x86_64-gcc.c 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638
  1. #include "../bn_lcl.h"
  2. #if !(defined(__GNUC__) && __GNUC__>=2)
  3. # include "../bn_asm.c" /* kind of dirty hack for Sun Studio */
  4. #else
  5. /*-
  6. * x86_64 BIGNUM accelerator version 0.1, December 2002.
  7. *
  8. * Implemented by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
  9. * project.
  10. *
  11. * Rights for redistribution and usage in source and binary forms are
  12. * granted according to the OpenSSL license. Warranty of any kind is
  13. * disclaimed.
  14. *
  15. * Q. Version 0.1? It doesn't sound like Andy, he used to assign real
  16. * versions, like 1.0...
  17. * A. Well, that's because this code is basically a quick-n-dirty
  18. * proof-of-concept hack. As you can see it's implemented with
  19. * inline assembler, which means that you're bound to GCC and that
  20. * there might be enough room for further improvement.
  21. *
  22. * Q. Why inline assembler?
  23. * A. x86_64 features own ABI which I'm not familiar with. This is
  24. * why I decided to let the compiler take care of subroutine
  25. * prologue/epilogue as well as register allocation. For reference.
  26. * Win64 implements different ABI for AMD64, different from Linux.
  27. *
  28. * Q. How much faster does it get?
  29. * A. 'apps/openssl speed rsa dsa' output with no-asm:
  30. *
  31. * sign verify sign/s verify/s
  32. * rsa 512 bits 0.0006s 0.0001s 1683.8 18456.2
  33. * rsa 1024 bits 0.0028s 0.0002s 356.0 6407.0
  34. * rsa 2048 bits 0.0172s 0.0005s 58.0 1957.8
  35. * rsa 4096 bits 0.1155s 0.0018s 8.7 555.6
  36. * sign verify sign/s verify/s
  37. * dsa 512 bits 0.0005s 0.0006s 2100.8 1768.3
  38. * dsa 1024 bits 0.0014s 0.0018s 692.3 559.2
  39. * dsa 2048 bits 0.0049s 0.0061s 204.7 165.0
  40. *
  41. * 'apps/openssl speed rsa dsa' output with this module:
  42. *
  43. * sign verify sign/s verify/s
  44. * rsa 512 bits 0.0004s 0.0000s 2767.1 33297.9
  45. * rsa 1024 bits 0.0012s 0.0001s 867.4 14674.7
  46. * rsa 2048 bits 0.0061s 0.0002s 164.0 5270.0
  47. * rsa 4096 bits 0.0384s 0.0006s 26.1 1650.8
  48. * sign verify sign/s verify/s
  49. * dsa 512 bits 0.0002s 0.0003s 4442.2 3786.3
  50. * dsa 1024 bits 0.0005s 0.0007s 1835.1 1497.4
  51. * dsa 2048 bits 0.0016s 0.0020s 620.4 504.6
  52. *
  53. * For the reference. IA-32 assembler implementation performs
  54. * very much like 64-bit code compiled with no-asm on the same
  55. * machine.
  56. */
  57. # if defined(_WIN64) || !defined(__LP64__)
  58. # define BN_ULONG unsigned long long
  59. # else
  60. # define BN_ULONG unsigned long
  61. # endif
  62. # undef mul
  63. # undef mul_add
  64. /*-
  65. * "m"(a), "+m"(r) is the way to favor DirectPath µ-code;
  66. * "g"(0) let the compiler to decide where does it
  67. * want to keep the value of zero;
  68. */
  69. # define mul_add(r,a,word,carry) do { \
  70. register BN_ULONG high,low; \
  71. asm ("mulq %3" \
  72. : "=a"(low),"=d"(high) \
  73. : "a"(word),"m"(a) \
  74. : "cc"); \
  75. asm ("addq %2,%0; adcq %3,%1" \
  76. : "+r"(carry),"+d"(high)\
  77. : "a"(low),"g"(0) \
  78. : "cc"); \
  79. asm ("addq %2,%0; adcq %3,%1" \
  80. : "+m"(r),"+d"(high) \
  81. : "r"(carry),"g"(0) \
  82. : "cc"); \
  83. carry=high; \
  84. } while (0)
  85. # define mul(r,a,word,carry) do { \
  86. register BN_ULONG high,low; \
  87. asm ("mulq %3" \
  88. : "=a"(low),"=d"(high) \
  89. : "a"(word),"g"(a) \
  90. : "cc"); \
  91. asm ("addq %2,%0; adcq %3,%1" \
  92. : "+r"(carry),"+d"(high)\
  93. : "a"(low),"g"(0) \
  94. : "cc"); \
  95. (r)=carry, carry=high; \
  96. } while (0)
  97. # undef sqr
  98. # define sqr(r0,r1,a) \
  99. asm ("mulq %2" \
  100. : "=a"(r0),"=d"(r1) \
  101. : "a"(a) \
  102. : "cc");
  103. BN_ULONG bn_mul_add_words(BN_ULONG *rp, const BN_ULONG *ap, int num,
  104. BN_ULONG w)
  105. {
  106. BN_ULONG c1 = 0;
  107. if (num <= 0)
  108. return (c1);
  109. while (num & ~3) {
  110. mul_add(rp[0], ap[0], w, c1);
  111. mul_add(rp[1], ap[1], w, c1);
  112. mul_add(rp[2], ap[2], w, c1);
  113. mul_add(rp[3], ap[3], w, c1);
  114. ap += 4;
  115. rp += 4;
  116. num -= 4;
  117. }
  118. if (num) {
  119. mul_add(rp[0], ap[0], w, c1);
  120. if (--num == 0)
  121. return c1;
  122. mul_add(rp[1], ap[1], w, c1);
  123. if (--num == 0)
  124. return c1;
  125. mul_add(rp[2], ap[2], w, c1);
  126. return c1;
  127. }
  128. return (c1);
  129. }
  130. BN_ULONG bn_mul_words(BN_ULONG *rp, const BN_ULONG *ap, int num, BN_ULONG w)
  131. {
  132. BN_ULONG c1 = 0;
  133. if (num <= 0)
  134. return (c1);
  135. while (num & ~3) {
  136. mul(rp[0], ap[0], w, c1);
  137. mul(rp[1], ap[1], w, c1);
  138. mul(rp[2], ap[2], w, c1);
  139. mul(rp[3], ap[3], w, c1);
  140. ap += 4;
  141. rp += 4;
  142. num -= 4;
  143. }
  144. if (num) {
  145. mul(rp[0], ap[0], w, c1);
  146. if (--num == 0)
  147. return c1;
  148. mul(rp[1], ap[1], w, c1);
  149. if (--num == 0)
  150. return c1;
  151. mul(rp[2], ap[2], w, c1);
  152. }
  153. return (c1);
  154. }
  155. void bn_sqr_words(BN_ULONG *r, const BN_ULONG *a, int n)
  156. {
  157. if (n <= 0)
  158. return;
  159. while (n & ~3) {
  160. sqr(r[0], r[1], a[0]);
  161. sqr(r[2], r[3], a[1]);
  162. sqr(r[4], r[5], a[2]);
  163. sqr(r[6], r[7], a[3]);
  164. a += 4;
  165. r += 8;
  166. n -= 4;
  167. }
  168. if (n) {
  169. sqr(r[0], r[1], a[0]);
  170. if (--n == 0)
  171. return;
  172. sqr(r[2], r[3], a[1]);
  173. if (--n == 0)
  174. return;
  175. sqr(r[4], r[5], a[2]);
  176. }
  177. }
  178. BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d)
  179. {
  180. BN_ULONG ret, waste;
  181. asm("divq %4":"=a"(ret), "=d"(waste)
  182. : "a"(l), "d"(h), "g"(d)
  183. : "cc");
  184. return ret;
  185. }
  186. BN_ULONG bn_add_words(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
  187. int n)
  188. {
  189. BN_ULONG ret;
  190. size_t i = 0;
  191. if (n <= 0)
  192. return 0;
  193. asm volatile (" subq %0,%0 \n" /* clear carry */
  194. " jmp 1f \n"
  195. ".p2align 4 \n"
  196. "1: movq (%4,%2,8),%0 \n"
  197. " adcq (%5,%2,8),%0 \n"
  198. " movq %0,(%3,%2,8) \n"
  199. " lea 1(%2),%2 \n"
  200. " loop 1b \n"
  201. " sbbq %0,%0 \n":"=&r" (ret), "+c"(n),
  202. "+r"(i)
  203. :"r"(rp), "r"(ap), "r"(bp)
  204. :"cc", "memory");
  205. return ret & 1;
  206. }
  207. # ifndef SIMICS
  208. BN_ULONG bn_sub_words(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
  209. int n)
  210. {
  211. BN_ULONG ret;
  212. size_t i = 0;
  213. if (n <= 0)
  214. return 0;
  215. asm volatile (" subq %0,%0 \n" /* clear borrow */
  216. " jmp 1f \n"
  217. ".p2align 4 \n"
  218. "1: movq (%4,%2,8),%0 \n"
  219. " sbbq (%5,%2,8),%0 \n"
  220. " movq %0,(%3,%2,8) \n"
  221. " lea 1(%2),%2 \n"
  222. " loop 1b \n"
  223. " sbbq %0,%0 \n":"=&r" (ret), "+c"(n),
  224. "+r"(i)
  225. :"r"(rp), "r"(ap), "r"(bp)
  226. :"cc", "memory");
  227. return ret & 1;
  228. }
  229. # else
  230. /* Simics 1.4<7 has buggy sbbq:-( */
  231. # define BN_MASK2 0xffffffffffffffffL
  232. BN_ULONG bn_sub_words(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
  233. {
  234. BN_ULONG t1, t2;
  235. int c = 0;
  236. if (n <= 0)
  237. return ((BN_ULONG)0);
  238. for (;;) {
  239. t1 = a[0];
  240. t2 = b[0];
  241. r[0] = (t1 - t2 - c) & BN_MASK2;
  242. if (t1 != t2)
  243. c = (t1 < t2);
  244. if (--n <= 0)
  245. break;
  246. t1 = a[1];
  247. t2 = b[1];
  248. r[1] = (t1 - t2 - c) & BN_MASK2;
  249. if (t1 != t2)
  250. c = (t1 < t2);
  251. if (--n <= 0)
  252. break;
  253. t1 = a[2];
  254. t2 = b[2];
  255. r[2] = (t1 - t2 - c) & BN_MASK2;
  256. if (t1 != t2)
  257. c = (t1 < t2);
  258. if (--n <= 0)
  259. break;
  260. t1 = a[3];
  261. t2 = b[3];
  262. r[3] = (t1 - t2 - c) & BN_MASK2;
  263. if (t1 != t2)
  264. c = (t1 < t2);
  265. if (--n <= 0)
  266. break;
  267. a += 4;
  268. b += 4;
  269. r += 4;
  270. }
  271. return (c);
  272. }
  273. # endif
  274. /* mul_add_c(a,b,c0,c1,c2) -- c+=a*b for three word number c=(c2,c1,c0) */
  275. /* mul_add_c2(a,b,c0,c1,c2) -- c+=2*a*b for three word number c=(c2,c1,c0) */
  276. /* sqr_add_c(a,i,c0,c1,c2) -- c+=a[i]^2 for three word number c=(c2,c1,c0) */
  277. /*
  278. * sqr_add_c2(a,i,c0,c1,c2) -- c+=2*a[i]*a[j] for three word number
  279. * c=(c2,c1,c0)
  280. */
  281. /*
  282. * Keep in mind that carrying into high part of multiplication result
  283. * can not overflow, because it cannot be all-ones.
  284. */
  285. # if 0
  286. /* original macros are kept for reference purposes */
  287. # define mul_add_c(a,b,c0,c1,c2) do { \
  288. BN_ULONG ta = (a), tb = (b); \
  289. BN_ULONG lo, hi; \
  290. BN_UMULT_LOHI(lo,hi,ta,tb); \
  291. c0 += lo; hi += (c0<lo)?1:0; \
  292. c1 += hi; c2 += (c1<hi)?1:0; \
  293. } while(0)
  294. # define mul_add_c2(a,b,c0,c1,c2) do { \
  295. BN_ULONG ta = (a), tb = (b); \
  296. BN_ULONG lo, hi, tt; \
  297. BN_UMULT_LOHI(lo,hi,ta,tb); \
  298. c0 += lo; tt = hi+((c0<lo)?1:0); \
  299. c1 += tt; c2 += (c1<tt)?1:0; \
  300. c0 += lo; hi += (c0<lo)?1:0; \
  301. c1 += hi; c2 += (c1<hi)?1:0; \
  302. } while(0)
  303. # define sqr_add_c(a,i,c0,c1,c2) do { \
  304. BN_ULONG ta = (a)[i]; \
  305. BN_ULONG lo, hi; \
  306. BN_UMULT_LOHI(lo,hi,ta,ta); \
  307. c0 += lo; hi += (c0<lo)?1:0; \
  308. c1 += hi; c2 += (c1<hi)?1:0; \
  309. } while(0)
  310. # else
  311. # define mul_add_c(a,b,c0,c1,c2) do { \
  312. BN_ULONG t1,t2; \
  313. asm ("mulq %3" \
  314. : "=a"(t1),"=d"(t2) \
  315. : "a"(a),"m"(b) \
  316. : "cc"); \
  317. asm ("addq %3,%0; adcq %4,%1; adcq %5,%2" \
  318. : "+r"(c0),"+r"(c1),"+r"(c2) \
  319. : "r"(t1),"r"(t2),"g"(0) \
  320. : "cc"); \
  321. } while (0)
  322. # define sqr_add_c(a,i,c0,c1,c2) do { \
  323. BN_ULONG t1,t2; \
  324. asm ("mulq %2" \
  325. : "=a"(t1),"=d"(t2) \
  326. : "a"(a[i]) \
  327. : "cc"); \
  328. asm ("addq %3,%0; adcq %4,%1; adcq %5,%2" \
  329. : "+r"(c0),"+r"(c1),"+r"(c2) \
  330. : "r"(t1),"r"(t2),"g"(0) \
  331. : "cc"); \
  332. } while (0)
  333. # define mul_add_c2(a,b,c0,c1,c2) do { \
  334. BN_ULONG t1,t2; \
  335. asm ("mulq %3" \
  336. : "=a"(t1),"=d"(t2) \
  337. : "a"(a),"m"(b) \
  338. : "cc"); \
  339. asm ("addq %3,%0; adcq %4,%1; adcq %5,%2" \
  340. : "+r"(c0),"+r"(c1),"+r"(c2) \
  341. : "r"(t1),"r"(t2),"g"(0) \
  342. : "cc"); \
  343. asm ("addq %3,%0; adcq %4,%1; adcq %5,%2" \
  344. : "+r"(c0),"+r"(c1),"+r"(c2) \
  345. : "r"(t1),"r"(t2),"g"(0) \
  346. : "cc"); \
  347. } while (0)
  348. # endif
  349. # define sqr_add_c2(a,i,j,c0,c1,c2) \
  350. mul_add_c2((a)[i],(a)[j],c0,c1,c2)
  351. void bn_mul_comba8(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
  352. {
  353. BN_ULONG c1, c2, c3;
  354. c1 = 0;
  355. c2 = 0;
  356. c3 = 0;
  357. mul_add_c(a[0], b[0], c1, c2, c3);
  358. r[0] = c1;
  359. c1 = 0;
  360. mul_add_c(a[0], b[1], c2, c3, c1);
  361. mul_add_c(a[1], b[0], c2, c3, c1);
  362. r[1] = c2;
  363. c2 = 0;
  364. mul_add_c(a[2], b[0], c3, c1, c2);
  365. mul_add_c(a[1], b[1], c3, c1, c2);
  366. mul_add_c(a[0], b[2], c3, c1, c2);
  367. r[2] = c3;
  368. c3 = 0;
  369. mul_add_c(a[0], b[3], c1, c2, c3);
  370. mul_add_c(a[1], b[2], c1, c2, c3);
  371. mul_add_c(a[2], b[1], c1, c2, c3);
  372. mul_add_c(a[3], b[0], c1, c2, c3);
  373. r[3] = c1;
  374. c1 = 0;
  375. mul_add_c(a[4], b[0], c2, c3, c1);
  376. mul_add_c(a[3], b[1], c2, c3, c1);
  377. mul_add_c(a[2], b[2], c2, c3, c1);
  378. mul_add_c(a[1], b[3], c2, c3, c1);
  379. mul_add_c(a[0], b[4], c2, c3, c1);
  380. r[4] = c2;
  381. c2 = 0;
  382. mul_add_c(a[0], b[5], c3, c1, c2);
  383. mul_add_c(a[1], b[4], c3, c1, c2);
  384. mul_add_c(a[2], b[3], c3, c1, c2);
  385. mul_add_c(a[3], b[2], c3, c1, c2);
  386. mul_add_c(a[4], b[1], c3, c1, c2);
  387. mul_add_c(a[5], b[0], c3, c1, c2);
  388. r[5] = c3;
  389. c3 = 0;
  390. mul_add_c(a[6], b[0], c1, c2, c3);
  391. mul_add_c(a[5], b[1], c1, c2, c3);
  392. mul_add_c(a[4], b[2], c1, c2, c3);
  393. mul_add_c(a[3], b[3], c1, c2, c3);
  394. mul_add_c(a[2], b[4], c1, c2, c3);
  395. mul_add_c(a[1], b[5], c1, c2, c3);
  396. mul_add_c(a[0], b[6], c1, c2, c3);
  397. r[6] = c1;
  398. c1 = 0;
  399. mul_add_c(a[0], b[7], c2, c3, c1);
  400. mul_add_c(a[1], b[6], c2, c3, c1);
  401. mul_add_c(a[2], b[5], c2, c3, c1);
  402. mul_add_c(a[3], b[4], c2, c3, c1);
  403. mul_add_c(a[4], b[3], c2, c3, c1);
  404. mul_add_c(a[5], b[2], c2, c3, c1);
  405. mul_add_c(a[6], b[1], c2, c3, c1);
  406. mul_add_c(a[7], b[0], c2, c3, c1);
  407. r[7] = c2;
  408. c2 = 0;
  409. mul_add_c(a[7], b[1], c3, c1, c2);
  410. mul_add_c(a[6], b[2], c3, c1, c2);
  411. mul_add_c(a[5], b[3], c3, c1, c2);
  412. mul_add_c(a[4], b[4], c3, c1, c2);
  413. mul_add_c(a[3], b[5], c3, c1, c2);
  414. mul_add_c(a[2], b[6], c3, c1, c2);
  415. mul_add_c(a[1], b[7], c3, c1, c2);
  416. r[8] = c3;
  417. c3 = 0;
  418. mul_add_c(a[2], b[7], c1, c2, c3);
  419. mul_add_c(a[3], b[6], c1, c2, c3);
  420. mul_add_c(a[4], b[5], c1, c2, c3);
  421. mul_add_c(a[5], b[4], c1, c2, c3);
  422. mul_add_c(a[6], b[3], c1, c2, c3);
  423. mul_add_c(a[7], b[2], c1, c2, c3);
  424. r[9] = c1;
  425. c1 = 0;
  426. mul_add_c(a[7], b[3], c2, c3, c1);
  427. mul_add_c(a[6], b[4], c2, c3, c1);
  428. mul_add_c(a[5], b[5], c2, c3, c1);
  429. mul_add_c(a[4], b[6], c2, c3, c1);
  430. mul_add_c(a[3], b[7], c2, c3, c1);
  431. r[10] = c2;
  432. c2 = 0;
  433. mul_add_c(a[4], b[7], c3, c1, c2);
  434. mul_add_c(a[5], b[6], c3, c1, c2);
  435. mul_add_c(a[6], b[5], c3, c1, c2);
  436. mul_add_c(a[7], b[4], c3, c1, c2);
  437. r[11] = c3;
  438. c3 = 0;
  439. mul_add_c(a[7], b[5], c1, c2, c3);
  440. mul_add_c(a[6], b[6], c1, c2, c3);
  441. mul_add_c(a[5], b[7], c1, c2, c3);
  442. r[12] = c1;
  443. c1 = 0;
  444. mul_add_c(a[6], b[7], c2, c3, c1);
  445. mul_add_c(a[7], b[6], c2, c3, c1);
  446. r[13] = c2;
  447. c2 = 0;
  448. mul_add_c(a[7], b[7], c3, c1, c2);
  449. r[14] = c3;
  450. r[15] = c1;
  451. }
  452. void bn_mul_comba4(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b)
  453. {
  454. BN_ULONG c1, c2, c3;
  455. c1 = 0;
  456. c2 = 0;
  457. c3 = 0;
  458. mul_add_c(a[0], b[0], c1, c2, c3);
  459. r[0] = c1;
  460. c1 = 0;
  461. mul_add_c(a[0], b[1], c2, c3, c1);
  462. mul_add_c(a[1], b[0], c2, c3, c1);
  463. r[1] = c2;
  464. c2 = 0;
  465. mul_add_c(a[2], b[0], c3, c1, c2);
  466. mul_add_c(a[1], b[1], c3, c1, c2);
  467. mul_add_c(a[0], b[2], c3, c1, c2);
  468. r[2] = c3;
  469. c3 = 0;
  470. mul_add_c(a[0], b[3], c1, c2, c3);
  471. mul_add_c(a[1], b[2], c1, c2, c3);
  472. mul_add_c(a[2], b[1], c1, c2, c3);
  473. mul_add_c(a[3], b[0], c1, c2, c3);
  474. r[3] = c1;
  475. c1 = 0;
  476. mul_add_c(a[3], b[1], c2, c3, c1);
  477. mul_add_c(a[2], b[2], c2, c3, c1);
  478. mul_add_c(a[1], b[3], c2, c3, c1);
  479. r[4] = c2;
  480. c2 = 0;
  481. mul_add_c(a[2], b[3], c3, c1, c2);
  482. mul_add_c(a[3], b[2], c3, c1, c2);
  483. r[5] = c3;
  484. c3 = 0;
  485. mul_add_c(a[3], b[3], c1, c2, c3);
  486. r[6] = c1;
  487. r[7] = c2;
  488. }
  489. void bn_sqr_comba8(BN_ULONG *r, const BN_ULONG *a)
  490. {
  491. BN_ULONG c1, c2, c3;
  492. c1 = 0;
  493. c2 = 0;
  494. c3 = 0;
  495. sqr_add_c(a, 0, c1, c2, c3);
  496. r[0] = c1;
  497. c1 = 0;
  498. sqr_add_c2(a, 1, 0, c2, c3, c1);
  499. r[1] = c2;
  500. c2 = 0;
  501. sqr_add_c(a, 1, c3, c1, c2);
  502. sqr_add_c2(a, 2, 0, c3, c1, c2);
  503. r[2] = c3;
  504. c3 = 0;
  505. sqr_add_c2(a, 3, 0, c1, c2, c3);
  506. sqr_add_c2(a, 2, 1, c1, c2, c3);
  507. r[3] = c1;
  508. c1 = 0;
  509. sqr_add_c(a, 2, c2, c3, c1);
  510. sqr_add_c2(a, 3, 1, c2, c3, c1);
  511. sqr_add_c2(a, 4, 0, c2, c3, c1);
  512. r[4] = c2;
  513. c2 = 0;
  514. sqr_add_c2(a, 5, 0, c3, c1, c2);
  515. sqr_add_c2(a, 4, 1, c3, c1, c2);
  516. sqr_add_c2(a, 3, 2, c3, c1, c2);
  517. r[5] = c3;
  518. c3 = 0;
  519. sqr_add_c(a, 3, c1, c2, c3);
  520. sqr_add_c2(a, 4, 2, c1, c2, c3);
  521. sqr_add_c2(a, 5, 1, c1, c2, c3);
  522. sqr_add_c2(a, 6, 0, c1, c2, c3);
  523. r[6] = c1;
  524. c1 = 0;
  525. sqr_add_c2(a, 7, 0, c2, c3, c1);
  526. sqr_add_c2(a, 6, 1, c2, c3, c1);
  527. sqr_add_c2(a, 5, 2, c2, c3, c1);
  528. sqr_add_c2(a, 4, 3, c2, c3, c1);
  529. r[7] = c2;
  530. c2 = 0;
  531. sqr_add_c(a, 4, c3, c1, c2);
  532. sqr_add_c2(a, 5, 3, c3, c1, c2);
  533. sqr_add_c2(a, 6, 2, c3, c1, c2);
  534. sqr_add_c2(a, 7, 1, c3, c1, c2);
  535. r[8] = c3;
  536. c3 = 0;
  537. sqr_add_c2(a, 7, 2, c1, c2, c3);
  538. sqr_add_c2(a, 6, 3, c1, c2, c3);
  539. sqr_add_c2(a, 5, 4, c1, c2, c3);
  540. r[9] = c1;
  541. c1 = 0;
  542. sqr_add_c(a, 5, c2, c3, c1);
  543. sqr_add_c2(a, 6, 4, c2, c3, c1);
  544. sqr_add_c2(a, 7, 3, c2, c3, c1);
  545. r[10] = c2;
  546. c2 = 0;
  547. sqr_add_c2(a, 7, 4, c3, c1, c2);
  548. sqr_add_c2(a, 6, 5, c3, c1, c2);
  549. r[11] = c3;
  550. c3 = 0;
  551. sqr_add_c(a, 6, c1, c2, c3);
  552. sqr_add_c2(a, 7, 5, c1, c2, c3);
  553. r[12] = c1;
  554. c1 = 0;
  555. sqr_add_c2(a, 7, 6, c2, c3, c1);
  556. r[13] = c2;
  557. c2 = 0;
  558. sqr_add_c(a, 7, c3, c1, c2);
  559. r[14] = c3;
  560. r[15] = c1;
  561. }
  562. void bn_sqr_comba4(BN_ULONG *r, const BN_ULONG *a)
  563. {
  564. BN_ULONG c1, c2, c3;
  565. c1 = 0;
  566. c2 = 0;
  567. c3 = 0;
  568. sqr_add_c(a, 0, c1, c2, c3);
  569. r[0] = c1;
  570. c1 = 0;
  571. sqr_add_c2(a, 1, 0, c2, c3, c1);
  572. r[1] = c2;
  573. c2 = 0;
  574. sqr_add_c(a, 1, c3, c1, c2);
  575. sqr_add_c2(a, 2, 0, c3, c1, c2);
  576. r[2] = c3;
  577. c3 = 0;
  578. sqr_add_c2(a, 3, 0, c1, c2, c3);
  579. sqr_add_c2(a, 2, 1, c1, c2, c3);
  580. r[3] = c1;
  581. c1 = 0;
  582. sqr_add_c(a, 2, c2, c3, c1);
  583. sqr_add_c2(a, 3, 1, c2, c3, c1);
  584. r[4] = c2;
  585. c2 = 0;
  586. sqr_add_c2(a, 3, 2, c3, c1, c2);
  587. r[5] = c3;
  588. c3 = 0;
  589. sqr_add_c(a, 3, c1, c2, c3);
  590. r[6] = c1;
  591. r[7] = c2;
  592. }
  593. #endif