2 # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the OpenSSL license (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
10 # ====================================================================
11 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
12 # project. The module is, however, dual licensed under OpenSSL and
13 # CRYPTOGAMS licenses depending on where you obtain it. For further
14 # details see http://www.openssl.org/~appro/cryptogams/.
15 # ====================================================================
17 # ECP_NISTZ256 module for SPARCv9.
21 # Original ECP_NISTZ256 submission targeting x86_64 is detailed in
22 # http://eprint.iacr.org/2013/816. In the process of adaptation
23 # original .c module was made 32-bit savvy in order to make this
24 # implementation possible.
26 # with/without -DECP_NISTZ256_ASM
27 # UltraSPARC III +12-18%
28 # SPARC T4 +99-550% (+66-150% on 32-bit Solaris)
30 # Ranges denote minimum and maximum improvement coefficients depending
31 # on benchmark. Lower coefficients are for ECDSA sign, server-side
32 # operation. Keep in mind that +200% means 3x improvement.
35 open STDOUT,">$output";
38 #include "sparc_arch.h"
40 #define LOCALS (STACK_BIAS+STACK_FRAME)
42 .register %g2,#scratch
43 .register %g3,#scratch
44 # define STACK64_FRAME STACK_FRAME
45 # define LOCALS64 LOCALS
47 # define STACK64_FRAME (2047+192)
48 # define LOCALS64 STACK64_FRAME
51 .section ".text",#alloc,#execinstr
53 ########################################################################
54 # Convert ecp_nistz256_table.c to layout expected by ecp_nistz_gather_w7
56 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
57 open TABLE,"<ecp_nistz256_table.c" or
58 open TABLE,"<${dir}../ecp_nistz256_table.c" or
59 die "failed to open ecp_nistz256_table.c:",$!;
64 s/TOBN\(\s*(0x[0-9a-f]+),\s*(0x[0-9a-f]+)\s*\)/push @arr,hex($2),hex($1)/geo;
68 # See ecp_nistz256_table.c for explanation for why it's 64*16*37.
69 # 64*16*37-1 is because $#arr returns last valid index or @arr, not
71 die "insane number of elements" if ($#arr != 64*16*37-1);
74 .globl ecp_nistz256_precomputed
76 ecp_nistz256_precomputed:
78 ########################################################################
79 # this conversion smashes P256_POINT_AFFINE by individual bytes with
80 # 64 byte interval, similar to
84 @tbl = splice(@arr,0,64*16);
85 for($i=0;$i<64;$i++) {
87 for($j=0;$j<64;$j++) {
88 push @line,(@tbl[$j*16+$i/4]>>(($i%4)*8))&0xff;
91 $code.=join(',',map { sprintf "0x%02x",$_} @line);
97 my ($rp,$ap,$bp)=map("%i$_",(0..2));
98 my @acc=map("%l$_",(0..7));
99 my ($t0,$t1,$t2,$t3,$t4,$t5,$t6,$t7)=(map("%o$_",(0..5)),"%g4","%g5");
100 my ($bi,$a0,$mask,$carry)=(map("%i$_",(3..5)),"%g1");
101 my ($rp_real,$ap_real)=("%g2","%g3");
104 .type ecp_nistz256_precomputed,#object
105 .size ecp_nistz256_precomputed,.-ecp_nistz256_precomputed
107 .LRR: ! 2^512 mod P precomputed for NIST P256 polynomial
108 .long 0x00000003, 0x00000000, 0xffffffff, 0xfffffffb
109 .long 0xfffffffe, 0xffffffff, 0xfffffffd, 0x00000004
111 .long 1,0,0,0,0,0,0,0
112 .asciz "ECP_NISTZ256 for SPARCv9, CRYPTOGAMS by <appro\@openssl.org>"
114 ! void ecp_nistz256_to_mont(BN_ULONG %i0[8],const BN_ULONG %i1[8]);
115 .globl ecp_nistz256_to_mont
117 ecp_nistz256_to_mont:
118 save %sp,-STACK_FRAME,%sp
122 call __ecp_nistz256_mul_mont
126 .type ecp_nistz256_to_mont,#function
127 .size ecp_nistz256_to_mont,.-ecp_nistz256_to_mont
129 ! void ecp_nistz256_from_mont(BN_ULONG %i0[8],const BN_ULONG %i1[8]);
130 .globl ecp_nistz256_from_mont
132 ecp_nistz256_from_mont:
133 save %sp,-STACK_FRAME,%sp
137 call __ecp_nistz256_mul_mont
141 .type ecp_nistz256_from_mont,#function
142 .size ecp_nistz256_from_mont,.-ecp_nistz256_from_mont
144 ! void ecp_nistz256_mul_mont(BN_ULONG %i0[8],const BN_ULONG %i1[8],
145 ! const BN_ULONG %i2[8]);
146 .globl ecp_nistz256_mul_mont
148 ecp_nistz256_mul_mont:
149 save %sp,-STACK_FRAME,%sp
151 call __ecp_nistz256_mul_mont
155 .type ecp_nistz256_mul_mont,#function
156 .size ecp_nistz256_mul_mont,.-ecp_nistz256_mul_mont
158 ! void ecp_nistz256_sqr_mont(BN_ULONG %i0[8],const BN_ULONG %i2[8]);
159 .globl ecp_nistz256_sqr_mont
161 ecp_nistz256_sqr_mont:
162 save %sp,-STACK_FRAME,%sp
164 call __ecp_nistz256_mul_mont
168 .type ecp_nistz256_sqr_mont,#function
169 .size ecp_nistz256_sqr_mont,.-ecp_nistz256_sqr_mont
172 ########################################################################
173 # Special thing to keep in mind is that $t0-$t7 hold 64-bit values,
174 # while all others are meant to keep 32. "Meant to" means that additions
175 # to @acc[0-7] do "contaminate" upper bits, but they are cleared before
176 # they can affect outcome (follow 'and' with $mask). Also keep in mind
177 # that addition with carry is addition with 32-bit carry, even though
178 # CPU is 64-bit. [Addition with 64-bit carry was introduced in T3, see
179 # below for VIS3 code paths.]
183 __ecp_nistz256_mul_mont:
184 ld [$bp+0],$bi ! b[0]
187 srl $mask,0,$mask ! 0xffffffff
195 mulx $a0,$bi,$t0 ! a[0-7]*b[0], 64-bit results
203 srlx $t0,32,@acc[1] ! extract high parts
210 srlx $t7,32,@acc[0] ! "@acc[8]"
213 for($i=1;$i<8;$i++) {
215 addcc @acc[1],$t1,@acc[1] ! accumulate high parts
216 ld [$bp+4*$i],$bi ! b[$i]
217 ld [$ap+4],$t1 ! re-load a[1-7]
218 addccc @acc[2],$t2,@acc[2]
219 addccc @acc[3],$t3,@acc[3]
222 addccc @acc[4],$t4,@acc[4]
223 addccc @acc[5],$t5,@acc[5]
226 addccc @acc[6],$t6,@acc[6]
227 addccc @acc[7],$t7,@acc[7]
230 addccc @acc[0],$carry,@acc[0] ! "@acc[8]"
233 # Reduction iteration is normally performed by accumulating
234 # result of multiplication of modulus by "magic" digit [and
235 # omitting least significant word, which is guaranteed to
236 # be 0], but thanks to special form of modulus and "magic"
237 # digit being equal to least significant word, it can be
238 # performed with additions and subtractions alone. Indeed:
240 # ffff.0001.0000.0000.0000.ffff.ffff.ffff
242 # + xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.abcd
244 # Now observing that ff..ff*x = (2^n-1)*x = 2^n*x-x, we
247 # xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.abcd
248 # + abcd.0000.abcd.0000.0000.abcd.0000.0000.0000
249 # - abcd.0000.0000.0000.0000.0000.0000.abcd
251 # or marking redundant operations:
253 # xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.----
254 # + abcd.0000.abcd.0000.0000.abcd.----.----.----
255 # - abcd.----.----.----.----.----.----.----
258 ! multiplication-less reduction
259 addcc @acc[3],$t0,@acc[3] ! r[3]+=r[0]
260 addccc @acc[4],%g0,@acc[4] ! r[4]+=0
261 and @acc[1],$mask,@acc[1]
262 and @acc[2],$mask,@acc[2]
263 addccc @acc[5],%g0,@acc[5] ! r[5]+=0
264 addccc @acc[6],$t0,@acc[6] ! r[6]+=r[0]
265 and @acc[3],$mask,@acc[3]
266 and @acc[4],$mask,@acc[4]
267 addccc @acc[7],%g0,@acc[7] ! r[7]+=0
268 addccc @acc[0],$t0,@acc[0] ! r[8]+=r[0] "@acc[8]"
269 and @acc[5],$mask,@acc[5]
270 and @acc[6],$mask,@acc[6]
271 addc $carry,%g0,$carry ! top-most carry
272 subcc @acc[7],$t0,@acc[7] ! r[7]-=r[0]
273 subccc @acc[0],%g0,@acc[0] ! r[8]-=0 "@acc[8]"
274 subc $carry,%g0,$carry ! top-most carry
275 and @acc[7],$mask,@acc[7]
276 and @acc[0],$mask,@acc[0] ! "@acc[8]"
278 push(@acc,shift(@acc)); # rotate registers to "omit" acc[0]
280 mulx $a0,$bi,$t0 ! a[0-7]*b[$i], 64-bit results
288 add @acc[0],$t0,$t0 ! accumulate low parts, can't overflow
290 srlx $t0,32,@acc[1] ! extract high parts
303 srlx $t7,32,@acc[0] ! "@acc[8]"
307 addcc @acc[1],$t1,@acc[1] ! accumulate high parts
308 addccc @acc[2],$t2,@acc[2]
309 addccc @acc[3],$t3,@acc[3]
310 addccc @acc[4],$t4,@acc[4]
311 addccc @acc[5],$t5,@acc[5]
312 addccc @acc[6],$t6,@acc[6]
313 addccc @acc[7],$t7,@acc[7]
314 addccc @acc[0],$carry,@acc[0] ! "@acc[8]"
317 addcc @acc[3],$t0,@acc[3] ! multiplication-less reduction
318 addccc @acc[4],%g0,@acc[4]
319 addccc @acc[5],%g0,@acc[5]
320 addccc @acc[6],$t0,@acc[6]
321 addccc @acc[7],%g0,@acc[7]
322 addccc @acc[0],$t0,@acc[0] ! "@acc[8]"
323 addc $carry,%g0,$carry
324 subcc @acc[7],$t0,@acc[7]
325 subccc @acc[0],%g0,@acc[0] ! "@acc[8]"
326 subc $carry,%g0,$carry ! top-most carry
328 push(@acc,shift(@acc)); # rotate registers to omit acc[0]
330 ! Final step is "if result > mod, subtract mod", but we do it
331 ! "other way around", namely subtract modulus from result
332 ! and if it borrowed, add modulus back.
334 subcc @acc[0],-1,@acc[0] ! subtract modulus
335 subccc @acc[1],-1,@acc[1]
336 subccc @acc[2],-1,@acc[2]
337 subccc @acc[3],0,@acc[3]
338 subccc @acc[4],0,@acc[4]
339 subccc @acc[5],0,@acc[5]
340 subccc @acc[6],1,@acc[6]
341 subccc @acc[7],-1,@acc[7]
342 subc $carry,0,$carry ! broadcast borrow bit
344 ! Note that because mod has special form, i.e. consists of
345 ! 0xffffffff, 1 and 0s, we can conditionally synthesize it by
346 ! using value of broadcasted borrow and the borrow bit itself.
347 ! To minimize dependency chain we first broadcast and then
348 ! extract the bit by negating (follow $bi).
350 addcc @acc[0],$carry,@acc[0] ! add modulus or zero
351 addccc @acc[1],$carry,@acc[1]
354 addccc @acc[2],$carry,@acc[2]
356 addccc @acc[3],0,@acc[3]
358 addccc @acc[4],0,@acc[4]
360 addccc @acc[5],0,@acc[5]
362 addccc @acc[6],$bi,@acc[6]
364 addc @acc[7],$carry,@acc[7]
368 .type __ecp_nistz256_mul_mont,#function
369 .size __ecp_nistz256_mul_mont,.-__ecp_nistz256_mul_mont
371 ! void ecp_nistz256_add(BN_ULONG %i0[8],const BN_ULONG %i1[8],
372 ! const BN_ULONG %i2[8]);
373 .globl ecp_nistz256_add
376 save %sp,-STACK_FRAME,%sp
384 call __ecp_nistz256_add
388 .type ecp_nistz256_add,#function
389 .size ecp_nistz256_add,.-ecp_nistz256_add
393 ld [$bp+0],$t0 ! b[0]
397 addcc @acc[0],$t0,@acc[0]
400 addccc @acc[1],$t1,@acc[1]
403 addccc @acc[2],$t2,@acc[2]
404 addccc @acc[3],$t3,@acc[3]
405 addccc @acc[4],$t4,@acc[4]
406 addccc @acc[5],$t5,@acc[5]
407 addccc @acc[6],$t6,@acc[6]
408 addccc @acc[7],$t7,@acc[7]
409 subc %g0,%g0,$carry ! broadcast carry bit
413 ! if a+b carries, subtract modulus.
415 ! Note that because mod has special form, i.e. consists of
416 ! 0xffffffff, 1 and 0s, we can conditionally synthesize it by
417 ! using value of broadcasted borrow and the borrow bit itself.
418 ! To minimize dependency chain we first broadcast and then
419 ! extract the bit by negating (follow $bi).
421 subcc @acc[0],$carry,@acc[0] ! subtract synthesized modulus
422 subccc @acc[1],$carry,@acc[1]
425 subccc @acc[2],$carry,@acc[2]
427 subccc @acc[3],0,@acc[3]
429 subccc @acc[4],0,@acc[4]
431 subccc @acc[5],0,@acc[5]
433 subccc @acc[6],$bi,@acc[6]
435 subc @acc[7],$carry,@acc[7]
439 .type __ecp_nistz256_add,#function
440 .size __ecp_nistz256_add,.-__ecp_nistz256_add
442 ! void ecp_nistz256_mul_by_2(BN_ULONG %i0[8],const BN_ULONG %i1[8]);
443 .globl ecp_nistz256_mul_by_2
445 ecp_nistz256_mul_by_2:
446 save %sp,-STACK_FRAME,%sp
454 call __ecp_nistz256_mul_by_2
458 .type ecp_nistz256_mul_by_2,#function
459 .size ecp_nistz256_mul_by_2,.-ecp_nistz256_mul_by_2
462 __ecp_nistz256_mul_by_2:
463 addcc @acc[0],@acc[0],@acc[0] ! a+a=2*a
464 addccc @acc[1],@acc[1],@acc[1]
465 addccc @acc[2],@acc[2],@acc[2]
466 addccc @acc[3],@acc[3],@acc[3]
467 addccc @acc[4],@acc[4],@acc[4]
468 addccc @acc[5],@acc[5],@acc[5]
469 addccc @acc[6],@acc[6],@acc[6]
470 addccc @acc[7],@acc[7],@acc[7]
472 subc %g0,%g0,$carry ! broadcast carry bit
473 .type __ecp_nistz256_mul_by_2,#function
474 .size __ecp_nistz256_mul_by_2,.-__ecp_nistz256_mul_by_2
476 ! void ecp_nistz256_mul_by_3(BN_ULONG %i0[8],const BN_ULONG %i1[8]);
477 .globl ecp_nistz256_mul_by_3
479 ecp_nistz256_mul_by_3:
480 save %sp,-STACK_FRAME,%sp
488 call __ecp_nistz256_mul_by_3
492 .type ecp_nistz256_mul_by_3,#function
493 .size ecp_nistz256_mul_by_3,.-ecp_nistz256_mul_by_3
496 __ecp_nistz256_mul_by_3:
497 addcc @acc[0],@acc[0],$t0 ! a+a=2*a
498 addccc @acc[1],@acc[1],$t1
499 addccc @acc[2],@acc[2],$t2
500 addccc @acc[3],@acc[3],$t3
501 addccc @acc[4],@acc[4],$t4
502 addccc @acc[5],@acc[5],$t5
503 addccc @acc[6],@acc[6],$t6
504 addccc @acc[7],@acc[7],$t7
505 subc %g0,%g0,$carry ! broadcast carry bit
507 subcc $t0,$carry,$t0 ! .Lreduce_by_sub but without stores
509 subccc $t1,$carry,$t1
510 subccc $t2,$carry,$t2
517 addcc $t0,@acc[0],@acc[0] ! 2*a+a=3*a
518 addccc $t1,@acc[1],@acc[1]
519 addccc $t2,@acc[2],@acc[2]
520 addccc $t3,@acc[3],@acc[3]
521 addccc $t4,@acc[4],@acc[4]
522 addccc $t5,@acc[5],@acc[5]
523 addccc $t6,@acc[6],@acc[6]
524 addccc $t7,@acc[7],@acc[7]
526 subc %g0,%g0,$carry ! broadcast carry bit
527 .type __ecp_nistz256_mul_by_3,#function
528 .size __ecp_nistz256_mul_by_3,.-__ecp_nistz256_mul_by_3
530 ! void ecp_nistz256_sub(BN_ULONG %i0[8],const BN_ULONG %i1[8],
531 ! const BN_ULONG %i2[8]);
532 .globl ecp_nistz256_sub
535 save %sp,-STACK_FRAME,%sp
543 call __ecp_nistz256_sub_from
547 .type ecp_nistz256_sub,#function
548 .size ecp_nistz256_sub,.-ecp_nistz256_sub
550 ! void ecp_nistz256_neg(BN_ULONG %i0[8],const BN_ULONG %i1[8]);
551 .globl ecp_nistz256_neg
554 save %sp,-STACK_FRAME,%sp
563 call __ecp_nistz256_sub_from
567 .type ecp_nistz256_neg,#function
568 .size ecp_nistz256_neg,.-ecp_nistz256_neg
571 __ecp_nistz256_sub_from:
572 ld [$bp+0],$t0 ! b[0]
576 subcc @acc[0],$t0,@acc[0]
579 subccc @acc[1],$t1,@acc[1]
580 subccc @acc[2],$t2,@acc[2]
583 subccc @acc[3],$t3,@acc[3]
584 subccc @acc[4],$t4,@acc[4]
585 subccc @acc[5],$t5,@acc[5]
586 subccc @acc[6],$t6,@acc[6]
587 subccc @acc[7],$t7,@acc[7]
588 subc %g0,%g0,$carry ! broadcast borrow bit
592 ! if a-b borrows, add modulus.
594 ! Note that because mod has special form, i.e. consists of
595 ! 0xffffffff, 1 and 0s, we can conditionally synthesize it by
596 ! using value of broadcasted borrow and the borrow bit itself.
597 ! To minimize dependency chain we first broadcast and then
598 ! extract the bit by negating (follow $bi).
600 addcc @acc[0],$carry,@acc[0] ! add synthesized modulus
601 addccc @acc[1],$carry,@acc[1]
604 addccc @acc[2],$carry,@acc[2]
606 addccc @acc[3],0,@acc[3]
608 addccc @acc[4],0,@acc[4]
610 addccc @acc[5],0,@acc[5]
612 addccc @acc[6],$bi,@acc[6]
614 addc @acc[7],$carry,@acc[7]
618 .type __ecp_nistz256_sub_from,#function
619 .size __ecp_nistz256_sub_from,.-__ecp_nistz256_sub_from
622 __ecp_nistz256_sub_morf:
623 ld [$bp+0],$t0 ! b[0]
627 subcc $t0,@acc[0],@acc[0]
630 subccc $t1,@acc[1],@acc[1]
631 subccc $t2,@acc[2],@acc[2]
634 subccc $t3,@acc[3],@acc[3]
635 subccc $t4,@acc[4],@acc[4]
636 subccc $t5,@acc[5],@acc[5]
637 subccc $t6,@acc[6],@acc[6]
638 subccc $t7,@acc[7],@acc[7]
640 subc %g0,%g0,$carry ! broadcast borrow bit
641 .type __ecp_nistz256_sub_morf,#function
642 .size __ecp_nistz256_sub_morf,.-__ecp_nistz256_sub_morf
644 ! void ecp_nistz256_div_by_2(BN_ULONG %i0[8],const BN_ULONG %i1[8]);
645 .globl ecp_nistz256_div_by_2
647 ecp_nistz256_div_by_2:
648 save %sp,-STACK_FRAME,%sp
656 call __ecp_nistz256_div_by_2
660 .type ecp_nistz256_div_by_2,#function
661 .size ecp_nistz256_div_by_2,.-ecp_nistz256_div_by_2
664 __ecp_nistz256_div_by_2:
665 ! ret = (a is odd ? a+mod : a) >> 1
669 addcc @acc[0],$carry,@acc[0]
670 addccc @acc[1],$carry,@acc[1]
671 addccc @acc[2],$carry,@acc[2]
672 addccc @acc[3],0,@acc[3]
673 addccc @acc[4],0,@acc[4]
674 addccc @acc[5],0,@acc[5]
675 addccc @acc[6],$bi,@acc[6]
676 addccc @acc[7],$carry,@acc[7]
681 srl @acc[0],1,@acc[0]
683 srl @acc[1],1,@acc[1]
684 or @acc[0],$t0,@acc[0]
686 srl @acc[2],1,@acc[2]
687 or @acc[1],$t1,@acc[1]
690 srl @acc[3],1,@acc[3]
691 or @acc[2],$t2,@acc[2]
694 srl @acc[4],1,@acc[4]
695 or @acc[3],$t3,@acc[3]
698 srl @acc[5],1,@acc[5]
699 or @acc[4],$t4,@acc[4]
702 srl @acc[6],1,@acc[6]
703 or @acc[5],$t5,@acc[5]
706 srl @acc[7],1,@acc[7]
707 or @acc[6],$t6,@acc[6]
710 or @acc[7],$t7,@acc[7]
714 .type __ecp_nistz256_div_by_2,#function
715 .size __ecp_nistz256_div_by_2,.-__ecp_nistz256_div_by_2
718 ########################################################################
719 # following subroutines are "literal" implementation of those found in
722 ########################################################################
723 # void ecp_nistz256_point_double(P256_POINT *out,const P256_POINT *inp);
726 my ($S,$M,$Zsqr,$tmp0)=map(32*$_,(0..3));
727 # above map() describes stack layout with 4 temporary
728 # 256-bit vectors on top.
735 .globl ecp_nistz256_point_double
737 ecp_nistz256_point_double:
738 SPARC_LOAD_ADDRESS_LEAF(OPENSSL_sparcv9cap_P,%g1,%g5)
739 ld [%g1],%g1 ! OPENSSL_sparcv9cap_P[0]
740 and %g1,(SPARCV9_VIS3|SPARCV9_64BIT_STACK),%g1
741 cmp %g1,(SPARCV9_VIS3|SPARCV9_64BIT_STACK)
742 be ecp_nistz256_point_double_vis3
745 save %sp,-STACK_FRAME-32*4,%sp
750 .Lpoint_double_shortcut:
752 ld [$ap+32+4],@acc[1]
753 ld [$ap+32+8],@acc[2]
754 ld [$ap+32+12],@acc[3]
755 ld [$ap+32+16],@acc[4]
756 ld [$ap+32+20],@acc[5]
757 ld [$ap+32+24],@acc[6]
758 ld [$ap+32+28],@acc[7]
759 call __ecp_nistz256_mul_by_2 ! p256_mul_by_2(S, in_y);
760 add %sp,LOCALS+$S,$rp
764 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Zsqr, in_z);
765 add %sp,LOCALS+$Zsqr,$rp
768 call __ecp_nistz256_add ! p256_add(M, Zsqr, in_x);
769 add %sp,LOCALS+$M,$rp
771 add %sp,LOCALS+$S,$bp
772 add %sp,LOCALS+$S,$ap
773 call __ecp_nistz256_mul_mont ! p256_sqr_mont(S, S);
774 add %sp,LOCALS+$S,$rp
776 ld [$ap_real],@acc[0]
777 add %sp,LOCALS+$Zsqr,$bp
778 ld [$ap_real+4],@acc[1]
779 ld [$ap_real+8],@acc[2]
780 ld [$ap_real+12],@acc[3]
781 ld [$ap_real+16],@acc[4]
782 ld [$ap_real+20],@acc[5]
783 ld [$ap_real+24],@acc[6]
784 ld [$ap_real+28],@acc[7]
785 call __ecp_nistz256_sub_from ! p256_sub(Zsqr, in_x, Zsqr);
786 add %sp,LOCALS+$Zsqr,$rp
790 call __ecp_nistz256_mul_mont ! p256_mul_mont(tmp0, in_z, in_y);
791 add %sp,LOCALS+$tmp0,$rp
793 call __ecp_nistz256_mul_by_2 ! p256_mul_by_2(res_z, tmp0);
796 add %sp,LOCALS+$Zsqr,$bp
797 add %sp,LOCALS+$M,$ap
798 call __ecp_nistz256_mul_mont ! p256_mul_mont(M, M, Zsqr);
799 add %sp,LOCALS+$M,$rp
801 call __ecp_nistz256_mul_by_3 ! p256_mul_by_3(M, M);
802 add %sp,LOCALS+$M,$rp
804 add %sp,LOCALS+$S,$bp
805 add %sp,LOCALS+$S,$ap
806 call __ecp_nistz256_mul_mont ! p256_sqr_mont(tmp0, S);
807 add %sp,LOCALS+$tmp0,$rp
809 call __ecp_nistz256_div_by_2 ! p256_div_by_2(res_y, tmp0);
813 add %sp,LOCALS+$S,$ap
814 call __ecp_nistz256_mul_mont ! p256_mul_mont(S, S, in_x);
815 add %sp,LOCALS+$S,$rp
817 call __ecp_nistz256_mul_by_2 ! p256_mul_by_2(tmp0, S);
818 add %sp,LOCALS+$tmp0,$rp
820 add %sp,LOCALS+$M,$bp
821 add %sp,LOCALS+$M,$ap
822 call __ecp_nistz256_mul_mont ! p256_sqr_mont(res_x, M);
825 add %sp,LOCALS+$tmp0,$bp
826 call __ecp_nistz256_sub_from ! p256_sub(res_x, res_x, tmp0);
829 add %sp,LOCALS+$S,$bp
830 call __ecp_nistz256_sub_morf ! p256_sub(S, S, res_x);
831 add %sp,LOCALS+$S,$rp
833 add %sp,LOCALS+$M,$bp
834 add %sp,LOCALS+$S,$ap
835 call __ecp_nistz256_mul_mont ! p256_mul_mont(S, S, M);
836 add %sp,LOCALS+$S,$rp
839 call __ecp_nistz256_sub_from ! p256_sub(res_y, S, res_y);
844 .type ecp_nistz256_point_double,#function
845 .size ecp_nistz256_point_double,.-ecp_nistz256_point_double
849 ########################################################################
850 # void ecp_nistz256_point_add(P256_POINT *out,const P256_POINT *in1,
851 # const P256_POINT *in2);
853 my ($res_x,$res_y,$res_z,
854 $H,$Hsqr,$R,$Rsqr,$Hcub,
855 $U1,$U2,$S1,$S2)=map(32*$_,(0..11));
856 my ($Z1sqr, $Z2sqr) = ($Hsqr, $Rsqr);
858 # above map() describes stack layout with 12 temporary
859 # 256-bit vectors on top. Then we reserve some space for
860 # !in1infty, !in2infty, result of check for zero and return pointer.
862 my $bp_real=$rp_real;
865 .globl ecp_nistz256_point_add
867 ecp_nistz256_point_add:
868 SPARC_LOAD_ADDRESS_LEAF(OPENSSL_sparcv9cap_P,%g1,%g5)
869 ld [%g1],%g1 ! OPENSSL_sparcv9cap_P[0]
870 and %g1,(SPARCV9_VIS3|SPARCV9_64BIT_STACK),%g1
871 cmp %g1,(SPARCV9_VIS3|SPARCV9_64BIT_STACK)
872 be ecp_nistz256_point_add_vis3
875 save %sp,-STACK_FRAME-32*12-32,%sp
877 stx $rp,[%fp+STACK_BIAS-8] ! off-load $rp
881 ld [$bp],@acc[0] ! in2_x
889 ld [$bp+32],$t0 ! in2_y
897 or @acc[1],@acc[0],@acc[0]
898 or @acc[3],@acc[2],@acc[2]
899 or @acc[5],@acc[4],@acc[4]
900 or @acc[7],@acc[6],@acc[6]
901 or @acc[2],@acc[0],@acc[0]
902 or @acc[6],@acc[4],@acc[4]
903 or @acc[4],@acc[0],@acc[0]
911 or @acc[0],$t0,$t0 ! !in2infty
913 st $t0,[%fp+STACK_BIAS-12]
915 ld [$ap],@acc[0] ! in1_x
923 ld [$ap+32],$t0 ! in1_y
931 or @acc[1],@acc[0],@acc[0]
932 or @acc[3],@acc[2],@acc[2]
933 or @acc[5],@acc[4],@acc[4]
934 or @acc[7],@acc[6],@acc[6]
935 or @acc[2],@acc[0],@acc[0]
936 or @acc[6],@acc[4],@acc[4]
937 or @acc[4],@acc[0],@acc[0]
945 or @acc[0],$t0,$t0 ! !in1infty
947 st $t0,[%fp+STACK_BIAS-16]
951 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Z2sqr, in2_z);
952 add %sp,LOCALS+$Z2sqr,$rp
956 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Z1sqr, in1_z);
957 add %sp,LOCALS+$Z1sqr,$rp
960 add %sp,LOCALS+$Z2sqr,$ap
961 call __ecp_nistz256_mul_mont ! p256_mul_mont(S1, Z2sqr, in2_z);
962 add %sp,LOCALS+$S1,$rp
965 add %sp,LOCALS+$Z1sqr,$ap
966 call __ecp_nistz256_mul_mont ! p256_mul_mont(S2, Z1sqr, in1_z);
967 add %sp,LOCALS+$S2,$rp
970 add %sp,LOCALS+$S1,$ap
971 call __ecp_nistz256_mul_mont ! p256_mul_mont(S1, S1, in1_y);
972 add %sp,LOCALS+$S1,$rp
975 add %sp,LOCALS+$S2,$ap
976 call __ecp_nistz256_mul_mont ! p256_mul_mont(S2, S2, in2_y);
977 add %sp,LOCALS+$S2,$rp
979 add %sp,LOCALS+$S1,$bp
980 call __ecp_nistz256_sub_from ! p256_sub(R, S2, S1);
981 add %sp,LOCALS+$R,$rp
983 or @acc[1],@acc[0],@acc[0] ! see if result is zero
984 or @acc[3],@acc[2],@acc[2]
985 or @acc[5],@acc[4],@acc[4]
986 or @acc[7],@acc[6],@acc[6]
987 or @acc[2],@acc[0],@acc[0]
988 or @acc[6],@acc[4],@acc[4]
989 or @acc[4],@acc[0],@acc[0]
990 st @acc[0],[%fp+STACK_BIAS-20]
993 add %sp,LOCALS+$Z2sqr,$ap
994 call __ecp_nistz256_mul_mont ! p256_mul_mont(U1, in1_x, Z2sqr);
995 add %sp,LOCALS+$U1,$rp
998 add %sp,LOCALS+$Z1sqr,$ap
999 call __ecp_nistz256_mul_mont ! p256_mul_mont(U2, in2_x, Z1sqr);
1000 add %sp,LOCALS+$U2,$rp
1002 add %sp,LOCALS+$U1,$bp
1003 call __ecp_nistz256_sub_from ! p256_sub(H, U2, U1);
1004 add %sp,LOCALS+$H,$rp
1006 or @acc[1],@acc[0],@acc[0] ! see if result is zero
1007 or @acc[3],@acc[2],@acc[2]
1008 or @acc[5],@acc[4],@acc[4]
1009 or @acc[7],@acc[6],@acc[6]
1010 or @acc[2],@acc[0],@acc[0]
1011 or @acc[6],@acc[4],@acc[4]
1012 orcc @acc[4],@acc[0],@acc[0]
1014 bne,pt %icc,.Ladd_proceed ! is_equal(U1,U2)?
1017 ld [%fp+STACK_BIAS-12],$t0
1018 ld [%fp+STACK_BIAS-16],$t1
1019 ld [%fp+STACK_BIAS-20],$t2
1021 be,pt %icc,.Ladd_proceed ! (in1infty || in2infty)?
1024 be,pt %icc,.Ladd_double ! is_equal(S1,S2)?
1027 ldx [%fp+STACK_BIAS-8],$rp
1057 ldx [%fp+STACK_BIAS-8],$rp_real
1059 b .Lpoint_double_shortcut
1060 add %sp,32*(12-4)+32,%sp ! difference in frame sizes
1064 add %sp,LOCALS+$R,$bp
1065 add %sp,LOCALS+$R,$ap
1066 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Rsqr, R);
1067 add %sp,LOCALS+$Rsqr,$rp
1070 add %sp,LOCALS+$H,$ap
1071 call __ecp_nistz256_mul_mont ! p256_mul_mont(res_z, H, in1_z);
1072 add %sp,LOCALS+$res_z,$rp
1074 add %sp,LOCALS+$H,$bp
1075 add %sp,LOCALS+$H,$ap
1076 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Hsqr, H);
1077 add %sp,LOCALS+$Hsqr,$rp
1080 add %sp,LOCALS+$res_z,$ap
1081 call __ecp_nistz256_mul_mont ! p256_mul_mont(res_z, res_z, in2_z);
1082 add %sp,LOCALS+$res_z,$rp
1084 add %sp,LOCALS+$H,$bp
1085 add %sp,LOCALS+$Hsqr,$ap
1086 call __ecp_nistz256_mul_mont ! p256_mul_mont(Hcub, Hsqr, H);
1087 add %sp,LOCALS+$Hcub,$rp
1089 add %sp,LOCALS+$U1,$bp
1090 add %sp,LOCALS+$Hsqr,$ap
1091 call __ecp_nistz256_mul_mont ! p256_mul_mont(U2, U1, Hsqr);
1092 add %sp,LOCALS+$U2,$rp
1094 call __ecp_nistz256_mul_by_2 ! p256_mul_by_2(Hsqr, U2);
1095 add %sp,LOCALS+$Hsqr,$rp
1097 add %sp,LOCALS+$Rsqr,$bp
1098 call __ecp_nistz256_sub_morf ! p256_sub(res_x, Rsqr, Hsqr);
1099 add %sp,LOCALS+$res_x,$rp
1101 add %sp,LOCALS+$Hcub,$bp
1102 call __ecp_nistz256_sub_from ! p256_sub(res_x, res_x, Hcub);
1103 add %sp,LOCALS+$res_x,$rp
1105 add %sp,LOCALS+$U2,$bp
1106 call __ecp_nistz256_sub_morf ! p256_sub(res_y, U2, res_x);
1107 add %sp,LOCALS+$res_y,$rp
1109 add %sp,LOCALS+$Hcub,$bp
1110 add %sp,LOCALS+$S1,$ap
1111 call __ecp_nistz256_mul_mont ! p256_mul_mont(S2, S1, Hcub);
1112 add %sp,LOCALS+$S2,$rp
1114 add %sp,LOCALS+$R,$bp
1115 add %sp,LOCALS+$res_y,$ap
1116 call __ecp_nistz256_mul_mont ! p256_mul_mont(res_y, res_y, R);
1117 add %sp,LOCALS+$res_y,$rp
1119 add %sp,LOCALS+$S2,$bp
1120 call __ecp_nistz256_sub_from ! p256_sub(res_y, res_y, S2);
1121 add %sp,LOCALS+$res_y,$rp
1123 ld [%fp+STACK_BIAS-16],$t1 ! !in1infty
1124 ld [%fp+STACK_BIAS-12],$t2 ! !in2infty
1125 ldx [%fp+STACK_BIAS-8],$rp
1127 for($i=0;$i<96;$i+=8) { # conditional moves
1129 ld [%sp+LOCALS+$i],@acc[0] ! res
1130 ld [%sp+LOCALS+$i+4],@acc[1]
1131 ld [$bp_real+$i],@acc[2] ! in2
1132 ld [$bp_real+$i+4],@acc[3]
1133 ld [$ap_real+$i],@acc[4] ! in1
1134 ld [$ap_real+$i+4],@acc[5]
1135 movrz $t1,@acc[2],@acc[0]
1136 movrz $t1,@acc[3],@acc[1]
1137 movrz $t2,@acc[4],@acc[0]
1138 movrz $t2,@acc[5],@acc[1]
1140 st @acc[1],[$rp+$i+4]
1147 .type ecp_nistz256_point_add,#function
1148 .size ecp_nistz256_point_add,.-ecp_nistz256_point_add
1152 ########################################################################
1153 # void ecp_nistz256_point_add_affine(P256_POINT *out,const P256_POINT *in1,
1154 # const P256_POINT_AFFINE *in2);
1156 my ($res_x,$res_y,$res_z,
1157 $U2,$S2,$H,$R,$Hsqr,$Hcub,$Rsqr)=map(32*$_,(0..9));
1159 # above map() describes stack layout with 10 temporary
1160 # 256-bit vectors on top. Then we reserve some space for
1161 # !in1infty, !in2infty, result of check for zero and return pointer.
1163 my @ONE_mont=(1,0,0,-1,-1,-1,-2,0);
1164 my $bp_real=$rp_real;
1167 .globl ecp_nistz256_point_add_affine
1169 ecp_nistz256_point_add_affine:
1170 SPARC_LOAD_ADDRESS_LEAF(OPENSSL_sparcv9cap_P,%g1,%g5)
1171 ld [%g1],%g1 ! OPENSSL_sparcv9cap_P[0]
1172 and %g1,(SPARCV9_VIS3|SPARCV9_64BIT_STACK),%g1
1173 cmp %g1,(SPARCV9_VIS3|SPARCV9_64BIT_STACK)
1174 be ecp_nistz256_point_add_affine_vis3
1177 save %sp,-STACK_FRAME-32*10-32,%sp
1179 stx $rp,[%fp+STACK_BIAS-8] ! off-load $rp
1183 ld [$ap],@acc[0] ! in1_x
1191 ld [$ap+32],$t0 ! in1_y
1199 or @acc[1],@acc[0],@acc[0]
1200 or @acc[3],@acc[2],@acc[2]
1201 or @acc[5],@acc[4],@acc[4]
1202 or @acc[7],@acc[6],@acc[6]
1203 or @acc[2],@acc[0],@acc[0]
1204 or @acc[6],@acc[4],@acc[4]
1205 or @acc[4],@acc[0],@acc[0]
1213 or @acc[0],$t0,$t0 ! !in1infty
1215 st $t0,[%fp+STACK_BIAS-16]
1217 ld [$bp],@acc[0] ! in2_x
1225 ld [$bp+32],$t0 ! in2_y
1233 or @acc[1],@acc[0],@acc[0]
1234 or @acc[3],@acc[2],@acc[2]
1235 or @acc[5],@acc[4],@acc[4]
1236 or @acc[7],@acc[6],@acc[6]
1237 or @acc[2],@acc[0],@acc[0]
1238 or @acc[6],@acc[4],@acc[4]
1239 or @acc[4],@acc[0],@acc[0]
1247 or @acc[0],$t0,$t0 ! !in2infty
1249 st $t0,[%fp+STACK_BIAS-12]
1253 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Z1sqr, in1_z);
1254 add %sp,LOCALS+$Z1sqr,$rp
1257 add %sp,LOCALS+$Z1sqr,$ap
1258 call __ecp_nistz256_mul_mont ! p256_mul_mont(U2, Z1sqr, in2_x);
1259 add %sp,LOCALS+$U2,$rp
1262 call __ecp_nistz256_sub_from ! p256_sub(H, U2, in1_x);
1263 add %sp,LOCALS+$H,$rp
1266 add %sp,LOCALS+$Z1sqr,$ap
1267 call __ecp_nistz256_mul_mont ! p256_mul_mont(S2, Z1sqr, in1_z);
1268 add %sp,LOCALS+$S2,$rp
1271 add %sp,LOCALS+$H,$ap
1272 call __ecp_nistz256_mul_mont ! p256_mul_mont(res_z, H, in1_z);
1273 add %sp,LOCALS+$res_z,$rp
1276 add %sp,LOCALS+$S2,$ap
1277 call __ecp_nistz256_mul_mont ! p256_mul_mont(S2, S2, in2_y);
1278 add %sp,LOCALS+$S2,$rp
1281 call __ecp_nistz256_sub_from ! p256_sub(R, S2, in1_y);
1282 add %sp,LOCALS+$R,$rp
1284 add %sp,LOCALS+$H,$bp
1285 add %sp,LOCALS+$H,$ap
1286 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Hsqr, H);
1287 add %sp,LOCALS+$Hsqr,$rp
1289 add %sp,LOCALS+$R,$bp
1290 add %sp,LOCALS+$R,$ap
1291 call __ecp_nistz256_mul_mont ! p256_sqr_mont(Rsqr, R);
1292 add %sp,LOCALS+$Rsqr,$rp
1294 add %sp,LOCALS+$H,$bp
1295 add %sp,LOCALS+$Hsqr,$ap
1296 call __ecp_nistz256_mul_mont ! p256_mul_mont(Hcub, Hsqr, H);
1297 add %sp,LOCALS+$Hcub,$rp
1300 add %sp,LOCALS+$Hsqr,$ap
1301 call __ecp_nistz256_mul_mont ! p256_mul_mont(U2, in1_x, Hsqr);
1302 add %sp,LOCALS+$U2,$rp
1304 call __ecp_nistz256_mul_by_2 ! p256_mul_by_2(Hsqr, U2);
1305 add %sp,LOCALS+$Hsqr,$rp
1307 add %sp,LOCALS+$Rsqr,$bp
1308 call __ecp_nistz256_sub_morf ! p256_sub(res_x, Rsqr, Hsqr);
1309 add %sp,LOCALS+$res_x,$rp
1311 add %sp,LOCALS+$Hcub,$bp
1312 call __ecp_nistz256_sub_from ! p256_sub(res_x, res_x, Hcub);
1313 add %sp,LOCALS+$res_x,$rp
1315 add %sp,LOCALS+$U2,$bp
1316 call __ecp_nistz256_sub_morf ! p256_sub(res_y, U2, res_x);
1317 add %sp,LOCALS+$res_y,$rp
1320 add %sp,LOCALS+$Hcub,$ap
1321 call __ecp_nistz256_mul_mont ! p256_mul_mont(S2, in1_y, Hcub);
1322 add %sp,LOCALS+$S2,$rp
1324 add %sp,LOCALS+$R,$bp
1325 add %sp,LOCALS+$res_y,$ap
1326 call __ecp_nistz256_mul_mont ! p256_mul_mont(res_y, res_y, R);
1327 add %sp,LOCALS+$res_y,$rp
1329 add %sp,LOCALS+$S2,$bp
1330 call __ecp_nistz256_sub_from ! p256_sub(res_y, res_y, S2);
1331 add %sp,LOCALS+$res_y,$rp
1333 ld [%fp+STACK_BIAS-16],$t1 ! !in1infty
1334 ld [%fp+STACK_BIAS-12],$t2 ! !in2infty
1335 ldx [%fp+STACK_BIAS-8],$rp
1337 for($i=0;$i<64;$i+=8) { # conditional moves
1339 ld [%sp+LOCALS+$i],@acc[0] ! res
1340 ld [%sp+LOCALS+$i+4],@acc[1]
1341 ld [$bp_real+$i],@acc[2] ! in2
1342 ld [$bp_real+$i+4],@acc[3]
1343 ld [$ap_real+$i],@acc[4] ! in1
1344 ld [$ap_real+$i+4],@acc[5]
1345 movrz $t1,@acc[2],@acc[0]
1346 movrz $t1,@acc[3],@acc[1]
1347 movrz $t2,@acc[4],@acc[0]
1348 movrz $t2,@acc[5],@acc[1]
1350 st @acc[1],[$rp+$i+4]
1356 ld [%sp+LOCALS+$i],@acc[0] ! res
1357 ld [%sp+LOCALS+$i+4],@acc[1]
1358 ld [$ap_real+$i],@acc[4] ! in1
1359 ld [$ap_real+$i+4],@acc[5]
1360 movrz $t1,@ONE_mont[$j],@acc[0]
1361 movrz $t1,@ONE_mont[$j+1],@acc[1]
1362 movrz $t2,@acc[4],@acc[0]
1363 movrz $t2,@acc[5],@acc[1]
1365 st @acc[1],[$rp+$i+4]
1371 .type ecp_nistz256_point_add_affine,#function
1372 .size ecp_nistz256_point_add_affine,.-ecp_nistz256_point_add_affine
1376 my ($out,$inp,$index)=map("%i$_",(0..2));
1380 ! void ecp_nistz256_scatter_w5(void *%i0,const P256_POINT *%i1,
1382 .globl ecp_nistz256_scatter_w5
1384 ecp_nistz256_scatter_w5:
1385 save %sp,-STACK_FRAME,%sp
1388 add $out,$index,$out
1399 st %l0,[$out+64*0-4]
1400 st %l1,[$out+64*1-4]
1401 st %l2,[$out+64*2-4]
1402 st %l3,[$out+64*3-4]
1403 st %l4,[$out+64*4-4]
1404 st %l5,[$out+64*5-4]
1405 st %l6,[$out+64*6-4]
1406 st %l7,[$out+64*7-4]
1418 st %l0,[$out+64*0-4]
1419 st %l1,[$out+64*1-4]
1420 st %l2,[$out+64*2-4]
1421 st %l3,[$out+64*3-4]
1422 st %l4,[$out+64*4-4]
1423 st %l5,[$out+64*5-4]
1424 st %l6,[$out+64*6-4]
1425 st %l7,[$out+64*7-4]
1436 st %l0,[$out+64*0-4]
1437 st %l1,[$out+64*1-4]
1438 st %l2,[$out+64*2-4]
1439 st %l3,[$out+64*3-4]
1440 st %l4,[$out+64*4-4]
1441 st %l5,[$out+64*5-4]
1442 st %l6,[$out+64*6-4]
1443 st %l7,[$out+64*7-4]
1447 .type ecp_nistz256_scatter_w5,#function
1448 .size ecp_nistz256_scatter_w5,.-ecp_nistz256_scatter_w5
1450 ! void ecp_nistz256_gather_w5(P256_POINT *%i0,const void *%i1,
1452 .globl ecp_nistz256_gather_w5
1454 ecp_nistz256_gather_w5:
1455 save %sp,-STACK_FRAME,%sp
1460 add $index,$mask,$index
1462 add $inp,$index,$inp
1545 .type ecp_nistz256_gather_w5,#function
1546 .size ecp_nistz256_gather_w5,.-ecp_nistz256_gather_w5
1548 ! void ecp_nistz256_scatter_w7(void *%i0,const P256_POINT_AFFINE *%i1,
1550 .globl ecp_nistz256_scatter_w7
1552 ecp_nistz256_scatter_w7:
1553 save %sp,-STACK_FRAME,%sp
1555 add $out,$index,$out
1560 subcc $index,1,$index
1561 stb %l0,[$out+64*0-1]
1563 stb %l1,[$out+64*1-1]
1565 stb %l2,[$out+64*2-1]
1567 stb %l3,[$out+64*3-1]
1568 bne .Loop_scatter_w7
1573 .type ecp_nistz256_scatter_w7,#function
1574 .size ecp_nistz256_scatter_w7,.-ecp_nistz256_scatter_w7
1576 ! void ecp_nistz256_gather_w7(P256_POINT_AFFINE *%i0,const void *%i1,
1578 .globl ecp_nistz256_gather_w7
1580 ecp_nistz256_gather_w7:
1581 save %sp,-STACK_FRAME,%sp
1586 add $index,$mask,$index
1587 add $inp,$index,$inp
1591 ldub [$inp+64*0],%l0
1592 prefetch [$inp+3840+64*0],1
1593 subcc $index,1,$index
1594 ldub [$inp+64*1],%l1
1595 prefetch [$inp+3840+64*1],1
1596 ldub [$inp+64*2],%l2
1597 prefetch [$inp+3840+64*2],1
1598 ldub [$inp+64*3],%l3
1599 prefetch [$inp+3840+64*3],1
1614 .type ecp_nistz256_gather_w7,#function
1615 .size ecp_nistz256_gather_w7,.-ecp_nistz256_gather_w7
1619 ########################################################################
1620 # Following subroutines are VIS3 counterparts of those above that
1621 # implement ones found in ecp_nistz256.c. Key difference is that they
1622 # use 128-bit muliplication and addition with 64-bit carry, and in order
1623 # to do that they perform conversion from uin32_t[8] to uint64_t[4] upon
1624 # entry and vice versa on return.
1626 my ($rp,$ap,$bp)=map("%i$_",(0..2));
1627 my ($t0,$t1,$t2,$t3,$a0,$a1,$a2,$a3)=map("%l$_",(0..7));
1628 my ($acc0,$acc1,$acc2,$acc3,$acc4,$acc5)=map("%o$_",(0..5));
1629 my ($bi,$poly1,$poly3,$minus1)=(map("%i$_",(3..5)),"%g1");
1630 my ($rp_real,$ap_real)=("%g2","%g3");
1631 my ($acc6,$acc7)=($bp,$bi); # used in squaring
1635 __ecp_nistz256_mul_by_2_vis3:
1636 addcc $acc0,$acc0,$acc0
1637 addxccc $acc1,$acc1,$acc1
1638 addxccc $acc2,$acc2,$acc2
1639 addxccc $acc3,$acc3,$acc3
1640 b .Lreduce_by_sub_vis3
1641 addxc %g0,%g0,$acc4 ! did it carry?
1642 .type __ecp_nistz256_mul_by_2_vis3,#function
1643 .size __ecp_nistz256_mul_by_2_vis3,.-__ecp_nistz256_mul_by_2_vis3
1646 __ecp_nistz256_add_vis3:
1652 __ecp_nistz256_add_noload_vis3:
1654 addcc $t0,$acc0,$acc0
1655 addxccc $t1,$acc1,$acc1
1656 addxccc $t2,$acc2,$acc2
1657 addxccc $t3,$acc3,$acc3
1658 addxc %g0,%g0,$acc4 ! did it carry?
1660 .Lreduce_by_sub_vis3:
1662 addcc $acc0,1,$t0 ! add -modulus, i.e. subtract
1663 addxccc $acc1,$poly1,$t1
1664 addxccc $acc2,$minus1,$t2
1665 addxc $acc3,$poly3,$t3
1667 movrnz $acc4,$t0,$acc0 ! if a+b carried, ret = ret-mod
1668 movrnz $acc4,$t1,$acc1
1670 movrnz $acc4,$t2,$acc2
1672 movrnz $acc4,$t3,$acc3
1676 .type __ecp_nistz256_add_vis3,#function
1677 .size __ecp_nistz256_add_vis3,.-__ecp_nistz256_add_vis3
1679 ! Trouble with subtraction is that there is no subtraction with 64-bit
1680 ! borrow, only with 32-bit one. For this reason we "decompose" 64-bit
1681 ! $acc0-$acc3 to 32-bit values and pick b[4] in 32-bit pieces. But
1682 ! recall that SPARC is big-endian, which is why you'll observe that
1683 ! b[4] is accessed as 4-0-12-8-20-16-28-24. And prior reduction we
1684 ! "collect" result back to 64-bit $acc0-$acc3.
1686 __ecp_nistz256_sub_from_vis3:
1695 subcc $acc0,$t0,$acc0
1697 subccc $acc4,$t1,$acc4
1699 subccc $acc1,$t2,$acc1
1701 and $acc0,$poly1,$acc0
1702 subccc $acc5,$t3,$acc5
1705 and $acc1,$poly1,$acc1
1707 or $acc0,$acc4,$acc0
1709 or $acc1,$acc5,$acc1
1711 subccc $acc2,$t0,$acc2
1712 subccc $acc4,$t1,$acc4
1713 subccc $acc3,$t2,$acc3
1714 and $acc2,$poly1,$acc2
1715 subccc $acc5,$t3,$acc5
1717 and $acc3,$poly1,$acc3
1719 or $acc2,$acc4,$acc2
1720 subc %g0,%g0,$acc4 ! did it borrow?
1721 b .Lreduce_by_add_vis3
1722 or $acc3,$acc5,$acc3
1723 .type __ecp_nistz256_sub_from_vis3,#function
1724 .size __ecp_nistz256_sub_from_vis3,.-__ecp_nistz256_sub_from_vis3
1727 __ecp_nistz256_sub_morf_vis3:
1736 subcc $t0,$acc0,$acc0
1738 subccc $t1,$acc4,$acc4
1740 subccc $t2,$acc1,$acc1
1742 and $acc0,$poly1,$acc0
1743 subccc $t3,$acc5,$acc5
1746 and $acc1,$poly1,$acc1
1748 or $acc0,$acc4,$acc0
1750 or $acc1,$acc5,$acc1
1752 subccc $t0,$acc2,$acc2
1753 subccc $t1,$acc4,$acc4
1754 subccc $t2,$acc3,$acc3
1755 and $acc2,$poly1,$acc2
1756 subccc $t3,$acc5,$acc5
1758 and $acc3,$poly1,$acc3
1760 or $acc2,$acc4,$acc2
1761 subc %g0,%g0,$acc4 ! did it borrow?
1762 or $acc3,$acc5,$acc3
1764 .Lreduce_by_add_vis3:
1766 addcc $acc0,-1,$t0 ! add modulus
1768 addxccc $acc1,$poly1,$t1
1769 not $poly1,$poly1 ! restore $poly1
1770 addxccc $acc2,%g0,$t2
1773 movrnz $acc4,$t0,$acc0 ! if a-b borrowed, ret = ret+mod
1774 movrnz $acc4,$t1,$acc1
1776 movrnz $acc4,$t2,$acc2
1778 movrnz $acc4,$t3,$acc3
1782 .type __ecp_nistz256_sub_morf_vis3,#function
1783 .size __ecp_nistz256_sub_morf_vis3,.-__ecp_nistz256_sub_morf_vis3
1786 __ecp_nistz256_div_by_2_vis3:
1787 ! ret = (a is odd ? a+mod : a) >> 1
1792 addcc $acc0,-1,$t0 ! add modulus
1793 addxccc $acc1,$t1,$t1
1794 addxccc $acc2,%g0,$t2
1795 addxccc $acc3,$t3,$t3
1796 addxc %g0,%g0,$acc4 ! carry bit
1798 movrnz $acc5,$t0,$acc0
1799 movrnz $acc5,$t1,$acc1
1800 movrnz $acc5,$t2,$acc2
1801 movrnz $acc5,$t3,$acc3
1802 movrz $acc5,%g0,$acc4
1817 sllx $acc4,63,$t3 ! don't forget carry bit
1823 .type __ecp_nistz256_div_by_2_vis3,#function
1824 .size __ecp_nistz256_div_by_2_vis3,.-__ecp_nistz256_div_by_2_vis3
1826 ! compared to __ecp_nistz256_mul_mont it's almost 4x smaller and
1827 ! 4x faster [on T4]...
1829 __ecp_nistz256_mul_mont_vis3:
1831 not $poly3,$poly3 ! 0xFFFFFFFF00000001
1839 ldx [$bp+8],$bi ! b[1]
1841 addcc $acc1,$t0,$acc1 ! accumulate high parts of multiplication
1843 addxccc $acc2,$t1,$acc2
1845 addxccc $acc3,$t2,$acc3
1849 for($i=1;$i<4;$i++) {
1850 # Reduction iteration is normally performed by accumulating
1851 # result of multiplication of modulus by "magic" digit [and
1852 # omitting least significant word, which is guaranteed to
1853 # be 0], but thanks to special form of modulus and "magic"
1854 # digit being equal to least significant word, it can be
1855 # performed with additions and subtractions alone. Indeed:
1857 # ffff0001.00000000.0000ffff.ffffffff
1859 # + xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx.abcdefgh
1861 # Now observing that ff..ff*x = (2^n-1)*x = 2^n*x-x, we
1864 # xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx.abcdefgh
1865 # + abcdefgh.abcdefgh.0000abcd.efgh0000.00000000
1866 # - 0000abcd.efgh0000.00000000.00000000.abcdefgh
1868 # or marking redundant operations:
1870 # xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx.--------
1871 # + abcdefgh.abcdefgh.0000abcd.efgh0000.--------
1872 # - 0000abcd.efgh0000.--------.--------.--------
1873 # ^^^^^^^^ but this word is calculated with umulxhi, because
1874 # there is no subtract with 64-bit borrow:-(
1877 sub $acc0,$t0,$t2 ! acc0*0xFFFFFFFF00000001, low part
1878 umulxhi $acc0,$poly3,$t3 ! acc0*0xFFFFFFFF00000001, high part
1879 addcc $acc1,$t0,$acc0 ! +=acc[0]<<96 and omit acc[0]
1881 addxccc $acc2,$t1,$acc1
1883 addxccc $acc3,$t2,$acc2 ! +=acc[0]*0xFFFFFFFF00000001
1885 addxccc $acc4,$t3,$acc3
1887 addxc $acc5,%g0,$acc4
1889 addcc $acc0,$t0,$acc0 ! accumulate low parts of multiplication
1891 addxccc $acc1,$t1,$acc1
1893 addxccc $acc2,$t2,$acc2
1895 addxccc $acc3,$t3,$acc3
1897 addxc $acc4,%g0,$acc4
1899 $code.=<<___ if ($i<3);
1900 ldx [$bp+8*($i+1)],$bi ! bp[$i+1]
1903 addcc $acc1,$t0,$acc1 ! accumulate high parts of multiplication
1905 addxccc $acc2,$t1,$acc2
1907 addxccc $acc3,$t2,$acc3
1908 addxccc $acc4,$t3,$acc4
1913 sub $acc0,$t0,$t2 ! acc0*0xFFFFFFFF00000001, low part
1914 umulxhi $acc0,$poly3,$t3 ! acc0*0xFFFFFFFF00000001, high part
1915 addcc $acc1,$t0,$acc0 ! +=acc[0]<<96 and omit acc[0]
1916 addxccc $acc2,$t1,$acc1
1917 addxccc $acc3,$t2,$acc2 ! +=acc[0]*0xFFFFFFFF00000001
1918 addxccc $acc4,$t3,$acc3
1919 b .Lmul_final_vis3 ! see below
1920 addxc $acc5,%g0,$acc4
1921 .type __ecp_nistz256_mul_mont_vis3,#function
1922 .size __ecp_nistz256_mul_mont_vis3,.-__ecp_nistz256_mul_mont_vis3
1924 ! compared to above __ecp_nistz256_mul_mont_vis3 it's 21% less
1925 ! instructions, but only 14% faster [on T4]...
1927 __ecp_nistz256_sqr_mont_vis3:
1928 ! | | | | | |a1*a0| |
1929 ! | | | | |a2*a0| | |
1930 ! | |a3*a2|a3*a0| | | |
1931 ! | | | |a2*a1| | | |
1932 ! | | |a3*a1| | | | |
1933 ! *| | | | | | | | 2|
1934 ! +|a3*a3|a2*a2|a1*a1|a0*a0|
1935 ! |--+--+--+--+--+--+--+--|
1936 ! |A7|A6|A5|A4|A3|A2|A1|A0|, where Ax is $accx, i.e. follow $accx
1938 ! "can't overflow" below mark carrying into high part of
1939 ! multiplication result, which can't overflow, because it
1940 ! can never be all ones.
1942 mulx $a1,$a0,$acc1 ! a[1]*a[0]
1944 mulx $a2,$a0,$acc2 ! a[2]*a[0]
1946 mulx $a3,$a0,$acc3 ! a[3]*a[0]
1947 umulxhi $a3,$a0,$acc4
1949 addcc $acc2,$t1,$acc2 ! accumulate high parts of multiplication
1950 mulx $a2,$a1,$t0 ! a[2]*a[1]
1952 addxccc $acc3,$t2,$acc3
1953 mulx $a3,$a1,$t2 ! a[3]*a[1]
1955 addxc $acc4,%g0,$acc4 ! can't overflow
1957 mulx $a3,$a2,$acc5 ! a[3]*a[2]
1958 not $poly3,$poly3 ! 0xFFFFFFFF00000001
1959 umulxhi $a3,$a2,$acc6
1961 addcc $t2,$t1,$t1 ! accumulate high parts of multiplication
1962 mulx $a0,$a0,$acc0 ! a[0]*a[0]
1963 addxc $t3,%g0,$t2 ! can't overflow
1965 addcc $acc3,$t0,$acc3 ! accumulate low parts of multiplication
1967 addxccc $acc4,$t1,$acc4
1968 mulx $a1,$a1,$t1 ! a[1]*a[1]
1969 addxccc $acc5,$t2,$acc5
1971 addxc $acc6,%g0,$acc6 ! can't overflow
1973 addcc $acc1,$acc1,$acc1 ! acc[1-6]*=2
1974 mulx $a2,$a2,$t2 ! a[2]*a[2]
1975 addxccc $acc2,$acc2,$acc2
1977 addxccc $acc3,$acc3,$acc3
1978 mulx $a3,$a3,$t3 ! a[3]*a[3]
1979 addxccc $acc4,$acc4,$acc4
1981 addxccc $acc5,$acc5,$acc5
1982 addxccc $acc6,$acc6,$acc6
1985 addcc $acc1,$a0,$acc1 ! +a[i]*a[i]
1986 addxccc $acc2,$t1,$acc2
1987 addxccc $acc3,$a1,$acc3
1988 addxccc $acc4,$t2,$acc4
1990 addxccc $acc5,$a2,$acc5
1992 addxccc $acc6,$t3,$acc6
1993 sub $acc0,$t0,$t2 ! acc0*0xFFFFFFFF00000001, low part
1994 addxc $acc7,$a3,$acc7
1996 for($i=0;$i<3;$i++) { # reductions, see commentary
1997 # in multiplication for details
1999 umulxhi $acc0,$poly3,$t3 ! acc0*0xFFFFFFFF00000001, high part
2000 addcc $acc1,$t0,$acc0 ! +=acc[0]<<96 and omit acc[0]
2002 addxccc $acc2,$t1,$acc1
2004 addxccc $acc3,$t2,$acc2 ! +=acc[0]*0xFFFFFFFF00000001
2005 sub $acc0,$t0,$t2 ! acc0*0xFFFFFFFF00000001, low part
2006 addxc %g0,$t3,$acc3 ! cant't overflow
2010 umulxhi $acc0,$poly3,$t3 ! acc0*0xFFFFFFFF00000001, high part
2011 addcc $acc1,$t0,$acc0 ! +=acc[0]<<96 and omit acc[0]
2012 addxccc $acc2,$t1,$acc1
2013 addxccc $acc3,$t2,$acc2 ! +=acc[0]*0xFFFFFFFF00000001
2014 addxc %g0,$t3,$acc3 ! can't overflow
2016 addcc $acc0,$acc4,$acc0 ! accumulate upper half
2017 addxccc $acc1,$acc5,$acc1
2018 addxccc $acc2,$acc6,$acc2
2019 addxccc $acc3,$acc7,$acc3
2024 ! Final step is "if result > mod, subtract mod", but as comparison
2025 ! means subtraction, we do the subtraction and then copy outcome
2026 ! if it didn't borrow. But note that as we [have to] replace
2027 ! subtraction with addition with negative, carry/borrow logic is
2030 addcc $acc0,1,$t0 ! add -modulus, i.e. subtract
2031 not $poly3,$poly3 ! restore 0x00000000FFFFFFFE
2032 addxccc $acc1,$poly1,$t1
2033 addxccc $acc2,$minus1,$t2
2034 addxccc $acc3,$poly3,$t3
2035 addxccc $acc4,$minus1,%g0 ! did it carry?
2037 movcs %xcc,$t0,$acc0
2038 movcs %xcc,$t1,$acc1
2040 movcs %xcc,$t2,$acc2
2042 movcs %xcc,$t3,$acc3
2046 .type __ecp_nistz256_sqr_mont_vis3,#function
2047 .size __ecp_nistz256_sqr_mont_vis3,.-__ecp_nistz256_sqr_mont_vis3
2050 ########################################################################
2051 # void ecp_nistz256_point_double(P256_POINT *out,const P256_POINT *inp);
2054 my ($res_x,$res_y,$res_z,
2056 $S,$M,$Zsqr,$tmp0)=map(32*$_,(0..9));
2057 # above map() describes stack layout with 10 temporary
2058 # 256-bit vectors on top.
2062 ecp_nistz256_point_double_vis3:
2063 save %sp,-STACK64_FRAME-32*10,%sp
2066 .Ldouble_shortcut_vis3:
2069 sllx $minus1,32,$poly1 ! 0xFFFFFFFF00000000
2070 srl $poly3,0,$poly3 ! 0x00000000FFFFFFFE
2072 ! convert input to uint64_t[4]
2083 ld [$ap+32],$acc0 ! in_y
2091 ld [$ap+32+16],$acc2
2095 ld [$ap+32+24],$acc3
2099 stx $a0,[%sp+LOCALS64+$in_x]
2101 stx $a1,[%sp+LOCALS64+$in_x+8]
2103 stx $a2,[%sp+LOCALS64+$in_x+16]
2105 stx $a3,[%sp+LOCALS64+$in_x+24]
2107 stx $acc0,[%sp+LOCALS64+$in_y]
2109 stx $acc1,[%sp+LOCALS64+$in_y+8]
2111 stx $acc2,[%sp+LOCALS64+$in_y+16]
2112 stx $acc3,[%sp+LOCALS64+$in_y+24]
2114 ld [$ap+64],$a0 ! in_z
2132 stx $a0,[%sp+LOCALS64+$in_z]
2134 stx $a1,[%sp+LOCALS64+$in_z+8]
2136 stx $a2,[%sp+LOCALS64+$in_z+16]
2137 stx $a3,[%sp+LOCALS64+$in_z+24]
2139 ! in_y is still in $acc0-$acc3
2140 call __ecp_nistz256_mul_by_2_vis3 ! p256_mul_by_2(S, in_y);
2141 add %sp,LOCALS64+$S,$rp
2143 ! in_z is still in $a0-$a3
2144 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Zsqr, in_z);
2145 add %sp,LOCALS64+$Zsqr,$rp
2147 mov $acc0,$a0 ! put Zsqr aside
2152 add %sp,LOCALS64+$in_x,$bp
2153 call __ecp_nistz256_add_vis3 ! p256_add(M, Zsqr, in_x);
2154 add %sp,LOCALS64+$M,$rp
2156 mov $a0,$acc0 ! restore Zsqr
2157 ldx [%sp+LOCALS64+$S],$a0 ! forward load
2159 ldx [%sp+LOCALS64+$S+8],$a1
2161 ldx [%sp+LOCALS64+$S+16],$a2
2163 ldx [%sp+LOCALS64+$S+24],$a3
2165 add %sp,LOCALS64+$in_x,$bp
2166 call __ecp_nistz256_sub_morf_vis3 ! p256_sub(Zsqr, in_x, Zsqr);
2167 add %sp,LOCALS64+$Zsqr,$rp
2169 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(S, S);
2170 add %sp,LOCALS64+$S,$rp
2172 ldx [%sp+LOCALS64+$in_z],$bi
2173 ldx [%sp+LOCALS64+$in_y],$a0
2174 ldx [%sp+LOCALS64+$in_y+8],$a1
2175 ldx [%sp+LOCALS64+$in_y+16],$a2
2176 ldx [%sp+LOCALS64+$in_y+24],$a3
2177 add %sp,LOCALS64+$in_z,$bp
2178 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(tmp0, in_z, in_y);
2179 add %sp,LOCALS64+$tmp0,$rp
2181 ldx [%sp+LOCALS64+$M],$bi ! forward load
2182 ldx [%sp+LOCALS64+$Zsqr],$a0
2183 ldx [%sp+LOCALS64+$Zsqr+8],$a1
2184 ldx [%sp+LOCALS64+$Zsqr+16],$a2
2185 ldx [%sp+LOCALS64+$Zsqr+24],$a3
2187 call __ecp_nistz256_mul_by_2_vis3 ! p256_mul_by_2(res_z, tmp0);
2188 add %sp,LOCALS64+$res_z,$rp
2190 add %sp,LOCALS64+$M,$bp
2191 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(M, M, Zsqr);
2192 add %sp,LOCALS64+$M,$rp
2194 mov $acc0,$a0 ! put aside M
2198 call __ecp_nistz256_mul_by_2_vis3
2199 add %sp,LOCALS64+$M,$rp
2200 mov $a0,$t0 ! copy M
2201 ldx [%sp+LOCALS64+$S],$a0 ! forward load
2203 ldx [%sp+LOCALS64+$S+8],$a1
2205 ldx [%sp+LOCALS64+$S+16],$a2
2207 ldx [%sp+LOCALS64+$S+24],$a3
2208 call __ecp_nistz256_add_noload_vis3 ! p256_mul_by_3(M, M);
2209 add %sp,LOCALS64+$M,$rp
2211 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(tmp0, S);
2212 add %sp,LOCALS64+$tmp0,$rp
2214 ldx [%sp+LOCALS64+$S],$bi ! forward load
2215 ldx [%sp+LOCALS64+$in_x],$a0
2216 ldx [%sp+LOCALS64+$in_x+8],$a1
2217 ldx [%sp+LOCALS64+$in_x+16],$a2
2218 ldx [%sp+LOCALS64+$in_x+24],$a3
2220 call __ecp_nistz256_div_by_2_vis3 ! p256_div_by_2(res_y, tmp0);
2221 add %sp,LOCALS64+$res_y,$rp
2223 add %sp,LOCALS64+$S,$bp
2224 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S, S, in_x);
2225 add %sp,LOCALS64+$S,$rp
2227 ldx [%sp+LOCALS64+$M],$a0 ! forward load
2228 ldx [%sp+LOCALS64+$M+8],$a1
2229 ldx [%sp+LOCALS64+$M+16],$a2
2230 ldx [%sp+LOCALS64+$M+24],$a3
2232 call __ecp_nistz256_mul_by_2_vis3 ! p256_mul_by_2(tmp0, S);
2233 add %sp,LOCALS64+$tmp0,$rp
2235 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(res_x, M);
2236 add %sp,LOCALS64+$res_x,$rp
2238 add %sp,LOCALS64+$tmp0,$bp
2239 call __ecp_nistz256_sub_from_vis3 ! p256_sub(res_x, res_x, tmp0);
2240 add %sp,LOCALS64+$res_x,$rp
2242 ldx [%sp+LOCALS64+$M],$a0 ! forward load
2243 ldx [%sp+LOCALS64+$M+8],$a1
2244 ldx [%sp+LOCALS64+$M+16],$a2
2245 ldx [%sp+LOCALS64+$M+24],$a3
2247 add %sp,LOCALS64+$S,$bp
2248 call __ecp_nistz256_sub_morf_vis3 ! p256_sub(S, S, res_x);
2249 add %sp,LOCALS64+$S,$rp
2252 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S, S, M);
2253 add %sp,LOCALS64+$S,$rp
2255 ldx [%sp+LOCALS64+$res_x],$a0 ! forward load
2256 ldx [%sp+LOCALS64+$res_x+8],$a1
2257 ldx [%sp+LOCALS64+$res_x+16],$a2
2258 ldx [%sp+LOCALS64+$res_x+24],$a3
2260 add %sp,LOCALS64+$res_y,$bp
2261 call __ecp_nistz256_sub_from_vis3 ! p256_sub(res_y, S, res_y);
2262 add %sp,LOCALS64+$res_y,$bp
2264 ! convert output to uint_32[8]
2267 st $a0,[$rp_real] ! res_x
2272 st $t1,[$rp_real+12]
2273 st $a2,[$rp_real+16]
2274 st $t2,[$rp_real+20]
2275 st $a3,[$rp_real+24]
2276 st $t3,[$rp_real+28]
2278 ldx [%sp+LOCALS64+$res_z],$a0 ! forward load
2280 ldx [%sp+LOCALS64+$res_z+8],$a1
2282 ldx [%sp+LOCALS64+$res_z+16],$a2
2284 ldx [%sp+LOCALS64+$res_z+24],$a3
2286 st $acc0,[$rp_real+32] ! res_y
2287 st $t0, [$rp_real+32+4]
2288 st $acc1,[$rp_real+32+8]
2289 st $t1, [$rp_real+32+12]
2290 st $acc2,[$rp_real+32+16]
2291 st $t2, [$rp_real+32+20]
2292 st $acc3,[$rp_real+32+24]
2293 st $t3, [$rp_real+32+28]
2297 st $a0,[$rp_real+64] ! res_z
2299 st $t0,[$rp_real+64+4]
2301 st $a1,[$rp_real+64+8]
2302 st $t1,[$rp_real+64+12]
2303 st $a2,[$rp_real+64+16]
2304 st $t2,[$rp_real+64+20]
2305 st $a3,[$rp_real+64+24]
2306 st $t3,[$rp_real+64+28]
2310 .type ecp_nistz256_point_double_vis3,#function
2311 .size ecp_nistz256_point_double_vis3,.-ecp_nistz256_point_double_vis3
2314 ########################################################################
2315 # void ecp_nistz256_point_add(P256_POINT *out,const P256_POINT *in1,
2316 # const P256_POINT *in2);
2318 my ($res_x,$res_y,$res_z,
2319 $in1_x,$in1_y,$in1_z,
2320 $in2_x,$in2_y,$in2_z,
2321 $H,$Hsqr,$R,$Rsqr,$Hcub,
2322 $U1,$U2,$S1,$S2)=map(32*$_,(0..17));
2323 my ($Z1sqr, $Z2sqr) = ($Hsqr, $Rsqr);
2325 # above map() describes stack layout with 18 temporary
2326 # 256-bit vectors on top. Then we reserve some space for
2327 # !in1infty, !in2infty and result of check for zero.
2330 .globl ecp_nistz256_point_add_vis3
2332 ecp_nistz256_point_add_vis3:
2333 save %sp,-STACK64_FRAME-32*18-32,%sp
2338 sllx $minus1,32,$poly1 ! 0xFFFFFFFF00000000
2339 srl $poly3,0,$poly3 ! 0x00000000FFFFFFFE
2341 ! convert input to uint64_t[4]
2342 ld [$bp],$a0 ! in2_x
2352 ld [$bp+32],$acc0 ! in2_y
2360 ld [$bp+32+16],$acc2
2364 ld [$bp+32+24],$acc3
2368 stx $a0,[%sp+LOCALS64+$in2_x]
2370 stx $a1,[%sp+LOCALS64+$in2_x+8]
2372 stx $a2,[%sp+LOCALS64+$in2_x+16]
2374 stx $a3,[%sp+LOCALS64+$in2_x+24]
2376 stx $acc0,[%sp+LOCALS64+$in2_y]
2378 stx $acc1,[%sp+LOCALS64+$in2_y+8]
2380 stx $acc2,[%sp+LOCALS64+$in2_y+16]
2381 stx $acc3,[%sp+LOCALS64+$in2_y+24]
2385 or $acc1,$acc0,$acc0
2386 or $acc3,$acc2,$acc2
2388 or $acc2,$acc0,$acc0
2390 movrnz $a0,-1,$a0 ! !in2infty
2391 stx $a0,[%fp+STACK_BIAS-8]
2393 ld [$bp+64],$acc0 ! in2_z
2397 ld [$bp+64+16],$acc2
2399 ld [$bp+64+24],$acc3
2403 ld [$ap],$a0 ! in1_x
2419 stx $acc0,[%sp+LOCALS64+$in2_z]
2421 stx $acc1,[%sp+LOCALS64+$in2_z+8]
2423 stx $acc2,[%sp+LOCALS64+$in2_z+16]
2424 stx $acc3,[%sp+LOCALS64+$in2_z+24]
2427 ld [$ap+32],$acc0 ! in1_y
2434 ld [$ap+32+16],$acc2
2436 ld [$ap+32+24],$acc3
2440 stx $a0,[%sp+LOCALS64+$in1_x]
2442 stx $a1,[%sp+LOCALS64+$in1_x+8]
2444 stx $a2,[%sp+LOCALS64+$in1_x+16]
2446 stx $a3,[%sp+LOCALS64+$in1_x+24]
2448 stx $acc0,[%sp+LOCALS64+$in1_y]
2450 stx $acc1,[%sp+LOCALS64+$in1_y+8]
2452 stx $acc2,[%sp+LOCALS64+$in1_y+16]
2453 stx $acc3,[%sp+LOCALS64+$in1_y+24]
2457 or $acc1,$acc0,$acc0
2458 or $acc3,$acc2,$acc2
2460 or $acc2,$acc0,$acc0
2462 movrnz $a0,-1,$a0 ! !in1infty
2463 stx $a0,[%fp+STACK_BIAS-16]
2465 ldx [%sp+LOCALS64+$in2_z],$a0 ! forward load
2466 ldx [%sp+LOCALS64+$in2_z+8],$a1
2467 ldx [%sp+LOCALS64+$in2_z+16],$a2
2468 ldx [%sp+LOCALS64+$in2_z+24],$a3
2470 ld [$ap+64],$acc0 ! in1_z
2474 ld [$ap+64+16],$acc2
2476 ld [$ap+64+24],$acc3
2484 stx $acc0,[%sp+LOCALS64+$in1_z]
2486 stx $acc1,[%sp+LOCALS64+$in1_z+8]
2488 stx $acc2,[%sp+LOCALS64+$in1_z+16]
2489 stx $acc3,[%sp+LOCALS64+$in1_z+24]
2491 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Z2sqr, in2_z);
2492 add %sp,LOCALS64+$Z2sqr,$rp
2494 ldx [%sp+LOCALS64+$in1_z],$a0
2495 ldx [%sp+LOCALS64+$in1_z+8],$a1
2496 ldx [%sp+LOCALS64+$in1_z+16],$a2
2497 ldx [%sp+LOCALS64+$in1_z+24],$a3
2498 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Z1sqr, in1_z);
2499 add %sp,LOCALS64+$Z1sqr,$rp
2501 ldx [%sp+LOCALS64+$Z2sqr],$bi
2502 ldx [%sp+LOCALS64+$in2_z],$a0
2503 ldx [%sp+LOCALS64+$in2_z+8],$a1
2504 ldx [%sp+LOCALS64+$in2_z+16],$a2
2505 ldx [%sp+LOCALS64+$in2_z+24],$a3
2506 add %sp,LOCALS64+$Z2sqr,$bp
2507 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S1, Z2sqr, in2_z);
2508 add %sp,LOCALS64+$S1,$rp
2510 ldx [%sp+LOCALS64+$Z1sqr],$bi
2511 ldx [%sp+LOCALS64+$in1_z],$a0
2512 ldx [%sp+LOCALS64+$in1_z+8],$a1
2513 ldx [%sp+LOCALS64+$in1_z+16],$a2
2514 ldx [%sp+LOCALS64+$in1_z+24],$a3
2515 add %sp,LOCALS64+$Z1sqr,$bp
2516 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S2, Z1sqr, in1_z);
2517 add %sp,LOCALS64+$S2,$rp
2519 ldx [%sp+LOCALS64+$S1],$bi
2520 ldx [%sp+LOCALS64+$in1_y],$a0
2521 ldx [%sp+LOCALS64+$in1_y+8],$a1
2522 ldx [%sp+LOCALS64+$in1_y+16],$a2
2523 ldx [%sp+LOCALS64+$in1_y+24],$a3
2524 add %sp,LOCALS64+$S1,$bp
2525 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S1, S1, in1_y);
2526 add %sp,LOCALS64+$S1,$rp
2528 ldx [%sp+LOCALS64+$S2],$bi
2529 ldx [%sp+LOCALS64+$in2_y],$a0
2530 ldx [%sp+LOCALS64+$in2_y+8],$a1
2531 ldx [%sp+LOCALS64+$in2_y+16],$a2
2532 ldx [%sp+LOCALS64+$in2_y+24],$a3
2533 add %sp,LOCALS64+$S2,$bp
2534 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S2, S2, in2_y);
2535 add %sp,LOCALS64+$S2,$rp
2537 ldx [%sp+LOCALS64+$Z2sqr],$bi ! forward load
2538 ldx [%sp+LOCALS64+$in1_x],$a0
2539 ldx [%sp+LOCALS64+$in1_x+8],$a1
2540 ldx [%sp+LOCALS64+$in1_x+16],$a2
2541 ldx [%sp+LOCALS64+$in1_x+24],$a3
2543 add %sp,LOCALS64+$S1,$bp
2544 call __ecp_nistz256_sub_from_vis3 ! p256_sub(R, S2, S1);
2545 add %sp,LOCALS64+$R,$rp
2547 or $acc1,$acc0,$acc0 ! see if result is zero
2548 or $acc3,$acc2,$acc2
2549 or $acc2,$acc0,$acc0
2550 stx $acc0,[%fp+STACK_BIAS-24]
2552 add %sp,LOCALS64+$Z2sqr,$bp
2553 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(U1, in1_x, Z2sqr);
2554 add %sp,LOCALS64+$U1,$rp
2556 ldx [%sp+LOCALS64+$Z1sqr],$bi
2557 ldx [%sp+LOCALS64+$in2_x],$a0
2558 ldx [%sp+LOCALS64+$in2_x+8],$a1
2559 ldx [%sp+LOCALS64+$in2_x+16],$a2
2560 ldx [%sp+LOCALS64+$in2_x+24],$a3
2561 add %sp,LOCALS64+$Z1sqr,$bp
2562 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(U2, in2_x, Z1sqr);
2563 add %sp,LOCALS64+$U2,$rp
2565 ldx [%sp+LOCALS64+$R],$a0 ! forward load
2566 ldx [%sp+LOCALS64+$R+8],$a1
2567 ldx [%sp+LOCALS64+$R+16],$a2
2568 ldx [%sp+LOCALS64+$R+24],$a3
2570 add %sp,LOCALS64+$U1,$bp
2571 call __ecp_nistz256_sub_from_vis3 ! p256_sub(H, U2, U1);
2572 add %sp,LOCALS64+$H,$rp
2574 or $acc1,$acc0,$acc0 ! see if result is zero
2575 or $acc3,$acc2,$acc2
2576 orcc $acc2,$acc0,$acc0
2578 bne,pt %xcc,.Ladd_proceed_vis3 ! is_equal(U1,U2)?
2581 ldx [%fp+STACK_BIAS-8],$t0
2582 ldx [%fp+STACK_BIAS-16],$t1
2583 ldx [%fp+STACK_BIAS-24],$t2
2585 be,pt %xcc,.Ladd_proceed_vis3 ! (in1infty || in2infty)?
2588 be,a,pt %xcc,.Ldouble_shortcut_vis3 ! is_equal(S1,S2)?
2589 add %sp,32*(12-10)+32,%sp ! difference in frame sizes
2594 st %g0,[$rp_real+12]
2595 st %g0,[$rp_real+16]
2596 st %g0,[$rp_real+20]
2597 st %g0,[$rp_real+24]
2598 st %g0,[$rp_real+28]
2599 st %g0,[$rp_real+32]
2600 st %g0,[$rp_real+32+4]
2601 st %g0,[$rp_real+32+8]
2602 st %g0,[$rp_real+32+12]
2603 st %g0,[$rp_real+32+16]
2604 st %g0,[$rp_real+32+20]
2605 st %g0,[$rp_real+32+24]
2606 st %g0,[$rp_real+32+28]
2607 st %g0,[$rp_real+64]
2608 st %g0,[$rp_real+64+4]
2609 st %g0,[$rp_real+64+8]
2610 st %g0,[$rp_real+64+12]
2611 st %g0,[$rp_real+64+16]
2612 st %g0,[$rp_real+64+20]
2613 st %g0,[$rp_real+64+24]
2614 st %g0,[$rp_real+64+28]
2620 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Rsqr, R);
2621 add %sp,LOCALS64+$Rsqr,$rp
2623 ldx [%sp+LOCALS64+$H],$bi
2624 ldx [%sp+LOCALS64+$in1_z],$a0
2625 ldx [%sp+LOCALS64+$in1_z+8],$a1
2626 ldx [%sp+LOCALS64+$in1_z+16],$a2
2627 ldx [%sp+LOCALS64+$in1_z+24],$a3
2628 add %sp,LOCALS64+$H,$bp
2629 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(res_z, H, in1_z);
2630 add %sp,LOCALS64+$res_z,$rp
2632 ldx [%sp+LOCALS64+$H],$a0
2633 ldx [%sp+LOCALS64+$H+8],$a1
2634 ldx [%sp+LOCALS64+$H+16],$a2
2635 ldx [%sp+LOCALS64+$H+24],$a3
2636 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Hsqr, H);
2637 add %sp,LOCALS64+$Hsqr,$rp
2639 ldx [%sp+LOCALS64+$res_z],$bi
2640 ldx [%sp+LOCALS64+$in2_z],$a0
2641 ldx [%sp+LOCALS64+$in2_z+8],$a1
2642 ldx [%sp+LOCALS64+$in2_z+16],$a2
2643 ldx [%sp+LOCALS64+$in2_z+24],$a3
2644 add %sp,LOCALS64+$res_z,$bp
2645 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(res_z, res_z, in2_z);
2646 add %sp,LOCALS64+$res_z,$rp
2648 ldx [%sp+LOCALS64+$H],$bi
2649 ldx [%sp+LOCALS64+$Hsqr],$a0
2650 ldx [%sp+LOCALS64+$Hsqr+8],$a1
2651 ldx [%sp+LOCALS64+$Hsqr+16],$a2
2652 ldx [%sp+LOCALS64+$Hsqr+24],$a3
2653 add %sp,LOCALS64+$H,$bp
2654 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(Hcub, Hsqr, H);
2655 add %sp,LOCALS64+$Hcub,$rp
2657 ldx [%sp+LOCALS64+$U1],$bi
2658 ldx [%sp+LOCALS64+$Hsqr],$a0
2659 ldx [%sp+LOCALS64+$Hsqr+8],$a1
2660 ldx [%sp+LOCALS64+$Hsqr+16],$a2
2661 ldx [%sp+LOCALS64+$Hsqr+24],$a3
2662 add %sp,LOCALS64+$U1,$bp
2663 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(U2, U1, Hsqr);
2664 add %sp,LOCALS64+$U2,$rp
2666 call __ecp_nistz256_mul_by_2_vis3 ! p256_mul_by_2(Hsqr, U2);
2667 add %sp,LOCALS64+$Hsqr,$rp
2669 add %sp,LOCALS64+$Rsqr,$bp
2670 call __ecp_nistz256_sub_morf_vis3 ! p256_sub(res_x, Rsqr, Hsqr);
2671 add %sp,LOCALS64+$res_x,$rp
2673 add %sp,LOCALS64+$Hcub,$bp
2674 call __ecp_nistz256_sub_from_vis3 ! p256_sub(res_x, res_x, Hcub);
2675 add %sp,LOCALS64+$res_x,$rp
2677 ldx [%sp+LOCALS64+$S1],$bi ! forward load
2678 ldx [%sp+LOCALS64+$Hcub],$a0
2679 ldx [%sp+LOCALS64+$Hcub+8],$a1
2680 ldx [%sp+LOCALS64+$Hcub+16],$a2
2681 ldx [%sp+LOCALS64+$Hcub+24],$a3
2683 add %sp,LOCALS64+$U2,$bp
2684 call __ecp_nistz256_sub_morf_vis3 ! p256_sub(res_y, U2, res_x);
2685 add %sp,LOCALS64+$res_y,$rp
2687 add %sp,LOCALS64+$S1,$bp
2688 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S2, S1, Hcub);
2689 add %sp,LOCALS64+$S2,$rp
2691 ldx [%sp+LOCALS64+$R],$bi
2692 ldx [%sp+LOCALS64+$res_y],$a0
2693 ldx [%sp+LOCALS64+$res_y+8],$a1
2694 ldx [%sp+LOCALS64+$res_y+16],$a2
2695 ldx [%sp+LOCALS64+$res_y+24],$a3
2696 add %sp,LOCALS64+$R,$bp
2697 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(res_y, res_y, R);
2698 add %sp,LOCALS64+$res_y,$rp
2700 add %sp,LOCALS64+$S2,$bp
2701 call __ecp_nistz256_sub_from_vis3 ! p256_sub(res_y, res_y, S2);
2702 add %sp,LOCALS64+$res_y,$rp
2704 ldx [%fp+STACK_BIAS-16],$t1 ! !in1infty
2705 ldx [%fp+STACK_BIAS-8],$t2 ! !in2infty
2707 for($i=0;$i<96;$i+=16) { # conditional moves
2709 ldx [%sp+LOCALS64+$res_x+$i],$acc0 ! res
2710 ldx [%sp+LOCALS64+$res_x+$i+8],$acc1
2711 ldx [%sp+LOCALS64+$in2_x+$i],$acc2 ! in2
2712 ldx [%sp+LOCALS64+$in2_x+$i+8],$acc3
2713 ldx [%sp+LOCALS64+$in1_x+$i],$acc4 ! in1
2714 ldx [%sp+LOCALS64+$in1_x+$i+8],$acc5
2715 movrz $t1,$acc2,$acc0
2716 movrz $t1,$acc3,$acc1
2717 movrz $t2,$acc4,$acc0
2718 movrz $t2,$acc5,$acc1
2721 st $acc0,[$rp_real+$i]
2722 st $acc2,[$rp_real+$i+4]
2723 st $acc1,[$rp_real+$i+8]
2724 st $acc3,[$rp_real+$i+12]
2731 .type ecp_nistz256_point_add_vis3,#function
2732 .size ecp_nistz256_point_add_vis3,.-ecp_nistz256_point_add_vis3
2735 ########################################################################
2736 # void ecp_nistz256_point_add_affine(P256_POINT *out,const P256_POINT *in1,
2737 # const P256_POINT_AFFINE *in2);
2739 my ($res_x,$res_y,$res_z,
2740 $in1_x,$in1_y,$in1_z,
2742 $U2,$S2,$H,$R,$Hsqr,$Hcub,$Rsqr)=map(32*$_,(0..14));
2744 # above map() describes stack layout with 15 temporary
2745 # 256-bit vectors on top. Then we reserve some space for
2746 # !in1infty and !in2infty.
2750 ecp_nistz256_point_add_affine_vis3:
2751 save %sp,-STACK64_FRAME-32*15-32,%sp
2756 sllx $minus1,32,$poly1 ! 0xFFFFFFFF00000000
2757 srl $poly3,0,$poly3 ! 0x00000000FFFFFFFE
2759 ! convert input to uint64_t[4]
2760 ld [$bp],$a0 ! in2_x
2770 ld [$bp+32],$acc0 ! in2_y
2778 ld [$bp+32+16],$acc2
2782 ld [$bp+32+24],$acc3
2786 stx $a0,[%sp+LOCALS64+$in2_x]
2788 stx $a1,[%sp+LOCALS64+$in2_x+8]
2790 stx $a2,[%sp+LOCALS64+$in2_x+16]
2792 stx $a3,[%sp+LOCALS64+$in2_x+24]
2794 stx $acc0,[%sp+LOCALS64+$in2_y]
2796 stx $acc1,[%sp+LOCALS64+$in2_y+8]
2798 stx $acc2,[%sp+LOCALS64+$in2_y+16]
2799 stx $acc3,[%sp+LOCALS64+$in2_y+24]
2803 or $acc1,$acc0,$acc0
2804 or $acc3,$acc2,$acc2
2806 or $acc2,$acc0,$acc0
2808 movrnz $a0,-1,$a0 ! !in2infty
2809 stx $a0,[%fp+STACK_BIAS-8]
2811 ld [$ap],$a0 ! in1_x
2821 ld [$ap+32],$acc0 ! in1_y
2829 ld [$ap+32+16],$acc2
2833 ld [$ap+32+24],$acc3
2837 stx $a0,[%sp+LOCALS64+$in1_x]
2839 stx $a1,[%sp+LOCALS64+$in1_x+8]
2841 stx $a2,[%sp+LOCALS64+$in1_x+16]
2843 stx $a3,[%sp+LOCALS64+$in1_x+24]
2845 stx $acc0,[%sp+LOCALS64+$in1_y]
2847 stx $acc1,[%sp+LOCALS64+$in1_y+8]
2849 stx $acc2,[%sp+LOCALS64+$in1_y+16]
2850 stx $acc3,[%sp+LOCALS64+$in1_y+24]
2854 or $acc1,$acc0,$acc0
2855 or $acc3,$acc2,$acc2
2857 or $acc2,$acc0,$acc0
2859 movrnz $a0,-1,$a0 ! !in1infty
2860 stx $a0,[%fp+STACK_BIAS-16]
2862 ld [$ap+64],$a0 ! in1_z
2876 stx $a0,[%sp+LOCALS64+$in1_z]
2878 stx $a1,[%sp+LOCALS64+$in1_z+8]
2880 stx $a2,[%sp+LOCALS64+$in1_z+16]
2881 stx $a3,[%sp+LOCALS64+$in1_z+24]
2883 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Z1sqr, in1_z);
2884 add %sp,LOCALS64+$Z1sqr,$rp
2886 ldx [%sp+LOCALS64+$in2_x],$bi
2891 add %sp,LOCALS64+$in2_x,$bp
2892 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(U2, Z1sqr, in2_x);
2893 add %sp,LOCALS64+$U2,$rp
2895 ldx [%sp+LOCALS64+$Z1sqr],$bi ! forward load
2896 ldx [%sp+LOCALS64+$in1_z],$a0
2897 ldx [%sp+LOCALS64+$in1_z+8],$a1
2898 ldx [%sp+LOCALS64+$in1_z+16],$a2
2899 ldx [%sp+LOCALS64+$in1_z+24],$a3
2901 add %sp,LOCALS64+$in1_x,$bp
2902 call __ecp_nistz256_sub_from_vis3 ! p256_sub(H, U2, in1_x);
2903 add %sp,LOCALS64+$H,$rp
2905 add %sp,LOCALS64+$Z1sqr,$bp
2906 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S2, Z1sqr, in1_z);
2907 add %sp,LOCALS64+$S2,$rp
2909 ldx [%sp+LOCALS64+$H],$bi
2910 ldx [%sp+LOCALS64+$in1_z],$a0
2911 ldx [%sp+LOCALS64+$in1_z+8],$a1
2912 ldx [%sp+LOCALS64+$in1_z+16],$a2
2913 ldx [%sp+LOCALS64+$in1_z+24],$a3
2914 add %sp,LOCALS64+$H,$bp
2915 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(res_z, H, in1_z);
2916 add %sp,LOCALS64+$res_z,$rp
2918 ldx [%sp+LOCALS64+$S2],$bi
2919 ldx [%sp+LOCALS64+$in2_y],$a0
2920 ldx [%sp+LOCALS64+$in2_y+8],$a1
2921 ldx [%sp+LOCALS64+$in2_y+16],$a2
2922 ldx [%sp+LOCALS64+$in2_y+24],$a3
2923 add %sp,LOCALS64+$S2,$bp
2924 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S2, S2, in2_y);
2925 add %sp,LOCALS64+$S2,$rp
2927 ldx [%sp+LOCALS64+$H],$a0 ! forward load
2928 ldx [%sp+LOCALS64+$H+8],$a1
2929 ldx [%sp+LOCALS64+$H+16],$a2
2930 ldx [%sp+LOCALS64+$H+24],$a3
2932 add %sp,LOCALS64+$in1_y,$bp
2933 call __ecp_nistz256_sub_from_vis3 ! p256_sub(R, S2, in1_y);
2934 add %sp,LOCALS64+$R,$rp
2936 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Hsqr, H);
2937 add %sp,LOCALS64+$Hsqr,$rp
2939 ldx [%sp+LOCALS64+$R],$a0
2940 ldx [%sp+LOCALS64+$R+8],$a1
2941 ldx [%sp+LOCALS64+$R+16],$a2
2942 ldx [%sp+LOCALS64+$R+24],$a3
2943 call __ecp_nistz256_sqr_mont_vis3 ! p256_sqr_mont(Rsqr, R);
2944 add %sp,LOCALS64+$Rsqr,$rp
2946 ldx [%sp+LOCALS64+$H],$bi
2947 ldx [%sp+LOCALS64+$Hsqr],$a0
2948 ldx [%sp+LOCALS64+$Hsqr+8],$a1
2949 ldx [%sp+LOCALS64+$Hsqr+16],$a2
2950 ldx [%sp+LOCALS64+$Hsqr+24],$a3
2951 add %sp,LOCALS64+$H,$bp
2952 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(Hcub, Hsqr, H);
2953 add %sp,LOCALS64+$Hcub,$rp
2955 ldx [%sp+LOCALS64+$Hsqr],$bi
2956 ldx [%sp+LOCALS64+$in1_x],$a0
2957 ldx [%sp+LOCALS64+$in1_x+8],$a1
2958 ldx [%sp+LOCALS64+$in1_x+16],$a2
2959 ldx [%sp+LOCALS64+$in1_x+24],$a3
2960 add %sp,LOCALS64+$Hsqr,$bp
2961 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(U2, in1_x, Hsqr);
2962 add %sp,LOCALS64+$U2,$rp
2964 call __ecp_nistz256_mul_by_2_vis3 ! p256_mul_by_2(Hsqr, U2);
2965 add %sp,LOCALS64+$Hsqr,$rp
2967 add %sp,LOCALS64+$Rsqr,$bp
2968 call __ecp_nistz256_sub_morf_vis3 ! p256_sub(res_x, Rsqr, Hsqr);
2969 add %sp,LOCALS64+$res_x,$rp
2971 add %sp,LOCALS64+$Hcub,$bp
2972 call __ecp_nistz256_sub_from_vis3 ! p256_sub(res_x, res_x, Hcub);
2973 add %sp,LOCALS64+$res_x,$rp
2975 ldx [%sp+LOCALS64+$Hcub],$bi ! forward load
2976 ldx [%sp+LOCALS64+$in1_y],$a0
2977 ldx [%sp+LOCALS64+$in1_y+8],$a1
2978 ldx [%sp+LOCALS64+$in1_y+16],$a2
2979 ldx [%sp+LOCALS64+$in1_y+24],$a3
2981 add %sp,LOCALS64+$U2,$bp
2982 call __ecp_nistz256_sub_morf_vis3 ! p256_sub(res_y, U2, res_x);
2983 add %sp,LOCALS64+$res_y,$rp
2985 add %sp,LOCALS64+$Hcub,$bp
2986 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(S2, in1_y, Hcub);
2987 add %sp,LOCALS64+$S2,$rp
2989 ldx [%sp+LOCALS64+$R],$bi
2990 ldx [%sp+LOCALS64+$res_y],$a0
2991 ldx [%sp+LOCALS64+$res_y+8],$a1
2992 ldx [%sp+LOCALS64+$res_y+16],$a2
2993 ldx [%sp+LOCALS64+$res_y+24],$a3
2994 add %sp,LOCALS64+$R,$bp
2995 call __ecp_nistz256_mul_mont_vis3 ! p256_mul_mont(res_y, res_y, R);
2996 add %sp,LOCALS64+$res_y,$rp
2998 add %sp,LOCALS64+$S2,$bp
2999 call __ecp_nistz256_sub_from_vis3 ! p256_sub(res_y, res_y, S2);
3000 add %sp,LOCALS64+$res_y,$rp
3002 ldx [%fp+STACK_BIAS-16],$t1 ! !in1infty
3003 ldx [%fp+STACK_BIAS-8],$t2 ! !in2infty
3005 add %o7,.Lone_mont_vis3-1b,$bp
3007 for($i=0;$i<64;$i+=16) { # conditional moves
3009 ldx [%sp+LOCALS64+$res_x+$i],$acc0 ! res
3010 ldx [%sp+LOCALS64+$res_x+$i+8],$acc1
3011 ldx [%sp+LOCALS64+$in2_x+$i],$acc2 ! in2
3012 ldx [%sp+LOCALS64+$in2_x+$i+8],$acc3
3013 ldx [%sp+LOCALS64+$in1_x+$i],$acc4 ! in1
3014 ldx [%sp+LOCALS64+$in1_x+$i+8],$acc5
3015 movrz $t1,$acc2,$acc0
3016 movrz $t1,$acc3,$acc1
3017 movrz $t2,$acc4,$acc0
3018 movrz $t2,$acc5,$acc1
3021 st $acc0,[$rp_real+$i]
3022 st $acc2,[$rp_real+$i+4]
3023 st $acc1,[$rp_real+$i+8]
3024 st $acc3,[$rp_real+$i+12]
3027 for(;$i<96;$i+=16) {
3029 ldx [%sp+LOCALS64+$res_x+$i],$acc0 ! res
3030 ldx [%sp+LOCALS64+$res_x+$i+8],$acc1
3031 ldx [$bp+$i-64],$acc2 ! "in2"
3032 ldx [$bp+$i-64+8],$acc3
3033 ldx [%sp+LOCALS64+$in1_x+$i],$acc4 ! in1
3034 ldx [%sp+LOCALS64+$in1_x+$i+8],$acc5
3035 movrz $t1,$acc2,$acc0
3036 movrz $t1,$acc3,$acc1
3037 movrz $t2,$acc4,$acc0
3038 movrz $t2,$acc5,$acc1
3041 st $acc0,[$rp_real+$i]
3042 st $acc2,[$rp_real+$i+4]
3043 st $acc1,[$rp_real+$i+8]
3044 st $acc3,[$rp_real+$i+12]
3050 .type ecp_nistz256_point_add_affine_vis3,#function
3051 .size ecp_nistz256_point_add_affine_vis3,.-ecp_nistz256_point_add_affine_vis3
3054 .long 0x00000000,0x00000001, 0xffffffff,0x00000000
3055 .long 0xffffffff,0xffffffff, 0x00000000,0xfffffffe
3060 # Purpose of these subroutines is to explicitly encode VIS instructions,
3061 # so that one can compile the module without having to specify VIS
3062 # extensions on compiler command line, e.g. -xarch=v9 vs. -xarch=v9a.
3063 # Idea is to reserve for option to produce "universal" binary and let
3064 # programmer detect if current CPU is VIS capable at run-time.
3066 my ($mnemonic,$rs1,$rs2,$rd)=@_;
3067 my %bias = ( "g" => 0, "o" => 8, "l" => 16, "i" => 24 );
3069 my %visopf = ( "addxc" => 0x011,
3071 "umulxhi" => 0x016 );
3073 $ref = "$mnemonic\t$rs1,$rs2,$rd";
3075 if ($opf=$visopf{$mnemonic}) {
3076 foreach ($rs1,$rs2,$rd) {
3077 return $ref if (!/%([goli])([0-9])/);
3081 return sprintf ".word\t0x%08x !%s",
3082 0x81b00000|$rd<<25|$rs1<<14|$opf<<5|$rs2,
3089 foreach (split("\n",$code)) {
3090 s/\`([^\`]*)\`/eval $1/ge;
3092 s/\b(umulxhi|addxc[c]{0,2})\s+(%[goli][0-7]),\s*(%[goli][0-7]),\s*(%[goli][0-7])/
3093 &unvis3($1,$2,$3,$4)