2 # Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
10 # ====================================================================
11 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
12 # project. The module is, however, dual licensed under OpenSSL and
13 # CRYPTOGAMS licenses depending on where you obtain it. For further
14 # details see http://www.openssl.org/~appro/cryptogams/.
15 # ====================================================================
17 # ECP_NISTZ256 module for SPARCv9.
21 # Original ECP_NISTZ256 submission targeting x86_64 is detailed in
22 # http://eprint.iacr.org/2013/816. In the process of adaptation
23 # original .c module was made 32-bit savvy in order to make this
24 # implementation possible.
26 # with/without -DECP_NISTZ256_ASM
27 # UltraSPARC III +12-18%
28 # SPARC T4 +99-550% (+66-150% on 32-bit Solaris)
30 # Ranges denote minimum and maximum improvement coefficients depending
31 # on benchmark. Lower coefficients are for ECDSA sign, server-side
32 # operation. Keep in mind that +200% means 3x improvement.
34 $output = pop and open STDOUT,">$output";
38 # define __ASSEMBLER__ 1
40 #include "crypto/sparc_arch.h"
42 #define LOCALS (STACK_BIAS+STACK_FRAME)
44 .register %g2,#scratch
45 .register %g3,#scratch
46 # define STACK64_FRAME STACK_FRAME
47 # define LOCALS64 LOCALS
49 # define STACK64_FRAME (2047+192)
50 # define LOCALS64 STACK64_FRAME
53 .section ".text",#alloc,#execinstr
55 ########################################################################
56 # Convert ecp_nistz256_table.c to layout expected by ecp_nistz_gather_w7
58 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
59 open TABLE,"<ecp_nistz256_table.c" or
60 open TABLE,"<${dir}../ecp_nistz256_table.c" or
61 die "failed to open ecp_nistz256_table.c:",$!;
66 s/TOBN\(\s*(0x[0-9a-f]+),\s*(0x[0-9a-f]+)\s*\)/push @arr,hex($2),hex($1)/geo;
70 # See ecp_nistz256_table.c for explanation for why it's 64*16*37.
71 # 64*16*37-1 is because $#arr returns last valid index or @arr, not
73 die "insane number of elements" if ($#arr != 64*16*37-1);
76 .globl ecp_nistz256_precomputed
78 ecp_nistz256_precomputed:
80 ########################################################################
81 # this conversion smashes P256_POINT_AFFINE by individual bytes with
82 # 64 byte interval, similar to
86 @tbl = splice(@arr,0,64*16);
87 for($i=0;$i<64;$i++) {
89 for($j=0;$j<64;$j++) {
90 push @line,(@tbl[$j*16+$i/4]>>(($i%4)*8))&0xff;
93 $code.=join(',',map { sprintf "0x%02x",$_} @line);
99 my ($rp,$ap,$bp)=map("%i$_",(0..2));
100 my @acc=map("%l$_",(0..7));
101 my ($t0,$t1,$t2,$t3,$t4,$t5,$t6,$t7)=(map("%o$_",(0..5)),"%g4","%g5");
102 my ($bi,$a0,$mask,$carry)=(map("%i$_",(3..5)),"%g1");
103 my ($rp_real,$ap_real)=("%g2","%g3");
106 .type ecp_nistz256_precomputed,#object
107 .size ecp_nistz256_precomputed,.-ecp_nistz256_precomputed
109 .LRR: ! 2^512 mod P precomputed for NIST P256 polynomial
110 .long 0x00000003, 0x00000000, 0xffffffff, 0xfffffffb
111 .long 0xfffffffe, 0xffffffff, 0xfffffffd, 0x00000004
113 .long 1,0,0,0,0,0,0,0
114 .asciz "ECP_NISTZ256 for SPARCv9, CRYPTOGAMS by <appro\@openssl.org>"
116 ! void ecp_nistz256_to_mont(BN_ULONG %i0[8],const BN_ULONG %i1[8]);
117 .globl ecp_nistz256_to_mont
119 ecp_nistz256_to_mont:
120 save %sp,-STACK_FRAME,%sp
124 call __ecp_nistz256_mul_mont
128 .type ecp_nistz256_to_mont,#function
129 .size ecp_nistz256_to_mont,.-ecp_nistz256_to_mont
131 ! void ecp_nistz256_from_mont(BN_ULONG %i0[8],const BN_ULONG %i1[8]);
132 .globl ecp_nistz256_from_mont
134 ecp_nistz256_from_mont:
135 save %sp,-STACK_FRAME,%sp
139 call __ecp_nistz256_mul_mont
143 .type ecp_nistz256_from_mont,#function
144 .size ecp_nistz256_from_mont,.-ecp_nistz256_from_mont
146 ! void ecp_nistz256_mul_mont(BN_ULONG %i0[8],const BN_ULONG %i1[8],
147 ! const BN_ULONG %i2[8]);
148 .globl ecp_nistz256_mul_mont
150 ecp_nistz256_mul_mont:
151 save %sp,-STACK_FRAME,%sp
153 call __ecp_nistz256_mul_mont
157 .type ecp_nistz256_mul_mont,#function
158 .size ecp_nistz256_mul_mont,.-ecp_nistz256_mul_mont
160 ! void ecp_nistz256_sqr_mont(BN_ULONG %i0[8],const BN_ULONG %i2[8]);
161 .globl ecp_nistz256_sqr_mont
163 ecp_nistz256_sqr_mont:
164 save %sp,-STACK_FRAME,%sp
166 call __ecp_nistz256_mul_mont
170 .type ecp_nistz256_sqr_mont,#function
171 .size ecp_nistz256_sqr_mont,.-ecp_nistz256_sqr_mont
174 ########################################################################
175 # Special thing to keep in mind is that $t0-$t7 hold 64-bit values,
176 # while all others are meant to keep 32. "Meant to" means that additions
177 # to @acc[0-7] do "contaminate" upper bits, but they are cleared before
178 # they can affect outcome (follow 'and' with $mask). Also keep in mind
179 # that addition with carry is addition with 32-bit carry, even though
180 # CPU is 64-bit. [Addition with 64-bit carry was introduced in T3, see
181 # below for VIS3 code paths.]
185 __ecp_nistz256_mul_mont:
186 ld [$bp+0],$bi ! b[0]
189 srl $mask,0,$mask ! 0xffffffff
197 mulx $a0,$bi,$t0 ! a[0-7]*b[0], 64-bit results
205 srlx $t0,32,@acc[1] ! extract high parts
212 srlx $t7,32,@acc[0] ! "@acc[8]"
215 for($i=1;$i<8;$i++) {
217 addcc @acc[1],$t1,@acc[1] ! accumulate high parts
218 ld [$bp+4*$i],$bi ! b[$i]
219 ld [$ap+4],$t1 ! re-load a[1-7]
220 addccc @acc[2],$t2,@acc[2]
221 addccc @acc[3],$t3,@acc[3]
224 addccc @acc[4],$t4,@acc[4]
225 addccc @acc[5],$t5,@acc[5]
228 addccc @acc[6],$t6,@acc[6]
229 addccc @acc[7],$t7,@acc[7]
232 addccc @acc[0],$carry,@acc[0] ! "@acc[8]"
235 # Reduction iteration is normally performed by accumulating
236 # result of multiplication of modulus by "magic" digit [and
237 # omitting least significant word, which is guaranteed to
238 # be 0], but thanks to special form of modulus and "magic"
239 # digit being equal to least significant word, it can be
240 # performed with additions and subtractions alone. Indeed:
242 # ffff.0001.0000.0000.0000.ffff.ffff.ffff
244 # + xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.abcd
246 # Now observing that ff..ff*x = (2^n-1)*x = 2^n*x-x, we
249 # xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.abcd
250 # + abcd.0000.abcd.0000.0000.abcd.0000.0000.0000
251 # - abcd.0000.0000.0000.0000.0000.0000.abcd
253 # or marking redundant operations:
255 # xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.----
256 # + abcd.0000.abcd.0000.0000.abcd.----.----.----
257 # - abcd.----.----.----.----.----.----.----
260 ! multiplication-less reduction
261 addcc @acc[3],$t0,@acc[3] ! r[3]+=r[0]
262 addccc @acc[4],%g0,@acc[4] ! r[4]+=0
263 and @acc[1],$mask,@acc[1]
264 and @acc[2],$mask,@acc[2]
265 addccc @acc[5],%g0,@acc[5] ! r[5]+=0
266 addccc @acc[6],$t0,@acc[6] ! r[6]+=r[0]
267 and @acc[3],$mask,@acc[3]
268 and @acc[4],$mask,@acc[4]
269 addccc @acc[7],%g0,@acc[7] ! r[7]+=0
270 addccc @acc[0],$t0,@acc[0] ! r[8]+=r[0] "@acc[8]"
271 and @acc[5],$mask,@acc[5]
272 and @acc[6],$mask,@acc[6]
273 addc $carry,%g0,$carry ! top-most carry
274 subcc @acc[7],$t0,@acc[7] ! r[7]-=r[0]
275 subccc @acc[0],%g0,@acc[0] ! r[8]-=0 "@acc[8]"
276 subc $carry,%g0,$carry ! top-most carry
277 and @acc[7],$mask,@acc[7]
278 and @acc[0],$mask,@acc[0] ! "@acc[8]"
280 push(@acc,shift(@acc)); # rotate registers to "omit" acc[0]
282 mulx $a0,$bi,$t0 ! a[0-7]*b[$i], 64-bit results
290 add @acc[0],$t0,$t0 ! accumulate low parts, can't overflow
292 srlx $t0,32,@acc[1] ! extract high parts
305 srlx $t7,32,@acc[0] ! "@acc[8]"
309 addcc @acc[1],$t1,@acc[1] ! accumulate high parts
310 addccc @acc[2],$t2,@acc[2]
311 addccc @acc[3],$t3,@acc[3]
312 addccc @acc[4],$t4,@acc[4]
313 addccc @acc[5],$t5,@acc[5]
314 addccc @acc[6],$t6,@acc[6]
315 addccc @acc[7],$t7,@acc[7]
316 addccc @acc[0],$carry,@acc[0] ! "@acc[8]"
319 addcc @acc[3],$t0,@acc[3] ! multiplication-less reduction
320 addccc @acc[4],%g0,@acc[4]
321 addccc @acc[5],%g0,@acc[5]
322 addccc @acc[6],$t0,@acc[6]
323 addccc @acc[7],%g0,@acc[7]
324 addccc @acc[0],$t0,@acc[0] ! "@acc[8]"
325 addc $carry,%g0,$carry
326 subcc @acc[7],$t0,@acc[7]
327 subccc @acc[0],%g0,@acc[0] ! "@acc[8]"
328 subc $carry,%g0,$carry ! top-most carry
330 push(@acc,shift(@acc)); # rotate registers to omit acc[0]
332 ! Final step is "if result > mod, subtract mod", but we do it
333 ! "other way around", namely subtract modulus from result
334 ! and if it borrowed, add modulus back.
336 subcc @acc[0],-1,@acc[0] ! subtract modulus
337 subccc @acc[1],-1,@acc[1]
338 subccc @acc[2],-1,@acc[2]
339 subccc @acc[3],0,@acc[3]
340 subccc @acc[4],0,@acc[4]
341 subccc @acc[5],0,@acc[5]
342 subccc @acc[6],1,@acc[6]
343 subccc @acc[7],-1,@acc[7]
344 subc $carry,0,$carry ! broadcast borrow bit
346 ! Note that because mod has special form, i.e. consists of
347 ! 0xffffffff, 1 and 0s, we can conditionally synthesize it by
348 ! using value of broadcasted borrow and the borrow bit itself.
349 ! To minimize dependency chain we first broadcast and then
350 ! extract the bit by negating (follow $bi).
352 addcc @acc[0],$carry,@acc[0] ! add modulus or zero
353 addccc @acc[1],$carry,@acc[1]
356 addccc @acc[2],$carry,@acc[2]
358 addccc @acc[3],0,@acc[3]
360 addccc @acc[4],0,@acc[4]
362 addccc @acc[5],0,@acc[5]
364 addccc @acc[6],$bi,@acc[6]
366 addc @acc[7],$carry,@acc[7]
370 .type __ecp_nistz256_mul_mont,#function
371 .size __ecp_nistz256_mul_mont,.-__ecp_nistz256_mul_mont
373 ! void ecp_nistz256_add(BN_ULONG %i0[8],const BN_ULONG %i1[8],
374 ! const BN_ULONG %i2[8]);
375 .globl ecp_nistz256_add
378 save %sp,-STACK_FRAME,%sp
386 call __ecp_nistz256_add
390 .type ecp_nistz256_add,#function
391 .size ecp_nistz256_add,.-ecp_nistz256_add
395 ld [$bp+0],$t0 ! b[0]
399 addcc @acc[0],$t0,@acc[0]
402 addccc @acc[1],$t1,@acc[1]
405 addccc @acc[2],$t2,@acc[2]
406 addccc @acc[3],$t3,@acc[3]
407 addccc @acc[4],$t4,@acc[4]
408 addccc @acc[5],$t5,@acc[5]
409 addccc @acc[6],$t6,@acc[6]
410 addccc @acc[7],$t7,@acc[7]
415 ! if a+b >= modulus, subtract modulus.
417 ! But since comparison implies subtraction, we subtract
418 ! modulus and then add it back if subtraction borrowed.
420 subcc @acc[0],-1,@acc[0]
421 subccc @acc[1],-1,@acc[1]
422 subccc @acc[2],-1,@acc[2]
423 subccc @acc[3], 0,@acc[3]
424 subccc @acc[4], 0,@acc[4]
425 subccc @acc[5], 0,@acc[5]
426 subccc @acc[6], 1,@acc[6]
427 subccc @acc[7],-1,@acc[7]
430 ! Note that because mod has special form, i.e. consists of
431 ! 0xffffffff, 1 and 0s, we can conditionally synthesize it by
432 ! using value of borrow and its negative.
434 addcc @acc[0],$carry,@acc[0] ! add synthesized modulus
435 addccc @acc[1],$carry,@acc[1]
438 addccc @acc[2],$carry,@acc[2]
440 addccc @acc[3],0,@acc[3]
442 addccc @acc[4],0,@acc[4]
444 addccc @acc[5],0,@acc[5]
446 addccc @acc[6],$bi,@acc[6]
448 addc @acc[7],$carry,@acc[7]
452 .type __ecp_nistz256_add,#function
453 .size __ecp_nistz256_add,.-__ecp_nistz256_add
455 ! void ecp_nistz256_mul_by_2(BN_ULONG %i0[8],const BN_ULONG %i1[8]);
456 .globl ecp_nistz256_mul_by_2
458 ecp_nistz256_mul_by_2:
459 save %sp,-STACK_FRAME,%sp
467 call __ecp_nistz256_mul_by_2
471 .type ecp_nistz256_mul_by_2,#function
472 .size ecp_nistz256_mul_by_2,.-ecp_nistz256_mul_by_2
475 __ecp_nistz256_mul_by_2:
476 addcc @acc[0],@acc[0],@acc[0] ! a+a=2*a
477 addccc @acc[1],@acc[1],@acc[1]
478 addccc @acc[2],@acc[2],@acc[2]
479 addccc @acc[3],@acc[3],@acc[3]
480 addccc @acc[4],@acc[4],@acc[4]
481 addccc @acc[5],@acc[5],@acc[5]
482 addccc @acc[6],@acc[6],@acc[6]
483 addccc @acc[7],@acc[7],@acc[7]
486 .type __ecp_nistz256_mul_by_2,#function
487 .size __ecp_nistz256_mul_by_2,.-__ecp_nistz256_mul_by_2
489 ! void ecp_nistz256_mul_by_3(BN_ULONG %i0[8],const BN_ULONG %i1[8]);
490 .globl ecp_nistz256_mul_by_3
492 ecp_nistz256_mul_by_3:
493 save %sp,-STACK_FRAME,%sp
501 call __ecp_nistz256_mul_by_3
505 .type ecp_nistz256_mul_by_3,#function
506 .size ecp_nistz256_mul_by_3,.-ecp_nistz256_mul_by_3
509 __ecp_nistz256_mul_by_3:
510 addcc @acc[0],@acc[0],$t0 ! a+a=2*a
511 addccc @acc[1],@acc[1],$t1
512 addccc @acc[2],@acc[2],$t2
513 addccc @acc[3],@acc[3],$t3
514 addccc @acc[4],@acc[4],$t4
515 addccc @acc[5],@acc[5],$t5
516 addccc @acc[6],@acc[6],$t6
517 addccc @acc[7],@acc[7],$t7
520 subcc $t0,-1,$t0 ! .Lreduce_by_sub but without stores
530 addcc $t0,$carry,$t0 ! add synthesized modulus
531 addccc $t1,$carry,$t1
533 addccc $t2,$carry,$t2
540 addcc $t0,@acc[0],@acc[0] ! 2*a+a=3*a
541 addccc $t1,@acc[1],@acc[1]
542 addccc $t2,@acc[2],@acc[2]
543 addccc $t3,@acc[3],@acc[3]
544 addccc $t4,@acc[4],@acc[4]
545 addccc $t5,@acc[5],@acc[5]
546 addccc $t6,@acc[6],@acc[6]
547 addccc $t7,@acc[7],@acc[7]
550 .type __ecp_nistz256_mul_by_3,#function
551 .size __ecp_nistz256_mul_by_3,.-__ecp_nistz256_mul_by_3
553 ! void ecp_nistz256_sub(BN_ULONG %i0[8],const BN_ULONG %i1[8],
554 ! const BN_ULONG %i2[8]);
555 .globl ecp_nistz256_sub
558 save %sp,-STACK_FRAME,%sp
566 call __ecp_nistz256_sub_from
570 .type ecp_nistz256_sub,#function
571 .size ecp_nistz256_sub,.-ecp_nistz256_sub
573 ! void ecp_nistz256_neg(BN_ULONG %i0[8],const BN_ULONG %i1[8]);
574 .globl ecp_nistz256_neg
577 save %sp,-STACK_FRAME,%sp
586 call __ecp_nistz256_sub_from
590 .type ecp_nistz256_neg,#function
591 .size ecp_nistz256_neg,.-ecp_nistz256_neg
594 __ecp_nistz256_sub_from:
595 ld [$bp+0],$t0 ! b[0]
599 subcc @acc[0],$t0,@acc[0]
602 subccc @acc[1],$t1,@acc[1]
603 subccc @acc[2],$t2,@acc[2]
606 subccc @acc[3],$t3,@acc[3]
607 subccc @acc[4],$t4,@acc[4]
608 subccc @acc[5],$t5,@acc[5]
609 subccc @acc[6],$t6,@acc[6]
610 subccc @acc[7],$t7,@acc[7]
611 subc %g0,%g0,$carry ! broadcast borrow bit
615 ! if a-b borrows, add modulus.
617 ! Note that because mod has special form, i.e. consists of
618 ! 0xffffffff, 1 and 0s, we can conditionally synthesize it by
619 ! using value of broadcasted borrow and the borrow bit itself.
620 ! To minimize dependency chain we first broadcast and then
621 ! extract the bit by negating (follow $bi).
623 addcc @acc[0],$carry,@acc[0] ! add synthesized modulus
624 addccc @acc[1],$carry,@acc[1]
627 addccc @acc[2],$carry,@acc[2]
629 addccc @acc[3],0,@acc[3]
631 addccc @acc[4],0,@acc[4]
633 addccc @acc[5],0,@acc[5]
635 addccc @acc[6],$bi,@acc[6]
637 addc @acc[7],$carry,@acc[7]
641 .type __ecp_nistz256_sub_from,#function
642 .size __ecp_nistz256_sub_from,.-__ecp_nistz256_sub_from
645 __ecp_nistz256_sub_morf:
646 ld [$bp+0],$t0 ! b[0]
650 subcc $t0,@acc[0],@acc[0]
653 subccc $t1,@acc[1],@acc[1]
654 subccc $t2,@acc[2],@acc[2]
657 subccc $t3,@acc[3],@acc[3]
658 subccc $t4,@acc[4],@acc[4]
659 subccc $t5,@acc[5],@acc[5]
660 subccc $t6,@acc[6],@acc[6]
661 subccc $t7,@acc[7],@acc[7]
663 subc %g0,%g0,$carry ! broadcast borrow bit
664 .type __ecp_nistz256_sub_morf,#function
665 .size __ecp_nistz256_sub_morf,.-__ecp_nistz256_sub_morf
667 ! void ecp_nistz256_div_by_2(BN_ULONG %i0[8],const BN_ULONG %i1[8]);
668 .globl ecp_nistz256_div_by_2
670 ecp_nistz256_div_by_2:
671 save %sp,-STACK_FRAME,%sp
679 call __ecp_nistz256_div_by_2
683 .type ecp_nistz256_div_by_2,#function
684 .size ecp_nistz256_div_by_2,.-ecp_nistz256_div_by_2
687 __ecp_nistz256_div_by_2:
688 ! ret = (a is odd ? a+mod : a) >> 1
692 addcc @acc[0],$carry,@acc[0]
693 addccc @acc[1],$carry,@acc[1]
694 addccc @acc[2],$carry,@acc[2]
695 addccc @acc[3],0,@acc[3]
696 addccc @acc[4],0,@acc[4]
697 addccc @acc[5],0,@acc[5]
698 addccc @acc[6],$bi,@acc[6]
699 addccc @acc[7],$carry,@acc[7]
704 srl @acc[0],1,@acc[0]
706 srl @acc[1],1,@acc[1]
707 or @acc[0],$t0,@acc[0]
709 srl @acc[2],1,@acc[2]
710 or @acc[1],$t1,@acc[1]
713 srl @acc[3],1,@acc[3]
714 or @acc[2],$t2,@acc[2]
717 srl @acc[4],1,@acc[4]
718 or @acc[3],$t3,@acc[3]
721 srl @acc[5],1,@acc[5]
722 or @acc[4],$t4,@acc[4]
725 srl @acc[6],1,@acc[6]
726 or @acc[5],$t5,@acc[5]
729 srl @acc[7],1,@acc[7]
730 or @acc[6],$t6,@acc[6]
733 or @acc[7],$t7,@acc[7]
737 .type __ecp_nistz256_div_by_2,#function
738 .size __ecp_nistz256_div_by_2,.-__ecp_nistz256_div_by_2
741 ########################################################################
742 # following subroutines are "literal" implementation of those found in
745 ########################################################################
746 # void ecp_nistz256_point_double(P256_POINT *out,const P256_POINT *inp);
749 my ($S,$M,$Zsqr,$tmp0)=map(32*$_,(0..3));
750 # above map() describes stack layout with 4 temporary
751 # 256-bit vectors on top.
758 .globl ecp_nistz256_point_double
760 ecp_nistz256_point_double:
761 SPARC_LOAD_ADDRESS_LEAF(OPENSSL_sparcv9cap_P,%g1,%g5)
762 ld [%g1],%g1 ! OPENSSL_sparcv9cap_P[0]
763 and %g1,(SPARCV9_VIS3|SPARCV9_64BIT_STACK),%g1
764 cmp %g1,(SPARCV9_VIS3|SPARCV9_64BIT_STACK)
765 be ecp_nistz256_point_double_vis3
768 save %sp,-STACK_FRAME-32*4,%sp
773 .Lpoint_double_shortcut:
775 ld [$ap+32+4],@acc[1]
776 ld [$ap+32+8],@acc[2]
777 ld [$ap+32+12],@acc[3]
778 ld [$ap+32+16],@acc[4]
779 ld [$ap+32+20],@acc[5]
780 ld [$ap+32+24],@acc[6]
781 ld [$ap+32+28],@acc[7]
782 call __ecp_nistz256_mul_by_2 ! p256_mul_by_2(S, in_y);
783 add %sp,LOCALS+$S,$rp
787 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Zsqr, in_z);
788 add %sp,LOCALS+$Zsqr,$rp
791 call __ecp_nistz256_add ! p256_add(M, Zsqr, in_x);
792 add %sp,LOCALS+$M,$rp
794 add %sp,LOCALS+$S,$bp
795 add %sp,LOCALS+$S,$ap
796 call __ecp_nistz256_mul_mont ! p256_sqr_mont(S, S);
797 add %sp,LOCALS+$S,$rp
799 ld [$ap_real],@acc[0]
800 add %sp,LOCALS+$Zsqr,$bp
801 ld [$ap_real+4],@acc[1]
802 ld [$ap_real+8],@acc[2]
803 ld [$ap_real+12],@acc[3]
804 ld [$ap_real+16],@acc[4]
805 ld [$ap_real+20],@acc[5]
806 ld [$ap_real+24],@acc[6]
807 ld [$ap_real+28],@acc[7]
808 call __ecp_nistz256_sub_from ! p256_sub(Zsqr, in_x, Zsqr);
809 add %sp,LOCALS+$Zsqr,$rp
813 call __ecp_nistz256_mul_mont ! p256_mul_mont(tmp0, in_z, in_y);
814 add %sp,LOCALS+$tmp0,$rp
816 call __ecp_nistz256_mul_by_2 ! p256_mul_by_2(res_z, tmp0);
819 add %sp,LOCALS+$Zsqr,$bp
820 add %sp,LOCALS+$M,$ap
821 call __ecp_nistz256_mul_mont ! p256_mul_mont(M, M, Zsqr);
822 add %sp,LOCALS+$M,$rp
824 call __ecp_nistz256_mul_by_3 ! p256_mul_by_3(M, M);
825 add %sp,LOCALS+$M,$rp
827 add %sp,LOCALS+$S,$bp
828 add %sp,LOCALS+$S,$ap
829 call __ecp_nistz256_mul_mont ! p256_sqr_mont(tmp0, S);
830 add %sp,LOCALS+$tmp0,$rp
832 call __ecp_nistz256_div_by_2 ! p256_div_by_2(res_y, tmp0);
836 add %sp,LOCALS+$S,$ap
837 call __ecp_nistz256_mul_mont ! p256_mul_mont(S, S, in_x);
838 add %sp,LOCALS+$S,$rp
840 call __ecp_nistz256_mul_by_2 ! p256_mul_by_2(tmp0, S);
841 add %sp,LOCALS+$tmp0,$rp
843 add %sp,LOCALS+$M,$bp
844 add %sp,LOCALS+$M,$ap
845 call __ecp_nistz256_mul_mont ! p256_sqr_mont(res_x, M);
848 add %sp,LOCALS+$tmp0,$bp
849 call __ecp_nistz256_sub_from ! p256_sub(res_x, res_x, tmp0);
852 add %sp,LOCALS+$S,$bp
853 call __ecp_nistz256_sub_morf ! p256_sub(S, S, res_x);
854 add %sp,LOCALS+$S,$rp
856 add %sp,LOCALS+$M,$bp
857 add %sp,LOCALS+$S,$ap
858 call __ecp_nistz256_mul_mont ! p256_mul_mont(S, S, M);
859 add %sp,LOCALS+$S,$rp
862 call __ecp_nistz256_sub_from ! p256_sub(res_y, S, res_y);
867 .type ecp_nistz256_point_double,#function
868 .size ecp_nistz256_point_double,.-ecp_nistz256_point_double
872 ########################################################################
873 # void ecp_nistz256_point_add(P256_POINT *out,const P256_POINT *in1,
874 # const P256_POINT *in2);
876 my ($res_x,$res_y,$res_z,
877 $H,$Hsqr,$R,$Rsqr,$Hcub,
878 $U1,$U2,$S1,$S2)=map(32*$_,(0..11));
879 my ($Z1sqr, $Z2sqr) = ($Hsqr, $Rsqr);
881 # above map() describes stack layout with 12 temporary
882 # 256-bit vectors on top. Then we reserve some space for
883 # !in1infty, !in2infty, result of check for zero and return pointer.
885 my $bp_real=$rp_real;
888 .globl ecp_nistz256_point_add
890 ecp_nistz256_point_add:
891 SPARC_LOAD_ADDRESS_LEAF(OPENSSL_sparcv9cap_P,%g1,%g5)
892 ld [%g1],%g1 ! OPENSSL_sparcv9cap_P[0]
893 and %g1,(SPARCV9_VIS3|SPARCV9_64BIT_STACK),%g1
894 cmp %g1,(SPARCV9_VIS3|SPARCV9_64BIT_STACK)
895 be ecp_nistz256_point_add_vis3
898 save %sp,-STACK_FRAME-32*12-32,%sp
900 stx $rp,[%fp+STACK_BIAS-8] ! off-load $rp
904 ld [$bp+64],$t0 ! in2_z
918 or $t4,$t0,$t0 ! !in2infty
920 st $t0,[%fp+STACK_BIAS-12]
922 ld [$ap+64],$t0 ! in1_z
936 or $t4,$t0,$t0 ! !in1infty
938 st $t0,[%fp+STACK_BIAS-16]
942 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Z2sqr, in2_z);
943 add %sp,LOCALS+$Z2sqr,$rp
947 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Z1sqr, in1_z);
948 add %sp,LOCALS+$Z1sqr,$rp
951 add %sp,LOCALS+$Z2sqr,$ap
952 call __ecp_nistz256_mul_mont ! p256_mul_mont(S1, Z2sqr, in2_z);
953 add %sp,LOCALS+$S1,$rp
956 add %sp,LOCALS+$Z1sqr,$ap
957 call __ecp_nistz256_mul_mont ! p256_mul_mont(S2, Z1sqr, in1_z);
958 add %sp,LOCALS+$S2,$rp
961 add %sp,LOCALS+$S1,$ap
962 call __ecp_nistz256_mul_mont ! p256_mul_mont(S1, S1, in1_y);
963 add %sp,LOCALS+$S1,$rp
966 add %sp,LOCALS+$S2,$ap
967 call __ecp_nistz256_mul_mont ! p256_mul_mont(S2, S2, in2_y);
968 add %sp,LOCALS+$S2,$rp
970 add %sp,LOCALS+$S1,$bp
971 call __ecp_nistz256_sub_from ! p256_sub(R, S2, S1);
972 add %sp,LOCALS+$R,$rp
974 or @acc[1],@acc[0],@acc[0] ! see if result is zero
975 or @acc[3],@acc[2],@acc[2]
976 or @acc[5],@acc[4],@acc[4]
977 or @acc[7],@acc[6],@acc[6]
978 or @acc[2],@acc[0],@acc[0]
979 or @acc[6],@acc[4],@acc[4]
980 or @acc[4],@acc[0],@acc[0]
981 st @acc[0],[%fp+STACK_BIAS-20]
984 add %sp,LOCALS+$Z2sqr,$ap
985 call __ecp_nistz256_mul_mont ! p256_mul_mont(U1, in1_x, Z2sqr);
986 add %sp,LOCALS+$U1,$rp
989 add %sp,LOCALS+$Z1sqr,$ap
990 call __ecp_nistz256_mul_mont ! p256_mul_mont(U2, in2_x, Z1sqr);
991 add %sp,LOCALS+$U2,$rp
993 add %sp,LOCALS+$U1,$bp
994 call __ecp_nistz256_sub_from ! p256_sub(H, U2, U1);
995 add %sp,LOCALS+$H,$rp
997 or @acc[1],@acc[0],@acc[0] ! see if result is zero
998 or @acc[3],@acc[2],@acc[2]
999 or @acc[5],@acc[4],@acc[4]
1000 or @acc[7],@acc[6],@acc[6]
1001 or @acc[2],@acc[0],@acc[0]
1002 or @acc[6],@acc[4],@acc[4]
1003 orcc @acc[4],@acc[0],@acc[0]
1005 bne,pt %icc,.Ladd_proceed ! is_equal(U1,U2)?
1008 ld [%fp+STACK_BIAS-12],$t0
1009 ld [%fp+STACK_BIAS-16],$t1
1010 ld [%fp+STACK_BIAS-20],$t2
1012 be,pt %icc,.Ladd_proceed ! (in1infty || in2infty)?
1015 be,pt %icc,.Ladd_double ! is_equal(S1,S2)?
1018 ldx [%fp+STACK_BIAS-8],$rp
1048 ldx [%fp+STACK_BIAS-8],$rp_real
1050 b .Lpoint_double_shortcut
1051 add %sp,32*(12-4)+32,%sp ! difference in frame sizes
1055 add %sp,LOCALS+$R,$bp
1056 add %sp,LOCALS+$R,$ap
1057 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Rsqr, R);
1058 add %sp,LOCALS+$Rsqr,$rp
1061 add %sp,LOCALS+$H,$ap
1062 call __ecp_nistz256_mul_mont ! p256_mul_mont(res_z, H, in1_z);
1063 add %sp,LOCALS+$res_z,$rp
1065 add %sp,LOCALS+$H,$bp
1066 add %sp,LOCALS+$H,$ap
1067 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Hsqr, H);
1068 add %sp,LOCALS+$Hsqr,$rp
1071 add %sp,LOCALS+$res_z,$ap
1072 call __ecp_nistz256_mul_mont ! p256_mul_mont(res_z, res_z, in2_z);
1073 add %sp,LOCALS+$res_z,$rp
1075 add %sp,LOCALS+$H,$bp
1076 add %sp,LOCALS+$Hsqr,$ap
1077 call __ecp_nistz256_mul_mont ! p256_mul_mont(Hcub, Hsqr, H);
1078 add %sp,LOCALS+$Hcub,$rp
1080 add %sp,LOCALS+$U1,$bp
1081 add %sp,LOCALS+$Hsqr,$ap
1082 call __ecp_nistz256_mul_mont ! p256_mul_mont(U2, U1, Hsqr);
1083 add %sp,LOCALS+$U2,$rp
1085 call __ecp_nistz256_mul_by_2 ! p256_mul_by_2(Hsqr, U2);
1086 add %sp,LOCALS+$Hsqr,$rp
1088 add %sp,LOCALS+$Rsqr,$bp
1089 call __ecp_nistz256_sub_morf ! p256_sub(res_x, Rsqr, Hsqr);
1090 add %sp,LOCALS+$res_x,$rp
1092 add %sp,LOCALS+$Hcub,$bp
1093 call __ecp_nistz256_sub_from ! p256_sub(res_x, res_x, Hcub);
1094 add %sp,LOCALS+$res_x,$rp
1096 add %sp,LOCALS+$U2,$bp
1097 call __ecp_nistz256_sub_morf ! p256_sub(res_y, U2, res_x);
1098 add %sp,LOCALS+$res_y,$rp
1100 add %sp,LOCALS+$Hcub,$bp
1101 add %sp,LOCALS+$S1,$ap
1102 call __ecp_nistz256_mul_mont ! p256_mul_mont(S2, S1, Hcub);
1103 add %sp,LOCALS+$S2,$rp
1105 add %sp,LOCALS+$R,$bp
1106 add %sp,LOCALS+$res_y,$ap
1107 call __ecp_nistz256_mul_mont ! p256_mul_mont(res_y, res_y, R);
1108 add %sp,LOCALS+$res_y,$rp
1110 add %sp,LOCALS+$S2,$bp
1111 call __ecp_nistz256_sub_from ! p256_sub(res_y, res_y, S2);
1112 add %sp,LOCALS+$res_y,$rp
1114 ld [%fp+STACK_BIAS-16],$t1 ! !in1infty
1115 ld [%fp+STACK_BIAS-12],$t2 ! !in2infty
1116 ldx [%fp+STACK_BIAS-8],$rp
1118 for($i=0;$i<96;$i+=8) { # conditional moves
1120 ld [%sp+LOCALS+$i],@acc[0] ! res
1121 ld [%sp+LOCALS+$i+4],@acc[1]
1122 ld [$bp_real+$i],@acc[2] ! in2
1123 ld [$bp_real+$i+4],@acc[3]
1124 ld [$ap_real+$i],@acc[4] ! in1
1125 ld [$ap_real+$i+4],@acc[5]
1126 movrz $t1,@acc[2],@acc[0]
1127 movrz $t1,@acc[3],@acc[1]
1128 movrz $t2,@acc[4],@acc[0]
1129 movrz $t2,@acc[5],@acc[1]
1131 st @acc[1],[$rp+$i+4]
1138 .type ecp_nistz256_point_add,#function
1139 .size ecp_nistz256_point_add,.-ecp_nistz256_point_add
1143 ########################################################################
1144 # void ecp_nistz256_point_add_affine(P256_POINT *out,const P256_POINT *in1,
1145 # const P256_POINT_AFFINE *in2);
1147 my ($res_x,$res_y,$res_z,
1148 $U2,$S2,$H,$R,$Hsqr,$Hcub,$Rsqr)=map(32*$_,(0..9));
1150 # above map() describes stack layout with 10 temporary
1151 # 256-bit vectors on top. Then we reserve some space for
1152 # !in1infty, !in2infty, result of check for zero and return pointer.
1154 my @ONE_mont=(1,0,0,-1,-1,-1,-2,0);
1155 my $bp_real=$rp_real;
1158 .globl ecp_nistz256_point_add_affine
1160 ecp_nistz256_point_add_affine:
1161 SPARC_LOAD_ADDRESS_LEAF(OPENSSL_sparcv9cap_P,%g1,%g5)
1162 ld [%g1],%g1 ! OPENSSL_sparcv9cap_P[0]
1163 and %g1,(SPARCV9_VIS3|SPARCV9_64BIT_STACK),%g1
1164 cmp %g1,(SPARCV9_VIS3|SPARCV9_64BIT_STACK)
1165 be ecp_nistz256_point_add_affine_vis3
1168 save %sp,-STACK_FRAME-32*10-32,%sp
1170 stx $rp,[%fp+STACK_BIAS-8] ! off-load $rp
1174 ld [$ap+64],$t0 ! in1_z
1188 or $t4,$t0,$t0 ! !in1infty
1190 st $t0,[%fp+STACK_BIAS-16]
1192 ld [$bp],@acc[0] ! in2_x
1200 ld [$bp+32],$t0 ! in2_y
1208 or @acc[1],@acc[0],@acc[0]
1209 or @acc[3],@acc[2],@acc[2]
1210 or @acc[5],@acc[4],@acc[4]
1211 or @acc[7],@acc[6],@acc[6]
1212 or @acc[2],@acc[0],@acc[0]
1213 or @acc[6],@acc[4],@acc[4]
1214 or @acc[4],@acc[0],@acc[0]
1222 or @acc[0],$t0,$t0 ! !in2infty
1224 st $t0,[%fp+STACK_BIAS-12]
1228 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Z1sqr, in1_z);
1229 add %sp,LOCALS+$Z1sqr,$rp
1232 add %sp,LOCALS+$Z1sqr,$ap
1233 call __ecp_nistz256_mul_mont ! p256_mul_mont(U2, Z1sqr, in2_x);
1234 add %sp,LOCALS+$U2,$rp
1237 call __ecp_nistz256_sub_from ! p256_sub(H, U2, in1_x);
1238 add %sp,LOCALS+$H,$rp
1241 add %sp,LOCALS+$Z1sqr,$ap
1242 call __ecp_nistz256_mul_mont ! p256_mul_mont(S2, Z1sqr, in1_z);
1243 add %sp,LOCALS+$S2,$rp
1246 add %sp,LOCALS+$H,$ap
1247 call __ecp_nistz256_mul_mont ! p256_mul_mont(res_z, H, in1_z);
1248 add %sp,LOCALS+$res_z,$rp
1251 add %sp,LOCALS+$S2,$ap
1252 call __ecp_nistz256_mul_mont ! p256_mul_mont(S2, S2, in2_y);
1253 add %sp,LOCALS+$S2,$rp
1256 call __ecp_nistz256_sub_from ! p256_sub(R, S2, in1_y);
1257 add %sp,LOCALS+$R,$rp
1259 add %sp,LOCALS+$H,$bp
1260 add %sp,LOCALS+$H,$ap
1261 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Hsqr, H);
1262 add %sp,LOCALS+$Hsqr,$rp
1264 add %sp,LOCALS+$R,$bp
1265 add %sp,LOCALS+$R,$ap
1266 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Rsqr, R);
1267 add %sp,LOCALS+$Rsqr,$rp
1269 add %sp,LOCALS+$H,$bp
1270 add %sp,LOCALS+$Hsqr,$ap
1271 call __ecp_nistz256_mul_mont ! p256_mul_mont(Hcub, Hsqr, H);
1272 add %sp,LOCALS+$Hcub,$rp
1275 add %sp,LOCALS+$Hsqr,$ap
1276 call __ecp_nistz256_mul_mont ! p256_mul_mont(U2, in1_x, Hsqr);
1277 add %sp,LOCALS+$U2,$rp
1279 call __ecp_nistz256_mul_by_2 ! p256_mul_by_2(Hsqr, U2);
1280 add %sp,LOCALS+$Hsqr,$rp
1282 add %sp,LOCALS+$Rsqr,$bp
1283 call __ecp_nistz256_sub_morf ! p256_sub(res_x, Rsqr, Hsqr);
1284 add %sp,LOCALS+$res_x,$rp
1286 add %sp,LOCALS+$Hcub,$bp
1287 call __ecp_nistz256_sub_from ! p256_sub(res_x, res_x, Hcub);
1288 add %sp,LOCALS+$res_x,$rp
1290 add %sp,LOCALS+$U2,$bp
1291 call __ecp_nistz256_sub_morf ! p256_sub(res_y, U2, res_x);
1292 add %sp,LOCALS+$res_y,$rp
1295 add %sp,LOCALS+$Hcub,$ap
1296 call __ecp_nistz256_mul_mont ! p256_mul_mont(S2, in1_y, Hcub);
1297 add %sp,LOCALS+$S2,$rp
1299 add %sp,LOCALS+$R,$bp
1300 add %sp,LOCALS+$res_y,$ap
1301 call __ecp_nistz256_mul_mont ! p256_mul_mont(res_y, res_y, R);
1302 add %sp,LOCALS+$res_y,$rp
1304 add %sp,LOCALS+$S2,$bp
1305 call __ecp_nistz256_sub_from ! p256_sub(res_y, res_y, S2);
1306 add %sp,LOCALS+$res_y,$rp
1308 ld [%fp+STACK_BIAS-16],$t1 ! !in1infty
1309 ld [%fp+STACK_BIAS-12],$t2 ! !in2infty
1310 ldx [%fp+STACK_BIAS-8],$rp
1312 for($i=0;$i<64;$i+=8) { # conditional moves
1314 ld [%sp+LOCALS+$i],@acc[0] ! res
1315 ld [%sp+LOCALS+$i+4],@acc[1]
1316 ld [$bp_real+$i],@acc[2] ! in2
1317 ld [$bp_real+$i+4],@acc[3]
1318 ld [$ap_real+$i],@acc[4] ! in1
1319 ld [$ap_real+$i+4],@acc[5]
1320 movrz $t1,@acc[2],@acc[0]
1321 movrz $t1,@acc[3],@acc[1]
1322 movrz $t2,@acc[4],@acc[0]
1323 movrz $t2,@acc[5],@acc[1]
1325 st @acc[1],[$rp+$i+4]
1331 ld [%sp+LOCALS+$i],@acc[0] ! res
1332 ld [%sp+LOCALS+$i+4],@acc[1]
1333 ld [$ap_real+$i],@acc[4] ! in1
1334 ld [$ap_real+$i+4],@acc[5]
1335 movrz $t1,@ONE_mont[$j],@acc[0]
1336 movrz $t1,@ONE_mont[$j+1],@acc[1]
1337 movrz $t2,@acc[4],@acc[0]
1338 movrz $t2,@acc[5],@acc[1]
1340 st @acc[1],[$rp+$i+4]
1346 .type ecp_nistz256_point_add_affine,#function
1347 .size ecp_nistz256_point_add_affine,.-ecp_nistz256_point_add_affine
1351 my ($out,$inp,$index)=map("%i$_",(0..2));
1355 ! void ecp_nistz256_scatter_w5(void *%i0,const P256_POINT *%i1,
1357 .globl ecp_nistz256_scatter_w5
1359 ecp_nistz256_scatter_w5:
1360 save %sp,-STACK_FRAME,%sp
1363 add $out,$index,$out
1374 st %l0,[$out+64*0-4]
1375 st %l1,[$out+64*1-4]
1376 st %l2,[$out+64*2-4]
1377 st %l3,[$out+64*3-4]
1378 st %l4,[$out+64*4-4]
1379 st %l5,[$out+64*5-4]
1380 st %l6,[$out+64*6-4]
1381 st %l7,[$out+64*7-4]
1393 st %l0,[$out+64*0-4]
1394 st %l1,[$out+64*1-4]
1395 st %l2,[$out+64*2-4]
1396 st %l3,[$out+64*3-4]
1397 st %l4,[$out+64*4-4]
1398 st %l5,[$out+64*5-4]
1399 st %l6,[$out+64*6-4]
1400 st %l7,[$out+64*7-4]
1411 st %l0,[$out+64*0-4]
1412 st %l1,[$out+64*1-4]
1413 st %l2,[$out+64*2-4]
1414 st %l3,[$out+64*3-4]
1415 st %l4,[$out+64*4-4]
1416 st %l5,[$out+64*5-4]
1417 st %l6,[$out+64*6-4]
1418 st %l7,[$out+64*7-4]
1422 .type ecp_nistz256_scatter_w5,#function
1423 .size ecp_nistz256_scatter_w5,.-ecp_nistz256_scatter_w5
1425 ! void ecp_nistz256_gather_w5(P256_POINT *%i0,const void *%i1,
1427 .globl ecp_nistz256_gather_w5
1429 ecp_nistz256_gather_w5:
1430 save %sp,-STACK_FRAME,%sp
1435 add $index,$mask,$index
1437 add $inp,$index,$inp
1520 .type ecp_nistz256_gather_w5,#function
1521 .size ecp_nistz256_gather_w5,.-ecp_nistz256_gather_w5
1523 ! void ecp_nistz256_scatter_w7(void *%i0,const P256_POINT_AFFINE *%i1,
1525 .globl ecp_nistz256_scatter_w7
1527 ecp_nistz256_scatter_w7:
1528 save %sp,-STACK_FRAME,%sp
1530 add $out,$index,$out
1535 subcc $index,1,$index
1543 bne .Loop_scatter_w7
1548 .type ecp_nistz256_scatter_w7,#function
1549 .size ecp_nistz256_scatter_w7,.-ecp_nistz256_scatter_w7
1551 ! void ecp_nistz256_gather_w7(P256_POINT_AFFINE *%i0,const void *%i1,
1553 .globl ecp_nistz256_gather_w7
1555 ecp_nistz256_gather_w7:
1556 save %sp,-STACK_FRAME,%sp
1561 add $index,$mask,$index
1562 add $inp,$index,$inp
1566 ldub [$inp+64*0],%l0
1567 prefetch [$inp+3840+64*0],1
1568 subcc $index,1,$index
1569 ldub [$inp+64*1],%l1
1570 prefetch [$inp+3840+64*1],1
1571 ldub [$inp+64*2],%l2
1572 prefetch [$inp+3840+64*2],1
1573 ldub [$inp+64*3],%l3
1574 prefetch [$inp+3840+64*3],1
1589 .type ecp_nistz256_gather_w7,#function
1590 .size ecp_nistz256_gather_w7,.-ecp_nistz256_gather_w7
1594 ########################################################################
1595 # Following subroutines are VIS3 counterparts of those above that
1596 # implement ones found in ecp_nistz256.c. Key difference is that they
1597 # use 128-bit multiplication and addition with 64-bit carry, and in order
1598 # to do that they perform conversion from uin32_t[8] to uint64_t[4] upon
1599 # entry and vice versa on return.
1601 my ($rp,$ap,$bp)=map("%i$_",(0..2));
1602 my ($t0,$t1,$t2,$t3,$a0,$a1,$a2,$a3)=map("%l$_",(0..7));
1603 my ($acc0,$acc1,$acc2,$acc3,$acc4,$acc5)=map("%o$_",(0..5));
1604 my ($bi,$poly1,$poly3,$minus1)=(map("%i$_",(3..5)),"%g1");
1605 my ($rp_real,$ap_real)=("%g2","%g3");
1606 my ($acc6,$acc7)=($bp,$bi); # used in squaring
1610 __ecp_nistz256_mul_by_2_vis3:
1611 addcc $acc0,$acc0,$acc0
1612 addxccc $acc1,$acc1,$acc1
1613 addxccc $acc2,$acc2,$acc2
1614 addxccc $acc3,$acc3,$acc3
1615 b .Lreduce_by_sub_vis3
1616 addxc %g0,%g0,$acc4 ! did it carry?
1617 .type __ecp_nistz256_mul_by_2_vis3,#function
1618 .size __ecp_nistz256_mul_by_2_vis3,.-__ecp_nistz256_mul_by_2_vis3
1621 __ecp_nistz256_add_vis3:
1627 __ecp_nistz256_add_noload_vis3:
1629 addcc $t0,$acc0,$acc0
1630 addxccc $t1,$acc1,$acc1
1631 addxccc $t2,$acc2,$acc2
1632 addxccc $t3,$acc3,$acc3
1633 addxc %g0,%g0,$acc4 ! did it carry?
1635 .Lreduce_by_sub_vis3:
1637 addcc $acc0,1,$t0 ! add -modulus, i.e. subtract
1638 addxccc $acc1,$poly1,$t1
1639 addxccc $acc2,$minus1,$t2
1640 addxccc $acc3,$poly3,$t3
1641 addxc $acc4,$minus1,$acc4
1643 movrz $acc4,$t0,$acc0 ! ret = borrow ? ret : ret-modulus
1644 movrz $acc4,$t1,$acc1
1646 movrz $acc4,$t2,$acc2
1648 movrz $acc4,$t3,$acc3
1652 .type __ecp_nistz256_add_vis3,#function
1653 .size __ecp_nistz256_add_vis3,.-__ecp_nistz256_add_vis3
1655 ! Trouble with subtraction is that there is no subtraction with 64-bit
1656 ! borrow, only with 32-bit one. For this reason we "decompose" 64-bit
1657 ! $acc0-$acc3 to 32-bit values and pick b[4] in 32-bit pieces. But
1658 ! recall that SPARC is big-endian, which is why you'll observe that
1659 ! b[4] is accessed as 4-0-12-8-20-16-28-24. And prior reduction we
1660 ! "collect" result back to 64-bit $acc0-$acc3.
1662 __ecp_nistz256_sub_from_vis3:
1671 subcc $acc0,$t0,$acc0
1673 subccc $acc4,$t1,$acc4
1675 subccc $acc1,$t2,$acc1
1677 and $acc0,$poly1,$acc0
1678 subccc $acc5,$t3,$acc5
1681 and $acc1,$poly1,$acc1
1683 or $acc0,$acc4,$acc0
1685 or $acc1,$acc5,$acc1
1687 subccc $acc2,$t0,$acc2
1688 subccc $acc4,$t1,$acc4
1689 subccc $acc3,$t2,$acc3
1690 and $acc2,$poly1,$acc2
1691 subccc $acc5,$t3,$acc5
1693 and $acc3,$poly1,$acc3
1695 or $acc2,$acc4,$acc2
1696 subc %g0,%g0,$acc4 ! did it borrow?
1697 b .Lreduce_by_add_vis3
1698 or $acc3,$acc5,$acc3
1699 .type __ecp_nistz256_sub_from_vis3,#function
1700 .size __ecp_nistz256_sub_from_vis3,.-__ecp_nistz256_sub_from_vis3
1703 __ecp_nistz256_sub_morf_vis3:
1712 subcc $t0,$acc0,$acc0
1714 subccc $t1,$acc4,$acc4
1716 subccc $t2,$acc1,$acc1
1718 and $acc0,$poly1,$acc0
1719 subccc $t3,$acc5,$acc5
1722 and $acc1,$poly1,$acc1
1724 or $acc0,$acc4,$acc0
1726 or $acc1,$acc5,$acc1
1728 subccc $t0,$acc2,$acc2
1729 subccc $t1,$acc4,$acc4
1730 subccc $t2,$acc3,$acc3
1731 and $acc2,$poly1,$acc2
1732 subccc $t3,$acc5,$acc5
1734 and $acc3,$poly1,$acc3
1736 or $acc2,$acc4,$acc2
1737 subc %g0,%g0,$acc4 ! did it borrow?
1738 or $acc3,$acc5,$acc3
1740 .Lreduce_by_add_vis3:
1742 addcc $acc0,-1,$t0 ! add modulus
1744 addxccc $acc1,$poly1,$t1
1745 not $poly1,$poly1 ! restore $poly1
1746 addxccc $acc2,%g0,$t2
1749 movrnz $acc4,$t0,$acc0 ! if a-b borrowed, ret = ret+mod
1750 movrnz $acc4,$t1,$acc1
1752 movrnz $acc4,$t2,$acc2
1754 movrnz $acc4,$t3,$acc3
1758 .type __ecp_nistz256_sub_morf_vis3,#function
1759 .size __ecp_nistz256_sub_morf_vis3,.-__ecp_nistz256_sub_morf_vis3
1762 __ecp_nistz256_div_by_2_vis3:
1763 ! ret = (a is odd ? a+mod : a) >> 1
1768 addcc $acc0,-1,$t0 ! add modulus
1769 addxccc $acc1,$t1,$t1
1770 addxccc $acc2,%g0,$t2
1771 addxccc $acc3,$t3,$t3
1772 addxc %g0,%g0,$acc4 ! carry bit
1774 movrnz $acc5,$t0,$acc0
1775 movrnz $acc5,$t1,$acc1
1776 movrnz $acc5,$t2,$acc2
1777 movrnz $acc5,$t3,$acc3
1778 movrz $acc5,%g0,$acc4
1793 sllx $acc4,63,$t3 ! don't forget carry bit
1799 .type __ecp_nistz256_div_by_2_vis3,#function
1800 .size __ecp_nistz256_div_by_2_vis3,.-__ecp_nistz256_div_by_2_vis3
1802 ! compared to __ecp_nistz256_mul_mont it's almost 4x smaller and
1803 ! 4x faster [on T4]...
1805 __ecp_nistz256_mul_mont_vis3:
1807 not $poly3,$poly3 ! 0xFFFFFFFF00000001
1815 ldx [$bp+8],$bi ! b[1]
1817 addcc $acc1,$t0,$acc1 ! accumulate high parts of multiplication
1819 addxccc $acc2,$t1,$acc2
1821 addxccc $acc3,$t2,$acc3
1825 for($i=1;$i<4;$i++) {
1826 # Reduction iteration is normally performed by accumulating
1827 # result of multiplication of modulus by "magic" digit [and
1828 # omitting least significant word, which is guaranteed to
1829 # be 0], but thanks to special form of modulus and "magic"
1830 # digit being equal to least significant word, it can be
1831 # performed with additions and subtractions alone. Indeed:
1833 # ffff0001.00000000.0000ffff.ffffffff
1835 # + xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx.abcdefgh
1837 # Now observing that ff..ff*x = (2^n-1)*x = 2^n*x-x, we
1840 # xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx.abcdefgh
1841 # + abcdefgh.abcdefgh.0000abcd.efgh0000.00000000
1842 # - 0000abcd.efgh0000.00000000.00000000.abcdefgh
1844 # or marking redundant operations:
1846 # xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx.--------
1847 # + abcdefgh.abcdefgh.0000abcd.efgh0000.--------
1848 # - 0000abcd.efgh0000.--------.--------.--------
1849 # ^^^^^^^^ but this word is calculated with umulxhi, because
1850 # there is no subtract with 64-bit borrow:-(
1853 sub $acc0,$t0,$t2 ! acc0*0xFFFFFFFF00000001, low part
1854 umulxhi $acc0,$poly3,$t3 ! acc0*0xFFFFFFFF00000001, high part
1855 addcc $acc1,$t0,$acc0 ! +=acc[0]<<96 and omit acc[0]
1857 addxccc $acc2,$t1,$acc1
1859 addxccc $acc3,$t2,$acc2 ! +=acc[0]*0xFFFFFFFF00000001
1861 addxccc $acc4,$t3,$acc3
1863 addxc $acc5,%g0,$acc4
1865 addcc $acc0,$t0,$acc0 ! accumulate low parts of multiplication
1867 addxccc $acc1,$t1,$acc1
1869 addxccc $acc2,$t2,$acc2
1871 addxccc $acc3,$t3,$acc3
1873 addxc $acc4,%g0,$acc4
1875 $code.=<<___ if ($i<3);
1876 ldx [$bp+8*($i+1)],$bi ! bp[$i+1]
1879 addcc $acc1,$t0,$acc1 ! accumulate high parts of multiplication
1881 addxccc $acc2,$t1,$acc2
1883 addxccc $acc3,$t2,$acc3
1884 addxccc $acc4,$t3,$acc4
1889 sub $acc0,$t0,$t2 ! acc0*0xFFFFFFFF00000001, low part
1890 umulxhi $acc0,$poly3,$t3 ! acc0*0xFFFFFFFF00000001, high part
1891 addcc $acc1,$t0,$acc0 ! +=acc[0]<<96 and omit acc[0]
1892 addxccc $acc2,$t1,$acc1
1893 addxccc $acc3,$t2,$acc2 ! +=acc[0]*0xFFFFFFFF00000001
1894 addxccc $acc4,$t3,$acc3
1895 b .Lmul_final_vis3 ! see below
1896 addxc $acc5,%g0,$acc4
1897 .type __ecp_nistz256_mul_mont_vis3,#function
1898 .size __ecp_nistz256_mul_mont_vis3,.-__ecp_nistz256_mul_mont_vis3
1900 ! compared to above __ecp_nistz256_mul_mont_vis3 it's 21% less
1901 ! instructions, but only 14% faster [on T4]...
1903 __ecp_nistz256_sqr_mont_vis3:
1904 ! | | | | | |a1*a0| |
1905 ! | | | | |a2*a0| | |
1906 ! | |a3*a2|a3*a0| | | |
1907 ! | | | |a2*a1| | | |
1908 ! | | |a3*a1| | | | |
1909 ! *| | | | | | | | 2|
1910 ! +|a3*a3|a2*a2|a1*a1|a0*a0|
1911 ! |--+--+--+--+--+--+--+--|
1912 ! |A7|A6|A5|A4|A3|A2|A1|A0|, where Ax is $accx, i.e. follow $accx
1914 ! "can't overflow" below mark carrying into high part of
1915 ! multiplication result, which can't overflow, because it
1916 ! can never be all ones.
1918 mulx $a1,$a0,$acc1 ! a[1]*a[0]
1920 mulx $a2,$a0,$acc2 ! a[2]*a[0]
1922 mulx $a3,$a0,$acc3 ! a[3]*a[0]
1923 umulxhi $a3,$a0,$acc4
1925 addcc $acc2,$t1,$acc2 ! accumulate high parts of multiplication
1926 mulx $a2,$a1,$t0 ! a[2]*a[1]
1928 addxccc $acc3,$t2,$acc3
1929 mulx $a3,$a1,$t2 ! a[3]*a[1]
1931 addxc $acc4,%g0,$acc4 ! can't overflow
1933 mulx $a3,$a2,$acc5 ! a[3]*a[2]
1934 not $poly3,$poly3 ! 0xFFFFFFFF00000001
1935 umulxhi $a3,$a2,$acc6
1937 addcc $t2,$t1,$t1 ! accumulate high parts of multiplication
1938 mulx $a0,$a0,$acc0 ! a[0]*a[0]
1939 addxc $t3,%g0,$t2 ! can't overflow
1941 addcc $acc3,$t0,$acc3 ! accumulate low parts of multiplication
1943 addxccc $acc4,$t1,$acc4
1944 mulx $a1,$a1,$t1 ! a[1]*a[1]
1945 addxccc $acc5,$t2,$acc5
1947 addxc $acc6,%g0,$acc6 ! can't overflow
1949 addcc $acc1,$acc1,$acc1 ! acc[1-6]*=2
1950 mulx $a2,$a2,$t2 ! a[2]*a[2]
1951 addxccc $acc2,$acc2,$acc2
1953 addxccc $acc3,$acc3,$acc3
1954 mulx $a3,$a3,$t3 ! a[3]*a[3]
1955 addxccc $acc4,$acc4,$acc4
1957 addxccc $acc5,$acc5,$acc5
1958 addxccc $acc6,$acc6,$acc6
1961 addcc $acc1,$a0,$acc1 ! +a[i]*a[i]
1962 addxccc $acc2,$t1,$acc2
1963 addxccc $acc3,$a1,$acc3
1964 addxccc $acc4,$t2,$acc4
1966 addxccc $acc5,$a2,$acc5
1968 addxccc $acc6,$t3,$acc6
1969 sub $acc0,$t0,$t2 ! acc0*0xFFFFFFFF00000001, low part
1970 addxc $acc7,$a3,$acc7
1972 for($i=0;$i<3;$i++) { # reductions, see commentary
1973 # in multiplication for details
1975 umulxhi $acc0,$poly3,$t3 ! acc0*0xFFFFFFFF00000001, high part
1976 addcc $acc1,$t0,$acc0 ! +=acc[0]<<96 and omit acc[0]
1978 addxccc $acc2,$t1,$acc1
1980 addxccc $acc3,$t2,$acc2 ! +=acc[0]*0xFFFFFFFF00000001
1981 sub $acc0,$t0,$t2 ! acc0*0xFFFFFFFF00000001, low part
1982 addxc %g0,$t3,$acc3 ! can't overflow
1986 umulxhi $acc0,$poly3,$t3 ! acc0*0xFFFFFFFF00000001, high part
1987 addcc $acc1,$t0,$acc0 ! +=acc[0]<<96 and omit acc[0]
1988 addxccc $acc2,$t1,$acc1
1989 addxccc $acc3,$t2,$acc2 ! +=acc[0]*0xFFFFFFFF00000001
1990 addxc %g0,$t3,$acc3 ! can't overflow
1992 addcc $acc0,$acc4,$acc0 ! accumulate upper half
1993 addxccc $acc1,$acc5,$acc1
1994 addxccc $acc2,$acc6,$acc2
1995 addxccc $acc3,$acc7,$acc3
2000 ! Final step is "if result > mod, subtract mod", but as comparison
2001 ! means subtraction, we do the subtraction and then copy outcome
2002 ! if it didn't borrow. But note that as we [have to] replace
2003 ! subtraction with addition with negative, carry/borrow logic is
2006 addcc $acc0,1,$t0 ! add -modulus, i.e. subtract
2007 not $poly3,$poly3 ! restore 0x00000000FFFFFFFE
2008 addxccc $acc1,$poly1,$t1
2009 addxccc $acc2,$minus1,$t2
2010 addxccc $acc3,$poly3,$t3
2011 addxccc $acc4,$minus1,%g0 ! did it carry?
2013 movcs %xcc,$t0,$acc0
2014 movcs %xcc,$t1,$acc1
2016 movcs %xcc,$t2,$acc2
2018 movcs %xcc,$t3,$acc3
2022 .type __ecp_nistz256_sqr_mont_vis3,#function
2023 .size __ecp_nistz256_sqr_mont_vis3,.-__ecp_nistz256_sqr_mont_vis3
2026 ########################################################################
2027 # void ecp_nistz256_point_double(P256_POINT *out,const P256_POINT *inp);
2030 my ($res_x,$res_y,$res_z,
2032 $S,$M,$Zsqr,$tmp0)=map(32*$_,(0..9));
2033 # above map() describes stack layout with 10 temporary
2034 # 256-bit vectors on top.
2038 ecp_nistz256_point_double_vis3:
2039 save %sp,-STACK64_FRAME-32*10,%sp
2042 .Ldouble_shortcut_vis3:
2045 sllx $minus1,32,$poly1 ! 0xFFFFFFFF00000000
2046 srl $poly3,0,$poly3 ! 0x00000000FFFFFFFE
2048 ! convert input to uint64_t[4]
2059 ld [$ap+32],$acc0 ! in_y
2067 ld [$ap+32+16],$acc2
2071 ld [$ap+32+24],$acc3
2075 stx $a0,[%sp+LOCALS64+$in_x]
2077 stx $a1,[%sp+LOCALS64+$in_x+8]
2079 stx $a2,[%sp+LOCALS64+$in_x+16]
2081 stx $a3,[%sp+LOCALS64+$in_x+24]
2083 stx $acc0,[%sp+LOCALS64+$in_y]
2085 stx $acc1,[%sp+LOCALS64+$in_y+8]
2087 stx $acc2,[%sp+LOCALS64+$in_y+16]
2088 stx $acc3,[%sp+LOCALS64+$in_y+24]
2090 ld [$ap+64],$a0 ! in_z
2108 stx $a0,[%sp+LOCALS64+$in_z]
2110 stx $a1,[%sp+LOCALS64+$in_z+8]
2112 stx $a2,[%sp+LOCALS64+$in_z+16]
2113 stx $a3,[%sp+LOCALS64+$in_z+24]
2115 ! in_y is still in $acc0-$acc3
2116 call __ecp_nistz256_mul_by_2_vis3 ! p256_mul_by_2(S, in_y);
2117 add %sp,LOCALS64+$S,$rp
2119 ! in_z is still in $a0-$a3
2120 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Zsqr, in_z);
2121 add %sp,LOCALS64+$Zsqr,$rp
2123 mov $acc0,$a0 ! put Zsqr aside
2128 add %sp,LOCALS64+$in_x,$bp
2129 call __ecp_nistz256_add_vis3 ! p256_add(M, Zsqr, in_x);
2130 add %sp,LOCALS64+$M,$rp
2132 mov $a0,$acc0 ! restore Zsqr
2133 ldx [%sp+LOCALS64+$S],$a0 ! forward load
2135 ldx [%sp+LOCALS64+$S+8],$a1
2137 ldx [%sp+LOCALS64+$S+16],$a2
2139 ldx [%sp+LOCALS64+$S+24],$a3
2141 add %sp,LOCALS64+$in_x,$bp
2142 call __ecp_nistz256_sub_morf_vis3 ! p256_sub(Zsqr, in_x, Zsqr);
2143 add %sp,LOCALS64+$Zsqr,$rp
2145 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(S, S);
2146 add %sp,LOCALS64+$S,$rp
2148 ldx [%sp+LOCALS64+$in_z],$bi
2149 ldx [%sp+LOCALS64+$in_y],$a0
2150 ldx [%sp+LOCALS64+$in_y+8],$a1
2151 ldx [%sp+LOCALS64+$in_y+16],$a2
2152 ldx [%sp+LOCALS64+$in_y+24],$a3
2153 add %sp,LOCALS64+$in_z,$bp
2154 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(tmp0, in_z, in_y);
2155 add %sp,LOCALS64+$tmp0,$rp
2157 ldx [%sp+LOCALS64+$M],$bi ! forward load
2158 ldx [%sp+LOCALS64+$Zsqr],$a0
2159 ldx [%sp+LOCALS64+$Zsqr+8],$a1
2160 ldx [%sp+LOCALS64+$Zsqr+16],$a2
2161 ldx [%sp+LOCALS64+$Zsqr+24],$a3
2163 call __ecp_nistz256_mul_by_2_vis3 ! p256_mul_by_2(res_z, tmp0);
2164 add %sp,LOCALS64+$res_z,$rp
2166 add %sp,LOCALS64+$M,$bp
2167 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(M, M, Zsqr);
2168 add %sp,LOCALS64+$M,$rp
2170 mov $acc0,$a0 ! put aside M
2174 call __ecp_nistz256_mul_by_2_vis3
2175 add %sp,LOCALS64+$M,$rp
2176 mov $a0,$t0 ! copy M
2177 ldx [%sp+LOCALS64+$S],$a0 ! forward load
2179 ldx [%sp+LOCALS64+$S+8],$a1
2181 ldx [%sp+LOCALS64+$S+16],$a2
2183 ldx [%sp+LOCALS64+$S+24],$a3
2184 call __ecp_nistz256_add_noload_vis3 ! p256_mul_by_3(M, M);
2185 add %sp,LOCALS64+$M,$rp
2187 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(tmp0, S);
2188 add %sp,LOCALS64+$tmp0,$rp
2190 ldx [%sp+LOCALS64+$S],$bi ! forward load
2191 ldx [%sp+LOCALS64+$in_x],$a0
2192 ldx [%sp+LOCALS64+$in_x+8],$a1
2193 ldx [%sp+LOCALS64+$in_x+16],$a2
2194 ldx [%sp+LOCALS64+$in_x+24],$a3
2196 call __ecp_nistz256_div_by_2_vis3 ! p256_div_by_2(res_y, tmp0);
2197 add %sp,LOCALS64+$res_y,$rp
2199 add %sp,LOCALS64+$S,$bp
2200 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S, S, in_x);
2201 add %sp,LOCALS64+$S,$rp
2203 ldx [%sp+LOCALS64+$M],$a0 ! forward load
2204 ldx [%sp+LOCALS64+$M+8],$a1
2205 ldx [%sp+LOCALS64+$M+16],$a2
2206 ldx [%sp+LOCALS64+$M+24],$a3
2208 call __ecp_nistz256_mul_by_2_vis3 ! p256_mul_by_2(tmp0, S);
2209 add %sp,LOCALS64+$tmp0,$rp
2211 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(res_x, M);
2212 add %sp,LOCALS64+$res_x,$rp
2214 add %sp,LOCALS64+$tmp0,$bp
2215 call __ecp_nistz256_sub_from_vis3 ! p256_sub(res_x, res_x, tmp0);
2216 add %sp,LOCALS64+$res_x,$rp
2218 ldx [%sp+LOCALS64+$M],$a0 ! forward load
2219 ldx [%sp+LOCALS64+$M+8],$a1
2220 ldx [%sp+LOCALS64+$M+16],$a2
2221 ldx [%sp+LOCALS64+$M+24],$a3
2223 add %sp,LOCALS64+$S,$bp
2224 call __ecp_nistz256_sub_morf_vis3 ! p256_sub(S, S, res_x);
2225 add %sp,LOCALS64+$S,$rp
2228 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S, S, M);
2229 add %sp,LOCALS64+$S,$rp
2231 ldx [%sp+LOCALS64+$res_x],$a0 ! forward load
2232 ldx [%sp+LOCALS64+$res_x+8],$a1
2233 ldx [%sp+LOCALS64+$res_x+16],$a2
2234 ldx [%sp+LOCALS64+$res_x+24],$a3
2236 add %sp,LOCALS64+$res_y,$bp
2237 call __ecp_nistz256_sub_from_vis3 ! p256_sub(res_y, S, res_y);
2238 add %sp,LOCALS64+$res_y,$bp
2240 ! convert output to uint_32[8]
2243 st $a0,[$rp_real] ! res_x
2248 st $t1,[$rp_real+12]
2249 st $a2,[$rp_real+16]
2250 st $t2,[$rp_real+20]
2251 st $a3,[$rp_real+24]
2252 st $t3,[$rp_real+28]
2254 ldx [%sp+LOCALS64+$res_z],$a0 ! forward load
2256 ldx [%sp+LOCALS64+$res_z+8],$a1
2258 ldx [%sp+LOCALS64+$res_z+16],$a2
2260 ldx [%sp+LOCALS64+$res_z+24],$a3
2262 st $acc0,[$rp_real+32] ! res_y
2263 st $t0, [$rp_real+32+4]
2264 st $acc1,[$rp_real+32+8]
2265 st $t1, [$rp_real+32+12]
2266 st $acc2,[$rp_real+32+16]
2267 st $t2, [$rp_real+32+20]
2268 st $acc3,[$rp_real+32+24]
2269 st $t3, [$rp_real+32+28]
2273 st $a0,[$rp_real+64] ! res_z
2275 st $t0,[$rp_real+64+4]
2277 st $a1,[$rp_real+64+8]
2278 st $t1,[$rp_real+64+12]
2279 st $a2,[$rp_real+64+16]
2280 st $t2,[$rp_real+64+20]
2281 st $a3,[$rp_real+64+24]
2282 st $t3,[$rp_real+64+28]
2286 .type ecp_nistz256_point_double_vis3,#function
2287 .size ecp_nistz256_point_double_vis3,.-ecp_nistz256_point_double_vis3
2290 ########################################################################
2291 # void ecp_nistz256_point_add(P256_POINT *out,const P256_POINT *in1,
2292 # const P256_POINT *in2);
2294 my ($res_x,$res_y,$res_z,
2295 $in1_x,$in1_y,$in1_z,
2296 $in2_x,$in2_y,$in2_z,
2297 $H,$Hsqr,$R,$Rsqr,$Hcub,
2298 $U1,$U2,$S1,$S2)=map(32*$_,(0..17));
2299 my ($Z1sqr, $Z2sqr) = ($Hsqr, $Rsqr);
2301 # above map() describes stack layout with 18 temporary
2302 # 256-bit vectors on top. Then we reserve some space for
2303 # !in1infty, !in2infty and result of check for zero.
2307 ecp_nistz256_point_add_vis3:
2308 save %sp,-STACK64_FRAME-32*18-32,%sp
2313 sllx $minus1,32,$poly1 ! 0xFFFFFFFF00000000
2314 srl $poly3,0,$poly3 ! 0x00000000FFFFFFFE
2316 ! convert input to uint64_t[4]
2317 ld [$bp],$a0 ! in2_x
2327 ld [$bp+32],$acc0 ! in2_y
2335 ld [$bp+32+16],$acc2
2339 ld [$bp+32+24],$acc3
2343 stx $a0,[%sp+LOCALS64+$in2_x]
2345 stx $a1,[%sp+LOCALS64+$in2_x+8]
2347 stx $a2,[%sp+LOCALS64+$in2_x+16]
2349 stx $a3,[%sp+LOCALS64+$in2_x+24]
2351 stx $acc0,[%sp+LOCALS64+$in2_y]
2353 stx $acc1,[%sp+LOCALS64+$in2_y+8]
2355 stx $acc2,[%sp+LOCALS64+$in2_y+16]
2356 stx $acc3,[%sp+LOCALS64+$in2_y+24]
2358 ld [$bp+64],$acc0 ! in2_z
2362 ld [$bp+64+16],$acc2
2364 ld [$bp+64+24],$acc3
2368 ld [$ap],$a0 ! in1_x
2384 stx $acc0,[%sp+LOCALS64+$in2_z]
2386 stx $acc1,[%sp+LOCALS64+$in2_z+8]
2388 stx $acc2,[%sp+LOCALS64+$in2_z+16]
2389 stx $acc3,[%sp+LOCALS64+$in2_z+24]
2391 or $acc1,$acc0,$acc0
2392 or $acc3,$acc2,$acc2
2393 or $acc2,$acc0,$acc0
2394 movrnz $acc0,-1,$acc0 ! !in2infty
2395 stx $acc0,[%fp+STACK_BIAS-8]
2398 ld [$ap+32],$acc0 ! in1_y
2405 ld [$ap+32+16],$acc2
2407 ld [$ap+32+24],$acc3
2411 stx $a0,[%sp+LOCALS64+$in1_x]
2413 stx $a1,[%sp+LOCALS64+$in1_x+8]
2415 stx $a2,[%sp+LOCALS64+$in1_x+16]
2417 stx $a3,[%sp+LOCALS64+$in1_x+24]
2419 stx $acc0,[%sp+LOCALS64+$in1_y]
2421 stx $acc1,[%sp+LOCALS64+$in1_y+8]
2423 stx $acc2,[%sp+LOCALS64+$in1_y+16]
2424 stx $acc3,[%sp+LOCALS64+$in1_y+24]
2426 ldx [%sp+LOCALS64+$in2_z],$a0 ! forward load
2427 ldx [%sp+LOCALS64+$in2_z+8],$a1
2428 ldx [%sp+LOCALS64+$in2_z+16],$a2
2429 ldx [%sp+LOCALS64+$in2_z+24],$a3
2431 ld [$ap+64],$acc0 ! in1_z
2435 ld [$ap+64+16],$acc2
2437 ld [$ap+64+24],$acc3
2445 stx $acc0,[%sp+LOCALS64+$in1_z]
2447 stx $acc1,[%sp+LOCALS64+$in1_z+8]
2449 stx $acc2,[%sp+LOCALS64+$in1_z+16]
2450 stx $acc3,[%sp+LOCALS64+$in1_z+24]
2452 or $acc1,$acc0,$acc0
2453 or $acc3,$acc2,$acc2
2454 or $acc2,$acc0,$acc0
2455 movrnz $acc0,-1,$acc0 ! !in1infty
2456 stx $acc0,[%fp+STACK_BIAS-16]
2458 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Z2sqr, in2_z);
2459 add %sp,LOCALS64+$Z2sqr,$rp
2461 ldx [%sp+LOCALS64+$in1_z],$a0
2462 ldx [%sp+LOCALS64+$in1_z+8],$a1
2463 ldx [%sp+LOCALS64+$in1_z+16],$a2
2464 ldx [%sp+LOCALS64+$in1_z+24],$a3
2465 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Z1sqr, in1_z);
2466 add %sp,LOCALS64+$Z1sqr,$rp
2468 ldx [%sp+LOCALS64+$Z2sqr],$bi
2469 ldx [%sp+LOCALS64+$in2_z],$a0
2470 ldx [%sp+LOCALS64+$in2_z+8],$a1
2471 ldx [%sp+LOCALS64+$in2_z+16],$a2
2472 ldx [%sp+LOCALS64+$in2_z+24],$a3
2473 add %sp,LOCALS64+$Z2sqr,$bp
2474 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S1, Z2sqr, in2_z);
2475 add %sp,LOCALS64+$S1,$rp
2477 ldx [%sp+LOCALS64+$Z1sqr],$bi
2478 ldx [%sp+LOCALS64+$in1_z],$a0
2479 ldx [%sp+LOCALS64+$in1_z+8],$a1
2480 ldx [%sp+LOCALS64+$in1_z+16],$a2
2481 ldx [%sp+LOCALS64+$in1_z+24],$a3
2482 add %sp,LOCALS64+$Z1sqr,$bp
2483 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S2, Z1sqr, in1_z);
2484 add %sp,LOCALS64+$S2,$rp
2486 ldx [%sp+LOCALS64+$S1],$bi
2487 ldx [%sp+LOCALS64+$in1_y],$a0
2488 ldx [%sp+LOCALS64+$in1_y+8],$a1
2489 ldx [%sp+LOCALS64+$in1_y+16],$a2
2490 ldx [%sp+LOCALS64+$in1_y+24],$a3
2491 add %sp,LOCALS64+$S1,$bp
2492 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S1, S1, in1_y);
2493 add %sp,LOCALS64+$S1,$rp
2495 ldx [%sp+LOCALS64+$S2],$bi
2496 ldx [%sp+LOCALS64+$in2_y],$a0
2497 ldx [%sp+LOCALS64+$in2_y+8],$a1
2498 ldx [%sp+LOCALS64+$in2_y+16],$a2
2499 ldx [%sp+LOCALS64+$in2_y+24],$a3
2500 add %sp,LOCALS64+$S2,$bp
2501 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S2, S2, in2_y);
2502 add %sp,LOCALS64+$S2,$rp
2504 ldx [%sp+LOCALS64+$Z2sqr],$bi ! forward load
2505 ldx [%sp+LOCALS64+$in1_x],$a0
2506 ldx [%sp+LOCALS64+$in1_x+8],$a1
2507 ldx [%sp+LOCALS64+$in1_x+16],$a2
2508 ldx [%sp+LOCALS64+$in1_x+24],$a3
2510 add %sp,LOCALS64+$S1,$bp
2511 call __ecp_nistz256_sub_from_vis3 ! p256_sub(R, S2, S1);
2512 add %sp,LOCALS64+$R,$rp
2514 or $acc1,$acc0,$acc0 ! see if result is zero
2515 or $acc3,$acc2,$acc2
2516 or $acc2,$acc0,$acc0
2517 stx $acc0,[%fp+STACK_BIAS-24]
2519 add %sp,LOCALS64+$Z2sqr,$bp
2520 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(U1, in1_x, Z2sqr);
2521 add %sp,LOCALS64+$U1,$rp
2523 ldx [%sp+LOCALS64+$Z1sqr],$bi
2524 ldx [%sp+LOCALS64+$in2_x],$a0
2525 ldx [%sp+LOCALS64+$in2_x+8],$a1
2526 ldx [%sp+LOCALS64+$in2_x+16],$a2
2527 ldx [%sp+LOCALS64+$in2_x+24],$a3
2528 add %sp,LOCALS64+$Z1sqr,$bp
2529 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(U2, in2_x, Z1sqr);
2530 add %sp,LOCALS64+$U2,$rp
2532 ldx [%sp+LOCALS64+$R],$a0 ! forward load
2533 ldx [%sp+LOCALS64+$R+8],$a1
2534 ldx [%sp+LOCALS64+$R+16],$a2
2535 ldx [%sp+LOCALS64+$R+24],$a3
2537 add %sp,LOCALS64+$U1,$bp
2538 call __ecp_nistz256_sub_from_vis3 ! p256_sub(H, U2, U1);
2539 add %sp,LOCALS64+$H,$rp
2541 or $acc1,$acc0,$acc0 ! see if result is zero
2542 or $acc3,$acc2,$acc2
2543 orcc $acc2,$acc0,$acc0
2545 bne,pt %xcc,.Ladd_proceed_vis3 ! is_equal(U1,U2)?
2548 ldx [%fp+STACK_BIAS-8],$t0
2549 ldx [%fp+STACK_BIAS-16],$t1
2550 ldx [%fp+STACK_BIAS-24],$t2
2552 be,pt %xcc,.Ladd_proceed_vis3 ! (in1infty || in2infty)?
2555 be,a,pt %xcc,.Ldouble_shortcut_vis3 ! is_equal(S1,S2)?
2556 add %sp,32*(12-10)+32,%sp ! difference in frame sizes
2561 st %g0,[$rp_real+12]
2562 st %g0,[$rp_real+16]
2563 st %g0,[$rp_real+20]
2564 st %g0,[$rp_real+24]
2565 st %g0,[$rp_real+28]
2566 st %g0,[$rp_real+32]
2567 st %g0,[$rp_real+32+4]
2568 st %g0,[$rp_real+32+8]
2569 st %g0,[$rp_real+32+12]
2570 st %g0,[$rp_real+32+16]
2571 st %g0,[$rp_real+32+20]
2572 st %g0,[$rp_real+32+24]
2573 st %g0,[$rp_real+32+28]
2574 st %g0,[$rp_real+64]
2575 st %g0,[$rp_real+64+4]
2576 st %g0,[$rp_real+64+8]
2577 st %g0,[$rp_real+64+12]
2578 st %g0,[$rp_real+64+16]
2579 st %g0,[$rp_real+64+20]
2580 st %g0,[$rp_real+64+24]
2581 st %g0,[$rp_real+64+28]
2587 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Rsqr, R);
2588 add %sp,LOCALS64+$Rsqr,$rp
2590 ldx [%sp+LOCALS64+$H],$bi
2591 ldx [%sp+LOCALS64+$in1_z],$a0
2592 ldx [%sp+LOCALS64+$in1_z+8],$a1
2593 ldx [%sp+LOCALS64+$in1_z+16],$a2
2594 ldx [%sp+LOCALS64+$in1_z+24],$a3
2595 add %sp,LOCALS64+$H,$bp
2596 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(res_z, H, in1_z);
2597 add %sp,LOCALS64+$res_z,$rp
2599 ldx [%sp+LOCALS64+$H],$a0
2600 ldx [%sp+LOCALS64+$H+8],$a1
2601 ldx [%sp+LOCALS64+$H+16],$a2
2602 ldx [%sp+LOCALS64+$H+24],$a3
2603 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Hsqr, H);
2604 add %sp,LOCALS64+$Hsqr,$rp
2606 ldx [%sp+LOCALS64+$res_z],$bi
2607 ldx [%sp+LOCALS64+$in2_z],$a0
2608 ldx [%sp+LOCALS64+$in2_z+8],$a1
2609 ldx [%sp+LOCALS64+$in2_z+16],$a2
2610 ldx [%sp+LOCALS64+$in2_z+24],$a3
2611 add %sp,LOCALS64+$res_z,$bp
2612 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(res_z, res_z, in2_z);
2613 add %sp,LOCALS64+$res_z,$rp
2615 ldx [%sp+LOCALS64+$H],$bi
2616 ldx [%sp+LOCALS64+$Hsqr],$a0
2617 ldx [%sp+LOCALS64+$Hsqr+8],$a1
2618 ldx [%sp+LOCALS64+$Hsqr+16],$a2
2619 ldx [%sp+LOCALS64+$Hsqr+24],$a3
2620 add %sp,LOCALS64+$H,$bp
2621 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(Hcub, Hsqr, H);
2622 add %sp,LOCALS64+$Hcub,$rp
2624 ldx [%sp+LOCALS64+$U1],$bi
2625 ldx [%sp+LOCALS64+$Hsqr],$a0
2626 ldx [%sp+LOCALS64+$Hsqr+8],$a1
2627 ldx [%sp+LOCALS64+$Hsqr+16],$a2
2628 ldx [%sp+LOCALS64+$Hsqr+24],$a3
2629 add %sp,LOCALS64+$U1,$bp
2630 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(U2, U1, Hsqr);
2631 add %sp,LOCALS64+$U2,$rp
2633 call __ecp_nistz256_mul_by_2_vis3 ! p256_mul_by_2(Hsqr, U2);
2634 add %sp,LOCALS64+$Hsqr,$rp
2636 add %sp,LOCALS64+$Rsqr,$bp
2637 call __ecp_nistz256_sub_morf_vis3 ! p256_sub(res_x, Rsqr, Hsqr);
2638 add %sp,LOCALS64+$res_x,$rp
2640 add %sp,LOCALS64+$Hcub,$bp
2641 call __ecp_nistz256_sub_from_vis3 ! p256_sub(res_x, res_x, Hcub);
2642 add %sp,LOCALS64+$res_x,$rp
2644 ldx [%sp+LOCALS64+$S1],$bi ! forward load
2645 ldx [%sp+LOCALS64+$Hcub],$a0
2646 ldx [%sp+LOCALS64+$Hcub+8],$a1
2647 ldx [%sp+LOCALS64+$Hcub+16],$a2
2648 ldx [%sp+LOCALS64+$Hcub+24],$a3
2650 add %sp,LOCALS64+$U2,$bp
2651 call __ecp_nistz256_sub_morf_vis3 ! p256_sub(res_y, U2, res_x);
2652 add %sp,LOCALS64+$res_y,$rp
2654 add %sp,LOCALS64+$S1,$bp
2655 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S2, S1, Hcub);
2656 add %sp,LOCALS64+$S2,$rp
2658 ldx [%sp+LOCALS64+$R],$bi
2659 ldx [%sp+LOCALS64+$res_y],$a0
2660 ldx [%sp+LOCALS64+$res_y+8],$a1
2661 ldx [%sp+LOCALS64+$res_y+16],$a2
2662 ldx [%sp+LOCALS64+$res_y+24],$a3
2663 add %sp,LOCALS64+$R,$bp
2664 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(res_y, res_y, R);
2665 add %sp,LOCALS64+$res_y,$rp
2667 add %sp,LOCALS64+$S2,$bp
2668 call __ecp_nistz256_sub_from_vis3 ! p256_sub(res_y, res_y, S2);
2669 add %sp,LOCALS64+$res_y,$rp
2671 ldx [%fp+STACK_BIAS-16],$t1 ! !in1infty
2672 ldx [%fp+STACK_BIAS-8],$t2 ! !in2infty
2674 for($i=0;$i<96;$i+=16) { # conditional moves
2676 ldx [%sp+LOCALS64+$res_x+$i],$acc0 ! res
2677 ldx [%sp+LOCALS64+$res_x+$i+8],$acc1
2678 ldx [%sp+LOCALS64+$in2_x+$i],$acc2 ! in2
2679 ldx [%sp+LOCALS64+$in2_x+$i+8],$acc3
2680 ldx [%sp+LOCALS64+$in1_x+$i],$acc4 ! in1
2681 ldx [%sp+LOCALS64+$in1_x+$i+8],$acc5
2682 movrz $t1,$acc2,$acc0
2683 movrz $t1,$acc3,$acc1
2684 movrz $t2,$acc4,$acc0
2685 movrz $t2,$acc5,$acc1
2688 st $acc0,[$rp_real+$i]
2689 st $acc2,[$rp_real+$i+4]
2690 st $acc1,[$rp_real+$i+8]
2691 st $acc3,[$rp_real+$i+12]
2698 .type ecp_nistz256_point_add_vis3,#function
2699 .size ecp_nistz256_point_add_vis3,.-ecp_nistz256_point_add_vis3
2702 ########################################################################
2703 # void ecp_nistz256_point_add_affine(P256_POINT *out,const P256_POINT *in1,
2704 # const P256_POINT_AFFINE *in2);
2706 my ($res_x,$res_y,$res_z,
2707 $in1_x,$in1_y,$in1_z,
2709 $U2,$S2,$H,$R,$Hsqr,$Hcub,$Rsqr)=map(32*$_,(0..14));
2711 # above map() describes stack layout with 15 temporary
2712 # 256-bit vectors on top. Then we reserve some space for
2713 # !in1infty and !in2infty.
2717 ecp_nistz256_point_add_affine_vis3:
2718 save %sp,-STACK64_FRAME-32*15-32,%sp
2723 sllx $minus1,32,$poly1 ! 0xFFFFFFFF00000000
2724 srl $poly3,0,$poly3 ! 0x00000000FFFFFFFE
2726 ! convert input to uint64_t[4]
2727 ld [$bp],$a0 ! in2_x
2737 ld [$bp+32],$acc0 ! in2_y
2745 ld [$bp+32+16],$acc2
2749 ld [$bp+32+24],$acc3
2753 stx $a0,[%sp+LOCALS64+$in2_x]
2755 stx $a1,[%sp+LOCALS64+$in2_x+8]
2757 stx $a2,[%sp+LOCALS64+$in2_x+16]
2759 stx $a3,[%sp+LOCALS64+$in2_x+24]
2761 stx $acc0,[%sp+LOCALS64+$in2_y]
2763 stx $acc1,[%sp+LOCALS64+$in2_y+8]
2765 stx $acc2,[%sp+LOCALS64+$in2_y+16]
2766 stx $acc3,[%sp+LOCALS64+$in2_y+24]
2770 or $acc1,$acc0,$acc0
2771 or $acc3,$acc2,$acc2
2773 or $acc2,$acc0,$acc0
2775 movrnz $a0,-1,$a0 ! !in2infty
2776 stx $a0,[%fp+STACK_BIAS-8]
2778 ld [$ap],$a0 ! in1_x
2788 ld [$ap+32],$acc0 ! in1_y
2796 ld [$ap+32+16],$acc2
2800 ld [$ap+32+24],$acc3
2804 stx $a0,[%sp+LOCALS64+$in1_x]
2806 stx $a1,[%sp+LOCALS64+$in1_x+8]
2808 stx $a2,[%sp+LOCALS64+$in1_x+16]
2810 stx $a3,[%sp+LOCALS64+$in1_x+24]
2812 stx $acc0,[%sp+LOCALS64+$in1_y]
2814 stx $acc1,[%sp+LOCALS64+$in1_y+8]
2816 stx $acc2,[%sp+LOCALS64+$in1_y+16]
2817 stx $acc3,[%sp+LOCALS64+$in1_y+24]
2819 ld [$ap+64],$a0 ! in1_z
2833 stx $a0,[%sp+LOCALS64+$in1_z]
2835 stx $a1,[%sp+LOCALS64+$in1_z+8]
2837 stx $a2,[%sp+LOCALS64+$in1_z+16]
2838 stx $a3,[%sp+LOCALS64+$in1_z+24]
2843 movrnz $t0,-1,$t0 ! !in1infty
2844 stx $t0,[%fp+STACK_BIAS-16]
2846 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Z1sqr, in1_z);
2847 add %sp,LOCALS64+$Z1sqr,$rp
2849 ldx [%sp+LOCALS64+$in2_x],$bi
2854 add %sp,LOCALS64+$in2_x,$bp
2855 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(U2, Z1sqr, in2_x);
2856 add %sp,LOCALS64+$U2,$rp
2858 ldx [%sp+LOCALS64+$Z1sqr],$bi ! forward load
2859 ldx [%sp+LOCALS64+$in1_z],$a0
2860 ldx [%sp+LOCALS64+$in1_z+8],$a1
2861 ldx [%sp+LOCALS64+$in1_z+16],$a2
2862 ldx [%sp+LOCALS64+$in1_z+24],$a3
2864 add %sp,LOCALS64+$in1_x,$bp
2865 call __ecp_nistz256_sub_from_vis3 ! p256_sub(H, U2, in1_x);
2866 add %sp,LOCALS64+$H,$rp
2868 add %sp,LOCALS64+$Z1sqr,$bp
2869 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S2, Z1sqr, in1_z);
2870 add %sp,LOCALS64+$S2,$rp
2872 ldx [%sp+LOCALS64+$H],$bi
2873 ldx [%sp+LOCALS64+$in1_z],$a0
2874 ldx [%sp+LOCALS64+$in1_z+8],$a1
2875 ldx [%sp+LOCALS64+$in1_z+16],$a2
2876 ldx [%sp+LOCALS64+$in1_z+24],$a3
2877 add %sp,LOCALS64+$H,$bp
2878 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(res_z, H, in1_z);
2879 add %sp,LOCALS64+$res_z,$rp
2881 ldx [%sp+LOCALS64+$S2],$bi
2882 ldx [%sp+LOCALS64+$in2_y],$a0
2883 ldx [%sp+LOCALS64+$in2_y+8],$a1
2884 ldx [%sp+LOCALS64+$in2_y+16],$a2
2885 ldx [%sp+LOCALS64+$in2_y+24],$a3
2886 add %sp,LOCALS64+$S2,$bp
2887 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S2, S2, in2_y);
2888 add %sp,LOCALS64+$S2,$rp
2890 ldx [%sp+LOCALS64+$H],$a0 ! forward load
2891 ldx [%sp+LOCALS64+$H+8],$a1
2892 ldx [%sp+LOCALS64+$H+16],$a2
2893 ldx [%sp+LOCALS64+$H+24],$a3
2895 add %sp,LOCALS64+$in1_y,$bp
2896 call __ecp_nistz256_sub_from_vis3 ! p256_sub(R, S2, in1_y);
2897 add %sp,LOCALS64+$R,$rp
2899 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Hsqr, H);
2900 add %sp,LOCALS64+$Hsqr,$rp
2902 ldx [%sp+LOCALS64+$R],$a0
2903 ldx [%sp+LOCALS64+$R+8],$a1
2904 ldx [%sp+LOCALS64+$R+16],$a2
2905 ldx [%sp+LOCALS64+$R+24],$a3
2906 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Rsqr, R);
2907 add %sp,LOCALS64+$Rsqr,$rp
2909 ldx [%sp+LOCALS64+$H],$bi
2910 ldx [%sp+LOCALS64+$Hsqr],$a0
2911 ldx [%sp+LOCALS64+$Hsqr+8],$a1
2912 ldx [%sp+LOCALS64+$Hsqr+16],$a2
2913 ldx [%sp+LOCALS64+$Hsqr+24],$a3
2914 add %sp,LOCALS64+$H,$bp
2915 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(Hcub, Hsqr, H);
2916 add %sp,LOCALS64+$Hcub,$rp
2918 ldx [%sp+LOCALS64+$Hsqr],$bi
2919 ldx [%sp+LOCALS64+$in1_x],$a0
2920 ldx [%sp+LOCALS64+$in1_x+8],$a1
2921 ldx [%sp+LOCALS64+$in1_x+16],$a2
2922 ldx [%sp+LOCALS64+$in1_x+24],$a3
2923 add %sp,LOCALS64+$Hsqr,$bp
2924 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(U2, in1_x, Hsqr);
2925 add %sp,LOCALS64+$U2,$rp
2927 call __ecp_nistz256_mul_by_2_vis3 ! p256_mul_by_2(Hsqr, U2);
2928 add %sp,LOCALS64+$Hsqr,$rp
2930 add %sp,LOCALS64+$Rsqr,$bp
2931 call __ecp_nistz256_sub_morf_vis3 ! p256_sub(res_x, Rsqr, Hsqr);
2932 add %sp,LOCALS64+$res_x,$rp
2934 add %sp,LOCALS64+$Hcub,$bp
2935 call __ecp_nistz256_sub_from_vis3 ! p256_sub(res_x, res_x, Hcub);
2936 add %sp,LOCALS64+$res_x,$rp
2938 ldx [%sp+LOCALS64+$Hcub],$bi ! forward load
2939 ldx [%sp+LOCALS64+$in1_y],$a0
2940 ldx [%sp+LOCALS64+$in1_y+8],$a1
2941 ldx [%sp+LOCALS64+$in1_y+16],$a2
2942 ldx [%sp+LOCALS64+$in1_y+24],$a3
2944 add %sp,LOCALS64+$U2,$bp
2945 call __ecp_nistz256_sub_morf_vis3 ! p256_sub(res_y, U2, res_x);
2946 add %sp,LOCALS64+$res_y,$rp
2948 add %sp,LOCALS64+$Hcub,$bp
2949 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S2, in1_y, Hcub);
2950 add %sp,LOCALS64+$S2,$rp
2952 ldx [%sp+LOCALS64+$R],$bi
2953 ldx [%sp+LOCALS64+$res_y],$a0
2954 ldx [%sp+LOCALS64+$res_y+8],$a1
2955 ldx [%sp+LOCALS64+$res_y+16],$a2
2956 ldx [%sp+LOCALS64+$res_y+24],$a3
2957 add %sp,LOCALS64+$R,$bp
2958 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(res_y, res_y, R);
2959 add %sp,LOCALS64+$res_y,$rp
2961 add %sp,LOCALS64+$S2,$bp
2962 call __ecp_nistz256_sub_from_vis3 ! p256_sub(res_y, res_y, S2);
2963 add %sp,LOCALS64+$res_y,$rp
2965 ldx [%fp+STACK_BIAS-16],$t1 ! !in1infty
2966 ldx [%fp+STACK_BIAS-8],$t2 ! !in2infty
2968 add %o7,.Lone_mont_vis3-1b,$bp
2970 for($i=0;$i<64;$i+=16) { # conditional moves
2972 ldx [%sp+LOCALS64+$res_x+$i],$acc0 ! res
2973 ldx [%sp+LOCALS64+$res_x+$i+8],$acc1
2974 ldx [%sp+LOCALS64+$in2_x+$i],$acc2 ! in2
2975 ldx [%sp+LOCALS64+$in2_x+$i+8],$acc3
2976 ldx [%sp+LOCALS64+$in1_x+$i],$acc4 ! in1
2977 ldx [%sp+LOCALS64+$in1_x+$i+8],$acc5
2978 movrz $t1,$acc2,$acc0
2979 movrz $t1,$acc3,$acc1
2980 movrz $t2,$acc4,$acc0
2981 movrz $t2,$acc5,$acc1
2984 st $acc0,[$rp_real+$i]
2985 st $acc2,[$rp_real+$i+4]
2986 st $acc1,[$rp_real+$i+8]
2987 st $acc3,[$rp_real+$i+12]
2990 for(;$i<96;$i+=16) {
2992 ldx [%sp+LOCALS64+$res_x+$i],$acc0 ! res
2993 ldx [%sp+LOCALS64+$res_x+$i+8],$acc1
2994 ldx [$bp+$i-64],$acc2 ! "in2"
2995 ldx [$bp+$i-64+8],$acc3
2996 ldx [%sp+LOCALS64+$in1_x+$i],$acc4 ! in1
2997 ldx [%sp+LOCALS64+$in1_x+$i+8],$acc5
2998 movrz $t1,$acc2,$acc0
2999 movrz $t1,$acc3,$acc1
3000 movrz $t2,$acc4,$acc0
3001 movrz $t2,$acc5,$acc1
3004 st $acc0,[$rp_real+$i]
3005 st $acc2,[$rp_real+$i+4]
3006 st $acc1,[$rp_real+$i+8]
3007 st $acc3,[$rp_real+$i+12]
3013 .type ecp_nistz256_point_add_affine_vis3,#function
3014 .size ecp_nistz256_point_add_affine_vis3,.-ecp_nistz256_point_add_affine_vis3
3017 .long 0x00000000,0x00000001, 0xffffffff,0x00000000
3018 .long 0xffffffff,0xffffffff, 0x00000000,0xfffffffe
3023 # Purpose of these subroutines is to explicitly encode VIS instructions,
3024 # so that one can compile the module without having to specify VIS
3025 # extensions on compiler command line, e.g. -xarch=v9 vs. -xarch=v9a.
3026 # Idea is to reserve for option to produce "universal" binary and let
3027 # programmer detect if current CPU is VIS capable at run-time.
3029 my ($mnemonic,$rs1,$rs2,$rd)=@_;
3030 my %bias = ( "g" => 0, "o" => 8, "l" => 16, "i" => 24 );
3032 my %visopf = ( "addxc" => 0x011,
3034 "umulxhi" => 0x016 );
3036 $ref = "$mnemonic\t$rs1,$rs2,$rd";
3038 if ($opf=$visopf{$mnemonic}) {
3039 foreach ($rs1,$rs2,$rd) {
3040 return $ref if (!/%([goli])([0-9])/);
3044 return sprintf ".word\t0x%08x !%s",
3045 0x81b00000|$rd<<25|$rs1<<14|$opf<<5|$rs2,
3052 foreach (split("\n",$code)) {
3053 s/\`([^\`]*)\`/eval $1/ge;
3055 s/\b(umulxhi|addxc[c]{0,2})\s+(%[goli][0-7]),\s*(%[goli][0-7]),\s*(%[goli][0-7])/
3056 &unvis3($1,$2,$3,$4)
3062 close STDOUT or die "error closing STDOUT: $!";