155714Skris/* crypto/bn/bn_lcl.h */ 255714Skris/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 355714Skris * All rights reserved. 455714Skris * 555714Skris * This package is an SSL implementation written 655714Skris * by Eric Young (eay@cryptsoft.com). 755714Skris * The implementation was written so as to conform with Netscapes SSL. 8280297Sjkim * 955714Skris * This library is free for commercial and non-commercial use as long as 1055714Skris * the following conditions are aheared to. The following conditions 1155714Skris * apply to all code found in this distribution, be it the RC4, RSA, 1255714Skris * lhash, DES, etc., code; not just the SSL code. The SSL documentation 1355714Skris * included with this distribution is covered by the same copyright terms 1455714Skris * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15280297Sjkim * 1655714Skris * Copyright remains Eric Young's, and as such any Copyright notices in 1755714Skris * the code are not to be removed. 1855714Skris * If this package is used in a product, Eric Young should be given attribution 1955714Skris * as the author of the parts of the library used. 2055714Skris * This can be in the form of a textual message at program startup or 2155714Skris * in documentation (online or textual) provided with the package. 22280297Sjkim * 2355714Skris * Redistribution and use in source and binary forms, with or without 2455714Skris * modification, are permitted provided that the following conditions 2555714Skris * are met: 2655714Skris * 1. Redistributions of source code must retain the copyright 2755714Skris * notice, this list of conditions and the following disclaimer. 2855714Skris * 2. Redistributions in binary form must reproduce the above copyright 2955714Skris * notice, this list of conditions and the following disclaimer in the 3055714Skris * documentation and/or other materials provided with the distribution. 3155714Skris * 3. All advertising materials mentioning features or use of this software 3255714Skris * must display the following acknowledgement: 3355714Skris * "This product includes cryptographic software written by 3455714Skris * Eric Young (eay@cryptsoft.com)" 3555714Skris * The word 'cryptographic' can be left out if the rouines from the library 3655714Skris * being used are not cryptographic related :-). 37280297Sjkim * 4. If you include any Windows specific code (or a derivative thereof) from 3855714Skris * the apps directory (application code) you must include an acknowledgement: 3955714Skris * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40280297Sjkim * 4155714Skris * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 4255714Skris * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 4355714Skris * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 4455714Skris * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 4555714Skris * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 4655714Skris * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 4755714Skris * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 4855714Skris * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 4955714Skris * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 5055714Skris * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 5155714Skris * SUCH DAMAGE. 52280297Sjkim * 5355714Skris * The licence and distribution terms for any publically available version or 5455714Skris * derivative of this code cannot be changed. i.e. this code cannot simply be 5555714Skris * copied and put under another distribution licence 5655714Skris * [including the GNU Public Licence.] 5755714Skris */ 5868651Skris/* ==================================================================== 59337982Sjkim * Copyright (c) 1998-2018 The OpenSSL Project. All rights reserved. 6068651Skris * 6168651Skris * Redistribution and use in source and binary forms, with or without 6268651Skris * modification, are permitted provided that the following conditions 6368651Skris * are met: 6468651Skris * 6568651Skris * 1. Redistributions of source code must retain the above copyright 66280297Sjkim * notice, this list of conditions and the following disclaimer. 6768651Skris * 6868651Skris * 2. Redistributions in binary form must reproduce the above copyright 6968651Skris * notice, this list of conditions and the following disclaimer in 7068651Skris * the documentation and/or other materials provided with the 7168651Skris * distribution. 7268651Skris * 7368651Skris * 3. All advertising materials mentioning features or use of this 7468651Skris * software must display the following acknowledgment: 7568651Skris * "This product includes software developed by the OpenSSL Project 7668651Skris * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 7768651Skris * 7868651Skris * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 7968651Skris * endorse or promote products derived from this software without 8068651Skris * prior written permission. For written permission, please contact 8168651Skris * openssl-core@openssl.org. 8268651Skris * 8368651Skris * 5. Products derived from this software may not be called "OpenSSL" 8468651Skris * nor may "OpenSSL" appear in their names without prior written 8568651Skris * permission of the OpenSSL Project. 8668651Skris * 8768651Skris * 6. Redistributions of any form whatsoever must retain the following 8868651Skris * acknowledgment: 8968651Skris * "This product includes software developed by the OpenSSL Project 9068651Skris * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 9168651Skris * 9268651Skris * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 9368651Skris * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 9468651Skris * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 9568651Skris * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 9668651Skris * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 9768651Skris * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 9868651Skris * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 9968651Skris * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 10068651Skris * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 10168651Skris * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 10268651Skris * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 10368651Skris * OF THE POSSIBILITY OF SUCH DAMAGE. 10468651Skris * ==================================================================== 10568651Skris * 10668651Skris * This product includes cryptographic software written by Eric Young 10768651Skris * (eay@cryptsoft.com). This product includes software written by Tim 10868651Skris * Hudson (tjh@cryptsoft.com). 10968651Skris * 11068651Skris */ 11155714Skris 11255714Skris#ifndef HEADER_BN_LCL_H 113280297Sjkim# define HEADER_BN_LCL_H 11455714Skris 115280297Sjkim# include <openssl/bn.h> 116337982Sjkim# include "bn_int.h" 11755714Skris 11855714Skris#ifdef __cplusplus 11955714Skrisextern "C" { 12055714Skris#endif 12155714Skris 122280297Sjkim/*- 12368651Skris * BN_window_bits_for_exponent_size -- macro for sliding window mod_exp functions 12468651Skris * 12568651Skris * 12668651Skris * For window size 'w' (w >= 2) and a random 'b' bits exponent, 12768651Skris * the number of multiplications is a constant plus on average 12868651Skris * 12968651Skris * 2^(w-1) + (b-w)/(w+1); 13068651Skris * 13168651Skris * here 2^(w-1) is for precomputing the table (we actually need 13268651Skris * entries only for windows that have the lowest bit set), and 13368651Skris * (b-w)/(w+1) is an approximation for the expected number of 13468651Skris * w-bit windows, not counting the first one. 13568651Skris * 13668651Skris * Thus we should use 13768651Skris * 13868651Skris * w >= 6 if b > 671 13968651Skris * w = 5 if 671 > b > 239 14068651Skris * w = 4 if 239 > b > 79 14168651Skris * w = 3 if 79 > b > 23 14268651Skris * w <= 2 if 23 > b 14368651Skris * 14468651Skris * (with draws in between). Very small exponents are often selected 14568651Skris * with low Hamming weight, so we use w = 1 for b <= 23. 14668651Skris */ 147280297Sjkim# if 1 148280297Sjkim# define BN_window_bits_for_exponent_size(b) \ 149280297Sjkim ((b) > 671 ? 6 : \ 150280297Sjkim (b) > 239 ? 5 : \ 151280297Sjkim (b) > 79 ? 4 : \ 152280297Sjkim (b) > 23 ? 3 : 1) 153280297Sjkim# else 154280297Sjkim/* 155280297Sjkim * Old SSLeay/OpenSSL table. Maximum window size was 5, so this table differs 156280297Sjkim * for b==1024; but it coincides for other interesting values (b==160, 157280297Sjkim * b==512). 15868651Skris */ 159280297Sjkim# define BN_window_bits_for_exponent_size(b) \ 160280297Sjkim ((b) > 255 ? 5 : \ 161280297Sjkim (b) > 127 ? 4 : \ 162280297Sjkim (b) > 17 ? 3 : 1) 163280297Sjkim# endif 16468651Skris 165280297Sjkim/* 166280297Sjkim * BN_mod_exp_mont_conttime is based on the assumption that the L1 data cache 167280297Sjkim * line width of the target processor is at least the following value. 168160814Ssimon */ 169280297Sjkim# define MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH ( 64 ) 170280297Sjkim# define MOD_EXP_CTIME_MIN_CACHE_LINE_MASK (MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH - 1) 171160814Ssimon 172280297Sjkim/* 173280297Sjkim * Window sizes optimized for fixed window size modular exponentiation 174280297Sjkim * algorithm (BN_mod_exp_mont_consttime). To achieve the security goals of 175280297Sjkim * BN_mode_exp_mont_consttime, the maximum size of the window must not exceed 176280297Sjkim * log_2(MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH). Window size thresholds are 177280297Sjkim * defined for cache line sizes of 32 and 64, cache line sizes where 178280297Sjkim * log_2(32)=5 and log_2(64)=6 respectively. A window size of 7 should only be 179280297Sjkim * used on processors that have a 128 byte or greater cache line size. 180160814Ssimon */ 181280297Sjkim# if MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH == 64 182160814Ssimon 183160814Ssimon# define BN_window_bits_for_ctime_exponent_size(b) \ 184280297Sjkim ((b) > 937 ? 6 : \ 185280297Sjkim (b) > 306 ? 5 : \ 186280297Sjkim (b) > 89 ? 4 : \ 187280297Sjkim (b) > 22 ? 3 : 1) 188280297Sjkim# define BN_MAX_WINDOW_BITS_FOR_CTIME_EXPONENT_SIZE (6) 189160814Ssimon 190280297Sjkim# elif MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH == 32 191160814Ssimon 192160814Ssimon# define BN_window_bits_for_ctime_exponent_size(b) \ 193280297Sjkim ((b) > 306 ? 5 : \ 194280297Sjkim (b) > 89 ? 4 : \ 195280297Sjkim (b) > 22 ? 3 : 1) 196280297Sjkim# define BN_MAX_WINDOW_BITS_FOR_CTIME_EXPONENT_SIZE (5) 197160814Ssimon 198280297Sjkim# endif 199160814Ssimon 20055714Skris/* Pentium pro 16,16,16,32,64 */ 20155714Skris/* Alpha 16,16,16,16.64 */ 202280297Sjkim# define BN_MULL_SIZE_NORMAL (16)/* 32 */ 203280297Sjkim# define BN_MUL_RECURSIVE_SIZE_NORMAL (16)/* 32 less than */ 204280297Sjkim# define BN_SQR_RECURSIVE_SIZE_NORMAL (16)/* 32 */ 205280297Sjkim# define BN_MUL_LOW_RECURSIVE_SIZE_NORMAL (32)/* 32 */ 206280297Sjkim# define BN_MONT_CTX_SET_SIZE_WORD (64)/* 32 */ 20755714Skris 208290207Sjkim/* 209290207Sjkim * 2011-02-22 SMS. In various places, a size_t variable or a type cast to 210290207Sjkim * size_t was used to perform integer-only operations on pointers. This 211290207Sjkim * failed on VMS with 64-bit pointers (CC /POINTER_SIZE = 64) because size_t 212290207Sjkim * is still only 32 bits. What's needed in these cases is an integer type 213290207Sjkim * with the same size as a pointer, which size_t is not certain to be. The 214290207Sjkim * only fix here is VMS-specific. 215290207Sjkim */ 216290207Sjkim# if defined(OPENSSL_SYS_VMS) 217290207Sjkim# if __INITIAL_POINTER_SIZE == 64 218290207Sjkim# define PTR_SIZE_INT long long 219290207Sjkim# else /* __INITIAL_POINTER_SIZE == 64 */ 220290207Sjkim# define PTR_SIZE_INT int 221290207Sjkim# endif /* __INITIAL_POINTER_SIZE == 64 [else] */ 222290207Sjkim# elif !defined(PTR_SIZE_INT) /* defined(OPENSSL_SYS_VMS) */ 223290207Sjkim# define PTR_SIZE_INT size_t 224290207Sjkim# endif /* defined(OPENSSL_SYS_VMS) [else] */ 225290207Sjkim 226280297Sjkim# if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM) && !defined(PEDANTIC) 22759191Skris/* 22859191Skris * BN_UMULT_HIGH section. 22959191Skris * 23059191Skris * No, I'm not trying to overwhelm you when stating that the 23159191Skris * product of N-bit numbers is 2*N bits wide:-) No, I don't expect 23259191Skris * you to be impressed when I say that if the compiler doesn't 23359191Skris * support 2*N integer type, then you have to replace every N*N 23459191Skris * multiplication with 4 (N/2)*(N/2) accompanied by some shifts 23559191Skris * and additions which unavoidably results in severe performance 23659191Skris * penalties. Of course provided that the hardware is capable of 23759191Skris * producing 2*N result... That's when you normally start 23859191Skris * considering assembler implementation. However! It should be 23959191Skris * pointed out that some CPUs (most notably Alpha, PowerPC and 24059191Skris * upcoming IA-64 family:-) provide *separate* instruction 24159191Skris * calculating the upper half of the product placing the result 24259191Skris * into a general purpose register. Now *if* the compiler supports 24359191Skris * inline assembler, then it's not impossible to implement the 24459191Skris * "bignum" routines (and have the compiler optimize 'em) 24559191Skris * exhibiting "native" performance in C. That's what BN_UMULT_HIGH 24659191Skris * macro is about:-) 24759191Skris * 248280297Sjkim * <appro@fy.chalmers.se> 24959191Skris */ 250280297Sjkim# if defined(__alpha) && (defined(SIXTY_FOUR_BIT_LONG) || defined(SIXTY_FOUR_BIT)) 251280297Sjkim# if defined(__DECC) 252280297Sjkim# include <c_asm.h> 253280297Sjkim# define BN_UMULT_HIGH(a,b) (BN_ULONG)asm("umulh %a0,%a1,%v0",(a),(b)) 254280297Sjkim# elif defined(__GNUC__) && __GNUC__>=2 255280297Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 256280297Sjkim register BN_ULONG ret; \ 257280297Sjkim asm ("umulh %1,%2,%0" \ 258280297Sjkim : "=r"(ret) \ 259280297Sjkim : "r"(a), "r"(b)); \ 260280297Sjkim ret; }) 261280297Sjkim# endif /* compiler */ 262280297Sjkim# elif defined(_ARCH_PPC) && defined(__64BIT__) && defined(SIXTY_FOUR_BIT_LONG) 263280297Sjkim# if defined(__GNUC__) && __GNUC__>=2 264280297Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 265280297Sjkim register BN_ULONG ret; \ 266280297Sjkim asm ("mulhdu %0,%1,%2" \ 267280297Sjkim : "=r"(ret) \ 268280297Sjkim : "r"(a), "r"(b)); \ 269280297Sjkim ret; }) 270280297Sjkim# endif /* compiler */ 271280297Sjkim# elif (defined(__x86_64) || defined(__x86_64__)) && \ 272238405Sjkim (defined(SIXTY_FOUR_BIT_LONG) || defined(SIXTY_FOUR_BIT)) 273280297Sjkim# if defined(__GNUC__) && __GNUC__>=2 274280297Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 275280297Sjkim register BN_ULONG ret,discard; \ 276280297Sjkim asm ("mulq %3" \ 277280297Sjkim : "=a"(discard),"=d"(ret) \ 278280297Sjkim : "a"(a), "g"(b) \ 279280297Sjkim : "cc"); \ 280280297Sjkim ret; }) 281280297Sjkim# define BN_UMULT_LOHI(low,high,a,b) \ 282280297Sjkim asm ("mulq %3" \ 283280297Sjkim : "=a"(low),"=d"(high) \ 284280297Sjkim : "a"(a),"g"(b) \ 285280297Sjkim : "cc"); 286280297Sjkim# endif 287280297Sjkim# elif (defined(_M_AMD64) || defined(_M_X64)) && defined(SIXTY_FOUR_BIT) 288280297Sjkim# if defined(_MSC_VER) && _MSC_VER>=1400 289280297Sjkimunsigned __int64 __umulh(unsigned __int64 a, unsigned __int64 b); 290280297Sjkimunsigned __int64 _umul128(unsigned __int64 a, unsigned __int64 b, 291280297Sjkim unsigned __int64 *h); 292280297Sjkim# pragma intrinsic(__umulh,_umul128) 293280297Sjkim# define BN_UMULT_HIGH(a,b) __umulh((a),(b)) 294280297Sjkim# define BN_UMULT_LOHI(low,high,a,b) ((low)=_umul128((a),(b),&(high))) 295280297Sjkim# endif 296280297Sjkim# elif defined(__mips) && (defined(SIXTY_FOUR_BIT) || defined(SIXTY_FOUR_BIT_LONG)) 297280297Sjkim# if defined(__GNUC__) && __GNUC__>=2 298284283Sjkim# if __GNUC__>4 || (__GNUC__>=4 && __GNUC_MINOR__>=4) 299280297Sjkim /* "h" constraint is no more since 4.4 */ 300280297Sjkim# define BN_UMULT_HIGH(a,b) (((__uint128_t)(a)*(b))>>64) 301280297Sjkim# define BN_UMULT_LOHI(low,high,a,b) ({ \ 302280297Sjkim __uint128_t ret=(__uint128_t)(a)*(b); \ 303280297Sjkim (high)=ret>>64; (low)=ret; }) 304280297Sjkim# else 305280297Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 306280297Sjkim register BN_ULONG ret; \ 307280297Sjkim asm ("dmultu %1,%2" \ 308280297Sjkim : "=h"(ret) \ 309280297Sjkim : "r"(a), "r"(b) : "l"); \ 310280297Sjkim ret; }) 311246772Sjkim# define BN_UMULT_LOHI(low,high,a,b)\ 312280297Sjkim asm ("dmultu %2,%3" \ 313280297Sjkim : "=l"(low),"=h"(high) \ 314280297Sjkim : "r"(a), "r"(b)); 315246772Sjkim# endif 316280297Sjkim# endif 317290207Sjkim# elif defined(__aarch64__) && defined(SIXTY_FOUR_BIT_LONG) 318290207Sjkim# if defined(__GNUC__) && __GNUC__>=2 319290207Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 320290207Sjkim register BN_ULONG ret; \ 321290207Sjkim asm ("umulh %0,%1,%2" \ 322290207Sjkim : "=r"(ret) \ 323290207Sjkim : "r"(a), "r"(b)); \ 324290207Sjkim ret; }) 325290207Sjkim# endif 326280297Sjkim# endif /* cpu */ 327280297Sjkim# endif /* OPENSSL_NO_ASM */ 32855714Skris 32955714Skris/************************************************************* 33055714Skris * Using the long long type 33155714Skris */ 332280297Sjkim# define Lw(t) (((BN_ULONG)(t))&BN_MASK2) 333280297Sjkim# define Hw(t) (((BN_ULONG)((t)>>BN_BITS2))&BN_MASK2) 33455714Skris 335280297Sjkim# ifdef BN_DEBUG_RAND 336280297Sjkim# define bn_clear_top2max(a) \ 337280297Sjkim { \ 338280297Sjkim int ind = (a)->dmax - (a)->top; \ 339280297Sjkim BN_ULONG *ftl = &(a)->d[(a)->top-1]; \ 340280297Sjkim for (; ind != 0; ind--) \ 341280297Sjkim *(++ftl) = 0x0; \ 342280297Sjkim } 343280297Sjkim# else 344280297Sjkim# define bn_clear_top2max(a) 345280297Sjkim# endif 34655714Skris 347280297Sjkim# ifdef BN_LLONG 348280297Sjkim# define mul_add(r,a,w,c) { \ 349280297Sjkim BN_ULLONG t; \ 350280297Sjkim t=(BN_ULLONG)w * (a) + (r) + (c); \ 351280297Sjkim (r)= Lw(t); \ 352280297Sjkim (c)= Hw(t); \ 353280297Sjkim } 35455714Skris 355280297Sjkim# define mul(r,a,w,c) { \ 356280297Sjkim BN_ULLONG t; \ 357280297Sjkim t=(BN_ULLONG)w * (a) + (c); \ 358280297Sjkim (r)= Lw(t); \ 359280297Sjkim (c)= Hw(t); \ 360280297Sjkim } 36155714Skris 362280297Sjkim# define sqr(r0,r1,a) { \ 363280297Sjkim BN_ULLONG t; \ 364280297Sjkim t=(BN_ULLONG)(a)*(a); \ 365280297Sjkim (r0)=Lw(t); \ 366280297Sjkim (r1)=Hw(t); \ 367280297Sjkim } 36859191Skris 369280297Sjkim# elif defined(BN_UMULT_LOHI) 370280297Sjkim# define mul_add(r,a,w,c) { \ 371280297Sjkim BN_ULONG high,low,ret,tmp=(a); \ 372280297Sjkim ret = (r); \ 373280297Sjkim BN_UMULT_LOHI(low,high,w,tmp); \ 374280297Sjkim ret += (c); \ 375280297Sjkim (c) = (ret<(c))?1:0; \ 376280297Sjkim (c) += high; \ 377280297Sjkim ret += low; \ 378280297Sjkim (c) += (ret<low)?1:0; \ 379280297Sjkim (r) = ret; \ 380280297Sjkim } 381160814Ssimon 382280297Sjkim# define mul(r,a,w,c) { \ 383280297Sjkim BN_ULONG high,low,ret,ta=(a); \ 384280297Sjkim BN_UMULT_LOHI(low,high,w,ta); \ 385280297Sjkim ret = low + (c); \ 386280297Sjkim (c) = high; \ 387280297Sjkim (c) += (ret<low)?1:0; \ 388280297Sjkim (r) = ret; \ 389280297Sjkim } 390160814Ssimon 391280297Sjkim# define sqr(r0,r1,a) { \ 392280297Sjkim BN_ULONG tmp=(a); \ 393280297Sjkim BN_UMULT_LOHI(r0,r1,tmp,tmp); \ 394280297Sjkim } 395160814Ssimon 396280297Sjkim# elif defined(BN_UMULT_HIGH) 397280297Sjkim# define mul_add(r,a,w,c) { \ 398280297Sjkim BN_ULONG high,low,ret,tmp=(a); \ 399280297Sjkim ret = (r); \ 400280297Sjkim high= BN_UMULT_HIGH(w,tmp); \ 401280297Sjkim ret += (c); \ 402280297Sjkim low = (w) * tmp; \ 403280297Sjkim (c) = (ret<(c))?1:0; \ 404280297Sjkim (c) += high; \ 405280297Sjkim ret += low; \ 406280297Sjkim (c) += (ret<low)?1:0; \ 407280297Sjkim (r) = ret; \ 408280297Sjkim } 40959191Skris 410280297Sjkim# define mul(r,a,w,c) { \ 411280297Sjkim BN_ULONG high,low,ret,ta=(a); \ 412280297Sjkim low = (w) * ta; \ 413280297Sjkim high= BN_UMULT_HIGH(w,ta); \ 414280297Sjkim ret = low + (c); \ 415280297Sjkim (c) = high; \ 416280297Sjkim (c) += (ret<low)?1:0; \ 417280297Sjkim (r) = ret; \ 418280297Sjkim } 41959191Skris 420280297Sjkim# define sqr(r0,r1,a) { \ 421280297Sjkim BN_ULONG tmp=(a); \ 422280297Sjkim (r0) = tmp * tmp; \ 423280297Sjkim (r1) = BN_UMULT_HIGH(tmp,tmp); \ 424280297Sjkim } 42559191Skris 426280297Sjkim# else 42755714Skris/************************************************************* 42855714Skris * No long long type 42955714Skris */ 43055714Skris 431280297Sjkim# define LBITS(a) ((a)&BN_MASK2l) 432280297Sjkim# define HBITS(a) (((a)>>BN_BITS4)&BN_MASK2l) 433280297Sjkim# define L2HBITS(a) (((a)<<BN_BITS4)&BN_MASK2) 43455714Skris 435280297Sjkim# define LLBITS(a) ((a)&BN_MASKl) 436280297Sjkim# define LHBITS(a) (((a)>>BN_BITS2)&BN_MASKl) 437280297Sjkim# define LL2HBITS(a) ((BN_ULLONG)((a)&BN_MASKl)<<BN_BITS2) 43855714Skris 439280297Sjkim# define mul64(l,h,bl,bh) \ 440280297Sjkim { \ 441280297Sjkim BN_ULONG m,m1,lt,ht; \ 44255714Skris \ 443280297Sjkim lt=l; \ 444280297Sjkim ht=h; \ 445280297Sjkim m =(bh)*(lt); \ 446280297Sjkim lt=(bl)*(lt); \ 447280297Sjkim m1=(bl)*(ht); \ 448280297Sjkim ht =(bh)*(ht); \ 449280297Sjkim m=(m+m1)&BN_MASK2; if (m < m1) ht+=L2HBITS((BN_ULONG)1); \ 450280297Sjkim ht+=HBITS(m); \ 451280297Sjkim m1=L2HBITS(m); \ 452280297Sjkim lt=(lt+m1)&BN_MASK2; if (lt < m1) ht++; \ 453280297Sjkim (l)=lt; \ 454280297Sjkim (h)=ht; \ 455280297Sjkim } 45655714Skris 457280297Sjkim# define sqr64(lo,ho,in) \ 458280297Sjkim { \ 459280297Sjkim BN_ULONG l,h,m; \ 46055714Skris \ 461280297Sjkim h=(in); \ 462280297Sjkim l=LBITS(h); \ 463280297Sjkim h=HBITS(h); \ 464280297Sjkim m =(l)*(h); \ 465280297Sjkim l*=l; \ 466280297Sjkim h*=h; \ 467280297Sjkim h+=(m&BN_MASK2h1)>>(BN_BITS4-1); \ 468280297Sjkim m =(m&BN_MASK2l)<<(BN_BITS4+1); \ 469280297Sjkim l=(l+m)&BN_MASK2; if (l < m) h++; \ 470280297Sjkim (lo)=l; \ 471280297Sjkim (ho)=h; \ 472280297Sjkim } 47355714Skris 474280297Sjkim# define mul_add(r,a,bl,bh,c) { \ 475280297Sjkim BN_ULONG l,h; \ 47655714Skris \ 477280297Sjkim h= (a); \ 478280297Sjkim l=LBITS(h); \ 479280297Sjkim h=HBITS(h); \ 480280297Sjkim mul64(l,h,(bl),(bh)); \ 48155714Skris \ 482280297Sjkim /* non-multiply part */ \ 483280297Sjkim l=(l+(c))&BN_MASK2; if (l < (c)) h++; \ 484280297Sjkim (c)=(r); \ 485280297Sjkim l=(l+(c))&BN_MASK2; if (l < (c)) h++; \ 486280297Sjkim (c)=h&BN_MASK2; \ 487280297Sjkim (r)=l; \ 488280297Sjkim } 48955714Skris 490280297Sjkim# define mul(r,a,bl,bh,c) { \ 491280297Sjkim BN_ULONG l,h; \ 49255714Skris \ 493280297Sjkim h= (a); \ 494280297Sjkim l=LBITS(h); \ 495280297Sjkim h=HBITS(h); \ 496280297Sjkim mul64(l,h,(bl),(bh)); \ 49755714Skris \ 498280297Sjkim /* non-multiply part */ \ 499280297Sjkim l+=(c); if ((l&BN_MASK2) < (c)) h++; \ 500280297Sjkim (c)=h&BN_MASK2; \ 501280297Sjkim (r)=l&BN_MASK2; \ 502280297Sjkim } 503280297Sjkim# endif /* !BN_LLONG */ 50455714Skris 505280297Sjkim# if defined(OPENSSL_DOING_MAKEDEPEND) && defined(OPENSSL_FIPS) 506280297Sjkim# undef bn_div_words 507280297Sjkim# endif 508238405Sjkim 509280297Sjkimvoid bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb); 510280297Sjkimvoid bn_mul_comba8(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b); 511280297Sjkimvoid bn_mul_comba4(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b); 512109998Smarkmvoid bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp); 513280297Sjkimvoid bn_sqr_comba8(BN_ULONG *r, const BN_ULONG *a); 514280297Sjkimvoid bn_sqr_comba4(BN_ULONG *r, const BN_ULONG *a); 515280297Sjkimint bn_cmp_words(const BN_ULONG *a, const BN_ULONG *b, int n); 516280297Sjkimint bn_cmp_part_words(const BN_ULONG *a, const BN_ULONG *b, int cl, int dl); 517280297Sjkimvoid bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2, 518280297Sjkim int dna, int dnb, BN_ULONG *t); 519280297Sjkimvoid bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, 520280297Sjkim int n, int tna, int tnb, BN_ULONG *t); 521280297Sjkimvoid bn_sqr_recursive(BN_ULONG *r, const BN_ULONG *a, int n2, BN_ULONG *t); 522280297Sjkimvoid bn_mul_low_normal(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n); 523280297Sjkimvoid bn_mul_low_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2, 524280297Sjkim BN_ULONG *t); 525280297Sjkimvoid bn_mul_high(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, BN_ULONG *l, int n2, 526280297Sjkim BN_ULONG *t); 527160814SsimonBN_ULONG bn_add_part_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, 528280297Sjkim int cl, int dl); 529160814SsimonBN_ULONG bn_sub_part_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, 530280297Sjkim int cl, int dl); 531280297Sjkimint bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp, 532280297Sjkim const BN_ULONG *np, const BN_ULONG *n0, int num); 53355714Skris 53455714Skris#ifdef __cplusplus 53555714Skris} 53655714Skris#endif 53755714Skris 53855714Skris#endif 539