Move the more readable version of bn_mul_mont() from bn_asm.c to bn_mont.c.

Nothing actually uses this code, as OPENSSL_BN_ASM_MONT is not defined
unless there is an assembly implementation available (not to mention that
defining both OPENSSL_NO_ASM and OPENSSL_BN_ASM_MONT at the same time is
extra strange).

Discussed with tb@

2 files changed, 55 insertions, 168 deletions

diff --git a/src/lib/libcrypto/bn/bn_asm.c b/src/lib/libcrypto/bn/bn_asm.c
index e2b584ee85..bfdeabd9eb 100644
--- a/src/lib/libcrypto/bn/bn_asm.c
+++ b/src/lib/libcrypto/bn/bn_asm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bn_asm.c,v 1.23 2023/01/23 12:17:57 jsing Exp $ */
+/* $OpenBSD: bn_asm.c,v 1.24 2023/01/28 17:07:02 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -63,169 +63,3 @@
 
 #include "bn_local.h"
 
-#if defined(BN_MUL_COMBA) && !defined(OPENSSL_SMALL_FOOTPRINT)
-
-#ifdef OPENSSL_NO_ASM
-#ifdef OPENSSL_BN_ASM_MONT
-/*
- * This is essentially reference implementation, which may or may not
- * result in performance improvement. E.g. on IA-32 this routine was
- * observed to give 40% faster rsa1024 private key operations and 10%
- * faster rsa4096 ones, while on AMD64 it improves rsa1024 sign only
- * by 10% and *worsens* rsa4096 sign by 15%. Once again, it's a
- * reference implementation, one to be used as starting point for
- * platform-specific assembler. Mentioned numbers apply to compiler
- * generated code compiled with and without -DOPENSSL_BN_ASM_MONT and
- * can vary not only from platform to platform, but even for compiler
- * versions. Assembler vs. assembler improvement coefficients can
- * [and are known to] differ and are to be documented elsewhere.
- */
-int
-bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp, const BN_ULONG *np, const BN_ULONG *n0p, int num)
-{
-        BN_ULONG c0, c1, ml, *tp, n0;
-#ifdef mul64
-        BN_ULONG mh;
-#endif
-        int i = 0, j;
-
-#if 0   /* template for platform-specific implementation */
-        if (ap == bp)
-                return bn_sqr_mont(rp, ap, np, n0p, num);
-#endif
-        tp = reallocarray(NULL, num + 2, sizeof(BN_ULONG));
-        if (tp == NULL)
-                return 0;
-
-        n0 = *n0p;
-
-        c0 = 0;
-        ml = bp[0];
-#ifdef mul64
-        mh = HBITS(ml);
-        ml = LBITS(ml);
-        for (j = 0; j < num; ++j)
-                mul(tp[j], ap[j], ml, mh, c0);
-#else
-        for (j = 0; j < num; ++j)
-                mul(tp[j], ap[j], ml, c0);
-#endif
-
-        tp[num] = c0;
-        tp[num + 1] = 0;
-        goto enter;
-
-        for (i = 0; i < num; i++) {
-                c0 = 0;
-                ml = bp[i];
-#ifdef mul64
-                mh = HBITS(ml);
-                ml = LBITS(ml);
-                for (j = 0; j < num; ++j)
-                        mul_add(tp[j], ap[j], ml, mh, c0);
-#else
-                for (j = 0; j < num; ++j)
-                        mul_add(tp[j], ap[j], ml, c0);
-#endif
-                c1 = (tp[num] + c0) & BN_MASK2;
-                tp[num] = c1;
-                tp[num + 1] = (c1 < c0 ? 1 : 0);
-enter:
-                c1 = tp[0];
-                ml = (c1 * n0) & BN_MASK2;
-                c0 = 0;
-#ifdef mul64
-                mh = HBITS(ml);
-                ml = LBITS(ml);
-                mul_add(c1, np[0], ml, mh, c0);
-#else
-                mul_add(c1, ml, np[0], c0);
-#endif
-                for (j = 1; j < num; j++) {
-                        c1 = tp[j];
-#ifdef mul64
-                        mul_add(c1, np[j], ml, mh, c0);
-#else
-                        mul_add(c1, ml, np[j], c0);
-#endif
-                        tp[j - 1] = c1 & BN_MASK2;
-                }
-                c1 = (tp[num] + c0) & BN_MASK2;
-                tp[num - 1] = c1;
-                tp[num] = tp[num + 1] + (c1 < c0 ? 1 : 0);
-        }
-
-        if (tp[num] != 0 || tp[num - 1] >= np[num - 1]) {
-                c0 = bn_sub_words(rp, tp, np, num);
-                if (tp[num] != 0 || c0 == 0) {
-                        goto out;
-                }
-        }
-        memcpy(rp, tp, num * sizeof(BN_ULONG));
-out:
-        freezero(tp, (num + 2) * sizeof(BN_ULONG));
-        return 1;
-}
-#else
-/*
- * Return value of 0 indicates that multiplication/convolution was not
- * performed to signal the caller to fall down to alternative/original
- * code-path.
- */
-int bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp, const BN_ULONG *np, const BN_ULONG *n0, int num)
-        {       return 0;
-}
-#endif /* OPENSSL_BN_ASM_MONT */
-#endif
-
-#else /* !BN_MUL_COMBA */
-
-#ifdef OPENSSL_NO_ASM
-#ifdef OPENSSL_BN_ASM_MONT
-int
-bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-    const BN_ULONG *np, const BN_ULONG *n0p, int num)
-{
-        BN_ULONG c0, c1, *tp, n0 = *n0p;
-        int i = 0, j;
-
-        tp = calloc(NULL, num + 2, sizeof(BN_ULONG));
-        if (tp == NULL)
-                return 0;
-
-        for (i = 0; i < num; i++) {
-                c0 = bn_mul_add_words(tp, ap, num, bp[i]);
-                c1 = (tp[num] + c0) & BN_MASK2;
-                tp[num] = c1;
-                tp[num + 1] = (c1 < c0 ? 1 : 0);
-
-                c0 = bn_mul_add_words(tp, np, num, tp[0] * n0);
-                c1 = (tp[num] + c0) & BN_MASK2;
-                tp[num] = c1;
-                tp[num + 1] += (c1 < c0 ? 1 : 0);
-                for (j = 0; j <= num; j++)
-                        tp[j] = tp[j + 1];
-        }
-
-        if (tp[num] != 0 || tp[num - 1] >= np[num - 1]) {
-                c0 = bn_sub_words(rp, tp, np, num);
-                if (tp[num] != 0 || c0 == 0) {
-                        goto out;
-                }
-        }
-        memcpy(rp, tp, num * sizeof(BN_ULONG));
-out:
-        freezero(tp, (num + 2) * sizeof(BN_ULONG));
-        return 1;
-}
-#else
-int
-bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
-    const BN_ULONG *np, const BN_ULONG *n0, int num)
-{
-        return 0;
-}
-#endif /* OPENSSL_BN_ASM_MONT */
-#endif
-
-#endif /* !BN_MUL_COMBA */
diff --git a/src/lib/libcrypto/bn/bn_mont.c b/src/lib/libcrypto/bn/bn_mont.c
index f8b870266c..8b364ff716 100644
--- a/src/lib/libcrypto/bn/bn_mont.c
+++ b/src/lib/libcrypto/bn/bn_mont.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bn_mont.c,v 1.33 2023/01/16 16:53:19 jsing Exp $ */
+/* $OpenBSD: bn_mont.c,v 1.34 2023/01/28 17:07:02 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -121,6 +121,59 @@
 
 #include "bn_local.h"
 
+#ifdef OPENSSL_NO_ASM
+#ifdef OPENSSL_BN_ASM_MONT
+int
+bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
+    const BN_ULONG *np, const BN_ULONG *n0p, int num)
+{
+        BN_ULONG c0, c1, *tp, n0 = *n0p;
+        int i = 0, j;
+
+        tp = calloc(NULL, num + 2, sizeof(BN_ULONG));
+        if (tp == NULL)
+                return 0;
+
+        for (i = 0; i < num; i++) {
+                c0 = bn_mul_add_words(tp, ap, num, bp[i]);
+                c1 = (tp[num] + c0) & BN_MASK2;
+                tp[num] = c1;
+                tp[num + 1] = (c1 < c0 ? 1 : 0);
+
+                c0 = bn_mul_add_words(tp, np, num, tp[0] * n0);
+                c1 = (tp[num] + c0) & BN_MASK2;
+                tp[num] = c1;
+                tp[num + 1] += (c1 < c0 ? 1 : 0);
+                for (j = 0; j <= num; j++)
+                        tp[j] = tp[j + 1];
+        }
+
+        if (tp[num] != 0 || tp[num - 1] >= np[num - 1]) {
+                c0 = bn_sub_words(rp, tp, np, num);
+                if (tp[num] != 0 || c0 == 0) {
+                        goto out;
+                }
+        }
+        memcpy(rp, tp, num * sizeof(BN_ULONG));
+out:
+        freezero(tp, (num + 2) * sizeof(BN_ULONG));
+        return 1;
+}
+#else /* !OPENSSL_BN_ASM_MONT */
+int
+bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
+    const BN_ULONG *np, const BN_ULONG *n0, int num)
+{
+        /*
+         * Return value of 0 indicates that multiplication/convolution was not
+         * performed to signal the caller to fall down to alternative/original
+         * code-path.
+         */
+        return 0;
+}
+#endif /* !OPENSSL_BN_ASM_MONT */
+#endif /* OPENSSL_NO_ASM */
+
 #define MONT_WORD /* use the faster word-based algorithm */
 
 #ifdef MONT_WORD