Coverage Report

Created: 2024-11-21 07:03

/src/mbedtls/library/constant_time_impl.h
Line
Count
Source (jump to first uncovered line)
1
/**
2
 *  Constant-time functions
3
 *
4
 *  Copyright The Mbed TLS Contributors
5
 *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6
 */
7
8
#ifndef MBEDTLS_CONSTANT_TIME_IMPL_H
9
#define MBEDTLS_CONSTANT_TIME_IMPL_H
10
11
#include <stddef.h>
12
13
#include "common.h"
14
15
#if defined(MBEDTLS_BIGNUM_C)
16
#include "mbedtls/bignum.h"
17
#endif
18
19
/*
20
 * To improve readability of constant_time_internal.h, the static inline
21
 * definitions are here, and constant_time_internal.h has only the declarations.
22
 *
23
 * This results in duplicate declarations of the form:
24
 *     static inline void f();         // from constant_time_internal.h
25
 *     static inline void f() { ... }  // from constant_time_impl.h
26
 * when constant_time_internal.h is included.
27
 *
28
 * This appears to behave as if the declaration-without-definition was not present
29
 * (except for warnings if gcc -Wredundant-decls or similar is used).
30
 *
31
 * Disable -Wredundant-decls so that gcc does not warn about this. This is re-enabled
32
 * at the bottom of this file.
33
 */
34
#if defined(MBEDTLS_COMPILER_IS_GCC) && (__GNUC__ > 4)
35
    #pragma GCC diagnostic push
36
    #pragma GCC diagnostic ignored "-Wredundant-decls"
37
#endif
38
39
/* armcc5 --gnu defines __GNUC__ but doesn't support GNU's extended asm */
40
#if defined(MBEDTLS_HAVE_ASM) && defined(__GNUC__) && (!defined(__ARMCC_VERSION) || \
41
    __ARMCC_VERSION >= 6000000)
42
#define MBEDTLS_CT_ASM
43
#if (defined(__arm__) || defined(__thumb__) || defined(__thumb2__))
44
#define MBEDTLS_CT_ARM_ASM
45
#elif defined(__aarch64__)
46
#define MBEDTLS_CT_AARCH64_ASM
47
#elif defined(__amd64__) || defined(__x86_64__)
48
#define MBEDTLS_CT_X86_64_ASM
49
#elif defined(__i386__)
50
#define MBEDTLS_CT_X86_ASM
51
#endif
52
#endif
53
54
#define MBEDTLS_CT_SIZE (sizeof(mbedtls_ct_uint_t) * 8)
55
56
57
/* ============================================================================
58
 * Core const-time primitives
59
 */
60
61
/* Ensure that the compiler cannot know the value of x (i.e., cannot optimise
62
 * based on its value) after this function is called.
63
 *
64
 * If we are not using assembly, this will be fairly inefficient, so its use
65
 * should be minimised.
66
 */
67
68
#if !defined(MBEDTLS_CT_ASM)
69
extern volatile mbedtls_ct_uint_t mbedtls_ct_zero;
70
#endif
71
72
/**
73
 * \brief   Ensure that a value cannot be known at compile time.
74
 *
75
 * \param x        The value to hide from the compiler.
76
 * \return         The same value that was passed in, such that the compiler
77
 *                 cannot prove its value (even for calls of the form
78
 *                 x = mbedtls_ct_compiler_opaque(1), x will be unknown).
79
 *
80
 * \note           This is mainly used in constructing mbedtls_ct_condition_t
81
 *                 values and performing operations over them, to ensure that
82
 *                 there is no way for the compiler to ever know anything about
83
 *                 the value of an mbedtls_ct_condition_t.
84
 */
85
static inline mbedtls_ct_uint_t mbedtls_ct_compiler_opaque(mbedtls_ct_uint_t x)
86
7.83M
{
87
7.83M
#if defined(MBEDTLS_CT_ASM)
88
7.83M
    asm volatile ("" : [x] "+r" (x) :);
89
7.83M
    return x;
90
#else
91
    return x ^ mbedtls_ct_zero;
92
#endif
93
7.83M
}
Unexecuted instantiation: rsa.c:mbedtls_ct_compiler_opaque
Unexecuted instantiation: bignum.c:mbedtls_ct_compiler_opaque
bignum_core.c:mbedtls_ct_compiler_opaque
Line
Count
Source
86
6.23M
{
87
6.23M
#if defined(MBEDTLS_CT_ASM)
88
6.23M
    asm volatile ("" : [x] "+r" (x) :);
89
6.23M
    return x;
90
#else
91
    return x ^ mbedtls_ct_zero;
92
#endif
93
6.23M
}
cipher.c:mbedtls_ct_compiler_opaque
Line
Count
Source
86
18
{
87
18
#if defined(MBEDTLS_CT_ASM)
88
18
    asm volatile ("" : [x] "+r" (x) :);
89
18
    return x;
90
#else
91
    return x ^ mbedtls_ct_zero;
92
#endif
93
18
}
Unexecuted instantiation: cmac.c:mbedtls_ct_compiler_opaque
constant_time.c:mbedtls_ct_compiler_opaque
Line
Count
Source
86
1.59M
{
87
1.59M
#if defined(MBEDTLS_CT_ASM)
88
1.59M
    asm volatile ("" : [x] "+r" (x) :);
89
1.59M
    return x;
90
#else
91
    return x ^ mbedtls_ct_zero;
92
#endif
93
1.59M
}
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_compiler_opaque
Unexecuted instantiation: nist_kw.c:mbedtls_ct_compiler_opaque
94
95
/*
96
 * Selecting unified syntax is needed for gcc, and harmless on clang.
97
 *
98
 * This is needed because on Thumb 1, condition flags are always set, so
99
 * e.g. "negs" is supported but "neg" is not (on Thumb 2, both exist).
100
 *
101
 * Under Thumb 1 unified syntax, only the "negs" form is accepted, and
102
 * under divided syntax, only the "neg" form is accepted. clang only
103
 * supports unified syntax.
104
 *
105
 * On Thumb 2 and Arm, both compilers are happy with the "s" suffix,
106
 * although we don't actually care about setting the flags.
107
 *
108
 * For old versions of gcc (see #8516 for details), restore divided
109
 * syntax afterwards - otherwise old versions of gcc seem to apply
110
 * unified syntax globally, which breaks other asm code.
111
 */
112
#if defined(MBEDTLS_COMPILER_IS_GCC) && defined(__thumb__) && !defined(__thumb2__) && \
113
    (__GNUC__ < 11) && !defined(__ARM_ARCH_2__)
114
#define RESTORE_ASM_SYNTAX  ".syntax divided                      \n\t"
115
#else
116
#define RESTORE_ASM_SYNTAX
117
#endif
118
119
/* Convert a number into a condition in constant time. */
120
static inline mbedtls_ct_condition_t mbedtls_ct_bool(mbedtls_ct_uint_t x)
121
8.19M
{
122
    /*
123
     * Define mask-generation code that, as far as possible, will not use branches or conditional instructions.
124
     *
125
     * For some platforms / type sizes, we define assembly to assure this.
126
     *
127
     * Otherwise, we define a plain C fallback which (in May 2023) does not get optimised into
128
     * conditional instructions or branches by trunk clang, gcc, or MSVC v19.
129
     */
130
#if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
131
    mbedtls_ct_uint_t s;
132
    asm volatile ("neg %x[s], %x[x]                               \n\t"
133
                  "orr %x[x], %x[s], %x[x]                        \n\t"
134
                  "asr %x[x], %x[x], 63                           \n\t"
135
                  :
136
                  [s] "=&r" (s),
137
                  [x] "+&r" (x)
138
                  :
139
                  :
140
                  );
141
    return (mbedtls_ct_condition_t) x;
142
#elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
143
    uint32_t s;
144
    asm volatile (".syntax unified                                \n\t"
145
                  "negs %[s], %[x]                                \n\t"
146
                  "orrs %[x], %[x], %[s]                          \n\t"
147
                  "asrs %[x], %[x], #31                           \n\t"
148
                  RESTORE_ASM_SYNTAX
149
                  :
150
                  [s] "=&l" (s),
151
                  [x] "+&l" (x)
152
                  :
153
                  :
154
                  "cc" /* clobbers flag bits */
155
                  );
156
    return (mbedtls_ct_condition_t) x;
157
#elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
158
8.19M
    uint64_t s;
159
8.19M
    asm volatile ("mov  %[x], %[s]                                \n\t"
160
8.19M
                  "neg  %[s]                                      \n\t"
161
8.19M
                  "or   %[x], %[s]                                \n\t"
162
8.19M
                  "sar  $63, %[s]                                 \n\t"
163
8.19M
                  :
164
8.19M
                  [s] "=&a" (s)
165
8.19M
                  :
166
8.19M
                  [x] "D" (x)
167
8.19M
                  :
168
8.19M
                  );
169
8.19M
    return (mbedtls_ct_condition_t) s;
170
#elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
171
    uint32_t s;
172
    asm volatile ("mov %[x], %[s]                                 \n\t"
173
                  "neg %[s]                                       \n\t"
174
                  "or %[s], %[x]                                  \n\t"
175
                  "sar $31, %[x]                                  \n\t"
176
                  :
177
                  [s] "=&c" (s),
178
                  [x] "+&a" (x)
179
                  :
180
                  :
181
                  );
182
    return (mbedtls_ct_condition_t) x;
183
#else
184
    const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x);
185
#if defined(_MSC_VER)
186
    /* MSVC has a warning about unary minus on unsigned, but this is
187
     * well-defined and precisely what we want to do here */
188
#pragma warning( push )
189
#pragma warning( disable : 4146 )
190
#endif
191
    // y is negative (i.e., top bit set) iff x is non-zero
192
    mbedtls_ct_int_t y = (-xo) | -(xo >> 1);
193
194
    // extract only the sign bit of y so that y == 1 (if x is non-zero) or 0 (if x is zero)
195
    y = (((mbedtls_ct_uint_t) y) >> (MBEDTLS_CT_SIZE - 1));
196
197
    // -y has all bits set (if x is non-zero), or all bits clear (if x is zero)
198
    return (mbedtls_ct_condition_t) (-y);
199
#if defined(_MSC_VER)
200
#pragma warning( pop )
201
#endif
202
#endif
203
8.19M
}
Unexecuted instantiation: rsa.c:mbedtls_ct_bool
bignum.c:mbedtls_ct_bool
Line
Count
Source
121
3.48M
{
122
    /*
123
     * Define mask-generation code that, as far as possible, will not use branches or conditional instructions.
124
     *
125
     * For some platforms / type sizes, we define assembly to assure this.
126
     *
127
     * Otherwise, we define a plain C fallback which (in May 2023) does not get optimised into
128
     * conditional instructions or branches by trunk clang, gcc, or MSVC v19.
129
     */
130
#if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
131
    mbedtls_ct_uint_t s;
132
    asm volatile ("neg %x[s], %x[x]                               \n\t"
133
                  "orr %x[x], %x[s], %x[x]                        \n\t"
134
                  "asr %x[x], %x[x], 63                           \n\t"
135
                  :
136
                  [s] "=&r" (s),
137
                  [x] "+&r" (x)
138
                  :
139
                  :
140
                  );
141
    return (mbedtls_ct_condition_t) x;
142
#elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
143
    uint32_t s;
144
    asm volatile (".syntax unified                                \n\t"
145
                  "negs %[s], %[x]                                \n\t"
146
                  "orrs %[x], %[x], %[s]                          \n\t"
147
                  "asrs %[x], %[x], #31                           \n\t"
148
                  RESTORE_ASM_SYNTAX
149
                  :
150
                  [s] "=&l" (s),
151
                  [x] "+&l" (x)
152
                  :
153
                  :
154
                  "cc" /* clobbers flag bits */
155
                  );
156
    return (mbedtls_ct_condition_t) x;
157
#elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
158
3.48M
    uint64_t s;
159
3.48M
    asm volatile ("mov  %[x], %[s]                                \n\t"
160
3.48M
                  "neg  %[s]                                      \n\t"
161
3.48M
                  "or   %[x], %[s]                                \n\t"
162
3.48M
                  "sar  $63, %[s]                                 \n\t"
163
3.48M
                  :
164
3.48M
                  [s] "=&a" (s)
165
3.48M
                  :
166
3.48M
                  [x] "D" (x)
167
3.48M
                  :
168
3.48M
                  );
169
3.48M
    return (mbedtls_ct_condition_t) s;
170
#elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
171
    uint32_t s;
172
    asm volatile ("mov %[x], %[s]                                 \n\t"
173
                  "neg %[s]                                       \n\t"
174
                  "or %[s], %[x]                                  \n\t"
175
                  "sar $31, %[x]                                  \n\t"
176
                  :
177
                  [s] "=&c" (s),
178
                  [x] "+&a" (x)
179
                  :
180
                  :
181
                  );
182
    return (mbedtls_ct_condition_t) x;
183
#else
184
    const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x);
185
#if defined(_MSC_VER)
186
    /* MSVC has a warning about unary minus on unsigned, but this is
187
     * well-defined and precisely what we want to do here */
188
#pragma warning( push )
189
#pragma warning( disable : 4146 )
190
#endif
191
    // y is negative (i.e., top bit set) iff x is non-zero
192
    mbedtls_ct_int_t y = (-xo) | -(xo >> 1);
193
194
    // extract only the sign bit of y so that y == 1 (if x is non-zero) or 0 (if x is zero)
195
    y = (((mbedtls_ct_uint_t) y) >> (MBEDTLS_CT_SIZE - 1));
196
197
    // -y has all bits set (if x is non-zero), or all bits clear (if x is zero)
198
    return (mbedtls_ct_condition_t) (-y);
199
#if defined(_MSC_VER)
200
#pragma warning( pop )
201
#endif
202
#endif
203
3.48M
}
bignum_core.c:mbedtls_ct_bool
Line
Count
Source
121
4.71M
{
122
    /*
123
     * Define mask-generation code that, as far as possible, will not use branches or conditional instructions.
124
     *
125
     * For some platforms / type sizes, we define assembly to assure this.
126
     *
127
     * Otherwise, we define a plain C fallback which (in May 2023) does not get optimised into
128
     * conditional instructions or branches by trunk clang, gcc, or MSVC v19.
129
     */
130
#if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
131
    mbedtls_ct_uint_t s;
132
    asm volatile ("neg %x[s], %x[x]                               \n\t"
133
                  "orr %x[x], %x[s], %x[x]                        \n\t"
134
                  "asr %x[x], %x[x], 63                           \n\t"
135
                  :
136
                  [s] "=&r" (s),
137
                  [x] "+&r" (x)
138
                  :
139
                  :
140
                  );
141
    return (mbedtls_ct_condition_t) x;
142
#elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
143
    uint32_t s;
144
    asm volatile (".syntax unified                                \n\t"
145
                  "negs %[s], %[x]                                \n\t"
146
                  "orrs %[x], %[x], %[s]                          \n\t"
147
                  "asrs %[x], %[x], #31                           \n\t"
148
                  RESTORE_ASM_SYNTAX
149
                  :
150
                  [s] "=&l" (s),
151
                  [x] "+&l" (x)
152
                  :
153
                  :
154
                  "cc" /* clobbers flag bits */
155
                  );
156
    return (mbedtls_ct_condition_t) x;
157
#elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
158
4.71M
    uint64_t s;
159
4.71M
    asm volatile ("mov  %[x], %[s]                                \n\t"
160
4.71M
                  "neg  %[s]                                      \n\t"
161
4.71M
                  "or   %[x], %[s]                                \n\t"
162
4.71M
                  "sar  $63, %[s]                                 \n\t"
163
4.71M
                  :
164
4.71M
                  [s] "=&a" (s)
165
4.71M
                  :
166
4.71M
                  [x] "D" (x)
167
4.71M
                  :
168
4.71M
                  );
169
4.71M
    return (mbedtls_ct_condition_t) s;
170
#elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
171
    uint32_t s;
172
    asm volatile ("mov %[x], %[s]                                 \n\t"
173
                  "neg %[s]                                       \n\t"
174
                  "or %[s], %[x]                                  \n\t"
175
                  "sar $31, %[x]                                  \n\t"
176
                  :
177
                  [s] "=&c" (s),
178
                  [x] "+&a" (x)
179
                  :
180
                  :
181
                  );
182
    return (mbedtls_ct_condition_t) x;
183
#else
184
    const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x);
185
#if defined(_MSC_VER)
186
    /* MSVC has a warning about unary minus on unsigned, but this is
187
     * well-defined and precisely what we want to do here */
188
#pragma warning( push )
189
#pragma warning( disable : 4146 )
190
#endif
191
    // y is negative (i.e., top bit set) iff x is non-zero
192
    mbedtls_ct_int_t y = (-xo) | -(xo >> 1);
193
194
    // extract only the sign bit of y so that y == 1 (if x is non-zero) or 0 (if x is zero)
195
    y = (((mbedtls_ct_uint_t) y) >> (MBEDTLS_CT_SIZE - 1));
196
197
    // -y has all bits set (if x is non-zero), or all bits clear (if x is zero)
198
    return (mbedtls_ct_condition_t) (-y);
199
#if defined(_MSC_VER)
200
#pragma warning( pop )
201
#endif
202
#endif
203
4.71M
}
cipher.c:mbedtls_ct_bool
Line
Count
Source
121
9
{
122
    /*
123
     * Define mask-generation code that, as far as possible, will not use branches or conditional instructions.
124
     *
125
     * For some platforms / type sizes, we define assembly to assure this.
126
     *
127
     * Otherwise, we define a plain C fallback which (in May 2023) does not get optimised into
128
     * conditional instructions or branches by trunk clang, gcc, or MSVC v19.
129
     */
130
#if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
131
    mbedtls_ct_uint_t s;
132
    asm volatile ("neg %x[s], %x[x]                               \n\t"
133
                  "orr %x[x], %x[s], %x[x]                        \n\t"
134
                  "asr %x[x], %x[x], 63                           \n\t"
135
                  :
136
                  [s] "=&r" (s),
137
                  [x] "+&r" (x)
138
                  :
139
                  :
140
                  );
141
    return (mbedtls_ct_condition_t) x;
142
#elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
143
    uint32_t s;
144
    asm volatile (".syntax unified                                \n\t"
145
                  "negs %[s], %[x]                                \n\t"
146
                  "orrs %[x], %[x], %[s]                          \n\t"
147
                  "asrs %[x], %[x], #31                           \n\t"
148
                  RESTORE_ASM_SYNTAX
149
                  :
150
                  [s] "=&l" (s),
151
                  [x] "+&l" (x)
152
                  :
153
                  :
154
                  "cc" /* clobbers flag bits */
155
                  );
156
    return (mbedtls_ct_condition_t) x;
157
#elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
158
9
    uint64_t s;
159
9
    asm volatile ("mov  %[x], %[s]                                \n\t"
160
9
                  "neg  %[s]                                      \n\t"
161
9
                  "or   %[x], %[s]                                \n\t"
162
9
                  "sar  $63, %[s]                                 \n\t"
163
9
                  :
164
9
                  [s] "=&a" (s)
165
9
                  :
166
9
                  [x] "D" (x)
167
9
                  :
168
9
                  );
169
9
    return (mbedtls_ct_condition_t) s;
170
#elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
171
    uint32_t s;
172
    asm volatile ("mov %[x], %[s]                                 \n\t"
173
                  "neg %[s]                                       \n\t"
174
                  "or %[s], %[x]                                  \n\t"
175
                  "sar $31, %[x]                                  \n\t"
176
                  :
177
                  [s] "=&c" (s),
178
                  [x] "+&a" (x)
179
                  :
180
                  :
181
                  );
182
    return (mbedtls_ct_condition_t) x;
183
#else
184
    const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x);
185
#if defined(_MSC_VER)
186
    /* MSVC has a warning about unary minus on unsigned, but this is
187
     * well-defined and precisely what we want to do here */
188
#pragma warning( push )
189
#pragma warning( disable : 4146 )
190
#endif
191
    // y is negative (i.e., top bit set) iff x is non-zero
192
    mbedtls_ct_int_t y = (-xo) | -(xo >> 1);
193
194
    // extract only the sign bit of y so that y == 1 (if x is non-zero) or 0 (if x is zero)
195
    y = (((mbedtls_ct_uint_t) y) >> (MBEDTLS_CT_SIZE - 1));
196
197
    // -y has all bits set (if x is non-zero), or all bits clear (if x is zero)
198
    return (mbedtls_ct_condition_t) (-y);
199
#if defined(_MSC_VER)
200
#pragma warning( pop )
201
#endif
202
#endif
203
9
}
cmac.c:mbedtls_ct_bool
Line
Count
Source
121
4
{
122
    /*
123
     * Define mask-generation code that, as far as possible, will not use branches or conditional instructions.
124
     *
125
     * For some platforms / type sizes, we define assembly to assure this.
126
     *
127
     * Otherwise, we define a plain C fallback which (in May 2023) does not get optimised into
128
     * conditional instructions or branches by trunk clang, gcc, or MSVC v19.
129
     */
130
#if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
131
    mbedtls_ct_uint_t s;
132
    asm volatile ("neg %x[s], %x[x]                               \n\t"
133
                  "orr %x[x], %x[s], %x[x]                        \n\t"
134
                  "asr %x[x], %x[x], 63                           \n\t"
135
                  :
136
                  [s] "=&r" (s),
137
                  [x] "+&r" (x)
138
                  :
139
                  :
140
                  );
141
    return (mbedtls_ct_condition_t) x;
142
#elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
143
    uint32_t s;
144
    asm volatile (".syntax unified                                \n\t"
145
                  "negs %[s], %[x]                                \n\t"
146
                  "orrs %[x], %[x], %[s]                          \n\t"
147
                  "asrs %[x], %[x], #31                           \n\t"
148
                  RESTORE_ASM_SYNTAX
149
                  :
150
                  [s] "=&l" (s),
151
                  [x] "+&l" (x)
152
                  :
153
                  :
154
                  "cc" /* clobbers flag bits */
155
                  );
156
    return (mbedtls_ct_condition_t) x;
157
#elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
158
4
    uint64_t s;
159
4
    asm volatile ("mov  %[x], %[s]                                \n\t"
160
4
                  "neg  %[s]                                      \n\t"
161
4
                  "or   %[x], %[s]                                \n\t"
162
4
                  "sar  $63, %[s]                                 \n\t"
163
4
                  :
164
4
                  [s] "=&a" (s)
165
4
                  :
166
4
                  [x] "D" (x)
167
4
                  :
168
4
                  );
169
4
    return (mbedtls_ct_condition_t) s;
170
#elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
171
    uint32_t s;
172
    asm volatile ("mov %[x], %[s]                                 \n\t"
173
                  "neg %[s]                                       \n\t"
174
                  "or %[s], %[x]                                  \n\t"
175
                  "sar $31, %[x]                                  \n\t"
176
                  :
177
                  [s] "=&c" (s),
178
                  [x] "+&a" (x)
179
                  :
180
                  :
181
                  );
182
    return (mbedtls_ct_condition_t) x;
183
#else
184
    const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x);
185
#if defined(_MSC_VER)
186
    /* MSVC has a warning about unary minus on unsigned, but this is
187
     * well-defined and precisely what we want to do here */
188
#pragma warning( push )
189
#pragma warning( disable : 4146 )
190
#endif
191
    // y is negative (i.e., top bit set) iff x is non-zero
192
    mbedtls_ct_int_t y = (-xo) | -(xo >> 1);
193
194
    // extract only the sign bit of y so that y == 1 (if x is non-zero) or 0 (if x is zero)
195
    y = (((mbedtls_ct_uint_t) y) >> (MBEDTLS_CT_SIZE - 1));
196
197
    // -y has all bits set (if x is non-zero), or all bits clear (if x is zero)
198
    return (mbedtls_ct_condition_t) (-y);
199
#if defined(_MSC_VER)
200
#pragma warning( pop )
201
#endif
202
#endif
203
4
}
Unexecuted instantiation: constant_time.c:mbedtls_ct_bool
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool
Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool
204
205
static inline mbedtls_ct_uint_t mbedtls_ct_if(mbedtls_ct_condition_t condition,
206
                                              mbedtls_ct_uint_t if1,
207
                                              mbedtls_ct_uint_t if0)
208
153M
{
209
#if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
210
    asm volatile ("and %x[if1], %x[if1], %x[condition]            \n\t"
211
                  "mvn %x[condition], %x[condition]               \n\t"
212
                  "and %x[condition], %x[condition], %x[if0]      \n\t"
213
                  "orr %x[condition], %x[if1], %x[condition]"
214
                  :
215
                  [condition] "+&r" (condition),
216
                  [if1] "+&r" (if1)
217
                  :
218
                  [if0] "r" (if0)
219
                  :
220
                  );
221
    return (mbedtls_ct_uint_t) condition;
222
#elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
223
    asm volatile (".syntax unified                                \n\t"
224
                  "ands %[if1], %[if1], %[condition]              \n\t"
225
                  "mvns %[condition], %[condition]                \n\t"
226
                  "ands %[condition], %[condition], %[if0]        \n\t"
227
                  "orrs %[condition], %[if1], %[condition]        \n\t"
228
                  RESTORE_ASM_SYNTAX
229
                  :
230
                  [condition] "+&l" (condition),
231
                  [if1] "+&l" (if1)
232
                  :
233
                  [if0] "l" (if0)
234
                  :
235
                  "cc"
236
                  );
237
    return (mbedtls_ct_uint_t) condition;
238
#elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
239
153M
    asm volatile ("and  %[condition], %[if1]                      \n\t"
240
153M
                  "not  %[condition]                              \n\t"
241
153M
                  "and  %[condition], %[if0]                      \n\t"
242
153M
                  "or   %[if1], %[if0]                            \n\t"
243
153M
                  :
244
153M
                  [condition] "+&D" (condition),
245
153M
                  [if1] "+&S" (if1),
246
153M
                  [if0] "+&a" (if0)
247
153M
                  :
248
153M
                  :
249
153M
                  );
250
153M
    return if0;
251
#elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
252
    asm volatile ("and %[condition], %[if1]                       \n\t"
253
                  "not %[condition]                               \n\t"
254
                  "and %[if0], %[condition]                       \n\t"
255
                  "or %[condition], %[if1]                        \n\t"
256
                  :
257
                  [condition] "+&c" (condition),
258
                  [if1] "+&a" (if1)
259
                  :
260
                  [if0] "b" (if0)
261
                  :
262
                  );
263
    return if1;
264
#else
265
    mbedtls_ct_condition_t not_cond =
266
        (mbedtls_ct_condition_t) (~mbedtls_ct_compiler_opaque(condition));
267
    return (mbedtls_ct_uint_t) ((condition & if1) | (not_cond & if0));
268
#endif
269
153M
}
Unexecuted instantiation: rsa.c:mbedtls_ct_if
bignum.c:mbedtls_ct_if
Line
Count
Source
208
3.48M
{
209
#if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
210
    asm volatile ("and %x[if1], %x[if1], %x[condition]            \n\t"
211
                  "mvn %x[condition], %x[condition]               \n\t"
212
                  "and %x[condition], %x[condition], %x[if0]      \n\t"
213
                  "orr %x[condition], %x[if1], %x[condition]"
214
                  :
215
                  [condition] "+&r" (condition),
216
                  [if1] "+&r" (if1)
217
                  :
218
                  [if0] "r" (if0)
219
                  :
220
                  );
221
    return (mbedtls_ct_uint_t) condition;
222
#elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
223
    asm volatile (".syntax unified                                \n\t"
224
                  "ands %[if1], %[if1], %[condition]              \n\t"
225
                  "mvns %[condition], %[condition]                \n\t"
226
                  "ands %[condition], %[condition], %[if0]        \n\t"
227
                  "orrs %[condition], %[if1], %[condition]        \n\t"
228
                  RESTORE_ASM_SYNTAX
229
                  :
230
                  [condition] "+&l" (condition),
231
                  [if1] "+&l" (if1)
232
                  :
233
                  [if0] "l" (if0)
234
                  :
235
                  "cc"
236
                  );
237
    return (mbedtls_ct_uint_t) condition;
238
#elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
239
3.48M
    asm volatile ("and  %[condition], %[if1]                      \n\t"
240
3.48M
                  "not  %[condition]                              \n\t"
241
3.48M
                  "and  %[condition], %[if0]                      \n\t"
242
3.48M
                  "or   %[if1], %[if0]                            \n\t"
243
3.48M
                  :
244
3.48M
                  [condition] "+&D" (condition),
245
3.48M
                  [if1] "+&S" (if1),
246
3.48M
                  [if0] "+&a" (if0)
247
3.48M
                  :
248
3.48M
                  :
249
3.48M
                  );
250
3.48M
    return if0;
251
#elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
252
    asm volatile ("and %[condition], %[if1]                       \n\t"
253
                  "not %[condition]                               \n\t"
254
                  "and %[if0], %[condition]                       \n\t"
255
                  "or %[condition], %[if1]                        \n\t"
256
                  :
257
                  [condition] "+&c" (condition),
258
                  [if1] "+&a" (if1)
259
                  :
260
                  [if0] "b" (if0)
261
                  :
262
                  );
263
    return if1;
264
#else
265
    mbedtls_ct_condition_t not_cond =
266
        (mbedtls_ct_condition_t) (~mbedtls_ct_compiler_opaque(condition));
267
    return (mbedtls_ct_uint_t) ((condition & if1) | (not_cond & if0));
268
#endif
269
3.48M
}
bignum_core.c:mbedtls_ct_if
Line
Count
Source
208
150M
{
209
#if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
210
    asm volatile ("and %x[if1], %x[if1], %x[condition]            \n\t"
211
                  "mvn %x[condition], %x[condition]               \n\t"
212
                  "and %x[condition], %x[condition], %x[if0]      \n\t"
213
                  "orr %x[condition], %x[if1], %x[condition]"
214
                  :
215
                  [condition] "+&r" (condition),
216
                  [if1] "+&r" (if1)
217
                  :
218
                  [if0] "r" (if0)
219
                  :
220
                  );
221
    return (mbedtls_ct_uint_t) condition;
222
#elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
223
    asm volatile (".syntax unified                                \n\t"
224
                  "ands %[if1], %[if1], %[condition]              \n\t"
225
                  "mvns %[condition], %[condition]                \n\t"
226
                  "ands %[condition], %[condition], %[if0]        \n\t"
227
                  "orrs %[condition], %[if1], %[condition]        \n\t"
228
                  RESTORE_ASM_SYNTAX
229
                  :
230
                  [condition] "+&l" (condition),
231
                  [if1] "+&l" (if1)
232
                  :
233
                  [if0] "l" (if0)
234
                  :
235
                  "cc"
236
                  );
237
    return (mbedtls_ct_uint_t) condition;
238
#elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
239
150M
    asm volatile ("and  %[condition], %[if1]                      \n\t"
240
150M
                  "not  %[condition]                              \n\t"
241
150M
                  "and  %[condition], %[if0]                      \n\t"
242
150M
                  "or   %[if1], %[if0]                            \n\t"
243
150M
                  :
244
150M
                  [condition] "+&D" (condition),
245
150M
                  [if1] "+&S" (if1),
246
150M
                  [if0] "+&a" (if0)
247
150M
                  :
248
150M
                  :
249
150M
                  );
250
150M
    return if0;
251
#elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
252
    asm volatile ("and %[condition], %[if1]                       \n\t"
253
                  "not %[condition]                               \n\t"
254
                  "and %[if0], %[condition]                       \n\t"
255
                  "or %[condition], %[if1]                        \n\t"
256
                  :
257
                  [condition] "+&c" (condition),
258
                  [if1] "+&a" (if1)
259
                  :
260
                  [if0] "b" (if0)
261
                  :
262
                  );
263
    return if1;
264
#else
265
    mbedtls_ct_condition_t not_cond =
266
        (mbedtls_ct_condition_t) (~mbedtls_ct_compiler_opaque(condition));
267
    return (mbedtls_ct_uint_t) ((condition & if1) | (not_cond & if0));
268
#endif
269
150M
}
Unexecuted instantiation: cipher.c:mbedtls_ct_if
Unexecuted instantiation: cmac.c:mbedtls_ct_if
Unexecuted instantiation: constant_time.c:mbedtls_ct_if
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_if
Unexecuted instantiation: nist_kw.c:mbedtls_ct_if
270
271
static inline mbedtls_ct_condition_t mbedtls_ct_uint_lt(mbedtls_ct_uint_t x, mbedtls_ct_uint_t y)
272
22.3k
{
273
#if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
274
    uint64_t s1;
275
    asm volatile ("eor     %x[s1], %x[y], %x[x]                   \n\t"
276
                  "sub     %x[x], %x[x], %x[y]                    \n\t"
277
                  "bic     %x[x], %x[x], %x[s1]                   \n\t"
278
                  "and     %x[s1], %x[s1], %x[y]                  \n\t"
279
                  "orr     %x[s1], %x[x], %x[s1]                  \n\t"
280
                  "asr     %x[x], %x[s1], 63"
281
                  :
282
                  [s1] "=&r" (s1),
283
                  [x] "+&r" (x)
284
                  :
285
                  [y] "r" (y)
286
                  :
287
                  );
288
    return (mbedtls_ct_condition_t) x;
289
#elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
290
    uint32_t s1;
291
    asm volatile (
292
        ".syntax unified                                          \n\t"
293
#if defined(__thumb__) && !defined(__thumb2__)
294
        "movs     %[s1], %[x]                                     \n\t"
295
        "eors     %[s1], %[s1], %[y]                              \n\t"
296
#else
297
        "eors     %[s1], %[x], %[y]                               \n\t"
298
#endif
299
        "subs    %[x], %[x], %[y]                                 \n\t"
300
        "bics    %[x], %[x], %[s1]                                \n\t"
301
        "ands    %[y], %[s1], %[y]                                \n\t"
302
        "orrs    %[x], %[x], %[y]                                 \n\t"
303
        "asrs    %[x], %[x], #31                                  \n\t"
304
        RESTORE_ASM_SYNTAX
305
        :
306
        [s1] "=&l" (s1),
307
        [x] "+&l" (x),
308
        [y] "+&l" (y)
309
        :
310
        :
311
        "cc"
312
        );
313
    return (mbedtls_ct_condition_t) x;
314
#elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
315
22.3k
    uint64_t s;
316
22.3k
    asm volatile ("mov %[x], %[s]                                 \n\t"
317
22.3k
                  "xor %[y], %[s]                                 \n\t"
318
22.3k
                  "sub %[y], %[x]                                 \n\t"
319
22.3k
                  "and %[s], %[y]                                 \n\t"
320
22.3k
                  "not %[s]                                       \n\t"
321
22.3k
                  "and %[s], %[x]                                 \n\t"
322
22.3k
                  "or %[y], %[x]                                  \n\t"
323
22.3k
                  "sar $63, %[x]                                  \n\t"
324
22.3k
                  :
325
22.3k
                  [s] "=&a" (s),
326
22.3k
                  [x] "+&D" (x),
327
22.3k
                  [y] "+&S" (y)
328
22.3k
                  :
329
22.3k
                  :
330
22.3k
                  );
331
22.3k
    return (mbedtls_ct_condition_t) x;
332
#elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
333
    uint32_t s;
334
    asm volatile ("mov %[x], %[s]                                 \n\t"
335
                  "xor %[y], %[s]                                 \n\t"
336
                  "sub %[y], %[x]                                 \n\t"
337
                  "and %[s], %[y]                                 \n\t"
338
                  "not %[s]                                       \n\t"
339
                  "and %[s], %[x]                                 \n\t"
340
                  "or  %[y], %[x]                                 \n\t"
341
                  "sar $31, %[x]                                  \n\t"
342
                  :
343
                  [s] "=&b" (s),
344
                  [x] "+&a" (x),
345
                  [y] "+&c" (y)
346
                  :
347
                  :
348
                  );
349
    return (mbedtls_ct_condition_t) x;
350
#else
351
    /* Ensure that the compiler cannot optimise the following operations over x and y,
352
     * even if it knows the value of x and y.
353
     */
354
    const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x);
355
    const mbedtls_ct_uint_t yo = mbedtls_ct_compiler_opaque(y);
356
    /*
357
     * Check if the most significant bits (MSB) of the operands are different.
358
     * cond is true iff the MSBs differ.
359
     */
360
    mbedtls_ct_condition_t cond = mbedtls_ct_bool((xo ^ yo) >> (MBEDTLS_CT_SIZE - 1));
361
362
    /*
363
     * If the MSB are the same then the difference x-y will be negative (and
364
     * have its MSB set to 1 during conversion to unsigned) if and only if x<y.
365
     *
366
     * If the MSB are different, then the operand with the MSB of 1 is the
367
     * bigger. (That is if y has MSB of 1, then x<y is true and it is false if
368
     * the MSB of y is 0.)
369
     */
370
371
    // Select either y, or x - y
372
    mbedtls_ct_uint_t ret = mbedtls_ct_if(cond, yo, (mbedtls_ct_uint_t) (xo - yo));
373
374
    // Extract only the MSB of ret
375
    ret = ret >> (MBEDTLS_CT_SIZE - 1);
376
377
    // Convert to a condition (i.e., all bits set iff non-zero)
378
    return mbedtls_ct_bool(ret);
379
#endif
380
22.3k
}
Unexecuted instantiation: rsa.c:mbedtls_ct_uint_lt
Unexecuted instantiation: bignum.c:mbedtls_ct_uint_lt
bignum_core.c:mbedtls_ct_uint_lt
Line
Count
Source
272
22.3k
{
273
#if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
274
    uint64_t s1;
275
    asm volatile ("eor     %x[s1], %x[y], %x[x]                   \n\t"
276
                  "sub     %x[x], %x[x], %x[y]                    \n\t"
277
                  "bic     %x[x], %x[x], %x[s1]                   \n\t"
278
                  "and     %x[s1], %x[s1], %x[y]                  \n\t"
279
                  "orr     %x[s1], %x[x], %x[s1]                  \n\t"
280
                  "asr     %x[x], %x[s1], 63"
281
                  :
282
                  [s1] "=&r" (s1),
283
                  [x] "+&r" (x)
284
                  :
285
                  [y] "r" (y)
286
                  :
287
                  );
288
    return (mbedtls_ct_condition_t) x;
289
#elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
290
    uint32_t s1;
291
    asm volatile (
292
        ".syntax unified                                          \n\t"
293
#if defined(__thumb__) && !defined(__thumb2__)
294
        "movs     %[s1], %[x]                                     \n\t"
295
        "eors     %[s1], %[s1], %[y]                              \n\t"
296
#else
297
        "eors     %[s1], %[x], %[y]                               \n\t"
298
#endif
299
        "subs    %[x], %[x], %[y]                                 \n\t"
300
        "bics    %[x], %[x], %[s1]                                \n\t"
301
        "ands    %[y], %[s1], %[y]                                \n\t"
302
        "orrs    %[x], %[x], %[y]                                 \n\t"
303
        "asrs    %[x], %[x], #31                                  \n\t"
304
        RESTORE_ASM_SYNTAX
305
        :
306
        [s1] "=&l" (s1),
307
        [x] "+&l" (x),
308
        [y] "+&l" (y)
309
        :
310
        :
311
        "cc"
312
        );
313
    return (mbedtls_ct_condition_t) x;
314
#elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
315
22.3k
    uint64_t s;
316
22.3k
    asm volatile ("mov %[x], %[s]                                 \n\t"
317
22.3k
                  "xor %[y], %[s]                                 \n\t"
318
22.3k
                  "sub %[y], %[x]                                 \n\t"
319
22.3k
                  "and %[s], %[y]                                 \n\t"
320
22.3k
                  "not %[s]                                       \n\t"
321
22.3k
                  "and %[s], %[x]                                 \n\t"
322
22.3k
                  "or %[y], %[x]                                  \n\t"
323
22.3k
                  "sar $63, %[x]                                  \n\t"
324
22.3k
                  :
325
22.3k
                  [s] "=&a" (s),
326
22.3k
                  [x] "+&D" (x),
327
22.3k
                  [y] "+&S" (y)
328
22.3k
                  :
329
22.3k
                  :
330
22.3k
                  );
331
22.3k
    return (mbedtls_ct_condition_t) x;
332
#elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
333
    uint32_t s;
334
    asm volatile ("mov %[x], %[s]                                 \n\t"
335
                  "xor %[y], %[s]                                 \n\t"
336
                  "sub %[y], %[x]                                 \n\t"
337
                  "and %[s], %[y]                                 \n\t"
338
                  "not %[s]                                       \n\t"
339
                  "and %[s], %[x]                                 \n\t"
340
                  "or  %[y], %[x]                                 \n\t"
341
                  "sar $31, %[x]                                  \n\t"
342
                  :
343
                  [s] "=&b" (s),
344
                  [x] "+&a" (x),
345
                  [y] "+&c" (y)
346
                  :
347
                  :
348
                  );
349
    return (mbedtls_ct_condition_t) x;
350
#else
351
    /* Ensure that the compiler cannot optimise the following operations over x and y,
352
     * even if it knows the value of x and y.
353
     */
354
    const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x);
355
    const mbedtls_ct_uint_t yo = mbedtls_ct_compiler_opaque(y);
356
    /*
357
     * Check if the most significant bits (MSB) of the operands are different.
358
     * cond is true iff the MSBs differ.
359
     */
360
    mbedtls_ct_condition_t cond = mbedtls_ct_bool((xo ^ yo) >> (MBEDTLS_CT_SIZE - 1));
361
362
    /*
363
     * If the MSB are the same then the difference x-y will be negative (and
364
     * have its MSB set to 1 during conversion to unsigned) if and only if x<y.
365
     *
366
     * If the MSB are different, then the operand with the MSB of 1 is the
367
     * bigger. (That is if y has MSB of 1, then x<y is true and it is false if
368
     * the MSB of y is 0.)
369
     */
370
371
    // Select either y, or x - y
372
    mbedtls_ct_uint_t ret = mbedtls_ct_if(cond, yo, (mbedtls_ct_uint_t) (xo - yo));
373
374
    // Extract only the MSB of ret
375
    ret = ret >> (MBEDTLS_CT_SIZE - 1);
376
377
    // Convert to a condition (i.e., all bits set iff non-zero)
378
    return mbedtls_ct_bool(ret);
379
#endif
380
22.3k
}
cipher.c:mbedtls_ct_uint_lt
Line
Count
Source
272
9
{
273
#if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
274
    uint64_t s1;
275
    asm volatile ("eor     %x[s1], %x[y], %x[x]                   \n\t"
276
                  "sub     %x[x], %x[x], %x[y]                    \n\t"
277
                  "bic     %x[x], %x[x], %x[s1]                   \n\t"
278
                  "and     %x[s1], %x[s1], %x[y]                  \n\t"
279
                  "orr     %x[s1], %x[x], %x[s1]                  \n\t"
280
                  "asr     %x[x], %x[s1], 63"
281
                  :
282
                  [s1] "=&r" (s1),
283
                  [x] "+&r" (x)
284
                  :
285
                  [y] "r" (y)
286
                  :
287
                  );
288
    return (mbedtls_ct_condition_t) x;
289
#elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
290
    uint32_t s1;
291
    asm volatile (
292
        ".syntax unified                                          \n\t"
293
#if defined(__thumb__) && !defined(__thumb2__)
294
        "movs     %[s1], %[x]                                     \n\t"
295
        "eors     %[s1], %[s1], %[y]                              \n\t"
296
#else
297
        "eors     %[s1], %[x], %[y]                               \n\t"
298
#endif
299
        "subs    %[x], %[x], %[y]                                 \n\t"
300
        "bics    %[x], %[x], %[s1]                                \n\t"
301
        "ands    %[y], %[s1], %[y]                                \n\t"
302
        "orrs    %[x], %[x], %[y]                                 \n\t"
303
        "asrs    %[x], %[x], #31                                  \n\t"
304
        RESTORE_ASM_SYNTAX
305
        :
306
        [s1] "=&l" (s1),
307
        [x] "+&l" (x),
308
        [y] "+&l" (y)
309
        :
310
        :
311
        "cc"
312
        );
313
    return (mbedtls_ct_condition_t) x;
314
#elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
315
9
    uint64_t s;
316
9
    asm volatile ("mov %[x], %[s]                                 \n\t"
317
9
                  "xor %[y], %[s]                                 \n\t"
318
9
                  "sub %[y], %[x]                                 \n\t"
319
9
                  "and %[s], %[y]                                 \n\t"
320
9
                  "not %[s]                                       \n\t"
321
9
                  "and %[s], %[x]                                 \n\t"
322
9
                  "or %[y], %[x]                                  \n\t"
323
9
                  "sar $63, %[x]                                  \n\t"
324
9
                  :
325
9
                  [s] "=&a" (s),
326
9
                  [x] "+&D" (x),
327
9
                  [y] "+&S" (y)
328
9
                  :
329
9
                  :
330
9
                  );
331
9
    return (mbedtls_ct_condition_t) x;
332
#elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
333
    uint32_t s;
334
    asm volatile ("mov %[x], %[s]                                 \n\t"
335
                  "xor %[y], %[s]                                 \n\t"
336
                  "sub %[y], %[x]                                 \n\t"
337
                  "and %[s], %[y]                                 \n\t"
338
                  "not %[s]                                       \n\t"
339
                  "and %[s], %[x]                                 \n\t"
340
                  "or  %[y], %[x]                                 \n\t"
341
                  "sar $31, %[x]                                  \n\t"
342
                  :
343
                  [s] "=&b" (s),
344
                  [x] "+&a" (x),
345
                  [y] "+&c" (y)
346
                  :
347
                  :
348
                  );
349
    return (mbedtls_ct_condition_t) x;
350
#else
351
    /* Ensure that the compiler cannot optimise the following operations over x and y,
352
     * even if it knows the value of x and y.
353
     */
354
    const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x);
355
    const mbedtls_ct_uint_t yo = mbedtls_ct_compiler_opaque(y);
356
    /*
357
     * Check if the most significant bits (MSB) of the operands are different.
358
     * cond is true iff the MSBs differ.
359
     */
360
    mbedtls_ct_condition_t cond = mbedtls_ct_bool((xo ^ yo) >> (MBEDTLS_CT_SIZE - 1));
361
362
    /*
363
     * If the MSB are the same then the difference x-y will be negative (and
364
     * have its MSB set to 1 during conversion to unsigned) if and only if x<y.
365
     *
366
     * If the MSB are different, then the operand with the MSB of 1 is the
367
     * bigger. (That is if y has MSB of 1, then x<y is true and it is false if
368
     * the MSB of y is 0.)
369
     */
370
371
    // Select either y, or x - y
372
    mbedtls_ct_uint_t ret = mbedtls_ct_if(cond, yo, (mbedtls_ct_uint_t) (xo - yo));
373
374
    // Extract only the MSB of ret
375
    ret = ret >> (MBEDTLS_CT_SIZE - 1);
376
377
    // Convert to a condition (i.e., all bits set iff non-zero)
378
    return mbedtls_ct_bool(ret);
379
#endif
380
9
}
Unexecuted instantiation: cmac.c:mbedtls_ct_uint_lt
Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_lt
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_lt
Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_lt
381
382
static inline mbedtls_ct_condition_t mbedtls_ct_uint_ne(mbedtls_ct_uint_t x, mbedtls_ct_uint_t y)
383
3.10M
{
384
    /* diff = 0 if x == y, non-zero otherwise */
385
3.10M
    const mbedtls_ct_uint_t diff = mbedtls_ct_compiler_opaque(x) ^ mbedtls_ct_compiler_opaque(y);
386
387
    /* all ones if x != y, 0 otherwise */
388
3.10M
    return mbedtls_ct_bool(diff);
389
3.10M
}
Unexecuted instantiation: rsa.c:mbedtls_ct_uint_ne
Unexecuted instantiation: bignum.c:mbedtls_ct_uint_ne
bignum_core.c:mbedtls_ct_uint_ne
Line
Count
Source
383
3.10M
{
384
    /* diff = 0 if x == y, non-zero otherwise */
385
3.10M
    const mbedtls_ct_uint_t diff = mbedtls_ct_compiler_opaque(x) ^ mbedtls_ct_compiler_opaque(y);
386
387
    /* all ones if x != y, 0 otherwise */
388
3.10M
    return mbedtls_ct_bool(diff);
389
3.10M
}
cipher.c:mbedtls_ct_uint_ne
Line
Count
Source
383
9
{
384
    /* diff = 0 if x == y, non-zero otherwise */
385
9
    const mbedtls_ct_uint_t diff = mbedtls_ct_compiler_opaque(x) ^ mbedtls_ct_compiler_opaque(y);
386
387
    /* all ones if x != y, 0 otherwise */
388
9
    return mbedtls_ct_bool(diff);
389
9
}
Unexecuted instantiation: cmac.c:mbedtls_ct_uint_ne
Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_ne
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_ne
Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_ne
390
391
static inline unsigned char mbedtls_ct_uchar_in_range_if(unsigned char low,
392
                                                         unsigned char high,
393
                                                         unsigned char c,
394
                                                         unsigned char t)
395
0
{
396
0
    const unsigned char co = (unsigned char) mbedtls_ct_compiler_opaque(c);
397
0
    const unsigned char to = (unsigned char) mbedtls_ct_compiler_opaque(t);
398
0
399
0
    /* low_mask is: 0 if low <= c, 0x...ff if low > c */
400
0
    unsigned low_mask = ((unsigned) co - low) >> 8;
401
0
    /* high_mask is: 0 if c <= high, 0x...ff if c > high */
402
0
    unsigned high_mask = ((unsigned) high - co) >> 8;
403
0
404
0
    return (unsigned char) (~(low_mask | high_mask)) & to;
405
0
}
Unexecuted instantiation: rsa.c:mbedtls_ct_uchar_in_range_if
Unexecuted instantiation: bignum.c:mbedtls_ct_uchar_in_range_if
Unexecuted instantiation: bignum_core.c:mbedtls_ct_uchar_in_range_if
Unexecuted instantiation: cipher.c:mbedtls_ct_uchar_in_range_if
Unexecuted instantiation: cmac.c:mbedtls_ct_uchar_in_range_if
Unexecuted instantiation: constant_time.c:mbedtls_ct_uchar_in_range_if
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uchar_in_range_if
Unexecuted instantiation: nist_kw.c:mbedtls_ct_uchar_in_range_if
406
407
/* ============================================================================
408
 * Everything below here is trivial wrapper functions
409
 */
410
411
static inline size_t mbedtls_ct_size_if(mbedtls_ct_condition_t condition,
412
                                        size_t if1,
413
                                        size_t if0)
414
0
{
415
0
    return (size_t) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1, (mbedtls_ct_uint_t) if0);
416
0
}
Unexecuted instantiation: rsa.c:mbedtls_ct_size_if
Unexecuted instantiation: bignum.c:mbedtls_ct_size_if
Unexecuted instantiation: bignum_core.c:mbedtls_ct_size_if
Unexecuted instantiation: cipher.c:mbedtls_ct_size_if
Unexecuted instantiation: cmac.c:mbedtls_ct_size_if
Unexecuted instantiation: constant_time.c:mbedtls_ct_size_if
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_size_if
Unexecuted instantiation: nist_kw.c:mbedtls_ct_size_if
417
418
static inline unsigned mbedtls_ct_uint_if(mbedtls_ct_condition_t condition,
419
                                          unsigned if1,
420
                                          unsigned if0)
421
3.48M
{
422
3.48M
    return (unsigned) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1, (mbedtls_ct_uint_t) if0);
423
3.48M
}
Unexecuted instantiation: rsa.c:mbedtls_ct_uint_if
bignum.c:mbedtls_ct_uint_if
Line
Count
Source
421
3.48M
{
422
3.48M
    return (unsigned) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1, (mbedtls_ct_uint_t) if0);
423
3.48M
}
Unexecuted instantiation: bignum_core.c:mbedtls_ct_uint_if
Unexecuted instantiation: cipher.c:mbedtls_ct_uint_if
Unexecuted instantiation: cmac.c:mbedtls_ct_uint_if
Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_if
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_if
Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_if
424
425
static inline mbedtls_ct_condition_t mbedtls_ct_bool_if(mbedtls_ct_condition_t condition,
426
                                                        mbedtls_ct_condition_t if1,
427
                                                        mbedtls_ct_condition_t if0)
428
0
{
429
0
    return (mbedtls_ct_condition_t) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1,
430
0
                                                  (mbedtls_ct_uint_t) if0);
431
0
}
Unexecuted instantiation: rsa.c:mbedtls_ct_bool_if
Unexecuted instantiation: bignum.c:mbedtls_ct_bool_if
Unexecuted instantiation: bignum_core.c:mbedtls_ct_bool_if
Unexecuted instantiation: cipher.c:mbedtls_ct_bool_if
Unexecuted instantiation: cmac.c:mbedtls_ct_bool_if
Unexecuted instantiation: constant_time.c:mbedtls_ct_bool_if
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool_if
Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool_if
432
433
#if defined(MBEDTLS_BIGNUM_C)
434
435
static inline mbedtls_mpi_uint mbedtls_ct_mpi_uint_if(mbedtls_ct_condition_t condition,
436
                                                      mbedtls_mpi_uint if1,
437
                                                      mbedtls_mpi_uint if0)
438
150M
{
439
150M
    return (mbedtls_mpi_uint) mbedtls_ct_if(condition,
440
150M
                                            (mbedtls_ct_uint_t) if1,
441
150M
                                            (mbedtls_ct_uint_t) if0);
442
150M
}
Unexecuted instantiation: rsa.c:mbedtls_ct_mpi_uint_if
Unexecuted instantiation: bignum.c:mbedtls_ct_mpi_uint_if
bignum_core.c:mbedtls_ct_mpi_uint_if
Line
Count
Source
438
150M
{
439
150M
    return (mbedtls_mpi_uint) mbedtls_ct_if(condition,
440
150M
                                            (mbedtls_ct_uint_t) if1,
441
150M
                                            (mbedtls_ct_uint_t) if0);
442
150M
}
Unexecuted instantiation: cipher.c:mbedtls_ct_mpi_uint_if
Unexecuted instantiation: cmac.c:mbedtls_ct_mpi_uint_if
Unexecuted instantiation: constant_time.c:mbedtls_ct_mpi_uint_if
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_mpi_uint_if
Unexecuted instantiation: nist_kw.c:mbedtls_ct_mpi_uint_if
443
444
#endif
445
446
static inline size_t mbedtls_ct_size_if_else_0(mbedtls_ct_condition_t condition, size_t if1)
447
16
{
448
16
    return (size_t) (condition & if1);
449
16
}
Unexecuted instantiation: rsa.c:mbedtls_ct_size_if_else_0
bignum.c:mbedtls_ct_size_if_else_0
Line
Count
Source
447
16
{
448
16
    return (size_t) (condition & if1);
449
16
}
Unexecuted instantiation: bignum_core.c:mbedtls_ct_size_if_else_0
Unexecuted instantiation: cipher.c:mbedtls_ct_size_if_else_0
Unexecuted instantiation: cmac.c:mbedtls_ct_size_if_else_0
Unexecuted instantiation: constant_time.c:mbedtls_ct_size_if_else_0
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_size_if_else_0
Unexecuted instantiation: nist_kw.c:mbedtls_ct_size_if_else_0
450
451
static inline unsigned mbedtls_ct_uint_if_else_0(mbedtls_ct_condition_t condition, unsigned if1)
452
20
{
453
20
    return (unsigned) (condition & if1);
454
20
}
Unexecuted instantiation: rsa.c:mbedtls_ct_uint_if_else_0
bignum.c:mbedtls_ct_uint_if_else_0
Line
Count
Source
452
16
{
453
16
    return (unsigned) (condition & if1);
454
16
}
Unexecuted instantiation: bignum_core.c:mbedtls_ct_uint_if_else_0
Unexecuted instantiation: cipher.c:mbedtls_ct_uint_if_else_0
cmac.c:mbedtls_ct_uint_if_else_0
Line
Count
Source
452
4
{
453
4
    return (unsigned) (condition & if1);
454
4
}
Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_if_else_0
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_if_else_0
Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_if_else_0
455
456
static inline mbedtls_ct_condition_t mbedtls_ct_bool_if_else_0(mbedtls_ct_condition_t condition,
457
                                                               mbedtls_ct_condition_t if1)
458
0
{
459
0
    return (mbedtls_ct_condition_t) (condition & if1);
460
0
}
Unexecuted instantiation: rsa.c:mbedtls_ct_bool_if_else_0
Unexecuted instantiation: bignum.c:mbedtls_ct_bool_if_else_0
Unexecuted instantiation: bignum_core.c:mbedtls_ct_bool_if_else_0
Unexecuted instantiation: cipher.c:mbedtls_ct_bool_if_else_0
Unexecuted instantiation: cmac.c:mbedtls_ct_bool_if_else_0
Unexecuted instantiation: constant_time.c:mbedtls_ct_bool_if_else_0
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool_if_else_0
Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool_if_else_0
461
462
#if defined(MBEDTLS_BIGNUM_C)
463
464
static inline mbedtls_mpi_uint mbedtls_ct_mpi_uint_if_else_0(mbedtls_ct_condition_t condition,
465
                                                             mbedtls_mpi_uint if1)
466
8.76k
{
467
8.76k
    return (mbedtls_mpi_uint) (condition & if1);
468
8.76k
}
Unexecuted instantiation: rsa.c:mbedtls_ct_mpi_uint_if_else_0
bignum.c:mbedtls_ct_mpi_uint_if_else_0
Line
Count
Source
466
8.76k
{
467
8.76k
    return (mbedtls_mpi_uint) (condition & if1);
468
8.76k
}
Unexecuted instantiation: bignum_core.c:mbedtls_ct_mpi_uint_if_else_0
Unexecuted instantiation: cipher.c:mbedtls_ct_mpi_uint_if_else_0
Unexecuted instantiation: cmac.c:mbedtls_ct_mpi_uint_if_else_0
Unexecuted instantiation: constant_time.c:mbedtls_ct_mpi_uint_if_else_0
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_mpi_uint_if_else_0
Unexecuted instantiation: nist_kw.c:mbedtls_ct_mpi_uint_if_else_0
469
470
#endif /* MBEDTLS_BIGNUM_C */
471
472
static inline int mbedtls_ct_error_if(mbedtls_ct_condition_t condition, int if1, int if0)
473
0
{
474
    /* Coverting int -> uint -> int here is safe, because we require if1 and if0 to be
475
     * in the range -32767..0, and we require 32-bit int and uint types.
476
     *
477
     * This means that (0 <= -if0 < INT_MAX), so negating if0 is safe, and similarly for
478
     * converting back to int.
479
     */
480
0
    return -((int) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) (-if1),
481
0
                                 (mbedtls_ct_uint_t) (-if0)));
482
0
}
Unexecuted instantiation: rsa.c:mbedtls_ct_error_if
Unexecuted instantiation: bignum.c:mbedtls_ct_error_if
Unexecuted instantiation: bignum_core.c:mbedtls_ct_error_if
Unexecuted instantiation: cipher.c:mbedtls_ct_error_if
Unexecuted instantiation: cmac.c:mbedtls_ct_error_if
Unexecuted instantiation: constant_time.c:mbedtls_ct_error_if
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_error_if
Unexecuted instantiation: nist_kw.c:mbedtls_ct_error_if
483
484
static inline int mbedtls_ct_error_if_else_0(mbedtls_ct_condition_t condition, int if1)
485
1
{
486
1
    return -((int) (condition & (-if1)));
487
1
}
Unexecuted instantiation: rsa.c:mbedtls_ct_error_if_else_0
Unexecuted instantiation: bignum.c:mbedtls_ct_error_if_else_0
Unexecuted instantiation: bignum_core.c:mbedtls_ct_error_if_else_0
cipher.c:mbedtls_ct_error_if_else_0
Line
Count
Source
485
1
{
486
1
    return -((int) (condition & (-if1)));
487
1
}
Unexecuted instantiation: cmac.c:mbedtls_ct_error_if_else_0
Unexecuted instantiation: constant_time.c:mbedtls_ct_error_if_else_0
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_error_if_else_0
Unexecuted instantiation: nist_kw.c:mbedtls_ct_error_if_else_0
488
489
static inline mbedtls_ct_condition_t mbedtls_ct_uint_eq(mbedtls_ct_uint_t x,
490
                                                        mbedtls_ct_uint_t y)
491
3.10M
{
492
3.10M
    return ~mbedtls_ct_uint_ne(x, y);
493
3.10M
}
Unexecuted instantiation: rsa.c:mbedtls_ct_uint_eq
Unexecuted instantiation: bignum.c:mbedtls_ct_uint_eq
bignum_core.c:mbedtls_ct_uint_eq
Line
Count
Source
491
3.10M
{
492
3.10M
    return ~mbedtls_ct_uint_ne(x, y);
493
3.10M
}
cipher.c:mbedtls_ct_uint_eq
Line
Count
Source
491
1
{
492
1
    return ~mbedtls_ct_uint_ne(x, y);
493
1
}
Unexecuted instantiation: cmac.c:mbedtls_ct_uint_eq
Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_eq
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_eq
Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_eq
494
495
static inline mbedtls_ct_condition_t mbedtls_ct_uint_gt(mbedtls_ct_uint_t x,
496
                                                        mbedtls_ct_uint_t y)
497
1
{
498
1
    return mbedtls_ct_uint_lt(y, x);
499
1
}
Unexecuted instantiation: rsa.c:mbedtls_ct_uint_gt
Unexecuted instantiation: bignum.c:mbedtls_ct_uint_gt
Unexecuted instantiation: bignum_core.c:mbedtls_ct_uint_gt
cipher.c:mbedtls_ct_uint_gt
Line
Count
Source
497
1
{
498
1
    return mbedtls_ct_uint_lt(y, x);
499
1
}
Unexecuted instantiation: cmac.c:mbedtls_ct_uint_gt
Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_gt
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_gt
Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_gt
500
501
static inline mbedtls_ct_condition_t mbedtls_ct_uint_ge(mbedtls_ct_uint_t x,
502
                                                        mbedtls_ct_uint_t y)
503
2.03k
{
504
2.03k
    return ~mbedtls_ct_uint_lt(x, y);
505
2.03k
}
Unexecuted instantiation: rsa.c:mbedtls_ct_uint_ge
Unexecuted instantiation: bignum.c:mbedtls_ct_uint_ge
bignum_core.c:mbedtls_ct_uint_ge
Line
Count
Source
503
2.02k
{
504
2.02k
    return ~mbedtls_ct_uint_lt(x, y);
505
2.02k
}
cipher.c:mbedtls_ct_uint_ge
Line
Count
Source
503
8
{
504
8
    return ~mbedtls_ct_uint_lt(x, y);
505
8
}
Unexecuted instantiation: cmac.c:mbedtls_ct_uint_ge
Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_ge
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_ge
Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_ge
506
507
static inline mbedtls_ct_condition_t mbedtls_ct_uint_le(mbedtls_ct_uint_t x,
508
                                                        mbedtls_ct_uint_t y)
509
0
{
510
0
    return ~mbedtls_ct_uint_gt(x, y);
511
0
}
Unexecuted instantiation: rsa.c:mbedtls_ct_uint_le
Unexecuted instantiation: bignum.c:mbedtls_ct_uint_le
Unexecuted instantiation: bignum_core.c:mbedtls_ct_uint_le
Unexecuted instantiation: cipher.c:mbedtls_ct_uint_le
Unexecuted instantiation: cmac.c:mbedtls_ct_uint_le
Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_le
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_le
Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_le
512
513
static inline mbedtls_ct_condition_t mbedtls_ct_bool_ne(mbedtls_ct_condition_t x,
514
                                                        mbedtls_ct_condition_t y)
515
16
{
516
16
    return (mbedtls_ct_condition_t) (x ^ y);
517
16
}
Unexecuted instantiation: rsa.c:mbedtls_ct_bool_ne
bignum.c:mbedtls_ct_bool_ne
Line
Count
Source
515
16
{
516
16
    return (mbedtls_ct_condition_t) (x ^ y);
517
16
}
Unexecuted instantiation: bignum_core.c:mbedtls_ct_bool_ne
Unexecuted instantiation: cipher.c:mbedtls_ct_bool_ne
Unexecuted instantiation: cmac.c:mbedtls_ct_bool_ne
Unexecuted instantiation: constant_time.c:mbedtls_ct_bool_ne
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool_ne
Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool_ne
518
519
static inline mbedtls_ct_condition_t mbedtls_ct_bool_and(mbedtls_ct_condition_t x,
520
                                                         mbedtls_ct_condition_t y)
521
12.2k
{
522
12.2k
    return (mbedtls_ct_condition_t) (x & y);
523
12.2k
}
Unexecuted instantiation: rsa.c:mbedtls_ct_bool_and
bignum.c:mbedtls_ct_bool_and
Line
Count
Source
521
32
{
522
32
    return (mbedtls_ct_condition_t) (x & y);
523
32
}
bignum_core.c:mbedtls_ct_bool_and
Line
Count
Source
521
12.1k
{
522
12.1k
    return (mbedtls_ct_condition_t) (x & y);
523
12.1k
}
cipher.c:mbedtls_ct_bool_and
Line
Count
Source
521
8
{
522
8
    return (mbedtls_ct_condition_t) (x & y);
523
8
}
Unexecuted instantiation: cmac.c:mbedtls_ct_bool_and
Unexecuted instantiation: constant_time.c:mbedtls_ct_bool_and
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool_and
Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool_and
524
525
static inline mbedtls_ct_condition_t mbedtls_ct_bool_or(mbedtls_ct_condition_t x,
526
                                                        mbedtls_ct_condition_t y)
527
40.5k
{
528
40.5k
    return (mbedtls_ct_condition_t) (x | y);
529
40.5k
}
Unexecuted instantiation: rsa.c:mbedtls_ct_bool_or
bignum.c:mbedtls_ct_bool_or
Line
Count
Source
527
16
{
528
16
    return (mbedtls_ct_condition_t) (x | y);
529
16
}
bignum_core.c:mbedtls_ct_bool_or
Line
Count
Source
527
40.5k
{
528
40.5k
    return (mbedtls_ct_condition_t) (x | y);
529
40.5k
}
cipher.c:mbedtls_ct_bool_or
Line
Count
Source
527
9
{
528
9
    return (mbedtls_ct_condition_t) (x | y);
529
9
}
Unexecuted instantiation: cmac.c:mbedtls_ct_bool_or
Unexecuted instantiation: constant_time.c:mbedtls_ct_bool_or
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool_or
Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool_or
530
531
static inline mbedtls_ct_condition_t mbedtls_ct_bool_not(mbedtls_ct_condition_t x)
532
3.49M
{
533
3.49M
    return (mbedtls_ct_condition_t) (~x);
534
3.49M
}
Unexecuted instantiation: rsa.c:mbedtls_ct_bool_not
bignum.c:mbedtls_ct_bool_not
Line
Count
Source
532
3.48M
{
533
3.48M
    return (mbedtls_ct_condition_t) (~x);
534
3.48M
}
bignum_core.c:mbedtls_ct_bool_not
Line
Count
Source
532
10.1k
{
533
10.1k
    return (mbedtls_ct_condition_t) (~x);
534
10.1k
}
Unexecuted instantiation: cipher.c:mbedtls_ct_bool_not
Unexecuted instantiation: cmac.c:mbedtls_ct_bool_not
Unexecuted instantiation: constant_time.c:mbedtls_ct_bool_not
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool_not
Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool_not
535
536
#if defined(MBEDTLS_COMPILER_IS_GCC) && (__GNUC__ > 4)
537
/* Restore warnings for -Wredundant-decls on gcc */
538
    #pragma GCC diagnostic pop
539
#endif
540
541
#endif /* MBEDTLS_CONSTANT_TIME_IMPL_H */