_ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEmEET_S2_:
   28|   128M|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) {
   29|   128M|   const T top = CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1));
   30|   128M|   return static_cast<T>(0) - top;
   31|   128M|}
_ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEmEET_S2_:
   37|  91.2M|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) {
   38|  91.2M|   return ct_expand_top_bit<T>(~x & (x - 1));
   39|  91.2M|}
_ZN5Botan6chooseITkNSt3__117unsigned_integralEmEET_S2_S2_S2_:
  217|   142M|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) {
  218|       |   //return (mask & a) | (~mask & b);
  219|   142M|   return (b ^ (mask & (a ^ b)));
  220|   142M|}
_ZN5Botan17ct_if_is_zero_retITkNSt3__117unsigned_integralEmEEmT_m:
   45|  45.4k|BOTAN_FORCE_INLINE constexpr size_t ct_if_is_zero_ret(T x, size_t s) {
   46|       |   /*
   47|       |   Similar to `return ct_is_zero(x) & s` but has to account for possibility that
   48|       |   sizeof(T) is smaller than sizeof(size_t) which would lead to incomplete masking
   49|       |   */
   50|  45.4k|   const T a = ~x & (x - 1);
   51|  45.4k|   const size_t a_top = static_cast<size_t>(CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1)));
   52|  45.4k|   const size_t mask = static_cast<size_t>(0) - a_top;
   53|  45.4k|   return mask & s;
   54|  45.4k|}
_ZN5Botan8high_bitITkNSt3__117unsigned_integralEmEEmT_:
   73|  7.57k|BOTAN_FORCE_INLINE constexpr size_t high_bit(T n) {
   74|  7.57k|   size_t hb = 0;
   75|       |
   76|  53.0k|   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
  ------------------
  |  Branch (76:38): [True: 45.4k, False: 7.57k]
  ------------------
   77|       |      // Equivalent to: ((n >> s) == 0) ? 0 : s;
   78|  45.4k|      const size_t z = s - ct_if_is_zero_ret<T>(n >> s, s);
   79|  45.4k|      hb += z;
   80|  45.4k|      n >>= z;
   81|  45.4k|   }
   82|       |
   83|  7.57k|   hb += static_cast<size_t>(n);
   84|       |
   85|  7.57k|   return hb;
   86|  7.57k|}
_ZN5Botan13ceil_divisionITkNSt3__117unsigned_integralEmEET_S2_S2_:
  167|  3.20k|BOTAN_FORCE_INLINE constexpr T ceil_division(T a, T b) {
  168|       |   // Same as `(a + b - 1) / b` but avoids possible overflow
  169|  3.20k|   return a / b + ((a % b != 0) ? 1 : 0);
  ------------------
  |  Branch (169:20): [True: 2.89k, False: 309]
  ------------------
  170|  3.20k|}
_ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEhEET_S2_:
   37|   160k|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) {
   38|   160k|   return ct_expand_top_bit<T>(~x & (x - 1));
   39|   160k|}
_ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEhEET_S2_:
   28|   160k|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) {
   29|   160k|   const T top = CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1));
   30|   160k|   return static_cast<T>(0) - top;
   31|   160k|}
_ZN5Botan6chooseITkNSt3__117unsigned_integralEhEET_S2_S2_S2_:
  217|   160k|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) {
  218|       |   //return (mask & a) | (~mask & b);
  219|   160k|   return (b ^ (mask & (a ^ b)));
  220|   160k|}

_ZN5Botan13reverse_bytesITkNSt3__117unsigned_integralEmQooooooeqstT_Li1EeqstS2_Li2EeqstS2_Li4EeqstS2_Li8EEES2_S2_:
   25|  25.6k|inline constexpr T reverse_bytes(T x) {
   26|       |   if constexpr(sizeof(T) == 1) {
   27|       |      return x;
   28|       |   } else if constexpr(sizeof(T) == 2) {
   29|       |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16)
   30|       |      return static_cast<T>(__builtin_bswap16(x));
   31|       |#else
   32|       |      return static_cast<T>((x << 8) | (x >> 8));
   33|       |#endif
   34|       |   } else if constexpr(sizeof(T) == 4) {
   35|       |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32)
   36|       |      return static_cast<T>(__builtin_bswap32(x));
   37|       |#else
   38|       |      // MSVC at least recognizes this as a bswap
   39|       |      return static_cast<T>(((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) |
   40|       |                            ((x & 0xFF000000) >> 24));
   41|       |#endif
   42|  25.6k|   } else if constexpr(sizeof(T) == 8) {
   43|  25.6k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64)
   44|  25.6k|      return static_cast<T>(__builtin_bswap64(x));
   45|       |#else
   46|       |      uint32_t hi = static_cast<uint32_t>(x >> 32);
   47|       |      uint32_t lo = static_cast<uint32_t>(x);
   48|       |
   49|       |      hi = reverse_bytes(hi);
   50|       |      lo = reverse_bytes(lo);
   51|       |
   52|       |      return (static_cast<T>(lo) << 32) | hi;
   53|       |#endif
   54|  25.6k|   }
   55|  25.6k|}

_ZN5Botan5CPUID3hasENS_10CPUFeatureES1_:
   98|   640k|      static bool has(CPUID::Feature feat1, CPUID::Feature feat2) {
   99|   640k|         return state().has_bit(feat1.as_u32() | feat2.as_u32());
  100|   640k|      }
_ZN5Botan5CPUID5stateEv:
  155|   641k|      static CPUID_Data& state() {
  156|   641k|         static CPUID::CPUID_Data g_cpuid;
  157|   641k|         return g_cpuid;
  158|   641k|      }
_ZNK5Botan5CPUID10CPUID_Data7has_bitEj:
  143|   641k|            bool has_bit(uint32_t bit) const { return (m_processor_features & bit) == bit; }
_ZN5Botan5CPUID3hasENS_10CPUFeatureE:
   93|    536|      static bool has(CPUID::Feature feat) { return state().has_bit(feat.as_u32()); }
_ZN5Botan5CPUID6is_setEjNS_10CPUFeatureE:
  126|      5|      static inline bool is_set(uint32_t allowed, CPUID::Feature bit) {
  127|      5|         const uint32_t feat_bit = bit.as_u32();
  128|      5|         return ((allowed & feat_bit) == feat_bit);
  129|      5|      }
cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE16x86_CPUID_1_bitsEEjmT_NS_10CPUFeatureEj:
  116|      7|      static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) {
  117|      7|         const uint64_t flag64 = static_cast<uint64_t>(flag);
  118|      7|         if((cpuid & flag64) == flag64) {
  ------------------
  |  Branch (118:13): [True: 7, False: 0]
  ------------------
  119|      7|            return (bit.as_u32() & allowed);
  120|      7|         } else {
  121|      0|            return 0;
  122|      0|         }
  123|      7|      }
cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE16x86_CPUID_7_bitsEEjmT_NS_10CPUFeatureEj:
  116|      8|      static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) {
  117|      8|         const uint64_t flag64 = static_cast<uint64_t>(flag);
  118|      8|         if((cpuid & flag64) == flag64) {
  ------------------
  |  Branch (118:13): [True: 5, False: 3]
  ------------------
  119|      5|            return (bit.as_u32() & allowed);
  120|      5|         } else {
  121|      3|            return 0;
  122|      3|         }
  123|      8|      }
cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE18x86_CPUID_7_1_bitsEEjmT_NS_10CPUFeatureEj:
  116|      3|      static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) {
  117|      3|         const uint64_t flag64 = static_cast<uint64_t>(flag);
  118|      3|         if((cpuid & flag64) == flag64) {
  ------------------
  |  Branch (118:13): [True: 0, False: 3]
  ------------------
  119|      0|            return (bit.as_u32() & allowed);
  120|      3|         } else {
  121|      3|            return 0;
  122|      3|         }
  123|      3|      }

_ZNK5Botan10CPUFeature6as_u32Ev:
   56|  1.28M|      uint32_t as_u32() const { return static_cast<uint32_t>(m_bit); }
_ZN5Botan10CPUFeatureC2ENS0_3BitE:
   54|  1.28M|      CPUFeature(Bit b) : m_bit(b) {}  // NOLINT(*-explicit-conversions,*-explicit-constructor)

_ZN5Botan2CT4MaskImE5is_gtEmm:
  458|   124k|      static constexpr Mask<T> is_gt(T x, T y) { return Mask<T>::is_lt(y, x); }
_ZN5Botan2CT4MaskImE5is_ltEmm:
  450|  37.4M|      static constexpr Mask<T> is_lt(T x, T y) {
  451|  37.4M|         T u = x ^ ((x ^ y) | ((x - y) ^ x));
  452|  37.4M|         return Mask<T>::expand_top_bit(u);
  453|  37.4M|      }
_ZN5Botan2CT4MaskImE14expand_top_bitEm:
  415|  37.6M|      static constexpr Mask<T> expand_top_bit(T v) { return Mask<T>(ct_expand_top_bit<T>(v)); }
_ZN5Botan2CT4MaskImEC2Em:
  637|   109M|      constexpr explicit Mask(T m) : m_mask(m) {}
_ZNK5Botan2CT4MaskImE13if_set_returnEm:
  538|  22.7M|      constexpr T if_set_return(T x) const { return value() & x; }
_ZNK5Botan2CT4MaskImE5valueEv:
  630|   140M|      constexpr T value() const { return value_barrier<T>(m_mask); }
_ZN5Botan2CT4MaskImE6is_gteEmm:
  468|   174k|      static constexpr Mask<T> is_gte(T x, T y) { return ~Mask<T>::is_lt(x, y); }
_ZNK5Botan2CT4MaskImEcoEv:
  533|  4.82M|      constexpr Mask<T> operator~() const { return Mask<T>(~value()); }
_ZN5Botan2CT6Choice9from_maskEm:
  303|  1.47M|      constexpr static Choice from_mask(underlying_type v) { return Choice(v); }
_ZNK5Botan2CT6ChoicentEv:
  309|  1.31M|      constexpr Choice operator!() const { return Choice(~value()); }
_ZNK5Botan2CT6ChoiceaaERKS1_:
  311|  1.31M|      constexpr Choice operator&&(const Choice& other) const { return Choice(value() & other.value()); }
_ZNK5Botan2CT6Choice7as_boolEv:
  329|  1.31M|      constexpr bool as_bool() const { return m_value != 0; }
_ZNK5Botan2CT6Choice5valueEv:
  332|  3.95M|      constexpr underlying_type value() const { return value_barrier(m_value); }
_ZN5Botan2CT6ChoiceC2Em:
  341|  5.27M|      constexpr explicit Choice(underlying_type v) : m_value(CT::value_barrier<underlying_type>(v)) {}
_ZN5Botan2CT4MaskImE7is_zeroEm:
  437|  46.1M|      static constexpr Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(value_barrier<T>(x))); }
_ZN5Botan2CT4MaskImE6expandEm:
  392|  4.07M|      static constexpr Mask<T> expand(T v) { return ~Mask<T>::is_zero(value_barrier<T>(v)); }
_ZNK5Botan2CT4MaskImE6selectEmm:
  548|  61.5M|      constexpr T select(T x, T y) const { return choose(value(), x, y); }
_ZN5Botan2CT8unpoisonImEEvPKT_m:
   67|  7.95M|constexpr inline void unpoison(const T* p, size_t n) {
   68|       |#if defined(BOTAN_HAS_VALGRIND)
   69|       |   if(!std::is_constant_evaluated()) {
   70|       |      VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T));
   71|       |   }
   72|       |#endif
   73|       |
   74|  7.95M|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  151|  7.95M|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   75|  7.95M|}
_ZN5Botan2CT8unpoisonITkNSt3__18integralEmEEvRKT_:
  112|  3.64M|constexpr void unpoison(const T& p) {
  113|  3.64M|   unpoison(&p, 1);
  114|  3.64M|}
_ZNK5Botan2CT4MaskImE16unpoisoned_valueEv:
  598|  1.48M|      constexpr T unpoisoned_value() const {
  599|  1.48M|         T r = value();
  600|  1.48M|         CT::unpoison(r);
  601|  1.48M|         return r;
  602|  1.48M|      }
_ZNK5Botan2CT4MaskImE9as_choiceEv:
  619|  1.47M|      constexpr CT::Choice as_choice() const {
  620|  1.47M|         if constexpr(sizeof(T) >= sizeof(Choice::underlying_type)) {
  621|  1.47M|            return CT::Choice::from_mask(static_cast<Choice::underlying_type>(unpoisoned_value()));
  622|       |         } else {
  623|       |            return CT::Choice::from_int(unpoisoned_value());
  624|       |         }
  625|  1.47M|      }
_ZN5Botan2CTorENS0_4MaskImEES2_:
  528|   224k|      friend constexpr Mask<T> operator|(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() | y.value()); }
_ZN5Botan2CT4MaskImE8is_equalEmm:
  442|  39.1M|      static constexpr Mask<T> is_equal(T x, T y) {
  443|  39.1M|         const T diff = value_barrier(x) ^ value_barrier(y);
  444|  39.1M|         return Mask<T>::is_zero(diff);
  445|  39.1M|      }
_ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES3_PS3_PKS3_S7_m:
  738|  1.48M|constexpr inline Mask<T> conditional_copy_mem(T cnd, T* dest, const T* if_set, const T* if_unset, size_t elems) {
  739|  1.48M|   const auto mask = CT::Mask<T>::expand(cnd);
  740|  1.48M|   return CT::conditional_copy_mem(mask, dest, if_set, if_unset, elems);
  741|  1.48M|}
_ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES4_PS3_PKS3_S7_m:
  732|  1.48M|constexpr inline Mask<T> conditional_copy_mem(Mask<T> mask, T* dest, const T* if_set, const T* if_unset, size_t elems) {
  733|  1.48M|   mask.select_n(dest, if_set, if_unset, elems);
  734|  1.48M|   return mask;
  735|  1.48M|}
_ZNK5Botan2CT4MaskImE8select_nEPmPKmS5_m:
  565|  4.33M|      constexpr void select_n(T output[], const T x[], const T y[], size_t len) const {
  566|  4.33M|         const T mask = value();
  567|  85.0M|         for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (567:28): [True: 80.7M, False: 4.33M]
  ------------------
  568|  80.7M|            output[i] = choose(mask, x[i], y[i]);
  569|  80.7M|         }
  570|  4.33M|      }
_ZNK5Botan2CT4MaskImE7as_boolEv:
  614|  2.55k|      constexpr bool as_bool() const { return unpoisoned_value() != 0; }
_ZNK5Botan2CT4MaskImE11select_maskES2_S2_:
  559|  20.8M|      Mask<T> select_mask(Mask<T> x, Mask<T> y) const { return Mask<T>(select(x.value(), y.value())); }
_ZN5Botan2CT4MaskImEoRES2_:
  510|  1.32k|      Mask<T>& operator|=(Mask<T> o) {
  511|  1.32k|         m_mask |= o.value();
  512|  1.32k|         return (*this);
  513|  1.32k|      }
_ZN5Botan2CT4MaskImEaNES2_:
  494|  1.15M|      Mask<T>& operator&=(Mask<T> o) {
  495|  1.15M|         m_mask &= o.value();
  496|  1.15M|         return (*this);
  497|  1.15M|      }
_ZN5Botan2CT4MaskImE11expand_boolEb:
  397|   160k|      static constexpr Mask<T> expand_bool(bool v) { return Mask<T>::expand(static_cast<T>(v)); }
_ZN5Botan2CT4MaskIhE11expand_boolEb:
  397|   160k|      static constexpr Mask<T> expand_bool(bool v) { return Mask<T>::expand(static_cast<T>(v)); }
_ZN5Botan2CT4MaskIhE6expandEh:
  392|   160k|      static constexpr Mask<T> expand(T v) { return ~Mask<T>::is_zero(value_barrier<T>(v)); }
_ZN5Botan2CT4MaskIhE7is_zeroEh:
  437|   160k|      static constexpr Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(value_barrier<T>(x))); }
_ZN5Botan2CT4MaskIhEC2Eh:
  637|   320k|      constexpr explicit Mask(T m) : m_mask(m) {}
_ZNK5Botan2CT4MaskIhEcoEv:
  533|   160k|      constexpr Mask<T> operator~() const { return Mask<T>(~value()); }
_ZNK5Botan2CT4MaskIhE5valueEv:
  630|   320k|      constexpr T value() const { return value_barrier<T>(m_mask); }
_ZNK5Botan2CT4MaskIhE6selectEhh:
  548|   160k|      constexpr T select(T x, T y) const { return choose(value(), x, y); }
_ZN5Botan2CT6poisonImEEvPKT_m:
   56|   864k|constexpr inline void poison(const T* p, size_t n) {
   57|       |#if defined(BOTAN_HAS_VALGRIND)
   58|       |   if(!std::is_constant_evaluated()) {
   59|       |      VALGRIND_MAKE_MEM_UNDEFINED(p, n * sizeof(T));
   60|       |   }
   61|       |#endif
   62|       |
   63|   864k|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  151|   864k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   64|   864k|}
_ZN5Botan2CTanENS0_4MaskImEES2_:
  518|  69.9k|      friend constexpr Mask<T> operator&(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() & y.value()); }
_ZN5Botan2CTeoENS0_4MaskImEES2_:
  523|   287k|      friend constexpr Mask<T> operator^(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() ^ y.value()); }
_ZN5Botan2CT6Choice8from_intIjQaasr3stdE17unsigned_integralIT_Entsr3stdE7same_asIbS3_EEES1_S3_:
  268|  1.15M|      constexpr static Choice from_int(T v) {
  269|  1.15M|         if constexpr(sizeof(T) <= sizeof(underlying_type)) {
  270|  1.15M|            return !Choice(ct_is_zero<underlying_type>(v));
  271|       |         } else {
  272|       |            // Mask of T that is either |0| or |1|
  273|       |            const T v_is_0 = ct_is_zero<T>(value_barrier<T>(v));
  274|       |
  275|       |            // We want the mask to be set if v != 0 so we must check that
  276|       |            // v_is_0 is itself zero.
  277|       |            //
  278|       |            // Also sizeof(T) may not equal sizeof(underlying_type) so we must
  279|       |            // use ct_is_zero<underlying_type>. It's ok to either truncate or
  280|       |            // zero extend v_is_0 to 32 bits since we know it is |0| or |1|
  281|       |            // so even just the low bit is sufficient.
  282|       |            return Choice(ct_is_zero<underlying_type>(static_cast<underlying_type>(v_is_0)));
  283|       |         }
  284|  1.15M|      }
_ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__14spanIKmLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEnt17custom_poisonableISB_EEEvRKSB_:
  121|   855k|constexpr void poison(const R& r) {
  122|   855k|   const std::span s{r};
  123|   855k|   poison(s.data(), s.size());
  124|   855k|}
_ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__16vectorImNS_16secure_allocatorImEEEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEnt19custom_unpoisonableISC_EEEvRKSC_:
  128|  2.56M|constexpr void unpoison(const R& r) {
  129|  2.56M|   const std::span s{r};
  130|  2.56M|   unpoison(s.data(), s.size());
  131|  2.56M|}
_ZN5Botan2CT8unpoisonITkNS_6ranges14spanable_rangeENSt3__14spanIKmLm18446744073709551615EEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEnt19custom_unpoisonableISB_EEEvRKSB_:
  128|   855k|constexpr void unpoison(const R& r) {
  129|   855k|   const std::span s{r};
  130|   855k|   unpoison(s.data(), s.size());
  131|   855k|}
_ZN5Botan2CT6poisonITkNS_6ranges14spanable_rangeENSt3__16vectorImNS_16secure_allocatorImEEEEQaasr3stdE23is_trivially_copyable_vINS3_11conditionalIXsr21__is_primary_templateINS3_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS3_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEnt17custom_poisonableISC_EEEvRKSC_:
  121|  8.57k|constexpr void poison(const R& r) {
  122|  8.57k|   const std::span s{r};
  123|  8.57k|   poison(s.data(), s.size());
  124|  8.57k|}
_ZN5Botan2CT22conditional_assign_memImEENS0_4MaskIT_EES3_PS3_PKS3_m:
  749|   284k|constexpr inline Mask<T> conditional_assign_mem(T cnd, T* dest, const T* src, size_t elems) {
  750|   284k|   const auto mask = CT::Mask<T>::expand(cnd);
  751|   284k|   mask.select_n(dest, src, dest, elems);
  752|   284k|   return mask;
  753|   284k|}
_ZN5Botan2CT12poison_rangeITkNSt3__16ranges5rangeENS2_6vectorINS_14Montgomery_IntENS2_9allocatorIS5_EEEEQ10poisonableINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS3_5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISF_EESG_E4type10value_typeEEEEvRKSC_:
  181|    536|constexpr void poison_range(const R& r) {
  182|  8.57k|   for(const auto& v : r) {
  ------------------
  |  Branch (182:22): [True: 8.57k, False: 536]
  ------------------
  183|  8.57k|      poison(v);
  184|  8.57k|   }
  185|    536|}
_ZN5Botan2CT6poisonITkNS0_17custom_poisonableENS_14Montgomery_IntEEEvRKT_:
  138|  8.57k|constexpr void poison(const T& x) {
  139|  8.57k|   x._const_time_poison();
  140|  8.57k|}
_ZN5Botan2CT8unpoisonITkNS0_19custom_unpoisonableENS_14Montgomery_IntEEEvRKT_:
  143|    512|constexpr void unpoison(const T& x) {
  144|    512|   x._const_time_unpoison();
  145|    512|}

_ZN5Botan3fmtIJPKcS2_S2_EEENSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEENS3_17basic_string_viewIcS6_EEDpRKT_:
   53|    149|std::string fmt(std::string_view format, const T&... args) {
   54|    149|   std::ostringstream oss;
   55|    149|   oss.imbue(std::locale::classic());
   56|    149|   fmt_detail::do_fmt(oss, format, args...);
   57|    149|   return oss.str();
   58|    149|}
_ZN5Botan10fmt_detail6do_fmtIPKcJS3_S3_EEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_:
   25|    149|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|    149|   size_t i = 0;
   27|       |
   28|    149|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 149, False: 0]
  ------------------
   29|    149|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 149, False: 0]
  |  Branch (29:30): [True: 149, False: 0]
  |  Branch (29:59): [True: 149, False: 0]
  ------------------
   30|    149|         oss << val;
   31|    149|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|    149|      } else {
   33|      0|         oss << format[i];
   34|      0|      }
   35|       |
   36|      0|      i += 1;
   37|      0|   }
   38|    149|}
_ZN5Botan10fmt_detail6do_fmtIPKcJS3_EEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_:
   25|    149|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|    149|   size_t i = 0;
   27|       |
   28|    745|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 745, False: 0]
  ------------------
   29|    745|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 149, False: 596]
  |  Branch (29:30): [True: 149, False: 0]
  |  Branch (29:59): [True: 149, False: 0]
  ------------------
   30|    149|         oss << val;
   31|    149|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|    596|      } else {
   33|    596|         oss << format[i];
   34|    596|      }
   35|       |
   36|    596|      i += 1;
   37|    596|   }
   38|    149|}
_ZN5Botan10fmt_detail6do_fmtIPKcJEEEvRNSt3__119basic_ostringstreamIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS4_17basic_string_viewIcS7_EERKT_DpRKT0_:
   25|    149|void do_fmt(std::ostringstream& oss, std::string_view format, const T& val, const Ts&... rest) {
   26|    149|   size_t i = 0;
   27|       |
   28|    298|   while(i < format.size()) {
  ------------------
  |  Branch (28:10): [True: 298, False: 0]
  ------------------
   29|    298|      if(format[i] == '{' && (format.size() > (i + 1)) && format.at(i + 1) == '}') {
  ------------------
  |  Branch (29:10): [True: 149, False: 149]
  |  Branch (29:30): [True: 149, False: 0]
  |  Branch (29:59): [True: 149, False: 0]
  ------------------
   30|    149|         oss << val;
   31|    149|         return do_fmt(oss, format.substr(i + 2), rest...);
   32|    149|      } else {
   33|    149|         oss << format[i];
   34|    149|      }
   35|       |
   36|    149|      i += 1;
   37|    149|   }
   38|    149|}
_ZN5Botan10fmt_detail6do_fmtERNSt3__119basic_ostringstreamIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EE:
   20|    149|inline void do_fmt(std::ostringstream& oss, std::string_view format) {
   21|    149|   oss << format;
   22|    149|}

_ZN5Botan11checked_mulITkNSt3__117unsigned_integralEmEENS1_8optionalIT_EES3_S3_:
   46|  3.45M|constexpr inline std::optional<T> checked_mul(T a, T b) {
   47|       |   // Multiplication by 1U is a hack to work around C's insane
   48|       |   // integer promotion rules.
   49|       |   // https://stackoverflow.com/questions/24795651
   50|  3.45M|   const T r = (1U * a) * b;
   51|       |   // If a == 0 then the multiply certainly did not overflow
   52|       |   // Otherwise r / a == b unless overflow occurred
   53|  3.45M|   if(a != 0 && r / a != b) {
  ------------------
  |  Branch (53:7): [True: 3.45M, False: 0]
  |  Branch (53:17): [True: 0, False: 3.45M]
  ------------------
   54|      0|      return {};
   55|      0|   }
   56|  3.45M|   return r;
   57|  3.45M|}

_ZN5Botan7load_beImJNSt3__14spanIKhLm8EEEEEEDaDpOT0_:
  504|  23.0k|inline constexpr auto load_be(ParamTs&&... params) {
  505|  23.0k|   return detail::load_any<std::endian::big, OutT>(std::forward<ParamTs>(params)...);
  506|  23.0k|}
_ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_:
  278|  23.0k|inline constexpr WrappedOutT load_any(InR&& in_range) {
  279|  23.0k|   using OutT = detail::wrapped_type<WrappedOutT>;
  280|  23.0k|   ranges::assert_exact_byte_length<sizeof(OutT)>(in_range);
  281|       |
  282|  23.0k|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|  23.0k|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  287|  23.0k|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|  23.0k|      } else {
  289|  23.0k|         const std::span in{in_range};
  290|  23.0k|         if constexpr(sizeof(OutT) == 1) {
  291|  23.0k|            return static_cast<OutT>(in[0]);
  292|  23.0k|         } else if constexpr(endianness == std::endian::native) {
  293|  23.0k|            return typecast_copy<OutT>(in);
  294|  23.0k|         } else {
  295|  23.0k|            static_assert(opposite(endianness) == std::endian::native);
  296|  23.0k|            return reverse_bytes(typecast_copy<OutT>(in));
  297|  23.0k|         }
  298|  23.0k|      }
  299|  23.0k|   }());
  300|  23.0k|}
_ZN5Botan6detail24wrap_strong_type_or_enumITkNS0_20unsigned_integralishEmTkNSt3__117unsigned_integralEmEEDaT0_:
  200|  25.6k|constexpr auto wrap_strong_type_or_enum(T t) {
  201|       |   if constexpr(std::is_enum_v<OutT>) {
  202|       |      return static_cast<OutT>(t);
  203|  25.6k|   } else {
  204|  25.6k|      return Botan::wrap_strong_type<OutT>(t);
  205|  25.6k|   }
  206|  25.6k|}
_ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv:
  282|  23.0k|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|  23.0k|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (286:10): [Folded, False: 23.0k]
  ------------------
  287|      0|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|  23.0k|      } else {
  289|  23.0k|         const std::span in{in_range};
  290|       |         if constexpr(sizeof(OutT) == 1) {
  291|       |            return static_cast<OutT>(in[0]);
  292|       |         } else if constexpr(endianness == std::endian::native) {
  293|       |            return typecast_copy<OutT>(in);
  294|  23.0k|         } else {
  295|  23.0k|            static_assert(opposite(endianness) == std::endian::native);
  296|  23.0k|            return reverse_bytes(typecast_copy<OutT>(in));
  297|  23.0k|         }
  298|  23.0k|      }
  299|  23.0k|   }());
_ZN5Botan7load_beImJRNSt3__15arrayIhLm8EEEEEEDaDpOT0_:
  504|  2.55k|inline constexpr auto load_be(ParamTs&&... params) {
  505|  2.55k|   return detail::load_any<std::endian::big, OutT>(std::forward<ParamTs>(params)...);
  506|  2.55k|}
_ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_:
  278|  2.55k|inline constexpr WrappedOutT load_any(InR&& in_range) {
  279|  2.55k|   using OutT = detail::wrapped_type<WrappedOutT>;
  280|  2.55k|   ranges::assert_exact_byte_length<sizeof(OutT)>(in_range);
  281|       |
  282|  2.55k|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|  2.55k|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  287|  2.55k|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|  2.55k|      } else {
  289|  2.55k|         const std::span in{in_range};
  290|  2.55k|         if constexpr(sizeof(OutT) == 1) {
  291|  2.55k|            return static_cast<OutT>(in[0]);
  292|  2.55k|         } else if constexpr(endianness == std::endian::native) {
  293|  2.55k|            return typecast_copy<OutT>(in);
  294|  2.55k|         } else {
  295|  2.55k|            static_assert(opposite(endianness) == std::endian::native);
  296|  2.55k|            return reverse_bytes(typecast_copy<OutT>(in));
  297|  2.55k|         }
  298|  2.55k|      }
  299|  2.55k|   }());
  300|  2.55k|}
_ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv:
  282|  2.55k|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|  2.55k|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (286:10): [Folded, False: 2.55k]
  ------------------
  287|      0|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|  2.55k|      } else {
  289|  2.55k|         const std::span in{in_range};
  290|       |         if constexpr(sizeof(OutT) == 1) {
  291|       |            return static_cast<OutT>(in[0]);
  292|       |         } else if constexpr(endianness == std::endian::native) {
  293|       |            return typecast_copy<OutT>(in);
  294|  2.55k|         } else {
  295|  2.55k|            static_assert(opposite(endianness) == std::endian::native);
  296|  2.55k|            return reverse_bytes(typecast_copy<OutT>(in));
  297|  2.55k|         }
  298|  2.55k|      }
  299|  2.55k|   }());

_ZN5Botan14zeroize_bufferITkNSt3__117unsigned_integralEmEEvPT_m:
   37|  5.66M|inline void zeroize_buffer(T buf[], size_t n) {
   38|  5.66M|   if(n > 0) {
  ------------------
  |  Branch (38:7): [True: 5.27M, False: 391k]
  ------------------
   39|  5.27M|      std::memset(buf, 0, sizeof(T) * n);
   40|  5.27M|   }
   41|  5.66M|}
_ZN5Botan21unchecked_copy_memoryITkNSt3__117unsigned_integralEmEEvPT_PKS2_m:
   44|   391k|inline void unchecked_copy_memory(T* out, const T* in, size_t n) {
   45|   391k|   if(in != nullptr && out != nullptr && n > 0) {
  ------------------
  |  Branch (45:7): [True: 391k, False: 0]
  |  Branch (45:24): [True: 391k, False: 0]
  |  Branch (45:42): [True: 391k, False: 0]
  ------------------
   46|   391k|      std::memmove(out, in, sizeof(T) * n);
   47|   391k|   }
   48|   391k|}

_ZNK5Botan17Montgomery_Params1pEv:
   41|   286k|      const BigInt& p() const { return m_data->p(); }
_ZNK5Botan17Montgomery_Params2R1Ev:
   43|    560|      const BigInt& R1() const { return m_data->r1(); }
_ZNK5Botan17Montgomery_Params2R2Ev:
   45|    536|      const BigInt& R2() const { return m_data->r2(); }
_ZNK5Botan17Montgomery_Params6p_dashEv:
   49|   284k|      word p_dash() const { return m_data->p_dash(); }
_ZNK5Botan17Montgomery_Params7p_wordsEv:
   51|   128k|      size_t p_words() const { return m_data->p_size(); }
_ZNK5Botan17Montgomery_Params4Data1pEv:
   76|   286k|            const BigInt& p() const { return m_p; }
_ZNK5Botan17Montgomery_Params4Data2r1Ev:
   78|    560|            const BigInt& r1() const { return m_r1; }
_ZNK5Botan17Montgomery_Params4Data2r2Ev:
   80|    536|            const BigInt& r2() const { return m_r2; }
_ZNK5Botan17Montgomery_Params4Data6p_dashEv:
   84|   284k|            word p_dash() const { return m_p_dash; }
_ZNK5Botan17Montgomery_Params4Data6p_sizeEv:
   86|   128k|            size_t p_size() const { return m_p_words; }
_ZNK5Botan14Montgomery_Int4reprEv:
  143|   892k|      const secure_vector<word>& repr() const { return m_v; }
_ZNK5Botan14Montgomery_Int18_const_time_poisonEv:
  180|  8.57k|      void _const_time_poison() const { CT::poison(m_v); }
_ZNK5Botan14Montgomery_Int20_const_time_unpoisonEv:
  182|    512|      void _const_time_unpoison() const { CT::unpoison(m_v); }
_ZNK5Botan14Montgomery_Int7_paramsEv:
  184|    536|      const Montgomery_Params& _params() const { return m_params; }

_ZN5Botan9monty_expERKNS_17Montgomery_ParamsERKNS_6BigIntES5_m:
   74|    536|                                size_t max_k_bits) {
   75|    536|   const auto precomputed = monty_precompute(params_p, g, 4, true);
   76|    536|   return monty_execute(*precomputed, k, max_k_bits);
   77|    536|}
_ZN5Botan31Montgomery_Exponentiation_StateC2Ev:
   41|    536|      Montgomery_Exponentiation_State() = default;
_ZN5Botan31Montgomery_Exponentiation_StateD2Ev:
   22|    536|      virtual ~Montgomery_Exponentiation_State() = default;

_ZN5Botan10word_madd2ITkNS_8WordTypeEmEET_S1_S1_PS1_:
   90|   833k|inline constexpr auto word_madd2(W a, W b, W* c) -> W {
   91|   833k|#if defined(BOTAN_MP_USE_X86_64_ASM)
   92|   833k|   if constexpr(std::same_as<W, uint64_t>) {
   93|   833k|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (93:10): [True: 833k, Folded]
  ------------------
   94|   833k|         asm(R"(
   95|   833k|            mulq %[b]
   96|   833k|            addq %[c],%[a]
   97|   833k|            adcq $0,%[carry]
   98|   833k|            )"
   99|   833k|             : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c)
  100|   833k|             : "0"(a), "1"(b), [c] "g"(*c)
  101|   833k|             : "cc");
  102|       |
  103|   833k|         return a;
  104|   833k|      }
  105|   833k|   }
  106|       |#elif defined(BOTAN_MP_USE_AARCH64_ASM)
  107|       |   if constexpr(std::same_as<W, uint64_t>) {
  108|       |      if(!std::is_constant_evaluated()) {
  109|       |         W lo = 0;
  110|       |         W hi = 0;
  111|       |         asm(R"(
  112|       |            mul  %[lo], %[a], %[b]
  113|       |            umulh %[hi], %[a], %[b]
  114|       |            adds %[lo], %[lo], %[c]
  115|       |            adc  %[hi], %[hi], xzr
  116|       |            )"
  117|       |             : [lo] "=&r"(lo), [hi] "=&r"(hi)
  118|       |             : [a] "r"(a), [b] "r"(b), [c] "r"(*c)
  119|       |             : "cc");
  120|       |
  121|       |         *c = hi;
  122|       |         return lo;
  123|       |      }
  124|       |   }
  125|       |#endif
  126|       |
  127|      0|   typedef typename WordInfo<W>::dword dword;
  128|   833k|   const dword s = dword(a) * b + *c;
  129|   833k|   *c = static_cast<W>(s >> WordInfo<W>::bits);
  130|   833k|   return static_cast<W>(s);
  131|   833k|}
_ZN5Botan10word8_add2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_:
  276|  1.37M|inline constexpr auto word8_add2(W x[8], const W y[8], W carry) -> W {
  277|  1.37M|#if defined(BOTAN_MP_USE_X86_64_ASM)
  278|  1.37M|   if constexpr(std::same_as<W, uint64_t>) {
  279|  1.37M|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (279:10): [True: 1.37M, Folded]
  ------------------
  280|  1.37M|         asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcq"))
  281|  1.37M|                      : [carry] "=r"(carry)
  282|  1.37M|                      : [x] "r"(x), [y] "r"(y), "0"(carry)
  283|  1.37M|                      : "cc", "memory");
  284|  1.37M|         return carry;
  285|  1.37M|      }
  286|  1.37M|   }
  287|      0|#endif
  288|       |
  289|      0|   x[0] = word_add(x[0], y[0], &carry);
  290|  1.37M|   x[1] = word_add(x[1], y[1], &carry);
  291|  1.37M|   x[2] = word_add(x[2], y[2], &carry);
  292|  1.37M|   x[3] = word_add(x[3], y[3], &carry);
  293|  1.37M|   x[4] = word_add(x[4], y[4], &carry);
  294|  1.37M|   x[5] = word_add(x[5], y[5], &carry);
  295|  1.37M|   x[6] = word_add(x[6], y[6], &carry);
  296|  1.37M|   x[7] = word_add(x[7], y[7], &carry);
  297|  1.37M|   return carry;
  298|  1.37M|}
_ZN5Botan8word_addITkNS_8WordTypeEmEET_S1_S1_PS1_:
  239|  46.1M|inline constexpr auto word_add(W x, W y, W* carry) -> W {
  240|  46.1M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_addc)
  241|  46.1M|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (241:7): [True: 46.1M, Folded]
  ------------------
  242|       |      if constexpr(std::same_as<W, unsigned int>) {
  243|       |         return __builtin_addc(x, y, *carry & 1, carry);
  244|  46.1M|      } else if constexpr(std::same_as<W, unsigned long>) {
  245|  46.1M|         return __builtin_addcl(x, y, *carry & 1, carry);
  246|       |      } else if constexpr(std::same_as<W, unsigned long long>) {
  247|       |         return __builtin_addcll(x, y, *carry & 1, carry);
  248|       |      }
  249|  46.1M|   }
  250|      0|#endif
  251|       |
  252|       |   if constexpr(WordInfo<W>::dword_is_native && use_dword_for_word_add) {
  253|       |      /*
  254|       |      TODO(Botan4) this is largely a performance hack for GCCs that don't
  255|       |      support __builtin_addc, if we increase the minimum supported version of
  256|       |      GCC to GCC 14 then we can remove this and not worry about it
  257|       |      */
  258|       |      const W cb = *carry & 1;
  259|       |      const auto s = typename WordInfo<W>::dword(x) + y + cb;
  260|       |      *carry = static_cast<W>(s >> WordInfo<W>::bits);
  261|       |      return static_cast<W>(s);
  262|  46.1M|   } else {
  263|  46.1M|      const W cb = *carry & 1;
  264|  46.1M|      W z = x + y;
  265|  46.1M|      W c1 = (z < x);
  266|  46.1M|      z += cb;
  267|  46.1M|      *carry = c1 | (z < cb);
  268|  46.1M|      return z;
  269|  46.1M|   }
  270|  46.1M|}
_ZN5Botan10word8_sub2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_:
  357|  2.07M|inline constexpr auto word8_sub2(W x[8], const W y[8], W carry) -> W {
  358|  2.07M|#if defined(BOTAN_MP_USE_X86_64_ASM)
  359|  2.07M|   if constexpr(std::same_as<W, uint64_t>) {
  360|  2.07M|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (360:10): [True: 2.07M, Folded]
  ------------------
  361|  2.07M|         asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "sbbq"))
  362|  2.07M|                      : [carry] "=r"(carry)
  363|  2.07M|                      : [x] "r"(x), [y] "r"(y), "0"(carry)
  364|  2.07M|                      : "cc", "memory");
  365|  2.07M|         return carry;
  366|  2.07M|      }
  367|  2.07M|   }
  368|      0|#endif
  369|       |
  370|      0|   x[0] = word_sub(x[0], y[0], &carry);
  371|  2.07M|   x[1] = word_sub(x[1], y[1], &carry);
  372|  2.07M|   x[2] = word_sub(x[2], y[2], &carry);
  373|  2.07M|   x[3] = word_sub(x[3], y[3], &carry);
  374|  2.07M|   x[4] = word_sub(x[4], y[4], &carry);
  375|  2.07M|   x[5] = word_sub(x[5], y[5], &carry);
  376|  2.07M|   x[6] = word_sub(x[6], y[6], &carry);
  377|  2.07M|   x[7] = word_sub(x[7], y[7], &carry);
  378|  2.07M|   return carry;
  379|  2.07M|}
_ZN5Botan8word_subITkNS_8WordTypeEmEET_S1_S1_PS1_:
  332|  30.1M|inline constexpr auto word_sub(W x, W y, W* carry) -> W {
  333|  30.1M|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_subc)
  334|  30.1M|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (334:7): [True: 30.1M, Folded]
  ------------------
  335|       |      if constexpr(std::same_as<W, unsigned int>) {
  336|       |         return __builtin_subc(x, y, *carry & 1, carry);
  337|  30.1M|      } else if constexpr(std::same_as<W, unsigned long>) {
  338|  30.1M|         return __builtin_subcl(x, y, *carry & 1, carry);
  339|       |      } else if constexpr(std::same_as<W, unsigned long long>) {
  340|       |         return __builtin_subcll(x, y, *carry & 1, carry);
  341|       |      }
  342|  30.1M|   }
  343|      0|#endif
  344|       |
  345|      0|   const W cb = *carry & 1;
  346|  30.1M|   W t0 = x - y;
  347|  30.1M|   W c1 = (t0 > x);
  348|  30.1M|   W z = t0 - cb;
  349|  30.1M|   *carry = c1 | (z > t0);
  350|  30.1M|   return z;
  351|  30.1M|}
_ZN5Botan10word8_sub3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_:
  385|  9.74M|inline constexpr auto word8_sub3(W z[8], const W x[8], const W y[8], W carry) -> W {
  386|  9.74M|#if defined(BOTAN_MP_USE_X86_64_ASM)
  387|  9.74M|   if constexpr(std::same_as<W, uint64_t>) {
  388|  9.74M|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (388:10): [True: 9.74M, Folded]
  ------------------
  389|  9.74M|         asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq"))
  390|  9.74M|                      : [carry] "=r"(carry)
  391|  9.74M|                      : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  392|  9.74M|                      : "cc", "memory");
  393|  9.74M|         return carry;
  394|  9.74M|      }
  395|  9.74M|   }
  396|      0|#endif
  397|       |
  398|      0|   z[0] = word_sub(x[0], y[0], &carry);
  399|  9.74M|   z[1] = word_sub(x[1], y[1], &carry);
  400|  9.74M|   z[2] = word_sub(x[2], y[2], &carry);
  401|  9.74M|   z[3] = word_sub(x[3], y[3], &carry);
  402|  9.74M|   z[4] = word_sub(x[4], y[4], &carry);
  403|  9.74M|   z[5] = word_sub(x[5], y[5], &carry);
  404|  9.74M|   z[6] = word_sub(x[6], y[6], &carry);
  405|  9.74M|   z[7] = word_sub(x[7], y[7], &carry);
  406|  9.74M|   return carry;
  407|  9.74M|}
_ZN5Botan10word8_add3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_:
  304|  1.37M|inline constexpr auto word8_add3(W z[8], const W x[8], const W y[8], W carry) -> W {
  305|  1.37M|#if defined(BOTAN_MP_USE_X86_64_ASM)
  306|  1.37M|   if constexpr(std::same_as<W, uint64_t>) {
  307|  1.37M|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (307:10): [True: 1.37M, Folded]
  ------------------
  308|  1.37M|         asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcq"))
  309|  1.37M|                      : [carry] "=r"(carry)
  310|  1.37M|                      : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  311|  1.37M|                      : "cc", "memory");
  312|  1.37M|         return carry;
  313|  1.37M|      }
  314|  1.37M|   }
  315|      0|#endif
  316|       |
  317|      0|   z[0] = word_add(x[0], y[0], &carry);
  318|  1.37M|   z[1] = word_add(x[1], y[1], &carry);
  319|  1.37M|   z[2] = word_add(x[2], y[2], &carry);
  320|  1.37M|   z[3] = word_add(x[3], y[3], &carry);
  321|  1.37M|   z[4] = word_add(x[4], y[4], &carry);
  322|  1.37M|   z[5] = word_add(x[5], y[5], &carry);
  323|  1.37M|   z[6] = word_add(x[6], y[6], &carry);
  324|  1.37M|   z[7] = word_add(x[7], y[7], &carry);
  325|  1.37M|   return carry;
  326|  1.37M|}
_ZN5Botan11word8_madd3ITkNS_8WordTypeEmEET_PS1_PKS1_S1_S1_:
  441|  89.5M|inline constexpr auto word8_madd3(W z[8], const W x[8], W y, W carry) -> W {
  442|  89.5M|#if defined(BOTAN_MP_USE_X86_64_ASM)
  443|  89.5M|   if constexpr(std::same_as<W, uint64_t>) {
  444|  89.5M|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (444:10): [True: 89.5M, Folded]
  ------------------
  445|  89.5M|         asm volatile(DO_8_TIMES(MULADD_OP, "")
  446|  89.5M|                      : [carry] "=r"(carry)
  447|  89.5M|                      : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  448|  89.5M|                      : "cc", "%rax", "%rdx", "memory");
  449|  89.5M|         return carry;
  450|  89.5M|      }
  451|  89.5M|   }
  452|      0|#endif
  453|       |
  454|      0|   z[0] = word_madd3(x[0], y, z[0], &carry);
  455|  89.5M|   z[1] = word_madd3(x[1], y, z[1], &carry);
  456|  89.5M|   z[2] = word_madd3(x[2], y, z[2], &carry);
  457|  89.5M|   z[3] = word_madd3(x[3], y, z[3], &carry);
  458|  89.5M|   z[4] = word_madd3(x[4], y, z[4], &carry);
  459|  89.5M|   z[5] = word_madd3(x[5], y, z[5], &carry);
  460|  89.5M|   z[6] = word_madd3(x[6], y, z[6], &carry);
  461|  89.5M|   z[7] = word_madd3(x[7], y, z[7], &carry);
  462|  89.5M|   return carry;
  463|  89.5M|}
_ZN5Botan10word_madd3ITkNS_8WordTypeEmEET_S1_S1_S1_PS1_:
  137|   101M|inline constexpr auto word_madd3(W a, W b, W c, W* d) -> W {
  138|   101M|#if defined(BOTAN_MP_USE_X86_64_ASM)
  139|   101M|   if constexpr(std::same_as<W, uint64_t>) {
  140|   101M|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (140:10): [True: 101M, Folded]
  ------------------
  141|   101M|         asm(R"(
  142|   101M|            mulq %[b]
  143|   101M|
  144|   101M|            addq %[c],%[a]
  145|   101M|            adcq $0,%[carry]
  146|   101M|
  147|   101M|            addq %[d],%[a]
  148|   101M|            adcq $0,%[carry]
  149|   101M|            )"
  150|   101M|             : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d)
  151|   101M|             : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d)
  152|   101M|             : "cc");
  153|       |
  154|   101M|         return a;
  155|   101M|      }
  156|   101M|   }
  157|       |#elif defined(BOTAN_MP_USE_AARCH64_ASM)
  158|       |   if constexpr(std::same_as<W, uint64_t>) {
  159|       |      if(!std::is_constant_evaluated()) {
  160|       |         W lo = 0;
  161|       |         W hi = 0;
  162|       |         asm(R"(
  163|       |            mul  %[lo], %[a], %[b]
  164|       |            umulh %[hi], %[a], %[b]
  165|       |            adds %[lo], %[lo], %[c]
  166|       |            adc  %[hi], %[hi], xzr
  167|       |            adds %[lo], %[lo], %[d]
  168|       |            adc  %[hi], %[hi], xzr
  169|       |            )"
  170|       |             : [lo] "=&r"(lo), [hi] "=&r"(hi)
  171|       |             : [a] "r"(a), [b] "r"(b), [c] "r"(c), [d] "r"(*d)
  172|       |             : "cc");
  173|       |
  174|       |         *d = hi;
  175|       |         return lo;
  176|       |      }
  177|       |   }
  178|       |#endif
  179|       |
  180|      0|   typedef typename WordInfo<W>::dword dword;
  181|   101M|   const dword s = dword(a) * b + c + *d;
  182|   101M|   *d = static_cast<W>(s >> WordInfo<W>::bits);
  183|   101M|   return static_cast<W>(s);
  184|   101M|}
_ZN5Botan5word3ImEC2Ev:
  478|   875k|      constexpr word3() : m_w(0) {}
_ZN5Botan5word3ImE3mulEmm:
  480|   196M|      inline constexpr void mul(W x, W y) { m_w += static_cast<W3>(x) * y; }
_ZN5Botan5word3ImE7extractEv:
  486|  28.2M|      inline constexpr W extract() {
  487|  28.2M|         W r = static_cast<W>(m_w);
  488|  28.2M|         m_w >>= WordInfo<W>::bits;
  489|  28.2M|         return r;
  490|  28.2M|      }
_ZN5Botan5word3ImE6mul_x2Emm:
  482|  25.3M|      inline constexpr void mul_x2(W x, W y) { m_w += static_cast<W3>(x) * y * 2; }
_ZN5Botan5word3ImE3addEm:
  484|   527k|      inline constexpr void add(W x) { m_w += x; }
_ZN5Botan5word3ImE10monty_stepEmm:
  492|   263k|      inline constexpr W monty_step(W p0, W p_dash) {
  493|   263k|         const W w0 = static_cast<W>(m_w);
  494|   263k|         const W r = w0 * p_dash;
  495|   263k|         mul(r, p0);
  496|   263k|         m_w >>= WordInfo<W>::bits;
  497|   263k|         return r;
  498|   263k|      }

_ZNK5Botan14divide_precompImE14divmod_2to1_ctEmm:
  731|  19.7k|      inline constexpr std::pair<W, W> divmod_2to1_ct(W n1, W n0) const {
  732|       |         /*
  733|       |         * Scale the numerator to match the normalized divisor; the scaling cancels
  734|       |         * in the quotient and is removed from the remainder by the final shift.
  735|       |         */
  736|  19.7k|         n1 <<= m_shift;
  737|  19.7k|         const size_t rshift = WordInfo<W>::bits - m_shift;
  738|       |         /*
  739|       |         * We can't just `n0 >> rshift` because m_shift may be 0 (high bit divisor)
  740|       |         * in which case rshift will be the maximum bit length, and >> by the maximum
  741|       |         * bitlength is undefined behavior despite having an entirely obvious meaning.
  742|       |         *
  743|       |         * However we know m_shift is not equal to the bit length of the word, because
  744|       |         * that would imply that the divisor is 0. Thus rshift must be >= 1. So split
  745|       |         * the shift into two phases (first rshift-1, then 1)
  746|       |         */
  747|  19.7k|         n1 |= (n0 >> 1) >> (rshift - 1);
  748|  19.7k|         n0 <<= m_shift;
  749|       |
  750|  19.7k|         const auto [q, scaled_r] = div2by1_preinv(n1, n0, m_norm_divisor, m_reciprocal);
  751|  19.7k|         const W r = scaled_r >> m_shift;
  752|  19.7k|         return std::make_pair(q, r);
  753|  19.7k|      }
_ZN5Botan14divide_precompImE14div2by1_preinvEmmmm:
  782|  19.7k|      static constexpr std::pair<W, W> div2by1_preinv(W u1, W u0, W D, W v) {
  783|       |         // Steps 1-3: <q1,q0> = v*u1; <q1,q0> += <u1,u0>; q1 += 1
  784|  19.7k|         W q1 = u0;
  785|  19.7k|         const W q0 = word_madd2(u1, v, &q1);  // <q1,q0> = u1*v + u0
  786|  19.7k|         q1 += u1 + 1;
  787|       |
  788|       |         // Step 4
  789|  19.7k|         W r = u0 - q1 * D;
  790|       |
  791|       |         // Steps 5-7: If r >= q0 { q1 -= 1; r += d; }
  792|  19.7k|         const auto fix_down = CT::Mask<W>::is_gt(r, q0);
  793|  19.7k|         q1 -= fix_down.if_set_return(1);
  794|  19.7k|         r += fix_down.if_set_return(D);
  795|       |
  796|       |         // Steps 8-10: if r >= D { q1 += 1; r -= D; }
  797|  19.7k|         const auto fix_up = CT::Mask<W>::is_gte(r, D);
  798|  19.7k|         q1 += fix_up.if_set_return(1);
  799|  19.7k|         r -= fix_up.if_set_return(D);
  800|       |
  801|       |         // Step 11
  802|  19.7k|         return std::make_pair(q1, r);
  803|  19.7k|      }
_ZN5Botan17bigint_monty_redcEPmPKmS2_mmS0_m:
 1077|  61.6k|   word r[], const word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) {
 1078|  61.6k|   const size_t z_size = 2 * p_size;
 1079|       |
 1080|  61.6k|   BOTAN_ARG_CHECK(ws_size >= p_size, "Montgomery reduction workspace too small");
  ------------------
  |  |   35|  61.6k|   do {                                                          \
  |  |   36|  61.6k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|  61.6k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 61.6k]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|  61.6k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 61.6k]
  |  |  ------------------
  ------------------
 1081|       |
 1082|  61.6k|   if(p_size == 4) {
  ------------------
  |  Branch (1082:7): [True: 6.90k, False: 54.7k]
  ------------------
 1083|  6.90k|      bigint_monty_redc_4(r, z, p, p_dash, ws);
 1084|  54.7k|   } else if(p_size == 6) {
  ------------------
  |  Branch (1084:14): [True: 8.75k, False: 45.9k]
  ------------------
 1085|  8.75k|      bigint_monty_redc_6(r, z, p, p_dash, ws);
 1086|  45.9k|   } else if(p_size == 8) {
  ------------------
  |  Branch (1086:14): [True: 10.8k, False: 35.1k]
  ------------------
 1087|  10.8k|      bigint_monty_redc_8(r, z, p, p_dash, ws);
 1088|  35.1k|   } else if(p_size == 12) {
  ------------------
  |  Branch (1088:14): [True: 10, False: 35.1k]
  ------------------
 1089|     10|      bigint_monty_redc_12(r, z, p, p_dash, ws);
 1090|  35.1k|   } else if(p_size == 16) {
  ------------------
  |  Branch (1090:14): [True: 20, False: 35.1k]
  ------------------
 1091|     20|      bigint_monty_redc_16(r, z, p, p_dash, ws);
 1092|  35.1k|   } else if(p_size == 24) {
  ------------------
  |  Branch (1092:14): [True: 11, False: 35.1k]
  ------------------
 1093|     11|      bigint_monty_redc_24(r, z, p, p_dash, ws);
 1094|  35.1k|   } else if(p_size == 32) {
  ------------------
  |  Branch (1094:14): [True: 15, False: 35.1k]
  ------------------
 1095|     15|      bigint_monty_redc_32(r, z, p, p_dash, ws);
 1096|  35.1k|   } else {
 1097|  35.1k|      bigint_monty_redc_generic(r, z, z_size, p, p_size, p_dash, ws);
 1098|  35.1k|   }
 1099|  61.6k|}
_ZN5Botan25bigint_monty_redc_inplaceEPmPKmmmS0_m:
 1101|    536|inline void bigint_monty_redc_inplace(word z[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) {
 1102|    536|   bigint_monty_redc(z, z, p, p_size, p_dash, ws, ws_size);
 1103|    536|   zeroize_buffer(z + p_size, p_size);
 1104|    536|}
_ZN5Botan18reciprocal_word_ctITkNS_8WordTypeEmEET_S1_:
  649|  2.41k|constexpr W reciprocal_word_ct(W D) {
  650|  2.41k|   BOTAN_DEBUG_ASSERT((D & WordInfo<W>::top_bit) != 0);
  ------------------
  |  |  137|  2.41k|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  138|  2.41k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (138:15): [Folded, False: 2.41k]
  |  |  ------------------
  ------------------
  651|       |
  652|       |   // Bit serial long division of ((~D) || (2^b - 1)) / D, with all of the
  653|       |   // conditional logic computed via masks
  654|  2.41k|   W remainder = static_cast<W>(~D);
  655|  2.41k|   W quotient = 0;
  656|       |
  657|   156k|   for(size_t i = 0; i != WordInfo<W>::bits; ++i) {
  ------------------
  |  Branch (657:22): [True: 154k, False: 2.41k]
  ------------------
  658|   154k|      const auto carry = CT::Mask<W>::expand_top_bit(remainder);
  659|   154k|      remainder = static_cast<W>((remainder << 1) | 1);
  660|   154k|      quotient <<= 1;
  661|       |
  662|   154k|      const auto sub = carry | CT::Mask<W>::is_gte(remainder, D);
  663|   154k|      remainder -= sub.if_set_return(D);
  664|   154k|      quotient |= sub.if_set_return(1);
  665|   154k|   }
  666|       |
  667|  2.41k|   return quotient;
  668|  2.41k|}
_ZN5Botan14divide_precompImE5setupEm:
  694|  2.41k|      static constexpr divide_precomp setup(W divisor) {
  695|  2.41k|         const size_t shift = WordInfo<W>::bits - high_bit(divisor);
  696|  2.41k|         const W norm_divisor = divisor << shift;
  697|  2.41k|         const W reciprocal = reciprocal_word_ct(norm_divisor);
  698|  2.41k|         return divide_precomp(divisor, shift, norm_divisor, reciprocal);
  699|  2.41k|      }
_ZN5Botan11bigint_add2ITkNS_8WordTypeEmEET_PS1_mPKS1_m:
   97|  1.03M|inline constexpr auto bigint_add2(W x[], size_t x_size, const W y[], size_t y_size) -> W {
   98|  1.03M|   W carry = 0;
   99|       |
  100|  1.03M|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   71|  1.03M|   do {                                                                                 \
  |  |   72|  1.03M|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                     \
  |  |   73|  1.03M|      if(!(expr)) {                                                                     \
  |  |  ------------------
  |  |  |  Branch (73:10): [True: 0, False: 1.03M]
  |  |  ------------------
  |  |   74|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                            \
  |  |   75|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   76|      0|      }                                                                                 \
  |  |   77|  1.03M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (77:12): [Folded, False: 1.03M]
  |  |  ------------------
  ------------------
  101|       |
  102|  1.03M|   const size_t blocks = y_size - (y_size % 8);
  103|       |
  104|  2.40M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (104:22): [True: 1.37M, False: 1.03M]
  ------------------
  105|  1.37M|      carry = word8_add2(x + i, y + i, carry);
  106|  1.37M|   }
  107|       |
  108|  2.04M|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (108:27): [True: 1.01M, False: 1.03M]
  ------------------
  109|  1.01M|      x[i] = word_add(x[i], y[i], &carry);
  110|  1.01M|   }
  111|       |
  112|  11.6M|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (112:27): [True: 10.6M, False: 1.03M]
  ------------------
  113|  10.6M|      x[i] = word_add(x[i], static_cast<W>(0), &carry);
  114|  10.6M|   }
  115|       |
  116|  1.03M|   return carry;
  117|  1.03M|}
_ZN5Botan10bigint_cmpITkNS_8WordTypeEmEEiPKT_mS3_m:
  462|   904k|inline constexpr int32_t bigint_cmp(const W x[], size_t x_size, const W y[], size_t y_size) {
  463|   904k|   static_assert(sizeof(W) >= sizeof(uint32_t), "Size assumption");
  464|       |
  465|   904k|   const W LT = static_cast<W>(-1);
  466|   904k|   const W EQ = 0;
  467|   904k|   const W GT = 1;
  468|       |
  469|   904k|   const size_t common_elems = std::min(x_size, y_size);
  470|       |
  471|   904k|   W result = EQ;  // until found otherwise
  472|       |
  473|  17.2M|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (473:22): [True: 16.3M, False: 904k]
  ------------------
  474|  16.3M|      const auto is_eq = CT::Mask<W>::is_equal(x[i], y[i]);
  475|  16.3M|      const auto is_lt = CT::Mask<W>::is_lt(x[i], y[i]);
  476|       |
  477|  16.3M|      result = is_eq.select(result, is_lt.select(LT, GT));
  478|  16.3M|   }
  479|       |
  480|   904k|   if(x_size < y_size) {
  ------------------
  |  Branch (480:7): [True: 34, False: 904k]
  ------------------
  481|     34|      W mask = 0;
  482|     68|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (482:30): [True: 34, False: 34]
  ------------------
  483|     34|         mask |= y[i];
  484|     34|      }
  485|       |
  486|       |      // If any bits were set in high part of y, then x < y
  487|     34|      result = CT::Mask<W>::is_zero(mask).select(result, LT);
  488|   904k|   } else if(y_size < x_size) {
  ------------------
  |  Branch (488:14): [True: 0, False: 904k]
  ------------------
  489|      0|      W mask = 0;
  490|      0|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (490:30): [True: 0, False: 0]
  ------------------
  491|      0|         mask |= x[i];
  492|      0|      }
  493|       |
  494|       |      // If any bits were set in high part of x, then x > y
  495|      0|      result = CT::Mask<W>::is_zero(mask).select(result, GT);
  496|      0|   }
  497|       |
  498|   904k|   CT::unpoison(result);
  499|   904k|   BOTAN_DEBUG_ASSERT(result == LT || result == GT || result == EQ);
  ------------------
  |  |  137|   904k|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  138|   904k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (138:15): [Folded, False: 904k]
  |  |  ------------------
  ------------------
  500|   904k|   return static_cast<int32_t>(result);
  501|   904k|}
_ZN5Botan11bigint_sub2ITkNS_8WordTypeEmEET_PS1_mPKS1_m:
  151|   912k|inline constexpr auto bigint_sub2(W x[], size_t x_size, const W y[], size_t y_size) -> W {
  152|   912k|   W borrow = 0;
  153|       |
  154|   912k|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   71|   912k|   do {                                                                                 \
  |  |   72|   912k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                     \
  |  |   73|   912k|      if(!(expr)) {                                                                     \
  |  |  ------------------
  |  |  |  Branch (73:10): [True: 0, False: 912k]
  |  |  ------------------
  |  |   74|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                            \
  |  |   75|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   76|      0|      }                                                                                 \
  |  |   77|   912k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (77:12): [Folded, False: 912k]
  |  |  ------------------
  ------------------
  155|       |
  156|   912k|   const size_t blocks = y_size - (y_size % 8);
  157|       |
  158|  2.98M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (158:22): [True: 2.07M, False: 912k]
  ------------------
  159|  2.07M|      borrow = word8_sub2(x + i, y + i, borrow);
  160|  2.07M|   }
  161|       |
  162|  3.24M|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (162:27): [True: 2.33M, False: 912k]
  ------------------
  163|  2.33M|      x[i] = word_sub(x[i], y[i], &borrow);
  164|  2.33M|   }
  165|       |
  166|  1.81M|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (166:27): [True: 903k, False: 912k]
  ------------------
  167|   903k|      x[i] = word_sub(x[i], static_cast<W>(0), &borrow);
  168|   903k|   }
  169|       |
  170|   912k|   return borrow;
  171|   912k|}
_ZN5Botan11bigint_sub3ITkNS_8WordTypeEmEET_PS1_PKS1_mS4_m:
  195|  1.71M|inline constexpr auto bigint_sub3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W {
  196|  1.71M|   W borrow = 0;
  197|       |
  198|  1.71M|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   71|  1.71M|   do {                                                                                 \
  |  |   72|  1.71M|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                     \
  |  |   73|  1.71M|      if(!(expr)) {                                                                     \
  |  |  ------------------
  |  |  |  Branch (73:10): [True: 0, False: 1.71M]
  |  |  ------------------
  |  |   74|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                            \
  |  |   75|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   76|      0|      }                                                                                 \
  |  |   77|  1.71M|   } while(0)
  |  |  ------------------
  |  |  |  Branch (77:12): [Folded, False: 1.71M]
  |  |  ------------------
  ------------------
  199|       |
  200|  1.71M|   const size_t blocks = y_size - (y_size % 8);
  201|       |
  202|  4.85M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (202:22): [True: 3.14M, False: 1.71M]
  ------------------
  203|  3.14M|      borrow = word8_sub3(z + i, x + i, y + i, borrow);
  204|  3.14M|   }
  205|       |
  206|  7.40M|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (206:27): [True: 5.69M, False: 1.71M]
  ------------------
  207|  5.69M|      z[i] = word_sub(x[i], y[i], &borrow);
  208|  5.69M|   }
  209|       |
  210|  3.42M|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (210:27): [True: 1.71M, False: 1.71M]
  ------------------
  211|  1.71M|      z[i] = word_sub(x[i], static_cast<W>(0), &borrow);
  212|  1.71M|   }
  213|       |
  214|  1.71M|   return borrow;
  215|  1.71M|}
_ZN5Botan11bigint_add3ITkNS_8WordTypeEmEET_PS1_PKS1_mS4_m:
  123|   343k|inline constexpr auto bigint_add3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W {
  124|   343k|   if(x_size < y_size) {
  ------------------
  |  Branch (124:7): [True: 0, False: 343k]
  ------------------
  125|      0|      return bigint_add3(z, y, y_size, x, x_size);
  126|      0|   }
  127|       |
  128|   343k|   W carry = 0;
  129|       |
  130|   343k|   const size_t blocks = y_size - (y_size % 8);
  131|       |
  132|  1.71M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (132:22): [True: 1.37M, False: 343k]
  ------------------
  133|  1.37M|      carry = word8_add3(z + i, x + i, y + i, carry);
  134|  1.37M|   }
  135|       |
  136|   670k|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (136:27): [True: 327k, False: 343k]
  ------------------
  137|   327k|      z[i] = word_add(x[i], y[i], &carry);
  138|   327k|   }
  139|       |
  140|   343k|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (140:27): [True: 0, False: 343k]
  ------------------
  141|      0|      z[i] = word_add(x[i], static_cast<W>(0), &carry);
  142|      0|   }
  143|       |
  144|   343k|   return carry;
  145|   343k|}
_ZN5Botan14bigint_cnd_addITkNS_8WordTypeEmEET_S1_PS1_PKS1_m:
   48|   304k|inline constexpr W bigint_cnd_add(W cnd, W x[], const W y[], size_t size) {
   49|   304k|   const auto mask = CT::Mask<W>::expand(cnd).value();
   50|       |
   51|   304k|   W carry = 0;
   52|       |
   53|  14.8M|   for(size_t i = 0; i != size; ++i) {
  ------------------
  |  Branch (53:22): [True: 14.5M, False: 304k]
  ------------------
   54|  14.5M|      x[i] = word_add(x[i], y[i] & mask, &carry);
   55|  14.5M|   }
   56|       |
   57|   304k|   return (mask & carry);
   58|   304k|}
_ZN5Botan14bigint_linmul3ITkNS_8WordTypeEmEEvPT_PKS1_mS1_:
  419|  67.1k|inline constexpr void bigint_linmul3(W z[], const W x[], size_t x_size, W y) {
  420|  67.1k|   const size_t blocks = x_size - (x_size % 8);
  421|       |
  422|  67.1k|   W carry = 0;
  423|       |
  424|  67.1k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (424:22): [True: 0, False: 67.1k]
  ------------------
  425|      0|      carry = word8_linmul3(z + i, x + i, y, carry);
  426|      0|   }
  427|       |
  428|   161k|   for(size_t i = blocks; i != x_size; ++i) {
  ------------------
  |  Branch (428:27): [True: 94.6k, False: 67.1k]
  ------------------
  429|  94.6k|      z[i] = word_madd2(x[i], y, &carry);
  430|  94.6k|   }
  431|       |
  432|  67.1k|   z[x_size] = carry;
  433|  67.1k|}
_ZN5Botan14divide_precompImEC2Emmmm:
  771|  2.41k|            m_divisor(divisor), m_shift(shift), m_norm_divisor(norm_divisor), m_reciprocal(reciprocal) {}
_ZN5Botan11bigint_shr1ITkNS_8WordTypeEmEEvPT_mm:
  334|   391k|inline constexpr void bigint_shr1(W x[], size_t x_size, size_t shift) {
  335|   391k|   const size_t word_shift = shift / WordInfo<W>::bits;
  336|   391k|   const size_t bit_shift = shift % WordInfo<W>::bits;
  337|       |
  338|   391k|   const size_t top = x_size >= word_shift ? (x_size - word_shift) : 0;
  ------------------
  |  Branch (338:23): [True: 391k, False: 0]
  ------------------
  339|       |
  340|   391k|   if(top > 0) {
  ------------------
  |  Branch (340:7): [True: 391k, False: 0]
  ------------------
  341|   391k|      unchecked_copy_memory(x, x + word_shift, top);
  342|   391k|   }
  343|   391k|   zeroize_buffer(x + top, std::min(word_shift, x_size));
  344|       |
  345|   391k|   const auto carry_mask = CT::Mask<W>::expand(bit_shift);
  346|   391k|   const W carry_shift = carry_mask.if_set_return(WordInfo<W>::bits - bit_shift);
  347|       |
  348|   391k|   W carry = 0;
  349|       |
  350|  8.75M|   for(size_t i = 0; i != top; ++i) {
  ------------------
  |  Branch (350:22): [True: 8.36M, False: 391k]
  ------------------
  351|  8.36M|      const W w = x[top - i - 1];
  352|  8.36M|      x[top - i - 1] = (w >> bit_shift) | carry;
  353|  8.36M|      carry = carry_mask.if_set_return(w << carry_shift);
  354|  8.36M|   }
  355|   391k|}
_ZN5Botan15bigint_ct_is_eqITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_m:
  542|    918|inline constexpr auto bigint_ct_is_eq(const W x[], size_t x_size, const W y[], size_t y_size) -> CT::Mask<W> {
  543|    918|   const size_t common_elems = std::min(x_size, y_size);
  544|       |
  545|    918|   W diff = 0;
  546|       |
  547|  17.2k|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (547:22): [True: 16.3k, False: 918]
  ------------------
  548|  16.3k|      diff |= (x[i] ^ y[i]);
  549|  16.3k|   }
  550|       |
  551|       |   // If any bits were set in high part of x/y, then they are not equal
  552|    918|   if(x_size < y_size) {
  ------------------
  |  Branch (552:7): [True: 296, False: 622]
  ------------------
  553|  1.66k|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (553:30): [True: 1.37k, False: 296]
  ------------------
  554|  1.37k|         diff |= y[i];
  555|  1.37k|      }
  556|    622|   } else if(y_size < x_size) {
  ------------------
  |  Branch (556:14): [True: 563, False: 59]
  ------------------
  557|  3.36k|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (557:30): [True: 2.80k, False: 563]
  ------------------
  558|  2.80k|         diff |= x[i];
  559|  2.80k|      }
  560|    563|   }
  561|       |
  562|    918|   return CT::Mask<W>::is_zero(diff);
  563|    918|}
_ZN5Botan15bigint_ct_is_ltITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_mb:
  510|  1.15M|   -> CT::Mask<W> {
  511|  1.15M|   const size_t common_elems = std::min(x_size, y_size);
  512|       |
  513|  1.15M|   auto is_lt = CT::Mask<W>::expand(lt_or_equal);
  514|       |
  515|  21.9M|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (515:22): [True: 20.8M, False: 1.15M]
  ------------------
  516|  20.8M|      const auto eq = CT::Mask<W>::is_equal(x[i], y[i]);
  517|  20.8M|      const auto lt = CT::Mask<W>::is_lt(x[i], y[i]);
  518|  20.8M|      is_lt = eq.select_mask(is_lt, lt);
  519|  20.8M|   }
  520|       |
  521|  1.15M|   if(x_size < y_size) {
  ------------------
  |  Branch (521:7): [True: 1.32k, False: 1.15M]
  ------------------
  522|  1.32k|      W mask = 0;
  523|  10.5k|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (523:30): [True: 9.20k, False: 1.32k]
  ------------------
  524|  9.20k|         mask |= y[i];
  525|  9.20k|      }
  526|       |      // If any bits were set in high part of y, then is_lt should be forced true
  527|  1.32k|      is_lt |= CT::Mask<W>::expand(mask);
  528|  1.15M|   } else if(y_size < x_size) {
  ------------------
  |  Branch (528:14): [True: 1.15M, False: 1.03k]
  ------------------
  529|  1.15M|      W mask = 0;
  530|  28.0M|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (530:30): [True: 26.8M, False: 1.15M]
  ------------------
  531|  26.8M|         mask |= x[i];
  532|  26.8M|      }
  533|       |
  534|       |      // If any bits were set in high part of x, then is_lt should be false
  535|  1.15M|      is_lt &= CT::Mask<W>::is_zero(mask);
  536|  1.15M|   }
  537|       |
  538|  1.15M|   return is_lt;
  539|  1.15M|}
_ZN5Botan13bigint_submulITkNS_8WordTypeEmEET_PS1_PKS1_mS1_:
  442|  17.4k|inline constexpr auto bigint_submul(W z[], const W y[], size_t N, W q) -> W {
  443|  17.4k|   W mul_carry = 0;
  444|  17.4k|   W borrow = 0;
  445|       |
  446|   314k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (446:22): [True: 297k, False: 17.4k]
  ------------------
  447|   297k|      const W t = word_madd2(y[i], q, &mul_carry);
  448|   297k|      z[i] = word_sub(z[i], t, &borrow);
  449|   297k|   }
  450|       |
  451|       |   // Both mul_carry <= W_max - 1 and borrow <= 1, so this cannot overflow
  452|  17.4k|   return mul_carry + borrow;
  453|  17.4k|}
_ZN5Botan14bigint_sub_absITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPS3_PKS3_S7_mS5_:
  282|  1.48M|inline constexpr auto bigint_sub_abs(W z[], const W x[], const W y[], size_t N, W ws[]) -> CT::Mask<W> {
  283|       |   // Subtract in both direction then conditional copy out the result
  284|       |
  285|  1.48M|   W* ws0 = ws;
  286|  1.48M|   W* ws1 = ws + N;
  287|       |
  288|  1.48M|   W borrow0 = 0;
  289|  1.48M|   W borrow1 = 0;
  290|       |
  291|  1.48M|   const size_t blocks = N - (N % 8);
  292|       |
  293|  4.56M|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (293:22): [True: 3.07M, False: 1.48M]
  ------------------
  294|  3.07M|      borrow0 = word8_sub3(ws0 + i, x + i, y + i, borrow0);
  295|  3.07M|      borrow1 = word8_sub3(ws1 + i, y + i, x + i, borrow1);
  296|  3.07M|   }
  297|       |
  298|  3.61M|   for(size_t i = blocks; i != N; ++i) {
  ------------------
  |  Branch (298:27): [True: 2.12M, False: 1.48M]
  ------------------
  299|  2.12M|      ws0[i] = word_sub(x[i], y[i], &borrow0);
  300|  2.12M|      ws1[i] = word_sub(y[i], x[i], &borrow1);
  301|  2.12M|   }
  302|       |
  303|  1.48M|   return CT::conditional_copy_mem(borrow0, z, ws1, ws0, N);
  304|  1.48M|}
_ZN5Botan14bigint_cnd_subITkNS_8WordTypeEmEET_S1_PS1_PKS1_m:
   65|   287k|inline constexpr auto bigint_cnd_sub(W cnd, W x[], const W y[], size_t size) -> W {
   66|   287k|   const auto mask = CT::Mask<W>::expand(cnd).value();
   67|       |
   68|   287k|   W carry = 0;
   69|       |
   70|  14.5M|   for(size_t i = 0; i != size; ++i) {
  ------------------
  |  Branch (70:22): [True: 14.2M, False: 287k]
  ------------------
   71|  14.2M|      x[i] = word_sub(x[i], y[i] & mask, &carry);
   72|  14.2M|   }
   73|       |
   74|   287k|   return (mask & carry);
   75|   287k|}
_ZN5Botan13monty_inverseITkNS_8WordTypeEmEET_S1_:
  856|    536|inline constexpr auto monty_inverse(W a) -> W {
  857|    536|   BOTAN_ARG_CHECK(a % 2 == 1, "Cannot compute Montgomery inverse of an even integer");
  ------------------
  |  |   35|    536|   do {                                                          \
  |  |   36|    536|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    536|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 536]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    536|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 536]
  |  |  ------------------
  ------------------
  858|       |
  859|       |   // Newton's Method, following https://lemire.me/blog/2017/09/18/computing-the-inverse-of-odd-integers/
  860|       |
  861|    536|   constexpr size_t iter = WordInfo<W>::bits == 64 ? 4 : 3;
  ------------------
  |  Branch (861:28): [True: 0, Folded]
  ------------------
  862|       |
  863|       |   // Initial guess provides 5 bits of accuracy
  864|    536|   W r = (3 * a) ^ 2;
  865|       |
  866|       |   // Each iteration doubles the accuracy
  867|  2.68k|   for(size_t i = 0; i != iter; ++i) {
  ------------------
  |  Branch (867:22): [True: 2.14k, False: 536]
  ------------------
  868|  2.14k|      r = r * (2 - r * a);
  869|  2.14k|   }
  870|       |
  871|       |   // Now invert in addition space
  872|    536|   r = (WordInfo<W>::max - r) + 1;
  873|       |
  874|    536|   return r;
  875|    536|}
_ZN5Botan22bigint_monty_maybe_subITkNS_8WordTypeEmEEvmPT_S1_PKS1_S4_:
  228|   258k|inline constexpr void bigint_monty_maybe_sub(size_t N, W z[], W x0, const W x[], const W p[]) {
  229|   258k|   W borrow = 0;
  230|       |
  231|   258k|   const size_t blocks = N - (N % 8);
  232|       |
  233|   704k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (233:22): [True: 446k, False: 258k]
  ------------------
  234|   446k|      borrow = word8_sub3(z + i, x + i, p + i, borrow);
  235|   446k|   }
  236|       |
  237|   795k|   for(size_t i = blocks; i != N; ++i) {
  ------------------
  |  Branch (237:27): [True: 536k, False: 258k]
  ------------------
  238|   536k|      z[i] = word_sub(x[i], p[i], &borrow);
  239|   536k|   }
  240|       |
  241|   258k|   borrow = (x0 - borrow) > x0;
  242|       |
  243|   258k|   CT::conditional_assign_mem(borrow, z, x, N);
  244|   258k|}
_ZN5Botan22bigint_monty_maybe_subILm4ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_:
  257|  6.90k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) {
  258|  6.90k|   W borrow = 0;
  259|       |
  260|  34.5k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (260:22): [True: 27.6k, False: 6.90k]
  ------------------
  261|  27.6k|      z[i] = word_sub(x[i], y[i], &borrow);
  262|  27.6k|   }
  263|       |
  264|  6.90k|   borrow = (x0 - borrow) > x0;
  265|       |
  266|  6.90k|   CT::conditional_assign_mem(borrow, z, x, N);
  267|  6.90k|}
_ZN5Botan22bigint_monty_maybe_subILm6ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_:
  257|  8.75k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) {
  258|  8.75k|   W borrow = 0;
  259|       |
  260|  61.2k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (260:22): [True: 52.5k, False: 8.75k]
  ------------------
  261|  52.5k|      z[i] = word_sub(x[i], y[i], &borrow);
  262|  52.5k|   }
  263|       |
  264|  8.75k|   borrow = (x0 - borrow) > x0;
  265|       |
  266|  8.75k|   CT::conditional_assign_mem(borrow, z, x, N);
  267|  8.75k|}
_ZN5Botan22bigint_monty_maybe_subILm8ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_:
  257|  10.8k|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) {
  258|  10.8k|   W borrow = 0;
  259|       |
  260|  97.3k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (260:22): [True: 86.5k, False: 10.8k]
  ------------------
  261|  86.5k|      z[i] = word_sub(x[i], y[i], &borrow);
  262|  86.5k|   }
  263|       |
  264|  10.8k|   borrow = (x0 - borrow) > x0;
  265|       |
  266|  10.8k|   CT::conditional_assign_mem(borrow, z, x, N);
  267|  10.8k|}
_ZN5Botan22bigint_monty_maybe_subILm12ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_:
  257|     10|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) {
  258|     10|   W borrow = 0;
  259|       |
  260|    130|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (260:22): [True: 120, False: 10]
  ------------------
  261|    120|      z[i] = word_sub(x[i], y[i], &borrow);
  262|    120|   }
  263|       |
  264|     10|   borrow = (x0 - borrow) > x0;
  265|       |
  266|     10|   CT::conditional_assign_mem(borrow, z, x, N);
  267|     10|}
_ZN5Botan22bigint_monty_maybe_subILm16ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_:
  257|     20|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) {
  258|     20|   W borrow = 0;
  259|       |
  260|    340|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (260:22): [True: 320, False: 20]
  ------------------
  261|    320|      z[i] = word_sub(x[i], y[i], &borrow);
  262|    320|   }
  263|       |
  264|     20|   borrow = (x0 - borrow) > x0;
  265|       |
  266|     20|   CT::conditional_assign_mem(borrow, z, x, N);
  267|     20|}
_ZN5Botan22bigint_monty_maybe_subILm24ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_:
  257|     11|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) {
  258|     11|   W borrow = 0;
  259|       |
  260|    275|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (260:22): [True: 264, False: 11]
  ------------------
  261|    264|      z[i] = word_sub(x[i], y[i], &borrow);
  262|    264|   }
  263|       |
  264|     11|   borrow = (x0 - borrow) > x0;
  265|       |
  266|     11|   CT::conditional_assign_mem(borrow, z, x, N);
  267|     11|}
_ZN5Botan22bigint_monty_maybe_subILm32ETkNS_8WordTypeEmEEvPT0_S1_PKS1_S4_:
  257|     15|inline constexpr void bigint_monty_maybe_sub(W z[N], W x0, const W x[N], const W y[N]) {
  258|     15|   W borrow = 0;
  259|       |
  260|    495|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (260:22): [True: 480, False: 15]
  ------------------
  261|    480|      z[i] = word_sub(x[i], y[i], &borrow);
  262|    480|   }
  263|       |
  264|     15|   borrow = (x0 - borrow) > x0;
  265|       |
  266|     15|   CT::conditional_assign_mem(borrow, z, x, N);
  267|     15|}

_ZN5Botan14use_mulx_montyEm:
   33|   284k|inline bool use_mulx_monty(size_t p_size) {
   34|   284k|   return p_size >= MulxMontyMinWords && CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX);
  ------------------
  |  Branch (34:11): [True: 223k, False: 61.1k]
  |  Branch (34:42): [True: 223k, False: 0]
  ------------------
   35|   284k|}

_ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEmQntsr3stdE7same_asIbT_EEES3_S3_:
   43|   406M|constexpr inline T value_barrier(T x) {
   44|   406M|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (44:7): [Folded, False: 406M]
  ------------------
   45|      0|      return x;
   46|   406M|   } else {
   47|   406M|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM)
   48|       |      /*
   49|       |      * We may want a "stronger" statement such as
   50|       |      *     asm volatile("" : "+r,m"(x) : : "memory);
   51|       |      * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html)
   52|       |      * however the current approach seems sufficient with current compilers,
   53|       |      * and is minimally damaging with regards to degrading code generation.
   54|       |      */
   55|   406M|      asm("" : "+r"(x) : /* no input */);  // NOLINT(*-no-assembler)
   56|   406M|      return x;
   57|       |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE)
   58|       |      volatile T vx = x;
   59|       |      return vx;
   60|       |#else
   61|       |      return x;
   62|       |#endif
   63|   406M|   }
   64|   406M|}
_ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEhQntsr3stdE7same_asIbT_EEES3_S3_:
   43|   802k|constexpr inline T value_barrier(T x) {
   44|   802k|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (44:7): [Folded, False: 802k]
  ------------------
   45|      0|      return x;
   46|   802k|   } else {
   47|   802k|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM)
   48|       |      /*
   49|       |      * We may want a "stronger" statement such as
   50|       |      *     asm volatile("" : "+r,m"(x) : : "memory);
   51|       |      * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html)
   52|       |      * however the current approach seems sufficient with current compilers,
   53|       |      * and is minimally damaging with regards to degrading code generation.
   54|       |      */
   55|   802k|      asm("" : "+r"(x) : /* no input */);  // NOLINT(*-no-assembler)
   56|   802k|      return x;
   57|       |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE)
   58|       |      volatile T vx = x;
   59|       |      return vx;
   60|       |#else
   61|       |      return x;
   62|       |#endif
   63|   802k|   }
   64|   802k|}

_ZN5Botan13ignore_paramsIJPKmmEEEvDpRKT_:
  149|  8.81M|constexpr void ignore_params([[maybe_unused]] const T&... args) {}

_ZN5BotaneqERKNS_6BigIntEm:
 1373|  2.01k|inline bool operator==(const BigInt& a, word b) {
 1374|  2.01k|   return (a.cmp_word(b) == 0);
 1375|  2.01k|}
_ZN5BotangtERKNS_6BigIntEm:
 1423|   392k|inline bool operator>(const BigInt& a, word b) {
 1424|   392k|   return (a.cmp_word(b) > 0);
 1425|   392k|}
_ZNK5Botan6BigInt6is_oddEv:
  487|   392k|      bool is_odd() const { return get_bit(0); }
_ZNK5Botan6BigInt7get_bitEm:
  549|   553k|      bool get_bit(size_t n) const { return ((word_at(n / (sizeof(word) * 8)) >> (n % (sizeof(word) * 8))) & 1) == 1; }
_ZNK5Botan6BigInt7word_atEm:
  601|  16.7M|      word word_at(size_t n) const { return m_data.get_word_at(n); }
_ZNK5Botan6BigInt4Data11get_word_atEm:
 1099|  16.7M|            word get_word_at(size_t n) const {
 1100|  16.7M|               if(n < m_reg.size()) {
  ------------------
  |  Branch (1100:19): [True: 15.9M, False: 739k]
  ------------------
 1101|  15.9M|                  return m_reg[n];
 1102|  15.9M|               }
 1103|   739k|               return 0;
 1104|  16.7M|            }
_ZN5Botan6BigIntaSEOS0_:
  190|   860k|      BigInt& operator=(BigInt&& other) noexcept {
  191|   860k|         if(this != &other) {
  ------------------
  |  Branch (191:13): [True: 860k, False: 0]
  ------------------
  192|   860k|            this->swap(other);
  193|   860k|         }
  194|       |
  195|   860k|         return (*this);
  196|   860k|      }
_ZN5Botan6BigInt4swapERS0_:
  207|   862k|      void swap(BigInt& other) noexcept {
  208|   862k|         m_data.swap(other.m_data);
  209|   862k|         std::swap(m_signedness, other.m_signedness);
  210|   862k|      }
_ZN5Botan6BigInt4Data4swapERS1_:
 1151|   862k|            void swap(Data& other) noexcept {
 1152|   862k|               m_reg.swap(other.m_reg);
 1153|   862k|               std::swap(m_sig_words, other.m_sig_words);
 1154|   862k|            }
_ZN5Botan6BigIntC2ERKS0_:
   88|  4.41k|      BigInt(const BigInt& other) = default;
_ZN5Botan6BigIntD2Ev:
  185|   882k|      ~BigInt() { _const_time_unpoison(); }
_ZN5BotanneERKNS_6BigIntES2_:
 1323|    918|inline bool operator!=(const BigInt& a, const BigInt& b) {
 1324|    918|   return !a.is_equal(b);
 1325|    918|}
_ZN5Botan6BigInt4zeroEv:
   50|    414|      static BigInt zero() { return BigInt(); }
_ZN5Botan6BigInt3oneEv:
   55|    339|      static BigInt one() { return BigInt::from_u64(1); }
_ZN5Botan6BigIntC2EOS0_:
  183|  1.90k|      BigInt(BigInt&& other) noexcept { this->swap(other); }
_ZN5Botan6BigInt5clearEv:
  441|  3.20k|      void clear() {
  442|  3.20k|         m_data.set_to_zero();
  443|  3.20k|         m_signedness = Positive;
  444|  3.20k|      }
_ZNK5Botan6BigInt7is_evenEv:
  481|    536|      bool is_even() const { return !get_bit(0); }
_ZNK5Botan6BigInt6signumEv:
  493|  1.57M|      int signum() const {
  494|  1.57M|         if(sig_words() == 0) {
  ------------------
  |  Branch (494:13): [True: 206k, False: 1.36M]
  ------------------
  495|   206k|            return 0;
  496|   206k|         }
  497|  1.36M|         return (sign() == Negative) ? -1 : 1;
  ------------------
  |  Branch (497:17): [True: 0, False: 1.36M]
  ------------------
  498|  1.57M|      }
_ZNK5Botan6BigInt7is_zeroEv:
  510|  1.83k|      bool is_zero() const { return sig_words() == 0; }
_ZN5Botan6BigInt7set_bitEm:
  516|  2.44k|      void set_bit(size_t n) { conditionally_set_bit(n, true); }
_ZN5Botan6BigInt21conditionally_set_bitEmb:
  526|  2.44k|      void conditionally_set_bit(size_t n, bool set_it) {
  527|  2.44k|         const size_t which = n / (sizeof(word) * 8);
  528|  2.44k|         const word mask = static_cast<word>(set_it) << (n % (sizeof(word) * 8));
  529|  2.44k|         m_data.set_word_at(which, word_at(which) | mask);
  530|  2.44k|      }
_ZN5Botan6BigInt11set_word_atEmm:
  608|  8.04M|      BOTAN_DEPRECATED("Deprecated no replacement") void set_word_at(size_t i, word w) { m_data.set_word_at(i, w); }
_ZNK5Botan6BigInt4signEv:
  641|  1.84M|      Sign sign() const { return (m_signedness); }
_ZN5Botan6BigInt8set_signENS0_4SignE:
  663|   160k|      void set_sign(Sign sign) {
  664|   160k|         if(sign == Negative && is_zero()) {
  ------------------
  |  Branch (664:13): [True: 0, False: 160k]
  |  Branch (664:33): [True: 0, False: 0]
  ------------------
  665|      0|            sign = Positive;
  666|      0|         }
  667|       |
  668|   160k|         m_signedness = sign;
  669|   160k|      }
_ZNK5Botan6BigInt4sizeEv:
  681|  5.51M|      size_t size() const { return m_data.size(); }
_ZNK5Botan6BigInt9sig_wordsEv:
  687|  5.24M|      size_t sig_words() const { return m_data.sig_words(); }
_ZNK5Botan6BigInt7grow_toEm:
  738|  4.54k|      BOTAN_DEPRECATED("Deprecated no replacement") void grow_to(size_t n) const { m_data.grow_to(n); }
_ZN5Botan6BigInt10power_of_2Em:
  906|  2.44k|      static BigInt power_of_2(size_t n) {
  907|  2.44k|         BigInt b;
  908|  2.44k|         b.set_bit(n);
  909|  2.44k|         return b;
  910|  2.44k|      }
_ZNK5Botan6BigInt8_as_spanEv:
 1023|  2.16k|      std::span<const word> _as_span() const { return m_data.const_span(); }
_ZNK5Botan6BigInt5_dataEv:
 1033|  7.29M|      const word* _data() const { return m_data.const_data(); }
_ZN5Botan6BigInt11_from_wordsERNSt3__16vectorImNS_16secure_allocatorImEEEE:
 1052|   861k|      static BigInt _from_words(secure_vector<word>& words) {
 1053|   861k|         BigInt bn;
 1054|   861k|         bn.m_data.swap(words);
 1055|   861k|         return bn;
 1056|   861k|      }
_ZN5Botan6BigInt4Data12mutable_dataEv:
 1083|   391k|            word* mutable_data() {
 1084|   391k|               invalidate_sig_words();
 1085|   391k|               return m_reg.data();
 1086|   391k|            }
_ZNK5Botan6BigInt4Data10const_dataEv:
 1088|  8.17M|            const word* const_data() const { return m_reg.data(); }
_ZNK5Botan6BigInt4Data10const_spanEv:
 1090|  2.16k|            std::span<const word> const_span() const { return std::span{m_reg}; }
_ZN5Botan6BigInt4Data11set_word_atEmm:
 1106|  8.04M|            void set_word_at(size_t i, word w) {
 1107|  8.04M|               invalidate_sig_words();
 1108|  8.04M|               if(i >= m_reg.size()) {
  ------------------
  |  Branch (1108:19): [True: 3.84k, False: 8.04M]
  ------------------
 1109|  3.84k|                  if(w == 0) {
  ------------------
  |  Branch (1109:22): [True: 1, False: 3.84k]
  ------------------
 1110|      1|                     return;
 1111|      1|                  }
 1112|  3.84k|                  grow_to(i + 1);
 1113|  3.84k|               }
 1114|  8.04M|               m_reg[i] = w;
 1115|  8.04M|            }
_ZNK5Botan6BigInt4Data7grow_toEm:
 1126|  8.38k|            void grow_to(size_t n) const {
 1127|  8.38k|               if(n > size()) {
  ------------------
  |  Branch (1127:19): [True: 8.07k, False: 316]
  ------------------
 1128|  8.07k|                  if(n <= m_reg.capacity()) {
  ------------------
  |  Branch (1128:22): [True: 0, False: 8.07k]
  ------------------
 1129|      0|                     m_reg.resize(n);
 1130|  8.07k|                  } else {
 1131|  8.07k|                     m_reg.resize(n + (8 - (n % 8)));
 1132|  8.07k|                  }
 1133|  8.07k|               }
 1134|  8.38k|            }
_ZNK5Botan6BigInt4Data4sizeEv:
 1136|  6.79M|            size_t size() const { return m_reg.size(); }
_ZN5Botan6BigInt4Data4swapERNSt3__16vectorImNS_16secure_allocatorImEEEE:
 1156|   864k|            void swap(secure_vector<word>& reg) noexcept {
 1157|   864k|               m_reg.swap(reg);
 1158|   864k|               invalidate_sig_words();
 1159|   864k|            }
_ZNK5Botan6BigInt4Data20invalidate_sig_wordsEv:
 1161|  9.30M|            void invalidate_sig_words() const noexcept { m_sig_words = sig_words_npos; }
_ZNK5Botan6BigInt4Data9sig_wordsEv:
 1163|  5.24M|            size_t sig_words() const {
 1164|  5.24M|               if(m_sig_words == sig_words_npos) {
  ------------------
  |  Branch (1164:19): [True: 1.25M, False: 3.98M]
  ------------------
 1165|  1.25M|                  m_sig_words = calc_sig_words();
 1166|  1.25M|               }
 1167|  5.24M|               return m_sig_words;
 1168|  5.24M|            }
_ZN5BotanltERKNS_6BigIntES2_:
 1353|  1.63k|inline bool operator<(const BigInt& a, const BigInt& b) {
 1354|  1.63k|   return a.is_less_than(b);
 1355|  1.63k|}
_ZN5BotanltERKNS_6BigIntEm:
 1413|    536|inline bool operator<(const BigInt& a, word b) {
 1414|    536|   return (a.cmp_word(b) < 0);
 1415|    536|}
_ZN5Botan6BigIntC2Ev:
   45|   875k|      BigInt() = default;
_ZN5Botan6BigIntaSERKS0_:
  201|    536|      BigInt& operator=(const BigInt&) = default;

_ZN5Botan11clear_bytesEPvm:
  101|  1.99M|inline constexpr void clear_bytes(void* ptr, size_t bytes) {
  102|  1.99M|   if(bytes > 0) {
  ------------------
  |  Branch (102:7): [True: 1.99M, False: 3.20k]
  ------------------
  103|  1.99M|      std::memset(ptr, 0, bytes);
  104|  1.99M|   }
  105|  1.99M|}
_ZN5Botan9clear_memImEEvPT_m:
  118|  1.13M|inline constexpr void clear_mem(T* ptr, size_t n) {
  119|  1.13M|   clear_bytes(ptr, sizeof(T) * n);
  120|  1.13M|}
_ZN5Botan8copy_memImQsr3stdE12is_trivial_vIu7__decayIT_EEEEvPS1_PKS1_m:
  144|   962k|inline constexpr void copy_mem(T* out, const T* in, size_t n) {
  145|   962k|   BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null");
  ------------------
  |  |  110|   962k|   do {                                                                                          \
  |  |  111|   962k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                              \
  |  |  112|  1.92M|      if((expr1) && !(expr2)) {                                                                  \
  |  |  ------------------
  |  |  |  Branch (112:10): [True: 962k, False: 0]
  |  |  |  Branch (112:23): [True: 962k, False: 0]
  |  |  |  Branch (112:23): [True: 962k, False: 0]
  |  |  ------------------
  |  |  113|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                                     \
  |  |  114|      0|         Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \
  |  |  115|      0|      }                                                                                          \
  |  |  116|   962k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (116:12): [Folded, False: 962k]
  |  |  ------------------
  ------------------
  146|       |
  147|   962k|   if(in != nullptr && out != nullptr && n > 0) {
  ------------------
  |  Branch (147:7): [True: 962k, False: 0]
  |  Branch (147:24): [True: 962k, False: 0]
  |  Branch (147:42): [True: 962k, False: 0]
  ------------------
  148|   962k|      std::memmove(out, in, sizeof(T) * n);
  149|   962k|   }
  150|   962k|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS6_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEEES6_RKSB_:
  210|  23.0k|inline constexpr ToT typecast_copy(const FromR& src) {
  211|  23.0k|   ToT dst;  // NOLINT(*-member-init)
  212|  23.0k|   typecast_copy(dst, src);
  213|  23.0k|   return dst;
  214|  23.0k|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISK_EEEvRSK_RKSA_:
  188|  23.0k|inline constexpr void typecast_copy(ToT& out, const FromR& in) {
  189|  23.0k|   typecast_copy(std::span<ToT, 1>(&out, 1), in);
  190|  23.0k|}
_ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IKhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_:
  176|  23.0k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) {
  177|  23.0k|   ranges::assert_equal_byte_lengths(out, in);
  178|  23.0k|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|  23.0k|}
_ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKhLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_:
  160|  2.55k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  161|  2.55k|   ranges::assert_equal_byte_lengths(out, in);
  162|  2.55k|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (162:7): [Folded, False: 2.55k]
  ------------------
  163|      0|      std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out));
  164|  2.55k|   } else if(ranges::size_bytes(out) > 0) {
  ------------------
  |  Branch (164:14): [True: 2.55k, False: 0]
  ------------------
  165|  2.55k|      std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  166|  2.55k|   }
  167|  2.55k|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS5_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEEES5_RKSA_:
  210|  2.55k|inline constexpr ToT typecast_copy(const FromR& src) {
  211|  2.55k|   ToT dst;  // NOLINT(*-member-init)
  212|  2.55k|   typecast_copy(dst, src);
  213|  2.55k|   return dst;
  214|  2.55k|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISC_EESD_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISJ_EEEvRSJ_RKS9_:
  188|  2.55k|inline constexpr void typecast_copy(ToT& out, const FromR& in) {
  189|  2.55k|   typecast_copy(std::span<ToT, 1>(&out, 1), in);
  190|  2.55k|}
_ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS6_IXsr21__is_primary_templateINS7_Iu14__remove_cvrefIDTclL_ZNS9_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSF_ISN_EESO_E4type10value_typeEEEEvOSK_RKSA_:
  176|  2.55k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) {
  177|  2.55k|   ranges::assert_equal_byte_lengths(out, in);
  178|  2.55k|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|  2.55k|}
_ZN5Botan9clear_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm18446744073709551615EEEEEvOT_Qsr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRS5_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEE:
  132|   855k|{
  133|   855k|   clear_bytes(std::ranges::data(mem), ranges::size_bytes(mem));
  134|   855k|}
_ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKmLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_:
  160|  1.09k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  161|  1.09k|   ranges::assert_equal_byte_lengths(out, in);
  162|  1.09k|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (162:7): [Folded, False: 1.09k]
  ------------------
  163|      0|      std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out));
  164|  1.09k|   } else if(ranges::size_bytes(out) > 0) {
  ------------------
  |  Branch (164:14): [True: 1.09k, False: 0]
  ------------------
  165|  1.09k|      std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  166|  1.09k|   }
  167|  1.09k|}
_ZN5Botan9clear_memIjEEvPT_m:
  118|      6|inline constexpr void clear_mem(T* ptr, size_t n) {
  119|      6|   clear_bytes(ptr, sizeof(T) * n);
  120|      6|}

_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|  2.55k|{
  101|  2.55k|   const std::span s0{r0};
  102|       |
  103|       |   if constexpr(statically_spanable_range<R0>) {
  104|       |      constexpr size_t expected_size = s0.size_bytes();
  105|       |      (assert_exact_byte_length<expected_size>(rs), ...);
  106|  2.55k|   } else {
  107|  2.55k|      const size_t expected_size = s0.size_bytes();
  108|  2.55k|      const bool correct_size =
  109|  2.55k|         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|  2.55k|      if(!correct_size) {
  ------------------
  |  Branch (111:10): [True: 0, False: 2.55k]
  ------------------
  112|      0|         memory_region_size_violation();
  113|      0|      }
  114|  2.55k|   }
  115|  2.55k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIhLm8EEEEEvRKT0_:
   77|  2.55k|inline constexpr void assert_exact_byte_length(const R& r) {
   78|  2.55k|   const std::span s{r};
   79|  2.55k|   if constexpr(statically_spanable_range<R>) {
   80|  2.55k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|  2.55k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIKhLm8EEEEEvRKT0_:
   77|  46.1k|inline constexpr void assert_exact_byte_length(const R& r) {
   78|  46.1k|   const std::span s{r};
   79|  46.1k|   if constexpr(statically_spanable_range<R>) {
   80|  46.1k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|  46.1k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IKhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|  23.0k|{
  101|  23.0k|   const std::span s0{r0};
  102|       |
  103|  23.0k|   if constexpr(statically_spanable_range<R0>) {
  104|  23.0k|      constexpr size_t expected_size = s0.size_bytes();
  105|  23.0k|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|  23.0k|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm1EEEEEmRKT_:
   59|  25.6k|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|  25.6k|   return std::span{r}.size_bytes();
   61|  25.6k|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEEEEmRKT_:
   59|  5.10k|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|  5.10k|   return std::span{r}.size_bytes();
   61|  5.10k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__15arrayIhLm8EEEEEvRKT0_:
   77|  2.55k|inline constexpr void assert_exact_byte_length(const R& r) {
   78|  2.55k|   const std::span s{r};
   79|  2.55k|   if constexpr(statically_spanable_range<R>) {
   80|  2.55k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|  2.55k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|  2.55k|{
  101|  2.55k|   const std::span s0{r0};
  102|       |
  103|  2.55k|   if constexpr(statically_spanable_range<R0>) {
  104|  2.55k|      constexpr size_t expected_size = s0.size_bytes();
  105|  2.55k|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|  2.55k|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm18446744073709551615EEEEEmRKT_:
   59|   857k|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|   857k|   return std::span{r}.size_bytes();
   61|   857k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKmLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|  1.09k|{
  101|  1.09k|   const std::span s0{r0};
  102|       |
  103|       |   if constexpr(statically_spanable_range<R0>) {
  104|       |      constexpr size_t expected_size = s0.size_bytes();
  105|       |      (assert_exact_byte_length<expected_size>(rs), ...);
  106|  1.09k|   } else {
  107|  1.09k|      const size_t expected_size = s0.size_bytes();
  108|  1.09k|      const bool correct_size =
  109|  1.09k|         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|  1.09k|      if(!correct_size) {
  ------------------
  |  Branch (111:10): [True: 0, False: 1.09k]
  ------------------
  112|      0|         memory_region_size_violation();
  113|      0|      }
  114|  1.09k|   }
  115|  1.09k|}

_ZN5Botan16secure_allocatorImE8allocateEm:
   95|  3.45M|      T* allocate(std::size_t n) { return static_cast<T*>(allocate_memory(n, sizeof(T))); }
_ZN5Botan16secure_allocatorImE10deallocateEPmm:
  102|  3.45M|      void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); }

_ZN5Botan16wrap_strong_typeImRmQoosr3stdE18constructible_fromIT_T0_Eaasr8conceptsE11strong_typeIS2_Esr3stdE18constructible_fromINS2_12wrapped_typeES3_EEEDcOS3_:
  144|  25.6k|[[nodiscard]] constexpr decltype(auto) wrap_strong_type(ParamT&& t) {
  145|  25.6k|   if constexpr(std::same_as<std::remove_cvref_t<ParamT>, T>) {
  146|       |      // Noop, if the parameter type already is the desired return type.
  147|  25.6k|      return std::forward<ParamT>(t);
  148|       |   } else if constexpr(std::constructible_from<T, ParamT>) {
  149|       |      // Implicit conversion from the parameter type to the return type.
  150|       |      return T{std::forward<ParamT>(t)};
  151|       |   } else {
  152|       |      // Explicitly calling the wrapped type's constructor to support
  153|       |      // implicit conversions on types that mark their constructors as explicit.
  154|       |      static_assert(concepts::strong_type<T> && std::constructible_from<typename T::wrapped_type, ParamT>);
  155|       |      return T{typename T::wrapped_type{std::forward<ParamT>(t)}};
  156|       |   }
  157|  25.6k|}

LLVMFuzzerInitialize:
   28|      2|extern "C" int LLVMFuzzerInitialize(int* /*argc*/, char*** /*argv*/) {
   29|       |   /*
   30|       |   * This disables the mlock pool, as overwrites within the pool are
   31|       |   * opaque to ASan or other instrumentation.
   32|       |   */
   33|      2|   ::setenv("BOTAN_MLOCK_POOL_SIZE", "0", 1);
   34|      2|   return 0;
   35|      2|}
LLVMFuzzerTestOneInput:
   39|  1.09k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t in[], size_t len) {
   40|  1.09k|   if(len <= max_fuzzer_input_size) {
  ------------------
  |  Branch (40:7): [True: 1.08k, False: 9]
  ------------------
   41|  1.08k|      try {
   42|  1.08k|         fuzz(std::span<const uint8_t>(in, len));
   43|  1.08k|      } catch(const std::exception& e) {
   44|      0|         std::cerr << "Uncaught exception from fuzzer driver " << e.what() << "\n";
   45|      0|         abort();
   46|      0|      } catch(...) {
   47|      0|         std::cerr << "Uncaught exception from fuzzer driver (unknown type)\n";
   48|      0|         abort();
   49|      0|      }
   50|  1.08k|   }
   51|  1.09k|   return 0;
   52|  1.09k|}

_Z4fuzzNSt3__14spanIKhLm18446744073709551615EEE:
   37|  1.08k|void fuzz(std::span<const uint8_t> in) {
   38|  1.08k|   static const size_t max_bits = 2048;
   39|       |
   40|  1.08k|   if(in.size() % 3 != 0) {
  ------------------
  |  Branch (40:7): [True: 12, False: 1.07k]
  ------------------
   41|     12|      return;
   42|     12|   }
   43|       |
   44|  1.07k|   const size_t part_size = in.size() / 3;
   45|       |
   46|  1.07k|   if(part_size * 8 > max_bits) {
  ------------------
  |  Branch (46:7): [True: 10, False: 1.06k]
  ------------------
   47|     10|      return;
   48|     10|   }
   49|       |
   50|  1.06k|   const Botan::BigInt g = Botan::BigInt::from_bytes(in.subspan(0, part_size));
   51|  1.06k|   const Botan::BigInt x = Botan::BigInt::from_bytes(in.subspan(part_size, part_size));
   52|  1.06k|   const Botan::BigInt p = Botan::BigInt::from_bytes(in.subspan(2 * part_size, part_size));
   53|       |
   54|  1.06k|   try {
   55|  1.06k|      const Botan::BigInt ref = simple_power_mod(g, x, p);
   56|  1.06k|      const Botan::BigInt z = Botan::power_mod(g, x, p);
   57|       |
   58|  1.06k|      if(ref != z) {
  ------------------
  |  Branch (58:10): [True: 0, False: 1.06k]
  ------------------
   59|      0|         FUZZER_WRITE_AND_CRASH("G = " << g.to_hex_string() << "\n"
  ------------------
  |  |   70|      0|   do {                                                                                                       \
  |  |   71|      0|      std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \
  |  |   72|      0|      abort();                                                                                                \
  |  |   73|      0|   } while(0)
  |  |  ------------------
  |  |  |  Branch (73:12): [Folded, False: 0]
  |  |  ------------------
  ------------------
   60|      0|                                       << "X = " << x.to_hex_string() << "\n"
   61|      0|                                       << "P = " << p.to_hex_string() << "\n"
   62|      0|                                       << "Z = " << z.to_hex_string() << "\n"
   63|      0|                                       << "R = " << ref.to_hex_string() << "\n");
   64|      0|      }
   65|  1.06k|   } catch(const Botan::Exception& e) {}
   66|  1.06k|}
pow_mod.cpp:_ZN12_GLOBAL__N_116simple_power_modEN5Botan6BigIntES1_RKS1_:
   14|  1.06k|Botan::BigInt simple_power_mod(Botan::BigInt x, Botan::BigInt n, const Botan::BigInt& p) {
   15|  1.06k|   if(n == 0) {
  ------------------
  |  Branch (15:7): [True: 32, False: 1.03k]
  ------------------
   16|     32|      if(p == 1) {
  ------------------
  |  Branch (16:10): [True: 1, False: 31]
  ------------------
   17|      1|         return 0;
   18|      1|      }
   19|     31|      return 1;
   20|     32|   }
   21|       |
   22|  1.03k|   auto mod_p = Botan::Barrett_Reduction::for_public_modulus(p);
   23|  1.03k|   Botan::BigInt y = 1;
   24|       |
   25|   392k|   while(n > 1) {
  ------------------
  |  Branch (25:10): [True: 391k, False: 1.03k]
  ------------------
   26|   391k|      if(n.is_odd()) {
  ------------------
  |  Branch (26:10): [True: 141k, False: 250k]
  ------------------
   27|   141k|         y = mod_p.multiply(x, y);
   28|   141k|      }
   29|   391k|      x = mod_p.square(x);
   30|   391k|      n >>= 1;
   31|   391k|   }
   32|  1.03k|   return mod_p.multiply(x, y);
   33|  1.06k|}

_ZN5Botan6BigIntrSEm:
  287|   391k|BigInt& BigInt::operator>>=(size_t shift) {
  288|   391k|   bigint_shr1(m_data.mutable_data(), m_data.size(), shift);
  289|       |
  290|   391k|   if(sig_words() == 0 && m_signedness == Negative) {
  ------------------
  |  Branch (290:7): [True: 0, False: 391k]
  |  Branch (290:27): [True: 0, False: 0]
  ------------------
  291|      0|      m_signedness = Positive;
  292|      0|   }
  293|       |
  294|   391k|   return (*this);
  295|   391k|}

_ZN5Botan6BigIntC2Em:
   18|  1.40k|BigInt::BigInt(uint64_t n) {
   19|  1.40k|   if constexpr(sizeof(word) == 8) {
   20|  1.40k|      m_data.set_word_at(0, static_cast<word>(n));
   21|       |   } else {
   22|       |      m_data.set_word_at(1, static_cast<word>(n >> 32));
   23|       |      m_data.set_word_at(0, static_cast<word>(n));
   24|       |   }
   25|  1.40k|}
_ZN5Botan6BigInt8from_u64Em:
   28|    339|BigInt BigInt::from_u64(uint64_t n) {
   29|    339|   return BigInt(n);
   30|    339|}
_ZN5Botan6BigInt10from_bytesENSt3__14spanIKhLm18446744073709551615EEE:
   81|  3.20k|BigInt BigInt::from_bytes(std::span<const uint8_t> input) {
   82|  3.20k|   BigInt r;
   83|  3.20k|   r.assign_from_bytes(input);
   84|  3.20k|   return r;
   85|  3.20k|}
_ZNK5Botan6BigInt8cmp_wordEm:
  120|   394k|int32_t BigInt::cmp_word(word other) const {
  121|   394k|   if(signum() < 0) {
  ------------------
  |  Branch (121:7): [True: 0, False: 394k]
  ------------------
  122|      0|      return -1;  // other is positive ...
  123|      0|   }
  124|       |
  125|   394k|   const size_t sw = this->sig_words();
  126|   394k|   if(sw > 1) {
  ------------------
  |  Branch (126:7): [True: 345k, False: 49.0k]
  ------------------
  127|   345k|      return 1;  // must be larger since other is just one word ...
  128|   345k|   }
  129|       |
  130|  49.0k|   return bigint_cmp(this->_data(), sw, &other, 1);
  131|   394k|}
_ZNK5Botan6BigInt8is_equalERKS0_:
  154|    918|bool BigInt::is_equal(const BigInt& other) const {
  155|    918|   if(this->sign() != other.sign()) {
  ------------------
  |  Branch (155:7): [True: 0, False: 918]
  ------------------
  156|      0|      return false;
  157|      0|   }
  158|       |
  159|    918|   return bigint_ct_is_eq(this->_data(), this->size(), other._data(), other.size()).as_bool();
  160|    918|}
_ZNK5Botan6BigInt12is_less_thanERKS0_:
  162|  1.63k|bool BigInt::is_less_than(const BigInt& other) const {
  163|  1.63k|   if(this->signum() < 0 && other.signum() >= 0) {
  ------------------
  |  Branch (163:7): [True: 0, False: 1.63k]
  |  Branch (163:29): [True: 0, False: 0]
  ------------------
  164|      0|      return true;
  165|      0|   }
  166|       |
  167|  1.63k|   if(this->signum() >= 0 && other.signum() < 0) {
  ------------------
  |  Branch (167:7): [True: 1.63k, False: 0]
  |  Branch (167:30): [True: 0, False: 1.63k]
  ------------------
  168|      0|      return false;
  169|      0|   }
  170|       |
  171|  1.63k|   if(other.signum() < 0 && this->signum() < 0) {
  ------------------
  |  Branch (171:7): [True: 0, False: 1.63k]
  |  Branch (171:29): [True: 0, False: 0]
  ------------------
  172|      0|      return bigint_ct_is_lt(other._data(), other.size(), this->_data(), this->size()).as_bool();
  173|      0|   }
  174|       |
  175|  1.63k|   return bigint_ct_is_lt(this->_data(), this->size(), other._data(), other.size()).as_bool();
  176|  1.63k|}
_ZN5Botan6BigInt4Data11set_to_zeroEv:
  189|  3.20k|void BigInt::Data::set_to_zero() {
  190|  3.20k|   m_reg.resize(m_reg.capacity());
  191|  3.20k|   clear_mem(m_reg.data(), m_reg.size());
  192|  3.20k|   m_sig_words = 0;
  193|  3.20k|}
_ZNK5Botan6BigInt4Data14calc_sig_wordsEv:
  213|  1.25M|size_t BigInt::Data::calc_sig_words() const {
  214|  1.25M|   const size_t sz = m_reg.size();
  215|  1.25M|   size_t sig = sz;
  216|       |
  217|  1.25M|   word sub = 1;
  218|       |
  219|  45.2M|   for(size_t i = 0; i != sz; ++i) {
  ------------------
  |  Branch (219:22): [True: 44.0M, False: 1.25M]
  ------------------
  220|  44.0M|      const word w = m_reg[sz - i - 1];
  221|  44.0M|      sub &= ct_is_zero(w);
  222|  44.0M|      sig -= sub;
  223|  44.0M|   }
  224|       |
  225|       |   /*
  226|       |   * This depends on the data so is poisoned, but unpoison it here as
  227|       |   * later conditionals are made on the size.
  228|       |   */
  229|  1.25M|   CT::unpoison(sig);
  230|       |
  231|  1.25M|   return sig;
  232|  1.25M|}
_ZNK5Botan6BigInt13get_substringEmm:
  237|  55.7k|uint32_t BigInt::get_substring(size_t offset, size_t length) const {
  238|  55.7k|   if(length == 0 || length > 32) {
  ------------------
  |  Branch (238:7): [True: 0, False: 55.7k]
  |  Branch (238:22): [True: 0, False: 55.7k]
  ------------------
  239|      0|      throw Invalid_Argument("BigInt::get_substring invalid substring length");
  240|      0|   }
  241|       |
  242|  55.7k|   const uint32_t mask = 0xFFFFFFFF >> (32 - length);
  243|       |
  244|  55.7k|   const size_t word_offset = offset / WordInfo<word>::bits;
  245|  55.7k|   const size_t wshift = (offset % WordInfo<word>::bits);
  246|       |
  247|       |   /*
  248|       |   * The substring is contained within one or at most two words. The
  249|       |   * offset and length are not secret, so we can perform conditional
  250|       |   * operations on those values.
  251|       |   */
  252|  55.7k|   const word w0 = word_at(word_offset);
  253|       |
  254|  55.7k|   if(wshift == 0 || (offset + length) / WordInfo<word>::bits == word_offset) {
  ------------------
  |  Branch (254:7): [True: 3.69k, False: 52.0k]
  |  Branch (254:22): [True: 48.7k, False: 3.29k]
  ------------------
  255|  52.4k|      return static_cast<uint32_t>(w0 >> wshift) & mask;
  256|  52.4k|   } else {
  257|  3.29k|      const word w1 = word_at(word_offset + 1);
  258|  3.29k|      return static_cast<uint32_t>((w0 >> wshift) | (w1 << (WordInfo<word>::bits - wshift))) & mask;
  259|  3.29k|   }
  260|  55.7k|}
_ZNK5Botan6BigInt13top_bits_freeEv:
  296|  2.75k|size_t BigInt::top_bits_free() const {
  297|  2.75k|   const size_t words = sig_words();
  298|       |
  299|  2.75k|   const word top_word = word_at(words - 1);
  300|  2.75k|   const size_t bits_used = high_bit(CT::value_barrier(top_word));
  301|  2.75k|   CT::unpoison(bits_used);
  302|  2.75k|   return WordInfo<word>::bits - bits_used;
  303|  2.75k|}
_ZNK5Botan6BigInt4bitsEv:
  305|  2.78k|size_t BigInt::bits() const {
  306|  2.78k|   const size_t words = sig_words();
  307|       |
  308|  2.78k|   if(words == 0) {
  ------------------
  |  Branch (308:7): [True: 30, False: 2.75k]
  ------------------
  309|     30|      return 0;
  310|     30|   }
  311|       |
  312|  2.75k|   const size_t full_words = (words - 1) * WordInfo<word>::bits;
  313|  2.75k|   const size_t top_bits = WordInfo<word>::bits - top_bits_free();
  314|       |
  315|  2.75k|   return full_words + top_bits;
  316|  2.78k|}
_ZNK5Botan6BigInt3absEv:
  384|    371|BigInt BigInt::abs() const {
  385|    371|   BigInt x = (*this);
  386|    371|   x.set_sign(Positive);
  387|    371|   return x;
  388|    371|}
_ZN5Botan6BigInt17assign_from_bytesENSt3__14spanIKhLm18446744073709551615EEE:
  423|  3.20k|void BigInt::assign_from_bytes(std::span<const uint8_t> bytes) {
  424|  3.20k|   clear();
  425|       |
  426|  3.20k|   const size_t length = bytes.size();
  427|  3.20k|   const size_t full_words = length / sizeof(word);
  428|  3.20k|   const size_t extra_bytes = length % sizeof(word);
  429|       |
  430|  3.20k|   const size_t total_words = full_words + (extra_bytes > 0 ? 1 : 0);
  ------------------
  |  Branch (430:45): [True: 2.55k, False: 651]
  ------------------
  431|       |
  432|  3.20k|   secure_vector<word> reg(8 * ceil_division<size_t>(total_words, 8));
  433|       |
  434|  26.2k|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (434:22): [True: 23.0k, False: 3.20k]
  ------------------
  435|  23.0k|      reg[i] = load_be<word>(bytes.last<sizeof(word)>());
  436|  23.0k|      bytes = bytes.first(bytes.size() - sizeof(word));
  437|  23.0k|   }
  438|       |
  439|  3.20k|   if(!bytes.empty()) {
  ------------------
  |  Branch (439:7): [True: 2.55k, False: 651]
  ------------------
  440|  2.55k|      BOTAN_ASSERT_NOMSG(extra_bytes == bytes.size());
  ------------------
  |  |   84|  2.55k|   do {                                                                     \
  |  |   85|  2.55k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|  2.55k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 2.55k]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|  2.55k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 2.55k]
  |  |  ------------------
  ------------------
  441|  2.55k|      std::array<uint8_t, sizeof(word)> last_partial_word = {0};
  442|  2.55k|      copy_mem(std::span{last_partial_word}.last(extra_bytes), bytes);
  443|  2.55k|      reg[full_words] = load_be<word>(last_partial_word);
  444|  2.55k|   }
  445|       |
  446|  3.20k|   m_data.swap(reg);
  447|  3.20k|}
_ZN5Botan6BigInt14cond_flip_signEb:
  521|   160k|void BigInt::cond_flip_sign(bool predicate) {
  522|       |   // This code is assuming Negative == 0, Positive == 1
  523|       |
  524|   160k|   const auto mask = CT::Mask<uint8_t>::expand_bool(predicate);
  525|       |
  526|   160k|   const uint8_t current_sign = static_cast<uint8_t>(sign());
  527|       |
  528|   160k|   const uint8_t new_sign = mask.select(current_sign ^ 1, current_sign);
  529|       |
  530|   160k|   set_sign(static_cast<Sign>(new_sign));
  531|   160k|}
_ZN5Botan6BigInt14ct_cond_assignEbRKS0_:
  533|   160k|void BigInt::ct_cond_assign(bool predicate, const BigInt& other) {
  534|   160k|   const size_t t_words = size();
  535|   160k|   const size_t o_words = other.size();
  536|       |
  537|   160k|   if(t_words < o_words) {
  ------------------
  |  Branch (537:7): [True: 189, False: 160k]
  ------------------
  538|    189|      grow_to(o_words);
  539|    189|   }
  540|       |
  541|   160k|   const size_t r_words = std::max(t_words, o_words);
  542|       |
  543|   160k|   const auto mask = CT::Mask<word>::expand_bool(predicate);
  544|       |
  545|  8.20M|   for(size_t i = 0; i != r_words; ++i) {
  ------------------
  |  Branch (545:22): [True: 8.04M, False: 160k]
  ------------------
  546|  8.04M|      const word o_word = other.word_at(i);
  547|  8.04M|      const word t_word = this->word_at(i);
  548|  8.04M|      this->set_word_at(i, mask.select(o_word, t_word));
  549|  8.04M|   }
  550|       |
  551|   160k|   const auto same_sign = CT::Mask<word>::is_equal(sign(), other.sign()).as_choice();
  552|   160k|   cond_flip_sign((mask.as_choice() && !same_sign).as_bool());
  553|   160k|}
_ZNK5Botan6BigInt20_const_time_unpoisonEv:
  559|   882k|void BigInt::_const_time_unpoison() const {
  560|   882k|   CT::unpoison(m_data.const_data(), m_data.size());
  561|   882k|}

_ZN5Botan15ct_divide_pow2kEmRKNS_6BigIntE:
  194|  1.90k|BigInt ct_divide_pow2k(size_t k, const BigInt& y) {
  195|  1.90k|   BOTAN_ARG_CHECK(y.signum() != 0, "Cannot divide by zero");
  ------------------
  |  |   35|  1.90k|   do {                                                          \
  |  |   36|  1.90k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|  1.90k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 1.90k]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|  1.90k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 1.90k]
  |  |  ------------------
  ------------------
  196|  1.90k|   BOTAN_ARG_CHECK(y.signum() >= 0, "Negative divisor not supported");
  ------------------
  |  |   35|  1.90k|   do {                                                          \
  |  |   36|  1.90k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|  1.90k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 1.90k]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|  1.90k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 1.90k]
  |  |  ------------------
  ------------------
  197|  1.90k|   BOTAN_ARG_CHECK(k > 1, "Invalid k");
  ------------------
  |  |   35|  1.90k|   do {                                                          \
  |  |   36|  1.90k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|  1.90k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 1.90k]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|  1.90k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 1.90k]
  |  |  ------------------
  ------------------
  198|       |
  199|  1.90k|   BigInt q;
  200|  1.90k|   BigInt r;
  201|  1.90k|   ct_divide_impl(q, r, BigInt::power_of_2(k), y);
  202|  1.90k|   return q;
  203|  1.90k|}
_ZN5Botan9ct_moduloERKNS_6BigIntES2_:
  262|    874|BigInt ct_modulo(const BigInt& x, const BigInt& y) {
  263|    874|   if(y.signum() <= 0) {
  ------------------
  |  Branch (263:7): [True: 0, False: 874]
  ------------------
  264|      0|      throw Invalid_Argument("ct_modulo requires y > 0");
  265|      0|   }
  266|       |
  267|    874|   BigInt q;
  268|    874|   BigInt r;
  269|    874|   ct_divide_impl(q, r, x, y);
  270|       |
  271|    874|   if(x.signum() < 0) {
  ------------------
  |  Branch (271:7): [True: 0, False: 874]
  ------------------
  272|      0|      if(r.signum() != 0) {
  ------------------
  |  Branch (272:10): [True: 0, False: 0]
  ------------------
  273|      0|         r = y - r;
  274|      0|      }
  275|      0|   }
  276|       |
  277|    874|   return r;
  278|    874|}
divide.cpp:_ZN5Botan12_GLOBAL__N_114ct_divide_implERNS_6BigIntES2_RKS1_S4_:
   66|  2.78k|void ct_divide_impl(BigInt& q_out, BigInt& r_out, const BigInt& x, const BigInt& y) {
   67|  2.78k|   constexpr size_t WB = WordInfo<word>::bits;
   68|       |
   69|  2.78k|   const size_t x_words = x.sig_words();
   70|  2.78k|   const size_t y_words = y.sig_words();
   71|  2.78k|   BOTAN_ASSERT_NOMSG(y_words > 0);
  ------------------
  |  |   84|  2.78k|   do {                                                                     \
  |  |   85|  2.78k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|  2.78k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 2.78k]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|  2.78k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 2.78k]
  |  |  ------------------
  ------------------
   72|       |
   73|  2.78k|   if(x_words < y_words) {
  ------------------
  |  Branch (73:7): [True: 371, False: 2.41k]
  ------------------
   74|       |      // Here |x| < |y| so q = 0 and r = |x|
   75|    371|      r_out = x.abs();
   76|    371|      q_out = BigInt::zero();
   77|    371|      return;
   78|    371|   }
   79|       |
   80|  2.41k|   const size_t r_words = x_words + 1;
   81|  2.41k|   const size_t q_words = x_words - y_words + 1;
   82|       |
   83|       |   // The number of leading zero bits of y, in [0,WB)
   84|  2.41k|   const word s = static_cast<word>(WB) - static_cast<word>(high_bit(CT::value_barrier(y._data()[y_words - 1])));
   85|  2.41k|   const auto s_mask = CT::Mask<word>::expand(s);
   86|  2.41k|   const word s_comp = s_mask.if_set_return(static_cast<word>(WB) - s);
   87|       |
   88|  2.41k|   secure_vector<word> yn(y_words);
   89|  2.41k|   secure_vector<word> rw(r_words);
   90|  2.41k|   secure_vector<word> qw(q_words);
   91|       |
   92|       |   // Normalize: yn = |y| << s (which sets the top bit of yn) and rw = |x| << s;
   93|       |   // shifting y stays within y_words words, shifting x adds at most one word
   94|  2.41k|   word carry = 0;
   95|  20.6k|   for(size_t i = 0; i != y_words; ++i) {
  ------------------
  |  Branch (95:22): [True: 18.1k, False: 2.41k]
  ------------------
   96|  18.1k|      const word w = y._data()[i];
   97|  18.1k|      yn[i] = (w << s) | carry;
   98|  18.1k|      carry = s_mask.if_set_return(w >> s_comp);
   99|  18.1k|   }
  100|       |
  101|  2.41k|   carry = 0;
  102|  37.9k|   for(size_t i = 0; i != x_words; ++i) {
  ------------------
  |  Branch (102:22): [True: 35.5k, False: 2.41k]
  ------------------
  103|  35.5k|      const word w = x._data()[i];
  104|  35.5k|      rw[i] = (w << s) | carry;
  105|  35.5k|      carry = s_mask.if_set_return(w >> s_comp);
  106|  35.5k|   }
  107|  2.41k|   rw[x_words] = carry;
  108|       |
  109|  2.41k|   const auto div_by_yn = divide_precomp<word>::setup(CT::value_barrier(yn[y_words - 1]));
  110|       |
  111|  2.41k|   if(y_words == 1) {
  ------------------
  |  Branch (111:7): [True: 891, False: 1.52k]
  ------------------
  112|       |      /*
  113|       |      * 2/1 word-serial division. The initial remainder is the shift-out
  114|       |      * carry, which is less than 2^s and so less than the divisor.
  115|       |      */
  116|    891|      word r = rw[x_words];
  117|  3.12k|      for(size_t i = x_words; i > 0; --i) {
  ------------------
  |  Branch (117:31): [True: 2.23k, False: 891]
  ------------------
  118|  2.23k|         const auto [qi, ri] = div_by_yn.divmod_2to1_ct(r, rw[i - 1]);
  119|  2.23k|         qw[i - 1] = qi;
  120|  2.23k|         r = ri;
  121|  2.23k|      }
  122|       |
  123|    891|      rw[0] = r >> s;
  124|  1.52k|   } else {
  125|  1.52k|      const word yn1 = yn[y_words - 1];
  126|  1.52k|      const word yn2 = yn[y_words - 2];
  127|       |
  128|  19.0k|      for(size_t i = q_words; i > 0; --i) {
  ------------------
  |  Branch (128:31): [True: 17.4k, False: 1.52k]
  ------------------
  129|  17.4k|         const size_t j = i - 1;  // current window is rw[j ... j + y_words]
  130|       |
  131|  17.4k|         const word u2 = rw[j + y_words];
  132|  17.4k|         const word u1 = rw[j + y_words - 1];
  133|  17.4k|         const word u0 = rw[j + y_words - 2];
  134|       |
  135|       |         /*
  136|       |         * Estimate the quotient digit from the top two words of the window.
  137|       |         * The window invariant gives u2 <= yn1; if u2 == yn1 the 2/1
  138|       |         * division precondition does not hold, and instead the digit
  139|       |         * estimate is the maximum word value.
  140|       |         */
  141|  17.4k|         const auto top_eq = CT::Mask<word>::is_equal(u2, yn1);
  142|  17.4k|         const word q_est = div_by_yn.divmod_2to1_ct(u2, u1).first;
  143|  17.4k|         word qhat = top_eq.select(WordInfo<word>::max, q_est);
  144|       |
  145|       |         // Per HAC 14.23, this correction is required at most twice
  146|  17.4k|         qhat -= division_check_ct(qhat, yn1, yn2, u2, u1, u0).if_set_return(1);
  147|  17.4k|         qhat -= division_check_ct(qhat, yn1, yn2, u2, u1, u0).if_set_return(1);
  148|       |
  149|       |         // Subtract qhat * yn from the window
  150|  17.4k|         const word bw = bigint_submul(&rw[j], yn.data(), y_words, qhat);
  151|  17.4k|         word borrow = 0;
  152|  17.4k|         rw[j + y_words] = word_sub(u2, bw, &borrow);
  153|       |
  154|       |         // If the digit was still one too large, the subtraction
  155|       |         // underflowed; add back and decrement the digit
  156|  17.4k|         const word cb = bigint_cnd_add(borrow, &rw[j], yn.data(), y_words);
  157|  17.4k|         rw[j + y_words] += cb;
  158|  17.4k|         qhat -= borrow;
  159|       |
  160|  17.4k|         qw[j] = qhat;
  161|  17.4k|      }
  162|       |
  163|       |      // The remainder is in rw[0:y_words], still shifted left by s, and
  164|       |      // rw[y_words] is zero
  165|  18.8k|      for(size_t i = 0; i != y_words; ++i) {
  ------------------
  |  Branch (165:25): [True: 17.3k, False: 1.52k]
  ------------------
  166|  17.3k|         rw[i] = (rw[i] >> s) | s_mask.if_set_return(CT::value_barrier(rw[i + 1]) << s_comp);
  167|  17.3k|      }
  168|  1.52k|   }
  169|       |
  170|  2.41k|   BigInt q = BigInt::_from_words(qw);
  171|  2.41k|   rw.resize(y_words);
  172|  2.41k|   BigInt r = BigInt::_from_words(rw);
  173|       |
  174|  2.41k|   r_out = std::move(r);
  175|  2.41k|   q_out = std::move(q);
  176|  2.41k|}
divide.cpp:_ZN5Botan12_GLOBAL__N_117division_check_ctEmmmmmm:
   39|  34.9k|inline CT::Mask<word> division_check_ct(word q, word y2, word y1, word x3, word x2, word x1) {
   40|  34.9k|   word y3 = 0;
   41|  34.9k|   y1 = word_madd2(q, y1, &y3);
   42|  34.9k|   y2 = word_madd2(q, y2, &y3);
   43|       |
   44|  34.9k|   const auto gt3 = CT::Mask<word>::is_gt(y3, x3);
   45|  34.9k|   const auto eq3 = CT::Mask<word>::is_equal(y3, x3);
   46|  34.9k|   const auto gt2 = CT::Mask<word>::is_gt(y2, x2);
   47|  34.9k|   const auto eq2 = CT::Mask<word>::is_equal(y2, x2);
   48|  34.9k|   const auto gt1 = CT::Mask<word>::is_gt(y1, x1);
   49|       |
   50|  34.9k|   return gt3 | (eq3 & (gt2 | (eq2 & gt1)));
   51|  34.9k|}

_ZN5Botan17bigint_comba_sqr4EPmPKm:
   22|  11.9k|void bigint_comba_sqr4(word z[8], const word x[4]) {
   23|  11.9k|#if defined(BOTAN_HAS_MP_MULX)
   24|  11.9k|   if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) {
  ------------------
  |  Branch (24:7): [True: 11.9k, False: 0]
  ------------------
   25|  11.9k|      return bigint_mulx_sqr4(z, x);
   26|  11.9k|   }
   27|      0|#endif
   28|       |
   29|      0|   word3<word> accum;
   30|       |
   31|      0|   accum.mul(x[0], x[0]);
   32|      0|   z[0] = accum.extract();
   33|      0|   accum.mul_x2(x[0], x[1]);
   34|      0|   z[1] = accum.extract();
   35|      0|   accum.mul_x2(x[0], x[2]);
   36|      0|   accum.mul(x[1], x[1]);
   37|      0|   z[2] = accum.extract();
   38|      0|   accum.mul_x2(x[0], x[3]);
   39|      0|   accum.mul_x2(x[1], x[2]);
   40|      0|   z[3] = accum.extract();
   41|      0|   accum.mul_x2(x[1], x[3]);
   42|      0|   accum.mul(x[2], x[2]);
   43|      0|   z[4] = accum.extract();
   44|      0|   accum.mul_x2(x[2], x[3]);
   45|      0|   z[5] = accum.extract();
   46|      0|   accum.mul(x[3], x[3]);
   47|      0|   z[6] = accum.extract();
   48|      0|   z[7] = accum.extract();
   49|      0|}
_ZN5Botan17bigint_comba_mul4EPmPKmS2_:
   54|  66.9k|void bigint_comba_mul4(word z[8], const word x[4], const word y[4]) {
   55|  66.9k|#if defined(BOTAN_HAS_MP_MULX)
   56|  66.9k|   if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) {
  ------------------
  |  Branch (56:7): [True: 66.9k, False: 0]
  ------------------
   57|  66.9k|      return bigint_mulx_mul4(z, x, y);
   58|  66.9k|   }
   59|      0|#endif
   60|       |
   61|      0|   word3<word> accum;
   62|       |
   63|      0|   accum.mul(x[0], y[0]);
   64|      0|   z[0] = accum.extract();
   65|      0|   accum.mul(x[0], y[1]);
   66|      0|   accum.mul(x[1], y[0]);
   67|      0|   z[1] = accum.extract();
   68|      0|   accum.mul(x[0], y[2]);
   69|      0|   accum.mul(x[1], y[1]);
   70|      0|   accum.mul(x[2], y[0]);
   71|      0|   z[2] = accum.extract();
   72|      0|   accum.mul(x[0], y[3]);
   73|      0|   accum.mul(x[1], y[2]);
   74|      0|   accum.mul(x[2], y[1]);
   75|      0|   accum.mul(x[3], y[0]);
   76|      0|   z[3] = accum.extract();
   77|      0|   accum.mul(x[1], y[3]);
   78|      0|   accum.mul(x[2], y[2]);
   79|      0|   accum.mul(x[3], y[1]);
   80|      0|   z[4] = accum.extract();
   81|      0|   accum.mul(x[2], y[3]);
   82|      0|   accum.mul(x[3], y[2]);
   83|      0|   z[5] = accum.extract();
   84|      0|   accum.mul(x[3], y[3]);
   85|      0|   z[6] = accum.extract();
   86|      0|   z[7] = accum.extract();
   87|      0|}
_ZN5Botan17bigint_comba_sqr6EPmPKm:
   92|  14.4k|void bigint_comba_sqr6(word z[12], const word x[6]) {
   93|  14.4k|#if defined(BOTAN_HAS_MP_MULX)
   94|  14.4k|   if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) {
  ------------------
  |  Branch (94:7): [True: 14.4k, False: 0]
  ------------------
   95|  14.4k|      return bigint_mulx_sqr6(z, x);
   96|  14.4k|   }
   97|      0|#endif
   98|       |
   99|      0|   word3<word> accum;
  100|       |
  101|      0|   accum.mul(x[0], x[0]);
  102|      0|   z[0] = accum.extract();
  103|      0|   accum.mul_x2(x[0], x[1]);
  104|      0|   z[1] = accum.extract();
  105|      0|   accum.mul_x2(x[0], x[2]);
  106|      0|   accum.mul(x[1], x[1]);
  107|      0|   z[2] = accum.extract();
  108|      0|   accum.mul_x2(x[0], x[3]);
  109|      0|   accum.mul_x2(x[1], x[2]);
  110|      0|   z[3] = accum.extract();
  111|      0|   accum.mul_x2(x[0], x[4]);
  112|      0|   accum.mul_x2(x[1], x[3]);
  113|      0|   accum.mul(x[2], x[2]);
  114|      0|   z[4] = accum.extract();
  115|      0|   accum.mul_x2(x[0], x[5]);
  116|      0|   accum.mul_x2(x[1], x[4]);
  117|      0|   accum.mul_x2(x[2], x[3]);
  118|      0|   z[5] = accum.extract();
  119|      0|   accum.mul_x2(x[1], x[5]);
  120|      0|   accum.mul_x2(x[2], x[4]);
  121|      0|   accum.mul(x[3], x[3]);
  122|      0|   z[6] = accum.extract();
  123|      0|   accum.mul_x2(x[2], x[5]);
  124|      0|   accum.mul_x2(x[3], x[4]);
  125|      0|   z[7] = accum.extract();
  126|      0|   accum.mul_x2(x[3], x[5]);
  127|      0|   accum.mul(x[4], x[4]);
  128|      0|   z[8] = accum.extract();
  129|      0|   accum.mul_x2(x[4], x[5]);
  130|      0|   z[9] = accum.extract();
  131|      0|   accum.mul(x[5], x[5]);
  132|      0|   z[10] = accum.extract();
  133|      0|   z[11] = accum.extract();
  134|      0|}
_ZN5Botan17bigint_comba_mul6EPmPKmS2_:
  139|  40.5k|void bigint_comba_mul6(word z[12], const word x[6], const word y[6]) {
  140|  40.5k|#if defined(BOTAN_HAS_MP_MULX)
  141|  40.5k|   if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) {
  ------------------
  |  Branch (141:7): [True: 40.5k, False: 0]
  ------------------
  142|  40.5k|      return bigint_mulx_mul6(z, x, y);
  143|  40.5k|   }
  144|      0|#endif
  145|       |
  146|      0|   word3<word> accum;
  147|       |
  148|      0|   accum.mul(x[0], y[0]);
  149|      0|   z[0] = accum.extract();
  150|      0|   accum.mul(x[0], y[1]);
  151|      0|   accum.mul(x[1], y[0]);
  152|      0|   z[1] = accum.extract();
  153|      0|   accum.mul(x[0], y[2]);
  154|      0|   accum.mul(x[1], y[1]);
  155|      0|   accum.mul(x[2], y[0]);
  156|      0|   z[2] = accum.extract();
  157|      0|   accum.mul(x[0], y[3]);
  158|      0|   accum.mul(x[1], y[2]);
  159|      0|   accum.mul(x[2], y[1]);
  160|      0|   accum.mul(x[3], y[0]);
  161|      0|   z[3] = accum.extract();
  162|      0|   accum.mul(x[0], y[4]);
  163|      0|   accum.mul(x[1], y[3]);
  164|      0|   accum.mul(x[2], y[2]);
  165|      0|   accum.mul(x[3], y[1]);
  166|      0|   accum.mul(x[4], y[0]);
  167|      0|   z[4] = accum.extract();
  168|      0|   accum.mul(x[0], y[5]);
  169|      0|   accum.mul(x[1], y[4]);
  170|      0|   accum.mul(x[2], y[3]);
  171|      0|   accum.mul(x[3], y[2]);
  172|      0|   accum.mul(x[4], y[1]);
  173|      0|   accum.mul(x[5], y[0]);
  174|      0|   z[5] = accum.extract();
  175|      0|   accum.mul(x[1], y[5]);
  176|      0|   accum.mul(x[2], y[4]);
  177|      0|   accum.mul(x[3], y[3]);
  178|      0|   accum.mul(x[4], y[2]);
  179|      0|   accum.mul(x[5], y[1]);
  180|      0|   z[6] = accum.extract();
  181|      0|   accum.mul(x[2], y[5]);
  182|      0|   accum.mul(x[3], y[4]);
  183|      0|   accum.mul(x[4], y[3]);
  184|      0|   accum.mul(x[5], y[2]);
  185|      0|   z[7] = accum.extract();
  186|      0|   accum.mul(x[3], y[5]);
  187|      0|   accum.mul(x[4], y[4]);
  188|      0|   accum.mul(x[5], y[3]);
  189|      0|   z[8] = accum.extract();
  190|      0|   accum.mul(x[4], y[5]);
  191|      0|   accum.mul(x[5], y[4]);
  192|      0|   z[9] = accum.extract();
  193|      0|   accum.mul(x[5], y[5]);
  194|      0|   z[10] = accum.extract();
  195|      0|   z[11] = accum.extract();
  196|      0|}
_ZN5Botan17bigint_comba_sqr8EPmPKm:
  322|  26.3k|void bigint_comba_sqr8(word z[16], const word x[8]) {
  323|  26.3k|#if defined(BOTAN_HAS_MP_MULX)
  324|  26.3k|   if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) {
  ------------------
  |  Branch (324:7): [True: 26.3k, False: 0]
  ------------------
  325|  26.3k|      return bigint_mulx_sqr8(z, x);
  326|  26.3k|   }
  327|      0|#endif
  328|       |
  329|      0|   word3<word> accum;
  330|       |
  331|      0|   accum.mul(x[0], x[0]);
  332|      0|   z[0] = accum.extract();
  333|      0|   accum.mul_x2(x[0], x[1]);
  334|      0|   z[1] = accum.extract();
  335|      0|   accum.mul_x2(x[0], x[2]);
  336|      0|   accum.mul(x[1], x[1]);
  337|      0|   z[2] = accum.extract();
  338|      0|   accum.mul_x2(x[0], x[3]);
  339|      0|   accum.mul_x2(x[1], x[2]);
  340|      0|   z[3] = accum.extract();
  341|      0|   accum.mul_x2(x[0], x[4]);
  342|      0|   accum.mul_x2(x[1], x[3]);
  343|      0|   accum.mul(x[2], x[2]);
  344|      0|   z[4] = accum.extract();
  345|      0|   accum.mul_x2(x[0], x[5]);
  346|      0|   accum.mul_x2(x[1], x[4]);
  347|      0|   accum.mul_x2(x[2], x[3]);
  348|      0|   z[5] = accum.extract();
  349|      0|   accum.mul_x2(x[0], x[6]);
  350|      0|   accum.mul_x2(x[1], x[5]);
  351|      0|   accum.mul_x2(x[2], x[4]);
  352|      0|   accum.mul(x[3], x[3]);
  353|      0|   z[6] = accum.extract();
  354|      0|   accum.mul_x2(x[0], x[7]);
  355|      0|   accum.mul_x2(x[1], x[6]);
  356|      0|   accum.mul_x2(x[2], x[5]);
  357|      0|   accum.mul_x2(x[3], x[4]);
  358|      0|   z[7] = accum.extract();
  359|      0|   accum.mul_x2(x[1], x[7]);
  360|      0|   accum.mul_x2(x[2], x[6]);
  361|      0|   accum.mul_x2(x[3], x[5]);
  362|      0|   accum.mul(x[4], x[4]);
  363|      0|   z[8] = accum.extract();
  364|      0|   accum.mul_x2(x[2], x[7]);
  365|      0|   accum.mul_x2(x[3], x[6]);
  366|      0|   accum.mul_x2(x[4], x[5]);
  367|      0|   z[9] = accum.extract();
  368|      0|   accum.mul_x2(x[3], x[7]);
  369|      0|   accum.mul_x2(x[4], x[6]);
  370|      0|   accum.mul(x[5], x[5]);
  371|      0|   z[10] = accum.extract();
  372|      0|   accum.mul_x2(x[4], x[7]);
  373|      0|   accum.mul_x2(x[5], x[6]);
  374|      0|   z[11] = accum.extract();
  375|      0|   accum.mul_x2(x[5], x[7]);
  376|      0|   accum.mul(x[6], x[6]);
  377|      0|   z[12] = accum.extract();
  378|      0|   accum.mul_x2(x[6], x[7]);
  379|      0|   z[13] = accum.extract();
  380|      0|   accum.mul(x[7], x[7]);
  381|      0|   z[14] = accum.extract();
  382|      0|   z[15] = accum.extract();
  383|      0|}
_ZN5Botan17bigint_comba_mul8EPmPKmS2_:
  388|  61.1k|void bigint_comba_mul8(word z[16], const word x[8], const word y[8]) {
  389|  61.1k|#if defined(BOTAN_HAS_MP_MULX)
  390|  61.1k|   if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) {
  ------------------
  |  Branch (390:7): [True: 61.1k, False: 0]
  ------------------
  391|  61.1k|      return bigint_mulx_mul8(z, x, y);
  392|  61.1k|   }
  393|      0|#endif
  394|       |
  395|      0|   word3<word> accum;
  396|       |
  397|      0|   accum.mul(x[0], y[0]);
  398|      0|   z[0] = accum.extract();
  399|      0|   accum.mul(x[0], y[1]);
  400|      0|   accum.mul(x[1], y[0]);
  401|      0|   z[1] = accum.extract();
  402|      0|   accum.mul(x[0], y[2]);
  403|      0|   accum.mul(x[1], y[1]);
  404|      0|   accum.mul(x[2], y[0]);
  405|      0|   z[2] = accum.extract();
  406|      0|   accum.mul(x[0], y[3]);
  407|      0|   accum.mul(x[1], y[2]);
  408|      0|   accum.mul(x[2], y[1]);
  409|      0|   accum.mul(x[3], y[0]);
  410|      0|   z[3] = accum.extract();
  411|      0|   accum.mul(x[0], y[4]);
  412|      0|   accum.mul(x[1], y[3]);
  413|      0|   accum.mul(x[2], y[2]);
  414|      0|   accum.mul(x[3], y[1]);
  415|      0|   accum.mul(x[4], y[0]);
  416|      0|   z[4] = accum.extract();
  417|      0|   accum.mul(x[0], y[5]);
  418|      0|   accum.mul(x[1], y[4]);
  419|      0|   accum.mul(x[2], y[3]);
  420|      0|   accum.mul(x[3], y[2]);
  421|      0|   accum.mul(x[4], y[1]);
  422|      0|   accum.mul(x[5], y[0]);
  423|      0|   z[5] = accum.extract();
  424|      0|   accum.mul(x[0], y[6]);
  425|      0|   accum.mul(x[1], y[5]);
  426|      0|   accum.mul(x[2], y[4]);
  427|      0|   accum.mul(x[3], y[3]);
  428|      0|   accum.mul(x[4], y[2]);
  429|      0|   accum.mul(x[5], y[1]);
  430|      0|   accum.mul(x[6], y[0]);
  431|      0|   z[6] = accum.extract();
  432|      0|   accum.mul(x[0], y[7]);
  433|      0|   accum.mul(x[1], y[6]);
  434|      0|   accum.mul(x[2], y[5]);
  435|      0|   accum.mul(x[3], y[4]);
  436|      0|   accum.mul(x[4], y[3]);
  437|      0|   accum.mul(x[5], y[2]);
  438|      0|   accum.mul(x[6], y[1]);
  439|      0|   accum.mul(x[7], y[0]);
  440|      0|   z[7] = accum.extract();
  441|      0|   accum.mul(x[1], y[7]);
  442|      0|   accum.mul(x[2], y[6]);
  443|      0|   accum.mul(x[3], y[5]);
  444|      0|   accum.mul(x[4], y[4]);
  445|      0|   accum.mul(x[5], y[3]);
  446|      0|   accum.mul(x[6], y[2]);
  447|      0|   accum.mul(x[7], y[1]);
  448|      0|   z[8] = accum.extract();
  449|      0|   accum.mul(x[2], y[7]);
  450|      0|   accum.mul(x[3], y[6]);
  451|      0|   accum.mul(x[4], y[5]);
  452|      0|   accum.mul(x[5], y[4]);
  453|      0|   accum.mul(x[6], y[3]);
  454|      0|   accum.mul(x[7], y[2]);
  455|      0|   z[9] = accum.extract();
  456|      0|   accum.mul(x[3], y[7]);
  457|      0|   accum.mul(x[4], y[6]);
  458|      0|   accum.mul(x[5], y[5]);
  459|      0|   accum.mul(x[6], y[4]);
  460|      0|   accum.mul(x[7], y[3]);
  461|      0|   z[10] = accum.extract();
  462|      0|   accum.mul(x[4], y[7]);
  463|      0|   accum.mul(x[5], y[6]);
  464|      0|   accum.mul(x[6], y[5]);
  465|      0|   accum.mul(x[7], y[4]);
  466|      0|   z[11] = accum.extract();
  467|      0|   accum.mul(x[5], y[7]);
  468|      0|   accum.mul(x[6], y[6]);
  469|      0|   accum.mul(x[7], y[5]);
  470|      0|   z[12] = accum.extract();
  471|      0|   accum.mul(x[6], y[7]);
  472|      0|   accum.mul(x[7], y[6]);
  473|      0|   z[13] = accum.extract();
  474|      0|   accum.mul(x[7], y[7]);
  475|      0|   z[14] = accum.extract();
  476|      0|   z[15] = accum.extract();
  477|      0|}
_ZN5Botan17bigint_comba_sqr9EPmPKm:
  482|  89.0k|void bigint_comba_sqr9(word z[18], const word x[9]) {
  483|  89.0k|#if defined(BOTAN_HAS_MP_MULX)
  484|  89.0k|   if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) {
  ------------------
  |  Branch (484:7): [True: 89.0k, False: 0]
  ------------------
  485|  89.0k|      return bigint_mulx_sqr9(z, x);
  486|  89.0k|   }
  487|      0|#endif
  488|       |
  489|      0|   word3<word> accum;
  490|       |
  491|      0|   accum.mul(x[0], x[0]);
  492|      0|   z[0] = accum.extract();
  493|      0|   accum.mul_x2(x[0], x[1]);
  494|      0|   z[1] = accum.extract();
  495|      0|   accum.mul_x2(x[0], x[2]);
  496|      0|   accum.mul(x[1], x[1]);
  497|      0|   z[2] = accum.extract();
  498|      0|   accum.mul_x2(x[0], x[3]);
  499|      0|   accum.mul_x2(x[1], x[2]);
  500|      0|   z[3] = accum.extract();
  501|      0|   accum.mul_x2(x[0], x[4]);
  502|      0|   accum.mul_x2(x[1], x[3]);
  503|      0|   accum.mul(x[2], x[2]);
  504|      0|   z[4] = accum.extract();
  505|      0|   accum.mul_x2(x[0], x[5]);
  506|      0|   accum.mul_x2(x[1], x[4]);
  507|      0|   accum.mul_x2(x[2], x[3]);
  508|      0|   z[5] = accum.extract();
  509|      0|   accum.mul_x2(x[0], x[6]);
  510|      0|   accum.mul_x2(x[1], x[5]);
  511|      0|   accum.mul_x2(x[2], x[4]);
  512|      0|   accum.mul(x[3], x[3]);
  513|      0|   z[6] = accum.extract();
  514|      0|   accum.mul_x2(x[0], x[7]);
  515|      0|   accum.mul_x2(x[1], x[6]);
  516|      0|   accum.mul_x2(x[2], x[5]);
  517|      0|   accum.mul_x2(x[3], x[4]);
  518|      0|   z[7] = accum.extract();
  519|      0|   accum.mul_x2(x[0], x[8]);
  520|      0|   accum.mul_x2(x[1], x[7]);
  521|      0|   accum.mul_x2(x[2], x[6]);
  522|      0|   accum.mul_x2(x[3], x[5]);
  523|      0|   accum.mul(x[4], x[4]);
  524|      0|   z[8] = accum.extract();
  525|      0|   accum.mul_x2(x[1], x[8]);
  526|      0|   accum.mul_x2(x[2], x[7]);
  527|      0|   accum.mul_x2(x[3], x[6]);
  528|      0|   accum.mul_x2(x[4], x[5]);
  529|      0|   z[9] = accum.extract();
  530|      0|   accum.mul_x2(x[2], x[8]);
  531|      0|   accum.mul_x2(x[3], x[7]);
  532|      0|   accum.mul_x2(x[4], x[6]);
  533|      0|   accum.mul(x[5], x[5]);
  534|      0|   z[10] = accum.extract();
  535|      0|   accum.mul_x2(x[3], x[8]);
  536|      0|   accum.mul_x2(x[4], x[7]);
  537|      0|   accum.mul_x2(x[5], x[6]);
  538|      0|   z[11] = accum.extract();
  539|      0|   accum.mul_x2(x[4], x[8]);
  540|      0|   accum.mul_x2(x[5], x[7]);
  541|      0|   accum.mul(x[6], x[6]);
  542|      0|   z[12] = accum.extract();
  543|      0|   accum.mul_x2(x[5], x[8]);
  544|      0|   accum.mul_x2(x[6], x[7]);
  545|      0|   z[13] = accum.extract();
  546|      0|   accum.mul_x2(x[6], x[8]);
  547|      0|   accum.mul(x[7], x[7]);
  548|      0|   z[14] = accum.extract();
  549|      0|   accum.mul_x2(x[7], x[8]);
  550|      0|   z[15] = accum.extract();
  551|      0|   accum.mul(x[8], x[8]);
  552|      0|   z[16] = accum.extract();
  553|      0|   z[17] = accum.extract();
  554|      0|}
_ZN5Botan17bigint_comba_mul9EPmPKmS2_:
  559|   107k|void bigint_comba_mul9(word z[18], const word x[9], const word y[9]) {
  560|   107k|#if defined(BOTAN_HAS_MP_MULX)
  561|   107k|   if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) {
  ------------------
  |  Branch (561:7): [True: 107k, False: 0]
  ------------------
  562|   107k|      return bigint_mulx_mul9(z, x, y);
  563|   107k|   }
  564|      0|#endif
  565|       |
  566|      0|   word3<word> accum;
  567|       |
  568|      0|   accum.mul(x[0], y[0]);
  569|      0|   z[0] = accum.extract();
  570|      0|   accum.mul(x[0], y[1]);
  571|      0|   accum.mul(x[1], y[0]);
  572|      0|   z[1] = accum.extract();
  573|      0|   accum.mul(x[0], y[2]);
  574|      0|   accum.mul(x[1], y[1]);
  575|      0|   accum.mul(x[2], y[0]);
  576|      0|   z[2] = accum.extract();
  577|      0|   accum.mul(x[0], y[3]);
  578|      0|   accum.mul(x[1], y[2]);
  579|      0|   accum.mul(x[2], y[1]);
  580|      0|   accum.mul(x[3], y[0]);
  581|      0|   z[3] = accum.extract();
  582|      0|   accum.mul(x[0], y[4]);
  583|      0|   accum.mul(x[1], y[3]);
  584|      0|   accum.mul(x[2], y[2]);
  585|      0|   accum.mul(x[3], y[1]);
  586|      0|   accum.mul(x[4], y[0]);
  587|      0|   z[4] = accum.extract();
  588|      0|   accum.mul(x[0], y[5]);
  589|      0|   accum.mul(x[1], y[4]);
  590|      0|   accum.mul(x[2], y[3]);
  591|      0|   accum.mul(x[3], y[2]);
  592|      0|   accum.mul(x[4], y[1]);
  593|      0|   accum.mul(x[5], y[0]);
  594|      0|   z[5] = accum.extract();
  595|      0|   accum.mul(x[0], y[6]);
  596|      0|   accum.mul(x[1], y[5]);
  597|      0|   accum.mul(x[2], y[4]);
  598|      0|   accum.mul(x[3], y[3]);
  599|      0|   accum.mul(x[4], y[2]);
  600|      0|   accum.mul(x[5], y[1]);
  601|      0|   accum.mul(x[6], y[0]);
  602|      0|   z[6] = accum.extract();
  603|      0|   accum.mul(x[0], y[7]);
  604|      0|   accum.mul(x[1], y[6]);
  605|      0|   accum.mul(x[2], y[5]);
  606|      0|   accum.mul(x[3], y[4]);
  607|      0|   accum.mul(x[4], y[3]);
  608|      0|   accum.mul(x[5], y[2]);
  609|      0|   accum.mul(x[6], y[1]);
  610|      0|   accum.mul(x[7], y[0]);
  611|      0|   z[7] = accum.extract();
  612|      0|   accum.mul(x[0], y[8]);
  613|      0|   accum.mul(x[1], y[7]);
  614|      0|   accum.mul(x[2], y[6]);
  615|      0|   accum.mul(x[3], y[5]);
  616|      0|   accum.mul(x[4], y[4]);
  617|      0|   accum.mul(x[5], y[3]);
  618|      0|   accum.mul(x[6], y[2]);
  619|      0|   accum.mul(x[7], y[1]);
  620|      0|   accum.mul(x[8], y[0]);
  621|      0|   z[8] = accum.extract();
  622|      0|   accum.mul(x[1], y[8]);
  623|      0|   accum.mul(x[2], y[7]);
  624|      0|   accum.mul(x[3], y[6]);
  625|      0|   accum.mul(x[4], y[5]);
  626|      0|   accum.mul(x[5], y[4]);
  627|      0|   accum.mul(x[6], y[3]);
  628|      0|   accum.mul(x[7], y[2]);
  629|      0|   accum.mul(x[8], y[1]);
  630|      0|   z[9] = accum.extract();
  631|      0|   accum.mul(x[2], y[8]);
  632|      0|   accum.mul(x[3], y[7]);
  633|      0|   accum.mul(x[4], y[6]);
  634|      0|   accum.mul(x[5], y[5]);
  635|      0|   accum.mul(x[6], y[4]);
  636|      0|   accum.mul(x[7], y[3]);
  637|      0|   accum.mul(x[8], y[2]);
  638|      0|   z[10] = accum.extract();
  639|      0|   accum.mul(x[3], y[8]);
  640|      0|   accum.mul(x[4], y[7]);
  641|      0|   accum.mul(x[5], y[6]);
  642|      0|   accum.mul(x[6], y[5]);
  643|      0|   accum.mul(x[7], y[4]);
  644|      0|   accum.mul(x[8], y[3]);
  645|      0|   z[11] = accum.extract();
  646|      0|   accum.mul(x[4], y[8]);
  647|      0|   accum.mul(x[5], y[7]);
  648|      0|   accum.mul(x[6], y[6]);
  649|      0|   accum.mul(x[7], y[5]);
  650|      0|   accum.mul(x[8], y[4]);
  651|      0|   z[12] = accum.extract();
  652|      0|   accum.mul(x[5], y[8]);
  653|      0|   accum.mul(x[6], y[7]);
  654|      0|   accum.mul(x[7], y[6]);
  655|      0|   accum.mul(x[8], y[5]);
  656|      0|   z[13] = accum.extract();
  657|      0|   accum.mul(x[6], y[8]);
  658|      0|   accum.mul(x[7], y[7]);
  659|      0|   accum.mul(x[8], y[6]);
  660|      0|   z[14] = accum.extract();
  661|      0|   accum.mul(x[7], y[8]);
  662|      0|   accum.mul(x[8], y[7]);
  663|      0|   z[15] = accum.extract();
  664|      0|   accum.mul(x[8], y[8]);
  665|      0|   z[16] = accum.extract();
  666|      0|   z[17] = accum.extract();
  667|      0|}
_ZN5Botan18bigint_comba_sqr16EPmPKm:
  672|   188k|void bigint_comba_sqr16(word z[32], const word x[16]) {
  673|   188k|   word3<word> accum;
  674|       |
  675|   188k|   accum.mul(x[0], x[0]);
  676|   188k|   z[0] = accum.extract();
  677|   188k|   accum.mul_x2(x[0], x[1]);
  678|   188k|   z[1] = accum.extract();
  679|   188k|   accum.mul_x2(x[0], x[2]);
  680|   188k|   accum.mul(x[1], x[1]);
  681|   188k|   z[2] = accum.extract();
  682|   188k|   accum.mul_x2(x[0], x[3]);
  683|   188k|   accum.mul_x2(x[1], x[2]);
  684|   188k|   z[3] = accum.extract();
  685|   188k|   accum.mul_x2(x[0], x[4]);
  686|   188k|   accum.mul_x2(x[1], x[3]);
  687|   188k|   accum.mul(x[2], x[2]);
  688|   188k|   z[4] = accum.extract();
  689|   188k|   accum.mul_x2(x[0], x[5]);
  690|   188k|   accum.mul_x2(x[1], x[4]);
  691|   188k|   accum.mul_x2(x[2], x[3]);
  692|   188k|   z[5] = accum.extract();
  693|   188k|   accum.mul_x2(x[0], x[6]);
  694|   188k|   accum.mul_x2(x[1], x[5]);
  695|   188k|   accum.mul_x2(x[2], x[4]);
  696|   188k|   accum.mul(x[3], x[3]);
  697|   188k|   z[6] = accum.extract();
  698|   188k|   accum.mul_x2(x[0], x[7]);
  699|   188k|   accum.mul_x2(x[1], x[6]);
  700|   188k|   accum.mul_x2(x[2], x[5]);
  701|   188k|   accum.mul_x2(x[3], x[4]);
  702|   188k|   z[7] = accum.extract();
  703|   188k|   accum.mul_x2(x[0], x[8]);
  704|   188k|   accum.mul_x2(x[1], x[7]);
  705|   188k|   accum.mul_x2(x[2], x[6]);
  706|   188k|   accum.mul_x2(x[3], x[5]);
  707|   188k|   accum.mul(x[4], x[4]);
  708|   188k|   z[8] = accum.extract();
  709|   188k|   accum.mul_x2(x[0], x[9]);
  710|   188k|   accum.mul_x2(x[1], x[8]);
  711|   188k|   accum.mul_x2(x[2], x[7]);
  712|   188k|   accum.mul_x2(x[3], x[6]);
  713|   188k|   accum.mul_x2(x[4], x[5]);
  714|   188k|   z[9] = accum.extract();
  715|   188k|   accum.mul_x2(x[0], x[10]);
  716|   188k|   accum.mul_x2(x[1], x[9]);
  717|   188k|   accum.mul_x2(x[2], x[8]);
  718|   188k|   accum.mul_x2(x[3], x[7]);
  719|   188k|   accum.mul_x2(x[4], x[6]);
  720|   188k|   accum.mul(x[5], x[5]);
  721|   188k|   z[10] = accum.extract();
  722|   188k|   accum.mul_x2(x[0], x[11]);
  723|   188k|   accum.mul_x2(x[1], x[10]);
  724|   188k|   accum.mul_x2(x[2], x[9]);
  725|   188k|   accum.mul_x2(x[3], x[8]);
  726|   188k|   accum.mul_x2(x[4], x[7]);
  727|   188k|   accum.mul_x2(x[5], x[6]);
  728|   188k|   z[11] = accum.extract();
  729|   188k|   accum.mul_x2(x[0], x[12]);
  730|   188k|   accum.mul_x2(x[1], x[11]);
  731|   188k|   accum.mul_x2(x[2], x[10]);
  732|   188k|   accum.mul_x2(x[3], x[9]);
  733|   188k|   accum.mul_x2(x[4], x[8]);
  734|   188k|   accum.mul_x2(x[5], x[7]);
  735|   188k|   accum.mul(x[6], x[6]);
  736|   188k|   z[12] = accum.extract();
  737|   188k|   accum.mul_x2(x[0], x[13]);
  738|   188k|   accum.mul_x2(x[1], x[12]);
  739|   188k|   accum.mul_x2(x[2], x[11]);
  740|   188k|   accum.mul_x2(x[3], x[10]);
  741|   188k|   accum.mul_x2(x[4], x[9]);
  742|   188k|   accum.mul_x2(x[5], x[8]);
  743|   188k|   accum.mul_x2(x[6], x[7]);
  744|   188k|   z[13] = accum.extract();
  745|   188k|   accum.mul_x2(x[0], x[14]);
  746|   188k|   accum.mul_x2(x[1], x[13]);
  747|   188k|   accum.mul_x2(x[2], x[12]);
  748|   188k|   accum.mul_x2(x[3], x[11]);
  749|   188k|   accum.mul_x2(x[4], x[10]);
  750|   188k|   accum.mul_x2(x[5], x[9]);
  751|   188k|   accum.mul_x2(x[6], x[8]);
  752|   188k|   accum.mul(x[7], x[7]);
  753|   188k|   z[14] = accum.extract();
  754|   188k|   accum.mul_x2(x[0], x[15]);
  755|   188k|   accum.mul_x2(x[1], x[14]);
  756|   188k|   accum.mul_x2(x[2], x[13]);
  757|   188k|   accum.mul_x2(x[3], x[12]);
  758|   188k|   accum.mul_x2(x[4], x[11]);
  759|   188k|   accum.mul_x2(x[5], x[10]);
  760|   188k|   accum.mul_x2(x[6], x[9]);
  761|   188k|   accum.mul_x2(x[7], x[8]);
  762|   188k|   z[15] = accum.extract();
  763|   188k|   accum.mul_x2(x[1], x[15]);
  764|   188k|   accum.mul_x2(x[2], x[14]);
  765|   188k|   accum.mul_x2(x[3], x[13]);
  766|   188k|   accum.mul_x2(x[4], x[12]);
  767|   188k|   accum.mul_x2(x[5], x[11]);
  768|   188k|   accum.mul_x2(x[6], x[10]);
  769|   188k|   accum.mul_x2(x[7], x[9]);
  770|   188k|   accum.mul(x[8], x[8]);
  771|   188k|   z[16] = accum.extract();
  772|   188k|   accum.mul_x2(x[2], x[15]);
  773|   188k|   accum.mul_x2(x[3], x[14]);
  774|   188k|   accum.mul_x2(x[4], x[13]);
  775|   188k|   accum.mul_x2(x[5], x[12]);
  776|   188k|   accum.mul_x2(x[6], x[11]);
  777|   188k|   accum.mul_x2(x[7], x[10]);
  778|   188k|   accum.mul_x2(x[8], x[9]);
  779|   188k|   z[17] = accum.extract();
  780|   188k|   accum.mul_x2(x[3], x[15]);
  781|   188k|   accum.mul_x2(x[4], x[14]);
  782|   188k|   accum.mul_x2(x[5], x[13]);
  783|   188k|   accum.mul_x2(x[6], x[12]);
  784|   188k|   accum.mul_x2(x[7], x[11]);
  785|   188k|   accum.mul_x2(x[8], x[10]);
  786|   188k|   accum.mul(x[9], x[9]);
  787|   188k|   z[18] = accum.extract();
  788|   188k|   accum.mul_x2(x[4], x[15]);
  789|   188k|   accum.mul_x2(x[5], x[14]);
  790|   188k|   accum.mul_x2(x[6], x[13]);
  791|   188k|   accum.mul_x2(x[7], x[12]);
  792|   188k|   accum.mul_x2(x[8], x[11]);
  793|   188k|   accum.mul_x2(x[9], x[10]);
  794|   188k|   z[19] = accum.extract();
  795|   188k|   accum.mul_x2(x[5], x[15]);
  796|   188k|   accum.mul_x2(x[6], x[14]);
  797|   188k|   accum.mul_x2(x[7], x[13]);
  798|   188k|   accum.mul_x2(x[8], x[12]);
  799|   188k|   accum.mul_x2(x[9], x[11]);
  800|   188k|   accum.mul(x[10], x[10]);
  801|   188k|   z[20] = accum.extract();
  802|   188k|   accum.mul_x2(x[6], x[15]);
  803|   188k|   accum.mul_x2(x[7], x[14]);
  804|   188k|   accum.mul_x2(x[8], x[13]);
  805|   188k|   accum.mul_x2(x[9], x[12]);
  806|   188k|   accum.mul_x2(x[10], x[11]);
  807|   188k|   z[21] = accum.extract();
  808|   188k|   accum.mul_x2(x[7], x[15]);
  809|   188k|   accum.mul_x2(x[8], x[14]);
  810|   188k|   accum.mul_x2(x[9], x[13]);
  811|   188k|   accum.mul_x2(x[10], x[12]);
  812|   188k|   accum.mul(x[11], x[11]);
  813|   188k|   z[22] = accum.extract();
  814|   188k|   accum.mul_x2(x[8], x[15]);
  815|   188k|   accum.mul_x2(x[9], x[14]);
  816|   188k|   accum.mul_x2(x[10], x[13]);
  817|   188k|   accum.mul_x2(x[11], x[12]);
  818|   188k|   z[23] = accum.extract();
  819|   188k|   accum.mul_x2(x[9], x[15]);
  820|   188k|   accum.mul_x2(x[10], x[14]);
  821|   188k|   accum.mul_x2(x[11], x[13]);
  822|   188k|   accum.mul(x[12], x[12]);
  823|   188k|   z[24] = accum.extract();
  824|   188k|   accum.mul_x2(x[10], x[15]);
  825|   188k|   accum.mul_x2(x[11], x[14]);
  826|   188k|   accum.mul_x2(x[12], x[13]);
  827|   188k|   z[25] = accum.extract();
  828|   188k|   accum.mul_x2(x[11], x[15]);
  829|   188k|   accum.mul_x2(x[12], x[14]);
  830|   188k|   accum.mul(x[13], x[13]);
  831|   188k|   z[26] = accum.extract();
  832|   188k|   accum.mul_x2(x[12], x[15]);
  833|   188k|   accum.mul_x2(x[13], x[14]);
  834|   188k|   z[27] = accum.extract();
  835|   188k|   accum.mul_x2(x[13], x[15]);
  836|   188k|   accum.mul(x[14], x[14]);
  837|   188k|   z[28] = accum.extract();
  838|   188k|   accum.mul_x2(x[14], x[15]);
  839|   188k|   z[29] = accum.extract();
  840|   188k|   accum.mul(x[15], x[15]);
  841|   188k|   z[30] = accum.extract();
  842|   188k|   z[31] = accum.extract();
  843|   188k|}
_ZN5Botan18bigint_comba_mul16EPmPKmS2_:
  848|   508k|void bigint_comba_mul16(word z[32], const word x[16], const word y[16]) {
  849|   508k|   word3<word> accum;
  850|       |
  851|   508k|   accum.mul(x[0], y[0]);
  852|   508k|   z[0] = accum.extract();
  853|   508k|   accum.mul(x[0], y[1]);
  854|   508k|   accum.mul(x[1], y[0]);
  855|   508k|   z[1] = accum.extract();
  856|   508k|   accum.mul(x[0], y[2]);
  857|   508k|   accum.mul(x[1], y[1]);
  858|   508k|   accum.mul(x[2], y[0]);
  859|   508k|   z[2] = accum.extract();
  860|   508k|   accum.mul(x[0], y[3]);
  861|   508k|   accum.mul(x[1], y[2]);
  862|   508k|   accum.mul(x[2], y[1]);
  863|   508k|   accum.mul(x[3], y[0]);
  864|   508k|   z[3] = accum.extract();
  865|   508k|   accum.mul(x[0], y[4]);
  866|   508k|   accum.mul(x[1], y[3]);
  867|   508k|   accum.mul(x[2], y[2]);
  868|   508k|   accum.mul(x[3], y[1]);
  869|   508k|   accum.mul(x[4], y[0]);
  870|   508k|   z[4] = accum.extract();
  871|   508k|   accum.mul(x[0], y[5]);
  872|   508k|   accum.mul(x[1], y[4]);
  873|   508k|   accum.mul(x[2], y[3]);
  874|   508k|   accum.mul(x[3], y[2]);
  875|   508k|   accum.mul(x[4], y[1]);
  876|   508k|   accum.mul(x[5], y[0]);
  877|   508k|   z[5] = accum.extract();
  878|   508k|   accum.mul(x[0], y[6]);
  879|   508k|   accum.mul(x[1], y[5]);
  880|   508k|   accum.mul(x[2], y[4]);
  881|   508k|   accum.mul(x[3], y[3]);
  882|   508k|   accum.mul(x[4], y[2]);
  883|   508k|   accum.mul(x[5], y[1]);
  884|   508k|   accum.mul(x[6], y[0]);
  885|   508k|   z[6] = accum.extract();
  886|   508k|   accum.mul(x[0], y[7]);
  887|   508k|   accum.mul(x[1], y[6]);
  888|   508k|   accum.mul(x[2], y[5]);
  889|   508k|   accum.mul(x[3], y[4]);
  890|   508k|   accum.mul(x[4], y[3]);
  891|   508k|   accum.mul(x[5], y[2]);
  892|   508k|   accum.mul(x[6], y[1]);
  893|   508k|   accum.mul(x[7], y[0]);
  894|   508k|   z[7] = accum.extract();
  895|   508k|   accum.mul(x[0], y[8]);
  896|   508k|   accum.mul(x[1], y[7]);
  897|   508k|   accum.mul(x[2], y[6]);
  898|   508k|   accum.mul(x[3], y[5]);
  899|   508k|   accum.mul(x[4], y[4]);
  900|   508k|   accum.mul(x[5], y[3]);
  901|   508k|   accum.mul(x[6], y[2]);
  902|   508k|   accum.mul(x[7], y[1]);
  903|   508k|   accum.mul(x[8], y[0]);
  904|   508k|   z[8] = accum.extract();
  905|   508k|   accum.mul(x[0], y[9]);
  906|   508k|   accum.mul(x[1], y[8]);
  907|   508k|   accum.mul(x[2], y[7]);
  908|   508k|   accum.mul(x[3], y[6]);
  909|   508k|   accum.mul(x[4], y[5]);
  910|   508k|   accum.mul(x[5], y[4]);
  911|   508k|   accum.mul(x[6], y[3]);
  912|   508k|   accum.mul(x[7], y[2]);
  913|   508k|   accum.mul(x[8], y[1]);
  914|   508k|   accum.mul(x[9], y[0]);
  915|   508k|   z[9] = accum.extract();
  916|   508k|   accum.mul(x[0], y[10]);
  917|   508k|   accum.mul(x[1], y[9]);
  918|   508k|   accum.mul(x[2], y[8]);
  919|   508k|   accum.mul(x[3], y[7]);
  920|   508k|   accum.mul(x[4], y[6]);
  921|   508k|   accum.mul(x[5], y[5]);
  922|   508k|   accum.mul(x[6], y[4]);
  923|   508k|   accum.mul(x[7], y[3]);
  924|   508k|   accum.mul(x[8], y[2]);
  925|   508k|   accum.mul(x[9], y[1]);
  926|   508k|   accum.mul(x[10], y[0]);
  927|   508k|   z[10] = accum.extract();
  928|   508k|   accum.mul(x[0], y[11]);
  929|   508k|   accum.mul(x[1], y[10]);
  930|   508k|   accum.mul(x[2], y[9]);
  931|   508k|   accum.mul(x[3], y[8]);
  932|   508k|   accum.mul(x[4], y[7]);
  933|   508k|   accum.mul(x[5], y[6]);
  934|   508k|   accum.mul(x[6], y[5]);
  935|   508k|   accum.mul(x[7], y[4]);
  936|   508k|   accum.mul(x[8], y[3]);
  937|   508k|   accum.mul(x[9], y[2]);
  938|   508k|   accum.mul(x[10], y[1]);
  939|   508k|   accum.mul(x[11], y[0]);
  940|   508k|   z[11] = accum.extract();
  941|   508k|   accum.mul(x[0], y[12]);
  942|   508k|   accum.mul(x[1], y[11]);
  943|   508k|   accum.mul(x[2], y[10]);
  944|   508k|   accum.mul(x[3], y[9]);
  945|   508k|   accum.mul(x[4], y[8]);
  946|   508k|   accum.mul(x[5], y[7]);
  947|   508k|   accum.mul(x[6], y[6]);
  948|   508k|   accum.mul(x[7], y[5]);
  949|   508k|   accum.mul(x[8], y[4]);
  950|   508k|   accum.mul(x[9], y[3]);
  951|   508k|   accum.mul(x[10], y[2]);
  952|   508k|   accum.mul(x[11], y[1]);
  953|   508k|   accum.mul(x[12], y[0]);
  954|   508k|   z[12] = accum.extract();
  955|   508k|   accum.mul(x[0], y[13]);
  956|   508k|   accum.mul(x[1], y[12]);
  957|   508k|   accum.mul(x[2], y[11]);
  958|   508k|   accum.mul(x[3], y[10]);
  959|   508k|   accum.mul(x[4], y[9]);
  960|   508k|   accum.mul(x[5], y[8]);
  961|   508k|   accum.mul(x[6], y[7]);
  962|   508k|   accum.mul(x[7], y[6]);
  963|   508k|   accum.mul(x[8], y[5]);
  964|   508k|   accum.mul(x[9], y[4]);
  965|   508k|   accum.mul(x[10], y[3]);
  966|   508k|   accum.mul(x[11], y[2]);
  967|   508k|   accum.mul(x[12], y[1]);
  968|   508k|   accum.mul(x[13], y[0]);
  969|   508k|   z[13] = accum.extract();
  970|   508k|   accum.mul(x[0], y[14]);
  971|   508k|   accum.mul(x[1], y[13]);
  972|   508k|   accum.mul(x[2], y[12]);
  973|   508k|   accum.mul(x[3], y[11]);
  974|   508k|   accum.mul(x[4], y[10]);
  975|   508k|   accum.mul(x[5], y[9]);
  976|   508k|   accum.mul(x[6], y[8]);
  977|   508k|   accum.mul(x[7], y[7]);
  978|   508k|   accum.mul(x[8], y[6]);
  979|   508k|   accum.mul(x[9], y[5]);
  980|   508k|   accum.mul(x[10], y[4]);
  981|   508k|   accum.mul(x[11], y[3]);
  982|   508k|   accum.mul(x[12], y[2]);
  983|   508k|   accum.mul(x[13], y[1]);
  984|   508k|   accum.mul(x[14], y[0]);
  985|   508k|   z[14] = accum.extract();
  986|   508k|   accum.mul(x[0], y[15]);
  987|   508k|   accum.mul(x[1], y[14]);
  988|   508k|   accum.mul(x[2], y[13]);
  989|   508k|   accum.mul(x[3], y[12]);
  990|   508k|   accum.mul(x[4], y[11]);
  991|   508k|   accum.mul(x[5], y[10]);
  992|   508k|   accum.mul(x[6], y[9]);
  993|   508k|   accum.mul(x[7], y[8]);
  994|   508k|   accum.mul(x[8], y[7]);
  995|   508k|   accum.mul(x[9], y[6]);
  996|   508k|   accum.mul(x[10], y[5]);
  997|   508k|   accum.mul(x[11], y[4]);
  998|   508k|   accum.mul(x[12], y[3]);
  999|   508k|   accum.mul(x[13], y[2]);
 1000|   508k|   accum.mul(x[14], y[1]);
 1001|   508k|   accum.mul(x[15], y[0]);
 1002|   508k|   z[15] = accum.extract();
 1003|   508k|   accum.mul(x[1], y[15]);
 1004|   508k|   accum.mul(x[2], y[14]);
 1005|   508k|   accum.mul(x[3], y[13]);
 1006|   508k|   accum.mul(x[4], y[12]);
 1007|   508k|   accum.mul(x[5], y[11]);
 1008|   508k|   accum.mul(x[6], y[10]);
 1009|   508k|   accum.mul(x[7], y[9]);
 1010|   508k|   accum.mul(x[8], y[8]);
 1011|   508k|   accum.mul(x[9], y[7]);
 1012|   508k|   accum.mul(x[10], y[6]);
 1013|   508k|   accum.mul(x[11], y[5]);
 1014|   508k|   accum.mul(x[12], y[4]);
 1015|   508k|   accum.mul(x[13], y[3]);
 1016|   508k|   accum.mul(x[14], y[2]);
 1017|   508k|   accum.mul(x[15], y[1]);
 1018|   508k|   z[16] = accum.extract();
 1019|   508k|   accum.mul(x[2], y[15]);
 1020|   508k|   accum.mul(x[3], y[14]);
 1021|   508k|   accum.mul(x[4], y[13]);
 1022|   508k|   accum.mul(x[5], y[12]);
 1023|   508k|   accum.mul(x[6], y[11]);
 1024|   508k|   accum.mul(x[7], y[10]);
 1025|   508k|   accum.mul(x[8], y[9]);
 1026|   508k|   accum.mul(x[9], y[8]);
 1027|   508k|   accum.mul(x[10], y[7]);
 1028|   508k|   accum.mul(x[11], y[6]);
 1029|   508k|   accum.mul(x[12], y[5]);
 1030|   508k|   accum.mul(x[13], y[4]);
 1031|   508k|   accum.mul(x[14], y[3]);
 1032|   508k|   accum.mul(x[15], y[2]);
 1033|   508k|   z[17] = accum.extract();
 1034|   508k|   accum.mul(x[3], y[15]);
 1035|   508k|   accum.mul(x[4], y[14]);
 1036|   508k|   accum.mul(x[5], y[13]);
 1037|   508k|   accum.mul(x[6], y[12]);
 1038|   508k|   accum.mul(x[7], y[11]);
 1039|   508k|   accum.mul(x[8], y[10]);
 1040|   508k|   accum.mul(x[9], y[9]);
 1041|   508k|   accum.mul(x[10], y[8]);
 1042|   508k|   accum.mul(x[11], y[7]);
 1043|   508k|   accum.mul(x[12], y[6]);
 1044|   508k|   accum.mul(x[13], y[5]);
 1045|   508k|   accum.mul(x[14], y[4]);
 1046|   508k|   accum.mul(x[15], y[3]);
 1047|   508k|   z[18] = accum.extract();
 1048|   508k|   accum.mul(x[4], y[15]);
 1049|   508k|   accum.mul(x[5], y[14]);
 1050|   508k|   accum.mul(x[6], y[13]);
 1051|   508k|   accum.mul(x[7], y[12]);
 1052|   508k|   accum.mul(x[8], y[11]);
 1053|   508k|   accum.mul(x[9], y[10]);
 1054|   508k|   accum.mul(x[10], y[9]);
 1055|   508k|   accum.mul(x[11], y[8]);
 1056|   508k|   accum.mul(x[12], y[7]);
 1057|   508k|   accum.mul(x[13], y[6]);
 1058|   508k|   accum.mul(x[14], y[5]);
 1059|   508k|   accum.mul(x[15], y[4]);
 1060|   508k|   z[19] = accum.extract();
 1061|   508k|   accum.mul(x[5], y[15]);
 1062|   508k|   accum.mul(x[6], y[14]);
 1063|   508k|   accum.mul(x[7], y[13]);
 1064|   508k|   accum.mul(x[8], y[12]);
 1065|   508k|   accum.mul(x[9], y[11]);
 1066|   508k|   accum.mul(x[10], y[10]);
 1067|   508k|   accum.mul(x[11], y[9]);
 1068|   508k|   accum.mul(x[12], y[8]);
 1069|   508k|   accum.mul(x[13], y[7]);
 1070|   508k|   accum.mul(x[14], y[6]);
 1071|   508k|   accum.mul(x[15], y[5]);
 1072|   508k|   z[20] = accum.extract();
 1073|   508k|   accum.mul(x[6], y[15]);
 1074|   508k|   accum.mul(x[7], y[14]);
 1075|   508k|   accum.mul(x[8], y[13]);
 1076|   508k|   accum.mul(x[9], y[12]);
 1077|   508k|   accum.mul(x[10], y[11]);
 1078|   508k|   accum.mul(x[11], y[10]);
 1079|   508k|   accum.mul(x[12], y[9]);
 1080|   508k|   accum.mul(x[13], y[8]);
 1081|   508k|   accum.mul(x[14], y[7]);
 1082|   508k|   accum.mul(x[15], y[6]);
 1083|   508k|   z[21] = accum.extract();
 1084|   508k|   accum.mul(x[7], y[15]);
 1085|   508k|   accum.mul(x[8], y[14]);
 1086|   508k|   accum.mul(x[9], y[13]);
 1087|   508k|   accum.mul(x[10], y[12]);
 1088|   508k|   accum.mul(x[11], y[11]);
 1089|   508k|   accum.mul(x[12], y[10]);
 1090|   508k|   accum.mul(x[13], y[9]);
 1091|   508k|   accum.mul(x[14], y[8]);
 1092|   508k|   accum.mul(x[15], y[7]);
 1093|   508k|   z[22] = accum.extract();
 1094|   508k|   accum.mul(x[8], y[15]);
 1095|   508k|   accum.mul(x[9], y[14]);
 1096|   508k|   accum.mul(x[10], y[13]);
 1097|   508k|   accum.mul(x[11], y[12]);
 1098|   508k|   accum.mul(x[12], y[11]);
 1099|   508k|   accum.mul(x[13], y[10]);
 1100|   508k|   accum.mul(x[14], y[9]);
 1101|   508k|   accum.mul(x[15], y[8]);
 1102|   508k|   z[23] = accum.extract();
 1103|   508k|   accum.mul(x[9], y[15]);
 1104|   508k|   accum.mul(x[10], y[14]);
 1105|   508k|   accum.mul(x[11], y[13]);
 1106|   508k|   accum.mul(x[12], y[12]);
 1107|   508k|   accum.mul(x[13], y[11]);
 1108|   508k|   accum.mul(x[14], y[10]);
 1109|   508k|   accum.mul(x[15], y[9]);
 1110|   508k|   z[24] = accum.extract();
 1111|   508k|   accum.mul(x[10], y[15]);
 1112|   508k|   accum.mul(x[11], y[14]);
 1113|   508k|   accum.mul(x[12], y[13]);
 1114|   508k|   accum.mul(x[13], y[12]);
 1115|   508k|   accum.mul(x[14], y[11]);
 1116|   508k|   accum.mul(x[15], y[10]);
 1117|   508k|   z[25] = accum.extract();
 1118|   508k|   accum.mul(x[11], y[15]);
 1119|   508k|   accum.mul(x[12], y[14]);
 1120|   508k|   accum.mul(x[13], y[13]);
 1121|   508k|   accum.mul(x[14], y[12]);
 1122|   508k|   accum.mul(x[15], y[11]);
 1123|   508k|   z[26] = accum.extract();
 1124|   508k|   accum.mul(x[12], y[15]);
 1125|   508k|   accum.mul(x[13], y[14]);
 1126|   508k|   accum.mul(x[14], y[13]);
 1127|   508k|   accum.mul(x[15], y[12]);
 1128|   508k|   z[27] = accum.extract();
 1129|   508k|   accum.mul(x[13], y[15]);
 1130|   508k|   accum.mul(x[14], y[14]);
 1131|   508k|   accum.mul(x[15], y[13]);
 1132|   508k|   z[28] = accum.extract();
 1133|   508k|   accum.mul(x[14], y[15]);
 1134|   508k|   accum.mul(x[15], y[14]);
 1135|   508k|   z[29] = accum.extract();
 1136|   508k|   accum.mul(x[15], y[15]);
 1137|   508k|   z[30] = accum.extract();
 1138|   508k|   z[31] = accum.extract();
 1139|   508k|}
_ZN5Botan18bigint_comba_sqr24EPmPKm:
 1144|  10.1k|void bigint_comba_sqr24(word z[48], const word x[24]) {
 1145|  10.1k|   word3<word> accum;
 1146|       |
 1147|  10.1k|   accum.mul(x[0], x[0]);
 1148|  10.1k|   z[0] = accum.extract();
 1149|  10.1k|   accum.mul_x2(x[0], x[1]);
 1150|  10.1k|   z[1] = accum.extract();
 1151|  10.1k|   accum.mul_x2(x[0], x[2]);
 1152|  10.1k|   accum.mul(x[1], x[1]);
 1153|  10.1k|   z[2] = accum.extract();
 1154|  10.1k|   accum.mul_x2(x[0], x[3]);
 1155|  10.1k|   accum.mul_x2(x[1], x[2]);
 1156|  10.1k|   z[3] = accum.extract();
 1157|  10.1k|   accum.mul_x2(x[0], x[4]);
 1158|  10.1k|   accum.mul_x2(x[1], x[3]);
 1159|  10.1k|   accum.mul(x[2], x[2]);
 1160|  10.1k|   z[4] = accum.extract();
 1161|  10.1k|   accum.mul_x2(x[0], x[5]);
 1162|  10.1k|   accum.mul_x2(x[1], x[4]);
 1163|  10.1k|   accum.mul_x2(x[2], x[3]);
 1164|  10.1k|   z[5] = accum.extract();
 1165|  10.1k|   accum.mul_x2(x[0], x[6]);
 1166|  10.1k|   accum.mul_x2(x[1], x[5]);
 1167|  10.1k|   accum.mul_x2(x[2], x[4]);
 1168|  10.1k|   accum.mul(x[3], x[3]);
 1169|  10.1k|   z[6] = accum.extract();
 1170|  10.1k|   accum.mul_x2(x[0], x[7]);
 1171|  10.1k|   accum.mul_x2(x[1], x[6]);
 1172|  10.1k|   accum.mul_x2(x[2], x[5]);
 1173|  10.1k|   accum.mul_x2(x[3], x[4]);
 1174|  10.1k|   z[7] = accum.extract();
 1175|  10.1k|   accum.mul_x2(x[0], x[8]);
 1176|  10.1k|   accum.mul_x2(x[1], x[7]);
 1177|  10.1k|   accum.mul_x2(x[2], x[6]);
 1178|  10.1k|   accum.mul_x2(x[3], x[5]);
 1179|  10.1k|   accum.mul(x[4], x[4]);
 1180|  10.1k|   z[8] = accum.extract();
 1181|  10.1k|   accum.mul_x2(x[0], x[9]);
 1182|  10.1k|   accum.mul_x2(x[1], x[8]);
 1183|  10.1k|   accum.mul_x2(x[2], x[7]);
 1184|  10.1k|   accum.mul_x2(x[3], x[6]);
 1185|  10.1k|   accum.mul_x2(x[4], x[5]);
 1186|  10.1k|   z[9] = accum.extract();
 1187|  10.1k|   accum.mul_x2(x[0], x[10]);
 1188|  10.1k|   accum.mul_x2(x[1], x[9]);
 1189|  10.1k|   accum.mul_x2(x[2], x[8]);
 1190|  10.1k|   accum.mul_x2(x[3], x[7]);
 1191|  10.1k|   accum.mul_x2(x[4], x[6]);
 1192|  10.1k|   accum.mul(x[5], x[5]);
 1193|  10.1k|   z[10] = accum.extract();
 1194|  10.1k|   accum.mul_x2(x[0], x[11]);
 1195|  10.1k|   accum.mul_x2(x[1], x[10]);
 1196|  10.1k|   accum.mul_x2(x[2], x[9]);
 1197|  10.1k|   accum.mul_x2(x[3], x[8]);
 1198|  10.1k|   accum.mul_x2(x[4], x[7]);
 1199|  10.1k|   accum.mul_x2(x[5], x[6]);
 1200|  10.1k|   z[11] = accum.extract();
 1201|  10.1k|   accum.mul_x2(x[0], x[12]);
 1202|  10.1k|   accum.mul_x2(x[1], x[11]);
 1203|  10.1k|   accum.mul_x2(x[2], x[10]);
 1204|  10.1k|   accum.mul_x2(x[3], x[9]);
 1205|  10.1k|   accum.mul_x2(x[4], x[8]);
 1206|  10.1k|   accum.mul_x2(x[5], x[7]);
 1207|  10.1k|   accum.mul(x[6], x[6]);
 1208|  10.1k|   z[12] = accum.extract();
 1209|  10.1k|   accum.mul_x2(x[0], x[13]);
 1210|  10.1k|   accum.mul_x2(x[1], x[12]);
 1211|  10.1k|   accum.mul_x2(x[2], x[11]);
 1212|  10.1k|   accum.mul_x2(x[3], x[10]);
 1213|  10.1k|   accum.mul_x2(x[4], x[9]);
 1214|  10.1k|   accum.mul_x2(x[5], x[8]);
 1215|  10.1k|   accum.mul_x2(x[6], x[7]);
 1216|  10.1k|   z[13] = accum.extract();
 1217|  10.1k|   accum.mul_x2(x[0], x[14]);
 1218|  10.1k|   accum.mul_x2(x[1], x[13]);
 1219|  10.1k|   accum.mul_x2(x[2], x[12]);
 1220|  10.1k|   accum.mul_x2(x[3], x[11]);
 1221|  10.1k|   accum.mul_x2(x[4], x[10]);
 1222|  10.1k|   accum.mul_x2(x[5], x[9]);
 1223|  10.1k|   accum.mul_x2(x[6], x[8]);
 1224|  10.1k|   accum.mul(x[7], x[7]);
 1225|  10.1k|   z[14] = accum.extract();
 1226|  10.1k|   accum.mul_x2(x[0], x[15]);
 1227|  10.1k|   accum.mul_x2(x[1], x[14]);
 1228|  10.1k|   accum.mul_x2(x[2], x[13]);
 1229|  10.1k|   accum.mul_x2(x[3], x[12]);
 1230|  10.1k|   accum.mul_x2(x[4], x[11]);
 1231|  10.1k|   accum.mul_x2(x[5], x[10]);
 1232|  10.1k|   accum.mul_x2(x[6], x[9]);
 1233|  10.1k|   accum.mul_x2(x[7], x[8]);
 1234|  10.1k|   z[15] = accum.extract();
 1235|  10.1k|   accum.mul_x2(x[0], x[16]);
 1236|  10.1k|   accum.mul_x2(x[1], x[15]);
 1237|  10.1k|   accum.mul_x2(x[2], x[14]);
 1238|  10.1k|   accum.mul_x2(x[3], x[13]);
 1239|  10.1k|   accum.mul_x2(x[4], x[12]);
 1240|  10.1k|   accum.mul_x2(x[5], x[11]);
 1241|  10.1k|   accum.mul_x2(x[6], x[10]);
 1242|  10.1k|   accum.mul_x2(x[7], x[9]);
 1243|  10.1k|   accum.mul(x[8], x[8]);
 1244|  10.1k|   z[16] = accum.extract();
 1245|  10.1k|   accum.mul_x2(x[0], x[17]);
 1246|  10.1k|   accum.mul_x2(x[1], x[16]);
 1247|  10.1k|   accum.mul_x2(x[2], x[15]);
 1248|  10.1k|   accum.mul_x2(x[3], x[14]);
 1249|  10.1k|   accum.mul_x2(x[4], x[13]);
 1250|  10.1k|   accum.mul_x2(x[5], x[12]);
 1251|  10.1k|   accum.mul_x2(x[6], x[11]);
 1252|  10.1k|   accum.mul_x2(x[7], x[10]);
 1253|  10.1k|   accum.mul_x2(x[8], x[9]);
 1254|  10.1k|   z[17] = accum.extract();
 1255|  10.1k|   accum.mul_x2(x[0], x[18]);
 1256|  10.1k|   accum.mul_x2(x[1], x[17]);
 1257|  10.1k|   accum.mul_x2(x[2], x[16]);
 1258|  10.1k|   accum.mul_x2(x[3], x[15]);
 1259|  10.1k|   accum.mul_x2(x[4], x[14]);
 1260|  10.1k|   accum.mul_x2(x[5], x[13]);
 1261|  10.1k|   accum.mul_x2(x[6], x[12]);
 1262|  10.1k|   accum.mul_x2(x[7], x[11]);
 1263|  10.1k|   accum.mul_x2(x[8], x[10]);
 1264|  10.1k|   accum.mul(x[9], x[9]);
 1265|  10.1k|   z[18] = accum.extract();
 1266|  10.1k|   accum.mul_x2(x[0], x[19]);
 1267|  10.1k|   accum.mul_x2(x[1], x[18]);
 1268|  10.1k|   accum.mul_x2(x[2], x[17]);
 1269|  10.1k|   accum.mul_x2(x[3], x[16]);
 1270|  10.1k|   accum.mul_x2(x[4], x[15]);
 1271|  10.1k|   accum.mul_x2(x[5], x[14]);
 1272|  10.1k|   accum.mul_x2(x[6], x[13]);
 1273|  10.1k|   accum.mul_x2(x[7], x[12]);
 1274|  10.1k|   accum.mul_x2(x[8], x[11]);
 1275|  10.1k|   accum.mul_x2(x[9], x[10]);
 1276|  10.1k|   z[19] = accum.extract();
 1277|  10.1k|   accum.mul_x2(x[0], x[20]);
 1278|  10.1k|   accum.mul_x2(x[1], x[19]);
 1279|  10.1k|   accum.mul_x2(x[2], x[18]);
 1280|  10.1k|   accum.mul_x2(x[3], x[17]);
 1281|  10.1k|   accum.mul_x2(x[4], x[16]);
 1282|  10.1k|   accum.mul_x2(x[5], x[15]);
 1283|  10.1k|   accum.mul_x2(x[6], x[14]);
 1284|  10.1k|   accum.mul_x2(x[7], x[13]);
 1285|  10.1k|   accum.mul_x2(x[8], x[12]);
 1286|  10.1k|   accum.mul_x2(x[9], x[11]);
 1287|  10.1k|   accum.mul(x[10], x[10]);
 1288|  10.1k|   z[20] = accum.extract();
 1289|  10.1k|   accum.mul_x2(x[0], x[21]);
 1290|  10.1k|   accum.mul_x2(x[1], x[20]);
 1291|  10.1k|   accum.mul_x2(x[2], x[19]);
 1292|  10.1k|   accum.mul_x2(x[3], x[18]);
 1293|  10.1k|   accum.mul_x2(x[4], x[17]);
 1294|  10.1k|   accum.mul_x2(x[5], x[16]);
 1295|  10.1k|   accum.mul_x2(x[6], x[15]);
 1296|  10.1k|   accum.mul_x2(x[7], x[14]);
 1297|  10.1k|   accum.mul_x2(x[8], x[13]);
 1298|  10.1k|   accum.mul_x2(x[9], x[12]);
 1299|  10.1k|   accum.mul_x2(x[10], x[11]);
 1300|  10.1k|   z[21] = accum.extract();
 1301|  10.1k|   accum.mul_x2(x[0], x[22]);
 1302|  10.1k|   accum.mul_x2(x[1], x[21]);
 1303|  10.1k|   accum.mul_x2(x[2], x[20]);
 1304|  10.1k|   accum.mul_x2(x[3], x[19]);
 1305|  10.1k|   accum.mul_x2(x[4], x[18]);
 1306|  10.1k|   accum.mul_x2(x[5], x[17]);
 1307|  10.1k|   accum.mul_x2(x[6], x[16]);
 1308|  10.1k|   accum.mul_x2(x[7], x[15]);
 1309|  10.1k|   accum.mul_x2(x[8], x[14]);
 1310|  10.1k|   accum.mul_x2(x[9], x[13]);
 1311|  10.1k|   accum.mul_x2(x[10], x[12]);
 1312|  10.1k|   accum.mul(x[11], x[11]);
 1313|  10.1k|   z[22] = accum.extract();
 1314|  10.1k|   accum.mul_x2(x[0], x[23]);
 1315|  10.1k|   accum.mul_x2(x[1], x[22]);
 1316|  10.1k|   accum.mul_x2(x[2], x[21]);
 1317|  10.1k|   accum.mul_x2(x[3], x[20]);
 1318|  10.1k|   accum.mul_x2(x[4], x[19]);
 1319|  10.1k|   accum.mul_x2(x[5], x[18]);
 1320|  10.1k|   accum.mul_x2(x[6], x[17]);
 1321|  10.1k|   accum.mul_x2(x[7], x[16]);
 1322|  10.1k|   accum.mul_x2(x[8], x[15]);
 1323|  10.1k|   accum.mul_x2(x[9], x[14]);
 1324|  10.1k|   accum.mul_x2(x[10], x[13]);
 1325|  10.1k|   accum.mul_x2(x[11], x[12]);
 1326|  10.1k|   z[23] = accum.extract();
 1327|  10.1k|   accum.mul_x2(x[1], x[23]);
 1328|  10.1k|   accum.mul_x2(x[2], x[22]);
 1329|  10.1k|   accum.mul_x2(x[3], x[21]);
 1330|  10.1k|   accum.mul_x2(x[4], x[20]);
 1331|  10.1k|   accum.mul_x2(x[5], x[19]);
 1332|  10.1k|   accum.mul_x2(x[6], x[18]);
 1333|  10.1k|   accum.mul_x2(x[7], x[17]);
 1334|  10.1k|   accum.mul_x2(x[8], x[16]);
 1335|  10.1k|   accum.mul_x2(x[9], x[15]);
 1336|  10.1k|   accum.mul_x2(x[10], x[14]);
 1337|  10.1k|   accum.mul_x2(x[11], x[13]);
 1338|  10.1k|   accum.mul(x[12], x[12]);
 1339|  10.1k|   z[24] = accum.extract();
 1340|  10.1k|   accum.mul_x2(x[2], x[23]);
 1341|  10.1k|   accum.mul_x2(x[3], x[22]);
 1342|  10.1k|   accum.mul_x2(x[4], x[21]);
 1343|  10.1k|   accum.mul_x2(x[5], x[20]);
 1344|  10.1k|   accum.mul_x2(x[6], x[19]);
 1345|  10.1k|   accum.mul_x2(x[7], x[18]);
 1346|  10.1k|   accum.mul_x2(x[8], x[17]);
 1347|  10.1k|   accum.mul_x2(x[9], x[16]);
 1348|  10.1k|   accum.mul_x2(x[10], x[15]);
 1349|  10.1k|   accum.mul_x2(x[11], x[14]);
 1350|  10.1k|   accum.mul_x2(x[12], x[13]);
 1351|  10.1k|   z[25] = accum.extract();
 1352|  10.1k|   accum.mul_x2(x[3], x[23]);
 1353|  10.1k|   accum.mul_x2(x[4], x[22]);
 1354|  10.1k|   accum.mul_x2(x[5], x[21]);
 1355|  10.1k|   accum.mul_x2(x[6], x[20]);
 1356|  10.1k|   accum.mul_x2(x[7], x[19]);
 1357|  10.1k|   accum.mul_x2(x[8], x[18]);
 1358|  10.1k|   accum.mul_x2(x[9], x[17]);
 1359|  10.1k|   accum.mul_x2(x[10], x[16]);
 1360|  10.1k|   accum.mul_x2(x[11], x[15]);
 1361|  10.1k|   accum.mul_x2(x[12], x[14]);
 1362|  10.1k|   accum.mul(x[13], x[13]);
 1363|  10.1k|   z[26] = accum.extract();
 1364|  10.1k|   accum.mul_x2(x[4], x[23]);
 1365|  10.1k|   accum.mul_x2(x[5], x[22]);
 1366|  10.1k|   accum.mul_x2(x[6], x[21]);
 1367|  10.1k|   accum.mul_x2(x[7], x[20]);
 1368|  10.1k|   accum.mul_x2(x[8], x[19]);
 1369|  10.1k|   accum.mul_x2(x[9], x[18]);
 1370|  10.1k|   accum.mul_x2(x[10], x[17]);
 1371|  10.1k|   accum.mul_x2(x[11], x[16]);
 1372|  10.1k|   accum.mul_x2(x[12], x[15]);
 1373|  10.1k|   accum.mul_x2(x[13], x[14]);
 1374|  10.1k|   z[27] = accum.extract();
 1375|  10.1k|   accum.mul_x2(x[5], x[23]);
 1376|  10.1k|   accum.mul_x2(x[6], x[22]);
 1377|  10.1k|   accum.mul_x2(x[7], x[21]);
 1378|  10.1k|   accum.mul_x2(x[8], x[20]);
 1379|  10.1k|   accum.mul_x2(x[9], x[19]);
 1380|  10.1k|   accum.mul_x2(x[10], x[18]);
 1381|  10.1k|   accum.mul_x2(x[11], x[17]);
 1382|  10.1k|   accum.mul_x2(x[12], x[16]);
 1383|  10.1k|   accum.mul_x2(x[13], x[15]);
 1384|  10.1k|   accum.mul(x[14], x[14]);
 1385|  10.1k|   z[28] = accum.extract();
 1386|  10.1k|   accum.mul_x2(x[6], x[23]);
 1387|  10.1k|   accum.mul_x2(x[7], x[22]);
 1388|  10.1k|   accum.mul_x2(x[8], x[21]);
 1389|  10.1k|   accum.mul_x2(x[9], x[20]);
 1390|  10.1k|   accum.mul_x2(x[10], x[19]);
 1391|  10.1k|   accum.mul_x2(x[11], x[18]);
 1392|  10.1k|   accum.mul_x2(x[12], x[17]);
 1393|  10.1k|   accum.mul_x2(x[13], x[16]);
 1394|  10.1k|   accum.mul_x2(x[14], x[15]);
 1395|  10.1k|   z[29] = accum.extract();
 1396|  10.1k|   accum.mul_x2(x[7], x[23]);
 1397|  10.1k|   accum.mul_x2(x[8], x[22]);
 1398|  10.1k|   accum.mul_x2(x[9], x[21]);
 1399|  10.1k|   accum.mul_x2(x[10], x[20]);
 1400|  10.1k|   accum.mul_x2(x[11], x[19]);
 1401|  10.1k|   accum.mul_x2(x[12], x[18]);
 1402|  10.1k|   accum.mul_x2(x[13], x[17]);
 1403|  10.1k|   accum.mul_x2(x[14], x[16]);
 1404|  10.1k|   accum.mul(x[15], x[15]);
 1405|  10.1k|   z[30] = accum.extract();
 1406|  10.1k|   accum.mul_x2(x[8], x[23]);
 1407|  10.1k|   accum.mul_x2(x[9], x[22]);
 1408|  10.1k|   accum.mul_x2(x[10], x[21]);
 1409|  10.1k|   accum.mul_x2(x[11], x[20]);
 1410|  10.1k|   accum.mul_x2(x[12], x[19]);
 1411|  10.1k|   accum.mul_x2(x[13], x[18]);
 1412|  10.1k|   accum.mul_x2(x[14], x[17]);
 1413|  10.1k|   accum.mul_x2(x[15], x[16]);
 1414|  10.1k|   z[31] = accum.extract();
 1415|  10.1k|   accum.mul_x2(x[9], x[23]);
 1416|  10.1k|   accum.mul_x2(x[10], x[22]);
 1417|  10.1k|   accum.mul_x2(x[11], x[21]);
 1418|  10.1k|   accum.mul_x2(x[12], x[20]);
 1419|  10.1k|   accum.mul_x2(x[13], x[19]);
 1420|  10.1k|   accum.mul_x2(x[14], x[18]);
 1421|  10.1k|   accum.mul_x2(x[15], x[17]);
 1422|  10.1k|   accum.mul(x[16], x[16]);
 1423|  10.1k|   z[32] = accum.extract();
 1424|  10.1k|   accum.mul_x2(x[10], x[23]);
 1425|  10.1k|   accum.mul_x2(x[11], x[22]);
 1426|  10.1k|   accum.mul_x2(x[12], x[21]);
 1427|  10.1k|   accum.mul_x2(x[13], x[20]);
 1428|  10.1k|   accum.mul_x2(x[14], x[19]);
 1429|  10.1k|   accum.mul_x2(x[15], x[18]);
 1430|  10.1k|   accum.mul_x2(x[16], x[17]);
 1431|  10.1k|   z[33] = accum.extract();
 1432|  10.1k|   accum.mul_x2(x[11], x[23]);
 1433|  10.1k|   accum.mul_x2(x[12], x[22]);
 1434|  10.1k|   accum.mul_x2(x[13], x[21]);
 1435|  10.1k|   accum.mul_x2(x[14], x[20]);
 1436|  10.1k|   accum.mul_x2(x[15], x[19]);
 1437|  10.1k|   accum.mul_x2(x[16], x[18]);
 1438|  10.1k|   accum.mul(x[17], x[17]);
 1439|  10.1k|   z[34] = accum.extract();
 1440|  10.1k|   accum.mul_x2(x[12], x[23]);
 1441|  10.1k|   accum.mul_x2(x[13], x[22]);
 1442|  10.1k|   accum.mul_x2(x[14], x[21]);
 1443|  10.1k|   accum.mul_x2(x[15], x[20]);
 1444|  10.1k|   accum.mul_x2(x[16], x[19]);
 1445|  10.1k|   accum.mul_x2(x[17], x[18]);
 1446|  10.1k|   z[35] = accum.extract();
 1447|  10.1k|   accum.mul_x2(x[13], x[23]);
 1448|  10.1k|   accum.mul_x2(x[14], x[22]);
 1449|  10.1k|   accum.mul_x2(x[15], x[21]);
 1450|  10.1k|   accum.mul_x2(x[16], x[20]);
 1451|  10.1k|   accum.mul_x2(x[17], x[19]);
 1452|  10.1k|   accum.mul(x[18], x[18]);
 1453|  10.1k|   z[36] = accum.extract();
 1454|  10.1k|   accum.mul_x2(x[14], x[23]);
 1455|  10.1k|   accum.mul_x2(x[15], x[22]);
 1456|  10.1k|   accum.mul_x2(x[16], x[21]);
 1457|  10.1k|   accum.mul_x2(x[17], x[20]);
 1458|  10.1k|   accum.mul_x2(x[18], x[19]);
 1459|  10.1k|   z[37] = accum.extract();
 1460|  10.1k|   accum.mul_x2(x[15], x[23]);
 1461|  10.1k|   accum.mul_x2(x[16], x[22]);
 1462|  10.1k|   accum.mul_x2(x[17], x[21]);
 1463|  10.1k|   accum.mul_x2(x[18], x[20]);
 1464|  10.1k|   accum.mul(x[19], x[19]);
 1465|  10.1k|   z[38] = accum.extract();
 1466|  10.1k|   accum.mul_x2(x[16], x[23]);
 1467|  10.1k|   accum.mul_x2(x[17], x[22]);
 1468|  10.1k|   accum.mul_x2(x[18], x[21]);
 1469|  10.1k|   accum.mul_x2(x[19], x[20]);
 1470|  10.1k|   z[39] = accum.extract();
 1471|  10.1k|   accum.mul_x2(x[17], x[23]);
 1472|  10.1k|   accum.mul_x2(x[18], x[22]);
 1473|  10.1k|   accum.mul_x2(x[19], x[21]);
 1474|  10.1k|   accum.mul(x[20], x[20]);
 1475|  10.1k|   z[40] = accum.extract();
 1476|  10.1k|   accum.mul_x2(x[18], x[23]);
 1477|  10.1k|   accum.mul_x2(x[19], x[22]);
 1478|  10.1k|   accum.mul_x2(x[20], x[21]);
 1479|  10.1k|   z[41] = accum.extract();
 1480|  10.1k|   accum.mul_x2(x[19], x[23]);
 1481|  10.1k|   accum.mul_x2(x[20], x[22]);
 1482|  10.1k|   accum.mul(x[21], x[21]);
 1483|  10.1k|   z[42] = accum.extract();
 1484|  10.1k|   accum.mul_x2(x[20], x[23]);
 1485|  10.1k|   accum.mul_x2(x[21], x[22]);
 1486|  10.1k|   z[43] = accum.extract();
 1487|  10.1k|   accum.mul_x2(x[21], x[23]);
 1488|  10.1k|   accum.mul(x[22], x[22]);
 1489|  10.1k|   z[44] = accum.extract();
 1490|  10.1k|   accum.mul_x2(x[22], x[23]);
 1491|  10.1k|   z[45] = accum.extract();
 1492|  10.1k|   accum.mul(x[23], x[23]);
 1493|  10.1k|   z[46] = accum.extract();
 1494|  10.1k|   z[47] = accum.extract();
 1495|  10.1k|}
_ZN5Botan18bigint_comba_mul24EPmPKmS2_:
 1500|   106k|void bigint_comba_mul24(word z[48], const word x[24], const word y[24]) {
 1501|   106k|   word3<word> accum;
 1502|       |
 1503|   106k|   accum.mul(x[0], y[0]);
 1504|   106k|   z[0] = accum.extract();
 1505|   106k|   accum.mul(x[0], y[1]);
 1506|   106k|   accum.mul(x[1], y[0]);
 1507|   106k|   z[1] = accum.extract();
 1508|   106k|   accum.mul(x[0], y[2]);
 1509|   106k|   accum.mul(x[1], y[1]);
 1510|   106k|   accum.mul(x[2], y[0]);
 1511|   106k|   z[2] = accum.extract();
 1512|   106k|   accum.mul(x[0], y[3]);
 1513|   106k|   accum.mul(x[1], y[2]);
 1514|   106k|   accum.mul(x[2], y[1]);
 1515|   106k|   accum.mul(x[3], y[0]);
 1516|   106k|   z[3] = accum.extract();
 1517|   106k|   accum.mul(x[0], y[4]);
 1518|   106k|   accum.mul(x[1], y[3]);
 1519|   106k|   accum.mul(x[2], y[2]);
 1520|   106k|   accum.mul(x[3], y[1]);
 1521|   106k|   accum.mul(x[4], y[0]);
 1522|   106k|   z[4] = accum.extract();
 1523|   106k|   accum.mul(x[0], y[5]);
 1524|   106k|   accum.mul(x[1], y[4]);
 1525|   106k|   accum.mul(x[2], y[3]);
 1526|   106k|   accum.mul(x[3], y[2]);
 1527|   106k|   accum.mul(x[4], y[1]);
 1528|   106k|   accum.mul(x[5], y[0]);
 1529|   106k|   z[5] = accum.extract();
 1530|   106k|   accum.mul(x[0], y[6]);
 1531|   106k|   accum.mul(x[1], y[5]);
 1532|   106k|   accum.mul(x[2], y[4]);
 1533|   106k|   accum.mul(x[3], y[3]);
 1534|   106k|   accum.mul(x[4], y[2]);
 1535|   106k|   accum.mul(x[5], y[1]);
 1536|   106k|   accum.mul(x[6], y[0]);
 1537|   106k|   z[6] = accum.extract();
 1538|   106k|   accum.mul(x[0], y[7]);
 1539|   106k|   accum.mul(x[1], y[6]);
 1540|   106k|   accum.mul(x[2], y[5]);
 1541|   106k|   accum.mul(x[3], y[4]);
 1542|   106k|   accum.mul(x[4], y[3]);
 1543|   106k|   accum.mul(x[5], y[2]);
 1544|   106k|   accum.mul(x[6], y[1]);
 1545|   106k|   accum.mul(x[7], y[0]);
 1546|   106k|   z[7] = accum.extract();
 1547|   106k|   accum.mul(x[0], y[8]);
 1548|   106k|   accum.mul(x[1], y[7]);
 1549|   106k|   accum.mul(x[2], y[6]);
 1550|   106k|   accum.mul(x[3], y[5]);
 1551|   106k|   accum.mul(x[4], y[4]);
 1552|   106k|   accum.mul(x[5], y[3]);
 1553|   106k|   accum.mul(x[6], y[2]);
 1554|   106k|   accum.mul(x[7], y[1]);
 1555|   106k|   accum.mul(x[8], y[0]);
 1556|   106k|   z[8] = accum.extract();
 1557|   106k|   accum.mul(x[0], y[9]);
 1558|   106k|   accum.mul(x[1], y[8]);
 1559|   106k|   accum.mul(x[2], y[7]);
 1560|   106k|   accum.mul(x[3], y[6]);
 1561|   106k|   accum.mul(x[4], y[5]);
 1562|   106k|   accum.mul(x[5], y[4]);
 1563|   106k|   accum.mul(x[6], y[3]);
 1564|   106k|   accum.mul(x[7], y[2]);
 1565|   106k|   accum.mul(x[8], y[1]);
 1566|   106k|   accum.mul(x[9], y[0]);
 1567|   106k|   z[9] = accum.extract();
 1568|   106k|   accum.mul(x[0], y[10]);
 1569|   106k|   accum.mul(x[1], y[9]);
 1570|   106k|   accum.mul(x[2], y[8]);
 1571|   106k|   accum.mul(x[3], y[7]);
 1572|   106k|   accum.mul(x[4], y[6]);
 1573|   106k|   accum.mul(x[5], y[5]);
 1574|   106k|   accum.mul(x[6], y[4]);
 1575|   106k|   accum.mul(x[7], y[3]);
 1576|   106k|   accum.mul(x[8], y[2]);
 1577|   106k|   accum.mul(x[9], y[1]);
 1578|   106k|   accum.mul(x[10], y[0]);
 1579|   106k|   z[10] = accum.extract();
 1580|   106k|   accum.mul(x[0], y[11]);
 1581|   106k|   accum.mul(x[1], y[10]);
 1582|   106k|   accum.mul(x[2], y[9]);
 1583|   106k|   accum.mul(x[3], y[8]);
 1584|   106k|   accum.mul(x[4], y[7]);
 1585|   106k|   accum.mul(x[5], y[6]);
 1586|   106k|   accum.mul(x[6], y[5]);
 1587|   106k|   accum.mul(x[7], y[4]);
 1588|   106k|   accum.mul(x[8], y[3]);
 1589|   106k|   accum.mul(x[9], y[2]);
 1590|   106k|   accum.mul(x[10], y[1]);
 1591|   106k|   accum.mul(x[11], y[0]);
 1592|   106k|   z[11] = accum.extract();
 1593|   106k|   accum.mul(x[0], y[12]);
 1594|   106k|   accum.mul(x[1], y[11]);
 1595|   106k|   accum.mul(x[2], y[10]);
 1596|   106k|   accum.mul(x[3], y[9]);
 1597|   106k|   accum.mul(x[4], y[8]);
 1598|   106k|   accum.mul(x[5], y[7]);
 1599|   106k|   accum.mul(x[6], y[6]);
 1600|   106k|   accum.mul(x[7], y[5]);
 1601|   106k|   accum.mul(x[8], y[4]);
 1602|   106k|   accum.mul(x[9], y[3]);
 1603|   106k|   accum.mul(x[10], y[2]);
 1604|   106k|   accum.mul(x[11], y[1]);
 1605|   106k|   accum.mul(x[12], y[0]);
 1606|   106k|   z[12] = accum.extract();
 1607|   106k|   accum.mul(x[0], y[13]);
 1608|   106k|   accum.mul(x[1], y[12]);
 1609|   106k|   accum.mul(x[2], y[11]);
 1610|   106k|   accum.mul(x[3], y[10]);
 1611|   106k|   accum.mul(x[4], y[9]);
 1612|   106k|   accum.mul(x[5], y[8]);
 1613|   106k|   accum.mul(x[6], y[7]);
 1614|   106k|   accum.mul(x[7], y[6]);
 1615|   106k|   accum.mul(x[8], y[5]);
 1616|   106k|   accum.mul(x[9], y[4]);
 1617|   106k|   accum.mul(x[10], y[3]);
 1618|   106k|   accum.mul(x[11], y[2]);
 1619|   106k|   accum.mul(x[12], y[1]);
 1620|   106k|   accum.mul(x[13], y[0]);
 1621|   106k|   z[13] = accum.extract();
 1622|   106k|   accum.mul(x[0], y[14]);
 1623|   106k|   accum.mul(x[1], y[13]);
 1624|   106k|   accum.mul(x[2], y[12]);
 1625|   106k|   accum.mul(x[3], y[11]);
 1626|   106k|   accum.mul(x[4], y[10]);
 1627|   106k|   accum.mul(x[5], y[9]);
 1628|   106k|   accum.mul(x[6], y[8]);
 1629|   106k|   accum.mul(x[7], y[7]);
 1630|   106k|   accum.mul(x[8], y[6]);
 1631|   106k|   accum.mul(x[9], y[5]);
 1632|   106k|   accum.mul(x[10], y[4]);
 1633|   106k|   accum.mul(x[11], y[3]);
 1634|   106k|   accum.mul(x[12], y[2]);
 1635|   106k|   accum.mul(x[13], y[1]);
 1636|   106k|   accum.mul(x[14], y[0]);
 1637|   106k|   z[14] = accum.extract();
 1638|   106k|   accum.mul(x[0], y[15]);
 1639|   106k|   accum.mul(x[1], y[14]);
 1640|   106k|   accum.mul(x[2], y[13]);
 1641|   106k|   accum.mul(x[3], y[12]);
 1642|   106k|   accum.mul(x[4], y[11]);
 1643|   106k|   accum.mul(x[5], y[10]);
 1644|   106k|   accum.mul(x[6], y[9]);
 1645|   106k|   accum.mul(x[7], y[8]);
 1646|   106k|   accum.mul(x[8], y[7]);
 1647|   106k|   accum.mul(x[9], y[6]);
 1648|   106k|   accum.mul(x[10], y[5]);
 1649|   106k|   accum.mul(x[11], y[4]);
 1650|   106k|   accum.mul(x[12], y[3]);
 1651|   106k|   accum.mul(x[13], y[2]);
 1652|   106k|   accum.mul(x[14], y[1]);
 1653|   106k|   accum.mul(x[15], y[0]);
 1654|   106k|   z[15] = accum.extract();
 1655|   106k|   accum.mul(x[0], y[16]);
 1656|   106k|   accum.mul(x[1], y[15]);
 1657|   106k|   accum.mul(x[2], y[14]);
 1658|   106k|   accum.mul(x[3], y[13]);
 1659|   106k|   accum.mul(x[4], y[12]);
 1660|   106k|   accum.mul(x[5], y[11]);
 1661|   106k|   accum.mul(x[6], y[10]);
 1662|   106k|   accum.mul(x[7], y[9]);
 1663|   106k|   accum.mul(x[8], y[8]);
 1664|   106k|   accum.mul(x[9], y[7]);
 1665|   106k|   accum.mul(x[10], y[6]);
 1666|   106k|   accum.mul(x[11], y[5]);
 1667|   106k|   accum.mul(x[12], y[4]);
 1668|   106k|   accum.mul(x[13], y[3]);
 1669|   106k|   accum.mul(x[14], y[2]);
 1670|   106k|   accum.mul(x[15], y[1]);
 1671|   106k|   accum.mul(x[16], y[0]);
 1672|   106k|   z[16] = accum.extract();
 1673|   106k|   accum.mul(x[0], y[17]);
 1674|   106k|   accum.mul(x[1], y[16]);
 1675|   106k|   accum.mul(x[2], y[15]);
 1676|   106k|   accum.mul(x[3], y[14]);
 1677|   106k|   accum.mul(x[4], y[13]);
 1678|   106k|   accum.mul(x[5], y[12]);
 1679|   106k|   accum.mul(x[6], y[11]);
 1680|   106k|   accum.mul(x[7], y[10]);
 1681|   106k|   accum.mul(x[8], y[9]);
 1682|   106k|   accum.mul(x[9], y[8]);
 1683|   106k|   accum.mul(x[10], y[7]);
 1684|   106k|   accum.mul(x[11], y[6]);
 1685|   106k|   accum.mul(x[12], y[5]);
 1686|   106k|   accum.mul(x[13], y[4]);
 1687|   106k|   accum.mul(x[14], y[3]);
 1688|   106k|   accum.mul(x[15], y[2]);
 1689|   106k|   accum.mul(x[16], y[1]);
 1690|   106k|   accum.mul(x[17], y[0]);
 1691|   106k|   z[17] = accum.extract();
 1692|   106k|   accum.mul(x[0], y[18]);
 1693|   106k|   accum.mul(x[1], y[17]);
 1694|   106k|   accum.mul(x[2], y[16]);
 1695|   106k|   accum.mul(x[3], y[15]);
 1696|   106k|   accum.mul(x[4], y[14]);
 1697|   106k|   accum.mul(x[5], y[13]);
 1698|   106k|   accum.mul(x[6], y[12]);
 1699|   106k|   accum.mul(x[7], y[11]);
 1700|   106k|   accum.mul(x[8], y[10]);
 1701|   106k|   accum.mul(x[9], y[9]);
 1702|   106k|   accum.mul(x[10], y[8]);
 1703|   106k|   accum.mul(x[11], y[7]);
 1704|   106k|   accum.mul(x[12], y[6]);
 1705|   106k|   accum.mul(x[13], y[5]);
 1706|   106k|   accum.mul(x[14], y[4]);
 1707|   106k|   accum.mul(x[15], y[3]);
 1708|   106k|   accum.mul(x[16], y[2]);
 1709|   106k|   accum.mul(x[17], y[1]);
 1710|   106k|   accum.mul(x[18], y[0]);
 1711|   106k|   z[18] = accum.extract();
 1712|   106k|   accum.mul(x[0], y[19]);
 1713|   106k|   accum.mul(x[1], y[18]);
 1714|   106k|   accum.mul(x[2], y[17]);
 1715|   106k|   accum.mul(x[3], y[16]);
 1716|   106k|   accum.mul(x[4], y[15]);
 1717|   106k|   accum.mul(x[5], y[14]);
 1718|   106k|   accum.mul(x[6], y[13]);
 1719|   106k|   accum.mul(x[7], y[12]);
 1720|   106k|   accum.mul(x[8], y[11]);
 1721|   106k|   accum.mul(x[9], y[10]);
 1722|   106k|   accum.mul(x[10], y[9]);
 1723|   106k|   accum.mul(x[11], y[8]);
 1724|   106k|   accum.mul(x[12], y[7]);
 1725|   106k|   accum.mul(x[13], y[6]);
 1726|   106k|   accum.mul(x[14], y[5]);
 1727|   106k|   accum.mul(x[15], y[4]);
 1728|   106k|   accum.mul(x[16], y[3]);
 1729|   106k|   accum.mul(x[17], y[2]);
 1730|   106k|   accum.mul(x[18], y[1]);
 1731|   106k|   accum.mul(x[19], y[0]);
 1732|   106k|   z[19] = accum.extract();
 1733|   106k|   accum.mul(x[0], y[20]);
 1734|   106k|   accum.mul(x[1], y[19]);
 1735|   106k|   accum.mul(x[2], y[18]);
 1736|   106k|   accum.mul(x[3], y[17]);
 1737|   106k|   accum.mul(x[4], y[16]);
 1738|   106k|   accum.mul(x[5], y[15]);
 1739|   106k|   accum.mul(x[6], y[14]);
 1740|   106k|   accum.mul(x[7], y[13]);
 1741|   106k|   accum.mul(x[8], y[12]);
 1742|   106k|   accum.mul(x[9], y[11]);
 1743|   106k|   accum.mul(x[10], y[10]);
 1744|   106k|   accum.mul(x[11], y[9]);
 1745|   106k|   accum.mul(x[12], y[8]);
 1746|   106k|   accum.mul(x[13], y[7]);
 1747|   106k|   accum.mul(x[14], y[6]);
 1748|   106k|   accum.mul(x[15], y[5]);
 1749|   106k|   accum.mul(x[16], y[4]);
 1750|   106k|   accum.mul(x[17], y[3]);
 1751|   106k|   accum.mul(x[18], y[2]);
 1752|   106k|   accum.mul(x[19], y[1]);
 1753|   106k|   accum.mul(x[20], y[0]);
 1754|   106k|   z[20] = accum.extract();
 1755|   106k|   accum.mul(x[0], y[21]);
 1756|   106k|   accum.mul(x[1], y[20]);
 1757|   106k|   accum.mul(x[2], y[19]);
 1758|   106k|   accum.mul(x[3], y[18]);
 1759|   106k|   accum.mul(x[4], y[17]);
 1760|   106k|   accum.mul(x[5], y[16]);
 1761|   106k|   accum.mul(x[6], y[15]);
 1762|   106k|   accum.mul(x[7], y[14]);
 1763|   106k|   accum.mul(x[8], y[13]);
 1764|   106k|   accum.mul(x[9], y[12]);
 1765|   106k|   accum.mul(x[10], y[11]);
 1766|   106k|   accum.mul(x[11], y[10]);
 1767|   106k|   accum.mul(x[12], y[9]);
 1768|   106k|   accum.mul(x[13], y[8]);
 1769|   106k|   accum.mul(x[14], y[7]);
 1770|   106k|   accum.mul(x[15], y[6]);
 1771|   106k|   accum.mul(x[16], y[5]);
 1772|   106k|   accum.mul(x[17], y[4]);
 1773|   106k|   accum.mul(x[18], y[3]);
 1774|   106k|   accum.mul(x[19], y[2]);
 1775|   106k|   accum.mul(x[20], y[1]);
 1776|   106k|   accum.mul(x[21], y[0]);
 1777|   106k|   z[21] = accum.extract();
 1778|   106k|   accum.mul(x[0], y[22]);
 1779|   106k|   accum.mul(x[1], y[21]);
 1780|   106k|   accum.mul(x[2], y[20]);
 1781|   106k|   accum.mul(x[3], y[19]);
 1782|   106k|   accum.mul(x[4], y[18]);
 1783|   106k|   accum.mul(x[5], y[17]);
 1784|   106k|   accum.mul(x[6], y[16]);
 1785|   106k|   accum.mul(x[7], y[15]);
 1786|   106k|   accum.mul(x[8], y[14]);
 1787|   106k|   accum.mul(x[9], y[13]);
 1788|   106k|   accum.mul(x[10], y[12]);
 1789|   106k|   accum.mul(x[11], y[11]);
 1790|   106k|   accum.mul(x[12], y[10]);
 1791|   106k|   accum.mul(x[13], y[9]);
 1792|   106k|   accum.mul(x[14], y[8]);
 1793|   106k|   accum.mul(x[15], y[7]);
 1794|   106k|   accum.mul(x[16], y[6]);
 1795|   106k|   accum.mul(x[17], y[5]);
 1796|   106k|   accum.mul(x[18], y[4]);
 1797|   106k|   accum.mul(x[19], y[3]);
 1798|   106k|   accum.mul(x[20], y[2]);
 1799|   106k|   accum.mul(x[21], y[1]);
 1800|   106k|   accum.mul(x[22], y[0]);
 1801|   106k|   z[22] = accum.extract();
 1802|   106k|   accum.mul(x[0], y[23]);
 1803|   106k|   accum.mul(x[1], y[22]);
 1804|   106k|   accum.mul(x[2], y[21]);
 1805|   106k|   accum.mul(x[3], y[20]);
 1806|   106k|   accum.mul(x[4], y[19]);
 1807|   106k|   accum.mul(x[5], y[18]);
 1808|   106k|   accum.mul(x[6], y[17]);
 1809|   106k|   accum.mul(x[7], y[16]);
 1810|   106k|   accum.mul(x[8], y[15]);
 1811|   106k|   accum.mul(x[9], y[14]);
 1812|   106k|   accum.mul(x[10], y[13]);
 1813|   106k|   accum.mul(x[11], y[12]);
 1814|   106k|   accum.mul(x[12], y[11]);
 1815|   106k|   accum.mul(x[13], y[10]);
 1816|   106k|   accum.mul(x[14], y[9]);
 1817|   106k|   accum.mul(x[15], y[8]);
 1818|   106k|   accum.mul(x[16], y[7]);
 1819|   106k|   accum.mul(x[17], y[6]);
 1820|   106k|   accum.mul(x[18], y[5]);
 1821|   106k|   accum.mul(x[19], y[4]);
 1822|   106k|   accum.mul(x[20], y[3]);
 1823|   106k|   accum.mul(x[21], y[2]);
 1824|   106k|   accum.mul(x[22], y[1]);
 1825|   106k|   accum.mul(x[23], y[0]);
 1826|   106k|   z[23] = accum.extract();
 1827|   106k|   accum.mul(x[1], y[23]);
 1828|   106k|   accum.mul(x[2], y[22]);
 1829|   106k|   accum.mul(x[3], y[21]);
 1830|   106k|   accum.mul(x[4], y[20]);
 1831|   106k|   accum.mul(x[5], y[19]);
 1832|   106k|   accum.mul(x[6], y[18]);
 1833|   106k|   accum.mul(x[7], y[17]);
 1834|   106k|   accum.mul(x[8], y[16]);
 1835|   106k|   accum.mul(x[9], y[15]);
 1836|   106k|   accum.mul(x[10], y[14]);
 1837|   106k|   accum.mul(x[11], y[13]);
 1838|   106k|   accum.mul(x[12], y[12]);
 1839|   106k|   accum.mul(x[13], y[11]);
 1840|   106k|   accum.mul(x[14], y[10]);
 1841|   106k|   accum.mul(x[15], y[9]);
 1842|   106k|   accum.mul(x[16], y[8]);
 1843|   106k|   accum.mul(x[17], y[7]);
 1844|   106k|   accum.mul(x[18], y[6]);
 1845|   106k|   accum.mul(x[19], y[5]);
 1846|   106k|   accum.mul(x[20], y[4]);
 1847|   106k|   accum.mul(x[21], y[3]);
 1848|   106k|   accum.mul(x[22], y[2]);
 1849|   106k|   accum.mul(x[23], y[1]);
 1850|   106k|   z[24] = accum.extract();
 1851|   106k|   accum.mul(x[2], y[23]);
 1852|   106k|   accum.mul(x[3], y[22]);
 1853|   106k|   accum.mul(x[4], y[21]);
 1854|   106k|   accum.mul(x[5], y[20]);
 1855|   106k|   accum.mul(x[6], y[19]);
 1856|   106k|   accum.mul(x[7], y[18]);
 1857|   106k|   accum.mul(x[8], y[17]);
 1858|   106k|   accum.mul(x[9], y[16]);
 1859|   106k|   accum.mul(x[10], y[15]);
 1860|   106k|   accum.mul(x[11], y[14]);
 1861|   106k|   accum.mul(x[12], y[13]);
 1862|   106k|   accum.mul(x[13], y[12]);
 1863|   106k|   accum.mul(x[14], y[11]);
 1864|   106k|   accum.mul(x[15], y[10]);
 1865|   106k|   accum.mul(x[16], y[9]);
 1866|   106k|   accum.mul(x[17], y[8]);
 1867|   106k|   accum.mul(x[18], y[7]);
 1868|   106k|   accum.mul(x[19], y[6]);
 1869|   106k|   accum.mul(x[20], y[5]);
 1870|   106k|   accum.mul(x[21], y[4]);
 1871|   106k|   accum.mul(x[22], y[3]);
 1872|   106k|   accum.mul(x[23], y[2]);
 1873|   106k|   z[25] = accum.extract();
 1874|   106k|   accum.mul(x[3], y[23]);
 1875|   106k|   accum.mul(x[4], y[22]);
 1876|   106k|   accum.mul(x[5], y[21]);
 1877|   106k|   accum.mul(x[6], y[20]);
 1878|   106k|   accum.mul(x[7], y[19]);
 1879|   106k|   accum.mul(x[8], y[18]);
 1880|   106k|   accum.mul(x[9], y[17]);
 1881|   106k|   accum.mul(x[10], y[16]);
 1882|   106k|   accum.mul(x[11], y[15]);
 1883|   106k|   accum.mul(x[12], y[14]);
 1884|   106k|   accum.mul(x[13], y[13]);
 1885|   106k|   accum.mul(x[14], y[12]);
 1886|   106k|   accum.mul(x[15], y[11]);
 1887|   106k|   accum.mul(x[16], y[10]);
 1888|   106k|   accum.mul(x[17], y[9]);
 1889|   106k|   accum.mul(x[18], y[8]);
 1890|   106k|   accum.mul(x[19], y[7]);
 1891|   106k|   accum.mul(x[20], y[6]);
 1892|   106k|   accum.mul(x[21], y[5]);
 1893|   106k|   accum.mul(x[22], y[4]);
 1894|   106k|   accum.mul(x[23], y[3]);
 1895|   106k|   z[26] = accum.extract();
 1896|   106k|   accum.mul(x[4], y[23]);
 1897|   106k|   accum.mul(x[5], y[22]);
 1898|   106k|   accum.mul(x[6], y[21]);
 1899|   106k|   accum.mul(x[7], y[20]);
 1900|   106k|   accum.mul(x[8], y[19]);
 1901|   106k|   accum.mul(x[9], y[18]);
 1902|   106k|   accum.mul(x[10], y[17]);
 1903|   106k|   accum.mul(x[11], y[16]);
 1904|   106k|   accum.mul(x[12], y[15]);
 1905|   106k|   accum.mul(x[13], y[14]);
 1906|   106k|   accum.mul(x[14], y[13]);
 1907|   106k|   accum.mul(x[15], y[12]);
 1908|   106k|   accum.mul(x[16], y[11]);
 1909|   106k|   accum.mul(x[17], y[10]);
 1910|   106k|   accum.mul(x[18], y[9]);
 1911|   106k|   accum.mul(x[19], y[8]);
 1912|   106k|   accum.mul(x[20], y[7]);
 1913|   106k|   accum.mul(x[21], y[6]);
 1914|   106k|   accum.mul(x[22], y[5]);
 1915|   106k|   accum.mul(x[23], y[4]);
 1916|   106k|   z[27] = accum.extract();
 1917|   106k|   accum.mul(x[5], y[23]);
 1918|   106k|   accum.mul(x[6], y[22]);
 1919|   106k|   accum.mul(x[7], y[21]);
 1920|   106k|   accum.mul(x[8], y[20]);
 1921|   106k|   accum.mul(x[9], y[19]);
 1922|   106k|   accum.mul(x[10], y[18]);
 1923|   106k|   accum.mul(x[11], y[17]);
 1924|   106k|   accum.mul(x[12], y[16]);
 1925|   106k|   accum.mul(x[13], y[15]);
 1926|   106k|   accum.mul(x[14], y[14]);
 1927|   106k|   accum.mul(x[15], y[13]);
 1928|   106k|   accum.mul(x[16], y[12]);
 1929|   106k|   accum.mul(x[17], y[11]);
 1930|   106k|   accum.mul(x[18], y[10]);
 1931|   106k|   accum.mul(x[19], y[9]);
 1932|   106k|   accum.mul(x[20], y[8]);
 1933|   106k|   accum.mul(x[21], y[7]);
 1934|   106k|   accum.mul(x[22], y[6]);
 1935|   106k|   accum.mul(x[23], y[5]);
 1936|   106k|   z[28] = accum.extract();
 1937|   106k|   accum.mul(x[6], y[23]);
 1938|   106k|   accum.mul(x[7], y[22]);
 1939|   106k|   accum.mul(x[8], y[21]);
 1940|   106k|   accum.mul(x[9], y[20]);
 1941|   106k|   accum.mul(x[10], y[19]);
 1942|   106k|   accum.mul(x[11], y[18]);
 1943|   106k|   accum.mul(x[12], y[17]);
 1944|   106k|   accum.mul(x[13], y[16]);
 1945|   106k|   accum.mul(x[14], y[15]);
 1946|   106k|   accum.mul(x[15], y[14]);
 1947|   106k|   accum.mul(x[16], y[13]);
 1948|   106k|   accum.mul(x[17], y[12]);
 1949|   106k|   accum.mul(x[18], y[11]);
 1950|   106k|   accum.mul(x[19], y[10]);
 1951|   106k|   accum.mul(x[20], y[9]);
 1952|   106k|   accum.mul(x[21], y[8]);
 1953|   106k|   accum.mul(x[22], y[7]);
 1954|   106k|   accum.mul(x[23], y[6]);
 1955|   106k|   z[29] = accum.extract();
 1956|   106k|   accum.mul(x[7], y[23]);
 1957|   106k|   accum.mul(x[8], y[22]);
 1958|   106k|   accum.mul(x[9], y[21]);
 1959|   106k|   accum.mul(x[10], y[20]);
 1960|   106k|   accum.mul(x[11], y[19]);
 1961|   106k|   accum.mul(x[12], y[18]);
 1962|   106k|   accum.mul(x[13], y[17]);
 1963|   106k|   accum.mul(x[14], y[16]);
 1964|   106k|   accum.mul(x[15], y[15]);
 1965|   106k|   accum.mul(x[16], y[14]);
 1966|   106k|   accum.mul(x[17], y[13]);
 1967|   106k|   accum.mul(x[18], y[12]);
 1968|   106k|   accum.mul(x[19], y[11]);
 1969|   106k|   accum.mul(x[20], y[10]);
 1970|   106k|   accum.mul(x[21], y[9]);
 1971|   106k|   accum.mul(x[22], y[8]);
 1972|   106k|   accum.mul(x[23], y[7]);
 1973|   106k|   z[30] = accum.extract();
 1974|   106k|   accum.mul(x[8], y[23]);
 1975|   106k|   accum.mul(x[9], y[22]);
 1976|   106k|   accum.mul(x[10], y[21]);
 1977|   106k|   accum.mul(x[11], y[20]);
 1978|   106k|   accum.mul(x[12], y[19]);
 1979|   106k|   accum.mul(x[13], y[18]);
 1980|   106k|   accum.mul(x[14], y[17]);
 1981|   106k|   accum.mul(x[15], y[16]);
 1982|   106k|   accum.mul(x[16], y[15]);
 1983|   106k|   accum.mul(x[17], y[14]);
 1984|   106k|   accum.mul(x[18], y[13]);
 1985|   106k|   accum.mul(x[19], y[12]);
 1986|   106k|   accum.mul(x[20], y[11]);
 1987|   106k|   accum.mul(x[21], y[10]);
 1988|   106k|   accum.mul(x[22], y[9]);
 1989|   106k|   accum.mul(x[23], y[8]);
 1990|   106k|   z[31] = accum.extract();
 1991|   106k|   accum.mul(x[9], y[23]);
 1992|   106k|   accum.mul(x[10], y[22]);
 1993|   106k|   accum.mul(x[11], y[21]);
 1994|   106k|   accum.mul(x[12], y[20]);
 1995|   106k|   accum.mul(x[13], y[19]);
 1996|   106k|   accum.mul(x[14], y[18]);
 1997|   106k|   accum.mul(x[15], y[17]);
 1998|   106k|   accum.mul(x[16], y[16]);
 1999|   106k|   accum.mul(x[17], y[15]);
 2000|   106k|   accum.mul(x[18], y[14]);
 2001|   106k|   accum.mul(x[19], y[13]);
 2002|   106k|   accum.mul(x[20], y[12]);
 2003|   106k|   accum.mul(x[21], y[11]);
 2004|   106k|   accum.mul(x[22], y[10]);
 2005|   106k|   accum.mul(x[23], y[9]);
 2006|   106k|   z[32] = accum.extract();
 2007|   106k|   accum.mul(x[10], y[23]);
 2008|   106k|   accum.mul(x[11], y[22]);
 2009|   106k|   accum.mul(x[12], y[21]);
 2010|   106k|   accum.mul(x[13], y[20]);
 2011|   106k|   accum.mul(x[14], y[19]);
 2012|   106k|   accum.mul(x[15], y[18]);
 2013|   106k|   accum.mul(x[16], y[17]);
 2014|   106k|   accum.mul(x[17], y[16]);
 2015|   106k|   accum.mul(x[18], y[15]);
 2016|   106k|   accum.mul(x[19], y[14]);
 2017|   106k|   accum.mul(x[20], y[13]);
 2018|   106k|   accum.mul(x[21], y[12]);
 2019|   106k|   accum.mul(x[22], y[11]);
 2020|   106k|   accum.mul(x[23], y[10]);
 2021|   106k|   z[33] = accum.extract();
 2022|   106k|   accum.mul(x[11], y[23]);
 2023|   106k|   accum.mul(x[12], y[22]);
 2024|   106k|   accum.mul(x[13], y[21]);
 2025|   106k|   accum.mul(x[14], y[20]);
 2026|   106k|   accum.mul(x[15], y[19]);
 2027|   106k|   accum.mul(x[16], y[18]);
 2028|   106k|   accum.mul(x[17], y[17]);
 2029|   106k|   accum.mul(x[18], y[16]);
 2030|   106k|   accum.mul(x[19], y[15]);
 2031|   106k|   accum.mul(x[20], y[14]);
 2032|   106k|   accum.mul(x[21], y[13]);
 2033|   106k|   accum.mul(x[22], y[12]);
 2034|   106k|   accum.mul(x[23], y[11]);
 2035|   106k|   z[34] = accum.extract();
 2036|   106k|   accum.mul(x[12], y[23]);
 2037|   106k|   accum.mul(x[13], y[22]);
 2038|   106k|   accum.mul(x[14], y[21]);
 2039|   106k|   accum.mul(x[15], y[20]);
 2040|   106k|   accum.mul(x[16], y[19]);
 2041|   106k|   accum.mul(x[17], y[18]);
 2042|   106k|   accum.mul(x[18], y[17]);
 2043|   106k|   accum.mul(x[19], y[16]);
 2044|   106k|   accum.mul(x[20], y[15]);
 2045|   106k|   accum.mul(x[21], y[14]);
 2046|   106k|   accum.mul(x[22], y[13]);
 2047|   106k|   accum.mul(x[23], y[12]);
 2048|   106k|   z[35] = accum.extract();
 2049|   106k|   accum.mul(x[13], y[23]);
 2050|   106k|   accum.mul(x[14], y[22]);
 2051|   106k|   accum.mul(x[15], y[21]);
 2052|   106k|   accum.mul(x[16], y[20]);
 2053|   106k|   accum.mul(x[17], y[19]);
 2054|   106k|   accum.mul(x[18], y[18]);
 2055|   106k|   accum.mul(x[19], y[17]);
 2056|   106k|   accum.mul(x[20], y[16]);
 2057|   106k|   accum.mul(x[21], y[15]);
 2058|   106k|   accum.mul(x[22], y[14]);
 2059|   106k|   accum.mul(x[23], y[13]);
 2060|   106k|   z[36] = accum.extract();
 2061|   106k|   accum.mul(x[14], y[23]);
 2062|   106k|   accum.mul(x[15], y[22]);
 2063|   106k|   accum.mul(x[16], y[21]);
 2064|   106k|   accum.mul(x[17], y[20]);
 2065|   106k|   accum.mul(x[18], y[19]);
 2066|   106k|   accum.mul(x[19], y[18]);
 2067|   106k|   accum.mul(x[20], y[17]);
 2068|   106k|   accum.mul(x[21], y[16]);
 2069|   106k|   accum.mul(x[22], y[15]);
 2070|   106k|   accum.mul(x[23], y[14]);
 2071|   106k|   z[37] = accum.extract();
 2072|   106k|   accum.mul(x[15], y[23]);
 2073|   106k|   accum.mul(x[16], y[22]);
 2074|   106k|   accum.mul(x[17], y[21]);
 2075|   106k|   accum.mul(x[18], y[20]);
 2076|   106k|   accum.mul(x[19], y[19]);
 2077|   106k|   accum.mul(x[20], y[18]);
 2078|   106k|   accum.mul(x[21], y[17]);
 2079|   106k|   accum.mul(x[22], y[16]);
 2080|   106k|   accum.mul(x[23], y[15]);
 2081|   106k|   z[38] = accum.extract();
 2082|   106k|   accum.mul(x[16], y[23]);
 2083|   106k|   accum.mul(x[17], y[22]);
 2084|   106k|   accum.mul(x[18], y[21]);
 2085|   106k|   accum.mul(x[19], y[20]);
 2086|   106k|   accum.mul(x[20], y[19]);
 2087|   106k|   accum.mul(x[21], y[18]);
 2088|   106k|   accum.mul(x[22], y[17]);
 2089|   106k|   accum.mul(x[23], y[16]);
 2090|   106k|   z[39] = accum.extract();
 2091|   106k|   accum.mul(x[17], y[23]);
 2092|   106k|   accum.mul(x[18], y[22]);
 2093|   106k|   accum.mul(x[19], y[21]);
 2094|   106k|   accum.mul(x[20], y[20]);
 2095|   106k|   accum.mul(x[21], y[19]);
 2096|   106k|   accum.mul(x[22], y[18]);
 2097|   106k|   accum.mul(x[23], y[17]);
 2098|   106k|   z[40] = accum.extract();
 2099|   106k|   accum.mul(x[18], y[23]);
 2100|   106k|   accum.mul(x[19], y[22]);
 2101|   106k|   accum.mul(x[20], y[21]);
 2102|   106k|   accum.mul(x[21], y[20]);
 2103|   106k|   accum.mul(x[22], y[19]);
 2104|   106k|   accum.mul(x[23], y[18]);
 2105|   106k|   z[41] = accum.extract();
 2106|   106k|   accum.mul(x[19], y[23]);
 2107|   106k|   accum.mul(x[20], y[22]);
 2108|   106k|   accum.mul(x[21], y[21]);
 2109|   106k|   accum.mul(x[22], y[20]);
 2110|   106k|   accum.mul(x[23], y[19]);
 2111|   106k|   z[42] = accum.extract();
 2112|   106k|   accum.mul(x[20], y[23]);
 2113|   106k|   accum.mul(x[21], y[22]);
 2114|   106k|   accum.mul(x[22], y[21]);
 2115|   106k|   accum.mul(x[23], y[20]);
 2116|   106k|   z[43] = accum.extract();
 2117|   106k|   accum.mul(x[21], y[23]);
 2118|   106k|   accum.mul(x[22], y[22]);
 2119|   106k|   accum.mul(x[23], y[21]);
 2120|   106k|   z[44] = accum.extract();
 2121|   106k|   accum.mul(x[22], y[23]);
 2122|   106k|   accum.mul(x[23], y[22]);
 2123|   106k|   z[45] = accum.extract();
 2124|   106k|   accum.mul(x[23], y[23]);
 2125|   106k|   z[46] = accum.extract();
 2126|   106k|   z[47] = accum.extract();
 2127|   106k|}

_ZN5Botan12basecase_mulEPmmPKmmS2_m:
   20|  1.66M|void basecase_mul(word z[], size_t z_size, const word x[], size_t x_size, const word y[], size_t y_size) {
   21|  1.66M|   if(z_size < x_size + y_size) {
  ------------------
  |  Branch (21:7): [True: 0, False: 1.66M]
  ------------------
   22|      0|      throw Invalid_Argument("basecase_mul z_size too small");
   23|      0|   }
   24|       |
   25|  1.66M|   const size_t x_size_8 = x_size - (x_size % 8);
   26|       |
   27|  1.66M|   zeroize_buffer(z, z_size);
   28|       |
   29|  31.8M|   for(size_t i = 0; i != y_size; ++i) {
  ------------------
  |  Branch (29:22): [True: 30.2M, False: 1.66M]
  ------------------
   30|  30.2M|      const word y_i = y[i];
   31|       |
   32|  30.2M|      word carry = 0;
   33|       |
   34|   103M|      for(size_t j = 0; j != x_size_8; j += 8) {
  ------------------
  |  Branch (34:25): [True: 73.7M, False: 30.2M]
  ------------------
   35|  73.7M|         carry = word8_madd3(z + i + j, x + j, y_i, carry);
   36|  73.7M|      }
   37|       |
   38|  90.5M|      for(size_t j = x_size_8; j != x_size; ++j) {
  ------------------
  |  Branch (38:32): [True: 60.3M, False: 30.2M]
  ------------------
   39|  60.3M|         z[i + j] = word_madd3(x[j], y_i, z[i + j], &carry);
   40|  60.3M|      }
   41|       |
   42|  30.2M|      z[x_size + i] = carry;
   43|  30.2M|   }
   44|  1.66M|}
_ZN5Botan12basecase_sqrEPmmPKmm:
   46|   347k|void basecase_sqr(word z[], size_t z_size, const word x[], size_t x_size) {
   47|   347k|   if(z_size < 2 * x_size) {
  ------------------
  |  Branch (47:7): [True: 0, False: 347k]
  ------------------
   48|      0|      throw Invalid_Argument("basecase_sqr z_size too small");
   49|      0|   }
   50|       |
   51|   347k|   const size_t x_size_8 = x_size - (x_size % 8);
   52|       |
   53|   347k|   zeroize_buffer(z, z_size);
   54|       |
   55|  7.07M|   for(size_t i = 0; i != x_size; ++i) {
  ------------------
  |  Branch (55:22): [True: 6.73M, False: 347k]
  ------------------
   56|  6.73M|      const word x_i = x[i];
   57|       |
   58|  6.73M|      word carry = 0;
   59|       |
   60|  22.5M|      for(size_t j = 0; j != x_size_8; j += 8) {
  ------------------
  |  Branch (60:25): [True: 15.7M, False: 6.73M]
  ------------------
   61|  15.7M|         carry = word8_madd3(z + i + j, x + j, x_i, carry);
   62|  15.7M|      }
   63|       |
   64|  43.1M|      for(size_t j = x_size_8; j != x_size; ++j) {
  ------------------
  |  Branch (64:32): [True: 36.3M, False: 6.73M]
  ------------------
   65|  36.3M|         z[i + j] = word_madd3(x[j], x_i, z[i + j], &carry);
   66|  36.3M|      }
   67|       |
   68|  6.73M|      z[x_size + i] = carry;
   69|  6.73M|   }
   70|   347k|}
_ZN5Botan10bigint_mulEPmmPKmmmS2_mmS0_m:
  292|  2.02M|                size_t ws_size) {
  293|  2.02M|   zeroize_buffer(z, z_size);
  294|       |
  295|  2.02M|   if(x_sw == 1) {
  ------------------
  |  Branch (295:7): [True: 14.7k, False: 2.01M]
  ------------------
  296|  14.7k|      bigint_linmul3(z, y, y_sw, x[0]);
  297|  2.01M|   } else if(y_sw == 1) {
  ------------------
  |  Branch (297:14): [True: 27.4k, False: 1.98M]
  ------------------
  298|  27.4k|      bigint_linmul3(z, x, x_sw, y[0]);
  299|  1.98M|   } else if(sized_for_comba_mul<4>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (299:14): [True: 66.9k, False: 1.91M]
  ------------------
  300|  66.9k|      bigint_comba_mul4(z, x, y);
  301|  1.91M|   } else if(sized_for_comba_mul<6>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (301:14): [True: 40.5k, False: 1.87M]
  ------------------
  302|  40.5k|      bigint_comba_mul6(z, x, y);
  303|  1.87M|   } else if(sized_for_comba_mul<8>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (303:14): [True: 61.1k, False: 1.81M]
  ------------------
  304|  61.1k|      bigint_comba_mul8(z, x, y);
  305|  1.81M|   } else if(sized_for_comba_mul<9>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (305:14): [True: 107k, False: 1.70M]
  ------------------
  306|   107k|      bigint_comba_mul9(z, x, y);
  307|  1.70M|   } else if(sized_for_comba_mul<16>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (307:14): [True: 137k, False: 1.57M]
  ------------------
  308|   137k|      bigint_comba_mul16(z, x, y);
  309|  1.57M|   } else if(sized_for_comba_mul<24>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (309:14): [True: 106k, False: 1.46M]
  ------------------
  310|   106k|      bigint_comba_mul24(z, x, y);
  311|  1.46M|   } else if(x_sw < KARATSUBA_MULTIPLY_THRESHOLD || y_sw < KARATSUBA_MULTIPLY_THRESHOLD || workspace == nullptr) {
  ------------------
  |  Branch (311:14): [True: 997k, False: 468k]
  |  Branch (311:53): [True: 139k, False: 328k]
  |  Branch (311:92): [True: 0, False: 328k]
  ------------------
  312|  1.13M|      basecase_mul(z, z_size, x, x_sw, y, y_sw);
  313|  1.13M|   } else {
  314|   328k|      const size_t N = karatsuba_size(z_size, x_size, x_sw, y_size, y_sw);
  315|       |
  316|   328k|      if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) {
  ------------------
  |  Branch (316:10): [True: 328k, False: 0]
  |  Branch (316:19): [True: 328k, False: 0]
  |  Branch (316:38): [True: 287k, False: 41.3k]
  ------------------
  317|   287k|         karatsuba_mul(z, x, y, N, workspace);
  318|   287k|      } else {
  319|  41.3k|         basecase_mul(z, z_size, x, x_sw, y, y_sw);
  320|  41.3k|      }
  321|   328k|   }
  322|  2.02M|}
_ZN5Botan10bigint_sqrEPmmPKmmmS0_m:
  327|   599k|void bigint_sqr(word z[], size_t z_size, const word x[], size_t x_size, size_t x_sw, word workspace[], size_t ws_size) {
  328|   599k|   zeroize_buffer(z, z_size);
  329|       |
  330|   599k|   BOTAN_ASSERT(z_size / 2 >= x_sw, "Output size is sufficient");
  ------------------
  |  |   71|   599k|   do {                                                                                 \
  |  |   72|   599k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                     \
  |  |   73|   599k|      if(!(expr)) {                                                                     \
  |  |  ------------------
  |  |  |  Branch (73:10): [True: 0, False: 599k]
  |  |  ------------------
  |  |   74|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                            \
  |  |   75|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   76|      0|      }                                                                                 \
  |  |   77|   599k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (77:12): [Folded, False: 599k]
  |  |  ------------------
  ------------------
  331|       |
  332|   599k|   if(x_sw == 1) {
  ------------------
  |  Branch (332:7): [True: 25.0k, False: 574k]
  ------------------
  333|  25.0k|      bigint_linmul3(z, x, x_sw, x[0]);
  334|   574k|   } else if(sized_for_comba_sqr<4>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (334:14): [True: 11.9k, False: 562k]
  ------------------
  335|  11.9k|      bigint_comba_sqr4(z, x);
  336|   562k|   } else if(sized_for_comba_sqr<6>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (336:14): [True: 14.4k, False: 548k]
  ------------------
  337|  14.4k|      bigint_comba_sqr6(z, x);
  338|   548k|   } else if(sized_for_comba_sqr<8>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (338:14): [True: 26.3k, False: 521k]
  ------------------
  339|  26.3k|      bigint_comba_sqr8(z, x);
  340|   521k|   } else if(sized_for_comba_sqr<9>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (340:14): [True: 89.0k, False: 432k]
  ------------------
  341|  89.0k|      bigint_comba_sqr9(z, x);
  342|   432k|   } else if(sized_for_comba_sqr<16>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (342:14): [True: 18.7k, False: 414k]
  ------------------
  343|  18.7k|      bigint_comba_sqr16(z, x);
  344|   414k|   } else if(sized_for_comba_sqr<24>(x_sw, x_size, z_size)) {
  ------------------
  |  Branch (344:14): [True: 10.1k, False: 403k]
  ------------------
  345|  10.1k|      bigint_comba_sqr24(z, x);
  346|   403k|   } else if(x_size < KARATSUBA_SQUARE_THRESHOLD || workspace == nullptr) {
  ------------------
  |  Branch (346:14): [True: 88.1k, False: 315k]
  |  Branch (346:53): [True: 0, False: 315k]
  ------------------
  347|  88.1k|      basecase_sqr(z, z_size, x, x_sw);
  348|   315k|   } else {
  349|   315k|      const size_t N = karatsuba_size(z_size, x_size, x_sw);
  350|       |
  351|   315k|      if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) {
  ------------------
  |  Branch (351:10): [True: 97.2k, False: 218k]
  |  Branch (351:19): [True: 97.2k, False: 0]
  |  Branch (351:38): [True: 97.2k, False: 0]
  ------------------
  352|  97.2k|         karatsuba_sqr(z, x, N, workspace);
  353|   218k|      } else {
  354|   218k|         basecase_sqr(z, z_size, x, x_sw);
  355|   218k|      }
  356|   315k|   }
  357|   599k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_114karatsuba_sizeEmmmmm:
  203|   328k|size_t karatsuba_size(size_t z_size, size_t x_size, size_t x_sw, size_t y_size, size_t y_sw) {
  204|   328k|   if(x_sw > x_size || x_sw > y_size || y_sw > x_size || y_sw > y_size) {
  ------------------
  |  Branch (204:7): [True: 0, False: 328k]
  |  Branch (204:24): [True: 0, False: 328k]
  |  Branch (204:41): [True: 0, False: 328k]
  |  Branch (204:58): [True: 0, False: 328k]
  ------------------
  205|      0|      return 0;
  206|      0|   }
  207|       |
  208|   328k|   if(((x_size == x_sw) && (x_size % 2 != 0)) || ((y_size == y_sw) && (y_size % 2 != 0))) {
  ------------------
  |  Branch (208:8): [True: 0, False: 328k]
  |  Branch (208:28): [True: 0, False: 0]
  |  Branch (208:51): [True: 0, False: 328k]
  |  Branch (208:71): [True: 0, False: 0]
  ------------------
  209|      0|      return 0;
  210|      0|   }
  211|       |
  212|   328k|   const size_t start = (x_sw > y_sw) ? x_sw : y_sw;
  ------------------
  |  Branch (212:25): [True: 81.7k, False: 246k]
  ------------------
  213|   328k|   const size_t end = (x_size < y_size) ? x_size : y_size;
  ------------------
  |  Branch (213:23): [True: 96.9k, False: 231k]
  ------------------
  214|       |
  215|   328k|   if(start == end) {
  ------------------
  |  Branch (215:7): [True: 0, False: 328k]
  ------------------
  216|      0|      if(start % 2 != 0) {
  ------------------
  |  Branch (216:10): [True: 0, False: 0]
  ------------------
  217|      0|         return 0;
  218|      0|      }
  219|      0|      return start;
  220|      0|   }
  221|       |
  222|   527k|   for(size_t j = start; j <= end; ++j) {
  ------------------
  |  Branch (222:26): [True: 527k, False: 0]
  ------------------
  223|   527k|      if(j % 2 != 0) {
  ------------------
  |  Branch (223:10): [True: 198k, False: 328k]
  ------------------
  224|   198k|         continue;
  225|   198k|      }
  226|       |
  227|   328k|      if(2 * j > z_size) {
  ------------------
  |  Branch (227:10): [True: 0, False: 328k]
  ------------------
  228|      0|         return 0;
  229|      0|      }
  230|       |
  231|   328k|      if(x_sw <= j && j <= x_size && y_sw <= j && j <= y_size) {
  ------------------
  |  Branch (231:10): [True: 328k, False: 0]
  |  Branch (231:23): [True: 328k, False: 0]
  |  Branch (231:38): [True: 328k, False: 0]
  |  Branch (231:51): [True: 328k, False: 0]
  ------------------
  232|   328k|         if(j % 4 == 2 && (j + 2) <= x_size && (j + 2) <= y_size && 2 * (j + 2) <= z_size) {
  ------------------
  |  Branch (232:13): [True: 204k, False: 123k]
  |  Branch (232:27): [True: 129k, False: 75.4k]
  |  Branch (232:48): [True: 129k, False: 0]
  |  Branch (232:69): [True: 0, False: 129k]
  ------------------
  233|      0|            return j + 2;
  234|      0|         }
  235|   328k|         return j;
  236|   328k|      }
  237|   328k|   }
  238|       |
  239|      0|   return 0;
  240|   328k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_113karatsuba_mulEPmPKmS3_mS1_:
   80|  1.14M|void karatsuba_mul(word z[], const word x[], const word y[], size_t N, word workspace[]) {
   81|  1.14M|   if(N < KARATSUBA_MULTIPLY_THRESHOLD || N % 2 != 0) {
  ------------------
  |  Branch (81:7): [True: 861k, False: 287k]
  |  Branch (81:43): [True: 0, False: 287k]
  ------------------
   82|   861k|      switch(N) {
   83|      0|         case 6:
  ------------------
  |  Branch (83:10): [True: 0, False: 861k]
  ------------------
   84|      0|            return bigint_comba_mul6(z, x, y);
   85|      0|         case 8:
  ------------------
  |  Branch (85:10): [True: 0, False: 861k]
  ------------------
   86|      0|            return bigint_comba_mul8(z, x, y);
   87|      0|         case 9:
  ------------------
  |  Branch (87:10): [True: 0, False: 861k]
  ------------------
   88|      0|            return bigint_comba_mul9(z, x, y);
   89|   371k|         case 16:
  ------------------
  |  Branch (89:10): [True: 371k, False: 490k]
  ------------------
   90|   371k|            return bigint_comba_mul16(z, x, y);
   91|      0|         case 24:
  ------------------
  |  Branch (91:10): [True: 0, False: 861k]
  ------------------
   92|      0|            return bigint_comba_mul24(z, x, y);
   93|   490k|         default:
  ------------------
  |  Branch (93:10): [True: 490k, False: 371k]
  ------------------
   94|   490k|            return basecase_mul(z, 2 * N, x, N, y, N);
   95|   861k|      }
   96|   861k|   }
   97|       |
   98|   287k|   const size_t N2 = N / 2;
   99|       |
  100|   287k|   const word* x0 = x;
  101|   287k|   const word* x1 = x + N2;
  102|   287k|   const word* y0 = y;
  103|   287k|   const word* y1 = y + N2;
  104|   287k|   word* z0 = z;
  105|   287k|   word* z1 = z + N;
  106|       |
  107|   287k|   word* ws0 = workspace;
  108|   287k|   word* ws1 = workspace + N;
  109|       |
  110|   287k|   zeroize_buffer(workspace, 2 * N);
  111|       |
  112|       |   /*
  113|       |   * If either of cmp0 or cmp1 is zero then z0 or z1 resp is zero here,
  114|       |   * resulting in a no-op - z0*z1 will be equal to zero so we don't need to do
  115|       |   * anything, zeroize_buffer above already set the correct result.
  116|       |   *
  117|       |   * However we ignore the result of the comparisons and always perform the
  118|       |   * subtractions and recursively multiply to avoid the timing channel.
  119|       |   */
  120|       |
  121|       |   // First compute (X_lo - X_hi)*(Y_hi - Y_lo)
  122|   287k|   const auto cmp0 = bigint_sub_abs(z0, x0, x1, N2, workspace);
  123|   287k|   const auto cmp1 = bigint_sub_abs(z1, y1, y0, N2, workspace);
  124|   287k|   const auto neg_mask = ~(cmp0 ^ cmp1);
  125|       |
  126|   287k|   karatsuba_mul(ws0, z0, z1, N2, ws1);
  127|       |
  128|       |   // Compute X_lo * Y_lo
  129|   287k|   karatsuba_mul(z0, x0, y0, N2, ws1);
  130|       |
  131|       |   // Compute X_hi * Y_hi
  132|   287k|   karatsuba_mul(z1, x1, y1, N2, ws1);
  133|       |
  134|   287k|   const word ws_carry = bigint_add3(ws1, z0, N, z1, N);
  135|   287k|   word z_carry = bigint_add2(z + N2, N, ws1, N);
  136|       |
  137|   287k|   z_carry += bigint_add2(z + N + N2, N2, &ws_carry, 1);
  138|   287k|   bigint_add2(z + N + N2, N2, &z_carry, 1);
  139|       |
  140|   287k|   zeroize_buffer(workspace + N, N2);
  141|       |
  142|   287k|   bigint_cnd_add(neg_mask.value(), z + N2, workspace, 2 * N - N2);
  143|   287k|   bigint_cnd_sub((~neg_mask).value(), z + N2, workspace, 2 * N - N2);
  144|   287k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_114karatsuba_sizeEmmm:
  245|   315k|size_t karatsuba_size(size_t z_size, size_t x_size, size_t x_sw) {
  246|   315k|   if(x_sw == x_size) {
  ------------------
  |  Branch (246:7): [True: 35, False: 315k]
  ------------------
  247|     35|      if(x_sw % 2 != 0) {
  ------------------
  |  Branch (247:10): [True: 0, False: 35]
  ------------------
  248|      0|         return 0;
  249|      0|      }
  250|     35|      return x_sw;
  251|     35|   }
  252|       |
  253|   534k|   for(size_t j = x_sw; j <= x_size; ++j) {
  ------------------
  |  Branch (253:25): [True: 534k, False: 0]
  ------------------
  254|   534k|      if(j % 2 != 0) {
  ------------------
  |  Branch (254:10): [True: 218k, False: 315k]
  ------------------
  255|   218k|         continue;
  256|   218k|      }
  257|       |
  258|   315k|      if(2 * j > z_size) {
  ------------------
  |  Branch (258:10): [True: 218k, False: 97.2k]
  ------------------
  259|   218k|         return 0;
  260|   218k|      }
  261|       |
  262|  97.2k|      if(j % 4 == 2 && (j + 2) <= x_size && 2 * (j + 2) <= z_size) {
  ------------------
  |  Branch (262:10): [True: 28.9k, False: 68.3k]
  |  Branch (262:24): [True: 28.9k, False: 0]
  |  Branch (262:45): [True: 0, False: 28.9k]
  ------------------
  263|      0|         return j + 2;
  264|      0|      }
  265|  97.2k|      return j;
  266|  97.2k|   }
  267|       |
  268|      0|   return 0;
  269|   315k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_113karatsuba_sqrEPmPKmmS1_:
  149|   266k|void karatsuba_sqr(word z[], const word x[], size_t N, word workspace[]) {
  150|   266k|   if(N < KARATSUBA_SQUARE_THRESHOLD || N % 2 != 0) {
  ------------------
  |  Branch (150:7): [True: 210k, False: 56.4k]
  |  Branch (150:41): [True: 0, False: 56.4k]
  ------------------
  151|   210k|      switch(N) {
  152|      0|         case 6:
  ------------------
  |  Branch (152:10): [True: 0, False: 210k]
  ------------------
  153|      0|            return bigint_comba_sqr6(z, x);
  154|      0|         case 8:
  ------------------
  |  Branch (154:10): [True: 0, False: 210k]
  ------------------
  155|      0|            return bigint_comba_sqr8(z, x);
  156|      0|         case 9:
  ------------------
  |  Branch (156:10): [True: 0, False: 210k]
  ------------------
  157|      0|            return bigint_comba_sqr9(z, x);
  158|   169k|         case 16:
  ------------------
  |  Branch (158:10): [True: 169k, False: 40.7k]
  ------------------
  159|   169k|            return bigint_comba_sqr16(z, x);
  160|      0|         case 24:
  ------------------
  |  Branch (160:10): [True: 0, False: 210k]
  ------------------
  161|      0|            return bigint_comba_sqr24(z, x);
  162|  40.7k|         default:
  ------------------
  |  Branch (162:10): [True: 40.7k, False: 169k]
  ------------------
  163|  40.7k|            return basecase_sqr(z, 2 * N, x, N);
  164|   210k|      }
  165|   210k|   }
  166|       |
  167|  56.4k|   const size_t N2 = N / 2;
  168|       |
  169|  56.4k|   const word* x0 = x;
  170|  56.4k|   const word* x1 = x + N2;
  171|  56.4k|   word* z0 = z;
  172|  56.4k|   word* z1 = z + N;
  173|       |
  174|  56.4k|   word* ws0 = workspace;
  175|  56.4k|   word* ws1 = workspace + N;
  176|       |
  177|  56.4k|   zeroize_buffer(workspace, 2 * N);
  178|       |
  179|       |   // See comment in karatsuba_mul
  180|  56.4k|   bigint_sub_abs(z0, x0, x1, N2, workspace);
  181|  56.4k|   karatsuba_sqr(ws0, z0, N2, ws1);
  182|       |
  183|  56.4k|   karatsuba_sqr(z0, x0, N2, ws1);
  184|  56.4k|   karatsuba_sqr(z1, x1, N2, ws1);
  185|       |
  186|  56.4k|   const word ws_carry = bigint_add3(ws1, z0, N, z1, N);
  187|  56.4k|   word z_carry = bigint_add2(z + N2, N, ws1, N);
  188|       |
  189|  56.4k|   z_carry += bigint_add2(z + N + N2, N2, &ws_carry, 1);
  190|  56.4k|   bigint_add2(z + N + N2, N2, &z_carry, 1);
  191|       |
  192|       |   /*
  193|       |   * This is only actually required if cmp (result of bigint_sub_abs) is != 0,
  194|       |   * however if cmp==0 then ws0[0:N] == 0 and avoiding the jump hides a
  195|       |   * timing channel.
  196|       |   */
  197|  56.4k|   bigint_sub2(z + N2, 2 * N - N2, ws0, N);
  198|  56.4k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm4EEEbmmmmm:
  272|  1.98M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|  1.98M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 110k, False: 1.87M]
  |  Branch (273:26): [True: 106k, False: 3.27k]
  |  Branch (273:42): [True: 104k, False: 2.15k]
  |  Branch (273:56): [True: 104k, False: 0]
  |  Branch (273:72): [True: 66.9k, False: 37.7k]
  ------------------
  274|  1.98M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm6EEEbmmmmm:
  272|  1.91M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|  1.91M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 93.2k, False: 1.82M]
  |  Branch (273:26): [True: 89.1k, False: 4.08k]
  |  Branch (273:42): [True: 81.5k, False: 7.57k]
  |  Branch (273:56): [True: 81.5k, False: 0]
  |  Branch (273:72): [True: 40.5k, False: 40.9k]
  ------------------
  274|  1.91M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm8EEEbmmmmm:
  272|  1.87M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|  1.87M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 119k, False: 1.75M]
  |  Branch (273:26): [True: 87.4k, False: 32.1k]
  |  Branch (273:42): [True: 80.0k, False: 7.43k]
  |  Branch (273:56): [True: 80.0k, False: 0]
  |  Branch (273:72): [True: 61.1k, False: 18.9k]
  ------------------
  274|  1.87M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm9EEEbmmmmm:
  272|  1.81M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|  1.81M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 171k, False: 1.64M]
  |  Branch (273:26): [True: 131k, False: 39.0k]
  |  Branch (273:42): [True: 119k, False: 12.5k]
  |  Branch (273:56): [True: 119k, False: 223]
  |  Branch (273:72): [True: 107k, False: 11.9k]
  ------------------
  274|  1.81M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm16EEEbmmmmm:
  272|  1.70M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|  1.70M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 665k, False: 1.04M]
  |  Branch (273:26): [True: 438k, False: 226k]
  |  Branch (273:42): [True: 406k, False: 32.2k]
  |  Branch (273:56): [True: 405k, False: 320]
  |  Branch (273:72): [True: 137k, False: 268k]
  ------------------
  274|  1.70M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm24EEEbmmmmm:
  272|  1.57M|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|  1.57M|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 895k, False: 676k]
  |  Branch (273:26): [True: 425k, False: 470k]
  |  Branch (273:42): [True: 386k, False: 38.7k]
  |  Branch (273:56): [True: 386k, False: 150]
  |  Branch (273:72): [True: 106k, False: 279k]
  ------------------
  274|  1.57M|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm4EEEbmmm:
  277|   574k|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|   574k|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 45.6k, False: 529k]
  |  Branch (278:26): [True: 33.8k, False: 11.8k]
  |  Branch (278:42): [True: 11.9k, False: 21.8k]
  ------------------
  279|   574k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm6EEEbmmm:
  277|   562k|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|   562k|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 59.2k, False: 503k]
  |  Branch (278:26): [True: 44.4k, False: 14.8k]
  |  Branch (278:42): [True: 14.4k, False: 29.9k]
  ------------------
  279|   562k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm8EEEbmmm:
  277|   548k|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|   548k|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 82.8k, False: 465k]
  |  Branch (278:26): [True: 65.3k, False: 17.4k]
  |  Branch (278:42): [True: 26.3k, False: 38.9k]
  ------------------
  279|   548k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm9EEEbmmm:
  277|   521k|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|   521k|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 145k, False: 376k]
  |  Branch (278:26): [True: 114k, False: 31.1k]
  |  Branch (278:42): [True: 89.0k, False: 25.2k]
  ------------------
  279|   521k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm16EEEbmmm:
  277|   432k|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|   432k|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 156k, False: 276k]
  |  Branch (278:26): [True: 113k, False: 42.4k]
  |  Branch (278:42): [True: 18.7k, False: 95.1k]
  ------------------
  279|   432k|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_sqrILm24EEEbmmm:
  277|   414k|inline bool sized_for_comba_sqr(size_t x_sw, size_t x_size, size_t z_size) {
  278|   414k|   return (x_sw <= SZ && x_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (278:12): [True: 229k, False: 184k]
  |  Branch (278:26): [True: 172k, False: 56.5k]
  |  Branch (278:42): [True: 10.1k, False: 162k]
  ------------------
  279|   414k|}

_ZN5Botan25bigint_monty_redc_genericEPmPKmmS2_mmS0_:
   95|  35.1k|   word r[], const word z[], size_t z_size, const word p[], size_t p_size, word p_dash, word ws[]) {
   96|  35.1k|   BOTAN_ARG_CHECK(z_size >= 2 * p_size && p_size > 0, "Invalid sizes for bigint_monty_redc_generic");
  ------------------
  |  |   35|  35.1k|   do {                                                          \
  |  |   36|  35.1k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|  70.2k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:12): [True: 35.1k, False: 0]
  |  |  |  Branch (37:12): [True: 35.1k, False: 0]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|  35.1k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 35.1k]
  |  |  ------------------
  ------------------
   97|       |
   98|  35.1k|   word3<word> accum;
   99|       |
  100|  35.1k|   accum.add(z[0]);
  101|       |
  102|  35.1k|   ws[0] = accum.monty_step(p[0], p_dash);
  103|       |
  104|  95.7k|   for(size_t i = 1; i != p_size; ++i) {
  ------------------
  |  Branch (104:22): [True: 60.6k, False: 35.1k]
  ------------------
  105|  60.6k|      mul_rev_range(accum, ws, p, i);
  106|  60.6k|      accum.add(z[i]);
  107|  60.6k|      ws[i] = accum.monty_step(p[0], p_dash);
  108|  60.6k|   }
  109|       |
  110|  95.7k|   for(size_t i = 0; i != p_size - 1; ++i) {
  ------------------
  |  Branch (110:22): [True: 60.6k, False: 35.1k]
  ------------------
  111|  60.6k|      mul_rev_range(accum, &ws[i + 1], &p[i], p_size - (i + 1));
  112|  60.6k|      accum.add(z[p_size + i]);
  113|  60.6k|      ws[i] = accum.extract();
  114|  60.6k|   }
  115|       |
  116|  35.1k|   accum.add(z[2 * p_size - 1]);
  117|       |
  118|  35.1k|   ws[p_size - 1] = accum.extract();
  119|       |   // w1 is the final part, which is not stored in the workspace
  120|  35.1k|   const word w1 = accum.extract();
  121|       |
  122|       |   /*
  123|       |   * The result might need to be reduced mod p. To avoid a timing
  124|       |   * channel, always perform the subtraction. If in the computation
  125|       |   * of x - p a borrow is required then x was already < p.
  126|       |   *
  127|       |   * x starts at ws[0] and is p_size bytes long plus a possible high
  128|       |   * digit left over in w1.
  129|       |   *
  130|       |   * x - p starts at z[0] and is also p_size bytes long
  131|       |   *
  132|       |   * If borrow was set after the subtraction, then x was already less
  133|       |   * than p and the subtraction was not needed. In that case overwrite
  134|       |   * z[0:p_size] with the original x in ws[0:p_size].
  135|       |   *
  136|       |   * We only copy out p_size in the final step because we know
  137|       |   * the Montgomery result is < P
  138|       |   */
  139|       |
  140|  35.1k|   bigint_monty_maybe_sub(p_size, r, w1, ws, p);
  141|  35.1k|}
_ZN5Botan16bigint_monty_mulEPmPKmS2_S2_mmS0_m:
  144|  59.5k|   word z[], const word x[], const word y[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) {
  145|  59.5k|   BOTAN_ARG_CHECK(ws_size >= 4 * p_size && p_size > 0, "Invalid workspace for Montgomery multiplication");
  ------------------
  |  |   35|  59.5k|   do {                                                          \
  |  |   36|  59.5k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|   119k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:12): [True: 59.5k, False: 0]
  |  |  |  Branch (37:12): [True: 59.5k, False: 0]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|  59.5k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 59.5k]
  |  |  ------------------
  ------------------
  146|       |
  147|  59.5k|#if defined(BOTAN_HAS_MP_MULX)
  148|  59.5k|   if(use_mulx_monty(p_size)) {
  ------------------
  |  Branch (148:7): [True: 45.9k, False: 13.5k]
  ------------------
  149|  45.9k|      return bigint_mulx_monty_mul(z, x, y, p, p_size, p_dash, ws);
  150|  45.9k|   }
  151|  13.5k|#endif
  152|       |
  153|  13.5k|   word* prod = ws;
  154|  13.5k|   word* mul_ws = ws + 2 * p_size;
  155|  13.5k|   bigint_mul(prod, 2 * p_size, x, p_size, p_size, y, p_size, p_size, mul_ws, 2 * p_size);
  156|  13.5k|   bigint_monty_redc(z, prod, p, p_size, p_dash, mul_ws, 2 * p_size);
  157|  13.5k|}
_ZN5Botan16bigint_monty_sqrEPmPKmS2_mmS0_m:
  159|   224k|void bigint_monty_sqr(word z[], const word x[], const word p[], size_t p_size, word p_dash, word ws[], size_t ws_size) {
  160|   224k|   BOTAN_ARG_CHECK(ws_size >= 4 * p_size && p_size > 0, "Invalid workspace for Montgomery squaring");
  ------------------
  |  |   35|   224k|   do {                                                          \
  |  |   36|   224k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|   449k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:12): [True: 224k, False: 0]
  |  |  |  Branch (37:12): [True: 224k, False: 0]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|   224k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 224k]
  |  |  ------------------
  ------------------
  161|       |
  162|   224k|   word* prod = ws;
  163|       |
  164|   224k|#if defined(BOTAN_HAS_MP_MULX)
  165|   224k|   if(use_mulx_monty(p_size)) {
  ------------------
  |  Branch (165:7): [True: 177k, False: 47.5k]
  ------------------
  166|   177k|      return bigint_mulx_monty_sqr(z, x, p, p_size, p_dash, ws);
  167|   177k|   }
  168|  47.5k|#endif
  169|       |
  170|  47.5k|   word* mul_ws = ws + 2 * p_size;
  171|  47.5k|   bigint_sqr(prod, 2 * p_size, x, p_size, p_size, mul_ws, 2 * p_size);
  172|  47.5k|   bigint_monty_redc(z, prod, p, p_size, p_dash, mul_ws, 2 * p_size);
  173|  47.5k|}
mp_monty.cpp:_ZN5Botan12_GLOBAL__N_113mul_rev_rangeERNS_5word3ImEEPKmS5_m:
   22|   121k|BOTAN_FORCE_INLINE void mul_rev_range(word3<word>& accum, const word ws[], const word p[], size_t bound) {
   23|       |   /*
   24|       |   Unrolled version of:
   25|       |
   26|       |   for(size_t i = 0; i < bound; ++i) {
   27|       |      accum.mul(ws[i], p[bound - i]);
   28|       |   }
   29|       |   */
   30|       |
   31|   121k|   size_t lower = 0;
   32|   274k|   while(lower < bound) {
  ------------------
  |  Branch (32:10): [True: 153k, False: 121k]
  ------------------
   33|   153k|      const size_t upper = bound - lower;
   34|       |
   35|   153k|      if(upper >= 16) {
  ------------------
  |  Branch (35:10): [True: 542, False: 153k]
  ------------------
   36|    542|         accum.mul(ws[lower], p[upper]);
   37|    542|         accum.mul(ws[lower + 1], p[upper - 1]);
   38|    542|         accum.mul(ws[lower + 2], p[upper - 2]);
   39|    542|         accum.mul(ws[lower + 3], p[upper - 3]);
   40|    542|         accum.mul(ws[lower + 4], p[upper - 4]);
   41|    542|         accum.mul(ws[lower + 5], p[upper - 5]);
   42|    542|         accum.mul(ws[lower + 6], p[upper - 6]);
   43|    542|         accum.mul(ws[lower + 7], p[upper - 7]);
   44|    542|         accum.mul(ws[lower + 8], p[upper - 8]);
   45|    542|         accum.mul(ws[lower + 9], p[upper - 9]);
   46|    542|         accum.mul(ws[lower + 10], p[upper - 10]);
   47|    542|         accum.mul(ws[lower + 11], p[upper - 11]);
   48|    542|         accum.mul(ws[lower + 12], p[upper - 12]);
   49|    542|         accum.mul(ws[lower + 13], p[upper - 13]);
   50|    542|         accum.mul(ws[lower + 14], p[upper - 14]);
   51|    542|         accum.mul(ws[lower + 15], p[upper - 15]);
   52|    542|         lower += 16;
   53|   153k|      } else if(upper >= 8) {
  ------------------
  |  Branch (53:17): [True: 1.55k, False: 151k]
  ------------------
   54|  1.55k|         accum.mul(ws[lower], p[upper]);
   55|  1.55k|         accum.mul(ws[lower + 1], p[upper - 1]);
   56|  1.55k|         accum.mul(ws[lower + 2], p[upper - 2]);
   57|  1.55k|         accum.mul(ws[lower + 3], p[upper - 3]);
   58|  1.55k|         accum.mul(ws[lower + 4], p[upper - 4]);
   59|  1.55k|         accum.mul(ws[lower + 5], p[upper - 5]);
   60|  1.55k|         accum.mul(ws[lower + 6], p[upper - 6]);
   61|  1.55k|         accum.mul(ws[lower + 7], p[upper - 7]);
   62|  1.55k|         lower += 8;
   63|   151k|      } else if(upper >= 4) {
  ------------------
  |  Branch (63:17): [True: 30.2k, False: 121k]
  ------------------
   64|  30.2k|         accum.mul(ws[lower], p[upper]);
   65|  30.2k|         accum.mul(ws[lower + 1], p[upper - 1]);
   66|  30.2k|         accum.mul(ws[lower + 2], p[upper - 2]);
   67|  30.2k|         accum.mul(ws[lower + 3], p[upper - 3]);
   68|  30.2k|         lower += 4;
   69|   121k|      } else if(upper >= 2) {
  ------------------
  |  Branch (69:17): [True: 52.9k, False: 68.3k]
  ------------------
   70|  52.9k|         accum.mul(ws[lower], p[upper]);
   71|  52.9k|         accum.mul(ws[lower + 1], p[upper - 1]);
   72|  52.9k|         lower += 2;
   73|  68.3k|      } else {
   74|  68.3k|         accum.mul(ws[lower], p[upper]);
   75|  68.3k|         lower += 1;
   76|  68.3k|      }
   77|   153k|   }
   78|   121k|}

_ZN5Botan19bigint_monty_redc_4EPmPKmS2_mS0_:
   12|  6.90k|void bigint_monty_redc_4(word r[4], const word z[8], const word p[4], word p_dash, word ws[4]) {
   13|  6.90k|   word3<word> accum;
   14|  6.90k|   accum.add(z[0]);
   15|  6.90k|   ws[0] = accum.monty_step(p[0], p_dash);
   16|  6.90k|   accum.mul(ws[0], p[1]);
   17|  6.90k|   accum.add(z[1]);
   18|  6.90k|   ws[1] = accum.monty_step(p[0], p_dash);
   19|  6.90k|   accum.mul(ws[0], p[2]);
   20|  6.90k|   accum.mul(ws[1], p[1]);
   21|  6.90k|   accum.add(z[2]);
   22|  6.90k|   ws[2] = accum.monty_step(p[0], p_dash);
   23|  6.90k|   accum.mul(ws[0], p[3]);
   24|  6.90k|   accum.mul(ws[1], p[2]);
   25|  6.90k|   accum.mul(ws[2], p[1]);
   26|  6.90k|   accum.add(z[3]);
   27|  6.90k|   ws[3] = accum.monty_step(p[0], p_dash);
   28|  6.90k|   accum.mul(ws[1], p[3]);
   29|  6.90k|   accum.mul(ws[2], p[2]);
   30|  6.90k|   accum.mul(ws[3], p[1]);
   31|  6.90k|   accum.add(z[4]);
   32|  6.90k|   ws[0] = accum.extract();
   33|  6.90k|   accum.mul(ws[2], p[3]);
   34|  6.90k|   accum.mul(ws[3], p[2]);
   35|  6.90k|   accum.add(z[5]);
   36|  6.90k|   ws[1] = accum.extract();
   37|  6.90k|   accum.mul(ws[3], p[3]);
   38|  6.90k|   accum.add(z[6]);
   39|  6.90k|   ws[2] = accum.extract();
   40|  6.90k|   accum.add(z[7]);
   41|  6.90k|   ws[3] = accum.extract();
   42|  6.90k|   const word w1 = accum.extract();
   43|  6.90k|   bigint_monty_maybe_sub<4>(r, w1, ws, p);
   44|  6.90k|}
_ZN5Botan19bigint_monty_redc_6EPmPKmS2_mS0_:
   46|  8.75k|void bigint_monty_redc_6(word r[6], const word z[12], const word p[6], word p_dash, word ws[6]) {
   47|  8.75k|   word3<word> accum;
   48|  8.75k|   accum.add(z[0]);
   49|  8.75k|   ws[0] = accum.monty_step(p[0], p_dash);
   50|  8.75k|   accum.mul(ws[0], p[1]);
   51|  8.75k|   accum.add(z[1]);
   52|  8.75k|   ws[1] = accum.monty_step(p[0], p_dash);
   53|  8.75k|   accum.mul(ws[0], p[2]);
   54|  8.75k|   accum.mul(ws[1], p[1]);
   55|  8.75k|   accum.add(z[2]);
   56|  8.75k|   ws[2] = accum.monty_step(p[0], p_dash);
   57|  8.75k|   accum.mul(ws[0], p[3]);
   58|  8.75k|   accum.mul(ws[1], p[2]);
   59|  8.75k|   accum.mul(ws[2], p[1]);
   60|  8.75k|   accum.add(z[3]);
   61|  8.75k|   ws[3] = accum.monty_step(p[0], p_dash);
   62|  8.75k|   accum.mul(ws[0], p[4]);
   63|  8.75k|   accum.mul(ws[1], p[3]);
   64|  8.75k|   accum.mul(ws[2], p[2]);
   65|  8.75k|   accum.mul(ws[3], p[1]);
   66|  8.75k|   accum.add(z[4]);
   67|  8.75k|   ws[4] = accum.monty_step(p[0], p_dash);
   68|  8.75k|   accum.mul(ws[0], p[5]);
   69|  8.75k|   accum.mul(ws[1], p[4]);
   70|  8.75k|   accum.mul(ws[2], p[3]);
   71|  8.75k|   accum.mul(ws[3], p[2]);
   72|  8.75k|   accum.mul(ws[4], p[1]);
   73|  8.75k|   accum.add(z[5]);
   74|  8.75k|   ws[5] = accum.monty_step(p[0], p_dash);
   75|  8.75k|   accum.mul(ws[1], p[5]);
   76|  8.75k|   accum.mul(ws[2], p[4]);
   77|  8.75k|   accum.mul(ws[3], p[3]);
   78|  8.75k|   accum.mul(ws[4], p[2]);
   79|  8.75k|   accum.mul(ws[5], p[1]);
   80|  8.75k|   accum.add(z[6]);
   81|  8.75k|   ws[0] = accum.extract();
   82|  8.75k|   accum.mul(ws[2], p[5]);
   83|  8.75k|   accum.mul(ws[3], p[4]);
   84|  8.75k|   accum.mul(ws[4], p[3]);
   85|  8.75k|   accum.mul(ws[5], p[2]);
   86|  8.75k|   accum.add(z[7]);
   87|  8.75k|   ws[1] = accum.extract();
   88|  8.75k|   accum.mul(ws[3], p[5]);
   89|  8.75k|   accum.mul(ws[4], p[4]);
   90|  8.75k|   accum.mul(ws[5], p[3]);
   91|  8.75k|   accum.add(z[8]);
   92|  8.75k|   ws[2] = accum.extract();
   93|  8.75k|   accum.mul(ws[4], p[5]);
   94|  8.75k|   accum.mul(ws[5], p[4]);
   95|  8.75k|   accum.add(z[9]);
   96|  8.75k|   ws[3] = accum.extract();
   97|  8.75k|   accum.mul(ws[5], p[5]);
   98|  8.75k|   accum.add(z[10]);
   99|  8.75k|   ws[4] = accum.extract();
  100|  8.75k|   accum.add(z[11]);
  101|  8.75k|   ws[5] = accum.extract();
  102|  8.75k|   const word w1 = accum.extract();
  103|  8.75k|   bigint_monty_maybe_sub<6>(r, w1, ws, p);
  104|  8.75k|}
_ZN5Botan19bigint_monty_redc_8EPmPKmS2_mS0_:
  106|  10.8k|void bigint_monty_redc_8(word r[8], const word z[16], const word p[8], word p_dash, word ws[8]) {
  107|  10.8k|   word3<word> accum;
  108|  10.8k|   accum.add(z[0]);
  109|  10.8k|   ws[0] = accum.monty_step(p[0], p_dash);
  110|  10.8k|   accum.mul(ws[0], p[1]);
  111|  10.8k|   accum.add(z[1]);
  112|  10.8k|   ws[1] = accum.monty_step(p[0], p_dash);
  113|  10.8k|   accum.mul(ws[0], p[2]);
  114|  10.8k|   accum.mul(ws[1], p[1]);
  115|  10.8k|   accum.add(z[2]);
  116|  10.8k|   ws[2] = accum.monty_step(p[0], p_dash);
  117|  10.8k|   accum.mul(ws[0], p[3]);
  118|  10.8k|   accum.mul(ws[1], p[2]);
  119|  10.8k|   accum.mul(ws[2], p[1]);
  120|  10.8k|   accum.add(z[3]);
  121|  10.8k|   ws[3] = accum.monty_step(p[0], p_dash);
  122|  10.8k|   accum.mul(ws[0], p[4]);
  123|  10.8k|   accum.mul(ws[1], p[3]);
  124|  10.8k|   accum.mul(ws[2], p[2]);
  125|  10.8k|   accum.mul(ws[3], p[1]);
  126|  10.8k|   accum.add(z[4]);
  127|  10.8k|   ws[4] = accum.monty_step(p[0], p_dash);
  128|  10.8k|   accum.mul(ws[0], p[5]);
  129|  10.8k|   accum.mul(ws[1], p[4]);
  130|  10.8k|   accum.mul(ws[2], p[3]);
  131|  10.8k|   accum.mul(ws[3], p[2]);
  132|  10.8k|   accum.mul(ws[4], p[1]);
  133|  10.8k|   accum.add(z[5]);
  134|  10.8k|   ws[5] = accum.monty_step(p[0], p_dash);
  135|  10.8k|   accum.mul(ws[0], p[6]);
  136|  10.8k|   accum.mul(ws[1], p[5]);
  137|  10.8k|   accum.mul(ws[2], p[4]);
  138|  10.8k|   accum.mul(ws[3], p[3]);
  139|  10.8k|   accum.mul(ws[4], p[2]);
  140|  10.8k|   accum.mul(ws[5], p[1]);
  141|  10.8k|   accum.add(z[6]);
  142|  10.8k|   ws[6] = accum.monty_step(p[0], p_dash);
  143|  10.8k|   accum.mul(ws[0], p[7]);
  144|  10.8k|   accum.mul(ws[1], p[6]);
  145|  10.8k|   accum.mul(ws[2], p[5]);
  146|  10.8k|   accum.mul(ws[3], p[4]);
  147|  10.8k|   accum.mul(ws[4], p[3]);
  148|  10.8k|   accum.mul(ws[5], p[2]);
  149|  10.8k|   accum.mul(ws[6], p[1]);
  150|  10.8k|   accum.add(z[7]);
  151|  10.8k|   ws[7] = accum.monty_step(p[0], p_dash);
  152|  10.8k|   accum.mul(ws[1], p[7]);
  153|  10.8k|   accum.mul(ws[2], p[6]);
  154|  10.8k|   accum.mul(ws[3], p[5]);
  155|  10.8k|   accum.mul(ws[4], p[4]);
  156|  10.8k|   accum.mul(ws[5], p[3]);
  157|  10.8k|   accum.mul(ws[6], p[2]);
  158|  10.8k|   accum.mul(ws[7], p[1]);
  159|  10.8k|   accum.add(z[8]);
  160|  10.8k|   ws[0] = accum.extract();
  161|  10.8k|   accum.mul(ws[2], p[7]);
  162|  10.8k|   accum.mul(ws[3], p[6]);
  163|  10.8k|   accum.mul(ws[4], p[5]);
  164|  10.8k|   accum.mul(ws[5], p[4]);
  165|  10.8k|   accum.mul(ws[6], p[3]);
  166|  10.8k|   accum.mul(ws[7], p[2]);
  167|  10.8k|   accum.add(z[9]);
  168|  10.8k|   ws[1] = accum.extract();
  169|  10.8k|   accum.mul(ws[3], p[7]);
  170|  10.8k|   accum.mul(ws[4], p[6]);
  171|  10.8k|   accum.mul(ws[5], p[5]);
  172|  10.8k|   accum.mul(ws[6], p[4]);
  173|  10.8k|   accum.mul(ws[7], p[3]);
  174|  10.8k|   accum.add(z[10]);
  175|  10.8k|   ws[2] = accum.extract();
  176|  10.8k|   accum.mul(ws[4], p[7]);
  177|  10.8k|   accum.mul(ws[5], p[6]);
  178|  10.8k|   accum.mul(ws[6], p[5]);
  179|  10.8k|   accum.mul(ws[7], p[4]);
  180|  10.8k|   accum.add(z[11]);
  181|  10.8k|   ws[3] = accum.extract();
  182|  10.8k|   accum.mul(ws[5], p[7]);
  183|  10.8k|   accum.mul(ws[6], p[6]);
  184|  10.8k|   accum.mul(ws[7], p[5]);
  185|  10.8k|   accum.add(z[12]);
  186|  10.8k|   ws[4] = accum.extract();
  187|  10.8k|   accum.mul(ws[6], p[7]);
  188|  10.8k|   accum.mul(ws[7], p[6]);
  189|  10.8k|   accum.add(z[13]);
  190|  10.8k|   ws[5] = accum.extract();
  191|  10.8k|   accum.mul(ws[7], p[7]);
  192|  10.8k|   accum.add(z[14]);
  193|  10.8k|   ws[6] = accum.extract();
  194|  10.8k|   accum.add(z[15]);
  195|  10.8k|   ws[7] = accum.extract();
  196|  10.8k|   const word w1 = accum.extract();
  197|  10.8k|   bigint_monty_maybe_sub<8>(r, w1, ws, p);
  198|  10.8k|}
_ZN5Botan20bigint_monty_redc_12EPmPKmS2_mS0_:
  200|     10|void bigint_monty_redc_12(word r[12], const word z[24], const word p[12], word p_dash, word ws[12]) {
  201|     10|   word3<word> accum;
  202|     10|   accum.add(z[0]);
  203|     10|   ws[0] = accum.monty_step(p[0], p_dash);
  204|     10|   accum.mul(ws[0], p[1]);
  205|     10|   accum.add(z[1]);
  206|     10|   ws[1] = accum.monty_step(p[0], p_dash);
  207|     10|   accum.mul(ws[0], p[2]);
  208|     10|   accum.mul(ws[1], p[1]);
  209|     10|   accum.add(z[2]);
  210|     10|   ws[2] = accum.monty_step(p[0], p_dash);
  211|     10|   accum.mul(ws[0], p[3]);
  212|     10|   accum.mul(ws[1], p[2]);
  213|     10|   accum.mul(ws[2], p[1]);
  214|     10|   accum.add(z[3]);
  215|     10|   ws[3] = accum.monty_step(p[0], p_dash);
  216|     10|   accum.mul(ws[0], p[4]);
  217|     10|   accum.mul(ws[1], p[3]);
  218|     10|   accum.mul(ws[2], p[2]);
  219|     10|   accum.mul(ws[3], p[1]);
  220|     10|   accum.add(z[4]);
  221|     10|   ws[4] = accum.monty_step(p[0], p_dash);
  222|     10|   accum.mul(ws[0], p[5]);
  223|     10|   accum.mul(ws[1], p[4]);
  224|     10|   accum.mul(ws[2], p[3]);
  225|     10|   accum.mul(ws[3], p[2]);
  226|     10|   accum.mul(ws[4], p[1]);
  227|     10|   accum.add(z[5]);
  228|     10|   ws[5] = accum.monty_step(p[0], p_dash);
  229|     10|   accum.mul(ws[0], p[6]);
  230|     10|   accum.mul(ws[1], p[5]);
  231|     10|   accum.mul(ws[2], p[4]);
  232|     10|   accum.mul(ws[3], p[3]);
  233|     10|   accum.mul(ws[4], p[2]);
  234|     10|   accum.mul(ws[5], p[1]);
  235|     10|   accum.add(z[6]);
  236|     10|   ws[6] = accum.monty_step(p[0], p_dash);
  237|     10|   accum.mul(ws[0], p[7]);
  238|     10|   accum.mul(ws[1], p[6]);
  239|     10|   accum.mul(ws[2], p[5]);
  240|     10|   accum.mul(ws[3], p[4]);
  241|     10|   accum.mul(ws[4], p[3]);
  242|     10|   accum.mul(ws[5], p[2]);
  243|     10|   accum.mul(ws[6], p[1]);
  244|     10|   accum.add(z[7]);
  245|     10|   ws[7] = accum.monty_step(p[0], p_dash);
  246|     10|   accum.mul(ws[0], p[8]);
  247|     10|   accum.mul(ws[1], p[7]);
  248|     10|   accum.mul(ws[2], p[6]);
  249|     10|   accum.mul(ws[3], p[5]);
  250|     10|   accum.mul(ws[4], p[4]);
  251|     10|   accum.mul(ws[5], p[3]);
  252|     10|   accum.mul(ws[6], p[2]);
  253|     10|   accum.mul(ws[7], p[1]);
  254|     10|   accum.add(z[8]);
  255|     10|   ws[8] = accum.monty_step(p[0], p_dash);
  256|     10|   accum.mul(ws[0], p[9]);
  257|     10|   accum.mul(ws[1], p[8]);
  258|     10|   accum.mul(ws[2], p[7]);
  259|     10|   accum.mul(ws[3], p[6]);
  260|     10|   accum.mul(ws[4], p[5]);
  261|     10|   accum.mul(ws[5], p[4]);
  262|     10|   accum.mul(ws[6], p[3]);
  263|     10|   accum.mul(ws[7], p[2]);
  264|     10|   accum.mul(ws[8], p[1]);
  265|     10|   accum.add(z[9]);
  266|     10|   ws[9] = accum.monty_step(p[0], p_dash);
  267|     10|   accum.mul(ws[0], p[10]);
  268|     10|   accum.mul(ws[1], p[9]);
  269|     10|   accum.mul(ws[2], p[8]);
  270|     10|   accum.mul(ws[3], p[7]);
  271|     10|   accum.mul(ws[4], p[6]);
  272|     10|   accum.mul(ws[5], p[5]);
  273|     10|   accum.mul(ws[6], p[4]);
  274|     10|   accum.mul(ws[7], p[3]);
  275|     10|   accum.mul(ws[8], p[2]);
  276|     10|   accum.mul(ws[9], p[1]);
  277|     10|   accum.add(z[10]);
  278|     10|   ws[10] = accum.monty_step(p[0], p_dash);
  279|     10|   accum.mul(ws[0], p[11]);
  280|     10|   accum.mul(ws[1], p[10]);
  281|     10|   accum.mul(ws[2], p[9]);
  282|     10|   accum.mul(ws[3], p[8]);
  283|     10|   accum.mul(ws[4], p[7]);
  284|     10|   accum.mul(ws[5], p[6]);
  285|     10|   accum.mul(ws[6], p[5]);
  286|     10|   accum.mul(ws[7], p[4]);
  287|     10|   accum.mul(ws[8], p[3]);
  288|     10|   accum.mul(ws[9], p[2]);
  289|     10|   accum.mul(ws[10], p[1]);
  290|     10|   accum.add(z[11]);
  291|     10|   ws[11] = accum.monty_step(p[0], p_dash);
  292|     10|   accum.mul(ws[1], p[11]);
  293|     10|   accum.mul(ws[2], p[10]);
  294|     10|   accum.mul(ws[3], p[9]);
  295|     10|   accum.mul(ws[4], p[8]);
  296|     10|   accum.mul(ws[5], p[7]);
  297|     10|   accum.mul(ws[6], p[6]);
  298|     10|   accum.mul(ws[7], p[5]);
  299|     10|   accum.mul(ws[8], p[4]);
  300|     10|   accum.mul(ws[9], p[3]);
  301|     10|   accum.mul(ws[10], p[2]);
  302|     10|   accum.mul(ws[11], p[1]);
  303|     10|   accum.add(z[12]);
  304|     10|   ws[0] = accum.extract();
  305|     10|   accum.mul(ws[2], p[11]);
  306|     10|   accum.mul(ws[3], p[10]);
  307|     10|   accum.mul(ws[4], p[9]);
  308|     10|   accum.mul(ws[5], p[8]);
  309|     10|   accum.mul(ws[6], p[7]);
  310|     10|   accum.mul(ws[7], p[6]);
  311|     10|   accum.mul(ws[8], p[5]);
  312|     10|   accum.mul(ws[9], p[4]);
  313|     10|   accum.mul(ws[10], p[3]);
  314|     10|   accum.mul(ws[11], p[2]);
  315|     10|   accum.add(z[13]);
  316|     10|   ws[1] = accum.extract();
  317|     10|   accum.mul(ws[3], p[11]);
  318|     10|   accum.mul(ws[4], p[10]);
  319|     10|   accum.mul(ws[5], p[9]);
  320|     10|   accum.mul(ws[6], p[8]);
  321|     10|   accum.mul(ws[7], p[7]);
  322|     10|   accum.mul(ws[8], p[6]);
  323|     10|   accum.mul(ws[9], p[5]);
  324|     10|   accum.mul(ws[10], p[4]);
  325|     10|   accum.mul(ws[11], p[3]);
  326|     10|   accum.add(z[14]);
  327|     10|   ws[2] = accum.extract();
  328|     10|   accum.mul(ws[4], p[11]);
  329|     10|   accum.mul(ws[5], p[10]);
  330|     10|   accum.mul(ws[6], p[9]);
  331|     10|   accum.mul(ws[7], p[8]);
  332|     10|   accum.mul(ws[8], p[7]);
  333|     10|   accum.mul(ws[9], p[6]);
  334|     10|   accum.mul(ws[10], p[5]);
  335|     10|   accum.mul(ws[11], p[4]);
  336|     10|   accum.add(z[15]);
  337|     10|   ws[3] = accum.extract();
  338|     10|   accum.mul(ws[5], p[11]);
  339|     10|   accum.mul(ws[6], p[10]);
  340|     10|   accum.mul(ws[7], p[9]);
  341|     10|   accum.mul(ws[8], p[8]);
  342|     10|   accum.mul(ws[9], p[7]);
  343|     10|   accum.mul(ws[10], p[6]);
  344|     10|   accum.mul(ws[11], p[5]);
  345|     10|   accum.add(z[16]);
  346|     10|   ws[4] = accum.extract();
  347|     10|   accum.mul(ws[6], p[11]);
  348|     10|   accum.mul(ws[7], p[10]);
  349|     10|   accum.mul(ws[8], p[9]);
  350|     10|   accum.mul(ws[9], p[8]);
  351|     10|   accum.mul(ws[10], p[7]);
  352|     10|   accum.mul(ws[11], p[6]);
  353|     10|   accum.add(z[17]);
  354|     10|   ws[5] = accum.extract();
  355|     10|   accum.mul(ws[7], p[11]);
  356|     10|   accum.mul(ws[8], p[10]);
  357|     10|   accum.mul(ws[9], p[9]);
  358|     10|   accum.mul(ws[10], p[8]);
  359|     10|   accum.mul(ws[11], p[7]);
  360|     10|   accum.add(z[18]);
  361|     10|   ws[6] = accum.extract();
  362|     10|   accum.mul(ws[8], p[11]);
  363|     10|   accum.mul(ws[9], p[10]);
  364|     10|   accum.mul(ws[10], p[9]);
  365|     10|   accum.mul(ws[11], p[8]);
  366|     10|   accum.add(z[19]);
  367|     10|   ws[7] = accum.extract();
  368|     10|   accum.mul(ws[9], p[11]);
  369|     10|   accum.mul(ws[10], p[10]);
  370|     10|   accum.mul(ws[11], p[9]);
  371|     10|   accum.add(z[20]);
  372|     10|   ws[8] = accum.extract();
  373|     10|   accum.mul(ws[10], p[11]);
  374|     10|   accum.mul(ws[11], p[10]);
  375|     10|   accum.add(z[21]);
  376|     10|   ws[9] = accum.extract();
  377|     10|   accum.mul(ws[11], p[11]);
  378|     10|   accum.add(z[22]);
  379|     10|   ws[10] = accum.extract();
  380|     10|   accum.add(z[23]);
  381|     10|   ws[11] = accum.extract();
  382|     10|   const word w1 = accum.extract();
  383|     10|   bigint_monty_maybe_sub<12>(r, w1, ws, p);
  384|     10|}
_ZN5Botan20bigint_monty_redc_16EPmPKmS2_mS0_:
  386|     20|void bigint_monty_redc_16(word r[16], const word z[32], const word p[16], word p_dash, word ws[16]) {
  387|     20|   word3<word> accum;
  388|     20|   accum.add(z[0]);
  389|     20|   ws[0] = accum.monty_step(p[0], p_dash);
  390|     20|   accum.mul(ws[0], p[1]);
  391|     20|   accum.add(z[1]);
  392|     20|   ws[1] = accum.monty_step(p[0], p_dash);
  393|     20|   accum.mul(ws[0], p[2]);
  394|     20|   accum.mul(ws[1], p[1]);
  395|     20|   accum.add(z[2]);
  396|     20|   ws[2] = accum.monty_step(p[0], p_dash);
  397|     20|   accum.mul(ws[0], p[3]);
  398|     20|   accum.mul(ws[1], p[2]);
  399|     20|   accum.mul(ws[2], p[1]);
  400|     20|   accum.add(z[3]);
  401|     20|   ws[3] = accum.monty_step(p[0], p_dash);
  402|     20|   accum.mul(ws[0], p[4]);
  403|     20|   accum.mul(ws[1], p[3]);
  404|     20|   accum.mul(ws[2], p[2]);
  405|     20|   accum.mul(ws[3], p[1]);
  406|     20|   accum.add(z[4]);
  407|     20|   ws[4] = accum.monty_step(p[0], p_dash);
  408|     20|   accum.mul(ws[0], p[5]);
  409|     20|   accum.mul(ws[1], p[4]);
  410|     20|   accum.mul(ws[2], p[3]);
  411|     20|   accum.mul(ws[3], p[2]);
  412|     20|   accum.mul(ws[4], p[1]);
  413|     20|   accum.add(z[5]);
  414|     20|   ws[5] = accum.monty_step(p[0], p_dash);
  415|     20|   accum.mul(ws[0], p[6]);
  416|     20|   accum.mul(ws[1], p[5]);
  417|     20|   accum.mul(ws[2], p[4]);
  418|     20|   accum.mul(ws[3], p[3]);
  419|     20|   accum.mul(ws[4], p[2]);
  420|     20|   accum.mul(ws[5], p[1]);
  421|     20|   accum.add(z[6]);
  422|     20|   ws[6] = accum.monty_step(p[0], p_dash);
  423|     20|   accum.mul(ws[0], p[7]);
  424|     20|   accum.mul(ws[1], p[6]);
  425|     20|   accum.mul(ws[2], p[5]);
  426|     20|   accum.mul(ws[3], p[4]);
  427|     20|   accum.mul(ws[4], p[3]);
  428|     20|   accum.mul(ws[5], p[2]);
  429|     20|   accum.mul(ws[6], p[1]);
  430|     20|   accum.add(z[7]);
  431|     20|   ws[7] = accum.monty_step(p[0], p_dash);
  432|     20|   accum.mul(ws[0], p[8]);
  433|     20|   accum.mul(ws[1], p[7]);
  434|     20|   accum.mul(ws[2], p[6]);
  435|     20|   accum.mul(ws[3], p[5]);
  436|     20|   accum.mul(ws[4], p[4]);
  437|     20|   accum.mul(ws[5], p[3]);
  438|     20|   accum.mul(ws[6], p[2]);
  439|     20|   accum.mul(ws[7], p[1]);
  440|     20|   accum.add(z[8]);
  441|     20|   ws[8] = accum.monty_step(p[0], p_dash);
  442|     20|   accum.mul(ws[0], p[9]);
  443|     20|   accum.mul(ws[1], p[8]);
  444|     20|   accum.mul(ws[2], p[7]);
  445|     20|   accum.mul(ws[3], p[6]);
  446|     20|   accum.mul(ws[4], p[5]);
  447|     20|   accum.mul(ws[5], p[4]);
  448|     20|   accum.mul(ws[6], p[3]);
  449|     20|   accum.mul(ws[7], p[2]);
  450|     20|   accum.mul(ws[8], p[1]);
  451|     20|   accum.add(z[9]);
  452|     20|   ws[9] = accum.monty_step(p[0], p_dash);
  453|     20|   accum.mul(ws[0], p[10]);
  454|     20|   accum.mul(ws[1], p[9]);
  455|     20|   accum.mul(ws[2], p[8]);
  456|     20|   accum.mul(ws[3], p[7]);
  457|     20|   accum.mul(ws[4], p[6]);
  458|     20|   accum.mul(ws[5], p[5]);
  459|     20|   accum.mul(ws[6], p[4]);
  460|     20|   accum.mul(ws[7], p[3]);
  461|     20|   accum.mul(ws[8], p[2]);
  462|     20|   accum.mul(ws[9], p[1]);
  463|     20|   accum.add(z[10]);
  464|     20|   ws[10] = accum.monty_step(p[0], p_dash);
  465|     20|   accum.mul(ws[0], p[11]);
  466|     20|   accum.mul(ws[1], p[10]);
  467|     20|   accum.mul(ws[2], p[9]);
  468|     20|   accum.mul(ws[3], p[8]);
  469|     20|   accum.mul(ws[4], p[7]);
  470|     20|   accum.mul(ws[5], p[6]);
  471|     20|   accum.mul(ws[6], p[5]);
  472|     20|   accum.mul(ws[7], p[4]);
  473|     20|   accum.mul(ws[8], p[3]);
  474|     20|   accum.mul(ws[9], p[2]);
  475|     20|   accum.mul(ws[10], p[1]);
  476|     20|   accum.add(z[11]);
  477|     20|   ws[11] = accum.monty_step(p[0], p_dash);
  478|     20|   accum.mul(ws[0], p[12]);
  479|     20|   accum.mul(ws[1], p[11]);
  480|     20|   accum.mul(ws[2], p[10]);
  481|     20|   accum.mul(ws[3], p[9]);
  482|     20|   accum.mul(ws[4], p[8]);
  483|     20|   accum.mul(ws[5], p[7]);
  484|     20|   accum.mul(ws[6], p[6]);
  485|     20|   accum.mul(ws[7], p[5]);
  486|     20|   accum.mul(ws[8], p[4]);
  487|     20|   accum.mul(ws[9], p[3]);
  488|     20|   accum.mul(ws[10], p[2]);
  489|     20|   accum.mul(ws[11], p[1]);
  490|     20|   accum.add(z[12]);
  491|     20|   ws[12] = accum.monty_step(p[0], p_dash);
  492|     20|   accum.mul(ws[0], p[13]);
  493|     20|   accum.mul(ws[1], p[12]);
  494|     20|   accum.mul(ws[2], p[11]);
  495|     20|   accum.mul(ws[3], p[10]);
  496|     20|   accum.mul(ws[4], p[9]);
  497|     20|   accum.mul(ws[5], p[8]);
  498|     20|   accum.mul(ws[6], p[7]);
  499|     20|   accum.mul(ws[7], p[6]);
  500|     20|   accum.mul(ws[8], p[5]);
  501|     20|   accum.mul(ws[9], p[4]);
  502|     20|   accum.mul(ws[10], p[3]);
  503|     20|   accum.mul(ws[11], p[2]);
  504|     20|   accum.mul(ws[12], p[1]);
  505|     20|   accum.add(z[13]);
  506|     20|   ws[13] = accum.monty_step(p[0], p_dash);
  507|     20|   accum.mul(ws[0], p[14]);
  508|     20|   accum.mul(ws[1], p[13]);
  509|     20|   accum.mul(ws[2], p[12]);
  510|     20|   accum.mul(ws[3], p[11]);
  511|     20|   accum.mul(ws[4], p[10]);
  512|     20|   accum.mul(ws[5], p[9]);
  513|     20|   accum.mul(ws[6], p[8]);
  514|     20|   accum.mul(ws[7], p[7]);
  515|     20|   accum.mul(ws[8], p[6]);
  516|     20|   accum.mul(ws[9], p[5]);
  517|     20|   accum.mul(ws[10], p[4]);
  518|     20|   accum.mul(ws[11], p[3]);
  519|     20|   accum.mul(ws[12], p[2]);
  520|     20|   accum.mul(ws[13], p[1]);
  521|     20|   accum.add(z[14]);
  522|     20|   ws[14] = accum.monty_step(p[0], p_dash);
  523|     20|   accum.mul(ws[0], p[15]);
  524|     20|   accum.mul(ws[1], p[14]);
  525|     20|   accum.mul(ws[2], p[13]);
  526|     20|   accum.mul(ws[3], p[12]);
  527|     20|   accum.mul(ws[4], p[11]);
  528|     20|   accum.mul(ws[5], p[10]);
  529|     20|   accum.mul(ws[6], p[9]);
  530|     20|   accum.mul(ws[7], p[8]);
  531|     20|   accum.mul(ws[8], p[7]);
  532|     20|   accum.mul(ws[9], p[6]);
  533|     20|   accum.mul(ws[10], p[5]);
  534|     20|   accum.mul(ws[11], p[4]);
  535|     20|   accum.mul(ws[12], p[3]);
  536|     20|   accum.mul(ws[13], p[2]);
  537|     20|   accum.mul(ws[14], p[1]);
  538|     20|   accum.add(z[15]);
  539|     20|   ws[15] = accum.monty_step(p[0], p_dash);
  540|     20|   accum.mul(ws[1], p[15]);
  541|     20|   accum.mul(ws[2], p[14]);
  542|     20|   accum.mul(ws[3], p[13]);
  543|     20|   accum.mul(ws[4], p[12]);
  544|     20|   accum.mul(ws[5], p[11]);
  545|     20|   accum.mul(ws[6], p[10]);
  546|     20|   accum.mul(ws[7], p[9]);
  547|     20|   accum.mul(ws[8], p[8]);
  548|     20|   accum.mul(ws[9], p[7]);
  549|     20|   accum.mul(ws[10], p[6]);
  550|     20|   accum.mul(ws[11], p[5]);
  551|     20|   accum.mul(ws[12], p[4]);
  552|     20|   accum.mul(ws[13], p[3]);
  553|     20|   accum.mul(ws[14], p[2]);
  554|     20|   accum.mul(ws[15], p[1]);
  555|     20|   accum.add(z[16]);
  556|     20|   ws[0] = accum.extract();
  557|     20|   accum.mul(ws[2], p[15]);
  558|     20|   accum.mul(ws[3], p[14]);
  559|     20|   accum.mul(ws[4], p[13]);
  560|     20|   accum.mul(ws[5], p[12]);
  561|     20|   accum.mul(ws[6], p[11]);
  562|     20|   accum.mul(ws[7], p[10]);
  563|     20|   accum.mul(ws[8], p[9]);
  564|     20|   accum.mul(ws[9], p[8]);
  565|     20|   accum.mul(ws[10], p[7]);
  566|     20|   accum.mul(ws[11], p[6]);
  567|     20|   accum.mul(ws[12], p[5]);
  568|     20|   accum.mul(ws[13], p[4]);
  569|     20|   accum.mul(ws[14], p[3]);
  570|     20|   accum.mul(ws[15], p[2]);
  571|     20|   accum.add(z[17]);
  572|     20|   ws[1] = accum.extract();
  573|     20|   accum.mul(ws[3], p[15]);
  574|     20|   accum.mul(ws[4], p[14]);
  575|     20|   accum.mul(ws[5], p[13]);
  576|     20|   accum.mul(ws[6], p[12]);
  577|     20|   accum.mul(ws[7], p[11]);
  578|     20|   accum.mul(ws[8], p[10]);
  579|     20|   accum.mul(ws[9], p[9]);
  580|     20|   accum.mul(ws[10], p[8]);
  581|     20|   accum.mul(ws[11], p[7]);
  582|     20|   accum.mul(ws[12], p[6]);
  583|     20|   accum.mul(ws[13], p[5]);
  584|     20|   accum.mul(ws[14], p[4]);
  585|     20|   accum.mul(ws[15], p[3]);
  586|     20|   accum.add(z[18]);
  587|     20|   ws[2] = accum.extract();
  588|     20|   accum.mul(ws[4], p[15]);
  589|     20|   accum.mul(ws[5], p[14]);
  590|     20|   accum.mul(ws[6], p[13]);
  591|     20|   accum.mul(ws[7], p[12]);
  592|     20|   accum.mul(ws[8], p[11]);
  593|     20|   accum.mul(ws[9], p[10]);
  594|     20|   accum.mul(ws[10], p[9]);
  595|     20|   accum.mul(ws[11], p[8]);
  596|     20|   accum.mul(ws[12], p[7]);
  597|     20|   accum.mul(ws[13], p[6]);
  598|     20|   accum.mul(ws[14], p[5]);
  599|     20|   accum.mul(ws[15], p[4]);
  600|     20|   accum.add(z[19]);
  601|     20|   ws[3] = accum.extract();
  602|     20|   accum.mul(ws[5], p[15]);
  603|     20|   accum.mul(ws[6], p[14]);
  604|     20|   accum.mul(ws[7], p[13]);
  605|     20|   accum.mul(ws[8], p[12]);
  606|     20|   accum.mul(ws[9], p[11]);
  607|     20|   accum.mul(ws[10], p[10]);
  608|     20|   accum.mul(ws[11], p[9]);
  609|     20|   accum.mul(ws[12], p[8]);
  610|     20|   accum.mul(ws[13], p[7]);
  611|     20|   accum.mul(ws[14], p[6]);
  612|     20|   accum.mul(ws[15], p[5]);
  613|     20|   accum.add(z[20]);
  614|     20|   ws[4] = accum.extract();
  615|     20|   accum.mul(ws[6], p[15]);
  616|     20|   accum.mul(ws[7], p[14]);
  617|     20|   accum.mul(ws[8], p[13]);
  618|     20|   accum.mul(ws[9], p[12]);
  619|     20|   accum.mul(ws[10], p[11]);
  620|     20|   accum.mul(ws[11], p[10]);
  621|     20|   accum.mul(ws[12], p[9]);
  622|     20|   accum.mul(ws[13], p[8]);
  623|     20|   accum.mul(ws[14], p[7]);
  624|     20|   accum.mul(ws[15], p[6]);
  625|     20|   accum.add(z[21]);
  626|     20|   ws[5] = accum.extract();
  627|     20|   accum.mul(ws[7], p[15]);
  628|     20|   accum.mul(ws[8], p[14]);
  629|     20|   accum.mul(ws[9], p[13]);
  630|     20|   accum.mul(ws[10], p[12]);
  631|     20|   accum.mul(ws[11], p[11]);
  632|     20|   accum.mul(ws[12], p[10]);
  633|     20|   accum.mul(ws[13], p[9]);
  634|     20|   accum.mul(ws[14], p[8]);
  635|     20|   accum.mul(ws[15], p[7]);
  636|     20|   accum.add(z[22]);
  637|     20|   ws[6] = accum.extract();
  638|     20|   accum.mul(ws[8], p[15]);
  639|     20|   accum.mul(ws[9], p[14]);
  640|     20|   accum.mul(ws[10], p[13]);
  641|     20|   accum.mul(ws[11], p[12]);
  642|     20|   accum.mul(ws[12], p[11]);
  643|     20|   accum.mul(ws[13], p[10]);
  644|     20|   accum.mul(ws[14], p[9]);
  645|     20|   accum.mul(ws[15], p[8]);
  646|     20|   accum.add(z[23]);
  647|     20|   ws[7] = accum.extract();
  648|     20|   accum.mul(ws[9], p[15]);
  649|     20|   accum.mul(ws[10], p[14]);
  650|     20|   accum.mul(ws[11], p[13]);
  651|     20|   accum.mul(ws[12], p[12]);
  652|     20|   accum.mul(ws[13], p[11]);
  653|     20|   accum.mul(ws[14], p[10]);
  654|     20|   accum.mul(ws[15], p[9]);
  655|     20|   accum.add(z[24]);
  656|     20|   ws[8] = accum.extract();
  657|     20|   accum.mul(ws[10], p[15]);
  658|     20|   accum.mul(ws[11], p[14]);
  659|     20|   accum.mul(ws[12], p[13]);
  660|     20|   accum.mul(ws[13], p[12]);
  661|     20|   accum.mul(ws[14], p[11]);
  662|     20|   accum.mul(ws[15], p[10]);
  663|     20|   accum.add(z[25]);
  664|     20|   ws[9] = accum.extract();
  665|     20|   accum.mul(ws[11], p[15]);
  666|     20|   accum.mul(ws[12], p[14]);
  667|     20|   accum.mul(ws[13], p[13]);
  668|     20|   accum.mul(ws[14], p[12]);
  669|     20|   accum.mul(ws[15], p[11]);
  670|     20|   accum.add(z[26]);
  671|     20|   ws[10] = accum.extract();
  672|     20|   accum.mul(ws[12], p[15]);
  673|     20|   accum.mul(ws[13], p[14]);
  674|     20|   accum.mul(ws[14], p[13]);
  675|     20|   accum.mul(ws[15], p[12]);
  676|     20|   accum.add(z[27]);
  677|     20|   ws[11] = accum.extract();
  678|     20|   accum.mul(ws[13], p[15]);
  679|     20|   accum.mul(ws[14], p[14]);
  680|     20|   accum.mul(ws[15], p[13]);
  681|     20|   accum.add(z[28]);
  682|     20|   ws[12] = accum.extract();
  683|     20|   accum.mul(ws[14], p[15]);
  684|     20|   accum.mul(ws[15], p[14]);
  685|     20|   accum.add(z[29]);
  686|     20|   ws[13] = accum.extract();
  687|     20|   accum.mul(ws[15], p[15]);
  688|     20|   accum.add(z[30]);
  689|     20|   ws[14] = accum.extract();
  690|     20|   accum.add(z[31]);
  691|     20|   ws[15] = accum.extract();
  692|     20|   const word w1 = accum.extract();
  693|     20|   bigint_monty_maybe_sub<16>(r, w1, ws, p);
  694|     20|}
_ZN5Botan20bigint_monty_redc_24EPmPKmS2_mS0_:
  696|     11|void bigint_monty_redc_24(word r[24], const word z[48], const word p[24], word p_dash, word ws[24]) {
  697|     11|   word3<word> accum;
  698|     11|   accum.add(z[0]);
  699|     11|   ws[0] = accum.monty_step(p[0], p_dash);
  700|     11|   accum.mul(ws[0], p[1]);
  701|     11|   accum.add(z[1]);
  702|     11|   ws[1] = accum.monty_step(p[0], p_dash);
  703|     11|   accum.mul(ws[0], p[2]);
  704|     11|   accum.mul(ws[1], p[1]);
  705|     11|   accum.add(z[2]);
  706|     11|   ws[2] = accum.monty_step(p[0], p_dash);
  707|     11|   accum.mul(ws[0], p[3]);
  708|     11|   accum.mul(ws[1], p[2]);
  709|     11|   accum.mul(ws[2], p[1]);
  710|     11|   accum.add(z[3]);
  711|     11|   ws[3] = accum.monty_step(p[0], p_dash);
  712|     11|   accum.mul(ws[0], p[4]);
  713|     11|   accum.mul(ws[1], p[3]);
  714|     11|   accum.mul(ws[2], p[2]);
  715|     11|   accum.mul(ws[3], p[1]);
  716|     11|   accum.add(z[4]);
  717|     11|   ws[4] = accum.monty_step(p[0], p_dash);
  718|     11|   accum.mul(ws[0], p[5]);
  719|     11|   accum.mul(ws[1], p[4]);
  720|     11|   accum.mul(ws[2], p[3]);
  721|     11|   accum.mul(ws[3], p[2]);
  722|     11|   accum.mul(ws[4], p[1]);
  723|     11|   accum.add(z[5]);
  724|     11|   ws[5] = accum.monty_step(p[0], p_dash);
  725|     11|   accum.mul(ws[0], p[6]);
  726|     11|   accum.mul(ws[1], p[5]);
  727|     11|   accum.mul(ws[2], p[4]);
  728|     11|   accum.mul(ws[3], p[3]);
  729|     11|   accum.mul(ws[4], p[2]);
  730|     11|   accum.mul(ws[5], p[1]);
  731|     11|   accum.add(z[6]);
  732|     11|   ws[6] = accum.monty_step(p[0], p_dash);
  733|     11|   accum.mul(ws[0], p[7]);
  734|     11|   accum.mul(ws[1], p[6]);
  735|     11|   accum.mul(ws[2], p[5]);
  736|     11|   accum.mul(ws[3], p[4]);
  737|     11|   accum.mul(ws[4], p[3]);
  738|     11|   accum.mul(ws[5], p[2]);
  739|     11|   accum.mul(ws[6], p[1]);
  740|     11|   accum.add(z[7]);
  741|     11|   ws[7] = accum.monty_step(p[0], p_dash);
  742|     11|   accum.mul(ws[0], p[8]);
  743|     11|   accum.mul(ws[1], p[7]);
  744|     11|   accum.mul(ws[2], p[6]);
  745|     11|   accum.mul(ws[3], p[5]);
  746|     11|   accum.mul(ws[4], p[4]);
  747|     11|   accum.mul(ws[5], p[3]);
  748|     11|   accum.mul(ws[6], p[2]);
  749|     11|   accum.mul(ws[7], p[1]);
  750|     11|   accum.add(z[8]);
  751|     11|   ws[8] = accum.monty_step(p[0], p_dash);
  752|     11|   accum.mul(ws[0], p[9]);
  753|     11|   accum.mul(ws[1], p[8]);
  754|     11|   accum.mul(ws[2], p[7]);
  755|     11|   accum.mul(ws[3], p[6]);
  756|     11|   accum.mul(ws[4], p[5]);
  757|     11|   accum.mul(ws[5], p[4]);
  758|     11|   accum.mul(ws[6], p[3]);
  759|     11|   accum.mul(ws[7], p[2]);
  760|     11|   accum.mul(ws[8], p[1]);
  761|     11|   accum.add(z[9]);
  762|     11|   ws[9] = accum.monty_step(p[0], p_dash);
  763|     11|   accum.mul(ws[0], p[10]);
  764|     11|   accum.mul(ws[1], p[9]);
  765|     11|   accum.mul(ws[2], p[8]);
  766|     11|   accum.mul(ws[3], p[7]);
  767|     11|   accum.mul(ws[4], p[6]);
  768|     11|   accum.mul(ws[5], p[5]);
  769|     11|   accum.mul(ws[6], p[4]);
  770|     11|   accum.mul(ws[7], p[3]);
  771|     11|   accum.mul(ws[8], p[2]);
  772|     11|   accum.mul(ws[9], p[1]);
  773|     11|   accum.add(z[10]);
  774|     11|   ws[10] = accum.monty_step(p[0], p_dash);
  775|     11|   accum.mul(ws[0], p[11]);
  776|     11|   accum.mul(ws[1], p[10]);
  777|     11|   accum.mul(ws[2], p[9]);
  778|     11|   accum.mul(ws[3], p[8]);
  779|     11|   accum.mul(ws[4], p[7]);
  780|     11|   accum.mul(ws[5], p[6]);
  781|     11|   accum.mul(ws[6], p[5]);
  782|     11|   accum.mul(ws[7], p[4]);
  783|     11|   accum.mul(ws[8], p[3]);
  784|     11|   accum.mul(ws[9], p[2]);
  785|     11|   accum.mul(ws[10], p[1]);
  786|     11|   accum.add(z[11]);
  787|     11|   ws[11] = accum.monty_step(p[0], p_dash);
  788|     11|   accum.mul(ws[0], p[12]);
  789|     11|   accum.mul(ws[1], p[11]);
  790|     11|   accum.mul(ws[2], p[10]);
  791|     11|   accum.mul(ws[3], p[9]);
  792|     11|   accum.mul(ws[4], p[8]);
  793|     11|   accum.mul(ws[5], p[7]);
  794|     11|   accum.mul(ws[6], p[6]);
  795|     11|   accum.mul(ws[7], p[5]);
  796|     11|   accum.mul(ws[8], p[4]);
  797|     11|   accum.mul(ws[9], p[3]);
  798|     11|   accum.mul(ws[10], p[2]);
  799|     11|   accum.mul(ws[11], p[1]);
  800|     11|   accum.add(z[12]);
  801|     11|   ws[12] = accum.monty_step(p[0], p_dash);
  802|     11|   accum.mul(ws[0], p[13]);
  803|     11|   accum.mul(ws[1], p[12]);
  804|     11|   accum.mul(ws[2], p[11]);
  805|     11|   accum.mul(ws[3], p[10]);
  806|     11|   accum.mul(ws[4], p[9]);
  807|     11|   accum.mul(ws[5], p[8]);
  808|     11|   accum.mul(ws[6], p[7]);
  809|     11|   accum.mul(ws[7], p[6]);
  810|     11|   accum.mul(ws[8], p[5]);
  811|     11|   accum.mul(ws[9], p[4]);
  812|     11|   accum.mul(ws[10], p[3]);
  813|     11|   accum.mul(ws[11], p[2]);
  814|     11|   accum.mul(ws[12], p[1]);
  815|     11|   accum.add(z[13]);
  816|     11|   ws[13] = accum.monty_step(p[0], p_dash);
  817|     11|   accum.mul(ws[0], p[14]);
  818|     11|   accum.mul(ws[1], p[13]);
  819|     11|   accum.mul(ws[2], p[12]);
  820|     11|   accum.mul(ws[3], p[11]);
  821|     11|   accum.mul(ws[4], p[10]);
  822|     11|   accum.mul(ws[5], p[9]);
  823|     11|   accum.mul(ws[6], p[8]);
  824|     11|   accum.mul(ws[7], p[7]);
  825|     11|   accum.mul(ws[8], p[6]);
  826|     11|   accum.mul(ws[9], p[5]);
  827|     11|   accum.mul(ws[10], p[4]);
  828|     11|   accum.mul(ws[11], p[3]);
  829|     11|   accum.mul(ws[12], p[2]);
  830|     11|   accum.mul(ws[13], p[1]);
  831|     11|   accum.add(z[14]);
  832|     11|   ws[14] = accum.monty_step(p[0], p_dash);
  833|     11|   accum.mul(ws[0], p[15]);
  834|     11|   accum.mul(ws[1], p[14]);
  835|     11|   accum.mul(ws[2], p[13]);
  836|     11|   accum.mul(ws[3], p[12]);
  837|     11|   accum.mul(ws[4], p[11]);
  838|     11|   accum.mul(ws[5], p[10]);
  839|     11|   accum.mul(ws[6], p[9]);
  840|     11|   accum.mul(ws[7], p[8]);
  841|     11|   accum.mul(ws[8], p[7]);
  842|     11|   accum.mul(ws[9], p[6]);
  843|     11|   accum.mul(ws[10], p[5]);
  844|     11|   accum.mul(ws[11], p[4]);
  845|     11|   accum.mul(ws[12], p[3]);
  846|     11|   accum.mul(ws[13], p[2]);
  847|     11|   accum.mul(ws[14], p[1]);
  848|     11|   accum.add(z[15]);
  849|     11|   ws[15] = accum.monty_step(p[0], p_dash);
  850|     11|   accum.mul(ws[0], p[16]);
  851|     11|   accum.mul(ws[1], p[15]);
  852|     11|   accum.mul(ws[2], p[14]);
  853|     11|   accum.mul(ws[3], p[13]);
  854|     11|   accum.mul(ws[4], p[12]);
  855|     11|   accum.mul(ws[5], p[11]);
  856|     11|   accum.mul(ws[6], p[10]);
  857|     11|   accum.mul(ws[7], p[9]);
  858|     11|   accum.mul(ws[8], p[8]);
  859|     11|   accum.mul(ws[9], p[7]);
  860|     11|   accum.mul(ws[10], p[6]);
  861|     11|   accum.mul(ws[11], p[5]);
  862|     11|   accum.mul(ws[12], p[4]);
  863|     11|   accum.mul(ws[13], p[3]);
  864|     11|   accum.mul(ws[14], p[2]);
  865|     11|   accum.mul(ws[15], p[1]);
  866|     11|   accum.add(z[16]);
  867|     11|   ws[16] = accum.monty_step(p[0], p_dash);
  868|     11|   accum.mul(ws[0], p[17]);
  869|     11|   accum.mul(ws[1], p[16]);
  870|     11|   accum.mul(ws[2], p[15]);
  871|     11|   accum.mul(ws[3], p[14]);
  872|     11|   accum.mul(ws[4], p[13]);
  873|     11|   accum.mul(ws[5], p[12]);
  874|     11|   accum.mul(ws[6], p[11]);
  875|     11|   accum.mul(ws[7], p[10]);
  876|     11|   accum.mul(ws[8], p[9]);
  877|     11|   accum.mul(ws[9], p[8]);
  878|     11|   accum.mul(ws[10], p[7]);
  879|     11|   accum.mul(ws[11], p[6]);
  880|     11|   accum.mul(ws[12], p[5]);
  881|     11|   accum.mul(ws[13], p[4]);
  882|     11|   accum.mul(ws[14], p[3]);
  883|     11|   accum.mul(ws[15], p[2]);
  884|     11|   accum.mul(ws[16], p[1]);
  885|     11|   accum.add(z[17]);
  886|     11|   ws[17] = accum.monty_step(p[0], p_dash);
  887|     11|   accum.mul(ws[0], p[18]);
  888|     11|   accum.mul(ws[1], p[17]);
  889|     11|   accum.mul(ws[2], p[16]);
  890|     11|   accum.mul(ws[3], p[15]);
  891|     11|   accum.mul(ws[4], p[14]);
  892|     11|   accum.mul(ws[5], p[13]);
  893|     11|   accum.mul(ws[6], p[12]);
  894|     11|   accum.mul(ws[7], p[11]);
  895|     11|   accum.mul(ws[8], p[10]);
  896|     11|   accum.mul(ws[9], p[9]);
  897|     11|   accum.mul(ws[10], p[8]);
  898|     11|   accum.mul(ws[11], p[7]);
  899|     11|   accum.mul(ws[12], p[6]);
  900|     11|   accum.mul(ws[13], p[5]);
  901|     11|   accum.mul(ws[14], p[4]);
  902|     11|   accum.mul(ws[15], p[3]);
  903|     11|   accum.mul(ws[16], p[2]);
  904|     11|   accum.mul(ws[17], p[1]);
  905|     11|   accum.add(z[18]);
  906|     11|   ws[18] = accum.monty_step(p[0], p_dash);
  907|     11|   accum.mul(ws[0], p[19]);
  908|     11|   accum.mul(ws[1], p[18]);
  909|     11|   accum.mul(ws[2], p[17]);
  910|     11|   accum.mul(ws[3], p[16]);
  911|     11|   accum.mul(ws[4], p[15]);
  912|     11|   accum.mul(ws[5], p[14]);
  913|     11|   accum.mul(ws[6], p[13]);
  914|     11|   accum.mul(ws[7], p[12]);
  915|     11|   accum.mul(ws[8], p[11]);
  916|     11|   accum.mul(ws[9], p[10]);
  917|     11|   accum.mul(ws[10], p[9]);
  918|     11|   accum.mul(ws[11], p[8]);
  919|     11|   accum.mul(ws[12], p[7]);
  920|     11|   accum.mul(ws[13], p[6]);
  921|     11|   accum.mul(ws[14], p[5]);
  922|     11|   accum.mul(ws[15], p[4]);
  923|     11|   accum.mul(ws[16], p[3]);
  924|     11|   accum.mul(ws[17], p[2]);
  925|     11|   accum.mul(ws[18], p[1]);
  926|     11|   accum.add(z[19]);
  927|     11|   ws[19] = accum.monty_step(p[0], p_dash);
  928|     11|   accum.mul(ws[0], p[20]);
  929|     11|   accum.mul(ws[1], p[19]);
  930|     11|   accum.mul(ws[2], p[18]);
  931|     11|   accum.mul(ws[3], p[17]);
  932|     11|   accum.mul(ws[4], p[16]);
  933|     11|   accum.mul(ws[5], p[15]);
  934|     11|   accum.mul(ws[6], p[14]);
  935|     11|   accum.mul(ws[7], p[13]);
  936|     11|   accum.mul(ws[8], p[12]);
  937|     11|   accum.mul(ws[9], p[11]);
  938|     11|   accum.mul(ws[10], p[10]);
  939|     11|   accum.mul(ws[11], p[9]);
  940|     11|   accum.mul(ws[12], p[8]);
  941|     11|   accum.mul(ws[13], p[7]);
  942|     11|   accum.mul(ws[14], p[6]);
  943|     11|   accum.mul(ws[15], p[5]);
  944|     11|   accum.mul(ws[16], p[4]);
  945|     11|   accum.mul(ws[17], p[3]);
  946|     11|   accum.mul(ws[18], p[2]);
  947|     11|   accum.mul(ws[19], p[1]);
  948|     11|   accum.add(z[20]);
  949|     11|   ws[20] = accum.monty_step(p[0], p_dash);
  950|     11|   accum.mul(ws[0], p[21]);
  951|     11|   accum.mul(ws[1], p[20]);
  952|     11|   accum.mul(ws[2], p[19]);
  953|     11|   accum.mul(ws[3], p[18]);
  954|     11|   accum.mul(ws[4], p[17]);
  955|     11|   accum.mul(ws[5], p[16]);
  956|     11|   accum.mul(ws[6], p[15]);
  957|     11|   accum.mul(ws[7], p[14]);
  958|     11|   accum.mul(ws[8], p[13]);
  959|     11|   accum.mul(ws[9], p[12]);
  960|     11|   accum.mul(ws[10], p[11]);
  961|     11|   accum.mul(ws[11], p[10]);
  962|     11|   accum.mul(ws[12], p[9]);
  963|     11|   accum.mul(ws[13], p[8]);
  964|     11|   accum.mul(ws[14], p[7]);
  965|     11|   accum.mul(ws[15], p[6]);
  966|     11|   accum.mul(ws[16], p[5]);
  967|     11|   accum.mul(ws[17], p[4]);
  968|     11|   accum.mul(ws[18], p[3]);
  969|     11|   accum.mul(ws[19], p[2]);
  970|     11|   accum.mul(ws[20], p[1]);
  971|     11|   accum.add(z[21]);
  972|     11|   ws[21] = accum.monty_step(p[0], p_dash);
  973|     11|   accum.mul(ws[0], p[22]);
  974|     11|   accum.mul(ws[1], p[21]);
  975|     11|   accum.mul(ws[2], p[20]);
  976|     11|   accum.mul(ws[3], p[19]);
  977|     11|   accum.mul(ws[4], p[18]);
  978|     11|   accum.mul(ws[5], p[17]);
  979|     11|   accum.mul(ws[6], p[16]);
  980|     11|   accum.mul(ws[7], p[15]);
  981|     11|   accum.mul(ws[8], p[14]);
  982|     11|   accum.mul(ws[9], p[13]);
  983|     11|   accum.mul(ws[10], p[12]);
  984|     11|   accum.mul(ws[11], p[11]);
  985|     11|   accum.mul(ws[12], p[10]);
  986|     11|   accum.mul(ws[13], p[9]);
  987|     11|   accum.mul(ws[14], p[8]);
  988|     11|   accum.mul(ws[15], p[7]);
  989|     11|   accum.mul(ws[16], p[6]);
  990|     11|   accum.mul(ws[17], p[5]);
  991|     11|   accum.mul(ws[18], p[4]);
  992|     11|   accum.mul(ws[19], p[3]);
  993|     11|   accum.mul(ws[20], p[2]);
  994|     11|   accum.mul(ws[21], p[1]);
  995|     11|   accum.add(z[22]);
  996|     11|   ws[22] = accum.monty_step(p[0], p_dash);
  997|     11|   accum.mul(ws[0], p[23]);
  998|     11|   accum.mul(ws[1], p[22]);
  999|     11|   accum.mul(ws[2], p[21]);
 1000|     11|   accum.mul(ws[3], p[20]);
 1001|     11|   accum.mul(ws[4], p[19]);
 1002|     11|   accum.mul(ws[5], p[18]);
 1003|     11|   accum.mul(ws[6], p[17]);
 1004|     11|   accum.mul(ws[7], p[16]);
 1005|     11|   accum.mul(ws[8], p[15]);
 1006|     11|   accum.mul(ws[9], p[14]);
 1007|     11|   accum.mul(ws[10], p[13]);
 1008|     11|   accum.mul(ws[11], p[12]);
 1009|     11|   accum.mul(ws[12], p[11]);
 1010|     11|   accum.mul(ws[13], p[10]);
 1011|     11|   accum.mul(ws[14], p[9]);
 1012|     11|   accum.mul(ws[15], p[8]);
 1013|     11|   accum.mul(ws[16], p[7]);
 1014|     11|   accum.mul(ws[17], p[6]);
 1015|     11|   accum.mul(ws[18], p[5]);
 1016|     11|   accum.mul(ws[19], p[4]);
 1017|     11|   accum.mul(ws[20], p[3]);
 1018|     11|   accum.mul(ws[21], p[2]);
 1019|     11|   accum.mul(ws[22], p[1]);
 1020|     11|   accum.add(z[23]);
 1021|     11|   ws[23] = accum.monty_step(p[0], p_dash);
 1022|     11|   accum.mul(ws[1], p[23]);
 1023|     11|   accum.mul(ws[2], p[22]);
 1024|     11|   accum.mul(ws[3], p[21]);
 1025|     11|   accum.mul(ws[4], p[20]);
 1026|     11|   accum.mul(ws[5], p[19]);
 1027|     11|   accum.mul(ws[6], p[18]);
 1028|     11|   accum.mul(ws[7], p[17]);
 1029|     11|   accum.mul(ws[8], p[16]);
 1030|     11|   accum.mul(ws[9], p[15]);
 1031|     11|   accum.mul(ws[10], p[14]);
 1032|     11|   accum.mul(ws[11], p[13]);
 1033|     11|   accum.mul(ws[12], p[12]);
 1034|     11|   accum.mul(ws[13], p[11]);
 1035|     11|   accum.mul(ws[14], p[10]);
 1036|     11|   accum.mul(ws[15], p[9]);
 1037|     11|   accum.mul(ws[16], p[8]);
 1038|     11|   accum.mul(ws[17], p[7]);
 1039|     11|   accum.mul(ws[18], p[6]);
 1040|     11|   accum.mul(ws[19], p[5]);
 1041|     11|   accum.mul(ws[20], p[4]);
 1042|     11|   accum.mul(ws[21], p[3]);
 1043|     11|   accum.mul(ws[22], p[2]);
 1044|     11|   accum.mul(ws[23], p[1]);
 1045|     11|   accum.add(z[24]);
 1046|     11|   ws[0] = accum.extract();
 1047|     11|   accum.mul(ws[2], p[23]);
 1048|     11|   accum.mul(ws[3], p[22]);
 1049|     11|   accum.mul(ws[4], p[21]);
 1050|     11|   accum.mul(ws[5], p[20]);
 1051|     11|   accum.mul(ws[6], p[19]);
 1052|     11|   accum.mul(ws[7], p[18]);
 1053|     11|   accum.mul(ws[8], p[17]);
 1054|     11|   accum.mul(ws[9], p[16]);
 1055|     11|   accum.mul(ws[10], p[15]);
 1056|     11|   accum.mul(ws[11], p[14]);
 1057|     11|   accum.mul(ws[12], p[13]);
 1058|     11|   accum.mul(ws[13], p[12]);
 1059|     11|   accum.mul(ws[14], p[11]);
 1060|     11|   accum.mul(ws[15], p[10]);
 1061|     11|   accum.mul(ws[16], p[9]);
 1062|     11|   accum.mul(ws[17], p[8]);
 1063|     11|   accum.mul(ws[18], p[7]);
 1064|     11|   accum.mul(ws[19], p[6]);
 1065|     11|   accum.mul(ws[20], p[5]);
 1066|     11|   accum.mul(ws[21], p[4]);
 1067|     11|   accum.mul(ws[22], p[3]);
 1068|     11|   accum.mul(ws[23], p[2]);
 1069|     11|   accum.add(z[25]);
 1070|     11|   ws[1] = accum.extract();
 1071|     11|   accum.mul(ws[3], p[23]);
 1072|     11|   accum.mul(ws[4], p[22]);
 1073|     11|   accum.mul(ws[5], p[21]);
 1074|     11|   accum.mul(ws[6], p[20]);
 1075|     11|   accum.mul(ws[7], p[19]);
 1076|     11|   accum.mul(ws[8], p[18]);
 1077|     11|   accum.mul(ws[9], p[17]);
 1078|     11|   accum.mul(ws[10], p[16]);
 1079|     11|   accum.mul(ws[11], p[15]);
 1080|     11|   accum.mul(ws[12], p[14]);
 1081|     11|   accum.mul(ws[13], p[13]);
 1082|     11|   accum.mul(ws[14], p[12]);
 1083|     11|   accum.mul(ws[15], p[11]);
 1084|     11|   accum.mul(ws[16], p[10]);
 1085|     11|   accum.mul(ws[17], p[9]);
 1086|     11|   accum.mul(ws[18], p[8]);
 1087|     11|   accum.mul(ws[19], p[7]);
 1088|     11|   accum.mul(ws[20], p[6]);
 1089|     11|   accum.mul(ws[21], p[5]);
 1090|     11|   accum.mul(ws[22], p[4]);
 1091|     11|   accum.mul(ws[23], p[3]);
 1092|     11|   accum.add(z[26]);
 1093|     11|   ws[2] = accum.extract();
 1094|     11|   accum.mul(ws[4], p[23]);
 1095|     11|   accum.mul(ws[5], p[22]);
 1096|     11|   accum.mul(ws[6], p[21]);
 1097|     11|   accum.mul(ws[7], p[20]);
 1098|     11|   accum.mul(ws[8], p[19]);
 1099|     11|   accum.mul(ws[9], p[18]);
 1100|     11|   accum.mul(ws[10], p[17]);
 1101|     11|   accum.mul(ws[11], p[16]);
 1102|     11|   accum.mul(ws[12], p[15]);
 1103|     11|   accum.mul(ws[13], p[14]);
 1104|     11|   accum.mul(ws[14], p[13]);
 1105|     11|   accum.mul(ws[15], p[12]);
 1106|     11|   accum.mul(ws[16], p[11]);
 1107|     11|   accum.mul(ws[17], p[10]);
 1108|     11|   accum.mul(ws[18], p[9]);
 1109|     11|   accum.mul(ws[19], p[8]);
 1110|     11|   accum.mul(ws[20], p[7]);
 1111|     11|   accum.mul(ws[21], p[6]);
 1112|     11|   accum.mul(ws[22], p[5]);
 1113|     11|   accum.mul(ws[23], p[4]);
 1114|     11|   accum.add(z[27]);
 1115|     11|   ws[3] = accum.extract();
 1116|     11|   accum.mul(ws[5], p[23]);
 1117|     11|   accum.mul(ws[6], p[22]);
 1118|     11|   accum.mul(ws[7], p[21]);
 1119|     11|   accum.mul(ws[8], p[20]);
 1120|     11|   accum.mul(ws[9], p[19]);
 1121|     11|   accum.mul(ws[10], p[18]);
 1122|     11|   accum.mul(ws[11], p[17]);
 1123|     11|   accum.mul(ws[12], p[16]);
 1124|     11|   accum.mul(ws[13], p[15]);
 1125|     11|   accum.mul(ws[14], p[14]);
 1126|     11|   accum.mul(ws[15], p[13]);
 1127|     11|   accum.mul(ws[16], p[12]);
 1128|     11|   accum.mul(ws[17], p[11]);
 1129|     11|   accum.mul(ws[18], p[10]);
 1130|     11|   accum.mul(ws[19], p[9]);
 1131|     11|   accum.mul(ws[20], p[8]);
 1132|     11|   accum.mul(ws[21], p[7]);
 1133|     11|   accum.mul(ws[22], p[6]);
 1134|     11|   accum.mul(ws[23], p[5]);
 1135|     11|   accum.add(z[28]);
 1136|     11|   ws[4] = accum.extract();
 1137|     11|   accum.mul(ws[6], p[23]);
 1138|     11|   accum.mul(ws[7], p[22]);
 1139|     11|   accum.mul(ws[8], p[21]);
 1140|     11|   accum.mul(ws[9], p[20]);
 1141|     11|   accum.mul(ws[10], p[19]);
 1142|     11|   accum.mul(ws[11], p[18]);
 1143|     11|   accum.mul(ws[12], p[17]);
 1144|     11|   accum.mul(ws[13], p[16]);
 1145|     11|   accum.mul(ws[14], p[15]);
 1146|     11|   accum.mul(ws[15], p[14]);
 1147|     11|   accum.mul(ws[16], p[13]);
 1148|     11|   accum.mul(ws[17], p[12]);
 1149|     11|   accum.mul(ws[18], p[11]);
 1150|     11|   accum.mul(ws[19], p[10]);
 1151|     11|   accum.mul(ws[20], p[9]);
 1152|     11|   accum.mul(ws[21], p[8]);
 1153|     11|   accum.mul(ws[22], p[7]);
 1154|     11|   accum.mul(ws[23], p[6]);
 1155|     11|   accum.add(z[29]);
 1156|     11|   ws[5] = accum.extract();
 1157|     11|   accum.mul(ws[7], p[23]);
 1158|     11|   accum.mul(ws[8], p[22]);
 1159|     11|   accum.mul(ws[9], p[21]);
 1160|     11|   accum.mul(ws[10], p[20]);
 1161|     11|   accum.mul(ws[11], p[19]);
 1162|     11|   accum.mul(ws[12], p[18]);
 1163|     11|   accum.mul(ws[13], p[17]);
 1164|     11|   accum.mul(ws[14], p[16]);
 1165|     11|   accum.mul(ws[15], p[15]);
 1166|     11|   accum.mul(ws[16], p[14]);
 1167|     11|   accum.mul(ws[17], p[13]);
 1168|     11|   accum.mul(ws[18], p[12]);
 1169|     11|   accum.mul(ws[19], p[11]);
 1170|     11|   accum.mul(ws[20], p[10]);
 1171|     11|   accum.mul(ws[21], p[9]);
 1172|     11|   accum.mul(ws[22], p[8]);
 1173|     11|   accum.mul(ws[23], p[7]);
 1174|     11|   accum.add(z[30]);
 1175|     11|   ws[6] = accum.extract();
 1176|     11|   accum.mul(ws[8], p[23]);
 1177|     11|   accum.mul(ws[9], p[22]);
 1178|     11|   accum.mul(ws[10], p[21]);
 1179|     11|   accum.mul(ws[11], p[20]);
 1180|     11|   accum.mul(ws[12], p[19]);
 1181|     11|   accum.mul(ws[13], p[18]);
 1182|     11|   accum.mul(ws[14], p[17]);
 1183|     11|   accum.mul(ws[15], p[16]);
 1184|     11|   accum.mul(ws[16], p[15]);
 1185|     11|   accum.mul(ws[17], p[14]);
 1186|     11|   accum.mul(ws[18], p[13]);
 1187|     11|   accum.mul(ws[19], p[12]);
 1188|     11|   accum.mul(ws[20], p[11]);
 1189|     11|   accum.mul(ws[21], p[10]);
 1190|     11|   accum.mul(ws[22], p[9]);
 1191|     11|   accum.mul(ws[23], p[8]);
 1192|     11|   accum.add(z[31]);
 1193|     11|   ws[7] = accum.extract();
 1194|     11|   accum.mul(ws[9], p[23]);
 1195|     11|   accum.mul(ws[10], p[22]);
 1196|     11|   accum.mul(ws[11], p[21]);
 1197|     11|   accum.mul(ws[12], p[20]);
 1198|     11|   accum.mul(ws[13], p[19]);
 1199|     11|   accum.mul(ws[14], p[18]);
 1200|     11|   accum.mul(ws[15], p[17]);
 1201|     11|   accum.mul(ws[16], p[16]);
 1202|     11|   accum.mul(ws[17], p[15]);
 1203|     11|   accum.mul(ws[18], p[14]);
 1204|     11|   accum.mul(ws[19], p[13]);
 1205|     11|   accum.mul(ws[20], p[12]);
 1206|     11|   accum.mul(ws[21], p[11]);
 1207|     11|   accum.mul(ws[22], p[10]);
 1208|     11|   accum.mul(ws[23], p[9]);
 1209|     11|   accum.add(z[32]);
 1210|     11|   ws[8] = accum.extract();
 1211|     11|   accum.mul(ws[10], p[23]);
 1212|     11|   accum.mul(ws[11], p[22]);
 1213|     11|   accum.mul(ws[12], p[21]);
 1214|     11|   accum.mul(ws[13], p[20]);
 1215|     11|   accum.mul(ws[14], p[19]);
 1216|     11|   accum.mul(ws[15], p[18]);
 1217|     11|   accum.mul(ws[16], p[17]);
 1218|     11|   accum.mul(ws[17], p[16]);
 1219|     11|   accum.mul(ws[18], p[15]);
 1220|     11|   accum.mul(ws[19], p[14]);
 1221|     11|   accum.mul(ws[20], p[13]);
 1222|     11|   accum.mul(ws[21], p[12]);
 1223|     11|   accum.mul(ws[22], p[11]);
 1224|     11|   accum.mul(ws[23], p[10]);
 1225|     11|   accum.add(z[33]);
 1226|     11|   ws[9] = accum.extract();
 1227|     11|   accum.mul(ws[11], p[23]);
 1228|     11|   accum.mul(ws[12], p[22]);
 1229|     11|   accum.mul(ws[13], p[21]);
 1230|     11|   accum.mul(ws[14], p[20]);
 1231|     11|   accum.mul(ws[15], p[19]);
 1232|     11|   accum.mul(ws[16], p[18]);
 1233|     11|   accum.mul(ws[17], p[17]);
 1234|     11|   accum.mul(ws[18], p[16]);
 1235|     11|   accum.mul(ws[19], p[15]);
 1236|     11|   accum.mul(ws[20], p[14]);
 1237|     11|   accum.mul(ws[21], p[13]);
 1238|     11|   accum.mul(ws[22], p[12]);
 1239|     11|   accum.mul(ws[23], p[11]);
 1240|     11|   accum.add(z[34]);
 1241|     11|   ws[10] = accum.extract();
 1242|     11|   accum.mul(ws[12], p[23]);
 1243|     11|   accum.mul(ws[13], p[22]);
 1244|     11|   accum.mul(ws[14], p[21]);
 1245|     11|   accum.mul(ws[15], p[20]);
 1246|     11|   accum.mul(ws[16], p[19]);
 1247|     11|   accum.mul(ws[17], p[18]);
 1248|     11|   accum.mul(ws[18], p[17]);
 1249|     11|   accum.mul(ws[19], p[16]);
 1250|     11|   accum.mul(ws[20], p[15]);
 1251|     11|   accum.mul(ws[21], p[14]);
 1252|     11|   accum.mul(ws[22], p[13]);
 1253|     11|   accum.mul(ws[23], p[12]);
 1254|     11|   accum.add(z[35]);
 1255|     11|   ws[11] = accum.extract();
 1256|     11|   accum.mul(ws[13], p[23]);
 1257|     11|   accum.mul(ws[14], p[22]);
 1258|     11|   accum.mul(ws[15], p[21]);
 1259|     11|   accum.mul(ws[16], p[20]);
 1260|     11|   accum.mul(ws[17], p[19]);
 1261|     11|   accum.mul(ws[18], p[18]);
 1262|     11|   accum.mul(ws[19], p[17]);
 1263|     11|   accum.mul(ws[20], p[16]);
 1264|     11|   accum.mul(ws[21], p[15]);
 1265|     11|   accum.mul(ws[22], p[14]);
 1266|     11|   accum.mul(ws[23], p[13]);
 1267|     11|   accum.add(z[36]);
 1268|     11|   ws[12] = accum.extract();
 1269|     11|   accum.mul(ws[14], p[23]);
 1270|     11|   accum.mul(ws[15], p[22]);
 1271|     11|   accum.mul(ws[16], p[21]);
 1272|     11|   accum.mul(ws[17], p[20]);
 1273|     11|   accum.mul(ws[18], p[19]);
 1274|     11|   accum.mul(ws[19], p[18]);
 1275|     11|   accum.mul(ws[20], p[17]);
 1276|     11|   accum.mul(ws[21], p[16]);
 1277|     11|   accum.mul(ws[22], p[15]);
 1278|     11|   accum.mul(ws[23], p[14]);
 1279|     11|   accum.add(z[37]);
 1280|     11|   ws[13] = accum.extract();
 1281|     11|   accum.mul(ws[15], p[23]);
 1282|     11|   accum.mul(ws[16], p[22]);
 1283|     11|   accum.mul(ws[17], p[21]);
 1284|     11|   accum.mul(ws[18], p[20]);
 1285|     11|   accum.mul(ws[19], p[19]);
 1286|     11|   accum.mul(ws[20], p[18]);
 1287|     11|   accum.mul(ws[21], p[17]);
 1288|     11|   accum.mul(ws[22], p[16]);
 1289|     11|   accum.mul(ws[23], p[15]);
 1290|     11|   accum.add(z[38]);
 1291|     11|   ws[14] = accum.extract();
 1292|     11|   accum.mul(ws[16], p[23]);
 1293|     11|   accum.mul(ws[17], p[22]);
 1294|     11|   accum.mul(ws[18], p[21]);
 1295|     11|   accum.mul(ws[19], p[20]);
 1296|     11|   accum.mul(ws[20], p[19]);
 1297|     11|   accum.mul(ws[21], p[18]);
 1298|     11|   accum.mul(ws[22], p[17]);
 1299|     11|   accum.mul(ws[23], p[16]);
 1300|     11|   accum.add(z[39]);
 1301|     11|   ws[15] = accum.extract();
 1302|     11|   accum.mul(ws[17], p[23]);
 1303|     11|   accum.mul(ws[18], p[22]);
 1304|     11|   accum.mul(ws[19], p[21]);
 1305|     11|   accum.mul(ws[20], p[20]);
 1306|     11|   accum.mul(ws[21], p[19]);
 1307|     11|   accum.mul(ws[22], p[18]);
 1308|     11|   accum.mul(ws[23], p[17]);
 1309|     11|   accum.add(z[40]);
 1310|     11|   ws[16] = accum.extract();
 1311|     11|   accum.mul(ws[18], p[23]);
 1312|     11|   accum.mul(ws[19], p[22]);
 1313|     11|   accum.mul(ws[20], p[21]);
 1314|     11|   accum.mul(ws[21], p[20]);
 1315|     11|   accum.mul(ws[22], p[19]);
 1316|     11|   accum.mul(ws[23], p[18]);
 1317|     11|   accum.add(z[41]);
 1318|     11|   ws[17] = accum.extract();
 1319|     11|   accum.mul(ws[19], p[23]);
 1320|     11|   accum.mul(ws[20], p[22]);
 1321|     11|   accum.mul(ws[21], p[21]);
 1322|     11|   accum.mul(ws[22], p[20]);
 1323|     11|   accum.mul(ws[23], p[19]);
 1324|     11|   accum.add(z[42]);
 1325|     11|   ws[18] = accum.extract();
 1326|     11|   accum.mul(ws[20], p[23]);
 1327|     11|   accum.mul(ws[21], p[22]);
 1328|     11|   accum.mul(ws[22], p[21]);
 1329|     11|   accum.mul(ws[23], p[20]);
 1330|     11|   accum.add(z[43]);
 1331|     11|   ws[19] = accum.extract();
 1332|     11|   accum.mul(ws[21], p[23]);
 1333|     11|   accum.mul(ws[22], p[22]);
 1334|     11|   accum.mul(ws[23], p[21]);
 1335|     11|   accum.add(z[44]);
 1336|     11|   ws[20] = accum.extract();
 1337|     11|   accum.mul(ws[22], p[23]);
 1338|     11|   accum.mul(ws[23], p[22]);
 1339|     11|   accum.add(z[45]);
 1340|     11|   ws[21] = accum.extract();
 1341|     11|   accum.mul(ws[23], p[23]);
 1342|     11|   accum.add(z[46]);
 1343|     11|   ws[22] = accum.extract();
 1344|     11|   accum.add(z[47]);
 1345|     11|   ws[23] = accum.extract();
 1346|     11|   const word w1 = accum.extract();
 1347|     11|   bigint_monty_maybe_sub<24>(r, w1, ws, p);
 1348|     11|}
_ZN5Botan20bigint_monty_redc_32EPmPKmS2_mS0_:
 1350|     15|void bigint_monty_redc_32(word r[32], const word z[64], const word p[32], word p_dash, word ws[32]) {
 1351|     15|   word3<word> accum;
 1352|     15|   accum.add(z[0]);
 1353|     15|   ws[0] = accum.monty_step(p[0], p_dash);
 1354|     15|   accum.mul(ws[0], p[1]);
 1355|     15|   accum.add(z[1]);
 1356|     15|   ws[1] = accum.monty_step(p[0], p_dash);
 1357|     15|   accum.mul(ws[0], p[2]);
 1358|     15|   accum.mul(ws[1], p[1]);
 1359|     15|   accum.add(z[2]);
 1360|     15|   ws[2] = accum.monty_step(p[0], p_dash);
 1361|     15|   accum.mul(ws[0], p[3]);
 1362|     15|   accum.mul(ws[1], p[2]);
 1363|     15|   accum.mul(ws[2], p[1]);
 1364|     15|   accum.add(z[3]);
 1365|     15|   ws[3] = accum.monty_step(p[0], p_dash);
 1366|     15|   accum.mul(ws[0], p[4]);
 1367|     15|   accum.mul(ws[1], p[3]);
 1368|     15|   accum.mul(ws[2], p[2]);
 1369|     15|   accum.mul(ws[3], p[1]);
 1370|     15|   accum.add(z[4]);
 1371|     15|   ws[4] = accum.monty_step(p[0], p_dash);
 1372|     15|   accum.mul(ws[0], p[5]);
 1373|     15|   accum.mul(ws[1], p[4]);
 1374|     15|   accum.mul(ws[2], p[3]);
 1375|     15|   accum.mul(ws[3], p[2]);
 1376|     15|   accum.mul(ws[4], p[1]);
 1377|     15|   accum.add(z[5]);
 1378|     15|   ws[5] = accum.monty_step(p[0], p_dash);
 1379|     15|   accum.mul(ws[0], p[6]);
 1380|     15|   accum.mul(ws[1], p[5]);
 1381|     15|   accum.mul(ws[2], p[4]);
 1382|     15|   accum.mul(ws[3], p[3]);
 1383|     15|   accum.mul(ws[4], p[2]);
 1384|     15|   accum.mul(ws[5], p[1]);
 1385|     15|   accum.add(z[6]);
 1386|     15|   ws[6] = accum.monty_step(p[0], p_dash);
 1387|     15|   accum.mul(ws[0], p[7]);
 1388|     15|   accum.mul(ws[1], p[6]);
 1389|     15|   accum.mul(ws[2], p[5]);
 1390|     15|   accum.mul(ws[3], p[4]);
 1391|     15|   accum.mul(ws[4], p[3]);
 1392|     15|   accum.mul(ws[5], p[2]);
 1393|     15|   accum.mul(ws[6], p[1]);
 1394|     15|   accum.add(z[7]);
 1395|     15|   ws[7] = accum.monty_step(p[0], p_dash);
 1396|     15|   accum.mul(ws[0], p[8]);
 1397|     15|   accum.mul(ws[1], p[7]);
 1398|     15|   accum.mul(ws[2], p[6]);
 1399|     15|   accum.mul(ws[3], p[5]);
 1400|     15|   accum.mul(ws[4], p[4]);
 1401|     15|   accum.mul(ws[5], p[3]);
 1402|     15|   accum.mul(ws[6], p[2]);
 1403|     15|   accum.mul(ws[7], p[1]);
 1404|     15|   accum.add(z[8]);
 1405|     15|   ws[8] = accum.monty_step(p[0], p_dash);
 1406|     15|   accum.mul(ws[0], p[9]);
 1407|     15|   accum.mul(ws[1], p[8]);
 1408|     15|   accum.mul(ws[2], p[7]);
 1409|     15|   accum.mul(ws[3], p[6]);
 1410|     15|   accum.mul(ws[4], p[5]);
 1411|     15|   accum.mul(ws[5], p[4]);
 1412|     15|   accum.mul(ws[6], p[3]);
 1413|     15|   accum.mul(ws[7], p[2]);
 1414|     15|   accum.mul(ws[8], p[1]);
 1415|     15|   accum.add(z[9]);
 1416|     15|   ws[9] = accum.monty_step(p[0], p_dash);
 1417|     15|   accum.mul(ws[0], p[10]);
 1418|     15|   accum.mul(ws[1], p[9]);
 1419|     15|   accum.mul(ws[2], p[8]);
 1420|     15|   accum.mul(ws[3], p[7]);
 1421|     15|   accum.mul(ws[4], p[6]);
 1422|     15|   accum.mul(ws[5], p[5]);
 1423|     15|   accum.mul(ws[6], p[4]);
 1424|     15|   accum.mul(ws[7], p[3]);
 1425|     15|   accum.mul(ws[8], p[2]);
 1426|     15|   accum.mul(ws[9], p[1]);
 1427|     15|   accum.add(z[10]);
 1428|     15|   ws[10] = accum.monty_step(p[0], p_dash);
 1429|     15|   accum.mul(ws[0], p[11]);
 1430|     15|   accum.mul(ws[1], p[10]);
 1431|     15|   accum.mul(ws[2], p[9]);
 1432|     15|   accum.mul(ws[3], p[8]);
 1433|     15|   accum.mul(ws[4], p[7]);
 1434|     15|   accum.mul(ws[5], p[6]);
 1435|     15|   accum.mul(ws[6], p[5]);
 1436|     15|   accum.mul(ws[7], p[4]);
 1437|     15|   accum.mul(ws[8], p[3]);
 1438|     15|   accum.mul(ws[9], p[2]);
 1439|     15|   accum.mul(ws[10], p[1]);
 1440|     15|   accum.add(z[11]);
 1441|     15|   ws[11] = accum.monty_step(p[0], p_dash);
 1442|     15|   accum.mul(ws[0], p[12]);
 1443|     15|   accum.mul(ws[1], p[11]);
 1444|     15|   accum.mul(ws[2], p[10]);
 1445|     15|   accum.mul(ws[3], p[9]);
 1446|     15|   accum.mul(ws[4], p[8]);
 1447|     15|   accum.mul(ws[5], p[7]);
 1448|     15|   accum.mul(ws[6], p[6]);
 1449|     15|   accum.mul(ws[7], p[5]);
 1450|     15|   accum.mul(ws[8], p[4]);
 1451|     15|   accum.mul(ws[9], p[3]);
 1452|     15|   accum.mul(ws[10], p[2]);
 1453|     15|   accum.mul(ws[11], p[1]);
 1454|     15|   accum.add(z[12]);
 1455|     15|   ws[12] = accum.monty_step(p[0], p_dash);
 1456|     15|   accum.mul(ws[0], p[13]);
 1457|     15|   accum.mul(ws[1], p[12]);
 1458|     15|   accum.mul(ws[2], p[11]);
 1459|     15|   accum.mul(ws[3], p[10]);
 1460|     15|   accum.mul(ws[4], p[9]);
 1461|     15|   accum.mul(ws[5], p[8]);
 1462|     15|   accum.mul(ws[6], p[7]);
 1463|     15|   accum.mul(ws[7], p[6]);
 1464|     15|   accum.mul(ws[8], p[5]);
 1465|     15|   accum.mul(ws[9], p[4]);
 1466|     15|   accum.mul(ws[10], p[3]);
 1467|     15|   accum.mul(ws[11], p[2]);
 1468|     15|   accum.mul(ws[12], p[1]);
 1469|     15|   accum.add(z[13]);
 1470|     15|   ws[13] = accum.monty_step(p[0], p_dash);
 1471|     15|   accum.mul(ws[0], p[14]);
 1472|     15|   accum.mul(ws[1], p[13]);
 1473|     15|   accum.mul(ws[2], p[12]);
 1474|     15|   accum.mul(ws[3], p[11]);
 1475|     15|   accum.mul(ws[4], p[10]);
 1476|     15|   accum.mul(ws[5], p[9]);
 1477|     15|   accum.mul(ws[6], p[8]);
 1478|     15|   accum.mul(ws[7], p[7]);
 1479|     15|   accum.mul(ws[8], p[6]);
 1480|     15|   accum.mul(ws[9], p[5]);
 1481|     15|   accum.mul(ws[10], p[4]);
 1482|     15|   accum.mul(ws[11], p[3]);
 1483|     15|   accum.mul(ws[12], p[2]);
 1484|     15|   accum.mul(ws[13], p[1]);
 1485|     15|   accum.add(z[14]);
 1486|     15|   ws[14] = accum.monty_step(p[0], p_dash);
 1487|     15|   accum.mul(ws[0], p[15]);
 1488|     15|   accum.mul(ws[1], p[14]);
 1489|     15|   accum.mul(ws[2], p[13]);
 1490|     15|   accum.mul(ws[3], p[12]);
 1491|     15|   accum.mul(ws[4], p[11]);
 1492|     15|   accum.mul(ws[5], p[10]);
 1493|     15|   accum.mul(ws[6], p[9]);
 1494|     15|   accum.mul(ws[7], p[8]);
 1495|     15|   accum.mul(ws[8], p[7]);
 1496|     15|   accum.mul(ws[9], p[6]);
 1497|     15|   accum.mul(ws[10], p[5]);
 1498|     15|   accum.mul(ws[11], p[4]);
 1499|     15|   accum.mul(ws[12], p[3]);
 1500|     15|   accum.mul(ws[13], p[2]);
 1501|     15|   accum.mul(ws[14], p[1]);
 1502|     15|   accum.add(z[15]);
 1503|     15|   ws[15] = accum.monty_step(p[0], p_dash);
 1504|     15|   accum.mul(ws[0], p[16]);
 1505|     15|   accum.mul(ws[1], p[15]);
 1506|     15|   accum.mul(ws[2], p[14]);
 1507|     15|   accum.mul(ws[3], p[13]);
 1508|     15|   accum.mul(ws[4], p[12]);
 1509|     15|   accum.mul(ws[5], p[11]);
 1510|     15|   accum.mul(ws[6], p[10]);
 1511|     15|   accum.mul(ws[7], p[9]);
 1512|     15|   accum.mul(ws[8], p[8]);
 1513|     15|   accum.mul(ws[9], p[7]);
 1514|     15|   accum.mul(ws[10], p[6]);
 1515|     15|   accum.mul(ws[11], p[5]);
 1516|     15|   accum.mul(ws[12], p[4]);
 1517|     15|   accum.mul(ws[13], p[3]);
 1518|     15|   accum.mul(ws[14], p[2]);
 1519|     15|   accum.mul(ws[15], p[1]);
 1520|     15|   accum.add(z[16]);
 1521|     15|   ws[16] = accum.monty_step(p[0], p_dash);
 1522|     15|   accum.mul(ws[0], p[17]);
 1523|     15|   accum.mul(ws[1], p[16]);
 1524|     15|   accum.mul(ws[2], p[15]);
 1525|     15|   accum.mul(ws[3], p[14]);
 1526|     15|   accum.mul(ws[4], p[13]);
 1527|     15|   accum.mul(ws[5], p[12]);
 1528|     15|   accum.mul(ws[6], p[11]);
 1529|     15|   accum.mul(ws[7], p[10]);
 1530|     15|   accum.mul(ws[8], p[9]);
 1531|     15|   accum.mul(ws[9], p[8]);
 1532|     15|   accum.mul(ws[10], p[7]);
 1533|     15|   accum.mul(ws[11], p[6]);
 1534|     15|   accum.mul(ws[12], p[5]);
 1535|     15|   accum.mul(ws[13], p[4]);
 1536|     15|   accum.mul(ws[14], p[3]);
 1537|     15|   accum.mul(ws[15], p[2]);
 1538|     15|   accum.mul(ws[16], p[1]);
 1539|     15|   accum.add(z[17]);
 1540|     15|   ws[17] = accum.monty_step(p[0], p_dash);
 1541|     15|   accum.mul(ws[0], p[18]);
 1542|     15|   accum.mul(ws[1], p[17]);
 1543|     15|   accum.mul(ws[2], p[16]);
 1544|     15|   accum.mul(ws[3], p[15]);
 1545|     15|   accum.mul(ws[4], p[14]);
 1546|     15|   accum.mul(ws[5], p[13]);
 1547|     15|   accum.mul(ws[6], p[12]);
 1548|     15|   accum.mul(ws[7], p[11]);
 1549|     15|   accum.mul(ws[8], p[10]);
 1550|     15|   accum.mul(ws[9], p[9]);
 1551|     15|   accum.mul(ws[10], p[8]);
 1552|     15|   accum.mul(ws[11], p[7]);
 1553|     15|   accum.mul(ws[12], p[6]);
 1554|     15|   accum.mul(ws[13], p[5]);
 1555|     15|   accum.mul(ws[14], p[4]);
 1556|     15|   accum.mul(ws[15], p[3]);
 1557|     15|   accum.mul(ws[16], p[2]);
 1558|     15|   accum.mul(ws[17], p[1]);
 1559|     15|   accum.add(z[18]);
 1560|     15|   ws[18] = accum.monty_step(p[0], p_dash);
 1561|     15|   accum.mul(ws[0], p[19]);
 1562|     15|   accum.mul(ws[1], p[18]);
 1563|     15|   accum.mul(ws[2], p[17]);
 1564|     15|   accum.mul(ws[3], p[16]);
 1565|     15|   accum.mul(ws[4], p[15]);
 1566|     15|   accum.mul(ws[5], p[14]);
 1567|     15|   accum.mul(ws[6], p[13]);
 1568|     15|   accum.mul(ws[7], p[12]);
 1569|     15|   accum.mul(ws[8], p[11]);
 1570|     15|   accum.mul(ws[9], p[10]);
 1571|     15|   accum.mul(ws[10], p[9]);
 1572|     15|   accum.mul(ws[11], p[8]);
 1573|     15|   accum.mul(ws[12], p[7]);
 1574|     15|   accum.mul(ws[13], p[6]);
 1575|     15|   accum.mul(ws[14], p[5]);
 1576|     15|   accum.mul(ws[15], p[4]);
 1577|     15|   accum.mul(ws[16], p[3]);
 1578|     15|   accum.mul(ws[17], p[2]);
 1579|     15|   accum.mul(ws[18], p[1]);
 1580|     15|   accum.add(z[19]);
 1581|     15|   ws[19] = accum.monty_step(p[0], p_dash);
 1582|     15|   accum.mul(ws[0], p[20]);
 1583|     15|   accum.mul(ws[1], p[19]);
 1584|     15|   accum.mul(ws[2], p[18]);
 1585|     15|   accum.mul(ws[3], p[17]);
 1586|     15|   accum.mul(ws[4], p[16]);
 1587|     15|   accum.mul(ws[5], p[15]);
 1588|     15|   accum.mul(ws[6], p[14]);
 1589|     15|   accum.mul(ws[7], p[13]);
 1590|     15|   accum.mul(ws[8], p[12]);
 1591|     15|   accum.mul(ws[9], p[11]);
 1592|     15|   accum.mul(ws[10], p[10]);
 1593|     15|   accum.mul(ws[11], p[9]);
 1594|     15|   accum.mul(ws[12], p[8]);
 1595|     15|   accum.mul(ws[13], p[7]);
 1596|     15|   accum.mul(ws[14], p[6]);
 1597|     15|   accum.mul(ws[15], p[5]);
 1598|     15|   accum.mul(ws[16], p[4]);
 1599|     15|   accum.mul(ws[17], p[3]);
 1600|     15|   accum.mul(ws[18], p[2]);
 1601|     15|   accum.mul(ws[19], p[1]);
 1602|     15|   accum.add(z[20]);
 1603|     15|   ws[20] = accum.monty_step(p[0], p_dash);
 1604|     15|   accum.mul(ws[0], p[21]);
 1605|     15|   accum.mul(ws[1], p[20]);
 1606|     15|   accum.mul(ws[2], p[19]);
 1607|     15|   accum.mul(ws[3], p[18]);
 1608|     15|   accum.mul(ws[4], p[17]);
 1609|     15|   accum.mul(ws[5], p[16]);
 1610|     15|   accum.mul(ws[6], p[15]);
 1611|     15|   accum.mul(ws[7], p[14]);
 1612|     15|   accum.mul(ws[8], p[13]);
 1613|     15|   accum.mul(ws[9], p[12]);
 1614|     15|   accum.mul(ws[10], p[11]);
 1615|     15|   accum.mul(ws[11], p[10]);
 1616|     15|   accum.mul(ws[12], p[9]);
 1617|     15|   accum.mul(ws[13], p[8]);
 1618|     15|   accum.mul(ws[14], p[7]);
 1619|     15|   accum.mul(ws[15], p[6]);
 1620|     15|   accum.mul(ws[16], p[5]);
 1621|     15|   accum.mul(ws[17], p[4]);
 1622|     15|   accum.mul(ws[18], p[3]);
 1623|     15|   accum.mul(ws[19], p[2]);
 1624|     15|   accum.mul(ws[20], p[1]);
 1625|     15|   accum.add(z[21]);
 1626|     15|   ws[21] = accum.monty_step(p[0], p_dash);
 1627|     15|   accum.mul(ws[0], p[22]);
 1628|     15|   accum.mul(ws[1], p[21]);
 1629|     15|   accum.mul(ws[2], p[20]);
 1630|     15|   accum.mul(ws[3], p[19]);
 1631|     15|   accum.mul(ws[4], p[18]);
 1632|     15|   accum.mul(ws[5], p[17]);
 1633|     15|   accum.mul(ws[6], p[16]);
 1634|     15|   accum.mul(ws[7], p[15]);
 1635|     15|   accum.mul(ws[8], p[14]);
 1636|     15|   accum.mul(ws[9], p[13]);
 1637|     15|   accum.mul(ws[10], p[12]);
 1638|     15|   accum.mul(ws[11], p[11]);
 1639|     15|   accum.mul(ws[12], p[10]);
 1640|     15|   accum.mul(ws[13], p[9]);
 1641|     15|   accum.mul(ws[14], p[8]);
 1642|     15|   accum.mul(ws[15], p[7]);
 1643|     15|   accum.mul(ws[16], p[6]);
 1644|     15|   accum.mul(ws[17], p[5]);
 1645|     15|   accum.mul(ws[18], p[4]);
 1646|     15|   accum.mul(ws[19], p[3]);
 1647|     15|   accum.mul(ws[20], p[2]);
 1648|     15|   accum.mul(ws[21], p[1]);
 1649|     15|   accum.add(z[22]);
 1650|     15|   ws[22] = accum.monty_step(p[0], p_dash);
 1651|     15|   accum.mul(ws[0], p[23]);
 1652|     15|   accum.mul(ws[1], p[22]);
 1653|     15|   accum.mul(ws[2], p[21]);
 1654|     15|   accum.mul(ws[3], p[20]);
 1655|     15|   accum.mul(ws[4], p[19]);
 1656|     15|   accum.mul(ws[5], p[18]);
 1657|     15|   accum.mul(ws[6], p[17]);
 1658|     15|   accum.mul(ws[7], p[16]);
 1659|     15|   accum.mul(ws[8], p[15]);
 1660|     15|   accum.mul(ws[9], p[14]);
 1661|     15|   accum.mul(ws[10], p[13]);
 1662|     15|   accum.mul(ws[11], p[12]);
 1663|     15|   accum.mul(ws[12], p[11]);
 1664|     15|   accum.mul(ws[13], p[10]);
 1665|     15|   accum.mul(ws[14], p[9]);
 1666|     15|   accum.mul(ws[15], p[8]);
 1667|     15|   accum.mul(ws[16], p[7]);
 1668|     15|   accum.mul(ws[17], p[6]);
 1669|     15|   accum.mul(ws[18], p[5]);
 1670|     15|   accum.mul(ws[19], p[4]);
 1671|     15|   accum.mul(ws[20], p[3]);
 1672|     15|   accum.mul(ws[21], p[2]);
 1673|     15|   accum.mul(ws[22], p[1]);
 1674|     15|   accum.add(z[23]);
 1675|     15|   ws[23] = accum.monty_step(p[0], p_dash);
 1676|     15|   accum.mul(ws[0], p[24]);
 1677|     15|   accum.mul(ws[1], p[23]);
 1678|     15|   accum.mul(ws[2], p[22]);
 1679|     15|   accum.mul(ws[3], p[21]);
 1680|     15|   accum.mul(ws[4], p[20]);
 1681|     15|   accum.mul(ws[5], p[19]);
 1682|     15|   accum.mul(ws[6], p[18]);
 1683|     15|   accum.mul(ws[7], p[17]);
 1684|     15|   accum.mul(ws[8], p[16]);
 1685|     15|   accum.mul(ws[9], p[15]);
 1686|     15|   accum.mul(ws[10], p[14]);
 1687|     15|   accum.mul(ws[11], p[13]);
 1688|     15|   accum.mul(ws[12], p[12]);
 1689|     15|   accum.mul(ws[13], p[11]);
 1690|     15|   accum.mul(ws[14], p[10]);
 1691|     15|   accum.mul(ws[15], p[9]);
 1692|     15|   accum.mul(ws[16], p[8]);
 1693|     15|   accum.mul(ws[17], p[7]);
 1694|     15|   accum.mul(ws[18], p[6]);
 1695|     15|   accum.mul(ws[19], p[5]);
 1696|     15|   accum.mul(ws[20], p[4]);
 1697|     15|   accum.mul(ws[21], p[3]);
 1698|     15|   accum.mul(ws[22], p[2]);
 1699|     15|   accum.mul(ws[23], p[1]);
 1700|     15|   accum.add(z[24]);
 1701|     15|   ws[24] = accum.monty_step(p[0], p_dash);
 1702|     15|   accum.mul(ws[0], p[25]);
 1703|     15|   accum.mul(ws[1], p[24]);
 1704|     15|   accum.mul(ws[2], p[23]);
 1705|     15|   accum.mul(ws[3], p[22]);
 1706|     15|   accum.mul(ws[4], p[21]);
 1707|     15|   accum.mul(ws[5], p[20]);
 1708|     15|   accum.mul(ws[6], p[19]);
 1709|     15|   accum.mul(ws[7], p[18]);
 1710|     15|   accum.mul(ws[8], p[17]);
 1711|     15|   accum.mul(ws[9], p[16]);
 1712|     15|   accum.mul(ws[10], p[15]);
 1713|     15|   accum.mul(ws[11], p[14]);
 1714|     15|   accum.mul(ws[12], p[13]);
 1715|     15|   accum.mul(ws[13], p[12]);
 1716|     15|   accum.mul(ws[14], p[11]);
 1717|     15|   accum.mul(ws[15], p[10]);
 1718|     15|   accum.mul(ws[16], p[9]);
 1719|     15|   accum.mul(ws[17], p[8]);
 1720|     15|   accum.mul(ws[18], p[7]);
 1721|     15|   accum.mul(ws[19], p[6]);
 1722|     15|   accum.mul(ws[20], p[5]);
 1723|     15|   accum.mul(ws[21], p[4]);
 1724|     15|   accum.mul(ws[22], p[3]);
 1725|     15|   accum.mul(ws[23], p[2]);
 1726|     15|   accum.mul(ws[24], p[1]);
 1727|     15|   accum.add(z[25]);
 1728|     15|   ws[25] = accum.monty_step(p[0], p_dash);
 1729|     15|   accum.mul(ws[0], p[26]);
 1730|     15|   accum.mul(ws[1], p[25]);
 1731|     15|   accum.mul(ws[2], p[24]);
 1732|     15|   accum.mul(ws[3], p[23]);
 1733|     15|   accum.mul(ws[4], p[22]);
 1734|     15|   accum.mul(ws[5], p[21]);
 1735|     15|   accum.mul(ws[6], p[20]);
 1736|     15|   accum.mul(ws[7], p[19]);
 1737|     15|   accum.mul(ws[8], p[18]);
 1738|     15|   accum.mul(ws[9], p[17]);
 1739|     15|   accum.mul(ws[10], p[16]);
 1740|     15|   accum.mul(ws[11], p[15]);
 1741|     15|   accum.mul(ws[12], p[14]);
 1742|     15|   accum.mul(ws[13], p[13]);
 1743|     15|   accum.mul(ws[14], p[12]);
 1744|     15|   accum.mul(ws[15], p[11]);
 1745|     15|   accum.mul(ws[16], p[10]);
 1746|     15|   accum.mul(ws[17], p[9]);
 1747|     15|   accum.mul(ws[18], p[8]);
 1748|     15|   accum.mul(ws[19], p[7]);
 1749|     15|   accum.mul(ws[20], p[6]);
 1750|     15|   accum.mul(ws[21], p[5]);
 1751|     15|   accum.mul(ws[22], p[4]);
 1752|     15|   accum.mul(ws[23], p[3]);
 1753|     15|   accum.mul(ws[24], p[2]);
 1754|     15|   accum.mul(ws[25], p[1]);
 1755|     15|   accum.add(z[26]);
 1756|     15|   ws[26] = accum.monty_step(p[0], p_dash);
 1757|     15|   accum.mul(ws[0], p[27]);
 1758|     15|   accum.mul(ws[1], p[26]);
 1759|     15|   accum.mul(ws[2], p[25]);
 1760|     15|   accum.mul(ws[3], p[24]);
 1761|     15|   accum.mul(ws[4], p[23]);
 1762|     15|   accum.mul(ws[5], p[22]);
 1763|     15|   accum.mul(ws[6], p[21]);
 1764|     15|   accum.mul(ws[7], p[20]);
 1765|     15|   accum.mul(ws[8], p[19]);
 1766|     15|   accum.mul(ws[9], p[18]);
 1767|     15|   accum.mul(ws[10], p[17]);
 1768|     15|   accum.mul(ws[11], p[16]);
 1769|     15|   accum.mul(ws[12], p[15]);
 1770|     15|   accum.mul(ws[13], p[14]);
 1771|     15|   accum.mul(ws[14], p[13]);
 1772|     15|   accum.mul(ws[15], p[12]);
 1773|     15|   accum.mul(ws[16], p[11]);
 1774|     15|   accum.mul(ws[17], p[10]);
 1775|     15|   accum.mul(ws[18], p[9]);
 1776|     15|   accum.mul(ws[19], p[8]);
 1777|     15|   accum.mul(ws[20], p[7]);
 1778|     15|   accum.mul(ws[21], p[6]);
 1779|     15|   accum.mul(ws[22], p[5]);
 1780|     15|   accum.mul(ws[23], p[4]);
 1781|     15|   accum.mul(ws[24], p[3]);
 1782|     15|   accum.mul(ws[25], p[2]);
 1783|     15|   accum.mul(ws[26], p[1]);
 1784|     15|   accum.add(z[27]);
 1785|     15|   ws[27] = accum.monty_step(p[0], p_dash);
 1786|     15|   accum.mul(ws[0], p[28]);
 1787|     15|   accum.mul(ws[1], p[27]);
 1788|     15|   accum.mul(ws[2], p[26]);
 1789|     15|   accum.mul(ws[3], p[25]);
 1790|     15|   accum.mul(ws[4], p[24]);
 1791|     15|   accum.mul(ws[5], p[23]);
 1792|     15|   accum.mul(ws[6], p[22]);
 1793|     15|   accum.mul(ws[7], p[21]);
 1794|     15|   accum.mul(ws[8], p[20]);
 1795|     15|   accum.mul(ws[9], p[19]);
 1796|     15|   accum.mul(ws[10], p[18]);
 1797|     15|   accum.mul(ws[11], p[17]);
 1798|     15|   accum.mul(ws[12], p[16]);
 1799|     15|   accum.mul(ws[13], p[15]);
 1800|     15|   accum.mul(ws[14], p[14]);
 1801|     15|   accum.mul(ws[15], p[13]);
 1802|     15|   accum.mul(ws[16], p[12]);
 1803|     15|   accum.mul(ws[17], p[11]);
 1804|     15|   accum.mul(ws[18], p[10]);
 1805|     15|   accum.mul(ws[19], p[9]);
 1806|     15|   accum.mul(ws[20], p[8]);
 1807|     15|   accum.mul(ws[21], p[7]);
 1808|     15|   accum.mul(ws[22], p[6]);
 1809|     15|   accum.mul(ws[23], p[5]);
 1810|     15|   accum.mul(ws[24], p[4]);
 1811|     15|   accum.mul(ws[25], p[3]);
 1812|     15|   accum.mul(ws[26], p[2]);
 1813|     15|   accum.mul(ws[27], p[1]);
 1814|     15|   accum.add(z[28]);
 1815|     15|   ws[28] = accum.monty_step(p[0], p_dash);
 1816|     15|   accum.mul(ws[0], p[29]);
 1817|     15|   accum.mul(ws[1], p[28]);
 1818|     15|   accum.mul(ws[2], p[27]);
 1819|     15|   accum.mul(ws[3], p[26]);
 1820|     15|   accum.mul(ws[4], p[25]);
 1821|     15|   accum.mul(ws[5], p[24]);
 1822|     15|   accum.mul(ws[6], p[23]);
 1823|     15|   accum.mul(ws[7], p[22]);
 1824|     15|   accum.mul(ws[8], p[21]);
 1825|     15|   accum.mul(ws[9], p[20]);
 1826|     15|   accum.mul(ws[10], p[19]);
 1827|     15|   accum.mul(ws[11], p[18]);
 1828|     15|   accum.mul(ws[12], p[17]);
 1829|     15|   accum.mul(ws[13], p[16]);
 1830|     15|   accum.mul(ws[14], p[15]);
 1831|     15|   accum.mul(ws[15], p[14]);
 1832|     15|   accum.mul(ws[16], p[13]);
 1833|     15|   accum.mul(ws[17], p[12]);
 1834|     15|   accum.mul(ws[18], p[11]);
 1835|     15|   accum.mul(ws[19], p[10]);
 1836|     15|   accum.mul(ws[20], p[9]);
 1837|     15|   accum.mul(ws[21], p[8]);
 1838|     15|   accum.mul(ws[22], p[7]);
 1839|     15|   accum.mul(ws[23], p[6]);
 1840|     15|   accum.mul(ws[24], p[5]);
 1841|     15|   accum.mul(ws[25], p[4]);
 1842|     15|   accum.mul(ws[26], p[3]);
 1843|     15|   accum.mul(ws[27], p[2]);
 1844|     15|   accum.mul(ws[28], p[1]);
 1845|     15|   accum.add(z[29]);
 1846|     15|   ws[29] = accum.monty_step(p[0], p_dash);
 1847|     15|   accum.mul(ws[0], p[30]);
 1848|     15|   accum.mul(ws[1], p[29]);
 1849|     15|   accum.mul(ws[2], p[28]);
 1850|     15|   accum.mul(ws[3], p[27]);
 1851|     15|   accum.mul(ws[4], p[26]);
 1852|     15|   accum.mul(ws[5], p[25]);
 1853|     15|   accum.mul(ws[6], p[24]);
 1854|     15|   accum.mul(ws[7], p[23]);
 1855|     15|   accum.mul(ws[8], p[22]);
 1856|     15|   accum.mul(ws[9], p[21]);
 1857|     15|   accum.mul(ws[10], p[20]);
 1858|     15|   accum.mul(ws[11], p[19]);
 1859|     15|   accum.mul(ws[12], p[18]);
 1860|     15|   accum.mul(ws[13], p[17]);
 1861|     15|   accum.mul(ws[14], p[16]);
 1862|     15|   accum.mul(ws[15], p[15]);
 1863|     15|   accum.mul(ws[16], p[14]);
 1864|     15|   accum.mul(ws[17], p[13]);
 1865|     15|   accum.mul(ws[18], p[12]);
 1866|     15|   accum.mul(ws[19], p[11]);
 1867|     15|   accum.mul(ws[20], p[10]);
 1868|     15|   accum.mul(ws[21], p[9]);
 1869|     15|   accum.mul(ws[22], p[8]);
 1870|     15|   accum.mul(ws[23], p[7]);
 1871|     15|   accum.mul(ws[24], p[6]);
 1872|     15|   accum.mul(ws[25], p[5]);
 1873|     15|   accum.mul(ws[26], p[4]);
 1874|     15|   accum.mul(ws[27], p[3]);
 1875|     15|   accum.mul(ws[28], p[2]);
 1876|     15|   accum.mul(ws[29], p[1]);
 1877|     15|   accum.add(z[30]);
 1878|     15|   ws[30] = accum.monty_step(p[0], p_dash);
 1879|     15|   accum.mul(ws[0], p[31]);
 1880|     15|   accum.mul(ws[1], p[30]);
 1881|     15|   accum.mul(ws[2], p[29]);
 1882|     15|   accum.mul(ws[3], p[28]);
 1883|     15|   accum.mul(ws[4], p[27]);
 1884|     15|   accum.mul(ws[5], p[26]);
 1885|     15|   accum.mul(ws[6], p[25]);
 1886|     15|   accum.mul(ws[7], p[24]);
 1887|     15|   accum.mul(ws[8], p[23]);
 1888|     15|   accum.mul(ws[9], p[22]);
 1889|     15|   accum.mul(ws[10], p[21]);
 1890|     15|   accum.mul(ws[11], p[20]);
 1891|     15|   accum.mul(ws[12], p[19]);
 1892|     15|   accum.mul(ws[13], p[18]);
 1893|     15|   accum.mul(ws[14], p[17]);
 1894|     15|   accum.mul(ws[15], p[16]);
 1895|     15|   accum.mul(ws[16], p[15]);
 1896|     15|   accum.mul(ws[17], p[14]);
 1897|     15|   accum.mul(ws[18], p[13]);
 1898|     15|   accum.mul(ws[19], p[12]);
 1899|     15|   accum.mul(ws[20], p[11]);
 1900|     15|   accum.mul(ws[21], p[10]);
 1901|     15|   accum.mul(ws[22], p[9]);
 1902|     15|   accum.mul(ws[23], p[8]);
 1903|     15|   accum.mul(ws[24], p[7]);
 1904|     15|   accum.mul(ws[25], p[6]);
 1905|     15|   accum.mul(ws[26], p[5]);
 1906|     15|   accum.mul(ws[27], p[4]);
 1907|     15|   accum.mul(ws[28], p[3]);
 1908|     15|   accum.mul(ws[29], p[2]);
 1909|     15|   accum.mul(ws[30], p[1]);
 1910|     15|   accum.add(z[31]);
 1911|     15|   ws[31] = accum.monty_step(p[0], p_dash);
 1912|     15|   accum.mul(ws[1], p[31]);
 1913|     15|   accum.mul(ws[2], p[30]);
 1914|     15|   accum.mul(ws[3], p[29]);
 1915|     15|   accum.mul(ws[4], p[28]);
 1916|     15|   accum.mul(ws[5], p[27]);
 1917|     15|   accum.mul(ws[6], p[26]);
 1918|     15|   accum.mul(ws[7], p[25]);
 1919|     15|   accum.mul(ws[8], p[24]);
 1920|     15|   accum.mul(ws[9], p[23]);
 1921|     15|   accum.mul(ws[10], p[22]);
 1922|     15|   accum.mul(ws[11], p[21]);
 1923|     15|   accum.mul(ws[12], p[20]);
 1924|     15|   accum.mul(ws[13], p[19]);
 1925|     15|   accum.mul(ws[14], p[18]);
 1926|     15|   accum.mul(ws[15], p[17]);
 1927|     15|   accum.mul(ws[16], p[16]);
 1928|     15|   accum.mul(ws[17], p[15]);
 1929|     15|   accum.mul(ws[18], p[14]);
 1930|     15|   accum.mul(ws[19], p[13]);
 1931|     15|   accum.mul(ws[20], p[12]);
 1932|     15|   accum.mul(ws[21], p[11]);
 1933|     15|   accum.mul(ws[22], p[10]);
 1934|     15|   accum.mul(ws[23], p[9]);
 1935|     15|   accum.mul(ws[24], p[8]);
 1936|     15|   accum.mul(ws[25], p[7]);
 1937|     15|   accum.mul(ws[26], p[6]);
 1938|     15|   accum.mul(ws[27], p[5]);
 1939|     15|   accum.mul(ws[28], p[4]);
 1940|     15|   accum.mul(ws[29], p[3]);
 1941|     15|   accum.mul(ws[30], p[2]);
 1942|     15|   accum.mul(ws[31], p[1]);
 1943|     15|   accum.add(z[32]);
 1944|     15|   ws[0] = accum.extract();
 1945|     15|   accum.mul(ws[2], p[31]);
 1946|     15|   accum.mul(ws[3], p[30]);
 1947|     15|   accum.mul(ws[4], p[29]);
 1948|     15|   accum.mul(ws[5], p[28]);
 1949|     15|   accum.mul(ws[6], p[27]);
 1950|     15|   accum.mul(ws[7], p[26]);
 1951|     15|   accum.mul(ws[8], p[25]);
 1952|     15|   accum.mul(ws[9], p[24]);
 1953|     15|   accum.mul(ws[10], p[23]);
 1954|     15|   accum.mul(ws[11], p[22]);
 1955|     15|   accum.mul(ws[12], p[21]);
 1956|     15|   accum.mul(ws[13], p[20]);
 1957|     15|   accum.mul(ws[14], p[19]);
 1958|     15|   accum.mul(ws[15], p[18]);
 1959|     15|   accum.mul(ws[16], p[17]);
 1960|     15|   accum.mul(ws[17], p[16]);
 1961|     15|   accum.mul(ws[18], p[15]);
 1962|     15|   accum.mul(ws[19], p[14]);
 1963|     15|   accum.mul(ws[20], p[13]);
 1964|     15|   accum.mul(ws[21], p[12]);
 1965|     15|   accum.mul(ws[22], p[11]);
 1966|     15|   accum.mul(ws[23], p[10]);
 1967|     15|   accum.mul(ws[24], p[9]);
 1968|     15|   accum.mul(ws[25], p[8]);
 1969|     15|   accum.mul(ws[26], p[7]);
 1970|     15|   accum.mul(ws[27], p[6]);
 1971|     15|   accum.mul(ws[28], p[5]);
 1972|     15|   accum.mul(ws[29], p[4]);
 1973|     15|   accum.mul(ws[30], p[3]);
 1974|     15|   accum.mul(ws[31], p[2]);
 1975|     15|   accum.add(z[33]);
 1976|     15|   ws[1] = accum.extract();
 1977|     15|   accum.mul(ws[3], p[31]);
 1978|     15|   accum.mul(ws[4], p[30]);
 1979|     15|   accum.mul(ws[5], p[29]);
 1980|     15|   accum.mul(ws[6], p[28]);
 1981|     15|   accum.mul(ws[7], p[27]);
 1982|     15|   accum.mul(ws[8], p[26]);
 1983|     15|   accum.mul(ws[9], p[25]);
 1984|     15|   accum.mul(ws[10], p[24]);
 1985|     15|   accum.mul(ws[11], p[23]);
 1986|     15|   accum.mul(ws[12], p[22]);
 1987|     15|   accum.mul(ws[13], p[21]);
 1988|     15|   accum.mul(ws[14], p[20]);
 1989|     15|   accum.mul(ws[15], p[19]);
 1990|     15|   accum.mul(ws[16], p[18]);
 1991|     15|   accum.mul(ws[17], p[17]);
 1992|     15|   accum.mul(ws[18], p[16]);
 1993|     15|   accum.mul(ws[19], p[15]);
 1994|     15|   accum.mul(ws[20], p[14]);
 1995|     15|   accum.mul(ws[21], p[13]);
 1996|     15|   accum.mul(ws[22], p[12]);
 1997|     15|   accum.mul(ws[23], p[11]);
 1998|     15|   accum.mul(ws[24], p[10]);
 1999|     15|   accum.mul(ws[25], p[9]);
 2000|     15|   accum.mul(ws[26], p[8]);
 2001|     15|   accum.mul(ws[27], p[7]);
 2002|     15|   accum.mul(ws[28], p[6]);
 2003|     15|   accum.mul(ws[29], p[5]);
 2004|     15|   accum.mul(ws[30], p[4]);
 2005|     15|   accum.mul(ws[31], p[3]);
 2006|     15|   accum.add(z[34]);
 2007|     15|   ws[2] = accum.extract();
 2008|     15|   accum.mul(ws[4], p[31]);
 2009|     15|   accum.mul(ws[5], p[30]);
 2010|     15|   accum.mul(ws[6], p[29]);
 2011|     15|   accum.mul(ws[7], p[28]);
 2012|     15|   accum.mul(ws[8], p[27]);
 2013|     15|   accum.mul(ws[9], p[26]);
 2014|     15|   accum.mul(ws[10], p[25]);
 2015|     15|   accum.mul(ws[11], p[24]);
 2016|     15|   accum.mul(ws[12], p[23]);
 2017|     15|   accum.mul(ws[13], p[22]);
 2018|     15|   accum.mul(ws[14], p[21]);
 2019|     15|   accum.mul(ws[15], p[20]);
 2020|     15|   accum.mul(ws[16], p[19]);
 2021|     15|   accum.mul(ws[17], p[18]);
 2022|     15|   accum.mul(ws[18], p[17]);
 2023|     15|   accum.mul(ws[19], p[16]);
 2024|     15|   accum.mul(ws[20], p[15]);
 2025|     15|   accum.mul(ws[21], p[14]);
 2026|     15|   accum.mul(ws[22], p[13]);
 2027|     15|   accum.mul(ws[23], p[12]);
 2028|     15|   accum.mul(ws[24], p[11]);
 2029|     15|   accum.mul(ws[25], p[10]);
 2030|     15|   accum.mul(ws[26], p[9]);
 2031|     15|   accum.mul(ws[27], p[8]);
 2032|     15|   accum.mul(ws[28], p[7]);
 2033|     15|   accum.mul(ws[29], p[6]);
 2034|     15|   accum.mul(ws[30], p[5]);
 2035|     15|   accum.mul(ws[31], p[4]);
 2036|     15|   accum.add(z[35]);
 2037|     15|   ws[3] = accum.extract();
 2038|     15|   accum.mul(ws[5], p[31]);
 2039|     15|   accum.mul(ws[6], p[30]);
 2040|     15|   accum.mul(ws[7], p[29]);
 2041|     15|   accum.mul(ws[8], p[28]);
 2042|     15|   accum.mul(ws[9], p[27]);
 2043|     15|   accum.mul(ws[10], p[26]);
 2044|     15|   accum.mul(ws[11], p[25]);
 2045|     15|   accum.mul(ws[12], p[24]);
 2046|     15|   accum.mul(ws[13], p[23]);
 2047|     15|   accum.mul(ws[14], p[22]);
 2048|     15|   accum.mul(ws[15], p[21]);
 2049|     15|   accum.mul(ws[16], p[20]);
 2050|     15|   accum.mul(ws[17], p[19]);
 2051|     15|   accum.mul(ws[18], p[18]);
 2052|     15|   accum.mul(ws[19], p[17]);
 2053|     15|   accum.mul(ws[20], p[16]);
 2054|     15|   accum.mul(ws[21], p[15]);
 2055|     15|   accum.mul(ws[22], p[14]);
 2056|     15|   accum.mul(ws[23], p[13]);
 2057|     15|   accum.mul(ws[24], p[12]);
 2058|     15|   accum.mul(ws[25], p[11]);
 2059|     15|   accum.mul(ws[26], p[10]);
 2060|     15|   accum.mul(ws[27], p[9]);
 2061|     15|   accum.mul(ws[28], p[8]);
 2062|     15|   accum.mul(ws[29], p[7]);
 2063|     15|   accum.mul(ws[30], p[6]);
 2064|     15|   accum.mul(ws[31], p[5]);
 2065|     15|   accum.add(z[36]);
 2066|     15|   ws[4] = accum.extract();
 2067|     15|   accum.mul(ws[6], p[31]);
 2068|     15|   accum.mul(ws[7], p[30]);
 2069|     15|   accum.mul(ws[8], p[29]);
 2070|     15|   accum.mul(ws[9], p[28]);
 2071|     15|   accum.mul(ws[10], p[27]);
 2072|     15|   accum.mul(ws[11], p[26]);
 2073|     15|   accum.mul(ws[12], p[25]);
 2074|     15|   accum.mul(ws[13], p[24]);
 2075|     15|   accum.mul(ws[14], p[23]);
 2076|     15|   accum.mul(ws[15], p[22]);
 2077|     15|   accum.mul(ws[16], p[21]);
 2078|     15|   accum.mul(ws[17], p[20]);
 2079|     15|   accum.mul(ws[18], p[19]);
 2080|     15|   accum.mul(ws[19], p[18]);
 2081|     15|   accum.mul(ws[20], p[17]);
 2082|     15|   accum.mul(ws[21], p[16]);
 2083|     15|   accum.mul(ws[22], p[15]);
 2084|     15|   accum.mul(ws[23], p[14]);
 2085|     15|   accum.mul(ws[24], p[13]);
 2086|     15|   accum.mul(ws[25], p[12]);
 2087|     15|   accum.mul(ws[26], p[11]);
 2088|     15|   accum.mul(ws[27], p[10]);
 2089|     15|   accum.mul(ws[28], p[9]);
 2090|     15|   accum.mul(ws[29], p[8]);
 2091|     15|   accum.mul(ws[30], p[7]);
 2092|     15|   accum.mul(ws[31], p[6]);
 2093|     15|   accum.add(z[37]);
 2094|     15|   ws[5] = accum.extract();
 2095|     15|   accum.mul(ws[7], p[31]);
 2096|     15|   accum.mul(ws[8], p[30]);
 2097|     15|   accum.mul(ws[9], p[29]);
 2098|     15|   accum.mul(ws[10], p[28]);
 2099|     15|   accum.mul(ws[11], p[27]);
 2100|     15|   accum.mul(ws[12], p[26]);
 2101|     15|   accum.mul(ws[13], p[25]);
 2102|     15|   accum.mul(ws[14], p[24]);
 2103|     15|   accum.mul(ws[15], p[23]);
 2104|     15|   accum.mul(ws[16], p[22]);
 2105|     15|   accum.mul(ws[17], p[21]);
 2106|     15|   accum.mul(ws[18], p[20]);
 2107|     15|   accum.mul(ws[19], p[19]);
 2108|     15|   accum.mul(ws[20], p[18]);
 2109|     15|   accum.mul(ws[21], p[17]);
 2110|     15|   accum.mul(ws[22], p[16]);
 2111|     15|   accum.mul(ws[23], p[15]);
 2112|     15|   accum.mul(ws[24], p[14]);
 2113|     15|   accum.mul(ws[25], p[13]);
 2114|     15|   accum.mul(ws[26], p[12]);
 2115|     15|   accum.mul(ws[27], p[11]);
 2116|     15|   accum.mul(ws[28], p[10]);
 2117|     15|   accum.mul(ws[29], p[9]);
 2118|     15|   accum.mul(ws[30], p[8]);
 2119|     15|   accum.mul(ws[31], p[7]);
 2120|     15|   accum.add(z[38]);
 2121|     15|   ws[6] = accum.extract();
 2122|     15|   accum.mul(ws[8], p[31]);
 2123|     15|   accum.mul(ws[9], p[30]);
 2124|     15|   accum.mul(ws[10], p[29]);
 2125|     15|   accum.mul(ws[11], p[28]);
 2126|     15|   accum.mul(ws[12], p[27]);
 2127|     15|   accum.mul(ws[13], p[26]);
 2128|     15|   accum.mul(ws[14], p[25]);
 2129|     15|   accum.mul(ws[15], p[24]);
 2130|     15|   accum.mul(ws[16], p[23]);
 2131|     15|   accum.mul(ws[17], p[22]);
 2132|     15|   accum.mul(ws[18], p[21]);
 2133|     15|   accum.mul(ws[19], p[20]);
 2134|     15|   accum.mul(ws[20], p[19]);
 2135|     15|   accum.mul(ws[21], p[18]);
 2136|     15|   accum.mul(ws[22], p[17]);
 2137|     15|   accum.mul(ws[23], p[16]);
 2138|     15|   accum.mul(ws[24], p[15]);
 2139|     15|   accum.mul(ws[25], p[14]);
 2140|     15|   accum.mul(ws[26], p[13]);
 2141|     15|   accum.mul(ws[27], p[12]);
 2142|     15|   accum.mul(ws[28], p[11]);
 2143|     15|   accum.mul(ws[29], p[10]);
 2144|     15|   accum.mul(ws[30], p[9]);
 2145|     15|   accum.mul(ws[31], p[8]);
 2146|     15|   accum.add(z[39]);
 2147|     15|   ws[7] = accum.extract();
 2148|     15|   accum.mul(ws[9], p[31]);
 2149|     15|   accum.mul(ws[10], p[30]);
 2150|     15|   accum.mul(ws[11], p[29]);
 2151|     15|   accum.mul(ws[12], p[28]);
 2152|     15|   accum.mul(ws[13], p[27]);
 2153|     15|   accum.mul(ws[14], p[26]);
 2154|     15|   accum.mul(ws[15], p[25]);
 2155|     15|   accum.mul(ws[16], p[24]);
 2156|     15|   accum.mul(ws[17], p[23]);
 2157|     15|   accum.mul(ws[18], p[22]);
 2158|     15|   accum.mul(ws[19], p[21]);
 2159|     15|   accum.mul(ws[20], p[20]);
 2160|     15|   accum.mul(ws[21], p[19]);
 2161|     15|   accum.mul(ws[22], p[18]);
 2162|     15|   accum.mul(ws[23], p[17]);
 2163|     15|   accum.mul(ws[24], p[16]);
 2164|     15|   accum.mul(ws[25], p[15]);
 2165|     15|   accum.mul(ws[26], p[14]);
 2166|     15|   accum.mul(ws[27], p[13]);
 2167|     15|   accum.mul(ws[28], p[12]);
 2168|     15|   accum.mul(ws[29], p[11]);
 2169|     15|   accum.mul(ws[30], p[10]);
 2170|     15|   accum.mul(ws[31], p[9]);
 2171|     15|   accum.add(z[40]);
 2172|     15|   ws[8] = accum.extract();
 2173|     15|   accum.mul(ws[10], p[31]);
 2174|     15|   accum.mul(ws[11], p[30]);
 2175|     15|   accum.mul(ws[12], p[29]);
 2176|     15|   accum.mul(ws[13], p[28]);
 2177|     15|   accum.mul(ws[14], p[27]);
 2178|     15|   accum.mul(ws[15], p[26]);
 2179|     15|   accum.mul(ws[16], p[25]);
 2180|     15|   accum.mul(ws[17], p[24]);
 2181|     15|   accum.mul(ws[18], p[23]);
 2182|     15|   accum.mul(ws[19], p[22]);
 2183|     15|   accum.mul(ws[20], p[21]);
 2184|     15|   accum.mul(ws[21], p[20]);
 2185|     15|   accum.mul(ws[22], p[19]);
 2186|     15|   accum.mul(ws[23], p[18]);
 2187|     15|   accum.mul(ws[24], p[17]);
 2188|     15|   accum.mul(ws[25], p[16]);
 2189|     15|   accum.mul(ws[26], p[15]);
 2190|     15|   accum.mul(ws[27], p[14]);
 2191|     15|   accum.mul(ws[28], p[13]);
 2192|     15|   accum.mul(ws[29], p[12]);
 2193|     15|   accum.mul(ws[30], p[11]);
 2194|     15|   accum.mul(ws[31], p[10]);
 2195|     15|   accum.add(z[41]);
 2196|     15|   ws[9] = accum.extract();
 2197|     15|   accum.mul(ws[11], p[31]);
 2198|     15|   accum.mul(ws[12], p[30]);
 2199|     15|   accum.mul(ws[13], p[29]);
 2200|     15|   accum.mul(ws[14], p[28]);
 2201|     15|   accum.mul(ws[15], p[27]);
 2202|     15|   accum.mul(ws[16], p[26]);
 2203|     15|   accum.mul(ws[17], p[25]);
 2204|     15|   accum.mul(ws[18], p[24]);
 2205|     15|   accum.mul(ws[19], p[23]);
 2206|     15|   accum.mul(ws[20], p[22]);
 2207|     15|   accum.mul(ws[21], p[21]);
 2208|     15|   accum.mul(ws[22], p[20]);
 2209|     15|   accum.mul(ws[23], p[19]);
 2210|     15|   accum.mul(ws[24], p[18]);
 2211|     15|   accum.mul(ws[25], p[17]);
 2212|     15|   accum.mul(ws[26], p[16]);
 2213|     15|   accum.mul(ws[27], p[15]);
 2214|     15|   accum.mul(ws[28], p[14]);
 2215|     15|   accum.mul(ws[29], p[13]);
 2216|     15|   accum.mul(ws[30], p[12]);
 2217|     15|   accum.mul(ws[31], p[11]);
 2218|     15|   accum.add(z[42]);
 2219|     15|   ws[10] = accum.extract();
 2220|     15|   accum.mul(ws[12], p[31]);
 2221|     15|   accum.mul(ws[13], p[30]);
 2222|     15|   accum.mul(ws[14], p[29]);
 2223|     15|   accum.mul(ws[15], p[28]);
 2224|     15|   accum.mul(ws[16], p[27]);
 2225|     15|   accum.mul(ws[17], p[26]);
 2226|     15|   accum.mul(ws[18], p[25]);
 2227|     15|   accum.mul(ws[19], p[24]);
 2228|     15|   accum.mul(ws[20], p[23]);
 2229|     15|   accum.mul(ws[21], p[22]);
 2230|     15|   accum.mul(ws[22], p[21]);
 2231|     15|   accum.mul(ws[23], p[20]);
 2232|     15|   accum.mul(ws[24], p[19]);
 2233|     15|   accum.mul(ws[25], p[18]);
 2234|     15|   accum.mul(ws[26], p[17]);
 2235|     15|   accum.mul(ws[27], p[16]);
 2236|     15|   accum.mul(ws[28], p[15]);
 2237|     15|   accum.mul(ws[29], p[14]);
 2238|     15|   accum.mul(ws[30], p[13]);
 2239|     15|   accum.mul(ws[31], p[12]);
 2240|     15|   accum.add(z[43]);
 2241|     15|   ws[11] = accum.extract();
 2242|     15|   accum.mul(ws[13], p[31]);
 2243|     15|   accum.mul(ws[14], p[30]);
 2244|     15|   accum.mul(ws[15], p[29]);
 2245|     15|   accum.mul(ws[16], p[28]);
 2246|     15|   accum.mul(ws[17], p[27]);
 2247|     15|   accum.mul(ws[18], p[26]);
 2248|     15|   accum.mul(ws[19], p[25]);
 2249|     15|   accum.mul(ws[20], p[24]);
 2250|     15|   accum.mul(ws[21], p[23]);
 2251|     15|   accum.mul(ws[22], p[22]);
 2252|     15|   accum.mul(ws[23], p[21]);
 2253|     15|   accum.mul(ws[24], p[20]);
 2254|     15|   accum.mul(ws[25], p[19]);
 2255|     15|   accum.mul(ws[26], p[18]);
 2256|     15|   accum.mul(ws[27], p[17]);
 2257|     15|   accum.mul(ws[28], p[16]);
 2258|     15|   accum.mul(ws[29], p[15]);
 2259|     15|   accum.mul(ws[30], p[14]);
 2260|     15|   accum.mul(ws[31], p[13]);
 2261|     15|   accum.add(z[44]);
 2262|     15|   ws[12] = accum.extract();
 2263|     15|   accum.mul(ws[14], p[31]);
 2264|     15|   accum.mul(ws[15], p[30]);
 2265|     15|   accum.mul(ws[16], p[29]);
 2266|     15|   accum.mul(ws[17], p[28]);
 2267|     15|   accum.mul(ws[18], p[27]);
 2268|     15|   accum.mul(ws[19], p[26]);
 2269|     15|   accum.mul(ws[20], p[25]);
 2270|     15|   accum.mul(ws[21], p[24]);
 2271|     15|   accum.mul(ws[22], p[23]);
 2272|     15|   accum.mul(ws[23], p[22]);
 2273|     15|   accum.mul(ws[24], p[21]);
 2274|     15|   accum.mul(ws[25], p[20]);
 2275|     15|   accum.mul(ws[26], p[19]);
 2276|     15|   accum.mul(ws[27], p[18]);
 2277|     15|   accum.mul(ws[28], p[17]);
 2278|     15|   accum.mul(ws[29], p[16]);
 2279|     15|   accum.mul(ws[30], p[15]);
 2280|     15|   accum.mul(ws[31], p[14]);
 2281|     15|   accum.add(z[45]);
 2282|     15|   ws[13] = accum.extract();
 2283|     15|   accum.mul(ws[15], p[31]);
 2284|     15|   accum.mul(ws[16], p[30]);
 2285|     15|   accum.mul(ws[17], p[29]);
 2286|     15|   accum.mul(ws[18], p[28]);
 2287|     15|   accum.mul(ws[19], p[27]);
 2288|     15|   accum.mul(ws[20], p[26]);
 2289|     15|   accum.mul(ws[21], p[25]);
 2290|     15|   accum.mul(ws[22], p[24]);
 2291|     15|   accum.mul(ws[23], p[23]);
 2292|     15|   accum.mul(ws[24], p[22]);
 2293|     15|   accum.mul(ws[25], p[21]);
 2294|     15|   accum.mul(ws[26], p[20]);
 2295|     15|   accum.mul(ws[27], p[19]);
 2296|     15|   accum.mul(ws[28], p[18]);
 2297|     15|   accum.mul(ws[29], p[17]);
 2298|     15|   accum.mul(ws[30], p[16]);
 2299|     15|   accum.mul(ws[31], p[15]);
 2300|     15|   accum.add(z[46]);
 2301|     15|   ws[14] = accum.extract();
 2302|     15|   accum.mul(ws[16], p[31]);
 2303|     15|   accum.mul(ws[17], p[30]);
 2304|     15|   accum.mul(ws[18], p[29]);
 2305|     15|   accum.mul(ws[19], p[28]);
 2306|     15|   accum.mul(ws[20], p[27]);
 2307|     15|   accum.mul(ws[21], p[26]);
 2308|     15|   accum.mul(ws[22], p[25]);
 2309|     15|   accum.mul(ws[23], p[24]);
 2310|     15|   accum.mul(ws[24], p[23]);
 2311|     15|   accum.mul(ws[25], p[22]);
 2312|     15|   accum.mul(ws[26], p[21]);
 2313|     15|   accum.mul(ws[27], p[20]);
 2314|     15|   accum.mul(ws[28], p[19]);
 2315|     15|   accum.mul(ws[29], p[18]);
 2316|     15|   accum.mul(ws[30], p[17]);
 2317|     15|   accum.mul(ws[31], p[16]);
 2318|     15|   accum.add(z[47]);
 2319|     15|   ws[15] = accum.extract();
 2320|     15|   accum.mul(ws[17], p[31]);
 2321|     15|   accum.mul(ws[18], p[30]);
 2322|     15|   accum.mul(ws[19], p[29]);
 2323|     15|   accum.mul(ws[20], p[28]);
 2324|     15|   accum.mul(ws[21], p[27]);
 2325|     15|   accum.mul(ws[22], p[26]);
 2326|     15|   accum.mul(ws[23], p[25]);
 2327|     15|   accum.mul(ws[24], p[24]);
 2328|     15|   accum.mul(ws[25], p[23]);
 2329|     15|   accum.mul(ws[26], p[22]);
 2330|     15|   accum.mul(ws[27], p[21]);
 2331|     15|   accum.mul(ws[28], p[20]);
 2332|     15|   accum.mul(ws[29], p[19]);
 2333|     15|   accum.mul(ws[30], p[18]);
 2334|     15|   accum.mul(ws[31], p[17]);
 2335|     15|   accum.add(z[48]);
 2336|     15|   ws[16] = accum.extract();
 2337|     15|   accum.mul(ws[18], p[31]);
 2338|     15|   accum.mul(ws[19], p[30]);
 2339|     15|   accum.mul(ws[20], p[29]);
 2340|     15|   accum.mul(ws[21], p[28]);
 2341|     15|   accum.mul(ws[22], p[27]);
 2342|     15|   accum.mul(ws[23], p[26]);
 2343|     15|   accum.mul(ws[24], p[25]);
 2344|     15|   accum.mul(ws[25], p[24]);
 2345|     15|   accum.mul(ws[26], p[23]);
 2346|     15|   accum.mul(ws[27], p[22]);
 2347|     15|   accum.mul(ws[28], p[21]);
 2348|     15|   accum.mul(ws[29], p[20]);
 2349|     15|   accum.mul(ws[30], p[19]);
 2350|     15|   accum.mul(ws[31], p[18]);
 2351|     15|   accum.add(z[49]);
 2352|     15|   ws[17] = accum.extract();
 2353|     15|   accum.mul(ws[19], p[31]);
 2354|     15|   accum.mul(ws[20], p[30]);
 2355|     15|   accum.mul(ws[21], p[29]);
 2356|     15|   accum.mul(ws[22], p[28]);
 2357|     15|   accum.mul(ws[23], p[27]);
 2358|     15|   accum.mul(ws[24], p[26]);
 2359|     15|   accum.mul(ws[25], p[25]);
 2360|     15|   accum.mul(ws[26], p[24]);
 2361|     15|   accum.mul(ws[27], p[23]);
 2362|     15|   accum.mul(ws[28], p[22]);
 2363|     15|   accum.mul(ws[29], p[21]);
 2364|     15|   accum.mul(ws[30], p[20]);
 2365|     15|   accum.mul(ws[31], p[19]);
 2366|     15|   accum.add(z[50]);
 2367|     15|   ws[18] = accum.extract();
 2368|     15|   accum.mul(ws[20], p[31]);
 2369|     15|   accum.mul(ws[21], p[30]);
 2370|     15|   accum.mul(ws[22], p[29]);
 2371|     15|   accum.mul(ws[23], p[28]);
 2372|     15|   accum.mul(ws[24], p[27]);
 2373|     15|   accum.mul(ws[25], p[26]);
 2374|     15|   accum.mul(ws[26], p[25]);
 2375|     15|   accum.mul(ws[27], p[24]);
 2376|     15|   accum.mul(ws[28], p[23]);
 2377|     15|   accum.mul(ws[29], p[22]);
 2378|     15|   accum.mul(ws[30], p[21]);
 2379|     15|   accum.mul(ws[31], p[20]);
 2380|     15|   accum.add(z[51]);
 2381|     15|   ws[19] = accum.extract();
 2382|     15|   accum.mul(ws[21], p[31]);
 2383|     15|   accum.mul(ws[22], p[30]);
 2384|     15|   accum.mul(ws[23], p[29]);
 2385|     15|   accum.mul(ws[24], p[28]);
 2386|     15|   accum.mul(ws[25], p[27]);
 2387|     15|   accum.mul(ws[26], p[26]);
 2388|     15|   accum.mul(ws[27], p[25]);
 2389|     15|   accum.mul(ws[28], p[24]);
 2390|     15|   accum.mul(ws[29], p[23]);
 2391|     15|   accum.mul(ws[30], p[22]);
 2392|     15|   accum.mul(ws[31], p[21]);
 2393|     15|   accum.add(z[52]);
 2394|     15|   ws[20] = accum.extract();
 2395|     15|   accum.mul(ws[22], p[31]);
 2396|     15|   accum.mul(ws[23], p[30]);
 2397|     15|   accum.mul(ws[24], p[29]);
 2398|     15|   accum.mul(ws[25], p[28]);
 2399|     15|   accum.mul(ws[26], p[27]);
 2400|     15|   accum.mul(ws[27], p[26]);
 2401|     15|   accum.mul(ws[28], p[25]);
 2402|     15|   accum.mul(ws[29], p[24]);
 2403|     15|   accum.mul(ws[30], p[23]);
 2404|     15|   accum.mul(ws[31], p[22]);
 2405|     15|   accum.add(z[53]);
 2406|     15|   ws[21] = accum.extract();
 2407|     15|   accum.mul(ws[23], p[31]);
 2408|     15|   accum.mul(ws[24], p[30]);
 2409|     15|   accum.mul(ws[25], p[29]);
 2410|     15|   accum.mul(ws[26], p[28]);
 2411|     15|   accum.mul(ws[27], p[27]);
 2412|     15|   accum.mul(ws[28], p[26]);
 2413|     15|   accum.mul(ws[29], p[25]);
 2414|     15|   accum.mul(ws[30], p[24]);
 2415|     15|   accum.mul(ws[31], p[23]);
 2416|     15|   accum.add(z[54]);
 2417|     15|   ws[22] = accum.extract();
 2418|     15|   accum.mul(ws[24], p[31]);
 2419|     15|   accum.mul(ws[25], p[30]);
 2420|     15|   accum.mul(ws[26], p[29]);
 2421|     15|   accum.mul(ws[27], p[28]);
 2422|     15|   accum.mul(ws[28], p[27]);
 2423|     15|   accum.mul(ws[29], p[26]);
 2424|     15|   accum.mul(ws[30], p[25]);
 2425|     15|   accum.mul(ws[31], p[24]);
 2426|     15|   accum.add(z[55]);
 2427|     15|   ws[23] = accum.extract();
 2428|     15|   accum.mul(ws[25], p[31]);
 2429|     15|   accum.mul(ws[26], p[30]);
 2430|     15|   accum.mul(ws[27], p[29]);
 2431|     15|   accum.mul(ws[28], p[28]);
 2432|     15|   accum.mul(ws[29], p[27]);
 2433|     15|   accum.mul(ws[30], p[26]);
 2434|     15|   accum.mul(ws[31], p[25]);
 2435|     15|   accum.add(z[56]);
 2436|     15|   ws[24] = accum.extract();
 2437|     15|   accum.mul(ws[26], p[31]);
 2438|     15|   accum.mul(ws[27], p[30]);
 2439|     15|   accum.mul(ws[28], p[29]);
 2440|     15|   accum.mul(ws[29], p[28]);
 2441|     15|   accum.mul(ws[30], p[27]);
 2442|     15|   accum.mul(ws[31], p[26]);
 2443|     15|   accum.add(z[57]);
 2444|     15|   ws[25] = accum.extract();
 2445|     15|   accum.mul(ws[27], p[31]);
 2446|     15|   accum.mul(ws[28], p[30]);
 2447|     15|   accum.mul(ws[29], p[29]);
 2448|     15|   accum.mul(ws[30], p[28]);
 2449|     15|   accum.mul(ws[31], p[27]);
 2450|     15|   accum.add(z[58]);
 2451|     15|   ws[26] = accum.extract();
 2452|     15|   accum.mul(ws[28], p[31]);
 2453|     15|   accum.mul(ws[29], p[30]);
 2454|     15|   accum.mul(ws[30], p[29]);
 2455|     15|   accum.mul(ws[31], p[28]);
 2456|     15|   accum.add(z[59]);
 2457|     15|   ws[27] = accum.extract();
 2458|     15|   accum.mul(ws[29], p[31]);
 2459|     15|   accum.mul(ws[30], p[30]);
 2460|     15|   accum.mul(ws[31], p[29]);
 2461|     15|   accum.add(z[60]);
 2462|     15|   ws[28] = accum.extract();
 2463|     15|   accum.mul(ws[30], p[31]);
 2464|     15|   accum.mul(ws[31], p[30]);
 2465|     15|   accum.add(z[61]);
 2466|     15|   ws[29] = accum.extract();
 2467|     15|   accum.mul(ws[31], p[31]);
 2468|     15|   accum.add(z[62]);
 2469|     15|   ws[30] = accum.extract();
 2470|     15|   accum.add(z[63]);
 2471|     15|   ws[31] = accum.extract();
 2472|     15|   const word w1 = accum.extract();
 2473|     15|   bigint_monty_maybe_sub<32>(r, w1, ws, p);
 2474|     15|}

_ZN5Botan21bigint_mulx_monty_mulEPmPKmS2_S2_mmS0_:
  111|  45.9k|void bigint_mulx_monty_mul(word z[], const word x[], const word y[], const word p[], size_t N, word p_dash, word ws[]) {
  112|       |   // t[-1] receives the word shifted out by each reduction row
  113|  45.9k|   word* t = ws + 1;
  114|  45.9k|   clear_mem(ws, N + 3);
  115|       |
  116|   867k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (116:22): [True: 821k, False: 45.9k]
  ------------------
  117|   821k|      monty_row(t, t, x, N, y[i], 0);
  118|   821k|      const word m = t[0] * p_dash;
  119|   821k|      monty_row(t - 1, t, p, N, m, 0);
  120|   821k|      t[N + 1] = 0;
  121|   821k|   }
  122|       |
  123|       |   // The result is below 2p, with t[N] holding its top bit
  124|  45.9k|   bigint_monty_maybe_sub(N, z, t[N], t, p);
  125|  45.9k|}
_ZN5Botan21bigint_mulx_monty_sqrEPmPKmS2_mmS0_:
  127|   177k|void bigint_mulx_monty_sqr(word z[], const word x[], const word p[], size_t N, word p_dash, word ws[]) {
  128|   177k|   bigint_mulx_sqr(ws, x, N);
  129|   177k|   bigint_mulx_monty_redc(z, ws, p, N, p_dash);
  130|   177k|}
_ZN5Botan15bigint_mulx_sqrEPmPKmm:
  132|   177k|void bigint_mulx_sqr(word z[], const word x[], size_t N) {
  133|   177k|   clear_mem(z, 2 * N + 1);
  134|       |
  135|       |   /*
  136|       |   * x is split into a leading block of N % 8 words followed by blocks of 8
  137|       |   * words. Rows from the leading block cover every product x[i]*x[j] with
  138|       |   * j > i; rows from the other blocks cover only products with x[j] in a
  139|       |   * later block, so their lengths are multiples of 8.
  140|       |   */
  141|   177k|   const size_t lead = N % 8;
  142|       |
  143|   529k|   for(size_t i = 0; i != lead; ++i) {
  ------------------
  |  Branch (143:22): [True: 351k, False: 177k]
  ------------------
  144|   351k|      monty_row(z + 2 * i + 1, z + 2 * i + 1, x + i + 1, N - i - 1, x[i], 0);
  145|   351k|   }
  146|       |
  147|   354k|   for(size_t b = lead; b + 8 < N; b += 8) {
  ------------------
  |  Branch (147:25): [True: 177k, False: 177k]
  ------------------
  148|  1.59M|      for(size_t i = b; i != b + 8; ++i) {
  ------------------
  |  Branch (148:25): [True: 1.42M, False: 177k]
  ------------------
  149|  1.42M|         monty_row(z + i + b + 8, z + i + b + 8, x + b + 8, N - b - 8, x[i], 0);
  150|  1.42M|      }
  151|   177k|   }
  152|       |
  153|       |   // Double the products while adding the squares not yet included, which together cover z[0..2N)
  154|   177k|   word carry = 0;
  155|   177k|   word top = 0;
  156|   177k|   auto double_and_add = [&](size_t k, word s) {
  157|   177k|      const word w = z[k];
  158|   177k|      z[k] = word_add((w << 1) | top, s, &carry);
  159|   177k|      top = w >> (WordInfo<word>::bits - 1);
  160|   177k|   };
  161|       |
  162|   529k|   for(size_t i = 0; i != lead; ++i) {
  ------------------
  |  Branch (162:22): [True: 351k, False: 177k]
  ------------------
  163|   351k|      word hi = 0;
  164|   351k|      const word lo = word_madd2(x[i], x[i], &hi);
  165|   351k|      double_and_add(2 * i, lo);
  166|   351k|      double_and_add(2 * i + 1, hi);
  167|   351k|   }
  168|       |
  169|   532k|   for(size_t b = lead; b != N; b += 8) {
  ------------------
  |  Branch (169:25): [True: 354k, False: 177k]
  ------------------
  170|   354k|      std::array<word, 16> sq{};
  171|   354k|      bigint_mulx_sqr8(sq.data(), x + b);
  172|  6.03M|      for(size_t k = 0; k != 16; ++k) {
  ------------------
  |  Branch (172:25): [True: 5.67M, False: 354k]
  ------------------
  173|  5.67M|         double_and_add(2 * b + k, sq[k]);
  174|  5.67M|      }
  175|   354k|   }
  176|       |
  177|       |   // The square fits in 2N words
  178|   177k|   BOTAN_DEBUG_ASSERT(carry == 0 && top == 0);
  ------------------
  |  |  137|   177k|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  138|   177k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (138:15): [Folded, False: 177k]
  |  |  ------------------
  ------------------
  179|   177k|}
_ZN5Botan22bigint_mulx_monty_redcEPmS0_PKmmm:
  181|   177k|void bigint_mulx_monty_redc(word r[], word z[], const word p[], size_t N, word p_dash) {
  182|   177k|   z[2 * N] = 0;
  183|       |
  184|   177k|   word c = 0;
  185|  3.36M|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (185:22): [True: 3.19M, False: 177k]
  ------------------
  186|  3.19M|      const word m = z[i] * p_dash;
  187|  3.19M|      c = monty_row(z + i, z + i, p, N, m, c);
  188|  3.19M|   }
  189|       |
  190|       |   // The sum is below 2p * B^N, so the final carry is zero and the top bit is z[2N]
  191|   177k|   BOTAN_DEBUG_ASSERT(c == 0);
  ------------------
  |  |  137|   177k|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  138|   177k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (138:15): [Folded, False: 177k]
  |  |  ------------------
  ------------------
  192|   177k|   bigint_monty_maybe_sub(N, r, z[2 * N], z + N, p);
  193|   177k|}
mp_monty_mulx.cpp:_ZN5Botan12_GLOBAL__N_19monty_rowEPmPKmS3_mmm:
   84|  6.60M|BOTAN_FORCE_INLINE word monty_row(word* out, const word* t, const word* x, size_t N, word b, word c) {
   85|  6.60M|   word carry = 0;
   86|       |   // Advancing the pointers, rather than indexing, keeps the compiler from generating a slower loop
   87|  21.5M|   for(size_t i = N / 8; i != 0; --i) {
  ------------------
  |  Branch (87:26): [True: 14.8M, False: 6.60M]
  ------------------
   88|  14.8M|      carry = muladd8(out, t, x, b, carry);
   89|  14.8M|      out += 8;
   90|  14.8M|      t += 8;
   91|  14.8M|      x += 8;
   92|  14.8M|   }
   93|  6.60M|   if(N % 8 >= 4) {
  ------------------
  |  Branch (93:7): [True: 1.36M, False: 5.24M]
  ------------------
   94|  1.36M|      carry = muladd4(out, t, x, b, carry);
   95|  1.36M|      out += 4;
   96|  1.36M|      t += 4;
   97|  1.36M|      x += 4;
   98|  1.36M|   }
   99|  11.6M|   for(size_t i = N % 4; i != 0; --i) {
  ------------------
  |  Branch (99:26): [True: 5.08M, False: 6.60M]
  ------------------
  100|  5.08M|      *out++ = word_madd3(*x++, b, *t++, &carry);
  101|  5.08M|   }
  102|       |
  103|  6.60M|   word c2 = 0;
  104|  6.60M|   out[0] = word_add(t[0], carry, &c2);
  105|  6.60M|   out[1] = word_add(t[1], c, &c2);
  106|  6.60M|   return c2;
  107|  6.60M|}
mp_monty_mulx.cpp:_ZN5Botan12_GLOBAL__N_17muladd8EPmPKmS3_mm:
   60|  14.8M|BOTAN_FORCE_INLINE word muladd8(word* out, const word* t, const word* x, word b, word carry) {
   61|  14.8M|   word tmp = 0;
   62|  14.8M|   word lo = 0;
   63|  14.8M|   word zero = 0;
   64|  14.8M|   BOTAN_MULADD_ASM(BOTAN_MULADD_STEPS8);
  ------------------
  |  |   38|  14.8M|   asm volatile("xorl %k[zero], %k[zero]\n\t"                                                       \
  |  |   39|  14.8M|                STEPS                                                                               \
  |  |   40|  14.8M|                "adox %[zero], %[carry]\n\t"                                                        \
  |  |   41|  14.8M|                "adcx %[zero], %[carry]\n\t"                                                        \
  |  |   42|  14.8M|                : [carry] "+&r"(carry), [tmp] "=&r"(tmp), [lo] "=&r"(lo), [zero] "=&r"(zero)        \
  |  |   43|  14.8M|                : [out] "r"(out), [t] "r"(t), [x] "r"(x), "d"(b)                                    \
  |  |   44|  14.8M|                : "cc", "memory")
  ------------------
   65|  14.8M|   return carry;
   66|  14.8M|}
mp_monty_mulx.cpp:_ZN5Botan12_GLOBAL__N_17muladd4EPmPKmS3_mm:
   69|  1.36M|BOTAN_FORCE_INLINE word muladd4(word* out, const word* t, const word* x, word b, word carry) {
   70|  1.36M|   word tmp = 0;
   71|  1.36M|   word lo = 0;
   72|  1.36M|   word zero = 0;
   73|  1.36M|   BOTAN_MULADD_ASM(BOTAN_MULADD_STEPS4);
  ------------------
  |  |   38|  1.36M|   asm volatile("xorl %k[zero], %k[zero]\n\t"                                                       \
  |  |   39|  1.36M|                STEPS                                                                               \
  |  |   40|  1.36M|                "adox %[zero], %[carry]\n\t"                                                        \
  |  |   41|  1.36M|                "adcx %[zero], %[carry]\n\t"                                                        \
  |  |   42|  1.36M|                : [carry] "+&r"(carry), [tmp] "=&r"(tmp), [lo] "=&r"(lo), [zero] "=&r"(zero)        \
  |  |   43|  1.36M|                : [out] "r"(out), [t] "r"(t), [x] "r"(x), "d"(b)                                    \
  |  |   44|  1.36M|                : "cc", "memory")
  ------------------
   74|  1.36M|   return carry;
   75|  1.36M|}
mp_monty_mulx.cpp:_ZZN5Botan15bigint_mulx_sqrEPmPKmmENK3$_0clEmm:
  156|  6.38M|   auto double_and_add = [&](size_t k, word s) {
  157|  6.38M|      const word w = z[k];
  158|  6.38M|      z[k] = word_add((w << 1) | top, s, &carry);
  159|  6.38M|      top = w >> (WordInfo<word>::bits - 1);
  160|  6.38M|   };

_ZN5Botan16bigint_mulx_sqr4EPmPKm:
   27|  11.9k|void bigint_mulx_sqr4(word z[8], const word x[4]) {
   28|       |   // clang-format off
   29|  11.9k|   asm(
   30|  11.9k|      "xorl %%r9d, %%r9d\n\t"
   31|  11.9k|      "xorl %%r10d, %%r10d\n\t"
   32|  11.9k|      "xorl %%r8d, %%r8d\n\t"
   33|       |
   34|  11.9k|      "movq 0(%[x]), %%rdx\n\t"  // x[0] * x[1..3]
   35|  11.9k|      "xorl %%eax, %%eax\n\t"
   36|  11.9k|      "mulx 8(%[x]), %%rax, %%rcx\n\t"
   37|  11.9k|      "adcx %%rax, %%r9\n\t"
   38|  11.9k|      "movq %%r9, 8(%[z])\n\t"
   39|  11.9k|      "mulx 16(%[x]), %%rax, %%r9\n\t"
   40|  11.9k|      "adox %%rcx, %%rax\n\t"
   41|  11.9k|      "adcx %%rax, %%r10\n\t"
   42|  11.9k|      "mulx 24(%[x]), %%rax, %%rcx\n\t"
   43|  11.9k|      "adox %%r9, %%rax\n\t"
   44|  11.9k|      "adcx %%rax, %%r8\n\t"
   45|  11.9k|      "movl $0, %%eax\n\t"
   46|  11.9k|      "adox %%rax, %%rcx\n\t"
   47|  11.9k|      "adcx %%rax, %%rcx\n\t"
   48|  11.9k|      "movq %%rcx, %%r9\n\t"
   49|  11.9k|      "movq %%r10, 16(%[z])\n\t"
   50|       |
   51|  11.9k|      "movq 8(%[x]), %%rdx\n\t"  // x[1] * x[2..3]
   52|  11.9k|      "xorl %%eax, %%eax\n\t"
   53|  11.9k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
   54|  11.9k|      "adcx %%rax, %%r8\n\t"
   55|  11.9k|      "movq %%r8, 24(%[z])\n\t"
   56|  11.9k|      "mulx 24(%[x]), %%rax, %%r10\n\t"
   57|  11.9k|      "adox %%rcx, %%rax\n\t"
   58|  11.9k|      "adcx %%rax, %%r9\n\t"
   59|  11.9k|      "movl $0, %%eax\n\t"
   60|  11.9k|      "adox %%rax, %%r10\n\t"
   61|  11.9k|      "adcx %%rax, %%r10\n\t"
   62|  11.9k|      "movq %%r9, 32(%[z])\n\t"
   63|       |
   64|  11.9k|      "movq 16(%[x]), %%rdx\n\t"  // x[2] * x[3..3]
   65|  11.9k|      "xorl %%eax, %%eax\n\t"
   66|  11.9k|      "mulx 24(%[x]), %%rax, %%rcx\n\t"
   67|  11.9k|      "adcx %%rax, %%r10\n\t"
   68|  11.9k|      "movq %%r10, 40(%[z])\n\t"
   69|  11.9k|      "movl $0, %%eax\n\t"
   70|  11.9k|      "adox %%rax, %%rcx\n\t"
   71|  11.9k|      "adcx %%rax, %%rcx\n\t"
   72|  11.9k|      "movq %%rcx, %%r8\n\t"
   73|  11.9k|      "movq %%r8, 48(%[z])\n\t"
   74|       |
   75|  11.9k|      "movq $0, 56(%[z])\n\t"
   76|  11.9k|      "xorl %%eax, %%eax\n\t"  // double the cross products and add the squares
   77|  11.9k|      "movq 0(%[x]), %%rdx\n\t"
   78|  11.9k|      "mulx %%rdx, %%rax, %%rcx\n\t"
   79|  11.9k|      "movq %%rax, 0(%[z])\n\t"
   80|  11.9k|      "movq 8(%[z]), %%r8\n\t"
   81|  11.9k|      "adcx %%r8, %%r8\n\t"
   82|  11.9k|      "adox %%rcx, %%r8\n\t"
   83|  11.9k|      "movq %%r8, 8(%[z])\n\t"
   84|  11.9k|      "movq 8(%[x]), %%rdx\n\t"
   85|  11.9k|      "mulx %%rdx, %%rax, %%rcx\n\t"
   86|  11.9k|      "movq 16(%[z]), %%r8\n\t"
   87|  11.9k|      "adcx %%r8, %%r8\n\t"
   88|  11.9k|      "adox %%rax, %%r8\n\t"
   89|  11.9k|      "movq %%r8, 16(%[z])\n\t"
   90|  11.9k|      "movq 24(%[z]), %%r8\n\t"
   91|  11.9k|      "adcx %%r8, %%r8\n\t"
   92|  11.9k|      "adox %%rcx, %%r8\n\t"
   93|  11.9k|      "movq %%r8, 24(%[z])\n\t"
   94|  11.9k|      "movq 16(%[x]), %%rdx\n\t"
   95|  11.9k|      "mulx %%rdx, %%rax, %%rcx\n\t"
   96|  11.9k|      "movq 32(%[z]), %%r8\n\t"
   97|  11.9k|      "adcx %%r8, %%r8\n\t"
   98|  11.9k|      "adox %%rax, %%r8\n\t"
   99|  11.9k|      "movq %%r8, 32(%[z])\n\t"
  100|  11.9k|      "movq 40(%[z]), %%r8\n\t"
  101|  11.9k|      "adcx %%r8, %%r8\n\t"
  102|  11.9k|      "adox %%rcx, %%r8\n\t"
  103|  11.9k|      "movq %%r8, 40(%[z])\n\t"
  104|  11.9k|      "movq 24(%[x]), %%rdx\n\t"
  105|  11.9k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  106|  11.9k|      "movq 48(%[z]), %%r8\n\t"
  107|  11.9k|      "adcx %%r8, %%r8\n\t"
  108|  11.9k|      "adox %%rax, %%r8\n\t"
  109|  11.9k|      "movq %%r8, 48(%[z])\n\t"
  110|  11.9k|      "movq 56(%[z]), %%r8\n\t"
  111|  11.9k|      "adcx %%r8, %%r8\n\t"
  112|  11.9k|      "adox %%rcx, %%r8\n\t"
  113|  11.9k|      "movq %%r8, 56(%[z])\n\t"
  114|  11.9k|      :
  115|  11.9k|      : [z] "r"(z), [x] "r"(x)
  116|  11.9k|      : "rax", "rcx", "rdx", "r8", "r9", "r10", "cc", "memory");
  117|       |   // clang-format on
  118|  11.9k|}
_ZN5Botan16bigint_mulx_mul4EPmPKmS2_:
  120|  66.9k|void bigint_mulx_mul4(word z[8], const word x[4], const word y[4]) {
  121|       |   // clang-format off
  122|  66.9k|   asm(
  123|  66.9k|      "xorl %%r8d, %%r8d\n\t"
  124|  66.9k|      "xorl %%r9d, %%r9d\n\t"
  125|  66.9k|      "xorl %%r10d, %%r10d\n\t"
  126|  66.9k|      "xorl %%r11d, %%r11d\n\t"
  127|       |
  128|  66.9k|      "movq 0(%[y]), %%rdx\n\t"  // row 0: x * y[0]
  129|  66.9k|      "xorl %%eax, %%eax\n\t"
  130|  66.9k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  131|  66.9k|      "adcx %%rax, %%r8\n\t"
  132|  66.9k|      "movq %%r8, 0(%[z])\n\t"
  133|  66.9k|      "mulx 8(%[x]), %%rax, %%r8\n\t"
  134|  66.9k|      "adox %%rcx, %%rax\n\t"
  135|  66.9k|      "adcx %%rax, %%r9\n\t"
  136|  66.9k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  137|  66.9k|      "adox %%r8, %%rax\n\t"
  138|  66.9k|      "adcx %%rax, %%r10\n\t"
  139|  66.9k|      "mulx 24(%[x]), %%rax, %%r8\n\t"
  140|  66.9k|      "adox %%rcx, %%rax\n\t"
  141|  66.9k|      "adcx %%rax, %%r11\n\t"
  142|  66.9k|      "movl $0, %%eax\n\t"
  143|  66.9k|      "adox %%rax, %%r8\n\t"
  144|  66.9k|      "adcx %%rax, %%r8\n\t"
  145|       |
  146|  66.9k|      "movq 8(%[y]), %%rdx\n\t"  // row 1: x * y[1]
  147|  66.9k|      "xorl %%eax, %%eax\n\t"
  148|  66.9k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  149|  66.9k|      "adcx %%rax, %%r9\n\t"
  150|  66.9k|      "movq %%r9, 8(%[z])\n\t"
  151|  66.9k|      "mulx 8(%[x]), %%rax, %%r9\n\t"
  152|  66.9k|      "adox %%rcx, %%rax\n\t"
  153|  66.9k|      "adcx %%rax, %%r10\n\t"
  154|  66.9k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  155|  66.9k|      "adox %%r9, %%rax\n\t"
  156|  66.9k|      "adcx %%rax, %%r11\n\t"
  157|  66.9k|      "mulx 24(%[x]), %%rax, %%r9\n\t"
  158|  66.9k|      "adox %%rcx, %%rax\n\t"
  159|  66.9k|      "adcx %%rax, %%r8\n\t"
  160|  66.9k|      "movl $0, %%eax\n\t"
  161|  66.9k|      "adox %%rax, %%r9\n\t"
  162|  66.9k|      "adcx %%rax, %%r9\n\t"
  163|       |
  164|  66.9k|      "movq 16(%[y]), %%rdx\n\t"  // row 2: x * y[2]
  165|  66.9k|      "xorl %%eax, %%eax\n\t"
  166|  66.9k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  167|  66.9k|      "adcx %%rax, %%r10\n\t"
  168|  66.9k|      "movq %%r10, 16(%[z])\n\t"
  169|  66.9k|      "mulx 8(%[x]), %%rax, %%r10\n\t"
  170|  66.9k|      "adox %%rcx, %%rax\n\t"
  171|  66.9k|      "adcx %%rax, %%r11\n\t"
  172|  66.9k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  173|  66.9k|      "adox %%r10, %%rax\n\t"
  174|  66.9k|      "adcx %%rax, %%r8\n\t"
  175|  66.9k|      "mulx 24(%[x]), %%rax, %%r10\n\t"
  176|  66.9k|      "adox %%rcx, %%rax\n\t"
  177|  66.9k|      "adcx %%rax, %%r9\n\t"
  178|  66.9k|      "movl $0, %%eax\n\t"
  179|  66.9k|      "adox %%rax, %%r10\n\t"
  180|  66.9k|      "adcx %%rax, %%r10\n\t"
  181|       |
  182|  66.9k|      "movq 24(%[y]), %%rdx\n\t"  // row 3: x * y[3]
  183|  66.9k|      "xorl %%eax, %%eax\n\t"
  184|  66.9k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  185|  66.9k|      "adcx %%rax, %%r11\n\t"
  186|  66.9k|      "movq %%r11, 24(%[z])\n\t"
  187|  66.9k|      "mulx 8(%[x]), %%rax, %%r11\n\t"
  188|  66.9k|      "adox %%rcx, %%rax\n\t"
  189|  66.9k|      "adcx %%rax, %%r8\n\t"
  190|  66.9k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  191|  66.9k|      "adox %%r11, %%rax\n\t"
  192|  66.9k|      "adcx %%rax, %%r9\n\t"
  193|  66.9k|      "mulx 24(%[x]), %%rax, %%r11\n\t"
  194|  66.9k|      "adox %%rcx, %%rax\n\t"
  195|  66.9k|      "adcx %%rax, %%r10\n\t"
  196|  66.9k|      "movl $0, %%eax\n\t"
  197|  66.9k|      "adox %%rax, %%r11\n\t"
  198|  66.9k|      "adcx %%rax, %%r11\n\t"
  199|       |
  200|  66.9k|      "movq %%r8, 32(%[z])\n\t"
  201|  66.9k|      "movq %%r9, 40(%[z])\n\t"
  202|  66.9k|      "movq %%r10, 48(%[z])\n\t"
  203|  66.9k|      "movq %%r11, 56(%[z])\n\t"
  204|  66.9k|      :
  205|  66.9k|      : [z] "r"(z), [x] "r"(x), [y] "r"(y)
  206|  66.9k|      : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "cc", "memory");
  207|       |   // clang-format on
  208|  66.9k|}
_ZN5Botan16bigint_mulx_sqr6EPmPKm:
  210|  14.4k|void bigint_mulx_sqr6(word z[12], const word x[6]) {
  211|       |   // clang-format off
  212|  14.4k|   asm(
  213|  14.4k|      "xorl %%r9d, %%r9d\n\t"
  214|  14.4k|      "xorl %%r10d, %%r10d\n\t"
  215|  14.4k|      "xorl %%r11d, %%r11d\n\t"
  216|  14.4k|      "xorl %%r12d, %%r12d\n\t"
  217|  14.4k|      "xorl %%r8d, %%r8d\n\t"
  218|       |
  219|  14.4k|      "movq 0(%[x]), %%rdx\n\t"  // x[0] * x[1..5]
  220|  14.4k|      "xorl %%eax, %%eax\n\t"
  221|  14.4k|      "mulx 8(%[x]), %%rax, %%rcx\n\t"
  222|  14.4k|      "adcx %%rax, %%r9\n\t"
  223|  14.4k|      "movq %%r9, 8(%[z])\n\t"
  224|  14.4k|      "mulx 16(%[x]), %%rax, %%r9\n\t"
  225|  14.4k|      "adox %%rcx, %%rax\n\t"
  226|  14.4k|      "adcx %%rax, %%r10\n\t"
  227|  14.4k|      "mulx 24(%[x]), %%rax, %%rcx\n\t"
  228|  14.4k|      "adox %%r9, %%rax\n\t"
  229|  14.4k|      "adcx %%rax, %%r11\n\t"
  230|  14.4k|      "mulx 32(%[x]), %%rax, %%r9\n\t"
  231|  14.4k|      "adox %%rcx, %%rax\n\t"
  232|  14.4k|      "adcx %%rax, %%r12\n\t"
  233|  14.4k|      "mulx 40(%[x]), %%rax, %%rcx\n\t"
  234|  14.4k|      "adox %%r9, %%rax\n\t"
  235|  14.4k|      "adcx %%rax, %%r8\n\t"
  236|  14.4k|      "movl $0, %%eax\n\t"
  237|  14.4k|      "adox %%rax, %%rcx\n\t"
  238|  14.4k|      "adcx %%rax, %%rcx\n\t"
  239|  14.4k|      "movq %%rcx, %%r9\n\t"
  240|  14.4k|      "movq %%r10, 16(%[z])\n\t"
  241|       |
  242|  14.4k|      "movq 8(%[x]), %%rdx\n\t"  // x[1] * x[2..5]
  243|  14.4k|      "xorl %%eax, %%eax\n\t"
  244|  14.4k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  245|  14.4k|      "adcx %%rax, %%r11\n\t"
  246|  14.4k|      "movq %%r11, 24(%[z])\n\t"
  247|  14.4k|      "mulx 24(%[x]), %%rax, %%r10\n\t"
  248|  14.4k|      "adox %%rcx, %%rax\n\t"
  249|  14.4k|      "adcx %%rax, %%r12\n\t"
  250|  14.4k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  251|  14.4k|      "adox %%r10, %%rax\n\t"
  252|  14.4k|      "adcx %%rax, %%r8\n\t"
  253|  14.4k|      "mulx 40(%[x]), %%rax, %%r10\n\t"
  254|  14.4k|      "adox %%rcx, %%rax\n\t"
  255|  14.4k|      "adcx %%rax, %%r9\n\t"
  256|  14.4k|      "movl $0, %%eax\n\t"
  257|  14.4k|      "adox %%rax, %%r10\n\t"
  258|  14.4k|      "adcx %%rax, %%r10\n\t"
  259|  14.4k|      "movq %%r12, 32(%[z])\n\t"
  260|       |
  261|  14.4k|      "movq 16(%[x]), %%rdx\n\t"  // x[2] * x[3..5]
  262|  14.4k|      "xorl %%eax, %%eax\n\t"
  263|  14.4k|      "mulx 24(%[x]), %%rax, %%rcx\n\t"
  264|  14.4k|      "adcx %%rax, %%r8\n\t"
  265|  14.4k|      "movq %%r8, 40(%[z])\n\t"
  266|  14.4k|      "mulx 32(%[x]), %%rax, %%r11\n\t"
  267|  14.4k|      "adox %%rcx, %%rax\n\t"
  268|  14.4k|      "adcx %%rax, %%r9\n\t"
  269|  14.4k|      "mulx 40(%[x]), %%rax, %%rcx\n\t"
  270|  14.4k|      "adox %%r11, %%rax\n\t"
  271|  14.4k|      "adcx %%rax, %%r10\n\t"
  272|  14.4k|      "movl $0, %%eax\n\t"
  273|  14.4k|      "adox %%rax, %%rcx\n\t"
  274|  14.4k|      "adcx %%rax, %%rcx\n\t"
  275|  14.4k|      "movq %%rcx, %%r11\n\t"
  276|  14.4k|      "movq %%r9, 48(%[z])\n\t"
  277|       |
  278|  14.4k|      "movq 24(%[x]), %%rdx\n\t"  // x[3] * x[4..5]
  279|  14.4k|      "xorl %%eax, %%eax\n\t"
  280|  14.4k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  281|  14.4k|      "adcx %%rax, %%r10\n\t"
  282|  14.4k|      "movq %%r10, 56(%[z])\n\t"
  283|  14.4k|      "mulx 40(%[x]), %%rax, %%r12\n\t"
  284|  14.4k|      "adox %%rcx, %%rax\n\t"
  285|  14.4k|      "adcx %%rax, %%r11\n\t"
  286|  14.4k|      "movl $0, %%eax\n\t"
  287|  14.4k|      "adox %%rax, %%r12\n\t"
  288|  14.4k|      "adcx %%rax, %%r12\n\t"
  289|  14.4k|      "movq %%r11, 64(%[z])\n\t"
  290|       |
  291|  14.4k|      "movq 32(%[x]), %%rdx\n\t"  // x[4] * x[5..5]
  292|  14.4k|      "xorl %%eax, %%eax\n\t"
  293|  14.4k|      "mulx 40(%[x]), %%rax, %%rcx\n\t"
  294|  14.4k|      "adcx %%rax, %%r12\n\t"
  295|  14.4k|      "movq %%r12, 72(%[z])\n\t"
  296|  14.4k|      "movl $0, %%eax\n\t"
  297|  14.4k|      "adox %%rax, %%rcx\n\t"
  298|  14.4k|      "adcx %%rax, %%rcx\n\t"
  299|  14.4k|      "movq %%rcx, %%r8\n\t"
  300|  14.4k|      "movq %%r8, 80(%[z])\n\t"
  301|       |
  302|  14.4k|      "movq $0, 88(%[z])\n\t"
  303|  14.4k|      "xorl %%eax, %%eax\n\t"  // double the cross products and add the squares
  304|  14.4k|      "movq 0(%[x]), %%rdx\n\t"
  305|  14.4k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  306|  14.4k|      "movq %%rax, 0(%[z])\n\t"
  307|  14.4k|      "movq 8(%[z]), %%r8\n\t"
  308|  14.4k|      "adcx %%r8, %%r8\n\t"
  309|  14.4k|      "adox %%rcx, %%r8\n\t"
  310|  14.4k|      "movq %%r8, 8(%[z])\n\t"
  311|  14.4k|      "movq 8(%[x]), %%rdx\n\t"
  312|  14.4k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  313|  14.4k|      "movq 16(%[z]), %%r8\n\t"
  314|  14.4k|      "adcx %%r8, %%r8\n\t"
  315|  14.4k|      "adox %%rax, %%r8\n\t"
  316|  14.4k|      "movq %%r8, 16(%[z])\n\t"
  317|  14.4k|      "movq 24(%[z]), %%r8\n\t"
  318|  14.4k|      "adcx %%r8, %%r8\n\t"
  319|  14.4k|      "adox %%rcx, %%r8\n\t"
  320|  14.4k|      "movq %%r8, 24(%[z])\n\t"
  321|  14.4k|      "movq 16(%[x]), %%rdx\n\t"
  322|  14.4k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  323|  14.4k|      "movq 32(%[z]), %%r8\n\t"
  324|  14.4k|      "adcx %%r8, %%r8\n\t"
  325|  14.4k|      "adox %%rax, %%r8\n\t"
  326|  14.4k|      "movq %%r8, 32(%[z])\n\t"
  327|  14.4k|      "movq 40(%[z]), %%r8\n\t"
  328|  14.4k|      "adcx %%r8, %%r8\n\t"
  329|  14.4k|      "adox %%rcx, %%r8\n\t"
  330|  14.4k|      "movq %%r8, 40(%[z])\n\t"
  331|  14.4k|      "movq 24(%[x]), %%rdx\n\t"
  332|  14.4k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  333|  14.4k|      "movq 48(%[z]), %%r8\n\t"
  334|  14.4k|      "adcx %%r8, %%r8\n\t"
  335|  14.4k|      "adox %%rax, %%r8\n\t"
  336|  14.4k|      "movq %%r8, 48(%[z])\n\t"
  337|  14.4k|      "movq 56(%[z]), %%r8\n\t"
  338|  14.4k|      "adcx %%r8, %%r8\n\t"
  339|  14.4k|      "adox %%rcx, %%r8\n\t"
  340|  14.4k|      "movq %%r8, 56(%[z])\n\t"
  341|  14.4k|      "movq 32(%[x]), %%rdx\n\t"
  342|  14.4k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  343|  14.4k|      "movq 64(%[z]), %%r8\n\t"
  344|  14.4k|      "adcx %%r8, %%r8\n\t"
  345|  14.4k|      "adox %%rax, %%r8\n\t"
  346|  14.4k|      "movq %%r8, 64(%[z])\n\t"
  347|  14.4k|      "movq 72(%[z]), %%r8\n\t"
  348|  14.4k|      "adcx %%r8, %%r8\n\t"
  349|  14.4k|      "adox %%rcx, %%r8\n\t"
  350|  14.4k|      "movq %%r8, 72(%[z])\n\t"
  351|  14.4k|      "movq 40(%[x]), %%rdx\n\t"
  352|  14.4k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  353|  14.4k|      "movq 80(%[z]), %%r8\n\t"
  354|  14.4k|      "adcx %%r8, %%r8\n\t"
  355|  14.4k|      "adox %%rax, %%r8\n\t"
  356|  14.4k|      "movq %%r8, 80(%[z])\n\t"
  357|  14.4k|      "movq 88(%[z]), %%r8\n\t"
  358|  14.4k|      "adcx %%r8, %%r8\n\t"
  359|  14.4k|      "adox %%rcx, %%r8\n\t"
  360|  14.4k|      "movq %%r8, 88(%[z])\n\t"
  361|  14.4k|      :
  362|  14.4k|      : [z] "r"(z), [x] "r"(x)
  363|  14.4k|      : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "cc", "memory");
  364|       |   // clang-format on
  365|  14.4k|}
_ZN5Botan16bigint_mulx_mul6EPmPKmS2_:
  367|  40.5k|void bigint_mulx_mul6(word z[12], const word x[6], const word y[6]) {
  368|       |   // clang-format off
  369|  40.5k|   asm(
  370|  40.5k|      "xorl %%r8d, %%r8d\n\t"
  371|  40.5k|      "xorl %%r9d, %%r9d\n\t"
  372|  40.5k|      "xorl %%r10d, %%r10d\n\t"
  373|  40.5k|      "xorl %%r11d, %%r11d\n\t"
  374|  40.5k|      "xorl %%r12d, %%r12d\n\t"
  375|  40.5k|      "xorl %%r13d, %%r13d\n\t"
  376|       |
  377|  40.5k|      "movq 0(%[y]), %%rdx\n\t"  // row 0: x * y[0]
  378|  40.5k|      "xorl %%eax, %%eax\n\t"
  379|  40.5k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  380|  40.5k|      "adcx %%rax, %%r8\n\t"
  381|  40.5k|      "movq %%r8, 0(%[z])\n\t"
  382|  40.5k|      "mulx 8(%[x]), %%rax, %%r8\n\t"
  383|  40.5k|      "adox %%rcx, %%rax\n\t"
  384|  40.5k|      "adcx %%rax, %%r9\n\t"
  385|  40.5k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  386|  40.5k|      "adox %%r8, %%rax\n\t"
  387|  40.5k|      "adcx %%rax, %%r10\n\t"
  388|  40.5k|      "mulx 24(%[x]), %%rax, %%r8\n\t"
  389|  40.5k|      "adox %%rcx, %%rax\n\t"
  390|  40.5k|      "adcx %%rax, %%r11\n\t"
  391|  40.5k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  392|  40.5k|      "adox %%r8, %%rax\n\t"
  393|  40.5k|      "adcx %%rax, %%r12\n\t"
  394|  40.5k|      "mulx 40(%[x]), %%rax, %%r8\n\t"
  395|  40.5k|      "adox %%rcx, %%rax\n\t"
  396|  40.5k|      "adcx %%rax, %%r13\n\t"
  397|  40.5k|      "movl $0, %%eax\n\t"
  398|  40.5k|      "adox %%rax, %%r8\n\t"
  399|  40.5k|      "adcx %%rax, %%r8\n\t"
  400|       |
  401|  40.5k|      "movq 8(%[y]), %%rdx\n\t"  // row 1: x * y[1]
  402|  40.5k|      "xorl %%eax, %%eax\n\t"
  403|  40.5k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  404|  40.5k|      "adcx %%rax, %%r9\n\t"
  405|  40.5k|      "movq %%r9, 8(%[z])\n\t"
  406|  40.5k|      "mulx 8(%[x]), %%rax, %%r9\n\t"
  407|  40.5k|      "adox %%rcx, %%rax\n\t"
  408|  40.5k|      "adcx %%rax, %%r10\n\t"
  409|  40.5k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  410|  40.5k|      "adox %%r9, %%rax\n\t"
  411|  40.5k|      "adcx %%rax, %%r11\n\t"
  412|  40.5k|      "mulx 24(%[x]), %%rax, %%r9\n\t"
  413|  40.5k|      "adox %%rcx, %%rax\n\t"
  414|  40.5k|      "adcx %%rax, %%r12\n\t"
  415|  40.5k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  416|  40.5k|      "adox %%r9, %%rax\n\t"
  417|  40.5k|      "adcx %%rax, %%r13\n\t"
  418|  40.5k|      "mulx 40(%[x]), %%rax, %%r9\n\t"
  419|  40.5k|      "adox %%rcx, %%rax\n\t"
  420|  40.5k|      "adcx %%rax, %%r8\n\t"
  421|  40.5k|      "movl $0, %%eax\n\t"
  422|  40.5k|      "adox %%rax, %%r9\n\t"
  423|  40.5k|      "adcx %%rax, %%r9\n\t"
  424|       |
  425|  40.5k|      "movq 16(%[y]), %%rdx\n\t"  // row 2: x * y[2]
  426|  40.5k|      "xorl %%eax, %%eax\n\t"
  427|  40.5k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  428|  40.5k|      "adcx %%rax, %%r10\n\t"
  429|  40.5k|      "movq %%r10, 16(%[z])\n\t"
  430|  40.5k|      "mulx 8(%[x]), %%rax, %%r10\n\t"
  431|  40.5k|      "adox %%rcx, %%rax\n\t"
  432|  40.5k|      "adcx %%rax, %%r11\n\t"
  433|  40.5k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  434|  40.5k|      "adox %%r10, %%rax\n\t"
  435|  40.5k|      "adcx %%rax, %%r12\n\t"
  436|  40.5k|      "mulx 24(%[x]), %%rax, %%r10\n\t"
  437|  40.5k|      "adox %%rcx, %%rax\n\t"
  438|  40.5k|      "adcx %%rax, %%r13\n\t"
  439|  40.5k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  440|  40.5k|      "adox %%r10, %%rax\n\t"
  441|  40.5k|      "adcx %%rax, %%r8\n\t"
  442|  40.5k|      "mulx 40(%[x]), %%rax, %%r10\n\t"
  443|  40.5k|      "adox %%rcx, %%rax\n\t"
  444|  40.5k|      "adcx %%rax, %%r9\n\t"
  445|  40.5k|      "movl $0, %%eax\n\t"
  446|  40.5k|      "adox %%rax, %%r10\n\t"
  447|  40.5k|      "adcx %%rax, %%r10\n\t"
  448|       |
  449|  40.5k|      "movq 24(%[y]), %%rdx\n\t"  // row 3: x * y[3]
  450|  40.5k|      "xorl %%eax, %%eax\n\t"
  451|  40.5k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  452|  40.5k|      "adcx %%rax, %%r11\n\t"
  453|  40.5k|      "movq %%r11, 24(%[z])\n\t"
  454|  40.5k|      "mulx 8(%[x]), %%rax, %%r11\n\t"
  455|  40.5k|      "adox %%rcx, %%rax\n\t"
  456|  40.5k|      "adcx %%rax, %%r12\n\t"
  457|  40.5k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  458|  40.5k|      "adox %%r11, %%rax\n\t"
  459|  40.5k|      "adcx %%rax, %%r13\n\t"
  460|  40.5k|      "mulx 24(%[x]), %%rax, %%r11\n\t"
  461|  40.5k|      "adox %%rcx, %%rax\n\t"
  462|  40.5k|      "adcx %%rax, %%r8\n\t"
  463|  40.5k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  464|  40.5k|      "adox %%r11, %%rax\n\t"
  465|  40.5k|      "adcx %%rax, %%r9\n\t"
  466|  40.5k|      "mulx 40(%[x]), %%rax, %%r11\n\t"
  467|  40.5k|      "adox %%rcx, %%rax\n\t"
  468|  40.5k|      "adcx %%rax, %%r10\n\t"
  469|  40.5k|      "movl $0, %%eax\n\t"
  470|  40.5k|      "adox %%rax, %%r11\n\t"
  471|  40.5k|      "adcx %%rax, %%r11\n\t"
  472|       |
  473|  40.5k|      "movq 32(%[y]), %%rdx\n\t"  // row 4: x * y[4]
  474|  40.5k|      "xorl %%eax, %%eax\n\t"
  475|  40.5k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  476|  40.5k|      "adcx %%rax, %%r12\n\t"
  477|  40.5k|      "movq %%r12, 32(%[z])\n\t"
  478|  40.5k|      "mulx 8(%[x]), %%rax, %%r12\n\t"
  479|  40.5k|      "adox %%rcx, %%rax\n\t"
  480|  40.5k|      "adcx %%rax, %%r13\n\t"
  481|  40.5k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  482|  40.5k|      "adox %%r12, %%rax\n\t"
  483|  40.5k|      "adcx %%rax, %%r8\n\t"
  484|  40.5k|      "mulx 24(%[x]), %%rax, %%r12\n\t"
  485|  40.5k|      "adox %%rcx, %%rax\n\t"
  486|  40.5k|      "adcx %%rax, %%r9\n\t"
  487|  40.5k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  488|  40.5k|      "adox %%r12, %%rax\n\t"
  489|  40.5k|      "adcx %%rax, %%r10\n\t"
  490|  40.5k|      "mulx 40(%[x]), %%rax, %%r12\n\t"
  491|  40.5k|      "adox %%rcx, %%rax\n\t"
  492|  40.5k|      "adcx %%rax, %%r11\n\t"
  493|  40.5k|      "movl $0, %%eax\n\t"
  494|  40.5k|      "adox %%rax, %%r12\n\t"
  495|  40.5k|      "adcx %%rax, %%r12\n\t"
  496|       |
  497|  40.5k|      "movq 40(%[y]), %%rdx\n\t"  // row 5: x * y[5]
  498|  40.5k|      "xorl %%eax, %%eax\n\t"
  499|  40.5k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  500|  40.5k|      "adcx %%rax, %%r13\n\t"
  501|  40.5k|      "movq %%r13, 40(%[z])\n\t"
  502|  40.5k|      "mulx 8(%[x]), %%rax, %%r13\n\t"
  503|  40.5k|      "adox %%rcx, %%rax\n\t"
  504|  40.5k|      "adcx %%rax, %%r8\n\t"
  505|  40.5k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  506|  40.5k|      "adox %%r13, %%rax\n\t"
  507|  40.5k|      "adcx %%rax, %%r9\n\t"
  508|  40.5k|      "mulx 24(%[x]), %%rax, %%r13\n\t"
  509|  40.5k|      "adox %%rcx, %%rax\n\t"
  510|  40.5k|      "adcx %%rax, %%r10\n\t"
  511|  40.5k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  512|  40.5k|      "adox %%r13, %%rax\n\t"
  513|  40.5k|      "adcx %%rax, %%r11\n\t"
  514|  40.5k|      "mulx 40(%[x]), %%rax, %%r13\n\t"
  515|  40.5k|      "adox %%rcx, %%rax\n\t"
  516|  40.5k|      "adcx %%rax, %%r12\n\t"
  517|  40.5k|      "movl $0, %%eax\n\t"
  518|  40.5k|      "adox %%rax, %%r13\n\t"
  519|  40.5k|      "adcx %%rax, %%r13\n\t"
  520|       |
  521|  40.5k|      "movq %%r8, 48(%[z])\n\t"
  522|  40.5k|      "movq %%r9, 56(%[z])\n\t"
  523|  40.5k|      "movq %%r10, 64(%[z])\n\t"
  524|  40.5k|      "movq %%r11, 72(%[z])\n\t"
  525|  40.5k|      "movq %%r12, 80(%[z])\n\t"
  526|  40.5k|      "movq %%r13, 88(%[z])\n\t"
  527|  40.5k|      :
  528|  40.5k|      : [z] "r"(z), [x] "r"(x), [y] "r"(y)
  529|  40.5k|      : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "cc", "memory");
  530|       |   // clang-format on
  531|  40.5k|}
_ZN5Botan16bigint_mulx_sqr8EPmPKm:
  533|   381k|void bigint_mulx_sqr8(word z[16], const word x[8]) {
  534|       |   // clang-format off
  535|   381k|   asm(
  536|   381k|      "xorl %%r9d, %%r9d\n\t"
  537|   381k|      "xorl %%r10d, %%r10d\n\t"
  538|   381k|      "xorl %%r11d, %%r11d\n\t"
  539|   381k|      "xorl %%r12d, %%r12d\n\t"
  540|   381k|      "xorl %%r13d, %%r13d\n\t"
  541|   381k|      "xorl %%r14d, %%r14d\n\t"
  542|   381k|      "xorl %%r8d, %%r8d\n\t"
  543|       |
  544|   381k|      "movq 0(%[x]), %%rdx\n\t"  // x[0] * x[1..7]
  545|   381k|      "xorl %%eax, %%eax\n\t"
  546|   381k|      "mulx 8(%[x]), %%rax, %%rcx\n\t"
  547|   381k|      "adcx %%rax, %%r9\n\t"
  548|   381k|      "movq %%r9, 8(%[z])\n\t"
  549|   381k|      "mulx 16(%[x]), %%rax, %%r9\n\t"
  550|   381k|      "adox %%rcx, %%rax\n\t"
  551|   381k|      "adcx %%rax, %%r10\n\t"
  552|   381k|      "mulx 24(%[x]), %%rax, %%rcx\n\t"
  553|   381k|      "adox %%r9, %%rax\n\t"
  554|   381k|      "adcx %%rax, %%r11\n\t"
  555|   381k|      "mulx 32(%[x]), %%rax, %%r9\n\t"
  556|   381k|      "adox %%rcx, %%rax\n\t"
  557|   381k|      "adcx %%rax, %%r12\n\t"
  558|   381k|      "mulx 40(%[x]), %%rax, %%rcx\n\t"
  559|   381k|      "adox %%r9, %%rax\n\t"
  560|   381k|      "adcx %%rax, %%r13\n\t"
  561|   381k|      "mulx 48(%[x]), %%rax, %%r9\n\t"
  562|   381k|      "adox %%rcx, %%rax\n\t"
  563|   381k|      "adcx %%rax, %%r14\n\t"
  564|   381k|      "mulx 56(%[x]), %%rax, %%rcx\n\t"
  565|   381k|      "adox %%r9, %%rax\n\t"
  566|   381k|      "adcx %%rax, %%r8\n\t"
  567|   381k|      "movl $0, %%eax\n\t"
  568|   381k|      "adox %%rax, %%rcx\n\t"
  569|   381k|      "adcx %%rax, %%rcx\n\t"
  570|   381k|      "movq %%rcx, %%r9\n\t"
  571|   381k|      "movq %%r10, 16(%[z])\n\t"
  572|       |
  573|   381k|      "movq 8(%[x]), %%rdx\n\t"  // x[1] * x[2..7]
  574|   381k|      "xorl %%eax, %%eax\n\t"
  575|   381k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  576|   381k|      "adcx %%rax, %%r11\n\t"
  577|   381k|      "movq %%r11, 24(%[z])\n\t"
  578|   381k|      "mulx 24(%[x]), %%rax, %%r10\n\t"
  579|   381k|      "adox %%rcx, %%rax\n\t"
  580|   381k|      "adcx %%rax, %%r12\n\t"
  581|   381k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  582|   381k|      "adox %%r10, %%rax\n\t"
  583|   381k|      "adcx %%rax, %%r13\n\t"
  584|   381k|      "mulx 40(%[x]), %%rax, %%r10\n\t"
  585|   381k|      "adox %%rcx, %%rax\n\t"
  586|   381k|      "adcx %%rax, %%r14\n\t"
  587|   381k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  588|   381k|      "adox %%r10, %%rax\n\t"
  589|   381k|      "adcx %%rax, %%r8\n\t"
  590|   381k|      "mulx 56(%[x]), %%rax, %%r10\n\t"
  591|   381k|      "adox %%rcx, %%rax\n\t"
  592|   381k|      "adcx %%rax, %%r9\n\t"
  593|   381k|      "movl $0, %%eax\n\t"
  594|   381k|      "adox %%rax, %%r10\n\t"
  595|   381k|      "adcx %%rax, %%r10\n\t"
  596|   381k|      "movq %%r12, 32(%[z])\n\t"
  597|       |
  598|   381k|      "movq 16(%[x]), %%rdx\n\t"  // x[2] * x[3..7]
  599|   381k|      "xorl %%eax, %%eax\n\t"
  600|   381k|      "mulx 24(%[x]), %%rax, %%rcx\n\t"
  601|   381k|      "adcx %%rax, %%r13\n\t"
  602|   381k|      "movq %%r13, 40(%[z])\n\t"
  603|   381k|      "mulx 32(%[x]), %%rax, %%r11\n\t"
  604|   381k|      "adox %%rcx, %%rax\n\t"
  605|   381k|      "adcx %%rax, %%r14\n\t"
  606|   381k|      "mulx 40(%[x]), %%rax, %%rcx\n\t"
  607|   381k|      "adox %%r11, %%rax\n\t"
  608|   381k|      "adcx %%rax, %%r8\n\t"
  609|   381k|      "mulx 48(%[x]), %%rax, %%r11\n\t"
  610|   381k|      "adox %%rcx, %%rax\n\t"
  611|   381k|      "adcx %%rax, %%r9\n\t"
  612|   381k|      "mulx 56(%[x]), %%rax, %%rcx\n\t"
  613|   381k|      "adox %%r11, %%rax\n\t"
  614|   381k|      "adcx %%rax, %%r10\n\t"
  615|   381k|      "movl $0, %%eax\n\t"
  616|   381k|      "adox %%rax, %%rcx\n\t"
  617|   381k|      "adcx %%rax, %%rcx\n\t"
  618|   381k|      "movq %%rcx, %%r11\n\t"
  619|   381k|      "movq %%r14, 48(%[z])\n\t"
  620|       |
  621|   381k|      "movq 24(%[x]), %%rdx\n\t"  // x[3] * x[4..7]
  622|   381k|      "xorl %%eax, %%eax\n\t"
  623|   381k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  624|   381k|      "adcx %%rax, %%r8\n\t"
  625|   381k|      "movq %%r8, 56(%[z])\n\t"
  626|   381k|      "mulx 40(%[x]), %%rax, %%r12\n\t"
  627|   381k|      "adox %%rcx, %%rax\n\t"
  628|   381k|      "adcx %%rax, %%r9\n\t"
  629|   381k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  630|   381k|      "adox %%r12, %%rax\n\t"
  631|   381k|      "adcx %%rax, %%r10\n\t"
  632|   381k|      "mulx 56(%[x]), %%rax, %%r12\n\t"
  633|   381k|      "adox %%rcx, %%rax\n\t"
  634|   381k|      "adcx %%rax, %%r11\n\t"
  635|   381k|      "movl $0, %%eax\n\t"
  636|   381k|      "adox %%rax, %%r12\n\t"
  637|   381k|      "adcx %%rax, %%r12\n\t"
  638|   381k|      "movq %%r9, 64(%[z])\n\t"
  639|       |
  640|   381k|      "movq 32(%[x]), %%rdx\n\t"  // x[4] * x[5..7]
  641|   381k|      "xorl %%eax, %%eax\n\t"
  642|   381k|      "mulx 40(%[x]), %%rax, %%rcx\n\t"
  643|   381k|      "adcx %%rax, %%r10\n\t"
  644|   381k|      "movq %%r10, 72(%[z])\n\t"
  645|   381k|      "mulx 48(%[x]), %%rax, %%r13\n\t"
  646|   381k|      "adox %%rcx, %%rax\n\t"
  647|   381k|      "adcx %%rax, %%r11\n\t"
  648|   381k|      "mulx 56(%[x]), %%rax, %%rcx\n\t"
  649|   381k|      "adox %%r13, %%rax\n\t"
  650|   381k|      "adcx %%rax, %%r12\n\t"
  651|   381k|      "movl $0, %%eax\n\t"
  652|   381k|      "adox %%rax, %%rcx\n\t"
  653|   381k|      "adcx %%rax, %%rcx\n\t"
  654|   381k|      "movq %%rcx, %%r13\n\t"
  655|   381k|      "movq %%r11, 80(%[z])\n\t"
  656|       |
  657|   381k|      "movq 40(%[x]), %%rdx\n\t"  // x[5] * x[6..7]
  658|   381k|      "xorl %%eax, %%eax\n\t"
  659|   381k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  660|   381k|      "adcx %%rax, %%r12\n\t"
  661|   381k|      "movq %%r12, 88(%[z])\n\t"
  662|   381k|      "mulx 56(%[x]), %%rax, %%r14\n\t"
  663|   381k|      "adox %%rcx, %%rax\n\t"
  664|   381k|      "adcx %%rax, %%r13\n\t"
  665|   381k|      "movl $0, %%eax\n\t"
  666|   381k|      "adox %%rax, %%r14\n\t"
  667|   381k|      "adcx %%rax, %%r14\n\t"
  668|   381k|      "movq %%r13, 96(%[z])\n\t"
  669|       |
  670|   381k|      "movq 48(%[x]), %%rdx\n\t"  // x[6] * x[7..7]
  671|   381k|      "xorl %%eax, %%eax\n\t"
  672|   381k|      "mulx 56(%[x]), %%rax, %%rcx\n\t"
  673|   381k|      "adcx %%rax, %%r14\n\t"
  674|   381k|      "movq %%r14, 104(%[z])\n\t"
  675|   381k|      "movl $0, %%eax\n\t"
  676|   381k|      "adox %%rax, %%rcx\n\t"
  677|   381k|      "adcx %%rax, %%rcx\n\t"
  678|   381k|      "movq %%rcx, %%r8\n\t"
  679|   381k|      "movq %%r8, 112(%[z])\n\t"
  680|       |
  681|   381k|      "movq $0, 120(%[z])\n\t"
  682|   381k|      "xorl %%eax, %%eax\n\t"  // double the cross products and add the squares
  683|   381k|      "movq 0(%[x]), %%rdx\n\t"
  684|   381k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  685|   381k|      "movq %%rax, 0(%[z])\n\t"
  686|   381k|      "movq 8(%[z]), %%r8\n\t"
  687|   381k|      "adcx %%r8, %%r8\n\t"
  688|   381k|      "adox %%rcx, %%r8\n\t"
  689|   381k|      "movq %%r8, 8(%[z])\n\t"
  690|   381k|      "movq 8(%[x]), %%rdx\n\t"
  691|   381k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  692|   381k|      "movq 16(%[z]), %%r8\n\t"
  693|   381k|      "adcx %%r8, %%r8\n\t"
  694|   381k|      "adox %%rax, %%r8\n\t"
  695|   381k|      "movq %%r8, 16(%[z])\n\t"
  696|   381k|      "movq 24(%[z]), %%r8\n\t"
  697|   381k|      "adcx %%r8, %%r8\n\t"
  698|   381k|      "adox %%rcx, %%r8\n\t"
  699|   381k|      "movq %%r8, 24(%[z])\n\t"
  700|   381k|      "movq 16(%[x]), %%rdx\n\t"
  701|   381k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  702|   381k|      "movq 32(%[z]), %%r8\n\t"
  703|   381k|      "adcx %%r8, %%r8\n\t"
  704|   381k|      "adox %%rax, %%r8\n\t"
  705|   381k|      "movq %%r8, 32(%[z])\n\t"
  706|   381k|      "movq 40(%[z]), %%r8\n\t"
  707|   381k|      "adcx %%r8, %%r8\n\t"
  708|   381k|      "adox %%rcx, %%r8\n\t"
  709|   381k|      "movq %%r8, 40(%[z])\n\t"
  710|   381k|      "movq 24(%[x]), %%rdx\n\t"
  711|   381k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  712|   381k|      "movq 48(%[z]), %%r8\n\t"
  713|   381k|      "adcx %%r8, %%r8\n\t"
  714|   381k|      "adox %%rax, %%r8\n\t"
  715|   381k|      "movq %%r8, 48(%[z])\n\t"
  716|   381k|      "movq 56(%[z]), %%r8\n\t"
  717|   381k|      "adcx %%r8, %%r8\n\t"
  718|   381k|      "adox %%rcx, %%r8\n\t"
  719|   381k|      "movq %%r8, 56(%[z])\n\t"
  720|   381k|      "movq 32(%[x]), %%rdx\n\t"
  721|   381k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  722|   381k|      "movq 64(%[z]), %%r8\n\t"
  723|   381k|      "adcx %%r8, %%r8\n\t"
  724|   381k|      "adox %%rax, %%r8\n\t"
  725|   381k|      "movq %%r8, 64(%[z])\n\t"
  726|   381k|      "movq 72(%[z]), %%r8\n\t"
  727|   381k|      "adcx %%r8, %%r8\n\t"
  728|   381k|      "adox %%rcx, %%r8\n\t"
  729|   381k|      "movq %%r8, 72(%[z])\n\t"
  730|   381k|      "movq 40(%[x]), %%rdx\n\t"
  731|   381k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  732|   381k|      "movq 80(%[z]), %%r8\n\t"
  733|   381k|      "adcx %%r8, %%r8\n\t"
  734|   381k|      "adox %%rax, %%r8\n\t"
  735|   381k|      "movq %%r8, 80(%[z])\n\t"
  736|   381k|      "movq 88(%[z]), %%r8\n\t"
  737|   381k|      "adcx %%r8, %%r8\n\t"
  738|   381k|      "adox %%rcx, %%r8\n\t"
  739|   381k|      "movq %%r8, 88(%[z])\n\t"
  740|   381k|      "movq 48(%[x]), %%rdx\n\t"
  741|   381k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  742|   381k|      "movq 96(%[z]), %%r8\n\t"
  743|   381k|      "adcx %%r8, %%r8\n\t"
  744|   381k|      "adox %%rax, %%r8\n\t"
  745|   381k|      "movq %%r8, 96(%[z])\n\t"
  746|   381k|      "movq 104(%[z]), %%r8\n\t"
  747|   381k|      "adcx %%r8, %%r8\n\t"
  748|   381k|      "adox %%rcx, %%r8\n\t"
  749|   381k|      "movq %%r8, 104(%[z])\n\t"
  750|   381k|      "movq 56(%[x]), %%rdx\n\t"
  751|   381k|      "mulx %%rdx, %%rax, %%rcx\n\t"
  752|   381k|      "movq 112(%[z]), %%r8\n\t"
  753|   381k|      "adcx %%r8, %%r8\n\t"
  754|   381k|      "adox %%rax, %%r8\n\t"
  755|   381k|      "movq %%r8, 112(%[z])\n\t"
  756|   381k|      "movq 120(%[z]), %%r8\n\t"
  757|   381k|      "adcx %%r8, %%r8\n\t"
  758|   381k|      "adox %%rcx, %%r8\n\t"
  759|   381k|      "movq %%r8, 120(%[z])\n\t"
  760|   381k|      :
  761|   381k|      : [z] "r"(z), [x] "r"(x)
  762|   381k|      : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "cc", "memory");
  763|       |   // clang-format on
  764|   381k|}
_ZN5Botan16bigint_mulx_mul8EPmPKmS2_:
  766|  61.1k|void bigint_mulx_mul8(word z[16], const word x[8], const word y[8]) {
  767|       |   // clang-format off
  768|  61.1k|   asm(
  769|  61.1k|      "xorl %%r8d, %%r8d\n\t"
  770|  61.1k|      "xorl %%r9d, %%r9d\n\t"
  771|  61.1k|      "xorl %%r10d, %%r10d\n\t"
  772|  61.1k|      "xorl %%r11d, %%r11d\n\t"
  773|  61.1k|      "xorl %%r12d, %%r12d\n\t"
  774|  61.1k|      "xorl %%r13d, %%r13d\n\t"
  775|  61.1k|      "xorl %%r14d, %%r14d\n\t"
  776|  61.1k|      "xorl %%r15d, %%r15d\n\t"
  777|       |
  778|  61.1k|      "movq 0(%[y]), %%rdx\n\t"  // row 0: x * y[0]
  779|  61.1k|      "xorl %%eax, %%eax\n\t"
  780|  61.1k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  781|  61.1k|      "adcx %%rax, %%r8\n\t"
  782|  61.1k|      "movq %%r8, 0(%[z])\n\t"
  783|  61.1k|      "mulx 8(%[x]), %%rax, %%r8\n\t"
  784|  61.1k|      "adox %%rcx, %%rax\n\t"
  785|  61.1k|      "adcx %%rax, %%r9\n\t"
  786|  61.1k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  787|  61.1k|      "adox %%r8, %%rax\n\t"
  788|  61.1k|      "adcx %%rax, %%r10\n\t"
  789|  61.1k|      "mulx 24(%[x]), %%rax, %%r8\n\t"
  790|  61.1k|      "adox %%rcx, %%rax\n\t"
  791|  61.1k|      "adcx %%rax, %%r11\n\t"
  792|  61.1k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  793|  61.1k|      "adox %%r8, %%rax\n\t"
  794|  61.1k|      "adcx %%rax, %%r12\n\t"
  795|  61.1k|      "mulx 40(%[x]), %%rax, %%r8\n\t"
  796|  61.1k|      "adox %%rcx, %%rax\n\t"
  797|  61.1k|      "adcx %%rax, %%r13\n\t"
  798|  61.1k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  799|  61.1k|      "adox %%r8, %%rax\n\t"
  800|  61.1k|      "adcx %%rax, %%r14\n\t"
  801|  61.1k|      "mulx 56(%[x]), %%rax, %%r8\n\t"
  802|  61.1k|      "adox %%rcx, %%rax\n\t"
  803|  61.1k|      "adcx %%rax, %%r15\n\t"
  804|  61.1k|      "movl $0, %%eax\n\t"
  805|  61.1k|      "adox %%rax, %%r8\n\t"
  806|  61.1k|      "adcx %%rax, %%r8\n\t"
  807|       |
  808|  61.1k|      "movq 8(%[y]), %%rdx\n\t"  // row 1: x * y[1]
  809|  61.1k|      "xorl %%eax, %%eax\n\t"
  810|  61.1k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  811|  61.1k|      "adcx %%rax, %%r9\n\t"
  812|  61.1k|      "movq %%r9, 8(%[z])\n\t"
  813|  61.1k|      "mulx 8(%[x]), %%rax, %%r9\n\t"
  814|  61.1k|      "adox %%rcx, %%rax\n\t"
  815|  61.1k|      "adcx %%rax, %%r10\n\t"
  816|  61.1k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  817|  61.1k|      "adox %%r9, %%rax\n\t"
  818|  61.1k|      "adcx %%rax, %%r11\n\t"
  819|  61.1k|      "mulx 24(%[x]), %%rax, %%r9\n\t"
  820|  61.1k|      "adox %%rcx, %%rax\n\t"
  821|  61.1k|      "adcx %%rax, %%r12\n\t"
  822|  61.1k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  823|  61.1k|      "adox %%r9, %%rax\n\t"
  824|  61.1k|      "adcx %%rax, %%r13\n\t"
  825|  61.1k|      "mulx 40(%[x]), %%rax, %%r9\n\t"
  826|  61.1k|      "adox %%rcx, %%rax\n\t"
  827|  61.1k|      "adcx %%rax, %%r14\n\t"
  828|  61.1k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  829|  61.1k|      "adox %%r9, %%rax\n\t"
  830|  61.1k|      "adcx %%rax, %%r15\n\t"
  831|  61.1k|      "mulx 56(%[x]), %%rax, %%r9\n\t"
  832|  61.1k|      "adox %%rcx, %%rax\n\t"
  833|  61.1k|      "adcx %%rax, %%r8\n\t"
  834|  61.1k|      "movl $0, %%eax\n\t"
  835|  61.1k|      "adox %%rax, %%r9\n\t"
  836|  61.1k|      "adcx %%rax, %%r9\n\t"
  837|       |
  838|  61.1k|      "movq 16(%[y]), %%rdx\n\t"  // row 2: x * y[2]
  839|  61.1k|      "xorl %%eax, %%eax\n\t"
  840|  61.1k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  841|  61.1k|      "adcx %%rax, %%r10\n\t"
  842|  61.1k|      "movq %%r10, 16(%[z])\n\t"
  843|  61.1k|      "mulx 8(%[x]), %%rax, %%r10\n\t"
  844|  61.1k|      "adox %%rcx, %%rax\n\t"
  845|  61.1k|      "adcx %%rax, %%r11\n\t"
  846|  61.1k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  847|  61.1k|      "adox %%r10, %%rax\n\t"
  848|  61.1k|      "adcx %%rax, %%r12\n\t"
  849|  61.1k|      "mulx 24(%[x]), %%rax, %%r10\n\t"
  850|  61.1k|      "adox %%rcx, %%rax\n\t"
  851|  61.1k|      "adcx %%rax, %%r13\n\t"
  852|  61.1k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  853|  61.1k|      "adox %%r10, %%rax\n\t"
  854|  61.1k|      "adcx %%rax, %%r14\n\t"
  855|  61.1k|      "mulx 40(%[x]), %%rax, %%r10\n\t"
  856|  61.1k|      "adox %%rcx, %%rax\n\t"
  857|  61.1k|      "adcx %%rax, %%r15\n\t"
  858|  61.1k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  859|  61.1k|      "adox %%r10, %%rax\n\t"
  860|  61.1k|      "adcx %%rax, %%r8\n\t"
  861|  61.1k|      "mulx 56(%[x]), %%rax, %%r10\n\t"
  862|  61.1k|      "adox %%rcx, %%rax\n\t"
  863|  61.1k|      "adcx %%rax, %%r9\n\t"
  864|  61.1k|      "movl $0, %%eax\n\t"
  865|  61.1k|      "adox %%rax, %%r10\n\t"
  866|  61.1k|      "adcx %%rax, %%r10\n\t"
  867|       |
  868|  61.1k|      "movq 24(%[y]), %%rdx\n\t"  // row 3: x * y[3]
  869|  61.1k|      "xorl %%eax, %%eax\n\t"
  870|  61.1k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  871|  61.1k|      "adcx %%rax, %%r11\n\t"
  872|  61.1k|      "movq %%r11, 24(%[z])\n\t"
  873|  61.1k|      "mulx 8(%[x]), %%rax, %%r11\n\t"
  874|  61.1k|      "adox %%rcx, %%rax\n\t"
  875|  61.1k|      "adcx %%rax, %%r12\n\t"
  876|  61.1k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  877|  61.1k|      "adox %%r11, %%rax\n\t"
  878|  61.1k|      "adcx %%rax, %%r13\n\t"
  879|  61.1k|      "mulx 24(%[x]), %%rax, %%r11\n\t"
  880|  61.1k|      "adox %%rcx, %%rax\n\t"
  881|  61.1k|      "adcx %%rax, %%r14\n\t"
  882|  61.1k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  883|  61.1k|      "adox %%r11, %%rax\n\t"
  884|  61.1k|      "adcx %%rax, %%r15\n\t"
  885|  61.1k|      "mulx 40(%[x]), %%rax, %%r11\n\t"
  886|  61.1k|      "adox %%rcx, %%rax\n\t"
  887|  61.1k|      "adcx %%rax, %%r8\n\t"
  888|  61.1k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  889|  61.1k|      "adox %%r11, %%rax\n\t"
  890|  61.1k|      "adcx %%rax, %%r9\n\t"
  891|  61.1k|      "mulx 56(%[x]), %%rax, %%r11\n\t"
  892|  61.1k|      "adox %%rcx, %%rax\n\t"
  893|  61.1k|      "adcx %%rax, %%r10\n\t"
  894|  61.1k|      "movl $0, %%eax\n\t"
  895|  61.1k|      "adox %%rax, %%r11\n\t"
  896|  61.1k|      "adcx %%rax, %%r11\n\t"
  897|       |
  898|  61.1k|      "movq 32(%[y]), %%rdx\n\t"  // row 4: x * y[4]
  899|  61.1k|      "xorl %%eax, %%eax\n\t"
  900|  61.1k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  901|  61.1k|      "adcx %%rax, %%r12\n\t"
  902|  61.1k|      "movq %%r12, 32(%[z])\n\t"
  903|  61.1k|      "mulx 8(%[x]), %%rax, %%r12\n\t"
  904|  61.1k|      "adox %%rcx, %%rax\n\t"
  905|  61.1k|      "adcx %%rax, %%r13\n\t"
  906|  61.1k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  907|  61.1k|      "adox %%r12, %%rax\n\t"
  908|  61.1k|      "adcx %%rax, %%r14\n\t"
  909|  61.1k|      "mulx 24(%[x]), %%rax, %%r12\n\t"
  910|  61.1k|      "adox %%rcx, %%rax\n\t"
  911|  61.1k|      "adcx %%rax, %%r15\n\t"
  912|  61.1k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  913|  61.1k|      "adox %%r12, %%rax\n\t"
  914|  61.1k|      "adcx %%rax, %%r8\n\t"
  915|  61.1k|      "mulx 40(%[x]), %%rax, %%r12\n\t"
  916|  61.1k|      "adox %%rcx, %%rax\n\t"
  917|  61.1k|      "adcx %%rax, %%r9\n\t"
  918|  61.1k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  919|  61.1k|      "adox %%r12, %%rax\n\t"
  920|  61.1k|      "adcx %%rax, %%r10\n\t"
  921|  61.1k|      "mulx 56(%[x]), %%rax, %%r12\n\t"
  922|  61.1k|      "adox %%rcx, %%rax\n\t"
  923|  61.1k|      "adcx %%rax, %%r11\n\t"
  924|  61.1k|      "movl $0, %%eax\n\t"
  925|  61.1k|      "adox %%rax, %%r12\n\t"
  926|  61.1k|      "adcx %%rax, %%r12\n\t"
  927|       |
  928|  61.1k|      "movq 40(%[y]), %%rdx\n\t"  // row 5: x * y[5]
  929|  61.1k|      "xorl %%eax, %%eax\n\t"
  930|  61.1k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  931|  61.1k|      "adcx %%rax, %%r13\n\t"
  932|  61.1k|      "movq %%r13, 40(%[z])\n\t"
  933|  61.1k|      "mulx 8(%[x]), %%rax, %%r13\n\t"
  934|  61.1k|      "adox %%rcx, %%rax\n\t"
  935|  61.1k|      "adcx %%rax, %%r14\n\t"
  936|  61.1k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  937|  61.1k|      "adox %%r13, %%rax\n\t"
  938|  61.1k|      "adcx %%rax, %%r15\n\t"
  939|  61.1k|      "mulx 24(%[x]), %%rax, %%r13\n\t"
  940|  61.1k|      "adox %%rcx, %%rax\n\t"
  941|  61.1k|      "adcx %%rax, %%r8\n\t"
  942|  61.1k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  943|  61.1k|      "adox %%r13, %%rax\n\t"
  944|  61.1k|      "adcx %%rax, %%r9\n\t"
  945|  61.1k|      "mulx 40(%[x]), %%rax, %%r13\n\t"
  946|  61.1k|      "adox %%rcx, %%rax\n\t"
  947|  61.1k|      "adcx %%rax, %%r10\n\t"
  948|  61.1k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  949|  61.1k|      "adox %%r13, %%rax\n\t"
  950|  61.1k|      "adcx %%rax, %%r11\n\t"
  951|  61.1k|      "mulx 56(%[x]), %%rax, %%r13\n\t"
  952|  61.1k|      "adox %%rcx, %%rax\n\t"
  953|  61.1k|      "adcx %%rax, %%r12\n\t"
  954|  61.1k|      "movl $0, %%eax\n\t"
  955|  61.1k|      "adox %%rax, %%r13\n\t"
  956|  61.1k|      "adcx %%rax, %%r13\n\t"
  957|       |
  958|  61.1k|      "movq 48(%[y]), %%rdx\n\t"  // row 6: x * y[6]
  959|  61.1k|      "xorl %%eax, %%eax\n\t"
  960|  61.1k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  961|  61.1k|      "adcx %%rax, %%r14\n\t"
  962|  61.1k|      "movq %%r14, 48(%[z])\n\t"
  963|  61.1k|      "mulx 8(%[x]), %%rax, %%r14\n\t"
  964|  61.1k|      "adox %%rcx, %%rax\n\t"
  965|  61.1k|      "adcx %%rax, %%r15\n\t"
  966|  61.1k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  967|  61.1k|      "adox %%r14, %%rax\n\t"
  968|  61.1k|      "adcx %%rax, %%r8\n\t"
  969|  61.1k|      "mulx 24(%[x]), %%rax, %%r14\n\t"
  970|  61.1k|      "adox %%rcx, %%rax\n\t"
  971|  61.1k|      "adcx %%rax, %%r9\n\t"
  972|  61.1k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  973|  61.1k|      "adox %%r14, %%rax\n\t"
  974|  61.1k|      "adcx %%rax, %%r10\n\t"
  975|  61.1k|      "mulx 40(%[x]), %%rax, %%r14\n\t"
  976|  61.1k|      "adox %%rcx, %%rax\n\t"
  977|  61.1k|      "adcx %%rax, %%r11\n\t"
  978|  61.1k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  979|  61.1k|      "adox %%r14, %%rax\n\t"
  980|  61.1k|      "adcx %%rax, %%r12\n\t"
  981|  61.1k|      "mulx 56(%[x]), %%rax, %%r14\n\t"
  982|  61.1k|      "adox %%rcx, %%rax\n\t"
  983|  61.1k|      "adcx %%rax, %%r13\n\t"
  984|  61.1k|      "movl $0, %%eax\n\t"
  985|  61.1k|      "adox %%rax, %%r14\n\t"
  986|  61.1k|      "adcx %%rax, %%r14\n\t"
  987|       |
  988|  61.1k|      "movq 56(%[y]), %%rdx\n\t"  // row 7: x * y[7]
  989|  61.1k|      "xorl %%eax, %%eax\n\t"
  990|  61.1k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  991|  61.1k|      "adcx %%rax, %%r15\n\t"
  992|  61.1k|      "movq %%r15, 56(%[z])\n\t"
  993|  61.1k|      "mulx 8(%[x]), %%rax, %%r15\n\t"
  994|  61.1k|      "adox %%rcx, %%rax\n\t"
  995|  61.1k|      "adcx %%rax, %%r8\n\t"
  996|  61.1k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  997|  61.1k|      "adox %%r15, %%rax\n\t"
  998|  61.1k|      "adcx %%rax, %%r9\n\t"
  999|  61.1k|      "mulx 24(%[x]), %%rax, %%r15\n\t"
 1000|  61.1k|      "adox %%rcx, %%rax\n\t"
 1001|  61.1k|      "adcx %%rax, %%r10\n\t"
 1002|  61.1k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1003|  61.1k|      "adox %%r15, %%rax\n\t"
 1004|  61.1k|      "adcx %%rax, %%r11\n\t"
 1005|  61.1k|      "mulx 40(%[x]), %%rax, %%r15\n\t"
 1006|  61.1k|      "adox %%rcx, %%rax\n\t"
 1007|  61.1k|      "adcx %%rax, %%r12\n\t"
 1008|  61.1k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1009|  61.1k|      "adox %%r15, %%rax\n\t"
 1010|  61.1k|      "adcx %%rax, %%r13\n\t"
 1011|  61.1k|      "mulx 56(%[x]), %%rax, %%r15\n\t"
 1012|  61.1k|      "adox %%rcx, %%rax\n\t"
 1013|  61.1k|      "adcx %%rax, %%r14\n\t"
 1014|  61.1k|      "movl $0, %%eax\n\t"
 1015|  61.1k|      "adox %%rax, %%r15\n\t"
 1016|  61.1k|      "adcx %%rax, %%r15\n\t"
 1017|       |
 1018|  61.1k|      "movq %%r8, 64(%[z])\n\t"
 1019|  61.1k|      "movq %%r9, 72(%[z])\n\t"
 1020|  61.1k|      "movq %%r10, 80(%[z])\n\t"
 1021|  61.1k|      "movq %%r11, 88(%[z])\n\t"
 1022|  61.1k|      "movq %%r12, 96(%[z])\n\t"
 1023|  61.1k|      "movq %%r13, 104(%[z])\n\t"
 1024|  61.1k|      "movq %%r14, 112(%[z])\n\t"
 1025|  61.1k|      "movq %%r15, 120(%[z])\n\t"
 1026|  61.1k|      :
 1027|  61.1k|      : [z] "r"(z), [x] "r"(x), [y] "r"(y)
 1028|  61.1k|      : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "cc", "memory");
 1029|       |   // clang-format on
 1030|  61.1k|}
_ZN5Botan16bigint_mulx_sqr9EPmPKm:
 1032|  89.0k|void bigint_mulx_sqr9(word z[18], const word x[9]) {
 1033|       |   // clang-format off
 1034|  89.0k|   asm(
 1035|  89.0k|      "xorl %%r9d, %%r9d\n\t"
 1036|  89.0k|      "xorl %%r10d, %%r10d\n\t"
 1037|  89.0k|      "xorl %%r11d, %%r11d\n\t"
 1038|  89.0k|      "xorl %%r12d, %%r12d\n\t"
 1039|  89.0k|      "xorl %%r13d, %%r13d\n\t"
 1040|  89.0k|      "xorl %%r14d, %%r14d\n\t"
 1041|  89.0k|      "xorl %%r15d, %%r15d\n\t"
 1042|  89.0k|      "xorl %%r8d, %%r8d\n\t"
 1043|       |
 1044|  89.0k|      "movq 0(%[x]), %%rdx\n\t"  // x[0] * x[1..8]
 1045|  89.0k|      "xorl %%eax, %%eax\n\t"
 1046|  89.0k|      "mulx 8(%[x]), %%rax, %%rcx\n\t"
 1047|  89.0k|      "adcx %%rax, %%r9\n\t"
 1048|  89.0k|      "movq %%r9, 8(%[z])\n\t"
 1049|  89.0k|      "mulx 16(%[x]), %%rax, %%r9\n\t"
 1050|  89.0k|      "adox %%rcx, %%rax\n\t"
 1051|  89.0k|      "adcx %%rax, %%r10\n\t"
 1052|  89.0k|      "mulx 24(%[x]), %%rax, %%rcx\n\t"
 1053|  89.0k|      "adox %%r9, %%rax\n\t"
 1054|  89.0k|      "adcx %%rax, %%r11\n\t"
 1055|  89.0k|      "mulx 32(%[x]), %%rax, %%r9\n\t"
 1056|  89.0k|      "adox %%rcx, %%rax\n\t"
 1057|  89.0k|      "adcx %%rax, %%r12\n\t"
 1058|  89.0k|      "mulx 40(%[x]), %%rax, %%rcx\n\t"
 1059|  89.0k|      "adox %%r9, %%rax\n\t"
 1060|  89.0k|      "adcx %%rax, %%r13\n\t"
 1061|  89.0k|      "mulx 48(%[x]), %%rax, %%r9\n\t"
 1062|  89.0k|      "adox %%rcx, %%rax\n\t"
 1063|  89.0k|      "adcx %%rax, %%r14\n\t"
 1064|  89.0k|      "mulx 56(%[x]), %%rax, %%rcx\n\t"
 1065|  89.0k|      "adox %%r9, %%rax\n\t"
 1066|  89.0k|      "adcx %%rax, %%r15\n\t"
 1067|  89.0k|      "mulx 64(%[x]), %%rax, %%r9\n\t"
 1068|  89.0k|      "adox %%rcx, %%rax\n\t"
 1069|  89.0k|      "adcx %%rax, %%r8\n\t"
 1070|  89.0k|      "movl $0, %%eax\n\t"
 1071|  89.0k|      "adox %%rax, %%r9\n\t"
 1072|  89.0k|      "adcx %%rax, %%r9\n\t"
 1073|  89.0k|      "movq %%r10, 16(%[z])\n\t"
 1074|       |
 1075|  89.0k|      "movq 8(%[x]), %%rdx\n\t"  // x[1] * x[2..8]
 1076|  89.0k|      "xorl %%eax, %%eax\n\t"
 1077|  89.0k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1078|  89.0k|      "adcx %%rax, %%r11\n\t"
 1079|  89.0k|      "movq %%r11, 24(%[z])\n\t"
 1080|  89.0k|      "mulx 24(%[x]), %%rax, %%r10\n\t"
 1081|  89.0k|      "adox %%rcx, %%rax\n\t"
 1082|  89.0k|      "adcx %%rax, %%r12\n\t"
 1083|  89.0k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1084|  89.0k|      "adox %%r10, %%rax\n\t"
 1085|  89.0k|      "adcx %%rax, %%r13\n\t"
 1086|  89.0k|      "mulx 40(%[x]), %%rax, %%r10\n\t"
 1087|  89.0k|      "adox %%rcx, %%rax\n\t"
 1088|  89.0k|      "adcx %%rax, %%r14\n\t"
 1089|  89.0k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1090|  89.0k|      "adox %%r10, %%rax\n\t"
 1091|  89.0k|      "adcx %%rax, %%r15\n\t"
 1092|  89.0k|      "mulx 56(%[x]), %%rax, %%r10\n\t"
 1093|  89.0k|      "adox %%rcx, %%rax\n\t"
 1094|  89.0k|      "adcx %%rax, %%r8\n\t"
 1095|  89.0k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1096|  89.0k|      "adox %%r10, %%rax\n\t"
 1097|  89.0k|      "adcx %%rax, %%r9\n\t"
 1098|  89.0k|      "movl $0, %%eax\n\t"
 1099|  89.0k|      "adox %%rax, %%rcx\n\t"
 1100|  89.0k|      "adcx %%rax, %%rcx\n\t"
 1101|  89.0k|      "movq %%rcx, %%r10\n\t"
 1102|  89.0k|      "movq %%r12, 32(%[z])\n\t"
 1103|       |
 1104|  89.0k|      "movq 16(%[x]), %%rdx\n\t"  // x[2] * x[3..8]
 1105|  89.0k|      "xorl %%eax, %%eax\n\t"
 1106|  89.0k|      "mulx 24(%[x]), %%rax, %%rcx\n\t"
 1107|  89.0k|      "adcx %%rax, %%r13\n\t"
 1108|  89.0k|      "movq %%r13, 40(%[z])\n\t"
 1109|  89.0k|      "mulx 32(%[x]), %%rax, %%r11\n\t"
 1110|  89.0k|      "adox %%rcx, %%rax\n\t"
 1111|  89.0k|      "adcx %%rax, %%r14\n\t"
 1112|  89.0k|      "mulx 40(%[x]), %%rax, %%rcx\n\t"
 1113|  89.0k|      "adox %%r11, %%rax\n\t"
 1114|  89.0k|      "adcx %%rax, %%r15\n\t"
 1115|  89.0k|      "mulx 48(%[x]), %%rax, %%r11\n\t"
 1116|  89.0k|      "adox %%rcx, %%rax\n\t"
 1117|  89.0k|      "adcx %%rax, %%r8\n\t"
 1118|  89.0k|      "mulx 56(%[x]), %%rax, %%rcx\n\t"
 1119|  89.0k|      "adox %%r11, %%rax\n\t"
 1120|  89.0k|      "adcx %%rax, %%r9\n\t"
 1121|  89.0k|      "mulx 64(%[x]), %%rax, %%r11\n\t"
 1122|  89.0k|      "adox %%rcx, %%rax\n\t"
 1123|  89.0k|      "adcx %%rax, %%r10\n\t"
 1124|  89.0k|      "movl $0, %%eax\n\t"
 1125|  89.0k|      "adox %%rax, %%r11\n\t"
 1126|  89.0k|      "adcx %%rax, %%r11\n\t"
 1127|  89.0k|      "movq %%r14, 48(%[z])\n\t"
 1128|       |
 1129|  89.0k|      "movq 24(%[x]), %%rdx\n\t"  // x[3] * x[4..8]
 1130|  89.0k|      "xorl %%eax, %%eax\n\t"
 1131|  89.0k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1132|  89.0k|      "adcx %%rax, %%r15\n\t"
 1133|  89.0k|      "movq %%r15, 56(%[z])\n\t"
 1134|  89.0k|      "mulx 40(%[x]), %%rax, %%r12\n\t"
 1135|  89.0k|      "adox %%rcx, %%rax\n\t"
 1136|  89.0k|      "adcx %%rax, %%r8\n\t"
 1137|  89.0k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1138|  89.0k|      "adox %%r12, %%rax\n\t"
 1139|  89.0k|      "adcx %%rax, %%r9\n\t"
 1140|  89.0k|      "mulx 56(%[x]), %%rax, %%r12\n\t"
 1141|  89.0k|      "adox %%rcx, %%rax\n\t"
 1142|  89.0k|      "adcx %%rax, %%r10\n\t"
 1143|  89.0k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1144|  89.0k|      "adox %%r12, %%rax\n\t"
 1145|  89.0k|      "adcx %%rax, %%r11\n\t"
 1146|  89.0k|      "movl $0, %%eax\n\t"
 1147|  89.0k|      "adox %%rax, %%rcx\n\t"
 1148|  89.0k|      "adcx %%rax, %%rcx\n\t"
 1149|  89.0k|      "movq %%rcx, %%r12\n\t"
 1150|  89.0k|      "movq %%r8, 64(%[z])\n\t"
 1151|       |
 1152|  89.0k|      "movq 32(%[x]), %%rdx\n\t"  // x[4] * x[5..8]
 1153|  89.0k|      "xorl %%eax, %%eax\n\t"
 1154|  89.0k|      "mulx 40(%[x]), %%rax, %%rcx\n\t"
 1155|  89.0k|      "adcx %%rax, %%r9\n\t"
 1156|  89.0k|      "movq %%r9, 72(%[z])\n\t"
 1157|  89.0k|      "mulx 48(%[x]), %%rax, %%r13\n\t"
 1158|  89.0k|      "adox %%rcx, %%rax\n\t"
 1159|  89.0k|      "adcx %%rax, %%r10\n\t"
 1160|  89.0k|      "mulx 56(%[x]), %%rax, %%rcx\n\t"
 1161|  89.0k|      "adox %%r13, %%rax\n\t"
 1162|  89.0k|      "adcx %%rax, %%r11\n\t"
 1163|  89.0k|      "mulx 64(%[x]), %%rax, %%r13\n\t"
 1164|  89.0k|      "adox %%rcx, %%rax\n\t"
 1165|  89.0k|      "adcx %%rax, %%r12\n\t"
 1166|  89.0k|      "movl $0, %%eax\n\t"
 1167|  89.0k|      "adox %%rax, %%r13\n\t"
 1168|  89.0k|      "adcx %%rax, %%r13\n\t"
 1169|  89.0k|      "movq %%r10, 80(%[z])\n\t"
 1170|       |
 1171|  89.0k|      "movq 40(%[x]), %%rdx\n\t"  // x[5] * x[6..8]
 1172|  89.0k|      "xorl %%eax, %%eax\n\t"
 1173|  89.0k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1174|  89.0k|      "adcx %%rax, %%r11\n\t"
 1175|  89.0k|      "movq %%r11, 88(%[z])\n\t"
 1176|  89.0k|      "mulx 56(%[x]), %%rax, %%r14\n\t"
 1177|  89.0k|      "adox %%rcx, %%rax\n\t"
 1178|  89.0k|      "adcx %%rax, %%r12\n\t"
 1179|  89.0k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1180|  89.0k|      "adox %%r14, %%rax\n\t"
 1181|  89.0k|      "adcx %%rax, %%r13\n\t"
 1182|  89.0k|      "movl $0, %%eax\n\t"
 1183|  89.0k|      "adox %%rax, %%rcx\n\t"
 1184|  89.0k|      "adcx %%rax, %%rcx\n\t"
 1185|  89.0k|      "movq %%rcx, %%r14\n\t"
 1186|  89.0k|      "movq %%r12, 96(%[z])\n\t"
 1187|       |
 1188|  89.0k|      "movq 48(%[x]), %%rdx\n\t"  // x[6] * x[7..8]
 1189|  89.0k|      "xorl %%eax, %%eax\n\t"
 1190|  89.0k|      "mulx 56(%[x]), %%rax, %%rcx\n\t"
 1191|  89.0k|      "adcx %%rax, %%r13\n\t"
 1192|  89.0k|      "movq %%r13, 104(%[z])\n\t"
 1193|  89.0k|      "mulx 64(%[x]), %%rax, %%r15\n\t"
 1194|  89.0k|      "adox %%rcx, %%rax\n\t"
 1195|  89.0k|      "adcx %%rax, %%r14\n\t"
 1196|  89.0k|      "movl $0, %%eax\n\t"
 1197|  89.0k|      "adox %%rax, %%r15\n\t"
 1198|  89.0k|      "adcx %%rax, %%r15\n\t"
 1199|  89.0k|      "movq %%r14, 112(%[z])\n\t"
 1200|       |
 1201|  89.0k|      "movq 56(%[x]), %%rdx\n\t"  // x[7] * x[8..8]
 1202|  89.0k|      "xorl %%eax, %%eax\n\t"
 1203|  89.0k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1204|  89.0k|      "adcx %%rax, %%r15\n\t"
 1205|  89.0k|      "movq %%r15, 120(%[z])\n\t"
 1206|  89.0k|      "movl $0, %%eax\n\t"
 1207|  89.0k|      "adox %%rax, %%rcx\n\t"
 1208|  89.0k|      "adcx %%rax, %%rcx\n\t"
 1209|  89.0k|      "movq %%rcx, %%r8\n\t"
 1210|  89.0k|      "movq %%r8, 128(%[z])\n\t"
 1211|       |
 1212|  89.0k|      "movq $0, 136(%[z])\n\t"
 1213|  89.0k|      "xorl %%eax, %%eax\n\t"  // double the cross products and add the squares
 1214|  89.0k|      "movq 0(%[x]), %%rdx\n\t"
 1215|  89.0k|      "mulx %%rdx, %%rax, %%rcx\n\t"
 1216|  89.0k|      "movq %%rax, 0(%[z])\n\t"
 1217|  89.0k|      "movq 8(%[z]), %%r8\n\t"
 1218|  89.0k|      "adcx %%r8, %%r8\n\t"
 1219|  89.0k|      "adox %%rcx, %%r8\n\t"
 1220|  89.0k|      "movq %%r8, 8(%[z])\n\t"
 1221|  89.0k|      "movq 8(%[x]), %%rdx\n\t"
 1222|  89.0k|      "mulx %%rdx, %%rax, %%rcx\n\t"
 1223|  89.0k|      "movq 16(%[z]), %%r8\n\t"
 1224|  89.0k|      "adcx %%r8, %%r8\n\t"
 1225|  89.0k|      "adox %%rax, %%r8\n\t"
 1226|  89.0k|      "movq %%r8, 16(%[z])\n\t"
 1227|  89.0k|      "movq 24(%[z]), %%r8\n\t"
 1228|  89.0k|      "adcx %%r8, %%r8\n\t"
 1229|  89.0k|      "adox %%rcx, %%r8\n\t"
 1230|  89.0k|      "movq %%r8, 24(%[z])\n\t"
 1231|  89.0k|      "movq 16(%[x]), %%rdx\n\t"
 1232|  89.0k|      "mulx %%rdx, %%rax, %%rcx\n\t"
 1233|  89.0k|      "movq 32(%[z]), %%r8\n\t"
 1234|  89.0k|      "adcx %%r8, %%r8\n\t"
 1235|  89.0k|      "adox %%rax, %%r8\n\t"
 1236|  89.0k|      "movq %%r8, 32(%[z])\n\t"
 1237|  89.0k|      "movq 40(%[z]), %%r8\n\t"
 1238|  89.0k|      "adcx %%r8, %%r8\n\t"
 1239|  89.0k|      "adox %%rcx, %%r8\n\t"
 1240|  89.0k|      "movq %%r8, 40(%[z])\n\t"
 1241|  89.0k|      "movq 24(%[x]), %%rdx\n\t"
 1242|  89.0k|      "mulx %%rdx, %%rax, %%rcx\n\t"
 1243|  89.0k|      "movq 48(%[z]), %%r8\n\t"
 1244|  89.0k|      "adcx %%r8, %%r8\n\t"
 1245|  89.0k|      "adox %%rax, %%r8\n\t"
 1246|  89.0k|      "movq %%r8, 48(%[z])\n\t"
 1247|  89.0k|      "movq 56(%[z]), %%r8\n\t"
 1248|  89.0k|      "adcx %%r8, %%r8\n\t"
 1249|  89.0k|      "adox %%rcx, %%r8\n\t"
 1250|  89.0k|      "movq %%r8, 56(%[z])\n\t"
 1251|  89.0k|      "movq 32(%[x]), %%rdx\n\t"
 1252|  89.0k|      "mulx %%rdx, %%rax, %%rcx\n\t"
 1253|  89.0k|      "movq 64(%[z]), %%r8\n\t"
 1254|  89.0k|      "adcx %%r8, %%r8\n\t"
 1255|  89.0k|      "adox %%rax, %%r8\n\t"
 1256|  89.0k|      "movq %%r8, 64(%[z])\n\t"
 1257|  89.0k|      "movq 72(%[z]), %%r8\n\t"
 1258|  89.0k|      "adcx %%r8, %%r8\n\t"
 1259|  89.0k|      "adox %%rcx, %%r8\n\t"
 1260|  89.0k|      "movq %%r8, 72(%[z])\n\t"
 1261|  89.0k|      "movq 40(%[x]), %%rdx\n\t"
 1262|  89.0k|      "mulx %%rdx, %%rax, %%rcx\n\t"
 1263|  89.0k|      "movq 80(%[z]), %%r8\n\t"
 1264|  89.0k|      "adcx %%r8, %%r8\n\t"
 1265|  89.0k|      "adox %%rax, %%r8\n\t"
 1266|  89.0k|      "movq %%r8, 80(%[z])\n\t"
 1267|  89.0k|      "movq 88(%[z]), %%r8\n\t"
 1268|  89.0k|      "adcx %%r8, %%r8\n\t"
 1269|  89.0k|      "adox %%rcx, %%r8\n\t"
 1270|  89.0k|      "movq %%r8, 88(%[z])\n\t"
 1271|  89.0k|      "movq 48(%[x]), %%rdx\n\t"
 1272|  89.0k|      "mulx %%rdx, %%rax, %%rcx\n\t"
 1273|  89.0k|      "movq 96(%[z]), %%r8\n\t"
 1274|  89.0k|      "adcx %%r8, %%r8\n\t"
 1275|  89.0k|      "adox %%rax, %%r8\n\t"
 1276|  89.0k|      "movq %%r8, 96(%[z])\n\t"
 1277|  89.0k|      "movq 104(%[z]), %%r8\n\t"
 1278|  89.0k|      "adcx %%r8, %%r8\n\t"
 1279|  89.0k|      "adox %%rcx, %%r8\n\t"
 1280|  89.0k|      "movq %%r8, 104(%[z])\n\t"
 1281|  89.0k|      "movq 56(%[x]), %%rdx\n\t"
 1282|  89.0k|      "mulx %%rdx, %%rax, %%rcx\n\t"
 1283|  89.0k|      "movq 112(%[z]), %%r8\n\t"
 1284|  89.0k|      "adcx %%r8, %%r8\n\t"
 1285|  89.0k|      "adox %%rax, %%r8\n\t"
 1286|  89.0k|      "movq %%r8, 112(%[z])\n\t"
 1287|  89.0k|      "movq 120(%[z]), %%r8\n\t"
 1288|  89.0k|      "adcx %%r8, %%r8\n\t"
 1289|  89.0k|      "adox %%rcx, %%r8\n\t"
 1290|  89.0k|      "movq %%r8, 120(%[z])\n\t"
 1291|  89.0k|      "movq 64(%[x]), %%rdx\n\t"
 1292|  89.0k|      "mulx %%rdx, %%rax, %%rcx\n\t"
 1293|  89.0k|      "movq 128(%[z]), %%r8\n\t"
 1294|  89.0k|      "adcx %%r8, %%r8\n\t"
 1295|  89.0k|      "adox %%rax, %%r8\n\t"
 1296|  89.0k|      "movq %%r8, 128(%[z])\n\t"
 1297|  89.0k|      "movq 136(%[z]), %%r8\n\t"
 1298|  89.0k|      "adcx %%r8, %%r8\n\t"
 1299|  89.0k|      "adox %%rcx, %%r8\n\t"
 1300|  89.0k|      "movq %%r8, 136(%[z])\n\t"
 1301|  89.0k|      :
 1302|  89.0k|      : [z] "r"(z), [x] "r"(x)
 1303|  89.0k|      : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "cc", "memory");
 1304|       |   // clang-format on
 1305|  89.0k|}
_ZN5Botan16bigint_mulx_mul9EPmPKmS2_:
 1307|   107k|void bigint_mulx_mul9(word z[18], const word x[9], const word y[9]) {
 1308|   107k|   copy_mem(z + 9, y, 9);
 1309|       |   // clang-format off
 1310|   107k|   asm(
 1311|   107k|      "xorl %%r8d, %%r8d\n\t"
 1312|   107k|      "xorl %%r9d, %%r9d\n\t"
 1313|   107k|      "xorl %%r10d, %%r10d\n\t"
 1314|   107k|      "xorl %%r11d, %%r11d\n\t"
 1315|   107k|      "xorl %%r12d, %%r12d\n\t"
 1316|   107k|      "xorl %%r13d, %%r13d\n\t"
 1317|   107k|      "xorl %%r14d, %%r14d\n\t"
 1318|   107k|      "xorl %%r15d, %%r15d\n\t"
 1319|   107k|      "xorl %%ebx, %%ebx\n\t"
 1320|       |
 1321|   107k|      "movq 72(%[z]), %%rdx\n\t"  // row 0: x * y[0]
 1322|   107k|      "xorl %%eax, %%eax\n\t"
 1323|   107k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1324|   107k|      "adcx %%rax, %%r8\n\t"
 1325|   107k|      "movq %%r8, 0(%[z])\n\t"
 1326|   107k|      "mulx 8(%[x]), %%rax, %%r8\n\t"
 1327|   107k|      "adox %%rcx, %%rax\n\t"
 1328|   107k|      "adcx %%rax, %%r9\n\t"
 1329|   107k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1330|   107k|      "adox %%r8, %%rax\n\t"
 1331|   107k|      "adcx %%rax, %%r10\n\t"
 1332|   107k|      "mulx 24(%[x]), %%rax, %%r8\n\t"
 1333|   107k|      "adox %%rcx, %%rax\n\t"
 1334|   107k|      "adcx %%rax, %%r11\n\t"
 1335|   107k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1336|   107k|      "adox %%r8, %%rax\n\t"
 1337|   107k|      "adcx %%rax, %%r12\n\t"
 1338|   107k|      "mulx 40(%[x]), %%rax, %%r8\n\t"
 1339|   107k|      "adox %%rcx, %%rax\n\t"
 1340|   107k|      "adcx %%rax, %%r13\n\t"
 1341|   107k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1342|   107k|      "adox %%r8, %%rax\n\t"
 1343|   107k|      "adcx %%rax, %%r14\n\t"
 1344|   107k|      "mulx 56(%[x]), %%rax, %%r8\n\t"
 1345|   107k|      "adox %%rcx, %%rax\n\t"
 1346|   107k|      "adcx %%rax, %%r15\n\t"
 1347|   107k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1348|   107k|      "adox %%r8, %%rax\n\t"
 1349|   107k|      "adcx %%rax, %%rbx\n\t"
 1350|   107k|      "movl $0, %%eax\n\t"
 1351|   107k|      "adox %%rax, %%rcx\n\t"
 1352|   107k|      "adcx %%rax, %%rcx\n\t"
 1353|   107k|      "movq %%rcx, %%r8\n\t"
 1354|       |
 1355|   107k|      "movq 80(%[z]), %%rdx\n\t"  // row 1: x * y[1]
 1356|   107k|      "xorl %%eax, %%eax\n\t"
 1357|   107k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1358|   107k|      "adcx %%rax, %%r9\n\t"
 1359|   107k|      "movq %%r9, 8(%[z])\n\t"
 1360|   107k|      "mulx 8(%[x]), %%rax, %%r9\n\t"
 1361|   107k|      "adox %%rcx, %%rax\n\t"
 1362|   107k|      "adcx %%rax, %%r10\n\t"
 1363|   107k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1364|   107k|      "adox %%r9, %%rax\n\t"
 1365|   107k|      "adcx %%rax, %%r11\n\t"
 1366|   107k|      "mulx 24(%[x]), %%rax, %%r9\n\t"
 1367|   107k|      "adox %%rcx, %%rax\n\t"
 1368|   107k|      "adcx %%rax, %%r12\n\t"
 1369|   107k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1370|   107k|      "adox %%r9, %%rax\n\t"
 1371|   107k|      "adcx %%rax, %%r13\n\t"
 1372|   107k|      "mulx 40(%[x]), %%rax, %%r9\n\t"
 1373|   107k|      "adox %%rcx, %%rax\n\t"
 1374|   107k|      "adcx %%rax, %%r14\n\t"
 1375|   107k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1376|   107k|      "adox %%r9, %%rax\n\t"
 1377|   107k|      "adcx %%rax, %%r15\n\t"
 1378|   107k|      "mulx 56(%[x]), %%rax, %%r9\n\t"
 1379|   107k|      "adox %%rcx, %%rax\n\t"
 1380|   107k|      "adcx %%rax, %%rbx\n\t"
 1381|   107k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1382|   107k|      "adox %%r9, %%rax\n\t"
 1383|   107k|      "adcx %%rax, %%r8\n\t"
 1384|   107k|      "movl $0, %%eax\n\t"
 1385|   107k|      "adox %%rax, %%rcx\n\t"
 1386|   107k|      "adcx %%rax, %%rcx\n\t"
 1387|   107k|      "movq %%rcx, %%r9\n\t"
 1388|       |
 1389|   107k|      "movq 88(%[z]), %%rdx\n\t"  // row 2: x * y[2]
 1390|   107k|      "xorl %%eax, %%eax\n\t"
 1391|   107k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1392|   107k|      "adcx %%rax, %%r10\n\t"
 1393|   107k|      "movq %%r10, 16(%[z])\n\t"
 1394|   107k|      "mulx 8(%[x]), %%rax, %%r10\n\t"
 1395|   107k|      "adox %%rcx, %%rax\n\t"
 1396|   107k|      "adcx %%rax, %%r11\n\t"
 1397|   107k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1398|   107k|      "adox %%r10, %%rax\n\t"
 1399|   107k|      "adcx %%rax, %%r12\n\t"
 1400|   107k|      "mulx 24(%[x]), %%rax, %%r10\n\t"
 1401|   107k|      "adox %%rcx, %%rax\n\t"
 1402|   107k|      "adcx %%rax, %%r13\n\t"
 1403|   107k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1404|   107k|      "adox %%r10, %%rax\n\t"
 1405|   107k|      "adcx %%rax, %%r14\n\t"
 1406|   107k|      "mulx 40(%[x]), %%rax, %%r10\n\t"
 1407|   107k|      "adox %%rcx, %%rax\n\t"
 1408|   107k|      "adcx %%rax, %%r15\n\t"
 1409|   107k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1410|   107k|      "adox %%r10, %%rax\n\t"
 1411|   107k|      "adcx %%rax, %%rbx\n\t"
 1412|   107k|      "mulx 56(%[x]), %%rax, %%r10\n\t"
 1413|   107k|      "adox %%rcx, %%rax\n\t"
 1414|   107k|      "adcx %%rax, %%r8\n\t"
 1415|   107k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1416|   107k|      "adox %%r10, %%rax\n\t"
 1417|   107k|      "adcx %%rax, %%r9\n\t"
 1418|   107k|      "movl $0, %%eax\n\t"
 1419|   107k|      "adox %%rax, %%rcx\n\t"
 1420|   107k|      "adcx %%rax, %%rcx\n\t"
 1421|   107k|      "movq %%rcx, %%r10\n\t"
 1422|       |
 1423|   107k|      "movq 96(%[z]), %%rdx\n\t"  // row 3: x * y[3]
 1424|   107k|      "xorl %%eax, %%eax\n\t"
 1425|   107k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1426|   107k|      "adcx %%rax, %%r11\n\t"
 1427|   107k|      "movq %%r11, 24(%[z])\n\t"
 1428|   107k|      "mulx 8(%[x]), %%rax, %%r11\n\t"
 1429|   107k|      "adox %%rcx, %%rax\n\t"
 1430|   107k|      "adcx %%rax, %%r12\n\t"
 1431|   107k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1432|   107k|      "adox %%r11, %%rax\n\t"
 1433|   107k|      "adcx %%rax, %%r13\n\t"
 1434|   107k|      "mulx 24(%[x]), %%rax, %%r11\n\t"
 1435|   107k|      "adox %%rcx, %%rax\n\t"
 1436|   107k|      "adcx %%rax, %%r14\n\t"
 1437|   107k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1438|   107k|      "adox %%r11, %%rax\n\t"
 1439|   107k|      "adcx %%rax, %%r15\n\t"
 1440|   107k|      "mulx 40(%[x]), %%rax, %%r11\n\t"
 1441|   107k|      "adox %%rcx, %%rax\n\t"
 1442|   107k|      "adcx %%rax, %%rbx\n\t"
 1443|   107k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1444|   107k|      "adox %%r11, %%rax\n\t"
 1445|   107k|      "adcx %%rax, %%r8\n\t"
 1446|   107k|      "mulx 56(%[x]), %%rax, %%r11\n\t"
 1447|   107k|      "adox %%rcx, %%rax\n\t"
 1448|   107k|      "adcx %%rax, %%r9\n\t"
 1449|   107k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1450|   107k|      "adox %%r11, %%rax\n\t"
 1451|   107k|      "adcx %%rax, %%r10\n\t"
 1452|   107k|      "movl $0, %%eax\n\t"
 1453|   107k|      "adox %%rax, %%rcx\n\t"
 1454|   107k|      "adcx %%rax, %%rcx\n\t"
 1455|   107k|      "movq %%rcx, %%r11\n\t"
 1456|       |
 1457|   107k|      "movq 104(%[z]), %%rdx\n\t"  // row 4: x * y[4]
 1458|   107k|      "xorl %%eax, %%eax\n\t"
 1459|   107k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1460|   107k|      "adcx %%rax, %%r12\n\t"
 1461|   107k|      "movq %%r12, 32(%[z])\n\t"
 1462|   107k|      "mulx 8(%[x]), %%rax, %%r12\n\t"
 1463|   107k|      "adox %%rcx, %%rax\n\t"
 1464|   107k|      "adcx %%rax, %%r13\n\t"
 1465|   107k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1466|   107k|      "adox %%r12, %%rax\n\t"
 1467|   107k|      "adcx %%rax, %%r14\n\t"
 1468|   107k|      "mulx 24(%[x]), %%rax, %%r12\n\t"
 1469|   107k|      "adox %%rcx, %%rax\n\t"
 1470|   107k|      "adcx %%rax, %%r15\n\t"
 1471|   107k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1472|   107k|      "adox %%r12, %%rax\n\t"
 1473|   107k|      "adcx %%rax, %%rbx\n\t"
 1474|   107k|      "mulx 40(%[x]), %%rax, %%r12\n\t"
 1475|   107k|      "adox %%rcx, %%rax\n\t"
 1476|   107k|      "adcx %%rax, %%r8\n\t"
 1477|   107k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1478|   107k|      "adox %%r12, %%rax\n\t"
 1479|   107k|      "adcx %%rax, %%r9\n\t"
 1480|   107k|      "mulx 56(%[x]), %%rax, %%r12\n\t"
 1481|   107k|      "adox %%rcx, %%rax\n\t"
 1482|   107k|      "adcx %%rax, %%r10\n\t"
 1483|   107k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1484|   107k|      "adox %%r12, %%rax\n\t"
 1485|   107k|      "adcx %%rax, %%r11\n\t"
 1486|   107k|      "movl $0, %%eax\n\t"
 1487|   107k|      "adox %%rax, %%rcx\n\t"
 1488|   107k|      "adcx %%rax, %%rcx\n\t"
 1489|   107k|      "movq %%rcx, %%r12\n\t"
 1490|       |
 1491|   107k|      "movq 112(%[z]), %%rdx\n\t"  // row 5: x * y[5]
 1492|   107k|      "xorl %%eax, %%eax\n\t"
 1493|   107k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1494|   107k|      "adcx %%rax, %%r13\n\t"
 1495|   107k|      "movq %%r13, 40(%[z])\n\t"
 1496|   107k|      "mulx 8(%[x]), %%rax, %%r13\n\t"
 1497|   107k|      "adox %%rcx, %%rax\n\t"
 1498|   107k|      "adcx %%rax, %%r14\n\t"
 1499|   107k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1500|   107k|      "adox %%r13, %%rax\n\t"
 1501|   107k|      "adcx %%rax, %%r15\n\t"
 1502|   107k|      "mulx 24(%[x]), %%rax, %%r13\n\t"
 1503|   107k|      "adox %%rcx, %%rax\n\t"
 1504|   107k|      "adcx %%rax, %%rbx\n\t"
 1505|   107k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1506|   107k|      "adox %%r13, %%rax\n\t"
 1507|   107k|      "adcx %%rax, %%r8\n\t"
 1508|   107k|      "mulx 40(%[x]), %%rax, %%r13\n\t"
 1509|   107k|      "adox %%rcx, %%rax\n\t"
 1510|   107k|      "adcx %%rax, %%r9\n\t"
 1511|   107k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1512|   107k|      "adox %%r13, %%rax\n\t"
 1513|   107k|      "adcx %%rax, %%r10\n\t"
 1514|   107k|      "mulx 56(%[x]), %%rax, %%r13\n\t"
 1515|   107k|      "adox %%rcx, %%rax\n\t"
 1516|   107k|      "adcx %%rax, %%r11\n\t"
 1517|   107k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1518|   107k|      "adox %%r13, %%rax\n\t"
 1519|   107k|      "adcx %%rax, %%r12\n\t"
 1520|   107k|      "movl $0, %%eax\n\t"
 1521|   107k|      "adox %%rax, %%rcx\n\t"
 1522|   107k|      "adcx %%rax, %%rcx\n\t"
 1523|   107k|      "movq %%rcx, %%r13\n\t"
 1524|       |
 1525|   107k|      "movq 120(%[z]), %%rdx\n\t"  // row 6: x * y[6]
 1526|   107k|      "xorl %%eax, %%eax\n\t"
 1527|   107k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1528|   107k|      "adcx %%rax, %%r14\n\t"
 1529|   107k|      "movq %%r14, 48(%[z])\n\t"
 1530|   107k|      "mulx 8(%[x]), %%rax, %%r14\n\t"
 1531|   107k|      "adox %%rcx, %%rax\n\t"
 1532|   107k|      "adcx %%rax, %%r15\n\t"
 1533|   107k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1534|   107k|      "adox %%r14, %%rax\n\t"
 1535|   107k|      "adcx %%rax, %%rbx\n\t"
 1536|   107k|      "mulx 24(%[x]), %%rax, %%r14\n\t"
 1537|   107k|      "adox %%rcx, %%rax\n\t"
 1538|   107k|      "adcx %%rax, %%r8\n\t"
 1539|   107k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1540|   107k|      "adox %%r14, %%rax\n\t"
 1541|   107k|      "adcx %%rax, %%r9\n\t"
 1542|   107k|      "mulx 40(%[x]), %%rax, %%r14\n\t"
 1543|   107k|      "adox %%rcx, %%rax\n\t"
 1544|   107k|      "adcx %%rax, %%r10\n\t"
 1545|   107k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1546|   107k|      "adox %%r14, %%rax\n\t"
 1547|   107k|      "adcx %%rax, %%r11\n\t"
 1548|   107k|      "mulx 56(%[x]), %%rax, %%r14\n\t"
 1549|   107k|      "adox %%rcx, %%rax\n\t"
 1550|   107k|      "adcx %%rax, %%r12\n\t"
 1551|   107k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1552|   107k|      "adox %%r14, %%rax\n\t"
 1553|   107k|      "adcx %%rax, %%r13\n\t"
 1554|   107k|      "movl $0, %%eax\n\t"
 1555|   107k|      "adox %%rax, %%rcx\n\t"
 1556|   107k|      "adcx %%rax, %%rcx\n\t"
 1557|   107k|      "movq %%rcx, %%r14\n\t"
 1558|       |
 1559|   107k|      "movq 128(%[z]), %%rdx\n\t"  // row 7: x * y[7]
 1560|   107k|      "xorl %%eax, %%eax\n\t"
 1561|   107k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1562|   107k|      "adcx %%rax, %%r15\n\t"
 1563|   107k|      "movq %%r15, 56(%[z])\n\t"
 1564|   107k|      "mulx 8(%[x]), %%rax, %%r15\n\t"
 1565|   107k|      "adox %%rcx, %%rax\n\t"
 1566|   107k|      "adcx %%rax, %%rbx\n\t"
 1567|   107k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1568|   107k|      "adox %%r15, %%rax\n\t"
 1569|   107k|      "adcx %%rax, %%r8\n\t"
 1570|   107k|      "mulx 24(%[x]), %%rax, %%r15\n\t"
 1571|   107k|      "adox %%rcx, %%rax\n\t"
 1572|   107k|      "adcx %%rax, %%r9\n\t"
 1573|   107k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1574|   107k|      "adox %%r15, %%rax\n\t"
 1575|   107k|      "adcx %%rax, %%r10\n\t"
 1576|   107k|      "mulx 40(%[x]), %%rax, %%r15\n\t"
 1577|   107k|      "adox %%rcx, %%rax\n\t"
 1578|   107k|      "adcx %%rax, %%r11\n\t"
 1579|   107k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1580|   107k|      "adox %%r15, %%rax\n\t"
 1581|   107k|      "adcx %%rax, %%r12\n\t"
 1582|   107k|      "mulx 56(%[x]), %%rax, %%r15\n\t"
 1583|   107k|      "adox %%rcx, %%rax\n\t"
 1584|   107k|      "adcx %%rax, %%r13\n\t"
 1585|   107k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1586|   107k|      "adox %%r15, %%rax\n\t"
 1587|   107k|      "adcx %%rax, %%r14\n\t"
 1588|   107k|      "movl $0, %%eax\n\t"
 1589|   107k|      "adox %%rax, %%rcx\n\t"
 1590|   107k|      "adcx %%rax, %%rcx\n\t"
 1591|   107k|      "movq %%rcx, %%r15\n\t"
 1592|       |
 1593|   107k|      "movq 136(%[z]), %%rdx\n\t"  // row 8: x * y[8]
 1594|   107k|      "xorl %%eax, %%eax\n\t"
 1595|   107k|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1596|   107k|      "adcx %%rax, %%rbx\n\t"
 1597|   107k|      "movq %%rbx, 64(%[z])\n\t"
 1598|   107k|      "mulx 8(%[x]), %%rax, %%rbx\n\t"
 1599|   107k|      "adox %%rcx, %%rax\n\t"
 1600|   107k|      "adcx %%rax, %%r8\n\t"
 1601|   107k|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1602|   107k|      "adox %%rbx, %%rax\n\t"
 1603|   107k|      "adcx %%rax, %%r9\n\t"
 1604|   107k|      "mulx 24(%[x]), %%rax, %%rbx\n\t"
 1605|   107k|      "adox %%rcx, %%rax\n\t"
 1606|   107k|      "adcx %%rax, %%r10\n\t"
 1607|   107k|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1608|   107k|      "adox %%rbx, %%rax\n\t"
 1609|   107k|      "adcx %%rax, %%r11\n\t"
 1610|   107k|      "mulx 40(%[x]), %%rax, %%rbx\n\t"
 1611|   107k|      "adox %%rcx, %%rax\n\t"
 1612|   107k|      "adcx %%rax, %%r12\n\t"
 1613|   107k|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1614|   107k|      "adox %%rbx, %%rax\n\t"
 1615|   107k|      "adcx %%rax, %%r13\n\t"
 1616|   107k|      "mulx 56(%[x]), %%rax, %%rbx\n\t"
 1617|   107k|      "adox %%rcx, %%rax\n\t"
 1618|   107k|      "adcx %%rax, %%r14\n\t"
 1619|   107k|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1620|   107k|      "adox %%rbx, %%rax\n\t"
 1621|   107k|      "adcx %%rax, %%r15\n\t"
 1622|   107k|      "movl $0, %%eax\n\t"
 1623|   107k|      "adox %%rax, %%rcx\n\t"
 1624|   107k|      "adcx %%rax, %%rcx\n\t"
 1625|   107k|      "movq %%rcx, %%rbx\n\t"
 1626|       |
 1627|   107k|      "movq %%r8, 72(%[z])\n\t"
 1628|   107k|      "movq %%r9, 80(%[z])\n\t"
 1629|   107k|      "movq %%r10, 88(%[z])\n\t"
 1630|   107k|      "movq %%r11, 96(%[z])\n\t"
 1631|   107k|      "movq %%r12, 104(%[z])\n\t"
 1632|   107k|      "movq %%r13, 112(%[z])\n\t"
 1633|   107k|      "movq %%r14, 120(%[z])\n\t"
 1634|   107k|      "movq %%r15, 128(%[z])\n\t"
 1635|   107k|      "movq %%rbx, 136(%[z])\n\t"
 1636|   107k|      :
 1637|   107k|      : [z] "r"(z), [x] "r"(x)
 1638|   107k|      : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "rbx", "cc", "memory");
 1639|       |   // clang-format on
 1640|   107k|}

_ZN5Botan17Barrett_ReductionC2ERKNS_6BigIntES1_m:
   17|  1.90k|      m_modulus(m), m_mu(std::move(mu)), m_mod_words(mw), m_modulus_bits(m.bits()) {
   18|       |   // Give some extra space for Karatsuba
   19|  1.90k|   m_modulus.grow_to(m_mod_words + 8);
   20|  1.90k|   m_mu.grow_to(m_mod_words + 8);
   21|  1.90k|}
_ZN5Botan17Barrett_Reduction18for_secret_modulusERKNS_6BigIntE:
   23|  1.90k|Barrett_Reduction Barrett_Reduction::for_secret_modulus(const BigInt& mod) {
   24|  1.90k|   BOTAN_ARG_CHECK(mod.signum() > 0, "Modulus must be positive");
  ------------------
  |  |   35|  1.90k|   do {                                                          \
  |  |   36|  1.90k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|  1.90k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 1, False: 1.90k]
  |  |  ------------------
  |  |   38|      1|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      1|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      1|      }                                                          \
  |  |   41|  1.90k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 1.90k]
  |  |  ------------------
  ------------------
   25|       |
   26|  1.90k|   const size_t mod_words = mod.sig_words();
   27|       |
   28|       |   // Compute mu = floor(2^{2k} / m)
   29|  1.90k|   const size_t mu_bits = 2 * WordInfo<word>::bits * mod_words;
   30|  1.90k|   return Barrett_Reduction(mod, ct_divide_pow2k(mu_bits, mod), mod_words);
   31|  1.90k|}
_ZN5Botan17Barrett_Reduction18for_public_modulusERKNS_6BigIntE:
   33|  1.03k|Barrett_Reduction Barrett_Reduction::for_public_modulus(const BigInt& mod) {
   34|  1.03k|   return Barrett_Reduction::for_secret_modulus(mod);
   35|  1.03k|}
_ZNK5Botan17Barrett_Reduction8multiplyERKNS_6BigIntES3_:
  153|   302k|BigInt Barrett_Reduction::multiply(const BigInt& x, const BigInt& y) const {
  154|   302k|   BOTAN_ARG_CHECK(acceptable_barrett_input(x, m_modulus).as_bool(), "Invalid x param for Barrett multiply");
  ------------------
  |  |   35|   302k|   do {                                                          \
  |  |   36|   302k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|   302k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 39, False: 302k]
  |  |  ------------------
  |  |   38|     39|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|     39|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|     39|      }                                                          \
  |  |   41|   302k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 302k]
  |  |  ------------------
  ------------------
  155|   302k|   BOTAN_ARG_CHECK(acceptable_barrett_input(y, m_modulus).as_bool(), "Invalid y param for Barrett multiply");
  ------------------
  |  |   35|   302k|   do {                                                          \
  |  |   36|   302k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|   302k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 8, False: 302k]
  |  |  ------------------
  |  |   38|      8|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      8|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      8|      }                                                          \
  |  |   41|   302k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 302k]
  |  |  ------------------
  ------------------
  156|       |
  157|   302k|   secure_vector<word> ws(2 * (m_mod_words + 2));
  158|   302k|   secure_vector<word> xy(2 * m_mod_words);
  159|       |
  160|   302k|   bigint_mul(xy.data(),
  161|   302k|              xy.size(),
  162|   302k|              x._data(),
  163|   302k|              x.size(),
  164|   302k|              std::min(x.size(), m_mod_words),
  165|   302k|              y._data(),
  166|   302k|              y.size(),
  167|   302k|              std::min(y.size(), m_mod_words),
  168|   302k|              ws.data(),
  169|   302k|              ws.size());
  170|       |
  171|   302k|   return barrett_reduce(m_mod_words, m_modulus, m_mu, xy, ws);
  172|   302k|}
_ZNK5Botan17Barrett_Reduction6squareERKNS_6BigIntE:
  174|   552k|BigInt Barrett_Reduction::square(const BigInt& x) const {
  175|   552k|   BOTAN_ARG_CHECK(acceptable_barrett_input(x, m_modulus).as_bool(), "Invalid x param for Barrett square");
  ------------------
  |  |   35|   552k|   do {                                                          \
  |  |   36|   552k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|   552k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 101, False: 552k]
  |  |  ------------------
  |  |   38|    101|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|    101|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|    101|      }                                                          \
  |  |   41|   552k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 552k]
  |  |  ------------------
  ------------------
  176|       |
  177|   552k|   secure_vector<word> ws(2 * (m_mod_words + 2));
  178|   552k|   secure_vector<word> x2(2 * m_mod_words);
  179|       |
  180|   552k|   bigint_sqr(x2.data(), x2.size(), x._data(), x.size(), std::min(x.size(), m_mod_words), ws.data(), ws.size());
  181|       |
  182|   552k|   return barrett_reduce(m_mod_words, m_modulus, m_mu, x2, ws);
  183|   552k|}
_ZNK5Botan17Barrett_Reduction6reduceERKNS_6BigIntE:
  185|    536|BigInt Barrett_Reduction::reduce(const BigInt& x) const {
  186|    536|   BOTAN_ARG_CHECK(x.signum() >= 0, "Argument must be non-negative");
  ------------------
  |  |   35|    536|   do {                                                          \
  |  |   36|    536|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    536|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 536]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    536|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 536]
  |  |  ------------------
  ------------------
  187|       |
  188|    536|   const size_t x_sw = x.sig_words();
  189|    536|   BOTAN_ARG_CHECK(x_sw <= 2 * m_mod_words, "Argument is too large for Barrett reduction");
  ------------------
  |  |   35|    536|   do {                                                          \
  |  |   36|    536|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    536|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 536]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    536|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 536]
  |  |  ------------------
  ------------------
  190|       |
  191|    536|   x.grow_to(2 * m_mod_words);
  192|       |
  193|    536|   secure_vector<word> ws;
  194|    536|   return barrett_reduce(m_mod_words, m_modulus, m_mu, x._as_span(), ws);
  195|    536|}
barrett.cpp:_ZN5Botan12_GLOBAL__N_124acceptable_barrett_inputERKNS_6BigIntES3_:
  145|  1.15M|CT::Choice acceptable_barrett_input(const BigInt& x, const BigInt& modulus) {
  146|  1.15M|   const auto x_is_positive = CT::Choice::from_int(static_cast<uint32_t>(x.signum() >= 0));
  147|  1.15M|   const auto x_lt_mod = bigint_ct_is_lt(x._data(), x.size(), modulus._data(), modulus.sig_words()).as_choice();
  148|  1.15M|   return x_is_positive && x_lt_mod;
  149|  1.15M|}
barrett.cpp:_ZN5Botan12_GLOBAL__N_114barrett_reduceEmRKNS_6BigIntES3_NSt3__14spanIKmLm18446744073709551615EEERNS4_6vectorImNS_16secure_allocatorImEEEE:
   48|   855k|   size_t mod_words, const BigInt& modulus, const BigInt& mu, std::span<const word> x_words, secure_vector<word>& ws) {
   49|   855k|   BOTAN_ASSERT_NOMSG(modulus.sig_words() == mod_words);
  ------------------
  |  |   84|   855k|   do {                                                                     \
  |  |   85|   855k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|   855k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 855k]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|   855k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 855k]
  |  |  ------------------
  ------------------
   50|       |
   51|       |   // Caller must expand input to be at least this size
   52|   855k|   BOTAN_ASSERT_NOMSG(x_words.size() >= 2 * mod_words);
  ------------------
  |  |   84|   855k|   do {                                                                     \
  |  |   85|   855k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|   855k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 855k]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|   855k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 855k]
  |  |  ------------------
  ------------------
   53|       |
   54|       |   // Normally mod_words + 1 but can be + 2 if the modulus is a power of 2
   55|   855k|   const size_t mu_words = mu.sig_words();
   56|   855k|   BOTAN_ASSERT_NOMSG(mu_words <= mod_words + 2);
  ------------------
  |  |   84|   855k|   do {                                                                     \
  |  |   85|   855k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|   855k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 855k]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|   855k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 855k]
  |  |  ------------------
  ------------------
   57|       |
   58|   855k|   if(ws.size() < 2 * (mod_words + 2)) {
  ------------------
  |  Branch (58:7): [True: 536, False: 855k]
  ------------------
   59|    536|      ws.resize(2 * (mod_words + 2));
   60|    536|   }
   61|       |
   62|   855k|   CT::poison(x_words);
   63|       |
   64|       |   /*
   65|       |   * Following the notation of Handbook of Applied Cryptography
   66|       |   * Algorithm 14.42 "Barrett modular reduction", page 604
   67|       |   * <https://cacr.uwaterloo.ca/hac/about/chap14.pdf>
   68|       |   *
   69|       |   * Using `mu` for µ in the code
   70|       |   */
   71|       |
   72|       |   // Compute q1 = floor(x / 2^(k - 1)) which is equivalent to ignoring the low (k-1) words
   73|       |
   74|       |   // 2 * mod_words + 1 is sufficient, extra is to enable Karatsuba
   75|   855k|   secure_vector<word> r(2 * mu_words + 2);
   76|       |
   77|   855k|   copy_mem(r.data(), x_words.data() + (mod_words - 1), mod_words + 1);
   78|       |
   79|       |   // Now compute q2 = q1 * µ
   80|       |
   81|       |   // We allocate more size than required since this allows Karatsuba more often;
   82|       |   // just `mu_words + (mod_words + 1)` is sufficient
   83|   855k|   const size_t q2_size = 2 * mu_words + 2;
   84|       |
   85|   855k|   secure_vector<word> q2(q2_size);
   86|       |
   87|   855k|   bigint_mul(
   88|   855k|      q2.data(), q2.size(), r.data(), r.size(), mod_words + 1, mu._data(), mu.size(), mu_words, ws.data(), ws.size());
   89|       |
   90|       |   // Compute r2 = (floor(q2 / b^(k+1)) * m) mod 2^(k+1)
   91|       |   // The division/floor is again effected by just ignoring the low k + 1 words
   92|   855k|   bigint_mul(r.data(),
   93|   855k|              r.size(),
   94|   855k|              &q2[mod_words + 1],  // ignoring the low mod_words + 1 words of the first product
   95|   855k|              q2.size() - (mod_words + 1),
   96|   855k|              mod_words + 1,
   97|   855k|              modulus._data(),
   98|   855k|              modulus.size(),
   99|   855k|              mod_words,
  100|   855k|              ws.data(),
  101|   855k|              ws.size());
  102|       |
  103|       |   // Clear the high words of the product, equivalent to computing mod 2^(k+1)
  104|       |   // TODO add masked mul to avoid computing high bits at all
  105|   855k|   clear_mem(std::span{r}.subspan(mod_words + 1));
  106|       |
  107|       |   // Compute r = r1 - r2
  108|       |
  109|       |   // The return value of bigint_sub_abs isn't quite right for what we need here so first compare
  110|   855k|   const int32_t relative_size = bigint_cmp(r.data(), mod_words + 1, x_words.data(), mod_words + 1);
  111|       |
  112|   855k|   bigint_sub_abs(r.data(), r.data(), x_words.data(), mod_words + 1, ws.data());
  113|       |
  114|       |   /*
  115|       |   If r is negative then we have to set r to r + 2^(k+1)
  116|       |
  117|       |   However for r negative computing this sum is equivalent to computing 2^(k+1) - abs(r)
  118|       |   */
  119|   855k|   clear_mem(ws.data(), mod_words + 2);
  120|   855k|   ws[mod_words + 1] = 1;
  121|   855k|   bigint_sub2(ws.data(), mod_words + 2, r.data(), mod_words + 2);
  122|       |
  123|       |   // If relative_size > 0 then assign r to 2^(k+1) - r
  124|   855k|   CT::Mask<word>::is_equal(static_cast<word>(relative_size), 1).select_n(r.data(), ws.data(), r.data(), mod_words + 2);
  125|       |
  126|       |   /*
  127|       |   * Per HAC Note 14.44 (ii) "step 4 is repeated at most twice since 0 <= r < 3m"
  128|       |   */
  129|   855k|   const size_t bound = 2;
  130|       |
  131|   855k|   BOTAN_ASSERT_NOMSG(r.size() >= mod_words + 1);
  ------------------
  |  |   84|   855k|   do {                                                                     \
  |  |   85|   855k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|   855k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 855k]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|   855k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 855k]
  |  |  ------------------
  ------------------
  132|  2.56M|   for(size_t i = 0; i != bound; ++i) {
  ------------------
  |  Branch (132:22): [True: 1.71M, False: 855k]
  ------------------
  133|  1.71M|      const word borrow = bigint_sub3(ws.data(), r.data(), mod_words + 1, modulus._data(), mod_words);
  134|  1.71M|      CT::Mask<word>::is_zero(borrow).select_n(r.data(), ws.data(), r.data(), mod_words + 1);
  135|  1.71M|   }
  136|       |
  137|   855k|   CT::unpoison(q2);
  138|   855k|   CT::unpoison(r);
  139|   855k|   CT::unpoison(ws);
  140|   855k|   CT::unpoison(x_words);
  141|       |
  142|   855k|   return BigInt::_from_words(r);
  143|   855k|}

_ZN5Botan17Montgomery_Params4DataC2ERKNS_6BigIntERKNS_17Barrett_ReductionE:
   40|    536|Montgomery_Params::Data::Data(const BigInt& p, const Barrett_Reduction& mod_p) {
   41|    536|   if(p.is_even() || p < 3) {
  ------------------
  |  Branch (41:7): [True: 0, False: 536]
  |  Branch (41:22): [True: 0, False: 536]
  ------------------
   42|      0|      throw Invalid_Argument("Montgomery_Params invalid modulus");
   43|      0|   }
   44|       |
   45|    536|   m_p = p;
   46|    536|   m_p_words = m_p.sig_words();
   47|    536|   m_p_dash = monty_inverse(m_p.word_at(0));
   48|       |
   49|    536|   const BigInt r = BigInt::power_of_2(m_p_words * WordInfo<word>::bits);
   50|       |
   51|    536|   m_r1 = mod_p.reduce(r);
   52|    536|   m_r2 = mod_p.square(m_r1);
   53|    536|   m_r3 = mod_p.multiply(m_r1, m_r2);
   54|       |
   55|       |   // Barrett should be at least zero prefixing up to modulus size
   56|    536|   BOTAN_ASSERT_NOMSG(m_r1.size() >= m_p_words);
  ------------------
  |  |   84|    536|   do {                                                                     \
  |  |   85|    536|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|    536|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 536]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|    536|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 536]
  |  |  ------------------
  ------------------
   57|    536|   BOTAN_ASSERT_NOMSG(m_r2.size() >= m_p_words);
  ------------------
  |  |   84|    536|   do {                                                                     \
  |  |   85|    536|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|    536|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 536]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|    536|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 536]
  |  |  ------------------
  ------------------
   58|    536|   BOTAN_ASSERT_NOMSG(m_r3.size() >= m_p_words);
  ------------------
  |  |   84|    536|   do {                                                                     \
  |  |   85|    536|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|    536|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 536]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|    536|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 536]
  |  |  ------------------
  ------------------
   59|    536|}
_ZN5Botan17Montgomery_ParamsC2ERKNS_6BigIntERKNS_17Barrett_ReductionE:
   62|    536|      m_data(std::make_shared<Data>(p, mod_p)) {}
_ZNK5Botan17Montgomery_ParamseqERKS0_:
   67|  3.75k|bool Montgomery_Params::operator==(const Montgomery_Params& other) const {
   68|  3.75k|   if(this->m_data == other.m_data) {
  ------------------
  |  Branch (68:7): [True: 3.75k, False: 0]
  ------------------
   69|  3.75k|      return true;
   70|  3.75k|   }
   71|       |
   72|      0|   return (this->m_data->p() == other.m_data->p());
   73|  3.75k|}
_ZN5Botan14Montgomery_IntC2ERKNS_17Montgomery_ParamsENSt3__16vectorImNS_16secure_allocatorImEEEE:
  227|  3.75k|      m_params(params), m_v(std::move(words)) {
  228|  3.75k|   BOTAN_ASSERT_NOMSG(m_v.size() == m_params.p_words());
  ------------------
  |  |   84|  3.75k|   do {                                                                     \
  |  |   85|  3.75k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|  3.75k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 3.75k]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|  3.75k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 3.75k]
  |  |  ------------------
  ------------------
  229|  3.75k|}
_ZN5Botan14Montgomery_Int3oneERKNS_17Montgomery_ParamsE:
  231|    560|Montgomery_Int Montgomery_Int::one(const Montgomery_Params& params) {
  232|    560|   return Montgomery_Int(params, params.R1(), false);
  233|    560|}
_ZN5Botan14Montgomery_IntC2ERKNS_17Montgomery_ParamsERKNS_6BigIntEb:
  242|  1.09k|      m_params(params), m_v(m_params.p_words()) {
  243|  1.09k|   BOTAN_ARG_CHECK(v.signum() >= 0 && v < m_params.p(), "Input out of range");
  ------------------
  |  |   35|  1.09k|   do {                                                          \
  |  |   36|  1.09k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|  2.19k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:12): [True: 1.09k, False: 0]
  |  |  |  Branch (37:12): [True: 1.09k, False: 0]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|  1.09k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 1.09k]
  |  |  ------------------
  ------------------
  244|       |
  245|  1.09k|   const size_t p_size = m_params.p_words();
  246|       |
  247|  1.09k|   auto v_span = v._as_span();
  248|       |
  249|  1.09k|   if(v_span.size() > p_size) {
  ------------------
  |  Branch (249:7): [True: 732, False: 364]
  ------------------
  250|       |      // Safe to truncate the span since we already checked v < p
  251|    732|      v_span = v_span.first(p_size);
  252|    732|   }
  253|       |
  254|  1.09k|   BOTAN_ASSERT_NOMSG(m_v.size() >= v_span.size());
  ------------------
  |  |   84|  1.09k|   do {                                                                     \
  |  |   85|  1.09k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|  1.09k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 1.09k]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|  1.09k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 1.09k]
  |  |  ------------------
  ------------------
  255|       |
  256|  1.09k|   copy_mem(std::span{m_v}.first(v_span.size()), v_span);
  257|       |
  258|  1.09k|   if(redc_needed) {
  ------------------
  |  Branch (258:7): [True: 536, False: 560]
  ------------------
  259|    536|      secure_vector<word> ws;
  260|    536|      this->mul_by(m_params.R2()._as_span().first(p_size), ws);
  261|    536|   }
  262|  1.09k|}
_ZN5Botan14Montgomery_IntC2ERKNS_17Montgomery_ParamsENSt3__14spanIKmLm18446744073709551615EEE:
  265|    512|      m_params(params), m_v(words.begin(), words.end()) {
  266|    512|   BOTAN_ARG_CHECK(m_v.size() == m_params.p_words(), "Invalid input span");
  ------------------
  |  |   35|    512|   do {                                                          \
  |  |   36|    512|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    512|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 512]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    512|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 512]
  |  |  ------------------
  ------------------
  267|    512|}
_ZNK5Botan14Montgomery_Int5valueEv:
  273|    536|BigInt Montgomery_Int::value() const {
  274|    536|   secure_vector<word> ws(m_params.p_words());
  275|       |
  276|    536|   secure_vector<word> z = m_v;
  277|    536|   z.resize(2 * m_params.p_words());  // zero extend
  278|       |
  279|    536|   bigint_monty_redc_inplace(
  280|    536|      z.data(), m_params.p()._data(), m_params.p_words(), m_params.p_dash(), ws.data(), ws.size());
  281|       |
  282|    536|   return BigInt::_from_words(z);
  283|    536|}
_ZNK5Botan14Montgomery_Int3mulERKS0_RNSt3__16vectorImNS_16secure_allocatorImEEEE:
  320|  3.75k|Montgomery_Int Montgomery_Int::mul(const Montgomery_Int& other, secure_vector<word>& ws) const {
  321|  3.75k|   BOTAN_STATE_CHECK(other.m_params == m_params);
  ------------------
  |  |   51|  3.75k|   do {                                                         \
  |  |   52|  3.75k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */             \
  |  |   53|  3.75k|      if(!(expr)) {                                             \
  |  |  ------------------
  |  |  |  Branch (53:10): [True: 0, False: 3.75k]
  |  |  ------------------
  |  |   54|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */    \
  |  |   55|      0|         Botan::throw_invalid_state(#expr, __func__, __FILE__); \
  |  |   56|      0|      }                                                         \
  |  |   57|  3.75k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (57:12): [Folded, False: 3.75k]
  |  |  ------------------
  ------------------
  322|       |
  323|  3.75k|   const size_t p_size = m_params.p_words();
  324|  3.75k|   BOTAN_ASSERT_NOMSG(m_v.size() == p_size && other.m_v.size() == p_size);
  ------------------
  |  |   84|  3.75k|   do {                                                                     \
  |  |   85|  3.75k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|  7.50k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:12): [True: 3.75k, False: 0]
  |  |  |  Branch (86:12): [True: 3.75k, False: 0]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|  3.75k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 3.75k]
  |  |  ------------------
  ------------------
  325|       |
  326|  3.75k|   if(ws.size() < 4 * p_size) {
  ------------------
  |  Branch (326:7): [True: 0, False: 3.75k]
  ------------------
  327|      0|      ws.resize(4 * p_size);
  328|      0|   }
  329|       |
  330|  3.75k|   secure_vector<word> z(p_size);
  331|       |
  332|  3.75k|   bigint_monty_mul(
  333|  3.75k|      z.data(), m_v.data(), other.m_v.data(), m_params.p()._data(), p_size, m_params.p_dash(), ws.data(), ws.size());
  334|       |
  335|  3.75k|   return Montgomery_Int(m_params, std::move(z));
  336|  3.75k|}
_ZN5Botan14Montgomery_Int6mul_byENSt3__14spanIKmLm18446744073709551615EEERNS1_6vectorImNS_16secure_allocatorImEEEE:
  343|  55.7k|Montgomery_Int& Montgomery_Int::mul_by(std::span<const word> other, secure_vector<word>& ws) {
  344|  55.7k|   const size_t p_size = m_params.p_words();
  345|  55.7k|   BOTAN_ASSERT_NOMSG(m_v.size() == p_size && other.size() == p_size);
  ------------------
  |  |   84|  55.7k|   do {                                                                     \
  |  |   85|  55.7k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|   111k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:12): [True: 55.7k, False: 0]
  |  |  |  Branch (86:12): [True: 55.7k, False: 0]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|  55.7k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 55.7k]
  |  |  ------------------
  ------------------
  346|       |
  347|  55.7k|   if(ws.size() < 4 * p_size) {
  ------------------
  |  Branch (347:7): [True: 536, False: 55.2k]
  ------------------
  348|    536|      ws.resize(4 * p_size);
  349|    536|   }
  350|       |
  351|  55.7k|   bigint_monty_mul(
  352|  55.7k|      m_v.data(), m_v.data(), other.data(), m_params.p()._data(), p_size, m_params.p_dash(), ws.data(), ws.size());
  353|       |
  354|  55.7k|   return (*this);
  355|  55.7k|}
_ZN5Botan14Montgomery_Int19square_this_n_timesERNSt3__16vectorImNS_16secure_allocatorImEEEEm:
  357|  59.0k|Montgomery_Int& Montgomery_Int::square_this_n_times(secure_vector<word>& ws, size_t n) {
  358|  59.0k|   const size_t p_size = m_params.p_words();
  359|  59.0k|   BOTAN_ASSERT_NOMSG(m_v.size() == p_size);
  ------------------
  |  |   84|  59.0k|   do {                                                                     \
  |  |   85|  59.0k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|  59.0k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 59.0k]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|  59.0k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 59.0k]
  |  |  ------------------
  ------------------
  360|       |
  361|  59.0k|   if(ws.size() < 4 * p_size) {
  ------------------
  |  Branch (361:7): [True: 1.03k, False: 57.9k]
  ------------------
  362|  1.03k|      ws.resize(4 * p_size);
  363|  1.03k|   }
  364|       |
  365|   283k|   for(size_t i = 0; i != n; ++i) {
  ------------------
  |  Branch (365:22): [True: 224k, False: 59.0k]
  ------------------
  366|   224k|      bigint_monty_sqr(m_v.data(), m_v.data(), m_params.p()._data(), p_size, m_params.p_dash(), ws.data(), ws.size());
  367|   224k|   }
  368|       |
  369|  59.0k|   return (*this);
  370|  59.0k|}
_ZNK5Botan14Montgomery_Int6squareERNSt3__16vectorImNS_16secure_allocatorImEEEE:
  463|  3.75k|Montgomery_Int Montgomery_Int::square(secure_vector<word>& ws) const {
  464|  3.75k|   auto z = (*this);
  465|  3.75k|   z.square_this_n_times(ws, 1);
  466|  3.75k|   return z;
  467|  3.75k|}

_ZN5Botan16monty_precomputeERKNS_14Montgomery_IntEmb:
  145|    536|                                                                        bool const_time) {
  146|    536|   if(window_bits == 0) {
  ------------------
  |  Branch (146:7): [True: 0, False: 536]
  ------------------
  147|      0|      window_bits = 4;
  148|      0|   }
  149|       |
  150|    536|   if(window_bits < 1 || window_bits > 12) {  // really even 8 is too large ...
  ------------------
  |  Branch (150:7): [True: 0, False: 536]
  |  Branch (150:26): [True: 0, False: 536]
  ------------------
  151|      0|      throw Invalid_Argument("Invalid window bits for Montgomery exponentiation");
  152|      0|   }
  153|       |
  154|    536|#if defined(BOTAN_HAS_MONTY_EXP_AVX512)
  155|    536|   if(CPUID::has(CPUID::Feature::AVX512)) {
  ------------------
  |  Branch (155:7): [True: 0, False: 536]
  ------------------
  156|      0|      if(auto state = make_monty_exp_avx512(g, window_bits, const_time)) {
  ------------------
  |  Branch (156:15): [True: 0, False: 0]
  ------------------
  157|      0|         return state;
  158|      0|      }
  159|      0|   }
  160|    536|#endif
  161|       |
  162|    536|   return std::make_shared<const Montgomery_Exponentiation_Generic>(g, window_bits, const_time);
  163|    536|}
_ZN5Botan16monty_precomputeERKNS_17Montgomery_ParamsERKNS_6BigIntEmb:
  168|    536|                                                                        bool const_time) {
  169|    536|   BOTAN_ARG_CHECK(g.signum() >= 0 && g < params.p(), "Montgomery exponentiation base integer out of range");
  ------------------
  |  |   35|    536|   do {                                                          \
  |  |   36|    536|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|  1.07k|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:12): [True: 536, False: 0]
  |  |  |  Branch (37:12): [True: 536, False: 0]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    536|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 536]
  |  |  ------------------
  ------------------
  170|    536|   const Montgomery_Int monty_g(params, g);
  171|    536|   return monty_precompute(monty_g, window_bits, const_time);
  172|    536|}
_ZN5Botan13monty_executeERKNS_31Montgomery_Exponentiation_StateERKNS_6BigIntEm:
  176|    536|                             size_t max_k_bits) {
  177|    536|   return precomputed_state.exponentiation(k, max_k_bits);
  178|    536|}
monty_exp.cpp:_ZN5Botan12_GLOBAL__N_133Montgomery_Exponentiation_GenericC2ERKNS_14Montgomery_IntEmb:
   43|    536|      m_params(g._params()), m_window_bits(window_bits) {
   44|    536|   const size_t window_size = (static_cast<size_t>(1) << m_window_bits);
   45|       |
   46|    536|   m_g.reserve(window_size);
   47|       |
   48|    536|   m_g.push_back(Montgomery_Int::one(m_params));
   49|       |
   50|    536|   m_g.push_back(g);
   51|       |
   52|    536|   secure_vector<word> ws(2 * m_params.p_words());
   53|       |
   54|  8.04k|   for(size_t i = 2; i != window_size; ++i) {
  ------------------
  |  Branch (54:22): [True: 7.50k, False: 536]
  ------------------
   55|  7.50k|      if(i % 2 == 0) {
  ------------------
  |  Branch (55:10): [True: 3.75k, False: 3.75k]
  ------------------
   56|  3.75k|         m_g.push_back(m_g[i / 2].square(ws));
   57|  3.75k|      } else {
   58|  3.75k|         m_g.push_back(m_g[1].mul(m_g[i - 1], ws));
   59|  3.75k|      }
   60|  7.50k|   }
   61|       |
   62|    536|   if(const_time) {
  ------------------
  |  Branch (62:7): [True: 536, False: 0]
  ------------------
   63|    536|      CT::poison_range(m_g);
   64|    536|   }
   65|    536|}
monty_exp.cpp:_ZNK5Botan12_GLOBAL__N_133Montgomery_Exponentiation_Generic14exponentiationERKNS_6BigIntEm:
   90|    536|Montgomery_Int Montgomery_Exponentiation_Generic::exponentiation(const BigInt& scalar, size_t max_k_bits) const {
   91|    536|   BOTAN_ARG_CHECK(scalar.signum() >= 0, "Invalid scalar for Montgomery exponentiation");
  ------------------
  |  |   35|    536|   do {                                                          \
  |  |   36|    536|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */              \
  |  |   37|    536|      if(!(expr)) {                                              \
  |  |  ------------------
  |  |  |  Branch (37:10): [True: 0, False: 536]
  |  |  ------------------
  |  |   38|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */     \
  |  |   39|      0|         Botan::throw_invalid_argument(msg, __func__, __FILE__); \
  |  |   40|      0|      }                                                          \
  |  |   41|    536|   } while(0)
  |  |  ------------------
  |  |  |  Branch (41:12): [Folded, False: 536]
  |  |  ------------------
  ------------------
   92|    536|   BOTAN_DEBUG_ASSERT(scalar.bits() <= max_k_bits);
  ------------------
  |  |  137|    536|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  138|    536|      } while(0)
  |  |  ------------------
  |  |  |  Branch (138:15): [Folded, False: 536]
  |  |  ------------------
  ------------------
   93|       |   // TODO add a const-time implementation of above assert and use it in release builds
   94|       |
   95|    536|   const size_t exp_nibbles = (max_k_bits + m_window_bits - 1) / m_window_bits;
   96|       |
   97|    536|   if(exp_nibbles == 0) {
  ------------------
  |  Branch (97:7): [True: 24, False: 512]
  ------------------
   98|     24|      return Montgomery_Int::one(m_params);
   99|     24|   }
  100|       |
  101|    512|   secure_vector<word> e_bits(m_params.p_words());
  102|    512|   secure_vector<word> ws(2 * m_params.p_words());
  103|       |
  104|    512|   const_time_lookup(e_bits, m_g, scalar.get_substring(m_window_bits * (exp_nibbles - 1), m_window_bits));
  105|    512|   Montgomery_Int x(m_params, std::span{e_bits});
  106|       |
  107|  55.7k|   for(size_t i = exp_nibbles - 1; i > 0; --i) {
  ------------------
  |  Branch (107:36): [True: 55.2k, False: 512]
  ------------------
  108|  55.2k|      x.square_this_n_times(ws, m_window_bits);
  109|  55.2k|      const_time_lookup(e_bits, m_g, scalar.get_substring(m_window_bits * (i - 1), m_window_bits));
  110|  55.2k|      x.mul_by(e_bits, ws);
  111|  55.2k|   }
  112|       |
  113|    512|   CT::unpoison(x);
  114|    512|   return x;
  115|    536|}
monty_exp.cpp:_ZN5Botan12_GLOBAL__N_117const_time_lookupERNSt3__16vectorImNS_16secure_allocatorImEEEERKNS2_INS_14Montgomery_IntENS1_9allocatorIS7_EEEEm:
   67|  55.7k|void const_time_lookup(secure_vector<word>& output, const std::vector<Montgomery_Int>& g, size_t nibble) {
   68|  55.7k|   BOTAN_ASSERT_NOMSG(g.size() % 2 == 0);  // actually a power of 2
  ------------------
  |  |   84|  55.7k|   do {                                                                     \
  |  |   85|  55.7k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|  55.7k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 55.7k]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|  55.7k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 55.7k]
  |  |  ------------------
  ------------------
   69|       |
   70|  55.7k|   const size_t words = output.size();
   71|       |
   72|  55.7k|   clear_mem(output.data(), output.size());
   73|       |
   74|   501k|   for(size_t i = 0; i != g.size(); i += 2) {
  ------------------
  |  Branch (74:22): [True: 446k, False: 55.7k]
  ------------------
   75|   446k|      const secure_vector<word>& vec_0 = g[i].repr();
   76|   446k|      const secure_vector<word>& vec_1 = g[i + 1].repr();
   77|       |
   78|   446k|      BOTAN_ASSERT_NOMSG(vec_0.size() >= words && vec_1.size() >= words);
  ------------------
  |  |   84|   446k|   do {                                                                     \
  |  |   85|   446k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|   892k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:12): [True: 446k, False: 0]
  |  |  |  Branch (86:12): [True: 446k, False: 0]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|   446k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 446k]
  |  |  ------------------
  ------------------
   79|       |
   80|   446k|      const auto mask_0 = CT::Mask<word>::is_equal(nibble, i);
   81|   446k|      const auto mask_1 = CT::Mask<word>::is_equal(nibble, i + 1);
   82|       |
   83|  7.20M|      for(size_t w = 0; w != words; ++w) {
  ------------------
  |  Branch (83:25): [True: 6.76M, False: 446k]
  ------------------
   84|  6.76M|         output[w] |= mask_0.if_set_return(vec_0[w]);
   85|  6.76M|         output[w] |= mask_1.if_set_return(vec_1[w]);
   86|  6.76M|      }
   87|   446k|   }
   88|  55.7k|}

_ZN5Botan9power_modERKNS_6BigIntES2_S2_:
  310|    918|BigInt power_mod(const BigInt& base, const BigInt& exp, const BigInt& mod) {
  311|    918|   if(mod.signum() < 0 || mod == 1) {
  ------------------
  |  Branch (311:7): [True: 0, False: 918]
  |  Branch (311:27): [True: 1, False: 917]
  ------------------
  312|      1|      return BigInt::zero();
  313|      1|   }
  314|       |
  315|    917|   if(base.is_zero() || mod.is_zero()) {
  ------------------
  |  Branch (315:7): [True: 42, False: 875]
  |  Branch (315:25): [True: 1, False: 874]
  ------------------
  316|     43|      if(exp.is_zero()) {
  ------------------
  |  Branch (316:10): [True: 1, False: 42]
  ------------------
  317|      1|         return BigInt::one();
  318|      1|      }
  319|     42|      return BigInt::zero();
  320|     43|   }
  321|       |
  322|    874|   const auto reduce_mod = Barrett_Reduction::for_secret_modulus(mod);
  323|       |
  324|    874|   const size_t exp_bits = exp.bits();
  325|       |
  326|    874|   if(mod.is_odd()) {
  ------------------
  |  Branch (326:7): [True: 536, False: 338]
  ------------------
  327|    536|      const Montgomery_Params monty_params(mod, reduce_mod);
  328|    536|      return monty_exp(monty_params, ct_modulo(base, mod), exp, exp_bits).value();
  329|    536|   }
  330|       |
  331|       |   /*
  332|       |   Support for even modulus is just a convenience and not considered
  333|       |   cryptographically important, so this implementation is slow ...
  334|       |   */
  335|    338|   BigInt accum = BigInt::one();
  336|    338|   BigInt g = ct_modulo(base, mod);
  337|    338|   BigInt t;
  338|       |
  339|   160k|   for(size_t i = 0; i != exp_bits; ++i) {
  ------------------
  |  Branch (339:22): [True: 160k, False: 338]
  ------------------
  340|   160k|      t = reduce_mod.multiply(g, accum);
  341|   160k|      g = reduce_mod.square(g);
  342|   160k|      accum.ct_cond_assign(exp.get_bit(i), t);
  343|   160k|   }
  344|    338|   return accum;
  345|    874|}

_ZN5Botan15allocate_memoryEmm:
   21|  3.45M|BOTAN_MALLOC_FN void* allocate_memory(size_t elems, size_t elem_size) {
   22|  3.45M|   if(elems == 0 || elem_size == 0) {
  ------------------
  |  Branch (22:7): [True: 0, False: 3.45M]
  |  Branch (22:21): [True: 0, False: 3.45M]
  ------------------
   23|      0|      return nullptr;
   24|      0|   }
   25|       |
   26|       |   // Some calloc implementations do not check for overflow (?!?)
   27|  3.45M|   if(!checked_mul(elems, elem_size).has_value()) {
  ------------------
  |  Branch (27:7): [True: 0, False: 3.45M]
  ------------------
   28|      0|      throw std::bad_alloc();
   29|      0|   }
   30|       |
   31|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   32|       |   // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy
   33|       |   if(void* p = mlock_allocator::instance().allocate(elems, elem_size)) {
   34|       |      return p;
   35|       |   }
   36|       |#endif
   37|       |
   38|       |#if defined(BOTAN_TARGET_OS_HAS_ALLOC_CONCEAL)
   39|       |   void* ptr = ::calloc_conceal(elems, elem_size);
   40|       |#else
   41|       |   // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy
   42|  3.45M|   void* ptr = std::calloc(elems, elem_size);  // NOLINT(*-no-malloc,*-owning-memory)
   43|  3.45M|#endif
   44|  3.45M|   if(ptr == nullptr) {
  ------------------
  |  Branch (44:7): [True: 0, False: 3.45M]
  ------------------
   45|      0|      [[unlikely]] throw std::bad_alloc();
   46|      0|   }
   47|  3.45M|   return ptr;
   48|  3.45M|}
_ZN5Botan17deallocate_memoryEPvmm:
   50|  3.45M|void deallocate_memory(void* p, size_t elems, size_t elem_size) {
   51|  3.45M|   if(p == nullptr) {
  ------------------
  |  Branch (51:7): [True: 0, False: 3.45M]
  ------------------
   52|      0|      [[unlikely]] return;
   53|      0|   }
   54|       |
   55|  3.45M|   secure_scrub_memory(p, elems * elem_size);
   56|       |
   57|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   58|       |   if(mlock_allocator::instance().deallocate(p, elems, elem_size)) {
   59|       |      return;
   60|       |   }
   61|       |#endif
   62|       |
   63|  3.45M|   std::free(p);  // NOLINT(*-no-malloc,*-owning-memory)
   64|  3.45M|}

_ZN5Botan22throw_invalid_argumentEPKcS1_S1_:
   23|    149|void throw_invalid_argument(const char* message, const char* func, const char* file) {
   24|    149|   throw Invalid_Argument(fmt("{} in {}:{}", message, func, file));
   25|    149|}

_ZN5Botan5CPUID10CPUID_DataC2Ev:
   80|      1|CPUID::CPUID_Data::CPUID_Data() {
   81|       |   // NOLINTBEGIN(*-prefer-member-initializer)
   82|      1|#if defined(BOTAN_HAS_CPUID_DETECTION)
   83|      1|   m_processor_features = detect_cpu_features(~cleared_cpuid_bits());
   84|       |#else
   85|       |   m_processor_features = 0;
   86|       |#endif
   87|       |   // NOLINTEND(*-prefer-member-initializer)
   88|      1|}
cpuid.cpp:_ZN5Botan12_GLOBAL__N_118cleared_cpuid_bitsEv:
   59|      1|uint32_t cleared_cpuid_bits() {
   60|      1|   uint32_t cleared = 0;
   61|       |
   62|      1|   #if defined(BOTAN_HAS_OS_UTILS)
   63|      1|   std::string clear_cpuid_env;
   64|      1|   if(OS::read_env_variable(clear_cpuid_env, "BOTAN_CLEAR_CPUID")) {
  ------------------
  |  Branch (64:7): [True: 0, False: 1]
  ------------------
   65|      0|      for(const auto& cpuid : split_on(clear_cpuid_env, ',')) {
  ------------------
  |  Branch (65:29): [True: 0, False: 0]
  ------------------
   66|      0|         if(auto bit = CPUID::bit_from_string(cpuid)) {
  ------------------
  |  Branch (66:18): [True: 0, False: 0]
  ------------------
   67|      0|            cleared |= bit->as_u32();
   68|      0|         }
   69|      0|      }
   70|      0|   }
   71|      1|   #endif
   72|       |
   73|      1|   return cleared;
   74|      1|}

_ZN5Botan5CPUID10CPUID_Data19detect_cpu_featuresEj:
   62|      1|uint32_t CPUID::CPUID_Data::detect_cpu_features(uint32_t allowed) {
   63|      1|   enum class x86_CPUID_1_bits : uint64_t {
   64|      1|      RDTSC = (1ULL << 4),
   65|      1|      SSE2 = (1ULL << 26),
   66|      1|      CLMUL = (1ULL << 33),
   67|      1|      SSSE3 = (1ULL << 41),
   68|      1|      SSE41 = (1ULL << 51),
   69|      1|      POPCNT = (1ULL << 55),
   70|      1|      AESNI = (1ULL << 57),
   71|       |      // AVX + OSXSAVE
   72|      1|      OSXSAVE = (1ULL << 59) | (1ULL << 60),
   73|      1|      RDRAND = (1ULL << 62)
   74|      1|   };
   75|       |
   76|      1|   enum class x86_CPUID_7_bits : uint64_t {
   77|      1|      BMI1 = (1ULL << 3),
   78|      1|      AVX2 = (1ULL << 5),
   79|      1|      BMI2 = (1ULL << 8),
   80|      1|      BMI_1_AND_2 = BMI1 | BMI2,
   81|      1|      AVX512_F = (1ULL << 16),
   82|      1|      AVX512_DQ = (1ULL << 17),
   83|      1|      RDSEED = (1ULL << 18),
   84|      1|      ADX = (1ULL << 19),
   85|      1|      AVX512_IFMA = (1ULL << 21),
   86|      1|      SHA = (1ULL << 29),
   87|      1|      AVX512_BW = (1ULL << 30),
   88|      1|      AVX512_VL = (1ULL << 31),
   89|      1|      AVX512_VBMI = (1ULL << 33),
   90|      1|      AVX512_VBMI2 = (1ULL << 38),
   91|      1|      GFNI = (1ULL << 40),
   92|      1|      AVX512_VAES = (1ULL << 41),
   93|      1|      AVX512_VCLMUL = (1ULL << 42),
   94|      1|      AVX512_VBITALG = (1ULL << 44),
   95|       |
   96|       |      /*
   97|       |      We only enable AVX512 support if all of the below flags are available
   98|       |
   99|       |      This is more than we strictly need for most uses, however it also has
  100|       |      the effect of preventing execution of AVX512 codepaths on cores that
  101|       |      have serious downclocking problems when AVX512 code executes,
  102|       |      especially Intel Skylake.
  103|       |
  104|       |      VBMI2/VBITALG are the key flags here as they restrict us to Intel Ice
  105|       |      Lake/Rocket Lake, or AMD Zen4, all of which do not have penalties for
  106|       |      executing AVX512.
  107|       |
  108|       |      There is nothing stopping some future processor from supporting the
  109|       |      above flags and having AVX512 penalties, but maybe you should not have
  110|       |      bought such a processor.
  111|       |      */
  112|      1|      AVX512_PROFILE =
  113|      1|         AVX512_F | AVX512_DQ | AVX512_IFMA | AVX512_BW | AVX512_VL | AVX512_VBMI | AVX512_VBMI2 | AVX512_VBITALG,
  114|      1|   };
  115|       |
  116|       |   // NOLINTNEXTLINE(performance-enum-size)
  117|      1|   enum class x86_CPUID_7_1_bits : uint64_t {
  118|      1|      SHA512 = (1 << 0),
  119|      1|      SM3 = (1 << 1),
  120|      1|      SM4 = (1 << 2),
  121|      1|   };
  122|       |
  123|      1|   uint32_t feat = 0;
  124|      1|   uint32_t cpuid[4] = {0};
  125|      1|   bool has_sse41 = false;
  126|      1|   bool has_os_ymm_support = false;
  127|      1|   bool has_os_zmm_support = false;
  128|       |
  129|       |   // CPUID 0: vendor identification, max sublevel
  130|      1|   invoke_cpuid(0, cpuid);
  131|       |
  132|      1|   const uint32_t max_supported_sublevel = cpuid[0];
  133|       |
  134|      1|   if(max_supported_sublevel >= 1) {
  ------------------
  |  Branch (134:7): [True: 1, False: 0]
  ------------------
  135|       |      // CPUID 1: feature bits
  136|      1|      invoke_cpuid(1, cpuid);
  137|      1|      const uint64_t flags0 = (static_cast<uint64_t>(cpuid[2]) << 32) | cpuid[3];
  138|       |
  139|      1|      feat |= if_set(flags0, x86_CPUID_1_bits::RDTSC, CPUFeature::Bit::RDTSC, allowed);
  140|       |
  141|      1|      feat |= if_set(flags0, x86_CPUID_1_bits::RDRAND, CPUFeature::Bit::RDRAND, allowed);
  142|       |
  143|      1|      feat |= if_set(flags0, x86_CPUID_1_bits::POPCNT, CPUFeature::Bit::POPCNT, allowed);
  144|       |
  145|      1|      feat |= if_set(flags0, x86_CPUID_1_bits::SSE2, CPUFeature::Bit::SSE2, allowed);
  146|       |
  147|      1|      if(is_set(feat, CPUFeature::Bit::SSE2)) {
  ------------------
  |  Branch (147:10): [True: 1, False: 0]
  ------------------
  148|      1|         feat |= if_set(flags0, x86_CPUID_1_bits::SSSE3, CPUFeature::Bit::SSSE3, allowed);
  149|       |
  150|      1|         if(is_set(feat, CPUFeature::Bit::SSSE3)) {
  ------------------
  |  Branch (150:13): [True: 1, False: 0]
  ------------------
  151|      1|            feat |= if_set(flags0, x86_CPUID_1_bits::CLMUL, CPUFeature::Bit::CLMUL, allowed);
  152|      1|            feat |= if_set(flags0, x86_CPUID_1_bits::AESNI, CPUFeature::Bit::AESNI, allowed);
  153|       |
  154|       |            // SSE4.1 is not tracked as a feature, but is required by the SHA-NI code
  155|      1|            const uint64_t sse41 = static_cast<uint64_t>(x86_CPUID_1_bits::SSE41);
  156|      1|            has_sse41 = (flags0 & sse41) == sse41;
  157|      1|         }
  158|       |
  159|      1|         const uint64_t osxsave64 = static_cast<uint64_t>(x86_CPUID_1_bits::OSXSAVE);
  160|      1|         if((flags0 & osxsave64) == osxsave64) {
  ------------------
  |  Branch (160:13): [True: 1, False: 0]
  ------------------
  161|      1|            const uint64_t xcr_flags = xgetbv();
  162|      1|            if((xcr_flags & 0x6) == 0x6) {
  ------------------
  |  Branch (162:16): [True: 1, False: 0]
  ------------------
  163|      1|               has_os_ymm_support = true;
  164|      1|               has_os_zmm_support = (xcr_flags & 0xE0) == 0xE0;
  165|      1|            }
  166|      1|         }
  167|      1|      }
  168|      1|   }
  169|       |
  170|      1|   if(max_supported_sublevel >= 7) {
  ------------------
  |  Branch (170:7): [True: 1, False: 0]
  ------------------
  171|      1|      clear_mem(cpuid, 4);
  172|      1|      invoke_cpuid_sublevel(7, 0, cpuid);
  173|       |
  174|      1|      const uint64_t flags7 = (static_cast<uint64_t>(cpuid[2]) << 32) | cpuid[1];
  175|       |
  176|      1|      clear_mem(cpuid, 4);
  177|      1|      invoke_cpuid_sublevel(7, 1, cpuid);
  178|      1|      const uint32_t flags7_1 = cpuid[0];
  179|       |
  180|      1|      feat |= if_set(flags7, x86_CPUID_7_bits::RDSEED, CPUFeature::Bit::RDSEED, allowed);
  181|      1|      feat |= if_set(flags7, x86_CPUID_7_bits::ADX, CPUFeature::Bit::ADX, allowed);
  182|       |
  183|       |      /*
  184|       |      We only set the BMI bit if both BMI1 and BMI2 are supported, since
  185|       |      typically we want to use both extensions in the same code.
  186|       |      */
  187|      1|      feat |= if_set(flags7, x86_CPUID_7_bits::BMI_1_AND_2, CPUFeature::Bit::BMI, allowed);
  188|       |
  189|      1|      if(is_set(feat, CPUFeature::Bit::SSSE3)) {
  ------------------
  |  Branch (189:10): [True: 1, False: 0]
  ------------------
  190|       |         // The SHA-NI code uses SSE4.1 instructions in addition to SSSE3
  191|      1|         if(has_sse41) {
  ------------------
  |  Branch (191:13): [True: 1, False: 0]
  ------------------
  192|      1|            feat |= if_set(flags7, x86_CPUID_7_bits::SHA, CPUFeature::Bit::SHA, allowed);
  193|      1|         }
  194|       |
  195|       |         // We only consider AVX2 if SSSE3 is supported
  196|      1|         if(has_os_ymm_support) {
  ------------------
  |  Branch (196:13): [True: 1, False: 0]
  ------------------
  197|      1|            feat |= if_set(flags7, x86_CPUID_7_bits::AVX2, CPUFeature::Bit::AVX2, allowed);
  198|       |
  199|      1|            if(is_set(feat, CPUFeature::Bit::AVX2)) {
  ------------------
  |  Branch (199:16): [True: 1, False: 0]
  ------------------
  200|      1|               feat |= if_set(flags7, x86_CPUID_7_bits::GFNI, CPUFeature::Bit::GFNI, allowed);
  201|      1|               feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VAES, CPUFeature::Bit::AVX2_AES, allowed);
  202|      1|               feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SHA512, CPUFeature::Bit::SHA512, allowed);
  203|       |               // The SM3/SM4 instructions are VEX encoded and the code using them also uses AVX2
  204|      1|               feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SM3, CPUFeature::Bit::SM3, allowed);
  205|      1|               feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SM4, CPUFeature::Bit::SM4, allowed);
  206|       |
  207|       |               // The VPCLMULQDQ code also uses the legacy 128-bit PCLMULQDQ instruction
  208|      1|               if(is_set(feat, CPUFeature::Bit::CLMUL)) {
  ------------------
  |  Branch (208:19): [True: 1, False: 0]
  ------------------
  209|      1|                  feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VCLMUL, CPUFeature::Bit::AVX2_CLMUL, allowed);
  210|      1|               }
  211|       |
  212|       |               // Likewise we only consider AVX-512 if AVX2 is supported
  213|      1|               if(has_os_zmm_support) {
  ------------------
  |  Branch (213:19): [True: 0, False: 1]
  ------------------
  214|      0|                  feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_PROFILE, CPUFeature::Bit::AVX512, allowed);
  215|       |
  216|      0|                  if(is_set(feat, CPUFeature::Bit::AVX512)) {
  ------------------
  |  Branch (216:22): [True: 0, False: 0]
  ------------------
  217|      0|                     feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VAES, CPUFeature::Bit::AVX512_AES, allowed);
  218|      0|                     if(is_set(feat, CPUFeature::Bit::CLMUL)) {
  ------------------
  |  Branch (218:25): [True: 0, False: 0]
  ------------------
  219|      0|                        feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VCLMUL, CPUFeature::Bit::AVX512_CLMUL, allowed);
  220|      0|                     }
  221|      0|                  }
  222|      0|               }
  223|      1|            }
  224|      1|         }
  225|      1|      }
  226|      1|   }
  227|       |
  228|       |/*
  229|       |   * If we don't have access to CPUID, we can still safely assume that
  230|       |   * any x86-64 processor has SSE2 and RDTSC
  231|       |   */
  232|      1|#if defined(BOTAN_TARGET_ARCH_IS_X86_64)
  233|      1|   if(feat == 0) {
  ------------------
  |  Branch (233:7): [True: 0, False: 1]
  ------------------
  234|      0|      feat |= CPUFeature::Bit::SSE2 & allowed;
  235|      0|      feat |= CPUFeature::Bit::RDTSC & allowed;
  236|      0|   }
  237|      1|#endif
  238|       |
  239|      1|   return feat;
  240|      1|}
cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_112invoke_cpuidEjPj:
   24|      2|void invoke_cpuid(uint32_t type, uint32_t out[4]) {
   25|      2|   clear_mem(out, 4);
   26|       |
   27|      2|#if defined(BOTAN_USE_GCC_INLINE_ASM)
   28|       |   // NOLINTNEXTLINE(*-no-assembler)
   29|      2|   asm volatile("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type));
   30|       |
   31|       |#elif defined(BOTAN_BUILD_COMPILER_IS_MSVC)
   32|       |   __cpuid((int*)out, type);
   33|       |
   34|       |#else
   35|       |   BOTAN_UNUSED(type);
   36|       |   #warning "No way of calling x86 cpuid instruction for this compiler"
   37|       |#endif
   38|      2|}
cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_16xgetbvEv:
   56|      1|BOTAN_FUNC_ISA("xsave") uint64_t xgetbv() {
   57|       |   return _xgetbv(0);
   58|      1|}
cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_121invoke_cpuid_sublevelEjjPj:
   40|      2|void invoke_cpuid_sublevel(uint32_t type, uint32_t level, uint32_t out[4]) {
   41|      2|   clear_mem(out, 4);
   42|       |
   43|      2|#if defined(BOTAN_USE_GCC_INLINE_ASM)
   44|       |   // NOLINTNEXTLINE(*-no-assembler)
   45|      2|   asm volatile("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type), "2"(level));
   46|       |
   47|       |#elif defined(BOTAN_BUILD_COMPILER_IS_MSVC)
   48|       |   __cpuidex((int*)out, type, level);
   49|       |
   50|       |#else
   51|       |   BOTAN_UNUSED(type, level);
   52|       |   #warning "No way of calling x86 cpuid instruction for this compiler"
   53|       |#endif
   54|      2|}

_ZN5Botan9ExceptionC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   71|    149|Exception::Exception(std::string_view msg) : m_msg(msg) {}
_ZN5Botan16Invalid_ArgumentC2ENSt3__117basic_string_viewIcNS1_11char_traitsIcEEEE:
   77|    149|Invalid_Argument::Invalid_Argument(std::string_view msg) : Exception(msg) {}

_ZN5Botan19secure_scrub_memoryEPvm:
   24|  3.45M|void secure_scrub_memory(void* ptr, size_t n) {
   25|  3.45M|   return secure_zeroize_buffer(ptr, n);
   26|  3.45M|}
_ZN5Botan21secure_zeroize_bufferEPvm:
   28|  3.45M|void secure_zeroize_buffer(void* ptr, size_t n) {
   29|  3.45M|   if(n == 0) {
  ------------------
  |  Branch (29:7): [True: 0, False: 3.45M]
  ------------------
   30|      0|      return;
   31|      0|   }
   32|       |
   33|       |#if defined(BOTAN_TARGET_OS_HAS_RTLSECUREZEROMEMORY)
   34|       |   ::RtlSecureZeroMemory(ptr, n);
   35|       |
   36|       |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_BZERO)
   37|  3.45M|   ::explicit_bzero(ptr, n);
   38|       |
   39|       |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_MEMSET)
   40|       |   (void)::explicit_memset(ptr, 0, n);
   41|       |
   42|       |#else
   43|       |   /*
   44|       |   * Call memset through a static volatile pointer, which the compiler should
   45|       |   * not elide. This construct should be safe in conforming compilers, but who
   46|       |   * knows. This has been checked to generate the expected code, which saves the
   47|       |   * memset address in the data segment and unconditionally loads and jumps to
   48|       |   * that address, with the following targets:
   49|       |   *
   50|       |   * x86-64: Clang 19, GCC 6, 11, 13, 14
   51|       |   * riscv64: GCC 14
   52|       |   * aarch64: GCC 14
   53|       |   * armv7: GCC 14
   54|       |   *
   55|       |   * Actually all of them generated the expected jump even without marking the
   56|       |   * function pointer as volatile. However this seems worth including as an
   57|       |   * additional precaution.
   58|       |   */
   59|       |   static void* (*const volatile memset_ptr)(void*, int, size_t) = std::memset;
   60|       |   (memset_ptr)(ptr, 0, n);
   61|       |#endif
   62|  3.45M|}

_ZN5Botan2OS17read_env_variableERNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EE:
  471|      1|bool OS::read_env_variable(std::string& value_out, std::string_view name_view) {
  472|      1|   value_out = "";
  473|       |
  474|      1|   if(running_in_privileged_state()) {
  ------------------
  |  Branch (474:7): [True: 0, False: 1]
  ------------------
  475|      0|      return false;
  476|      0|   }
  477|       |
  478|       |#if defined(BOTAN_TARGET_OS_HAS_WIN32) && \
  479|       |   (defined(BOTAN_BUILD_COMPILER_IS_MSVC) || defined(BOTAN_BUILD_COMPILER_IS_CLANGCL))
  480|       |   const std::string name(name_view);
  481|       |
  482|       |   // First query the required buffer size; req_size is 0 if the variable is not set
  483|       |   size_t req_size = 0;
  484|       |   if(getenv_s(&req_size, nullptr, 0, name.c_str()) != 0 || req_size == 0) {
  485|       |      return false;
  486|       |   }
  487|       |
  488|       |   // The reported size includes the terminating \0
  489|       |   std::string val(req_size, '\0');
  490|       |   if(getenv_s(&req_size, val.data(), val.size(), name.c_str()) != 0) {
  491|       |      return false;
  492|       |   }
  493|       |
  494|       |   value_out = std::string(val.c_str());
  495|       |   return true;
  496|       |#else
  497|      1|   const std::string name(name_view);
  498|      1|   if(const char* val = std::getenv(name.c_str())) {
  ------------------
  |  Branch (498:19): [True: 0, False: 1]
  ------------------
  499|      0|      value_out = val;
  500|      0|      return true;
  501|      0|   }
  502|      1|#endif
  503|       |
  504|      1|   return false;
  505|      1|}
os_utils.cpp:_ZN5Botan12_GLOBAL__N_110get_auxvalENSt3__18optionalImEE:
  120|      1|std::optional<unsigned long> get_auxval(std::optional<unsigned long> id) {
  121|      1|   if(id) {
  ------------------
  |  Branch (121:7): [True: 1, False: 0]
  ------------------
  122|      1|#if defined(BOTAN_TARGET_OS_HAS_GETAUXVAL)
  123|      1|      return ::getauxval(*id);
  124|       |#elif defined(BOTAN_TARGET_OS_HAS_ELF_AUX_INFO)
  125|       |      unsigned long auxinfo = 0;
  126|       |      if(::elf_aux_info(static_cast<int>(*id), &auxinfo, sizeof(auxinfo)) == 0) {
  127|       |         return auxinfo;
  128|       |      }
  129|       |#endif
  130|      1|   }
  131|       |
  132|      0|   return {};
  133|      1|}
os_utils.cpp:_ZN5Botan12_GLOBAL__N_127running_in_privileged_stateEv:
  154|      1|bool running_in_privileged_state() {
  155|      1|#if defined(AT_SECURE)
  156|      1|   if(const auto at_secure = get_auxval(AT_SECURE)) {
  ------------------
  |  Branch (156:18): [True: 1, False: 0]
  ------------------
  157|      1|      return at_secure != 0;
  158|      1|   }
  159|      0|#endif
  160|       |
  161|      0|#if defined(BOTAN_TARGET_OS_HAS_POSIX1)
  162|      0|   return (::getuid() != ::geteuid()) || (::getgid() != ::getegid());
  ------------------
  |  Branch (162:11): [True: 0, False: 0]
  |  Branch (162:42): [True: 0, False: 0]
  ------------------
  163|       |#else
  164|       |   return false;
  165|       |#endif
  166|      1|}