/src/mbedtls/library/constant_time_impl.h
Line | Count | Source (jump to first uncovered line) |
1 | | /** |
2 | | * Constant-time functions |
3 | | * |
4 | | * Copyright The Mbed TLS Contributors |
5 | | * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later |
6 | | */ |
7 | | |
8 | | #ifndef MBEDTLS_CONSTANT_TIME_IMPL_H |
9 | | #define MBEDTLS_CONSTANT_TIME_IMPL_H |
10 | | |
11 | | #include <stddef.h> |
12 | | |
13 | | #include "common.h" |
14 | | |
15 | | #if defined(MBEDTLS_BIGNUM_C) |
16 | | #include "mbedtls/bignum.h" |
17 | | #endif |
18 | | |
19 | | /* |
20 | | * To improve readability of constant_time_internal.h, the static inline |
21 | | * definitions are here, and constant_time_internal.h has only the declarations. |
22 | | * |
23 | | * This results in duplicate declarations of the form: |
24 | | * static inline void f(); // from constant_time_internal.h |
25 | | * static inline void f() { ... } // from constant_time_impl.h |
26 | | * when constant_time_internal.h is included. |
27 | | * |
28 | | * This appears to behave as if the declaration-without-definition was not present |
29 | | * (except for warnings if gcc -Wredundant-decls or similar is used). |
30 | | * |
31 | | * Disable -Wredundant-decls so that gcc does not warn about this. This is re-enabled |
32 | | * at the bottom of this file. |
33 | | */ |
34 | | #if defined(MBEDTLS_COMPILER_IS_GCC) && (__GNUC__ > 4) |
35 | | #pragma GCC diagnostic push |
36 | | #pragma GCC diagnostic ignored "-Wredundant-decls" |
37 | | #endif |
38 | | |
39 | | /* armcc5 --gnu defines __GNUC__ but doesn't support GNU's extended asm */ |
40 | | #if defined(MBEDTLS_HAVE_ASM) && defined(__GNUC__) && (!defined(__ARMCC_VERSION) || \ |
41 | | __ARMCC_VERSION >= 6000000) |
42 | | #define MBEDTLS_CT_ASM |
43 | | #if (defined(__arm__) || defined(__thumb__) || defined(__thumb2__)) |
44 | | #define MBEDTLS_CT_ARM_ASM |
45 | | #elif defined(__aarch64__) |
46 | | #define MBEDTLS_CT_AARCH64_ASM |
47 | | #elif defined(__amd64__) || defined(__x86_64__) |
48 | | #define MBEDTLS_CT_X86_64_ASM |
49 | | #elif defined(__i386__) |
50 | | #define MBEDTLS_CT_X86_ASM |
51 | | #endif |
52 | | #endif |
53 | | |
54 | | #define MBEDTLS_CT_SIZE (sizeof(mbedtls_ct_uint_t) * 8) |
55 | | |
56 | | |
57 | | /* ============================================================================ |
58 | | * Core const-time primitives |
59 | | */ |
60 | | |
61 | | /* Ensure that the compiler cannot know the value of x (i.e., cannot optimise |
62 | | * based on its value) after this function is called. |
63 | | * |
64 | | * If we are not using assembly, this will be fairly inefficient, so its use |
65 | | * should be minimised. |
66 | | */ |
67 | | |
68 | | #if !defined(MBEDTLS_CT_ASM) |
69 | | extern volatile mbedtls_ct_uint_t mbedtls_ct_zero; |
70 | | #endif |
71 | | |
72 | | /** |
73 | | * \brief Ensure that a value cannot be known at compile time. |
74 | | * |
75 | | * \param x The value to hide from the compiler. |
76 | | * \return The same value that was passed in, such that the compiler |
77 | | * cannot prove its value (even for calls of the form |
78 | | * x = mbedtls_ct_compiler_opaque(1), x will be unknown). |
79 | | * |
80 | | * \note This is mainly used in constructing mbedtls_ct_condition_t |
81 | | * values and performing operations over them, to ensure that |
82 | | * there is no way for the compiler to ever know anything about |
83 | | * the value of an mbedtls_ct_condition_t. |
84 | | */ |
85 | | static inline mbedtls_ct_uint_t mbedtls_ct_compiler_opaque(mbedtls_ct_uint_t x) |
86 | 7.83M | { |
87 | 7.83M | #if defined(MBEDTLS_CT_ASM) |
88 | 7.83M | asm volatile ("" : [x] "+r" (x) :); |
89 | 7.83M | return x; |
90 | | #else |
91 | | return x ^ mbedtls_ct_zero; |
92 | | #endif |
93 | 7.83M | } Unexecuted instantiation: rsa.c:mbedtls_ct_compiler_opaque Unexecuted instantiation: bignum.c:mbedtls_ct_compiler_opaque bignum_core.c:mbedtls_ct_compiler_opaque Line | Count | Source | 86 | 6.23M | { | 87 | 6.23M | #if defined(MBEDTLS_CT_ASM) | 88 | 6.23M | asm volatile ("" : [x] "+r" (x) :); | 89 | 6.23M | return x; | 90 | | #else | 91 | | return x ^ mbedtls_ct_zero; | 92 | | #endif | 93 | 6.23M | } |
cipher.c:mbedtls_ct_compiler_opaque Line | Count | Source | 86 | 18 | { | 87 | 18 | #if defined(MBEDTLS_CT_ASM) | 88 | 18 | asm volatile ("" : [x] "+r" (x) :); | 89 | 18 | return x; | 90 | | #else | 91 | | return x ^ mbedtls_ct_zero; | 92 | | #endif | 93 | 18 | } |
Unexecuted instantiation: cmac.c:mbedtls_ct_compiler_opaque constant_time.c:mbedtls_ct_compiler_opaque Line | Count | Source | 86 | 1.59M | { | 87 | 1.59M | #if defined(MBEDTLS_CT_ASM) | 88 | 1.59M | asm volatile ("" : [x] "+r" (x) :); | 89 | 1.59M | return x; | 90 | | #else | 91 | | return x ^ mbedtls_ct_zero; | 92 | | #endif | 93 | 1.59M | } |
Unexecuted instantiation: ecp_curves.c:mbedtls_ct_compiler_opaque Unexecuted instantiation: nist_kw.c:mbedtls_ct_compiler_opaque |
94 | | |
95 | | /* |
96 | | * Selecting unified syntax is needed for gcc, and harmless on clang. |
97 | | * |
98 | | * This is needed because on Thumb 1, condition flags are always set, so |
99 | | * e.g. "negs" is supported but "neg" is not (on Thumb 2, both exist). |
100 | | * |
101 | | * Under Thumb 1 unified syntax, only the "negs" form is accepted, and |
102 | | * under divided syntax, only the "neg" form is accepted. clang only |
103 | | * supports unified syntax. |
104 | | * |
105 | | * On Thumb 2 and Arm, both compilers are happy with the "s" suffix, |
106 | | * although we don't actually care about setting the flags. |
107 | | * |
108 | | * For old versions of gcc (see #8516 for details), restore divided |
109 | | * syntax afterwards - otherwise old versions of gcc seem to apply |
110 | | * unified syntax globally, which breaks other asm code. |
111 | | */ |
112 | | #if defined(MBEDTLS_COMPILER_IS_GCC) && defined(__thumb__) && !defined(__thumb2__) && \ |
113 | | (__GNUC__ < 11) && !defined(__ARM_ARCH_2__) |
114 | | #define RESTORE_ASM_SYNTAX ".syntax divided \n\t" |
115 | | #else |
116 | | #define RESTORE_ASM_SYNTAX |
117 | | #endif |
118 | | |
119 | | /* Convert a number into a condition in constant time. */ |
120 | | static inline mbedtls_ct_condition_t mbedtls_ct_bool(mbedtls_ct_uint_t x) |
121 | 8.19M | { |
122 | | /* |
123 | | * Define mask-generation code that, as far as possible, will not use branches or conditional instructions. |
124 | | * |
125 | | * For some platforms / type sizes, we define assembly to assure this. |
126 | | * |
127 | | * Otherwise, we define a plain C fallback which (in May 2023) does not get optimised into |
128 | | * conditional instructions or branches by trunk clang, gcc, or MSVC v19. |
129 | | */ |
130 | | #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) |
131 | | mbedtls_ct_uint_t s; |
132 | | asm volatile ("neg %x[s], %x[x] \n\t" |
133 | | "orr %x[x], %x[s], %x[x] \n\t" |
134 | | "asr %x[x], %x[x], 63 \n\t" |
135 | | : |
136 | | [s] "=&r" (s), |
137 | | [x] "+&r" (x) |
138 | | : |
139 | | : |
140 | | ); |
141 | | return (mbedtls_ct_condition_t) x; |
142 | | #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32) |
143 | | uint32_t s; |
144 | | asm volatile (".syntax unified \n\t" |
145 | | "negs %[s], %[x] \n\t" |
146 | | "orrs %[x], %[x], %[s] \n\t" |
147 | | "asrs %[x], %[x], #31 \n\t" |
148 | | RESTORE_ASM_SYNTAX |
149 | | : |
150 | | [s] "=&l" (s), |
151 | | [x] "+&l" (x) |
152 | | : |
153 | | : |
154 | | "cc" /* clobbers flag bits */ |
155 | | ); |
156 | | return (mbedtls_ct_condition_t) x; |
157 | | #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) |
158 | 8.19M | uint64_t s; |
159 | 8.19M | asm volatile ("mov %[x], %[s] \n\t" |
160 | 8.19M | "neg %[s] \n\t" |
161 | 8.19M | "or %[x], %[s] \n\t" |
162 | 8.19M | "sar $63, %[s] \n\t" |
163 | 8.19M | : |
164 | 8.19M | [s] "=&a" (s) |
165 | 8.19M | : |
166 | 8.19M | [x] "D" (x) |
167 | 8.19M | : |
168 | 8.19M | ); |
169 | 8.19M | return (mbedtls_ct_condition_t) s; |
170 | | #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32) |
171 | | uint32_t s; |
172 | | asm volatile ("mov %[x], %[s] \n\t" |
173 | | "neg %[s] \n\t" |
174 | | "or %[s], %[x] \n\t" |
175 | | "sar $31, %[x] \n\t" |
176 | | : |
177 | | [s] "=&c" (s), |
178 | | [x] "+&a" (x) |
179 | | : |
180 | | : |
181 | | ); |
182 | | return (mbedtls_ct_condition_t) x; |
183 | | #else |
184 | | const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x); |
185 | | #if defined(_MSC_VER) |
186 | | /* MSVC has a warning about unary minus on unsigned, but this is |
187 | | * well-defined and precisely what we want to do here */ |
188 | | #pragma warning( push ) |
189 | | #pragma warning( disable : 4146 ) |
190 | | #endif |
191 | | // y is negative (i.e., top bit set) iff x is non-zero |
192 | | mbedtls_ct_int_t y = (-xo) | -(xo >> 1); |
193 | | |
194 | | // extract only the sign bit of y so that y == 1 (if x is non-zero) or 0 (if x is zero) |
195 | | y = (((mbedtls_ct_uint_t) y) >> (MBEDTLS_CT_SIZE - 1)); |
196 | | |
197 | | // -y has all bits set (if x is non-zero), or all bits clear (if x is zero) |
198 | | return (mbedtls_ct_condition_t) (-y); |
199 | | #if defined(_MSC_VER) |
200 | | #pragma warning( pop ) |
201 | | #endif |
202 | | #endif |
203 | 8.19M | } Unexecuted instantiation: rsa.c:mbedtls_ct_bool Line | Count | Source | 121 | 3.48M | { | 122 | | /* | 123 | | * Define mask-generation code that, as far as possible, will not use branches or conditional instructions. | 124 | | * | 125 | | * For some platforms / type sizes, we define assembly to assure this. | 126 | | * | 127 | | * Otherwise, we define a plain C fallback which (in May 2023) does not get optimised into | 128 | | * conditional instructions or branches by trunk clang, gcc, or MSVC v19. | 129 | | */ | 130 | | #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 131 | | mbedtls_ct_uint_t s; | 132 | | asm volatile ("neg %x[s], %x[x] \n\t" | 133 | | "orr %x[x], %x[s], %x[x] \n\t" | 134 | | "asr %x[x], %x[x], 63 \n\t" | 135 | | : | 136 | | [s] "=&r" (s), | 137 | | [x] "+&r" (x) | 138 | | : | 139 | | : | 140 | | ); | 141 | | return (mbedtls_ct_condition_t) x; | 142 | | #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32) | 143 | | uint32_t s; | 144 | | asm volatile (".syntax unified \n\t" | 145 | | "negs %[s], %[x] \n\t" | 146 | | "orrs %[x], %[x], %[s] \n\t" | 147 | | "asrs %[x], %[x], #31 \n\t" | 148 | | RESTORE_ASM_SYNTAX | 149 | | : | 150 | | [s] "=&l" (s), | 151 | | [x] "+&l" (x) | 152 | | : | 153 | | : | 154 | | "cc" /* clobbers flag bits */ | 155 | | ); | 156 | | return (mbedtls_ct_condition_t) x; | 157 | | #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 158 | 3.48M | uint64_t s; | 159 | 3.48M | asm volatile ("mov %[x], %[s] \n\t" | 160 | 3.48M | "neg %[s] \n\t" | 161 | 3.48M | "or %[x], %[s] \n\t" | 162 | 3.48M | "sar $63, %[s] \n\t" | 163 | 3.48M | : | 164 | 3.48M | [s] "=&a" (s) | 165 | 3.48M | : | 166 | 3.48M | [x] "D" (x) | 167 | 3.48M | : | 168 | 3.48M | ); | 169 | 3.48M | return (mbedtls_ct_condition_t) s; | 170 | | #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32) | 171 | | uint32_t s; | 172 | | asm volatile ("mov %[x], %[s] \n\t" | 173 | | "neg %[s] \n\t" | 174 | | "or %[s], %[x] \n\t" | 175 | | "sar $31, %[x] \n\t" | 176 | | : | 177 | | [s] "=&c" (s), | 178 | | [x] "+&a" (x) | 179 | | : | 180 | | : | 181 | | ); | 182 | | return (mbedtls_ct_condition_t) x; | 183 | | #else | 184 | | const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x); | 185 | | #if defined(_MSC_VER) | 186 | | /* MSVC has a warning about unary minus on unsigned, but this is | 187 | | * well-defined and precisely what we want to do here */ | 188 | | #pragma warning( push ) | 189 | | #pragma warning( disable : 4146 ) | 190 | | #endif | 191 | | // y is negative (i.e., top bit set) iff x is non-zero | 192 | | mbedtls_ct_int_t y = (-xo) | -(xo >> 1); | 193 | | | 194 | | // extract only the sign bit of y so that y == 1 (if x is non-zero) or 0 (if x is zero) | 195 | | y = (((mbedtls_ct_uint_t) y) >> (MBEDTLS_CT_SIZE - 1)); | 196 | | | 197 | | // -y has all bits set (if x is non-zero), or all bits clear (if x is zero) | 198 | | return (mbedtls_ct_condition_t) (-y); | 199 | | #if defined(_MSC_VER) | 200 | | #pragma warning( pop ) | 201 | | #endif | 202 | | #endif | 203 | 3.48M | } |
bignum_core.c:mbedtls_ct_bool Line | Count | Source | 121 | 4.71M | { | 122 | | /* | 123 | | * Define mask-generation code that, as far as possible, will not use branches or conditional instructions. | 124 | | * | 125 | | * For some platforms / type sizes, we define assembly to assure this. | 126 | | * | 127 | | * Otherwise, we define a plain C fallback which (in May 2023) does not get optimised into | 128 | | * conditional instructions or branches by trunk clang, gcc, or MSVC v19. | 129 | | */ | 130 | | #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 131 | | mbedtls_ct_uint_t s; | 132 | | asm volatile ("neg %x[s], %x[x] \n\t" | 133 | | "orr %x[x], %x[s], %x[x] \n\t" | 134 | | "asr %x[x], %x[x], 63 \n\t" | 135 | | : | 136 | | [s] "=&r" (s), | 137 | | [x] "+&r" (x) | 138 | | : | 139 | | : | 140 | | ); | 141 | | return (mbedtls_ct_condition_t) x; | 142 | | #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32) | 143 | | uint32_t s; | 144 | | asm volatile (".syntax unified \n\t" | 145 | | "negs %[s], %[x] \n\t" | 146 | | "orrs %[x], %[x], %[s] \n\t" | 147 | | "asrs %[x], %[x], #31 \n\t" | 148 | | RESTORE_ASM_SYNTAX | 149 | | : | 150 | | [s] "=&l" (s), | 151 | | [x] "+&l" (x) | 152 | | : | 153 | | : | 154 | | "cc" /* clobbers flag bits */ | 155 | | ); | 156 | | return (mbedtls_ct_condition_t) x; | 157 | | #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 158 | 4.71M | uint64_t s; | 159 | 4.71M | asm volatile ("mov %[x], %[s] \n\t" | 160 | 4.71M | "neg %[s] \n\t" | 161 | 4.71M | "or %[x], %[s] \n\t" | 162 | 4.71M | "sar $63, %[s] \n\t" | 163 | 4.71M | : | 164 | 4.71M | [s] "=&a" (s) | 165 | 4.71M | : | 166 | 4.71M | [x] "D" (x) | 167 | 4.71M | : | 168 | 4.71M | ); | 169 | 4.71M | return (mbedtls_ct_condition_t) s; | 170 | | #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32) | 171 | | uint32_t s; | 172 | | asm volatile ("mov %[x], %[s] \n\t" | 173 | | "neg %[s] \n\t" | 174 | | "or %[s], %[x] \n\t" | 175 | | "sar $31, %[x] \n\t" | 176 | | : | 177 | | [s] "=&c" (s), | 178 | | [x] "+&a" (x) | 179 | | : | 180 | | : | 181 | | ); | 182 | | return (mbedtls_ct_condition_t) x; | 183 | | #else | 184 | | const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x); | 185 | | #if defined(_MSC_VER) | 186 | | /* MSVC has a warning about unary minus on unsigned, but this is | 187 | | * well-defined and precisely what we want to do here */ | 188 | | #pragma warning( push ) | 189 | | #pragma warning( disable : 4146 ) | 190 | | #endif | 191 | | // y is negative (i.e., top bit set) iff x is non-zero | 192 | | mbedtls_ct_int_t y = (-xo) | -(xo >> 1); | 193 | | | 194 | | // extract only the sign bit of y so that y == 1 (if x is non-zero) or 0 (if x is zero) | 195 | | y = (((mbedtls_ct_uint_t) y) >> (MBEDTLS_CT_SIZE - 1)); | 196 | | | 197 | | // -y has all bits set (if x is non-zero), or all bits clear (if x is zero) | 198 | | return (mbedtls_ct_condition_t) (-y); | 199 | | #if defined(_MSC_VER) | 200 | | #pragma warning( pop ) | 201 | | #endif | 202 | | #endif | 203 | 4.71M | } |
Line | Count | Source | 121 | 9 | { | 122 | | /* | 123 | | * Define mask-generation code that, as far as possible, will not use branches or conditional instructions. | 124 | | * | 125 | | * For some platforms / type sizes, we define assembly to assure this. | 126 | | * | 127 | | * Otherwise, we define a plain C fallback which (in May 2023) does not get optimised into | 128 | | * conditional instructions or branches by trunk clang, gcc, or MSVC v19. | 129 | | */ | 130 | | #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 131 | | mbedtls_ct_uint_t s; | 132 | | asm volatile ("neg %x[s], %x[x] \n\t" | 133 | | "orr %x[x], %x[s], %x[x] \n\t" | 134 | | "asr %x[x], %x[x], 63 \n\t" | 135 | | : | 136 | | [s] "=&r" (s), | 137 | | [x] "+&r" (x) | 138 | | : | 139 | | : | 140 | | ); | 141 | | return (mbedtls_ct_condition_t) x; | 142 | | #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32) | 143 | | uint32_t s; | 144 | | asm volatile (".syntax unified \n\t" | 145 | | "negs %[s], %[x] \n\t" | 146 | | "orrs %[x], %[x], %[s] \n\t" | 147 | | "asrs %[x], %[x], #31 \n\t" | 148 | | RESTORE_ASM_SYNTAX | 149 | | : | 150 | | [s] "=&l" (s), | 151 | | [x] "+&l" (x) | 152 | | : | 153 | | : | 154 | | "cc" /* clobbers flag bits */ | 155 | | ); | 156 | | return (mbedtls_ct_condition_t) x; | 157 | | #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 158 | 9 | uint64_t s; | 159 | 9 | asm volatile ("mov %[x], %[s] \n\t" | 160 | 9 | "neg %[s] \n\t" | 161 | 9 | "or %[x], %[s] \n\t" | 162 | 9 | "sar $63, %[s] \n\t" | 163 | 9 | : | 164 | 9 | [s] "=&a" (s) | 165 | 9 | : | 166 | 9 | [x] "D" (x) | 167 | 9 | : | 168 | 9 | ); | 169 | 9 | return (mbedtls_ct_condition_t) s; | 170 | | #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32) | 171 | | uint32_t s; | 172 | | asm volatile ("mov %[x], %[s] \n\t" | 173 | | "neg %[s] \n\t" | 174 | | "or %[s], %[x] \n\t" | 175 | | "sar $31, %[x] \n\t" | 176 | | : | 177 | | [s] "=&c" (s), | 178 | | [x] "+&a" (x) | 179 | | : | 180 | | : | 181 | | ); | 182 | | return (mbedtls_ct_condition_t) x; | 183 | | #else | 184 | | const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x); | 185 | | #if defined(_MSC_VER) | 186 | | /* MSVC has a warning about unary minus on unsigned, but this is | 187 | | * well-defined and precisely what we want to do here */ | 188 | | #pragma warning( push ) | 189 | | #pragma warning( disable : 4146 ) | 190 | | #endif | 191 | | // y is negative (i.e., top bit set) iff x is non-zero | 192 | | mbedtls_ct_int_t y = (-xo) | -(xo >> 1); | 193 | | | 194 | | // extract only the sign bit of y so that y == 1 (if x is non-zero) or 0 (if x is zero) | 195 | | y = (((mbedtls_ct_uint_t) y) >> (MBEDTLS_CT_SIZE - 1)); | 196 | | | 197 | | // -y has all bits set (if x is non-zero), or all bits clear (if x is zero) | 198 | | return (mbedtls_ct_condition_t) (-y); | 199 | | #if defined(_MSC_VER) | 200 | | #pragma warning( pop ) | 201 | | #endif | 202 | | #endif | 203 | 9 | } |
Line | Count | Source | 121 | 4 | { | 122 | | /* | 123 | | * Define mask-generation code that, as far as possible, will not use branches or conditional instructions. | 124 | | * | 125 | | * For some platforms / type sizes, we define assembly to assure this. | 126 | | * | 127 | | * Otherwise, we define a plain C fallback which (in May 2023) does not get optimised into | 128 | | * conditional instructions or branches by trunk clang, gcc, or MSVC v19. | 129 | | */ | 130 | | #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 131 | | mbedtls_ct_uint_t s; | 132 | | asm volatile ("neg %x[s], %x[x] \n\t" | 133 | | "orr %x[x], %x[s], %x[x] \n\t" | 134 | | "asr %x[x], %x[x], 63 \n\t" | 135 | | : | 136 | | [s] "=&r" (s), | 137 | | [x] "+&r" (x) | 138 | | : | 139 | | : | 140 | | ); | 141 | | return (mbedtls_ct_condition_t) x; | 142 | | #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32) | 143 | | uint32_t s; | 144 | | asm volatile (".syntax unified \n\t" | 145 | | "negs %[s], %[x] \n\t" | 146 | | "orrs %[x], %[x], %[s] \n\t" | 147 | | "asrs %[x], %[x], #31 \n\t" | 148 | | RESTORE_ASM_SYNTAX | 149 | | : | 150 | | [s] "=&l" (s), | 151 | | [x] "+&l" (x) | 152 | | : | 153 | | : | 154 | | "cc" /* clobbers flag bits */ | 155 | | ); | 156 | | return (mbedtls_ct_condition_t) x; | 157 | | #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 158 | 4 | uint64_t s; | 159 | 4 | asm volatile ("mov %[x], %[s] \n\t" | 160 | 4 | "neg %[s] \n\t" | 161 | 4 | "or %[x], %[s] \n\t" | 162 | 4 | "sar $63, %[s] \n\t" | 163 | 4 | : | 164 | 4 | [s] "=&a" (s) | 165 | 4 | : | 166 | 4 | [x] "D" (x) | 167 | 4 | : | 168 | 4 | ); | 169 | 4 | return (mbedtls_ct_condition_t) s; | 170 | | #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32) | 171 | | uint32_t s; | 172 | | asm volatile ("mov %[x], %[s] \n\t" | 173 | | "neg %[s] \n\t" | 174 | | "or %[s], %[x] \n\t" | 175 | | "sar $31, %[x] \n\t" | 176 | | : | 177 | | [s] "=&c" (s), | 178 | | [x] "+&a" (x) | 179 | | : | 180 | | : | 181 | | ); | 182 | | return (mbedtls_ct_condition_t) x; | 183 | | #else | 184 | | const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x); | 185 | | #if defined(_MSC_VER) | 186 | | /* MSVC has a warning about unary minus on unsigned, but this is | 187 | | * well-defined and precisely what we want to do here */ | 188 | | #pragma warning( push ) | 189 | | #pragma warning( disable : 4146 ) | 190 | | #endif | 191 | | // y is negative (i.e., top bit set) iff x is non-zero | 192 | | mbedtls_ct_int_t y = (-xo) | -(xo >> 1); | 193 | | | 194 | | // extract only the sign bit of y so that y == 1 (if x is non-zero) or 0 (if x is zero) | 195 | | y = (((mbedtls_ct_uint_t) y) >> (MBEDTLS_CT_SIZE - 1)); | 196 | | | 197 | | // -y has all bits set (if x is non-zero), or all bits clear (if x is zero) | 198 | | return (mbedtls_ct_condition_t) (-y); | 199 | | #if defined(_MSC_VER) | 200 | | #pragma warning( pop ) | 201 | | #endif | 202 | | #endif | 203 | 4 | } |
Unexecuted instantiation: constant_time.c:mbedtls_ct_bool Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool |
204 | | |
205 | | static inline mbedtls_ct_uint_t mbedtls_ct_if(mbedtls_ct_condition_t condition, |
206 | | mbedtls_ct_uint_t if1, |
207 | | mbedtls_ct_uint_t if0) |
208 | 153M | { |
209 | | #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) |
210 | | asm volatile ("and %x[if1], %x[if1], %x[condition] \n\t" |
211 | | "mvn %x[condition], %x[condition] \n\t" |
212 | | "and %x[condition], %x[condition], %x[if0] \n\t" |
213 | | "orr %x[condition], %x[if1], %x[condition]" |
214 | | : |
215 | | [condition] "+&r" (condition), |
216 | | [if1] "+&r" (if1) |
217 | | : |
218 | | [if0] "r" (if0) |
219 | | : |
220 | | ); |
221 | | return (mbedtls_ct_uint_t) condition; |
222 | | #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32) |
223 | | asm volatile (".syntax unified \n\t" |
224 | | "ands %[if1], %[if1], %[condition] \n\t" |
225 | | "mvns %[condition], %[condition] \n\t" |
226 | | "ands %[condition], %[condition], %[if0] \n\t" |
227 | | "orrs %[condition], %[if1], %[condition] \n\t" |
228 | | RESTORE_ASM_SYNTAX |
229 | | : |
230 | | [condition] "+&l" (condition), |
231 | | [if1] "+&l" (if1) |
232 | | : |
233 | | [if0] "l" (if0) |
234 | | : |
235 | | "cc" |
236 | | ); |
237 | | return (mbedtls_ct_uint_t) condition; |
238 | | #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) |
239 | 153M | asm volatile ("and %[condition], %[if1] \n\t" |
240 | 153M | "not %[condition] \n\t" |
241 | 153M | "and %[condition], %[if0] \n\t" |
242 | 153M | "or %[if1], %[if0] \n\t" |
243 | 153M | : |
244 | 153M | [condition] "+&D" (condition), |
245 | 153M | [if1] "+&S" (if1), |
246 | 153M | [if0] "+&a" (if0) |
247 | 153M | : |
248 | 153M | : |
249 | 153M | ); |
250 | 153M | return if0; |
251 | | #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32) |
252 | | asm volatile ("and %[condition], %[if1] \n\t" |
253 | | "not %[condition] \n\t" |
254 | | "and %[if0], %[condition] \n\t" |
255 | | "or %[condition], %[if1] \n\t" |
256 | | : |
257 | | [condition] "+&c" (condition), |
258 | | [if1] "+&a" (if1) |
259 | | : |
260 | | [if0] "b" (if0) |
261 | | : |
262 | | ); |
263 | | return if1; |
264 | | #else |
265 | | mbedtls_ct_condition_t not_cond = |
266 | | (mbedtls_ct_condition_t) (~mbedtls_ct_compiler_opaque(condition)); |
267 | | return (mbedtls_ct_uint_t) ((condition & if1) | (not_cond & if0)); |
268 | | #endif |
269 | 153M | } Unexecuted instantiation: rsa.c:mbedtls_ct_if Line | Count | Source | 208 | 3.48M | { | 209 | | #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 210 | | asm volatile ("and %x[if1], %x[if1], %x[condition] \n\t" | 211 | | "mvn %x[condition], %x[condition] \n\t" | 212 | | "and %x[condition], %x[condition], %x[if0] \n\t" | 213 | | "orr %x[condition], %x[if1], %x[condition]" | 214 | | : | 215 | | [condition] "+&r" (condition), | 216 | | [if1] "+&r" (if1) | 217 | | : | 218 | | [if0] "r" (if0) | 219 | | : | 220 | | ); | 221 | | return (mbedtls_ct_uint_t) condition; | 222 | | #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32) | 223 | | asm volatile (".syntax unified \n\t" | 224 | | "ands %[if1], %[if1], %[condition] \n\t" | 225 | | "mvns %[condition], %[condition] \n\t" | 226 | | "ands %[condition], %[condition], %[if0] \n\t" | 227 | | "orrs %[condition], %[if1], %[condition] \n\t" | 228 | | RESTORE_ASM_SYNTAX | 229 | | : | 230 | | [condition] "+&l" (condition), | 231 | | [if1] "+&l" (if1) | 232 | | : | 233 | | [if0] "l" (if0) | 234 | | : | 235 | | "cc" | 236 | | ); | 237 | | return (mbedtls_ct_uint_t) condition; | 238 | | #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 239 | 3.48M | asm volatile ("and %[condition], %[if1] \n\t" | 240 | 3.48M | "not %[condition] \n\t" | 241 | 3.48M | "and %[condition], %[if0] \n\t" | 242 | 3.48M | "or %[if1], %[if0] \n\t" | 243 | 3.48M | : | 244 | 3.48M | [condition] "+&D" (condition), | 245 | 3.48M | [if1] "+&S" (if1), | 246 | 3.48M | [if0] "+&a" (if0) | 247 | 3.48M | : | 248 | 3.48M | : | 249 | 3.48M | ); | 250 | 3.48M | return if0; | 251 | | #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32) | 252 | | asm volatile ("and %[condition], %[if1] \n\t" | 253 | | "not %[condition] \n\t" | 254 | | "and %[if0], %[condition] \n\t" | 255 | | "or %[condition], %[if1] \n\t" | 256 | | : | 257 | | [condition] "+&c" (condition), | 258 | | [if1] "+&a" (if1) | 259 | | : | 260 | | [if0] "b" (if0) | 261 | | : | 262 | | ); | 263 | | return if1; | 264 | | #else | 265 | | mbedtls_ct_condition_t not_cond = | 266 | | (mbedtls_ct_condition_t) (~mbedtls_ct_compiler_opaque(condition)); | 267 | | return (mbedtls_ct_uint_t) ((condition & if1) | (not_cond & if0)); | 268 | | #endif | 269 | 3.48M | } |
bignum_core.c:mbedtls_ct_if Line | Count | Source | 208 | 150M | { | 209 | | #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 210 | | asm volatile ("and %x[if1], %x[if1], %x[condition] \n\t" | 211 | | "mvn %x[condition], %x[condition] \n\t" | 212 | | "and %x[condition], %x[condition], %x[if0] \n\t" | 213 | | "orr %x[condition], %x[if1], %x[condition]" | 214 | | : | 215 | | [condition] "+&r" (condition), | 216 | | [if1] "+&r" (if1) | 217 | | : | 218 | | [if0] "r" (if0) | 219 | | : | 220 | | ); | 221 | | return (mbedtls_ct_uint_t) condition; | 222 | | #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32) | 223 | | asm volatile (".syntax unified \n\t" | 224 | | "ands %[if1], %[if1], %[condition] \n\t" | 225 | | "mvns %[condition], %[condition] \n\t" | 226 | | "ands %[condition], %[condition], %[if0] \n\t" | 227 | | "orrs %[condition], %[if1], %[condition] \n\t" | 228 | | RESTORE_ASM_SYNTAX | 229 | | : | 230 | | [condition] "+&l" (condition), | 231 | | [if1] "+&l" (if1) | 232 | | : | 233 | | [if0] "l" (if0) | 234 | | : | 235 | | "cc" | 236 | | ); | 237 | | return (mbedtls_ct_uint_t) condition; | 238 | | #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 239 | 150M | asm volatile ("and %[condition], %[if1] \n\t" | 240 | 150M | "not %[condition] \n\t" | 241 | 150M | "and %[condition], %[if0] \n\t" | 242 | 150M | "or %[if1], %[if0] \n\t" | 243 | 150M | : | 244 | 150M | [condition] "+&D" (condition), | 245 | 150M | [if1] "+&S" (if1), | 246 | 150M | [if0] "+&a" (if0) | 247 | 150M | : | 248 | 150M | : | 249 | 150M | ); | 250 | 150M | return if0; | 251 | | #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32) | 252 | | asm volatile ("and %[condition], %[if1] \n\t" | 253 | | "not %[condition] \n\t" | 254 | | "and %[if0], %[condition] \n\t" | 255 | | "or %[condition], %[if1] \n\t" | 256 | | : | 257 | | [condition] "+&c" (condition), | 258 | | [if1] "+&a" (if1) | 259 | | : | 260 | | [if0] "b" (if0) | 261 | | : | 262 | | ); | 263 | | return if1; | 264 | | #else | 265 | | mbedtls_ct_condition_t not_cond = | 266 | | (mbedtls_ct_condition_t) (~mbedtls_ct_compiler_opaque(condition)); | 267 | | return (mbedtls_ct_uint_t) ((condition & if1) | (not_cond & if0)); | 268 | | #endif | 269 | 150M | } |
Unexecuted instantiation: cipher.c:mbedtls_ct_if Unexecuted instantiation: cmac.c:mbedtls_ct_if Unexecuted instantiation: constant_time.c:mbedtls_ct_if Unexecuted instantiation: ecp_curves.c:mbedtls_ct_if Unexecuted instantiation: nist_kw.c:mbedtls_ct_if |
270 | | |
271 | | static inline mbedtls_ct_condition_t mbedtls_ct_uint_lt(mbedtls_ct_uint_t x, mbedtls_ct_uint_t y) |
272 | 22.3k | { |
273 | | #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) |
274 | | uint64_t s1; |
275 | | asm volatile ("eor %x[s1], %x[y], %x[x] \n\t" |
276 | | "sub %x[x], %x[x], %x[y] \n\t" |
277 | | "bic %x[x], %x[x], %x[s1] \n\t" |
278 | | "and %x[s1], %x[s1], %x[y] \n\t" |
279 | | "orr %x[s1], %x[x], %x[s1] \n\t" |
280 | | "asr %x[x], %x[s1], 63" |
281 | | : |
282 | | [s1] "=&r" (s1), |
283 | | [x] "+&r" (x) |
284 | | : |
285 | | [y] "r" (y) |
286 | | : |
287 | | ); |
288 | | return (mbedtls_ct_condition_t) x; |
289 | | #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32) |
290 | | uint32_t s1; |
291 | | asm volatile ( |
292 | | ".syntax unified \n\t" |
293 | | #if defined(__thumb__) && !defined(__thumb2__) |
294 | | "movs %[s1], %[x] \n\t" |
295 | | "eors %[s1], %[s1], %[y] \n\t" |
296 | | #else |
297 | | "eors %[s1], %[x], %[y] \n\t" |
298 | | #endif |
299 | | "subs %[x], %[x], %[y] \n\t" |
300 | | "bics %[x], %[x], %[s1] \n\t" |
301 | | "ands %[y], %[s1], %[y] \n\t" |
302 | | "orrs %[x], %[x], %[y] \n\t" |
303 | | "asrs %[x], %[x], #31 \n\t" |
304 | | RESTORE_ASM_SYNTAX |
305 | | : |
306 | | [s1] "=&l" (s1), |
307 | | [x] "+&l" (x), |
308 | | [y] "+&l" (y) |
309 | | : |
310 | | : |
311 | | "cc" |
312 | | ); |
313 | | return (mbedtls_ct_condition_t) x; |
314 | | #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) |
315 | 22.3k | uint64_t s; |
316 | 22.3k | asm volatile ("mov %[x], %[s] \n\t" |
317 | 22.3k | "xor %[y], %[s] \n\t" |
318 | 22.3k | "sub %[y], %[x] \n\t" |
319 | 22.3k | "and %[s], %[y] \n\t" |
320 | 22.3k | "not %[s] \n\t" |
321 | 22.3k | "and %[s], %[x] \n\t" |
322 | 22.3k | "or %[y], %[x] \n\t" |
323 | 22.3k | "sar $63, %[x] \n\t" |
324 | 22.3k | : |
325 | 22.3k | [s] "=&a" (s), |
326 | 22.3k | [x] "+&D" (x), |
327 | 22.3k | [y] "+&S" (y) |
328 | 22.3k | : |
329 | 22.3k | : |
330 | 22.3k | ); |
331 | 22.3k | return (mbedtls_ct_condition_t) x; |
332 | | #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32) |
333 | | uint32_t s; |
334 | | asm volatile ("mov %[x], %[s] \n\t" |
335 | | "xor %[y], %[s] \n\t" |
336 | | "sub %[y], %[x] \n\t" |
337 | | "and %[s], %[y] \n\t" |
338 | | "not %[s] \n\t" |
339 | | "and %[s], %[x] \n\t" |
340 | | "or %[y], %[x] \n\t" |
341 | | "sar $31, %[x] \n\t" |
342 | | : |
343 | | [s] "=&b" (s), |
344 | | [x] "+&a" (x), |
345 | | [y] "+&c" (y) |
346 | | : |
347 | | : |
348 | | ); |
349 | | return (mbedtls_ct_condition_t) x; |
350 | | #else |
351 | | /* Ensure that the compiler cannot optimise the following operations over x and y, |
352 | | * even if it knows the value of x and y. |
353 | | */ |
354 | | const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x); |
355 | | const mbedtls_ct_uint_t yo = mbedtls_ct_compiler_opaque(y); |
356 | | /* |
357 | | * Check if the most significant bits (MSB) of the operands are different. |
358 | | * cond is true iff the MSBs differ. |
359 | | */ |
360 | | mbedtls_ct_condition_t cond = mbedtls_ct_bool((xo ^ yo) >> (MBEDTLS_CT_SIZE - 1)); |
361 | | |
362 | | /* |
363 | | * If the MSB are the same then the difference x-y will be negative (and |
364 | | * have its MSB set to 1 during conversion to unsigned) if and only if x<y. |
365 | | * |
366 | | * If the MSB are different, then the operand with the MSB of 1 is the |
367 | | * bigger. (That is if y has MSB of 1, then x<y is true and it is false if |
368 | | * the MSB of y is 0.) |
369 | | */ |
370 | | |
371 | | // Select either y, or x - y |
372 | | mbedtls_ct_uint_t ret = mbedtls_ct_if(cond, yo, (mbedtls_ct_uint_t) (xo - yo)); |
373 | | |
374 | | // Extract only the MSB of ret |
375 | | ret = ret >> (MBEDTLS_CT_SIZE - 1); |
376 | | |
377 | | // Convert to a condition (i.e., all bits set iff non-zero) |
378 | | return mbedtls_ct_bool(ret); |
379 | | #endif |
380 | 22.3k | } Unexecuted instantiation: rsa.c:mbedtls_ct_uint_lt Unexecuted instantiation: bignum.c:mbedtls_ct_uint_lt bignum_core.c:mbedtls_ct_uint_lt Line | Count | Source | 272 | 22.3k | { | 273 | | #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 274 | | uint64_t s1; | 275 | | asm volatile ("eor %x[s1], %x[y], %x[x] \n\t" | 276 | | "sub %x[x], %x[x], %x[y] \n\t" | 277 | | "bic %x[x], %x[x], %x[s1] \n\t" | 278 | | "and %x[s1], %x[s1], %x[y] \n\t" | 279 | | "orr %x[s1], %x[x], %x[s1] \n\t" | 280 | | "asr %x[x], %x[s1], 63" | 281 | | : | 282 | | [s1] "=&r" (s1), | 283 | | [x] "+&r" (x) | 284 | | : | 285 | | [y] "r" (y) | 286 | | : | 287 | | ); | 288 | | return (mbedtls_ct_condition_t) x; | 289 | | #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32) | 290 | | uint32_t s1; | 291 | | asm volatile ( | 292 | | ".syntax unified \n\t" | 293 | | #if defined(__thumb__) && !defined(__thumb2__) | 294 | | "movs %[s1], %[x] \n\t" | 295 | | "eors %[s1], %[s1], %[y] \n\t" | 296 | | #else | 297 | | "eors %[s1], %[x], %[y] \n\t" | 298 | | #endif | 299 | | "subs %[x], %[x], %[y] \n\t" | 300 | | "bics %[x], %[x], %[s1] \n\t" | 301 | | "ands %[y], %[s1], %[y] \n\t" | 302 | | "orrs %[x], %[x], %[y] \n\t" | 303 | | "asrs %[x], %[x], #31 \n\t" | 304 | | RESTORE_ASM_SYNTAX | 305 | | : | 306 | | [s1] "=&l" (s1), | 307 | | [x] "+&l" (x), | 308 | | [y] "+&l" (y) | 309 | | : | 310 | | : | 311 | | "cc" | 312 | | ); | 313 | | return (mbedtls_ct_condition_t) x; | 314 | | #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 315 | 22.3k | uint64_t s; | 316 | 22.3k | asm volatile ("mov %[x], %[s] \n\t" | 317 | 22.3k | "xor %[y], %[s] \n\t" | 318 | 22.3k | "sub %[y], %[x] \n\t" | 319 | 22.3k | "and %[s], %[y] \n\t" | 320 | 22.3k | "not %[s] \n\t" | 321 | 22.3k | "and %[s], %[x] \n\t" | 322 | 22.3k | "or %[y], %[x] \n\t" | 323 | 22.3k | "sar $63, %[x] \n\t" | 324 | 22.3k | : | 325 | 22.3k | [s] "=&a" (s), | 326 | 22.3k | [x] "+&D" (x), | 327 | 22.3k | [y] "+&S" (y) | 328 | 22.3k | : | 329 | 22.3k | : | 330 | 22.3k | ); | 331 | 22.3k | return (mbedtls_ct_condition_t) x; | 332 | | #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32) | 333 | | uint32_t s; | 334 | | asm volatile ("mov %[x], %[s] \n\t" | 335 | | "xor %[y], %[s] \n\t" | 336 | | "sub %[y], %[x] \n\t" | 337 | | "and %[s], %[y] \n\t" | 338 | | "not %[s] \n\t" | 339 | | "and %[s], %[x] \n\t" | 340 | | "or %[y], %[x] \n\t" | 341 | | "sar $31, %[x] \n\t" | 342 | | : | 343 | | [s] "=&b" (s), | 344 | | [x] "+&a" (x), | 345 | | [y] "+&c" (y) | 346 | | : | 347 | | : | 348 | | ); | 349 | | return (mbedtls_ct_condition_t) x; | 350 | | #else | 351 | | /* Ensure that the compiler cannot optimise the following operations over x and y, | 352 | | * even if it knows the value of x and y. | 353 | | */ | 354 | | const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x); | 355 | | const mbedtls_ct_uint_t yo = mbedtls_ct_compiler_opaque(y); | 356 | | /* | 357 | | * Check if the most significant bits (MSB) of the operands are different. | 358 | | * cond is true iff the MSBs differ. | 359 | | */ | 360 | | mbedtls_ct_condition_t cond = mbedtls_ct_bool((xo ^ yo) >> (MBEDTLS_CT_SIZE - 1)); | 361 | | | 362 | | /* | 363 | | * If the MSB are the same then the difference x-y will be negative (and | 364 | | * have its MSB set to 1 during conversion to unsigned) if and only if x<y. | 365 | | * | 366 | | * If the MSB are different, then the operand with the MSB of 1 is the | 367 | | * bigger. (That is if y has MSB of 1, then x<y is true and it is false if | 368 | | * the MSB of y is 0.) | 369 | | */ | 370 | | | 371 | | // Select either y, or x - y | 372 | | mbedtls_ct_uint_t ret = mbedtls_ct_if(cond, yo, (mbedtls_ct_uint_t) (xo - yo)); | 373 | | | 374 | | // Extract only the MSB of ret | 375 | | ret = ret >> (MBEDTLS_CT_SIZE - 1); | 376 | | | 377 | | // Convert to a condition (i.e., all bits set iff non-zero) | 378 | | return mbedtls_ct_bool(ret); | 379 | | #endif | 380 | 22.3k | } |
cipher.c:mbedtls_ct_uint_lt Line | Count | Source | 272 | 9 | { | 273 | | #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 274 | | uint64_t s1; | 275 | | asm volatile ("eor %x[s1], %x[y], %x[x] \n\t" | 276 | | "sub %x[x], %x[x], %x[y] \n\t" | 277 | | "bic %x[x], %x[x], %x[s1] \n\t" | 278 | | "and %x[s1], %x[s1], %x[y] \n\t" | 279 | | "orr %x[s1], %x[x], %x[s1] \n\t" | 280 | | "asr %x[x], %x[s1], 63" | 281 | | : | 282 | | [s1] "=&r" (s1), | 283 | | [x] "+&r" (x) | 284 | | : | 285 | | [y] "r" (y) | 286 | | : | 287 | | ); | 288 | | return (mbedtls_ct_condition_t) x; | 289 | | #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32) | 290 | | uint32_t s1; | 291 | | asm volatile ( | 292 | | ".syntax unified \n\t" | 293 | | #if defined(__thumb__) && !defined(__thumb2__) | 294 | | "movs %[s1], %[x] \n\t" | 295 | | "eors %[s1], %[s1], %[y] \n\t" | 296 | | #else | 297 | | "eors %[s1], %[x], %[y] \n\t" | 298 | | #endif | 299 | | "subs %[x], %[x], %[y] \n\t" | 300 | | "bics %[x], %[x], %[s1] \n\t" | 301 | | "ands %[y], %[s1], %[y] \n\t" | 302 | | "orrs %[x], %[x], %[y] \n\t" | 303 | | "asrs %[x], %[x], #31 \n\t" | 304 | | RESTORE_ASM_SYNTAX | 305 | | : | 306 | | [s1] "=&l" (s1), | 307 | | [x] "+&l" (x), | 308 | | [y] "+&l" (y) | 309 | | : | 310 | | : | 311 | | "cc" | 312 | | ); | 313 | | return (mbedtls_ct_condition_t) x; | 314 | | #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64)) | 315 | 9 | uint64_t s; | 316 | 9 | asm volatile ("mov %[x], %[s] \n\t" | 317 | 9 | "xor %[y], %[s] \n\t" | 318 | 9 | "sub %[y], %[x] \n\t" | 319 | 9 | "and %[s], %[y] \n\t" | 320 | 9 | "not %[s] \n\t" | 321 | 9 | "and %[s], %[x] \n\t" | 322 | 9 | "or %[y], %[x] \n\t" | 323 | 9 | "sar $63, %[x] \n\t" | 324 | 9 | : | 325 | 9 | [s] "=&a" (s), | 326 | 9 | [x] "+&D" (x), | 327 | 9 | [y] "+&S" (y) | 328 | 9 | : | 329 | 9 | : | 330 | 9 | ); | 331 | 9 | return (mbedtls_ct_condition_t) x; | 332 | | #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32) | 333 | | uint32_t s; | 334 | | asm volatile ("mov %[x], %[s] \n\t" | 335 | | "xor %[y], %[s] \n\t" | 336 | | "sub %[y], %[x] \n\t" | 337 | | "and %[s], %[y] \n\t" | 338 | | "not %[s] \n\t" | 339 | | "and %[s], %[x] \n\t" | 340 | | "or %[y], %[x] \n\t" | 341 | | "sar $31, %[x] \n\t" | 342 | | : | 343 | | [s] "=&b" (s), | 344 | | [x] "+&a" (x), | 345 | | [y] "+&c" (y) | 346 | | : | 347 | | : | 348 | | ); | 349 | | return (mbedtls_ct_condition_t) x; | 350 | | #else | 351 | | /* Ensure that the compiler cannot optimise the following operations over x and y, | 352 | | * even if it knows the value of x and y. | 353 | | */ | 354 | | const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x); | 355 | | const mbedtls_ct_uint_t yo = mbedtls_ct_compiler_opaque(y); | 356 | | /* | 357 | | * Check if the most significant bits (MSB) of the operands are different. | 358 | | * cond is true iff the MSBs differ. | 359 | | */ | 360 | | mbedtls_ct_condition_t cond = mbedtls_ct_bool((xo ^ yo) >> (MBEDTLS_CT_SIZE - 1)); | 361 | | | 362 | | /* | 363 | | * If the MSB are the same then the difference x-y will be negative (and | 364 | | * have its MSB set to 1 during conversion to unsigned) if and only if x<y. | 365 | | * | 366 | | * If the MSB are different, then the operand with the MSB of 1 is the | 367 | | * bigger. (That is if y has MSB of 1, then x<y is true and it is false if | 368 | | * the MSB of y is 0.) | 369 | | */ | 370 | | | 371 | | // Select either y, or x - y | 372 | | mbedtls_ct_uint_t ret = mbedtls_ct_if(cond, yo, (mbedtls_ct_uint_t) (xo - yo)); | 373 | | | 374 | | // Extract only the MSB of ret | 375 | | ret = ret >> (MBEDTLS_CT_SIZE - 1); | 376 | | | 377 | | // Convert to a condition (i.e., all bits set iff non-zero) | 378 | | return mbedtls_ct_bool(ret); | 379 | | #endif | 380 | 9 | } |
Unexecuted instantiation: cmac.c:mbedtls_ct_uint_lt Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_lt Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_lt Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_lt |
381 | | |
382 | | static inline mbedtls_ct_condition_t mbedtls_ct_uint_ne(mbedtls_ct_uint_t x, mbedtls_ct_uint_t y) |
383 | 3.10M | { |
384 | | /* diff = 0 if x == y, non-zero otherwise */ |
385 | 3.10M | const mbedtls_ct_uint_t diff = mbedtls_ct_compiler_opaque(x) ^ mbedtls_ct_compiler_opaque(y); |
386 | | |
387 | | /* all ones if x != y, 0 otherwise */ |
388 | 3.10M | return mbedtls_ct_bool(diff); |
389 | 3.10M | } Unexecuted instantiation: rsa.c:mbedtls_ct_uint_ne Unexecuted instantiation: bignum.c:mbedtls_ct_uint_ne bignum_core.c:mbedtls_ct_uint_ne Line | Count | Source | 383 | 3.10M | { | 384 | | /* diff = 0 if x == y, non-zero otherwise */ | 385 | 3.10M | const mbedtls_ct_uint_t diff = mbedtls_ct_compiler_opaque(x) ^ mbedtls_ct_compiler_opaque(y); | 386 | | | 387 | | /* all ones if x != y, 0 otherwise */ | 388 | 3.10M | return mbedtls_ct_bool(diff); | 389 | 3.10M | } |
cipher.c:mbedtls_ct_uint_ne Line | Count | Source | 383 | 9 | { | 384 | | /* diff = 0 if x == y, non-zero otherwise */ | 385 | 9 | const mbedtls_ct_uint_t diff = mbedtls_ct_compiler_opaque(x) ^ mbedtls_ct_compiler_opaque(y); | 386 | | | 387 | | /* all ones if x != y, 0 otherwise */ | 388 | 9 | return mbedtls_ct_bool(diff); | 389 | 9 | } |
Unexecuted instantiation: cmac.c:mbedtls_ct_uint_ne Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_ne Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_ne Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_ne |
390 | | |
391 | | static inline unsigned char mbedtls_ct_uchar_in_range_if(unsigned char low, |
392 | | unsigned char high, |
393 | | unsigned char c, |
394 | | unsigned char t) |
395 | 0 | { |
396 | 0 | const unsigned char co = (unsigned char) mbedtls_ct_compiler_opaque(c); |
397 | 0 | const unsigned char to = (unsigned char) mbedtls_ct_compiler_opaque(t); |
398 | 0 |
|
399 | 0 | /* low_mask is: 0 if low <= c, 0x...ff if low > c */ |
400 | 0 | unsigned low_mask = ((unsigned) co - low) >> 8; |
401 | 0 | /* high_mask is: 0 if c <= high, 0x...ff if c > high */ |
402 | 0 | unsigned high_mask = ((unsigned) high - co) >> 8; |
403 | 0 |
|
404 | 0 | return (unsigned char) (~(low_mask | high_mask)) & to; |
405 | 0 | } Unexecuted instantiation: rsa.c:mbedtls_ct_uchar_in_range_if Unexecuted instantiation: bignum.c:mbedtls_ct_uchar_in_range_if Unexecuted instantiation: bignum_core.c:mbedtls_ct_uchar_in_range_if Unexecuted instantiation: cipher.c:mbedtls_ct_uchar_in_range_if Unexecuted instantiation: cmac.c:mbedtls_ct_uchar_in_range_if Unexecuted instantiation: constant_time.c:mbedtls_ct_uchar_in_range_if Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uchar_in_range_if Unexecuted instantiation: nist_kw.c:mbedtls_ct_uchar_in_range_if |
406 | | |
407 | | /* ============================================================================ |
408 | | * Everything below here is trivial wrapper functions |
409 | | */ |
410 | | |
411 | | static inline size_t mbedtls_ct_size_if(mbedtls_ct_condition_t condition, |
412 | | size_t if1, |
413 | | size_t if0) |
414 | 0 | { |
415 | 0 | return (size_t) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1, (mbedtls_ct_uint_t) if0); |
416 | 0 | } Unexecuted instantiation: rsa.c:mbedtls_ct_size_if Unexecuted instantiation: bignum.c:mbedtls_ct_size_if Unexecuted instantiation: bignum_core.c:mbedtls_ct_size_if Unexecuted instantiation: cipher.c:mbedtls_ct_size_if Unexecuted instantiation: cmac.c:mbedtls_ct_size_if Unexecuted instantiation: constant_time.c:mbedtls_ct_size_if Unexecuted instantiation: ecp_curves.c:mbedtls_ct_size_if Unexecuted instantiation: nist_kw.c:mbedtls_ct_size_if |
417 | | |
418 | | static inline unsigned mbedtls_ct_uint_if(mbedtls_ct_condition_t condition, |
419 | | unsigned if1, |
420 | | unsigned if0) |
421 | 3.48M | { |
422 | 3.48M | return (unsigned) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1, (mbedtls_ct_uint_t) if0); |
423 | 3.48M | } Unexecuted instantiation: rsa.c:mbedtls_ct_uint_if bignum.c:mbedtls_ct_uint_if Line | Count | Source | 421 | 3.48M | { | 422 | 3.48M | return (unsigned) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1, (mbedtls_ct_uint_t) if0); | 423 | 3.48M | } |
Unexecuted instantiation: bignum_core.c:mbedtls_ct_uint_if Unexecuted instantiation: cipher.c:mbedtls_ct_uint_if Unexecuted instantiation: cmac.c:mbedtls_ct_uint_if Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_if Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_if Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_if |
424 | | |
425 | | static inline mbedtls_ct_condition_t mbedtls_ct_bool_if(mbedtls_ct_condition_t condition, |
426 | | mbedtls_ct_condition_t if1, |
427 | | mbedtls_ct_condition_t if0) |
428 | 0 | { |
429 | 0 | return (mbedtls_ct_condition_t) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1, |
430 | 0 | (mbedtls_ct_uint_t) if0); |
431 | 0 | } Unexecuted instantiation: rsa.c:mbedtls_ct_bool_if Unexecuted instantiation: bignum.c:mbedtls_ct_bool_if Unexecuted instantiation: bignum_core.c:mbedtls_ct_bool_if Unexecuted instantiation: cipher.c:mbedtls_ct_bool_if Unexecuted instantiation: cmac.c:mbedtls_ct_bool_if Unexecuted instantiation: constant_time.c:mbedtls_ct_bool_if Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool_if Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool_if |
432 | | |
433 | | #if defined(MBEDTLS_BIGNUM_C) |
434 | | |
435 | | static inline mbedtls_mpi_uint mbedtls_ct_mpi_uint_if(mbedtls_ct_condition_t condition, |
436 | | mbedtls_mpi_uint if1, |
437 | | mbedtls_mpi_uint if0) |
438 | 150M | { |
439 | 150M | return (mbedtls_mpi_uint) mbedtls_ct_if(condition, |
440 | 150M | (mbedtls_ct_uint_t) if1, |
441 | 150M | (mbedtls_ct_uint_t) if0); |
442 | 150M | } Unexecuted instantiation: rsa.c:mbedtls_ct_mpi_uint_if Unexecuted instantiation: bignum.c:mbedtls_ct_mpi_uint_if bignum_core.c:mbedtls_ct_mpi_uint_if Line | Count | Source | 438 | 150M | { | 439 | 150M | return (mbedtls_mpi_uint) mbedtls_ct_if(condition, | 440 | 150M | (mbedtls_ct_uint_t) if1, | 441 | 150M | (mbedtls_ct_uint_t) if0); | 442 | 150M | } |
Unexecuted instantiation: cipher.c:mbedtls_ct_mpi_uint_if Unexecuted instantiation: cmac.c:mbedtls_ct_mpi_uint_if Unexecuted instantiation: constant_time.c:mbedtls_ct_mpi_uint_if Unexecuted instantiation: ecp_curves.c:mbedtls_ct_mpi_uint_if Unexecuted instantiation: nist_kw.c:mbedtls_ct_mpi_uint_if |
443 | | |
444 | | #endif |
445 | | |
446 | | static inline size_t mbedtls_ct_size_if_else_0(mbedtls_ct_condition_t condition, size_t if1) |
447 | 16 | { |
448 | 16 | return (size_t) (condition & if1); |
449 | 16 | } Unexecuted instantiation: rsa.c:mbedtls_ct_size_if_else_0 bignum.c:mbedtls_ct_size_if_else_0 Line | Count | Source | 447 | 16 | { | 448 | 16 | return (size_t) (condition & if1); | 449 | 16 | } |
Unexecuted instantiation: bignum_core.c:mbedtls_ct_size_if_else_0 Unexecuted instantiation: cipher.c:mbedtls_ct_size_if_else_0 Unexecuted instantiation: cmac.c:mbedtls_ct_size_if_else_0 Unexecuted instantiation: constant_time.c:mbedtls_ct_size_if_else_0 Unexecuted instantiation: ecp_curves.c:mbedtls_ct_size_if_else_0 Unexecuted instantiation: nist_kw.c:mbedtls_ct_size_if_else_0 |
450 | | |
451 | | static inline unsigned mbedtls_ct_uint_if_else_0(mbedtls_ct_condition_t condition, unsigned if1) |
452 | 20 | { |
453 | 20 | return (unsigned) (condition & if1); |
454 | 20 | } Unexecuted instantiation: rsa.c:mbedtls_ct_uint_if_else_0 bignum.c:mbedtls_ct_uint_if_else_0 Line | Count | Source | 452 | 16 | { | 453 | 16 | return (unsigned) (condition & if1); | 454 | 16 | } |
Unexecuted instantiation: bignum_core.c:mbedtls_ct_uint_if_else_0 Unexecuted instantiation: cipher.c:mbedtls_ct_uint_if_else_0 cmac.c:mbedtls_ct_uint_if_else_0 Line | Count | Source | 452 | 4 | { | 453 | 4 | return (unsigned) (condition & if1); | 454 | 4 | } |
Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_if_else_0 Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_if_else_0 Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_if_else_0 |
455 | | |
456 | | static inline mbedtls_ct_condition_t mbedtls_ct_bool_if_else_0(mbedtls_ct_condition_t condition, |
457 | | mbedtls_ct_condition_t if1) |
458 | 0 | { |
459 | 0 | return (mbedtls_ct_condition_t) (condition & if1); |
460 | 0 | } Unexecuted instantiation: rsa.c:mbedtls_ct_bool_if_else_0 Unexecuted instantiation: bignum.c:mbedtls_ct_bool_if_else_0 Unexecuted instantiation: bignum_core.c:mbedtls_ct_bool_if_else_0 Unexecuted instantiation: cipher.c:mbedtls_ct_bool_if_else_0 Unexecuted instantiation: cmac.c:mbedtls_ct_bool_if_else_0 Unexecuted instantiation: constant_time.c:mbedtls_ct_bool_if_else_0 Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool_if_else_0 Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool_if_else_0 |
461 | | |
462 | | #if defined(MBEDTLS_BIGNUM_C) |
463 | | |
464 | | static inline mbedtls_mpi_uint mbedtls_ct_mpi_uint_if_else_0(mbedtls_ct_condition_t condition, |
465 | | mbedtls_mpi_uint if1) |
466 | 8.76k | { |
467 | 8.76k | return (mbedtls_mpi_uint) (condition & if1); |
468 | 8.76k | } Unexecuted instantiation: rsa.c:mbedtls_ct_mpi_uint_if_else_0 bignum.c:mbedtls_ct_mpi_uint_if_else_0 Line | Count | Source | 466 | 8.76k | { | 467 | 8.76k | return (mbedtls_mpi_uint) (condition & if1); | 468 | 8.76k | } |
Unexecuted instantiation: bignum_core.c:mbedtls_ct_mpi_uint_if_else_0 Unexecuted instantiation: cipher.c:mbedtls_ct_mpi_uint_if_else_0 Unexecuted instantiation: cmac.c:mbedtls_ct_mpi_uint_if_else_0 Unexecuted instantiation: constant_time.c:mbedtls_ct_mpi_uint_if_else_0 Unexecuted instantiation: ecp_curves.c:mbedtls_ct_mpi_uint_if_else_0 Unexecuted instantiation: nist_kw.c:mbedtls_ct_mpi_uint_if_else_0 |
469 | | |
470 | | #endif /* MBEDTLS_BIGNUM_C */ |
471 | | |
472 | | static inline int mbedtls_ct_error_if(mbedtls_ct_condition_t condition, int if1, int if0) |
473 | 0 | { |
474 | | /* Coverting int -> uint -> int here is safe, because we require if1 and if0 to be |
475 | | * in the range -32767..0, and we require 32-bit int and uint types. |
476 | | * |
477 | | * This means that (0 <= -if0 < INT_MAX), so negating if0 is safe, and similarly for |
478 | | * converting back to int. |
479 | | */ |
480 | 0 | return -((int) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) (-if1), |
481 | 0 | (mbedtls_ct_uint_t) (-if0))); |
482 | 0 | } Unexecuted instantiation: rsa.c:mbedtls_ct_error_if Unexecuted instantiation: bignum.c:mbedtls_ct_error_if Unexecuted instantiation: bignum_core.c:mbedtls_ct_error_if Unexecuted instantiation: cipher.c:mbedtls_ct_error_if Unexecuted instantiation: cmac.c:mbedtls_ct_error_if Unexecuted instantiation: constant_time.c:mbedtls_ct_error_if Unexecuted instantiation: ecp_curves.c:mbedtls_ct_error_if Unexecuted instantiation: nist_kw.c:mbedtls_ct_error_if |
483 | | |
484 | | static inline int mbedtls_ct_error_if_else_0(mbedtls_ct_condition_t condition, int if1) |
485 | 1 | { |
486 | 1 | return -((int) (condition & (-if1))); |
487 | 1 | } Unexecuted instantiation: rsa.c:mbedtls_ct_error_if_else_0 Unexecuted instantiation: bignum.c:mbedtls_ct_error_if_else_0 Unexecuted instantiation: bignum_core.c:mbedtls_ct_error_if_else_0 cipher.c:mbedtls_ct_error_if_else_0 Line | Count | Source | 485 | 1 | { | 486 | 1 | return -((int) (condition & (-if1))); | 487 | 1 | } |
Unexecuted instantiation: cmac.c:mbedtls_ct_error_if_else_0 Unexecuted instantiation: constant_time.c:mbedtls_ct_error_if_else_0 Unexecuted instantiation: ecp_curves.c:mbedtls_ct_error_if_else_0 Unexecuted instantiation: nist_kw.c:mbedtls_ct_error_if_else_0 |
488 | | |
489 | | static inline mbedtls_ct_condition_t mbedtls_ct_uint_eq(mbedtls_ct_uint_t x, |
490 | | mbedtls_ct_uint_t y) |
491 | 3.10M | { |
492 | 3.10M | return ~mbedtls_ct_uint_ne(x, y); |
493 | 3.10M | } Unexecuted instantiation: rsa.c:mbedtls_ct_uint_eq Unexecuted instantiation: bignum.c:mbedtls_ct_uint_eq bignum_core.c:mbedtls_ct_uint_eq Line | Count | Source | 491 | 3.10M | { | 492 | 3.10M | return ~mbedtls_ct_uint_ne(x, y); | 493 | 3.10M | } |
cipher.c:mbedtls_ct_uint_eq Line | Count | Source | 491 | 1 | { | 492 | 1 | return ~mbedtls_ct_uint_ne(x, y); | 493 | 1 | } |
Unexecuted instantiation: cmac.c:mbedtls_ct_uint_eq Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_eq Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_eq Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_eq |
494 | | |
495 | | static inline mbedtls_ct_condition_t mbedtls_ct_uint_gt(mbedtls_ct_uint_t x, |
496 | | mbedtls_ct_uint_t y) |
497 | 1 | { |
498 | 1 | return mbedtls_ct_uint_lt(y, x); |
499 | 1 | } Unexecuted instantiation: rsa.c:mbedtls_ct_uint_gt Unexecuted instantiation: bignum.c:mbedtls_ct_uint_gt Unexecuted instantiation: bignum_core.c:mbedtls_ct_uint_gt cipher.c:mbedtls_ct_uint_gt Line | Count | Source | 497 | 1 | { | 498 | 1 | return mbedtls_ct_uint_lt(y, x); | 499 | 1 | } |
Unexecuted instantiation: cmac.c:mbedtls_ct_uint_gt Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_gt Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_gt Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_gt |
500 | | |
501 | | static inline mbedtls_ct_condition_t mbedtls_ct_uint_ge(mbedtls_ct_uint_t x, |
502 | | mbedtls_ct_uint_t y) |
503 | 2.03k | { |
504 | 2.03k | return ~mbedtls_ct_uint_lt(x, y); |
505 | 2.03k | } Unexecuted instantiation: rsa.c:mbedtls_ct_uint_ge Unexecuted instantiation: bignum.c:mbedtls_ct_uint_ge bignum_core.c:mbedtls_ct_uint_ge Line | Count | Source | 503 | 2.02k | { | 504 | 2.02k | return ~mbedtls_ct_uint_lt(x, y); | 505 | 2.02k | } |
cipher.c:mbedtls_ct_uint_ge Line | Count | Source | 503 | 8 | { | 504 | 8 | return ~mbedtls_ct_uint_lt(x, y); | 505 | 8 | } |
Unexecuted instantiation: cmac.c:mbedtls_ct_uint_ge Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_ge Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_ge Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_ge |
506 | | |
507 | | static inline mbedtls_ct_condition_t mbedtls_ct_uint_le(mbedtls_ct_uint_t x, |
508 | | mbedtls_ct_uint_t y) |
509 | 0 | { |
510 | 0 | return ~mbedtls_ct_uint_gt(x, y); |
511 | 0 | } Unexecuted instantiation: rsa.c:mbedtls_ct_uint_le Unexecuted instantiation: bignum.c:mbedtls_ct_uint_le Unexecuted instantiation: bignum_core.c:mbedtls_ct_uint_le Unexecuted instantiation: cipher.c:mbedtls_ct_uint_le Unexecuted instantiation: cmac.c:mbedtls_ct_uint_le Unexecuted instantiation: constant_time.c:mbedtls_ct_uint_le Unexecuted instantiation: ecp_curves.c:mbedtls_ct_uint_le Unexecuted instantiation: nist_kw.c:mbedtls_ct_uint_le |
512 | | |
513 | | static inline mbedtls_ct_condition_t mbedtls_ct_bool_ne(mbedtls_ct_condition_t x, |
514 | | mbedtls_ct_condition_t y) |
515 | 16 | { |
516 | 16 | return (mbedtls_ct_condition_t) (x ^ y); |
517 | 16 | } Unexecuted instantiation: rsa.c:mbedtls_ct_bool_ne bignum.c:mbedtls_ct_bool_ne Line | Count | Source | 515 | 16 | { | 516 | 16 | return (mbedtls_ct_condition_t) (x ^ y); | 517 | 16 | } |
Unexecuted instantiation: bignum_core.c:mbedtls_ct_bool_ne Unexecuted instantiation: cipher.c:mbedtls_ct_bool_ne Unexecuted instantiation: cmac.c:mbedtls_ct_bool_ne Unexecuted instantiation: constant_time.c:mbedtls_ct_bool_ne Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool_ne Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool_ne |
518 | | |
519 | | static inline mbedtls_ct_condition_t mbedtls_ct_bool_and(mbedtls_ct_condition_t x, |
520 | | mbedtls_ct_condition_t y) |
521 | 12.2k | { |
522 | 12.2k | return (mbedtls_ct_condition_t) (x & y); |
523 | 12.2k | } Unexecuted instantiation: rsa.c:mbedtls_ct_bool_and bignum.c:mbedtls_ct_bool_and Line | Count | Source | 521 | 32 | { | 522 | 32 | return (mbedtls_ct_condition_t) (x & y); | 523 | 32 | } |
bignum_core.c:mbedtls_ct_bool_and Line | Count | Source | 521 | 12.1k | { | 522 | 12.1k | return (mbedtls_ct_condition_t) (x & y); | 523 | 12.1k | } |
cipher.c:mbedtls_ct_bool_and Line | Count | Source | 521 | 8 | { | 522 | 8 | return (mbedtls_ct_condition_t) (x & y); | 523 | 8 | } |
Unexecuted instantiation: cmac.c:mbedtls_ct_bool_and Unexecuted instantiation: constant_time.c:mbedtls_ct_bool_and Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool_and Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool_and |
524 | | |
525 | | static inline mbedtls_ct_condition_t mbedtls_ct_bool_or(mbedtls_ct_condition_t x, |
526 | | mbedtls_ct_condition_t y) |
527 | 40.5k | { |
528 | 40.5k | return (mbedtls_ct_condition_t) (x | y); |
529 | 40.5k | } Unexecuted instantiation: rsa.c:mbedtls_ct_bool_or bignum.c:mbedtls_ct_bool_or Line | Count | Source | 527 | 16 | { | 528 | 16 | return (mbedtls_ct_condition_t) (x | y); | 529 | 16 | } |
bignum_core.c:mbedtls_ct_bool_or Line | Count | Source | 527 | 40.5k | { | 528 | 40.5k | return (mbedtls_ct_condition_t) (x | y); | 529 | 40.5k | } |
cipher.c:mbedtls_ct_bool_or Line | Count | Source | 527 | 9 | { | 528 | 9 | return (mbedtls_ct_condition_t) (x | y); | 529 | 9 | } |
Unexecuted instantiation: cmac.c:mbedtls_ct_bool_or Unexecuted instantiation: constant_time.c:mbedtls_ct_bool_or Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool_or Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool_or |
530 | | |
531 | | static inline mbedtls_ct_condition_t mbedtls_ct_bool_not(mbedtls_ct_condition_t x) |
532 | 3.49M | { |
533 | 3.49M | return (mbedtls_ct_condition_t) (~x); |
534 | 3.49M | } Unexecuted instantiation: rsa.c:mbedtls_ct_bool_not bignum.c:mbedtls_ct_bool_not Line | Count | Source | 532 | 3.48M | { | 533 | 3.48M | return (mbedtls_ct_condition_t) (~x); | 534 | 3.48M | } |
bignum_core.c:mbedtls_ct_bool_not Line | Count | Source | 532 | 10.1k | { | 533 | 10.1k | return (mbedtls_ct_condition_t) (~x); | 534 | 10.1k | } |
Unexecuted instantiation: cipher.c:mbedtls_ct_bool_not Unexecuted instantiation: cmac.c:mbedtls_ct_bool_not Unexecuted instantiation: constant_time.c:mbedtls_ct_bool_not Unexecuted instantiation: ecp_curves.c:mbedtls_ct_bool_not Unexecuted instantiation: nist_kw.c:mbedtls_ct_bool_not |
535 | | |
536 | | #if defined(MBEDTLS_COMPILER_IS_GCC) && (__GNUC__ > 4) |
537 | | /* Restore warnings for -Wredundant-decls on gcc */ |
538 | | #pragma GCC diagnostic pop |
539 | | #endif |
540 | | |
541 | | #endif /* MBEDTLS_CONSTANT_TIME_IMPL_H */ |