q, 32(z) - sbbq a, 40(z) - sbbq a, 48(z) - sbbq a, 56(z) - sbbl ashort, cshort - andl $0x1FF, cshort - movq c, 64(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n521_9) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_mod_n521_9_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_mod_n521_9_alt.S deleted file mode 100644 index f3ac6493b4e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_mod_n521_9_alt.S +++ /dev/null @@ -1,161 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_521 -// Input x[9]; output z[9] -// -// extern void bignum_mod_n521_9_alt(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Reduction is modulo the group order of the NIST curve P-521. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n521_9_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n521_9_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n521_9_alt) - .text - -#define z %rdi -#define x %rsi - -#define q %rcx -#define a %rax -#define d %rdx - -#define c %rcx - -#define n0 %r8 -#define n1 %r9 -#define n2 %r10 -#define n3 %r11 - -#define ashort %eax -#define cshort %ecx -#define qshort %edx - -S2N_BN_SYMBOL(bignum_mod_n521_9_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the top digit, putting a bit-stuffed version in output buffer. -// The initial quotient estimate is q = h + 1 where x = 2^521 * h + t -// The last add also clears the CF and OF flags ready for the carry chain. - - movq 64(x), q - movq $~0x1FF, a - orq q, a - movq a, 64(z) - shrq $9, q - addq $1, q - -// Now load other digits and form r = x - q * n_521 = (q * r_521 + t) - 2^521, -// which is stored in the output buffer. Thanks to the bit-stuffing at the -// start, we get r' = (q * r_521 + t) + (2^576 - 2^521) = r + 2^576 as the -// computed result including the top carry. Hence CF <=> r >= 0, while -// r' == r (mod 2^521) because things below bit 521 are uncorrupted. We -// keep the top word in the register c since we at least have that one free. - - movq $0x449048e16ec79bf7, %rax - mulq q - movq %rax, n0 - movq %rdx, n1 - - movq $0xc44a36477663b851, %rax - mulq q - xorq n2, n2 - addq %rax, n1 - adcq %rdx, n2 - - movq $0x8033feb708f65a2f, %rax - mulq q - xorq n3, n3 - addq %rax, n2 - adcq %rdx, n3 - - movq $0xae79787c40d06994, %rax - mulq q - imulq $5, q - addq %rax, n3 - adcq %rdx, q - sbbq %rdx, %rdx - negq %rdx - -// [%rdx;q;n3;n2;n1;n0] = q * r_521 - - xorl %eax, %eax // %rax is used as a zero hereafter - addq (x), n0 - movq n0, (z) - adcq 8(x), n1 - movq n1, 8(z) - adcq 16(x), n2 - movq n2, 16(z) - adcq 24(x), n3 - movq n3, 24(z) - adcq 32(x), q - movq q, 32(z) - adcq 40(x), %rdx - movq %rdx, 40(z) - movq 48(x), d - adcq %rax, d - movq d, 48(z) - movq 56(x), d - adcq %rax, d - movq d, 56(z) - movq 64(z), c - adcq %rax, c - -// We already know r < n_521, but if it actually went negative then -// we need to add back n_521 again. Use d as a bitmask for r < n_521, -// and just subtract r_521 and mask rather than literally adding 2^521. -// This also gets rid of the bit-stuffing above. - - cmc - sbbq d, d - - movq $0x449048e16ec79bf7, n0 - andq d, n0 - movq $0xc44a36477663b851, n1 - andq d, n1 - movq $0x8033feb708f65a2f, n2 - andq d, n2 - movq $0xae79787c40d06994, n3 - andq d, n3 - andq $5, d - - subq n0, (z) - sbbq n1, 8(z) - sbbq n2, 16(z) - sbbq n3, 24(z) - sbbq d, 32(z) - sbbq %rax, 40(z) - sbbq %rax, 48(z) - sbbq %rax, 56(z) - sbbl ashort, cshort - andl $0x1FF, cshort - movq c, 64(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n521_9_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_mod_p521_9.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_mod_p521_9.S deleted file mode 100644 index 953f8d931b2..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_mod_p521_9.S +++ /dev/null @@ -1,123 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_521 -// Input x[9]; output z[9] -// -// extern void bignum_mod_p521_9(uint64_t z[static 9], const uint64_t x[static 9]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p521_9) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p521_9) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p521_9) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rax -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 -#define d4 %r10 -#define d5 %r11 -#define d6 %rbx - -#define d8 %rdx - -#define d8short %edx - -// Re-use the input pointer as other variable once safe to do so - -#define d7 %rsi - -S2N_BN_SYMBOL(bignum_mod_p521_9): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save one more register - - CFI_PUSH(%rbx) - -// Separate out the input into x = 2^521 * H + L, so that x mod p_521 = -// (H + L) mod p_521 = if H + L >= p_521 then H + L - p_521 else H + L. - - movq 64(x), d0 - movl $0x1FF, d8short - andq d0, d8 - shrq $9, d0 - -// Force carry-in to get s = [d8;d7;d6;d5;d4;d3;d2;d1;d0] = H + L + 1. - - stc - adcq (x), d0 - movq 8(x), d1 - adcq $0, d1 - movq 16(x), d2 - adcq $0, d2 - movq 24(x), d3 - adcq $0, d3 - movq 32(x), d4 - adcq $0, d4 - movq 40(x), d5 - adcq $0, d5 - movq 48(x), d6 - adcq $0, d6 - movq 56(x), d7 - adcq $0, d7 - adcq $0, d8 - -// Set CF <=> s < 2^521 <=> H + L < p_521, so that if CF is set -// we want H + L = s - 1, otherwise (H + L) - p_521 = s - 2^521. -// This is done with just s - CF then masking to 521 bits. - - cmpq $512, d8 - - sbbq $0, d0 - movq d0, (z) - sbbq $0, d1 - movq d1, 8(z) - sbbq $0, d2 - movq d2, 16(z) - sbbq $0, d3 - movq d3, 24(z) - sbbq $0, d4 - movq d4, 32(z) - sbbq $0, d5 - movq d5, 40(z) - sbbq $0, d6 - movq d6, 48(z) - sbbq $0, d7 - movq d7, 56(z) - sbbq $0, d8 - andq $0x1FF, d8 - movq d8, 64(z) - -// Restore register - - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p521_9) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montmul_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montmul_p521.S deleted file mode 100644 index a457acce5b6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montmul_p521.S +++ /dev/null @@ -1,418 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^576) mod p_521 -// Inputs x[9], y[9]; output z[9] -// -// extern void bignum_montmul_p521(uint64_t z[static 9], -// const uint64_t x[static 9], -// const uint64_t y[static 9]); -// -// Does z := (x * y / 2^576) mod p_521, assuming x < p_521, y < p_521. This -// means the Montgomery base is the "native size" 2^{9*64} = 2^576; since -// p_521 is a Mersenne prime the basic modular multiplication bignum_mul_p521 -// can be considered a Montgomery operation to base 2^521. -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p521) - .text - -#define z %rdi -#define x %rsi - -// Copied in - -#define y %rcx - -// mulpadd (high,low,x) adds rdx * x to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rbx as temporaries. - -#define mulpadd(high,low,x) \ - mulxq x, %rax, %rbx ; \ - adcxq %rax, low ; \ - adoxq %rbx, high - -S2N_BN_SYMBOL(bignum_montmul_p521): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with and make temporary space on stack - - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(64) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Clone of the main body of bignum_8_16, writing back the low 8 words -// to the stack and keeping the top half in %r15,...,%r8 - - xorl %ebp, %ebp - movq (y), %rdx - mulxq (x), %r8, %r9 - movq %r8, (%rsp) - mulxq 0x8(x), %rbx, %r10 - adcq %rbx, %r9 - mulxq 0x10(x), %rbx, %r11 - adcq %rbx, %r10 - mulxq 0x18(x), %rbx, %r12 - adcq %rbx, %r11 - mulxq 0x20(x), %rbx, %r13 - adcq %rbx, %r12 - mulxq 0x28(x), %rbx, %r14 - adcq %rbx, %r13 - mulxq 0x30(x), %rbx, %r15 - adcq %rbx, %r14 - mulxq 0x38(x), %rbx, %r8 - adcq %rbx, %r15 - adcq %rbp, %r8 - movq 0x8(y), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - movq %r9, 0x8(%rsp) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x38(x), %rax, %r9 - adcxq %rax, %r8 - adoxq %rbp, %r9 - adcq %rbp, %r9 - movq 0x10(y), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - movq %r10, 0x10(%rsp) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x38(x), %rax, %r10 - adcxq %rax, %r9 - adoxq %rbp, %r10 - adcq %rbp, %r10 - movq 0x18(y), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq %r11, 0x18(%rsp) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x38(x), %rax, %r11 - adcxq %rax, %r10 - adoxq %rbp, %r11 - adcq %rbp, %r11 - movq 0x20(y), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - movq %r12, 0x20(%rsp) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x38(x), %rax, %r12 - adcxq %rax, %r11 - adoxq %rbp, %r12 - adcq %rbp, %r12 - movq 0x28(y), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - movq %r13, 0x28(%rsp) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x38(x), %rax, %r13 - adcxq %rax, %r12 - adoxq %rbp, %r13 - adcq %rbp, %r13 - movq 0x30(y), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r14 - adoxq %rbx, %r15 - movq %r14, 0x30(%rsp) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x38(x), %rax, %r14 - adcxq %rax, %r13 - adoxq %rbp, %r14 - adcq %rbp, %r14 - movq 0x38(y), %rdx - xorl %ebp, %ebp - mulxq (x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %r8 - movq %r15, 0x38(%rsp) - mulxq 0x8(x), %rax, %rbx - adcxq %rax, %r8 - adoxq %rbx, %r9 - mulxq 0x10(x), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x18(x), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x20(x), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x28(x), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x30(x), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x38(x), %rax, %r15 - adcxq %rax, %r14 - adoxq %rbp, %r15 - adcq %rbp, %r15 - -// Accumulate x[8] * y[0..7], extending the window to %rbp,%r15,...,%r8 - - movq 64(x), %rdx - xorl %ebp, %ebp - mulpadd(%r9,%r8,(y)) - mulpadd(%r10,%r9,8(y)) - mulpadd(%r11,%r10,16(y)) - mulpadd(%r12,%r11,24(y)) - mulpadd(%r13,%r12,32(y)) - mulpadd(%r14,%r13,40(y)) - mulpadd(%r15,%r14,48(y)) - mulxq 56(y), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbp, %rbx - adcq %rbx, %rbp - -// Accumulate y[8] * x[0..8] within this extended window %rbp,%r15,...,%r8 - - movq 64(y), %rdx - xorl %eax, %eax - mulpadd(%r9,%r8,(x)) - mulpadd(%r10,%r9,8(x)) - mulpadd(%r11,%r10,16(x)) - mulpadd(%r12,%r11,24(x)) - mulpadd(%r13,%r12,32(x)) - mulpadd(%r14,%r13,40(x)) - mulpadd(%r15,%r14,48(x)) - mulxq 56(x), %rax, %rbx - adcxq %rax, %r15 - adoxq %rbx, %rbp - mulxq 64(x), %rax, %rbx - adcq %rax, %rbp - -// Rotate the upper portion right 9 bits since 2^512 == 2^-9 (mod p_521) -// Let rotated result %rbp,%r15,%r14,...,%r8 be h (high) and %rsp[0..7] be l (low) - - movq %r8, %rax - andq $0x1FF, %rax - shrdq $9, %r9, %r8 - shrdq $9, %r10, %r9 - shrdq $9, %r11, %r10 - shrdq $9, %r12, %r11 - shrdq $9, %r13, %r12 - shrdq $9, %r14, %r13 - shrdq $9, %r15, %r14 - shrdq $9, %rbp, %r15 - shrq $9, %rbp - addq %rax, %rbp - -// Force carry-in then add to get s = h + l + 1 -// but actually add all 1s in the top 53 bits to get simple carry out - - stc - adcq (%rsp), %r8 - adcq 8(%rsp), %r9 - adcq 16(%rsp), %r10 - adcq 24(%rsp), %r11 - adcq 32(%rsp), %r12 - adcq 40(%rsp), %r13 - adcq 48(%rsp), %r14 - adcq 56(%rsp), %r15 - adcq $~0x1FF, %rbp - -// Now CF is set <=> h + l + 1 >= 2^521 <=> h + l >= p_521, -// in which case the lower 521 bits are already right. Otherwise if -// CF is clear, we want to subtract 1. Hence subtract the complement -// of the carry flag then mask the top word, which scrubs the -// padding in either case. - - cmc - sbbq $0, %r8 - sbbq $0, %r9 - sbbq $0, %r10 - sbbq $0, %r11 - sbbq $0, %r12 - sbbq $0, %r13 - sbbq $0, %r14 - sbbq $0, %r15 - sbbq $0, %rbp - andq $0x1FF, %rbp - -// So far, this has been the same as a pure modular multiply. -// Now finally the Montgomery ingredient, which is just a 521-bit -// rotation by 9*64 - 521 = 55 bits right. Write digits back as -// they are created. - - movq %r8, %rax - shrdq $55, %r9, %r8 - movq %r8, (z) - shrdq $55, %r10, %r9 - movq %r9, 8(z) - shrdq $55, %r11, %r10 - shlq $9, %rax - movq %r10, 16(z) - shrdq $55, %r12, %r11 - movq %r11, 24(z) - shrdq $55, %r13, %r12 - movq %r12, 32(z) - orq %rax, %rbp - shrdq $55, %r14, %r13 - movq %r13, 40(z) - shrdq $55, %r15, %r14 - movq %r14, 48(z) - shrdq $55, %rbp, %r15 - movq %r15, 56(z) - shrq $55, %rbp - movq %rbp, 64(z) - -// Restore registers and return - - CFI_INC_RSP(64) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montmul_p521_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montmul_p521_alt.S deleted file mode 100644 index 22d7a7074dd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montmul_p521_alt.S +++ /dev/null @@ -1,348 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^576) mod p_521 -// Inputs x[9], y[9]; output z[9] -// -// extern void bignum_montmul_p521_alt(uint64_t z[static 9], -// const uint64_t x[static 9], -// const uint64_t y[static 9]); -// -// Does z := (x * y / 2^576) mod p_521, assuming x < p_521, y < p_521. This -// means the Montgomery base is the "native size" 2^{9*64} = 2^576; since -// p_521 is a Mersenne prime the basic modular multiplication bignum_mul_p521 -// can be considered a Montgomery operation to base 2^521. -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p521_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_p521_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p521_alt) - .text - -#define z %rdi -#define x %rsi - -// This is moved from %rdx to free it for muls - -#define y %rcx - -// Macro for the key "multiply and add to (c,h,l)" step - -#define combadd(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A minutely shorter form for when c = 0 initially - -#define combadz(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq c, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h - -S2N_BN_SYMBOL(bignum_montmul_p521_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Make more registers available and make temporary space on stack - - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(72) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Copy y into a safe register to start with - - mov %rdx, y - -// Start doing a conventional columnwise multiplication, -// temporarily storing the lower 9 digits to the stack. -// Start with result term 0 - - movq (x), %rax - mulq (y) - - movq %rax, (%rsp) - movq %rdx, %r9 - xorq %r10, %r10 - -// Result term 1 - - xorq %r11, %r11 - combads(%r10,%r9,(x),8(y)) - combadz(%r11,%r10,%r9,8(x),(y)) - movq %r9, 8(%rsp) - -// Result term 2 - - xorq %r12, %r12 - combadz(%r12,%r11,%r10,(x),16(y)) - combadd(%r12,%r11,%r10,8(x),8(y)) - combadd(%r12,%r11,%r10,16(x),(y)) - movq %r10, 16(%rsp) - -// Result term 3 - - xorq %r13, %r13 - combadz(%r13,%r12,%r11,(x),24(y)) - combadd(%r13,%r12,%r11,8(x),16(y)) - combadd(%r13,%r12,%r11,16(x),8(y)) - combadd(%r13,%r12,%r11,24(x),(y)) - movq %r11, 24(%rsp) - -// Result term 4 - - xorq %r14, %r14 - combadz(%r14,%r13,%r12,(x),32(y)) - combadd(%r14,%r13,%r12,8(x),24(y)) - combadd(%r14,%r13,%r12,16(x),16(y)) - combadd(%r14,%r13,%r12,24(x),8(y)) - combadd(%r14,%r13,%r12,32(x),(y)) - movq %r12, 32(%rsp) - -// Result term 5 - - xorq %r15, %r15 - combadz(%r15,%r14,%r13,(x),40(y)) - combadd(%r15,%r14,%r13,8(x),32(y)) - combadd(%r15,%r14,%r13,16(x),24(y)) - combadd(%r15,%r14,%r13,24(x),16(y)) - combadd(%r15,%r14,%r13,32(x),8(y)) - combadd(%r15,%r14,%r13,40(x),(y)) - movq %r13, 40(%rsp) - -// Result term 6 - - xorq %r8, %r8 - combadz(%r8,%r15,%r14,(x),48(y)) - combadd(%r8,%r15,%r14,8(x),40(y)) - combadd(%r8,%r15,%r14,16(x),32(y)) - combadd(%r8,%r15,%r14,24(x),24(y)) - combadd(%r8,%r15,%r14,32(x),16(y)) - combadd(%r8,%r15,%r14,40(x),8(y)) - combadd(%r8,%r15,%r14,48(x),(y)) - movq %r14, 48(%rsp) - -// Result term 7 - - xorq %r9, %r9 - combadz(%r9,%r8,%r15,(x),56(y)) - combadd(%r9,%r8,%r15,8(x),48(y)) - combadd(%r9,%r8,%r15,16(x),40(y)) - combadd(%r9,%r8,%r15,24(x),32(y)) - combadd(%r9,%r8,%r15,32(x),24(y)) - combadd(%r9,%r8,%r15,40(x),16(y)) - combadd(%r9,%r8,%r15,48(x),8(y)) - combadd(%r9,%r8,%r15,56(x),(y)) - movq %r15, 56(%rsp) - -// Result term 8 - - xorq %r10, %r10 - combadz(%r10,%r9,%r8,(x),64(y)) - combadd(%r10,%r9,%r8,8(x),56(y)) - combadd(%r10,%r9,%r8,16(x),48(y)) - combadd(%r10,%r9,%r8,24(x),40(y)) - combadd(%r10,%r9,%r8,32(x),32(y)) - combadd(%r10,%r9,%r8,40(x),24(y)) - combadd(%r10,%r9,%r8,48(x),16(y)) - combadd(%r10,%r9,%r8,56(x),8(y)) - combadd(%r10,%r9,%r8,64(x),(y)) - movq %r8, 64(%rsp) - -// At this point we suspend writing back results and collect them -// in a register window. Next is result term 9 - - xorq %r11, %r11 - combadz(%r11,%r10,%r9,8(x),64(y)) - combadd(%r11,%r10,%r9,16(x),56(y)) - combadd(%r11,%r10,%r9,24(x),48(y)) - combadd(%r11,%r10,%r9,32(x),40(y)) - combadd(%r11,%r10,%r9,40(x),32(y)) - combadd(%r11,%r10,%r9,48(x),24(y)) - combadd(%r11,%r10,%r9,56(x),16(y)) - combadd(%r11,%r10,%r9,64(x),8(y)) - -// Result term 10 - - xorq %r12, %r12 - combadz(%r12,%r11,%r10,16(x),64(y)) - combadd(%r12,%r11,%r10,24(x),56(y)) - combadd(%r12,%r11,%r10,32(x),48(y)) - combadd(%r12,%r11,%r10,40(x),40(y)) - combadd(%r12,%r11,%r10,48(x),32(y)) - combadd(%r12,%r11,%r10,56(x),24(y)) - combadd(%r12,%r11,%r10,64(x),16(y)) - -// Result term 11 - - xorq %r13, %r13 - combadz(%r13,%r12,%r11,24(x),64(y)) - combadd(%r13,%r12,%r11,32(x),56(y)) - combadd(%r13,%r12,%r11,40(x),48(y)) - combadd(%r13,%r12,%r11,48(x),40(y)) - combadd(%r13,%r12,%r11,56(x),32(y)) - combadd(%r13,%r12,%r11,64(x),24(y)) - -// Result term 12 - - xorq %r14, %r14 - combadz(%r14,%r13,%r12,32(x),64(y)) - combadd(%r14,%r13,%r12,40(x),56(y)) - combadd(%r14,%r13,%r12,48(x),48(y)) - combadd(%r14,%r13,%r12,56(x),40(y)) - combadd(%r14,%r13,%r12,64(x),32(y)) - -// Result term 13 - - xorq %r15, %r15 - combadz(%r15,%r14,%r13,40(x),64(y)) - combadd(%r15,%r14,%r13,48(x),56(y)) - combadd(%r15,%r14,%r13,56(x),48(y)) - combadd(%r15,%r14,%r13,64(x),40(y)) - -// Result term 14 - - xorq %r8, %r8 - combadz(%r8,%r15,%r14,48(x),64(y)) - combadd(%r8,%r15,%r14,56(x),56(y)) - combadd(%r8,%r15,%r14,64(x),48(y)) - -// Result term 15 - - combads(%r8,%r15,56(x),64(y)) - combads(%r8,%r15,64(x),56(y)) - -// Result term 16 - - movq 64(x), %rax - imulq 64(y), %rax - addq %r8, %rax - -// Now the upper portion is [%rax;%r15;%r14;%r13;%r12;%r11;%r10;%r9;[%rsp+64]]. -// Rotate the upper portion right 9 bits since 2^512 == 2^-9 (mod p_521) -// Let rotated result %rdx,%r15,%r14,...,%r8 be h (high) and %rsp[0..7] be l (low) - - movq 64(%rsp), %r8 - movq %r8, %rdx - andq $0x1FF, %rdx - shrdq $9, %r9, %r8 - shrdq $9, %r10, %r9 - shrdq $9, %r11, %r10 - shrdq $9, %r12, %r11 - shrdq $9, %r13, %r12 - shrdq $9, %r14, %r13 - shrdq $9, %r15, %r14 - shrdq $9, %rax, %r15 - shrq $9, %rax - addq %rax, %rdx - -// Force carry-in then add to get s = h + l + 1 -// but actually add all 1s in the top 53 bits to get simple carry out - - stc - adcq (%rsp), %r8 - adcq 8(%rsp), %r9 - adcq 16(%rsp), %r10 - adcq 24(%rsp), %r11 - adcq 32(%rsp), %r12 - adcq 40(%rsp), %r13 - adcq 48(%rsp), %r14 - adcq 56(%rsp), %r15 - adcq $~0x1FF, %rdx - -// Now CF is set <=> h + l + 1 >= 2^521 <=> h + l >= p_521, -// in which case the lower 521 bits are already right. Otherwise if -// CF is clear, we want to subtract 1. Hence subtract the complement -// of the carry flag then mask the top word, which scrubs the -// padding in either case. - - cmc - sbbq $0, %r8 - sbbq $0, %r9 - sbbq $0, %r10 - sbbq $0, %r11 - sbbq $0, %r12 - sbbq $0, %r13 - sbbq $0, %r14 - sbbq $0, %r15 - sbbq $0, %rdx - andq $0x1FF, %rdx - -// So far, this has been the same as a pure modular multiply. -// Now finally the Montgomery ingredient, which is just a 521-bit -// rotation by 9*64 - 521 = 55 bits right. Write digits back as -// they are created. - - movq %r8, %rax - shrdq $55, %r9, %r8 - movq %r8, (z) - shrdq $55, %r10, %r9 - movq %r9, 8(z) - shrdq $55, %r11, %r10 - shlq $9, %rax - movq %r10, 16(z) - shrdq $55, %r12, %r11 - movq %r11, 24(z) - shrdq $55, %r13, %r12 - movq %r12, 32(z) - orq %rax, %rdx - shrdq $55, %r14, %r13 - movq %r13, 40(z) - shrdq $55, %r15, %r14 - movq %r14, 48(z) - shrdq $55, %rdx, %r15 - movq %r15, 56(z) - shrq $55, %rdx - movq %rdx, 64(z) - -// Restore registers and return - - CFI_INC_RSP(72) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_p521_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montsqr_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montsqr_p521.S deleted file mode 100644 index 775f047ec8e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montsqr_p521.S +++ /dev/null @@ -1,326 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^576) mod p_521 -// Input x[9]; output z[9] -// -// extern void bignum_montsqr_p521(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Does z := (x^2 / 2^576) mod p_521, assuming x < p_521. This means the -// Montgomery base is the "native size" 2^{9*64} = 2^576; since p_521 is -// a Mersenne prime the basic modular squaring bignum_sqr_p521 can be -// considered a Montgomery operation to base 2^521. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p521) - .text - -#define z %rdi -#define x %rsi - -// A zero register - -#define zero %rbp -#define zeroe %ebp - -// mulpadd(high,low,i) adds %rdx * x[i] to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rcx as temporaries. - -#define mulpadd(high,low,I) \ - mulxq I(x), %rax, %rcx ; \ - adcxq %rax, low ; \ - adoxq %rcx, high - -// mulpade(high,low,i) adds %rdx * x[i] to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax as a temporary, assuming high created from scratch -// and that zero has value zero. - -#define mulpade(high,low,I) \ - mulxq I(x), %rax, high ; \ - adcxq %rax, low ; \ - adoxq zero, high - -S2N_BN_SYMBOL(bignum_montsqr_p521): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with and make temporary space on stack - - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(64) - -// Do a basic 8x8 squaring stashing %rsp[0..7] but keeping the -// top half in the usual rotating register window %r15,...,%r8. Except -// for the lack of full writeback this is the same as bignum_sqr_8_16. - - xorl zeroe, zeroe - - movq (x), %rdx - mulxq 8(x), %r9, %rax - movq %r9, 8(%rsp) - mulxq 16(x), %r10, %rcx - adcxq %rax, %r10 - movq %r10, 16(%rsp) - mulxq 24(x), %r11, %rax - adcxq %rcx, %r11 - mulxq 32(x), %r12, %rcx - adcxq %rax, %r12 - mulxq 40(x), %r13, %rax - adcxq %rcx, %r13 - mulxq 48(x), %r14, %rcx - adcxq %rax, %r14 - mulxq 56(x), %r15, %r8 - adcxq %rcx, %r15 - adcxq zero, %r8 - - xorl zeroe, zeroe - movq 8(x), %rdx - mulpadd(%r12,%r11,16) - movq %r11, 24(%rsp) - mulpadd(%r13,%r12,24) - movq %r12, 32(%rsp) - mulpadd(%r14,%r13,32) - mulpadd(%r15,%r14,40) - mulpadd(%r8,%r15,48) - mulpade(%r9,%r8,56) - movq 32(x), %rdx - mulpade(%r10,%r9,40) - adcxq zero, %r10 - - xorl zeroe, zeroe - movq 16(x), %rdx - mulpadd(%r14,%r13,24) - movq %r13, 40(%rsp) - mulpadd(%r15,%r14,32) - movq %r14, 48(%rsp) - mulpadd(%r8,%r15,40) - mulpadd(%r9,%r8,48) - mulpadd(%r10,%r9,56) - movq 48(x), %rdx - mulpade(%r11,%r10,32) - mulpade(%r12,%r11,40) - adcxq zero, %r12 - - xorl zeroe, zeroe - movq 24(x), %rdx - mulpadd(%r8,%r15,32) - movq %r15, 56(%rsp) - mulpadd(%r9,%r8,40) - mulpadd(%r10,%r9,48) - mulpadd(%r11,%r10,56) - movq 56(x), %rdx - mulpadd(%r12,%r11,32) - mulpade(%r13,%r12,40) - mulpade(%r14,%r13,48) - adcxq zero, %r14 - - xorl zeroe, zeroe - movq (x), %rdx - mulxq %rdx, %rax, %rcx - movq %rax, (%rsp) - movq 8(%rsp), %rax - adcxq %rax, %rax - adoxq %rcx, %rax - movq %rax, 8(%rsp) - - movq 16(%rsp), %rax - movq 8(x), %rdx - mulxq %rdx, %rdx, %rcx - adcxq %rax, %rax - adoxq %rdx, %rax - movq %rax, 16(%rsp) - movq 24(%rsp), %rax - adcxq %rax, %rax - adoxq %rcx, %rax - movq %rax, 24(%rsp) - - movq 32(%rsp), %rax - movq 16(x), %rdx - mulxq %rdx, %rdx, %rcx - adcxq %rax, %rax - adoxq %rdx, %rax - movq %rax, 32(%rsp) - movq 40(%rsp), %rax - adcxq %rax, %rax - adoxq %rcx, %rax - movq %rax, 40(%rsp) - - movq 48(%rsp), %rax - movq 24(x), %rdx - mulxq %rdx, %rdx, %rcx - adcxq %rax, %rax - adoxq %rdx, %rax - movq %rax, 48(%rsp) - movq 56(%rsp), %rax - adcxq %rax, %rax - adoxq %rcx, %rax - movq %rax, 56(%rsp) - - movq 32(x), %rdx - mulxq %rdx, %rdx, %rcx - adcxq %r8, %r8 - adoxq %rdx, %r8 - adcxq %r9, %r9 - adoxq %rcx, %r9 - - movq 40(x), %rdx - mulxq %rdx, %rdx, %rcx - adcxq %r10, %r10 - adoxq %rdx, %r10 - adcxq %r11, %r11 - adoxq %rcx, %r11 - - movq 48(x), %rdx - mulxq %rdx, %rdx, %rcx - adcxq %r12, %r12 - adoxq %rdx, %r12 - adcxq %r13, %r13 - adoxq %rcx, %r13 - - movq 56(x), %rdx - mulxq %rdx, %rdx, %r15 - adcxq %r14, %r14 - adoxq %rdx, %r14 - adcxq zero, %r15 - adoxq zero, %r15 - -// Augment the high part with the contribution from the top little word C. -// If we write the input as 2^512 * C + x then we are otherwise just doing -// x^2, so we need to add to the high part 2^512 * C^2 + (2 * C) * x. -// The initial doubling add of C also clears the CF and OF flags as desired. -// We extend the window now to the 9-element %rbp,%r15,%r14,...,%r8. - - movq 64(x), %rdx - movq %rdx, %rbp - imulq %rbp, %rbp - addq %rdx, %rdx - mulpadd(%r9,%r8,0) - mulpadd(%r10,%r9,8) - mulpadd(%r11,%r10,16) - mulpadd(%r12,%r11,24) - mulpadd(%r13,%r12,32) - mulpadd(%r14,%r13,40) - mulpadd(%r15,%r14,48) - mulxq 56(x), %rax, %rcx - adcxq %rax, %r15 - adoxq %rcx, %rbp - adcq $0, %rbp - -// Rotate the upper portion right 9 bits since 2^512 == 2^-9 (mod p_521) -// Let rotated result %rbp,%r15,%r14,...,%r8 be h (high) and %rsp[0..7] be l (low) - - movq %r8, %rax - andq $0x1FF, %rax - shrdq $9, %r9, %r8 - shrdq $9, %r10, %r9 - shrdq $9, %r11, %r10 - shrdq $9, %r12, %r11 - shrdq $9, %r13, %r12 - shrdq $9, %r14, %r13 - shrdq $9, %r15, %r14 - shrdq $9, %rbp, %r15 - shrq $9, %rbp - addq %rax, %rbp - -// Force carry-in then add to get s = h + l + 1 -// but actually add all 1s in the top 53 bits to get simple carry out - - stc - adcq (%rsp), %r8 - adcq 8(%rsp), %r9 - adcq 16(%rsp), %r10 - adcq 24(%rsp), %r11 - adcq 32(%rsp), %r12 - adcq 40(%rsp), %r13 - adcq 48(%rsp), %r14 - adcq 56(%rsp), %r15 - adcq $~0x1FF, %rbp - -// Now CF is set <=> h + l + 1 >= 2^521 <=> h + l >= p_521, -// in which case the lower 521 bits are already right. Otherwise if -// CF is clear, we want to subtract 1. Hence subtract the complement -// of the carry flag then mask the top word, which scrubs the -// padding in either case. - - cmc - sbbq $0, %r8 - sbbq $0, %r9 - sbbq $0, %r10 - sbbq $0, %r11 - sbbq $0, %r12 - sbbq $0, %r13 - sbbq $0, %r14 - sbbq $0, %r15 - sbbq $0, %rbp - andq $0x1FF, %rbp - -// So far, this has been the same as a pure modular squaring. -// Now finally the Montgomery ingredient, which is just a 521-bit -// rotation by 9*64 - 521 = 55 bits right. Write digits back as -// they are created. - - movq %r8, %rax - shrdq $55, %r9, %r8 - movq %r8, (z) - shrdq $55, %r10, %r9 - movq %r9, 8(z) - shrdq $55, %r11, %r10 - shlq $9, %rax - movq %r10, 16(z) - shrdq $55, %r12, %r11 - movq %r11, 24(z) - shrdq $55, %r13, %r12 - movq %r12, 32(z) - orq %rax, %rbp - shrdq $55, %r14, %r13 - movq %r13, 40(z) - shrdq $55, %r15, %r14 - movq %r14, 48(z) - shrdq $55, %rbp, %r15 - movq %r15, 56(z) - shrq $55, %rbp - movq %rbp, 64(z) - -// Restore registers and return - - CFI_INC_RSP(64) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montsqr_p521_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montsqr_p521_alt.S deleted file mode 100644 index 3916e5d3586..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_montsqr_p521_alt.S +++ /dev/null @@ -1,339 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^576) mod p_521 -// Input x[9]; output z[9] -// -// extern void bignum_montsqr_p521_alt(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Does z := (x^2 / 2^576) mod p_521, assuming x < p_521. This means the -// Montgomery base is the "native size" 2^{9*64} = 2^576; since p_521 is -// a Mersenne prime the basic modular squaring bignum_sqr_p521 can be -// considered a Montgomery operation to base 2^521. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p521_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_p521_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p521_alt) - .text - -// Input arguments - -#define z %rdi -#define x %rsi - -// Macro for the key "multiply and add to (c,h,l)" step - -#define combadd(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// Set up initial window (c,h,l) = numa * numb - -#define combaddz(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - xorq c, c ; \ - movq %rax, l ; \ - movq %rdx, h - -// Doubling step (c,h,l) = 2 * (c,hh,ll) + (0,h,l) - -#define doubladd(c,h,l,hh,ll) \ - addq ll, ll ; \ - adcq hh, hh ; \ - adcq c, c ; \ - addq ll, l ; \ - adcq hh, h ; \ - adcq $0, c - -// Square term incorporation (c,h,l) += numba^2 - -#define combadd1(c,h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h - -// A version doubling directly before adding, for single non-square terms - -#define combadd2(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0, c ; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -S2N_BN_SYMBOL(bignum_montsqr_p521_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Make more registers available and make temporary space on stack - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(72) - -// Start doing a conventional columnwise squaring, -// temporarily storing the lower 9 digits on the stack. -// Start with result term 0 - - movq (x), %rax - mulq %rax - - movq %rax, (%rsp) - movq %rdx, %r9 - xorq %r10, %r10 - -// Result term 1 - - xorq %r11, %r11 - combadd2(%r11,%r10,%r9,(x),8(x)) - movq %r9, 8(%rsp) - -// Result term 2 - - xorq %r12, %r12 - combadd1(%r12,%r11,%r10,8(x)) - combadd2(%r12,%r11,%r10,(x),16(x)) - movq %r10, 16(%rsp) - -// Result term 3 - - combaddz(%r13,%rcx,%rbx,(x),24(x)) - combadd(%r13,%rcx,%rbx,8(x),16(x)) - doubladd(%r13,%r12,%r11,%rcx,%rbx) - movq %r11, 24(%rsp) - -// Result term 4 - - combaddz(%r14,%rcx,%rbx,(x),32(x)) - combadd(%r14,%rcx,%rbx,8(x),24(x)) - doubladd(%r14,%r13,%r12,%rcx,%rbx) - combadd1(%r14,%r13,%r12,16(x)) - movq %r12, 32(%rsp) - -// Result term 5 - - combaddz(%r15,%rcx,%rbx,(x),40(x)) - combadd(%r15,%rcx,%rbx,8(x),32(x)) - combadd(%r15,%rcx,%rbx,16(x),24(x)) - doubladd(%r15,%r14,%r13,%rcx,%rbx) - movq %r13, 40(%rsp) - -// Result term 6 - - combaddz(%r8,%rcx,%rbx,(x),48(x)) - combadd(%r8,%rcx,%rbx,8(x),40(x)) - combadd(%r8,%rcx,%rbx,16(x),32(x)) - doubladd(%r8,%r15,%r14,%rcx,%rbx) - combadd1(%r8,%r15,%r14,24(x)) - movq %r14, 48(%rsp) - -// Result term 7 - - combaddz(%r9,%rcx,%rbx,(x),56(x)) - combadd(%r9,%rcx,%rbx,8(x),48(x)) - combadd(%r9,%rcx,%rbx,16(x),40(x)) - combadd(%r9,%rcx,%rbx,24(x),32(x)) - doubladd(%r9,%r8,%r15,%rcx,%rbx) - movq %r15, 56(%rsp) - -// Result term 8 - - combaddz(%r10,%rcx,%rbx,(x),64(x)) - combadd(%r10,%rcx,%rbx,8(x),56(x)) - combadd(%r10,%rcx,%rbx,16(x),48(x)) - combadd(%r10,%rcx,%rbx,24(x),40(x)) - doubladd(%r10,%r9,%r8,%rcx,%rbx) - combadd1(%r10,%r9,%r8,32(x)) - movq %r8, 64(%rsp) - -// We now stop writing back and keep remaining results in a register window. -// Continue with result term 9 - - combaddz(%r11,%rcx,%rbx,8(x),64(x)) - combadd(%r11,%rcx,%rbx,16(x),56(x)) - combadd(%r11,%rcx,%rbx,24(x),48(x)) - combadd(%r11,%rcx,%rbx,32(x),40(x)) - doubladd(%r11,%r10,%r9,%rcx,%rbx) - -// Result term 10 - - combaddz(%r12,%rcx,%rbx,16(x),64(x)) - combadd(%r12,%rcx,%rbx,24(x),56(x)) - combadd(%r12,%rcx,%rbx,32(x),48(x)) - doubladd(%r12,%r11,%r10,%rcx,%rbx) - combadd1(%r12,%r11,%r10,40(x)) - -// Result term 11 - - combaddz(%r13,%rcx,%rbx,24(x),64(x)) - combadd(%r13,%rcx,%rbx,32(x),56(x)) - combadd(%r13,%rcx,%rbx,40(x),48(x)) - doubladd(%r13,%r12,%r11,%rcx,%rbx) - -// Result term 12 - - combaddz(%r14,%rcx,%rbx,32(x),64(x)) - combadd(%r14,%rcx,%rbx,40(x),56(x)) - doubladd(%r14,%r13,%r12,%rcx,%rbx) - combadd1(%r14,%r13,%r12,48(x)) - -// Result term 13 - - combaddz(%r15,%rcx,%rbx,40(x),64(x)) - combadd(%r15,%rcx,%rbx,48(x),56(x)) - doubladd(%r15,%r14,%r13,%rcx,%rbx); - -// Result term 14 - - xorq %r8, %r8 - combadd1(%r8,%r15,%r14,56(x)) - combadd2(%r8,%r15,%r14,48(x),64(x)) - -// Result term 15 - - movq 56(x), %rax - mulq 64(x) - addq %rax, %rax - adcq %rdx, %rdx - addq %rax, %r15 - adcq %rdx, %r8 - -// Result term 16 - - movq 64(x), %rax - imulq %rax, %rax - addq %r8, %rax - -// Now the upper portion is [%rax;%r15;%r14;%r13;%r12;%r11;%r10;%r9;[%rsp+64]]. -// Rotate the upper portion right 9 bits since 2^512 == 2^-9 (mod p_521) -// Let rotated result %rdx,%r15,%r14,...,%r8 be h (high) and %rsp[0..7] be l (low) - - movq 64(%rsp), %r8 - movq %r8, %rdx - andq $0x1FF, %rdx - shrdq $9, %r9, %r8 - shrdq $9, %r10, %r9 - shrdq $9, %r11, %r10 - shrdq $9, %r12, %r11 - shrdq $9, %r13, %r12 - shrdq $9, %r14, %r13 - shrdq $9, %r15, %r14 - shrdq $9, %rax, %r15 - shrq $9, %rax - addq %rax, %rdx - -// Force carry-in then add to get s = h + l + 1 -// but actually add all 1s in the top 53 bits to get simple carry out - - stc - adcq (%rsp), %r8 - adcq 8(%rsp), %r9 - adcq 16(%rsp), %r10 - adcq 24(%rsp), %r11 - adcq 32(%rsp), %r12 - adcq 40(%rsp), %r13 - adcq 48(%rsp), %r14 - adcq 56(%rsp), %r15 - adcq $~0x1FF, %rdx - -// Now CF is set <=> h + l + 1 >= 2^521 <=> h + l >= p_521, -// in which case the lower 521 bits are already right. Otherwise if -// CF is clear, we want to subtract 1. Hence subtract the complement -// of the carry flag then mask the top word, which scrubs the -// padding in either case. - - cmc - sbbq $0, %r8 - sbbq $0, %r9 - sbbq $0, %r10 - sbbq $0, %r11 - sbbq $0, %r12 - sbbq $0, %r13 - sbbq $0, %r14 - sbbq $0, %r15 - sbbq $0, %rdx - andq $0x1FF, %rdx - -// So far, this has been the same as a pure modular squaring. -// Now finally the Montgomery ingredient, which is just a 521-bit -// rotation by 9*64 - 521 = 55 bits right. Write digits back as -// they are created. - - movq %r8, %rax - shrdq $55, %r9, %r8 - movq %r8, (z) - shrdq $55, %r10, %r9 - movq %r9, 8(z) - shrdq $55, %r11, %r10 - shlq $9, %rax - movq %r10, 16(z) - shrdq $55, %r12, %r11 - movq %r11, 24(z) - shrdq $55, %r13, %r12 - movq %r12, 32(z) - orq %rax, %rdx - shrdq $55, %r14, %r13 - movq %r13, 40(z) - shrdq $55, %r15, %r14 - movq %r14, 48(z) - shrdq $55, %rdx, %r15 - movq %r15, 56(z) - shrq $55, %rdx - movq %rdx, 64(z) - -// Restore registers and return - - CFI_INC_RSP(72) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_p521_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_optneg_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_optneg_p521.S deleted file mode 100644 index bb72dd14d30..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_optneg_p521.S +++ /dev/null @@ -1,111 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo p_521, z := (-x) mod p_521 (if p nonzero) or -// z := x (if p zero), assuming x reduced -// Inputs p, x[9]; output z[9] -// -// extern void bignum_optneg_p521(uint64_t z[static 9], uint64_t p, -// const uint64_t x[static 9]); -// -// Standard x86-64 ABI: RDI = z, RSI = p, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = p, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg_p521) - .text - -#define z %rdi -#define p %rsi -#define x %rdx - -#define q %rax -#define d0 %rcx -#define d1 %r8 -#define d2 %r9 -#define d3 %r10 -#define d4 %r11 - -S2N_BN_SYMBOL(bignum_optneg_p521): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Load most inputs (into the limited registers) and OR all of them to get q - - movq (x), d0 - movq d0, q - movq 8(x), d1 - orq d1, q - movq 16(x), d2 - orq d2, q - movq 24(x), d3 - orq d3, q - movq 32(x), d4 - orq d4, q - orq 40(x), q - orq 48(x), q - orq 56(x), q - orq 64(x), q - -// Turn q into a bitmask for "input is nonzero and p is nonzero", so that -// we avoid doing -0 = p_521 and hence maintain strict modular reduction - - negq q - sbbq q, q - testq p, p - cmovzq p, q - -// Since p_521 is all 1s, the subtraction is just an exclusive-or with q -// to give an optional inversion, with a slight fiddle for the top digit. - - xorq q, d0 - movq d0, (z) - xorq q, d1 - movq d1, 8(z) - xorq q, d2 - movq d2, 16(z) - xorq q, d3 - movq d3, 24(z) - xorq q, d4 - movq d4, 32(z) - movq 40(x), d0 - xorq q, d0 - movq d0, 40(z) - movq 48(x), d1 - xorq q, d1 - movq d1, 48(z) - movq 56(x), d2 - xorq q, d2 - movq d2, 56(z) - movq 64(x), d3 - andq $0x1FF, q - xorq q, d3 - movq d3, 64(z) - -// Return - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_tomont_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_tomont_p521.S deleted file mode 100644 index 7a87b67fb87..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_tomont_p521.S +++ /dev/null @@ -1,142 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert to Montgomery form z := (2^576 * x) mod p_521 -// Input x[9]; output z[9] -// -// extern void bignum_tomont_p521(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tomont_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tomont_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tomont_p521) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rax -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 -#define d4 %r10 -#define d5 %r11 -#define d6 %rbx - -#define d8 %rdx - -#define d8short %edx - -// Re-use the input pointer as other variable once safe to do so - -#define d7 %rsi - -S2N_BN_SYMBOL(bignum_tomont_p521): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save one more register - - CFI_PUSH(%rbx) - -// Separate out the input into x = 2^521 * H + L, so that x mod p_521 = -// (H + L) mod p_521 = if H + L >= p_521 then H + L - p_521 else H + L. - - movq 64(x), d0 - movl $0x1FF, d8short - andq d0, d8 - shrq $9, d0 - -// Force carry-in to get s = [d8;d7;d6;d5;d4;d3;d2;d1;d0] = H + L + 1. - - stc - adcq (x), d0 - movq 8(x), d1 - adcq $0, d1 - movq 16(x), d2 - adcq $0, d2 - movq 24(x), d3 - adcq $0, d3 - movq 32(x), d4 - adcq $0, d4 - movq 40(x), d5 - adcq $0, d5 - movq 48(x), d6 - adcq $0, d6 - movq 56(x), d7 - adcq $0, d7 - adcq $0, d8 - -// Set CF <=> s < 2^521 <=> H + L < p_521, so that if CF is set -// we want H + L = s - 1, otherwise (H + L) - p_521 = s - 2^521. -// This is done with just s - CF then masking to 521 bits. - - cmpq $512, d8 - - sbbq $0, d0 - sbbq $0, d1 - sbbq $0, d2 - sbbq $0, d3 - sbbq $0, d4 - sbbq $0, d5 - sbbq $0, d6 - sbbq $0, d7 - sbbq $0, d8 - -// So far, this is just a modular reduction as in bignum_mod_p521_9, -// except that the final masking of d8 is skipped since that comes out -// in the wash anyway from the next block, which is the Montgomery map, -// multiplying by 2^576 modulo p_521. Because 2^521 == 1 (mod p_521) -// this is just rotation left by 576 - 521 = 55 bits. Store back -// digits as created, though in a slightly peculiar order because we -// want to avoid using another register. - - shldq $55, d7, d8 - shldq $55, d6, d7 - movq d7, 56(z) - shldq $55, d5, d6 - movq d6, 48(z) - shldq $55, d4, d5 - movq d5, 40(z) - shldq $55, d3, d4 - movq d4, 32(z) - shldq $55, d2, d3 - movq d3, 24(z) - shldq $55, d1, d2 - movq d2, 16(z) - shldq $55, d0, d1 - movq d1, 8(z) - shldq $55, d8, d0 - movq d0, (z) - andq $0x1FF, d8 - movq d8, 64(z) - -// Restore register - - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_tomont_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_triple_p521.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_triple_p521.S deleted file mode 100644 index e2291fa56b9..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_triple_p521.S +++ /dev/null @@ -1,162 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_521, z := (3 * x) mod p_521, assuming x reduced -// Input x[9]; output z[9] -// -// extern void bignum_triple_p521(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p521) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p521) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p521) - .text - -#define z %rdi -#define x %rsi - -// d7 re-uses the input pointer when safe to do so - -#define d0 %rax -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 -#define d4 %r10 -#define d5 %r11 -#define d6 %r12 -#define d7 %rsi -#define d8 %rdx - -#define m %rbx -#define mshort %ebx - - - -S2N_BN_SYMBOL(bignum_triple_p521): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - -// Load the top (short) word first to compute the initial carry-in -// Set OF according to bit 520, but *always* set CF to get a +1 bump - - movq 64(x), m - movq m, d8 - shlq $54, m - addq m, m - stc - -// Use a double carry chain to compute x' + x + 1 where x' is a -// 1-bit left rotation of x; this is then == 3 * x + 1 (mod p_521) -// This gives us s = [d8;d7;d6;d5;d4;d3;d2;d1;d0] = x + x' + 1. - - movq (x), m - movq m, d0 - adcxq m, m - adoxq m, d0 - movq 8(x), m - movq m, d1 - adcxq m, m - adoxq m, d1 - movq 16(x), m - movq m, d2 - adcxq m, m - adoxq m, d2 - movq 24(x), m - movq m, d3 - adcxq m, m - adoxq m, d3 - movq 32(x), m - movq m, d4 - adcxq m, m - adoxq m, d4 - movq 40(x), m - movq m, d5 - adcxq m, m - adoxq m, d5 - movq 48(x), m - movq m, d6 - adcxq m, m - adoxq m, d6 - movq 56(x), m - movq m, d7 - adcxq m, m - adoxq m, d7 - -// The last word is slightly more intricate: we naturally end up adding -// 2 * top bit when we shouldn't (because it's a rotation and we've already -// added it at the LSB position) but then compensate by subtracting it. - - movq d8, m - adcxq m, m - adoxq m, d8 - andq $0x200, m - subq m, d8 - -// Now x + x' >= p_521 <=> s = x + x' + 1 >= 2^521 -// Make m = 512 * [x + x' >= p_521] - - movl $512, mshort - andq d8, m - -// Now if x + x' >= p_521, we want (x + x') - p_521 = s - 2^521 -// while otherwise we want x + x' = s - 1 -// We use the mask m both as an operand and to generate the dual carry -// Write back the results as generated - - cmpq $512, m - - sbbq $0, d0 - movq d0, (z) - sbbq $0, d1 - movq d1, 8(z) - sbbq $0, d2 - movq d2, 16(z) - sbbq $0, d3 - movq d3, 24(z) - sbbq $0, d4 - movq d4, 32(z) - sbbq $0, d5 - movq d5, 40(z) - sbbq $0, d6 - movq d6, 48(z) - sbbq $0, d7 - movq d7, 56(z) - sbbq m, d8 - movq d8, 64(z) - -// Restore registers and return - - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p521) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_triple_p521_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_triple_p521_alt.S deleted file mode 100644 index 3c084b1ae20..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/bignum_triple_p521_alt.S +++ /dev/null @@ -1,170 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_521, z := (3 * x) mod p_521, assuming x reduced -// Input x[9]; output z[9] -// -// extern void bignum_triple_p521_alt(uint64_t z[static 9], -// const uint64_t x[static 9]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p521_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p521_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p521_alt) - .text - -#define z %rdi -#define x %rsi - -// Digits; d8 is safely also used for the multiplier 3 - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 -#define d4 %rbx -#define d5 %rbp -#define d6 %r12 -#define d7 %rcx // Also used for multiplier m = 3 -#define d8 %rsi // Overwrites input pointer - -// Other variables - -#define m %rcx -#define a %rax -#define d %rdx - -S2N_BN_SYMBOL(bignum_triple_p521_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save additional registers to use - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - -// Let [d8;...;d0] = x' + x + 1 where x' is a rotation left by 1 bit -// as a 521-bit quantity. This is == 3 * x + 1 (mod p_521) and keeps -// in a more limited range so that the correction is easier. Mostly -// we do just multiply by 3, except that 2 * bit_520 is stuffed in -// at the bottom instead of the top, so the top two digits are a bit -// more intricate. - - movq $3, m - movq 64(x), d0 - shrq $8, d0 - incq d0 - - movq (x), a - mulq m - xorq d1, d1 - addq a, d0 - adcq d, d1 - - movq 8(x), a - mulq m - xorq d2, d2 - addq a, d1 - adcq d, d2 - - movq 16(x), a - mulq m - xorq d3, d3 - addq a, d2 - adcq d, d3 - - movq 24(x), a - mulq m - xorq d4, d4 - addq a, d3 - adcq d, d4 - - movq 32(x), a - mulq m - xorq d5, d5 - addq a, d4 - adcq d, d5 - - movq 40(x), a - mulq m - xorq d6, d6 - addq a, d5 - adcq d, d6 - - movq 48(x), a - mulq m - movq 56(x), d7 - movq 64(x), d8 - addq a, d6 - adcq $0, d - - movq $0xFF, a - andq d8, a - leaq (d8,a,2), d8 - - xorl %eax, %eax - addq d7, d - adcq a, d8 - addq d7, d7 - adcq a, d8 - addq d, d7 - adcq a, d8 - -// Now d8 >= 2^9 <=> x' + x + 1 >= 2^521 <=> x' + x >= p_521. -// If that is the case we want (x' + x) - p_521 = (x' + x + 1) - 2^521 -// while otherwise we want just x' + x = (x' + x + 1) - 1. - - cmpq $0x200, d8 - - sbbq a, d0 - movq d0, (z) - sbbq a, d1 - movq d1, 8(z) - sbbq a, d2 - movq d2, 16(z) - sbbq a, d3 - movq d3, 24(z) - sbbq a, d4 - movq d4, 32(z) - sbbq a, d5 - movq d5, 40(z) - sbbq a, d6 - movq d6, 48(z) - sbbq a, d7 - movq d7, 56(z) - sbbq a, d8 - andq $0x1FF, d8 - movq d8, 64(z) - -// Restore registers and return - - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p521_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jadd.S deleted file mode 100644 index 877a524c1af..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jadd.S +++ /dev/null @@ -1,878 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-521 in Jacobian coordinates -// -// extern void p521_jadd(uint64_t p3[static 27], const uint64_t p1[static 27], -// const uint64_t p2[static 27]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// It is assumed that all coordinates of the input points p1 and p2 are -// fully reduced mod p_521, that both z coordinates are nonzero and -// that neither p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents -// the same affine point as". -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p521_jadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p521_jadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p521_jadd) - .text - -// Size of individual field elements - -#define NUMSIZE 72 - -// Stable homes for input arguments during main code sequence -// These are where they arrive except for input_y, initially in %rdx - -#define input_z %rdi -#define input_x %rsi -#define input_y %rcx - -// Pointer-offset pairs for inputs and outputs - -#define x_1 0(input_x) -#define y_1 NUMSIZE(input_x) -#define z_1 (2*NUMSIZE)(input_x) - -#define x_2 0(input_y) -#define y_2 NUMSIZE(input_y) -#define z_2 (2*NUMSIZE)(input_y) - -#define x_3 0(input_z) -#define y_3 NUMSIZE(input_z) -#define z_3 (2*NUMSIZE)(input_z) - -// Pointer-offset pairs for temporaries, with some aliasing -// The tmp field is internal storage for field mul and sqr. -// NSPACE is the total stack needed for these temporaries - -#define z1sq (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define x1a (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define z2sq (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define y1a (NUMSIZE*6)(%rsp) - -#define tmp (NUMSIZE*7)(%rsp) - -#define NSPACE 568 - -// Corresponds exactly to bignum_mul_p521 - -#define mul_p521(P0,P1,P2) \ - xorl %ebp, %ebp ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - movq %r8, 504(%rsp) ; \ - mulxq 0x8+P1, %rbx, %r10 ; \ - adcq %rbx, %r9 ; \ - mulxq 0x10+P1, %rbx, %r11 ; \ - adcq %rbx, %r10 ; \ - mulxq 0x18+P1, %rbx, %r12 ; \ - adcq %rbx, %r11 ; \ - mulxq 0x20+P1, %rbx, %r13 ; \ - adcq %rbx, %r12 ; \ - mulxq 0x28+P1, %rbx, %r14 ; \ - adcq %rbx, %r13 ; \ - mulxq 0x30+P1, %rbx, %r15 ; \ - adcq %rbx, %r14 ; \ - mulxq 0x38+P1, %rbx, %r8 ; \ - adcq %rbx, %r15 ; \ - adcq %rbp, %r8 ; \ - movq 0x8+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - movq %r9, 512(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x38+P1, %rax, %r9 ; \ - adcxq %rax, %r8 ; \ - adoxq %rbp, %r9 ; \ - adcq %rbp, %r9 ; \ - movq 0x10+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - movq %r10, 520(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x38+P1, %rax, %r10 ; \ - adcxq %rax, %r9 ; \ - adoxq %rbp, %r10 ; \ - adcq %rbp, %r10 ; \ - movq 0x18+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq %r11, 528(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x38+P1, %rax, %r11 ; \ - adcxq %rax, %r10 ; \ - adoxq %rbp, %r11 ; \ - adcq %rbp, %r11 ; \ - movq 0x20+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movq %r12, 536(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x38+P1, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbp, %r12 ; \ - adcq %rbp, %r12 ; \ - movq 0x28+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - movq %r13, 544(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x38+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rbp, %r13 ; \ - adcq %rbp, %r13 ; \ - movq 0x30+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - movq %r14, 552(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x38+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rbp, %r14 ; \ - adcq %rbp, %r14 ; \ - movq 0x38+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - movq %r15, 560(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x38+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rbp, %r15 ; \ - adcq %rbp, %r15 ; \ - movq 0x40+P1, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P2, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x8+P2, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x10+P2, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x18+P2, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x20+P2, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x28+P2, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x30+P2, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x38+P2, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbp, %rbx ; \ - adcq %rbx, %rbp ; \ - movq 0x40+P2, %rdx ; \ - xorl %eax, %eax ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x38+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %rbp ; \ - mulxq 0x40+P1, %rax, %rbx ; \ - adcq %rax, %rbp ; \ - movq %r8, %rax ; \ - andq $0x1ff, %rax ; \ - shrdq $0x9, %r9, %r8 ; \ - shrdq $0x9, %r10, %r9 ; \ - shrdq $0x9, %r11, %r10 ; \ - shrdq $0x9, %r12, %r11 ; \ - shrdq $0x9, %r13, %r12 ; \ - shrdq $0x9, %r14, %r13 ; \ - shrdq $0x9, %r15, %r14 ; \ - shrdq $0x9, %rbp, %r15 ; \ - shrq $0x9, %rbp ; \ - addq %rax, %rbp ; \ - stc; \ - adcq 504(%rsp), %r8 ; \ - adcq 512(%rsp), %r9 ; \ - adcq 520(%rsp), %r10 ; \ - adcq 528(%rsp), %r11 ; \ - adcq 536(%rsp), %r12 ; \ - adcq 544(%rsp), %r13 ; \ - adcq 552(%rsp), %r14 ; \ - adcq 560(%rsp), %r15 ; \ - adcq $0xfffffffffffffe00, %rbp ; \ - cmc; \ - sbbq $0x0, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x8+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x18+P0 ; \ - sbbq $0x0, %r12 ; \ - movq %r12, 0x20+P0 ; \ - sbbq $0x0, %r13 ; \ - movq %r13, 0x28+P0 ; \ - sbbq $0x0, %r14 ; \ - movq %r14, 0x30+P0 ; \ - sbbq $0x0, %r15 ; \ - movq %r15, 0x38+P0 ; \ - sbbq $0x0, %rbp ; \ - andq $0x1ff, %rbp ; \ - movq %rbp, 0x40+P0 - -// Corresponds exactly to bignum_sqr_p521 - -#define sqr_p521(P0,P1) \ - xorl %ebp, %ebp ; \ - movq P1, %rdx ; \ - mulxq 0x8+P1, %r9, %rax ; \ - movq %r9, 512(%rsp) ; \ - mulxq 0x10+P1, %r10, %rbx ; \ - adcxq %rax, %r10 ; \ - movq %r10, 520(%rsp) ; \ - mulxq 0x18+P1, %r11, %rax ; \ - adcxq %rbx, %r11 ; \ - mulxq 0x20+P1, %r12, %rbx ; \ - adcxq %rax, %r12 ; \ - mulxq 0x28+P1, %r13, %rax ; \ - adcxq %rbx, %r13 ; \ - mulxq 0x30+P1, %r14, %rbx ; \ - adcxq %rax, %r14 ; \ - mulxq 0x38+P1, %r15, %r8 ; \ - adcxq %rbx, %r15 ; \ - adcxq %rbp, %r8 ; \ - xorl %ebp, %ebp ; \ - movq 0x8+P1, %rdx ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq %r11, 528(%rsp) ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movq %r12, 536(%rsp) ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x38+P1, %rax, %r9 ; \ - adcxq %rax, %r8 ; \ - adoxq %rbp, %r9 ; \ - movq 0x20+P1, %rdx ; \ - mulxq 0x28+P1, %rax, %r10 ; \ - adcxq %rax, %r9 ; \ - adoxq %rbp, %r10 ; \ - adcxq %rbp, %r10 ; \ - xorl %ebp, %ebp ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - movq %r13, 544(%rsp) ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - movq %r14, 552(%rsp) ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x38+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - movq 0x30+P1, %rdx ; \ - mulxq 0x20+P1, %rax, %r11 ; \ - adcxq %rax, %r10 ; \ - adoxq %rbp, %r11 ; \ - mulxq 0x28+P1, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbp, %r12 ; \ - adcxq %rbp, %r12 ; \ - xorl %ebp, %ebp ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - movq %r15, 560(%rsp) ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x38+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - movq 0x38+P1, %rdx ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x28+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rbp, %r13 ; \ - mulxq 0x30+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rbp, %r14 ; \ - adcxq %rbp, %r14 ; \ - xorl %ebp, %ebp ; \ - movq P1, %rdx ; \ - mulxq %rdx, %rax, %rbx ; \ - movq %rax, 504(%rsp) ; \ - movq 512(%rsp), %rax ; \ - adcxq %rax, %rax ; \ - adoxq %rbx, %rax ; \ - movq %rax, 512(%rsp) ; \ - movq 520(%rsp), %rax ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rdx, %rbx ; \ - adcxq %rax, %rax ; \ - adoxq %rdx, %rax ; \ - movq %rax, 520(%rsp) ; \ - movq 528(%rsp), %rax ; \ - adcxq %rax, %rax ; \ - adoxq %rbx, %rax ; \ - movq %rax, 528(%rsp) ; \ - movq 536(%rsp), %rax ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rdx, %rbx ; \ - adcxq %rax, %rax ; \ - adoxq %rdx, %rax ; \ - movq %rax, 536(%rsp) ; \ - movq 544(%rsp), %rax ; \ - adcxq %rax, %rax ; \ - adoxq %rbx, %rax ; \ - movq %rax, 544(%rsp) ; \ - movq 552(%rsp), %rax ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rdx, %rbx ; \ - adcxq %rax, %rax ; \ - adoxq %rdx, %rax ; \ - movq %rax, 552(%rsp) ; \ - movq 560(%rsp), %rax ; \ - adcxq %rax, %rax ; \ - adoxq %rbx, %rax ; \ - movq %rax, 560(%rsp) ; \ - movq 0x20+P1, %rdx ; \ - mulxq %rdx, %rdx, %rbx ; \ - adcxq %r8, %r8 ; \ - adoxq %rdx, %r8 ; \ - adcxq %r9, %r9 ; \ - adoxq %rbx, %r9 ; \ - movq 0x28+P1, %rdx ; \ - mulxq %rdx, %rdx, %rbx ; \ - adcxq %r10, %r10 ; \ - adoxq %rdx, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rbx, %r11 ; \ - movq 0x30+P1, %rdx ; \ - mulxq %rdx, %rdx, %rbx ; \ - adcxq %r12, %r12 ; \ - adoxq %rdx, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rbx, %r13 ; \ - movq 0x38+P1, %rdx ; \ - mulxq %rdx, %rdx, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rdx, %r14 ; \ - adcxq %rbp, %r15 ; \ - adoxq %rbp, %r15 ; \ - movq 0x40+P1, %rdx ; \ - movq %rdx, %rbp ; \ - imulq %rbp, %rbp ; \ - addq %rdx, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x38+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %rbp ; \ - adcq $0x0, %rbp ; \ - movq %r8, %rax ; \ - andq $0x1ff, %rax ; \ - shrdq $0x9, %r9, %r8 ; \ - shrdq $0x9, %r10, %r9 ; \ - shrdq $0x9, %r11, %r10 ; \ - shrdq $0x9, %r12, %r11 ; \ - shrdq $0x9, %r13, %r12 ; \ - shrdq $0x9, %r14, %r13 ; \ - shrdq $0x9, %r15, %r14 ; \ - shrdq $0x9, %rbp, %r15 ; \ - shrq $0x9, %rbp ; \ - addq %rax, %rbp ; \ - stc; \ - adcq 504(%rsp), %r8 ; \ - adcq 512(%rsp), %r9 ; \ - adcq 520(%rsp), %r10 ; \ - adcq 528(%rsp), %r11 ; \ - adcq 536(%rsp), %r12 ; \ - adcq 544(%rsp), %r13 ; \ - adcq 552(%rsp), %r14 ; \ - adcq 560(%rsp), %r15 ; \ - adcq $0xfffffffffffffe00, %rbp ; \ - cmc; \ - sbbq $0x0, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x8+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x18+P0 ; \ - sbbq $0x0, %r12 ; \ - movq %r12, 0x20+P0 ; \ - sbbq $0x0, %r13 ; \ - movq %r13, 0x28+P0 ; \ - sbbq $0x0, %r14 ; \ - movq %r14, 0x30+P0 ; \ - sbbq $0x0, %r15 ; \ - movq %r15, 0x38+P0 ; \ - sbbq $0x0, %rbp ; \ - andq $0x1ff, %rbp ; \ - movq %rbp, 0x40+P0 - -// Corresponds exactly to bignum_sub_p521 - -#define sub_p521(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rdx ; \ - sbbq 0x8+P2, %rdx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq 0x20+P1, %r10 ; \ - sbbq 0x20+P2, %r10 ; \ - movq 0x28+P1, %r11 ; \ - sbbq 0x28+P2, %r11 ; \ - movq 0x30+P1, %r12 ; \ - sbbq 0x30+P2, %r12 ; \ - movq 0x38+P1, %r13 ; \ - sbbq 0x38+P2, %r13 ; \ - movq 0x40+P1, %r14 ; \ - sbbq 0x40+P2, %r14 ; \ - sbbq $0x0, %rax ; \ - movq %rax, P0 ; \ - sbbq $0x0, %rdx ; \ - movq %rdx, 0x8+P0 ; \ - sbbq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x18+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x20+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x28+P0 ; \ - sbbq $0x0, %r12 ; \ - movq %r12, 0x30+P0 ; \ - sbbq $0x0, %r13 ; \ - movq %r13, 0x38+P0 ; \ - sbbq $0x0, %r14 ; \ - andq $0x1ff, %r14 ; \ - movq %r14, 0x40+P0 - -// Additional macros to help with final multiplexing - -#define load9(r0,r1,r2,r3,r4,r5,r6,r7,ra,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 ; \ - movq 32+P, r4 ; \ - movq 40+P, r5 ; \ - movq 48+P, r6 ; \ - movq 56+P, r7 ; \ - movq 64+P, ra - -#define store9(P,r0,r1,r2,r3,r4,r5,r6,r7,ra) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P ; \ - movq r4, 32+P ; \ - movq r5, 40+P ; \ - movq r6, 48+P ; \ - movq r7, 56+P ; \ - movq ra, 64+P - -#define muxload9(r0,r1,r2,r3,r4,r5,r6,r7,ra,P0,P1,P2) \ - movq P0, r0 ; \ - cmovbq P1, r0 ; \ - cmovnbe P2, r0 ; \ - movq 8+P0, r1 ; \ - cmovbq 8+P1, r1 ; \ - cmovnbe 8+P2, r1 ; \ - movq 16+P0, r2 ; \ - cmovbq 16+P1, r2 ; \ - cmovnbe 16+P2, r2 ; \ - movq 24+P0, r3 ; \ - cmovbq 24+P1, r3 ; \ - cmovnbe 24+P2, r3 ; \ - movq 32+P0, r4 ; \ - cmovbq 32+P1, r4 ; \ - cmovnbe 32+P2, r4 ; \ - movq 40+P0, r5 ; \ - cmovbq 40+P1, r5 ; \ - cmovnbe 40+P2, r5 ; \ - movq 48+P0, r6 ; \ - cmovbq 48+P1, r6 ; \ - cmovnbe 48+P2, r6 ; \ - movq 56+P0, r7 ; \ - cmovbq 56+P1, r7 ; \ - cmovnbe 56+P2, r7 ; \ - movq 64+P0, ra ; \ - cmovbq 64+P1, ra ; \ - cmovnbe 64+P2, ra - -#define copy9(P0,P1) \ - movq P1, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - movq %rax, 24+P0 ; \ - movq 32+P1, %rax ; \ - movq %rax, 32+P0 ; \ - movq 40+P1, %rax ; \ - movq %rax, 40+P0 ; \ - movq 48+P1, %rax ; \ - movq %rax, 48+P0 ; \ - movq 56+P1, %rax ; \ - movq %rax, 56+P0 ; \ - movq 64+P1, %rax ; \ - movq %rax, 64+P0 - -S2N_BN_SYMBOL(p521_jadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Move the input arguments to stable places (two are already there) - - movq %rdx, input_y - -// Main code, just a sequence of basic field operations - - sqr_p521(z1sq,z_1) - sqr_p521(z2sq,z_2) - - mul_p521(y1a,z_2,y_1) - mul_p521(y2a,z_1,y_2) - - mul_p521(x2a,z1sq,x_2) - mul_p521(x1a,z2sq,x_1) - mul_p521(y2a,z1sq,y2a) - mul_p521(y1a,z2sq,y1a) - - sub_p521(xd,x2a,x1a) - sub_p521(yd,y2a,y1a) - - sqr_p521(zz,xd) - sqr_p521(ww,yd) - - mul_p521(zzx1,zz,x1a) - mul_p521(zzx2,zz,x2a) - - sub_p521(resx,ww,zzx1) - sub_p521(t1,zzx2,zzx1) - - mul_p521(xd,xd,z_1) - - sub_p521(resx,resx,zzx2) - - sub_p521(t2,zzx1,resx) - - mul_p521(t1,t1,y1a) - mul_p521(resz,xd,z_2) - mul_p521(t2,yd,t2) - - sub_p521(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "NBE" <=> ~(CF \/ ZF) <=> P1 = 0 /\ ~(P2 = 0) -// and "B" <=> CF <=> ~(P1 = 0) /\ P2 = 0 -// and "Z" <=> ZF <=> (P1 = 0 <=> P2 = 0) - - load9(%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp,z_1) - orq %r9, %r8 - orq %r11, %r10 - orq %r13, %r12 - orq %r15, %r14 - orq %r10, %r8 - orq %r14, %r12 - orq %rbp, %r8 - orq %r12, %r8 - negq %r8 - sbbq %rax, %rax - - load9(%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp,z_2) - orq %r9, %r8 - orq %r11, %r10 - orq %r13, %r12 - orq %r15, %r14 - orq %r10, %r8 - orq %r14, %r12 - orq %rbp, %r8 - orq %r12, %r8 - negq %r8 - sbbq %rdx, %rdx - - cmpq %rax, %rdx - -// Multiplex the outputs accordingly. Re-store them in resz until there -// are no more loads, so there are no assumptions on input-output aliasing - - muxload9(%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp,resy,y_1,y_2) - store9(resy,%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp) - muxload9(%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp,resz,z_1,z_2) - store9(resz,%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp) - muxload9(%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp,resx,x_1,x_2) - store9(x_3,%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp) - copy9(y_3,resy) - copy9(z_3,resz) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p521_jadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jadd_alt.S deleted file mode 100644 index d7579da2481..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jadd_alt.S +++ /dev/null @@ -1,1154 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on NIST curve P-521 in Jacobian coordinates -// -// extern void p521_jadd_alt(uint64_t p3[static 27], const uint64_t p1[static 27], -// const uint64_t p2[static 27]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// It is assumed that all coordinates of the input points p1 and p2 are -// fully reduced mod p_521, that both z coordinates are nonzero and -// that neither p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents -// the same affine point as". -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p521_jadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p521_jadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p521_jadd_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 72 - -// Stable homes for input arguments during main code sequence -// These are where they arrive except for input_y, initially in %rdx - -#define input_z %rdi -#define input_x %rsi -#define input_y %rcx - -// Pointer-offset pairs for inputs and outputs - -#define x_1 0(input_x) -#define y_1 NUMSIZE(input_x) -#define z_1 (2*NUMSIZE)(input_x) - -#define x_2 0(input_y) -#define y_2 NUMSIZE(input_y) -#define z_2 (2*NUMSIZE)(input_y) - -#define x_3 0(input_z) -#define y_3 NUMSIZE(input_z) -#define z_3 (2*NUMSIZE)(input_z) - -// Pointer-offset pairs for temporaries, with some aliasing -// The tmp field is internal storage for field mul and sqr. -// NSPACE is the total stack needed for these temporaries - -#define z1sq (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define x1a (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define z2sq (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define y1a (NUMSIZE*6)(%rsp) - -#define tmp (NUMSIZE*7)(%rsp) - -#define NSPACE NUMSIZE*8 - -// Corresponds exactly to bignum_mul_p521_alt except temp storage - -#define mul_p521(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, 504(%rsp) ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq %r11, %r11 ; \ - movq %r9, 512(%rsp) ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq %r10, 520(%rsp) ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq %r11, 528(%rsp) ; \ - xorq %r14, %r14 ; \ - movq P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x20+P1, %rax ; \ - mulq P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq %r12, 536(%rsp) ; \ - xorq %r15, %r15 ; \ - movq P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x28+P1, %rax ; \ - mulq P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq %r13, 544(%rsp) ; \ - xorq %r8, %r8 ; \ - movq P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r8, %r8 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x30+P1, %rax ; \ - mulq P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq %r14, 552(%rsp) ; \ - xorq %r9, %r9 ; \ - movq P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq %r9, %r9 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x38+P1, %rax ; \ - mulq P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq %r15, 560(%rsp) ; \ - xorq %r10, %r10 ; \ - movq P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %r10, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x40+P1, %rax ; \ - mulq P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq %r8, 568(%rsp) ; \ - xorq %r11, %r11 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq %r11, %r11 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - xorq %r8, %r8 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r8, %r8 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - movq 0x40+P1, %rax ; \ - imulq 0x40+P2, %rax ; \ - addq %r8, %rax ; \ - movq 568(%rsp), %r8 ; \ - movq %r8, %rdx ; \ - andq $0x1ff, %rdx ; \ - shrdq $0x9, %r9, %r8 ; \ - shrdq $0x9, %r10, %r9 ; \ - shrdq $0x9, %r11, %r10 ; \ - shrdq $0x9, %r12, %r11 ; \ - shrdq $0x9, %r13, %r12 ; \ - shrdq $0x9, %r14, %r13 ; \ - shrdq $0x9, %r15, %r14 ; \ - shrdq $0x9, %rax, %r15 ; \ - shrq $0x9, %rax ; \ - addq %rax, %rdx ; \ - stc; \ - adcq 504(%rsp), %r8 ; \ - adcq 512(%rsp), %r9 ; \ - adcq 520(%rsp), %r10 ; \ - adcq 528(%rsp), %r11 ; \ - adcq 536(%rsp), %r12 ; \ - adcq 544(%rsp), %r13 ; \ - adcq 552(%rsp), %r14 ; \ - adcq 560(%rsp), %r15 ; \ - adcq $0xfffffffffffffe00, %rdx ; \ - cmc; \ - sbbq $0x0, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x8+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x18+P0 ; \ - sbbq $0x0, %r12 ; \ - movq %r12, 0x20+P0 ; \ - sbbq $0x0, %r13 ; \ - movq %r13, 0x28+P0 ; \ - sbbq $0x0, %r14 ; \ - movq %r14, 0x30+P0 ; \ - sbbq $0x0, %r15 ; \ - movq %r15, 0x38+P0 ; \ - sbbq $0x0, %rdx ; \ - andq $0x1ff, %rdx ; \ - movq %rdx, 0x40+P0 - -// Corresponds to bignum_sqr_p521_alt except %rbp is used -// in place of %rcx and tmp is the temp storage location - -#define sqr_p521(P0,P1) \ - movq P1, %rax ; \ - mulq %rax; \ - movq %rax, 504(%rsp) ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r11 ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq %r9, 512(%rsp) ; \ - xorq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r12 ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq %r10, 520(%rsp) ; \ - movq P1, %rax ; \ - mulq 0x18+P1; \ - xorq %r13, %r13 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r13 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r13, %r13 ; \ - addq %rbx, %r11 ; \ - adcq %rbp, %r12 ; \ - adcq $0x0, %r13 ; \ - movq %r11, 528(%rsp) ; \ - movq P1, %rax ; \ - mulq 0x20+P1; \ - xorq %r14, %r14 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r14 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r14, %r14 ; \ - addq %rbx, %r12 ; \ - adcq %rbp, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq %r12, 536(%rsp) ; \ - movq P1, %rax ; \ - mulq 0x28+P1; \ - xorq %r15, %r15 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq 0x20+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r15 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r15, %r15 ; \ - addq %rbx, %r13 ; \ - adcq %rbp, %r14 ; \ - adcq $0x0, %r15 ; \ - movq %r13, 544(%rsp) ; \ - movq P1, %rax ; \ - mulq 0x30+P1; \ - xorq %r8, %r8 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq 0x28+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r8 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x20+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r8 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r8, %r8 ; \ - addq %rbx, %r14 ; \ - adcq %rbp, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq %r14, 552(%rsp) ; \ - movq P1, %rax ; \ - mulq 0x38+P1; \ - xorq %r9, %r9 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq 0x30+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r9 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x28+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r9 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x20+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r9 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r9, %r9 ; \ - addq %rbx, %r15 ; \ - adcq %rbp, %r8 ; \ - adcq $0x0, %r9 ; \ - movq %r15, 560(%rsp) ; \ - movq P1, %rax ; \ - mulq 0x40+P1; \ - xorq %r10, %r10 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq 0x38+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r10 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x30+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r10 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x28+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r10 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r10, %r10 ; \ - addq %rbx, %r8 ; \ - adcq %rbp, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x20+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq %r8, 568(%rsp) ; \ - movq 0x8+P1, %rax ; \ - mulq 0x40+P1; \ - xorq %r11, %r11 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x10+P1, %rax ; \ - mulq 0x38+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r11 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x30+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r11 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x28+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r11 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r11, %r11 ; \ - addq %rbx, %r9 ; \ - adcq %rbp, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x40+P1; \ - xorq %r12, %r12 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x18+P1, %rax ; \ - mulq 0x38+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r12 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x30+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r12 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r12, %r12 ; \ - addq %rbx, %r10 ; \ - adcq %rbp, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x28+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x40+P1; \ - xorq %r13, %r13 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x20+P1, %rax ; \ - mulq 0x38+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r13 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x30+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r13 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r13, %r13 ; \ - addq %rbx, %r11 ; \ - adcq %rbp, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x40+P1; \ - xorq %r14, %r14 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x28+P1, %rax ; \ - mulq 0x38+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r14 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r14, %r14 ; \ - addq %rbx, %r12 ; \ - adcq %rbp, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x30+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x40+P1; \ - xorq %r15, %r15 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x30+P1, %rax ; \ - mulq 0x38+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r15 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r15, %r15 ; \ - addq %rbx, %r13 ; \ - adcq %rbp, %r14 ; \ - adcq $0x0, %r15 ; \ - xorq %r8, %r8 ; \ - movq 0x38+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x40+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r8 ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x40+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - movq 0x40+P1, %rax ; \ - imulq %rax, %rax ; \ - addq %r8, %rax ; \ - movq 568(%rsp), %r8 ; \ - movq %r8, %rdx ; \ - andq $0x1ff, %rdx ; \ - shrdq $0x9, %r9, %r8 ; \ - shrdq $0x9, %r10, %r9 ; \ - shrdq $0x9, %r11, %r10 ; \ - shrdq $0x9, %r12, %r11 ; \ - shrdq $0x9, %r13, %r12 ; \ - shrdq $0x9, %r14, %r13 ; \ - shrdq $0x9, %r15, %r14 ; \ - shrdq $0x9, %rax, %r15 ; \ - shrq $0x9, %rax ; \ - addq %rax, %rdx ; \ - stc; \ - adcq 504(%rsp), %r8 ; \ - adcq 512(%rsp), %r9 ; \ - adcq 520(%rsp), %r10 ; \ - adcq 528(%rsp), %r11 ; \ - adcq 536(%rsp), %r12 ; \ - adcq 544(%rsp), %r13 ; \ - adcq 552(%rsp), %r14 ; \ - adcq 560(%rsp), %r15 ; \ - adcq $0xfffffffffffffe00, %rdx ; \ - cmc; \ - sbbq $0x0, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x8+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x18+P0 ; \ - sbbq $0x0, %r12 ; \ - movq %r12, 0x20+P0 ; \ - sbbq $0x0, %r13 ; \ - movq %r13, 0x28+P0 ; \ - sbbq $0x0, %r14 ; \ - movq %r14, 0x30+P0 ; \ - sbbq $0x0, %r15 ; \ - movq %r15, 0x38+P0 ; \ - sbbq $0x0, %rdx ; \ - andq $0x1ff, %rdx ; \ - movq %rdx, 0x40+P0 - -// Corresponds exactly to bignum_sub_p521 - -#define sub_p521(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rdx ; \ - sbbq 0x8+P2, %rdx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq 0x20+P1, %r10 ; \ - sbbq 0x20+P2, %r10 ; \ - movq 0x28+P1, %r11 ; \ - sbbq 0x28+P2, %r11 ; \ - movq 0x30+P1, %r12 ; \ - sbbq 0x30+P2, %r12 ; \ - movq 0x38+P1, %r13 ; \ - sbbq 0x38+P2, %r13 ; \ - movq 0x40+P1, %r14 ; \ - sbbq 0x40+P2, %r14 ; \ - sbbq $0x0, %rax ; \ - movq %rax, P0 ; \ - sbbq $0x0, %rdx ; \ - movq %rdx, 0x8+P0 ; \ - sbbq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x18+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x20+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x28+P0 ; \ - sbbq $0x0, %r12 ; \ - movq %r12, 0x30+P0 ; \ - sbbq $0x0, %r13 ; \ - movq %r13, 0x38+P0 ; \ - sbbq $0x0, %r14 ; \ - andq $0x1ff, %r14 ; \ - movq %r14, 0x40+P0 - -// Additional macros to help with final multiplexing - -#define load9(r0,r1,r2,r3,r4,r5,r6,r7,ra,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 ; \ - movq 32+P, r4 ; \ - movq 40+P, r5 ; \ - movq 48+P, r6 ; \ - movq 56+P, r7 ; \ - movq 64+P, ra - -#define store9(P,r0,r1,r2,r3,r4,r5,r6,r7,ra) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P ; \ - movq r4, 32+P ; \ - movq r5, 40+P ; \ - movq r6, 48+P ; \ - movq r7, 56+P ; \ - movq ra, 64+P - -#define muxload9(r0,r1,r2,r3,r4,r5,r6,r7,ra,P0,P1,P2) \ - movq P0, r0 ; \ - cmovbq P1, r0 ; \ - cmovnbe P2, r0 ; \ - movq 8+P0, r1 ; \ - cmovbq 8+P1, r1 ; \ - cmovnbe 8+P2, r1 ; \ - movq 16+P0, r2 ; \ - cmovbq 16+P1, r2 ; \ - cmovnbe 16+P2, r2 ; \ - movq 24+P0, r3 ; \ - cmovbq 24+P1, r3 ; \ - cmovnbe 24+P2, r3 ; \ - movq 32+P0, r4 ; \ - cmovbq 32+P1, r4 ; \ - cmovnbe 32+P2, r4 ; \ - movq 40+P0, r5 ; \ - cmovbq 40+P1, r5 ; \ - cmovnbe 40+P2, r5 ; \ - movq 48+P0, r6 ; \ - cmovbq 48+P1, r6 ; \ - cmovnbe 48+P2, r6 ; \ - movq 56+P0, r7 ; \ - cmovbq 56+P1, r7 ; \ - cmovnbe 56+P2, r7 ; \ - movq 64+P0, ra ; \ - cmovbq 64+P1, ra ; \ - cmovnbe 64+P2, ra - -#define copy9(P0,P1) \ - movq P1, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - movq %rax, 24+P0 ; \ - movq 32+P1, %rax ; \ - movq %rax, 32+P0 ; \ - movq 40+P1, %rax ; \ - movq %rax, 40+P0 ; \ - movq 48+P1, %rax ; \ - movq %rax, 48+P0 ; \ - movq 56+P1, %rax ; \ - movq %rax, 56+P0 ; \ - movq 64+P1, %rax ; \ - movq %rax, 64+P0 - -S2N_BN_SYMBOL(p521_jadd_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Move the input arguments to stable places (two are already there) - - movq %rdx, input_y - -// Main code, just a sequence of basic field operations - - sqr_p521(z1sq,z_1) - sqr_p521(z2sq,z_2) - - mul_p521(y1a,z_2,y_1) - mul_p521(y2a,z_1,y_2) - - mul_p521(x2a,z1sq,x_2) - mul_p521(x1a,z2sq,x_1) - mul_p521(y2a,z1sq,y2a) - mul_p521(y1a,z2sq,y1a) - - sub_p521(xd,x2a,x1a) - sub_p521(yd,y2a,y1a) - - sqr_p521(zz,xd) - sqr_p521(ww,yd) - - mul_p521(zzx1,zz,x1a) - mul_p521(zzx2,zz,x2a) - - sub_p521(resx,ww,zzx1) - sub_p521(t1,zzx2,zzx1) - - mul_p521(xd,xd,z_1) - - sub_p521(resx,resx,zzx2) - - sub_p521(t2,zzx1,resx) - - mul_p521(t1,t1,y1a) - mul_p521(resz,xd,z_2) - mul_p521(t2,yd,t2) - - sub_p521(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "NBE" <=> ~(CF \/ ZF) <=> P1 = 0 /\ ~(P2 = 0) -// and "B" <=> CF <=> ~(P1 = 0) /\ P2 = 0 -// and "Z" <=> ZF <=> (P1 = 0 <=> P2 = 0) - - load9(%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp,z_1) - orq %r9, %r8 - orq %r11, %r10 - orq %r13, %r12 - orq %r15, %r14 - orq %r10, %r8 - orq %r14, %r12 - orq %rbp, %r8 - orq %r12, %r8 - negq %r8 - sbbq %rax, %rax - - load9(%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp,z_2) - orq %r9, %r8 - orq %r11, %r10 - orq %r13, %r12 - orq %r15, %r14 - orq %r10, %r8 - orq %r14, %r12 - orq %rbp, %r8 - orq %r12, %r8 - negq %r8 - sbbq %rdx, %rdx - - cmpq %rax, %rdx - -// Multiplex the outputs accordingly. Re-store them in resz until there -// are no more loads, so there are no assumptions on input-output aliasing - - muxload9(%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp,resy,y_1,y_2) - store9(resy,%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp) - muxload9(%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp,resz,z_1,z_2) - store9(resz,%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp) - muxload9(%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp,resx,x_1,x_2) - store9(x_3,%r8,%r9,%r10,%r11,%r12,%r13,%r14,%r15,%rbp) - copy9(y_3,resy) - copy9(z_3,resz) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p521_jadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jmixadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jmixadd.S deleted file mode 100644 index 51ade217ced..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jmixadd.S +++ /dev/null @@ -1,873 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on NIST curve P-521 in Jacobian coordinates -// -// extern void p521_jmixadd(uint64_t p3[static 27], const uint64_t p1[static 27], -// const uint64_t p2[static 18]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. It is assumed that -// all the coordinates of the input points p1 and p2 are fully reduced -// mod p_521, that the z coordinate of p1 is nonzero and that neither -// p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents the same affine -// point as". -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p521_jmixadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p521_jmixadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p521_jmixadd) - .text - -// Size of individual field elements - -#define NUMSIZE 72 - -// Stable homes for input arguments during main code sequence -// These are where they arrive except for input_y, initially in %rdx - -#define input_z %rdi -#define input_x %rsi -#define input_y %rcx - -// Pointer-offset pairs for inputs and outputs - -#define x_1 0(input_x) -#define y_1 NUMSIZE(input_x) -#define z_1 (2*NUMSIZE)(input_x) - -#define x_2 0(input_y) -#define y_2 NUMSIZE(input_y) - -#define x_3 0(input_z) -#define y_3 NUMSIZE(input_z) -#define z_3 (2*NUMSIZE)(input_z) - -// Pointer-offset pairs for temporaries, with some aliasing -// The tmp field is internal storage for field mul and sqr. -// NSPACE is the total stack needed for these temporaries - -#define zp2 (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define tmp (NUMSIZE*6)(%rsp) - -#define NSPACE 496 - -// Corresponds exactly to bignum_mul_p521 - -#define mul_p521(P0,P1,P2) \ - xorl %ebp, %ebp ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - movq %r8, 432(%rsp) ; \ - mulxq 0x8+P1, %rbx, %r10 ; \ - adcq %rbx, %r9 ; \ - mulxq 0x10+P1, %rbx, %r11 ; \ - adcq %rbx, %r10 ; \ - mulxq 0x18+P1, %rbx, %r12 ; \ - adcq %rbx, %r11 ; \ - mulxq 0x20+P1, %rbx, %r13 ; \ - adcq %rbx, %r12 ; \ - mulxq 0x28+P1, %rbx, %r14 ; \ - adcq %rbx, %r13 ; \ - mulxq 0x30+P1, %rbx, %r15 ; \ - adcq %rbx, %r14 ; \ - mulxq 0x38+P1, %rbx, %r8 ; \ - adcq %rbx, %r15 ; \ - adcq %rbp, %r8 ; \ - movq 0x8+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - movq %r9, 440(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x38+P1, %rax, %r9 ; \ - adcxq %rax, %r8 ; \ - adoxq %rbp, %r9 ; \ - adcq %rbp, %r9 ; \ - movq 0x10+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - movq %r10, 448(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x38+P1, %rax, %r10 ; \ - adcxq %rax, %r9 ; \ - adoxq %rbp, %r10 ; \ - adcq %rbp, %r10 ; \ - movq 0x18+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq %r11, 456(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x38+P1, %rax, %r11 ; \ - adcxq %rax, %r10 ; \ - adoxq %rbp, %r11 ; \ - adcq %rbp, %r11 ; \ - movq 0x20+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movq %r12, 464(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x38+P1, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbp, %r12 ; \ - adcq %rbp, %r12 ; \ - movq 0x28+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - movq %r13, 472(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x38+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rbp, %r13 ; \ - adcq %rbp, %r13 ; \ - movq 0x30+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - movq %r14, 480(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x38+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rbp, %r14 ; \ - adcq %rbp, %r14 ; \ - movq 0x38+P2, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - movq %r15, 488(%rsp) ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x38+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rbp, %r15 ; \ - adcq %rbp, %r15 ; \ - movq 0x40+P1, %rdx ; \ - xorl %ebp, %ebp ; \ - mulxq P2, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x8+P2, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x10+P2, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x18+P2, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x20+P2, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x28+P2, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x30+P2, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x38+P2, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbp, %rbx ; \ - adcq %rbx, %rbp ; \ - movq 0x40+P2, %rdx ; \ - xorl %eax, %eax ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x38+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %rbp ; \ - mulxq 0x40+P1, %rax, %rbx ; \ - adcq %rax, %rbp ; \ - movq %r8, %rax ; \ - andq $0x1ff, %rax ; \ - shrdq $0x9, %r9, %r8 ; \ - shrdq $0x9, %r10, %r9 ; \ - shrdq $0x9, %r11, %r10 ; \ - shrdq $0x9, %r12, %r11 ; \ - shrdq $0x9, %r13, %r12 ; \ - shrdq $0x9, %r14, %r13 ; \ - shrdq $0x9, %r15, %r14 ; \ - shrdq $0x9, %rbp, %r15 ; \ - shrq $0x9, %rbp ; \ - addq %rax, %rbp ; \ - stc; \ - adcq 432(%rsp), %r8 ; \ - adcq 440(%rsp), %r9 ; \ - adcq 448(%rsp), %r10 ; \ - adcq 456(%rsp), %r11 ; \ - adcq 464(%rsp), %r12 ; \ - adcq 472(%rsp), %r13 ; \ - adcq 480(%rsp), %r14 ; \ - adcq 488(%rsp), %r15 ; \ - adcq $0xfffffffffffffe00, %rbp ; \ - cmc; \ - sbbq $0x0, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x8+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x18+P0 ; \ - sbbq $0x0, %r12 ; \ - movq %r12, 0x20+P0 ; \ - sbbq $0x0, %r13 ; \ - movq %r13, 0x28+P0 ; \ - sbbq $0x0, %r14 ; \ - movq %r14, 0x30+P0 ; \ - sbbq $0x0, %r15 ; \ - movq %r15, 0x38+P0 ; \ - sbbq $0x0, %rbp ; \ - andq $0x1ff, %rbp ; \ - movq %rbp, 0x40+P0 - -// Corresponds exactly to bignum_sqr_p521 - -#define sqr_p521(P0,P1) \ - xorl %ebp, %ebp ; \ - movq P1, %rdx ; \ - mulxq 0x8+P1, %r9, %rax ; \ - movq %r9, 440(%rsp) ; \ - mulxq 0x10+P1, %r10, %rbx ; \ - adcxq %rax, %r10 ; \ - movq %r10, 448(%rsp) ; \ - mulxq 0x18+P1, %r11, %rax ; \ - adcxq %rbx, %r11 ; \ - mulxq 0x20+P1, %r12, %rbx ; \ - adcxq %rax, %r12 ; \ - mulxq 0x28+P1, %r13, %rax ; \ - adcxq %rbx, %r13 ; \ - mulxq 0x30+P1, %r14, %rbx ; \ - adcxq %rax, %r14 ; \ - mulxq 0x38+P1, %r15, %r8 ; \ - adcxq %rbx, %r15 ; \ - adcxq %rbp, %r8 ; \ - xorl %ebp, %ebp ; \ - movq 0x8+P1, %rdx ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq %r11, 456(%rsp) ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - movq %r12, 464(%rsp) ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x38+P1, %rax, %r9 ; \ - adcxq %rax, %r8 ; \ - adoxq %rbp, %r9 ; \ - movq 0x20+P1, %rdx ; \ - mulxq 0x28+P1, %rax, %r10 ; \ - adcxq %rax, %r9 ; \ - adoxq %rbp, %r10 ; \ - adcxq %rbp, %r10 ; \ - xorl %ebp, %ebp ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - movq %r13, 472(%rsp) ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - movq %r14, 480(%rsp) ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x38+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - movq 0x30+P1, %rdx ; \ - mulxq 0x20+P1, %rax, %r11 ; \ - adcxq %rax, %r10 ; \ - adoxq %rbp, %r11 ; \ - mulxq 0x28+P1, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbp, %r12 ; \ - adcxq %rbp, %r12 ; \ - xorl %ebp, %ebp ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %r8 ; \ - movq %r15, 488(%rsp) ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x38+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - movq 0x38+P1, %rdx ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x28+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rbp, %r13 ; \ - mulxq 0x30+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rbp, %r14 ; \ - adcxq %rbp, %r14 ; \ - xorl %ebp, %ebp ; \ - movq P1, %rdx ; \ - mulxq %rdx, %rax, %rbx ; \ - movq %rax, 432(%rsp) ; \ - movq 440(%rsp), %rax ; \ - adcxq %rax, %rax ; \ - adoxq %rbx, %rax ; \ - movq %rax, 440(%rsp) ; \ - movq 448(%rsp), %rax ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rdx, %rbx ; \ - adcxq %rax, %rax ; \ - adoxq %rdx, %rax ; \ - movq %rax, 448(%rsp) ; \ - movq 456(%rsp), %rax ; \ - adcxq %rax, %rax ; \ - adoxq %rbx, %rax ; \ - movq %rax, 456(%rsp) ; \ - movq 464(%rsp), %rax ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rdx, %rbx ; \ - adcxq %rax, %rax ; \ - adoxq %rdx, %rax ; \ - movq %rax, 464(%rsp) ; \ - movq 472(%rsp), %rax ; \ - adcxq %rax, %rax ; \ - adoxq %rbx, %rax ; \ - movq %rax, 472(%rsp) ; \ - movq 480(%rsp), %rax ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rdx, %rbx ; \ - adcxq %rax, %rax ; \ - adoxq %rdx, %rax ; \ - movq %rax, 480(%rsp) ; \ - movq 488(%rsp), %rax ; \ - adcxq %rax, %rax ; \ - adoxq %rbx, %rax ; \ - movq %rax, 488(%rsp) ; \ - movq 0x20+P1, %rdx ; \ - mulxq %rdx, %rdx, %rbx ; \ - adcxq %r8, %r8 ; \ - adoxq %rdx, %r8 ; \ - adcxq %r9, %r9 ; \ - adoxq %rbx, %r9 ; \ - movq 0x28+P1, %rdx ; \ - mulxq %rdx, %rdx, %rbx ; \ - adcxq %r10, %r10 ; \ - adoxq %rdx, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rbx, %r11 ; \ - movq 0x30+P1, %rdx ; \ - mulxq %rdx, %rdx, %rbx ; \ - adcxq %r12, %r12 ; \ - adoxq %rdx, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rbx, %r13 ; \ - movq 0x38+P1, %rdx ; \ - mulxq %rdx, %rdx, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rdx, %r14 ; \ - adcxq %rbp, %r15 ; \ - adoxq %rbp, %r15 ; \ - movq 0x40+P1, %rdx ; \ - movq %rdx, %rbp ; \ - imulq %rbp, %rbp ; \ - addq %rdx, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x18+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x20+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x28+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x30+P1, %rax, %rbx ; \ - adcxq %rax, %r14 ; \ - adoxq %rbx, %r15 ; \ - mulxq 0x38+P1, %rax, %rbx ; \ - adcxq %rax, %r15 ; \ - adoxq %rbx, %rbp ; \ - adcq $0x0, %rbp ; \ - movq %r8, %rax ; \ - andq $0x1ff, %rax ; \ - shrdq $0x9, %r9, %r8 ; \ - shrdq $0x9, %r10, %r9 ; \ - shrdq $0x9, %r11, %r10 ; \ - shrdq $0x9, %r12, %r11 ; \ - shrdq $0x9, %r13, %r12 ; \ - shrdq $0x9, %r14, %r13 ; \ - shrdq $0x9, %r15, %r14 ; \ - shrdq $0x9, %rbp, %r15 ; \ - shrq $0x9, %rbp ; \ - addq %rax, %rbp ; \ - stc; \ - adcq 432(%rsp), %r8 ; \ - adcq 440(%rsp), %r9 ; \ - adcq 448(%rsp), %r10 ; \ - adcq 456(%rsp), %r11 ; \ - adcq 464(%rsp), %r12 ; \ - adcq 472(%rsp), %r13 ; \ - adcq 480(%rsp), %r14 ; \ - adcq 488(%rsp), %r15 ; \ - adcq $0xfffffffffffffe00, %rbp ; \ - cmc; \ - sbbq $0x0, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x8+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x18+P0 ; \ - sbbq $0x0, %r12 ; \ - movq %r12, 0x20+P0 ; \ - sbbq $0x0, %r13 ; \ - movq %r13, 0x28+P0 ; \ - sbbq $0x0, %r14 ; \ - movq %r14, 0x30+P0 ; \ - sbbq $0x0, %r15 ; \ - movq %r15, 0x38+P0 ; \ - sbbq $0x0, %rbp ; \ - andq $0x1ff, %rbp ; \ - movq %rbp, 0x40+P0 - -// Corresponds exactly to bignum_sub_p521 - -#define sub_p521(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rdx ; \ - sbbq 0x8+P2, %rdx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq 0x20+P1, %r10 ; \ - sbbq 0x20+P2, %r10 ; \ - movq 0x28+P1, %r11 ; \ - sbbq 0x28+P2, %r11 ; \ - movq 0x30+P1, %r12 ; \ - sbbq 0x30+P2, %r12 ; \ - movq 0x38+P1, %r13 ; \ - sbbq 0x38+P2, %r13 ; \ - movq 0x40+P1, %r14 ; \ - sbbq 0x40+P2, %r14 ; \ - sbbq $0x0, %rax ; \ - movq %rax, P0 ; \ - sbbq $0x0, %rdx ; \ - movq %rdx, 0x8+P0 ; \ - sbbq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x18+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x20+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x28+P0 ; \ - sbbq $0x0, %r12 ; \ - movq %r12, 0x30+P0 ; \ - sbbq $0x0, %r13 ; \ - movq %r13, 0x38+P0 ; \ - sbbq $0x0, %r14 ; \ - andq $0x1ff, %r14 ; \ - movq %r14, 0x40+P0 - -// Additional macros to help with final multiplexing - -#define testzero9(P) \ - movq P, %rax ; \ - movq 8+P, %rbx ; \ - movq 16+P, %rdx ; \ - movq 24+P, %rbp ; \ - orq 32+P, %rax ; \ - orq 40+P, %rbx ; \ - orq 48+P, %rdx ; \ - orq 56+P, %rbp ; \ - orq %rbx, %rax ; \ - orq %rbp, %rdx ; \ - orq 64+P, %rax ; \ - orq %rdx, %rax - -#define mux9(P0,PNE,PEQ) \ - movq PNE, %rax ; \ - movq PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, P0 ; \ - movq 8+PNE, %rax ; \ - movq 8+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+PNE, %rax ; \ - movq 16+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+PNE, %rax ; \ - movq 24+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 24+P0 ; \ - movq 32+PNE, %rax ; \ - movq 32+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 32+P0 ; \ - movq 40+PNE, %rax ; \ - movq 40+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 40+P0 ; \ - movq 48+PNE, %rax ; \ - movq 48+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 48+P0 ; \ - movq 56+PNE, %rax ; \ - movq 56+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 56+P0 ; \ - movq 64+PNE, %rax ; \ - movq 64+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 64+P0 - -#define mux9c(P0,PNE) \ - movq PNE, %rax ; \ - movl $1, %ebx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, P0 ; \ - movq 8+PNE, %rax ; \ - movl $0, %ebx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 24+P0 ; \ - movq 32+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 32+P0 ; \ - movq 40+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 40+P0 ; \ - movq 48+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 48+P0 ; \ - movq 56+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 56+P0 ; \ - movq 64+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 64+P0 - -#define copy9(P0,P1) \ - movq P1, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - movq %rax, 24+P0 ; \ - movq 32+P1, %rax ; \ - movq %rax, 32+P0 ; \ - movq 40+P1, %rax ; \ - movq %rax, 40+P0 ; \ - movq 48+P1, %rax ; \ - movq %rax, 48+P0 ; \ - movq 56+P1, %rax ; \ - movq %rax, 56+P0 ; \ - movq 64+P1, %rax ; \ - movq %rax, 64+P0 - -S2N_BN_SYMBOL(p521_jmixadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Move the input arguments to stable places (two are already there) - - movq %rdx, input_y - -// Main code, just a sequence of basic field operations - - sqr_p521(zp2,z_1) - mul_p521(y2a,z_1,y_2) - - mul_p521(x2a,zp2,x_2) - mul_p521(y2a,zp2,y2a) - - sub_p521(xd,x2a,x_1) - sub_p521(yd,y2a,y_1) - - sqr_p521(zz,xd) - sqr_p521(ww,yd) - - mul_p521(zzx1,zz,x_1) - mul_p521(zzx2,zz,x2a) - - sub_p521(resx,ww,zzx1) - sub_p521(t1,zzx2,zzx1) - - mul_p521(resz,xd,z_1) - - sub_p521(resx,resx,zzx2) - - sub_p521(t2,zzx1,resx) - - mul_p521(t1,t1,y_1) - mul_p521(t2,yd,t2) - - sub_p521(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - testzero9(z_1) - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with an extra z = 1 -// coordinate, hence giving 0 + p2 = p2 for the final result. - - mux9 (resx,resx,x_2) - mux9 (resy,resy,y_2) - - copy9(x_3,resx) - copy9(y_3,resy) - - mux9c(z_3,resz) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p521_jmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jmixadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jmixadd_alt.S deleted file mode 100644 index f22868594bc..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/p521/p521_jmixadd_alt.S +++ /dev/null @@ -1,1150 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on NIST curve P-521 in Jacobian coordinates -// -// extern void p521_jmixadd_alt(uint64_t p3[static 27], -// const uint64_t p1[static 27], -// const uint64_t p2[static 18]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. It is assumed that -// all the coordinates of the input points p1 and p2 are fully reduced -// mod p_521, that the z coordinate of p1 is nonzero and that neither -// p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents the same affine -// point as". -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(p521_jmixadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(p521_jmixadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(p521_jmixadd_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 72 - -// Stable homes for input arguments during main code sequence -// These are where they arrive except for input_y, initially in %rdx - -#define input_z %rdi -#define input_x %rsi -#define input_y %rcx - -// Pointer-offset pairs for inputs and outputs - -#define x_1 0(input_x) -#define y_1 NUMSIZE(input_x) -#define z_1 (2*NUMSIZE)(input_x) - -#define x_2 0(input_y) -#define y_2 NUMSIZE(input_y) - -#define x_3 0(input_z) -#define y_3 NUMSIZE(input_z) -#define z_3 (2*NUMSIZE)(input_z) - -// Pointer-offset pairs for temporaries, with some aliasing -// The tmp field is internal storage for field mul and sqr. -// NSPACE is the total stack needed for these temporaries - -#define zp2 (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define tmp (NUMSIZE*6)(%rsp) - -#define NSPACE NUMSIZE*7 - -// Corresponds exactly to bignum_mul_p521_alt except temp storage - -#define mul_p521(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, 432(%rsp) ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq %r11, %r11 ; \ - movq %r9, 440(%rsp) ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq %r10, 448(%rsp) ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq %r11, 456(%rsp) ; \ - xorq %r14, %r14 ; \ - movq P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x20+P1, %rax ; \ - mulq P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq %r12, 464(%rsp) ; \ - xorq %r15, %r15 ; \ - movq P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x28+P1, %rax ; \ - mulq P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq %r13, 472(%rsp) ; \ - xorq %r8, %r8 ; \ - movq P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r8, %r8 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x30+P1, %rax ; \ - mulq P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq %r14, 480(%rsp) ; \ - xorq %r9, %r9 ; \ - movq P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq %r9, %r9 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq 0x38+P1, %rax ; \ - mulq P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - adcq $0x0, %r9 ; \ - movq %r15, 488(%rsp) ; \ - xorq %r10, %r10 ; \ - movq P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %r10, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x40+P1, %rax ; \ - mulq P2; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq %r8, 496(%rsp) ; \ - xorq %r11, %r11 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq %r11, %r11 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x20+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x28+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - xorq %r8, %r8 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq %r8, %r8 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x30+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x40+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - movq 0x40+P1, %rax ; \ - mulq 0x38+P2; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - movq 0x40+P1, %rax ; \ - imulq 0x40+P2, %rax ; \ - addq %r8, %rax ; \ - movq 496(%rsp), %r8 ; \ - movq %r8, %rdx ; \ - andq $0x1ff, %rdx ; \ - shrdq $0x9, %r9, %r8 ; \ - shrdq $0x9, %r10, %r9 ; \ - shrdq $0x9, %r11, %r10 ; \ - shrdq $0x9, %r12, %r11 ; \ - shrdq $0x9, %r13, %r12 ; \ - shrdq $0x9, %r14, %r13 ; \ - shrdq $0x9, %r15, %r14 ; \ - shrdq $0x9, %rax, %r15 ; \ - shrq $0x9, %rax ; \ - addq %rax, %rdx ; \ - stc; \ - adcq 432(%rsp), %r8 ; \ - adcq 440(%rsp), %r9 ; \ - adcq 448(%rsp), %r10 ; \ - adcq 456(%rsp), %r11 ; \ - adcq 464(%rsp), %r12 ; \ - adcq 472(%rsp), %r13 ; \ - adcq 480(%rsp), %r14 ; \ - adcq 488(%rsp), %r15 ; \ - adcq $0xfffffffffffffe00, %rdx ; \ - cmc; \ - sbbq $0x0, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x8+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x18+P0 ; \ - sbbq $0x0, %r12 ; \ - movq %r12, 0x20+P0 ; \ - sbbq $0x0, %r13 ; \ - movq %r13, 0x28+P0 ; \ - sbbq $0x0, %r14 ; \ - movq %r14, 0x30+P0 ; \ - sbbq $0x0, %r15 ; \ - movq %r15, 0x38+P0 ; \ - sbbq $0x0, %rdx ; \ - andq $0x1ff, %rdx ; \ - movq %rdx, 0x40+P0 - -// Corresponds to bignum_sqr_p521_alt except %rbp is used -// in place of %rcx and the output as temp storage location - -#define sqr_p521(P0,P1) \ - movq P1, %rax ; \ - mulq %rax; \ - movq %rax, 432(%rsp) ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r11 ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - movq %r9, 440(%rsp) ; \ - xorq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r12 ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq %r10, 448(%rsp) ; \ - movq P1, %rax ; \ - mulq 0x18+P1; \ - xorq %r13, %r13 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r13 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r13, %r13 ; \ - addq %rbx, %r11 ; \ - adcq %rbp, %r12 ; \ - adcq $0x0, %r13 ; \ - movq %r11, 456(%rsp) ; \ - movq P1, %rax ; \ - mulq 0x20+P1; \ - xorq %r14, %r14 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r14 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r14, %r14 ; \ - addq %rbx, %r12 ; \ - adcq %rbp, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq %r12, 464(%rsp) ; \ - movq P1, %rax ; \ - mulq 0x28+P1; \ - xorq %r15, %r15 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq 0x20+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r15 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r15, %r15 ; \ - addq %rbx, %r13 ; \ - adcq %rbp, %r14 ; \ - adcq $0x0, %r15 ; \ - movq %r13, 472(%rsp) ; \ - movq P1, %rax ; \ - mulq 0x30+P1; \ - xorq %r8, %r8 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq 0x28+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r8 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x20+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r8 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r8, %r8 ; \ - addq %rbx, %r14 ; \ - adcq %rbp, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq %r14, 480(%rsp) ; \ - movq P1, %rax ; \ - mulq 0x38+P1; \ - xorq %r9, %r9 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq 0x30+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r9 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x28+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r9 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x20+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r9 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r9, %r9 ; \ - addq %rbx, %r15 ; \ - adcq %rbp, %r8 ; \ - adcq $0x0, %r9 ; \ - movq %r15, 488(%rsp) ; \ - movq P1, %rax ; \ - mulq 0x40+P1; \ - xorq %r10, %r10 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x8+P1, %rax ; \ - mulq 0x38+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r10 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x30+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r10 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x28+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r10 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r10, %r10 ; \ - addq %rbx, %r8 ; \ - adcq %rbp, %r9 ; \ - adcq $0x0, %r10 ; \ - movq 0x20+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - movq %r8, 496(%rsp) ; \ - movq 0x8+P1, %rax ; \ - mulq 0x40+P1; \ - xorq %r11, %r11 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x10+P1, %rax ; \ - mulq 0x38+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r11 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x30+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r11 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x28+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r11 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r11, %r11 ; \ - addq %rbx, %r9 ; \ - adcq %rbp, %r10 ; \ - adcq $0x0, %r11 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x40+P1; \ - xorq %r12, %r12 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x18+P1, %rax ; \ - mulq 0x38+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r12 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x30+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r12 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r12, %r12 ; \ - addq %rbx, %r10 ; \ - adcq %rbp, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x28+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x40+P1; \ - xorq %r13, %r13 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x20+P1, %rax ; \ - mulq 0x38+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r13 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x30+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r13 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r13, %r13 ; \ - addq %rbx, %r11 ; \ - adcq %rbp, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x20+P1, %rax ; \ - mulq 0x40+P1; \ - xorq %r14, %r14 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x28+P1, %rax ; \ - mulq 0x38+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r14 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r14, %r14 ; \ - addq %rbx, %r12 ; \ - adcq %rbp, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x30+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x28+P1, %rax ; \ - mulq 0x40+P1; \ - xorq %r15, %r15 ; \ - movq %rax, %rbx ; \ - movq %rdx, %rbp ; \ - movq 0x30+P1, %rax ; \ - mulq 0x38+P1; \ - addq %rax, %rbx ; \ - adcq %rdx, %rbp ; \ - adcq $0x0, %r15 ; \ - addq %rbx, %rbx ; \ - adcq %rbp, %rbp ; \ - adcq %r15, %r15 ; \ - addq %rbx, %r13 ; \ - adcq %rbp, %r14 ; \ - adcq $0x0, %r15 ; \ - xorq %r8, %r8 ; \ - movq 0x38+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x30+P1, %rax ; \ - mulq 0x40+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r8 ; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - adcq $0x0, %r8 ; \ - movq 0x38+P1, %rax ; \ - mulq 0x40+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - addq %rax, %r15 ; \ - adcq %rdx, %r8 ; \ - movq 0x40+P1, %rax ; \ - imulq %rax, %rax ; \ - addq %r8, %rax ; \ - movq 496(%rsp), %r8 ; \ - movq %r8, %rdx ; \ - andq $0x1ff, %rdx ; \ - shrdq $0x9, %r9, %r8 ; \ - shrdq $0x9, %r10, %r9 ; \ - shrdq $0x9, %r11, %r10 ; \ - shrdq $0x9, %r12, %r11 ; \ - shrdq $0x9, %r13, %r12 ; \ - shrdq $0x9, %r14, %r13 ; \ - shrdq $0x9, %r15, %r14 ; \ - shrdq $0x9, %rax, %r15 ; \ - shrq $0x9, %rax ; \ - addq %rax, %rdx ; \ - stc; \ - adcq 432(%rsp), %r8 ; \ - adcq 440(%rsp), %r9 ; \ - adcq 448(%rsp), %r10 ; \ - adcq 456(%rsp), %r11 ; \ - adcq 464(%rsp), %r12 ; \ - adcq 472(%rsp), %r13 ; \ - adcq 480(%rsp), %r14 ; \ - adcq 488(%rsp), %r15 ; \ - adcq $0xfffffffffffffe00, %rdx ; \ - cmc; \ - sbbq $0x0, %r8 ; \ - movq %r8, P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x8+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x10+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x18+P0 ; \ - sbbq $0x0, %r12 ; \ - movq %r12, 0x20+P0 ; \ - sbbq $0x0, %r13 ; \ - movq %r13, 0x28+P0 ; \ - sbbq $0x0, %r14 ; \ - movq %r14, 0x30+P0 ; \ - sbbq $0x0, %r15 ; \ - movq %r15, 0x38+P0 ; \ - sbbq $0x0, %rdx ; \ - andq $0x1ff, %rdx ; \ - movq %rdx, 0x40+P0 ; \ - -// Corresponds exactly to bignum_sub_p521 - -#define sub_p521(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rdx ; \ - sbbq 0x8+P2, %rdx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq 0x20+P1, %r10 ; \ - sbbq 0x20+P2, %r10 ; \ - movq 0x28+P1, %r11 ; \ - sbbq 0x28+P2, %r11 ; \ - movq 0x30+P1, %r12 ; \ - sbbq 0x30+P2, %r12 ; \ - movq 0x38+P1, %r13 ; \ - sbbq 0x38+P2, %r13 ; \ - movq 0x40+P1, %r14 ; \ - sbbq 0x40+P2, %r14 ; \ - sbbq $0x0, %rax ; \ - movq %rax, P0 ; \ - sbbq $0x0, %rdx ; \ - movq %rdx, 0x8+P0 ; \ - sbbq $0x0, %r8 ; \ - movq %r8, 0x10+P0 ; \ - sbbq $0x0, %r9 ; \ - movq %r9, 0x18+P0 ; \ - sbbq $0x0, %r10 ; \ - movq %r10, 0x20+P0 ; \ - sbbq $0x0, %r11 ; \ - movq %r11, 0x28+P0 ; \ - sbbq $0x0, %r12 ; \ - movq %r12, 0x30+P0 ; \ - sbbq $0x0, %r13 ; \ - movq %r13, 0x38+P0 ; \ - sbbq $0x0, %r14 ; \ - andq $0x1ff, %r14 ; \ - movq %r14, 0x40+P0 - -// Additional macros to help with final multiplexing - -#define testzero9(P) \ - movq P, %rax ; \ - movq 8+P, %rbx ; \ - movq 16+P, %rdx ; \ - movq 24+P, %rbp ; \ - orq 32+P, %rax ; \ - orq 40+P, %rbx ; \ - orq 48+P, %rdx ; \ - orq 56+P, %rbp ; \ - orq %rbx, %rax ; \ - orq %rbp, %rdx ; \ - orq 64+P, %rax ; \ - orq %rdx, %rax - -#define mux9(P0,PNE,PEQ) \ - movq PNE, %rax ; \ - movq PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, P0 ; \ - movq 8+PNE, %rax ; \ - movq 8+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+PNE, %rax ; \ - movq 16+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+PNE, %rax ; \ - movq 24+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 24+P0 ; \ - movq 32+PNE, %rax ; \ - movq 32+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 32+P0 ; \ - movq 40+PNE, %rax ; \ - movq 40+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 40+P0 ; \ - movq 48+PNE, %rax ; \ - movq 48+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 48+P0 ; \ - movq 56+PNE, %rax ; \ - movq 56+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 56+P0 ; \ - movq 64+PNE, %rax ; \ - movq 64+PEQ, %rbx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 64+P0 - -#define mux9c(P0,PNE) \ - movq PNE, %rax ; \ - movl $1, %ebx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, P0 ; \ - movq 8+PNE, %rax ; \ - movl $0, %ebx ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 24+P0 ; \ - movq 32+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 32+P0 ; \ - movq 40+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 40+P0 ; \ - movq 48+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 48+P0 ; \ - movq 56+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 56+P0 ; \ - movq 64+PNE, %rax ; \ - cmovzq %rbx, %rax ; \ - movq %rax, 64+P0 - -#define copy9(P0,P1) \ - movq P1, %rax ; \ - movq %rax, P0 ; \ - movq 8+P1, %rax ; \ - movq %rax, 8+P0 ; \ - movq 16+P1, %rax ; \ - movq %rax, 16+P0 ; \ - movq 24+P1, %rax ; \ - movq %rax, 24+P0 ; \ - movq 32+P1, %rax ; \ - movq %rax, 32+P0 ; \ - movq 40+P1, %rax ; \ - movq %rax, 40+P0 ; \ - movq 48+P1, %rax ; \ - movq %rax, 48+P0 ; \ - movq 56+P1, %rax ; \ - movq %rax, 56+P0 ; \ - movq 64+P1, %rax ; \ - movq %rax, 64+P0 - -S2N_BN_SYMBOL(p521_jmixadd_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Move the input arguments to stable places (two are already there) - - movq %rdx, input_y - -// Main code, just a sequence of basic field operations - - sqr_p521(zp2,z_1) - mul_p521(y2a,z_1,y_2) - - mul_p521(x2a,zp2,x_2) - mul_p521(y2a,zp2,y2a) - - sub_p521(xd,x2a,x_1) - sub_p521(yd,y2a,y_1) - - sqr_p521(zz,xd) - sqr_p521(ww,yd) - - mul_p521(zzx1,zz,x_1) - mul_p521(zzx2,zz,x2a) - - sub_p521(resx,ww,zzx1) - sub_p521(t1,zzx2,zzx1) - - mul_p521(resz,xd,z_1) - - sub_p521(resx,resx,zzx2) - - sub_p521(t2,zzx1,resx) - - mul_p521(t1,t1,y_1) - mul_p521(t2,yd,t2) - - sub_p521(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - testzero9(z_1) - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with an extra z = 1 -// coordinate, hence giving 0 + p2 = p2 for the final result. - - mux9 (resx,resx,x_2) - mux9 (resy,resy,y_2) - - copy9(x_3,resx) - copy9(y_3,resy) - - mux9c(z_3,resz) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(p521_jmixadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_add_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_add_p256k1.S deleted file mode 100644 index 55e3f2cc1ab..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_add_p256k1.S +++ /dev/null @@ -1,105 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Add modulo p_256k1, z := (x + y) mod p_256k1, assuming x and y reduced -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_add_p256k1(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_add_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_add_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_add_p256k1) - .text - -#define z %rdi -#define x %rsi -#define y %rdx - -#define d0 %rcx -#define d1 %r8 -#define d2 %r9 -#define d3 %r10 - -#define dd %rax - -// These two re-use inputs x and y when safe to do so - -#define l %rsi -#define c %rdx - -S2N_BN_SYMBOL(bignum_add_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Load and add the two inputs as 2^256 * (-c) + [d3;d2;d1;d0] = x + y - - movq (x), d0 - addq (y), d0 - movq 8(x), d1 - adcq 8(y), d1 - movq 16(x), d2 - adcq 16(y), d2 - movq 24(x), d3 - adcq 24(y), d3 - sbbq c, c - -// Create dd = d3 AND d2 AND d1 to condense the later comparison -// We hope this will interleave with the addition, though we can't -// express that directly as the AND operation destroys the carry flag. - - movq d1, dd - andq d2, dd - andq d3, dd - -// Decide whether z >= p_256k1 <=> z + 4294968273 >= 2^256. -// For the lowest word use d0 + 4294968273 >= 2^64 <=> ~4294968273 < d0 - - movq $~4294968273, l - cmpq d0, l - adcq $0, dd - sbbq $0, c - -// Now c <> 0 <=> z >= p_256k1, so mask the constant l accordingly - - notq l - cmovzq c, l - -// If z >= p_256k1 do z := z - p_256k1, i.e. add l in 4 digits - - addq l, d0 - movq d0, (z) - adcq $0, d1 - movq d1, 8(z) - adcq $0, d2 - movq d2, 16(z) - adcq $0, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_add_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_cmul_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_cmul_p256k1.S deleted file mode 100644 index 61c216cc3da..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_cmul_p256k1.S +++ /dev/null @@ -1,111 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_256k1, z := (c * x) mod p_256k1, assuming -// x reduced -// Inputs c, x[4]; output z[4] -// -// extern void bignum_cmul_p256k1(uint64_t z[static 4], uint64_t c, -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = c, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = c, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p256k1) - .text - -#define z %rdi - -// Temporarily moved here for initial multiply - -#define x %rcx -#define c %rcx - -// Likewise this is thrown away after initial multiply - -#define d %rdx -#define h %rdx - -#define a %rax -#define ashort %eax -#define q %rax - -#define d0 %rsi -#define d1 %r8 -#define d2 %r9 -#define d3 %r10 - -S2N_BN_SYMBOL(bignum_cmul_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Shuffle inputs (since we want multiplier in %rdx) - - movq %rdx, x - movq %rsi, d - -// Multiply, accumulating the result as 2^256 * h + [d3;d2;d1;d0] - - mulxq (x), d0, d1 - mulxq 8(x), a, d2 - addq a, d1 - mulxq 16(x), a, d3 - adcq a, d2 - mulxq 24(x), a, h - adcq a, d3 - adcq $0, h - -// Now the quotient estimate is q = h + 1, and then we do the reduction, -// writing z = [d3;d2;d1;d0], as z' = (2^256 * h + z) - q * p_256k1 = -// (2^256 * h + z) - q * (2^256 - 4294968273) = -2^256 + (z + 4294968273 * q) - - leaq 1(h), q - movq $4294968273, c - mulq c - - addq %rax, d0 - adcq %rdx, d1 - adcq $0, d2 - adcq $0, d3 - -// Because of the implicit -2^256, CF means >= 0 so z' is the answer; ~CF -// means z' < 0 so we add p_256k1, which in 4 digits means subtracting c. - - movq $0, a - cmovcq a, c - - subq c, d0 - movq d0, (z) - sbbq a, d1 - movq d1, 8(z) - sbbq a, d2 - movq d2, 16(z) - sbbq a, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_cmul_p256k1_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_cmul_p256k1_alt.S deleted file mode 100644 index 922c5c241f6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_cmul_p256k1_alt.S +++ /dev/null @@ -1,123 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_256k1, z := (c * x) mod p_256k1, assuming -// x reduced -// Inputs c, x[4]; output z[4] -// -// extern void bignum_cmul_p256k1_alt(uint64_t z[static 4], uint64_t c, -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = c, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = c, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_p256k1_alt) - .text - -#define z %rdi - -// Temporarily moved here for initial multiply - -#define x %rcx -#define c %rsi - -// Likewise this is thrown away after initial multiply - -#define d %rdx -#define h %rdx - -#define a %rax -#define ashort %eax -#define q %rax - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %rcx - -S2N_BN_SYMBOL(bignum_cmul_p256k1_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Shuffle inputs (since we want %rdx for the high parts of products) - - movq %rdx, x - -// Multiply, accumulating the result as 2^256 * h + [d3;d2;d1;d0] - - movq (x), a - mulq c - movq a, d0 - movq d, d1 - - movq 8(x), a - xorq d2, d2 - mulq c - addq a, d1 - adcq d, d2 - - movq 16(x), a - mulq c - addq a, d2 - adcq $0, d - - movq 24(x), a - movq d, d3 - mulq c - addq a, d3 - adcq $0, h - -// Now the quotient estimate is q = h + 1, and then we do the reduction, -// writing z = [d3;d2;d1;d0], as z' = (2^256 * h + z) - q * p_256k1 = -// (2^256 * h + z) - q * (2^256 - 4294968273) = -2^256 + (z + 4294968273 * q) - - leaq 1(h), q - movq $4294968273, c - mulq c - - addq %rax, d0 - adcq %rdx, d1 - adcq $0, d2 - adcq $0, d3 - -// Because of the implicit -2^256, CF means >= 0 so z' is the answer; ~CF -// means z' < 0 so we add p_256k1, which in 4 digits means subtracting c. - - movq $0, a - cmovcq a, c - - subq c, d0 - movq d0, (z) - sbbq a, d1 - movq d1, 8(z) - sbbq a, d2 - movq d2, 16(z) - sbbq a, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_p256k1_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_deamont_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_deamont_p256k1.S deleted file mode 100644 index d569466be38..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_deamont_p256k1.S +++ /dev/null @@ -1,151 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^256) mod p_256k1, -// Input x[4]; output z[4] -// -// extern void bignum_deamont_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Convert a 4-digit bignum x out of its (optionally almost) Montgomery form, -// "almost" meaning any 4-digit input will work, with no range restriction. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_deamont_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_deamont_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_deamont_p256k1) - .text - -#define z %rdi -#define x %rsi - -// Re-use x variable for the negated multiplicative inverse of p_256k1 - -#define w %rsi - -// The rotating registers for the 4 digits - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -// Other variables. We need d == %rdx for mulx instructions - -#define a %rax -#define d %rdx -#define c %rcx - -S2N_BN_SYMBOL(bignum_deamont_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Set up an initial 4-word window [d3,d2,d1,d0] = x - - movq (x), d0 - movq 8(x), d1 - movq 16(x), d2 - movq 24(x), d3 - -// Set w to negated multiplicative inverse p_256k1 * w == -1 (mod 2^64). - - movq $0xd838091dd2253531, w - -// Four stages of Montgomery reduction, rotating the register window. -// Use c as a carry-catcher since the imul destroys the flags in general. - - imulq w, d0 - movq $4294968273, a - mulq d0 - subq d, d1 - sbbq c, c - - imulq w, d1 - movq $4294968273, a - mulq d1 - negq c - sbbq d, d2 - sbbq c, c - - imulq w, d2 - movq $4294968273, a - mulq d2 - negq c - sbbq d, d3 - sbbq c, c - - imulq w, d3 - movq $4294968273, a - mulq d3 - -// Take an AND of the four cofactor digits, re-using the w variable. -// We hope this will interleave nicely with the computation sequence -// above but don't want to use other registers explicitly, so put -// it all together in a block. - - movq d0, w - andq d1, w - andq d2, w - andq d3, w - -// Finish propagating carry through new top part - - xorq a, a - negq c - sbbq d, d0 - sbbq a, d1 - sbbq a, d2 - sbbq a, d3 - -// The result thus far is z = (x + q * p_256k1) / 2^256. Note that -// z < p_256k1 <=> x < (2^256 - q) * p_256k1, and since -// x < 2^256 < 2 * p_256k1, we have that *if* q < 2^256 - 1 then -// z < p_256k1. Conversely if q = 2^256 - 1 then since -// x + q * p_256k1 == 0 (mod 2^256) we have x == p_256k1 (mod 2^256) -// and thus x = p_256k1, and z >= p_256k1 (in fact z = p_256k1). -// So in summary z < p_256k1 <=> ~(q = 2^256 - 1) <=> ~(x = p_256k1). -// and hence iff q is all 1s, or equivalently dd is all 1s, we -// correct by subtracting p_256k1 to get 0. Since this is only one -// case we compute the result more explicitly rather than doing -// arithmetic with carry propagation. - - movq $4294968273, d - addq d0, d - addq $1, w - cmovzq d, d0 - cmovzq a, d1 - cmovzq a, d2 - cmovzq a, d3 - -// write back and return - - movq d0, (z) - movq d1, 8(z) - movq d2, 16(z) - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_deamont_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_demont_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_demont_p256k1.S deleted file mode 100644 index c6cbb050f84..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_demont_p256k1.S +++ /dev/null @@ -1,118 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^256) mod p_256k1, -// assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_demont_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// This assumes the input is < p_256k1 for correctness. If this is not the -// case, use the variant "bignum_deamont_p256k1" instead. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_p256k1) - .text - -#define z %rdi -#define x %rsi - -// Re-use x variable for the negated multiplicative inverse of p_256k1 - -#define w %rsi - -// The rotating registers for the 4 digits - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -// Other variables. We need d == %rdx for mulx instructions - -#define a %rax -#define d %rdx -#define c %rcx - -S2N_BN_SYMBOL(bignum_demont_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Set up an initial 4-word window [d3,d2,d1,d0] = x - - movq (x), d0 - movq 8(x), d1 - movq 16(x), d2 - movq 24(x), d3 - -// Set w to negated multiplicative inverse p_256k1 * w == -1 (mod 2^64). - - movq $0xd838091dd2253531, w - -// Four stages of Montgomery reduction, rotating the register window. -// Use c as a carry-catcher since the imul destroys the flags in general. - - imulq w, d0 - movq $4294968273, a - mulq d0 - subq d, d1 - sbbq c, c - - imulq w, d1 - movq $4294968273, a - mulq d1 - negq c - sbbq d, d2 - sbbq c, c - - imulq w, d2 - movq $4294968273, a - mulq d2 - negq c - sbbq d, d3 - sbbq c, c - - imulq w, d3 - movq $4294968273, a - mulq d3 - negq c - sbbq d, d0 - -// Finish propagating carry through new top part, write back and return - - movq d0, (z) - sbbq $0, d1 - movq d1, 8(z) - sbbq $0, d2 - movq d2, 16(z) - sbbq $0, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_double_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_double_p256k1.S deleted file mode 100644 index b14c551da80..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_double_p256k1.S +++ /dev/null @@ -1,100 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo p_256k1, z := (2 * x) mod p_256k1, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_double_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_double_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_double_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_double_p256k1) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rcx -#define d1 %r8 -#define d2 %r9 -#define d3 %r10 - -#define dd %rax -#define c %rdx - -// Re-uses the input x when safe to do so - -#define l %rsi - -S2N_BN_SYMBOL(bignum_double_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the inputs and double top-down as z = 2^256 * c + [d3;d2;d1;d0] -// While doing this, create an AND dd of [d3;d2;d1] to condense comparison - - movq 24(x), d3 - movq d3, c - movq 16(x), d2 - shrq $63, c - shldq $1, d2, d3 - movq d3, dd - movq 8(x), d1 - shldq $1, d1, d2 - andq d2, dd - movq (x), d0 - shldq $1, d0, d1 - andq d1, dd - shlq $1, d0 - -// Decide whether z >= p_256k1 <=> z + 4294968273 >= 2^256. -// For the lowest word use d0 + 4294968273 >= 2^64 <=> ~4294968273 < d0 - - movq $~4294968273, l - cmpq d0, l - adcq $0, dd - adcq $0, c - -// Now c <> 0 <=> z >= p_256k1, so mask the constant l accordingly - - notq l - cmovzq c, l - -// If z >= p_256k1 do z := z - p_256k1, i.e. add l in 4 digits - - addq l, d0 - movq d0, (z) - adcq $0, d1 - movq d1, 8(z) - adcq $0, d2 - movq d2, 16(z) - adcq $0, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_double_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_half_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_half_p256k1.S deleted file mode 100644 index b06044ce262..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_half_p256k1.S +++ /dev/null @@ -1,90 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Halve modulo p_256k1, z := (x / 2) mod p_256k1, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_half_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_half_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_half_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_half_p256k1) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rcx -#define d1 %rdx -#define d2 %r8 -#define d3 %r9 - -#define c %rax - -S2N_BN_SYMBOL(bignum_half_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the 4 digits of x, and letting b be the LSB (whether it's odd) -// construct the constant c = 4294968273 * b - - movq (x), d0 - movq $4294968273, c - movq 8(x), d1 - movq $1, d3 - andq d0, d3 - movq 16(x), d2 - cmovzq d3, c - movq 24(x), d3 - -// We want (x + b * p_256k1) / 2 where b is that LSB, in {0,1}. -// That amounts to (2^256 * b + x - 4294968273 * b) / 2, and -// modulo 4 words that's the same as ([2^256 * c + x] - c) / 2. -// So do that subtraction and shift a place right as we go. - - subq c, d0 - sbbq $0, d1 - sbbq $0, d2 - sbbq $0, d3 - sbbq $0, c - -// Shift right, pushing the carry back down, and store back - - shrdq $1, d1, d0 - movq d0, (z) - shrdq $1, d2, d1 - movq d1, 8(z) - shrdq $1, d3, d2 - movq d2, 16(z) - shrdq $1, c, d3 - movq d3, 24(z) - -// Return - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_half_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mod_n256k1_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mod_n256k1_4.S deleted file mode 100644 index 9ba9731a235..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mod_n256k1_4.S +++ /dev/null @@ -1,102 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_mod_n256k1_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Reduction is modulo the group order of the secp256k1 curve. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_n256k1_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_n256k1_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_n256k1_4) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n0 %rax -#define n1 %r10 -#define n2 %r11 - -#define n2short %r11d - -// Can re-use this as a temporary once we've loaded the input - -#define c %rsi - -S2N_BN_SYMBOL(bignum_mod_n256k1_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load a set of registers [0; n2; n1; n0] = 2^256 - n_256k1 - - movq $0x402da1732fc9bebf, n0 - movq $0x4551231950b75fc4, n1 - movl $1, n2short - -// Load the input and compute x + (2^256 - n_256k1) - - movq (x), d0 - addq n0, d0 - movq 8(x), d1 - adcq n1, d1 - movq 16(x), d2 - adcq n2, d2 - movq 24(x), d3 - adcq $0, d3 - -// Now CF is set iff 2^256 <= x + (2^256 - n_256k1), i.e. iff n_256k1 <= x. -// Create a mask for the condition x < n, and mask the three nontrivial digits -// ready to undo the previous addition with a compensating subtraction - - sbbq c, c - notq c - andq c, n0 - andq c, n1 - andq c, n2 - -// Now subtract mask * (2^256 - n_256k1) again and store - - subq n0, d0 - movq d0, (z) - sbbq n1, d1 - movq d1, 8(z) - sbbq n2, d2 - movq d2, 16(z) - sbbq $0, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_n256k1_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mod_p256k1_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mod_p256k1_4.S deleted file mode 100644 index 4e3fe523b2f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mod_p256k1_4.S +++ /dev/null @@ -1,87 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_mod_p256k1_4(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_p256k1_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_p256k1_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_p256k1_4) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 -#define c %r10 - -#define d %rax - - -S2N_BN_SYMBOL(bignum_mod_p256k1_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the inputs as [d3;d2;d1;d0] and let d be an AND of [d3;d2;d1] to -// condense the comparison below. - - movq (x), d0 - movq 8(x), d1 - movq d1, d - movq 16(x), d2 - andq d2, d - movq 24(x), d3 - andq d3, d - -// Compare x >= p_256k1 = 2^256 - 4294968273 using condensed carry: -// we get a carry from the lowest digit and all other digits are 1. -// We end up with c and d as adjusted digits for x - p_256k1 if so. - - movq $4294968273, c - addq d0, c - adcq $0, d - -// If indeed x >= p_256k1 then x := x - p_256k1, using c and d -// Either way, write back to z - - cmovcq c, d0 - movq d0, (z) - cmovcq d, d1 - movq d1, 8(z) - cmovcq d, d2 - movq d2, 16(z) - cmovcq d, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_p256k1_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montmul_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montmul_p256k1.S deleted file mode 100644 index 6e3c5718121..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montmul_p256k1.S +++ /dev/null @@ -1,240 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_256k1 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_256k1, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_256k2 (in particular this is true if we are in -// the "usual" case x < p_256k1 and y < p_256k1). -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p256k1) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// Copied in or set up - -#define y %rcx - -// A zero register - -#define zero %rbp -#define zeroe %ebp - -// Also used for multiplicative inverse in second part - -#define w %rbp - -// mulpadd(high,low,m) adds %rdx * m to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rbx as temporaries. - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rbx ; \ - adcxq %rax, low ; \ - adoxq %rbx, high - -// mulpade(high,low,i) adds %rdx * x[i] to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax as a temporary, assuming high created from scratch -// and that zero has value zero. - -#define mulpade(high,low,m) \ - mulxq m, %rax, high ; \ - adcxq %rax, low ; \ - adoxq zero, high - -S2N_BN_SYMBOL(bignum_montmul_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Zero a register, which also makes sure we don't get a fake carry-in - - xorl zeroe, zeroe - -// Do the zeroth row, which is a bit different - - movq (y), %rdx - - mulxq (x), %r8, %r9 - mulxq 8(x), %rax, %r10 - addq %rax, %r9 - mulxq 16(x), %rax, %r11 - adcq %rax, %r10 - mulxq 24(x), %rax, %r12 - adcq %rax, %r11 - adcq zero, %r12 - -// Add row 1 - - xorl zeroe, zeroe - movq 8(y), %rdx - mulpadd(%r10,%r9,(x)) - mulpadd(%r11,%r10,8(x)) - mulpadd(%r12,%r11,16(x)) - mulpade(%r13,%r12,24(x)) - adcxq zero, %r13 - -// Add row 2 - - xorl zeroe, zeroe - movq 16(y), %rdx - mulpadd(%r11,%r10,(x)) - mulpadd(%r12,%r11,8(x)) - mulpadd(%r13,%r12,16(x)) - mulpade(%r14,%r13,24(x)); - adcxq zero, %r14 - -// Add row 3 - - xorl zeroe, zeroe - movq 24(y), %rdx - mulpadd(%r12,%r11,(x)) - mulpadd(%r13,%r12,8(x)) - mulpadd(%r14,%r13,16(x)); - mulpade(%r15,%r14,24(x)); - adcxq zero, %r15 - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [%r15,%r14,%r13,%r12] and l = [%r11,%r10,%r9,%r8] -// Do Montgomery reductions, now using %rcx as a carry-saver. -// A direct carry chain is possible using mulx exclusively, but it -// requires more moves and overall seems to have lower performance. - - movq $0xd838091dd2253531, w - movq $4294968273, %rbx - -// Montgomery reduce row 0 - - movq %rbx, %rax - imulq w, %r8 - mulq %r8 - subq %rdx, %r9 - sbbq %rcx, %rcx - -// Montgomery reduce row 1 - - movq %rbx, %rax - imulq w, %r9 - mulq %r9 - negq %rcx - sbbq %rdx, %r10 - sbbq %rcx, %rcx - -// Montgomery reduce row 2 - - movq %rbx, %rax - imulq w, %r10 - mulq %r10 - negq %rcx - sbbq %rdx, %r11 - sbbq %rcx, %rcx - -// Montgomery reduce row 3 - - movq %rbx, %rax - imulq w, %r11 - mulq %r11 - negq %rcx - -// Now [%r15,%r14,%r13,%r12] := [%r15,%r14,%r13,%r12] + [%r11,%r10,%r9,%r8] - (%rdx + CF) - - sbbq %rdx, %r8 - sbbq $0, %r9 - sbbq $0, %r10 - sbbq $0, %r11 - - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - sbbq w, w - -// Let b be the top carry captured just above as w = (2^64-1) * b -// Now if [b,%r15,%r14,%r13,%r12] >= p_256k1, subtract p_256k1, i.e. add 4294968273 -// and either way throw away the top word. [b,%r15,%r14,%r13,%r12] - p_256k1 = -// [(b - 1),%r15,%r14,%r13,%r12] + 4294968273. If [%r15,%r14,%r13,%r12] + 4294968273 -// gives carry flag CF then >= comparison is top = 0 <=> b - 1 + CF = 0 which -// is equivalent to b \/ CF, and so to (2^64-1) * b + (2^64 - 1) + CF >= 2^64 - - movq %r12, %r8 - addq %rbx, %r8 - movq %r13, %r9 - adcq $0, %r9 - movq %r14, %r10 - adcq $0, %r10 - movq %r15, %r11 - adcq $0, %r11 - - adcq $-1, w - -// Write everything back - - cmovcq %r8, %r12 - movq %r12, (z) - cmovcq %r9, %r13 - movq %r13, 8(z) - cmovcq %r10, %r14 - movq %r14, 16(z) - cmovcq %r11, %r15 - movq %r15, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montmul_p256k1_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montmul_p256k1_alt.S deleted file mode 100644 index 0d6d037ce2b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montmul_p256k1_alt.S +++ /dev/null @@ -1,240 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_256k1 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_p256k1_alt(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_256k1, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_256k2 (in particular this is true if we are in -// the "usual" case x < p_256k1 and y < p_256k1). -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_p256k1_alt) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// Copied in or set up - -#define y %rcx - -// Re-used for constants in second part - -#define w %rsi - -// Macro for the key "multiply and add to (c,h,l)" step - -#define combadd(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A minutely shorter form for when c = 0 initially - -#define combadz(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq c, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h - -S2N_BN_SYMBOL(bignum_montmul_p256k1_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Start the window as [%r10;%r9;%r8] with 00 product - - movq (x), %rax - mulq (y) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - -// Column 1 - - xorq %r11, %r11 - combads(%r10,%r9,(x),8(y)) - combadz(%r11,%r10,%r9,8(x),(y)) - -// Column 2 - - xorq %r12, %r12 - combadz(%r12,%r11,%r10,(x),16(y)) - combadd(%r12,%r11,%r10,8(x),8(y)) - combadd(%r12,%r11,%r10,16(x),(y)) - -// Column 3 - - xorq %r13, %r13 - combadz(%r13,%r12,%r11,(x),24(y)) - combadd(%r13,%r12,%r11,8(x),16(y)) - combadd(%r13,%r12,%r11,16(x),8(y)) - combadd(%r13,%r12,%r11,24(x),(y)) - -// Column 4 - - xorq %r14, %r14 - combadz(%r14,%r13,%r12,8(x),24(y)) - combadd(%r14,%r13,%r12,16(x),16(y)) - combadd(%r14,%r13,%r12,24(x),8(y)) - -// Column 5 - - xorq %r15, %r15 - combadz(%r15,%r14,%r13,16(x),24(y)) - combadd(%r15,%r14,%r13,24(x),16(y)) - -// Final work for columns 6 and 7 - - movq 24(x), %rax - mulq 24(y) - addq %rax, %r14 - adcq %rdx, %r15 - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [%r15,%r14,%r13,%r12] and l = [%r11,%r10,%r9,%r8] -// Do Montgomery reductions, now using %rcx as a carry-saver. - - movq $0xd838091dd2253531, w - movq $4294968273, %rbx - -// Montgomery reduce row 0 - - movq %rbx, %rax - imulq w, %r8 - mulq %r8 - subq %rdx, %r9 - sbbq %rcx, %rcx - -// Montgomery reduce row 1 - - movq %rbx, %rax - imulq w, %r9 - mulq %r9 - negq %rcx - sbbq %rdx, %r10 - sbbq %rcx, %rcx - -// Montgomery reduce row 2 - - movq %rbx, %rax - imulq w, %r10 - mulq %r10 - negq %rcx - sbbq %rdx, %r11 - sbbq %rcx, %rcx - -// Montgomery reduce row 3 - - movq %rbx, %rax - imulq w, %r11 - mulq %r11 - negq %rcx - -// Now [%r15,%r14,%r13,%r12] := [%r15,%r14,%r13,%r12] + [%r11,%r10,%r9,%r8] - (%rdx + CF) - - sbbq %rdx, %r8 - sbbq $0, %r9 - sbbq $0, %r10 - sbbq $0, %r11 - - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - sbbq w, w - -// Let b be the top carry captured just above as w = (2^64-1) * b -// Now if [b,%r15,%r14,%r13,%r12] >= p_256k1, subtract p_256k1, i.e. add 4294968273 -// and either way throw away the top word. [b,%r15,%r14,%r13,%r12] - p_256k1 = -// [(b - 1),%r15,%r14,%r13,%r12] + 4294968273. If [%r15,%r14,%r13,%r12] + 4294968273 -// gives carry flag CF then >= comparison is top = 0 <=> b - 1 + CF = 0 which -// is equivalent to b \/ CF, and so to (2^64-1) * b + (2^64 - 1) + CF >= 2^64 - - movq %r12, %r8 - addq %rbx, %r8 - movq %r13, %r9 - adcq $0, %r9 - movq %r14, %r10 - adcq $0, %r10 - movq %r15, %r11 - adcq $0, %r11 - - adcq $-1, w - -// Write everything back - - cmovcq %r8, %r12 - movq %r12, (z) - cmovcq %r9, %r13 - movq %r13, 8(z) - cmovcq %r10, %r14 - movq %r14, 16(z) - cmovcq %r11, %r15 - movq %r15, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_p256k1_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montsqr_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montsqr_p256k1.S deleted file mode 100644 index eecb129f60b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montsqr_p256k1.S +++ /dev/null @@ -1,217 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_256k1, assuming x^2 <= 2^256 * p_256k1, which -// is guaranteed in particular if x < p_256k1 initially (the "intended" case). -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p256k1) - .text - -#define z %rdi -#define x %rsi - -// Use this fairly consistently for a zero - -#define zero %rbp -#define zeroe %ebp - -// Also use the same register for multiplicative inverse in Montgomery stage - -#define w %rbp - -// Add %rdx * m into a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rbx as temporaries - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rbx ; \ - adcxq %rax, low ; \ - adoxq %rbx, high - -S2N_BN_SYMBOL(bignum_montsqr_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Compute [%r15;%r8] = [00] which we use later, but mainly -// set up an initial window [%r14;...;%r9] = [23;03;01] - - movq (x), %rdx - mulxq %rdx, %r8, %r15 - mulxq 8(x), %r9, %r10 - mulxq 24(x), %r11, %r12 - movq 16(x), %rdx - mulxq 24(x), %r13, %r14 - -// Clear our zero register, and also initialize the flags for the carry chain - - xorl zeroe, zeroe - -// Chain in the addition of 02 + 12 + 13 to that window (no carry-out possible) -// This gives all the "heterogeneous" terms of the squaring ready to double - - mulpadd(%r11,%r10,(x)) - mulpadd(%r12,%r11,8(x)) - movq 24(x), %rdx - mulpadd(%r13,%r12,8(x)) - adcxq zero, %r13 - adoxq zero, %r14 - adcq zero, %r14 - -// Double and add to the 00 + 11 + 22 + 33 terms - - xorl zeroe, zeroe - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 8(x), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 16(x), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 24(x), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq zero, %r15 - adoxq zero, %r15 - -// Now we have the full 8-digit square 2^256 * h + l where -// h = [%r15,%r14,%r13,%r12] and l = [%r11,%r10,%r9,%r8] -// Do Montgomery reductions, now using %rcx as a carry save - - movq $0xd838091dd2253531, w - movq $4294968273, %rbx - -// Montgomery reduce row 0 - - movq %rbx, %rax - imulq w, %r8 - mulq %r8 - subq %rdx, %r9 - sbbq %rcx, %rcx - -// Montgomery reduce row 1 - - movq %rbx, %rax - imulq w, %r9 - mulq %r9 - negq %rcx - sbbq %rdx, %r10 - sbbq %rcx, %rcx - -// Montgomery reduce row 2 - - movq %rbx, %rax - imulq w, %r10 - mulq %r10 - negq %rcx - sbbq %rdx, %r11 - sbbq %rcx, %rcx - -// Montgomery reduce row 3 - - movq %rbx, %rax - imulq w, %r11 - mulq %r11 - negq %rcx - -// Now [%r15,%r14,%r13,%r12] := [%r15,%r14,%r13,%r12] + [%r11,%r10,%r9,%r8] - (%rdx + CF) - - sbbq %rdx, %r8 - sbbq $0, %r9 - sbbq $0, %r10 - sbbq $0, %r11 - - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - sbbq w, w - -// Let b be the top carry captured just above as w = (2^64-1) * b -// Now if [b,%r15,%r14,%r13,%r12] >= p_256k1, subtract p_256k1, i.e. add 4294968273 -// and either way throw away the top word. [b,%r15,%r14,%r13,%r12] - p_256k1 = -// [(b - 1),%r15,%r14,%r13,%r12] + 4294968273. If [%r15,%r14,%r13,%r12] + 4294968273 -// gives carry flag CF then >= comparison is top = 0 <=> b - 1 + CF = 0 which -// is equivalent to b \/ CF, and so to (2^64-1) * b + (2^64 - 1) + CF >= 2^64 - - movq %r12, %r8 - addq %rbx, %r8 - movq %r13, %r9 - adcq $0, %r9 - movq %r14, %r10 - adcq $0, %r10 - movq %r15, %r11 - adcq $0, %r11 - - adcq $-1, w - -// Write everything back - - cmovcq %r8, %r12 - movq %r12, (z) - cmovcq %r9, %r13 - movq %r13, 8(z) - cmovcq %r10, %r14 - movq %r14, 16(z) - cmovcq %r11, %r15 - movq %r15, 24(z) - -// Restore saved registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montsqr_p256k1_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montsqr_p256k1_alt.S deleted file mode 100644 index 57bf4d1a670..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_montsqr_p256k1_alt.S +++ /dev/null @@ -1,222 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_p256k1_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_256k1, assuming x^2 <= 2^256 * p_256k1, which -// is guaranteed in particular if x < p_256k1 initially (the "intended" case). -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_p256k1_alt) - .text - -#define z %rdi -#define x %rsi - -// Re-used for constants in second part - -#define w %rsi - -// Macro for the key "multiply and add to (c,h,l)" step, for square term - -#define combadd1(c,h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h - -// A version doubling before adding, for non-square terms - -#define combadd2(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0, c ; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -S2N_BN_SYMBOL(bignum_montsqr_p256k1_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Result term 0 - - movq (x), %rax - mulq %rax - - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - -// Result term 1 - - xorq %r11, %r11 - combadd2(%r11,%r10,%r9,(x),8(x)) - -// Result term 2 - - xorq %r12, %r12 - combadd1(%r12,%r11,%r10,8(x)) - combadd2(%r12,%r11,%r10,(x),16(x)) - -// Result term 3 - - xorq %r13, %r13 - combadd2(%r13,%r12,%r11,(x),24(x)) - combadd2(%r13,%r12,%r11,8(x),16(x)) - -// Result term 4 - - xorq %r14, %r14 - combadd2(%r14,%r13,%r12,8(x),24(x)) - combadd1(%r14,%r13,%r12,16(x)) - -// Result term 5 - - xorq %r15, %r15 - combadd2(%r15,%r14,%r13,16(x),24(x)) - -// Result term 6 - - combads(%r15,%r14,24(x)) - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [%r15,%r14,%r13,%r12] and l = [%r11,%r10,%r9,%r8] -// Do Montgomery reductions, now using %rcx as a carry-saver. - - movq $0xd838091dd2253531, w - movq $4294968273, %rbx - -// Montgomery reduce row 0 - - movq %rbx, %rax - imulq w, %r8 - mulq %r8 - subq %rdx, %r9 - sbbq %rcx, %rcx - -// Montgomery reduce row 1 - - movq %rbx, %rax - imulq w, %r9 - mulq %r9 - negq %rcx - sbbq %rdx, %r10 - sbbq %rcx, %rcx - -// Montgomery reduce row 2 - - movq %rbx, %rax - imulq w, %r10 - mulq %r10 - negq %rcx - sbbq %rdx, %r11 - sbbq %rcx, %rcx - -// Montgomery reduce row 3 - - movq %rbx, %rax - imulq w, %r11 - mulq %r11 - negq %rcx - -// Now [%r15,%r14,%r13,%r12] := [%r15,%r14,%r13,%r12] + [%r11,%r10,%r9,%r8] - (%rdx + CF) - - sbbq %rdx, %r8 - sbbq $0, %r9 - sbbq $0, %r10 - sbbq $0, %r11 - - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - sbbq w, w - -// Let b be the top carry captured just above as w = (2^64-1) * b -// Now if [b,%r15,%r14,%r13,%r12] >= p_256k1, subtract p_256k1, i.e. add 4294968273 -// and either way throw away the top word. [b,%r15,%r14,%r13,%r12] - p_256k1 = -// [(b - 1),%r15,%r14,%r13,%r12] + 4294968273. If [%r15,%r14,%r13,%r12] + 4294968273 -// gives carry flag CF then >= comparison is top = 0 <=> b - 1 + CF = 0 which -// is equivalent to b \/ CF, and so to (2^64-1) * b + (2^64 - 1) + CF >= 2^64 - - movq %r12, %r8 - addq %rbx, %r8 - movq %r13, %r9 - adcq $0, %r9 - movq %r14, %r10 - adcq $0, %r10 - movq %r15, %r11 - adcq $0, %r11 - - adcq $-1, w - -// Write everything back - - cmovcq %r8, %r12 - movq %r12, (z) - cmovcq %r9, %r13 - movq %r13, 8(z) - cmovcq %r10, %r14 - movq %r14, 16(z) - cmovcq %r11, %r15 - movq %r15, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_p256k1_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mul_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mul_p256k1.S deleted file mode 100644 index d3e939efad3..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mul_p256k1.S +++ /dev/null @@ -1,188 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply modulo p_256k1, z := (x * y) mod p_256k1 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_mul_p256k1(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_p256k1) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// Copied in or set up - -#define y %rcx - -// A zero register - -#define zero %rbp -#define zeroe %ebp - -// mulpadd(high,low,m) adds %rdx * m to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rbx as temporaries. - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rbx ; \ - adcxq %rax, low ; \ - adoxq %rbx, high - -// mulpade(high,low,m) adds %rdx * m to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax as a temporary, assuming high created from scratch -// and that zero has value zero. - -#define mulpade(high,low,m) \ - mulxq m, %rax, high ; \ - adcxq %rax, low ; \ - adoxq zero, high - -S2N_BN_SYMBOL(bignum_mul_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Zero a register, which also makes sure we don't get a fake carry-in - - xorl zeroe, zeroe - -// Do the zeroth row, which is a bit different - - movq (y), %rdx - - mulxq (x), %r8, %r9 - mulxq 8(x), %rax, %r10 - addq %rax, %r9 - mulxq 16(x), %rax, %r11 - adcq %rax, %r10 - mulxq 24(x), %rax, %r12 - adcq %rax, %r11 - adcq zero, %r12 - -// Add row 1 - - xorl zeroe, zeroe - movq 8(y), %rdx - mulpadd(%r10,%r9,(x)) - mulpadd(%r11,%r10,8(x)) - mulpadd(%r12,%r11,16(x)) - mulpade(%r13,%r12,24(x)) - adcxq zero, %r13 - -// Add row 2 - - xorl zeroe, zeroe - movq 16(y), %rdx - mulpadd(%r11,%r10,(x)) - mulpadd(%r12,%r11,8(x)) - mulpadd(%r13,%r12,16(x)) - mulpade(%r14,%r13,24(x)); - adcxq zero, %r14 - -// Add row 3 - - xorl zeroe, zeroe - movq 24(y), %rdx - mulpadd(%r12,%r11,(x)) - mulpadd(%r13,%r12,8(x)) - mulpadd(%r14,%r13,16(x)); - mulpade(%r15,%r14,24(x)); - adcxq zero, %r15 - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [%r15,%r14,%r13,%r12] and l = [%r11,%r10,%r9,%r8] -// and this is == 4294968273 * h + l (mod p_256k1) - - movq $4294968273, %rdx - - xorl zeroe, zeroe - - mulpadd(%r9,%r8,%r12) - mulpadd(%r10,%r9,%r13) - mulpadd(%r11,%r10,%r14) - mulpade(%r12,%r11,%r15) - adcxq zero, %r12 - -// Now we have reduced to 5 digits, 2^256 * h + l = [%r12,%r11,%r10,%r9,%r8] -// Use q = h + 1 as the initial quotient estimate, either right or 1 too big. - - leaq 1(%r12), %rax - mulxq %rax, %rax, %rbx - addq %rax, %r8 - adcq %rbx, %r9 - adcq zero, %r10 - adcq zero, %r11 - -// Now the effective answer is 2^256 * (CF - 1) + [%r11,%r10,%r9,%r8] -// So we correct if CF = 0 by subtracting 4294968273, i.e. by -// adding p_256k1 to the "full" answer - - cmovcq zero, %rdx - subq %rdx, %r8 - sbbq zero, %r9 - sbbq zero, %r10 - sbbq zero, %r11 - -// Write everything back - - movq %r8, (z) - movq %r9, 8(z) - movq %r10, 16(z) - movq %r11, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mul_p256k1_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mul_p256k1_alt.S deleted file mode 100644 index 428cc2cd7f9..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_mul_p256k1_alt.S +++ /dev/null @@ -1,216 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply modulo p_256k1, z := (x * y) mod p_256k1 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_mul_p256k1_alt(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_p256k1_alt) - .text - -// These are actually right - -#define z %rdi -#define x %rsi - -// Copied in or set up - -#define y %rcx - -// Re-use input pointers later for constant and top carry - -#define d %rsi -#define c %rcx - -// Macro for the key "multiply and add to (c,h,l)" step - -#define combadd(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A minutely shorter form for when c = 0 initially - -#define combadz(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq c, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h - -S2N_BN_SYMBOL(bignum_mul_p256k1_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Start the window as [%r10;%r9;%r8] with 00 product - - movq (x), %rax - mulq (y) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - -// Column 1 - - xorq %r11, %r11 - combads(%r10,%r9,(x),8(y)) - combadd(%r11,%r10,%r9,8(x),(y)) - -// Column 2 - - xorq %r12, %r12 - combadz(%r12,%r11,%r10,(x),16(y)) - combadd(%r12,%r11,%r10,8(x),8(y)) - combadd(%r12,%r11,%r10,16(x),(y)) - -// Column 3 - - xorq %r13, %r13 - combadz(%r13,%r12,%r11,(x),24(y)) - combadd(%r13,%r12,%r11,8(x),16(y)) - combadd(%r13,%r12,%r11,16(x),8(y)) - combadd(%r13,%r12,%r11,24(x),(y)) - -// Column 4 - - xorq %r14, %r14 - combadz(%r14,%r13,%r12,8(x),24(y)) - combadd(%r14,%r13,%r12,16(x),16(y)) - combadd(%r14,%r13,%r12,24(x),8(y)) - -// Column 5 - - xorq %r15, %r15 - combadz(%r15,%r14,%r13,16(x),24(y)) - combadd(%r15,%r14,%r13,24(x),16(y)) - -// Final work for columns 6 and 7 - - movq 24(x), %rax - mulq 24(y) - addq %rax, %r14 - adcq %rdx, %r15 - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [%r15,%r14,%r13,%r12] and l = [%r11,%r10,%r9,%r8] -// and this is == 4294968273 * h + l (mod p_256k1) - - movq $4294968273, d - - movq %r12, %rax - mulq d - addq %rax, %r8 - adcq %rdx, %r9 - sbbq c, c - - movq %r13, %rax - mulq d - subq c, %rdx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq c, c - - movq %r14, %rax - mulq d - subq c, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq c, c - - movq %r15, %rax - mulq d - subq c, %rdx - xorq c, c - addq %rax, %r11 - movq %rdx, %r12 - adcq c, %r12 - -// Now we have reduced to 5 digits, 2^256 * h + l = [%r12,%r11,%r10,%r9,%r8] -// Use q = h + 1 as the initial quotient estimate, either right or 1 too big. - - leaq 1(%r12), %rax - mulq d - addq %rax, %r8 - adcq %rdx, %r9 - adcq c, %r10 - adcq c, %r11 - -// Now the effective answer is 2^256 * (CF - 1) + [%r11,%r10,%r9,%r8] -// So we correct if CF = 0 by subtracting 4294968273, i.e. by -// adding p_256k1 to the "full" answer - - sbbq %rax, %rax - notq %rax - andq d, %rax - subq %rax, %r8 - sbbq c, %r9 - sbbq c, %r10 - sbbq c, %r11 - -// Write everything back - - movq %r8, (z) - movq %r9, 8(z) - movq %r10, 16(z) - movq %r11, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mul_p256k1_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_neg_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_neg_p256k1.S deleted file mode 100644 index 2f91665fd6b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_neg_p256k1.S +++ /dev/null @@ -1,87 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Negate modulo p_256k1, z := (-x) mod p_256k1, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_neg_p256k1(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_neg_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_neg_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_neg_p256k1) - .text - -#define z %rdi -#define x %rsi - -#define q %rdx -#define n0 %rax -#define n1 %rcx -#define n2 %r8 -#define n3 %r9 - -#define c %r10 - -#define qshort %esi - -S2N_BN_SYMBOL(bignum_neg_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the 4 digits of x and let q be an OR of all the digits - - movq (x), n0 - movq n0, q - movq 8(x), n1 - orq n1, q - movq 16(x), n2 - orq n2, q - movq 24(x), n3 - orq n3, q - -// Turn q into a strict bitmask, and c a masked constant -4294968273 - - negq q - sbbq q, q - movq $-4294968273, c - andq q, c - -// Now just do [2^256 - 4294968273] - x where the constant is masked - - subq n0, c - movq c, (z) - movq q, c - sbbq n1, c - movq c, 8(z) - movq q, c - sbbq n2, c - movq c, 16(z) - sbbq n3, q - movq q, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_neg_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_optneg_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_optneg_p256k1.S deleted file mode 100644 index a9ea1e227e5..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_optneg_p256k1.S +++ /dev/null @@ -1,98 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo p_256k1, z := (-x) mod p_256k1 (if p nonzero) or -// z := x (if p zero), assuming x reduced -// Inputs p, x[4]; output z[4] -// -// extern void bignum_optneg_p256k1(uint64_t z[static 4], uint64_t p, -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = p, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = p, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg_p256k1) - .text - -#define z %rdi -#define q %rsi -#define x %rdx - -#define n0 %rax -#define n1 %rcx -#define n2 %r8 -#define n3 %r9 - -#define c %r10 - -#define qshort %esi - -S2N_BN_SYMBOL(bignum_optneg_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Load the 4 digits of x and let c be an OR of all the digits - - movq (x), n0 - movq n0, c - movq 8(x), n1 - orq n1, c - movq 16(x), n2 - orq n2, c - movq 24(x), n3 - orq n3, c - -// Turn q into a strict bitmask. Force it to zero if the input is zero, -// to avoid giving -0 = p_256k1, which is not reduced though correct modulo. - - cmovzq c, q - negq q - sbbq q, q - -// We want z := if q then (2^256 - 4294968273) - x else x -// which is: [if q then ~x else x] - [if q then 4294968272 else 0] - - xorq q, n0 - xorq q, n1 - xorq q, n2 - xorq q, n3 - - movq $4294968272, c - andq q, c - xorl qshort, qshort - - subq c, n0 - movq n0, (z) - sbbq q, n1 - movq n1, 8(z) - sbbq q, n2 - movq n2, 16(z) - sbbq q, n3 - movq n3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_sqr_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_sqr_p256k1.S deleted file mode 100644 index 13b589c3b16..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_sqr_p256k1.S +++ /dev/null @@ -1,178 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square modulo p_256k1, z := (x^2) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_sqr_p256k1(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_p256k1) - .text - -#define z %rdi -#define x %rsi - -// Use this fairly consistently for a zero - -#define zero %rbx -#define zeroe %ebx - -// Add %rdx * m into a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rcx as temporaries - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rcx ; \ - adcxq %rax, low ; \ - adoxq %rcx, high - -// mulpade(high,low,m) adds %rdx * m to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax as a temporary, assuming high created from scratch -// and that zero has value zero. - -#define mulpade(high,low,m) \ - mulxq m, %rax, high ; \ - adcxq %rax, low ; \ - adoxq zero, high - -S2N_BN_SYMBOL(bignum_sqr_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Compute [%r15;%r8] = [00] which we use later, but mainly -// set up an initial window [%r14;...;%r9] = [23;03;01] - - movq (x), %rdx - mulxq %rdx, %r8, %r15 - mulxq 8(x), %r9, %r10 - mulxq 24(x), %r11, %r12 - movq 16(x), %rdx - mulxq 24(x), %r13, %r14 - -// Clear our zero register, and also initialize the flags for the carry chain - - xorl zeroe, zeroe - -// Chain in the addition of 02 + 12 + 13 to that window (no carry-out possible) -// This gives all the "heterogeneous" terms of the squaring ready to double - - mulpadd(%r11,%r10,(x)) - mulpadd(%r12,%r11,8(x)) - movq 24(x), %rdx - mulpadd(%r13,%r12,8(x)) - adcxq zero, %r13 - adoxq zero, %r14 - adcq zero, %r14 - -// Double and add to the 00 + 11 + 22 + 33 terms - - xorl zeroe, zeroe - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 8(x), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 16(x), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 24(x), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq zero, %r15 - adoxq zero, %r15 - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [%r15,%r14,%r13,%r12] and l = [%r11,%r10,%r9,%r8] -// and this is == 4294968273 * h + l (mod p_256k1) - - movq $4294968273, %rdx - - xorl zeroe, zeroe - - mulpadd(%r9,%r8,%r12) - mulpadd(%r10,%r9,%r13) - mulpadd(%r11,%r10,%r14) - mulpade(%r12,%r11,%r15) - adcxq zero, %r12 - -// Now we have reduced to 5 digits, 2^256 * h + l = [%r12,%r11,%r10,%r9,%r8] -// Use q = h + 1 as the initial quotient estimate, either right or 1 too big. - - leaq 1(%r12), %rax - mulxq %rax, %rax, %rcx - addq %rax, %r8 - adcq %rcx, %r9 - adcq zero, %r10 - adcq zero, %r11 - -// Now the effective answer is 2^256 * (CF - 1) + [%r11,%r10,%r9,%r8] -// So we correct if CF = 0 by subtracting 4294968273, i.e. by -// adding p_256k1 to the "full" answer - - sbbq %rax, %rax - notq %rax - andq %rdx, %rax - subq %rax, %r8 - sbbq zero, %r9 - sbbq zero, %r10 - sbbq zero, %r11 - -// Write everything back - - movq %r8, (z) - movq %r9, 8(z) - movq %r10, 16(z) - movq %r11, 24(z) - -// Restore saved registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_sqr_p256k1_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_sqr_p256k1_alt.S deleted file mode 100644 index c3785f042b8..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_sqr_p256k1_alt.S +++ /dev/null @@ -1,199 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Square modulo p_256k1, z := (x^2) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_sqr_p256k1_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_p256k1_alt) - .text - -#define z %rdi -#define x %rsi - -// Re-use input pointer later for constant - -#define d %rsi -#define c %rcx - -// Macro for the key "multiply and add to (c,h,l)" step, for square term - -#define combadd1(c,h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa) \ - movq numa, %rax ; \ - mulq %rax; \ - addq %rax, l ; \ - adcq %rdx, h - -// A version doubling before adding, for non-square terms - -#define combadd2(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0, c ; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -S2N_BN_SYMBOL(bignum_sqr_p256k1_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Result term 0 - - movq (x), %rax - mulq %rax - - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - -// Result term 1 - - xorq %r11, %r11 - combadd2(%r11,%r10,%r9,(x),8(x)) - -// Result term 2 - - xorq %r12, %r12 - combadd1(%r12,%r11,%r10,8(x)) - combadd2(%r12,%r11,%r10,(x),16(x)) - -// Result term 3 - - xorq %r13, %r13 - combadd2(%r13,%r12,%r11,(x),24(x)) - combadd2(%r13,%r12,%r11,8(x),16(x)) - -// Result term 4 - - xorq %r14, %r14 - combadd2(%r14,%r13,%r12,8(x),24(x)) - combadd1(%r14,%r13,%r12,16(x)) - -// Result term 5 - - xorq %r15, %r15 - combadd2(%r15,%r14,%r13,16(x),24(x)) - -// Result term 6 - - combads(%r15,%r14,24(x)) - -// Now we have the full 8-digit product 2^256 * h + l where -// h = [%r15,%r14,%r13,%r12] and l = [%r11,%r10,%r9,%r8] -// and this is == 4294968273 * h + l (mod p_256k1) - - movq $4294968273, d - - movq %r12, %rax - mulq d - addq %rax, %r8 - adcq %rdx, %r9 - sbbq c, c - - movq %r13, %rax - mulq d - subq c, %rdx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq c, c - - movq %r14, %rax - mulq d - subq c, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq c, c - - movq %r15, %rax - mulq d - subq c, %rdx - xorq c, c - addq %rax, %r11 - movq %rdx, %r12 - adcq c, %r12 - -// Now we have reduced to 5 digits, 2^256 * h + l = [%r12,%r11,%r10,%r9,%r8] -// Use q = h + 1 as the initial quotient estimate, either right or 1 too big. - - leaq 1(%r12), %rax - mulq d - addq %rax, %r8 - adcq %rdx, %r9 - adcq c, %r10 - adcq c, %r11 - -// Now the effective answer is 2^256 * (CF - 1) + [%r11,%r10,%r9,%r8] -// So we correct if CF = 0 by subtracting 4294968273, i.e. by -// adding p_256k1 to the "full" answer - - sbbq %rax, %rax - notq %rax - andq d, %rax - subq %rax, %r8 - sbbq c, %r9 - sbbq c, %r10 - sbbq c, %r11 - -// Write everything back - - movq %r8, (z) - movq %r9, 8(z) - movq %r10, 16(z) - movq %r11, 24(z) - -// Restore registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sqr_p256k1_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_sub_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_sub_p256k1.S deleted file mode 100644 index 878ad24597a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_sub_p256k1.S +++ /dev/null @@ -1,91 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Subtract modulo p_256k1, z := (x - y) mod p_256k1 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_sub_p256k1(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sub_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sub_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sub_p256k1) - .text - -#define z %rdi -#define x %rsi -#define y %rdx - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -#define zero %rax -#define zeroe %eax -#define c %rcx - -S2N_BN_SYMBOL(bignum_sub_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Zero a register first - - xorl zeroe, zeroe - -// Load and subtract the two inputs as [d3;d2;d1;d0] = x - y (modulo 2^256) - - movq (x), d0 - subq (y), d0 - movq 8(x), d1 - sbbq 8(y), d1 - movq 16(x), d2 - sbbq 16(y), d2 - movq 24(x), d3 - sbbq 24(y), d3 - -// Now if x < y we want to add back p_256k1, which staying within 4 digits -// means subtracting 4294968273, since p_256k1 = 2^256 - 4294968273. -// Let c be that constant 4294968273 when x < y, zero otherwise. - - movq $4294968273, c - cmovncq zero, c - -// Now correct by adding masked p_256k1, i.e. subtracting c, and write back - - subq c, d0 - movq d0, (z) - sbbq zero, d1 - movq d1, 8(z) - sbbq zero, d2 - movq d2, 16(z) - sbbq zero, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sub_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_tomont_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_tomont_p256k1.S deleted file mode 100644 index df2a5e01a4e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_tomont_p256k1.S +++ /dev/null @@ -1,109 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert to Montgomery form z := (2^256 * x) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_tomont_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tomont_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tomont_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tomont_p256k1) - .text - -#define z %rdi -#define x %rsi - -#define d %rdx - -#define a %rax -#define ashort %eax -#define q %rax - -#define d0 %rcx -#define d1 %r8 -#define d2 %r9 -#define d3 %r10 - -// Re-use the x argument later on when it's no longer needed - -#define h %rsi -#define c %rsi - -S2N_BN_SYMBOL(bignum_tomont_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Since 2^256 == 4294968273 (mod p_256k1) we more or less just set -// m = 4294968273 then devolve to a variant of bignum_cmul_p256k1; -// the logic that q = h + 1 < 2^64 and hence doesn't wrap still holds -// since the multiplier 4294968273 is known to be much less than 2^64. -// We keep this constant in %rdx throughout as it's used repeatedly. - - movq $4294968273, d - -// Multiply, accumulating the result as 2^256 * h + [d3;d2;d1;d0] -// But immediately add 1 to h to get q = h + 1 as the quotient estimate. - - mulxq (x), d0, d1 - mulxq 8(x), a, d2 - addq a, d1 - mulxq 16(x), a, d3 - adcq a, d2 - mulxq 24(x), a, h - adcq a, d3 - adcq $1, h - -// Now the quotient estimate is q = h + 1, and then we do the reduction, -// writing z = [d3;d2;d1;d0], as z' = (2^256 * h + z) - q * p_256k1 = -// (2^256 * h + z) - q * (2^256 - 4294968273) = -2^256 + (z + 4294968273 * q) - - mulxq h, a, c - - addq a, d0 - adcq c, d1 - adcq $0, d2 - adcq $0, d3 - -// Because of the implicit -2^256, CF means >= 0 so z' is the answer; ~CF -// means z' < 0 so we add p_256k1, which in 4 digits means subtracting c. - - movq $0, a - cmovcq a, d - - subq d, d0 - movq d0, (z) - sbbq a, d1 - movq d1, 8(z) - sbbq a, d2 - movq d2, 16(z) - sbbq a, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_tomont_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_tomont_p256k1_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_tomont_p256k1_alt.S deleted file mode 100644 index 5b5ca8be4e5..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_tomont_p256k1_alt.S +++ /dev/null @@ -1,119 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert to Montgomery form z := (2^256 * x) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_tomont_p256k1_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tomont_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tomont_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tomont_p256k1_alt) - .text - -#define z %rdi -#define x %rsi - -#define c %rcx -#define d %rdx -#define h %rdx - -#define a %rax -#define ashort %eax -#define q %rax - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %rsi - -S2N_BN_SYMBOL(bignum_tomont_p256k1_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Since 2^256 == 4294968273 (mod p_256k1) we more or less just set -// m = 4294968273 then devolve to a variant of bignum_cmul_p256k1; -// the logic that q = h + 1 < 2^64 and hence doesn't wrap still holds -// since the multiplier 4294968273 is known to be much less than 2^64. -// We keep this constant in %rcx throughout as it's used repeatedly. - - movq $4294968273, c - -// Multiply, accumulating the result as 2^256 * h + [d3;d2;d1;d0] - - movq (x), a - mulq c - movq a, d0 - movq d, d1 - - movq 8(x), a - xorq d2, d2 - mulq c - addq a, d1 - adcq d, d2 - - movq 16(x), a - mulq c - addq a, d2 - adcq $0, d - - movq 24(x), a - movq d, d3 - mulq c - addq a, d3 - adcq $0, h - -// Now the quotient estimate is q = h + 1, and then we do the reduction, -// writing z = [d3;d2;d1;d0], as z' = (2^256 * h + z) - q * p_256k1 = -// (2^256 * h + z) - q * (2^256 - 4294968273) = -2^256 + (z + 4294968273 * q) - - leaq 1(h), q - mulq c - - addq %rax, d0 - adcq %rdx, d1 - adcq $0, d2 - adcq $0, d3 - -// Because of the implicit -2^256, CF means >= 0 so z' is the answer; ~CF -// means z' < 0 so we add p_256k1, which in 4 digits means subtracting c. - - movq $0, a - cmovcq a, c - - subq c, d0 - movq d0, (z) - sbbq a, d1 - movq d1, 8(z) - sbbq a, d2 - movq d2, 16(z) - sbbq a, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_tomont_p256k1_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_triple_p256k1.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_triple_p256k1.S deleted file mode 100644 index 3b3fd0ac611..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_triple_p256k1.S +++ /dev/null @@ -1,124 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_256k1, z := (3 * x) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_triple_p256k1(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// The input x can be any 4-digit bignum, not necessarily reduced modulo -// p_256k1, and the result is always fully reduced, z = (3 * x) mod p_256k1. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p256k1) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p256k1) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p256k1) - .text - -#define z %rdi -#define x %rsi - -// Main digits of intermediate results - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -// Quotient estimate = top of product + 1 - -#define q %rdx - -// Other temporary variables and their short version - -#define a %rax -#define c %rcx - -#define ashort %eax -#define qshort %edx - -S2N_BN_SYMBOL(bignum_triple_p256k1): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// First do the multiplication by 3, getting z = [h; d3; ...; d0] -// but immediately form the quotient estimate q = h + 1 - - xorl ashort, ashort - - movq (x), q - movq q, d0 - adcxq q, q - adoxq q, d0 - movq 8(x), q - movq q, d1 - adcxq q, q - adoxq q, d1 - movq 16(x), q - movq q, d2 - adcxq q, q - adoxq q, d2 - movq 24(x), q - movq q, d3 - adcxq q, q - adoxq q, d3 - -// For this limited range a simple quotient estimate of q = h + 1 works, where -// h = floor(z / 2^256). Then -p_256k1 <= z - q * p_256k1 < p_256k1. - - movl $1, qshort - adcxq a, q - adoxq a, q - -// Initial subtraction of z - q * p_256k1, actually by adding q * 4294968273. - - movq $4294968273, c - xorq a, a - imulq c, q - addq q, d0 - adcq a, d1 - adcq a, d2 - adcq a, d3 - -// With z = 2^256 * h + l, the underlying result z' is actually -// (2^256 * h + l) - q * (2^256 - 4294968273) = (l + q * 4294968273) - 2^256 -// so carry-clear <=> z' is negative. Correct by subtracting in that case. -// In any case, write final result to z as we go. - - cmovcq a, c - - subq c, d0 - movq d0, (z) - sbbq a, d1 - movq d1, 8(z) - sbbq a, d2 - movq d2, 16(z) - sbbq a, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p256k1) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_triple_p256k1_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_triple_p256k1_alt.S deleted file mode 100644 index fef9d46cc7d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/bignum_triple_p256k1_alt.S +++ /dev/null @@ -1,126 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_256k1, z := (3 * x) mod p_256k1 -// Input x[4]; output z[4] -// -// extern void bignum_triple_p256k1_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// The input x can be any 4-digit bignum, not necessarily reduced modulo -// p_256k1, and the result is always fully reduced, z = (3 * x) mod p_256k1. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_p256k1_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_p256k1_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_p256k1_alt) - .text - -#define z %rdi -#define x %rsi - -// Main digits of intermediate results - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -// Quotient estimate = top of product + 1 - -#define d %rdx -#define h %rdx -#define q %rdx - -// Other temporary variables and their short version - -#define a %rax -#define c %rcx - -#define ashort %eax -#define qshort %edx - -S2N_BN_SYMBOL(bignum_triple_p256k1_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// First do the multiplication by 3, getting z = [h; d3; ...; d0] -// but immediately form the quotient estimate q = h + 1 - - movq $3, c - - movq (x), a - mulq c - movq a, d0 - movq d, d1 - - movq 8(x), a - xorq d2, d2 - mulq c - addq a, d1 - adcq d, d2 - - movq 16(x), a - mulq c - addq a, d2 - adcq $0, d - - movq 24(x), a - movq d, d3 - mulq c - addq a, d3 - adcq $1, h - -// For this limited range a simple quotient estimate of q = h + 1 works, where -// h = floor(z / 2^256). Then -p_256k1 <= z - q * p_256k1 < p_256k1. -// Initial subtraction of z - q * p_256k1, actually by adding q * 4294968273. - - movq $4294968273, c - xorq a, a - imulq c, q - addq q, d0 - adcq a, d1 - adcq a, d2 - adcq a, d3 - -// With z = 2^256 * h + l, the underlying result z' is actually -// (2^256 * h + l) - q * (2^256 - 4294968273) = (l + q * 4294968273) - 2^256 -// so carry-clear <=> z' is negative. Correct by subtracting in that case. -// In any case, write final result to z as we go. - - cmovcq a, c - - subq c, d0 - movq d0, (z) - sbbq a, d1 - movq d1, 8(z) - sbbq a, d2 - movq d2, 16(z) - sbbq a, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_p256k1_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jadd.S deleted file mode 100644 index cd01c351335..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jadd.S +++ /dev/null @@ -1,429 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on SECG curve secp256k1 in Jacobian coordinates -// -// extern void secp256k1_jadd(uint64_t p3[static 12], const uint64_t p1[static 12], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// It is assumed that all coordinates of the input points p1 and p2 are -// fully reduced mod p_256k1, that both z coordinates are nonzero and -// that neither p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents -// the same affine point as". -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(secp256k1_jadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(secp256k1_jadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(secp256k1_jadd) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rbp = p2, -// all of which are maintained throughout the code. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rbp) -#define y_2 NUMSIZE(%rbp) -#define z_2 (2*NUMSIZE)(%rbp) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z1sq (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define x1a (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define z2sq (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define y1a (NUMSIZE*6)(%rsp) - -#define NSPACE NUMSIZE*7 - -// Corresponds exactly to bignum_mul_p256k1 - -#define mul_p256k1(P0,P1,P2) \ - xorl %ecx, %ecx ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rcx, %r12 ; \ - xorl %ecx, %ecx ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rcx, %r13 ; \ - xorl %ecx, %ecx ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcxq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rcx, %r15 ; \ - adcxq %rcx, %r15 ; \ - movabs $0x1000003d1, %rdx ; \ - xorl %ecx, %ecx ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - adcxq %rcx, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - mulxq %rax, %rax, %rbx ; \ - addq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - cmovbq %rcx, %rdx ; \ - subq %rdx, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Corresponds exactly to bignum_sqr_p256k1 - -#define sqr_p256k1(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ebx, %ebx ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rbx, %r13 ; \ - adoxq %rbx, %r14 ; \ - adcq %rbx, %r14 ; \ - xorl %ebx, %ebx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rbx, %r15 ; \ - adoxq %rbx, %r15 ; \ - movabs $0x1000003d1, %rdx ; \ - xorl %ebx, %ebx ; \ - mulxq %r12, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq %r13, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq %r14, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - adcxq %rbx, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - mulxq %rax, %rax, %rcx ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rdx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Corresponds exactly to bignum_sub_p256k1 - -#define sub_p256k1(P0,P1,P2) \ - xorl %eax, %eax ; \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 0x8+P1, %r9 ; \ - sbbq 0x8+P2, %r9 ; \ - movq 0x10+P1, %r10 ; \ - sbbq 0x10+P2, %r10 ; \ - movq 0x18+P1, %r11 ; \ - sbbq 0x18+P2, %r11 ; \ - movabs $0x1000003d1, %rcx ; \ - cmovae %rax, %rcx ; \ - subq %rcx, %r8 ; \ - movq %r8, P0 ; \ - sbbq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - sbbq %rax, %r10 ; \ - movq %r10, 0x10+P0 ; \ - sbbq %rax, %r11 ; \ - movq %r11, 0x18+P0 - -// Additional macros to help with final multiplexing - -#define load4(r0,r1,r2,r3,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 - -#define store4(P,r0,r1,r2,r3) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P - -#define czload4(r0,r1,r2,r3,P) \ - cmovzq P, r0 ; \ - cmovzq 8+P, r1 ; \ - cmovzq 16+P, r2 ; \ - cmovzq 24+P, r3 - -#define muxload4(r0,r1,r2,r3,P0,P1,P2) \ - movq P0, r0 ; \ - cmovbq P1, r0 ; \ - cmovnbe P2, r0 ; \ - movq 8+P0, r1 ; \ - cmovbq 8+P1, r1 ; \ - cmovnbe 8+P2, r1 ; \ - movq 16+P0, r2 ; \ - cmovbq 16+P1, r2 ; \ - cmovnbe 16+P2, r2 ; \ - movq 24+P0, r3 ; \ - cmovbq 24+P1, r3 ; \ - cmovnbe 24+P2, r3 - -S2N_BN_SYMBOL(secp256k1_jadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input y in %rbp where it stays - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdx, %rbp - -// Main code, just a sequence of basic field operations - - sqr_p256k1(z1sq,z_1) - sqr_p256k1(z2sq,z_2) - - mul_p256k1(y1a,z_2,y_1) - mul_p256k1(y2a,z_1,y_2) - - mul_p256k1(x2a,z1sq,x_2) - mul_p256k1(x1a,z2sq,x_1) - mul_p256k1(y2a,z1sq,y2a) - mul_p256k1(y1a,z2sq,y1a) - - sub_p256k1(xd,x2a,x1a) - sub_p256k1(yd,y2a,y1a) - - sqr_p256k1(zz,xd) - sqr_p256k1(ww,yd) - - mul_p256k1(zzx1,zz,x1a) - mul_p256k1(zzx2,zz,x2a) - - sub_p256k1(resx,ww,zzx1) - sub_p256k1(t1,zzx2,zzx1) - - mul_p256k1(xd,xd,z_1) - - sub_p256k1(resx,resx,zzx2) - - sub_p256k1(t2,zzx1,resx) - - mul_p256k1(t1,t1,y1a) - mul_p256k1(resz,xd,z_2) - mul_p256k1(t2,yd,t2) - - sub_p256k1(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "NBE" <=> ~(CF \/ ZF) <=> P1 = 0 /\ ~(P2 = 0) -// and "B" <=> CF <=> ~(P1 = 0) /\ P2 = 0 -// and "Z" <=> ZF <=> (P1 = 0 <=> P2 = 0) - - load4(%r8,%r9,%r10,%r11,z_1) - - movq %r8, %rax - movq %r9, %rdx - orq %r10, %rax - orq %r11, %rdx - orq %rdx, %rax - negq %rax - sbbq %rax, %rax - - load4(%r12,%r13,%r14,%r15,z_2) - - movq %r12, %rbx - movq %r13, %rdx - orq %r14, %rbx - orq %r15, %rdx - orq %rdx, %rbx - negq %rbx - sbbq %rbx, %rbx - - cmpq %rax, %rbx - -// Multiplex the outputs accordingly, re-using the z's in registers - - cmovbq %r8, %r12 - cmovbq %r9, %r13 - cmovbq %r10, %r14 - cmovbq %r11, %r15 - - czload4(%r12,%r13,%r14,%r15,resz) - - muxload4(%rax,%rbx,%rcx,%rdx,resx,x_1,x_2) - muxload4(%r8,%r9,%r10,%r11,resy,y_1,y_2) - -// Finally store back the multiplexed values - - store4(x_3,%rax,%rbx,%rcx,%rdx) - store4(y_3,%r8,%r9,%r10,%r11) - store4(z_3,%r12,%r13,%r14,%r15) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(secp256k1_jadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jadd_alt.S deleted file mode 100644 index 685e1022343..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jadd_alt.S +++ /dev/null @@ -1,511 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on SECG curve secp256k1 in Jacobian coordinates -// -// extern void secp256k1_jadd_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// It is assumed that all coordinates of the input points p1 and p2 are -// fully reduced mod p_256k1, that both z coordinates are nonzero and -// that neither p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents -// the same affine point as". -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(secp256k1_jadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(secp256k1_jadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(secp256k1_jadd_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rbp = p2, -// all of which are maintained throughout the code. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rbp) -#define y_2 NUMSIZE(%rbp) -#define z_2 (2*NUMSIZE)(%rbp) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z1sq (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define x1a (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define z2sq (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define y1a (NUMSIZE*6)(%rsp) - -#define NSPACE NUMSIZE*7 - -// Corresponds to bignum_mul_p256k1_alt except %rsi -> %rbx - -#define mul_p256k1(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movq $0x1000003d1, %rbx ; \ - movq %r12, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rbx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Corresponds to bignum_sqr_p256k1_alt except for %rsi -> %rbx - -#define sqr_p256k1(P0,P1) \ - movq P1, %rax ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r11 ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r12 ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r14 ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r15 ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movq $0x1000003d1, %rbx ; \ - movq %r12, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rbx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Corresponds exactly to bignum_sub_p256k1 - -#define sub_p256k1(P0,P1,P2) \ - xorl %eax, %eax ; \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 0x8+P1, %r9 ; \ - sbbq 0x8+P2, %r9 ; \ - movq 0x10+P1, %r10 ; \ - sbbq 0x10+P2, %r10 ; \ - movq 0x18+P1, %r11 ; \ - sbbq 0x18+P2, %r11 ; \ - movabs $0x1000003d1, %rcx ; \ - cmovae %rax, %rcx ; \ - subq %rcx, %r8 ; \ - movq %r8, P0 ; \ - sbbq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - sbbq %rax, %r10 ; \ - movq %r10, 0x10+P0 ; \ - sbbq %rax, %r11 ; \ - movq %r11, 0x18+P0 - -// Additional macros to help with final multiplexing - -#define load4(r0,r1,r2,r3,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 - -#define store4(P,r0,r1,r2,r3) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P - -#define czload4(r0,r1,r2,r3,P) \ - cmovzq P, r0 ; \ - cmovzq 8+P, r1 ; \ - cmovzq 16+P, r2 ; \ - cmovzq 24+P, r3 - -#define muxload4(r0,r1,r2,r3,P0,P1,P2) \ - movq P0, r0 ; \ - cmovbq P1, r0 ; \ - cmovnbe P2, r0 ; \ - movq 8+P0, r1 ; \ - cmovbq 8+P1, r1 ; \ - cmovnbe 8+P2, r1 ; \ - movq 16+P0, r2 ; \ - cmovbq 16+P1, r2 ; \ - cmovnbe 16+P2, r2 ; \ - movq 24+P0, r3 ; \ - cmovbq 24+P1, r3 ; \ - cmovnbe 24+P2, r3 - -S2N_BN_SYMBOL(secp256k1_jadd_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input y in %rbp where it stays - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdx, %rbp - -// Main code, just a sequence of basic field operations - - sqr_p256k1(z1sq,z_1) - sqr_p256k1(z2sq,z_2) - - mul_p256k1(y1a,z_2,y_1) - mul_p256k1(y2a,z_1,y_2) - - mul_p256k1(x2a,z1sq,x_2) - mul_p256k1(x1a,z2sq,x_1) - mul_p256k1(y2a,z1sq,y2a) - mul_p256k1(y1a,z2sq,y1a) - - sub_p256k1(xd,x2a,x1a) - sub_p256k1(yd,y2a,y1a) - - sqr_p256k1(zz,xd) - sqr_p256k1(ww,yd) - - mul_p256k1(zzx1,zz,x1a) - mul_p256k1(zzx2,zz,x2a) - - sub_p256k1(resx,ww,zzx1) - sub_p256k1(t1,zzx2,zzx1) - - mul_p256k1(xd,xd,z_1) - - sub_p256k1(resx,resx,zzx2) - - sub_p256k1(t2,zzx1,resx) - - mul_p256k1(t1,t1,y1a) - mul_p256k1(resz,xd,z_2) - mul_p256k1(t2,yd,t2) - - sub_p256k1(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "NBE" <=> ~(CF \/ ZF) <=> P1 = 0 /\ ~(P2 = 0) -// and "B" <=> CF <=> ~(P1 = 0) /\ P2 = 0 -// and "Z" <=> ZF <=> (P1 = 0 <=> P2 = 0) - - load4(%r8,%r9,%r10,%r11,z_1) - - movq %r8, %rax - movq %r9, %rdx - orq %r10, %rax - orq %r11, %rdx - orq %rdx, %rax - negq %rax - sbbq %rax, %rax - - load4(%r12,%r13,%r14,%r15,z_2) - - movq %r12, %rbx - movq %r13, %rdx - orq %r14, %rbx - orq %r15, %rdx - orq %rdx, %rbx - negq %rbx - sbbq %rbx, %rbx - - cmpq %rax, %rbx - -// Multiplex the outputs accordingly, re-using the z's in registers - - cmovbq %r8, %r12 - cmovbq %r9, %r13 - cmovbq %r10, %r14 - cmovbq %r11, %r15 - - czload4(%r12,%r13,%r14,%r15,resz) - - muxload4(%rax,%rbx,%rcx,%rdx,resx,x_1,x_2) - muxload4(%r8,%r9,%r10,%r11,resy,y_1,y_2) - -// Finally store back the multiplexed values - - store4(x_3,%rax,%rbx,%rcx,%rdx) - store4(y_3,%r8,%r9,%r10,%r11) - store4(z_3,%r12,%r13,%r14,%r15) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(secp256k1_jadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jdouble.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jdouble.S deleted file mode 100644 index c9c86991fe2..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jdouble.S +++ /dev/null @@ -1,623 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on SECG curve secp256k1 in Jacobian coordinates -// -// extern void secp256k1_jdouble(uint64_t p3[static 12], -// const uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// It is assumed that all coordinates of the input point are fully -// reduced mod p_256k1 and that the z coordinate is not zero. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1 -// Microsoft x64 ABI: RCX = p3, RDX = p1 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(secp256k1_jdouble) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(secp256k1_jdouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(secp256k1_jdouble) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1, which is true when the -// arguments come in initially and is not disturbed throughout. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define x_2 (NUMSIZE*0)(%rsp) -#define y_2 (NUMSIZE*1)(%rsp) -#define d (NUMSIZE*2)(%rsp) -#define tmp (NUMSIZE*3)(%rsp) -#define x_4 (NUMSIZE*4)(%rsp) -#define y_4 (NUMSIZE*6)(%rsp) -#define dx2 (NUMSIZE*8)(%rsp) -#define xy2 (NUMSIZE*10)(%rsp) - -#define NSPACE NUMSIZE*12 - -// Corresponds exactly to bignum_mul_p256k1 - -#define mul_p256k1(P0,P1,P2) \ - xorl %ecx, %ecx ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rcx, %r12 ; \ - xorl %ecx, %ecx ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rcx, %r13 ; \ - xorl %ecx, %ecx ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcxq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rcx, %r15 ; \ - adcxq %rcx, %r15 ; \ - movabsq $0x1000003d1, %rdx ; \ - xorl %ecx, %ecx ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - adcxq %rcx, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - mulxq %rax, %rax, %rbx ; \ - addq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - cmovbq %rcx, %rdx ; \ - subq %rdx, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Corresponds exactly to bignum_sqr_p256k1 - -#define sqr_p256k1(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ebx, %ebx ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rbx, %r13 ; \ - adoxq %rbx, %r14 ; \ - adcq %rbx, %r14 ; \ - xorl %ebx, %ebx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rbx, %r15 ; \ - adoxq %rbx, %r15 ; \ - movabsq $0x1000003d1, %rdx ; \ - xorl %ebx, %ebx ; \ - mulxq %r12, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq %r13, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq %r14, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - adcxq %rbx, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - mulxq %rax, %rax, %rcx ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rdx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Rough versions producing 5-word results - -#define roughmul_p256k1(P0,P1,P2) \ - xorl %ecx, %ecx ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rcx, %r12 ; \ - xorl %ecx, %ecx ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rcx, %r13 ; \ - xorl %ecx, %ecx ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcxq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rcx, %r15 ; \ - adcxq %rcx, %r15 ; \ - movabsq $0x1000003d1, %rdx ; \ - xorl %ecx, %ecx ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - adcxq %rcx, %r12 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 ; \ - movq %r12, 0x20+P0 - -#define roughsqr_p256k1(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ebx, %ebx ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rbx, %r13 ; \ - adoxq %rbx, %r14 ; \ - adcq %rbx, %r14 ; \ - xorl %ebx, %ebx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rbx, %r15 ; \ - adoxq %rbx, %r15 ; \ - movabsq $0x1000003d1, %rdx ; \ - xorl %ebx, %ebx ; \ - mulxq %r12, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq %r13, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq %r14, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - adcxq %rbx, %r12 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 ; \ - movq %r12, 0x20+P0 - -// Weak doubling operation, staying in 4 digits but not in general -// fully normalizing - -#define weakdouble_p256k1(P0,P1) \ - movq 24+P1, %r11 ; \ - movq 16+P1, %r10 ; \ - movq $0x1000003d1, %rax ; \ - xorq %rdx, %rdx ; \ - shldq $1, %r10, %r11 ; \ - cmovncq %rdx, %rax ; \ - movq 8+P1, %r9 ; \ - shldq $1, %r9, %r10 ; \ - movq P1, %r8 ; \ - shldq $1, %r8, %r9 ; \ - shlq $1, %r8 ; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq %rdx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %r11, 24+P0 - -// P0 = C * P1 - D * P2 with 5-word inputs P1 and P2 -// Only used here with C = 12, D = 9, but could be used more generally. -// We actually compute C * P1 + D * (2^33 * p_256k1 - P2) - -#define cmsub_p256k1(P0,C,P1,D,P2) \ - movq $0xfffff85e00000000, %r8 ; \ - subq P2, %r8 ; \ - movq $0xfffffffffffffffd, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq $0xffffffffffffffff, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq $0xffffffffffffffff, %r11 ; \ - sbbq 24+P2, %r11 ; \ - movq $0x00000001ffffffff, %r12 ; \ - sbbq 32+P2, %r12 ; \ - movq $D, %rdx ; \ - mulxq %r8, %r8, %rax ; \ - mulxq %r9, %r9, %rcx ; \ - addq %rax, %r9 ; \ - mulxq %r10, %r10, %rax ; \ - adcq %rcx, %r10 ; \ - mulxq %r11, %r11, %rcx ; \ - adcq %rax, %r11 ; \ - mulxq %r12, %r12, %rax ; \ - adcq %rcx, %r12 ; \ - movq $C, %rdx ; \ - xorq %rbx, %rbx ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq 8+P1, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq 16+P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 24+P1, %rax, %rcx ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - mulxq 32+P1, %rax, %rcx ; \ - adcxq %rax, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movq $0x1000003d1, %rcx ; \ - mulq %rcx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - cmovbq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - movq %r8, P0 ; \ - sbbq %rbx, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq %rbx, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq %rbx, %r11 ; \ - movq %r11, 24+P0 ; \ - -// P0 = 3 * P1 - 8 * P2 with 5-digit P1 and P2 -// We actually compute 3 * P1 + (2^33 * p_256k1 - P2) << 3 - -#define cmsub38_p256k1(P0,P1,P2) \ - movq $0xfffff85e00000000, %r8 ; \ - subq P2, %r8 ; \ - movq $0xfffffffffffffffd, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq $0xffffffffffffffff, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq $0xffffffffffffffff, %r11 ; \ - sbbq 24+P2, %r11 ; \ - movq $0x00000001ffffffff, %r12 ; \ - sbbq 32+P2, %r12 ; \ - shldq $3, %r11, %r12 ; \ - shldq $3, %r10, %r11 ; \ - shldq $3, %r9, %r10 ; \ - shldq $3, %r8, %r9 ; \ - shlq $3, %r8 ; \ - movq $3, %rdx ; \ - xorq %rbx, %rbx ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq 8+P1, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq 16+P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 24+P1, %rax, %rcx ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - mulxq 32+P1, %rax, %rcx ; \ - adcxq %rax, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movq $0x1000003d1, %rcx ; \ - mulq %rcx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - cmovbq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - movq %r8, P0 ; \ - sbbq %rbx, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq %rbx, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq %rbx, %r11 ; \ - movq %r11, 24+P0 ; \ - -// P0 = 4 * P1 - P2 with 5-digit P1, 4-digit P2 and result. -// This is done by direct subtraction of P2 since the method -// in bignum_cmul_p256k1 etc. for quotient estimation still -// works when the value to be reduced is negative, as -// long as it is > -p_256k1, which is the case here. - -#define cmsub41_p256k1(P0,P1,P2) \ - movq 32+P1, %r12 ; \ - movq 24+P1, %r11 ; \ - shldq $2, %r11, %r12 ; \ - movq 16+P1, %r10 ; \ - shldq $2, %r10, %r11 ; \ - movq 8+P1, %r9 ; \ - shldq $2, %r9, %r10 ; \ - movq P1, %r8 ; \ - shldq $2, %r8, %r9 ; \ - shlq $2, %r8 ; \ - subq P2, %r8 ; \ - sbbq 8+P2, %r9 ; \ - sbbq 16+P2, %r10 ; \ - sbbq 24+P2, %r11 ; \ - sbbq $0, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movq $0x1000003d1, %rcx ; \ - mulq %rcx; \ - xorq %rbx, %rbx ; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - adcq $0x0, %r11 ; \ - cmovbq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - movq %r8, P0 ; \ - sbbq %rbx, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq %rbx, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq %rbx, %r11 ; \ - movq %r11, 24+P0 ; \ - -S2N_BN_SYMBOL(secp256k1_jdouble): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers and make room on stack for temporary variables - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main sequence of operations - - // y_2 = y^2 - - sqr_p256k1(y_2,y_1) - - // x_2 = x^2 - - sqr_p256k1(x_2,x_1) - - // tmp = 2 * y_1 (in 4 words but not fully normalized) - - weakdouble_p256k1(tmp,y_1) - - // xy2 = x * y^2 (5-digit partially reduced) - // x_4 = x^4 (5-digit partially reduced) - - roughmul_p256k1(xy2,x_1,y_2) - roughsqr_p256k1(x_4,x_2) - - // z_3 = 2 * y_1 * z_1 - - mul_p256k1(z_3,z_1,tmp) - - // d = 12 * xy2 - 9 * x_4 - - cmsub_p256k1(d,12,xy2,9,x_4) - - // y4 = y2^2 (5-digit partially reduced) - - roughsqr_p256k1(y_4,y_2) - - // dx2 = d * x_2 (5-digit partially reduced) - - roughmul_p256k1(dx2,x_2,d) - - // x_3 = 4 * xy2 - d - - cmsub41_p256k1(x_3,xy2,d) - - // y_3 = 3 * dx2 - 8 * y_4 - - cmsub38_p256k1(y_3,dx2,y_4) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(secp256k1_jdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jdouble_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jdouble_alt.S deleted file mode 100644 index 9e32b0c4555..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jdouble_alt.S +++ /dev/null @@ -1,817 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on SECG curve secp256k1 in Jacobian coordinates -// -// extern void secp256k1_jdouble_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// It is assumed that all coordinates of the input point are fully -// reduced mod p_256k1 and that the z coordinate is not zero. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1 -// Microsoft x64 ABI: RCX = p3, RDX = p1 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(secp256k1_jdouble_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(secp256k1_jdouble_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(secp256k1_jdouble_alt) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1, which is true when the -// arguments come in initially and is not disturbed throughout. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define x_2 (NUMSIZE*0)(%rsp) -#define y_2 (NUMSIZE*1)(%rsp) -#define d (NUMSIZE*2)(%rsp) -#define tmp (NUMSIZE*3)(%rsp) -#define x_4 (NUMSIZE*4)(%rsp) -#define y_4 (NUMSIZE*6)(%rsp) -#define dx2 (NUMSIZE*8)(%rsp) -#define xy2 (NUMSIZE*10)(%rsp) - -#define NSPACE NUMSIZE*12 - -// Corresponds to bignum_mul_p256k1_alt except %rsi -> %rbx - -#define mul_p256k1(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movq $0x1000003d1, %rbx ; \ - movq %r12, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rbx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Corresponds to bignum_sqr_p256k1_alt except for %rsi -> %rbx - -#define sqr_p256k1(P0,P1) \ - movq P1, %rax ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r11 ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r12 ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r14 ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r15 ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movq $0x1000003d1, %rbx ; \ - movq %r12, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rbx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Rough versions producing 5-word results - -#define roughmul_p256k1(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movq $0x1000003d1, %rbx ; \ - movq %r12, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 ; \ - movq %r12, 0x20+P0 - -#define roughsqr_p256k1(P0,P1) \ - movq P1, %rax ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r11 ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r12 ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r14 ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r15 ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movq $0x1000003d1, %rbx ; \ - movq %r12, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 ; \ - movq %r12, 0x20+P0 - -// Weak doubling operation, staying in 4 digits but not in general -// fully normalizing - -#define weakdouble_p256k1(P0,P1) \ - movq 24+P1, %r11 ; \ - movq 16+P1, %r10 ; \ - movq $0x1000003d1, %rax ; \ - xorq %rdx, %rdx ; \ - shldq $1, %r10, %r11 ; \ - cmovncq %rdx, %rax ; \ - movq 8+P1, %r9 ; \ - shldq $1, %r9, %r10 ; \ - movq P1, %r8 ; \ - shldq $1, %r8, %r9 ; \ - shlq $1, %r8 ; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq %rdx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 8+P0 ; \ - movq %r10, 16+P0 ; \ - movq %r11, 24+P0 - -// P0 = C * P1 - D * P2 with 5-word inputs P1 and P2 -// Only used here with C = 12, D = 9, but could be used more generally. -// We actually compute C * P1 + D * (2^33 * p_256k1 - P2) - -#define cmsub_p256k1(P0,C,P1,D,P2) \ - movq $0xfffff85e00000000, %r9 ; \ - subq P2, %r9 ; \ - movq $0xfffffffffffffffd, %r10 ; \ - sbbq 8+P2, %r10 ; \ - movq $0xffffffffffffffff, %r11 ; \ - sbbq 16+P2, %r11 ; \ - movq $0xffffffffffffffff, %r12 ; \ - sbbq 24+P2, %r12 ; \ - movq $0x00000001ffffffff, %r13 ; \ - sbbq 32+P2, %r13 ; \ - movq $D, %rcx ; \ - movq %r9, %rax ; \ - mulq %rcx; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - movq %r10, %rax ; \ - xorl %r10d, %r10d ; \ - mulq %rcx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq %r11, %rax ; \ - xorl %r11d, %r11d ; \ - mulq %rcx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - movq %r12, %rax ; \ - xorl %r12d, %r12d ; \ - mulq %rcx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - imulq %r13, %rcx ; \ - addq %rcx, %r12 ; \ - movq $C, %rcx ; \ - movq P1, %rax ; \ - mulq %rcx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rbx, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rbx, %rbx ; \ - movq 0x10+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rbx, %rbx ; \ - movq 0x18+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - movq 0x20+P1, %rax ; \ - mulq %rcx; \ - addq %rax, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movq $0x1000003d1, %rcx ; \ - mulq %rcx; \ - xorl %ebx, %ebx ; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - cmovbq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - movq %r8, P0 ; \ - sbbq %rbx, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq %rbx, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq %rbx, %r11 ; \ - movq %r11, 24+P0 ; \ - -// P0 = 3 * P1 - 8 * P2 with 5-digit P1 and P2 -// We actually compute 3 * P1 + (2^33 * p_256k1 - P2) << 3 - -#define cmsub38_p256k1(P0,P1,P2) \ - movq $0xfffff85e00000000, %r8 ; \ - subq P2, %r8 ; \ - movq $0xfffffffffffffffd, %r9 ; \ - sbbq 8+P2, %r9 ; \ - movq $0xffffffffffffffff, %r10 ; \ - sbbq 16+P2, %r10 ; \ - movq $0xffffffffffffffff, %r11 ; \ - sbbq 24+P2, %r11 ; \ - movq $0x00000001ffffffff, %r12 ; \ - sbbq 32+P2, %r12 ; \ - shldq $3, %r11, %r12 ; \ - shldq $3, %r10, %r11 ; \ - shldq $3, %r9, %r10 ; \ - shldq $3, %r8, %r9 ; \ - shlq $3, %r8 ; \ - movl $3, %ecx ; \ - movq P1, %rax ; \ - mulq %rcx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rbx, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rbx, %rbx ; \ - movq 0x10+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rbx, %rbx ; \ - movq 0x18+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - movq 0x20+P1, %rax ; \ - mulq %rcx; \ - addq %rax, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movq $0x1000003d1, %rcx ; \ - mulq %rcx; \ - xorl %ebx, %ebx ; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - cmovbq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - movq %r8, P0 ; \ - sbbq %rbx, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq %rbx, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq %rbx, %r11 ; \ - movq %r11, 24+P0 ; \ - -// P0 = 4 * P1 - P2 with 5-digit P1, 4-digit P2 and result. -// This is done by direct subtraction of P2 since the method -// in bignum_cmul_p256k1 etc. for quotient estimation still -// works when the value to be reduced is negative, as -// long as it is > -p_256k1, which is the case here. - -#define cmsub41_p256k1(P0,P1,P2) \ - movq 32+P1, %r12 ; \ - movq 24+P1, %r11 ; \ - shldq $2, %r11, %r12 ; \ - movq 16+P1, %r10 ; \ - shldq $2, %r10, %r11 ; \ - movq 8+P1, %r9 ; \ - shldq $2, %r9, %r10 ; \ - movq P1, %r8 ; \ - shldq $2, %r8, %r9 ; \ - shlq $2, %r8 ; \ - subq P2, %r8 ; \ - sbbq 8+P2, %r9 ; \ - sbbq 16+P2, %r10 ; \ - sbbq 24+P2, %r11 ; \ - sbbq $0, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - movq $0x1000003d1, %rcx ; \ - mulq %rcx; \ - xorq %rbx, %rbx ; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq $0x0, %r10 ; \ - adcq $0x0, %r11 ; \ - cmovbq %rbx, %rcx ; \ - subq %rcx, %r8 ; \ - movq %r8, P0 ; \ - sbbq %rbx, %r9 ; \ - movq %r9, 8+P0 ; \ - sbbq %rbx, %r10 ; \ - movq %r10, 16+P0 ; \ - sbbq %rbx, %r11 ; \ - movq %r11, 24+P0 ; \ - -S2N_BN_SYMBOL(secp256k1_jdouble_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers and make room on stack for temporary variables - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main sequence of operations - - // y_2 = y^2 - - sqr_p256k1(y_2,y_1) - - // x_2 = x^2 - - sqr_p256k1(x_2,x_1) - - // tmp = 2 * y_1 (in 4 words but not fully normalized) - - weakdouble_p256k1(tmp,y_1) - - // xy2 = x * y^2 (5-digit partially reduced) - // x_4 = x^4 (5-digit partially reduced) - - roughmul_p256k1(xy2,x_1,y_2) - roughsqr_p256k1(x_4,x_2) - - // z_3 = 2 * y_1 * z_1 - - mul_p256k1(z_3,z_1,tmp) - - // d = 12 * xy2 - 9 * x_4 - - cmsub_p256k1(d,12,xy2,9,x_4) - - // y4 = y2^2 (5-digit partially reduced) - - roughsqr_p256k1(y_4,y_2) - - // dx2 = d * x_2 (5-digit partially reduced) - - roughmul_p256k1(dx2,x_2,d) - - // x_3 = 4 * xy2 - d - - cmsub41_p256k1(x_3,xy2,d) - - // y_3 = 3 * dx2 - 8 * y_4 - - cmsub38_p256k1(y_3,dx2,y_4) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(secp256k1_jdouble_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jmixadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jmixadd.S deleted file mode 100644 index e58f67d846e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jmixadd.S +++ /dev/null @@ -1,402 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on SECG curve secp256k1 in Jacobian coordinates -// -// extern void secp256k1_jmixadd(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 8]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. It is assumed that -// all the coordinates of the input points p1 and p2 are fully reduced -// mod p_256k1, that the z coordinate of p1 is nonzero and that neither -// p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents the same affine -// point as". -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(secp256k1_jmixadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(secp256k1_jmixadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(secp256k1_jmixadd) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rbp = p2, -// all of which are maintained throughout the code. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rbp) -#define y_2 NUMSIZE(%rbp) -#define z_2 (2*NUMSIZE)(%rbp) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define zp2 (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define NSPACE NUMSIZE*6 - -// Corresponds exactly to bignum_mul_p256k1 - -#define mul_p256k1(P0,P1,P2) \ - xorl %ecx, %ecx ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rcx, %r12 ; \ - xorl %ecx, %ecx ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rcx, %r13 ; \ - xorl %ecx, %ecx ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcxq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rcx, %r15 ; \ - adcxq %rcx, %r15 ; \ - movabs $0x1000003d1, %rdx ; \ - xorl %ecx, %ecx ; \ - mulxq %r12, %rax, %rbx ; \ - adcxq %rax, %r8 ; \ - adoxq %rbx, %r9 ; \ - mulxq %r13, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq %r14, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - adcxq %rcx, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - mulxq %rax, %rax, %rbx ; \ - addq %rax, %r8 ; \ - adcq %rbx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - cmovbq %rcx, %rdx ; \ - subq %rdx, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Corresponds exactly to bignum_sqr_p256k1 - -#define sqr_p256k1(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ebx, %ebx ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r11 ; \ - adoxq %rcx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rbx, %r13 ; \ - adoxq %rbx, %r14 ; \ - adcq %rbx, %r14 ; \ - xorl %ebx, %ebx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rbx, %r15 ; \ - adoxq %rbx, %r15 ; \ - movabs $0x1000003d1, %rdx ; \ - xorl %ebx, %ebx ; \ - mulxq %r12, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq %r13, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq %r14, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq %r15, %rax, %r12 ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - adcxq %rbx, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - mulxq %rax, %rax, %rcx ; \ - addq %rax, %r8 ; \ - adcq %rcx, %r9 ; \ - adcq %rbx, %r10 ; \ - adcq %rbx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rdx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rbx, %r9 ; \ - sbbq %rbx, %r10 ; \ - sbbq %rbx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Corresponds exactly to bignum_sub_p256k1 - -#define sub_p256k1(P0,P1,P2) \ - xorl %eax, %eax ; \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 0x8+P1, %r9 ; \ - sbbq 0x8+P2, %r9 ; \ - movq 0x10+P1, %r10 ; \ - sbbq 0x10+P2, %r10 ; \ - movq 0x18+P1, %r11 ; \ - sbbq 0x18+P2, %r11 ; \ - movabs $0x1000003d1, %rcx ; \ - cmovae %rax, %rcx ; \ - subq %rcx, %r8 ; \ - movq %r8, P0 ; \ - sbbq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - sbbq %rax, %r10 ; \ - movq %r10, 0x10+P0 ; \ - sbbq %rax, %r11 ; \ - movq %r11, 0x18+P0 - -// Additional macros to help with final multiplexing - -#define testzero4(P) \ - movq P, %rax ; \ - movq 8+P, %rdx ; \ - orq 16+P, %rax ; \ - orq 24+P, %rdx ; \ - orq %rdx, %rax - -#define mux4(r0,r1,r2,r3,PNE,PEQ) \ - movq PNE, r0 ; \ - movq PEQ, %rax ; \ - cmovzq %rax, r0 ; \ - movq 8+PNE, r1 ; \ - movq 8+PEQ, %rax ; \ - cmovzq %rax, r1 ; \ - movq 16+PNE, r2 ; \ - movq 16+PEQ, %rax ; \ - cmovzq %rax, r2 ; \ - movq 24+PNE, r3 ; \ - movq 24+PEQ, %rax ; \ - cmovzq %rax, r3 - -#define load4(r0,r1,r2,r3,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 - -#define store4(P,r0,r1,r2,r3) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P - -S2N_BN_SYMBOL(secp256k1_jmixadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input y in %rbp where it stays - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdx, %rbp - -// Main code, just a sequence of basic field operations - - sqr_p256k1(zp2,z_1) - - mul_p256k1(y2a,z_1,y_2) - mul_p256k1(x2a,zp2,x_2) - mul_p256k1(y2a,zp2,y2a) - - sub_p256k1(xd,x2a,x_1) - - sub_p256k1(yd,y2a,y_1) - - sqr_p256k1(zz,xd) - sqr_p256k1(ww,yd) - - mul_p256k1(zzx1,zz,x_1) - mul_p256k1(zzx2,zz,x2a) - - sub_p256k1(resx,ww,zzx1) - sub_p256k1(t1,zzx2,zzx1) - - mul_p256k1(resz,xd,z_1) - - sub_p256k1(resx,resx,zzx2) - - sub_p256k1(t2,zzx1,resx) - - mul_p256k1(t1,t1,y_1) - mul_p256k1(t2,yd,t2) - - sub_p256k1(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - testzero4(z_1) - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with an extra z = 1 -// coordinate, hence giving 0 + p2 = p2 for the final result. - - mux4(%r8,%r9,%r10,%r11,resx,x_2) - mux4(%r12,%r13,%r14,%r15,resy,y_2) - - store4(x_3,%r8,%r9,%r10,%r11) - store4(y_3,%r12,%r13,%r14,%r15) - - load4(%r8,%r9,%r10,%r11,resz) - movl $1, %eax - cmovzq %rax, %r8 - movl $0, %eax - cmovzq %rax, %r9 - cmovzq %rax, %r10 - cmovzq %rax, %r11 - - store4(z_3,%r8,%r9,%r10,%r11) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(secp256k1_jmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jmixadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jmixadd_alt.S deleted file mode 100644 index ea9dfadef2a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/secp256k1/secp256k1_jmixadd_alt.S +++ /dev/null @@ -1,483 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on SECG curve secp256k1 in Jacobian coordinates -// -// extern void secp256k1_jmixadd_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 8]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples. -// A Jacobian triple (x,y,z) represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. It is assumed that -// all the coordinates of the input points p1 and p2 are fully reduced -// mod p_256k1, that the z coordinate of p1 is nonzero and that neither -// p1 =~= p2 or p1 =~= -p2, where "=~=" means "represents the same affine -// point as". -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(secp256k1_jmixadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(secp256k1_jmixadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(secp256k1_jmixadd_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rbp = p2, -// all of which are maintained throughout the code. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rbp) -#define y_2 NUMSIZE(%rbp) -#define z_2 (2*NUMSIZE)(%rbp) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define zp2 (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define NSPACE NUMSIZE*6 - -// Corresponds to bignum_mul_p256k1_alt except %rsi -> %rbx - -#define mul_p256k1(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movq $0x1000003d1, %rbx ; \ - movq %r12, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rbx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Corresponds to bignum_sqr_p256k1_alt except for %rsi -> %rbx - -#define sqr_p256k1(P0,P1) \ - movq P1, %rax ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r11 ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq $0x0, %r11 ; \ - xorq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r12 ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r13 ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r14 ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P1; \ - addq %rax, %rax ; \ - adcq %rdx, %rdx ; \ - adcq $0x0, %r15 ; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movq $0x1000003d1, %rbx ; \ - movq %r12, %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rcx, %rcx ; \ - movq %r13, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rcx, %rcx ; \ - movq %r14, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq %r15, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - xorq %rcx, %rcx ; \ - addq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - adcq %rcx, %r12 ; \ - leaq 0x1(%r12), %rax ; \ - mulq %rbx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - adcq %rcx, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rax, %rax ; \ - notq %rax; \ - andq %rbx, %rax ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rcx, %r11 ; \ - movq %r8, P0 ; \ - movq %r9, 0x8+P0 ; \ - movq %r10, 0x10+P0 ; \ - movq %r11, 0x18+P0 - -// Corresponds exactly to bignum_sub_p256k1 - -#define sub_p256k1(P0,P1,P2) \ - xorl %eax, %eax ; \ - movq P1, %r8 ; \ - subq P2, %r8 ; \ - movq 0x8+P1, %r9 ; \ - sbbq 0x8+P2, %r9 ; \ - movq 0x10+P1, %r10 ; \ - sbbq 0x10+P2, %r10 ; \ - movq 0x18+P1, %r11 ; \ - sbbq 0x18+P2, %r11 ; \ - movabs $0x1000003d1, %rcx ; \ - cmovae %rax, %rcx ; \ - subq %rcx, %r8 ; \ - movq %r8, P0 ; \ - sbbq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - sbbq %rax, %r10 ; \ - movq %r10, 0x10+P0 ; \ - sbbq %rax, %r11 ; \ - movq %r11, 0x18+P0 - -// Additional macros to help with final multiplexing - -#define testzero4(P) \ - movq P, %rax ; \ - movq 8+P, %rdx ; \ - orq 16+P, %rax ; \ - orq 24+P, %rdx ; \ - orq %rdx, %rax - -#define mux4(r0,r1,r2,r3,PNE,PEQ) \ - movq PNE, r0 ; \ - movq PEQ, %rax ; \ - cmovzq %rax, r0 ; \ - movq 8+PNE, r1 ; \ - movq 8+PEQ, %rax ; \ - cmovzq %rax, r1 ; \ - movq 16+PNE, r2 ; \ - movq 16+PEQ, %rax ; \ - cmovzq %rax, r2 ; \ - movq 24+PNE, r3 ; \ - movq 24+PEQ, %rax ; \ - cmovzq %rax, r3 - -#define load4(r0,r1,r2,r3,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 - -#define store4(P,r0,r1,r2,r3) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P - -S2N_BN_SYMBOL(secp256k1_jmixadd_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input y in %rbp where it stays - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdx, %rbp - -// Main code, just a sequence of basic field operations - - sqr_p256k1(zp2,z_1) - - mul_p256k1(y2a,z_1,y_2) - mul_p256k1(x2a,zp2,x_2) - mul_p256k1(y2a,zp2,y2a) - - sub_p256k1(xd,x2a,x_1) - - sub_p256k1(yd,y2a,y_1) - - sqr_p256k1(zz,xd) - sqr_p256k1(ww,yd) - - mul_p256k1(zzx1,zz,x_1) - mul_p256k1(zzx2,zz,x2a) - - sub_p256k1(resx,ww,zzx1) - sub_p256k1(t1,zzx2,zzx1) - - mul_p256k1(resz,xd,z_1) - - sub_p256k1(resx,resx,zzx2) - - sub_p256k1(t2,zzx1,resx) - - mul_p256k1(t1,t1,y_1) - mul_p256k1(t2,yd,t2) - - sub_p256k1(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - testzero4(z_1) - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with an extra z = 1 -// coordinate, hence giving 0 + p2 = p2 for the final result. - - mux4(%r8,%r9,%r10,%r11,resx,x_2) - mux4(%r12,%r13,%r14,%r15,resy,y_2) - - store4(x_3,%r8,%r9,%r10,%r11) - store4(y_3,%r12,%r13,%r14,%r15) - - load4(%r8,%r9,%r10,%r11,resz) - movl $1, %eax - cmovzq %rax, %r8 - movl $0, %eax - cmovzq %rax, %r9 - cmovzq %rax, %r10 - cmovzq %rax, %r11 - - store4(z_3,%r8,%r9,%r10,%r11) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(secp256k1_jmixadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_add_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_add_sm2.S deleted file mode 100644 index 440711bab05..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_add_sm2.S +++ /dev/null @@ -1,104 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Add modulo p_sm2, z := (x + y) mod p_sm2, assuming x and y reduced -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_add_sm2(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_add_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_add_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_add_sm2) - .text - -#define z %rdi -#define x %rsi -#define y %rdx - -#define d0 %rax -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n1 %r10 -#define n3 %rdx -#define c %r11 - -#define n1short %r10d - - - -S2N_BN_SYMBOL(bignum_add_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Load and add the two inputs as 2^256 * c + [d3;d2;d1;d0] = x + y - - xorq c, c - movq (x), d0 - addq (y), d0 - movq 8(x), d1 - adcq 8(y), d1 - movq 16(x), d2 - adcq 16(y), d2 - movq 24(x), d3 - adcq 24(y), d3 - adcq c, c - -// Now subtract 2^256 * c + [d3;d3;d1;d1] = x + y - p_sm2 -// The constants n1 and n3 in [n3; 0; n1; -1] = p_sm2 are saved for later - - subq $-1, d0 - movq $0xffffffff00000000, n1 - sbbq n1, d1 - sbbq $-1, d2 - movq $0xfffffffeffffffff, n3 - sbbq n3, d3 - -// Since by hypothesis x < p_sm2 we know x + y - p_sm2 < 2^256, so the top -// carry c actually gives us a bitmask for x + y - p_sm2 < 0, which we -// now use to make a masked p_sm2' = [n3; 0; n1; c] - - sbbq $0, c - andq c, n1 - andq c, n3 - -// Do the corrective addition and copy to output - - addq c, d0 - movq d0, (z) - adcq n1, d1 - movq d1, 8(z) - adcq c, d2 - movq d2, 16(z) - adcq n3, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_add_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_cmul_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_cmul_sm2.S deleted file mode 100644 index 70a15ad8a98..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_cmul_sm2.S +++ /dev/null @@ -1,137 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_sm2, z := (c * x) mod p_sm2, assuming -// x reduced -// Inputs c, x[4]; output z[4] -// -// extern void bignum_cmul_sm2(uint64_t z[static 4], uint64_t c, -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = c, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = c, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_sm2) - .text - -#define z %rdi - -// Temporarily moved here for initial multiply -#define x %rcx -// Likewise this is thrown away after initial multiply -#define m %rdx - -#define a %rax -#define c %rcx - -#define d0 %rsi -#define d1 %r8 -#define d2 %r9 -#define d3 %r10 -#define h %r11 - -// Multiplier again for second stage -#define q %rdx -#define qshort %edx - -S2N_BN_SYMBOL(bignum_cmul_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Shuffle inputs (since we want multiplier in %rdx) - - movq %rdx, x - movq %rsi, m - -// Multiply, accumulating the result as ca = 2^256 * h + [d3;d2;d1;d0] - - mulxq (x), d0, d1 - mulxq 8(x), a, d2 - addq a, d1 - mulxq 16(x), a, d3 - adcq a, d2 - mulxq 24(x), a, h - adcq a, d3 - adcq $0, h - -// Quotient approximation is (h * (1 + 2^32 + 2^64) + d3 + 2^64) >> 64. -// Note that by hypothesis our product is <= (2^64 - 1) * (p_sm2 - 1), -// so there is no need to max this out to avoid wrapping, unlike in the -// more general case of bignum_mod_sm2. - - movq d3, a - movl $1, qshort - addq h, a - adcq h, q - - shrq $32, a - addq h, a - - shrq $32, a - addq a, q - -// Now compute the initial pre-reduced [h;d3;d2;d1;d0] = ca - p_sm2 * q -// = ca - (2^256 - 2^224 - 2^96 + 2^64 - 1) * q - - movq q, a - movq q, c - shlq $32, a - shrq $32, c - - addq a, d3 - adcq c, h - - subq q, a - sbbq $0, c - - subq q, h - - addq q, d0 - adcq a, d1 - adcq c, d2 - adcq $0, d3 - adcq $0, h - -// Now our top word h is either zero or all 1s, and we use this to discriminate -// whether a correction is needed because our result is negative, as a bitmask -// Do a masked addition of p_sm2 - - movq $0xffffffff00000000, a - andq h, a - movq $0xfffffffeffffffff, c - andq h, c - addq h, d0 - movq d0, (z) - adcq a, d1 - movq d1, 8(z) - adcq h, d2 - movq d2, 16(z) - adcq c, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_cmul_sm2_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_cmul_sm2_alt.S deleted file mode 100644 index 4cf707f6bc7..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_cmul_sm2_alt.S +++ /dev/null @@ -1,154 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Multiply by a single word modulo p_sm2, z := (c * x) mod p_sm2, assuming -// x reduced -// Inputs c, x[4]; output z[4] -// -// extern void bignum_cmul_sm2_alt(uint64_t z[static 4], uint64_t c, -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = c, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = c, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_cmul_sm2_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_cmul_sm2_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_cmul_sm2_alt) - .text - -#define z %rdi - -// Temporarily moved here for initial multiply then thrown away - -#define x %rcx -#define m %rsi - -// Other variables - -#define d %rdx -#define a %rax -#define c %rcx - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 -#define h %rsi - -#define hshort %esi - -// Multiplier again for second stage -#define q %rdx -#define qshort %edx - -S2N_BN_SYMBOL(bignum_cmul_sm2_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Shuffle inputs (since we want %rdx for the high parts of products) - - movq %rdx, x - -// Multiply, accumulating the result as ca = 2^256 * h + [d3;d2;d1;d0] - - movq (x), a - mulq m - movq a, d0 - movq d, d1 - - movq 8(x), a - mulq m - xorq d2, d2 - addq a, d1 - adcq d, d2 - - movq 16(x), a - mulq m - xorq d3, d3 - addq a, d2 - adcq d, d3 - - movq 24(x), a - mulq m - xorl hshort, hshort - addq a, d3 - adcq d, h - -// Quotient approximation is (h * (1 + 2^32 + 2^64) + d3 + 2^64) >> 64. -// Note that by hypothesis our product is <= (2^64 - 1) * (p_sm2 - 1), -// so there is no need to max this out to avoid wrapping, unlike in the -// more general case of bignum_mod_sm2. - - movq d3, a - movl $1, qshort - addq h, a - adcq h, q - - shrq $32, a - addq h, a - shrq $32, a - addq a, q - -// Now compute the initial pre-reduced [h;d3;d2;d1;d0] = ca - p_sm2 * q -// = ca - (2^256 - 2^224 - 2^96 + 2^64 - 1) * q - - movq q, a - movq q, c - shlq $32, a - shrq $32, c - - addq a, d3 - adcq c, h - - subq q, a - sbbq $0, c - - subq q, h - - addq q, d0 - adcq a, d1 - adcq c, d2 - adcq $0, d3 - adcq $0, h - -// Now our top word h is either zero or all 1s, and we use this to discriminate -// whether a correction is needed because our result is negative, as a bitmask -// Do a masked addition of p_sm2 - - movq $0xffffffff00000000, a - andq h, a - movq $0xfffffffeffffffff, c - andq h, c - addq h, d0 - movq d0, (z) - adcq a, d1 - movq d1, 8(z) - adcq h, d2 - movq d2, 16(z) - adcq c, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_cmul_sm2_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_deamont_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_deamont_sm2.S deleted file mode 100644 index 1946337ee2f..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_deamont_sm2.S +++ /dev/null @@ -1,123 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from almost-Montgomery form, z := (x / 2^256) mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_deamont_sm2(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Convert a 4-digit bignum x out of its (optionally almost) Montgomery form, -// "almost" meaning any 4-digit input will work, with no range restriction. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_deamont_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_deamont_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_deamont_sm2) - .text - -#define z %rdi -#define x %rsi - -#define c %rcx -#define n1 %rax -#define n3 %rdx - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d0;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1], and using %rax, %rcx, %rdx and %rsi -// as temporaries. -// --------------------------------------------------------------------------- - -#define montreds(d3,d2,d1,d0) \ - movq d0, %rax ; \ - shlq $32, %rax ; \ - movq d0, %rcx ; \ - shrq $32, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rsi ; \ - subq d0, %rax ; \ - sbbq $0, %rcx ; \ - subq %rax, d1 ; \ - sbbq %rcx, d2 ; \ - sbbq %rdx, d3 ; \ - sbbq %rsi, d0 - -S2N_BN_SYMBOL(bignum_deamont_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Set up an initial 4-word window [%r11,%r10,%r9,%r8] = x - - movq (x), %r8 - movq 8(x), %r9 - movq 16(x), %r10 - movq 24(x), %r11 - -// Systematically scroll left doing 1-step reductions. This process -// keeps things inside 4 digits (i.e. < 2^256) at each stage, since -// we have w * p_sm2 + x <= (2^64 - 1) * p_sm2 + (2 EXP 256 - 1) -// <= (2^64 - 1) * (2^256 - 1) + (2 EXP 256 - 1) <= 2^64 * (2^256 - 1) - - montreds(%r11,%r10,%r9,%r8) - - montreds(%r8,%r11,%r10,%r9) - - montreds(%r9,%r8,%r11,%r10) - - montreds(%r10,%r9,%r8,%r11) - -// Let [%r11;%r10;%r9;%r8] := [%r11;%r10;%r9;%r8] - p_sm2, saving constants -// n1 and n3 in [n3; -1; n1; -1] = p_sm2 for later use. - - subq $-1, %r8 - movq $0xffffffff00000000, n1 - sbbq n1, %r9 - sbbq $-1, %r10 - movq $0xfffffffeffffffff, n3 - sbbq n3, %r11 - -// Capture the carry to determine whether to add back p_sm2, and use -// it to create a masked p_sm2' = [n3; c; n1; c] - - sbbq c, c - andq c, n1 - andq c, n3 - -// Do the corrective addition and copy to output - - addq c, %r8 - movq %r8, (z) - adcq n1, %r9 - movq %r9, 8(z) - adcq c, %r10 - movq %r10, 16(z) - adcq n3, %r11 - movq %r11, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_deamont_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_demont_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_demont_sm2.S deleted file mode 100644 index 25596e6816c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_demont_sm2.S +++ /dev/null @@ -1,96 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert from Montgomery form z := (x / 2^256) mod p_sm2, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_demont_sm2(uint64_t z[static 4], const uint64_t x[static 4]); -// -// This assumes the input is < p_sm2 for correctness. If this is not the case, -// use the variant "bignum_deamont_sm2" instead. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_demont_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_demont_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_demont_sm2) - .text - -#define z %rdi -#define x %rsi - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d0;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1], and using %rax, %rcx, %rdx and %rsi -// as temporaries. -// --------------------------------------------------------------------------- - -#define montreds(d3,d2,d1,d0) \ - movq d0, %rax ; \ - shlq $32, %rax ; \ - movq d0, %rcx ; \ - shrq $32, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rsi ; \ - subq d0, %rax ; \ - sbbq $0, %rcx ; \ - subq %rax, d1 ; \ - sbbq %rcx, d2 ; \ - sbbq %rdx, d3 ; \ - sbbq %rsi, d0 - -S2N_BN_SYMBOL(bignum_demont_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Set up an initial 4-word window [%r11,%r10,%r9,%r8] = x - - movq (x), %r8 - movq 8(x), %r9 - movq 16(x), %r10 - movq 24(x), %r11 - -// Systematically scroll left doing 1-step reductions. This process -// keeps things reduced < p_sm2 at each stage, since we have -// w * p_sm2 + x <= (2^64 - 1) * p_sm2 + (p_sm2 - 1) < 2^64 * p_sm2 - - montreds(%r11,%r10,%r9,%r8) - - montreds(%r8,%r11,%r10,%r9) - - montreds(%r9,%r8,%r11,%r10) - - montreds(%r10,%r9,%r8,%r11) - -// Write back result - - movq %r8, (z) - movq %r9, 8(z) - movq %r10, 16(z) - movq %r11, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_demont_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_double_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_double_sm2.S deleted file mode 100644 index 9695479b775..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_double_sm2.S +++ /dev/null @@ -1,100 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Double modulo p_sm2, z := (2 * x) mod p_sm2, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_double_sm2(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_double_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_double_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_double_sm2) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n1 %r10 -#define n3 %r11 -#define c %rax - -#define n1short %r10d - -S2N_BN_SYMBOL(bignum_double_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the input and double it so that 2^256 * c + [d3;d2;d1;d0] = 2 * x -// Could also consider using shld to decouple carries - - xorq c, c - movq (x), d0 - addq d0, d0 - movq 8(x), d1 - adcq d1, d1 - movq 16(x), d2 - adcq d2, d2 - movq 24(x), d3 - adcq d3, d3 - adcq c, c - -// Now subtract 2^256 * c + [d3;d3;d1;d1] = 2 * x - p_sm2 -// The constants n1 and n3 in [n3; -1; n1; -1] = p_sm2 are saved for later - - subq $-1, d0 - movq $0xffffffff00000000, n1 - sbbq n1, d1 - sbbq $-1, d2 - movq $0xfffffffeffffffff, n3 - sbbq n3, d3 - -// Since by hypothesis x < p_sm2 we know 2 * x - p_sm2 < 2^256, so the top -// carry c actually gives us a bitmask for 2 * x - p_sm2 < 0, which we -// now use to make a masked p_sm2' = [n3; c; n1; c] - - sbbq $0, c - andq c, n1 - andq c, n3 - -// Do the corrective addition and copy to output - - addq c, d0 - movq d0, (z) - adcq n1, d1 - movq d1, 8(z) - adcq c, d2 - movq d2, 16(z) - adcq n3, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_double_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_half_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_half_sm2.S deleted file mode 100644 index ef2a1e83178..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_half_sm2.S +++ /dev/null @@ -1,92 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Halve modulo p_sm2, z := (x / 2) mod p_sm2, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_half_sm2(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_half_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_half_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_half_sm2) - .text - -#define z %rdi -#define x %rsi - -#define a %rax -#define d0 %rcx -#define d1 %rdx -#define d2 %r8 -#define d3 %r9 - -#define d0short %ecx -#define d1short %edx - -S2N_BN_SYMBOL(bignum_half_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load lowest digit and get a mask for its lowest bit in d0 - - movq (x), a - movl $1, d0short - andq a, d0 - negq d0 - -// Create a masked version of p_sm2 - - movq $0xffffffff00000000, d1 - andq d0, d1 - movq d0, d2 - movq $0xfffffffeffffffff, d3 - andq d0, d3 - -// Perform addition with masked p_sm2. Catch the carry in a, as a bitmask -// for convenience though we only use its LSB below with SHRD - - addq a, d0 - adcq 8(x), d1 - adcq 16(x), d2 - adcq 24(x), d3 - sbbq a, a - -// Shift right, pushing the carry back down, and store back - - shrdq $1, d1, d0 - movq d0, (z) - shrdq $1, d2, d1 - movq d1, 8(z) - shrdq $1, d3, d2 - movq d2, 16(z) - shrdq $1, a, d3 - movq d3, 24(z) - -// Return - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_half_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_inv_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_inv_sm2.S deleted file mode 100644 index 720c51bde3d..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_inv_sm2.S +++ /dev/null @@ -1,1633 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Modular inverse modulo p_sm2 = 2^256 - 2^224 - 2^96 + 2^64 - 1 -// Input x[4]; output z[4] -// -// extern void bignum_inv_sm2(uint64_t z[static 4],const uint64_t x[static 4]); -// -// If the 4-digit input x is coprime to p_sm2, i.e. is not divisible -// by it, returns z < p_sm2 such that x * z == 1 (mod p_sm2). Note that -// x does not need to be reduced modulo p_sm2, but the output always is. -// If the input is divisible (i.e. is 0 or p_sm2), then there can be no -// modular inverse and z = 0 is returned. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_inv_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_inv_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_inv_sm2) - .text - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack - -#define f 0(%rsp) -#define g (5*N)(%rsp) -#define u (10*N)(%rsp) -#define v (15*N)(%rsp) -#define tmp (20*N)(%rsp) -#define tmp2 (21*N)(%rsp) -#define i (22*N)(%rsp) -#define d (23*N)(%rsp) - -#define mat (24*N)(%rsp) - -// Backup for the input pointer - -#define res (28*N)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 30*N - -// Syntactic variants to make x86_att version simpler to generate - -#define F 0 -#define G (5*N) -#define U (10*N) -#define V (15*N) -#define MAT (24*N) - -#define ff (%rsp) -#define gg (5*N)(%rsp) - -// --------------------------------------------------------------------------- -// Core signed almost-Montgomery reduction macro from u[4..0] to u[3..0]. -// --------------------------------------------------------------------------- - -#define amontred(P) \ -/* We only know the input is -2^316 < x < 2^316. To do traditional */ \ -/* unsigned Montgomery reduction, start by adding 2^61 * p_sm2. */ \ - movq $0xe000000000000000, %r8 ; \ - addq P, %r8 ; \ - movq $0x1fffffffffffffff, %r9 ; \ - adcq 8+P, %r9 ; \ - movq $0xffffffffe0000000, %r10 ; \ - adcq 16+P, %r10 ; \ - movq $0xffffffffffffffff, %r11 ; \ - adcq 24+P, %r11 ; \ - movq $0x1fffffffdfffffff, %r12 ; \ - adcq 32+P, %r12 ; \ -/* Let [%rcx;%rbx] = 2^32 * d0 and [%rdx;%rax] = (2^32-1) * d0 */ \ - movq %r8, %rbx ; \ - movq %r8, %rcx ; \ - shrq $32, %rcx ; \ - shlq $32, %rbx ; \ - movl $0xffffffff, %eax ; \ - mulq %r8; \ -/* Now [%r12;%r11;%r10;%r9] := [%r8;%r11;%r10;%r9] - [%rcx;%rbx;%rdx;%rax] */ \ - subq %rax, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - sbbq %rcx, %r8 ; \ - addq %r8, %r12 ; \ -/* Now capture carry and subtract p_sm2 if set (almost-Montgomery) */ \ - sbbq %rax, %rax ; \ - movl $0xffffffff, %ebx ; \ - notq %rbx; \ - andq %rax, %rbx ; \ - movq %rax, %rdx ; \ - btr $32, %rdx ; \ - subq %rax, %r9 ; \ - movq %r9, P ; \ - sbbq %rbx, %r10 ; \ - movq %r10, 8+P ; \ - sbbq %rax, %r11 ; \ - movq %r11, 16+P ; \ - sbbq %rdx, %r12 ; \ - movq %r12, 24+P - -// Very similar to a subroutine call to the s2n-bignum word_divstep59. -// But different in register usage and returning the final matrix as -// -// [ %r8 %r10] -// [ %r12 %r14] -// -// and also returning the matrix still negated (which doesn't matter) - -#define divstep59(din,fin,gin) \ - movq din, %rsi ; \ - movq fin, %rdx ; \ - movq gin, %rcx ; \ - movq %rdx, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq $0xfffffffffffffffe, %rax ; \ - xorl %ebp, %ebp ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %rdx ; \ - leaq (%rcx,%rax), %rdi ; \ - shlq $0x16, %rdx ; \ - shlq $0x16, %rdi ; \ - sarq $0x2b, %rdx ; \ - sarq $0x2b, %rdi ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %rbx ; \ - leaq (%rcx,%rax), %rcx ; \ - sarq $0x2a, %rbx ; \ - sarq $0x2a, %rcx ; \ - movq %rdx, MAT(%rsp) ; \ - movq %rbx, MAT+0x8(%rsp) ; \ - movq %rdi, MAT+0x10(%rsp) ; \ - movq %rcx, MAT+0x18(%rsp) ; \ - movq fin, %r12 ; \ - imulq %r12, %rdi ; \ - imulq %rdx, %r12 ; \ - movq gin, %r13 ; \ - imulq %r13, %rbx ; \ - imulq %rcx, %r13 ; \ - addq %rbx, %r12 ; \ - addq %rdi, %r13 ; \ - sarq $0x14, %r12 ; \ - sarq $0x14, %r13 ; \ - movq %r12, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - movq %r13, %rcx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq $0xfffffffffffffffe, %rax ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %r8 ; \ - leaq (%rcx,%rax), %r10 ; \ - shlq $0x16, %r8 ; \ - shlq $0x16, %r10 ; \ - sarq $0x2b, %r8 ; \ - sarq $0x2b, %r10 ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %r15 ; \ - leaq (%rcx,%rax), %r11 ; \ - sarq $0x2a, %r15 ; \ - sarq $0x2a, %r11 ; \ - movq %r13, %rbx ; \ - movq %r12, %rcx ; \ - imulq %r8, %r12 ; \ - imulq %r15, %rbx ; \ - addq %rbx, %r12 ; \ - imulq %r11, %r13 ; \ - imulq %r10, %rcx ; \ - addq %rcx, %r13 ; \ - sarq $0x14, %r12 ; \ - sarq $0x14, %r13 ; \ - movq %r12, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - movq %r13, %rcx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq MAT(%rsp), %rax ; \ - imulq %r8, %rax ; \ - movq MAT+0x10(%rsp), %rdx ; \ - imulq %r15, %rdx ; \ - imulq MAT+0x8(%rsp), %r8 ; \ - imulq MAT+0x18(%rsp), %r15 ; \ - addq %r8, %r15 ; \ - leaq (%rax,%rdx), %r9 ; \ - movq MAT(%rsp), %rax ; \ - imulq %r10, %rax ; \ - movq MAT+0x10(%rsp), %rdx ; \ - imulq %r11, %rdx ; \ - imulq MAT+0x8(%rsp), %r10 ; \ - imulq MAT+0x18(%rsp), %r11 ; \ - addq %r10, %r11 ; \ - leaq (%rax,%rdx), %r13 ; \ - movq $0xfffffffffffffffe, %rax ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %r8 ; \ - leaq (%rcx,%rax), %r12 ; \ - shlq $0x15, %r8 ; \ - shlq $0x15, %r12 ; \ - sarq $0x2b, %r8 ; \ - sarq $0x2b, %r12 ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %r10 ; \ - leaq (%rcx,%rax), %r14 ; \ - sarq $0x2b, %r10 ; \ - sarq $0x2b, %r14 ; \ - movq %r9, %rax ; \ - imulq %r8, %rax ; \ - movq %r13, %rdx ; \ - imulq %r10, %rdx ; \ - imulq %r15, %r8 ; \ - imulq %r11, %r10 ; \ - addq %r8, %r10 ; \ - leaq (%rax,%rdx), %r8 ; \ - movq %r9, %rax ; \ - imulq %r12, %rax ; \ - movq %r13, %rdx ; \ - imulq %r14, %rdx ; \ - imulq %r15, %r12 ; \ - imulq %r11, %r14 ; \ - addq %r12, %r14 ; \ - leaq (%rax,%rdx), %r12 - -S2N_BN_SYMBOL(bignum_inv_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers and make room for temporaries - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Save the return pointer for the end so we can overwrite %rdi later - - movq %rdi, res - -// Create constant [%rdx;%rcx;%rbx;%rax] = p_sm2 and copy it into the variable f -// including the 5th zero digit - - xorl %ebp, %ebp - leaq -1(%rbp), %rax - movl $0x00000000ffffffff, %ebx - notq %rbx - movq %rax, %rcx - movq %rax, %rdx - btr $32, %rdx - - movq %rax, F(%rsp) - movq %rbx, F+8(%rsp) - movq %rcx, F+16(%rsp) - movq %rdx, F+24(%rsp) - movq %rbp, F+32(%rsp) - -// Now reduce the input modulo p_sm2, first negating the constant to get -// [%rdx;%rcx;%rbx;%rax] = 2^256 - p_sm2, adding it to x and hence getting -// the comparison x < p_sm2 <=> (2^256 - p_sm2) + x < 2^256 and choosing -// g accordingly. - - movq (%rsi), %r8 - movq 8(%rsi), %r9 - movq 16(%rsi), %r10 - movq 24(%rsi), %r11 - - movl $1, %eax - notq %rbx - xorl %ecx, %ecx - notq %rdx - - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - - cmovncq %r8, %rax - cmovncq %r9, %rbx - cmovncq %r10, %rcx - cmovncq %r11, %rdx - - movq %rax, G(%rsp) - movq %rbx, G+8(%rsp) - movq %rcx, G+16(%rsp) - movq %rdx, G+24(%rsp) - xorl %eax, %eax - movq %rax, G+32(%rsp) - -// Also maintain reduced < 2^256 vector [u,v] such that -// [f,g] == x * 2^{5*i-50} * [u,v] (mod p_sm2) -// starting with [p_sm2,x] == x * 2^{5*0-50} * [0,2^50] (mod p_sm2) -// The weird-looking 5*i modifications come in because we are doing -// 64-bit word-sized Montgomery reductions at each stage, which is -// 5 bits more than the 59-bit requirement to keep things stable. - - xorl %eax, %eax - movq %rax, U(%rsp) - movq %rax, U+8(%rsp) - movq %rax, U+16(%rsp) - movq %rax, U+24(%rsp) - - movq $0x0004000000000000, %rcx - movq %rcx, V(%rsp) - movq %rax, V+8(%rsp) - movq %rax, V+16(%rsp) - movq %rax, V+24(%rsp) - -// Start of main loop. We jump into the middle so that the divstep -// portion is common to the special tenth iteration after a uniform -// first 9. - - movq $10, i - movq $1, d - jmp Lbignum_inv_sm2_midloop - -Lbignum_inv_sm2_loop: - -// Separate out the matrix into sign-magnitude pairs - - movq %r8, %r9 - sarq $63, %r9 - xorq %r9, %r8 - subq %r9, %r8 - - movq %r10, %r11 - sarq $63, %r11 - xorq %r11, %r10 - subq %r11, %r10 - - movq %r12, %r13 - sarq $63, %r13 - xorq %r13, %r12 - subq %r13, %r12 - - movq %r14, %r15 - sarq $63, %r15 - xorq %r15, %r14 - subq %r15, %r14 - -// Adjust the initial values to allow for complement instead of negation -// This initial offset is the same for [f,g] and [u,v] compositions. -// Save it in temporary storage for the [u,v] part and do [f,g] first. - - movq %r8, %rax - andq %r9, %rax - movq %r10, %rdi - andq %r11, %rdi - addq %rax, %rdi - movq %rdi, tmp - - movq %r12, %rax - andq %r13, %rax - movq %r14, %rsi - andq %r15, %rsi - addq %rax, %rsi - movq %rsi, tmp2 - -// Now the computation of the updated f and g values. This maintains a -// 2-word carry between stages so we can conveniently insert the shift -// right by 59 before storing back, and not overwrite digits we need -// again of the old f and g values. -// -// Digit 0 of [f,g] - - xorl %ebx, %ebx - movq F(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rdi - adcq %rdx, %rbx - movq G(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rdi - adcq %rdx, %rbx - - xorl %ebp, %ebp - movq F(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rbp - movq G(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - -// Digit 1 of [f,g] - - xorl %ecx, %ecx - movq F+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq G+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - shrdq $59, %rbx, %rdi - movq %rdi, F(%rsp) - - xorl %edi, %edi - movq F+N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rbp - adcq %rdx, %rdi - movq G+N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rdi - shrdq $59, %rbp, %rsi - movq %rsi, G(%rsp) - -// Digit 2 of [f,g] - - xorl %esi, %esi - movq F+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rsi - movq G+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rsi - shrdq $59, %rcx, %rbx - movq %rbx, F+N(%rsp) - - xorl %ebx, %ebx - movq F+2*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rdi - adcq %rdx, %rbx - movq G+2*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rdi - adcq %rdx, %rbx - shrdq $59, %rdi, %rbp - movq %rbp, G+N(%rsp) - -// Digits 3 and 4 of [f,g] - - movq F+3*N(%rsp), %rax - xorq %r9, %rax - movq F+4*N(%rsp), %rbp - xorq %r9, %rbp - andq %r8, %rbp - negq %rbp - mulq %r8 - addq %rax, %rsi - adcq %rdx, %rbp - movq G+3*N(%rsp), %rax - xorq %r11, %rax - movq G+4*N(%rsp), %rdx - xorq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbp - mulq %r10 - addq %rax, %rsi - adcq %rdx, %rbp - shrdq $59, %rsi, %rcx - movq %rcx, F+2*N(%rsp) - shrdq $59, %rbp, %rsi - sarq $59, %rbp - - movq F+3*N(%rsp), %rax - movq %rsi, F+3*N(%rsp) - - movq F+4*N(%rsp), %rsi - movq %rbp, F+4*N(%rsp) - - xorq %r13, %rax - xorq %r13, %rsi - andq %r12, %rsi - negq %rsi - mulq %r12 - addq %rax, %rbx - adcq %rdx, %rsi - movq G+3*N(%rsp), %rax - xorq %r15, %rax - movq G+4*N(%rsp), %rdx - xorq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rsi - mulq %r14 - addq %rax, %rbx - adcq %rdx, %rsi - shrdq $59, %rbx, %rdi - movq %rdi, G+2*N(%rsp) - shrdq $59, %rsi, %rbx - movq %rbx, G+3*N(%rsp) - sarq $59, %rsi - movq %rsi, G+4*N(%rsp) - -// Get the initial carries back from storage and do the [u,v] accumulation - - movq tmp, %rbx - movq tmp2, %rbp - -// Digit 0 of [u,v] - - xorl %ecx, %ecx - movq U(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq V(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - - xorl %esi, %esi - movq U(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, U(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq V(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, V(%rsp) - -// Digit 1 of [u,v] - - xorl %ebx, %ebx - movq U+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq V+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rbx - - xorl %ebp, %ebp - movq U+N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rcx, U+N(%rsp) - addq %rax, %rsi - adcq %rdx, %rbp - movq V+N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - movq %rsi, V+N(%rsp) - -// Digit 2 of [u,v] - - xorl %ecx, %ecx - movq U+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq V+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - - xorl %esi, %esi - movq U+2*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, U+2*N(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq V+2*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, V+2*N(%rsp) - -// Digits 3 and 4 of u (top is unsigned) - - movq U+3*N(%rsp), %rax - xorq %r9, %rax - movq %r9, %rbx - andq %r8, %rbx - negq %rbx - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq V+3*N(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbx - mulq %r10 - addq %rax, %rcx - adcq %rbx, %rdx - -// Preload for last use of old u digit 3 - - movq U+3*N(%rsp), %rax - movq %rcx, U+3*N(%rsp) - movq %rdx, U+4*N(%rsp) - -// Digits 3 and 4 of v (top is unsigned) - - xorq %r13, %rax - movq %r13, %rcx - andq %r12, %rcx - negq %rcx - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rcx - movq V+3*N(%rsp), %rax - xorq %r15, %rax - movq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rcx - mulq %r14 - addq %rax, %rsi - adcq %rcx, %rdx - movq %rsi, V+3*N(%rsp) - movq %rdx, V+4*N(%rsp) - -// Montgomery reduction of u - - amontred(u) - -// Montgomery reduction of v - - amontred(v) - -Lbignum_inv_sm2_midloop: - - divstep59(d,ff,gg) - movq %rsi, d - -// Next iteration - - decq i - jnz Lbignum_inv_sm2_loop - -// The 10th and last iteration does not need anything except the -// u value and the sign of f; the latter can be obtained from the -// lowest word of f. So it's done differently from the main loop. -// Find the sign of the new f. For this we just need one digit -// since we know (for in-scope cases) that f is either +1 or -1. -// We don't explicitly shift right by 59 either, but looking at -// bit 63 (or any bit >= 60) of the unshifted result is enough -// to distinguish -1 from +1; this is then made into a mask. - - movq F(%rsp), %rax - movq G(%rsp), %rcx - imulq %r8, %rax - imulq %r10, %rcx - addq %rcx, %rax - sarq $63, %rax - -// Now separate out the matrix into sign-magnitude pairs -// and adjust each one based on the sign of f. -// -// Note that at this point we expect |f|=1 and we got its -// sign above, so then since [f,0] == x * [u,v] (mod p_sm2) -// we want to flip the sign of u according to that of f. - - movq %r8, %r9 - sarq $63, %r9 - xorq %r9, %r8 - subq %r9, %r8 - xorq %rax, %r9 - - movq %r10, %r11 - sarq $63, %r11 - xorq %r11, %r10 - subq %r11, %r10 - xorq %rax, %r11 - - movq %r12, %r13 - sarq $63, %r13 - xorq %r13, %r12 - subq %r13, %r12 - xorq %rax, %r13 - - movq %r14, %r15 - sarq $63, %r15 - xorq %r15, %r14 - subq %r15, %r14 - xorq %rax, %r15 - -// Adjust the initial value to allow for complement instead of negation - - movq %r8, %rax - andq %r9, %rax - movq %r10, %r12 - andq %r11, %r12 - addq %rax, %r12 - -// Digit 0 of [u] - - xorl %r13d, %r13d - movq U(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r12 - adcq %rdx, %r13 - movq V(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r12 - adcq %rdx, %r13 - -// Digit 1 of [u] - - xorl %r14d, %r14d - movq U+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r13 - adcq %rdx, %r14 - movq V+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r13 - adcq %rdx, %r14 - -// Digit 2 of [u] - - xorl %r15d, %r15d - movq U+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r14 - adcq %rdx, %r15 - movq V+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r14 - adcq %rdx, %r15 - -// Digits 3 and 4 of u (top is unsigned) - - movq U+3*N(%rsp), %rax - xorq %r9, %rax - andq %r8, %r9 - negq %r9 - mulq %r8 - addq %rax, %r15 - adcq %rdx, %r9 - movq V+3*N(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %r9 - mulq %r10 - addq %rax, %r15 - adcq %rdx, %r9 - -// Store back and Montgomery reduce u - - movq %r12, U(%rsp) - movq %r13, U+N(%rsp) - movq %r14, U+2*N(%rsp) - movq %r15, U+3*N(%rsp) - movq %r9, U+4*N(%rsp) - - amontred(u) - -// Perform final strict reduction mod p_sm2 and copy to output - - movq U(%rsp), %r8 - movq U+N(%rsp), %r9 - movq U+2*N(%rsp), %r10 - movq U+3*N(%rsp), %r11 - - movl $1, %eax - movl $0x00000000ffffffff, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - bts $32, %rdx - - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - - cmovncq %r8, %rax - cmovncq %r9, %rbx - cmovncq %r10, %rcx - cmovncq %r11, %rdx - - movq res, %rdi - movq %rax, (%rdi) - movq %rbx, N(%rdi) - movq %rcx, 2*N(%rdi) - movq %rdx, 3*N(%rdi) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_inv_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_nsm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_nsm2.S deleted file mode 100644 index 45ce4de5f51..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_nsm2.S +++ /dev/null @@ -1,207 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_sm2 -// Input x[k]; output z[4] -// -// extern void bignum_mod_nsm2(uint64_t z[static 4], uint64_t k, -// const uint64_t *x); -// -// Reduction is modulo the group order of the GM/T 0003-2012 curve SM2. -// -// Standard x86-64 ABI: RDI = z, RSI = k, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = k, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_nsm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_nsm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_nsm2) - .text - -#define z %rdi -#define k %rsi -#define x %rcx - -#define m0 %r8 -#define m1 %r9 -#define m2 %r10 -#define m3 %r11 -#define d %r12 - -#define n0 %rax -#define n1 %rbx -#define n3 %rdx -#define q %rdx - -#define qshort %edx - -S2N_BN_SYMBOL(bignum_mod_nsm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save extra registers - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - -// If the input is already <= 3 words long, go to a trivial "copy" path - - cmpq $4, k - jc Lbignum_mod_nsm2_shortinput - -// Otherwise load the top 4 digits (top-down) and reduce k by 4 - - subq $4, k - movq 24(%rdx,k,8), m3 - movq 16(%rdx,k,8), m2 - movq 8(%rdx,k,8), m1 - movq (%rdx,k,8), m0 - -// Move x into another register to leave %rdx free for multiplies and use of n3 - - movq %rdx, x - -// Reduce the top 4 digits mod n_sm2 (a conditional subtraction of n_sm2) - - movq $0xac440bf6c62abedd, n0 - movq $0x8dfc2094de39fad4, n1 - movq $0x0000000100000000, n3 - - addq n0, m0 - adcq n1, m1 - adcq $0, m2 - adcq n3, m3 - sbbq d, d - notq d - andq d, n0 - andq d, n1 - andq d, n3 - subq n0, m0 - sbbq n1, m1 - sbbq $0, m2 - sbbq n3, m3 - -// Now do (k-4) iterations of 5->4 word modular reduction - - testq k, k - jz Lbignum_mod_nsm2_writeback - -Lbignum_mod_nsm2_loop: - -// Writing the input, with the new zeroth digit implicitly appended, as -// z = 2^256 * m3 + 2^192 * m2 + t, our intended quotient approximation is -// MIN ((m3 * (1 + 2^32 + 2^64) + m2 + 2^64) >> 64) (2^64 - 1) - - movq m2, d - movl $1, qshort - addq m3, d - adcq m3, q - - shrq $32, d - addq m3, d - - shrq $32, d - addq d, q - sbbq $0, q - -// Load the next digit so current m to reduce = [m3;m2;m1;m0;d] - - movq -8(x,k,8), d - -// Now form [m3;m2;m1;m0;d] = m - q * n_sm2 - - subq q, m3 - movq $0xac440bf6c62abedd, n0 - mulxq n0, n0, n1 - addq n0, d - adcq n1, m0 - movq $0x8dfc2094de39fad4, n0 - mulxq n0, n0, n1 - adcq $0, n1 - addq n0, m0 - adcq n1, m1 - movq $0x0000000100000000, n0 - mulxq n0, n0, n1 - adcq n0, m2 - adcq n1, m3 - -// Now our top word m3 is either zero or all 1s. Use it for a masked -// addition of n_sm2, which we can do by a *subtraction* of -// 2^256 - n_sm2 from our portion - - movq $0xac440bf6c62abedd, n0 - andq m3, n0 - movq $0x8dfc2094de39fad4, n1 - andq m3, n1 - movq $0x0000000100000000, n3 - andq m3, n3 - - subq n0, d - sbbq n1, m0 - sbbq $0, m1 - sbbq n3, m2 - -// Now shuffle registers up and loop - - movq m2, m3 - movq m1, m2 - movq m0, m1 - movq d, m0 - - decq k - jnz Lbignum_mod_nsm2_loop - -// Write back - -Lbignum_mod_nsm2_writeback: - - movq m0, (z) - movq m1, 8(z) - movq m2, 16(z) - movq m3, 24(z) - -// Restore registers and return - - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_nsm2) - -Lbignum_mod_nsm2_shortinput: - - xorq m0, m0 - xorq m1, m1 - xorq m2, m2 - xorq m3, m3 - - testq k, k - jz Lbignum_mod_nsm2_writeback - movq (%rdx), m0 - decq k - jz Lbignum_mod_nsm2_writeback - movq 8(%rdx), m1 - decq k - jz Lbignum_mod_nsm2_writeback - movq 16(%rdx), m2 - jmp Lbignum_mod_nsm2_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_nsm2_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_nsm2_4.S deleted file mode 100644 index cdf66aa88d6..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_nsm2_4.S +++ /dev/null @@ -1,99 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_mod_nsm2_4(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Reduction is modulo the group order of the GM/T 0003-2012 curve SM2. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_nsm2_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_nsm2_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_nsm2_4) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n0 %rax -#define n1 %r10 -#define n3 %r11 - -// Can re-use this as a temporary once we've loaded the input - -#define c %rsi - -S2N_BN_SYMBOL(bignum_mod_nsm2_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load a set of registers [n3; 0; n1; n0] = 2^256 - n_sm2 - - movq $0xac440bf6c62abedd, n0 - movq $0x8dfc2094de39fad4, n1 - movq $0x0000000100000000, n3 - -// Load the input and compute x + (2^256 - n_sm2) - - movq (x), d0 - addq n0, d0 - movq 8(x), d1 - adcq n1, d1 - movq 16(x), d2 - adcq $0, d2 - movq 24(x), d3 - adcq n3, d3 - -// Now CF is set iff 2^256 <= x + (2^256 - n_sm2), i.e. iff n_sm2 <= x. -// Create a mask for the condition x < n, and mask the three nontrivial digits -// ready to undo the previous addition with a compensating subtraction - - sbbq c, c - notq c - andq c, n0 - andq c, n1 - andq c, n3 - -// Now subtract mask * (2^256 - n_sm2) again and store - - subq n0, d0 - movq d0, (z) - sbbq n1, d1 - movq d1, 8(z) - sbbq $0, d2 - movq d2, 16(z) - sbbq n3, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_nsm2_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_nsm2_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_nsm2_alt.S deleted file mode 100644 index 7f1be93fcbf..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_nsm2_alt.S +++ /dev/null @@ -1,215 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo group order, z := x mod n_sm2 -// Input x[k]; output z[4] -// -// extern void bignum_mod_nsm2_alt(uint64_t z[static 4], uint64_t k, -// const uint64_t *x); -// -// Reduction is modulo the group order of the GM/T 0003-2012 curve SM2. -// -// Standard x86-64 ABI: RDI = z, RSI = k, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = k, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_nsm2_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_nsm2_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_nsm2_alt) - .text - -#define z %rdi -#define k %rsi -#define x %rcx - -#define m0 %r8 -#define m1 %r9 -#define m2 %r10 -#define m3 %r11 -#define d %r12 - -#define n0 %rax -#define n1 %rbx -#define n3 %rdx - -#define q %rbx - -#define qshort %ebx - -S2N_BN_SYMBOL(bignum_mod_nsm2_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save extra registers - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - -// If the input is already <= 3 words long, go to a trivial "copy" path - - cmpq $4, k - jc Lbignum_mod_nsm2_alt_shortinput - -// Otherwise load the top 4 digits (top-down) and reduce k by 4 - - subq $4, k - movq 24(%rdx,k,8), m3 - movq 16(%rdx,k,8), m2 - movq 8(%rdx,k,8), m1 - movq (%rdx,k,8), m0 - -// Move x into another register to leave %rdx free for multiplies and use of n3 - - movq %rdx, x - -// Reduce the top 4 digits mod n_sm2 (a conditional subtraction of n_sm2) - - movq $0xac440bf6c62abedd, n0 - movq $0x8dfc2094de39fad4, n1 - movq $0x0000000100000000, n3 - - addq n0, m0 - adcq n1, m1 - adcq $0, m2 - adcq n3, m3 - sbbq d, d - notq d - andq d, n0 - andq d, n1 - andq d, n3 - subq n0, m0 - sbbq n1, m1 - sbbq $0, m2 - sbbq n3, m3 - -// Now do (k-4) iterations of 5->4 word modular reduction - - testq k, k - jz Lbignum_mod_nsm2_alt_writeback - -Lbignum_mod_nsm2_alt_loop: - -// Writing the input, with the new zeroth digit implicitly appended, as -// z = 2^256 * m3 + 2^192 * m2 + t, our intended quotient approximation is -// MIN ((m3 * (1 + 2^32 + 2^64) + m2 + 2^64) >> 64) (2^64 - 1) - - movq m2, d - movl $1, qshort - addq m3, d - adcq m3, q - - shrq $32, d - addq m3, d - - shrq $32, d - addq d, q - sbbq $0, q - -// Load the next digit so current m to reduce = [m3;m2;m1;m0;d] - - movq -8(x,k,8), d - -// Now form [m3;m2;m1;m0;d] = m - q * n_sm2 - - subq q, m3 - - movq $0xac440bf6c62abedd, %rax - mulq q - addq %rax, d - adcq %rdx, m0 - adcq $0, m1 - adcq $0, m2 - adcq $0, m3 - - movq $0x8dfc2094de39fad4, %rax - mulq q - addq %rax, m0 - adcq %rdx, m1 - adcq $0, m2 - adcq $0, m3 - - movq $0x0000000100000000, %rax - mulq q - addq %rax, m2 - adcq %rdx, m3 - -// Now our top word m3 is either zero or all 1s. Use it for a masked -// addition of n_sm2, which we can do by a *subtraction* of -// 2^256 - n_sm2 from our portion - - movq $0xac440bf6c62abedd, n0 - andq m3, n0 - movq $0x8dfc2094de39fad4, n1 - andq m3, n1 - movq $0x0000000100000000, n3 - andq m3, n3 - - subq n0, d - sbbq n1, m0 - sbbq $0, m1 - sbbq n3, m2 - -// Now shuffle registers up and loop - - movq m2, m3 - movq m1, m2 - movq m0, m1 - movq d, m0 - - decq k - jnz Lbignum_mod_nsm2_alt_loop - -// Write back - -Lbignum_mod_nsm2_alt_writeback: - - movq m0, (z) - movq m1, 8(z) - movq m2, 16(z) - movq m3, 24(z) - -// Restore registers and return - - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_nsm2_alt) - -Lbignum_mod_nsm2_alt_shortinput: - - xorq m0, m0 - xorq m1, m1 - xorq m2, m2 - xorq m3, m3 - - testq k, k - jz Lbignum_mod_nsm2_alt_writeback - movq (%rdx), m0 - decq k - jz Lbignum_mod_nsm2_alt_writeback - movq 8(%rdx), m1 - decq k - jz Lbignum_mod_nsm2_alt_writeback - movq 16(%rdx), m2 - jmp Lbignum_mod_nsm2_alt_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_sm2.S deleted file mode 100644 index 1549c2fdf47..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_sm2.S +++ /dev/null @@ -1,201 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_sm2 -// Input x[k]; output z[4] -// -// extern void bignum_mod_sm2(uint64_t z[static 4], uint64_t k, const uint64_t *x); -// -// Standard x86-64 ABI: RDI = z, RSI = k, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = k, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_sm2) - .text - -#define z %rdi -#define k %rsi -#define x %rdx - -#define m0 %r8 -#define m1 %r9 -#define m2 %r10 -#define m3 %r11 -#define d %r12 - -#define n0 %rax -#define n1 %rbx -#define n3 %rcx -#define q %rcx - -#define qshort %ecx - -S2N_BN_SYMBOL(bignum_mod_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save extra registers - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - -// If the input is already <= 3 words long, go to a trivial "copy" path - - cmpq $4, k - jc Lbignum_mod_sm2_shortinput - -// Otherwise load the top 4 digits (top-down) and reduce k by 4 - - subq $4, k - movq 24(x,k,8), m3 - movq 16(x,k,8), m2 - movq 8(x,k,8), m1 - movq (x,k,8), m0 - -// Load non-trivial digits [n3; -1; n1; -1] = p_sm2 and do a conditional -// subtraction to reduce the four starting digits [m3;m2;m1;m0] modulo p_sm2 - - subq $-1, m0 - movq $0xffffffff00000000, n1 - sbbq n1, m1 - movq $0xfffffffeffffffff, n3 - sbbq $-1, m2 - sbbq n3, m3 - - sbbq n0, n0 - - andq n0, n1 - andq n0, n3 - addq n0, m0 - adcq n1, m1 - adcq n0, m2 - adcq n3, m3 - -// Now do (k-4) iterations of 5->4 word modular reduction - - testq k, k - jz Lbignum_mod_sm2_writeback - -Lbignum_mod_sm2_loop: - -// Writing the input, with the new zeroth digit implicitly appended, as -// z = 2^256 * m3 + 2^192 * m2 + t, our intended quotient approximation is -// MIN ((m3 * (1 + 2^32 + 2^64) + m2 + 2^64) >> 64) (2^64 - 1) - - movq m2, d - movl $1, qshort - addq m3, d - adcq m3, q - - shrq $32, d - addq m3, d - - shrq $32, d - addq d, q - sbbq $0, q - -// Load the next digit so current m to reduce = [m3;m2;m1;m0;d] - - movq -8(x,k,8), d - -// Now compute the initial pre-reduced [m3;m2;m1;m0;d] = m - p_sm2 * q -// = z - (2^256 - 2^224 - 2^96 + 2^64 - 1) * q - - movq q, n0 - movq q, n1 - shlq $32, n0 - shrq $32, n1 - - addq n0, m2 - adcq n1, m3 - - subq q, n0 - sbbq $0, n1 - - subq q, m3 - - addq q, d - adcq n0, m0 - adcq n1, m1 - adcq $0, m2 - adcq $0, m3 - -// Now our top word m3 is either zero or all 1s, and we use this to discriminate -// whether a correction is needed because our result is negative, as a bitmask -// Do a masked addition of p_sm2 - - movq $0xffffffff00000000, n1 - andq m3, n1 - movq $0xfffffffeffffffff, n3 - andq m3, n3 - addq m3, d - adcq n1, m0 - adcq m3, m1 - adcq n3, m2 - -// Shuffle registers up and loop - - movq m2, m3 - movq m1, m2 - movq m0, m1 - movq d, m0 - - decq k - jnz Lbignum_mod_sm2_loop - -// Write back - -Lbignum_mod_sm2_writeback: - - movq m0, (z) - movq m1, 8(z) - movq m2, 16(z) - movq m3, 24(z) - -// Restore registers and return - - CFI_POP(%r12) - CFI_POP(%rbx) -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_sm2) - -Lbignum_mod_sm2_shortinput: - - xorq m0, m0 - xorq m1, m1 - xorq m2, m2 - xorq m3, m3 - - testq k, k - jz Lbignum_mod_sm2_writeback - movq (%rdx), m0 - decq k - jz Lbignum_mod_sm2_writeback - movq 8(%rdx), m1 - decq k - jz Lbignum_mod_sm2_writeback - movq 16(%rdx), m2 - jmp Lbignum_mod_sm2_writeback - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_sm2_4.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_sm2_4.S deleted file mode 100644 index 4477ab75570..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_mod_sm2_4.S +++ /dev/null @@ -1,87 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Reduce modulo field characteristic, z := x mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_mod_sm2_4(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mod_sm2_4) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mod_sm2_4) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mod_sm2_4) - .text - -#define z %rdi -#define x %rsi - -#define d0 %rdx -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n1 %r10 -#define n3 %r11 -#define c %rax - -S2N_BN_SYMBOL(bignum_mod_sm2_4): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the input and subtract to get [d3;d3;d1;d1] = x - p_sm2 (modulo 2^256) -// The constants n1 and n3 in [n3; -1; n1; -1] = p_sm2 are saved for later - - movq (x), d0 - subq $-1, d0 - movq 8(x), d1 - movq $0xffffffff00000000, n1 - sbbq n1, d1 - movq 16(x), d2 - sbbq $-1, d2 - movq $0xfffffffeffffffff, n3 - movq 24(x), d3 - sbbq n3, d3 - -// Capture the carry to determine whether to add back p_sm2, and use -// it to create a masked p_sm2' = [n3; c; n1; c] - - sbbq c, c - andq c, n1 - andq c, n3 - -// Do the corrective addition and copy to output - - addq c, d0 - movq d0, (z) - adcq n1, d1 - movq d1, 8(z) - adcq c, d2 - movq d2, 16(z) - adcq n3, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_mod_sm2_4) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montinv_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montinv_sm2.S deleted file mode 100644 index aff551fc37c..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montinv_sm2.S +++ /dev/null @@ -1,1645 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery inverse modulo p_sm2 = 2^256 - 2^224 - 2^96 + 2^64 - 1 -// Input x[4]; output z[4] -// -// extern void bignum_montinv_sm2(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// If the 4-digit input x is coprime to p_sm2, i.e. is not divisible -// by it, returns z < p_sm2 such that x * z == 2^512 (mod p_sm2). This -// is effectively "Montgomery inverse" because if we consider x and z as -// Montgomery forms of X and Z, i.e. x == 2^256 * X and z == 2^256 * Z -// (both mod p_sm2) then X * Z == 1 (mod p_sm2). That is, this function -// gives the analog of the modular inverse bignum_inv_sm2 but with both -// input and output in the Montgomery domain. Note that x does not need -// to be reduced modulo p_sm2, but the output always is. If the input -// is divisible (i.e. is 0 or p_sm2), then there can be no solution to -// the congruence x * z == 2^512 (mod p_sm2), and z = 0 is returned. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montinv_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montinv_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montinv_sm2) - .text - -// Size in bytes of a 64-bit word - -#define N 8 - -// Pointer-offset pairs for temporaries on stack - -#define f 0(%rsp) -#define g (5*N)(%rsp) -#define u (10*N)(%rsp) -#define v (15*N)(%rsp) -#define tmp (20*N)(%rsp) -#define tmp2 (21*N)(%rsp) -#define i (22*N)(%rsp) -#define d (23*N)(%rsp) - -#define mat (24*N)(%rsp) - -// Backup for the input pointer - -#define res (28*N)(%rsp) - -// Total size to reserve on the stack - -#define NSPACE 30*N - -// Syntactic variants to make x86_att version simpler to generate - -#define F 0 -#define G (5*N) -#define U (10*N) -#define V (15*N) -#define MAT (24*N) - -#define ff (%rsp) -#define gg (5*N)(%rsp) - -// --------------------------------------------------------------------------- -// Core signed almost-Montgomery reduction macro from u[4..0] to u[3..0]. -// --------------------------------------------------------------------------- - -#define amontred(P) \ -/* We only know the input is -2^316 < x < 2^316. To do traditional */ \ -/* unsigned Montgomery reduction, start by adding 2^61 * p_sm2. */ \ - movq $0xe000000000000000, %r8 ; \ - addq P, %r8 ; \ - movq $0x1fffffffffffffff, %r9 ; \ - adcq 8+P, %r9 ; \ - movq $0xffffffffe0000000, %r10 ; \ - adcq 16+P, %r10 ; \ - movq $0xffffffffffffffff, %r11 ; \ - adcq 24+P, %r11 ; \ - movq $0x1fffffffdfffffff, %r12 ; \ - adcq 32+P, %r12 ; \ -/* Let [%rcx;%rbx] = 2^32 * d0 and [%rdx;%rax] = (2^32-1) * d0 */ \ - movq %r8, %rbx ; \ - movq %r8, %rcx ; \ - shrq $32, %rcx ; \ - shlq $32, %rbx ; \ - movl $0xffffffff, %eax ; \ - mulq %r8; \ -/* Now [%r12;%r11;%r10;%r9] := [%r8;%r11;%r10;%r9] - [%rcx;%rbx;%rdx;%rax] */ \ - subq %rax, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - sbbq %rcx, %r8 ; \ - addq %r8, %r12 ; \ -/* Now capture carry and subtract p_sm2 if set (almost-Montgomery) */ \ - sbbq %rax, %rax ; \ - movl $0xffffffff, %ebx ; \ - notq %rbx; \ - andq %rax, %rbx ; \ - movq %rax, %rdx ; \ - btr $32, %rdx ; \ - subq %rax, %r9 ; \ - movq %r9, P ; \ - sbbq %rbx, %r10 ; \ - movq %r10, 8+P ; \ - sbbq %rax, %r11 ; \ - movq %r11, 16+P ; \ - sbbq %rdx, %r12 ; \ - movq %r12, 24+P - -// Very similar to a subroutine call to the s2n-bignum word_divstep59. -// But different in register usage and returning the final matrix as -// -// [ %r8 %r10] -// [ %r12 %r14] -// -// and also returning the matrix still negated (which doesn't matter) - -#define divstep59(din,fin,gin) \ - movq din, %rsi ; \ - movq fin, %rdx ; \ - movq gin, %rcx ; \ - movq %rdx, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq $0xfffffffffffffffe, %rax ; \ - xorl %ebp, %ebp ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %rdx ; \ - leaq (%rcx,%rax), %rdi ; \ - shlq $0x16, %rdx ; \ - shlq $0x16, %rdi ; \ - sarq $0x2b, %rdx ; \ - sarq $0x2b, %rdi ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %rbx ; \ - leaq (%rcx,%rax), %rcx ; \ - sarq $0x2a, %rbx ; \ - sarq $0x2a, %rcx ; \ - movq %rdx, MAT(%rsp) ; \ - movq %rbx, MAT+0x8(%rsp) ; \ - movq %rdi, MAT+0x10(%rsp) ; \ - movq %rcx, MAT+0x18(%rsp) ; \ - movq fin, %r12 ; \ - imulq %r12, %rdi ; \ - imulq %rdx, %r12 ; \ - movq gin, %r13 ; \ - imulq %r13, %rbx ; \ - imulq %rcx, %r13 ; \ - addq %rbx, %r12 ; \ - addq %rdi, %r13 ; \ - sarq $0x14, %r12 ; \ - sarq $0x14, %r13 ; \ - movq %r12, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - movq %r13, %rcx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq $0xfffffffffffffffe, %rax ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %r8 ; \ - leaq (%rcx,%rax), %r10 ; \ - shlq $0x16, %r8 ; \ - shlq $0x16, %r10 ; \ - sarq $0x2b, %r8 ; \ - sarq $0x2b, %r10 ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %r15 ; \ - leaq (%rcx,%rax), %r11 ; \ - sarq $0x2a, %r15 ; \ - sarq $0x2a, %r11 ; \ - movq %r13, %rbx ; \ - movq %r12, %rcx ; \ - imulq %r8, %r12 ; \ - imulq %r15, %rbx ; \ - addq %rbx, %r12 ; \ - imulq %r11, %r13 ; \ - imulq %r10, %rcx ; \ - addq %rcx, %r13 ; \ - sarq $0x14, %r12 ; \ - sarq $0x14, %r13 ; \ - movq %r12, %rbx ; \ - andq $0xfffff, %rbx ; \ - movabsq $0xfffffe0000000000, %rax ; \ - orq %rax, %rbx ; \ - movq %r13, %rcx ; \ - andq $0xfffff, %rcx ; \ - movabsq $0xc000000000000000, %rax ; \ - orq %rax, %rcx ; \ - movq MAT(%rsp), %rax ; \ - imulq %r8, %rax ; \ - movq MAT+0x10(%rsp), %rdx ; \ - imulq %r15, %rdx ; \ - imulq MAT+0x8(%rsp), %r8 ; \ - imulq MAT+0x18(%rsp), %r15 ; \ - addq %r8, %r15 ; \ - leaq (%rax,%rdx), %r9 ; \ - movq MAT(%rsp), %rax ; \ - imulq %r10, %rax ; \ - movq MAT+0x10(%rsp), %rdx ; \ - imulq %r11, %rdx ; \ - imulq MAT+0x8(%rsp), %r10 ; \ - imulq MAT+0x18(%rsp), %r11 ; \ - addq %r10, %r11 ; \ - leaq (%rax,%rdx), %r13 ; \ - movq $0xfffffffffffffffe, %rax ; \ - movl $0x2, %edx ; \ - movq %rbx, %rdi ; \ - movq %rax, %r8 ; \ - testq %rsi, %rsi ; \ - cmovs %rbp, %r8 ; \ - testq $0x1, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - cmovs %rbp, %r8 ; \ - movq %rbx, %rdi ; \ - testq %rdx, %rcx ; \ - cmoveq %rbp, %r8 ; \ - cmoveq %rbp, %rdi ; \ - sarq $1, %rcx ; \ - xorq %r8, %rdi ; \ - xorq %r8, %rsi ; \ - btq $0x3f, %r8 ; \ - cmovbq %rcx, %rbx ; \ - movq %rax, %r8 ; \ - subq %rax, %rsi ; \ - leaq (%rcx,%rdi), %rcx ; \ - sarq $1, %rcx ; \ - movl $0x100000, %eax ; \ - leaq (%rbx,%rax), %r8 ; \ - leaq (%rcx,%rax), %r12 ; \ - shlq $0x15, %r8 ; \ - shlq $0x15, %r12 ; \ - sarq $0x2b, %r8 ; \ - sarq $0x2b, %r12 ; \ - movabsq $0x20000100000, %rax ; \ - leaq (%rbx,%rax), %r10 ; \ - leaq (%rcx,%rax), %r14 ; \ - sarq $0x2b, %r10 ; \ - sarq $0x2b, %r14 ; \ - movq %r9, %rax ; \ - imulq %r8, %rax ; \ - movq %r13, %rdx ; \ - imulq %r10, %rdx ; \ - imulq %r15, %r8 ; \ - imulq %r11, %r10 ; \ - addq %r8, %r10 ; \ - leaq (%rax,%rdx), %r8 ; \ - movq %r9, %rax ; \ - imulq %r12, %rax ; \ - movq %r13, %rdx ; \ - imulq %r14, %rdx ; \ - imulq %r15, %r12 ; \ - imulq %r11, %r14 ; \ - addq %r12, %r14 ; \ - leaq (%rax,%rdx), %r12 - -S2N_BN_SYMBOL(bignum_montinv_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers and make room for temporaries - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Save the return pointer for the end so we can overwrite %rdi later - - movq %rdi, res - -// Create constant [%rdx;%rcx;%rbx;%rax] = p_sm2 and copy it into the variable f -// including the 5th zero digit - - xorl %ebp, %ebp - leaq -1(%rbp), %rax - movl $0x00000000ffffffff, %ebx - notq %rbx - movq %rax, %rcx - movq %rax, %rdx - btr $32, %rdx - - movq %rax, F(%rsp) - movq %rbx, F+8(%rsp) - movq %rcx, F+16(%rsp) - movq %rdx, F+24(%rsp) - movq %rbp, F+32(%rsp) - -// Now reduce the input modulo p_sm2, first negating the constant to get -// [%rdx;%rcx;%rbx;%rax] = 2^256 - p_sm2, adding it to x and hence getting -// the comparison x < p_sm2 <=> (2^256 - p_sm2) + x < 2^256 and choosing -// g accordingly. - - movq (%rsi), %r8 - movq 8(%rsi), %r9 - movq 16(%rsi), %r10 - movq 24(%rsi), %r11 - - movl $1, %eax - notq %rbx - xorl %ecx, %ecx - notq %rdx - - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - - cmovncq %r8, %rax - cmovncq %r9, %rbx - cmovncq %r10, %rcx - cmovncq %r11, %rdx - - movq %rax, G(%rsp) - movq %rbx, G+8(%rsp) - movq %rcx, G+16(%rsp) - movq %rdx, G+24(%rsp) - xorl %eax, %eax - movq %rax, G+32(%rsp) - -// Also maintain reduced < 2^256 vector [u,v] such that -// [f,g] == x * 2^{5*i-562} * [u,v] (mod p_sm2) -// starting with [p_sm2,x] == x * 2^{5*0-562} * [0,2^562] (mod p_sm2) -// The weird-looking 5*i modifications come in because we are doing -// 64-bit word-sized Montgomery reductions at each stage, which is -// 5 bits more than the 59-bit requirement to keep things stable. -// After the 10th and last iteration and sign adjustment, when -// f == 1 for in-scope cases, we have x * 2^{50-562} * u == 1, i.e. -// x * u == 2^512 as required. - - xorl %eax, %eax - movq %rax, U(%rsp) - movq %rax, U+8(%rsp) - movq %rax, U+16(%rsp) - movq %rax, U+24(%rsp) - - movq $0x000c000000100000, %rax - movq %rax, V(%rsp) - movq $0x000bfffffff80000, %rax - movq %rax, V+8(%rsp) - movq $0x00040000000c0000, %rax - movq %rax, V+16(%rsp) - movq $0x0018000000040000, %rax - movq %rax, V+24(%rsp) - -// Start of main loop. We jump into the middle so that the divstep -// portion is common to the special tenth iteration after a uniform -// first 9. - - movq $10, i - movq $1, d - jmp Lbignum_montinv_sm2_midloop - -Lbignum_montinv_sm2_loop: - -// Separate out the matrix into sign-magnitude pairs - - movq %r8, %r9 - sarq $63, %r9 - xorq %r9, %r8 - subq %r9, %r8 - - movq %r10, %r11 - sarq $63, %r11 - xorq %r11, %r10 - subq %r11, %r10 - - movq %r12, %r13 - sarq $63, %r13 - xorq %r13, %r12 - subq %r13, %r12 - - movq %r14, %r15 - sarq $63, %r15 - xorq %r15, %r14 - subq %r15, %r14 - -// Adjust the initial values to allow for complement instead of negation -// This initial offset is the same for [f,g] and [u,v] compositions. -// Save it in temporary storage for the [u,v] part and do [f,g] first. - - movq %r8, %rax - andq %r9, %rax - movq %r10, %rdi - andq %r11, %rdi - addq %rax, %rdi - movq %rdi, tmp - - movq %r12, %rax - andq %r13, %rax - movq %r14, %rsi - andq %r15, %rsi - addq %rax, %rsi - movq %rsi, tmp2 - -// Now the computation of the updated f and g values. This maintains a -// 2-word carry between stages so we can conveniently insert the shift -// right by 59 before storing back, and not overwrite digits we need -// again of the old f and g values. -// -// Digit 0 of [f,g] - - xorl %ebx, %ebx - movq F(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rdi - adcq %rdx, %rbx - movq G(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rdi - adcq %rdx, %rbx - - xorl %ebp, %ebp - movq F(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rbp - movq G(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - -// Digit 1 of [f,g] - - xorl %ecx, %ecx - movq F+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq G+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - shrdq $59, %rbx, %rdi - movq %rdi, F(%rsp) - - xorl %edi, %edi - movq F+N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rbp - adcq %rdx, %rdi - movq G+N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rdi - shrdq $59, %rbp, %rsi - movq %rsi, G(%rsp) - -// Digit 2 of [f,g] - - xorl %esi, %esi - movq F+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rsi - movq G+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rsi - shrdq $59, %rcx, %rbx - movq %rbx, F+N(%rsp) - - xorl %ebx, %ebx - movq F+2*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - addq %rax, %rdi - adcq %rdx, %rbx - movq G+2*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rdi - adcq %rdx, %rbx - shrdq $59, %rdi, %rbp - movq %rbp, G+N(%rsp) - -// Digits 3 and 4 of [f,g] - - movq F+3*N(%rsp), %rax - xorq %r9, %rax - movq F+4*N(%rsp), %rbp - xorq %r9, %rbp - andq %r8, %rbp - negq %rbp - mulq %r8 - addq %rax, %rsi - adcq %rdx, %rbp - movq G+3*N(%rsp), %rax - xorq %r11, %rax - movq G+4*N(%rsp), %rdx - xorq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbp - mulq %r10 - addq %rax, %rsi - adcq %rdx, %rbp - shrdq $59, %rsi, %rcx - movq %rcx, F+2*N(%rsp) - shrdq $59, %rbp, %rsi - sarq $59, %rbp - - movq F+3*N(%rsp), %rax - movq %rsi, F+3*N(%rsp) - - movq F+4*N(%rsp), %rsi - movq %rbp, F+4*N(%rsp) - - xorq %r13, %rax - xorq %r13, %rsi - andq %r12, %rsi - negq %rsi - mulq %r12 - addq %rax, %rbx - adcq %rdx, %rsi - movq G+3*N(%rsp), %rax - xorq %r15, %rax - movq G+4*N(%rsp), %rdx - xorq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rsi - mulq %r14 - addq %rax, %rbx - adcq %rdx, %rsi - shrdq $59, %rbx, %rdi - movq %rdi, G+2*N(%rsp) - shrdq $59, %rsi, %rbx - movq %rbx, G+3*N(%rsp) - sarq $59, %rsi - movq %rsi, G+4*N(%rsp) - -// Get the initial carries back from storage and do the [u,v] accumulation - - movq tmp, %rbx - movq tmp2, %rbp - -// Digit 0 of [u,v] - - xorl %ecx, %ecx - movq U(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq V(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - - xorl %esi, %esi - movq U(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, U(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq V(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, V(%rsp) - -// Digit 1 of [u,v] - - xorl %ebx, %ebx - movq U+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq V+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rcx - adcq %rdx, %rbx - - xorl %ebp, %ebp - movq U+N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rcx, U+N(%rsp) - addq %rax, %rsi - adcq %rdx, %rbp - movq V+N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rsi - adcq %rdx, %rbp - movq %rsi, V+N(%rsp) - -// Digit 2 of [u,v] - - xorl %ecx, %ecx - movq U+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %rbx - adcq %rdx, %rcx - movq V+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %rbx - adcq %rdx, %rcx - - xorl %esi, %esi - movq U+2*N(%rsp), %rax - xorq %r13, %rax - mulq %r12 - movq %rbx, U+2*N(%rsp) - addq %rax, %rbp - adcq %rdx, %rsi - movq V+2*N(%rsp), %rax - xorq %r15, %rax - mulq %r14 - addq %rax, %rbp - adcq %rdx, %rsi - movq %rbp, V+2*N(%rsp) - -// Digits 3 and 4 of u (top is unsigned) - - movq U+3*N(%rsp), %rax - xorq %r9, %rax - movq %r9, %rbx - andq %r8, %rbx - negq %rbx - mulq %r8 - addq %rax, %rcx - adcq %rdx, %rbx - movq V+3*N(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %rbx - mulq %r10 - addq %rax, %rcx - adcq %rbx, %rdx - -// Preload for last use of old u digit 3 - - movq U+3*N(%rsp), %rax - movq %rcx, U+3*N(%rsp) - movq %rdx, U+4*N(%rsp) - -// Digits 3 and 4 of v (top is unsigned) - - xorq %r13, %rax - movq %r13, %rcx - andq %r12, %rcx - negq %rcx - mulq %r12 - addq %rax, %rsi - adcq %rdx, %rcx - movq V+3*N(%rsp), %rax - xorq %r15, %rax - movq %r15, %rdx - andq %r14, %rdx - subq %rdx, %rcx - mulq %r14 - addq %rax, %rsi - adcq %rcx, %rdx - movq %rsi, V+3*N(%rsp) - movq %rdx, V+4*N(%rsp) - -// Montgomery reduction of u - - amontred(u) - -// Montgomery reduction of v - - amontred(v) - -Lbignum_montinv_sm2_midloop: - - divstep59(d,ff,gg) - movq %rsi, d - -// Next iteration - - decq i - jnz Lbignum_montinv_sm2_loop - -// The 10th and last iteration does not need anything except the -// u value and the sign of f; the latter can be obtained from the -// lowest word of f. So it's done differently from the main loop. -// Find the sign of the new f. For this we just need one digit -// since we know (for in-scope cases) that f is either +1 or -1. -// We don't explicitly shift right by 59 either, but looking at -// bit 63 (or any bit >= 60) of the unshifted result is enough -// to distinguish -1 from +1; this is then made into a mask. - - movq F(%rsp), %rax - movq G(%rsp), %rcx - imulq %r8, %rax - imulq %r10, %rcx - addq %rcx, %rax - sarq $63, %rax - -// Now separate out the matrix into sign-magnitude pairs -// and adjust each one based on the sign of f. -// -// Note that at this point we expect |f|=1 and we got its -// sign above, so then since [f,0] == x * 2^{-512} [u,v] (mod p_sm2) -// we want to flip the sign of u according to that of f. - - movq %r8, %r9 - sarq $63, %r9 - xorq %r9, %r8 - subq %r9, %r8 - xorq %rax, %r9 - - movq %r10, %r11 - sarq $63, %r11 - xorq %r11, %r10 - subq %r11, %r10 - xorq %rax, %r11 - - movq %r12, %r13 - sarq $63, %r13 - xorq %r13, %r12 - subq %r13, %r12 - xorq %rax, %r13 - - movq %r14, %r15 - sarq $63, %r15 - xorq %r15, %r14 - subq %r15, %r14 - xorq %rax, %r15 - -// Adjust the initial value to allow for complement instead of negation - - movq %r8, %rax - andq %r9, %rax - movq %r10, %r12 - andq %r11, %r12 - addq %rax, %r12 - -// Digit 0 of [u] - - xorl %r13d, %r13d - movq U(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r12 - adcq %rdx, %r13 - movq V(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r12 - adcq %rdx, %r13 - -// Digit 1 of [u] - - xorl %r14d, %r14d - movq U+N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r13 - adcq %rdx, %r14 - movq V+N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r13 - adcq %rdx, %r14 - -// Digit 2 of [u] - - xorl %r15d, %r15d - movq U+2*N(%rsp), %rax - xorq %r9, %rax - mulq %r8 - addq %rax, %r14 - adcq %rdx, %r15 - movq V+2*N(%rsp), %rax - xorq %r11, %rax - mulq %r10 - addq %rax, %r14 - adcq %rdx, %r15 - -// Digits 3 and 4 of u (top is unsigned) - - movq U+3*N(%rsp), %rax - xorq %r9, %rax - andq %r8, %r9 - negq %r9 - mulq %r8 - addq %rax, %r15 - adcq %rdx, %r9 - movq V+3*N(%rsp), %rax - xorq %r11, %rax - movq %r11, %rdx - andq %r10, %rdx - subq %rdx, %r9 - mulq %r10 - addq %rax, %r15 - adcq %rdx, %r9 - -// Store back and Montgomery reduce u - - movq %r12, U(%rsp) - movq %r13, U+N(%rsp) - movq %r14, U+2*N(%rsp) - movq %r15, U+3*N(%rsp) - movq %r9, U+4*N(%rsp) - - amontred(u) - -// Perform final strict reduction mod p_sm2 and copy to output - - movq U(%rsp), %r8 - movq U+N(%rsp), %r9 - movq U+2*N(%rsp), %r10 - movq U+3*N(%rsp), %r11 - - movl $1, %eax - movl $0x00000000ffffffff, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - bts $32, %rdx - - addq %r8, %rax - adcq %r9, %rbx - adcq %r10, %rcx - adcq %r11, %rdx - - cmovncq %r8, %rax - cmovncq %r9, %rbx - cmovncq %r10, %rcx - cmovncq %r11, %rdx - - movq res, %rdi - movq %rax, (%rdi) - movq %rbx, N(%rdi) - movq %rcx, 2*N(%rdi) - movq %rdx, 3*N(%rdi) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montinv_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montmul_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montmul_sm2.S deleted file mode 100644 index 65ee0117fd9..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montmul_sm2.S +++ /dev/null @@ -1,216 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_sm2 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_sm2(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_sm2, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_sm2 (in particular this is true if we are in -// the "usual" case x < p_sm2 and y < p_sm2). -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_sm2) - .text - -#define z %rdi -#define x %rsi - -// We move the y argument here so we can use %rdx for multipliers - -#define y %rcx - -// Use this fairly consistently for a zero - -#define zero %rbp -#define zeroe %ebp - -// mulpadd(high,low,m) adds %rdx * m to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rbx as temporaries. - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rbx ; \ - adcxq %rax, low ; \ - adoxq %rbx, high - -// mulpade(high,low,m) adds %rdx * m to a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax as a temporary, assuming high created from scratch -// and that zero has value zero. - -#define mulpade(high,low,m) \ - mulxq m, %rax, high ; \ - adcxq %rax, low ; \ - adoxq zero, high - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d0;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1], and using %rax, %rcx, %rdx and %rbx -// as temporaries. -// --------------------------------------------------------------------------- - -#define montreds(d3,d2,d1,d0) \ - movq d0, %rax ; \ - shlq $32, %rax ; \ - movq d0, %rcx ; \ - shrq $32, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq d0, %rax ; \ - sbbq $0, %rcx ; \ - subq %rax, d1 ; \ - sbbq %rcx, d2 ; \ - sbbq %rdx, d3 ; \ - sbbq %rbx, d0 - -S2N_BN_SYMBOL(bignum_montmul_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Zero a register, which also makes sure we don't get a fake carry-in - - xorl zeroe, zeroe - -// Do the zeroth row, which is a bit different - - movq (y), %rdx - - mulxq (x), %r8, %r9 - mulxq 8(x), %rax, %r10 - addq %rax, %r9 - mulxq 16(x), %rax, %r11 - adcq %rax, %r10 - mulxq 24(x), %rax, %r12 - adcq %rax, %r11 - adcq zero, %r12 - -// Add row 1 - - xorl zeroe, zeroe - movq 8(y), %rdx - mulpadd(%r10,%r9,(x)) - mulpadd(%r11,%r10,8(x)) - mulpadd(%r12,%r11,16(x)) - mulpade(%r13,%r12,24(x)) - adcxq zero, %r13 - -// Add row 2 - - xorl zeroe, zeroe - movq 16(y), %rdx - mulpadd(%r11,%r10,(x)) - mulpadd(%r12,%r11,8(x)) - mulpadd(%r13,%r12,16(x)) - mulpade(%r14,%r13,24(x)) - adcxq zero, %r14 - -// Add row 3 - - xorl zeroe, zeroe - movq 24(y), %rdx - mulpadd(%r12,%r11,(x)) - mulpadd(%r13,%r12,8(x)) - mulpadd(%r14,%r13,16(x)) - mulpade(%r15,%r14,24(x)) - adcxq zero, %r15 - -// Multiplication complete. Perform 4 Montgomery steps to rotate the lower half - - montreds(%r11,%r10,%r9,%r8) - montreds(%r8,%r11,%r10,%r9) - montreds(%r9,%r8,%r11,%r10) - montreds(%r10,%r9,%r8,%r11) - -// Add high and low parts, catching carry in %rax - - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - -// Load [%r8;%r11;%rbp;%rdx;%rcx] = 2^320 - p_sm2 then do -// [%r8;%r11;%rbp;%rdx;%rcx] = [%rax;%r15;%r14;%r13;%r12] + (2^320 - p_sm2) - - movl $1, %ecx - movl $0x00000000FFFFFFFF, %edx - xorl %ebp, %ebp - addq %r12, %rcx - leaq 1(%rdx), %r11 - adcq %r13, %rdx - leaq -1(%rbp), %r8 - adcq %r14, %rbp - adcq %r15, %r11 - adcq %rax, %r8 - -// Now carry is set if r + (2^320 - p_sm2) >= 2^320, i.e. r >= p_sm2 -// where r is the pre-reduced form. So conditionally select the -// output accordingly. - - cmovcq %rcx, %r12 - cmovcq %rdx, %r13 - cmovcq %rbp, %r14 - cmovcq %r11, %r15 - -// Write back reduced value - - movq %r12, (z) - movq %r13, 8(z) - movq %r14, 16(z) - movq %r15, 24(z) - -// Restore saved registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montmul_sm2_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montmul_sm2_alt.S deleted file mode 100644 index 0a467ab1df0..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montmul_sm2_alt.S +++ /dev/null @@ -1,219 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery multiply, z := (x * y / 2^256) mod p_sm2 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_montmul_sm2_alt(uint64_t z[static 4], -// const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Does z := (2^{-256} * x * y) mod p_sm2, assuming that the inputs x and y -// satisfy x * y <= 2^256 * p_sm2 (in particular this is true if we are in -// the "usual" case x < p_sm2 and y < p_sm2). -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montmul_sm2_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montmul_sm2_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montmul_sm2_alt) - .text - -#define z %rdi -#define x %rsi - -// We move the y argument here so we can use %rdx for multipliers - -#define y %rcx - -// Macro for the key "multiply and add to (c,h,l)" step - -#define combadd(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq $0, c - -// A minutely shorter form for when c = 0 initially - -#define combadz(c,h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h ; \ - adcq c, c - -// A short form where we don't expect a top carry - -#define combads(h,l,numa,numb) \ - movq numa, %rax ; \ - mulq numb; \ - addq %rax, l ; \ - adcq %rdx, h - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d0;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1], and using %rax, %rcx, %rdx and %rbx -// as temporaries. -// --------------------------------------------------------------------------- - -#define montreds(d3,d2,d1,d0) \ - movq d0, %rax ; \ - shlq $32, %rax ; \ - movq d0, %rcx ; \ - shrq $32, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq d0, %rax ; \ - sbbq $0, %rcx ; \ - subq %rax, d1 ; \ - sbbq %rcx, d2 ; \ - sbbq %rdx, d3 ; \ - sbbq %rbx, d0 - -S2N_BN_SYMBOL(bignum_montmul_sm2_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Copy y into a safe register to start with - - movq %rdx, y - -// Start the window as [%r10;%r9;%r8] with 00 product - - movq (x), %rax - mulq (y) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - -// Column 1 - - xorq %r11, %r11 - combads(%r10,%r9,(x),8(y)) - combadz(%r11,%r10,%r9,8(x),(y)) - -// Column 2 - - xorq %r12, %r12 - combadz(%r12,%r11,%r10,(x),16(y)) - combadd(%r12,%r11,%r10,8(x),8(y)) - combadd(%r12,%r11,%r10,16(x),(y)) - -// Column 3 - - xorq %r13, %r13 - combadz(%r13,%r12,%r11,(x),24(y)) - combadd(%r13,%r12,%r11,8(x),16(y)) - combadd(%r13,%r12,%r11,16(x),8(y)) - combadd(%r13,%r12,%r11,24(x),(y)) - -// Column 4 - - xorq %r14, %r14 - combadz(%r14,%r13,%r12,8(x),24(y)) - combadd(%r14,%r13,%r12,16(x),16(y)) - combadd(%r14,%r13,%r12,24(x),8(y)) - -// Column 5 - - xorq %r15, %r15 - combadz(%r15,%r14,%r13,16(x),24(y)) - combadd(%r15,%r14,%r13,24(x),16(y)) - -// Final work for columns 6 and 7 - - movq 24(x), %rax - mulq 24(y) - addq %rax, %r14 - adcq %rdx, %r15 - -// Multiplication complete. Perform 4 Montgomery steps to rotate the lower half - - montreds(%r11,%r10,%r9,%r8) - montreds(%r8,%r11,%r10,%r9) - montreds(%r9,%r8,%r11,%r10) - montreds(%r10,%r9,%r8,%r11) - -// Add high and low parts, catching carry in %rax - - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - -// Load [%r8;%r11;%rbx;%rdx;%rcx] = 2^320 - p_sm2 then do -// [%r8;%r11;%rbx;%rdx;%rcx] = [%rax;%r15;%r14;%r13;%r12] + (2^320 - p_sm2) - - movl $1, %ecx - movl $0x00000000FFFFFFFF, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 1(%rdx), %r11 - adcq %r13, %rdx - leaq -1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - -// Now carry is set if r + (2^320 - p_sm2) >= 2^320, i.e. r >= p_sm2 -// where r is the pre-reduced form. So conditionally select the -// output accordingly. - - cmovcq %rcx, %r12 - cmovcq %rdx, %r13 - cmovcq %rbx, %r14 - cmovcq %r11, %r15 - -// Write back reduced value - - movq %r12, (z) - movq %r13, 8(z) - movq %r14, 16(z) - movq %r15, 24(z) - -// Restore saved registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montmul_sm2_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montsqr_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montsqr_sm2.S deleted file mode 100644 index febf99ef4fa..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montsqr_sm2.S +++ /dev/null @@ -1,198 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_sm2(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_sm2, assuming x^2 <= 2^256 * p_sm2, which is -// guaranteed in particular if x < p_sm2 initially (the "intended" case). -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_sm2) - .text - -#define z %rdi -#define x %rsi - -// Use this fairly consistently for a zero - -#define zero %rbp -#define zeroe %ebp - -// Add %rdx * m into a register-pair (high,low) -// maintaining consistent double-carrying with adcx and adox, -// using %rax and %rbx as temporaries - -#define mulpadd(high,low,m) \ - mulxq m, %rax, %rbx ; \ - adcxq %rax, low ; \ - adoxq %rbx, high - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d0;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1], and using %rax, %rcx, %rdx and %rbx -// as temporaries. -// --------------------------------------------------------------------------- - -#define montreds(d3,d2,d1,d0) \ - movq d0, %rax ; \ - shlq $32, %rax ; \ - movq d0, %rcx ; \ - shrq $32, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq d0, %rax ; \ - sbbq $0, %rcx ; \ - subq %rax, d1 ; \ - sbbq %rcx, d2 ; \ - sbbq %rdx, d3 ; \ - sbbq %rbx, d0 - -S2N_BN_SYMBOL(bignum_montsqr_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Compute [%r15;%r8] = [00] which we use later, but mainly -// set up an initial window [%r14;...;%r9] = [23;03;01] - - movq (x), %rdx - mulxq %rdx, %r8, %r15 - mulxq 8(x), %r9, %r10 - mulxq 24(x), %r11, %r12 - movq 16(x), %rdx - mulxq 24(x), %r13, %r14 - -// Clear our zero register, and also initialize the flags for the carry chain - - xorl zeroe, zeroe - -// Chain in the addition of 02 + 12 + 13 to that window (no carry-out possible) -// This gives all the "heterogeneous" terms of the squaring ready to double - - mulpadd(%r11,%r10,(x)) - mulpadd(%r12,%r11,8(x)) - movq 24(x), %rdx - mulpadd(%r13,%r12,8(x)) - adcxq zero, %r13 - adoxq zero, %r14 - adcq zero, %r14 - -// Double and add to the 00 + 11 + 22 + 33 terms - - xorl zeroe, zeroe - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 8(x), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 16(x), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 24(x), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq zero, %r15 - adoxq zero, %r15 - -// Squaring complete. Perform 4 Montgomery steps to rotate the lower half - - montreds(%r11,%r10,%r9,%r8) - montreds(%r8,%r11,%r10,%r9) - montreds(%r9,%r8,%r11,%r10) - montreds(%r10,%r9,%r8,%r11) - -// Add high and low parts, catching carry in %rax - - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - -// Load [%r8;%r11;%rbp;%rdx;%rcx] = 2^320 - p_sm2 then do -// [%r8;%r11;%rbp;%rdx;%rcx] = [%rax;%r15;%r14;%r13;%r12] + (2^320 - p_sm2) - - movl $1, %ecx - movl $0x00000000FFFFFFFF, %edx - xorl %ebp, %ebp - addq %r12, %rcx - leaq 1(%rdx), %r11 - adcq %r13, %rdx - leaq -1(%rbp), %r8 - adcq %r14, %rbp - adcq %r15, %r11 - adcq %rax, %r8 - -// Now carry is set if r + (2^320 - p_sm2) >= 2^320, i.e. r >= p_sm2 -// where r is the pre-reduced form. So conditionally select the -// output accordingly. - - cmovcq %rcx, %r12 - cmovcq %rdx, %r13 - cmovcq %rbp, %r14 - cmovcq %r11, %r15 - -// Write back reduced value - - movq %r12, (z) - movq %r13, 8(z) - movq %r14, 16(z) - movq %r15, 24(z) - -// Restore saved registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montsqr_sm2_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montsqr_sm2_alt.S deleted file mode 100644 index d8b16876a37..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_montsqr_sm2_alt.S +++ /dev/null @@ -1,227 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery square, z := (x^2 / 2^256) mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_montsqr_sm2_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// Does z := (x^2 / 2^256) mod p_sm2, assuming x^2 <= 2^256 * p_sm2, which is -// guaranteed in particular if x < p_sm2 initially (the "intended" case). -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_montsqr_sm2_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_montsqr_sm2_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_montsqr_sm2_alt) - .text - -#define z %rdi -#define x %rsi - -// Add %rbx * m into a register-pair (high,low) maintaining consistent -// carry-catching with carry (negated, as bitmask) and using %rax and %rdx -// as temporaries - -#define mulpadd(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rbx; \ - subq carry, %rdx ; \ - addq %rax, low ; \ - adcq %rdx, high ; \ - sbbq carry, carry - -// Initial version assuming no carry-in - -#define mulpadi(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rbx; \ - addq %rax, low ; \ - adcq %rdx, high ; \ - sbbq carry, carry - -// End version not catching the top carry-out - -#define mulpade(carry,high,low,m) \ - movq m, %rax ; \ - mulq %rbx; \ - subq carry, %rdx ; \ - addq %rax, low ; \ - adcq %rdx, high - -// --------------------------------------------------------------------------- -// Core one-step "short" Montgomery reduction macro. Takes input in -// [d3;d2;d1;d0] and returns result in [d0;d3;d2;d1], adding to the -// existing contents of [d3;d2;d1], and using %rax, %rcx, %rdx and %rbx -// as temporaries. -// --------------------------------------------------------------------------- - -#define montreds(d3,d2,d1,d0) \ - movq d0, %rax ; \ - shlq $32, %rax ; \ - movq d0, %rcx ; \ - shrq $32, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq d0, %rax ; \ - sbbq $0, %rcx ; \ - subq %rax, d1 ; \ - sbbq %rcx, d2 ; \ - sbbq %rdx, d3 ; \ - sbbq %rbx, d0 - -S2N_BN_SYMBOL(bignum_montsqr_sm2_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save more registers to play with - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - -// Compute [%r15;%r8] = [00] which we use later, but mainly -// set up an initial window [%r14;...;%r9] = [23;03;01] - - movq (x), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 8(x), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 24(x), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 16(x), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - -// Chain in the addition of 02 + 12 + 13 to that window (no carry-out possible) -// This gives all the "heterogeneous" terms of the squaring ready to double - - mulpadi(%rcx,%r11,%r10,(x)) - mulpadd(%rcx,%r12,%r11,8(x)) - movq 24(x), %rbx - mulpade(%rcx,%r13,%r12,8(x)) - adcq $0, %r14 - -// Double the window [%r14;...;%r9], catching top carry in %rcx - - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - -// Add to the 00 + 11 + 22 + 33 terms - - movq 8(x), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 16(x), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 24(x), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - -// Squaring complete. Perform 4 Montgomery steps to rotate the lower half - - montreds(%r11,%r10,%r9,%r8) - montreds(%r8,%r11,%r10,%r9) - montreds(%r9,%r8,%r11,%r10) - montreds(%r10,%r9,%r8,%r11) - -// Add high and low parts, catching carry in %rax - - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - -// Load [%r8;%r11;%rbx;%rdx;%rcx] = 2^320 - p_sm2 then do -// [%r8;%r11;%rbx;%rdx;%rcx] = [%rax;%r15;%r14;%r13;%r12] + (2^320 - p_sm2) - - movl $1, %ecx - movl $0x00000000FFFFFFFF, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 1(%rdx), %r11 - adcq %r13, %rdx - leaq -1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - -// Now carry is set if r + (2^320 - p_sm2) >= 2^320, i.e. r >= p_sm2 -// where r is the pre-reduced form. So conditionally select the -// output accordingly. - - cmovcq %rcx, %r12 - cmovcq %rdx, %r13 - cmovcq %rbx, %r14 - cmovcq %r11, %r15 - -// Write back reduced value - - movq %r12, (z) - movq %r13, 8(z) - movq %r14, 16(z) - movq %r15, 24(z) - -// Restore saved registers and return - - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_montsqr_sm2_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_neg_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_neg_sm2.S deleted file mode 100644 index 1133939d06a..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_neg_sm2.S +++ /dev/null @@ -1,94 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Negate modulo p_sm2, z := (-x) mod p_sm2, assuming x reduced -// Input x[4]; output z[4] -// -// extern void bignum_neg_sm2(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_neg_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_neg_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_neg_sm2) - .text - -#define z %rdi -#define x %rsi - -#define q %rdx - -#define d0 %rax -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n1 %r10 -#define n3 %r11 - -S2N_BN_SYMBOL(bignum_neg_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the input digits as [d3;d2;d1;d0] and also set a bitmask q -// for the input being nonzero, so that we avoid doing -0 = p_sm2 -// and hence maintain strict modular reduction - - movq (x), d0 - movq 8(x), d1 - movq d0, n1 - orq d1, n1 - movq 16(x), d2 - movq 24(x), d3 - movq d2, n3 - orq d3, n3 - orq n1, n3 - negq n3 - sbbq q, q - -// Load the non-trivial words of p_sm2 = [n3;-1;n1;-1] and mask them with q - - movq $0xffffffff00000000, n1 - movq $0xfffffffeffffffff, n3 - andq q, n1 - andq q, n3 - -// Do the subtraction, using an xor for the first digit and getting the -// overall result as [n3;q;n1;d0], all these tweaks just to avoid moves - - xorq q, d0 - subq d1, n1 - sbbq d2, q - sbbq d3, n3 - -// Write back - - movq d0, (z) - movq n1, 8(z) - movq q, 16(z) - movq n3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_neg_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_optneg_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_optneg_sm2.S deleted file mode 100644 index af987bc7a55..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_optneg_sm2.S +++ /dev/null @@ -1,104 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Optionally negate modulo p_sm2, z := (-x) mod p_sm2 (if p nonzero) or -// z := x (if p zero), assuming x reduced -// Inputs p, x[4]; output z[4] -// -// extern void bignum_optneg_sm2(uint64_t z[static 4], uint64_t p, -// const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = p, RDX = x -// Microsoft x64 ABI: RCX = z, RDX = p, R8 = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_optneg_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_optneg_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_optneg_sm2) - .text - -#define z %rdi -#define q %rsi -#define x %rdx - -#define n0 %rax -#define n1 %rcx -#define n2 %r8 -#define n3 %r9 - -S2N_BN_SYMBOL(bignum_optneg_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Adjust q by zeroing it if the input is zero (to avoid giving -0 = p_sm2, -// which is not strictly reduced even though it's correct modulo p_sm2). -// This step is redundant if we know a priori that the input is nonzero, which -// is the case for the y coordinate of points on the SM2 curve, for example. - - movq (x), n0 - orq 8(x), n0 - movq 16(x), n1 - orq 24(x), n1 - orq n1, n0 - negq n0 - sbbq n0, n0 - andq n0, q - -// Turn q into a bitmask, all 1s for q=false, all 0s for q=true - - negq q - sbbq q, q - notq q - -// Let [n3;n2;n1;n0] = if q then p_sm2 else -1 - - movq $0xffffffffffffffff, n0 - movq $0xffffffff00000000, n1 - orq q, n1 - movq n0, n2 - movq $0xfffffffeffffffff, n3 - orq q, n3 - -// Subtract so [n3;n2;n1;n0] = if q then p_sm2 - x else -1 - x - - subq (x), n0 - sbbq 8(x), n1 - sbbq 16(x), n2 - sbbq 24(x), n3 - -// XOR the words with the bitmask, which in the case q = false has the -// effect of restoring ~(-1 - x) = -(-1 - x) - 1 = 1 + x - 1 = x -// and write back the digits to the output - - xorq q, n0 - movq n0, (z) - xorq q, n1 - movq n1, 8(z) - xorq q, n2 - movq n2, 16(z) - xorq q, n3 - movq n3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_optneg_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_sub_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_sub_sm2.S deleted file mode 100644 index 0f3832b6a9e..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_sub_sm2.S +++ /dev/null @@ -1,93 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Subtract modulo p_sm2, z := (x - y) mod p_sm2 -// Inputs x[4], y[4]; output z[4] -// -// extern void bignum_sub_sm2(uint64_t z[static 4], const uint64_t x[static 4], -// const uint64_t y[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y -// Microsoft x64 ABI: RCX = z, RDX = x, R8 = y -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sub_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sub_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sub_sm2) - .text - -#define z %rdi -#define x %rsi -#define y %rdx - -#define d0 %rax -#define d1 %rcx -#define d2 %r8 -#define d3 %r9 - -#define n1 %r10 -#define n3 %rdx -#define c %r11 - -#define n1short %r10d - - - -S2N_BN_SYMBOL(bignum_sub_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Load and subtract the two inputs as [d3;d2;d1;d0] = x - y (modulo 2^256) - - movq (x), d0 - subq (y), d0 - movq 8(x), d1 - sbbq 8(y), d1 - movq 16(x), d2 - sbbq 16(y), d2 - movq 24(x), d3 - sbbq 24(y), d3 - -// Capture the carry, which indicates x < y, and create corresponding masked -// correction p_sm2' = [n3; c; n1; c] to add - - movq $0xffffffff00000000, n1 - sbbq c, c - andq c, n1 - movq c, n3 - btr $32, n3 - -// Do the corrective addition and copy to output - - addq c, d0 - movq d0, (z) - adcq n1, d1 - movq d1, 8(z) - adcq c, d2 - movq d2, 16(z) - adcq n3, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_sub_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_tomont_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_tomont_sm2.S deleted file mode 100644 index 2d204338edd..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_tomont_sm2.S +++ /dev/null @@ -1,147 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Convert to Montgomery form z := (2^256 * x) mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_tomont_sm2(uint64_t z[static 4], const uint64_t x[static 4]); -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_tomont_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_tomont_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_tomont_sm2) - .text - -#define z %rdi -#define x %rsi - -#define m0 %r8 -#define m1 %r9 -#define m2 %r10 -#define m3 %r11 - -#define q %rax -#define n1 %rcx -#define n3 %rdx -#define qshort %eax - -// ---------------------------------------------------------------------------- -// Core "x |-> (2^64 * x) mod p_sm2" macro, with x assumed to be < p_sm2. -// Input is [d3;d2;d1;d0] and output is [d2;d1;d0;q] where q is a fixed -// quotient estimate register (%rax), so the registers get shuffled. -// ---------------------------------------------------------------------------- - -#define modstep_sm2(d3,d2,d1,d0) \ -/* Writing the input, with lower zero digit appended, as */ \ -/* z = 2^256 * d3 + 2^192 * d2 + t, quotient approximation is */ \ -/* MIN ((d3 * (1 + 2^32 + 2^64) + d2 + 2^64) >> 64) (2^64 - 1) */ \ - movq d2, n1 ; \ - movl $1, qshort ; \ - addq d3, n1 ; \ - adcq d3, q ; \ - shrq $32, n1 ; \ - addq d3, n1 ; \ - shrq $32, n1 ; \ - addq n1, q ; \ - sbbq $0, q ; \ -/* Compute the pre-reduced [d3;d2;d1;d0;q] = m - p_sm2 * q */ \ -/* = z - (2^256 - 2^224 - 2^96 + 2^64 - 1) * q */ \ - movq q, n1 ; \ - movq q, n3 ; \ - shlq $32, n1 ; \ - shrq $32, n3 ; \ - addq n1, d2 ; \ - adcq n3, d3 ; \ - subq q, n1 ; \ - sbbq $0, n3 ; \ - subq q, d3 ; \ - addq n1, d0 ; \ - adcq n3, d1 ; \ - adcq $0, d2 ; \ - adcq $0, d3 ; \ -/* Corrective addition with top word d3 as a bitmask */ \ - movq $0xffffffff00000000, n1 ; \ - andq d3, n1 ; \ - movq $0xfffffffeffffffff, n3 ; \ - andq d3, n3 ; \ - addq d3, q ; \ - adcq n1, d0 ; \ - adcq d3, d1 ; \ - adcq n3, d2 - -S2N_BN_SYMBOL(bignum_tomont_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Load the inputs - - movq (x), m0 - movq 8(x), m1 - movq 16(x), m2 - movq 24(x), m3 - -// Load non-trivial digits [n3; -1; n1; -1] = p_sm2 and do a conditional -// subtraction to reduce the four starting digits [m3;m2;m1;m0] modulo p_sm2 - - subq $-1, m0 - movq $0xffffffff00000000, n1 - sbbq n1, m1 - movq $0xfffffffeffffffff, n3 - sbbq $-1, m2 - sbbq n3, m3 - sbbq q, q - andq q, n1 - andq q, n3 - addq q, m0 - adcq n1, m1 - adcq q, m2 - adcq n3, m3 - -// Now do 4 iterations of 5->4 word modular reduction - - modstep_sm2(m3,m2,m1,m0) - - movq q, m3 - - modstep_sm2(m2,m1,m0,m3) - - movq q, m2 - - modstep_sm2(m1,m0,m3,m2) - - movq q, m1 - - modstep_sm2(m0,m3,m2,m1) - -// Write back result and return - - movq q, (z) - movq m1, 8(z) - movq m2, 16(z) - movq m3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_tomont_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_triple_sm2.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_triple_sm2.S deleted file mode 100644 index 0ca30d3b82b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_triple_sm2.S +++ /dev/null @@ -1,131 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_sm2, z := (3 * x) mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_triple_sm2(uint64_t z[static 4], const uint64_t x[static 4]); -// -// The input x can be any 4-digit bignum, not necessarily reduced modulo p_sm2, -// and the result is always fully reduced, i.e. z = (3 * x) mod p_sm2. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_sm2) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_sm2) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_sm2) - .text - -#define z %rdi -#define x %rsi - -// Main digits of intermediate results - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -// Quotient estimate = top of product + 1 - -#define q %rdx -#define h %rdx -#define qshort %edx - -// Other temporary variables and their short version - -#define a %rax -#define c %rcx - -#define ashort %eax - -S2N_BN_SYMBOL(bignum_triple_sm2): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// First do the multiplication by 3, getting z = [h; d3; ...; d0] -// but immediately form the quotient estimate q = h + 1 - - xorl ashort, ashort - - movq (x), q - movq q, d0 - adcxq q, q - adoxq q, d0 - movq 8(x), q - movq q, d1 - adcxq q, q - adoxq q, d1 - movq 16(x), q - movq q, d2 - adcxq q, q - adoxq q, d2 - movq 24(x), q - movq q, d3 - adcxq q, q - adoxq q, d3 - -// For this limited range a simple quotient estimate of q = h + 1 works, where -// h = floor(z / 2^256). Then -p_sm2 <= z - q * p_sm2 < p_sm2, so we just need -// to subtract q * p_sm2 and then if that's negative, add back p_sm2. - - movl $1, qshort - adcxq a, q - adoxq a, q - -// Now compute the initial pre-reduced [h;d3;d2;d1;d0] = z - p_sm2 * q -// = z - (2^256 - 2^224 - 2^96 + 2^64 - 1) * q - - movq q, a - shlq $32, a - movq a, c - subq q, a - - addq q, d0 - adcq a, d1 - adcq $0, d2 - adcq c, d3 - sbbq h, h - notq h - -// Now our top word h is either zero or all 1s, and we use this to discriminate -// whether a correction is needed because our result is negative, as a bitmask -// Do a masked addition of p_sm2 - - movq $0xffffffff00000000, a - andq h, a - movq $0xfffffffeffffffff, c - andq h, c - addq h, d0 - movq d0, (z) - adcq a, d1 - movq d1, 8(z) - adcq h, d2 - movq d2, 16(z) - adcq c, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_sm2) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_triple_sm2_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_triple_sm2_alt.S deleted file mode 100644 index b32ee473635..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/bignum_triple_sm2_alt.S +++ /dev/null @@ -1,135 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Triple modulo p_sm2, z := (3 * x) mod p_sm2 -// Input x[4]; output z[4] -// -// extern void bignum_triple_sm2_alt(uint64_t z[static 4], -// const uint64_t x[static 4]); -// -// The input x can be any 4-digit bignum, not necessarily reduced modulo p_sm2, -// and the result is always fully reduced, i.e. z = (3 * x) mod p_sm2. -// -// Standard x86-64 ABI: RDI = z, RSI = x -// Microsoft x64 ABI: RCX = z, RDX = x -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_triple_sm2_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_triple_sm2_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_triple_sm2_alt) - .text - -#define z %rdi -#define x %rsi - -// Main digits of intermediate results - -#define d0 %r8 -#define d1 %r9 -#define d2 %r10 -#define d3 %r11 - -// Quotient estimate = top of product + 1 - -#define q %rdx -#define h %rdx - -// Other temporary variables and their short version - -#define a %rax -#define c %rcx -#define d %rdx - -#define ashort %eax -#define cshort %ecx - -S2N_BN_SYMBOL(bignum_triple_sm2_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// First do the multiplication by 3, getting z = [h; d3; ...; d0] -// but immediately form the quotient estimate q = h + 1 - - movl $3, cshort - - movq (x), a - mulq c - movq a, d0 - movq d, d1 - - movq 8(x), a - xorq d2, d2 - mulq c - addq a, d1 - adcq d, d2 - - movq 16(x), a - xorq d3, d3 - mulq c - addq a, d2 - adcq d, d3 - - movq 24(x), a - mulq c - addq a, d3 - -// For this limited range a simple quotient estimate of q = h + 1 works, where -// h = floor(z / 2^256). Then -p_sm2 <= z - q * p_sm2 < p_sm2, so we just need -// to subtract q * p_sm2 and then if that's negative, add back p_sm2. - - adcq $1, q - -// Now compute the initial pre-reduced [h;d3;d2;d1;d0] = z - p_sm2 * q -// = z - (2^256 - 2^224 - 2^96 + 2^64 - 1) * q - - movq q, a - shlq $32, a - movq a, c - subq q, a - - addq q, d0 - adcq a, d1 - adcq $0, d2 - adcq c, d3 - sbbq h, h - notq h - -// Now our top word h is either zero or all 1s, and we use this to discriminate -// whether a correction is needed because our result is negative, as a bitmask -// Do a masked addition of p_sm2 - - movq $0xffffffff00000000, a - andq h, a - movq $0xfffffffeffffffff, c - andq h, c - addq h, d0 - movq d0, (z) - adcq a, d1 - movq d1, 8(z) - adcq h, d2 - movq d2, 16(z) - adcq c, d3 - movq d3, 24(z) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(bignum_triple_sm2_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack,"",%progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjadd.S deleted file mode 100644 index ee210a3fe50..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjadd.S +++ /dev/null @@ -1,625 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on GM/T 0003-2012 curve SM2 in Montgomery-Jacobian coordinates -// -// extern void sm2_montjadd(uint64_t p3[static 12], const uint64_t p1[static 12], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_sm2. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjadd) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rbp = p2, -// which needs to be set up explicitly before use. -// By design, none of the code macros modify any of -// these, so we maintain the assignments throughout. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rbp) -#define y_2 NUMSIZE(%rbp) -#define z_2 (2*NUMSIZE)(%rbp) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z1sq (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define x1a (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define z2sq (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define y1a (NUMSIZE*6)(%rsp) - -#define NSPACE NUMSIZE*7 - -// Corresponds to bignum_montmul_sm2 except for registers - -#define montmul_sm2(P0,P1,P2) \ - xorl %ecx, %ecx ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rcx, %r12 ; \ - xorl %ecx, %ecx ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rcx, %r13 ; \ - xorl %ecx, %ecx ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcxq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rcx, %r15 ; \ - adcxq %rcx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - xorl %eax, %eax ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - adcq %rax, %rax ; \ - movl $0x1, %ecx ; \ - movl $0xffffffff, %edx ; \ - xorl %ebx, %ebx ; \ - addq %r12, %rcx ; \ - leaq 0x1(%rdx), %r11 ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbx), %r8 ; \ - adcq %r14, %rbx ; \ - adcq %r15, %r11 ; \ - adcq %rax, %r8 ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds to bignum_montsqr_sm2 except for registers - -#define montsqr_sm2(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ecx, %ecx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - xorl %eax, %eax ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - adcq %rax, %rax ; \ - movl $0x1, %ecx ; \ - movl $0xffffffff, %edx ; \ - xorl %ebx, %ebx ; \ - addq %r12, %rcx ; \ - leaq 0x1(%rdx), %r11 ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbx), %r8 ; \ - adcq %r14, %rbx ; \ - adcq %r15, %r11 ; \ - adcq %rax, %r8 ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Almost-Montgomery variant which we use when an input to other muls -// with the other argument fully reduced (which is always safe). - -#define amontsqr_sm2(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ecx, %ecx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - sbbq %rax, %rax ; \ - movq $0xffffffff00000000, %rbx ; \ - movq %rax, %rcx ; \ - andq %rax, %rbx ; \ - btr $32, %rcx ; \ - subq %rax, %r12 ; \ - sbbq %rbx, %r13 ; \ - sbbq %rax, %r14 ; \ - sbbq %rcx, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_sub_sm2 - -#define sub_sm2(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - sbbq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq $0xffffffff00000000, %r10 ; \ - sbbq %r11, %r11 ; \ - andq %r11, %r10 ; \ - movq %r11, %rdx ; \ - btr $0x20, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq %r11, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// Additional macros to help with final multiplexing - -#define load4(r0,r1,r2,r3,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 - -#define store4(P,r0,r1,r2,r3) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P - -#define czload4(r0,r1,r2,r3,P) \ - cmovzq P, r0 ; \ - cmovzq 8+P, r1 ; \ - cmovzq 16+P, r2 ; \ - cmovzq 24+P, r3 - -#define muxload4(r0,r1,r2,r3,P0,P1,P2) \ - movq P0, r0 ; \ - cmovbq P1, r0 ; \ - cmovnbe P2, r0 ; \ - movq 8+P0, r1 ; \ - cmovbq 8+P1, r1 ; \ - cmovnbe 8+P2, r1 ; \ - movq 16+P0, r2 ; \ - cmovbq 16+P1, r2 ; \ - cmovnbe 16+P2, r2 ; \ - movq 24+P0, r3 ; \ - cmovbq 24+P1, r3 ; \ - cmovnbe 24+P2, r3 - -S2N_BN_SYMBOL(sm2_montjadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input y in %rbp where it lasts throughout the main code. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdx, %rbp - -// Main code, just a sequence of basic field operations -// 12 * multiply + 4 * square + 7 * subtract - - amontsqr_sm2(z1sq,z_1) - amontsqr_sm2(z2sq,z_2) - - montmul_sm2(y1a,z_2,y_1) - montmul_sm2(y2a,z_1,y_2) - - montmul_sm2(x2a,z1sq,x_2) - montmul_sm2(x1a,z2sq,x_1) - montmul_sm2(y2a,z1sq,y2a) - montmul_sm2(y1a,z2sq,y1a) - - sub_sm2(xd,x2a,x1a) - sub_sm2(yd,y2a,y1a) - - amontsqr_sm2(zz,xd) - montsqr_sm2(ww,yd) - - montmul_sm2(zzx1,zz,x1a) - montmul_sm2(zzx2,zz,x2a) - - sub_sm2(resx,ww,zzx1) - sub_sm2(t1,zzx2,zzx1) - - montmul_sm2(xd,xd,z_1) - - sub_sm2(resx,resx,zzx2) - - sub_sm2(t2,zzx1,resx) - - montmul_sm2(t1,t1,y1a) - - montmul_sm2(resz,xd,z_2) - montmul_sm2(t2,yd,t2) - - sub_sm2(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "NBE" <=> ~(CF \/ ZF) <=> P1 = 0 /\ ~(P2 = 0) -// and "B" <=> CF <=> ~(P1 = 0) /\ P2 = 0 -// and "Z" <=> ZF <=> (P1 = 0 <=> P2 = 0) - - load4(%r8,%r9,%r10,%r11,z_1) - - movq %r8, %rax - movq %r9, %rdx - orq %r10, %rax - orq %r11, %rdx - orq %rdx, %rax - negq %rax - sbbq %rax, %rax - - load4(%r12,%r13,%r14,%r15,z_2) - - movq %r12, %rbx - movq %r13, %rdx - orq %r14, %rbx - orq %r15, %rdx - orq %rdx, %rbx - negq %rbx - sbbq %rbx, %rbx - - cmpq %rax, %rbx - -// Multiplex the outputs accordingly, re-using the z's in registers - - cmovbq %r8, %r12 - cmovbq %r9, %r13 - cmovbq %r10, %r14 - cmovbq %r11, %r15 - - czload4(%r12,%r13,%r14,%r15,resz) - - muxload4(%rax,%rbx,%rcx,%rdx,resx,x_1,x_2) - muxload4(%r8,%r9,%r10,%r11,resy,y_1,y_2) - -// Finally store back the multiplexed values - - store4(x_3,%rax,%rbx,%rcx,%rdx) - store4(y_3,%r8,%r9,%r10,%r11) - store4(z_3,%r12,%r13,%r14,%r15) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjadd_alt.S deleted file mode 100644 index 313d0b26278..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjadd_alt.S +++ /dev/null @@ -1,564 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point addition on GM/T 0003-2012 curve SM2 in Montgomery-Jacobian coordinates -// -// extern void sm2_montjadd_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 12]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_sm2. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjadd_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rbp = p2, -// which needs to be set up explicitly before use. -// By design, none of the code macros modify any of -// these, so we maintain the assignments throughout. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rbp) -#define y_2 NUMSIZE(%rbp) -#define z_2 (2*NUMSIZE)(%rbp) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z1sq (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define x1a (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define z2sq (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define y1a (NUMSIZE*6)(%rsp) - -#define NSPACE NUMSIZE*7 -// Corresponds to bignum_montmul_sm2_alt except for registers - -#define montmul_sm2(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq %r11, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - xorl %eax, %eax ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - adcq %rax, %rax ; \ - movl $0x1, %ecx ; \ - movl $0xffffffff, %edx ; \ - xorl %ebx, %ebx ; \ - addq %r12, %rcx ; \ - leaq 0x1(%rdx), %r11 ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbx), %r8 ; \ - adcq %r14, %rbx ; \ - adcq %r15, %r11 ; \ - adcq %rax, %r8 ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds to bignum_montsqr_sm2_alt except for registers - -#define montsqr_sm2(P0,P1) \ - movq P1, %rax ; \ - movq %rax, %rbx ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r15 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r9 ; \ - movq %rdx, %r10 ; \ - movq 0x18+P1, %rax ; \ - movq %rax, %r13 ; \ - mulq %rbx; \ - movq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - movq 0x10+P1, %rax ; \ - movq %rax, %rbx ; \ - mulq %r13; \ - movq %rax, %r13 ; \ - movq %rdx, %r14 ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - movq 0x18+P1, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorl %ecx, %ecx ; \ - addq %r9, %r9 ; \ - adcq %r10, %r10 ; \ - adcq %r11, %r11 ; \ - adcq %r12, %r12 ; \ - adcq %r13, %r13 ; \ - adcq %r14, %r14 ; \ - adcq %rcx, %rcx ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %r15, %r9 ; \ - adcq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - negq %r15; \ - adcq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - negq %r15; \ - adcq %rax, %r14 ; \ - adcq %rcx, %rdx ; \ - movq %rdx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - xorl %eax, %eax ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - adcq %rax, %rax ; \ - movl $0x1, %ecx ; \ - movl $0xffffffff, %edx ; \ - xorl %ebx, %ebx ; \ - addq %r12, %rcx ; \ - leaq 0x1(%rdx), %r11 ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbx), %r8 ; \ - adcq %r14, %rbx ; \ - adcq %r15, %r11 ; \ - adcq %rax, %r8 ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_sub_sm2 - -#define sub_sm2(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - sbbq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq $0xffffffff00000000, %r10 ; \ - sbbq %r11, %r11 ; \ - andq %r11, %r10 ; \ - movq %r11, %rdx ; \ - btr $0x20, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq %r11, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// Additional macros to help with final multiplexing - -#define load4(r0,r1,r2,r3,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 - -#define store4(P,r0,r1,r2,r3) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P - -#define czload4(r0,r1,r2,r3,P) \ - cmovzq P, r0 ; \ - cmovzq 8+P, r1 ; \ - cmovzq 16+P, r2 ; \ - cmovzq 24+P, r3 - -#define muxload4(r0,r1,r2,r3,P0,P1,P2) \ - movq P0, r0 ; \ - cmovbq P1, r0 ; \ - cmovnbe P2, r0 ; \ - movq 8+P0, r1 ; \ - cmovbq 8+P1, r1 ; \ - cmovnbe 8+P2, r1 ; \ - movq 16+P0, r2 ; \ - cmovbq 16+P1, r2 ; \ - cmovnbe 16+P2, r2 ; \ - movq 24+P0, r3 ; \ - cmovbq 24+P1, r3 ; \ - cmovnbe 24+P2, r3 - -S2N_BN_SYMBOL(sm2_montjadd_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input y in %rbp where it lasts throughout the main code. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdx, %rbp - -// Main code, just a sequence of basic field operations -// 12 * multiply + 4 * square + 7 * subtract - - montsqr_sm2(z1sq,z_1) - montsqr_sm2(z2sq,z_2) - - montmul_sm2(y1a,z_2,y_1) - montmul_sm2(y2a,z_1,y_2) - - montmul_sm2(x2a,z1sq,x_2) - montmul_sm2(x1a,z2sq,x_1) - montmul_sm2(y2a,z1sq,y2a) - montmul_sm2(y1a,z2sq,y1a) - - sub_sm2(xd,x2a,x1a) - sub_sm2(yd,y2a,y1a) - - montsqr_sm2(zz,xd) - montsqr_sm2(ww,yd) - - montmul_sm2(zzx1,zz,x1a) - montmul_sm2(zzx2,zz,x2a) - - sub_sm2(resx,ww,zzx1) - sub_sm2(t1,zzx2,zzx1) - - montmul_sm2(xd,xd,z_1) - - sub_sm2(resx,resx,zzx2) - - sub_sm2(t2,zzx1,resx) - - montmul_sm2(t1,t1,y1a) - - montmul_sm2(resz,xd,z_2) - montmul_sm2(t2,yd,t2) - - sub_sm2(resy,t2,t1) - -// Load in the z coordinates of the inputs to check for P1 = 0 and P2 = 0 -// The condition codes get set by a comparison (P2 != 0) - (P1 != 0) -// So "NBE" <=> ~(CF \/ ZF) <=> P1 = 0 /\ ~(P2 = 0) -// and "B" <=> CF <=> ~(P1 = 0) /\ P2 = 0 -// and "Z" <=> ZF <=> (P1 = 0 <=> P2 = 0) - - load4(%r8,%r9,%r10,%r11,z_1) - - movq %r8, %rax - movq %r9, %rdx - orq %r10, %rax - orq %r11, %rdx - orq %rdx, %rax - negq %rax - sbbq %rax, %rax - - load4(%r12,%r13,%r14,%r15,z_2) - - movq %r12, %rbx - movq %r13, %rdx - orq %r14, %rbx - orq %r15, %rdx - orq %rdx, %rbx - negq %rbx - sbbq %rbx, %rbx - - cmpq %rax, %rbx - -// Multiplex the outputs accordingly, re-using the z's in registers - - cmovbq %r8, %r12 - cmovbq %r9, %r13 - cmovbq %r10, %r14 - cmovbq %r11, %r15 - - czload4(%r12,%r13,%r14,%r15,resz) - - muxload4(%rax,%rbx,%rcx,%rdx,resx,x_1,x_2) - muxload4(%r8,%r9,%r10,%r11,resy,y_1,y_2) - -// Finally store back the multiplexed values - - store4(x_3,%rax,%rbx,%rcx,%rdx) - store4(y_3,%r8,%r9,%r10,%r11) - store4(z_3,%r12,%r13,%r14,%r15) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjdouble.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjdouble.S deleted file mode 100644 index bfa2055fa46..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjdouble.S +++ /dev/null @@ -1,652 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on GM/T 0003-2012 curve SM2 in Montgomery-Jacobian coordinates -// -// extern void sm2_montjdouble(uint64_t p3[static 12], -// const uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_sm2. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard x86-64 ABI: RDI = p3, RSI = p1 -// Microsoft x64 ABI: RCX = p3, RDX = p1 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjdouble) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjdouble) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjdouble) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1, which is true when the -// arguments come in initially and is not disturbed throughout. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z2 (NUMSIZE*0)(%rsp) -#define y4 (NUMSIZE*0)(%rsp) - -#define y2 (NUMSIZE*1)(%rsp) - -#define t1 (NUMSIZE*2)(%rsp) - -#define t2 (NUMSIZE*3)(%rsp) -#define x2p (NUMSIZE*3)(%rsp) -#define dx2 (NUMSIZE*3)(%rsp) - -#define xy2 (NUMSIZE*4)(%rsp) - -#define x4p (NUMSIZE*5)(%rsp) -#define d (NUMSIZE*5)(%rsp) - -#define NSPACE NUMSIZE*6 - -// Corresponds to bignum_montmul_sm2 except for registers - -#define montmul_sm2(P0,P1,P2) \ - xorl %ecx, %ecx ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rcx, %r12 ; \ - xorl %ecx, %ecx ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rcx, %r13 ; \ - xorl %ecx, %ecx ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcxq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rcx, %r15 ; \ - adcxq %rcx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - xorl %eax, %eax ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - adcq %rax, %rax ; \ - movl $0x1, %ecx ; \ - movl $0xffffffff, %edx ; \ - xorl %ebx, %ebx ; \ - addq %r12, %rcx ; \ - leaq 0x1(%rdx), %r11 ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbx), %r8 ; \ - adcq %r14, %rbx ; \ - adcq %r15, %r11 ; \ - adcq %rax, %r8 ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds to bignum_montsqr_sm2 except for registers - -#define montsqr_sm2(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ecx, %ecx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - xorl %eax, %eax ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - adcq %rax, %rax ; \ - movl $0x1, %ecx ; \ - movl $0xffffffff, %edx ; \ - xorl %ebx, %ebx ; \ - addq %r12, %rcx ; \ - leaq 0x1(%rdx), %r11 ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbx), %r8 ; \ - adcq %r14, %rbx ; \ - adcq %r15, %r11 ; \ - adcq %rax, %r8 ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_sub_sm2 - -#define sub_sm2(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - sbbq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq $0xffffffff00000000, %r10 ; \ - sbbq %r11, %r11 ; \ - andq %r11, %r10 ; \ - movq %r11, %rdx ; \ - btr $0x20, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq %r11, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// Corresponds exactly to bignum_add_sm2 - -#define add_sm2(P0,P1,P2) \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - adcq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - adcq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - adcq 0x18+P2, %r9 ; \ - adcq %r11, %r11 ; \ - subq $0xffffffffffffffff, %rax ; \ - movq $0xffffffff00000000, %r10 ; \ - sbbq %r10, %rcx ; \ - sbbq $0xffffffffffffffff, %r8 ; \ - movq $0xfffffffeffffffff, %rdx ; \ - sbbq %rdx, %r9 ; \ - sbbq $0x0, %r11 ; \ - andq %r11, %r10 ; \ - andq %r11, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq %r11, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// A weak version of add that only guarantees sum in 4 digits - -#define weakadd_sm2(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - adcq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - adcq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - adcq 0x18+P2, %r9 ; \ - movq $0xffffffff00000000, %r10 ; \ - sbbq %r11, %r11 ; \ - andq %r11, %r10 ; \ - movq %r11, %rdx ; \ - btr $0x20, %rdx ; \ - subq %r11, %rax ; \ - movq %rax, P0 ; \ - sbbq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - sbbq %r11, %r8 ; \ - movq %r8, 0x10+P0 ; \ - sbbq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// P0 = C * P1 - D * P2 computed as d * (p_sm2 - P2) + c * P1 -// Quotient estimation is done just as q = h + 1 as in bignum_triple_sm2 -// This also applies to the other functions following. - -#define cmsub_sm2(P0,C,P1,D,P2) \ - /* First (%r11;%r10;%r9;%r8) = p_sm2 - P2 */ \ - movq $0xffffffffffffffff, %r8 ; \ - movq %r8, %r10 ; \ - subq P2, %r8 ; \ - movq $0xffffffff00000000, %r9 ; \ - sbbq 0x8+P2, %r9 ; \ - sbbq 0x10+P2, %r10 ; \ - movq $0xfffffffeffffffff, %r11 ; \ - sbbq 0x18+P2, %r11 ; \ - /* (%r12;%r11;%r10;%r9;%r8) = D * (p_sm2 - P2) */ \ - xorl %r12d, %r12d ; \ - movq $D, %rdx ; \ - mulxq %r8, %r8, %rax ; \ - mulxq %r9, %r9, %rcx ; \ - addq %rax, %r9 ; \ - mulxq %r10, %r10, %rax ; \ - adcq %rcx, %r10 ; \ - mulxq %r11, %r11, %rcx ; \ - adcq %rax, %r11 ; \ - adcq %rcx, %r12 ; \ - /* (%rdx;%r11;%r10;%r9;%r8) = 2^256 + C * P1 + D * (p_sm2 - P2) */ \ - movq $C, %rdx ; \ - xorl %eax, %eax ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq 0x10+P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x18+P1, %rax, %rdx ; \ - adcxq %rax, %r11 ; \ - adoxq %r12, %rdx ; \ - adcq $1, %rdx ; \ - /* Now the tail for modular reduction from tripling */ \ - movq %rdx, %rax ; \ - shlq $0x20, %rax ; \ - movq %rax, %rcx ; \ - subq %rdx, %rax ; \ - addq %rdx, %r8 ; \ - adcq %rax, %r9 ; \ - adcq $0x0, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rdx, %rdx ; \ - notq %rdx; \ - movq $0xffffffff00000000, %rax ; \ - andq %rdx, %rax ; \ - movq %rdx, %rcx ; \ - btr $0x20, %rcx ; \ - addq %rdx, %r8 ; \ - movq %r8, P0 ; \ - adcq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - adcq %rdx, %r10 ; \ - movq %r10, 0x10+P0 ; \ - adcq %rcx, %r11 ; \ - movq %r11, 0x18+P0 - -// P0 = 3 * P1 - 8 * P2, computed as (p_sm2 - P2) << 3 + 3 * P1 - -#define cmsub38_sm2(P0,P1,P2) \ - /* First (%r11;%r10;%r9;%r8) = p_sm2 - P2 */ \ - movq $0xffffffffffffffff, %r8 ; \ - movq %r8, %r10 ; \ - subq P2, %r8 ; \ - movq $0xffffffff00000000, %r9 ; \ - sbbq 0x8+P2, %r9 ; \ - sbbq 0x10+P2, %r10 ; \ - movq $0xfffffffeffffffff, %r11 ; \ - sbbq 0x18+P2, %r11 ; \ - /* (%r12;%r11;%r10;%r9;%r8) = (p_sm2 - P2) << 3 */ \ - movq %r11, %r12 ; \ - shldq $3, %r10, %r11 ; \ - shldq $3, %r9, %r10 ; \ - shldq $3, %r8, %r9 ; \ - shlq $3, %r8 ; \ - shrq $61, %r12 ; \ - /* (%rdx;%r11;%r10;%r9;%r8) = 2^256 + 3 * P1 + 8 * (p_sm2 - P2) */ \ - movq $3, %rdx ; \ - xorl %eax, %eax ; \ - mulxq P1, %rax, %rcx ; \ - adcxq %rax, %r8 ; \ - adoxq %rcx, %r9 ; \ - mulxq 0x8+P1, %rax, %rcx ; \ - adcxq %rax, %r9 ; \ - adoxq %rcx, %r10 ; \ - mulxq 0x10+P1, %rax, %rcx ; \ - adcxq %rax, %r10 ; \ - adoxq %rcx, %r11 ; \ - mulxq 0x18+P1, %rax, %rdx ; \ - adcxq %rax, %r11 ; \ - adoxq %r12, %rdx ; \ - adcq $1, %rdx ; \ - /* Now the tail for modular reduction from tripling */ \ - movq %rdx, %rax ; \ - shlq $0x20, %rax ; \ - movq %rax, %rcx ; \ - subq %rdx, %rax ; \ - addq %rdx, %r8 ; \ - adcq %rax, %r9 ; \ - adcq $0x0, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rdx, %rdx ; \ - notq %rdx; \ - movq $0xffffffff00000000, %rax ; \ - andq %rdx, %rax ; \ - movq %rdx, %rcx ; \ - btr $0x20, %rcx ; \ - addq %rdx, %r8 ; \ - movq %r8, P0 ; \ - adcq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - adcq %rdx, %r10 ; \ - movq %r10, 0x10+P0 ; \ - adcq %rcx, %r11 ; \ - movq %r11, 0x18+P0 - -// P0 = 4 * P1 - P2, by direct subtraction of P2, -// since the quotient estimate still works safely -// for initial value > -p_sm2 - -#define cmsub41_sm2(P0,P1,P2) \ - movq 0x18+P1, %r11 ; \ - movq %r11, %rdx ; \ - movq 0x10+P1, %r10 ; \ - shldq $2, %r10, %r11 ; \ - movq 0x8+P1, %r9 ; \ - shldq $2, %r9, %r10 ; \ - movq P1, %r8 ; \ - shldq $2, %r8, %r9 ; \ - shlq $2, %r8 ; \ - shrq $62, %rdx ; \ - addq $1, %rdx ; \ - subq P2, %r8 ; \ - sbbq 0x8+P2, %r9 ; \ - sbbq 0x10+P2, %r10 ; \ - sbbq 0x18+P2, %r11 ; \ - sbbq $0, %rdx ; \ - /* Now the tail for modular reduction from tripling */ \ - movq %rdx, %rax ; \ - shlq $0x20, %rax ; \ - movq %rax, %rcx ; \ - subq %rdx, %rax ; \ - addq %rdx, %r8 ; \ - adcq %rax, %r9 ; \ - adcq $0x0, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rdx, %rdx ; \ - notq %rdx; \ - movq $0xffffffff00000000, %rax ; \ - andq %rdx, %rax ; \ - movq %rdx, %rcx ; \ - btr $0x20, %rcx ; \ - addq %rdx, %r8 ; \ - movq %r8, P0 ; \ - adcq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - adcq %rdx, %r10 ; \ - movq %r10, 0x10+P0 ; \ - adcq %rcx, %r11 ; \ - movq %r11, 0x18+P0 - -S2N_BN_SYMBOL(sm2_montjdouble): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers and make room on stack for temporary variables - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main code, just a sequence of basic field operations -// z2 = z^2 -// y2 = y^2 - - montsqr_sm2(z2,z_1) - montsqr_sm2(y2,y_1) - -// x2p = x^2 - z^4 = (x + z^2) * (x - z^2) - - sub_sm2(t2,x_1,z2) - weakadd_sm2(t1,x_1,z2) - montmul_sm2(x2p,t1,t2) - -// t1 = y + z -// xy2 = x * y^2 -// x4p = x2p^2 - - add_sm2(t1,y_1,z_1) - montmul_sm2(xy2,x_1,y2) - montsqr_sm2(x4p,x2p) - -// t1 = (y + z)^2 - - montsqr_sm2(t1,t1) - -// d = 12 * xy2 - 9 * x4p -// t1 = y^2 + 2 * y * z - - cmsub_sm2(d,12,xy2,9,x4p) - sub_sm2(t1,t1,z2) - -// y4 = y^4 - - montsqr_sm2(y4,y2) - -// dx2 = d * x2p - - montmul_sm2(dx2,d,x2p) - -// z_3' = 2 * y * z - - sub_sm2(z_3,t1,y2) - -// x' = 4 * xy2 - d - - cmsub41_sm2(x_3,xy2,d) - -// y' = 3 * dx2 - 8 * y4 - - cmsub38_sm2(y_3,dx2,y4) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjdouble_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjdouble_alt.S deleted file mode 100644 index 8739e72f346..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjdouble_alt.S +++ /dev/null @@ -1,731 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point doubling on GM/T 0003-2012 curve SM2 in Montgomery-Jacobian coordinates -// -// extern void sm2_montjdouble_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12]); -// -// Does p3 := 2 * p1 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_sm2. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// -// Standard x86-64 ABI: RDI = p3, RSI = p1 -// Microsoft x64 ABI: RCX = p3, RDX = p1 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjdouble_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjdouble_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjdouble_alt) - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1, which is true when the -// arguments come in initially and is not disturbed throughout. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define z2 (NUMSIZE*0)(%rsp) -#define y4 (NUMSIZE*0)(%rsp) - -#define y2 (NUMSIZE*1)(%rsp) - -#define t1 (NUMSIZE*2)(%rsp) - -#define t2 (NUMSIZE*3)(%rsp) -#define x2p (NUMSIZE*3)(%rsp) -#define dx2 (NUMSIZE*3)(%rsp) - -#define xy2 (NUMSIZE*4)(%rsp) - -#define x4p (NUMSIZE*5)(%rsp) -#define d (NUMSIZE*5)(%rsp) - -#define NSPACE NUMSIZE*6 - -// Corresponds to bignum_montmul_sm2_alt except for registers - -#define montmul_sm2(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq %r11, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - xorl %eax, %eax ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - adcq %rax, %rax ; \ - movl $0x1, %ecx ; \ - movl $0xffffffff, %edx ; \ - xorl %ebx, %ebx ; \ - addq %r12, %rcx ; \ - leaq 0x1(%rdx), %r11 ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbx), %r8 ; \ - adcq %r14, %rbx ; \ - adcq %r15, %r11 ; \ - adcq %rax, %r8 ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds to bignum_montsqr_sm2_alt except for registers - -#define montsqr_sm2(P0,P1) \ - movq P1, %rax ; \ - movq %rax, %rbx ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r15 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r9 ; \ - movq %rdx, %r10 ; \ - movq 0x18+P1, %rax ; \ - movq %rax, %r13 ; \ - mulq %rbx; \ - movq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - movq 0x10+P1, %rax ; \ - movq %rax, %rbx ; \ - mulq %r13; \ - movq %rax, %r13 ; \ - movq %rdx, %r14 ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - movq 0x18+P1, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorl %ecx, %ecx ; \ - addq %r9, %r9 ; \ - adcq %r10, %r10 ; \ - adcq %r11, %r11 ; \ - adcq %r12, %r12 ; \ - adcq %r13, %r13 ; \ - adcq %r14, %r14 ; \ - adcq %rcx, %rcx ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %r15, %r9 ; \ - adcq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - negq %r15; \ - adcq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - negq %r15; \ - adcq %rax, %r14 ; \ - adcq %rcx, %rdx ; \ - movq %rdx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - xorl %eax, %eax ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - adcq %rax, %rax ; \ - movl $0x1, %ecx ; \ - movl $0xffffffff, %edx ; \ - xorl %ebx, %ebx ; \ - addq %r12, %rcx ; \ - leaq 0x1(%rdx), %r11 ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbx), %r8 ; \ - adcq %r14, %rbx ; \ - adcq %r15, %r11 ; \ - adcq %rax, %r8 ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_sub_sm2 - -#define sub_sm2(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - sbbq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq $0xffffffff00000000, %r10 ; \ - sbbq %r11, %r11 ; \ - andq %r11, %r10 ; \ - movq %r11, %rdx ; \ - btr $0x20, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq %r11, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// Corresponds exactly to bignum_add_sm2 - -#define add_sm2(P0,P1,P2) \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - adcq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - adcq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - adcq 0x18+P2, %r9 ; \ - adcq %r11, %r11 ; \ - subq $0xffffffffffffffff, %rax ; \ - movq $0xffffffff00000000, %r10 ; \ - sbbq %r10, %rcx ; \ - sbbq $0xffffffffffffffff, %r8 ; \ - movq $0xfffffffeffffffff, %rdx ; \ - sbbq %rdx, %r9 ; \ - sbbq $0x0, %r11 ; \ - andq %r11, %r10 ; \ - andq %r11, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq %r11, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// A weak version of add that only guarantees sum in 4 digits - -#define weakadd_sm2(P0,P1,P2) \ - movq P1, %rax ; \ - addq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - adcq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - adcq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - adcq 0x18+P2, %r9 ; \ - movq $0xffffffff00000000, %r10 ; \ - sbbq %r11, %r11 ; \ - andq %r11, %r10 ; \ - movq %r11, %rdx ; \ - btr $0x20, %rdx ; \ - subq %r11, %rax ; \ - movq %rax, P0 ; \ - sbbq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - sbbq %r11, %r8 ; \ - movq %r8, 0x10+P0 ; \ - sbbq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// P0 = C * P1 - D * P2 computed as d * (p_sm2 - P2) + c * P1 -// Quotient estimation is done just as q = h + 1 as in bignum_triple_sm2 -// This also applies to the other functions following. - -#define cmsub_sm2(P0,C,P1,D,P2) \ - /* First (%r12;%r11;%r10;%r9) = p_sm2 - P2 */ \ - movq $0xffffffffffffffff, %r9 ; \ - movq %r9, %r11 ; \ - subq P2, %r9 ; \ - movq $0xffffffff00000000, %r10 ; \ - sbbq 0x8+P2, %r10 ; \ - sbbq 0x10+P2, %r11 ; \ - movq $0xfffffffeffffffff, %r12 ; \ - sbbq 0x18+P2, %r12 ; \ - /* (%r12;%r11;%r10;%r9;%r8) = D * (p_sm2 - P2) */ \ - movq $D, %rcx ; \ - movq %r9, %rax ; \ - mulq %rcx; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - movq %r10, %rax ; \ - xorl %r10d, %r10d ; \ - mulq %rcx; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq %r11, %rax ; \ - xorl %r11d, %r11d ; \ - mulq %rcx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - movq %r12, %rax ; \ - xorl %r12d, %r12d ; \ - mulq %rcx; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - /* (%rdx;%r11;%r10;%r9;%r8) = 2^256 + C * P1 + D * (p_sm2 - P2) */ \ - movl $C, %ecx ; \ - movq P1, %rax ; \ - mulq %rcx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rbx, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rbx, %rbx ; \ - movq 0x10+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rbx, %rbx ; \ - movq 0x18+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - leaq 1(%r12), %rdx ; \ - /* Now the tail for modular reduction from tripling */ \ - movq %rdx, %rax ; \ - shlq $0x20, %rax ; \ - movq %rax, %rcx ; \ - subq %rdx, %rax ; \ - addq %rdx, %r8 ; \ - adcq %rax, %r9 ; \ - adcq $0x0, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rdx, %rdx ; \ - notq %rdx; \ - movq $0xffffffff00000000, %rax ; \ - andq %rdx, %rax ; \ - movq %rdx, %rcx ; \ - btr $0x20, %rcx ; \ - addq %rdx, %r8 ; \ - movq %r8, P0 ; \ - adcq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - adcq %rdx, %r10 ; \ - movq %r10, 0x10+P0 ; \ - adcq %rcx, %r11 ; \ - movq %r11, 0x18+P0 - -// P0 = 3 * P1 - 8 * P2, computed as (p_sm2 - P2) << 3 + 3 * P1 - -#define cmsub38_sm2(P0,P1,P2) \ - /* First (%r11;%r10;%r9;%r8) = p_sm2 - P2 */ \ - movq $0xffffffffffffffff, %r8 ; \ - movq %r8, %r10 ; \ - subq P2, %r8 ; \ - movq $0xffffffff00000000, %r9 ; \ - sbbq 0x8+P2, %r9 ; \ - sbbq 0x10+P2, %r10 ; \ - movq $0xfffffffeffffffff, %r11 ; \ - sbbq 0x18+P2, %r11 ; \ - /* (%r12;%r11;%r10;%r9;%r8) = (p_sm2 - P2) << 3 */ \ - movq %r11, %r12 ; \ - shldq $3, %r10, %r11 ; \ - shldq $3, %r9, %r10 ; \ - shldq $3, %r8, %r9 ; \ - shlq $3, %r8 ; \ - shrq $61, %r12 ; \ - /* (%rdx;%r11;%r10;%r9;%r8) = 2^256 + 3 * P1 + 8 * (p_sm2 - P2) */ \ - movl $3, %ecx ; \ - movq P1, %rax ; \ - mulq %rcx; \ - addq %rax, %r8 ; \ - adcq %rdx, %r9 ; \ - sbbq %rbx, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - sbbq %rbx, %rbx ; \ - movq 0x10+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rbx, %rbx ; \ - movq 0x18+P1, %rax ; \ - mulq %rcx; \ - subq %rbx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - leaq 1(%r12), %rdx ; \ - /* Now the tail for modular reduction from tripling */ \ - movq %rdx, %rax ; \ - shlq $0x20, %rax ; \ - movq %rax, %rcx ; \ - subq %rdx, %rax ; \ - addq %rdx, %r8 ; \ - adcq %rax, %r9 ; \ - adcq $0x0, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rdx, %rdx ; \ - notq %rdx; \ - movq $0xffffffff00000000, %rax ; \ - andq %rdx, %rax ; \ - movq %rdx, %rcx ; \ - btr $0x20, %rcx ; \ - addq %rdx, %r8 ; \ - movq %r8, P0 ; \ - adcq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - adcq %rdx, %r10 ; \ - movq %r10, 0x10+P0 ; \ - adcq %rcx, %r11 ; \ - movq %r11, 0x18+P0 - -// P0 = 4 * P1 - P2, by direct subtraction of P2, -// since the quotient estimate still works safely -// for initial value > -p_sm2 - -#define cmsub41_sm2(P0,P1,P2) \ - movq 0x18+P1, %r11 ; \ - movq %r11, %rdx ; \ - movq 0x10+P1, %r10 ; \ - shldq $2, %r10, %r11 ; \ - movq 0x8+P1, %r9 ; \ - shldq $2, %r9, %r10 ; \ - movq P1, %r8 ; \ - shldq $2, %r8, %r9 ; \ - shlq $2, %r8 ; \ - shrq $62, %rdx ; \ - addq $1, %rdx ; \ - subq P2, %r8 ; \ - sbbq 0x8+P2, %r9 ; \ - sbbq 0x10+P2, %r10 ; \ - sbbq 0x18+P2, %r11 ; \ - sbbq $0, %rdx ; \ - /* Now the tail for modular reduction from tripling */ \ - movq %rdx, %rax ; \ - shlq $0x20, %rax ; \ - movq %rax, %rcx ; \ - subq %rdx, %rax ; \ - addq %rdx, %r8 ; \ - adcq %rax, %r9 ; \ - adcq $0x0, %r10 ; \ - adcq %rcx, %r11 ; \ - sbbq %rdx, %rdx ; \ - notq %rdx; \ - movq $0xffffffff00000000, %rax ; \ - andq %rdx, %rax ; \ - movq %rdx, %rcx ; \ - btr $0x20, %rcx ; \ - addq %rdx, %r8 ; \ - movq %r8, P0 ; \ - adcq %rax, %r9 ; \ - movq %r9, 0x8+P0 ; \ - adcq %rdx, %r10 ; \ - movq %r10, 0x10+P0 ; \ - adcq %rcx, %r11 ; \ - movq %r11, 0x18+P0 - -S2N_BN_SYMBOL(sm2_montjdouble_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi -#endif - -// Save registers and make room on stack for temporary variables - - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - -// Main code, just a sequence of basic field operations - -// z2 = z^2 -// y2 = y^2 - - montsqr_sm2(z2,z_1) - montsqr_sm2(y2,y_1) - -// x2p = x^2 - z^4 = (x + z^2) * (x - z^2) - - sub_sm2(t2,x_1,z2) - weakadd_sm2(t1,x_1,z2) - montmul_sm2(x2p,t1,t2) - -// t1 = y + z -// xy2 = x * y^2 -// x4p = x2p^2 - - add_sm2(t1,y_1,z_1) - montmul_sm2(xy2,x_1,y2) - montsqr_sm2(x4p,x2p) - -// t1 = (y + z)^2 - - montsqr_sm2(t1,t1) - -// d = 12 * xy2 - 9 * x4p -// t1 = y^2 + 2 * y * z - - cmsub_sm2(d,12,xy2,9,x4p) - sub_sm2(t1,t1,z2) - -// y4 = y^4 - - montsqr_sm2(y4,y2) - -// dx2 = d * x2p - - montmul_sm2(dx2,d,x2p) - -// z_3' = 2 * y * z - - sub_sm2(z_3,t1,y2) - -// x' = 4 * xy2 - d - - cmsub41_sm2(x_3,xy2,d) - -// y' = 3 * dx2 - 8 * y4 - - cmsub38_sm2(y_3,dx2,y4) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjdouble_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjmixadd.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjmixadd.S deleted file mode 100644 index 17e94903541..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjmixadd.S +++ /dev/null @@ -1,599 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on GM/T 0003-2012 curve SM2 in Montgomery-Jacobian coordinates -// -// extern void sm2_montjmixadd(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 8]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_sm2. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjmixadd) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjmixadd) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjmixadd) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rbp = p2, -// which needs to be set up explicitly before use. -// By design, none of the code macros modify any of -// these, so we maintain the assignments throughout. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rbp) -#define y_2 NUMSIZE(%rbp) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define zp2 (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define NSPACE NUMSIZE*6 - -// Corresponds to bignum_montmul_sm2 except for registers - -#define montmul_sm2(P0,P1,P2) \ - xorl %ecx, %ecx ; \ - movq P2, %rdx ; \ - mulxq P1, %r8, %r9 ; \ - mulxq 0x8+P1, %rax, %r10 ; \ - addq %rax, %r9 ; \ - mulxq 0x10+P1, %rax, %r11 ; \ - adcq %rax, %r10 ; \ - mulxq 0x18+P1, %rax, %r12 ; \ - adcq %rax, %r11 ; \ - adcq %rcx, %r12 ; \ - xorl %ecx, %ecx ; \ - movq 0x8+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r9 ; \ - adoxq %rbx, %r10 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x18+P1, %rax, %r13 ; \ - adcxq %rax, %r12 ; \ - adoxq %rcx, %r13 ; \ - adcxq %rcx, %r13 ; \ - xorl %ecx, %ecx ; \ - movq 0x10+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x18+P1, %rax, %r14 ; \ - adcxq %rax, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcxq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - movq 0x18+P2, %rdx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - mulxq 0x10+P1, %rax, %rbx ; \ - adcxq %rax, %r13 ; \ - adoxq %rbx, %r14 ; \ - mulxq 0x18+P1, %rax, %r15 ; \ - adcxq %rax, %r14 ; \ - adoxq %rcx, %r15 ; \ - adcxq %rcx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - xorl %eax, %eax ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - adcq %rax, %rax ; \ - movl $0x1, %ecx ; \ - movl $0xffffffff, %edx ; \ - xorl %ebx, %ebx ; \ - addq %r12, %rcx ; \ - leaq 0x1(%rdx), %r11 ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbx), %r8 ; \ - adcq %r14, %rbx ; \ - adcq %r15, %r11 ; \ - adcq %rax, %r8 ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds to bignum_montsqr_sm2 except for registers - -#define montsqr_sm2(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ecx, %ecx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - xorl %eax, %eax ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - adcq %rax, %rax ; \ - movl $0x1, %ecx ; \ - movl $0xffffffff, %edx ; \ - xorl %ebx, %ebx ; \ - addq %r12, %rcx ; \ - leaq 0x1(%rdx), %r11 ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbx), %r8 ; \ - adcq %r14, %rbx ; \ - adcq %r15, %r11 ; \ - adcq %rax, %r8 ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Almost-Montgomery variant which we use when an input to other muls -// with the other argument fully reduced (which is always safe). - -#define amontsqr_sm2(P0,P1) \ - movq P1, %rdx ; \ - mulxq %rdx, %r8, %r15 ; \ - mulxq 0x8+P1, %r9, %r10 ; \ - mulxq 0x18+P1, %r11, %r12 ; \ - movq 0x10+P1, %rdx ; \ - mulxq 0x18+P1, %r13, %r14 ; \ - xorl %ecx, %ecx ; \ - mulxq P1, %rax, %rbx ; \ - adcxq %rax, %r10 ; \ - adoxq %rbx, %r11 ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r11 ; \ - adoxq %rbx, %r12 ; \ - movq 0x18+P1, %rdx ; \ - mulxq 0x8+P1, %rax, %rbx ; \ - adcxq %rax, %r12 ; \ - adoxq %rbx, %r13 ; \ - adcxq %rcx, %r13 ; \ - adoxq %rcx, %r14 ; \ - adcq %rcx, %r14 ; \ - xorl %ecx, %ecx ; \ - adcxq %r9, %r9 ; \ - adoxq %r15, %r9 ; \ - movq 0x8+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r10, %r10 ; \ - adoxq %rax, %r10 ; \ - adcxq %r11, %r11 ; \ - adoxq %rdx, %r11 ; \ - movq 0x10+P1, %rdx ; \ - mulxq %rdx, %rax, %rdx ; \ - adcxq %r12, %r12 ; \ - adoxq %rax, %r12 ; \ - adcxq %r13, %r13 ; \ - adoxq %rdx, %r13 ; \ - movq 0x18+P1, %rdx ; \ - mulxq %rdx, %rax, %r15 ; \ - adcxq %r14, %r14 ; \ - adoxq %rax, %r14 ; \ - adcxq %rcx, %r15 ; \ - adoxq %rcx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - sbbq %rax, %rax ; \ - movq $0xffffffff00000000, %rbx ; \ - movq %rax, %rcx ; \ - andq %rax, %rbx ; \ - btr $32, %rcx ; \ - subq %rax, %r12 ; \ - sbbq %rbx, %r13 ; \ - sbbq %rax, %r14 ; \ - sbbq %rcx, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_sub_sm2 - -#define sub_sm2(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - sbbq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq $0xffffffff00000000, %r10 ; \ - sbbq %r11, %r11 ; \ - andq %r11, %r10 ; \ - movq %r11, %rdx ; \ - btr $0x20, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq %r11, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// Additional macros to help with final multiplexing - -#define testzero4(P) \ - movq P, %rax ; \ - movq 8+P, %rdx ; \ - orq 16+P, %rax ; \ - orq 24+P, %rdx ; \ - orq %rdx, %rax - -#define mux4(r0,r1,r2,r3,PNE,PEQ) \ - movq PNE, r0 ; \ - movq PEQ, %rax ; \ - cmovzq %rax, r0 ; \ - movq 8+PNE, r1 ; \ - movq 8+PEQ, %rax ; \ - cmovzq %rax, r1 ; \ - movq 16+PNE, r2 ; \ - movq 16+PEQ, %rax ; \ - cmovzq %rax, r2 ; \ - movq 24+PNE, r3 ; \ - movq 24+PEQ, %rax ; \ - cmovzq %rax, r3 - -#define load4(r0,r1,r2,r3,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 - -#define store4(P,r0,r1,r2,r3) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P - -S2N_BN_SYMBOL(sm2_montjmixadd): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input y in %rbp where it lasts throughout the main code. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdx, %rbp - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - amontsqr_sm2(zp2,z_1) - - montmul_sm2(y2a,z_1,y_2) - montmul_sm2(x2a,zp2,x_2) - montmul_sm2(y2a,zp2,y2a) - - sub_sm2(xd,x2a,x_1) - - sub_sm2(yd,y2a,y_1) - - amontsqr_sm2(zz,xd) - montsqr_sm2(ww,yd) - - montmul_sm2(zzx1,zz,x_1) - montmul_sm2(zzx2,zz,x2a) - - sub_sm2(resx,ww,zzx1) - sub_sm2(t1,zzx2,zzx1) - - montmul_sm2(resz,xd,z_1) - - sub_sm2(resx,resx,zzx2) - - sub_sm2(t2,zzx1,resx) - - montmul_sm2(t1,t1,y_1) - montmul_sm2(t2,yd,t2) - - sub_sm2(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - testzero4(z_1) - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with a z = 1 coordinate (in -// Montgomery form so not the simple constant 1 but rather 2^256 - p_sm2), -// hence giving 0 + p2 = p2 for the final result. - - mux4(%r8,%r9,%r10,%r11,resx,x_2) - mux4(%r12,%r13,%r14,%r15,resy,y_2) - - store4(x_3,%r8,%r9,%r10,%r11) - store4(y_3,%r12,%r13,%r14,%r15) - - load4(%r8,%r9,%r10,%r11,resz) - movl $1, %eax - cmovzq %rax, %r8 - movl $0x00000000ffffffff, %eax - cmovzq %rax, %r9 - movl $0, %eax - cmovzq %rax, %r10 - movq $0x0000000100000000, %rax - cmovzq %rax, %r11 - - store4(z_3,%r8,%r9,%r10,%r11) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjmixadd) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjmixadd_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjmixadd_alt.S deleted file mode 100644 index 83750a0e97b..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjmixadd_alt.S +++ /dev/null @@ -1,538 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Point mixed addition on GM/T 0003-2012 curve SM2 in Montgomery-Jacobian coordinates -// -// extern void sm2_montjmixadd_alt(uint64_t p3[static 12], -// const uint64_t p1[static 12], -// const uint64_t p2[static 8]); -// -// Does p3 := p1 + p2 where all points are regarded as Jacobian triples with -// each coordinate in the Montgomery domain, i.e. x' = (2^256 * x) mod p_sm2. -// A Jacobian triple (x',y',z') represents affine point (x/z^2,y/z^3). -// The "mixed" part means that p2 only has x and y coordinates, with the -// implicit z coordinate assumed to be the identity. -// -// Standard x86-64 ABI: RDI = p3, RSI = p1, RDX = p2 -// Microsoft x64 ABI: RCX = p3, RDX = p1, R8 = p2 -// ---------------------------------------------------------------------------- -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjmixadd_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjmixadd_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjmixadd_alt) - .text - -// Size of individual field elements - -#define NUMSIZE 32 - -// Pointer-offset pairs for inputs and outputs -// These assume %rdi = p3, %rsi = p1 and %rbp = p2, -// which needs to be set up explicitly before use. -// By design, none of the code macros modify any of -// these, so we maintain the assignments throughout. - -#define x_1 0(%rsi) -#define y_1 NUMSIZE(%rsi) -#define z_1 (2*NUMSIZE)(%rsi) - -#define x_2 0(%rbp) -#define y_2 NUMSIZE(%rbp) - -#define x_3 0(%rdi) -#define y_3 NUMSIZE(%rdi) -#define z_3 (2*NUMSIZE)(%rdi) - -// Pointer-offset pairs for temporaries, with some aliasing -// NSPACE is the total stack needed for these temporaries - -#define zp2 (NUMSIZE*0)(%rsp) -#define ww (NUMSIZE*0)(%rsp) -#define resx (NUMSIZE*0)(%rsp) - -#define yd (NUMSIZE*1)(%rsp) -#define y2a (NUMSIZE*1)(%rsp) - -#define x2a (NUMSIZE*2)(%rsp) -#define zzx2 (NUMSIZE*2)(%rsp) - -#define zz (NUMSIZE*3)(%rsp) -#define t1 (NUMSIZE*3)(%rsp) - -#define t2 (NUMSIZE*4)(%rsp) -#define zzx1 (NUMSIZE*4)(%rsp) -#define resy (NUMSIZE*4)(%rsp) - -#define xd (NUMSIZE*5)(%rsp) -#define resz (NUMSIZE*5)(%rsp) - -#define NSPACE NUMSIZE*6 - -// Corresponds to bignum_montmul_sm2_alt except for registers - -#define montmul_sm2(P0,P1,P2) \ - movq P1, %rax ; \ - mulq P2; \ - movq %rax, %r8 ; \ - movq %rdx, %r9 ; \ - xorq %r10, %r10 ; \ - xorq %r11, %r11 ; \ - movq P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - movq 0x8+P1, %rax ; \ - mulq P2; \ - addq %rax, %r9 ; \ - adcq %rdx, %r10 ; \ - adcq %r11, %r11 ; \ - xorq %r12, %r12 ; \ - movq P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq %r12, %r12 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - movq 0x10+P1, %rax ; \ - mulq P2; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - adcq $0x0, %r12 ; \ - xorq %r13, %r13 ; \ - movq P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq %r13, %r13 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - movq 0x18+P1, %rax ; \ - mulq P2; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - adcq $0x0, %r13 ; \ - xorq %r14, %r14 ; \ - movq 0x8+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq %r14, %r14 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x8+P2; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x10+P2; \ - addq %rax, %r13 ; \ - adcq %rdx, %r14 ; \ - adcq $0x0, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq 0x18+P2; \ - addq %rax, %r14 ; \ - adcq %rdx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - xorl %eax, %eax ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - adcq %rax, %rax ; \ - movl $0x1, %ecx ; \ - movl $0xffffffff, %edx ; \ - xorl %ebx, %ebx ; \ - addq %r12, %rcx ; \ - leaq 0x1(%rdx), %r11 ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbx), %r8 ; \ - adcq %r14, %rbx ; \ - adcq %r15, %r11 ; \ - adcq %rax, %r8 ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds to bignum_montsqr_sm2_alt except for registers - -#define montsqr_sm2(P0,P1) \ - movq P1, %rax ; \ - movq %rax, %rbx ; \ - mulq %rax; \ - movq %rax, %r8 ; \ - movq %rdx, %r15 ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - movq %rax, %r9 ; \ - movq %rdx, %r10 ; \ - movq 0x18+P1, %rax ; \ - movq %rax, %r13 ; \ - mulq %rbx; \ - movq %rax, %r11 ; \ - movq %rdx, %r12 ; \ - movq 0x10+P1, %rax ; \ - movq %rax, %rbx ; \ - mulq %r13; \ - movq %rax, %r13 ; \ - movq %rdx, %r14 ; \ - movq P1, %rax ; \ - mulq %rbx; \ - addq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %rcx, %rcx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r11 ; \ - adcq %rdx, %r12 ; \ - sbbq %rcx, %rcx ; \ - movq 0x18+P1, %rbx ; \ - movq 0x8+P1, %rax ; \ - mulq %rbx; \ - subq %rcx, %rdx ; \ - addq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - adcq $0x0, %r14 ; \ - xorl %ecx, %ecx ; \ - addq %r9, %r9 ; \ - adcq %r10, %r10 ; \ - adcq %r11, %r11 ; \ - adcq %r12, %r12 ; \ - adcq %r13, %r13 ; \ - adcq %r14, %r14 ; \ - adcq %rcx, %rcx ; \ - movq 0x8+P1, %rax ; \ - mulq %rax; \ - addq %r15, %r9 ; \ - adcq %rax, %r10 ; \ - adcq %rdx, %r11 ; \ - sbbq %r15, %r15 ; \ - movq 0x10+P1, %rax ; \ - mulq %rax; \ - negq %r15; \ - adcq %rax, %r12 ; \ - adcq %rdx, %r13 ; \ - sbbq %r15, %r15 ; \ - movq 0x18+P1, %rax ; \ - mulq %rax; \ - negq %r15; \ - adcq %rax, %r14 ; \ - adcq %rcx, %rdx ; \ - movq %rdx, %r15 ; \ - movq %r8, %rax ; \ - shlq $0x20, %rax ; \ - movq %r8, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r8, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r9 ; \ - sbbq %rcx, %r10 ; \ - sbbq %rdx, %r11 ; \ - sbbq %rbx, %r8 ; \ - movq %r9, %rax ; \ - shlq $0x20, %rax ; \ - movq %r9, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r9, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r10 ; \ - sbbq %rcx, %r11 ; \ - sbbq %rdx, %r8 ; \ - sbbq %rbx, %r9 ; \ - movq %r10, %rax ; \ - shlq $0x20, %rax ; \ - movq %r10, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r10, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r11 ; \ - sbbq %rcx, %r8 ; \ - sbbq %rdx, %r9 ; \ - sbbq %rbx, %r10 ; \ - movq %r11, %rax ; \ - shlq $0x20, %rax ; \ - movq %r11, %rcx ; \ - shrq $0x20, %rcx ; \ - movq %rax, %rdx ; \ - movq %rcx, %rbx ; \ - subq %r11, %rax ; \ - sbbq $0x0, %rcx ; \ - subq %rax, %r8 ; \ - sbbq %rcx, %r9 ; \ - sbbq %rdx, %r10 ; \ - sbbq %rbx, %r11 ; \ - xorl %eax, %eax ; \ - addq %r8, %r12 ; \ - adcq %r9, %r13 ; \ - adcq %r10, %r14 ; \ - adcq %r11, %r15 ; \ - adcq %rax, %rax ; \ - movl $0x1, %ecx ; \ - movl $0xffffffff, %edx ; \ - xorl %ebx, %ebx ; \ - addq %r12, %rcx ; \ - leaq 0x1(%rdx), %r11 ; \ - adcq %r13, %rdx ; \ - leaq -0x1(%rbx), %r8 ; \ - adcq %r14, %rbx ; \ - adcq %r15, %r11 ; \ - adcq %rax, %r8 ; \ - cmovbq %rcx, %r12 ; \ - cmovbq %rdx, %r13 ; \ - cmovbq %rbx, %r14 ; \ - cmovbq %r11, %r15 ; \ - movq %r12, P0 ; \ - movq %r13, 0x8+P0 ; \ - movq %r14, 0x10+P0 ; \ - movq %r15, 0x18+P0 - -// Corresponds exactly to bignum_sub_sm2 - -#define sub_sm2(P0,P1,P2) \ - movq P1, %rax ; \ - subq P2, %rax ; \ - movq 0x8+P1, %rcx ; \ - sbbq 0x8+P2, %rcx ; \ - movq 0x10+P1, %r8 ; \ - sbbq 0x10+P2, %r8 ; \ - movq 0x18+P1, %r9 ; \ - sbbq 0x18+P2, %r9 ; \ - movq $0xffffffff00000000, %r10 ; \ - sbbq %r11, %r11 ; \ - andq %r11, %r10 ; \ - movq %r11, %rdx ; \ - btr $0x20, %rdx ; \ - addq %r11, %rax ; \ - movq %rax, P0 ; \ - adcq %r10, %rcx ; \ - movq %rcx, 0x8+P0 ; \ - adcq %r11, %r8 ; \ - movq %r8, 0x10+P0 ; \ - adcq %rdx, %r9 ; \ - movq %r9, 0x18+P0 - -// Additional macros to help with final multiplexing - -#define testzero4(P) \ - movq P, %rax ; \ - movq 8+P, %rdx ; \ - orq 16+P, %rax ; \ - orq 24+P, %rdx ; \ - orq %rdx, %rax - -#define mux4(r0,r1,r2,r3,PNE,PEQ) \ - movq PNE, r0 ; \ - movq PEQ, %rax ; \ - cmovzq %rax, r0 ; \ - movq 8+PNE, r1 ; \ - movq 8+PEQ, %rax ; \ - cmovzq %rax, r1 ; \ - movq 16+PNE, r2 ; \ - movq 16+PEQ, %rax ; \ - cmovzq %rax, r2 ; \ - movq 24+PNE, r3 ; \ - movq 24+PEQ, %rax ; \ - cmovzq %rax, r3 - -#define load4(r0,r1,r2,r3,P) \ - movq P, r0 ; \ - movq 8+P, r1 ; \ - movq 16+P, r2 ; \ - movq 24+P, r3 - -#define store4(P,r0,r1,r2,r3) \ - movq r0, P ; \ - movq r1, 8+P ; \ - movq r2, 16+P ; \ - movq r3, 24+P - -S2N_BN_SYMBOL(sm2_montjmixadd_alt): - CFI_START - _CET_ENDBR - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx -#endif - -// Save registers and make room on stack for temporary variables -// Put the input y in %rbp where it lasts throughout the main code. - - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - - CFI_DEC_RSP(NSPACE) - - movq %rdx, %rbp - -// Main code, just a sequence of basic field operations -// 8 * multiply + 3 * square + 7 * subtract - - montsqr_sm2(zp2,z_1) - - montmul_sm2(y2a,z_1,y_2) - montmul_sm2(x2a,zp2,x_2) - montmul_sm2(y2a,zp2,y2a) - - sub_sm2(xd,x2a,x_1) - - sub_sm2(yd,y2a,y_1) - - montsqr_sm2(zz,xd) - montsqr_sm2(ww,yd) - - montmul_sm2(zzx1,zz,x_1) - montmul_sm2(zzx2,zz,x2a) - - sub_sm2(resx,ww,zzx1) - sub_sm2(t1,zzx2,zzx1) - - montmul_sm2(resz,xd,z_1) - - sub_sm2(resx,resx,zzx2) - - sub_sm2(t2,zzx1,resx) - - montmul_sm2(t1,t1,y_1) - montmul_sm2(t2,yd,t2) - - sub_sm2(resy,t2,t1) - -// Test if z_1 = 0 to decide if p1 = 0 (up to projective equivalence) - - testzero4(z_1) - -// Multiplex: if p1 <> 0 just copy the computed result from the staging area. -// If p1 = 0 then return the point p2 augmented with a z = 1 coordinate (in -// Montgomery form so not the simple constant 1 but rather 2^256 - p_sm2), -// hence giving 0 + p2 = p2 for the final result. - - mux4(%r8,%r9,%r10,%r11,resx,x_2) - mux4(%r12,%r13,%r14,%r15,resy,y_2) - - store4(x_3,%r8,%r9,%r10,%r11) - store4(y_3,%r12,%r13,%r14,%r15) - - load4(%r8,%r9,%r10,%r11,resz) - movl $1, %eax - cmovzq %rax, %r8 - movl $0x00000000ffffffff, %eax - cmovzq %rax, %r9 - movl $0, %eax - cmovzq %rax, %r10 - movq $0x0000000100000000, %rax - cmovzq %rax, %r11 - - store4(z_3,%r8,%r9,%r10,%r11) - -// Restore stack and registers - - CFI_INC_RSP(NSPACE) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - -#if WINDOWS_ABI - CFI_POP(%rsi) - CFI_POP(%rdi) -#endif - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjmixadd_alt) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjscalarmul.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjscalarmul.S deleted file mode 100644 index 6d32fbc17b3..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjscalarmul.S +++ /dev/null @@ -1,3883 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery-Jacobian form scalar multiplication for GM/T 0003-2012 curve SM2 -// Input scalar[4], point[12]; output res[12] -// -// extern void sm2_montjscalarmul -// (uint64_t res[static 12], -// const uint64_t scalar[static 4], -// const uint64_t point[static 12]); -// -// This function is a variant of its affine point version sm2_scalarmul. -// Here, input and output points are assumed to be in Jacobian form with -// their coordinates in the Montgomery domain. Thus, if priming indicates -// Montgomery form, x' = (2^256 * x) mod p_sm2 etc., each point argument -// is a triple (x',y',z') representing the affine point (x/z^2,y/z^3) when -// z' is nonzero or the point at infinity (group identity) if z' = 0. -// -// Given scalar = n and point = P, assumed to be on the NIST elliptic -// curve SM2, returns a representation of n * P. If the result is the -// point at infinity (either because the input point was or because the -// scalar was a multiple of p_sm2) then the output is guaranteed to -// represent the point at infinity, i.e. to have its z coordinate zero. -// -// Standard x86-64 ABI: RDI = res, RSI = scalar, RDX = point -// Microsoft x64 ABI: RCX = res, RDX = scalar, R8 = point -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjscalarmul) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjscalarmul) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjscalarmul) - - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Intermediate variables on the stack. Uppercase syntactic variants -// make x86_att version simpler to generate. - -#define SCALARB (0*NUMSIZE) -#define scalarb (0*NUMSIZE)(%rsp) -#define ACC (1*NUMSIZE) -#define acc (1*NUMSIZE)(%rsp) -#define TABENT (4*NUMSIZE) -#define tabent (4*NUMSIZE)(%rsp) - -#define TAB (7*NUMSIZE) -#define tab (7*NUMSIZE)(%rsp) - -#define res (31*NUMSIZE)(%rsp) - -#define NSPACE 32*NUMSIZE - -// Avoid using .rep for the sake of the BoringSSL/AWS-LC delocator, -// which doesn't accept repetitions, assembler macros etc. - -#define selectblock(I) \ - cmpq $I, %rdi ; \ - cmovzq TAB+96*(I-1)(%rsp), %rax ; \ - cmovzq TAB+96*(I-1)+8(%rsp), %rbx ; \ - cmovzq TAB+96*(I-1)+16(%rsp), %rcx ; \ - cmovzq TAB+96*(I-1)+24(%rsp), %rdx ; \ - cmovzq TAB+96*(I-1)+32(%rsp), %r8 ; \ - cmovzq TAB+96*(I-1)+40(%rsp), %r9 ; \ - cmovzq TAB+96*(I-1)+48(%rsp), %r10 ; \ - cmovzq TAB+96*(I-1)+56(%rsp), %r11 ; \ - cmovzq TAB+96*(I-1)+64(%rsp), %r12 ; \ - cmovzq TAB+96*(I-1)+72(%rsp), %r13 ; \ - cmovzq TAB+96*(I-1)+80(%rsp), %r14 ; \ - cmovzq TAB+96*(I-1)+88(%rsp), %r15 - -S2N_BN_SYMBOL(sm2_montjscalarmul): - CFI_START - _CET_ENDBR - -// The Windows version literally calls the standard ABI version. -// This simplifies the proofs since subroutine offsets are fixed. - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - CFI_CALL(Lsm2_montjscalarmul_standard) - CFI_POP(%rsi) - CFI_POP(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjscalarmul) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lsm2_montjscalarmul_standard) - -Lsm2_montjscalarmul_standard: - CFI_START -#endif - -// Real start of the standard ABI code. - - CFI_PUSH(%r15) - CFI_PUSH(%r14) - CFI_PUSH(%r13) - CFI_PUSH(%r12) - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - - CFI_DEC_RSP(NSPACE) - -// Preserve the "res" and "point" input arguments. We load and process the -// scalar immediately so we don't bother preserving that input argument. -// Also, "point" is only needed early on and so its register gets re-used. - - movq %rdx, %rbx - movq %rdi, res - -// Load the digits of group order n_sm2 = [%r15;%r14;%r13;%r12] - - movq $0x53bbf40939d54123, %r12 - movq $0x7203df6b21c6052b, %r13 - movq $0xffffffffffffffff, %r14 - movq $0xfffffffeffffffff, %r15 - -// First, reduce the input scalar mod n_sm2, i.e. conditionally subtract n_sm2 - - movq (%rsi), %r8 - subq %r12, %r8 - movq 8(%rsi), %r9 - sbbq %r13, %r9 - movq 16(%rsi), %r10 - sbbq %r14, %r10 - movq 24(%rsi), %r11 - sbbq %r15, %r11 - - cmovcq (%rsi), %r8 - cmovcq 8(%rsi), %r9 - cmovcq 16(%rsi), %r10 - cmovcq 24(%rsi), %r11 - -// Now if the top bit of the reduced scalar is set, negate it mod n_sm2, -// i.e. do n |-> n_sm2 - n. Remember the sign in %rbp so we can -// correspondingly negate the point below. - - subq %r8, %r12 - sbbq %r9, %r13 - sbbq %r10, %r14 - sbbq %r11, %r15 - - movq %r11, %rbp - shrq $63, %rbp - cmovnzq %r12, %r8 - cmovnzq %r13, %r9 - cmovnzq %r14, %r10 - cmovnzq %r15, %r11 - -// In either case then add the recoding constant 0x08888...888 to allow -// signed digits. - - movq $0x8888888888888888, %rax - addq %rax, %r8 - adcq %rax, %r9 - adcq %rax, %r10 - adcq %rax, %r11 - btc $63, %r11 - - movq %r8, SCALARB(%rsp) - movq %r9, SCALARB+8(%rsp) - movq %r10, SCALARB+16(%rsp) - movq %r11, SCALARB+24(%rsp) - -// Set the tab[0] table entry to the input point = 1 * P, except -// that we negate it if the top bit of the scalar was set. This -// negation takes care over the y = 0 case to maintain all the -// coordinates < p_sm2 throughout, even though triples (x,y,z) -// with y = 0 can only represent a point on the curve when z = 0 -// and it represents the point at infinity regardless of x and y. - - movq (%rbx), %rax - movq %rax, TAB(%rsp) - movq 8(%rbx), %rax - movq %rax, TAB+8(%rsp) - movq 16(%rbx), %rax - movq %rax, TAB+16(%rsp) - movq 24(%rbx), %rax - movq %rax, TAB+24(%rsp) - - movq 32(%rbx), %r12 - movq %r12, %rax - movq 40(%rbx), %r13 - orq %r13, %rax - movq 48(%rbx), %r14 - movq %r14, %rcx - movq 56(%rbx), %r15 - orq %r15, %rcx - orq %rcx, %rax - cmovzq %rax, %rbp - - xorl %r11d, %r11d - movl $0x00000000ffffffff, %r9d - notq %r11 - movq %r11, %r8 - movq %r11, %r10 - xorq %r8, %r9 - btr $32, %r11 - - subq %r12, %r8 - sbbq %r13, %r9 - sbbq %r14, %r10 - sbbq %r15, %r11 - testq %rbp, %rbp - cmovzq %r12, %r8 - cmovzq %r13, %r9 - cmovzq %r14, %r10 - cmovzq %r15, %r11 - movq %r8, TAB+32(%rsp) - movq %r9, TAB+40(%rsp) - movq %r10, TAB+48(%rsp) - movq %r11, TAB+56(%rsp) - - movq 64(%rbx), %rax - movq %rax, TAB+64(%rsp) - movq 72(%rbx), %rax - movq %rax, TAB+72(%rsp) - movq 80(%rbx), %rax - movq %rax, TAB+80(%rsp) - movq 88(%rbx), %rax - movq %rax, TAB+88(%rsp) - -// Compute and record tab[1] = 2 * p, ..., tab[7] = 8 * P - - leaq TAB+96*1(%rsp), %rdi - leaq TAB(%rsp), %rsi - CFI_CALL(Lsm2_montjscalarmul_sm2_montjdouble) - - leaq TAB+96*2(%rsp), %rdi - leaq TAB+96*1(%rsp), %rsi - leaq TAB(%rsp), %rdx - CFI_CALL(Lsm2_montjscalarmul_sm2_montjadd) - - leaq TAB+96*3(%rsp), %rdi - leaq TAB+96*1(%rsp), %rsi - CFI_CALL(Lsm2_montjscalarmul_sm2_montjdouble) - - leaq TAB+96*4(%rsp), %rdi - leaq TAB+96*3(%rsp), %rsi - leaq TAB(%rsp), %rdx - CFI_CALL(Lsm2_montjscalarmul_sm2_montjadd) - - leaq TAB+96*5(%rsp), %rdi - leaq TAB+96*2(%rsp), %rsi - CFI_CALL(Lsm2_montjscalarmul_sm2_montjdouble) - - leaq TAB+96*6(%rsp), %rdi - leaq TAB+96*5(%rsp), %rsi - leaq TAB(%rsp), %rdx - CFI_CALL(Lsm2_montjscalarmul_sm2_montjadd) - - leaq TAB+96*7(%rsp), %rdi - leaq TAB+96*3(%rsp), %rsi - CFI_CALL(Lsm2_montjscalarmul_sm2_montjdouble) - -// Set up accumulator as table entry for top 4 bits (constant-time indexing) - - movq SCALARB+24(%rsp), %rdi - shrq $60, %rdi - - xorl %eax, %eax - xorl %ebx, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - xorl %r8d, %r8d - xorl %r9d, %r9d - xorl %r10d, %r10d - xorl %r11d, %r11d - xorl %r12d, %r12d - xorl %r13d, %r13d - xorl %r14d, %r14d - xorl %r15d, %r15d - - selectblock(1) - selectblock(2) - selectblock(3) - selectblock(4) - selectblock(5) - selectblock(6) - selectblock(7) - selectblock(8) - - movq %rax, ACC(%rsp) - movq %rbx, ACC+8(%rsp) - movq %rcx, ACC+16(%rsp) - movq %rdx, ACC+24(%rsp) - movq %r8, ACC+32(%rsp) - movq %r9, ACC+40(%rsp) - movq %r10, ACC+48(%rsp) - movq %r11, ACC+56(%rsp) - movq %r12, ACC+64(%rsp) - movq %r13, ACC+72(%rsp) - movq %r14, ACC+80(%rsp) - movq %r15, ACC+88(%rsp) - -// Main loop over size-4 bitfield - - movl $252, %ebp - -Lsm2_montjscalarmul_mainloop: - subq $4, %rbp - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lsm2_montjscalarmul_sm2_montjdouble) - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lsm2_montjscalarmul_sm2_montjdouble) - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lsm2_montjscalarmul_sm2_montjdouble) - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lsm2_montjscalarmul_sm2_montjdouble) - - movq %rbp, %rax - shrq $6, %rax - movq (%rsp,%rax,8), %rdi - movq %rbp, %rcx - shrq %cl, %rdi - andq $15, %rdi - - subq $8, %rdi - sbbq %rsi, %rsi // %rsi = sign of digit (-1 = negative) - xorq %rsi, %rdi - subq %rsi, %rdi // %rdi = absolute value of digit - - xorl %eax, %eax - xorl %ebx, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - xorl %r8d, %r8d - xorl %r9d, %r9d - xorl %r10d, %r10d - xorl %r11d, %r11d - xorl %r12d, %r12d - xorl %r13d, %r13d - xorl %r14d, %r14d - xorl %r15d, %r15d - - selectblock(1) - selectblock(2) - selectblock(3) - selectblock(4) - selectblock(5) - selectblock(6) - selectblock(7) - selectblock(8) - -// Store it to "tabent" with the y coordinate optionally negated -// Again, do it carefully to give coordinates < p_sm2 even in -// the degenerate case y = 0 (when z = 0 for points on the curve). - - movq %rax, TABENT(%rsp) - movq %rbx, TABENT+8(%rsp) - movq %rcx, TABENT+16(%rsp) - movq %rdx, TABENT+24(%rsp) - - movq %r12, TABENT+64(%rsp) - movq %r13, TABENT+72(%rsp) - movq %r14, TABENT+80(%rsp) - movq %r15, TABENT+88(%rsp) - - xorl %r15d, %r15d - movq %r8, %rax - movl $0x00000000ffffffff, %r13d - orq %r9, %rax - notq %r15 - movq %r10, %rcx - movq %r15, %r12 - orq %r11, %rcx - movq %r15, %r14 - xorq %r12, %r13 - btr $32, %r15 - orq %rcx, %rax - cmovzq %rax, %rsi - - subq %r8, %r12 - sbbq %r9, %r13 - sbbq %r10, %r14 - sbbq %r11, %r15 - - testq %rsi, %rsi - cmovnzq %r12, %r8 - cmovnzq %r13, %r9 - cmovnzq %r14, %r10 - cmovnzq %r15, %r11 - - movq %r8, TABENT+32(%rsp) - movq %r9, TABENT+40(%rsp) - movq %r10, TABENT+48(%rsp) - movq %r11, TABENT+56(%rsp) - - leaq TABENT(%rsp), %rdx - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lsm2_montjscalarmul_sm2_montjadd) - - testq %rbp, %rbp - jne Lsm2_montjscalarmul_mainloop - -// That's the end of the main loop, and we just need to copy the -// result in "acc" to the output. - - movq res, %rdi - movq ACC(%rsp), %rax - movq %rax, (%rdi) - movq ACC+8(%rsp), %rax - movq %rax, 8(%rdi) - movq ACC+16(%rsp), %rax - movq %rax, 16(%rdi) - movq ACC+24(%rsp), %rax - movq %rax, 24(%rdi) - - movq ACC+32(%rsp), %rax - movq %rax, 32(%rdi) - movq ACC+40(%rsp), %rax - movq %rax, 40(%rdi) - movq ACC+48(%rsp), %rax - movq %rax, 48(%rdi) - movq ACC+56(%rsp), %rax - movq %rax, 56(%rdi) - - movq ACC+64(%rsp), %rax - movq %rax, 64(%rdi) - movq ACC+72(%rsp), %rax - movq %rax, 72(%rdi) - movq ACC+80(%rsp), %rax - movq %rax, 80(%rdi) - movq ACC+88(%rsp), %rax - movq %rax, 88(%rdi) - -// Restore stack and registers and return - - CFI_INC_RSP(NSPACE) - CFI_POP(%rbx) - CFI_POP(%rbp) - CFI_POP(%r12) - CFI_POP(%r13) - CFI_POP(%r14) - CFI_POP(%r15) - CFI_RET - -#if WINDOWS_ABI -S2N_BN_SIZE_DIRECTIVE(Lsm2_montjscalarmul_standard) -#else -S2N_BN_SIZE_DIRECTIVE(sm2_montjscalarmul) -#endif - -// Local copies of subroutines, complete clones at the moment - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lsm2_montjscalarmul_sm2_montjadd) - -Lsm2_montjscalarmul_sm2_montjadd: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(224) - movq %rdx, %rbp - movq 0x40(%rsi), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x48(%rsi), %r9, %r10 - mulxq 0x58(%rsi), %r11, %r12 - movq 0x50(%rsi), %rdx - mulxq 0x58(%rsi), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x58(%rsi), %rdx - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x48(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x50(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x58(%rsi), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - sbbq %rax, %rax - movabsq $0xffffffff00000000, %rbx - movq %rax, %rcx - andq %rax, %rbx - btr $0x20, %rcx - subq %rax, %r12 - sbbq %rbx, %r13 - sbbq %rax, %r14 - sbbq %rcx, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x40(%rbp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x48(%rbp), %r9, %r10 - mulxq 0x58(%rbp), %r11, %r12 - movq 0x50(%rbp), %rdx - mulxq 0x58(%rbp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x40(%rbp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rbp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x58(%rbp), %rdx - mulxq 0x48(%rbp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x48(%rbp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x50(%rbp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x58(%rbp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - sbbq %rax, %rax - movabsq $0xffffffff00000000, %rbx - movq %rax, %rcx - andq %rax, %rbx - btr $0x20, %rcx - subq %rax, %r12 - sbbq %rbx, %r13 - sbbq %rax, %r14 - sbbq %rcx, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - xorl %ecx, %ecx - movq 0x20(%rsi), %rdx - mulxq 0x40(%rbp), %r8, %r9 - mulxq 0x48(%rbp), %rax, %r10 - addq %rax, %r9 - mulxq 0x50(%rbp), %rax, %r11 - adcq %rax, %r10 - mulxq 0x58(%rbp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x28(%rsi), %rdx - mulxq 0x40(%rbp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x48(%rbp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x50(%rbp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x58(%rbp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x30(%rsi), %rdx - mulxq 0x40(%rbp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rbp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x50(%rbp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x58(%rbp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x38(%rsi), %rdx - mulxq 0x40(%rbp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x48(%rbp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x50(%rbp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x58(%rbp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0xc0(%rsp) - movq %r13, 0xc8(%rsp) - movq %r14, 0xd0(%rsp) - movq %r15, 0xd8(%rsp) - xorl %ecx, %ecx - movq 0x20(%rbp), %rdx - mulxq 0x40(%rsi), %r8, %r9 - mulxq 0x48(%rsi), %rax, %r10 - addq %rax, %r9 - mulxq 0x50(%rsi), %rax, %r11 - adcq %rax, %r10 - mulxq 0x58(%rsi), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x28(%rbp), %rdx - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x50(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x58(%rsi), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x30(%rbp), %rdx - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x50(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x58(%rsi), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x38(%rbp), %rdx - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x50(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x58(%rsi), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - xorl %ecx, %ecx - movq 0x0(%rbp), %rdx - mulxq (%rsp), %r8, %r9 - mulxq 0x8(%rsp), %rax, %r10 - addq %rax, %r9 - mulxq 0x10(%rsp), %rax, %r11 - adcq %rax, %r10 - mulxq 0x18(%rsp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x8(%rbp), %rdx - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x10(%rbp), %rdx - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x18(%rsp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x18(%rbp), %rdx - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x18(%rsp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - xorl %ecx, %ecx - movq (%rsi), %rdx - mulxq 0xa0(%rsp), %r8, %r9 - mulxq 0xa8(%rsp), %rax, %r10 - addq %rax, %r9 - mulxq 0xb0(%rsp), %rax, %r11 - adcq %rax, %r10 - mulxq 0xb8(%rsp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x8(%rsi), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb8(%rsp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x10(%rsi), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb8(%rsp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x18(%rsi), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0xb8(%rsp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - xorl %ecx, %ecx - movq 0x20(%rsp), %rdx - mulxq (%rsp), %r8, %r9 - mulxq 0x8(%rsp), %rax, %r10 - addq %rax, %r9 - mulxq 0x10(%rsp), %rax, %r11 - adcq %rax, %r10 - mulxq 0x18(%rsp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x28(%rsp), %rdx - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x30(%rsp), %rdx - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x18(%rsp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x38(%rsp), %rdx - mulxq (%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x18(%rsp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - xorl %ecx, %ecx - movq 0xc0(%rsp), %rdx - mulxq 0xa0(%rsp), %r8, %r9 - mulxq 0xa8(%rsp), %rax, %r10 - addq %rax, %r9 - mulxq 0xb0(%rsp), %rax, %r11 - adcq %rax, %r10 - mulxq 0xb8(%rsp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0xc8(%rsp), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb8(%rsp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0xd0(%rsp), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb8(%rsp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0xd8(%rsp), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0xb8(%rsp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0xc0(%rsp) - movq %r13, 0xc8(%rsp) - movq %r14, 0xd0(%rsp) - movq %r15, 0xd8(%rsp) - movq 0x40(%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0xa0(%rsp) - adcq %r10, %rcx - movq %rcx, 0xa8(%rsp) - adcq %r11, %r8 - movq %r8, 0xb0(%rsp) - adcq %rdx, %r9 - movq %r9, 0xb8(%rsp) - movq 0x20(%rsp), %rax - subq 0xc0(%rsp), %rax - movq 0x28(%rsp), %rcx - sbbq 0xc8(%rsp), %rcx - movq 0x30(%rsp), %r8 - sbbq 0xd0(%rsp), %r8 - movq 0x38(%rsp), %r9 - sbbq 0xd8(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x20(%rsp) - adcq %r10, %rcx - movq %rcx, 0x28(%rsp) - adcq %r11, %r8 - movq %r8, 0x30(%rsp) - adcq %rdx, %r9 - movq %r9, 0x38(%rsp) - movq 0xa0(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0xa8(%rsp), %r9, %r10 - mulxq 0xb8(%rsp), %r11, %r12 - movq 0xb0(%rsp), %rdx - mulxq 0xb8(%rsp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0xb8(%rsp), %rdx - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0xa8(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0xb0(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0xb8(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - sbbq %rax, %rax - movabsq $0xffffffff00000000, %rbx - movq %rax, %rcx - andq %rax, %rbx - btr $0x20, %rcx - subq %rax, %r12 - sbbq %rbx, %r13 - sbbq %rax, %r14 - sbbq %rcx, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x20(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x28(%rsp), %r9, %r10 - mulxq 0x38(%rsp), %r11, %r12 - movq 0x30(%rsp), %rdx - mulxq 0x38(%rsp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x38(%rsp), %rdx - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x28(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x30(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x38(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - xorl %ecx, %ecx - movq 0x80(%rsp), %rdx - mulxq 0x60(%rsp), %r8, %r9 - mulxq 0x68(%rsp), %rax, %r10 - addq %rax, %r9 - mulxq 0x70(%rsp), %rax, %r11 - adcq %rax, %r10 - mulxq 0x78(%rsp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x88(%rsp), %rdx - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x78(%rsp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x90(%rsp), %rdx - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x78(%rsp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x98(%rsp), %rdx - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x78(%rsp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - xorl %ecx, %ecx - movq 0x40(%rsp), %rdx - mulxq 0x60(%rsp), %r8, %r9 - mulxq 0x68(%rsp), %rax, %r10 - addq %rax, %r9 - mulxq 0x70(%rsp), %rax, %r11 - adcq %rax, %r10 - mulxq 0x78(%rsp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x48(%rsp), %rdx - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x78(%rsp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x50(%rsp), %rdx - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x78(%rsp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x58(%rsp), %rdx - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x78(%rsp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq (%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq %r11, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x40(%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x60(%rsp) - adcq %r10, %rcx - movq %rcx, 0x68(%rsp) - adcq %r11, %r8 - movq %r8, 0x70(%rsp) - adcq %rdx, %r9 - movq %r9, 0x78(%rsp) - xorl %ecx, %ecx - movq 0x40(%rsi), %rdx - mulxq 0xa0(%rsp), %r8, %r9 - mulxq 0xa8(%rsp), %rax, %r10 - addq %rax, %r9 - mulxq 0xb0(%rsp), %rax, %r11 - adcq %rax, %r10 - mulxq 0xb8(%rsp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x48(%rsi), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb8(%rsp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x50(%rsi), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb8(%rsp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x58(%rsi), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0xb8(%rsp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq (%rsp), %rax - subq 0x40(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x48(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x50(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x58(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq %r11, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x80(%rsp), %rax - subq (%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x18(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq %r11, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - xorl %ecx, %ecx - movq 0xc0(%rsp), %rdx - mulxq 0x60(%rsp), %r8, %r9 - mulxq 0x68(%rsp), %rax, %r10 - addq %rax, %r9 - mulxq 0x70(%rsp), %rax, %r11 - adcq %rax, %r10 - mulxq 0x78(%rsp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0xc8(%rsp), %rdx - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x78(%rsp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0xd0(%rsp), %rdx - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x78(%rsp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0xd8(%rsp), %rdx - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x70(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x78(%rsp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - xorl %ecx, %ecx - movq 0x40(%rbp), %rdx - mulxq 0xa0(%rsp), %r8, %r9 - mulxq 0xa8(%rsp), %rax, %r10 - addq %rax, %r9 - mulxq 0xb0(%rsp), %rax, %r11 - adcq %rax, %r10 - mulxq 0xb8(%rsp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x48(%rbp), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb8(%rsp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x50(%rbp), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb8(%rsp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x58(%rbp), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0xb8(%rsp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - xorl %ecx, %ecx - movq 0x80(%rsp), %rdx - mulxq 0x20(%rsp), %r8, %r9 - mulxq 0x28(%rsp), %rax, %r10 - addq %rax, %r9 - mulxq 0x30(%rsp), %rax, %r11 - adcq %rax, %r10 - mulxq 0x38(%rsp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x88(%rsp), %rdx - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x30(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x38(%rsp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x90(%rsp), %rdx - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x30(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x38(%rsp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x98(%rsp), %rdx - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x30(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x38(%rsp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x80(%rsp), %rax - subq 0x60(%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x68(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x70(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x78(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq %r11, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - movq 0x40(%rsi), %r8 - movq 0x48(%rsi), %r9 - movq 0x50(%rsi), %r10 - movq 0x58(%rsi), %r11 - movq %r8, %rax - movq %r9, %rdx - orq %r10, %rax - orq %r11, %rdx - orq %rdx, %rax - negq %rax - sbbq %rax, %rax - movq 0x40(%rbp), %r12 - movq 0x48(%rbp), %r13 - movq 0x50(%rbp), %r14 - movq 0x58(%rbp), %r15 - movq %r12, %rbx - movq %r13, %rdx - orq %r14, %rbx - orq %r15, %rdx - orq %rdx, %rbx - negq %rbx - sbbq %rbx, %rbx - cmpq %rax, %rbx - cmovbq %r8, %r12 - cmovbq %r9, %r13 - cmovbq %r10, %r14 - cmovbq %r11, %r15 - cmoveq 0xa0(%rsp), %r12 - cmoveq 0xa8(%rsp), %r13 - cmoveq 0xb0(%rsp), %r14 - cmoveq 0xb8(%rsp), %r15 - movq (%rsp), %rax - cmovbq (%rsi), %rax - cmova 0x0(%rbp), %rax - movq 0x8(%rsp), %rbx - cmovbq 0x8(%rsi), %rbx - cmova 0x8(%rbp), %rbx - movq 0x10(%rsp), %rcx - cmovbq 0x10(%rsi), %rcx - cmova 0x10(%rbp), %rcx - movq 0x18(%rsp), %rdx - cmovbq 0x18(%rsi), %rdx - cmova 0x18(%rbp), %rdx - movq 0x80(%rsp), %r8 - cmovbq 0x20(%rsi), %r8 - cmova 0x20(%rbp), %r8 - movq 0x88(%rsp), %r9 - cmovbq 0x28(%rsi), %r9 - cmova 0x28(%rbp), %r9 - movq 0x90(%rsp), %r10 - cmovbq 0x30(%rsi), %r10 - cmova 0x30(%rbp), %r10 - movq 0x98(%rsp), %r11 - cmovbq 0x38(%rsi), %r11 - cmova 0x38(%rbp), %r11 - movq %rax, (%rdi) - movq %rbx, 0x8(%rdi) - movq %rcx, 0x10(%rdi) - movq %rdx, 0x18(%rdi) - movq %r8, 0x20(%rdi) - movq %r9, 0x28(%rdi) - movq %r10, 0x30(%rdi) - movq %r11, 0x38(%rdi) - movq %r12, 0x40(%rdi) - movq %r13, 0x48(%rdi) - movq %r14, 0x50(%rdi) - movq %r15, 0x58(%rdi) - CFI_INC_RSP(224) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lsm2_montjscalarmul_sm2_montjadd) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lsm2_montjscalarmul_sm2_montjdouble) - -Lsm2_montjscalarmul_sm2_montjdouble: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(192) - movq 0x40(%rsi), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x48(%rsi), %r9, %r10 - mulxq 0x58(%rsi), %r11, %r12 - movq 0x50(%rsi), %rdx - mulxq 0x58(%rsi), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x40(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x58(%rsi), %rdx - mulxq 0x48(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x48(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x50(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x58(%rsi), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x20(%rsi), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x28(%rsi), %r9, %r10 - mulxq 0x38(%rsi), %r11, %r12 - movq 0x30(%rsi), %rdx - mulxq 0x38(%rsi), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x20(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x38(%rsi), %rdx - mulxq 0x28(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x28(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x30(%rsi), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x38(%rsi), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq (%rsi), %rax - subq (%rsp), %rax - movq 0x8(%rsi), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x10(%rsi), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x18(%rsi), %r9 - sbbq 0x18(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x60(%rsp) - adcq %r10, %rcx - movq %rcx, 0x68(%rsp) - adcq %r11, %r8 - movq %r8, 0x70(%rsp) - adcq %rdx, %r9 - movq %r9, 0x78(%rsp) - movq (%rsi), %rax - addq (%rsp), %rax - movq 0x8(%rsi), %rcx - adcq 0x8(%rsp), %rcx - movq 0x10(%rsi), %r8 - adcq 0x10(%rsp), %r8 - movq 0x18(%rsi), %r9 - adcq 0x18(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - subq %r11, %rax - movq %rax, 0x40(%rsp) - sbbq %r10, %rcx - movq %rcx, 0x48(%rsp) - sbbq %r11, %r8 - movq %r8, 0x50(%rsp) - sbbq %rdx, %r9 - movq %r9, 0x58(%rsp) - xorl %ecx, %ecx - movq 0x60(%rsp), %rdx - mulxq 0x40(%rsp), %r8, %r9 - mulxq 0x48(%rsp), %rax, %r10 - addq %rax, %r9 - mulxq 0x50(%rsp), %rax, %r11 - adcq %rax, %r10 - mulxq 0x58(%rsp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x68(%rsp), %rdx - mulxq 0x40(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x48(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x50(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x58(%rsp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x70(%rsp), %rdx - mulxq 0x40(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x50(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x58(%rsp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x78(%rsp), %rdx - mulxq 0x40(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x48(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x50(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x58(%rsp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - xorq %r11, %r11 - movq 0x20(%rsi), %rax - addq 0x40(%rsi), %rax - movq 0x28(%rsi), %rcx - adcq 0x48(%rsi), %rcx - movq 0x30(%rsi), %r8 - adcq 0x50(%rsi), %r8 - movq 0x38(%rsi), %r9 - adcq 0x58(%rsi), %r9 - adcq %r11, %r11 - subq $0xffffffffffffffff, %rax - movabsq $0xffffffff00000000, %r10 - sbbq %r10, %rcx - sbbq $0xffffffffffffffff, %r8 - movabsq $0xfffffffeffffffff, %rdx - sbbq %rdx, %r9 - sbbq $0x0, %r11 - andq %r11, %r10 - andq %r11, %rdx - addq %r11, %rax - movq %rax, 0x40(%rsp) - adcq %r10, %rcx - movq %rcx, 0x48(%rsp) - adcq %r11, %r8 - movq %r8, 0x50(%rsp) - adcq %rdx, %r9 - movq %r9, 0x58(%rsp) - xorl %ecx, %ecx - movq 0x20(%rsp), %rdx - mulxq (%rsi), %r8, %r9 - mulxq 0x8(%rsi), %rax, %r10 - addq %rax, %r9 - mulxq 0x10(%rsi), %rax, %r11 - adcq %rax, %r10 - mulxq 0x18(%rsi), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x28(%rsp), %rdx - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x18(%rsi), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x30(%rsp), %rdx - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x18(%rsi), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x38(%rsp), %rdx - mulxq (%rsi), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0x8(%rsi), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0x10(%rsi), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0x18(%rsi), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x60(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x68(%rsp), %r9, %r10 - mulxq 0x78(%rsp), %r11, %r12 - movq 0x70(%rsp), %rdx - mulxq 0x78(%rsp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x60(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x78(%rsp), %rdx - mulxq 0x68(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x68(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x70(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x78(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq 0x40(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x48(%rsp), %r9, %r10 - mulxq 0x58(%rsp), %r11, %r12 - movq 0x50(%rsp), %rdx - mulxq 0x58(%rsp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x40(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x48(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x58(%rsp), %rdx - mulxq 0x48(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x48(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x50(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x58(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq $0xffffffffffffffff, %r8 - movq %r8, %r10 - subq 0xa0(%rsp), %r8 - movabsq $0xffffffff00000000, %r9 - sbbq 0xa8(%rsp), %r9 - sbbq 0xb0(%rsp), %r10 - movabsq $0xfffffffeffffffff, %r11 - sbbq 0xb8(%rsp), %r11 - xorl %r12d, %r12d - movq $0x9, %rdx - mulxq %r8, %r8, %rax - mulxq %r9, %r9, %rcx - addq %rax, %r9 - mulxq %r10, %r10, %rax - adcq %rcx, %r10 - mulxq %r11, %r11, %rcx - adcq %rax, %r11 - adcq %rcx, %r12 - movq $0xc, %rdx - xorl %eax, %eax - mulxq 0x80(%rsp), %rax, %rcx - adcxq %rax, %r8 - adoxq %rcx, %r9 - mulxq 0x88(%rsp), %rax, %rcx - adcxq %rax, %r9 - adoxq %rcx, %r10 - mulxq 0x90(%rsp), %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - mulxq 0x98(%rsp), %rax, %rdx - adcxq %rax, %r11 - adoxq %r12, %rdx - adcq $0x1, %rdx - movq %rdx, %rax - shlq $0x20, %rax - movq %rax, %rcx - subq %rdx, %rax - addq %rdx, %r8 - adcq %rax, %r9 - adcq $0x0, %r10 - adcq %rcx, %r11 - sbbq %rdx, %rdx - notq %rdx - movabsq $0xffffffff00000000, %rax - andq %rdx, %rax - movq %rdx, %rcx - btr $0x20, %rcx - addq %rdx, %r8 - movq %r8, 0xa0(%rsp) - adcq %rax, %r9 - movq %r9, 0xa8(%rsp) - adcq %rdx, %r10 - movq %r10, 0xb0(%rsp) - adcq %rcx, %r11 - movq %r11, 0xb8(%rsp) - movq 0x40(%rsp), %rax - subq (%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x18(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x40(%rsp) - adcq %r10, %rcx - movq %rcx, 0x48(%rsp) - adcq %r11, %r8 - movq %r8, 0x50(%rsp) - adcq %rdx, %r9 - movq %r9, 0x58(%rsp) - movq 0x20(%rsp), %rdx - mulxq %rdx, %r8, %r15 - mulxq 0x28(%rsp), %r9, %r10 - mulxq 0x38(%rsp), %r11, %r12 - movq 0x30(%rsp), %rdx - mulxq 0x38(%rsp), %r13, %r14 - xorl %ecx, %ecx - mulxq 0x20(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - movq 0x38(%rsp), %rdx - mulxq 0x28(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - adcxq %rcx, %r13 - adoxq %rcx, %r14 - adcq %rcx, %r14 - xorl %ecx, %ecx - adcxq %r9, %r9 - adoxq %r15, %r9 - movq 0x28(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r10, %r10 - adoxq %rax, %r10 - adcxq %r11, %r11 - adoxq %rdx, %r11 - movq 0x30(%rsp), %rdx - mulxq %rdx, %rax, %rdx - adcxq %r12, %r12 - adoxq %rax, %r12 - adcxq %r13, %r13 - adoxq %rdx, %r13 - movq 0x38(%rsp), %rdx - mulxq %rdx, %rax, %r15 - adcxq %r14, %r14 - adoxq %rax, %r14 - adcxq %rcx, %r15 - adoxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - xorl %ecx, %ecx - movq 0x60(%rsp), %rdx - mulxq 0xa0(%rsp), %r8, %r9 - mulxq 0xa8(%rsp), %rax, %r10 - addq %rax, %r9 - mulxq 0xb0(%rsp), %rax, %r11 - adcq %rax, %r10 - mulxq 0xb8(%rsp), %rax, %r12 - adcq %rax, %r11 - adcq %rcx, %r12 - xorl %ecx, %ecx - movq 0x68(%rsp), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r9 - adoxq %rbx, %r10 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb8(%rsp), %rax, %r13 - adcxq %rax, %r12 - adoxq %rcx, %r13 - adcxq %rcx, %r13 - xorl %ecx, %ecx - movq 0x70(%rsp), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r10 - adoxq %rbx, %r11 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb8(%rsp), %rax, %r14 - adcxq %rax, %r13 - adoxq %rcx, %r14 - adcxq %rcx, %r14 - xorl %ecx, %ecx - movq 0x78(%rsp), %rdx - mulxq 0xa0(%rsp), %rax, %rbx - adcxq %rax, %r11 - adoxq %rbx, %r12 - mulxq 0xa8(%rsp), %rax, %rbx - adcxq %rax, %r12 - adoxq %rbx, %r13 - mulxq 0xb0(%rsp), %rax, %rbx - adcxq %rax, %r13 - adoxq %rbx, %r14 - mulxq 0xb8(%rsp), %rax, %r15 - adcxq %rax, %r14 - adoxq %rcx, %r15 - adcxq %rcx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x40(%rsp), %rax - subq 0x20(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x28(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x30(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x38(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x40(%rdi) - adcq %r10, %rcx - movq %rcx, 0x48(%rdi) - adcq %r11, %r8 - movq %r8, 0x50(%rdi) - adcq %rdx, %r9 - movq %r9, 0x58(%rdi) - movq 0x98(%rsp), %r11 - movq %r11, %rdx - movq 0x90(%rsp), %r10 - shldq $0x2, %r10, %r11 - movq 0x88(%rsp), %r9 - shldq $0x2, %r9, %r10 - movq 0x80(%rsp), %r8 - shldq $0x2, %r8, %r9 - shlq $0x2, %r8 - shrq $0x3e, %rdx - addq $0x1, %rdx - subq 0xa0(%rsp), %r8 - sbbq 0xa8(%rsp), %r9 - sbbq 0xb0(%rsp), %r10 - sbbq 0xb8(%rsp), %r11 - sbbq $0x0, %rdx - movq %rdx, %rax - shlq $0x20, %rax - movq %rax, %rcx - subq %rdx, %rax - addq %rdx, %r8 - adcq %rax, %r9 - adcq $0x0, %r10 - adcq %rcx, %r11 - sbbq %rdx, %rdx - notq %rdx - movabsq $0xffffffff00000000, %rax - andq %rdx, %rax - movq %rdx, %rcx - btr $0x20, %rcx - addq %rdx, %r8 - movq %r8, (%rdi) - adcq %rax, %r9 - movq %r9, 0x8(%rdi) - adcq %rdx, %r10 - movq %r10, 0x10(%rdi) - adcq %rcx, %r11 - movq %r11, 0x18(%rdi) - movq $0xffffffffffffffff, %r8 - movq %r8, %r10 - subq (%rsp), %r8 - movabsq $0xffffffff00000000, %r9 - sbbq 0x8(%rsp), %r9 - sbbq 0x10(%rsp), %r10 - movabsq $0xfffffffeffffffff, %r11 - sbbq 0x18(%rsp), %r11 - movq %r11, %r12 - shldq $0x3, %r10, %r11 - shldq $0x3, %r9, %r10 - shldq $0x3, %r8, %r9 - shlq $0x3, %r8 - shrq $0x3d, %r12 - movq $0x3, %rdx - xorl %eax, %eax - mulxq 0x60(%rsp), %rax, %rcx - adcxq %rax, %r8 - adoxq %rcx, %r9 - mulxq 0x68(%rsp), %rax, %rcx - adcxq %rax, %r9 - adoxq %rcx, %r10 - mulxq 0x70(%rsp), %rax, %rcx - adcxq %rax, %r10 - adoxq %rcx, %r11 - mulxq 0x78(%rsp), %rax, %rdx - adcxq %rax, %r11 - adoxq %r12, %rdx - adcq $0x1, %rdx - movq %rdx, %rax - shlq $0x20, %rax - movq %rax, %rcx - subq %rdx, %rax - addq %rdx, %r8 - adcq %rax, %r9 - adcq $0x0, %r10 - adcq %rcx, %r11 - sbbq %rdx, %rdx - notq %rdx - movabsq $0xffffffff00000000, %rax - andq %rdx, %rax - movq %rdx, %rcx - btr $0x20, %rcx - addq %rdx, %r8 - movq %r8, 0x20(%rdi) - adcq %rax, %r9 - movq %r9, 0x28(%rdi) - adcq %rdx, %r10 - movq %r10, 0x30(%rdi) - adcq %rcx, %r11 - movq %r11, 0x38(%rdi) - CFI_INC_RSP(192) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lsm2_montjscalarmul_sm2_montjdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif diff --git a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjscalarmul_alt.S b/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjscalarmul_alt.S deleted file mode 100644 index 9e503ba6b69..00000000000 --- a/third_party/s2n-bignum/s2n-bignum-imported/x86_att/sm2/sm2_montjscalarmul_alt.S +++ /dev/null @@ -1,4550 +0,0 @@ -// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. -// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 - -// ---------------------------------------------------------------------------- -// Montgomery-Jacobian form scalar multiplication for GM/T 0003-2012 curve SM2 -// Input scalar[4], point[12]; output res[12] -// -// extern void sm2_montjscalarmul_alt -// (uint64_t res[static 12], -// const uint64_t scalar[static 4], -// const uint64_t point[static 12]); -// -// This function is a variant of its affine point version sm2_scalarmul. -// Here, input and output points are assumed to be in Jacobian form with -// their coordinates in the Montgomery domain. Thus, if priming indicates -// Montgomery form, x' = (2^256 * x) mod p_sm2 etc., each point argument -// is a triple (x',y',z') representing the affine point (x/z^2,y/z^3) when -// z' is nonzero or the point at infinity (group identity) if z' = 0. -// -// Given scalar = n and point = P, assumed to be on the NIST elliptic -// curve SM2, returns a representation of n * P. If the result is the -// point at infinity (either because the input point was or because the -// scalar was a multiple of p_sm2) then the output is guaranteed to -// represent the point at infinity, i.e. to have its z coordinate zero. -// -// Standard x86-64 ABI: RDI = res, RSI = scalar, RDX = point -// Microsoft x64 ABI: RCX = res, RDX = scalar, R8 = point -// ---------------------------------------------------------------------------- - -#include "_internal_s2n_bignum_x86_att.h" - - - S2N_BN_SYM_VISIBILITY_DIRECTIVE(sm2_montjscalarmul_alt) - S2N_BN_FUNCTION_TYPE_DIRECTIVE(sm2_montjscalarmul_alt) - S2N_BN_SYM_PRIVACY_DIRECTIVE(sm2_montjscalarmul_alt) - - - .text - .balign 4 - -// Size of individual field elements - -#define NUMSIZE 32 - -// Intermediate variables on the stack. Uppercase syntactic variants -// make x86_att version simpler to generate. - -#define SCALARB (0*NUMSIZE) -#define scalarb (0*NUMSIZE)(%rsp) -#define ACC (1*NUMSIZE) -#define acc (1*NUMSIZE)(%rsp) -#define TABENT (4*NUMSIZE) -#define tabent (4*NUMSIZE)(%rsp) - -#define TAB (7*NUMSIZE) -#define tab (7*NUMSIZE)(%rsp) - -#define res (31*NUMSIZE)(%rsp) - -#define NSPACE 32*NUMSIZE - -// Avoid using .rep for the sake of the BoringSSL/AWS-LC delocator, -// which doesn't accept repetitions, assembler macros etc. - -#define selectblock(I) \ - cmpq $I, %rdi ; \ - cmovzq TAB+96*(I-1)(%rsp), %rax ; \ - cmovzq TAB+96*(I-1)+8(%rsp), %rbx ; \ - cmovzq TAB+96*(I-1)+16(%rsp), %rcx ; \ - cmovzq TAB+96*(I-1)+24(%rsp), %rdx ; \ - cmovzq TAB+96*(I-1)+32(%rsp), %r8 ; \ - cmovzq TAB+96*(I-1)+40(%rsp), %r9 ; \ - cmovzq TAB+96*(I-1)+48(%rsp), %r10 ; \ - cmovzq TAB+96*(I-1)+56(%rsp), %r11 ; \ - cmovzq TAB+96*(I-1)+64(%rsp), %r12 ; \ - cmovzq TAB+96*(I-1)+72(%rsp), %r13 ; \ - cmovzq TAB+96*(I-1)+80(%rsp), %r14 ; \ - cmovzq TAB+96*(I-1)+88(%rsp), %r15 - -S2N_BN_SYMBOL(sm2_montjscalarmul_alt): - CFI_START - _CET_ENDBR - -// The Windows version literally calls the standard ABI version. -// This simplifies the proofs since subroutine offsets are fixed. - -#if WINDOWS_ABI - CFI_PUSH(%rdi) - CFI_PUSH(%rsi) - movq %rcx, %rdi - movq %rdx, %rsi - movq %r8, %rdx - CFI_CALL(Lsm2_montjscalarmul_alt_standard) - CFI_POP(%rsi) - CFI_POP(%rdi) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(sm2_montjscalarmul_alt) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lsm2_montjscalarmul_alt_standard) - -Lsm2_montjscalarmul_alt_standard: - CFI_START -#endif - -// Real start of the standard ABI code. - - CFI_PUSH(%r15) - CFI_PUSH(%r14) - CFI_PUSH(%r13) - CFI_PUSH(%r12) - CFI_PUSH(%rbp) - CFI_PUSH(%rbx) - - CFI_DEC_RSP(NSPACE) - -// Preserve the "res" and "point" input arguments. We load and process the -// scalar immediately so we don't bother preserving that input argument. -// Also, "point" is only needed early on and so its register gets re-used. - - movq %rdx, %rbx - movq %rdi, res - -// Load the digits of group order n_sm2 = [%r15;%r14;%r13;%r12] - - movq $0x53bbf40939d54123, %r12 - movq $0x7203df6b21c6052b, %r13 - movq $0xffffffffffffffff, %r14 - movq $0xfffffffeffffffff, %r15 - -// First, reduce the input scalar mod n_sm2, i.e. conditionally subtract n_sm2 - - movq (%rsi), %r8 - subq %r12, %r8 - movq 8(%rsi), %r9 - sbbq %r13, %r9 - movq 16(%rsi), %r10 - sbbq %r14, %r10 - movq 24(%rsi), %r11 - sbbq %r15, %r11 - - cmovcq (%rsi), %r8 - cmovcq 8(%rsi), %r9 - cmovcq 16(%rsi), %r10 - cmovcq 24(%rsi), %r11 - -// Now if the top bit of the reduced scalar is set, negate it mod n_sm2, -// i.e. do n |-> n_sm2 - n. Remember the sign in %rbp so we can -// correspondingly negate the point below. - - subq %r8, %r12 - sbbq %r9, %r13 - sbbq %r10, %r14 - sbbq %r11, %r15 - - movq %r11, %rbp - shrq $63, %rbp - cmovnzq %r12, %r8 - cmovnzq %r13, %r9 - cmovnzq %r14, %r10 - cmovnzq %r15, %r11 - -// In either case then add the recoding constant 0x08888...888 to allow -// signed digits. - - movq $0x8888888888888888, %rax - addq %rax, %r8 - adcq %rax, %r9 - adcq %rax, %r10 - adcq %rax, %r11 - btc $63, %r11 - - movq %r8, SCALARB(%rsp) - movq %r9, SCALARB+8(%rsp) - movq %r10, SCALARB+16(%rsp) - movq %r11, SCALARB+24(%rsp) - -// Set the tab[0] table entry to the input point = 1 * P, except -// that we negate it if the top bit of the scalar was set. This -// negation takes care over the y = 0 case to maintain all the -// coordinates < p_sm2 throughout, even though triples (x,y,z) -// with y = 0 can only represent a point on the curve when z = 0 -// and it represents the point at infinity regardless of x and y. - - movq (%rbx), %rax - movq %rax, TAB(%rsp) - movq 8(%rbx), %rax - movq %rax, TAB+8(%rsp) - movq 16(%rbx), %rax - movq %rax, TAB+16(%rsp) - movq 24(%rbx), %rax - movq %rax, TAB+24(%rsp) - - movq 32(%rbx), %r12 - movq %r12, %rax - movq 40(%rbx), %r13 - orq %r13, %rax - movq 48(%rbx), %r14 - movq %r14, %rcx - movq 56(%rbx), %r15 - orq %r15, %rcx - orq %rcx, %rax - cmovzq %rax, %rbp - - xorl %r11d, %r11d - movl $0x00000000ffffffff, %r9d - notq %r11 - movq %r11, %r8 - movq %r11, %r10 - xorq %r8, %r9 - btr $32, %r11 - - subq %r12, %r8 - sbbq %r13, %r9 - sbbq %r14, %r10 - sbbq %r15, %r11 - testq %rbp, %rbp - cmovzq %r12, %r8 - cmovzq %r13, %r9 - cmovzq %r14, %r10 - cmovzq %r15, %r11 - movq %r8, TAB+32(%rsp) - movq %r9, TAB+40(%rsp) - movq %r10, TAB+48(%rsp) - movq %r11, TAB+56(%rsp) - - movq 64(%rbx), %rax - movq %rax, TAB+64(%rsp) - movq 72(%rbx), %rax - movq %rax, TAB+72(%rsp) - movq 80(%rbx), %rax - movq %rax, TAB+80(%rsp) - movq 88(%rbx), %rax - movq %rax, TAB+88(%rsp) - -// Compute and record tab[1] = 2 * p, ..., tab[7] = 8 * P - - leaq TAB+96*1(%rsp), %rdi - leaq TAB(%rsp), %rsi - CFI_CALL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - leaq TAB+96*2(%rsp), %rdi - leaq TAB+96*1(%rsp), %rsi - leaq TAB(%rsp), %rdx - CFI_CALL(Lsm2_montjscalarmul_alt_sm2_montjadd) - - leaq TAB+96*3(%rsp), %rdi - leaq TAB+96*1(%rsp), %rsi - CFI_CALL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - leaq TAB+96*4(%rsp), %rdi - leaq TAB+96*3(%rsp), %rsi - leaq TAB(%rsp), %rdx - CFI_CALL(Lsm2_montjscalarmul_alt_sm2_montjadd) - - leaq TAB+96*5(%rsp), %rdi - leaq TAB+96*2(%rsp), %rsi - CFI_CALL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - leaq TAB+96*6(%rsp), %rdi - leaq TAB+96*5(%rsp), %rsi - leaq TAB(%rsp), %rdx - CFI_CALL(Lsm2_montjscalarmul_alt_sm2_montjadd) - - leaq TAB+96*7(%rsp), %rdi - leaq TAB+96*3(%rsp), %rsi - CFI_CALL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - -// Set up accumulator as table entry for top 4 bits (constant-time indexing) - - movq SCALARB+24(%rsp), %rdi - shrq $60, %rdi - - xorl %eax, %eax - xorl %ebx, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - xorl %r8d, %r8d - xorl %r9d, %r9d - xorl %r10d, %r10d - xorl %r11d, %r11d - xorl %r12d, %r12d - xorl %r13d, %r13d - xorl %r14d, %r14d - xorl %r15d, %r15d - - selectblock(1) - selectblock(2) - selectblock(3) - selectblock(4) - selectblock(5) - selectblock(6) - selectblock(7) - selectblock(8) - - movq %rax, ACC(%rsp) - movq %rbx, ACC+8(%rsp) - movq %rcx, ACC+16(%rsp) - movq %rdx, ACC+24(%rsp) - movq %r8, ACC+32(%rsp) - movq %r9, ACC+40(%rsp) - movq %r10, ACC+48(%rsp) - movq %r11, ACC+56(%rsp) - movq %r12, ACC+64(%rsp) - movq %r13, ACC+72(%rsp) - movq %r14, ACC+80(%rsp) - movq %r15, ACC+88(%rsp) - -// Main loop over size-4 bitfield - - movl $252, %ebp - -Lsm2_montjscalarmul_alt_mainloop: - subq $4, %rbp - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lsm2_montjscalarmul_alt_sm2_montjdouble) - - movq %rbp, %rax - shrq $6, %rax - movq (%rsp,%rax,8), %rdi - movq %rbp, %rcx - shrq %cl, %rdi - andq $15, %rdi - - subq $8, %rdi - sbbq %rsi, %rsi // %rsi = sign of digit (-1 = negative) - xorq %rsi, %rdi - subq %rsi, %rdi // %rdi = absolute value of digit - - xorl %eax, %eax - xorl %ebx, %ebx - xorl %ecx, %ecx - xorl %edx, %edx - xorl %r8d, %r8d - xorl %r9d, %r9d - xorl %r10d, %r10d - xorl %r11d, %r11d - xorl %r12d, %r12d - xorl %r13d, %r13d - xorl %r14d, %r14d - xorl %r15d, %r15d - - selectblock(1) - selectblock(2) - selectblock(3) - selectblock(4) - selectblock(5) - selectblock(6) - selectblock(7) - selectblock(8) - -// Store it to "tabent" with the y coordinate optionally negated -// Again, do it carefully to give coordinates < p_sm2 even in -// the degenerate case y = 0 (when z = 0 for points on the curve). - - movq %rax, TABENT(%rsp) - movq %rbx, TABENT+8(%rsp) - movq %rcx, TABENT+16(%rsp) - movq %rdx, TABENT+24(%rsp) - - movq %r12, TABENT+64(%rsp) - movq %r13, TABENT+72(%rsp) - movq %r14, TABENT+80(%rsp) - movq %r15, TABENT+88(%rsp) - - xorl %r15d, %r15d - movq %r8, %rax - movl $0x00000000ffffffff, %r13d - orq %r9, %rax - notq %r15 - movq %r10, %rcx - movq %r15, %r12 - orq %r11, %rcx - movq %r15, %r14 - xorq %r12, %r13 - btr $32, %r15 - orq %rcx, %rax - cmovzq %rax, %rsi - - subq %r8, %r12 - sbbq %r9, %r13 - sbbq %r10, %r14 - sbbq %r11, %r15 - - testq %rsi, %rsi - cmovnzq %r12, %r8 - cmovnzq %r13, %r9 - cmovnzq %r14, %r10 - cmovnzq %r15, %r11 - - movq %r8, TABENT+32(%rsp) - movq %r9, TABENT+40(%rsp) - movq %r10, TABENT+48(%rsp) - movq %r11, TABENT+56(%rsp) - - leaq TABENT(%rsp), %rdx - leaq ACC(%rsp), %rsi - leaq ACC(%rsp), %rdi - CFI_CALL(Lsm2_montjscalarmul_alt_sm2_montjadd) - - testq %rbp, %rbp - jne Lsm2_montjscalarmul_alt_mainloop - -// That's the end of the main loop, and we just need to copy the -// result in "acc" to the output. - - movq res, %rdi - movq ACC(%rsp), %rax - movq %rax, (%rdi) - movq ACC+8(%rsp), %rax - movq %rax, 8(%rdi) - movq ACC+16(%rsp), %rax - movq %rax, 16(%rdi) - movq ACC+24(%rsp), %rax - movq %rax, 24(%rdi) - - movq ACC+32(%rsp), %rax - movq %rax, 32(%rdi) - movq ACC+40(%rsp), %rax - movq %rax, 40(%rdi) - movq ACC+48(%rsp), %rax - movq %rax, 48(%rdi) - movq ACC+56(%rsp), %rax - movq %rax, 56(%rdi) - - movq ACC+64(%rsp), %rax - movq %rax, 64(%rdi) - movq ACC+72(%rsp), %rax - movq %rax, 72(%rdi) - movq ACC+80(%rsp), %rax - movq %rax, 80(%rdi) - movq ACC+88(%rsp), %rax - movq %rax, 88(%rdi) - -// Restore stack and registers and return - - CFI_INC_RSP(NSPACE) - CFI_POP(%rbx) - CFI_POP(%rbp) - CFI_POP(%r12) - CFI_POP(%r13) - CFI_POP(%r14) - CFI_POP(%r15) - CFI_RET - -#if WINDOWS_ABI -S2N_BN_SIZE_DIRECTIVE(Lsm2_montjscalarmul_alt_standard) -#else -S2N_BN_SIZE_DIRECTIVE(sm2_montjscalarmul_alt) -#endif - -// Local copies of subroutines, complete clones at the moment - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lsm2_montjscalarmul_alt_sm2_montjadd) - -Lsm2_montjscalarmul_alt_sm2_montjadd: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%rbp) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(224) - movq %rdx, %rbp - movq 0x40(%rsi), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x48(%rsi), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x58(%rsi), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x50(%rsi), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x48(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x58(%rsi), %rbx - movq 0x48(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x48(%rsi), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x50(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x58(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x40(%rbp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x48(%rbp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x58(%rbp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x50(%rbp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x40(%rbp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x48(%rbp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x58(%rbp), %rbx - movq 0x48(%rbp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x48(%rbp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x50(%rbp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x58(%rbp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq 0x40(%rbp), %rax - mulq 0x20(%rsi) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq 0x40(%rbp), %rax - mulq 0x28(%rsi) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x48(%rbp), %rax - mulq 0x20(%rsi) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq 0x40(%rbp), %rax - mulq 0x30(%rsi) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0x48(%rbp), %rax - mulq 0x28(%rsi) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0x50(%rbp), %rax - mulq 0x20(%rsi) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq 0x40(%rbp), %rax - mulq 0x38(%rsi) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0x48(%rbp), %rax - mulq 0x30(%rsi) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x50(%rbp), %rax - mulq 0x28(%rsi) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x58(%rbp), %rax - mulq 0x20(%rsi) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0x48(%rbp), %rax - mulq 0x38(%rsi) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x50(%rbp), %rax - mulq 0x30(%rsi) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0x58(%rbp), %rax - mulq 0x28(%rsi) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0x50(%rbp), %rax - mulq 0x38(%rsi) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x58(%rbp), %rax - mulq 0x30(%rsi) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0x58(%rbp), %rax - mulq 0x38(%rsi) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0xc0(%rsp) - movq %r13, 0xc8(%rsp) - movq %r14, 0xd0(%rsp) - movq %r15, 0xd8(%rsp) - movq 0x40(%rsi), %rax - mulq 0x20(%rbp) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq 0x40(%rsi), %rax - mulq 0x28(%rbp) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x48(%rsi), %rax - mulq 0x20(%rbp) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq 0x40(%rsi), %rax - mulq 0x30(%rbp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0x48(%rsi), %rax - mulq 0x28(%rbp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0x50(%rsi), %rax - mulq 0x20(%rbp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq 0x40(%rsi), %rax - mulq 0x38(%rbp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0x48(%rsi), %rax - mulq 0x30(%rbp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x50(%rsi), %rax - mulq 0x28(%rbp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x58(%rsi), %rax - mulq 0x20(%rbp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0x48(%rsi), %rax - mulq 0x38(%rbp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x50(%rsi), %rax - mulq 0x30(%rbp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0x58(%rsi), %rax - mulq 0x28(%rbp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0x50(%rsi), %rax - mulq 0x38(%rbp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x58(%rsi), %rax - mulq 0x30(%rbp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0x58(%rsi), %rax - mulq 0x38(%rbp) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq (%rsp), %rax - mulq 0x0(%rbp) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq (%rsp), %rax - mulq 0x8(%rbp) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x8(%rsp), %rax - mulq 0x0(%rbp) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq (%rsp), %rax - mulq 0x10(%rbp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0x8(%rsp), %rax - mulq 0x8(%rbp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0x10(%rsp), %rax - mulq 0x0(%rbp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq (%rsp), %rax - mulq 0x18(%rbp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0x8(%rsp), %rax - mulq 0x10(%rbp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x10(%rsp), %rax - mulq 0x8(%rbp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x18(%rsp), %rax - mulq 0x0(%rbp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0x8(%rsp), %rax - mulq 0x18(%rbp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rsp), %rax - mulq 0x10(%rbp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0x18(%rsp), %rax - mulq 0x8(%rbp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0x10(%rsp), %rax - mulq 0x18(%rbp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rsp), %rax - mulq 0x10(%rbp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0x18(%rsp), %rax - mulq 0x18(%rbp) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq 0xa0(%rsp), %rax - mulq (%rsi) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq 0xa0(%rsp), %rax - mulq 0x8(%rsi) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0xa8(%rsp), %rax - mulq (%rsi) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq 0xa0(%rsp), %rax - mulq 0x10(%rsi) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0xa8(%rsp), %rax - mulq 0x8(%rsi) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0xb0(%rsp), %rax - mulq (%rsi) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq 0xa0(%rsp), %rax - mulq 0x18(%rsi) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0xa8(%rsp), %rax - mulq 0x10(%rsi) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0xb0(%rsp), %rax - mulq 0x8(%rsi) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0xb8(%rsp), %rax - mulq (%rsi) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0xa8(%rsp), %rax - mulq 0x18(%rsi) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0xb0(%rsp), %rax - mulq 0x10(%rsi) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0xb8(%rsp), %rax - mulq 0x8(%rsi) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0xb0(%rsp), %rax - mulq 0x18(%rsi) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0xb8(%rsp), %rax - mulq 0x10(%rsi) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0xb8(%rsp), %rax - mulq 0x18(%rsi) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq (%rsp), %rax - mulq 0x20(%rsp) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq (%rsp), %rax - mulq 0x28(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x8(%rsp), %rax - mulq 0x20(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq (%rsp), %rax - mulq 0x30(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0x8(%rsp), %rax - mulq 0x28(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0x10(%rsp), %rax - mulq 0x20(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq (%rsp), %rax - mulq 0x38(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0x8(%rsp), %rax - mulq 0x30(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x10(%rsp), %rax - mulq 0x28(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x18(%rsp), %rax - mulq 0x20(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0x8(%rsp), %rax - mulq 0x38(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rsp), %rax - mulq 0x30(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0x18(%rsp), %rax - mulq 0x28(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0x10(%rsp), %rax - mulq 0x38(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rsp), %rax - mulq 0x30(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0x18(%rsp), %rax - mulq 0x38(%rsp) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq 0xa0(%rsp), %rax - mulq 0xc0(%rsp) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq 0xa0(%rsp), %rax - mulq 0xc8(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0xa8(%rsp), %rax - mulq 0xc0(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq 0xa0(%rsp), %rax - mulq 0xd0(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0xa8(%rsp), %rax - mulq 0xc8(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0xb0(%rsp), %rax - mulq 0xc0(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq 0xa0(%rsp), %rax - mulq 0xd8(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0xa8(%rsp), %rax - mulq 0xd0(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0xb0(%rsp), %rax - mulq 0xc8(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0xb8(%rsp), %rax - mulq 0xc0(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0xa8(%rsp), %rax - mulq 0xd8(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0xb0(%rsp), %rax - mulq 0xd0(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0xb8(%rsp), %rax - mulq 0xc8(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0xb0(%rsp), %rax - mulq 0xd8(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0xb8(%rsp), %rax - mulq 0xd0(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0xb8(%rsp), %rax - mulq 0xd8(%rsp) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0xc0(%rsp) - movq %r13, 0xc8(%rsp) - movq %r14, 0xd0(%rsp) - movq %r15, 0xd8(%rsp) - movq 0x40(%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0xa0(%rsp) - adcq %r10, %rcx - movq %rcx, 0xa8(%rsp) - adcq %r11, %r8 - movq %r8, 0xb0(%rsp) - adcq %rdx, %r9 - movq %r9, 0xb8(%rsp) - movq 0x20(%rsp), %rax - subq 0xc0(%rsp), %rax - movq 0x28(%rsp), %rcx - sbbq 0xc8(%rsp), %rcx - movq 0x30(%rsp), %r8 - sbbq 0xd0(%rsp), %r8 - movq 0x38(%rsp), %r9 - sbbq 0xd8(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x20(%rsp) - adcq %r10, %rcx - movq %rcx, 0x28(%rsp) - adcq %r11, %r8 - movq %r8, 0x30(%rsp) - adcq %rdx, %r9 - movq %r9, 0x38(%rsp) - movq 0xa0(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0xa8(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0xb8(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0xb0(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0xa0(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0xa8(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0xb8(%rsp), %rbx - movq 0xa8(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0xa8(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0xb0(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0xb8(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x20(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x28(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x38(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x30(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x28(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x38(%rsp), %rbx - movq 0x28(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x28(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x30(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x38(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x60(%rsp), %rax - mulq 0x80(%rsp) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq 0x60(%rsp), %rax - mulq 0x88(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x68(%rsp), %rax - mulq 0x80(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq 0x60(%rsp), %rax - mulq 0x90(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0x68(%rsp), %rax - mulq 0x88(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0x70(%rsp), %rax - mulq 0x80(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq 0x60(%rsp), %rax - mulq 0x98(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0x68(%rsp), %rax - mulq 0x90(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x70(%rsp), %rax - mulq 0x88(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x78(%rsp), %rax - mulq 0x80(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0x68(%rsp), %rax - mulq 0x98(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x70(%rsp), %rax - mulq 0x90(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0x78(%rsp), %rax - mulq 0x88(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0x70(%rsp), %rax - mulq 0x98(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x78(%rsp), %rax - mulq 0x90(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0x78(%rsp), %rax - mulq 0x98(%rsp) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x60(%rsp), %rax - mulq 0x40(%rsp) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq 0x60(%rsp), %rax - mulq 0x48(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x68(%rsp), %rax - mulq 0x40(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq 0x60(%rsp), %rax - mulq 0x50(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0x68(%rsp), %rax - mulq 0x48(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0x70(%rsp), %rax - mulq 0x40(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq 0x60(%rsp), %rax - mulq 0x58(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0x68(%rsp), %rax - mulq 0x50(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x70(%rsp), %rax - mulq 0x48(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x78(%rsp), %rax - mulq 0x40(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0x68(%rsp), %rax - mulq 0x58(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x70(%rsp), %rax - mulq 0x50(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0x78(%rsp), %rax - mulq 0x48(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0x70(%rsp), %rax - mulq 0x58(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x78(%rsp), %rax - mulq 0x50(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0x78(%rsp), %rax - mulq 0x58(%rsp) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq (%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq %r11, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x40(%rsp), %rax - subq 0x80(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x88(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x90(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x98(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x60(%rsp) - adcq %r10, %rcx - movq %rcx, 0x68(%rsp) - adcq %r11, %r8 - movq %r8, 0x70(%rsp) - adcq %rdx, %r9 - movq %r9, 0x78(%rsp) - movq 0xa0(%rsp), %rax - mulq 0x40(%rsi) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq 0xa0(%rsp), %rax - mulq 0x48(%rsi) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0xa8(%rsp), %rax - mulq 0x40(%rsi) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq 0xa0(%rsp), %rax - mulq 0x50(%rsi) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0xa8(%rsp), %rax - mulq 0x48(%rsi) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0xb0(%rsp), %rax - mulq 0x40(%rsi) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq 0xa0(%rsp), %rax - mulq 0x58(%rsi) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0xa8(%rsp), %rax - mulq 0x50(%rsi) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0xb0(%rsp), %rax - mulq 0x48(%rsi) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0xb8(%rsp), %rax - mulq 0x40(%rsi) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0xa8(%rsp), %rax - mulq 0x58(%rsi) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0xb0(%rsp), %rax - mulq 0x50(%rsi) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0xb8(%rsp), %rax - mulq 0x48(%rsi) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0xb0(%rsp), %rax - mulq 0x58(%rsi) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0xb8(%rsp), %rax - mulq 0x50(%rsi) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0xb8(%rsp), %rax - mulq 0x58(%rsi) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq (%rsp), %rax - subq 0x40(%rsp), %rax - movq 0x8(%rsp), %rcx - sbbq 0x48(%rsp), %rcx - movq 0x10(%rsp), %r8 - sbbq 0x50(%rsp), %r8 - movq 0x18(%rsp), %r9 - sbbq 0x58(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, (%rsp) - adcq %r10, %rcx - movq %rcx, 0x8(%rsp) - adcq %r11, %r8 - movq %r8, 0x10(%rsp) - adcq %rdx, %r9 - movq %r9, 0x18(%rsp) - movq 0x80(%rsp), %rax - subq (%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x18(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq %r11, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - movq 0x60(%rsp), %rax - mulq 0xc0(%rsp) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq 0x60(%rsp), %rax - mulq 0xc8(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x68(%rsp), %rax - mulq 0xc0(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq 0x60(%rsp), %rax - mulq 0xd0(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0x68(%rsp), %rax - mulq 0xc8(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0x70(%rsp), %rax - mulq 0xc0(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq 0x60(%rsp), %rax - mulq 0xd8(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0x68(%rsp), %rax - mulq 0xd0(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x70(%rsp), %rax - mulq 0xc8(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x78(%rsp), %rax - mulq 0xc0(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0x68(%rsp), %rax - mulq 0xd8(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x70(%rsp), %rax - mulq 0xd0(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0x78(%rsp), %rax - mulq 0xc8(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0x70(%rsp), %rax - mulq 0xd8(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x78(%rsp), %rax - mulq 0xd0(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0x78(%rsp), %rax - mulq 0xd8(%rsp) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0xa0(%rsp), %rax - mulq 0x40(%rbp) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq 0xa0(%rsp), %rax - mulq 0x48(%rbp) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0xa8(%rsp), %rax - mulq 0x40(%rbp) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq 0xa0(%rsp), %rax - mulq 0x50(%rbp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0xa8(%rsp), %rax - mulq 0x48(%rbp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0xb0(%rsp), %rax - mulq 0x40(%rbp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq 0xa0(%rsp), %rax - mulq 0x58(%rbp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0xa8(%rsp), %rax - mulq 0x50(%rbp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0xb0(%rsp), %rax - mulq 0x48(%rbp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0xb8(%rsp), %rax - mulq 0x40(%rbp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0xa8(%rsp), %rax - mulq 0x58(%rbp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0xb0(%rsp), %rax - mulq 0x50(%rbp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0xb8(%rsp), %rax - mulq 0x48(%rbp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0xb0(%rsp), %rax - mulq 0x58(%rbp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0xb8(%rsp), %rax - mulq 0x50(%rbp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0xb8(%rsp), %rax - mulq 0x58(%rbp) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq 0x20(%rsp), %rax - mulq 0x80(%rsp) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq 0x20(%rsp), %rax - mulq 0x88(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x28(%rsp), %rax - mulq 0x80(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq 0x20(%rsp), %rax - mulq 0x90(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0x28(%rsp), %rax - mulq 0x88(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0x30(%rsp), %rax - mulq 0x80(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq 0x20(%rsp), %rax - mulq 0x98(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0x28(%rsp), %rax - mulq 0x90(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x30(%rsp), %rax - mulq 0x88(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x38(%rsp), %rax - mulq 0x80(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0x28(%rsp), %rax - mulq 0x98(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x30(%rsp), %rax - mulq 0x90(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0x38(%rsp), %rax - mulq 0x88(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0x30(%rsp), %rax - mulq 0x98(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x38(%rsp), %rax - mulq 0x90(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0x38(%rsp), %rax - mulq 0x98(%rsp) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x80(%rsp), %rax - subq 0x60(%rsp), %rax - movq 0x88(%rsp), %rcx - sbbq 0x68(%rsp), %rcx - movq 0x90(%rsp), %r8 - sbbq 0x70(%rsp), %r8 - movq 0x98(%rsp), %r9 - sbbq 0x78(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x80(%rsp) - adcq %r10, %rcx - movq %rcx, 0x88(%rsp) - adcq %r11, %r8 - movq %r8, 0x90(%rsp) - adcq %rdx, %r9 - movq %r9, 0x98(%rsp) - movq 0x40(%rsi), %r8 - movq 0x48(%rsi), %r9 - movq 0x50(%rsi), %r10 - movq 0x58(%rsi), %r11 - movq %r8, %rax - movq %r9, %rdx - orq %r10, %rax - orq %r11, %rdx - orq %rdx, %rax - negq %rax - sbbq %rax, %rax - movq 0x40(%rbp), %r12 - movq 0x48(%rbp), %r13 - movq 0x50(%rbp), %r14 - movq 0x58(%rbp), %r15 - movq %r12, %rbx - movq %r13, %rdx - orq %r14, %rbx - orq %r15, %rdx - orq %rdx, %rbx - negq %rbx - sbbq %rbx, %rbx - cmpq %rax, %rbx - cmovbq %r8, %r12 - cmovbq %r9, %r13 - cmovbq %r10, %r14 - cmovbq %r11, %r15 - cmoveq 0xa0(%rsp), %r12 - cmoveq 0xa8(%rsp), %r13 - cmoveq 0xb0(%rsp), %r14 - cmoveq 0xb8(%rsp), %r15 - movq (%rsp), %rax - cmovbq (%rsi), %rax - cmova 0x0(%rbp), %rax - movq 0x8(%rsp), %rbx - cmovbq 0x8(%rsi), %rbx - cmova 0x8(%rbp), %rbx - movq 0x10(%rsp), %rcx - cmovbq 0x10(%rsi), %rcx - cmova 0x10(%rbp), %rcx - movq 0x18(%rsp), %rdx - cmovbq 0x18(%rsi), %rdx - cmova 0x18(%rbp), %rdx - movq 0x80(%rsp), %r8 - cmovbq 0x20(%rsi), %r8 - cmova 0x20(%rbp), %r8 - movq 0x88(%rsp), %r9 - cmovbq 0x28(%rsi), %r9 - cmova 0x28(%rbp), %r9 - movq 0x90(%rsp), %r10 - cmovbq 0x30(%rsi), %r10 - cmova 0x30(%rbp), %r10 - movq 0x98(%rsp), %r11 - cmovbq 0x38(%rsi), %r11 - cmova 0x38(%rbp), %r11 - movq %rax, (%rdi) - movq %rbx, 0x8(%rdi) - movq %rcx, 0x10(%rdi) - movq %rdx, 0x18(%rdi) - movq %r8, 0x20(%rdi) - movq %r9, 0x28(%rdi) - movq %r10, 0x30(%rdi) - movq %r11, 0x38(%rdi) - movq %r12, 0x40(%rdi) - movq %r13, 0x48(%rdi) - movq %r14, 0x50(%rdi) - movq %r15, 0x58(%rdi) - CFI_INC_RSP(224) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbp) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lsm2_montjscalarmul_alt_sm2_montjadd) - -S2N_BN_FUNCTION_TYPE_DIRECTIVE(Lsm2_montjscalarmul_alt_sm2_montjdouble) - -Lsm2_montjscalarmul_alt_sm2_montjdouble: - CFI_START - CFI_PUSH(%rbx) - CFI_PUSH(%r12) - CFI_PUSH(%r13) - CFI_PUSH(%r14) - CFI_PUSH(%r15) - CFI_DEC_RSP(192) - movq 0x40(%rsi), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x48(%rsi), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x58(%rsi), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x50(%rsi), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x40(%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x48(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x58(%rsi), %rbx - movq 0x48(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x48(%rsi), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x50(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x58(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0x20(%rsi), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x28(%rsi), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x38(%rsi), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x30(%rsi), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x20(%rsi), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x28(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x38(%rsi), %rbx - movq 0x28(%rsi), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x28(%rsi), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x30(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x38(%rsi), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x20(%rsp) - movq %r13, 0x28(%rsp) - movq %r14, 0x30(%rsp) - movq %r15, 0x38(%rsp) - movq (%rsi), %rax - subq (%rsp), %rax - movq 0x8(%rsi), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x10(%rsi), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x18(%rsi), %r9 - sbbq 0x18(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x60(%rsp) - adcq %r10, %rcx - movq %rcx, 0x68(%rsp) - adcq %r11, %r8 - movq %r8, 0x70(%rsp) - adcq %rdx, %r9 - movq %r9, 0x78(%rsp) - movq (%rsi), %rax - addq (%rsp), %rax - movq 0x8(%rsi), %rcx - adcq 0x8(%rsp), %rcx - movq 0x10(%rsi), %r8 - adcq 0x10(%rsp), %r8 - movq 0x18(%rsi), %r9 - adcq 0x18(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - subq %r11, %rax - movq %rax, 0x40(%rsp) - sbbq %r10, %rcx - movq %rcx, 0x48(%rsp) - sbbq %r11, %r8 - movq %r8, 0x50(%rsp) - sbbq %rdx, %r9 - movq %r9, 0x58(%rsp) - movq 0x40(%rsp), %rax - mulq 0x60(%rsp) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq 0x40(%rsp), %rax - mulq 0x68(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x48(%rsp), %rax - mulq 0x60(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq 0x40(%rsp), %rax - mulq 0x70(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0x48(%rsp), %rax - mulq 0x68(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0x50(%rsp), %rax - mulq 0x60(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq 0x40(%rsp), %rax - mulq 0x78(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0x48(%rsp), %rax - mulq 0x70(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x50(%rsp), %rax - mulq 0x68(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x58(%rsp), %rax - mulq 0x60(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0x48(%rsp), %rax - mulq 0x78(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x50(%rsp), %rax - mulq 0x70(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0x58(%rsp), %rax - mulq 0x68(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0x50(%rsp), %rax - mulq 0x78(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x58(%rsp), %rax - mulq 0x70(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0x58(%rsp), %rax - mulq 0x78(%rsp) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - xorq %r11, %r11 - movq 0x20(%rsi), %rax - addq 0x40(%rsi), %rax - movq 0x28(%rsi), %rcx - adcq 0x48(%rsi), %rcx - movq 0x30(%rsi), %r8 - adcq 0x50(%rsi), %r8 - movq 0x38(%rsi), %r9 - adcq 0x58(%rsi), %r9 - adcq %r11, %r11 - subq $0xffffffffffffffff, %rax - movabsq $0xffffffff00000000, %r10 - sbbq %r10, %rcx - sbbq $0xffffffffffffffff, %r8 - movabsq $0xfffffffeffffffff, %rdx - sbbq %rdx, %r9 - sbbq $0x0, %r11 - andq %r11, %r10 - andq %r11, %rdx - addq %r11, %rax - movq %rax, 0x40(%rsp) - adcq %r10, %rcx - movq %rcx, 0x48(%rsp) - adcq %r11, %r8 - movq %r8, 0x50(%rsp) - adcq %rdx, %r9 - movq %r9, 0x58(%rsp) - movq (%rsi), %rax - mulq 0x20(%rsp) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq (%rsi), %rax - mulq 0x28(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0x8(%rsi), %rax - mulq 0x20(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq (%rsi), %rax - mulq 0x30(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0x8(%rsi), %rax - mulq 0x28(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0x10(%rsi), %rax - mulq 0x20(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq (%rsi), %rax - mulq 0x38(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0x8(%rsi), %rax - mulq 0x30(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x10(%rsi), %rax - mulq 0x28(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0x18(%rsi), %rax - mulq 0x20(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0x8(%rsi), %rax - mulq 0x38(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0x10(%rsi), %rax - mulq 0x30(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0x18(%rsi), %rax - mulq 0x28(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0x10(%rsi), %rax - mulq 0x38(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0x18(%rsi), %rax - mulq 0x30(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0x18(%rsi), %rax - mulq 0x38(%rsp) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x80(%rsp) - movq %r13, 0x88(%rsp) - movq %r14, 0x90(%rsp) - movq %r15, 0x98(%rsp) - movq 0x60(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x68(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x78(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x70(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x60(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x68(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x78(%rsp), %rbx - movq 0x68(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x68(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x70(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x78(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0xa0(%rsp) - movq %r13, 0xa8(%rsp) - movq %r14, 0xb0(%rsp) - movq %r15, 0xb8(%rsp) - movq 0x40(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x48(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x58(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x50(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x40(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x48(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x58(%rsp), %rbx - movq 0x48(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x48(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x50(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x58(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x40(%rsp) - movq %r13, 0x48(%rsp) - movq %r14, 0x50(%rsp) - movq %r15, 0x58(%rsp) - movq $0xffffffffffffffff, %r9 - movq %r9, %r11 - subq 0xa0(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq 0xa8(%rsp), %r10 - sbbq 0xb0(%rsp), %r11 - movabsq $0xfffffffeffffffff, %r12 - sbbq 0xb8(%rsp), %r12 - movq $0x9, %rcx - movq %r9, %rax - mulq %rcx - movq %rax, %r8 - movq %rdx, %r9 - movq %r10, %rax - xorl %r10d, %r10d - mulq %rcx - addq %rax, %r9 - adcq %rdx, %r10 - movq %r11, %rax - xorl %r11d, %r11d - mulq %rcx - addq %rax, %r10 - adcq %rdx, %r11 - movq %r12, %rax - xorl %r12d, %r12d - mulq %rcx - addq %rax, %r11 - adcq %rdx, %r12 - movl $0xc, %ecx - movq 0x80(%rsp), %rax - mulq %rcx - addq %rax, %r8 - adcq %rdx, %r9 - sbbq %rbx, %rbx - movq 0x88(%rsp), %rax - mulq %rcx - subq %rbx, %rdx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rbx, %rbx - movq 0x90(%rsp), %rax - mulq %rcx - subq %rbx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rbx, %rbx - movq 0x98(%rsp), %rax - mulq %rcx - subq %rbx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - leaq 0x1(%r12), %rdx - movq %rdx, %rax - shlq $0x20, %rax - movq %rax, %rcx - subq %rdx, %rax - addq %rdx, %r8 - adcq %rax, %r9 - adcq $0x0, %r10 - adcq %rcx, %r11 - sbbq %rdx, %rdx - notq %rdx - movabsq $0xffffffff00000000, %rax - andq %rdx, %rax - movq %rdx, %rcx - btr $0x20, %rcx - addq %rdx, %r8 - movq %r8, 0xa0(%rsp) - adcq %rax, %r9 - movq %r9, 0xa8(%rsp) - adcq %rdx, %r10 - movq %r10, 0xb0(%rsp) - adcq %rcx, %r11 - movq %r11, 0xb8(%rsp) - movq 0x40(%rsp), %rax - subq (%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x8(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x10(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x18(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x40(%rsp) - adcq %r10, %rcx - movq %rcx, 0x48(%rsp) - adcq %r11, %r8 - movq %r8, 0x50(%rsp) - adcq %rdx, %r9 - movq %r9, 0x58(%rsp) - movq 0x20(%rsp), %rax - movq %rax, %rbx - mulq %rax - movq %rax, %r8 - movq %rdx, %r15 - movq 0x28(%rsp), %rax - mulq %rbx - movq %rax, %r9 - movq %rdx, %r10 - movq 0x38(%rsp), %rax - movq %rax, %r13 - mulq %rbx - movq %rax, %r11 - movq %rdx, %r12 - movq 0x30(%rsp), %rax - movq %rax, %rbx - mulq %r13 - movq %rax, %r13 - movq %rdx, %r14 - movq 0x20(%rsp), %rax - mulq %rbx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rcx, %rcx - movq 0x28(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - sbbq %rcx, %rcx - movq 0x38(%rsp), %rbx - movq 0x28(%rsp), %rax - mulq %rbx - subq %rcx, %rdx - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorl %ecx, %ecx - addq %r9, %r9 - adcq %r10, %r10 - adcq %r11, %r11 - adcq %r12, %r12 - adcq %r13, %r13 - adcq %r14, %r14 - adcq %rcx, %rcx - movq 0x28(%rsp), %rax - mulq %rax - addq %r15, %r9 - adcq %rax, %r10 - adcq %rdx, %r11 - sbbq %r15, %r15 - movq 0x30(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r12 - adcq %rdx, %r13 - sbbq %r15, %r15 - movq 0x38(%rsp), %rax - mulq %rax - negq %r15 - adcq %rax, %r14 - adcq %rcx, %rdx - movq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, (%rsp) - movq %r13, 0x8(%rsp) - movq %r14, 0x10(%rsp) - movq %r15, 0x18(%rsp) - movq 0xa0(%rsp), %rax - mulq 0x60(%rsp) - movq %rax, %r8 - movq %rdx, %r9 - xorq %r10, %r10 - xorq %r11, %r11 - movq 0xa0(%rsp), %rax - mulq 0x68(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - movq 0xa8(%rsp), %rax - mulq 0x60(%rsp) - addq %rax, %r9 - adcq %rdx, %r10 - adcq %r11, %r11 - xorq %r12, %r12 - movq 0xa0(%rsp), %rax - mulq 0x70(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq %r12, %r12 - movq 0xa8(%rsp), %rax - mulq 0x68(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - movq 0xb0(%rsp), %rax - mulq 0x60(%rsp) - addq %rax, %r10 - adcq %rdx, %r11 - adcq $0x0, %r12 - xorq %r13, %r13 - movq 0xa0(%rsp), %rax - mulq 0x78(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq %r13, %r13 - movq 0xa8(%rsp), %rax - mulq 0x70(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0xb0(%rsp), %rax - mulq 0x68(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - movq 0xb8(%rsp), %rax - mulq 0x60(%rsp) - addq %rax, %r11 - adcq %rdx, %r12 - adcq $0x0, %r13 - xorq %r14, %r14 - movq 0xa8(%rsp), %rax - mulq 0x78(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq %r14, %r14 - movq 0xb0(%rsp), %rax - mulq 0x70(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - movq 0xb8(%rsp), %rax - mulq 0x68(%rsp) - addq %rax, %r12 - adcq %rdx, %r13 - adcq $0x0, %r14 - xorq %r15, %r15 - movq 0xb0(%rsp), %rax - mulq 0x78(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq %r15, %r15 - movq 0xb8(%rsp), %rax - mulq 0x70(%rsp) - addq %rax, %r13 - adcq %rdx, %r14 - adcq $0x0, %r15 - movq 0xb8(%rsp), %rax - mulq 0x78(%rsp) - addq %rax, %r14 - adcq %rdx, %r15 - movq %r8, %rax - shlq $0x20, %rax - movq %r8, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r8, %rax - sbbq $0x0, %rcx - subq %rax, %r9 - sbbq %rcx, %r10 - sbbq %rdx, %r11 - sbbq %rbx, %r8 - movq %r9, %rax - shlq $0x20, %rax - movq %r9, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r9, %rax - sbbq $0x0, %rcx - subq %rax, %r10 - sbbq %rcx, %r11 - sbbq %rdx, %r8 - sbbq %rbx, %r9 - movq %r10, %rax - shlq $0x20, %rax - movq %r10, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r10, %rax - sbbq $0x0, %rcx - subq %rax, %r11 - sbbq %rcx, %r8 - sbbq %rdx, %r9 - sbbq %rbx, %r10 - movq %r11, %rax - shlq $0x20, %rax - movq %r11, %rcx - shrq $0x20, %rcx - movq %rax, %rdx - movq %rcx, %rbx - subq %r11, %rax - sbbq $0x0, %rcx - subq %rax, %r8 - sbbq %rcx, %r9 - sbbq %rdx, %r10 - sbbq %rbx, %r11 - xorl %eax, %eax - addq %r8, %r12 - adcq %r9, %r13 - adcq %r10, %r14 - adcq %r11, %r15 - adcq %rax, %rax - movl $0x1, %ecx - movl $0xffffffff, %edx - xorl %ebx, %ebx - addq %r12, %rcx - leaq 0x1(%rdx), %r11 - adcq %r13, %rdx - leaq -0x1(%rbx), %r8 - adcq %r14, %rbx - adcq %r15, %r11 - adcq %rax, %r8 - cmovbq %rcx, %r12 - cmovbq %rdx, %r13 - cmovbq %rbx, %r14 - cmovbq %r11, %r15 - movq %r12, 0x60(%rsp) - movq %r13, 0x68(%rsp) - movq %r14, 0x70(%rsp) - movq %r15, 0x78(%rsp) - movq 0x40(%rsp), %rax - subq 0x20(%rsp), %rax - movq 0x48(%rsp), %rcx - sbbq 0x28(%rsp), %rcx - movq 0x50(%rsp), %r8 - sbbq 0x30(%rsp), %r8 - movq 0x58(%rsp), %r9 - sbbq 0x38(%rsp), %r9 - movabsq $0xffffffff00000000, %r10 - sbbq %r11, %r11 - andq %r11, %r10 - movq %r11, %rdx - btr $0x20, %rdx - addq %r11, %rax - movq %rax, 0x40(%rdi) - adcq %r10, %rcx - movq %rcx, 0x48(%rdi) - adcq %r11, %r8 - movq %r8, 0x50(%rdi) - adcq %rdx, %r9 - movq %r9, 0x58(%rdi) - movq 0x98(%rsp), %r11 - movq %r11, %rdx - movq 0x90(%rsp), %r10 - shldq $0x2, %r10, %r11 - movq 0x88(%rsp), %r9 - shldq $0x2, %r9, %r10 - movq 0x80(%rsp), %r8 - shldq $0x2, %r8, %r9 - shlq $0x2, %r8 - shrq $0x3e, %rdx - addq $0x1, %rdx - subq 0xa0(%rsp), %r8 - sbbq 0xa8(%rsp), %r9 - sbbq 0xb0(%rsp), %r10 - sbbq 0xb8(%rsp), %r11 - sbbq $0x0, %rdx - movq %rdx, %rax - shlq $0x20, %rax - movq %rax, %rcx - subq %rdx, %rax - addq %rdx, %r8 - adcq %rax, %r9 - adcq $0x0, %r10 - adcq %rcx, %r11 - sbbq %rdx, %rdx - notq %rdx - movabsq $0xffffffff00000000, %rax - andq %rdx, %rax - movq %rdx, %rcx - btr $0x20, %rcx - addq %rdx, %r8 - movq %r8, (%rdi) - adcq %rax, %r9 - movq %r9, 0x8(%rdi) - adcq %rdx, %r10 - movq %r10, 0x10(%rdi) - adcq %rcx, %r11 - movq %r11, 0x18(%rdi) - movq $0xffffffffffffffff, %r8 - movq %r8, %r10 - subq (%rsp), %r8 - movabsq $0xffffffff00000000, %r9 - sbbq 0x8(%rsp), %r9 - sbbq 0x10(%rsp), %r10 - movabsq $0xfffffffeffffffff, %r11 - sbbq 0x18(%rsp), %r11 - movq %r11, %r12 - shldq $0x3, %r10, %r11 - shldq $0x3, %r9, %r10 - shldq $0x3, %r8, %r9 - shlq $0x3, %r8 - shrq $0x3d, %r12 - movl $0x3, %ecx - movq 0x60(%rsp), %rax - mulq %rcx - addq %rax, %r8 - adcq %rdx, %r9 - sbbq %rbx, %rbx - movq 0x68(%rsp), %rax - mulq %rcx - subq %rbx, %rdx - addq %rax, %r9 - adcq %rdx, %r10 - sbbq %rbx, %rbx - movq 0x70(%rsp), %rax - mulq %rcx - subq %rbx, %rdx - addq %rax, %r10 - adcq %rdx, %r11 - sbbq %rbx, %rbx - movq 0x78(%rsp), %rax - mulq %rcx - subq %rbx, %rdx - addq %rax, %r11 - adcq %rdx, %r12 - leaq 0x1(%r12), %rdx - movq %rdx, %rax - shlq $0x20, %rax - movq %rax, %rcx - subq %rdx, %rax - addq %rdx, %r8 - adcq %rax, %r9 - adcq $0x0, %r10 - adcq %rcx, %r11 - sbbq %rdx, %rdx - notq %rdx - movabsq $0xffffffff00000000, %rax - andq %rdx, %rax - movq %rdx, %rcx - btr $0x20, %rcx - addq %rdx, %r8 - movq %r8, 0x20(%rdi) - adcq %rax, %r9 - movq %r9, 0x28(%rdi) - adcq %rdx, %r10 - movq %r10, 0x30(%rdi) - adcq %rcx, %r11 - movq %r11, 0x38(%rdi) - CFI_INC_RSP(192) - CFI_POP(%r15) - CFI_POP(%r14) - CFI_POP(%r13) - CFI_POP(%r12) - CFI_POP(%rbx) - CFI_RET - -S2N_BN_SIZE_DIRECTIVE(Lsm2_montjscalarmul_alt_sm2_montjdouble) - -#if defined(__linux__) && defined(__ELF__) -.section .note.GNU-stack, "", %progbits -#endif