Disable auto-vectorization of P224 ReduceLarge() under GCC

crypto/p224.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This is an implementation of the P224 elliptic curve group. It's written to
 // be short and simple rather than fast, although it's still constant-time.
 //
 // See http://www.imperialviolet.org/2010/12/04/ecc.html ([1]) for background.
 
 #include "crypto/p224.h"
@@ skipping 105 matching lines @@
 static const uint32 kBottom28Bits = 0xfffffff;
 
 // LargeFieldElement also represents an element of the field. The limbs are
 // still spaced 28-bits apart and in little-endian order. So the limbs are at
 // 0, 28, 56, ..., 392 bits, each 64-bits wide.
 typedef uint64 LargeFieldElement[15];
 
 // ReduceLarge converts a LargeFieldElement to a FieldElement.
 //
 // in[i] < 2**62
+
+// GCC 4.9 incorrectly vectorizes the first coefficient elimination loop, so
+// disable that optimization via pragma. Don't use the pragma under Clang, since
+// clang doesn't understand it.
+// TODO(wez): Remove this when crbug.com/439566 is fixed.
+#if defined(__GNUC__) && !defined(__clang__)
+#pragma GCC optimize("no-tree-vectorize")
+#endif
+
 void ReduceLarge(FieldElement* out, LargeFieldElement* inptr) {
   LargeFieldElement& in(*inptr);
 
   for (int i = 0; i < 8; i++) {
     in[i] += kZero63ModP[i];
   }
 
   // Eliminate the coefficients at 2**224 and greater while maintaining the
   // same value mod p.
   for (int i = 14; i >= 8; i--) {
@@ skipping 21 matching lines @@
   // out[1,2,5..7] < 2**28
 
   (*out)[0] = static_cast<uint32>(in[0] & kBottom28Bits);
   (*out)[1] += static_cast<uint32>((in[0] >> 28) & kBottom28Bits);
   (*out)[2] += static_cast<uint32>(in[0] >> 56);
   // out[0] < 2**28
   // out[1..4] < 2**29
   // out[5..7] < 2**28
 }
 
+// TODO(wez): Remove this when crbug.com/439566 is fixed.
+#if defined(__GNUC__) && !defined(__clang__)
+#pragma GCC optimize("tree-vectorize")
+#endif
+
 // Mul computes *out = a*b
 //
 // a[i] < 2**29, b[i] < 2**30 (or vice versa)
 // out[i] < 2**29
 void Mul(FieldElement* out, const FieldElement& a, const FieldElement& b) {
   LargeFieldElement tmp;
   memset(&tmp, 0, sizeof(tmp));
 
   for (int i = 0; i < 8; i++) {
     for (int j = 0; j < 8; j++) {
@@ skipping 557 matching lines @@
   Subtract(&out->y, kP, y);
   Reduce(&out->y);
 
   memset(&out->z, 0, sizeof(out->z));
   out->z[0] = 1;
 }
 
 }  // namespace p224
 
 }  // namespace crypto