_ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEmEET_S2_:
   28|   374k|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) {
   29|   374k|   const T top = CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1));
   30|   374k|   return static_cast<T>(0) - top;
   31|   374k|}
_ZN5Botan6chooseITkNSt3__117unsigned_integralEmEET_S2_S2_S2_:
  217|  9.18k|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) {
  218|       |   //return (mask & a) | (~mask & b);
  219|  9.18k|   return (b ^ (mask & (a ^ b)));
  220|  9.18k|}
_ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEmEET_S2_:
   37|   115k|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) {
   38|   115k|   return ct_expand_top_bit<T>(~x & (x - 1));
   39|   115k|}
_ZN5Botan8high_bitITkNSt3__117unsigned_integralEmEEmT_:
   73|  3.96k|BOTAN_FORCE_INLINE constexpr size_t high_bit(T n) {
   74|  3.96k|   size_t hb = 0;
   75|       |
   76|  27.7k|   for(size_t s = 8 * sizeof(T) / 2; s > 0; s /= 2) {
  ------------------
  |  Branch (76:38): [True: 23.7k, False: 3.96k]
  ------------------
   77|       |      // Equivalent to: ((n >> s) == 0) ? 0 : s;
   78|  23.7k|      const size_t z = s - ct_if_is_zero_ret<T>(n >> s, s);
   79|  23.7k|      hb += z;
   80|  23.7k|      n >>= z;
   81|  23.7k|   }
   82|       |
   83|  3.96k|   hb += static_cast<size_t>(n);
   84|       |
   85|  3.96k|   return hb;
   86|  3.96k|}
_ZN5Botan17ct_if_is_zero_retITkNSt3__117unsigned_integralEmEEmT_m:
   45|  23.7k|BOTAN_FORCE_INLINE constexpr size_t ct_if_is_zero_ret(T x, size_t s) {
   46|       |   /*
   47|       |   Similar to `return ct_is_zero(x) & s` but has to account for possibility that
   48|       |   sizeof(T) is smaller than sizeof(size_t) which would lead to incomplete masking
   49|       |   */
   50|  23.7k|   const T a = ~x & (x - 1);
   51|  23.7k|   const size_t a_top = static_cast<size_t>(CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1)));
   52|  23.7k|   const size_t mask = static_cast<size_t>(0) - a_top;
   53|  23.7k|   return mask & s;
   54|  23.7k|}
_ZN5Botan13ceil_divisionITkNSt3__117unsigned_integralEmEET_S2_S2_:
  167|  1.66k|BOTAN_FORCE_INLINE constexpr T ceil_division(T a, T b) {
  168|       |   // Same as `(a + b - 1) / b` but avoids possible overflow
  169|  1.66k|   return a / b + ((a % b != 0) ? 1 : 0);
  ------------------
  |  Branch (169:20): [True: 1.52k, False: 140]
  ------------------
  170|  1.66k|}
_ZN5Botan10ct_is_zeroITkNSt3__117unsigned_integralEhEET_S2_:
   37|  3.28k|BOTAN_FORCE_INLINE constexpr T ct_is_zero(T x) {
   38|  3.28k|   return ct_expand_top_bit<T>(~x & (x - 1));
   39|  3.28k|}
_ZN5Botan17ct_expand_top_bitITkNSt3__117unsigned_integralEhEET_S2_:
   28|  3.28k|BOTAN_FORCE_INLINE constexpr T ct_expand_top_bit(T a) {
   29|  3.28k|   const T top = CT::value_barrier<T>(a >> (sizeof(T) * 8 - 1));
   30|  3.28k|   return static_cast<T>(0) - top;
   31|  3.28k|}
_ZN5Botan6chooseITkNSt3__117unsigned_integralEhEET_S2_S2_S2_:
  217|  3.28k|BOTAN_FORCE_INLINE constexpr T choose(T mask, T a, T b) {
  218|       |   //return (mask & a) | (~mask & b);
  219|  3.28k|   return (b ^ (mask & (a ^ b)));
  220|  3.28k|}

_ZN5Botan13reverse_bytesITkNSt3__117unsigned_integralEmQooooooeqstT_Li1EeqstS2_Li2EeqstS2_Li4EeqstS2_Li8EEES2_S2_:
   25|  15.0k|inline constexpr T reverse_bytes(T x) {
   26|       |   if constexpr(sizeof(T) == 1) {
   27|       |      return x;
   28|       |   } else if constexpr(sizeof(T) == 2) {
   29|       |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap16)
   30|       |      return static_cast<T>(__builtin_bswap16(x));
   31|       |#else
   32|       |      return static_cast<T>((x << 8) | (x >> 8));
   33|       |#endif
   34|       |   } else if constexpr(sizeof(T) == 4) {
   35|       |#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap32)
   36|       |      return static_cast<T>(__builtin_bswap32(x));
   37|       |#else
   38|       |      // MSVC at least recognizes this as a bswap
   39|       |      return static_cast<T>(((x & 0x000000FF) << 24) | ((x & 0x0000FF00) << 8) | ((x & 0x00FF0000) >> 8) |
   40|       |                            ((x & 0xFF000000) >> 24));
   41|       |#endif
   42|  15.0k|   } else if constexpr(sizeof(T) == 8) {
   43|  15.0k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_bswap64)
   44|  15.0k|      return static_cast<T>(__builtin_bswap64(x));
   45|       |#else
   46|       |      uint32_t hi = static_cast<uint32_t>(x >> 32);
   47|       |      uint32_t lo = static_cast<uint32_t>(x);
   48|       |
   49|       |      hi = reverse_bytes(hi);
   50|       |      lo = reverse_bytes(lo);
   51|       |
   52|       |      return (static_cast<T>(lo) << 32) | hi;
   53|       |#endif
   54|  15.0k|   }
   55|  15.0k|}

_ZN5Botan5CPUID3hasENS_10CPUFeatureES1_:
   98|     32|      static bool has(CPUID::Feature feat1, CPUID::Feature feat2) {
   99|     32|         return state().has_bit(feat1.as_u32() | feat2.as_u32());
  100|     32|      }
_ZN5Botan5CPUID5stateEv:
  155|     32|      static CPUID_Data& state() {
  156|     32|         static CPUID::CPUID_Data g_cpuid;
  157|     32|         return g_cpuid;
  158|     32|      }
_ZNK5Botan5CPUID10CPUID_Data7has_bitEj:
  143|     32|            bool has_bit(uint32_t bit) const { return (m_processor_features & bit) == bit; }
_ZN5Botan5CPUID6is_setEjNS_10CPUFeatureE:
  126|      5|      static inline bool is_set(uint32_t allowed, CPUID::Feature bit) {
  127|      5|         const uint32_t feat_bit = bit.as_u32();
  128|      5|         return ((allowed & feat_bit) == feat_bit);
  129|      5|      }
cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE16x86_CPUID_1_bitsEEjmT_NS_10CPUFeatureEj:
  116|      7|      static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) {
  117|      7|         const uint64_t flag64 = static_cast<uint64_t>(flag);
  118|      7|         if((cpuid & flag64) == flag64) {
  ------------------
  |  Branch (118:13): [True: 7, False: 0]
  ------------------
  119|      7|            return (bit.as_u32() & allowed);
  120|      7|         } else {
  121|      0|            return 0;
  122|      0|         }
  123|      7|      }
cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE16x86_CPUID_7_bitsEEjmT_NS_10CPUFeatureEj:
  116|      8|      static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) {
  117|      8|         const uint64_t flag64 = static_cast<uint64_t>(flag);
  118|      8|         if((cpuid & flag64) == flag64) {
  ------------------
  |  Branch (118:13): [True: 5, False: 3]
  ------------------
  119|      5|            return (bit.as_u32() & allowed);
  120|      5|         } else {
  121|      3|            return 0;
  122|      3|         }
  123|      8|      }
cpuid_x86.cpp:_ZN5Botan5CPUID6if_setIZNS0_10CPUID_Data19detect_cpu_featuresEjE18x86_CPUID_7_1_bitsEEjmT_NS_10CPUFeatureEj:
  116|      3|      static inline uint32_t if_set(uint64_t cpuid, T flag, CPUID::Feature bit, uint32_t allowed) {
  117|      3|         const uint64_t flag64 = static_cast<uint64_t>(flag);
  118|      3|         if((cpuid & flag64) == flag64) {
  ------------------
  |  Branch (118:13): [True: 0, False: 3]
  ------------------
  119|      0|            return (bit.as_u32() & allowed);
  120|      3|         } else {
  121|      3|            return 0;
  122|      3|         }
  123|      3|      }

_ZNK5Botan10CPUFeature6as_u32Ev:
   56|     81|      uint32_t as_u32() const { return static_cast<uint32_t>(m_bit); }
_ZN5Botan10CPUFeatureC2ENS0_3BitE:
   54|     87|      CPUFeature(Bit b) : m_bit(b) {}  // NOLINT(*-explicit-conversions,*-explicit-constructor)

_ZN5Botan2CT4MaskImE8is_equalEmm:
  442|  20.6k|      static constexpr Mask<T> is_equal(T x, T y) {
  443|  20.6k|         const T diff = value_barrier(x) ^ value_barrier(y);
  444|  20.6k|         return Mask<T>::is_zero(diff);
  445|  20.6k|      }
_ZN5Botan2CT4MaskImE5is_ltEmm:
  450|   157k|      static constexpr Mask<T> is_lt(T x, T y) {
  451|   157k|         T u = x ^ ((x ^ y) | ((x - y) ^ x));
  452|   157k|         return Mask<T>::expand_top_bit(u);
  453|   157k|      }
_ZN5Botan2CT4MaskImE14expand_top_bitEm:
  415|   258k|      static constexpr Mask<T> expand_top_bit(T v) { return Mask<T>(ct_expand_top_bit<T>(v)); }
_ZN5Botan2CT4MaskImEC2Em:
  637|   544k|      constexpr explicit Mask(T m) : m_mask(m) {}
_ZNK5Botan2CT4MaskImE6selectEmm:
  548|  9.09k|      constexpr T select(T x, T y) const { return choose(value(), x, y); }
_ZNK5Botan2CT4MaskImE5valueEv:
  630|   698k|      constexpr T value() const { return value_barrier<T>(m_mask); }
_ZN5Botan2CT4MaskImE7is_zeroEm:
  437|  30.8k|      static constexpr Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(value_barrier<T>(x))); }
_ZN5Botan2CT8unpoisonITkNSt3__18integralEmEEvRKT_:
  112|  11.8k|constexpr void unpoison(const T& p) {
  113|  11.8k|   unpoison(&p, 1);
  114|  11.8k|}
_ZN5Botan2CT8unpoisonImEEvPKT_m:
   67|  24.9k|constexpr inline void unpoison(const T* p, size_t n) {
   68|       |#if defined(BOTAN_HAS_VALGRIND)
   69|       |   if(!std::is_constant_evaluated()) {
   70|       |      VALGRIND_MAKE_MEM_DEFINED(p, n * sizeof(T));
   71|       |   }
   72|       |#endif
   73|       |
   74|  24.9k|   BOTAN_UNUSED(p, n);
  ------------------
  |  |  151|  24.9k|#define BOTAN_UNUSED Botan::ignore_params
  ------------------
   75|  24.9k|}
_ZNK5Botan2CT4MaskImE13if_set_returnEm:
  538|   295k|      constexpr T if_set_return(T x) const { return value() & x; }
_ZN5Botan2CT4MaskImE5is_gtEmm:
  458|  34.0k|      static constexpr Mask<T> is_gt(T x, T y) { return Mask<T>::is_lt(y, x); }
_ZN5Botan2CT4MaskImE6is_gteEmm:
  468|   117k|      static constexpr Mask<T> is_gte(T x, T y) { return ~Mask<T>::is_lt(x, y); }
_ZNK5Botan2CT4MaskImEcoEv:
  533|   124k|      constexpr Mask<T> operator~() const { return Mask<T>(~value()); }
_ZN5Botan2CT4MaskImE6expandEm:
  392|  7.79k|      static constexpr Mask<T> expand(T v) { return ~Mask<T>::is_zero(value_barrier<T>(v)); }
_ZNK5Botan2CT4MaskImE16unpoisoned_valueEv:
  598|  4.09k|      constexpr T unpoisoned_value() const {
  599|  4.09k|         T r = value();
  600|  4.09k|         CT::unpoison(r);
  601|  4.09k|         return r;
  602|  4.09k|      }
_ZNK5Botan2CT4MaskImE7as_boolEv:
  614|  4.09k|      constexpr bool as_bool() const { return unpoisoned_value() != 0; }
_ZNK5Botan2CT4MaskImE11select_maskES2_S2_:
  559|  5.34k|      Mask<T> select_mask(Mask<T> x, Mask<T> y) const { return Mask<T>(select(x.value(), y.value())); }
_ZN5Botan2CT4MaskImEoRES2_:
  510|  1.58k|      Mask<T>& operator|=(Mask<T> o) {
  511|  1.58k|         m_mask |= o.value();
  512|  1.58k|         return (*this);
  513|  1.58k|      }
_ZN5Botan2CT4MaskImEaNES2_:
  494|      6|      Mask<T>& operator&=(Mask<T> o) {
  495|      6|         m_mask &= o.value();
  496|      6|         return (*this);
  497|      6|      }
_ZNK5Botan2CT4MaskImE8select_nEPmPKmS5_m:
  565|      6|      constexpr void select_n(T output[], const T x[], const T y[], size_t len) const {
  566|      6|         const T mask = value();
  567|    102|         for(size_t i = 0; i != len; ++i) {
  ------------------
  |  Branch (567:28): [True: 96, False: 6]
  ------------------
  568|     96|            output[i] = choose(mask, x[i], y[i]);
  569|     96|         }
  570|      6|      }
_ZN5Botan2CT4MaskIhE11expand_boolEb:
  397|  3.28k|      static constexpr Mask<T> expand_bool(bool v) { return Mask<T>::expand(static_cast<T>(v)); }
_ZN5Botan2CT4MaskIhE6expandEh:
  392|  3.28k|      static constexpr Mask<T> expand(T v) { return ~Mask<T>::is_zero(value_barrier<T>(v)); }
_ZN5Botan2CT4MaskIhE7is_zeroEh:
  437|  3.28k|      static constexpr Mask<T> is_zero(T x) { return Mask<T>(ct_is_zero<T>(value_barrier<T>(x))); }
_ZN5Botan2CT4MaskIhEC2Eh:
  637|  6.56k|      constexpr explicit Mask(T m) : m_mask(m) {}
_ZNK5Botan2CT4MaskIhEcoEv:
  533|  3.28k|      constexpr Mask<T> operator~() const { return Mask<T>(~value()); }
_ZNK5Botan2CT4MaskIhE5valueEv:
  630|  6.56k|      constexpr T value() const { return value_barrier<T>(m_mask); }
_ZNK5Botan2CT4MaskIhE6selectEhh:
  548|  3.28k|      constexpr T select(T x, T y) const { return choose(value(), x, y); }
_ZN5Botan2CTorENS0_4MaskImEES2_:
  528|   112k|      friend constexpr Mask<T> operator|(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() | y.value()); }
_ZN5Botan2CTanENS0_4MaskImEES2_:
  518|  11.9k|      friend constexpr Mask<T> operator&(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() & y.value()); }
_ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES3_PS3_PKS3_S7_m:
  738|      6|constexpr inline Mask<T> conditional_copy_mem(T cnd, T* dest, const T* if_set, const T* if_unset, size_t elems) {
  739|      6|   const auto mask = CT::Mask<T>::expand(cnd);
  740|      6|   return CT::conditional_copy_mem(mask, dest, if_set, if_unset, elems);
  741|      6|}
_ZN5Botan2CT20conditional_copy_memImEENS0_4MaskIT_EES4_PS3_PKS3_S7_m:
  732|      6|constexpr inline Mask<T> conditional_copy_mem(Mask<T> mask, T* dest, const T* if_set, const T* if_unset, size_t elems) {
  733|      6|   mask.select_n(dest, if_set, if_unset, elems);
  734|      6|   return mask;
  735|      6|}
_ZN5Botan2CTeoENS0_4MaskImEES2_:
  523|      3|      friend constexpr Mask<T> operator^(Mask<T> x, Mask<T> y) { return Mask<T>(x.value() ^ y.value()); }

_ZN5Botan11checked_mulITkNSt3__117unsigned_integralEmEENS1_8optionalIT_EES3_S3_:
   46|  11.4k|constexpr inline std::optional<T> checked_mul(T a, T b) {
   47|       |   // Multiplication by 1U is a hack to work around C's insane
   48|       |   // integer promotion rules.
   49|       |   // https://stackoverflow.com/questions/24795651
   50|  11.4k|   const T r = (1U * a) * b;
   51|       |   // If a == 0 then the multiply certainly did not overflow
   52|       |   // Otherwise r / a == b unless overflow occurred
   53|  11.4k|   if(a != 0 && r / a != b) {
  ------------------
  |  Branch (53:7): [True: 11.4k, False: 0]
  |  Branch (53:17): [True: 0, False: 11.4k]
  ------------------
   54|      0|      return {};
   55|      0|   }
   56|  11.4k|   return r;
   57|  11.4k|}

_ZN5Botan7load_beImJNSt3__14spanIKhLm8EEEEEEDaDpOT0_:
  504|  13.6k|inline constexpr auto load_be(ParamTs&&... params) {
  505|  13.6k|   return detail::load_any<std::endian::big, OutT>(std::forward<ParamTs>(params)...);
  506|  13.6k|}
_ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_:
  278|  13.6k|inline constexpr WrappedOutT load_any(InR&& in_range) {
  279|  13.6k|   using OutT = detail::wrapped_type<WrappedOutT>;
  280|  13.6k|   ranges::assert_exact_byte_length<sizeof(OutT)>(in_range);
  281|       |
  282|  13.6k|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|  13.6k|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  287|  13.6k|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|  13.6k|      } else {
  289|  13.6k|         const std::span in{in_range};
  290|  13.6k|         if constexpr(sizeof(OutT) == 1) {
  291|  13.6k|            return static_cast<OutT>(in[0]);
  292|  13.6k|         } else if constexpr(endianness == std::endian::native) {
  293|  13.6k|            return typecast_copy<OutT>(in);
  294|  13.6k|         } else {
  295|  13.6k|            static_assert(opposite(endianness) == std::endian::native);
  296|  13.6k|            return reverse_bytes(typecast_copy<OutT>(in));
  297|  13.6k|         }
  298|  13.6k|      }
  299|  13.6k|   }());
  300|  13.6k|}
_ZN5Botan6detail24wrap_strong_type_or_enumITkNS0_20unsigned_integralishEmTkNSt3__117unsigned_integralEmEEDaT0_:
  200|  15.0k|constexpr auto wrap_strong_type_or_enum(T t) {
  201|       |   if constexpr(std::is_enum_v<OutT>) {
  202|       |      return static_cast<OutT>(t);
  203|  15.0k|   } else {
  204|  15.0k|      return Botan::wrap_strong_type<OutT>(t);
  205|  15.0k|   }
  206|  15.0k|}
_ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEENS2_4spanIKhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv:
  282|  13.6k|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|  13.6k|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (286:10): [Folded, False: 13.6k]
  ------------------
  287|      0|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|  13.6k|      } else {
  289|  13.6k|         const std::span in{in_range};
  290|       |         if constexpr(sizeof(OutT) == 1) {
  291|       |            return static_cast<OutT>(in[0]);
  292|       |         } else if constexpr(endianness == std::endian::native) {
  293|       |            return typecast_copy<OutT>(in);
  294|  13.6k|         } else {
  295|  13.6k|            static_assert(opposite(endianness) == std::endian::native);
  296|  13.6k|            return reverse_bytes(typecast_copy<OutT>(in));
  297|  13.6k|         }
  298|  13.6k|      }
  299|  13.6k|   }());
_ZN5Botan7load_beImJRNSt3__15arrayIhLm8EEEEEEDaDpOT0_:
  504|  1.30k|inline constexpr auto load_be(ParamTs&&... params) {
  505|  1.30k|   return detail::load_any<std::endian::big, OutT>(std::forward<ParamTs>(params)...);
  506|  1.30k|}
_ZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_:
  278|  1.30k|inline constexpr WrappedOutT load_any(InR&& in_range) {
  279|  1.30k|   using OutT = detail::wrapped_type<WrappedOutT>;
  280|  1.30k|   ranges::assert_exact_byte_length<sizeof(OutT)>(in_range);
  281|       |
  282|  1.30k|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|  1.30k|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  287|  1.30k|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|  1.30k|      } else {
  289|  1.30k|         const std::span in{in_range};
  290|  1.30k|         if constexpr(sizeof(OutT) == 1) {
  291|  1.30k|            return static_cast<OutT>(in[0]);
  292|  1.30k|         } else if constexpr(endianness == std::endian::native) {
  293|  1.30k|            return typecast_copy<OutT>(in);
  294|  1.30k|         } else {
  295|  1.30k|            static_assert(opposite(endianness) == std::endian::native);
  296|  1.30k|            return reverse_bytes(typecast_copy<OutT>(in));
  297|  1.30k|         }
  298|  1.30k|      }
  299|  1.30k|   }());
  300|  1.30k|}
_ZZN5Botan6detail8load_anyILNSt3__16endianE64206ETkNS0_20unsigned_integralishEmTkNS_6ranges16contiguous_rangeIhEERNS2_5arrayIhLm8EEEQnt15custom_loadableINS0_19wrapped_type_helperIu14__remove_cvrefIT0_EE4typeEEEESA_OT1_ENKUlvE_clEv:
  282|  1.30k|   return detail::wrap_strong_type_or_enum<WrappedOutT>([&]() -> OutT {
  283|       |      // At compile time we cannot use `typecast_copy` as it uses `std::memcpy`
  284|       |      // internally to copy ranges on a byte-by-byte basis, which is not allowed
  285|       |      // in a `constexpr` context.
  286|  1.30k|      if(std::is_constant_evaluated()) /* TODO: C++23: if consteval {} */ {
  ------------------
  |  Branch (286:10): [Folded, False: 1.30k]
  ------------------
  287|      0|         return fallback_load_any<endianness, OutT>(std::forward<InR>(in_range));
  288|  1.30k|      } else {
  289|  1.30k|         const std::span in{in_range};
  290|       |         if constexpr(sizeof(OutT) == 1) {
  291|       |            return static_cast<OutT>(in[0]);
  292|       |         } else if constexpr(endianness == std::endian::native) {
  293|       |            return typecast_copy<OutT>(in);
  294|  1.30k|         } else {
  295|  1.30k|            static_assert(opposite(endianness) == std::endian::native);
  296|  1.30k|            return reverse_bytes(typecast_copy<OutT>(in));
  297|  1.30k|         }
  298|  1.30k|      }
  299|  1.30k|   }());

_ZN5Botan14zeroize_bufferITkNSt3__117unsigned_integralEmEEvPT_m:
   37|    292|inline void zeroize_buffer(T buf[], size_t n) {
   38|    292|   if(n > 0) {
  ------------------
  |  Branch (38:7): [True: 292, False: 0]
  ------------------
   39|    292|      std::memset(buf, 0, sizeof(T) * n);
   40|    292|   }
   41|    292|}

_ZN5Botan10word8_add3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_:
  304|    273|inline constexpr auto word8_add3(W z[8], const W x[8], const W y[8], W carry) -> W {
  305|    273|#if defined(BOTAN_MP_USE_X86_64_ASM)
  306|    273|   if constexpr(std::same_as<W, uint64_t>) {
  307|    273|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (307:10): [True: 273, Folded]
  ------------------
  308|    273|         asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "adcq"))
  309|    273|                      : [carry] "=r"(carry)
  310|    273|                      : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  311|    273|                      : "cc", "memory");
  312|    273|         return carry;
  313|    273|      }
  314|    273|   }
  315|      0|#endif
  316|       |
  317|      0|   z[0] = word_add(x[0], y[0], &carry);
  318|    273|   z[1] = word_add(x[1], y[1], &carry);
  319|    273|   z[2] = word_add(x[2], y[2], &carry);
  320|    273|   z[3] = word_add(x[3], y[3], &carry);
  321|    273|   z[4] = word_add(x[4], y[4], &carry);
  322|    273|   z[5] = word_add(x[5], y[5], &carry);
  323|    273|   z[6] = word_add(x[6], y[6], &carry);
  324|    273|   z[7] = word_add(x[7], y[7], &carry);
  325|    273|   return carry;
  326|    273|}
_ZN5Botan8word_addITkNS_8WordTypeEmEET_S1_S1_PS1_:
  239|  41.7k|inline constexpr auto word_add(W x, W y, W* carry) -> W {
  240|  41.7k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_addc)
  241|  41.7k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (241:7): [True: 41.7k, Folded]
  ------------------
  242|       |      if constexpr(std::same_as<W, unsigned int>) {
  243|       |         return __builtin_addc(x, y, *carry & 1, carry);
  244|  41.7k|      } else if constexpr(std::same_as<W, unsigned long>) {
  245|  41.7k|         return __builtin_addcl(x, y, *carry & 1, carry);
  246|       |      } else if constexpr(std::same_as<W, unsigned long long>) {
  247|       |         return __builtin_addcll(x, y, *carry & 1, carry);
  248|       |      }
  249|  41.7k|   }
  250|      0|#endif
  251|       |
  252|       |   if constexpr(WordInfo<W>::dword_is_native && use_dword_for_word_add) {
  253|       |      /*
  254|       |      TODO(Botan4) this is largely a performance hack for GCCs that don't
  255|       |      support __builtin_addc, if we increase the minimum supported version of
  256|       |      GCC to GCC 14 then we can remove this and not worry about it
  257|       |      */
  258|       |      const W cb = *carry & 1;
  259|       |      const auto s = typename WordInfo<W>::dword(x) + y + cb;
  260|       |      *carry = static_cast<W>(s >> WordInfo<W>::bits);
  261|       |      return static_cast<W>(s);
  262|  41.7k|   } else {
  263|  41.7k|      const W cb = *carry & 1;
  264|  41.7k|      W z = x + y;
  265|  41.7k|      W c1 = (z < x);
  266|  41.7k|      z += cb;
  267|  41.7k|      *carry = c1 | (z < cb);
  268|  41.7k|      return z;
  269|  41.7k|   }
  270|  41.7k|}
_ZN5Botan10word8_sub3ITkNS_8WordTypeEmEET_PS1_PKS1_S4_S1_:
  385|     24|inline constexpr auto word8_sub3(W z[8], const W x[8], const W y[8], W carry) -> W {
  386|     24|#if defined(BOTAN_MP_USE_X86_64_ASM)
  387|     24|   if constexpr(std::same_as<W, uint64_t>) {
  388|     24|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (388:10): [True: 24, Folded]
  ------------------
  389|     24|         asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB3_OP, "sbbq"))
  390|     24|                      : [carry] "=r"(carry)
  391|     24|                      : [x] "r"(x), [y] "r"(y), [z] "r"(z), "0"(carry)
  392|     24|                      : "cc", "memory");
  393|     24|         return carry;
  394|     24|      }
  395|     24|   }
  396|      0|#endif
  397|       |
  398|      0|   z[0] = word_sub(x[0], y[0], &carry);
  399|     24|   z[1] = word_sub(x[1], y[1], &carry);
  400|     24|   z[2] = word_sub(x[2], y[2], &carry);
  401|     24|   z[3] = word_sub(x[3], y[3], &carry);
  402|     24|   z[4] = word_sub(x[4], y[4], &carry);
  403|     24|   z[5] = word_sub(x[5], y[5], &carry);
  404|     24|   z[6] = word_sub(x[6], y[6], &carry);
  405|     24|   z[7] = word_sub(x[7], y[7], &carry);
  406|     24|   return carry;
  407|     24|}
_ZN5Botan8word_subITkNS_8WordTypeEmEET_S1_S1_PS1_:
  332|  33.1k|inline constexpr auto word_sub(W x, W y, W* carry) -> W {
  333|  33.1k|#if BOTAN_COMPILER_HAS_BUILTIN(__builtin_subc)
  334|  33.1k|   if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (334:7): [True: 33.1k, Folded]
  ------------------
  335|       |      if constexpr(std::same_as<W, unsigned int>) {
  336|       |         return __builtin_subc(x, y, *carry & 1, carry);
  337|  33.1k|      } else if constexpr(std::same_as<W, unsigned long>) {
  338|  33.1k|         return __builtin_subcl(x, y, *carry & 1, carry);
  339|       |      } else if constexpr(std::same_as<W, unsigned long long>) {
  340|       |         return __builtin_subcll(x, y, *carry & 1, carry);
  341|       |      }
  342|  33.1k|   }
  343|      0|#endif
  344|       |
  345|      0|   const W cb = *carry & 1;
  346|  33.1k|   W t0 = x - y;
  347|  33.1k|   W c1 = (t0 > x);
  348|  33.1k|   W z = t0 - cb;
  349|  33.1k|   *carry = c1 | (z > t0);
  350|  33.1k|   return z;
  351|  33.1k|}
_ZN5Botan13word8_linmul3ITkNS_8WordTypeEmEET_PS1_PKS1_S1_S1_:
  413|    734|inline constexpr auto word8_linmul3(W z[8], const W x[8], W y, W carry) -> W {
  414|    734|#if defined(BOTAN_MP_USE_X86_64_ASM)
  415|    734|   if constexpr(std::same_as<W, uint64_t>) {
  416|    734|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (416:10): [True: 734, Folded]
  ------------------
  417|    734|         asm volatile(DO_8_TIMES(LINMUL_OP, "z")
  418|    734|                      : [carry] "=r"(carry)
  419|    734|                      : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  420|    734|                      : "cc", "%rax", "%rdx", "memory");
  421|    734|         return carry;
  422|    734|      }
  423|    734|   }
  424|      0|#endif
  425|       |
  426|      0|   z[0] = word_madd2(x[0], y, &carry);
  427|    734|   z[1] = word_madd2(x[1], y, &carry);
  428|    734|   z[2] = word_madd2(x[2], y, &carry);
  429|    734|   z[3] = word_madd2(x[3], y, &carry);
  430|    734|   z[4] = word_madd2(x[4], y, &carry);
  431|    734|   z[5] = word_madd2(x[5], y, &carry);
  432|    734|   z[6] = word_madd2(x[6], y, &carry);
  433|    734|   z[7] = word_madd2(x[7], y, &carry);
  434|    734|   return carry;
  435|    734|}
_ZN5Botan10word_madd2ITkNS_8WordTypeEmEET_S1_S1_PS1_:
   90|  59.5k|inline constexpr auto word_madd2(W a, W b, W* c) -> W {
   91|  59.5k|#if defined(BOTAN_MP_USE_X86_64_ASM)
   92|  59.5k|   if constexpr(std::same_as<W, uint64_t>) {
   93|  59.5k|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (93:10): [True: 59.5k, Folded]
  ------------------
   94|  59.5k|         asm(R"(
   95|  59.5k|            mulq %[b]
   96|  59.5k|            addq %[c],%[a]
   97|  59.5k|            adcq $0,%[carry]
   98|  59.5k|            )"
   99|  59.5k|             : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*c)
  100|  59.5k|             : "0"(a), "1"(b), [c] "g"(*c)
  101|  59.5k|             : "cc");
  102|       |
  103|  59.5k|         return a;
  104|  59.5k|      }
  105|  59.5k|   }
  106|       |#elif defined(BOTAN_MP_USE_AARCH64_ASM)
  107|       |   if constexpr(std::same_as<W, uint64_t>) {
  108|       |      if(!std::is_constant_evaluated()) {
  109|       |         W lo = 0;
  110|       |         W hi = 0;
  111|       |         asm(R"(
  112|       |            mul  %[lo], %[a], %[b]
  113|       |            umulh %[hi], %[a], %[b]
  114|       |            adds %[lo], %[lo], %[c]
  115|       |            adc  %[hi], %[hi], xzr
  116|       |            )"
  117|       |             : [lo] "=&r"(lo), [hi] "=&r"(hi)
  118|       |             : [a] "r"(a), [b] "r"(b), [c] "r"(*c)
  119|       |             : "cc");
  120|       |
  121|       |         *c = hi;
  122|       |         return lo;
  123|       |      }
  124|       |   }
  125|       |#endif
  126|       |
  127|      0|   typedef typename WordInfo<W>::dword dword;
  128|  59.5k|   const dword s = dword(a) * b + *c;
  129|  59.5k|   *c = static_cast<W>(s >> WordInfo<W>::bits);
  130|  59.5k|   return static_cast<W>(s);
  131|  59.5k|}
_ZN5Botan11word8_madd3ITkNS_8WordTypeEmEET_PS1_PKS1_S1_S1_:
  441|  1.91k|inline constexpr auto word8_madd3(W z[8], const W x[8], W y, W carry) -> W {
  442|  1.91k|#if defined(BOTAN_MP_USE_X86_64_ASM)
  443|  1.91k|   if constexpr(std::same_as<W, uint64_t>) {
  444|  1.91k|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (444:10): [True: 1.91k, Folded]
  ------------------
  445|  1.91k|         asm volatile(DO_8_TIMES(MULADD_OP, "")
  446|  1.91k|                      : [carry] "=r"(carry)
  447|  1.91k|                      : [z] "r"(z), [x] "r"(x), [y] "rm"(y), "0"(carry)
  448|  1.91k|                      : "cc", "%rax", "%rdx", "memory");
  449|  1.91k|         return carry;
  450|  1.91k|      }
  451|  1.91k|   }
  452|      0|#endif
  453|       |
  454|      0|   z[0] = word_madd3(x[0], y, z[0], &carry);
  455|  1.91k|   z[1] = word_madd3(x[1], y, z[1], &carry);
  456|  1.91k|   z[2] = word_madd3(x[2], y, z[2], &carry);
  457|  1.91k|   z[3] = word_madd3(x[3], y, z[3], &carry);
  458|  1.91k|   z[4] = word_madd3(x[4], y, z[4], &carry);
  459|  1.91k|   z[5] = word_madd3(x[5], y, z[5], &carry);
  460|  1.91k|   z[6] = word_madd3(x[6], y, z[6], &carry);
  461|  1.91k|   z[7] = word_madd3(x[7], y, z[7], &carry);
  462|  1.91k|   return carry;
  463|  1.91k|}
_ZN5Botan10word_madd3ITkNS_8WordTypeEmEET_S1_S1_S1_PS1_:
  137|  4.60k|inline constexpr auto word_madd3(W a, W b, W c, W* d) -> W {
  138|  4.60k|#if defined(BOTAN_MP_USE_X86_64_ASM)
  139|  4.60k|   if constexpr(std::same_as<W, uint64_t>) {
  140|  4.60k|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (140:10): [True: 4.60k, Folded]
  ------------------
  141|  4.60k|         asm(R"(
  142|  4.60k|            mulq %[b]
  143|  4.60k|
  144|  4.60k|            addq %[c],%[a]
  145|  4.60k|            adcq $0,%[carry]
  146|  4.60k|
  147|  4.60k|            addq %[d],%[a]
  148|  4.60k|            adcq $0,%[carry]
  149|  4.60k|            )"
  150|  4.60k|             : [a] "=a"(a), [b] "=rm"(b), [carry] "=&d"(*d)
  151|  4.60k|             : "0"(a), "1"(b), [c] "g"(c), [d] "g"(*d)
  152|  4.60k|             : "cc");
  153|       |
  154|  4.60k|         return a;
  155|  4.60k|      }
  156|  4.60k|   }
  157|       |#elif defined(BOTAN_MP_USE_AARCH64_ASM)
  158|       |   if constexpr(std::same_as<W, uint64_t>) {
  159|       |      if(!std::is_constant_evaluated()) {
  160|       |         W lo = 0;
  161|       |         W hi = 0;
  162|       |         asm(R"(
  163|       |            mul  %[lo], %[a], %[b]
  164|       |            umulh %[hi], %[a], %[b]
  165|       |            adds %[lo], %[lo], %[c]
  166|       |            adc  %[hi], %[hi], xzr
  167|       |            adds %[lo], %[lo], %[d]
  168|       |            adc  %[hi], %[hi], xzr
  169|       |            )"
  170|       |             : [lo] "=&r"(lo), [hi] "=&r"(hi)
  171|       |             : [a] "r"(a), [b] "r"(b), [c] "r"(c), [d] "r"(*d)
  172|       |             : "cc");
  173|       |
  174|       |         *d = hi;
  175|       |         return lo;
  176|       |      }
  177|       |   }
  178|       |#endif
  179|       |
  180|      0|   typedef typename WordInfo<W>::dword dword;
  181|  4.60k|   const dword s = dword(a) * b + c + *d;
  182|  4.60k|   *d = static_cast<W>(s >> WordInfo<W>::bits);
  183|  4.60k|   return static_cast<W>(s);
  184|  4.60k|}
_ZN5Botan10word8_add2ITkNS_8WordTypeEmEET_PS1_PKS1_S1_:
  276|     12|inline constexpr auto word8_add2(W x[8], const W y[8], W carry) -> W {
  277|     12|#if defined(BOTAN_MP_USE_X86_64_ASM)
  278|     12|   if constexpr(std::same_as<W, uint64_t>) {
  279|     12|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (279:10): [True: 12, Folded]
  ------------------
  280|     12|         asm volatile(ADD_OR_SUBTRACT(DO_8_TIMES(ADDSUB2_OP, "adcq"))
  281|     12|                      : [carry] "=r"(carry)
  282|     12|                      : [x] "r"(x), [y] "r"(y), "0"(carry)
  283|     12|                      : "cc", "memory");
  284|     12|         return carry;
  285|     12|      }
  286|     12|   }
  287|      0|#endif
  288|       |
  289|      0|   x[0] = word_add(x[0], y[0], &carry);
  290|     12|   x[1] = word_add(x[1], y[1], &carry);
  291|     12|   x[2] = word_add(x[2], y[2], &carry);
  292|     12|   x[3] = word_add(x[3], y[3], &carry);
  293|     12|   x[4] = word_add(x[4], y[4], &carry);
  294|     12|   x[5] = word_add(x[5], y[5], &carry);
  295|     12|   x[6] = word_add(x[6], y[6], &carry);
  296|     12|   x[7] = word_add(x[7], y[7], &carry);
  297|     12|   return carry;
  298|     12|}
_ZN5Botan5word3ImEC2Ev:
  478|     30|      constexpr word3() : m_w(0) {}
_ZN5Botan5word3ImE3mulEmm:
  480|  11.2k|      inline constexpr void mul(W x, W y) { m_w += static_cast<W3>(x) * y; }
_ZN5Botan5word3ImE7extractEv:
  486|  1.13k|      inline constexpr W extract() {
  487|  1.13k|         W r = static_cast<W>(m_w);
  488|  1.13k|         m_w >>= WordInfo<W>::bits;
  489|  1.13k|         return r;
  490|  1.13k|      }

_ZN5Botan11bigint_add3ITkNS_8WordTypeEmEET_PS1_PKS1_mS4_m:
  123|  2.43k|inline constexpr auto bigint_add3(W z[], const W x[], size_t x_size, const W y[], size_t y_size) -> W {
  124|  2.43k|   if(x_size < y_size) {
  ------------------
  |  Branch (124:7): [True: 785, False: 1.64k]
  ------------------
  125|    785|      return bigint_add3(z, y, y_size, x, x_size);
  126|    785|   }
  127|       |
  128|  1.64k|   W carry = 0;
  129|       |
  130|  1.64k|   const size_t blocks = y_size - (y_size % 8);
  131|       |
  132|  1.91k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (132:22): [True: 273, False: 1.64k]
  ------------------
  133|    273|      carry = word8_add3(z + i, x + i, y + i, carry);
  134|    273|   }
  135|       |
  136|  2.80k|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (136:27): [True: 1.15k, False: 1.64k]
  ------------------
  137|  1.15k|      z[i] = word_add(x[i], y[i], &carry);
  138|  1.15k|   }
  139|       |
  140|  11.9k|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (140:27): [True: 10.3k, False: 1.64k]
  ------------------
  141|  10.3k|      z[i] = word_add(x[i], static_cast<W>(0), &carry);
  142|  10.3k|   }
  143|       |
  144|  1.64k|   return carry;
  145|  2.43k|}
_ZN5Botan10bigint_cmpITkNS_8WordTypeEmEEiPKT_mS3_m:
  462|    382|inline constexpr int32_t bigint_cmp(const W x[], size_t x_size, const W y[], size_t y_size) {
  463|    382|   static_assert(sizeof(W) >= sizeof(uint32_t), "Size assumption");
  464|       |
  465|    382|   const W LT = static_cast<W>(-1);
  466|    382|   const W EQ = 0;
  467|    382|   const W GT = 1;
  468|       |
  469|    382|   const size_t common_elems = std::min(x_size, y_size);
  470|       |
  471|    382|   W result = EQ;  // until found otherwise
  472|       |
  473|    762|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (473:22): [True: 380, False: 382]
  ------------------
  474|    380|      const auto is_eq = CT::Mask<W>::is_equal(x[i], y[i]);
  475|    380|      const auto is_lt = CT::Mask<W>::is_lt(x[i], y[i]);
  476|       |
  477|    380|      result = is_eq.select(result, is_lt.select(LT, GT));
  478|    380|   }
  479|       |
  480|    382|   if(x_size < y_size) {
  ------------------
  |  Branch (480:7): [True: 2, False: 380]
  ------------------
  481|      2|      W mask = 0;
  482|      4|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (482:30): [True: 2, False: 2]
  ------------------
  483|      2|         mask |= y[i];
  484|      2|      }
  485|       |
  486|       |      // If any bits were set in high part of y, then x < y
  487|      2|      result = CT::Mask<W>::is_zero(mask).select(result, LT);
  488|    380|   } else if(y_size < x_size) {
  ------------------
  |  Branch (488:14): [True: 0, False: 380]
  ------------------
  489|      0|      W mask = 0;
  490|      0|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (490:30): [True: 0, False: 0]
  ------------------
  491|      0|         mask |= x[i];
  492|      0|      }
  493|       |
  494|       |      // If any bits were set in high part of x, then x > y
  495|      0|      result = CT::Mask<W>::is_zero(mask).select(result, GT);
  496|      0|   }
  497|       |
  498|    382|   CT::unpoison(result);
  499|    382|   BOTAN_DEBUG_ASSERT(result == LT || result == GT || result == EQ);
  ------------------
  |  |  137|    382|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  138|    382|      } while(0)
  |  |  ------------------
  |  |  |  Branch (138:15): [Folded, False: 382]
  |  |  ------------------
  ------------------
  500|    382|   return static_cast<int32_t>(result);
  501|    382|}
_ZN5Botan14bigint_linmul3ITkNS_8WordTypeEmEEvPT_PKS1_mS1_:
  419|    638|inline constexpr void bigint_linmul3(W z[], const W x[], size_t x_size, W y) {
  420|    638|   const size_t blocks = x_size - (x_size % 8);
  421|       |
  422|    638|   W carry = 0;
  423|       |
  424|  1.37k|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (424:22): [True: 734, False: 638]
  ------------------
  425|    734|      carry = word8_linmul3(z + i, x + i, y, carry);
  426|    734|   }
  427|       |
  428|  2.06k|   for(size_t i = blocks; i != x_size; ++i) {
  ------------------
  |  Branch (428:27): [True: 1.43k, False: 638]
  ------------------
  429|  1.43k|      z[i] = word_madd2(x[i], y, &carry);
  430|  1.43k|   }
  431|       |
  432|    638|   z[x_size] = carry;
  433|    638|}
_ZN5Botan14divide_precompImE13setup_vartimeEm:
  686|    810|      static constexpr divide_precomp setup_vartime(W divisor) {
  687|    810|         const size_t shift = WordInfo<W>::bits - high_bit(divisor);
  688|    810|         const W norm_divisor = divisor << shift;
  689|    810|         const W reciprocal = reciprocal_word(norm_divisor);
  690|    810|         return divide_precomp(divisor, shift, norm_divisor, reciprocal);
  691|    810|      }
_ZN5Botan15reciprocal_wordITkNS_8WordTypeEmEET_S1_:
  577|    810|constexpr W reciprocal_word(W D) {
  578|    810|   BOTAN_DEBUG_ASSERT((D & WordInfo<W>::top_bit) != 0);
  ------------------
  |  |  137|    810|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  138|    810|      } while(0)
  |  |  ------------------
  |  |  |  Branch (138:15): [Folded, False: 810]
  |  |  ------------------
  ------------------
  579|       |
  580|       |   /*
  581|       |   * Subtracting 2^b*D from the numerator gives
  582|       |   * v = floor(((~D)*2^b + (2^b - 1)) / D). Since D is normalized, ~D < D
  583|       |   * and the quotient fits in a word. See the first part of Section III A
  584|       |   * in the paper.
  585|       |   */
  586|       |   if constexpr(sizeof(W) == 4) {
  587|       |      const auto nD = ~D;  // Work around spurious MSVC warning
  588|       |      const typename WordInfo<W>::dword n =
  589|       |         (static_cast<typename WordInfo<W>::dword>(nD) << WordInfo<W>::bits) | WordInfo<W>::max;
  590|       |      return static_cast<W>(n / D);
  591|    810|   } else {
  592|    810|      if(!std::is_constant_evaluated()) {
  ------------------
  |  Branch (592:10): [True: 810, Folded]
  ------------------
  593|    810|#if defined(BOTAN_MP_USE_X86_64_ASM)
  594|    810|         W quotient = 0;
  595|    810|         W remainder = 0;
  596|       |         // NOLINTNEXTLINE(*-no-assembler)
  597|    810|         asm("divq %[d]"
  598|    810|             : "=a"(quotient), "=d"(remainder)
  599|    810|             : [d] "r"(D), "a"(WordInfo<W>::max), "d"(static_cast<W>(~D))
  600|    810|             : "cc");
  601|    810|         return quotient;
  602|       |#elif !defined(BOTAN_BUILD_COMPILER_IS_CLANGCL)
  603|       |         /* clang-cl has a bug where on encountering a 128/64 division it emits
  604|       |         * a call to __udivti3() but then fails to link the relevant builtin into
  605|       |         * the binary, causing a link failure. Work around this by simply omitting
  606|       |         * such code for clang-cl
  607|       |         *
  608|       |         * See https://github.com/llvm/llvm-project/issues/25679
  609|       |         */
  610|       |         if constexpr(WordInfo<W>::dword_is_native) {
  611|       |            typename WordInfo<W>::dword n =
  612|       |               (static_cast<typename WordInfo<W>::dword>(~D) << WordInfo<W>::bits) | WordInfo<W>::max;
  613|       |            return static_cast<W>(n / D);
  614|       |         }
  615|       |#endif
  616|    810|      }
  617|       |
  618|       |      // Algorithm 2 of Möller and Granlund
  619|      0|      const W d0 = D & 1;
  620|      0|      const W d9 = D >> 55;
  621|      0|      const W d40 = (D >> 24) + 1;
  622|      0|      const W d63 = (D >> 1) + d0;  // ceil(D/2)
  623|       |
  624|       |      // This division is done with a table lookup in the paper
  625|      0|      const W v0 = ((W(1) << 19) - (W(3) << 8)) / d9;
  626|      0|      const W v1 = (v0 << 11) - ((v0 * v0 * d40) >> 40) - 1;
  627|      0|      const W v2 = (v1 << 13) + ((v1 * ((W(1) << 60) - v1 * d40)) >> 47);
  628|       |
  629|      0|      const W e = W(0) - v2 * d63 + (v2 >> 1) * d0;
  630|       |
  631|      0|      W product_hi = 0;
  632|      0|      word_madd2(v2, e, &product_hi);
  633|      0|      const W v3 = (v2 << 31) + (product_hi >> 1);
  634|       |
  635|       |      // Compute floor((v3 + 2^64 + 1) * D / 2^64) modulo 2^64
  636|      0|      product_hi = D;
  637|      0|      word_madd2(v3, D, &product_hi);
  638|      0|      return v3 - D - product_hi;
  639|    810|   }
  640|    810|}
_ZN5Botan14divide_precompImEC2Emmmm:
  771|  2.38k|            m_divisor(divisor), m_shift(shift), m_norm_divisor(norm_divisor), m_reciprocal(reciprocal) {}
_ZNK5Botan14divide_precompImE19divmod_2to1_vartimeEmm:
  709|  6.62k|      inline constexpr std::pair<W, W> divmod_2to1_vartime(W n1, W n0) const {
  710|  6.62k|         if(m_divisor == WordInfo<W>::max) {
  ------------------
  |  Branch (710:13): [True: 691, False: 5.93k]
  ------------------
  711|    691|            const W q = div_2to1_max_d(n1, n0);
  712|    691|            const W r = static_cast<W>(n0 + q);
  713|    691|            return std::make_pair(q, r);
  714|    691|         }
  715|       |
  716|  5.93k|         if(m_divisor == WordInfo<W>::top_bit) {
  ------------------
  |  Branch (716:13): [True: 111, False: 5.81k]
  ------------------
  717|       |            // Simply a shift by N-1 bits
  718|    111|            const W q = (n1 << 1) | (n0 >> (WordInfo<W>::bits - 1));
  719|    111|            const W r = static_cast<W>(n0 & (WordInfo<W>::top_bit - 1));
  720|    111|            return std::make_pair(q, r);
  721|    111|         }
  722|       |
  723|  5.81k|         return divmod_2to1_ct(n1, n0);
  724|  5.93k|      }
_ZN5Botan14divide_precompImE14div_2to1_max_dEmm:
  809|    691|      static inline constexpr W div_2to1_max_d(W n1, W n0) {
  810|       |         /*
  811|       |         Use k to refer to WordInfo<W>::bits
  812|       |
  813|       |         We are dividing n = (n1 * 2^k) + n0 by 2^k - 1
  814|       |
  815|       |         Recall that 2^k = 1 (mod 2^k - 1)
  816|       |
  817|       |         Rewrite n = n1*2^k + n0 as n1*(2^k - 1) + n1 + n0
  818|       |
  819|       |         The result of dividing n by (2^k - 1) will be equal to
  820|       |         (n1*(2^k-1) + n1 + n0) / (2^k-1) =
  821|       |         n1 + ((n1 + n0) / (2^k-1)
  822|       |
  823|       |         Use c to refer to ((n1 + n0) / (2^k-1))
  824|       |
  825|       |         If (n1 + n0) < (2^k - 1) then c is 0
  826|       |         If (n1 + n0) >= (2^k - 1) then c is 1
  827|       |
  828|       |         Since n1 < 2^k - 1 [*] and n0 <= 2^k - 1 it is impossible for (n1 + n0) / (2^k -1)
  829|       |         to be greater than 1.
  830|       |
  831|       |         [*] We require n1 be strictly less than the divisor to ensure that the
  832|       |         output fits in a single word; this is checked at the start of divmod_2to1.
  833|       |
  834|       |         And since n1 + 1 <= 2^k - 1, c == 1 exactly when n0 + (n1 + 1) carries out.
  835|       |         */
  836|       |
  837|    691|         const W s = n0 + n1 + 1;
  838|    691|         const W c = CT::Mask<W>::is_lt(s, n0).if_set_return(1);
  839|    691|         return n1 + c;
  840|    691|      }
_ZNK5Botan14divide_precompImE14divmod_2to1_ctEmm:
  731|  16.1k|      inline constexpr std::pair<W, W> divmod_2to1_ct(W n1, W n0) const {
  732|       |         /*
  733|       |         * Scale the numerator to match the normalized divisor; the scaling cancels
  734|       |         * in the quotient and is removed from the remainder by the final shift.
  735|       |         */
  736|  16.1k|         n1 <<= m_shift;
  737|  16.1k|         const size_t rshift = WordInfo<W>::bits - m_shift;
  738|       |         /*
  739|       |         * We can't just `n0 >> rshift` because m_shift may be 0 (high bit divisor)
  740|       |         * in which case rshift will be the maximum bit length, and >> by the maximum
  741|       |         * bitlength is undefined behavior despite having an entirely obvious meaning.
  742|       |         *
  743|       |         * However we know m_shift is not equal to the bit length of the word, because
  744|       |         * that would imply that the divisor is 0. Thus rshift must be >= 1. So split
  745|       |         * the shift into two phases (first rshift-1, then 1)
  746|       |         */
  747|  16.1k|         n1 |= (n0 >> 1) >> (rshift - 1);
  748|  16.1k|         n0 <<= m_shift;
  749|       |
  750|  16.1k|         const auto [q, scaled_r] = div2by1_preinv(n1, n0, m_norm_divisor, m_reciprocal);
  751|  16.1k|         const W r = scaled_r >> m_shift;
  752|  16.1k|         return std::make_pair(q, r);
  753|  16.1k|      }
_ZN5Botan14divide_precompImE14div2by1_preinvEmmmm:
  782|  16.1k|      static constexpr std::pair<W, W> div2by1_preinv(W u1, W u0, W D, W v) {
  783|       |         // Steps 1-3: <q1,q0> = v*u1; <q1,q0> += <u1,u0>; q1 += 1
  784|  16.1k|         W q1 = u0;
  785|  16.1k|         const W q0 = word_madd2(u1, v, &q1);  // <q1,q0> = u1*v + u0
  786|  16.1k|         q1 += u1 + 1;
  787|       |
  788|       |         // Step 4
  789|  16.1k|         W r = u0 - q1 * D;
  790|       |
  791|       |         // Steps 5-7: If r >= q0 { q1 -= 1; r += d; }
  792|  16.1k|         const auto fix_down = CT::Mask<W>::is_gt(r, q0);
  793|  16.1k|         q1 -= fix_down.if_set_return(1);
  794|  16.1k|         r += fix_down.if_set_return(D);
  795|       |
  796|       |         // Steps 8-10: if r >= D { q1 += 1; r -= D; }
  797|  16.1k|         const auto fix_up = CT::Mask<W>::is_gte(r, D);
  798|  16.1k|         q1 += fix_up.if_set_return(1);
  799|  16.1k|         r -= fix_up.if_set_return(D);
  800|       |
  801|       |         // Step 11
  802|  16.1k|         return std::make_pair(q1, r);
  803|  16.1k|      }
_ZN5Botan15bigint_ct_is_eqITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_m:
  542|  2.45k|inline constexpr auto bigint_ct_is_eq(const W x[], size_t x_size, const W y[], size_t y_size) -> CT::Mask<W> {
  543|  2.45k|   const size_t common_elems = std::min(x_size, y_size);
  544|       |
  545|  2.45k|   W diff = 0;
  546|       |
  547|  31.6k|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (547:22): [True: 29.2k, False: 2.45k]
  ------------------
  548|  29.2k|      diff |= (x[i] ^ y[i]);
  549|  29.2k|   }
  550|       |
  551|       |   // If any bits were set in high part of x/y, then they are not equal
  552|  2.45k|   if(x_size < y_size) {
  ------------------
  |  Branch (552:7): [True: 33, False: 2.41k]
  ------------------
  553|    841|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (553:30): [True: 808, False: 33]
  ------------------
  554|    808|         diff |= y[i];
  555|    808|      }
  556|  2.41k|   } else if(y_size < x_size) {
  ------------------
  |  Branch (556:14): [True: 211, False: 2.20k]
  ------------------
  557|  1.89k|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (557:30): [True: 1.68k, False: 211]
  ------------------
  558|  1.68k|         diff |= x[i];
  559|  1.68k|      }
  560|    211|   }
  561|       |
  562|  2.45k|   return CT::Mask<W>::is_zero(diff);
  563|  2.45k|}
_ZN5Botan15bigint_ct_is_ltITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPKS3_mS6_mb:
  510|  1.64k|   -> CT::Mask<W> {
  511|  1.64k|   const size_t common_elems = std::min(x_size, y_size);
  512|       |
  513|  1.64k|   auto is_lt = CT::Mask<W>::expand(lt_or_equal);
  514|       |
  515|  6.99k|   for(size_t i = 0; i != common_elems; i++) {
  ------------------
  |  Branch (515:22): [True: 5.34k, False: 1.64k]
  ------------------
  516|  5.34k|      const auto eq = CT::Mask<W>::is_equal(x[i], y[i]);
  517|  5.34k|      const auto lt = CT::Mask<W>::is_lt(x[i], y[i]);
  518|  5.34k|      is_lt = eq.select_mask(is_lt, lt);
  519|  5.34k|   }
  520|       |
  521|  1.64k|   if(x_size < y_size) {
  ------------------
  |  Branch (521:7): [True: 1.58k, False: 62]
  ------------------
  522|  1.58k|      W mask = 0;
  523|  14.9k|      for(size_t i = x_size; i != y_size; i++) {
  ------------------
  |  Branch (523:30): [True: 13.3k, False: 1.58k]
  ------------------
  524|  13.3k|         mask |= y[i];
  525|  13.3k|      }
  526|       |      // If any bits were set in high part of y, then is_lt should be forced true
  527|  1.58k|      is_lt |= CT::Mask<W>::expand(mask);
  528|  1.58k|   } else if(y_size < x_size) {
  ------------------
  |  Branch (528:14): [True: 6, False: 56]
  ------------------
  529|      6|      W mask = 0;
  530|    182|      for(size_t i = y_size; i != x_size; i++) {
  ------------------
  |  Branch (530:30): [True: 176, False: 6]
  ------------------
  531|    176|         mask |= x[i];
  532|    176|      }
  533|       |
  534|       |      // If any bits were set in high part of x, then is_lt should be false
  535|      6|      is_lt &= CT::Mask<W>::is_zero(mask);
  536|      6|   }
  537|       |
  538|  1.64k|   return is_lt;
  539|  1.64k|}
_ZN5Botan14divide_precompImE5setupEm:
  694|  1.57k|      static constexpr divide_precomp setup(W divisor) {
  695|  1.57k|         const size_t shift = WordInfo<W>::bits - high_bit(divisor);
  696|  1.57k|         const W norm_divisor = divisor << shift;
  697|  1.57k|         const W reciprocal = reciprocal_word_ct(norm_divisor);
  698|  1.57k|         return divide_precomp(divisor, shift, norm_divisor, reciprocal);
  699|  1.57k|      }
_ZN5Botan18reciprocal_word_ctITkNS_8WordTypeEmEET_S1_:
  649|  1.57k|constexpr W reciprocal_word_ct(W D) {
  650|  1.57k|   BOTAN_DEBUG_ASSERT((D & WordInfo<W>::top_bit) != 0);
  ------------------
  |  |  137|  1.57k|      do { /* NOLINT(*-avoid-do-while) */ \
  |  |  138|  1.57k|      } while(0)
  |  |  ------------------
  |  |  |  Branch (138:15): [Folded, False: 1.57k]
  |  |  ------------------
  ------------------
  651|       |
  652|       |   // Bit serial long division of ((~D) || (2^b - 1)) / D, with all of the
  653|       |   // conditional logic computed via masks
  654|  1.57k|   W remainder = static_cast<W>(~D);
  655|  1.57k|   W quotient = 0;
  656|       |
  657|   102k|   for(size_t i = 0; i != WordInfo<W>::bits; ++i) {
  ------------------
  |  Branch (657:22): [True: 100k, False: 1.57k]
  ------------------
  658|   100k|      const auto carry = CT::Mask<W>::expand_top_bit(remainder);
  659|   100k|      remainder = static_cast<W>((remainder << 1) | 1);
  660|   100k|      quotient <<= 1;
  661|       |
  662|   100k|      const auto sub = carry | CT::Mask<W>::is_gte(remainder, D);
  663|   100k|      remainder -= sub.if_set_return(D);
  664|   100k|      quotient |= sub.if_set_return(1);
  665|   100k|   }
  666|       |
  667|  1.57k|   return quotient;
  668|  1.57k|}
_ZN5Botan13bigint_submulITkNS_8WordTypeEmEET_PS1_PKS1_mS1_:
  442|  2.98k|inline constexpr auto bigint_submul(W z[], const W y[], size_t N, W q) -> W {
  443|  2.98k|   W mul_carry = 0;
  444|  2.98k|   W borrow = 0;
  445|       |
  446|  32.9k|   for(size_t i = 0; i != N; ++i) {
  ------------------
  |  Branch (446:22): [True: 29.9k, False: 2.98k]
  ------------------
  447|  29.9k|      const W t = word_madd2(y[i], q, &mul_carry);
  448|  29.9k|      z[i] = word_sub(z[i], t, &borrow);
  449|  29.9k|   }
  450|       |
  451|       |   // Both mul_carry <= W_max - 1 and borrow <= 1, so this cannot overflow
  452|  2.98k|   return mul_carry + borrow;
  453|  2.98k|}
_ZN5Botan14bigint_cnd_addITkNS_8WordTypeEmEET_S1_PS1_PKS1_m:
   48|  2.98k|inline constexpr W bigint_cnd_add(W cnd, W x[], const W y[], size_t size) {
   49|  2.98k|   const auto mask = CT::Mask<W>::expand(cnd).value();
   50|       |
   51|  2.98k|   W carry = 0;
   52|       |
   53|  33.1k|   for(size_t i = 0; i != size; ++i) {
  ------------------
  |  Branch (53:22): [True: 30.1k, False: 2.98k]
  ------------------
   54|  30.1k|      x[i] = word_add(x[i], y[i] & mask, &carry);
   55|  30.1k|   }
   56|       |
   57|  2.98k|   return (mask & carry);
   58|  2.98k|}
_ZN5Botan14bigint_sub_absITkNS_8WordTypeEmEENS_2CT4MaskIT_EEPS3_PKS3_S7_mS5_:
  282|      6|inline constexpr auto bigint_sub_abs(W z[], const W x[], const W y[], size_t N, W ws[]) -> CT::Mask<W> {
  283|       |   // Subtract in both direction then conditional copy out the result
  284|       |
  285|      6|   W* ws0 = ws;
  286|      6|   W* ws1 = ws + N;
  287|       |
  288|      6|   W borrow0 = 0;
  289|      6|   W borrow1 = 0;
  290|       |
  291|      6|   const size_t blocks = N - (N % 8);
  292|       |
  293|     18|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (293:22): [True: 12, False: 6]
  ------------------
  294|     12|      borrow0 = word8_sub3(ws0 + i, x + i, y + i, borrow0);
  295|     12|      borrow1 = word8_sub3(ws1 + i, y + i, x + i, borrow1);
  296|     12|   }
  297|       |
  298|      6|   for(size_t i = blocks; i != N; ++i) {
  ------------------
  |  Branch (298:27): [True: 0, False: 6]
  ------------------
  299|      0|      ws0[i] = word_sub(x[i], y[i], &borrow0);
  300|      0|      ws1[i] = word_sub(y[i], x[i], &borrow1);
  301|      0|   }
  302|       |
  303|      6|   return CT::conditional_copy_mem(borrow0, z, ws1, ws0, N);
  304|      6|}
_ZN5Botan11bigint_add2ITkNS_8WordTypeEmEET_PS1_mPKS1_m:
   97|      9|inline constexpr auto bigint_add2(W x[], size_t x_size, const W y[], size_t y_size) -> W {
   98|      9|   W carry = 0;
   99|       |
  100|      9|   BOTAN_ASSERT(x_size >= y_size, "Expected sizes");
  ------------------
  |  |   71|      9|   do {                                                                                 \
  |  |   72|      9|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                     \
  |  |   73|      9|      if(!(expr)) {                                                                     \
  |  |  ------------------
  |  |  |  Branch (73:10): [True: 0, False: 9]
  |  |  ------------------
  |  |   74|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                            \
  |  |   75|      0|         Botan::assertion_failure(#expr, assertion_made, __func__, __FILE__, __LINE__); \
  |  |   76|      0|      }                                                                                 \
  |  |   77|      9|   } while(0)
  |  |  ------------------
  |  |  |  Branch (77:12): [Folded, False: 9]
  |  |  ------------------
  ------------------
  101|       |
  102|      9|   const size_t blocks = y_size - (y_size % 8);
  103|       |
  104|     21|   for(size_t i = 0; i != blocks; i += 8) {
  ------------------
  |  Branch (104:22): [True: 12, False: 9]
  ------------------
  105|     12|      carry = word8_add2(x + i, y + i, carry);
  106|     12|   }
  107|       |
  108|     15|   for(size_t i = blocks; i != y_size; ++i) {
  ------------------
  |  Branch (108:27): [True: 6, False: 9]
  ------------------
  109|      6|      x[i] = word_add(x[i], y[i], &carry);
  110|      6|   }
  111|       |
  112|     99|   for(size_t i = y_size; i != x_size; ++i) {
  ------------------
  |  Branch (112:27): [True: 90, False: 9]
  ------------------
  113|     90|      x[i] = word_add(x[i], static_cast<W>(0), &carry);
  114|     90|   }
  115|       |
  116|      9|   return carry;
  117|      9|}
_ZN5Botan14bigint_cnd_subITkNS_8WordTypeEmEET_S1_PS1_PKS1_m:
   65|      3|inline constexpr auto bigint_cnd_sub(W cnd, W x[], const W y[], size_t size) -> W {
   66|      3|   const auto mask = CT::Mask<W>::expand(cnd).value();
   67|       |
   68|      3|   W carry = 0;
   69|       |
   70|    147|   for(size_t i = 0; i != size; ++i) {
  ------------------
  |  Branch (70:22): [True: 144, False: 3]
  ------------------
   71|    144|      x[i] = word_sub(x[i], y[i] & mask, &carry);
   72|    144|   }
   73|       |
   74|      3|   return (mask & carry);
   75|      3|}

_ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEmQntsr3stdE7same_asIbT_EEES3_S3_:
   43|  1.18M|constexpr inline T value_barrier(T x) {
   44|  1.18M|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (44:7): [Folded, False: 1.18M]
  ------------------
   45|      0|      return x;
   46|  1.18M|   } else {
   47|  1.18M|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM)
   48|       |      /*
   49|       |      * We may want a "stronger" statement such as
   50|       |      *     asm volatile("" : "+r,m"(x) : : "memory);
   51|       |      * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html)
   52|       |      * however the current approach seems sufficient with current compilers,
   53|       |      * and is minimally damaging with regards to degrading code generation.
   54|       |      */
   55|  1.18M|      asm("" : "+r"(x) : /* no input */);  // NOLINT(*-no-assembler)
   56|  1.18M|      return x;
   57|       |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE)
   58|       |      volatile T vx = x;
   59|       |      return vx;
   60|       |#else
   61|       |      return x;
   62|       |#endif
   63|  1.18M|   }
   64|  1.18M|}
_ZN5Botan2CT13value_barrierITkNSt3__117unsigned_integralEhQntsr3stdE7same_asIbT_EEES3_S3_:
   43|  16.4k|constexpr inline T value_barrier(T x) {
   44|  16.4k|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (44:7): [Folded, False: 16.4k]
  ------------------
   45|      0|      return x;
   46|  16.4k|   } else {
   47|  16.4k|#if defined(BOTAN_CT_VALUE_BARRIER_USE_ASM)
   48|       |      /*
   49|       |      * We may want a "stronger" statement such as
   50|       |      *     asm volatile("" : "+r,m"(x) : : "memory);
   51|       |      * (see https://theunixzoo.co.uk/blog/2021-10-14-preventing-optimisations.html)
   52|       |      * however the current approach seems sufficient with current compilers,
   53|       |      * and is minimally damaging with regards to degrading code generation.
   54|       |      */
   55|  16.4k|      asm("" : "+r"(x) : /* no input */);  // NOLINT(*-no-assembler)
   56|  16.4k|      return x;
   57|       |#elif defined(BOTAN_CT_VALUE_BARRIER_USE_VOLATILE)
   58|       |      volatile T vx = x;
   59|       |      return vx;
   60|       |#else
   61|       |      return x;
   62|       |#endif
   63|  16.4k|   }
   64|  16.4k|}

_ZN5Botan13ignore_paramsIJPKmmEEEvDpRKT_:
  149|  24.9k|constexpr void ignore_params([[maybe_unused]] const T&... args) {}

_ZN5Botan6BigIntD2Ev:
  185|  13.1k|      ~BigInt() { _const_time_unpoison(); }
_ZN5Botan6BigIntaSEOS0_:
  190|  11.4k|      BigInt& operator=(BigInt&& other) noexcept {
  191|  11.4k|         if(this != &other) {
  ------------------
  |  Branch (191:13): [True: 11.4k, False: 0]
  ------------------
  192|  11.4k|            this->swap(other);
  193|  11.4k|         }
  194|       |
  195|  11.4k|         return (*this);
  196|  11.4k|      }
_ZN5Botan6BigInt4swapERS0_:
  207|  11.4k|      void swap(BigInt& other) noexcept {
  208|  11.4k|         m_data.swap(other.m_data);
  209|  11.4k|         std::swap(m_signedness, other.m_signedness);
  210|  11.4k|      }
_ZN5Botan6BigInt4Data4swapERS1_:
 1151|  11.4k|            void swap(Data& other) noexcept {
 1152|  11.4k|               m_reg.swap(other.m_reg);
 1153|  11.4k|               std::swap(m_sig_words, other.m_sig_words);
 1154|  11.4k|            }
_ZN5BotaneqERKNS_6BigIntEm:
 1373|    834|inline bool operator==(const BigInt& a, word b) {
 1374|    834|   return (a.cmp_word(b) == 0);
 1375|    834|}
_ZN5BotanltERKNS_6BigIntES2_:
 1353|  1.64k|inline bool operator<(const BigInt& a, const BigInt& b) {
 1354|  1.64k|   return a.is_less_than(b);
 1355|  1.64k|}
_ZN5BotanplERKNS_6BigIntES2_:
 1189|  1.64k|inline BigInt operator+(const BigInt& x, const BigInt& y) {
 1190|  1.64k|   return BigInt::add2(x, y._data(), y.sig_words(), y.sign());
 1191|  1.64k|}
_ZNK5Botan6BigInt5_dataEv:
 1033|  38.8k|      const word* _data() const { return m_data.const_data(); }
_ZNK5Botan6BigInt4Data10const_dataEv:
 1088|  51.9k|            const word* const_data() const { return m_reg.data(); }
_ZNK5Botan6BigInt9sig_wordsEv:
  687|  22.9k|      size_t sig_words() const { return m_data.sig_words(); }
_ZNK5Botan6BigInt4Data9sig_wordsEv:
 1163|  22.9k|            size_t sig_words() const {
 1164|  22.9k|               if(m_sig_words == sig_words_npos) {
  ------------------
  |  Branch (1164:19): [True: 7.33k, False: 15.6k]
  ------------------
 1165|  7.33k|                  m_sig_words = calc_sig_words();
 1166|  7.33k|               }
 1167|  22.9k|               return m_sig_words;
 1168|  22.9k|            }
_ZNK5Botan6BigInt4signEv:
  641|  27.5k|      Sign sign() const { return (m_signedness); }
_ZN5BotanneERKNS_6BigIntES2_:
 1323|  2.45k|inline bool operator!=(const BigInt& a, const BigInt& b) {
 1324|  2.45k|   return !a.is_equal(b);
 1325|  2.45k|}
_ZNK5Botan6BigInt7word_atEm:
  601|  2.28k|      word word_at(size_t n) const { return m_data.get_word_at(n); }
_ZNK5Botan6BigInt4Data11get_word_atEm:
 1099|  2.28k|            word get_word_at(size_t n) const {
 1100|  2.28k|               if(n < m_reg.size()) {
  ------------------
  |  Branch (1100:19): [True: 2.27k, False: 8]
  ------------------
 1101|  2.27k|                  return m_reg[n];
 1102|  2.27k|               }
 1103|      8|               return 0;
 1104|  2.28k|            }
_ZN5Botan6BigInt4zeroEv:
   50|     65|      static BigInt zero() { return BigInt(); }
_ZN5Botan6BigInt5clearEv:
  441|  1.66k|      void clear() {
  442|  1.66k|         m_data.set_to_zero();
  443|  1.66k|         m_signedness = Positive;
  444|  1.66k|      }
_ZNK5Botan6BigInt6signumEv:
  493|  9.85k|      int signum() const {
  494|  9.85k|         if(sig_words() == 0) {
  ------------------
  |  Branch (494:13): [True: 329, False: 9.52k]
  ------------------
  495|    329|            return 0;
  496|    329|         }
  497|  9.52k|         return (sign() == Negative) ? -1 : 1;
  ------------------
  |  Branch (497:17): [True: 0, False: 9.52k]
  ------------------
  498|  9.85k|      }
_ZNK5Botan6BigInt7is_zeroEv:
  510|  1.64k|      bool is_zero() const { return sig_words() == 0; }
_ZN5Botan6BigInt11set_word_atEmm:
  608|    810|      BOTAN_DEPRECATED("Deprecated no replacement") void set_word_at(size_t i, word w) { m_data.set_word_at(i, w); }
_ZN5Botan6BigInt8set_signENS0_4SignE:
  663|  4.99k|      void set_sign(Sign sign) {
  664|  4.99k|         if(sign == Negative && is_zero()) {
  ------------------
  |  Branch (664:13): [True: 0, False: 4.99k]
  |  Branch (664:33): [True: 0, False: 0]
  ------------------
  665|      0|            sign = Positive;
  666|      0|         }
  667|       |
  668|  4.99k|         m_signedness = sign;
  669|  4.99k|      }
_ZNK5Botan6BigInt4sizeEv:
  681|  12.1k|      size_t size() const { return m_data.size(); }
_ZN5Botan6BigInt12mutable_dataEv:
  712|  4.09k|      BOTAN_DEPRECATED("Deprecated no replacement") word* mutable_data() { return m_data.mutable_data(); }
_ZNK5Botan6BigInt7grow_toEm:
  738|  3.28k|      BOTAN_DEPRECATED("Deprecated no replacement") void grow_to(size_t n) const { m_data.grow_to(n); }
_ZN5Botan6BigInt11_from_wordsERNSt3__16vectorImNS_16secure_allocatorImEEEE:
 1052|  3.96k|      static BigInt _from_words(secure_vector<word>& words) {
 1053|  3.96k|         BigInt bn;
 1054|  3.96k|         bn.m_data.swap(words);
 1055|  3.96k|         return bn;
 1056|  3.96k|      }
_ZN5Botan6BigInt4Data12mutable_dataEv:
 1083|  4.09k|            word* mutable_data() {
 1084|  4.09k|               invalidate_sig_words();
 1085|  4.09k|               return m_reg.data();
 1086|  4.09k|            }
_ZN5Botan6BigInt4Data11set_word_atEmm:
 1106|    810|            void set_word_at(size_t i, word w) {
 1107|    810|               invalidate_sig_words();
 1108|    810|               if(i >= m_reg.size()) {
  ------------------
  |  Branch (1108:19): [True: 810, False: 0]
  ------------------
 1109|    810|                  if(w == 0) {
  ------------------
  |  Branch (1109:22): [True: 0, False: 810]
  ------------------
 1110|      0|                     return;
 1111|      0|                  }
 1112|    810|                  grow_to(i + 1);
 1113|    810|               }
 1114|    810|               m_reg[i] = w;
 1115|    810|            }
_ZNK5Botan6BigInt4Data7grow_toEm:
 1126|  4.09k|            void grow_to(size_t n) const {
 1127|  4.09k|               if(n > size()) {
  ------------------
  |  Branch (1127:19): [True: 4.09k, False: 0]
  ------------------
 1128|  4.09k|                  if(n <= m_reg.capacity()) {
  ------------------
  |  Branch (1128:22): [True: 0, False: 4.09k]
  ------------------
 1129|      0|                     m_reg.resize(n);
 1130|  4.09k|                  } else {
 1131|  4.09k|                     m_reg.resize(n + (8 - (n % 8)));
 1132|  4.09k|                  }
 1133|  4.09k|               }
 1134|  4.09k|            }
_ZNK5Botan6BigInt4Data4sizeEv:
 1136|  29.3k|            size_t size() const { return m_reg.size(); }
_ZN5Botan6BigInt4Data4swapERNSt3__16vectorImNS_16secure_allocatorImEEEE:
 1156|  5.63k|            void swap(secure_vector<word>& reg) noexcept {
 1157|  5.63k|               m_reg.swap(reg);
 1158|  5.63k|               invalidate_sig_words();
 1159|  5.63k|            }
_ZNK5Botan6BigInt4Data20invalidate_sig_wordsEv:
 1161|  10.5k|            void invalidate_sig_words() const noexcept { m_sig_words = sig_words_npos; }
_ZN5Botan6BigIntC2Ev:
   45|  13.0k|      BigInt() = default;
_ZN5Botan6BigIntC2ERKS0_:
   88|     65|      BigInt(const BigInt& other) = default;

_ZN5Botan11clear_bytesEPvm:
  101|  1.67k|inline constexpr void clear_bytes(void* ptr, size_t bytes) {
  102|  1.67k|   if(bytes > 0) {
  ------------------
  |  Branch (102:7): [True: 6, False: 1.66k]
  ------------------
  103|      6|      std::memset(ptr, 0, bytes);
  104|      6|   }
  105|  1.67k|}
_ZN5Botan9clear_memImEEvPT_m:
  118|  1.66k|inline constexpr void clear_mem(T* ptr, size_t n) {
  119|  1.66k|   clear_bytes(ptr, sizeof(T) * n);
  120|  1.66k|}
_ZN5Botan8copy_memImQsr3stdE12is_trivial_vIu7__decayIT_EEEEvPS1_PKS1_m:
  144|      9|inline constexpr void copy_mem(T* out, const T* in, size_t n) {
  145|      9|   BOTAN_ASSERT_IMPLICATION(n > 0, in != nullptr && out != nullptr, "If n > 0 then args are not null");
  ------------------
  |  |  110|      9|   do {                                                                                          \
  |  |  111|      9|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                                              \
  |  |  112|     18|      if((expr1) && !(expr2)) {                                                                  \
  |  |  ------------------
  |  |  |  Branch (112:10): [True: 9, False: 0]
  |  |  |  Branch (112:23): [True: 9, False: 0]
  |  |  |  Branch (112:23): [True: 9, False: 0]
  |  |  ------------------
  |  |  113|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                                     \
  |  |  114|      0|         Botan::assertion_failure(#expr1 " implies " #expr2, msg, __func__, __FILE__, __LINE__); \
  |  |  115|      0|      }                                                                                          \
  |  |  116|      9|   } while(0)
  |  |  ------------------
  |  |  |  Branch (116:12): [Folded, False: 9]
  |  |  ------------------
  ------------------
  146|       |
  147|      9|   if(in != nullptr && out != nullptr && n > 0) {
  ------------------
  |  Branch (147:7): [True: 9, False: 0]
  |  Branch (147:24): [True: 9, False: 0]
  |  Branch (147:42): [True: 9, False: 0]
  ------------------
  148|      9|      std::memmove(out, in, sizeof(T) * n);
  149|      9|   }
  150|      9|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS6_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEEES6_RKSB_:
  210|  13.6k|inline constexpr ToT typecast_copy(const FromR& src) {
  211|  13.6k|   ToT dst;  // NOLINT(*-member-init)
  212|  13.6k|   typecast_copy(dst, src);
  213|  13.6k|   return dst;
  214|  13.6k|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIKhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISK_EEEvRSK_RKSA_:
  188|  13.6k|inline constexpr void typecast_copy(ToT& out, const FromR& in) {
  189|  13.6k|   typecast_copy(std::span<ToT, 1>(&out, 1), in);
  190|  13.6k|}
_ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IKhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEEEvOSL_RKSB_:
  176|  13.6k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) {
  177|  13.6k|   ranges::assert_equal_byte_lengths(out, in);
  178|  13.6k|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|  13.6k|}
_ZN5Botan8copy_memITkNS_6ranges23contiguous_output_rangeENSt3__14spanIhLm18446744073709551615EEETkNS1_16contiguous_rangeENS3_IKhLm18446744073709551615EEEQaasr3stdE9is_same_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISE_EESF_E4type10value_typeENS7_IXsr21__is_primary_templateINS8_Iu14__remove_cvrefIDTclL_ZNSA_5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENSG_ISO_EESP_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIST_EEEvOSB_RKSL_:
  160|  1.30k|inline constexpr void copy_mem(OutR&& out /* NOLINT(*-std-forward) */, const InR& in) {
  161|  1.30k|   ranges::assert_equal_byte_lengths(out, in);
  162|  1.30k|   if(std::is_constant_evaluated()) {
  ------------------
  |  Branch (162:7): [Folded, False: 1.30k]
  ------------------
  163|      0|      std::copy(std::ranges::begin(in), std::ranges::end(in), std::ranges::begin(out));
  164|  1.30k|   } else if(ranges::size_bytes(out) > 0) {
  ------------------
  |  Branch (164:14): [True: 1.30k, False: 0]
  ------------------
  165|  1.30k|      std::memmove(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  166|  1.30k|   }
  167|  1.30k|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE26is_default_constructible_vIT_Esr3stdE23is_trivially_copyable_vIS5_Esr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEEES5_RKSA_:
  210|  1.30k|inline constexpr ToT typecast_copy(const FromR& src) {
  211|  1.30k|   ToT dst;  // NOLINT(*-member-init)
  212|  1.30k|   typecast_copy(dst, src);
  213|  1.30k|   return dst;
  214|  1.30k|}
_ZN5Botan13typecast_copyImTkNS_6ranges16contiguous_rangeENSt3__14spanIhLm8EEEQaaaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISC_EESD_E4type10value_typeEEsr3stdE23is_trivially_copyable_vIT_Entsr3std6rangesE5rangeISJ_EEEvRSJ_RKS9_:
  188|  1.30k|inline constexpr void typecast_copy(ToT& out, const FromR& in) {
  189|  1.30k|   typecast_copy(std::span<ToT, 1>(&out, 1), in);
  190|  1.30k|}
_ZN5Botan13typecast_copyITkNS_6ranges23contiguous_output_rangeENSt3__14spanImLm1EEETkNS1_16contiguous_rangeENS3_IhLm8EEEQaasr3stdE23is_trivially_copyable_vINS2_11conditionalIXsr21__is_primary_templateINS2_15iterator_traitsIu14__remove_cvrefIDTclL_ZNS2_6ranges5__cpo5beginEEclsr3stdE7declvalIRT0_EEEEEEEEE5valueENS2_26indirectly_readable_traitsISD_EESE_E4type10value_typeEEsr3stdE23is_trivially_copyable_vINS6_IXsr21__is_primary_templateINS7_Iu14__remove_cvrefIDTclL_ZNS9_5beginEEclsr3stdE7declvalIRT_EEEEEEEEE5valueENSF_ISN_EESO_E4type10value_typeEEEEvOSK_RKSA_:
  176|  1.30k|inline constexpr void typecast_copy(ToR&& out /* NOLINT(*-std-forward) */, const FromR& in) {
  177|  1.30k|   ranges::assert_equal_byte_lengths(out, in);
  178|  1.30k|   std::memcpy(std::ranges::data(out), std::ranges::data(in), ranges::size_bytes(out));
  179|  1.30k|}
_ZN5Botan9clear_memIjEEvPT_m:
  118|      6|inline constexpr void clear_mem(T* ptr, size_t n) {
  119|      6|   clear_bytes(ptr, sizeof(T) * n);
  120|      6|}

_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEETpTkNS0_14spanable_rangeEJNS3_IKhLm18446744073709551615EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|  1.30k|{
  101|  1.30k|   const std::span s0{r0};
  102|       |
  103|       |   if constexpr(statically_spanable_range<R0>) {
  104|       |      constexpr size_t expected_size = s0.size_bytes();
  105|       |      (assert_exact_byte_length<expected_size>(rs), ...);
  106|  1.30k|   } else {
  107|  1.30k|      const size_t expected_size = s0.size_bytes();
  108|  1.30k|      const bool correct_size =
  109|  1.30k|         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|  1.30k|      if(!correct_size) {
  ------------------
  |  Branch (111:10): [True: 0, False: 1.30k]
  ------------------
  112|      0|         memory_region_size_violation();
  113|      0|      }
  114|  1.30k|   }
  115|  1.30k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIhLm8EEEEEvRKT0_:
   77|  1.30k|inline constexpr void assert_exact_byte_length(const R& r) {
   78|  1.30k|   const std::span s{r};
   79|  1.30k|   if constexpr(statically_spanable_range<R>) {
   80|  1.30k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|  1.30k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__14spanIKhLm8EEEEEvRKT0_:
   77|  27.3k|inline constexpr void assert_exact_byte_length(const R& r) {
   78|  27.3k|   const std::span s{r};
   79|  27.3k|   if constexpr(statically_spanable_range<R>) {
   80|  27.3k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|  27.3k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IKhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|  13.6k|{
  101|  13.6k|   const std::span s0{r0};
  102|       |
  103|  13.6k|   if constexpr(statically_spanable_range<R0>) {
  104|  13.6k|      constexpr size_t expected_size = s0.size_bytes();
  105|  13.6k|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|  13.6k|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanImLm1EEEEEmRKT_:
   59|  15.0k|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|  15.0k|   return std::span{r}.size_bytes();
   61|  15.0k|}
_ZN5Botan6ranges10size_bytesITkNS0_14spanable_rangeENSt3__14spanIhLm18446744073709551615EEEEEmRKT_:
   59|  2.61k|inline constexpr size_t size_bytes(const spanable_range auto& r) {
   60|  2.61k|   return std::span{r}.size_bytes();
   61|  2.61k|}
_ZN5Botan6ranges24assert_exact_byte_lengthILm8ETkNS0_14spanable_rangeENSt3__15arrayIhLm8EEEEEvRKT0_:
   77|  1.30k|inline constexpr void assert_exact_byte_length(const R& r) {
   78|  1.30k|   const std::span s{r};
   79|  1.30k|   if constexpr(statically_spanable_range<R>) {
   80|  1.30k|      static_assert(s.size_bytes() == expected, "memory region does not have expected byte lengths");
   81|       |   } else {
   82|       |      if(s.size_bytes() != expected) {
   83|       |         memory_region_size_violation();
   84|       |      }
   85|       |   }
   86|  1.30k|}
_ZN5Botan6ranges25assert_equal_byte_lengthsITkNS0_14spanable_rangeENSt3__14spanImLm1EEETpTkNS0_14spanable_rangeEJNS3_IhLm8EEEEEEvRKT_DpRKT0_QgtsZT0_Li0E:
  100|  1.30k|{
  101|  1.30k|   const std::span s0{r0};
  102|       |
  103|  1.30k|   if constexpr(statically_spanable_range<R0>) {
  104|  1.30k|      constexpr size_t expected_size = s0.size_bytes();
  105|  1.30k|      (assert_exact_byte_length<expected_size>(rs), ...);
  106|       |   } else {
  107|       |      const size_t expected_size = s0.size_bytes();
  108|       |      const bool correct_size =
  109|       |         ((std::span<const std::ranges::range_value_t<Rs>>{rs}.size_bytes() == expected_size) && ...);
  110|       |
  111|       |      if(!correct_size) {
  112|       |         memory_region_size_violation();
  113|       |      }
  114|       |   }
  115|  1.30k|}

_ZN5Botan16secure_allocatorImE10deallocateEPmm:
  102|  11.4k|      void deallocate(T* p, std::size_t n) { deallocate_memory(p, n, sizeof(T)); }
_ZN5Botan16secure_allocatorImE8allocateEm:
   95|  11.4k|      T* allocate(std::size_t n) { return static_cast<T*>(allocate_memory(n, sizeof(T))); }

_ZN5Botan16wrap_strong_typeImRmQoosr3stdE18constructible_fromIT_T0_Eaasr8conceptsE11strong_typeIS2_Esr3stdE18constructible_fromINS2_12wrapped_typeES3_EEEDcOS3_:
  144|  15.0k|[[nodiscard]] constexpr decltype(auto) wrap_strong_type(ParamT&& t) {
  145|  15.0k|   if constexpr(std::same_as<std::remove_cvref_t<ParamT>, T>) {
  146|       |      // Noop, if the parameter type already is the desired return type.
  147|  15.0k|      return std::forward<ParamT>(t);
  148|       |   } else if constexpr(std::constructible_from<T, ParamT>) {
  149|       |      // Implicit conversion from the parameter type to the return type.
  150|       |      return T{std::forward<ParamT>(t)};
  151|       |   } else {
  152|       |      // Explicitly calling the wrapped type's constructor to support
  153|       |      // implicit conversions on types that mark their constructors as explicit.
  154|       |      static_assert(concepts::strong_type<T> && std::constructible_from<typename T::wrapped_type, ParamT>);
  155|       |      return T{typename T::wrapped_type{std::forward<ParamT>(t)}};
  156|       |   }
  157|  15.0k|}

_Z4fuzzNSt3__14spanIKhLm18446744073709551615EEE:
   10|    851|void fuzz(std::span<const uint8_t> in) {
   11|    851|   if(in.size() > 2 * 4096 / 8) {
  ------------------
  |  Branch (11:7): [True: 17, False: 834]
  ------------------
   12|     17|      return;
   13|     17|   }
   14|       |
   15|       |   // Save on allocations by making these static
   16|    834|   static Botan::BigInt x;
   17|    834|   static Botan::BigInt y;
   18|    834|   static Botan::BigInt q;
   19|    834|   static Botan::BigInt r;
   20|    834|   static Botan::BigInt z;
   21|    834|   static Botan::BigInt ct_q;
   22|       |
   23|    834|   x = Botan::BigInt::from_bytes(in.subspan(0, in.size() / 2));
   24|    834|   y = Botan::BigInt::from_bytes(in.subspan(in.size() / 2, in.size() - in.size() / 2));
   25|       |
   26|    834|   if(y == 0) {
  ------------------
  |  Branch (26:7): [True: 2, False: 832]
  ------------------
   27|      2|      return;
   28|      2|   }
   29|       |
   30|    832|   Botan::ct_divide(x, y, q, r);
   31|       |
   32|    832|   FUZZER_ASSERT_TRUE(r < y);
  ------------------
  |  |   89|    832|   do {                                                               \
  |  |   90|    832|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                   \
  |  |   91|    832|      if(!(e)) {                                                      \
  |  |  ------------------
  |  |  |  Branch (91:10): [True: 0, False: 832]
  |  |  ------------------
  |  |   92|      0|         FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \
  |  |  ------------------
  |  |  |  |   70|      0|   do {                                                                                                       \
  |  |  |  |   71|      0|      std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \
  |  |  |  |   72|      0|      abort();                                                                                                \
  |  |  |  |   73|      0|   } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (73:12): [Folded, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   93|      0|      }                                                               \
  |  |   94|    832|   } while(0)
  |  |  ------------------
  |  |  |  Branch (94:12): [Folded, False: 832]
  |  |  ------------------
  ------------------
   33|       |
   34|    832|   z = q * y + r;
   35|       |
   36|    832|   FUZZER_ASSERT_EQUAL(z, x);
  ------------------
  |  |   79|    832|   do {                                                                                      \
  |  |   80|    832|      if((x) != (y)) {                                                                       \
  |  |  ------------------
  |  |  |  Branch (80:10): [True: 0, False: 832]
  |  |  ------------------
  |  |   81|      0|         FUZZER_WRITE_AND_CRASH(#x << " = " << (x) << " != " << #y << " = " << (y) << "\n"); \
  |  |  ------------------
  |  |  |  |   70|      0|   do {                                                                                                       \
  |  |  |  |   71|      0|      std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \
  |  |  |  |   72|      0|      abort();                                                                                                \
  |  |  |  |   73|      0|   } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (73:12): [Folded, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   82|      0|      }                                                                                      \
  |  |   83|    832|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 832]
  |  |  ------------------
  ------------------
   37|       |
   38|       |   // Now divide by just low word of y, cross-checking the word division
   39|       |   // against the general division
   40|       |
   41|    832|   const Botan::word yw = y.word_at(0);
   42|    832|   if(yw == 0) {
  ------------------
  |  Branch (42:7): [True: 22, False: 810]
  ------------------
   43|     22|      return;
   44|     22|   }
   45|       |
   46|    810|   y = Botan::BigInt::from_word(yw);
   47|       |
   48|    810|   Botan::ct_divide(x, y, q, r);
   49|       |
   50|    810|   FUZZER_ASSERT_TRUE(r < y);
  ------------------
  |  |   89|    810|   do {                                                               \
  |  |   90|    810|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                   \
  |  |   91|    810|      if(!(e)) {                                                      \
  |  |  ------------------
  |  |  |  Branch (91:10): [True: 0, False: 810]
  |  |  ------------------
  |  |   92|      0|         FUZZER_WRITE_AND_CRASH("Expression " << #e << " was false"); \
  |  |  ------------------
  |  |  |  |   70|      0|   do {                                                                                                       \
  |  |  |  |   71|      0|      std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \
  |  |  |  |   72|      0|      abort();                                                                                                \
  |  |  |  |   73|      0|   } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (73:12): [Folded, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   93|      0|      }                                                               \
  |  |   94|    810|   } while(0)
  |  |  ------------------
  |  |  |  Branch (94:12): [Folded, False: 810]
  |  |  ------------------
  ------------------
   51|    810|   z = q * y + r;
   52|    810|   FUZZER_ASSERT_EQUAL(z, x);
  ------------------
  |  |   79|    810|   do {                                                                                      \
  |  |   80|    810|      if((x) != (y)) {                                                                       \
  |  |  ------------------
  |  |  |  Branch (80:10): [True: 0, False: 810]
  |  |  ------------------
  |  |   81|      0|         FUZZER_WRITE_AND_CRASH(#x << " = " << (x) << " != " << #y << " = " << (y) << "\n"); \
  |  |  ------------------
  |  |  |  |   70|      0|   do {                                                                                                       \
  |  |  |  |   71|      0|      std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \
  |  |  |  |   72|      0|      abort();                                                                                                \
  |  |  |  |   73|      0|   } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (73:12): [Folded, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   82|      0|      }                                                                                      \
  |  |   83|    810|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 810]
  |  |  ------------------
  ------------------
   53|       |
   54|    810|   Botan::word rw = 0;
   55|    810|   Botan::ct_divide_word(x, yw, ct_q, rw);
   56|    810|   FUZZER_ASSERT_EQUAL(ct_q, q);
  ------------------
  |  |   79|    810|   do {                                                                                      \
  |  |   80|    810|      if((x) != (y)) {                                                                       \
  |  |  ------------------
  |  |  |  Branch (80:10): [True: 0, False: 810]
  |  |  ------------------
  |  |   81|      0|         FUZZER_WRITE_AND_CRASH(#x << " = " << (x) << " != " << #y << " = " << (y) << "\n"); \
  |  |  ------------------
  |  |  |  |   70|      0|   do {                                                                                                       \
  |  |  |  |   71|      0|      std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \
  |  |  |  |   72|      0|      abort();                                                                                                \
  |  |  |  |   73|      0|   } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (73:12): [Folded, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   82|      0|      }                                                                                      \
  |  |   83|    810|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 810]
  |  |  ------------------
  ------------------
   57|    810|   FUZZER_ASSERT_EQUAL(rw, r.word_at(0));
  ------------------
  |  |   79|    810|   do {                                                                                      \
  |  |   80|    810|      if((x) != (y)) {                                                                       \
  |  |  ------------------
  |  |  |  Branch (80:10): [True: 0, False: 810]
  |  |  ------------------
  |  |   81|      0|         FUZZER_WRITE_AND_CRASH(#x << " = " << (x) << " != " << #y << " = " << (y) << "\n"); \
  |  |  ------------------
  |  |  |  |   70|      0|   do {                                                                                                       \
  |  |  |  |   71|      0|      std::cerr << expr << " @ Line " << __LINE__ << " in " << __FILE__ << "\n"; /* NOLINT(*-macro-paren*) */ \
  |  |  |  |   72|      0|      abort();                                                                                                \
  |  |  |  |   73|      0|   } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (73:12): [Folded, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   82|      0|      }                                                                                      \
  |  |   83|    810|   } while(0)
  |  |  ------------------
  |  |  |  Branch (83:12): [Folded, False: 810]
  |  |  ------------------
  ------------------
   58|    810|}

LLVMFuzzerInitialize:
   28|      2|extern "C" int LLVMFuzzerInitialize(int* /*argc*/, char*** /*argv*/) {
   29|       |   /*
   30|       |   * This disables the mlock pool, as overwrites within the pool are
   31|       |   * opaque to ASan or other instrumentation.
   32|       |   */
   33|      2|   ::setenv("BOTAN_MLOCK_POOL_SIZE", "0", 1);
   34|      2|   return 0;
   35|      2|}
LLVMFuzzerTestOneInput:
   39|    861|extern "C" int LLVMFuzzerTestOneInput(const uint8_t in[], size_t len) {
   40|    861|   if(len <= max_fuzzer_input_size) {
  ------------------
  |  Branch (40:7): [True: 851, False: 10]
  ------------------
   41|    851|      try {
   42|    851|         fuzz(std::span<const uint8_t>(in, len));
   43|    851|      } catch(const std::exception& e) {
   44|      0|         std::cerr << "Uncaught exception from fuzzer driver " << e.what() << "\n";
   45|      0|         abort();
   46|      0|      } catch(...) {
   47|      0|         std::cerr << "Uncaught exception from fuzzer driver (unknown type)\n";
   48|      0|         abort();
   49|      0|      }
   50|    851|   }
   51|    861|   return 0;
   52|    861|}

_ZN5Botan6BigInt4add2ERKS0_PKmmNS0_4SignE:
   20|  1.64k|BigInt BigInt::add2(const BigInt& x, const word y[], size_t y_size, BigInt::Sign y_sign) {
   21|  1.64k|   const size_t x_sw = x.sig_words();
   22|       |
   23|  1.64k|   BigInt z = BigInt::with_capacity(std::max(x_sw, y_size) + 1);
   24|       |
   25|  1.64k|   if(x.sign() == y_sign) {
  ------------------
  |  Branch (25:7): [True: 1.64k, False: 0]
  ------------------
   26|  1.64k|      const word carry = bigint_add3(z.mutable_data(), x._data(), x_sw, y, y_size);
   27|  1.64k|      z.mutable_data()[std::max(x_sw, y_size)] += carry;
   28|  1.64k|      z.set_sign(x.sign());
   29|  1.64k|   } else {
   30|      0|      const int32_t relative_size = bigint_cmp(x.data(), x_sw, y, y_size);
   31|       |
   32|      0|      if(relative_size < 0) {
  ------------------
  |  Branch (32:10): [True: 0, False: 0]
  ------------------
   33|       |         // x < y so z = abs(y - x)
   34|       |         // NOLINTNEXTLINE(*-suspicious-call-argument) intentionally swapping x and y here
   35|      0|         bigint_sub3(z.mutable_data(), y, y_size, x.data(), x_sw);
   36|      0|         z.set_sign(y_sign);
   37|      0|      } else if(relative_size == 0) {
  ------------------
  |  Branch (37:17): [True: 0, False: 0]
  ------------------
   38|       |         // Positive zero (nothing to do in this case)
   39|      0|      } else {
   40|       |         /*
   41|       |         * We know at this point that x >= y so if y_size is larger than
   42|       |         * x_sw, we are guaranteed they are just leading zeros which can
   43|       |         * be ignored
   44|       |         */
   45|      0|         y_size = std::min(x_sw, y_size);
   46|      0|         bigint_sub3(z.mutable_data(), x.data(), x_sw, y, y_size);
   47|      0|         z.set_sign(x.sign());
   48|      0|      }
   49|      0|   }
   50|       |
   51|  1.64k|   return z;
   52|  1.64k|}
_ZN5BotanmlERKNS_6BigIntES2_:
   57|  1.64k|BigInt operator*(const BigInt& x, const BigInt& y) {
   58|  1.64k|   const size_t x_sw = x.sig_words();
   59|  1.64k|   const size_t y_sw = y.sig_words();
   60|       |
   61|  1.64k|   BigInt z = BigInt::with_capacity(x.size() + y.size());
   62|       |
   63|  1.64k|   if(x_sw == 1 && y_sw > 0) {
  ------------------
  |  Branch (63:7): [True: 366, False: 1.27k]
  |  Branch (63:20): [True: 366, False: 0]
  ------------------
   64|    366|      bigint_linmul3(z.mutable_data(), y._data(), y_sw, x.word_at(0));
   65|  1.27k|   } else if(y_sw == 1 && x_sw > 0) {
  ------------------
  |  Branch (65:14): [True: 982, False: 294]
  |  Branch (65:27): [True: 272, False: 710]
  ------------------
   66|    272|      bigint_linmul3(z.mutable_data(), x._data(), x_sw, y.word_at(0));
   67|  1.00k|   } else if(x_sw > 0 && y_sw > 0) {
  ------------------
  |  Branch (67:14): [True: 171, False: 833]
  |  Branch (67:26): [True: 171, False: 0]
  ------------------
   68|    171|      secure_vector<word> workspace(z.size());
   69|       |
   70|    171|      bigint_mul(z.mutable_data(),
   71|    171|                 z.size(),
   72|    171|                 x._data(),
   73|    171|                 x.size(),
   74|    171|                 x_sw,
   75|    171|                 y._data(),
   76|    171|                 y.size(),
   77|    171|                 y_sw,
   78|    171|                 workspace.data(),
   79|    171|                 workspace.size());
   80|    171|   }
   81|       |
   82|  1.64k|   z.cond_flip_sign(x_sw > 0 && y_sw > 0 && x.sign() != y.sign());
  ------------------
  |  Branch (82:21): [True: 809, False: 833]
  |  Branch (82:33): [True: 809, False: 0]
  |  Branch (82:45): [True: 0, False: 809]
  ------------------
   83|       |
   84|  1.64k|   return z;
   85|  1.64k|}

_ZN5Botan6BigInt9from_wordEm:
   33|    810|BigInt BigInt::from_word(word n) {
   34|    810|   BigInt bn;
   35|    810|   bn.set_word_at(0, n);
   36|    810|   return bn;
   37|    810|}
_ZN5Botan6BigInt13with_capacityEm:
   49|  3.28k|BigInt BigInt::with_capacity(size_t size) {
   50|  3.28k|   BigInt bn;
   51|  3.28k|   bn.grow_to(size);
   52|  3.28k|   return bn;
   53|  3.28k|}
_ZN5Botan6BigInt10from_bytesENSt3__14spanIKhLm18446744073709551615EEE:
   81|  1.66k|BigInt BigInt::from_bytes(std::span<const uint8_t> input) {
   82|  1.66k|   BigInt r;
   83|  1.66k|   r.assign_from_bytes(input);
   84|  1.66k|   return r;
   85|  1.66k|}
_ZNK5Botan6BigInt8cmp_wordEm:
  120|    834|int32_t BigInt::cmp_word(word other) const {
  121|    834|   if(signum() < 0) {
  ------------------
  |  Branch (121:7): [True: 0, False: 834]
  ------------------
  122|      0|      return -1;  // other is positive ...
  123|      0|   }
  124|       |
  125|    834|   const size_t sw = this->sig_words();
  126|    834|   if(sw > 1) {
  ------------------
  |  Branch (126:7): [True: 452, False: 382]
  ------------------
  127|    452|      return 1;  // must be larger since other is just one word ...
  128|    452|   }
  129|       |
  130|    382|   return bigint_cmp(this->_data(), sw, &other, 1);
  131|    834|}
_ZNK5Botan6BigInt8is_equalERKS0_:
  154|  2.45k|bool BigInt::is_equal(const BigInt& other) const {
  155|  2.45k|   if(this->sign() != other.sign()) {
  ------------------
  |  Branch (155:7): [True: 0, False: 2.45k]
  ------------------
  156|      0|      return false;
  157|      0|   }
  158|       |
  159|  2.45k|   return bigint_ct_is_eq(this->_data(), this->size(), other._data(), other.size()).as_bool();
  160|  2.45k|}
_ZNK5Botan6BigInt12is_less_thanERKS0_:
  162|  1.64k|bool BigInt::is_less_than(const BigInt& other) const {
  163|  1.64k|   if(this->signum() < 0 && other.signum() >= 0) {
  ------------------
  |  Branch (163:7): [True: 0, False: 1.64k]
  |  Branch (163:29): [True: 0, False: 0]
  ------------------
  164|      0|      return true;
  165|      0|   }
  166|       |
  167|  1.64k|   if(this->signum() >= 0 && other.signum() < 0) {
  ------------------
  |  Branch (167:7): [True: 1.64k, False: 0]
  |  Branch (167:30): [True: 0, False: 1.64k]
  ------------------
  168|      0|      return false;
  169|      0|   }
  170|       |
  171|  1.64k|   if(other.signum() < 0 && this->signum() < 0) {
  ------------------
  |  Branch (171:7): [True: 0, False: 1.64k]
  |  Branch (171:29): [True: 0, False: 0]
  ------------------
  172|      0|      return bigint_ct_is_lt(other._data(), other.size(), this->_data(), this->size()).as_bool();
  173|      0|   }
  174|       |
  175|  1.64k|   return bigint_ct_is_lt(this->_data(), this->size(), other._data(), other.size()).as_bool();
  176|  1.64k|}
_ZN5Botan6BigInt4Data11set_to_zeroEv:
  189|  1.66k|void BigInt::Data::set_to_zero() {
  190|  1.66k|   m_reg.resize(m_reg.capacity());
  191|  1.66k|   clear_mem(m_reg.data(), m_reg.size());
  192|  1.66k|   m_sig_words = 0;
  193|  1.66k|}
_ZNK5Botan6BigInt4Data14calc_sig_wordsEv:
  213|  7.33k|size_t BigInt::Data::calc_sig_words() const {
  214|  7.33k|   const size_t sz = m_reg.size();
  215|  7.33k|   size_t sig = sz;
  216|       |
  217|  7.33k|   word sub = 1;
  218|       |
  219|  92.4k|   for(size_t i = 0; i != sz; ++i) {
  ------------------
  |  Branch (219:22): [True: 85.1k, False: 7.33k]
  ------------------
  220|  85.1k|      const word w = m_reg[sz - i - 1];
  221|  85.1k|      sub &= ct_is_zero(w);
  222|  85.1k|      sig -= sub;
  223|  85.1k|   }
  224|       |
  225|       |   /*
  226|       |   * This depends on the data so is poisoned, but unpoison it here as
  227|       |   * later conditionals are made on the size.
  228|       |   */
  229|  7.33k|   CT::unpoison(sig);
  230|       |
  231|  7.33k|   return sig;
  232|  7.33k|}
_ZNK5Botan6BigInt3absEv:
  384|     65|BigInt BigInt::abs() const {
  385|     65|   BigInt x = (*this);
  386|     65|   x.set_sign(Positive);
  387|     65|   return x;
  388|     65|}
_ZN5Botan6BigInt17assign_from_bytesENSt3__14spanIKhLm18446744073709551615EEE:
  423|  1.66k|void BigInt::assign_from_bytes(std::span<const uint8_t> bytes) {
  424|  1.66k|   clear();
  425|       |
  426|  1.66k|   const size_t length = bytes.size();
  427|  1.66k|   const size_t full_words = length / sizeof(word);
  428|  1.66k|   const size_t extra_bytes = length % sizeof(word);
  429|       |
  430|  1.66k|   const size_t total_words = full_words + (extra_bytes > 0 ? 1 : 0);
  ------------------
  |  Branch (430:45): [True: 1.30k, False: 362]
  ------------------
  431|       |
  432|  1.66k|   secure_vector<word> reg(8 * ceil_division<size_t>(total_words, 8));
  433|       |
  434|  15.3k|   for(size_t i = 0; i != full_words; ++i) {
  ------------------
  |  Branch (434:22): [True: 13.6k, False: 1.66k]
  ------------------
  435|  13.6k|      reg[i] = load_be<word>(bytes.last<sizeof(word)>());
  436|  13.6k|      bytes = bytes.first(bytes.size() - sizeof(word));
  437|  13.6k|   }
  438|       |
  439|  1.66k|   if(!bytes.empty()) {
  ------------------
  |  Branch (439:7): [True: 1.30k, False: 362]
  ------------------
  440|  1.30k|      BOTAN_ASSERT_NOMSG(extra_bytes == bytes.size());
  ------------------
  |  |   84|  1.30k|   do {                                                                     \
  |  |   85|  1.30k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|  1.30k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 1.30k]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|  1.30k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 1.30k]
  |  |  ------------------
  ------------------
  441|  1.30k|      std::array<uint8_t, sizeof(word)> last_partial_word = {0};
  442|  1.30k|      copy_mem(std::span{last_partial_word}.last(extra_bytes), bytes);
  443|  1.30k|      reg[full_words] = load_be<word>(last_partial_word);
  444|  1.30k|   }
  445|       |
  446|  1.66k|   m_data.swap(reg);
  447|  1.66k|}
_ZN5Botan6BigInt14cond_flip_signEb:
  521|  3.28k|void BigInt::cond_flip_sign(bool predicate) {
  522|       |   // This code is assuming Negative == 0, Positive == 1
  523|       |
  524|  3.28k|   const auto mask = CT::Mask<uint8_t>::expand_bool(predicate);
  525|       |
  526|  3.28k|   const uint8_t current_sign = static_cast<uint8_t>(sign());
  527|       |
  528|  3.28k|   const uint8_t new_sign = mask.select(current_sign ^ 1, current_sign);
  529|       |
  530|  3.28k|   set_sign(static_cast<Sign>(new_sign));
  531|  3.28k|}
_ZNK5Botan6BigInt20_const_time_unpoisonEv:
  559|  13.1k|void BigInt::_const_time_unpoison() const {
  560|  13.1k|   CT::unpoison(m_data.const_data(), m_data.size());
  561|  13.1k|}

_ZN5Botan9ct_divideERKNS_6BigIntES2_RS0_S3_:
  180|  1.64k|void ct_divide(const BigInt& x, const BigInt& y, BigInt& q_out, BigInt& r_out) {
  181|  1.64k|   if(y.is_zero()) {
  ------------------
  |  Branch (181:7): [True: 0, False: 1.64k]
  ------------------
  182|      0|      throw Invalid_Argument("ct_divide: cannot divide by zero");
  183|      0|   }
  184|       |
  185|  1.64k|   BigInt q;
  186|  1.64k|   BigInt r;
  187|  1.64k|   ct_divide_impl(q, r, x, y);
  188|       |
  189|  1.64k|   sign_fixup(x, y, q, r);
  190|  1.64k|   r_out = std::move(r);
  191|  1.64k|   q_out = std::move(q);
  192|  1.64k|}
_ZN5Botan14ct_divide_wordERKNS_6BigIntEmRS0_Rm:
  205|    810|void ct_divide_word(const BigInt& x, word y, BigInt& q_out, word& r_out) {
  206|    810|   if(y == 0) {
  ------------------
  |  Branch (206:7): [True: 0, False: 810]
  ------------------
  207|      0|      throw Invalid_Argument("ct_divide_word: cannot divide by zero");
  208|      0|   }
  209|       |
  210|    810|   const size_t x_words = x.sig_words();
  211|       |
  212|       |   // The divisor is public here; setup is variable time in it
  213|    810|   const auto div_y = divide_precomp<word>::setup_vartime(y);
  214|       |
  215|    810|   secure_vector<word> qw(x_words);
  216|    810|   word r = 0;
  217|       |
  218|       |   // Each step depends on r < y, which holds since r is a remainder mod y
  219|  7.43k|   for(size_t i = x_words; i > 0; --i) {
  ------------------
  |  Branch (219:28): [True: 6.62k, False: 810]
  ------------------
  220|  6.62k|      const auto [qi, ri] = div_y.divmod_2to1_vartime(r, x._data()[i - 1]);
  221|  6.62k|      qw[i - 1] = qi;
  222|  6.62k|      r = ri;
  223|  6.62k|   }
  224|       |
  225|    810|   BigInt q = BigInt::_from_words(qw);
  226|       |
  227|    810|   if(x.signum() < 0) {
  ------------------
  |  Branch (227:7): [True: 0, False: 810]
  ------------------
  228|      0|      q.flip_sign();
  229|      0|      if(r != 0) {
  ------------------
  |  Branch (229:10): [True: 0, False: 0]
  ------------------
  230|      0|         --q;
  231|      0|         r = y - r;
  232|      0|      }
  233|      0|   }
  234|       |
  235|    810|   r_out = r;
  236|    810|   q_out = std::move(q);
  237|    810|}
divide.cpp:_ZN5Botan12_GLOBAL__N_114ct_divide_implERNS_6BigIntES2_RKS1_S4_:
   66|  1.64k|void ct_divide_impl(BigInt& q_out, BigInt& r_out, const BigInt& x, const BigInt& y) {
   67|  1.64k|   constexpr size_t WB = WordInfo<word>::bits;
   68|       |
   69|  1.64k|   const size_t x_words = x.sig_words();
   70|  1.64k|   const size_t y_words = y.sig_words();
   71|  1.64k|   BOTAN_ASSERT_NOMSG(y_words > 0);
  ------------------
  |  |   84|  1.64k|   do {                                                                     \
  |  |   85|  1.64k|      /* NOLINTNEXTLINE(*-simplify-boolean-expr) */                         \
  |  |   86|  1.64k|      if(!(expr)) {                                                         \
  |  |  ------------------
  |  |  |  Branch (86:10): [True: 0, False: 1.64k]
  |  |  ------------------
  |  |   87|      0|         /* NOLINTNEXTLINE(bugprone-lambda-function-name) */                \
  |  |   88|      0|         Botan::assertion_failure(#expr, "", __func__, __FILE__, __LINE__); \
  |  |   89|      0|      }                                                                     \
  |  |   90|  1.64k|   } while(0)
  |  |  ------------------
  |  |  |  Branch (90:12): [Folded, False: 1.64k]
  |  |  ------------------
  ------------------
   72|       |
   73|  1.64k|   if(x_words < y_words) {
  ------------------
  |  Branch (73:7): [True: 65, False: 1.57k]
  ------------------
   74|       |      // Here |x| < |y| so q = 0 and r = |x|
   75|     65|      r_out = x.abs();
   76|     65|      q_out = BigInt::zero();
   77|     65|      return;
   78|     65|   }
   79|       |
   80|  1.57k|   const size_t r_words = x_words + 1;
   81|  1.57k|   const size_t q_words = x_words - y_words + 1;
   82|       |
   83|       |   // The number of leading zero bits of y, in [0,WB)
   84|  1.57k|   const word s = static_cast<word>(WB) - static_cast<word>(high_bit(CT::value_barrier(y._data()[y_words - 1])));
   85|  1.57k|   const auto s_mask = CT::Mask<word>::expand(s);
   86|  1.57k|   const word s_comp = s_mask.if_set_return(static_cast<word>(WB) - s);
   87|       |
   88|  1.57k|   secure_vector<word> yn(y_words);
   89|  1.57k|   secure_vector<word> rw(r_words);
   90|  1.57k|   secure_vector<word> qw(q_words);
   91|       |
   92|       |   // Normalize: yn = |y| << s (which sets the top bit of yn) and rw = |x| << s;
   93|       |   // shifting y stays within y_words words, shifting x adds at most one word
   94|  1.57k|   word carry = 0;
   95|  6.09k|   for(size_t i = 0; i != y_words; ++i) {
  ------------------
  |  Branch (95:22): [True: 4.51k, False: 1.57k]
  ------------------
   96|  4.51k|      const word w = y._data()[i];
   97|  4.51k|      yn[i] = (w << s) | carry;
   98|  4.51k|      carry = s_mask.if_set_return(w >> s_comp);
   99|  4.51k|   }
  100|       |
  101|  1.57k|   carry = 0;
  102|  14.8k|   for(size_t i = 0; i != x_words; ++i) {
  ------------------
  |  Branch (102:22): [True: 13.2k, False: 1.57k]
  ------------------
  103|  13.2k|      const word w = x._data()[i];
  104|  13.2k|      rw[i] = (w << s) | carry;
  105|  13.2k|      carry = s_mask.if_set_return(w >> s_comp);
  106|  13.2k|   }
  107|  1.57k|   rw[x_words] = carry;
  108|       |
  109|  1.57k|   const auto div_by_yn = divide_precomp<word>::setup(CT::value_barrier(yn[y_words - 1]));
  110|       |
  111|  1.57k|   if(y_words == 1) {
  ------------------
  |  Branch (111:7): [True: 1.15k, False: 426]
  ------------------
  112|       |      /*
  113|       |      * 2/1 word-serial division. The initial remainder is the shift-out
  114|       |      * carry, which is less than 2^s and so less than the divisor.
  115|       |      */
  116|  1.15k|      word r = rw[x_words];
  117|  8.51k|      for(size_t i = x_words; i > 0; --i) {
  ------------------
  |  Branch (117:31): [True: 7.36k, False: 1.15k]
  ------------------
  118|  7.36k|         const auto [qi, ri] = div_by_yn.divmod_2to1_ct(r, rw[i - 1]);
  119|  7.36k|         qw[i - 1] = qi;
  120|  7.36k|         r = ri;
  121|  7.36k|      }
  122|       |
  123|  1.15k|      rw[0] = r >> s;
  124|  1.15k|   } else {
  125|    426|      const word yn1 = yn[y_words - 1];
  126|    426|      const word yn2 = yn[y_words - 2];
  127|       |
  128|  3.40k|      for(size_t i = q_words; i > 0; --i) {
  ------------------
  |  Branch (128:31): [True: 2.98k, False: 426]
  ------------------
  129|  2.98k|         const size_t j = i - 1;  // current window is rw[j ... j + y_words]
  130|       |
  131|  2.98k|         const word u2 = rw[j + y_words];
  132|  2.98k|         const word u1 = rw[j + y_words - 1];
  133|  2.98k|         const word u0 = rw[j + y_words - 2];
  134|       |
  135|       |         /*
  136|       |         * Estimate the quotient digit from the top two words of the window.
  137|       |         * The window invariant gives u2 <= yn1; if u2 == yn1 the 2/1
  138|       |         * division precondition does not hold, and instead the digit
  139|       |         * estimate is the maximum word value.
  140|       |         */
  141|  2.98k|         const auto top_eq = CT::Mask<word>::is_equal(u2, yn1);
  142|  2.98k|         const word q_est = div_by_yn.divmod_2to1_ct(u2, u1).first;
  143|  2.98k|         word qhat = top_eq.select(WordInfo<word>::max, q_est);
  144|       |
  145|       |         // Per HAC 14.23, this correction is required at most twice
  146|  2.98k|         qhat -= division_check_ct(qhat, yn1, yn2, u2, u1, u0).if_set_return(1);
  147|  2.98k|         qhat -= division_check_ct(qhat, yn1, yn2, u2, u1, u0).if_set_return(1);
  148|       |
  149|       |         // Subtract qhat * yn from the window
  150|  2.98k|         const word bw = bigint_submul(&rw[j], yn.data(), y_words, qhat);
  151|  2.98k|         word borrow = 0;
  152|  2.98k|         rw[j + y_words] = word_sub(u2, bw, &borrow);
  153|       |
  154|       |         // If the digit was still one too large, the subtraction
  155|       |         // underflowed; add back and decrement the digit
  156|  2.98k|         const word cb = bigint_cnd_add(borrow, &rw[j], yn.data(), y_words);
  157|  2.98k|         rw[j + y_words] += cb;
  158|  2.98k|         qhat -= borrow;
  159|       |
  160|  2.98k|         qw[j] = qhat;
  161|  2.98k|      }
  162|       |
  163|       |      // The remainder is in rw[0:y_words], still shifted left by s, and
  164|       |      // rw[y_words] is zero
  165|  3.79k|      for(size_t i = 0; i != y_words; ++i) {
  ------------------
  |  Branch (165:25): [True: 3.36k, False: 426]
  ------------------
  166|  3.36k|         rw[i] = (rw[i] >> s) | s_mask.if_set_return(CT::value_barrier(rw[i + 1]) << s_comp);
  167|  3.36k|      }
  168|    426|   }
  169|       |
  170|  1.57k|   BigInt q = BigInt::_from_words(qw);
  171|  1.57k|   rw.resize(y_words);
  172|  1.57k|   BigInt r = BigInt::_from_words(rw);
  173|       |
  174|  1.57k|   r_out = std::move(r);
  175|  1.57k|   q_out = std::move(q);
  176|  1.57k|}
divide.cpp:_ZN5Botan12_GLOBAL__N_117division_check_ctEmmmmmm:
   39|  5.96k|inline CT::Mask<word> division_check_ct(word q, word y2, word y1, word x3, word x2, word x1) {
   40|  5.96k|   word y3 = 0;
   41|  5.96k|   y1 = word_madd2(q, y1, &y3);
   42|  5.96k|   y2 = word_madd2(q, y2, &y3);
   43|       |
   44|  5.96k|   const auto gt3 = CT::Mask<word>::is_gt(y3, x3);
   45|  5.96k|   const auto eq3 = CT::Mask<word>::is_equal(y3, x3);
   46|  5.96k|   const auto gt2 = CT::Mask<word>::is_gt(y2, x2);
   47|  5.96k|   const auto eq2 = CT::Mask<word>::is_equal(y2, x2);
   48|  5.96k|   const auto gt1 = CT::Mask<word>::is_gt(y1, x1);
   49|       |
   50|  5.96k|   return gt3 | (eq3 & (gt2 | (eq2 & gt1)));
   51|  5.96k|}
divide.cpp:_ZN5Botan12_GLOBAL__N_110sign_fixupERKNS_6BigIntES3_RS1_S4_:
   22|  1.64k|void sign_fixup(const BigInt& x, const BigInt& y, BigInt& q, BigInt& r) {
   23|  1.64k|   q.cond_flip_sign(x.sign() != y.sign());
   24|       |
   25|  1.64k|   if(x.signum() < 0 && r.signum() != 0) {
  ------------------
  |  Branch (25:7): [True: 0, False: 1.64k]
  |  Branch (25:25): [True: 0, False: 0]
  ------------------
   26|      0|      if(y.signum() > 0) {
  ------------------
  |  Branch (26:10): [True: 0, False: 0]
  ------------------
   27|      0|         q -= 1;
   28|      0|      } else {
   29|      0|         q += 1;
   30|      0|      }
   31|      0|      r = y.abs() - r;
   32|      0|   }
   33|  1.64k|}

_ZN5Botan17bigint_comba_mul4EPmPKmS2_:
   54|      9|void bigint_comba_mul4(word z[8], const word x[4], const word y[4]) {
   55|      9|#if defined(BOTAN_HAS_MP_MULX)
   56|      9|   if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) {
  ------------------
  |  Branch (56:7): [True: 9, False: 0]
  ------------------
   57|      9|      return bigint_mulx_mul4(z, x, y);
   58|      9|   }
   59|      0|#endif
   60|       |
   61|      0|   word3<word> accum;
   62|       |
   63|      0|   accum.mul(x[0], y[0]);
   64|      0|   z[0] = accum.extract();
   65|      0|   accum.mul(x[0], y[1]);
   66|      0|   accum.mul(x[1], y[0]);
   67|      0|   z[1] = accum.extract();
   68|      0|   accum.mul(x[0], y[2]);
   69|      0|   accum.mul(x[1], y[1]);
   70|      0|   accum.mul(x[2], y[0]);
   71|      0|   z[2] = accum.extract();
   72|      0|   accum.mul(x[0], y[3]);
   73|      0|   accum.mul(x[1], y[2]);
   74|      0|   accum.mul(x[2], y[1]);
   75|      0|   accum.mul(x[3], y[0]);
   76|      0|   z[3] = accum.extract();
   77|      0|   accum.mul(x[1], y[3]);
   78|      0|   accum.mul(x[2], y[2]);
   79|      0|   accum.mul(x[3], y[1]);
   80|      0|   z[4] = accum.extract();
   81|      0|   accum.mul(x[2], y[3]);
   82|      0|   accum.mul(x[3], y[2]);
   83|      0|   z[5] = accum.extract();
   84|      0|   accum.mul(x[3], y[3]);
   85|      0|   z[6] = accum.extract();
   86|      0|   z[7] = accum.extract();
   87|      0|}
_ZN5Botan17bigint_comba_mul6EPmPKmS2_:
  139|      6|void bigint_comba_mul6(word z[12], const word x[6], const word y[6]) {
  140|      6|#if defined(BOTAN_HAS_MP_MULX)
  141|      6|   if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) {
  ------------------
  |  Branch (141:7): [True: 6, False: 0]
  ------------------
  142|      6|      return bigint_mulx_mul6(z, x, y);
  143|      6|   }
  144|      0|#endif
  145|       |
  146|      0|   word3<word> accum;
  147|       |
  148|      0|   accum.mul(x[0], y[0]);
  149|      0|   z[0] = accum.extract();
  150|      0|   accum.mul(x[0], y[1]);
  151|      0|   accum.mul(x[1], y[0]);
  152|      0|   z[1] = accum.extract();
  153|      0|   accum.mul(x[0], y[2]);
  154|      0|   accum.mul(x[1], y[1]);
  155|      0|   accum.mul(x[2], y[0]);
  156|      0|   z[2] = accum.extract();
  157|      0|   accum.mul(x[0], y[3]);
  158|      0|   accum.mul(x[1], y[2]);
  159|      0|   accum.mul(x[2], y[1]);
  160|      0|   accum.mul(x[3], y[0]);
  161|      0|   z[3] = accum.extract();
  162|      0|   accum.mul(x[0], y[4]);
  163|      0|   accum.mul(x[1], y[3]);
  164|      0|   accum.mul(x[2], y[2]);
  165|      0|   accum.mul(x[3], y[1]);
  166|      0|   accum.mul(x[4], y[0]);
  167|      0|   z[4] = accum.extract();
  168|      0|   accum.mul(x[0], y[5]);
  169|      0|   accum.mul(x[1], y[4]);
  170|      0|   accum.mul(x[2], y[3]);
  171|      0|   accum.mul(x[3], y[2]);
  172|      0|   accum.mul(x[4], y[1]);
  173|      0|   accum.mul(x[5], y[0]);
  174|      0|   z[5] = accum.extract();
  175|      0|   accum.mul(x[1], y[5]);
  176|      0|   accum.mul(x[2], y[4]);
  177|      0|   accum.mul(x[3], y[3]);
  178|      0|   accum.mul(x[4], y[2]);
  179|      0|   accum.mul(x[5], y[1]);
  180|      0|   z[6] = accum.extract();
  181|      0|   accum.mul(x[2], y[5]);
  182|      0|   accum.mul(x[3], y[4]);
  183|      0|   accum.mul(x[4], y[3]);
  184|      0|   accum.mul(x[5], y[2]);
  185|      0|   z[7] = accum.extract();
  186|      0|   accum.mul(x[3], y[5]);
  187|      0|   accum.mul(x[4], y[4]);
  188|      0|   accum.mul(x[5], y[3]);
  189|      0|   z[8] = accum.extract();
  190|      0|   accum.mul(x[4], y[5]);
  191|      0|   accum.mul(x[5], y[4]);
  192|      0|   z[9] = accum.extract();
  193|      0|   accum.mul(x[5], y[5]);
  194|      0|   z[10] = accum.extract();
  195|      0|   z[11] = accum.extract();
  196|      0|}
_ZN5Botan17bigint_comba_mul8EPmPKmS2_:
  388|      8|void bigint_comba_mul8(word z[16], const word x[8], const word y[8]) {
  389|      8|#if defined(BOTAN_HAS_MP_MULX)
  390|      8|   if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) {
  ------------------
  |  Branch (390:7): [True: 8, False: 0]
  ------------------
  391|      8|      return bigint_mulx_mul8(z, x, y);
  392|      8|   }
  393|      0|#endif
  394|       |
  395|      0|   word3<word> accum;
  396|       |
  397|      0|   accum.mul(x[0], y[0]);
  398|      0|   z[0] = accum.extract();
  399|      0|   accum.mul(x[0], y[1]);
  400|      0|   accum.mul(x[1], y[0]);
  401|      0|   z[1] = accum.extract();
  402|      0|   accum.mul(x[0], y[2]);
  403|      0|   accum.mul(x[1], y[1]);
  404|      0|   accum.mul(x[2], y[0]);
  405|      0|   z[2] = accum.extract();
  406|      0|   accum.mul(x[0], y[3]);
  407|      0|   accum.mul(x[1], y[2]);
  408|      0|   accum.mul(x[2], y[1]);
  409|      0|   accum.mul(x[3], y[0]);
  410|      0|   z[3] = accum.extract();
  411|      0|   accum.mul(x[0], y[4]);
  412|      0|   accum.mul(x[1], y[3]);
  413|      0|   accum.mul(x[2], y[2]);
  414|      0|   accum.mul(x[3], y[1]);
  415|      0|   accum.mul(x[4], y[0]);
  416|      0|   z[4] = accum.extract();
  417|      0|   accum.mul(x[0], y[5]);
  418|      0|   accum.mul(x[1], y[4]);
  419|      0|   accum.mul(x[2], y[3]);
  420|      0|   accum.mul(x[3], y[2]);
  421|      0|   accum.mul(x[4], y[1]);
  422|      0|   accum.mul(x[5], y[0]);
  423|      0|   z[5] = accum.extract();
  424|      0|   accum.mul(x[0], y[6]);
  425|      0|   accum.mul(x[1], y[5]);
  426|      0|   accum.mul(x[2], y[4]);
  427|      0|   accum.mul(x[3], y[3]);
  428|      0|   accum.mul(x[4], y[2]);
  429|      0|   accum.mul(x[5], y[1]);
  430|      0|   accum.mul(x[6], y[0]);
  431|      0|   z[6] = accum.extract();
  432|      0|   accum.mul(x[0], y[7]);
  433|      0|   accum.mul(x[1], y[6]);
  434|      0|   accum.mul(x[2], y[5]);
  435|      0|   accum.mul(x[3], y[4]);
  436|      0|   accum.mul(x[4], y[3]);
  437|      0|   accum.mul(x[5], y[2]);
  438|      0|   accum.mul(x[6], y[1]);
  439|      0|   accum.mul(x[7], y[0]);
  440|      0|   z[7] = accum.extract();
  441|      0|   accum.mul(x[1], y[7]);
  442|      0|   accum.mul(x[2], y[6]);
  443|      0|   accum.mul(x[3], y[5]);
  444|      0|   accum.mul(x[4], y[4]);
  445|      0|   accum.mul(x[5], y[3]);
  446|      0|   accum.mul(x[6], y[2]);
  447|      0|   accum.mul(x[7], y[1]);
  448|      0|   z[8] = accum.extract();
  449|      0|   accum.mul(x[2], y[7]);
  450|      0|   accum.mul(x[3], y[6]);
  451|      0|   accum.mul(x[4], y[5]);
  452|      0|   accum.mul(x[5], y[4]);
  453|      0|   accum.mul(x[6], y[3]);
  454|      0|   accum.mul(x[7], y[2]);
  455|      0|   z[9] = accum.extract();
  456|      0|   accum.mul(x[3], y[7]);
  457|      0|   accum.mul(x[4], y[6]);
  458|      0|   accum.mul(x[5], y[5]);
  459|      0|   accum.mul(x[6], y[4]);
  460|      0|   accum.mul(x[7], y[3]);
  461|      0|   z[10] = accum.extract();
  462|      0|   accum.mul(x[4], y[7]);
  463|      0|   accum.mul(x[5], y[6]);
  464|      0|   accum.mul(x[6], y[5]);
  465|      0|   accum.mul(x[7], y[4]);
  466|      0|   z[11] = accum.extract();
  467|      0|   accum.mul(x[5], y[7]);
  468|      0|   accum.mul(x[6], y[6]);
  469|      0|   accum.mul(x[7], y[5]);
  470|      0|   z[12] = accum.extract();
  471|      0|   accum.mul(x[6], y[7]);
  472|      0|   accum.mul(x[7], y[6]);
  473|      0|   z[13] = accum.extract();
  474|      0|   accum.mul(x[7], y[7]);
  475|      0|   z[14] = accum.extract();
  476|      0|   z[15] = accum.extract();
  477|      0|}
_ZN5Botan17bigint_comba_mul9EPmPKmS2_:
  559|      9|void bigint_comba_mul9(word z[18], const word x[9], const word y[9]) {
  560|      9|#if defined(BOTAN_HAS_MP_MULX)
  561|      9|   if(CPUID::has(CPUID::Feature::BMI, CPUID::Feature::ADX)) {
  ------------------
  |  Branch (561:7): [True: 9, False: 0]
  ------------------
  562|      9|      return bigint_mulx_mul9(z, x, y);
  563|      9|   }
  564|      0|#endif
  565|       |
  566|      0|   word3<word> accum;
  567|       |
  568|      0|   accum.mul(x[0], y[0]);
  569|      0|   z[0] = accum.extract();
  570|      0|   accum.mul(x[0], y[1]);
  571|      0|   accum.mul(x[1], y[0]);
  572|      0|   z[1] = accum.extract();
  573|      0|   accum.mul(x[0], y[2]);
  574|      0|   accum.mul(x[1], y[1]);
  575|      0|   accum.mul(x[2], y[0]);
  576|      0|   z[2] = accum.extract();
  577|      0|   accum.mul(x[0], y[3]);
  578|      0|   accum.mul(x[1], y[2]);
  579|      0|   accum.mul(x[2], y[1]);
  580|      0|   accum.mul(x[3], y[0]);
  581|      0|   z[3] = accum.extract();
  582|      0|   accum.mul(x[0], y[4]);
  583|      0|   accum.mul(x[1], y[3]);
  584|      0|   accum.mul(x[2], y[2]);
  585|      0|   accum.mul(x[3], y[1]);
  586|      0|   accum.mul(x[4], y[0]);
  587|      0|   z[4] = accum.extract();
  588|      0|   accum.mul(x[0], y[5]);
  589|      0|   accum.mul(x[1], y[4]);
  590|      0|   accum.mul(x[2], y[3]);
  591|      0|   accum.mul(x[3], y[2]);
  592|      0|   accum.mul(x[4], y[1]);
  593|      0|   accum.mul(x[5], y[0]);
  594|      0|   z[5] = accum.extract();
  595|      0|   accum.mul(x[0], y[6]);
  596|      0|   accum.mul(x[1], y[5]);
  597|      0|   accum.mul(x[2], y[4]);
  598|      0|   accum.mul(x[3], y[3]);
  599|      0|   accum.mul(x[4], y[2]);
  600|      0|   accum.mul(x[5], y[1]);
  601|      0|   accum.mul(x[6], y[0]);
  602|      0|   z[6] = accum.extract();
  603|      0|   accum.mul(x[0], y[7]);
  604|      0|   accum.mul(x[1], y[6]);
  605|      0|   accum.mul(x[2], y[5]);
  606|      0|   accum.mul(x[3], y[4]);
  607|      0|   accum.mul(x[4], y[3]);
  608|      0|   accum.mul(x[5], y[2]);
  609|      0|   accum.mul(x[6], y[1]);
  610|      0|   accum.mul(x[7], y[0]);
  611|      0|   z[7] = accum.extract();
  612|      0|   accum.mul(x[0], y[8]);
  613|      0|   accum.mul(x[1], y[7]);
  614|      0|   accum.mul(x[2], y[6]);
  615|      0|   accum.mul(x[3], y[5]);
  616|      0|   accum.mul(x[4], y[4]);
  617|      0|   accum.mul(x[5], y[3]);
  618|      0|   accum.mul(x[6], y[2]);
  619|      0|   accum.mul(x[7], y[1]);
  620|      0|   accum.mul(x[8], y[0]);
  621|      0|   z[8] = accum.extract();
  622|      0|   accum.mul(x[1], y[8]);
  623|      0|   accum.mul(x[2], y[7]);
  624|      0|   accum.mul(x[3], y[6]);
  625|      0|   accum.mul(x[4], y[5]);
  626|      0|   accum.mul(x[5], y[4]);
  627|      0|   accum.mul(x[6], y[3]);
  628|      0|   accum.mul(x[7], y[2]);
  629|      0|   accum.mul(x[8], y[1]);
  630|      0|   z[9] = accum.extract();
  631|      0|   accum.mul(x[2], y[8]);
  632|      0|   accum.mul(x[3], y[7]);
  633|      0|   accum.mul(x[4], y[6]);
  634|      0|   accum.mul(x[5], y[5]);
  635|      0|   accum.mul(x[6], y[4]);
  636|      0|   accum.mul(x[7], y[3]);
  637|      0|   accum.mul(x[8], y[2]);
  638|      0|   z[10] = accum.extract();
  639|      0|   accum.mul(x[3], y[8]);
  640|      0|   accum.mul(x[4], y[7]);
  641|      0|   accum.mul(x[5], y[6]);
  642|      0|   accum.mul(x[6], y[5]);
  643|      0|   accum.mul(x[7], y[4]);
  644|      0|   accum.mul(x[8], y[3]);
  645|      0|   z[11] = accum.extract();
  646|      0|   accum.mul(x[4], y[8]);
  647|      0|   accum.mul(x[5], y[7]);
  648|      0|   accum.mul(x[6], y[6]);
  649|      0|   accum.mul(x[7], y[5]);
  650|      0|   accum.mul(x[8], y[4]);
  651|      0|   z[12] = accum.extract();
  652|      0|   accum.mul(x[5], y[8]);
  653|      0|   accum.mul(x[6], y[7]);
  654|      0|   accum.mul(x[7], y[6]);
  655|      0|   accum.mul(x[8], y[5]);
  656|      0|   z[13] = accum.extract();
  657|      0|   accum.mul(x[6], y[8]);
  658|      0|   accum.mul(x[7], y[7]);
  659|      0|   accum.mul(x[8], y[6]);
  660|      0|   z[14] = accum.extract();
  661|      0|   accum.mul(x[7], y[8]);
  662|      0|   accum.mul(x[8], y[7]);
  663|      0|   z[15] = accum.extract();
  664|      0|   accum.mul(x[8], y[8]);
  665|      0|   z[16] = accum.extract();
  666|      0|   z[17] = accum.extract();
  667|      0|}
_ZN5Botan18bigint_comba_mul16EPmPKmS2_:
  848|     19|void bigint_comba_mul16(word z[32], const word x[16], const word y[16]) {
  849|     19|   word3<word> accum;
  850|       |
  851|     19|   accum.mul(x[0], y[0]);
  852|     19|   z[0] = accum.extract();
  853|     19|   accum.mul(x[0], y[1]);
  854|     19|   accum.mul(x[1], y[0]);
  855|     19|   z[1] = accum.extract();
  856|     19|   accum.mul(x[0], y[2]);
  857|     19|   accum.mul(x[1], y[1]);
  858|     19|   accum.mul(x[2], y[0]);
  859|     19|   z[2] = accum.extract();
  860|     19|   accum.mul(x[0], y[3]);
  861|     19|   accum.mul(x[1], y[2]);
  862|     19|   accum.mul(x[2], y[1]);
  863|     19|   accum.mul(x[3], y[0]);
  864|     19|   z[3] = accum.extract();
  865|     19|   accum.mul(x[0], y[4]);
  866|     19|   accum.mul(x[1], y[3]);
  867|     19|   accum.mul(x[2], y[2]);
  868|     19|   accum.mul(x[3], y[1]);
  869|     19|   accum.mul(x[4], y[0]);
  870|     19|   z[4] = accum.extract();
  871|     19|   accum.mul(x[0], y[5]);
  872|     19|   accum.mul(x[1], y[4]);
  873|     19|   accum.mul(x[2], y[3]);
  874|     19|   accum.mul(x[3], y[2]);
  875|     19|   accum.mul(x[4], y[1]);
  876|     19|   accum.mul(x[5], y[0]);
  877|     19|   z[5] = accum.extract();
  878|     19|   accum.mul(x[0], y[6]);
  879|     19|   accum.mul(x[1], y[5]);
  880|     19|   accum.mul(x[2], y[4]);
  881|     19|   accum.mul(x[3], y[3]);
  882|     19|   accum.mul(x[4], y[2]);
  883|     19|   accum.mul(x[5], y[1]);
  884|     19|   accum.mul(x[6], y[0]);
  885|     19|   z[6] = accum.extract();
  886|     19|   accum.mul(x[0], y[7]);
  887|     19|   accum.mul(x[1], y[6]);
  888|     19|   accum.mul(x[2], y[5]);
  889|     19|   accum.mul(x[3], y[4]);
  890|     19|   accum.mul(x[4], y[3]);
  891|     19|   accum.mul(x[5], y[2]);
  892|     19|   accum.mul(x[6], y[1]);
  893|     19|   accum.mul(x[7], y[0]);
  894|     19|   z[7] = accum.extract();
  895|     19|   accum.mul(x[0], y[8]);
  896|     19|   accum.mul(x[1], y[7]);
  897|     19|   accum.mul(x[2], y[6]);
  898|     19|   accum.mul(x[3], y[5]);
  899|     19|   accum.mul(x[4], y[4]);
  900|     19|   accum.mul(x[5], y[3]);
  901|     19|   accum.mul(x[6], y[2]);
  902|     19|   accum.mul(x[7], y[1]);
  903|     19|   accum.mul(x[8], y[0]);
  904|     19|   z[8] = accum.extract();
  905|     19|   accum.mul(x[0], y[9]);
  906|     19|   accum.mul(x[1], y[8]);
  907|     19|   accum.mul(x[2], y[7]);
  908|     19|   accum.mul(x[3], y[6]);
  909|     19|   accum.mul(x[4], y[5]);
  910|     19|   accum.mul(x[5], y[4]);
  911|     19|   accum.mul(x[6], y[3]);
  912|     19|   accum.mul(x[7], y[2]);
  913|     19|   accum.mul(x[8], y[1]);
  914|     19|   accum.mul(x[9], y[0]);
  915|     19|   z[9] = accum.extract();
  916|     19|   accum.mul(x[0], y[10]);
  917|     19|   accum.mul(x[1], y[9]);
  918|     19|   accum.mul(x[2], y[8]);
  919|     19|   accum.mul(x[3], y[7]);
  920|     19|   accum.mul(x[4], y[6]);
  921|     19|   accum.mul(x[5], y[5]);
  922|     19|   accum.mul(x[6], y[4]);
  923|     19|   accum.mul(x[7], y[3]);
  924|     19|   accum.mul(x[8], y[2]);
  925|     19|   accum.mul(x[9], y[1]);
  926|     19|   accum.mul(x[10], y[0]);
  927|     19|   z[10] = accum.extract();
  928|     19|   accum.mul(x[0], y[11]);
  929|     19|   accum.mul(x[1], y[10]);
  930|     19|   accum.mul(x[2], y[9]);
  931|     19|   accum.mul(x[3], y[8]);
  932|     19|   accum.mul(x[4], y[7]);
  933|     19|   accum.mul(x[5], y[6]);
  934|     19|   accum.mul(x[6], y[5]);
  935|     19|   accum.mul(x[7], y[4]);
  936|     19|   accum.mul(x[8], y[3]);
  937|     19|   accum.mul(x[9], y[2]);
  938|     19|   accum.mul(x[10], y[1]);
  939|     19|   accum.mul(x[11], y[0]);
  940|     19|   z[11] = accum.extract();
  941|     19|   accum.mul(x[0], y[12]);
  942|     19|   accum.mul(x[1], y[11]);
  943|     19|   accum.mul(x[2], y[10]);
  944|     19|   accum.mul(x[3], y[9]);
  945|     19|   accum.mul(x[4], y[8]);
  946|     19|   accum.mul(x[5], y[7]);
  947|     19|   accum.mul(x[6], y[6]);
  948|     19|   accum.mul(x[7], y[5]);
  949|     19|   accum.mul(x[8], y[4]);
  950|     19|   accum.mul(x[9], y[3]);
  951|     19|   accum.mul(x[10], y[2]);
  952|     19|   accum.mul(x[11], y[1]);
  953|     19|   accum.mul(x[12], y[0]);
  954|     19|   z[12] = accum.extract();
  955|     19|   accum.mul(x[0], y[13]);
  956|     19|   accum.mul(x[1], y[12]);
  957|     19|   accum.mul(x[2], y[11]);
  958|     19|   accum.mul(x[3], y[10]);
  959|     19|   accum.mul(x[4], y[9]);
  960|     19|   accum.mul(x[5], y[8]);
  961|     19|   accum.mul(x[6], y[7]);
  962|     19|   accum.mul(x[7], y[6]);
  963|     19|   accum.mul(x[8], y[5]);
  964|     19|   accum.mul(x[9], y[4]);
  965|     19|   accum.mul(x[10], y[3]);
  966|     19|   accum.mul(x[11], y[2]);
  967|     19|   accum.mul(x[12], y[1]);
  968|     19|   accum.mul(x[13], y[0]);
  969|     19|   z[13] = accum.extract();
  970|     19|   accum.mul(x[0], y[14]);
  971|     19|   accum.mul(x[1], y[13]);
  972|     19|   accum.mul(x[2], y[12]);
  973|     19|   accum.mul(x[3], y[11]);
  974|     19|   accum.mul(x[4], y[10]);
  975|     19|   accum.mul(x[5], y[9]);
  976|     19|   accum.mul(x[6], y[8]);
  977|     19|   accum.mul(x[7], y[7]);
  978|     19|   accum.mul(x[8], y[6]);
  979|     19|   accum.mul(x[9], y[5]);
  980|     19|   accum.mul(x[10], y[4]);
  981|     19|   accum.mul(x[11], y[3]);
  982|     19|   accum.mul(x[12], y[2]);
  983|     19|   accum.mul(x[13], y[1]);
  984|     19|   accum.mul(x[14], y[0]);
  985|     19|   z[14] = accum.extract();
  986|     19|   accum.mul(x[0], y[15]);
  987|     19|   accum.mul(x[1], y[14]);
  988|     19|   accum.mul(x[2], y[13]);
  989|     19|   accum.mul(x[3], y[12]);
  990|     19|   accum.mul(x[4], y[11]);
  991|     19|   accum.mul(x[5], y[10]);
  992|     19|   accum.mul(x[6], y[9]);
  993|     19|   accum.mul(x[7], y[8]);
  994|     19|   accum.mul(x[8], y[7]);
  995|     19|   accum.mul(x[9], y[6]);
  996|     19|   accum.mul(x[10], y[5]);
  997|     19|   accum.mul(x[11], y[4]);
  998|     19|   accum.mul(x[12], y[3]);
  999|     19|   accum.mul(x[13], y[2]);
 1000|     19|   accum.mul(x[14], y[1]);
 1001|     19|   accum.mul(x[15], y[0]);
 1002|     19|   z[15] = accum.extract();
 1003|     19|   accum.mul(x[1], y[15]);
 1004|     19|   accum.mul(x[2], y[14]);
 1005|     19|   accum.mul(x[3], y[13]);
 1006|     19|   accum.mul(x[4], y[12]);
 1007|     19|   accum.mul(x[5], y[11]);
 1008|     19|   accum.mul(x[6], y[10]);
 1009|     19|   accum.mul(x[7], y[9]);
 1010|     19|   accum.mul(x[8], y[8]);
 1011|     19|   accum.mul(x[9], y[7]);
 1012|     19|   accum.mul(x[10], y[6]);
 1013|     19|   accum.mul(x[11], y[5]);
 1014|     19|   accum.mul(x[12], y[4]);
 1015|     19|   accum.mul(x[13], y[3]);
 1016|     19|   accum.mul(x[14], y[2]);
 1017|     19|   accum.mul(x[15], y[1]);
 1018|     19|   z[16] = accum.extract();
 1019|     19|   accum.mul(x[2], y[15]);
 1020|     19|   accum.mul(x[3], y[14]);
 1021|     19|   accum.mul(x[4], y[13]);
 1022|     19|   accum.mul(x[5], y[12]);
 1023|     19|   accum.mul(x[6], y[11]);
 1024|     19|   accum.mul(x[7], y[10]);
 1025|     19|   accum.mul(x[8], y[9]);
 1026|     19|   accum.mul(x[9], y[8]);
 1027|     19|   accum.mul(x[10], y[7]);
 1028|     19|   accum.mul(x[11], y[6]);
 1029|     19|   accum.mul(x[12], y[5]);
 1030|     19|   accum.mul(x[13], y[4]);
 1031|     19|   accum.mul(x[14], y[3]);
 1032|     19|   accum.mul(x[15], y[2]);
 1033|     19|   z[17] = accum.extract();
 1034|     19|   accum.mul(x[3], y[15]);
 1035|     19|   accum.mul(x[4], y[14]);
 1036|     19|   accum.mul(x[5], y[13]);
 1037|     19|   accum.mul(x[6], y[12]);
 1038|     19|   accum.mul(x[7], y[11]);
 1039|     19|   accum.mul(x[8], y[10]);
 1040|     19|   accum.mul(x[9], y[9]);
 1041|     19|   accum.mul(x[10], y[8]);
 1042|     19|   accum.mul(x[11], y[7]);
 1043|     19|   accum.mul(x[12], y[6]);
 1044|     19|   accum.mul(x[13], y[5]);
 1045|     19|   accum.mul(x[14], y[4]);
 1046|     19|   accum.mul(x[15], y[3]);
 1047|     19|   z[18] = accum.extract();
 1048|     19|   accum.mul(x[4], y[15]);
 1049|     19|   accum.mul(x[5], y[14]);
 1050|     19|   accum.mul(x[6], y[13]);
 1051|     19|   accum.mul(x[7], y[12]);
 1052|     19|   accum.mul(x[8], y[11]);
 1053|     19|   accum.mul(x[9], y[10]);
 1054|     19|   accum.mul(x[10], y[9]);
 1055|     19|   accum.mul(x[11], y[8]);
 1056|     19|   accum.mul(x[12], y[7]);
 1057|     19|   accum.mul(x[13], y[6]);
 1058|     19|   accum.mul(x[14], y[5]);
 1059|     19|   accum.mul(x[15], y[4]);
 1060|     19|   z[19] = accum.extract();
 1061|     19|   accum.mul(x[5], y[15]);
 1062|     19|   accum.mul(x[6], y[14]);
 1063|     19|   accum.mul(x[7], y[13]);
 1064|     19|   accum.mul(x[8], y[12]);
 1065|     19|   accum.mul(x[9], y[11]);
 1066|     19|   accum.mul(x[10], y[10]);
 1067|     19|   accum.mul(x[11], y[9]);
 1068|     19|   accum.mul(x[12], y[8]);
 1069|     19|   accum.mul(x[13], y[7]);
 1070|     19|   accum.mul(x[14], y[6]);
 1071|     19|   accum.mul(x[15], y[5]);
 1072|     19|   z[20] = accum.extract();
 1073|     19|   accum.mul(x[6], y[15]);
 1074|     19|   accum.mul(x[7], y[14]);
 1075|     19|   accum.mul(x[8], y[13]);
 1076|     19|   accum.mul(x[9], y[12]);
 1077|     19|   accum.mul(x[10], y[11]);
 1078|     19|   accum.mul(x[11], y[10]);
 1079|     19|   accum.mul(x[12], y[9]);
 1080|     19|   accum.mul(x[13], y[8]);
 1081|     19|   accum.mul(x[14], y[7]);
 1082|     19|   accum.mul(x[15], y[6]);
 1083|     19|   z[21] = accum.extract();
 1084|     19|   accum.mul(x[7], y[15]);
 1085|     19|   accum.mul(x[8], y[14]);
 1086|     19|   accum.mul(x[9], y[13]);
 1087|     19|   accum.mul(x[10], y[12]);
 1088|     19|   accum.mul(x[11], y[11]);
 1089|     19|   accum.mul(x[12], y[10]);
 1090|     19|   accum.mul(x[13], y[9]);
 1091|     19|   accum.mul(x[14], y[8]);
 1092|     19|   accum.mul(x[15], y[7]);
 1093|     19|   z[22] = accum.extract();
 1094|     19|   accum.mul(x[8], y[15]);
 1095|     19|   accum.mul(x[9], y[14]);
 1096|     19|   accum.mul(x[10], y[13]);
 1097|     19|   accum.mul(x[11], y[12]);
 1098|     19|   accum.mul(x[12], y[11]);
 1099|     19|   accum.mul(x[13], y[10]);
 1100|     19|   accum.mul(x[14], y[9]);
 1101|     19|   accum.mul(x[15], y[8]);
 1102|     19|   z[23] = accum.extract();
 1103|     19|   accum.mul(x[9], y[15]);
 1104|     19|   accum.mul(x[10], y[14]);
 1105|     19|   accum.mul(x[11], y[13]);
 1106|     19|   accum.mul(x[12], y[12]);
 1107|     19|   accum.mul(x[13], y[11]);
 1108|     19|   accum.mul(x[14], y[10]);
 1109|     19|   accum.mul(x[15], y[9]);
 1110|     19|   z[24] = accum.extract();
 1111|     19|   accum.mul(x[10], y[15]);
 1112|     19|   accum.mul(x[11], y[14]);
 1113|     19|   accum.mul(x[12], y[13]);
 1114|     19|   accum.mul(x[13], y[12]);
 1115|     19|   accum.mul(x[14], y[11]);
 1116|     19|   accum.mul(x[15], y[10]);
 1117|     19|   z[25] = accum.extract();
 1118|     19|   accum.mul(x[11], y[15]);
 1119|     19|   accum.mul(x[12], y[14]);
 1120|     19|   accum.mul(x[13], y[13]);
 1121|     19|   accum.mul(x[14], y[12]);
 1122|     19|   accum.mul(x[15], y[11]);
 1123|     19|   z[26] = accum.extract();
 1124|     19|   accum.mul(x[12], y[15]);
 1125|     19|   accum.mul(x[13], y[14]);
 1126|     19|   accum.mul(x[14], y[13]);
 1127|     19|   accum.mul(x[15], y[12]);
 1128|     19|   z[27] = accum.extract();
 1129|     19|   accum.mul(x[13], y[15]);
 1130|     19|   accum.mul(x[14], y[14]);
 1131|     19|   accum.mul(x[15], y[13]);
 1132|     19|   z[28] = accum.extract();
 1133|     19|   accum.mul(x[14], y[15]);
 1134|     19|   accum.mul(x[15], y[14]);
 1135|     19|   z[29] = accum.extract();
 1136|     19|   accum.mul(x[15], y[15]);
 1137|     19|   z[30] = accum.extract();
 1138|     19|   z[31] = accum.extract();
 1139|     19|}
_ZN5Botan18bigint_comba_mul24EPmPKmS2_:
 1500|     11|void bigint_comba_mul24(word z[48], const word x[24], const word y[24]) {
 1501|     11|   word3<word> accum;
 1502|       |
 1503|     11|   accum.mul(x[0], y[0]);
 1504|     11|   z[0] = accum.extract();
 1505|     11|   accum.mul(x[0], y[1]);
 1506|     11|   accum.mul(x[1], y[0]);
 1507|     11|   z[1] = accum.extract();
 1508|     11|   accum.mul(x[0], y[2]);
 1509|     11|   accum.mul(x[1], y[1]);
 1510|     11|   accum.mul(x[2], y[0]);
 1511|     11|   z[2] = accum.extract();
 1512|     11|   accum.mul(x[0], y[3]);
 1513|     11|   accum.mul(x[1], y[2]);
 1514|     11|   accum.mul(x[2], y[1]);
 1515|     11|   accum.mul(x[3], y[0]);
 1516|     11|   z[3] = accum.extract();
 1517|     11|   accum.mul(x[0], y[4]);
 1518|     11|   accum.mul(x[1], y[3]);
 1519|     11|   accum.mul(x[2], y[2]);
 1520|     11|   accum.mul(x[3], y[1]);
 1521|     11|   accum.mul(x[4], y[0]);
 1522|     11|   z[4] = accum.extract();
 1523|     11|   accum.mul(x[0], y[5]);
 1524|     11|   accum.mul(x[1], y[4]);
 1525|     11|   accum.mul(x[2], y[3]);
 1526|     11|   accum.mul(x[3], y[2]);
 1527|     11|   accum.mul(x[4], y[1]);
 1528|     11|   accum.mul(x[5], y[0]);
 1529|     11|   z[5] = accum.extract();
 1530|     11|   accum.mul(x[0], y[6]);
 1531|     11|   accum.mul(x[1], y[5]);
 1532|     11|   accum.mul(x[2], y[4]);
 1533|     11|   accum.mul(x[3], y[3]);
 1534|     11|   accum.mul(x[4], y[2]);
 1535|     11|   accum.mul(x[5], y[1]);
 1536|     11|   accum.mul(x[6], y[0]);
 1537|     11|   z[6] = accum.extract();
 1538|     11|   accum.mul(x[0], y[7]);
 1539|     11|   accum.mul(x[1], y[6]);
 1540|     11|   accum.mul(x[2], y[5]);
 1541|     11|   accum.mul(x[3], y[4]);
 1542|     11|   accum.mul(x[4], y[3]);
 1543|     11|   accum.mul(x[5], y[2]);
 1544|     11|   accum.mul(x[6], y[1]);
 1545|     11|   accum.mul(x[7], y[0]);
 1546|     11|   z[7] = accum.extract();
 1547|     11|   accum.mul(x[0], y[8]);
 1548|     11|   accum.mul(x[1], y[7]);
 1549|     11|   accum.mul(x[2], y[6]);
 1550|     11|   accum.mul(x[3], y[5]);
 1551|     11|   accum.mul(x[4], y[4]);
 1552|     11|   accum.mul(x[5], y[3]);
 1553|     11|   accum.mul(x[6], y[2]);
 1554|     11|   accum.mul(x[7], y[1]);
 1555|     11|   accum.mul(x[8], y[0]);
 1556|     11|   z[8] = accum.extract();
 1557|     11|   accum.mul(x[0], y[9]);
 1558|     11|   accum.mul(x[1], y[8]);
 1559|     11|   accum.mul(x[2], y[7]);
 1560|     11|   accum.mul(x[3], y[6]);
 1561|     11|   accum.mul(x[4], y[5]);
 1562|     11|   accum.mul(x[5], y[4]);
 1563|     11|   accum.mul(x[6], y[3]);
 1564|     11|   accum.mul(x[7], y[2]);
 1565|     11|   accum.mul(x[8], y[1]);
 1566|     11|   accum.mul(x[9], y[0]);
 1567|     11|   z[9] = accum.extract();
 1568|     11|   accum.mul(x[0], y[10]);
 1569|     11|   accum.mul(x[1], y[9]);
 1570|     11|   accum.mul(x[2], y[8]);
 1571|     11|   accum.mul(x[3], y[7]);
 1572|     11|   accum.mul(x[4], y[6]);
 1573|     11|   accum.mul(x[5], y[5]);
 1574|     11|   accum.mul(x[6], y[4]);
 1575|     11|   accum.mul(x[7], y[3]);
 1576|     11|   accum.mul(x[8], y[2]);
 1577|     11|   accum.mul(x[9], y[1]);
 1578|     11|   accum.mul(x[10], y[0]);
 1579|     11|   z[10] = accum.extract();
 1580|     11|   accum.mul(x[0], y[11]);
 1581|     11|   accum.mul(x[1], y[10]);
 1582|     11|   accum.mul(x[2], y[9]);
 1583|     11|   accum.mul(x[3], y[8]);
 1584|     11|   accum.mul(x[4], y[7]);
 1585|     11|   accum.mul(x[5], y[6]);
 1586|     11|   accum.mul(x[6], y[5]);
 1587|     11|   accum.mul(x[7], y[4]);
 1588|     11|   accum.mul(x[8], y[3]);
 1589|     11|   accum.mul(x[9], y[2]);
 1590|     11|   accum.mul(x[10], y[1]);
 1591|     11|   accum.mul(x[11], y[0]);
 1592|     11|   z[11] = accum.extract();
 1593|     11|   accum.mul(x[0], y[12]);
 1594|     11|   accum.mul(x[1], y[11]);
 1595|     11|   accum.mul(x[2], y[10]);
 1596|     11|   accum.mul(x[3], y[9]);
 1597|     11|   accum.mul(x[4], y[8]);
 1598|     11|   accum.mul(x[5], y[7]);
 1599|     11|   accum.mul(x[6], y[6]);
 1600|     11|   accum.mul(x[7], y[5]);
 1601|     11|   accum.mul(x[8], y[4]);
 1602|     11|   accum.mul(x[9], y[3]);
 1603|     11|   accum.mul(x[10], y[2]);
 1604|     11|   accum.mul(x[11], y[1]);
 1605|     11|   accum.mul(x[12], y[0]);
 1606|     11|   z[12] = accum.extract();
 1607|     11|   accum.mul(x[0], y[13]);
 1608|     11|   accum.mul(x[1], y[12]);
 1609|     11|   accum.mul(x[2], y[11]);
 1610|     11|   accum.mul(x[3], y[10]);
 1611|     11|   accum.mul(x[4], y[9]);
 1612|     11|   accum.mul(x[5], y[8]);
 1613|     11|   accum.mul(x[6], y[7]);
 1614|     11|   accum.mul(x[7], y[6]);
 1615|     11|   accum.mul(x[8], y[5]);
 1616|     11|   accum.mul(x[9], y[4]);
 1617|     11|   accum.mul(x[10], y[3]);
 1618|     11|   accum.mul(x[11], y[2]);
 1619|     11|   accum.mul(x[12], y[1]);
 1620|     11|   accum.mul(x[13], y[0]);
 1621|     11|   z[13] = accum.extract();
 1622|     11|   accum.mul(x[0], y[14]);
 1623|     11|   accum.mul(x[1], y[13]);
 1624|     11|   accum.mul(x[2], y[12]);
 1625|     11|   accum.mul(x[3], y[11]);
 1626|     11|   accum.mul(x[4], y[10]);
 1627|     11|   accum.mul(x[5], y[9]);
 1628|     11|   accum.mul(x[6], y[8]);
 1629|     11|   accum.mul(x[7], y[7]);
 1630|     11|   accum.mul(x[8], y[6]);
 1631|     11|   accum.mul(x[9], y[5]);
 1632|     11|   accum.mul(x[10], y[4]);
 1633|     11|   accum.mul(x[11], y[3]);
 1634|     11|   accum.mul(x[12], y[2]);
 1635|     11|   accum.mul(x[13], y[1]);
 1636|     11|   accum.mul(x[14], y[0]);
 1637|     11|   z[14] = accum.extract();
 1638|     11|   accum.mul(x[0], y[15]);
 1639|     11|   accum.mul(x[1], y[14]);
 1640|     11|   accum.mul(x[2], y[13]);
 1641|     11|   accum.mul(x[3], y[12]);
 1642|     11|   accum.mul(x[4], y[11]);
 1643|     11|   accum.mul(x[5], y[10]);
 1644|     11|   accum.mul(x[6], y[9]);
 1645|     11|   accum.mul(x[7], y[8]);
 1646|     11|   accum.mul(x[8], y[7]);
 1647|     11|   accum.mul(x[9], y[6]);
 1648|     11|   accum.mul(x[10], y[5]);
 1649|     11|   accum.mul(x[11], y[4]);
 1650|     11|   accum.mul(x[12], y[3]);
 1651|     11|   accum.mul(x[13], y[2]);
 1652|     11|   accum.mul(x[14], y[1]);
 1653|     11|   accum.mul(x[15], y[0]);
 1654|     11|   z[15] = accum.extract();
 1655|     11|   accum.mul(x[0], y[16]);
 1656|     11|   accum.mul(x[1], y[15]);
 1657|     11|   accum.mul(x[2], y[14]);
 1658|     11|   accum.mul(x[3], y[13]);
 1659|     11|   accum.mul(x[4], y[12]);
 1660|     11|   accum.mul(x[5], y[11]);
 1661|     11|   accum.mul(x[6], y[10]);
 1662|     11|   accum.mul(x[7], y[9]);
 1663|     11|   accum.mul(x[8], y[8]);
 1664|     11|   accum.mul(x[9], y[7]);
 1665|     11|   accum.mul(x[10], y[6]);
 1666|     11|   accum.mul(x[11], y[5]);
 1667|     11|   accum.mul(x[12], y[4]);
 1668|     11|   accum.mul(x[13], y[3]);
 1669|     11|   accum.mul(x[14], y[2]);
 1670|     11|   accum.mul(x[15], y[1]);
 1671|     11|   accum.mul(x[16], y[0]);
 1672|     11|   z[16] = accum.extract();
 1673|     11|   accum.mul(x[0], y[17]);
 1674|     11|   accum.mul(x[1], y[16]);
 1675|     11|   accum.mul(x[2], y[15]);
 1676|     11|   accum.mul(x[3], y[14]);
 1677|     11|   accum.mul(x[4], y[13]);
 1678|     11|   accum.mul(x[5], y[12]);
 1679|     11|   accum.mul(x[6], y[11]);
 1680|     11|   accum.mul(x[7], y[10]);
 1681|     11|   accum.mul(x[8], y[9]);
 1682|     11|   accum.mul(x[9], y[8]);
 1683|     11|   accum.mul(x[10], y[7]);
 1684|     11|   accum.mul(x[11], y[6]);
 1685|     11|   accum.mul(x[12], y[5]);
 1686|     11|   accum.mul(x[13], y[4]);
 1687|     11|   accum.mul(x[14], y[3]);
 1688|     11|   accum.mul(x[15], y[2]);
 1689|     11|   accum.mul(x[16], y[1]);
 1690|     11|   accum.mul(x[17], y[0]);
 1691|     11|   z[17] = accum.extract();
 1692|     11|   accum.mul(x[0], y[18]);
 1693|     11|   accum.mul(x[1], y[17]);
 1694|     11|   accum.mul(x[2], y[16]);
 1695|     11|   accum.mul(x[3], y[15]);
 1696|     11|   accum.mul(x[4], y[14]);
 1697|     11|   accum.mul(x[5], y[13]);
 1698|     11|   accum.mul(x[6], y[12]);
 1699|     11|   accum.mul(x[7], y[11]);
 1700|     11|   accum.mul(x[8], y[10]);
 1701|     11|   accum.mul(x[9], y[9]);
 1702|     11|   accum.mul(x[10], y[8]);
 1703|     11|   accum.mul(x[11], y[7]);
 1704|     11|   accum.mul(x[12], y[6]);
 1705|     11|   accum.mul(x[13], y[5]);
 1706|     11|   accum.mul(x[14], y[4]);
 1707|     11|   accum.mul(x[15], y[3]);
 1708|     11|   accum.mul(x[16], y[2]);
 1709|     11|   accum.mul(x[17], y[1]);
 1710|     11|   accum.mul(x[18], y[0]);
 1711|     11|   z[18] = accum.extract();
 1712|     11|   accum.mul(x[0], y[19]);
 1713|     11|   accum.mul(x[1], y[18]);
 1714|     11|   accum.mul(x[2], y[17]);
 1715|     11|   accum.mul(x[3], y[16]);
 1716|     11|   accum.mul(x[4], y[15]);
 1717|     11|   accum.mul(x[5], y[14]);
 1718|     11|   accum.mul(x[6], y[13]);
 1719|     11|   accum.mul(x[7], y[12]);
 1720|     11|   accum.mul(x[8], y[11]);
 1721|     11|   accum.mul(x[9], y[10]);
 1722|     11|   accum.mul(x[10], y[9]);
 1723|     11|   accum.mul(x[11], y[8]);
 1724|     11|   accum.mul(x[12], y[7]);
 1725|     11|   accum.mul(x[13], y[6]);
 1726|     11|   accum.mul(x[14], y[5]);
 1727|     11|   accum.mul(x[15], y[4]);
 1728|     11|   accum.mul(x[16], y[3]);
 1729|     11|   accum.mul(x[17], y[2]);
 1730|     11|   accum.mul(x[18], y[1]);
 1731|     11|   accum.mul(x[19], y[0]);
 1732|     11|   z[19] = accum.extract();
 1733|     11|   accum.mul(x[0], y[20]);
 1734|     11|   accum.mul(x[1], y[19]);
 1735|     11|   accum.mul(x[2], y[18]);
 1736|     11|   accum.mul(x[3], y[17]);
 1737|     11|   accum.mul(x[4], y[16]);
 1738|     11|   accum.mul(x[5], y[15]);
 1739|     11|   accum.mul(x[6], y[14]);
 1740|     11|   accum.mul(x[7], y[13]);
 1741|     11|   accum.mul(x[8], y[12]);
 1742|     11|   accum.mul(x[9], y[11]);
 1743|     11|   accum.mul(x[10], y[10]);
 1744|     11|   accum.mul(x[11], y[9]);
 1745|     11|   accum.mul(x[12], y[8]);
 1746|     11|   accum.mul(x[13], y[7]);
 1747|     11|   accum.mul(x[14], y[6]);
 1748|     11|   accum.mul(x[15], y[5]);
 1749|     11|   accum.mul(x[16], y[4]);
 1750|     11|   accum.mul(x[17], y[3]);
 1751|     11|   accum.mul(x[18], y[2]);
 1752|     11|   accum.mul(x[19], y[1]);
 1753|     11|   accum.mul(x[20], y[0]);
 1754|     11|   z[20] = accum.extract();
 1755|     11|   accum.mul(x[0], y[21]);
 1756|     11|   accum.mul(x[1], y[20]);
 1757|     11|   accum.mul(x[2], y[19]);
 1758|     11|   accum.mul(x[3], y[18]);
 1759|     11|   accum.mul(x[4], y[17]);
 1760|     11|   accum.mul(x[5], y[16]);
 1761|     11|   accum.mul(x[6], y[15]);
 1762|     11|   accum.mul(x[7], y[14]);
 1763|     11|   accum.mul(x[8], y[13]);
 1764|     11|   accum.mul(x[9], y[12]);
 1765|     11|   accum.mul(x[10], y[11]);
 1766|     11|   accum.mul(x[11], y[10]);
 1767|     11|   accum.mul(x[12], y[9]);
 1768|     11|   accum.mul(x[13], y[8]);
 1769|     11|   accum.mul(x[14], y[7]);
 1770|     11|   accum.mul(x[15], y[6]);
 1771|     11|   accum.mul(x[16], y[5]);
 1772|     11|   accum.mul(x[17], y[4]);
 1773|     11|   accum.mul(x[18], y[3]);
 1774|     11|   accum.mul(x[19], y[2]);
 1775|     11|   accum.mul(x[20], y[1]);
 1776|     11|   accum.mul(x[21], y[0]);
 1777|     11|   z[21] = accum.extract();
 1778|     11|   accum.mul(x[0], y[22]);
 1779|     11|   accum.mul(x[1], y[21]);
 1780|     11|   accum.mul(x[2], y[20]);
 1781|     11|   accum.mul(x[3], y[19]);
 1782|     11|   accum.mul(x[4], y[18]);
 1783|     11|   accum.mul(x[5], y[17]);
 1784|     11|   accum.mul(x[6], y[16]);
 1785|     11|   accum.mul(x[7], y[15]);
 1786|     11|   accum.mul(x[8], y[14]);
 1787|     11|   accum.mul(x[9], y[13]);
 1788|     11|   accum.mul(x[10], y[12]);
 1789|     11|   accum.mul(x[11], y[11]);
 1790|     11|   accum.mul(x[12], y[10]);
 1791|     11|   accum.mul(x[13], y[9]);
 1792|     11|   accum.mul(x[14], y[8]);
 1793|     11|   accum.mul(x[15], y[7]);
 1794|     11|   accum.mul(x[16], y[6]);
 1795|     11|   accum.mul(x[17], y[5]);
 1796|     11|   accum.mul(x[18], y[4]);
 1797|     11|   accum.mul(x[19], y[3]);
 1798|     11|   accum.mul(x[20], y[2]);
 1799|     11|   accum.mul(x[21], y[1]);
 1800|     11|   accum.mul(x[22], y[0]);
 1801|     11|   z[22] = accum.extract();
 1802|     11|   accum.mul(x[0], y[23]);
 1803|     11|   accum.mul(x[1], y[22]);
 1804|     11|   accum.mul(x[2], y[21]);
 1805|     11|   accum.mul(x[3], y[20]);
 1806|     11|   accum.mul(x[4], y[19]);
 1807|     11|   accum.mul(x[5], y[18]);
 1808|     11|   accum.mul(x[6], y[17]);
 1809|     11|   accum.mul(x[7], y[16]);
 1810|     11|   accum.mul(x[8], y[15]);
 1811|     11|   accum.mul(x[9], y[14]);
 1812|     11|   accum.mul(x[10], y[13]);
 1813|     11|   accum.mul(x[11], y[12]);
 1814|     11|   accum.mul(x[12], y[11]);
 1815|     11|   accum.mul(x[13], y[10]);
 1816|     11|   accum.mul(x[14], y[9]);
 1817|     11|   accum.mul(x[15], y[8]);
 1818|     11|   accum.mul(x[16], y[7]);
 1819|     11|   accum.mul(x[17], y[6]);
 1820|     11|   accum.mul(x[18], y[5]);
 1821|     11|   accum.mul(x[19], y[4]);
 1822|     11|   accum.mul(x[20], y[3]);
 1823|     11|   accum.mul(x[21], y[2]);
 1824|     11|   accum.mul(x[22], y[1]);
 1825|     11|   accum.mul(x[23], y[0]);
 1826|     11|   z[23] = accum.extract();
 1827|     11|   accum.mul(x[1], y[23]);
 1828|     11|   accum.mul(x[2], y[22]);
 1829|     11|   accum.mul(x[3], y[21]);
 1830|     11|   accum.mul(x[4], y[20]);
 1831|     11|   accum.mul(x[5], y[19]);
 1832|     11|   accum.mul(x[6], y[18]);
 1833|     11|   accum.mul(x[7], y[17]);
 1834|     11|   accum.mul(x[8], y[16]);
 1835|     11|   accum.mul(x[9], y[15]);
 1836|     11|   accum.mul(x[10], y[14]);
 1837|     11|   accum.mul(x[11], y[13]);
 1838|     11|   accum.mul(x[12], y[12]);
 1839|     11|   accum.mul(x[13], y[11]);
 1840|     11|   accum.mul(x[14], y[10]);
 1841|     11|   accum.mul(x[15], y[9]);
 1842|     11|   accum.mul(x[16], y[8]);
 1843|     11|   accum.mul(x[17], y[7]);
 1844|     11|   accum.mul(x[18], y[6]);
 1845|     11|   accum.mul(x[19], y[5]);
 1846|     11|   accum.mul(x[20], y[4]);
 1847|     11|   accum.mul(x[21], y[3]);
 1848|     11|   accum.mul(x[22], y[2]);
 1849|     11|   accum.mul(x[23], y[1]);
 1850|     11|   z[24] = accum.extract();
 1851|     11|   accum.mul(x[2], y[23]);
 1852|     11|   accum.mul(x[3], y[22]);
 1853|     11|   accum.mul(x[4], y[21]);
 1854|     11|   accum.mul(x[5], y[20]);
 1855|     11|   accum.mul(x[6], y[19]);
 1856|     11|   accum.mul(x[7], y[18]);
 1857|     11|   accum.mul(x[8], y[17]);
 1858|     11|   accum.mul(x[9], y[16]);
 1859|     11|   accum.mul(x[10], y[15]);
 1860|     11|   accum.mul(x[11], y[14]);
 1861|     11|   accum.mul(x[12], y[13]);
 1862|     11|   accum.mul(x[13], y[12]);
 1863|     11|   accum.mul(x[14], y[11]);
 1864|     11|   accum.mul(x[15], y[10]);
 1865|     11|   accum.mul(x[16], y[9]);
 1866|     11|   accum.mul(x[17], y[8]);
 1867|     11|   accum.mul(x[18], y[7]);
 1868|     11|   accum.mul(x[19], y[6]);
 1869|     11|   accum.mul(x[20], y[5]);
 1870|     11|   accum.mul(x[21], y[4]);
 1871|     11|   accum.mul(x[22], y[3]);
 1872|     11|   accum.mul(x[23], y[2]);
 1873|     11|   z[25] = accum.extract();
 1874|     11|   accum.mul(x[3], y[23]);
 1875|     11|   accum.mul(x[4], y[22]);
 1876|     11|   accum.mul(x[5], y[21]);
 1877|     11|   accum.mul(x[6], y[20]);
 1878|     11|   accum.mul(x[7], y[19]);
 1879|     11|   accum.mul(x[8], y[18]);
 1880|     11|   accum.mul(x[9], y[17]);
 1881|     11|   accum.mul(x[10], y[16]);
 1882|     11|   accum.mul(x[11], y[15]);
 1883|     11|   accum.mul(x[12], y[14]);
 1884|     11|   accum.mul(x[13], y[13]);
 1885|     11|   accum.mul(x[14], y[12]);
 1886|     11|   accum.mul(x[15], y[11]);
 1887|     11|   accum.mul(x[16], y[10]);
 1888|     11|   accum.mul(x[17], y[9]);
 1889|     11|   accum.mul(x[18], y[8]);
 1890|     11|   accum.mul(x[19], y[7]);
 1891|     11|   accum.mul(x[20], y[6]);
 1892|     11|   accum.mul(x[21], y[5]);
 1893|     11|   accum.mul(x[22], y[4]);
 1894|     11|   accum.mul(x[23], y[3]);
 1895|     11|   z[26] = accum.extract();
 1896|     11|   accum.mul(x[4], y[23]);
 1897|     11|   accum.mul(x[5], y[22]);
 1898|     11|   accum.mul(x[6], y[21]);
 1899|     11|   accum.mul(x[7], y[20]);
 1900|     11|   accum.mul(x[8], y[19]);
 1901|     11|   accum.mul(x[9], y[18]);
 1902|     11|   accum.mul(x[10], y[17]);
 1903|     11|   accum.mul(x[11], y[16]);
 1904|     11|   accum.mul(x[12], y[15]);
 1905|     11|   accum.mul(x[13], y[14]);
 1906|     11|   accum.mul(x[14], y[13]);
 1907|     11|   accum.mul(x[15], y[12]);
 1908|     11|   accum.mul(x[16], y[11]);
 1909|     11|   accum.mul(x[17], y[10]);
 1910|     11|   accum.mul(x[18], y[9]);
 1911|     11|   accum.mul(x[19], y[8]);
 1912|     11|   accum.mul(x[20], y[7]);
 1913|     11|   accum.mul(x[21], y[6]);
 1914|     11|   accum.mul(x[22], y[5]);
 1915|     11|   accum.mul(x[23], y[4]);
 1916|     11|   z[27] = accum.extract();
 1917|     11|   accum.mul(x[5], y[23]);
 1918|     11|   accum.mul(x[6], y[22]);
 1919|     11|   accum.mul(x[7], y[21]);
 1920|     11|   accum.mul(x[8], y[20]);
 1921|     11|   accum.mul(x[9], y[19]);
 1922|     11|   accum.mul(x[10], y[18]);
 1923|     11|   accum.mul(x[11], y[17]);
 1924|     11|   accum.mul(x[12], y[16]);
 1925|     11|   accum.mul(x[13], y[15]);
 1926|     11|   accum.mul(x[14], y[14]);
 1927|     11|   accum.mul(x[15], y[13]);
 1928|     11|   accum.mul(x[16], y[12]);
 1929|     11|   accum.mul(x[17], y[11]);
 1930|     11|   accum.mul(x[18], y[10]);
 1931|     11|   accum.mul(x[19], y[9]);
 1932|     11|   accum.mul(x[20], y[8]);
 1933|     11|   accum.mul(x[21], y[7]);
 1934|     11|   accum.mul(x[22], y[6]);
 1935|     11|   accum.mul(x[23], y[5]);
 1936|     11|   z[28] = accum.extract();
 1937|     11|   accum.mul(x[6], y[23]);
 1938|     11|   accum.mul(x[7], y[22]);
 1939|     11|   accum.mul(x[8], y[21]);
 1940|     11|   accum.mul(x[9], y[20]);
 1941|     11|   accum.mul(x[10], y[19]);
 1942|     11|   accum.mul(x[11], y[18]);
 1943|     11|   accum.mul(x[12], y[17]);
 1944|     11|   accum.mul(x[13], y[16]);
 1945|     11|   accum.mul(x[14], y[15]);
 1946|     11|   accum.mul(x[15], y[14]);
 1947|     11|   accum.mul(x[16], y[13]);
 1948|     11|   accum.mul(x[17], y[12]);
 1949|     11|   accum.mul(x[18], y[11]);
 1950|     11|   accum.mul(x[19], y[10]);
 1951|     11|   accum.mul(x[20], y[9]);
 1952|     11|   accum.mul(x[21], y[8]);
 1953|     11|   accum.mul(x[22], y[7]);
 1954|     11|   accum.mul(x[23], y[6]);
 1955|     11|   z[29] = accum.extract();
 1956|     11|   accum.mul(x[7], y[23]);
 1957|     11|   accum.mul(x[8], y[22]);
 1958|     11|   accum.mul(x[9], y[21]);
 1959|     11|   accum.mul(x[10], y[20]);
 1960|     11|   accum.mul(x[11], y[19]);
 1961|     11|   accum.mul(x[12], y[18]);
 1962|     11|   accum.mul(x[13], y[17]);
 1963|     11|   accum.mul(x[14], y[16]);
 1964|     11|   accum.mul(x[15], y[15]);
 1965|     11|   accum.mul(x[16], y[14]);
 1966|     11|   accum.mul(x[17], y[13]);
 1967|     11|   accum.mul(x[18], y[12]);
 1968|     11|   accum.mul(x[19], y[11]);
 1969|     11|   accum.mul(x[20], y[10]);
 1970|     11|   accum.mul(x[21], y[9]);
 1971|     11|   accum.mul(x[22], y[8]);
 1972|     11|   accum.mul(x[23], y[7]);
 1973|     11|   z[30] = accum.extract();
 1974|     11|   accum.mul(x[8], y[23]);
 1975|     11|   accum.mul(x[9], y[22]);
 1976|     11|   accum.mul(x[10], y[21]);
 1977|     11|   accum.mul(x[11], y[20]);
 1978|     11|   accum.mul(x[12], y[19]);
 1979|     11|   accum.mul(x[13], y[18]);
 1980|     11|   accum.mul(x[14], y[17]);
 1981|     11|   accum.mul(x[15], y[16]);
 1982|     11|   accum.mul(x[16], y[15]);
 1983|     11|   accum.mul(x[17], y[14]);
 1984|     11|   accum.mul(x[18], y[13]);
 1985|     11|   accum.mul(x[19], y[12]);
 1986|     11|   accum.mul(x[20], y[11]);
 1987|     11|   accum.mul(x[21], y[10]);
 1988|     11|   accum.mul(x[22], y[9]);
 1989|     11|   accum.mul(x[23], y[8]);
 1990|     11|   z[31] = accum.extract();
 1991|     11|   accum.mul(x[9], y[23]);
 1992|     11|   accum.mul(x[10], y[22]);
 1993|     11|   accum.mul(x[11], y[21]);
 1994|     11|   accum.mul(x[12], y[20]);
 1995|     11|   accum.mul(x[13], y[19]);
 1996|     11|   accum.mul(x[14], y[18]);
 1997|     11|   accum.mul(x[15], y[17]);
 1998|     11|   accum.mul(x[16], y[16]);
 1999|     11|   accum.mul(x[17], y[15]);
 2000|     11|   accum.mul(x[18], y[14]);
 2001|     11|   accum.mul(x[19], y[13]);
 2002|     11|   accum.mul(x[20], y[12]);
 2003|     11|   accum.mul(x[21], y[11]);
 2004|     11|   accum.mul(x[22], y[10]);
 2005|     11|   accum.mul(x[23], y[9]);
 2006|     11|   z[32] = accum.extract();
 2007|     11|   accum.mul(x[10], y[23]);
 2008|     11|   accum.mul(x[11], y[22]);
 2009|     11|   accum.mul(x[12], y[21]);
 2010|     11|   accum.mul(x[13], y[20]);
 2011|     11|   accum.mul(x[14], y[19]);
 2012|     11|   accum.mul(x[15], y[18]);
 2013|     11|   accum.mul(x[16], y[17]);
 2014|     11|   accum.mul(x[17], y[16]);
 2015|     11|   accum.mul(x[18], y[15]);
 2016|     11|   accum.mul(x[19], y[14]);
 2017|     11|   accum.mul(x[20], y[13]);
 2018|     11|   accum.mul(x[21], y[12]);
 2019|     11|   accum.mul(x[22], y[11]);
 2020|     11|   accum.mul(x[23], y[10]);
 2021|     11|   z[33] = accum.extract();
 2022|     11|   accum.mul(x[11], y[23]);
 2023|     11|   accum.mul(x[12], y[22]);
 2024|     11|   accum.mul(x[13], y[21]);
 2025|     11|   accum.mul(x[14], y[20]);
 2026|     11|   accum.mul(x[15], y[19]);
 2027|     11|   accum.mul(x[16], y[18]);
 2028|     11|   accum.mul(x[17], y[17]);
 2029|     11|   accum.mul(x[18], y[16]);
 2030|     11|   accum.mul(x[19], y[15]);
 2031|     11|   accum.mul(x[20], y[14]);
 2032|     11|   accum.mul(x[21], y[13]);
 2033|     11|   accum.mul(x[22], y[12]);
 2034|     11|   accum.mul(x[23], y[11]);
 2035|     11|   z[34] = accum.extract();
 2036|     11|   accum.mul(x[12], y[23]);
 2037|     11|   accum.mul(x[13], y[22]);
 2038|     11|   accum.mul(x[14], y[21]);
 2039|     11|   accum.mul(x[15], y[20]);
 2040|     11|   accum.mul(x[16], y[19]);
 2041|     11|   accum.mul(x[17], y[18]);
 2042|     11|   accum.mul(x[18], y[17]);
 2043|     11|   accum.mul(x[19], y[16]);
 2044|     11|   accum.mul(x[20], y[15]);
 2045|     11|   accum.mul(x[21], y[14]);
 2046|     11|   accum.mul(x[22], y[13]);
 2047|     11|   accum.mul(x[23], y[12]);
 2048|     11|   z[35] = accum.extract();
 2049|     11|   accum.mul(x[13], y[23]);
 2050|     11|   accum.mul(x[14], y[22]);
 2051|     11|   accum.mul(x[15], y[21]);
 2052|     11|   accum.mul(x[16], y[20]);
 2053|     11|   accum.mul(x[17], y[19]);
 2054|     11|   accum.mul(x[18], y[18]);
 2055|     11|   accum.mul(x[19], y[17]);
 2056|     11|   accum.mul(x[20], y[16]);
 2057|     11|   accum.mul(x[21], y[15]);
 2058|     11|   accum.mul(x[22], y[14]);
 2059|     11|   accum.mul(x[23], y[13]);
 2060|     11|   z[36] = accum.extract();
 2061|     11|   accum.mul(x[14], y[23]);
 2062|     11|   accum.mul(x[15], y[22]);
 2063|     11|   accum.mul(x[16], y[21]);
 2064|     11|   accum.mul(x[17], y[20]);
 2065|     11|   accum.mul(x[18], y[19]);
 2066|     11|   accum.mul(x[19], y[18]);
 2067|     11|   accum.mul(x[20], y[17]);
 2068|     11|   accum.mul(x[21], y[16]);
 2069|     11|   accum.mul(x[22], y[15]);
 2070|     11|   accum.mul(x[23], y[14]);
 2071|     11|   z[37] = accum.extract();
 2072|     11|   accum.mul(x[15], y[23]);
 2073|     11|   accum.mul(x[16], y[22]);
 2074|     11|   accum.mul(x[17], y[21]);
 2075|     11|   accum.mul(x[18], y[20]);
 2076|     11|   accum.mul(x[19], y[19]);
 2077|     11|   accum.mul(x[20], y[18]);
 2078|     11|   accum.mul(x[21], y[17]);
 2079|     11|   accum.mul(x[22], y[16]);
 2080|     11|   accum.mul(x[23], y[15]);
 2081|     11|   z[38] = accum.extract();
 2082|     11|   accum.mul(x[16], y[23]);
 2083|     11|   accum.mul(x[17], y[22]);
 2084|     11|   accum.mul(x[18], y[21]);
 2085|     11|   accum.mul(x[19], y[20]);
 2086|     11|   accum.mul(x[20], y[19]);
 2087|     11|   accum.mul(x[21], y[18]);
 2088|     11|   accum.mul(x[22], y[17]);
 2089|     11|   accum.mul(x[23], y[16]);
 2090|     11|   z[39] = accum.extract();
 2091|     11|   accum.mul(x[17], y[23]);
 2092|     11|   accum.mul(x[18], y[22]);
 2093|     11|   accum.mul(x[19], y[21]);
 2094|     11|   accum.mul(x[20], y[20]);
 2095|     11|   accum.mul(x[21], y[19]);
 2096|     11|   accum.mul(x[22], y[18]);
 2097|     11|   accum.mul(x[23], y[17]);
 2098|     11|   z[40] = accum.extract();
 2099|     11|   accum.mul(x[18], y[23]);
 2100|     11|   accum.mul(x[19], y[22]);
 2101|     11|   accum.mul(x[20], y[21]);
 2102|     11|   accum.mul(x[21], y[20]);
 2103|     11|   accum.mul(x[22], y[19]);
 2104|     11|   accum.mul(x[23], y[18]);
 2105|     11|   z[41] = accum.extract();
 2106|     11|   accum.mul(x[19], y[23]);
 2107|     11|   accum.mul(x[20], y[22]);
 2108|     11|   accum.mul(x[21], y[21]);
 2109|     11|   accum.mul(x[22], y[20]);
 2110|     11|   accum.mul(x[23], y[19]);
 2111|     11|   z[42] = accum.extract();
 2112|     11|   accum.mul(x[20], y[23]);
 2113|     11|   accum.mul(x[21], y[22]);
 2114|     11|   accum.mul(x[22], y[21]);
 2115|     11|   accum.mul(x[23], y[20]);
 2116|     11|   z[43] = accum.extract();
 2117|     11|   accum.mul(x[21], y[23]);
 2118|     11|   accum.mul(x[22], y[22]);
 2119|     11|   accum.mul(x[23], y[21]);
 2120|     11|   z[44] = accum.extract();
 2121|     11|   accum.mul(x[22], y[23]);
 2122|     11|   accum.mul(x[23], y[22]);
 2123|     11|   z[45] = accum.extract();
 2124|     11|   accum.mul(x[23], y[23]);
 2125|     11|   z[46] = accum.extract();
 2126|     11|   z[47] = accum.extract();
 2127|     11|}

_ZN5Botan12basecase_mulEPmmPKmmS2_m:
   20|    115|void basecase_mul(word z[], size_t z_size, const word x[], size_t x_size, const word y[], size_t y_size) {
   21|    115|   if(z_size < x_size + y_size) {
  ------------------
  |  Branch (21:7): [True: 0, False: 115]
  ------------------
   22|      0|      throw Invalid_Argument("basecase_mul z_size too small");
   23|      0|   }
   24|       |
   25|    115|   const size_t x_size_8 = x_size - (x_size % 8);
   26|       |
   27|    115|   zeroize_buffer(z, z_size);
   28|       |
   29|  1.71k|   for(size_t i = 0; i != y_size; ++i) {
  ------------------
  |  Branch (29:22): [True: 1.59k, False: 115]
  ------------------
   30|  1.59k|      const word y_i = y[i];
   31|       |
   32|  1.59k|      word carry = 0;
   33|       |
   34|  3.51k|      for(size_t j = 0; j != x_size_8; j += 8) {
  ------------------
  |  Branch (34:25): [True: 1.91k, False: 1.59k]
  ------------------
   35|  1.91k|         carry = word8_madd3(z + i + j, x + j, y_i, carry);
   36|  1.91k|      }
   37|       |
   38|  6.20k|      for(size_t j = x_size_8; j != x_size; ++j) {
  ------------------
  |  Branch (38:32): [True: 4.60k, False: 1.59k]
  ------------------
   39|  4.60k|         z[i + j] = word_madd3(x[j], y_i, z[i + j], &carry);
   40|  4.60k|      }
   41|       |
   42|  1.59k|      z[x_size + i] = carry;
   43|  1.59k|   }
   44|    115|}
_ZN5Botan10bigint_mulEPmmPKmmmS2_mmS0_m:
  292|    171|                size_t ws_size) {
  293|    171|   zeroize_buffer(z, z_size);
  294|       |
  295|    171|   if(x_sw == 1) {
  ------------------
  |  Branch (295:7): [True: 0, False: 171]
  ------------------
  296|      0|      bigint_linmul3(z, y, y_sw, x[0]);
  297|    171|   } else if(y_sw == 1) {
  ------------------
  |  Branch (297:14): [True: 0, False: 171]
  ------------------
  298|      0|      bigint_linmul3(z, x, x_sw, y[0]);
  299|    171|   } else if(sized_for_comba_mul<4>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (299:14): [True: 9, False: 162]
  ------------------
  300|      9|      bigint_comba_mul4(z, x, y);
  301|    162|   } else if(sized_for_comba_mul<6>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (301:14): [True: 6, False: 156]
  ------------------
  302|      6|      bigint_comba_mul6(z, x, y);
  303|    156|   } else if(sized_for_comba_mul<8>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (303:14): [True: 8, False: 148]
  ------------------
  304|      8|      bigint_comba_mul8(z, x, y);
  305|    148|   } else if(sized_for_comba_mul<9>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (305:14): [True: 9, False: 139]
  ------------------
  306|      9|      bigint_comba_mul9(z, x, y);
  307|    139|   } else if(sized_for_comba_mul<16>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (307:14): [True: 10, False: 129]
  ------------------
  308|     10|      bigint_comba_mul16(z, x, y);
  309|    129|   } else if(sized_for_comba_mul<24>(x_sw, x_size, y_sw, y_size, z_size)) {
  ------------------
  |  Branch (309:14): [True: 11, False: 118]
  ------------------
  310|     11|      bigint_comba_mul24(z, x, y);
  311|    118|   } else if(x_sw < KARATSUBA_MULTIPLY_THRESHOLD || y_sw < KARATSUBA_MULTIPLY_THRESHOLD || workspace == nullptr) {
  ------------------
  |  Branch (311:14): [True: 88, False: 30]
  |  Branch (311:53): [True: 25, False: 5]
  |  Branch (311:92): [True: 0, False: 5]
  ------------------
  312|    113|      basecase_mul(z, z_size, x, x_sw, y, y_sw);
  313|    113|   } else {
  314|      5|      const size_t N = karatsuba_size(z_size, x_size, x_sw, y_size, y_sw);
  315|       |
  316|      5|      if(N > 0 && z_size >= 2 * N && ws_size >= 2 * N) {
  ------------------
  |  Branch (316:10): [True: 3, False: 2]
  |  Branch (316:19): [True: 3, False: 0]
  |  Branch (316:38): [True: 3, False: 0]
  ------------------
  317|      3|         karatsuba_mul(z, x, y, N, workspace);
  318|      3|      } else {
  319|      2|         basecase_mul(z, z_size, x, x_sw, y, y_sw);
  320|      2|      }
  321|      5|   }
  322|    171|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_114karatsuba_sizeEmmmmm:
  203|      5|size_t karatsuba_size(size_t z_size, size_t x_size, size_t x_sw, size_t y_size, size_t y_sw) {
  204|      5|   if(x_sw > x_size || x_sw > y_size || y_sw > x_size || y_sw > y_size) {
  ------------------
  |  Branch (204:7): [True: 0, False: 5]
  |  Branch (204:24): [True: 0, False: 5]
  |  Branch (204:41): [True: 1, False: 4]
  |  Branch (204:58): [True: 0, False: 4]
  ------------------
  205|      1|      return 0;
  206|      1|   }
  207|       |
  208|      4|   if(((x_size == x_sw) && (x_size % 2 != 0)) || ((y_size == y_sw) && (y_size % 2 != 0))) {
  ------------------
  |  Branch (208:8): [True: 3, False: 1]
  |  Branch (208:28): [True: 1, False: 2]
  |  Branch (208:51): [True: 0, False: 3]
  |  Branch (208:71): [True: 0, False: 0]
  ------------------
  209|      1|      return 0;
  210|      1|   }
  211|       |
  212|      3|   const size_t start = (x_sw > y_sw) ? x_sw : y_sw;
  ------------------
  |  Branch (212:25): [True: 0, False: 3]
  ------------------
  213|      3|   const size_t end = (x_size < y_size) ? x_size : y_size;
  ------------------
  |  Branch (213:23): [True: 3, False: 0]
  ------------------
  214|       |
  215|      3|   if(start == end) {
  ------------------
  |  Branch (215:7): [True: 2, False: 1]
  ------------------
  216|      2|      if(start % 2 != 0) {
  ------------------
  |  Branch (216:10): [True: 0, False: 2]
  ------------------
  217|      0|         return 0;
  218|      0|      }
  219|      2|      return start;
  220|      2|   }
  221|       |
  222|      1|   for(size_t j = start; j <= end; ++j) {
  ------------------
  |  Branch (222:26): [True: 1, False: 0]
  ------------------
  223|      1|      if(j % 2 != 0) {
  ------------------
  |  Branch (223:10): [True: 0, False: 1]
  ------------------
  224|      0|         continue;
  225|      0|      }
  226|       |
  227|      1|      if(2 * j > z_size) {
  ------------------
  |  Branch (227:10): [True: 0, False: 1]
  ------------------
  228|      0|         return 0;
  229|      0|      }
  230|       |
  231|      1|      if(x_sw <= j && j <= x_size && y_sw <= j && j <= y_size) {
  ------------------
  |  Branch (231:10): [True: 1, False: 0]
  |  Branch (231:23): [True: 1, False: 0]
  |  Branch (231:38): [True: 1, False: 0]
  |  Branch (231:51): [True: 1, False: 0]
  ------------------
  232|      1|         if(j % 4 == 2 && (j + 2) <= x_size && (j + 2) <= y_size && 2 * (j + 2) <= z_size) {
  ------------------
  |  Branch (232:13): [True: 0, False: 1]
  |  Branch (232:27): [True: 0, False: 0]
  |  Branch (232:48): [True: 0, False: 0]
  |  Branch (232:69): [True: 0, False: 0]
  ------------------
  233|      0|            return j + 2;
  234|      0|         }
  235|      1|         return j;
  236|      1|      }
  237|      1|   }
  238|       |
  239|      0|   return 0;
  240|      1|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_113karatsuba_mulEPmPKmS3_mS1_:
   80|     12|void karatsuba_mul(word z[], const word x[], const word y[], size_t N, word workspace[]) {
   81|     12|   if(N < KARATSUBA_MULTIPLY_THRESHOLD || N % 2 != 0) {
  ------------------
  |  Branch (81:7): [True: 9, False: 3]
  |  Branch (81:43): [True: 0, False: 3]
  ------------------
   82|      9|      switch(N) {
   83|      0|         case 6:
  ------------------
  |  Branch (83:10): [True: 0, False: 9]
  ------------------
   84|      0|            return bigint_comba_mul6(z, x, y);
   85|      0|         case 8:
  ------------------
  |  Branch (85:10): [True: 0, False: 9]
  ------------------
   86|      0|            return bigint_comba_mul8(z, x, y);
   87|      0|         case 9:
  ------------------
  |  Branch (87:10): [True: 0, False: 9]
  ------------------
   88|      0|            return bigint_comba_mul9(z, x, y);
   89|      9|         case 16:
  ------------------
  |  Branch (89:10): [True: 9, False: 0]
  ------------------
   90|      9|            return bigint_comba_mul16(z, x, y);
   91|      0|         case 24:
  ------------------
  |  Branch (91:10): [True: 0, False: 9]
  ------------------
   92|      0|            return bigint_comba_mul24(z, x, y);
   93|      0|         default:
  ------------------
  |  Branch (93:10): [True: 0, False: 9]
  ------------------
   94|      0|            return basecase_mul(z, 2 * N, x, N, y, N);
   95|      9|      }
   96|      9|   }
   97|       |
   98|      3|   const size_t N2 = N / 2;
   99|       |
  100|      3|   const word* x0 = x;
  101|      3|   const word* x1 = x + N2;
  102|      3|   const word* y0 = y;
  103|      3|   const word* y1 = y + N2;
  104|      3|   word* z0 = z;
  105|      3|   word* z1 = z + N;
  106|       |
  107|      3|   word* ws0 = workspace;
  108|      3|   word* ws1 = workspace + N;
  109|       |
  110|      3|   zeroize_buffer(workspace, 2 * N);
  111|       |
  112|       |   /*
  113|       |   * If either of cmp0 or cmp1 is zero then z0 or z1 resp is zero here,
  114|       |   * resulting in a no-op - z0*z1 will be equal to zero so we don't need to do
  115|       |   * anything, zeroize_buffer above already set the correct result.
  116|       |   *
  117|       |   * However we ignore the result of the comparisons and always perform the
  118|       |   * subtractions and recursively multiply to avoid the timing channel.
  119|       |   */
  120|       |
  121|       |   // First compute (X_lo - X_hi)*(Y_hi - Y_lo)
  122|      3|   const auto cmp0 = bigint_sub_abs(z0, x0, x1, N2, workspace);
  123|      3|   const auto cmp1 = bigint_sub_abs(z1, y1, y0, N2, workspace);
  124|      3|   const auto neg_mask = ~(cmp0 ^ cmp1);
  125|       |
  126|      3|   karatsuba_mul(ws0, z0, z1, N2, ws1);
  127|       |
  128|       |   // Compute X_lo * Y_lo
  129|      3|   karatsuba_mul(z0, x0, y0, N2, ws1);
  130|       |
  131|       |   // Compute X_hi * Y_hi
  132|      3|   karatsuba_mul(z1, x1, y1, N2, ws1);
  133|       |
  134|      3|   const word ws_carry = bigint_add3(ws1, z0, N, z1, N);
  135|      3|   word z_carry = bigint_add2(z + N2, N, ws1, N);
  136|       |
  137|      3|   z_carry += bigint_add2(z + N + N2, N2, &ws_carry, 1);
  138|      3|   bigint_add2(z + N + N2, N2, &z_carry, 1);
  139|       |
  140|      3|   zeroize_buffer(workspace + N, N2);
  141|       |
  142|      3|   bigint_cnd_add(neg_mask.value(), z + N2, workspace, 2 * N - N2);
  143|      3|   bigint_cnd_sub((~neg_mask).value(), z + N2, workspace, 2 * N - N2);
  144|      3|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm4EEEbmmmmm:
  272|    171|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    171|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 41, False: 130]
  |  Branch (273:26): [True: 15, False: 26]
  |  Branch (273:42): [True: 9, False: 6]
  |  Branch (273:56): [True: 9, False: 0]
  |  Branch (273:72): [True: 9, False: 0]
  ------------------
  274|    171|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm6EEEbmmmmm:
  272|    162|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    162|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 47, False: 115]
  |  Branch (273:26): [True: 11, False: 36]
  |  Branch (273:42): [True: 6, False: 5]
  |  Branch (273:56): [True: 6, False: 0]
  |  Branch (273:72): [True: 6, False: 0]
  ------------------
  274|    162|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm8EEEbmmmmm:
  272|    156|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    156|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 63, False: 93]
  |  Branch (273:26): [True: 20, False: 43]
  |  Branch (273:42): [True: 8, False: 12]
  |  Branch (273:56): [True: 8, False: 0]
  |  Branch (273:72): [True: 8, False: 0]
  ------------------
  274|    156|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm9EEEbmmmmm:
  272|    148|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    148|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 64, False: 84]
  |  Branch (273:26): [True: 13, False: 51]
  |  Branch (273:42): [True: 9, False: 4]
  |  Branch (273:56): [True: 9, False: 0]
  |  Branch (273:72): [True: 9, False: 0]
  ------------------
  274|    148|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm16EEEbmmmmm:
  272|    139|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    139|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 76, False: 63]
  |  Branch (273:26): [True: 13, False: 63]
  |  Branch (273:42): [True: 10, False: 3]
  |  Branch (273:56): [True: 10, False: 0]
  |  Branch (273:72): [True: 10, False: 0]
  ------------------
  274|    139|}
mp_karat.cpp:_ZN5Botan12_GLOBAL__N_119sized_for_comba_mulILm24EEEbmmmmm:
  272|    129|inline bool sized_for_comba_mul(size_t x_sw, size_t x_size, size_t y_sw, size_t y_size, size_t z_size) {
  273|    129|   return (x_sw <= SZ && x_size >= SZ && y_sw <= SZ && y_size >= SZ && z_size >= 2 * SZ);
  ------------------
  |  Branch (273:12): [True: 93, False: 36]
  |  Branch (273:26): [True: 15, False: 78]
  |  Branch (273:42): [True: 11, False: 4]
  |  Branch (273:56): [True: 11, False: 0]
  |  Branch (273:72): [True: 11, False: 0]
  ------------------
  274|    129|}

_ZN5Botan16bigint_mulx_mul4EPmPKmS2_:
  120|      9|void bigint_mulx_mul4(word z[8], const word x[4], const word y[4]) {
  121|       |   // clang-format off
  122|      9|   asm(
  123|      9|      "xorl %%r8d, %%r8d\n\t"
  124|      9|      "xorl %%r9d, %%r9d\n\t"
  125|      9|      "xorl %%r10d, %%r10d\n\t"
  126|      9|      "xorl %%r11d, %%r11d\n\t"
  127|       |
  128|      9|      "movq 0(%[y]), %%rdx\n\t"  // row 0: x * y[0]
  129|      9|      "xorl %%eax, %%eax\n\t"
  130|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  131|      9|      "adcx %%rax, %%r8\n\t"
  132|      9|      "movq %%r8, 0(%[z])\n\t"
  133|      9|      "mulx 8(%[x]), %%rax, %%r8\n\t"
  134|      9|      "adox %%rcx, %%rax\n\t"
  135|      9|      "adcx %%rax, %%r9\n\t"
  136|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  137|      9|      "adox %%r8, %%rax\n\t"
  138|      9|      "adcx %%rax, %%r10\n\t"
  139|      9|      "mulx 24(%[x]), %%rax, %%r8\n\t"
  140|      9|      "adox %%rcx, %%rax\n\t"
  141|      9|      "adcx %%rax, %%r11\n\t"
  142|      9|      "movl $0, %%eax\n\t"
  143|      9|      "adox %%rax, %%r8\n\t"
  144|      9|      "adcx %%rax, %%r8\n\t"
  145|       |
  146|      9|      "movq 8(%[y]), %%rdx\n\t"  // row 1: x * y[1]
  147|      9|      "xorl %%eax, %%eax\n\t"
  148|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  149|      9|      "adcx %%rax, %%r9\n\t"
  150|      9|      "movq %%r9, 8(%[z])\n\t"
  151|      9|      "mulx 8(%[x]), %%rax, %%r9\n\t"
  152|      9|      "adox %%rcx, %%rax\n\t"
  153|      9|      "adcx %%rax, %%r10\n\t"
  154|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  155|      9|      "adox %%r9, %%rax\n\t"
  156|      9|      "adcx %%rax, %%r11\n\t"
  157|      9|      "mulx 24(%[x]), %%rax, %%r9\n\t"
  158|      9|      "adox %%rcx, %%rax\n\t"
  159|      9|      "adcx %%rax, %%r8\n\t"
  160|      9|      "movl $0, %%eax\n\t"
  161|      9|      "adox %%rax, %%r9\n\t"
  162|      9|      "adcx %%rax, %%r9\n\t"
  163|       |
  164|      9|      "movq 16(%[y]), %%rdx\n\t"  // row 2: x * y[2]
  165|      9|      "xorl %%eax, %%eax\n\t"
  166|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  167|      9|      "adcx %%rax, %%r10\n\t"
  168|      9|      "movq %%r10, 16(%[z])\n\t"
  169|      9|      "mulx 8(%[x]), %%rax, %%r10\n\t"
  170|      9|      "adox %%rcx, %%rax\n\t"
  171|      9|      "adcx %%rax, %%r11\n\t"
  172|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  173|      9|      "adox %%r10, %%rax\n\t"
  174|      9|      "adcx %%rax, %%r8\n\t"
  175|      9|      "mulx 24(%[x]), %%rax, %%r10\n\t"
  176|      9|      "adox %%rcx, %%rax\n\t"
  177|      9|      "adcx %%rax, %%r9\n\t"
  178|      9|      "movl $0, %%eax\n\t"
  179|      9|      "adox %%rax, %%r10\n\t"
  180|      9|      "adcx %%rax, %%r10\n\t"
  181|       |
  182|      9|      "movq 24(%[y]), %%rdx\n\t"  // row 3: x * y[3]
  183|      9|      "xorl %%eax, %%eax\n\t"
  184|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  185|      9|      "adcx %%rax, %%r11\n\t"
  186|      9|      "movq %%r11, 24(%[z])\n\t"
  187|      9|      "mulx 8(%[x]), %%rax, %%r11\n\t"
  188|      9|      "adox %%rcx, %%rax\n\t"
  189|      9|      "adcx %%rax, %%r8\n\t"
  190|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  191|      9|      "adox %%r11, %%rax\n\t"
  192|      9|      "adcx %%rax, %%r9\n\t"
  193|      9|      "mulx 24(%[x]), %%rax, %%r11\n\t"
  194|      9|      "adox %%rcx, %%rax\n\t"
  195|      9|      "adcx %%rax, %%r10\n\t"
  196|      9|      "movl $0, %%eax\n\t"
  197|      9|      "adox %%rax, %%r11\n\t"
  198|      9|      "adcx %%rax, %%r11\n\t"
  199|       |
  200|      9|      "movq %%r8, 32(%[z])\n\t"
  201|      9|      "movq %%r9, 40(%[z])\n\t"
  202|      9|      "movq %%r10, 48(%[z])\n\t"
  203|      9|      "movq %%r11, 56(%[z])\n\t"
  204|      9|      :
  205|      9|      : [z] "r"(z), [x] "r"(x), [y] "r"(y)
  206|      9|      : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "cc", "memory");
  207|       |   // clang-format on
  208|      9|}
_ZN5Botan16bigint_mulx_mul6EPmPKmS2_:
  367|      6|void bigint_mulx_mul6(word z[12], const word x[6], const word y[6]) {
  368|       |   // clang-format off
  369|      6|   asm(
  370|      6|      "xorl %%r8d, %%r8d\n\t"
  371|      6|      "xorl %%r9d, %%r9d\n\t"
  372|      6|      "xorl %%r10d, %%r10d\n\t"
  373|      6|      "xorl %%r11d, %%r11d\n\t"
  374|      6|      "xorl %%r12d, %%r12d\n\t"
  375|      6|      "xorl %%r13d, %%r13d\n\t"
  376|       |
  377|      6|      "movq 0(%[y]), %%rdx\n\t"  // row 0: x * y[0]
  378|      6|      "xorl %%eax, %%eax\n\t"
  379|      6|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  380|      6|      "adcx %%rax, %%r8\n\t"
  381|      6|      "movq %%r8, 0(%[z])\n\t"
  382|      6|      "mulx 8(%[x]), %%rax, %%r8\n\t"
  383|      6|      "adox %%rcx, %%rax\n\t"
  384|      6|      "adcx %%rax, %%r9\n\t"
  385|      6|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  386|      6|      "adox %%r8, %%rax\n\t"
  387|      6|      "adcx %%rax, %%r10\n\t"
  388|      6|      "mulx 24(%[x]), %%rax, %%r8\n\t"
  389|      6|      "adox %%rcx, %%rax\n\t"
  390|      6|      "adcx %%rax, %%r11\n\t"
  391|      6|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  392|      6|      "adox %%r8, %%rax\n\t"
  393|      6|      "adcx %%rax, %%r12\n\t"
  394|      6|      "mulx 40(%[x]), %%rax, %%r8\n\t"
  395|      6|      "adox %%rcx, %%rax\n\t"
  396|      6|      "adcx %%rax, %%r13\n\t"
  397|      6|      "movl $0, %%eax\n\t"
  398|      6|      "adox %%rax, %%r8\n\t"
  399|      6|      "adcx %%rax, %%r8\n\t"
  400|       |
  401|      6|      "movq 8(%[y]), %%rdx\n\t"  // row 1: x * y[1]
  402|      6|      "xorl %%eax, %%eax\n\t"
  403|      6|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  404|      6|      "adcx %%rax, %%r9\n\t"
  405|      6|      "movq %%r9, 8(%[z])\n\t"
  406|      6|      "mulx 8(%[x]), %%rax, %%r9\n\t"
  407|      6|      "adox %%rcx, %%rax\n\t"
  408|      6|      "adcx %%rax, %%r10\n\t"
  409|      6|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  410|      6|      "adox %%r9, %%rax\n\t"
  411|      6|      "adcx %%rax, %%r11\n\t"
  412|      6|      "mulx 24(%[x]), %%rax, %%r9\n\t"
  413|      6|      "adox %%rcx, %%rax\n\t"
  414|      6|      "adcx %%rax, %%r12\n\t"
  415|      6|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  416|      6|      "adox %%r9, %%rax\n\t"
  417|      6|      "adcx %%rax, %%r13\n\t"
  418|      6|      "mulx 40(%[x]), %%rax, %%r9\n\t"
  419|      6|      "adox %%rcx, %%rax\n\t"
  420|      6|      "adcx %%rax, %%r8\n\t"
  421|      6|      "movl $0, %%eax\n\t"
  422|      6|      "adox %%rax, %%r9\n\t"
  423|      6|      "adcx %%rax, %%r9\n\t"
  424|       |
  425|      6|      "movq 16(%[y]), %%rdx\n\t"  // row 2: x * y[2]
  426|      6|      "xorl %%eax, %%eax\n\t"
  427|      6|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  428|      6|      "adcx %%rax, %%r10\n\t"
  429|      6|      "movq %%r10, 16(%[z])\n\t"
  430|      6|      "mulx 8(%[x]), %%rax, %%r10\n\t"
  431|      6|      "adox %%rcx, %%rax\n\t"
  432|      6|      "adcx %%rax, %%r11\n\t"
  433|      6|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  434|      6|      "adox %%r10, %%rax\n\t"
  435|      6|      "adcx %%rax, %%r12\n\t"
  436|      6|      "mulx 24(%[x]), %%rax, %%r10\n\t"
  437|      6|      "adox %%rcx, %%rax\n\t"
  438|      6|      "adcx %%rax, %%r13\n\t"
  439|      6|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  440|      6|      "adox %%r10, %%rax\n\t"
  441|      6|      "adcx %%rax, %%r8\n\t"
  442|      6|      "mulx 40(%[x]), %%rax, %%r10\n\t"
  443|      6|      "adox %%rcx, %%rax\n\t"
  444|      6|      "adcx %%rax, %%r9\n\t"
  445|      6|      "movl $0, %%eax\n\t"
  446|      6|      "adox %%rax, %%r10\n\t"
  447|      6|      "adcx %%rax, %%r10\n\t"
  448|       |
  449|      6|      "movq 24(%[y]), %%rdx\n\t"  // row 3: x * y[3]
  450|      6|      "xorl %%eax, %%eax\n\t"
  451|      6|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  452|      6|      "adcx %%rax, %%r11\n\t"
  453|      6|      "movq %%r11, 24(%[z])\n\t"
  454|      6|      "mulx 8(%[x]), %%rax, %%r11\n\t"
  455|      6|      "adox %%rcx, %%rax\n\t"
  456|      6|      "adcx %%rax, %%r12\n\t"
  457|      6|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  458|      6|      "adox %%r11, %%rax\n\t"
  459|      6|      "adcx %%rax, %%r13\n\t"
  460|      6|      "mulx 24(%[x]), %%rax, %%r11\n\t"
  461|      6|      "adox %%rcx, %%rax\n\t"
  462|      6|      "adcx %%rax, %%r8\n\t"
  463|      6|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  464|      6|      "adox %%r11, %%rax\n\t"
  465|      6|      "adcx %%rax, %%r9\n\t"
  466|      6|      "mulx 40(%[x]), %%rax, %%r11\n\t"
  467|      6|      "adox %%rcx, %%rax\n\t"
  468|      6|      "adcx %%rax, %%r10\n\t"
  469|      6|      "movl $0, %%eax\n\t"
  470|      6|      "adox %%rax, %%r11\n\t"
  471|      6|      "adcx %%rax, %%r11\n\t"
  472|       |
  473|      6|      "movq 32(%[y]), %%rdx\n\t"  // row 4: x * y[4]
  474|      6|      "xorl %%eax, %%eax\n\t"
  475|      6|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  476|      6|      "adcx %%rax, %%r12\n\t"
  477|      6|      "movq %%r12, 32(%[z])\n\t"
  478|      6|      "mulx 8(%[x]), %%rax, %%r12\n\t"
  479|      6|      "adox %%rcx, %%rax\n\t"
  480|      6|      "adcx %%rax, %%r13\n\t"
  481|      6|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  482|      6|      "adox %%r12, %%rax\n\t"
  483|      6|      "adcx %%rax, %%r8\n\t"
  484|      6|      "mulx 24(%[x]), %%rax, %%r12\n\t"
  485|      6|      "adox %%rcx, %%rax\n\t"
  486|      6|      "adcx %%rax, %%r9\n\t"
  487|      6|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  488|      6|      "adox %%r12, %%rax\n\t"
  489|      6|      "adcx %%rax, %%r10\n\t"
  490|      6|      "mulx 40(%[x]), %%rax, %%r12\n\t"
  491|      6|      "adox %%rcx, %%rax\n\t"
  492|      6|      "adcx %%rax, %%r11\n\t"
  493|      6|      "movl $0, %%eax\n\t"
  494|      6|      "adox %%rax, %%r12\n\t"
  495|      6|      "adcx %%rax, %%r12\n\t"
  496|       |
  497|      6|      "movq 40(%[y]), %%rdx\n\t"  // row 5: x * y[5]
  498|      6|      "xorl %%eax, %%eax\n\t"
  499|      6|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  500|      6|      "adcx %%rax, %%r13\n\t"
  501|      6|      "movq %%r13, 40(%[z])\n\t"
  502|      6|      "mulx 8(%[x]), %%rax, %%r13\n\t"
  503|      6|      "adox %%rcx, %%rax\n\t"
  504|      6|      "adcx %%rax, %%r8\n\t"
  505|      6|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  506|      6|      "adox %%r13, %%rax\n\t"
  507|      6|      "adcx %%rax, %%r9\n\t"
  508|      6|      "mulx 24(%[x]), %%rax, %%r13\n\t"
  509|      6|      "adox %%rcx, %%rax\n\t"
  510|      6|      "adcx %%rax, %%r10\n\t"
  511|      6|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  512|      6|      "adox %%r13, %%rax\n\t"
  513|      6|      "adcx %%rax, %%r11\n\t"
  514|      6|      "mulx 40(%[x]), %%rax, %%r13\n\t"
  515|      6|      "adox %%rcx, %%rax\n\t"
  516|      6|      "adcx %%rax, %%r12\n\t"
  517|      6|      "movl $0, %%eax\n\t"
  518|      6|      "adox %%rax, %%r13\n\t"
  519|      6|      "adcx %%rax, %%r13\n\t"
  520|       |
  521|      6|      "movq %%r8, 48(%[z])\n\t"
  522|      6|      "movq %%r9, 56(%[z])\n\t"
  523|      6|      "movq %%r10, 64(%[z])\n\t"
  524|      6|      "movq %%r11, 72(%[z])\n\t"
  525|      6|      "movq %%r12, 80(%[z])\n\t"
  526|      6|      "movq %%r13, 88(%[z])\n\t"
  527|      6|      :
  528|      6|      : [z] "r"(z), [x] "r"(x), [y] "r"(y)
  529|      6|      : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "cc", "memory");
  530|       |   // clang-format on
  531|      6|}
_ZN5Botan16bigint_mulx_mul8EPmPKmS2_:
  766|      8|void bigint_mulx_mul8(word z[16], const word x[8], const word y[8]) {
  767|       |   // clang-format off
  768|      8|   asm(
  769|      8|      "xorl %%r8d, %%r8d\n\t"
  770|      8|      "xorl %%r9d, %%r9d\n\t"
  771|      8|      "xorl %%r10d, %%r10d\n\t"
  772|      8|      "xorl %%r11d, %%r11d\n\t"
  773|      8|      "xorl %%r12d, %%r12d\n\t"
  774|      8|      "xorl %%r13d, %%r13d\n\t"
  775|      8|      "xorl %%r14d, %%r14d\n\t"
  776|      8|      "xorl %%r15d, %%r15d\n\t"
  777|       |
  778|      8|      "movq 0(%[y]), %%rdx\n\t"  // row 0: x * y[0]
  779|      8|      "xorl %%eax, %%eax\n\t"
  780|      8|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  781|      8|      "adcx %%rax, %%r8\n\t"
  782|      8|      "movq %%r8, 0(%[z])\n\t"
  783|      8|      "mulx 8(%[x]), %%rax, %%r8\n\t"
  784|      8|      "adox %%rcx, %%rax\n\t"
  785|      8|      "adcx %%rax, %%r9\n\t"
  786|      8|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  787|      8|      "adox %%r8, %%rax\n\t"
  788|      8|      "adcx %%rax, %%r10\n\t"
  789|      8|      "mulx 24(%[x]), %%rax, %%r8\n\t"
  790|      8|      "adox %%rcx, %%rax\n\t"
  791|      8|      "adcx %%rax, %%r11\n\t"
  792|      8|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  793|      8|      "adox %%r8, %%rax\n\t"
  794|      8|      "adcx %%rax, %%r12\n\t"
  795|      8|      "mulx 40(%[x]), %%rax, %%r8\n\t"
  796|      8|      "adox %%rcx, %%rax\n\t"
  797|      8|      "adcx %%rax, %%r13\n\t"
  798|      8|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  799|      8|      "adox %%r8, %%rax\n\t"
  800|      8|      "adcx %%rax, %%r14\n\t"
  801|      8|      "mulx 56(%[x]), %%rax, %%r8\n\t"
  802|      8|      "adox %%rcx, %%rax\n\t"
  803|      8|      "adcx %%rax, %%r15\n\t"
  804|      8|      "movl $0, %%eax\n\t"
  805|      8|      "adox %%rax, %%r8\n\t"
  806|      8|      "adcx %%rax, %%r8\n\t"
  807|       |
  808|      8|      "movq 8(%[y]), %%rdx\n\t"  // row 1: x * y[1]
  809|      8|      "xorl %%eax, %%eax\n\t"
  810|      8|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  811|      8|      "adcx %%rax, %%r9\n\t"
  812|      8|      "movq %%r9, 8(%[z])\n\t"
  813|      8|      "mulx 8(%[x]), %%rax, %%r9\n\t"
  814|      8|      "adox %%rcx, %%rax\n\t"
  815|      8|      "adcx %%rax, %%r10\n\t"
  816|      8|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  817|      8|      "adox %%r9, %%rax\n\t"
  818|      8|      "adcx %%rax, %%r11\n\t"
  819|      8|      "mulx 24(%[x]), %%rax, %%r9\n\t"
  820|      8|      "adox %%rcx, %%rax\n\t"
  821|      8|      "adcx %%rax, %%r12\n\t"
  822|      8|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  823|      8|      "adox %%r9, %%rax\n\t"
  824|      8|      "adcx %%rax, %%r13\n\t"
  825|      8|      "mulx 40(%[x]), %%rax, %%r9\n\t"
  826|      8|      "adox %%rcx, %%rax\n\t"
  827|      8|      "adcx %%rax, %%r14\n\t"
  828|      8|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  829|      8|      "adox %%r9, %%rax\n\t"
  830|      8|      "adcx %%rax, %%r15\n\t"
  831|      8|      "mulx 56(%[x]), %%rax, %%r9\n\t"
  832|      8|      "adox %%rcx, %%rax\n\t"
  833|      8|      "adcx %%rax, %%r8\n\t"
  834|      8|      "movl $0, %%eax\n\t"
  835|      8|      "adox %%rax, %%r9\n\t"
  836|      8|      "adcx %%rax, %%r9\n\t"
  837|       |
  838|      8|      "movq 16(%[y]), %%rdx\n\t"  // row 2: x * y[2]
  839|      8|      "xorl %%eax, %%eax\n\t"
  840|      8|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  841|      8|      "adcx %%rax, %%r10\n\t"
  842|      8|      "movq %%r10, 16(%[z])\n\t"
  843|      8|      "mulx 8(%[x]), %%rax, %%r10\n\t"
  844|      8|      "adox %%rcx, %%rax\n\t"
  845|      8|      "adcx %%rax, %%r11\n\t"
  846|      8|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  847|      8|      "adox %%r10, %%rax\n\t"
  848|      8|      "adcx %%rax, %%r12\n\t"
  849|      8|      "mulx 24(%[x]), %%rax, %%r10\n\t"
  850|      8|      "adox %%rcx, %%rax\n\t"
  851|      8|      "adcx %%rax, %%r13\n\t"
  852|      8|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  853|      8|      "adox %%r10, %%rax\n\t"
  854|      8|      "adcx %%rax, %%r14\n\t"
  855|      8|      "mulx 40(%[x]), %%rax, %%r10\n\t"
  856|      8|      "adox %%rcx, %%rax\n\t"
  857|      8|      "adcx %%rax, %%r15\n\t"
  858|      8|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  859|      8|      "adox %%r10, %%rax\n\t"
  860|      8|      "adcx %%rax, %%r8\n\t"
  861|      8|      "mulx 56(%[x]), %%rax, %%r10\n\t"
  862|      8|      "adox %%rcx, %%rax\n\t"
  863|      8|      "adcx %%rax, %%r9\n\t"
  864|      8|      "movl $0, %%eax\n\t"
  865|      8|      "adox %%rax, %%r10\n\t"
  866|      8|      "adcx %%rax, %%r10\n\t"
  867|       |
  868|      8|      "movq 24(%[y]), %%rdx\n\t"  // row 3: x * y[3]
  869|      8|      "xorl %%eax, %%eax\n\t"
  870|      8|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  871|      8|      "adcx %%rax, %%r11\n\t"
  872|      8|      "movq %%r11, 24(%[z])\n\t"
  873|      8|      "mulx 8(%[x]), %%rax, %%r11\n\t"
  874|      8|      "adox %%rcx, %%rax\n\t"
  875|      8|      "adcx %%rax, %%r12\n\t"
  876|      8|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  877|      8|      "adox %%r11, %%rax\n\t"
  878|      8|      "adcx %%rax, %%r13\n\t"
  879|      8|      "mulx 24(%[x]), %%rax, %%r11\n\t"
  880|      8|      "adox %%rcx, %%rax\n\t"
  881|      8|      "adcx %%rax, %%r14\n\t"
  882|      8|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  883|      8|      "adox %%r11, %%rax\n\t"
  884|      8|      "adcx %%rax, %%r15\n\t"
  885|      8|      "mulx 40(%[x]), %%rax, %%r11\n\t"
  886|      8|      "adox %%rcx, %%rax\n\t"
  887|      8|      "adcx %%rax, %%r8\n\t"
  888|      8|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  889|      8|      "adox %%r11, %%rax\n\t"
  890|      8|      "adcx %%rax, %%r9\n\t"
  891|      8|      "mulx 56(%[x]), %%rax, %%r11\n\t"
  892|      8|      "adox %%rcx, %%rax\n\t"
  893|      8|      "adcx %%rax, %%r10\n\t"
  894|      8|      "movl $0, %%eax\n\t"
  895|      8|      "adox %%rax, %%r11\n\t"
  896|      8|      "adcx %%rax, %%r11\n\t"
  897|       |
  898|      8|      "movq 32(%[y]), %%rdx\n\t"  // row 4: x * y[4]
  899|      8|      "xorl %%eax, %%eax\n\t"
  900|      8|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  901|      8|      "adcx %%rax, %%r12\n\t"
  902|      8|      "movq %%r12, 32(%[z])\n\t"
  903|      8|      "mulx 8(%[x]), %%rax, %%r12\n\t"
  904|      8|      "adox %%rcx, %%rax\n\t"
  905|      8|      "adcx %%rax, %%r13\n\t"
  906|      8|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  907|      8|      "adox %%r12, %%rax\n\t"
  908|      8|      "adcx %%rax, %%r14\n\t"
  909|      8|      "mulx 24(%[x]), %%rax, %%r12\n\t"
  910|      8|      "adox %%rcx, %%rax\n\t"
  911|      8|      "adcx %%rax, %%r15\n\t"
  912|      8|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  913|      8|      "adox %%r12, %%rax\n\t"
  914|      8|      "adcx %%rax, %%r8\n\t"
  915|      8|      "mulx 40(%[x]), %%rax, %%r12\n\t"
  916|      8|      "adox %%rcx, %%rax\n\t"
  917|      8|      "adcx %%rax, %%r9\n\t"
  918|      8|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  919|      8|      "adox %%r12, %%rax\n\t"
  920|      8|      "adcx %%rax, %%r10\n\t"
  921|      8|      "mulx 56(%[x]), %%rax, %%r12\n\t"
  922|      8|      "adox %%rcx, %%rax\n\t"
  923|      8|      "adcx %%rax, %%r11\n\t"
  924|      8|      "movl $0, %%eax\n\t"
  925|      8|      "adox %%rax, %%r12\n\t"
  926|      8|      "adcx %%rax, %%r12\n\t"
  927|       |
  928|      8|      "movq 40(%[y]), %%rdx\n\t"  // row 5: x * y[5]
  929|      8|      "xorl %%eax, %%eax\n\t"
  930|      8|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  931|      8|      "adcx %%rax, %%r13\n\t"
  932|      8|      "movq %%r13, 40(%[z])\n\t"
  933|      8|      "mulx 8(%[x]), %%rax, %%r13\n\t"
  934|      8|      "adox %%rcx, %%rax\n\t"
  935|      8|      "adcx %%rax, %%r14\n\t"
  936|      8|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  937|      8|      "adox %%r13, %%rax\n\t"
  938|      8|      "adcx %%rax, %%r15\n\t"
  939|      8|      "mulx 24(%[x]), %%rax, %%r13\n\t"
  940|      8|      "adox %%rcx, %%rax\n\t"
  941|      8|      "adcx %%rax, %%r8\n\t"
  942|      8|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  943|      8|      "adox %%r13, %%rax\n\t"
  944|      8|      "adcx %%rax, %%r9\n\t"
  945|      8|      "mulx 40(%[x]), %%rax, %%r13\n\t"
  946|      8|      "adox %%rcx, %%rax\n\t"
  947|      8|      "adcx %%rax, %%r10\n\t"
  948|      8|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  949|      8|      "adox %%r13, %%rax\n\t"
  950|      8|      "adcx %%rax, %%r11\n\t"
  951|      8|      "mulx 56(%[x]), %%rax, %%r13\n\t"
  952|      8|      "adox %%rcx, %%rax\n\t"
  953|      8|      "adcx %%rax, %%r12\n\t"
  954|      8|      "movl $0, %%eax\n\t"
  955|      8|      "adox %%rax, %%r13\n\t"
  956|      8|      "adcx %%rax, %%r13\n\t"
  957|       |
  958|      8|      "movq 48(%[y]), %%rdx\n\t"  // row 6: x * y[6]
  959|      8|      "xorl %%eax, %%eax\n\t"
  960|      8|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  961|      8|      "adcx %%rax, %%r14\n\t"
  962|      8|      "movq %%r14, 48(%[z])\n\t"
  963|      8|      "mulx 8(%[x]), %%rax, %%r14\n\t"
  964|      8|      "adox %%rcx, %%rax\n\t"
  965|      8|      "adcx %%rax, %%r15\n\t"
  966|      8|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  967|      8|      "adox %%r14, %%rax\n\t"
  968|      8|      "adcx %%rax, %%r8\n\t"
  969|      8|      "mulx 24(%[x]), %%rax, %%r14\n\t"
  970|      8|      "adox %%rcx, %%rax\n\t"
  971|      8|      "adcx %%rax, %%r9\n\t"
  972|      8|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
  973|      8|      "adox %%r14, %%rax\n\t"
  974|      8|      "adcx %%rax, %%r10\n\t"
  975|      8|      "mulx 40(%[x]), %%rax, %%r14\n\t"
  976|      8|      "adox %%rcx, %%rax\n\t"
  977|      8|      "adcx %%rax, %%r11\n\t"
  978|      8|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
  979|      8|      "adox %%r14, %%rax\n\t"
  980|      8|      "adcx %%rax, %%r12\n\t"
  981|      8|      "mulx 56(%[x]), %%rax, %%r14\n\t"
  982|      8|      "adox %%rcx, %%rax\n\t"
  983|      8|      "adcx %%rax, %%r13\n\t"
  984|      8|      "movl $0, %%eax\n\t"
  985|      8|      "adox %%rax, %%r14\n\t"
  986|      8|      "adcx %%rax, %%r14\n\t"
  987|       |
  988|      8|      "movq 56(%[y]), %%rdx\n\t"  // row 7: x * y[7]
  989|      8|      "xorl %%eax, %%eax\n\t"
  990|      8|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
  991|      8|      "adcx %%rax, %%r15\n\t"
  992|      8|      "movq %%r15, 56(%[z])\n\t"
  993|      8|      "mulx 8(%[x]), %%rax, %%r15\n\t"
  994|      8|      "adox %%rcx, %%rax\n\t"
  995|      8|      "adcx %%rax, %%r8\n\t"
  996|      8|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
  997|      8|      "adox %%r15, %%rax\n\t"
  998|      8|      "adcx %%rax, %%r9\n\t"
  999|      8|      "mulx 24(%[x]), %%rax, %%r15\n\t"
 1000|      8|      "adox %%rcx, %%rax\n\t"
 1001|      8|      "adcx %%rax, %%r10\n\t"
 1002|      8|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1003|      8|      "adox %%r15, %%rax\n\t"
 1004|      8|      "adcx %%rax, %%r11\n\t"
 1005|      8|      "mulx 40(%[x]), %%rax, %%r15\n\t"
 1006|      8|      "adox %%rcx, %%rax\n\t"
 1007|      8|      "adcx %%rax, %%r12\n\t"
 1008|      8|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1009|      8|      "adox %%r15, %%rax\n\t"
 1010|      8|      "adcx %%rax, %%r13\n\t"
 1011|      8|      "mulx 56(%[x]), %%rax, %%r15\n\t"
 1012|      8|      "adox %%rcx, %%rax\n\t"
 1013|      8|      "adcx %%rax, %%r14\n\t"
 1014|      8|      "movl $0, %%eax\n\t"
 1015|      8|      "adox %%rax, %%r15\n\t"
 1016|      8|      "adcx %%rax, %%r15\n\t"
 1017|       |
 1018|      8|      "movq %%r8, 64(%[z])\n\t"
 1019|      8|      "movq %%r9, 72(%[z])\n\t"
 1020|      8|      "movq %%r10, 80(%[z])\n\t"
 1021|      8|      "movq %%r11, 88(%[z])\n\t"
 1022|      8|      "movq %%r12, 96(%[z])\n\t"
 1023|      8|      "movq %%r13, 104(%[z])\n\t"
 1024|      8|      "movq %%r14, 112(%[z])\n\t"
 1025|      8|      "movq %%r15, 120(%[z])\n\t"
 1026|      8|      :
 1027|      8|      : [z] "r"(z), [x] "r"(x), [y] "r"(y)
 1028|      8|      : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "cc", "memory");
 1029|       |   // clang-format on
 1030|      8|}
_ZN5Botan16bigint_mulx_mul9EPmPKmS2_:
 1307|      9|void bigint_mulx_mul9(word z[18], const word x[9], const word y[9]) {
 1308|      9|   copy_mem(z + 9, y, 9);
 1309|       |   // clang-format off
 1310|      9|   asm(
 1311|      9|      "xorl %%r8d, %%r8d\n\t"
 1312|      9|      "xorl %%r9d, %%r9d\n\t"
 1313|      9|      "xorl %%r10d, %%r10d\n\t"
 1314|      9|      "xorl %%r11d, %%r11d\n\t"
 1315|      9|      "xorl %%r12d, %%r12d\n\t"
 1316|      9|      "xorl %%r13d, %%r13d\n\t"
 1317|      9|      "xorl %%r14d, %%r14d\n\t"
 1318|      9|      "xorl %%r15d, %%r15d\n\t"
 1319|      9|      "xorl %%ebx, %%ebx\n\t"
 1320|       |
 1321|      9|      "movq 72(%[z]), %%rdx\n\t"  // row 0: x * y[0]
 1322|      9|      "xorl %%eax, %%eax\n\t"
 1323|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1324|      9|      "adcx %%rax, %%r8\n\t"
 1325|      9|      "movq %%r8, 0(%[z])\n\t"
 1326|      9|      "mulx 8(%[x]), %%rax, %%r8\n\t"
 1327|      9|      "adox %%rcx, %%rax\n\t"
 1328|      9|      "adcx %%rax, %%r9\n\t"
 1329|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1330|      9|      "adox %%r8, %%rax\n\t"
 1331|      9|      "adcx %%rax, %%r10\n\t"
 1332|      9|      "mulx 24(%[x]), %%rax, %%r8\n\t"
 1333|      9|      "adox %%rcx, %%rax\n\t"
 1334|      9|      "adcx %%rax, %%r11\n\t"
 1335|      9|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1336|      9|      "adox %%r8, %%rax\n\t"
 1337|      9|      "adcx %%rax, %%r12\n\t"
 1338|      9|      "mulx 40(%[x]), %%rax, %%r8\n\t"
 1339|      9|      "adox %%rcx, %%rax\n\t"
 1340|      9|      "adcx %%rax, %%r13\n\t"
 1341|      9|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1342|      9|      "adox %%r8, %%rax\n\t"
 1343|      9|      "adcx %%rax, %%r14\n\t"
 1344|      9|      "mulx 56(%[x]), %%rax, %%r8\n\t"
 1345|      9|      "adox %%rcx, %%rax\n\t"
 1346|      9|      "adcx %%rax, %%r15\n\t"
 1347|      9|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1348|      9|      "adox %%r8, %%rax\n\t"
 1349|      9|      "adcx %%rax, %%rbx\n\t"
 1350|      9|      "movl $0, %%eax\n\t"
 1351|      9|      "adox %%rax, %%rcx\n\t"
 1352|      9|      "adcx %%rax, %%rcx\n\t"
 1353|      9|      "movq %%rcx, %%r8\n\t"
 1354|       |
 1355|      9|      "movq 80(%[z]), %%rdx\n\t"  // row 1: x * y[1]
 1356|      9|      "xorl %%eax, %%eax\n\t"
 1357|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1358|      9|      "adcx %%rax, %%r9\n\t"
 1359|      9|      "movq %%r9, 8(%[z])\n\t"
 1360|      9|      "mulx 8(%[x]), %%rax, %%r9\n\t"
 1361|      9|      "adox %%rcx, %%rax\n\t"
 1362|      9|      "adcx %%rax, %%r10\n\t"
 1363|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1364|      9|      "adox %%r9, %%rax\n\t"
 1365|      9|      "adcx %%rax, %%r11\n\t"
 1366|      9|      "mulx 24(%[x]), %%rax, %%r9\n\t"
 1367|      9|      "adox %%rcx, %%rax\n\t"
 1368|      9|      "adcx %%rax, %%r12\n\t"
 1369|      9|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1370|      9|      "adox %%r9, %%rax\n\t"
 1371|      9|      "adcx %%rax, %%r13\n\t"
 1372|      9|      "mulx 40(%[x]), %%rax, %%r9\n\t"
 1373|      9|      "adox %%rcx, %%rax\n\t"
 1374|      9|      "adcx %%rax, %%r14\n\t"
 1375|      9|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1376|      9|      "adox %%r9, %%rax\n\t"
 1377|      9|      "adcx %%rax, %%r15\n\t"
 1378|      9|      "mulx 56(%[x]), %%rax, %%r9\n\t"
 1379|      9|      "adox %%rcx, %%rax\n\t"
 1380|      9|      "adcx %%rax, %%rbx\n\t"
 1381|      9|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1382|      9|      "adox %%r9, %%rax\n\t"
 1383|      9|      "adcx %%rax, %%r8\n\t"
 1384|      9|      "movl $0, %%eax\n\t"
 1385|      9|      "adox %%rax, %%rcx\n\t"
 1386|      9|      "adcx %%rax, %%rcx\n\t"
 1387|      9|      "movq %%rcx, %%r9\n\t"
 1388|       |
 1389|      9|      "movq 88(%[z]), %%rdx\n\t"  // row 2: x * y[2]
 1390|      9|      "xorl %%eax, %%eax\n\t"
 1391|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1392|      9|      "adcx %%rax, %%r10\n\t"
 1393|      9|      "movq %%r10, 16(%[z])\n\t"
 1394|      9|      "mulx 8(%[x]), %%rax, %%r10\n\t"
 1395|      9|      "adox %%rcx, %%rax\n\t"
 1396|      9|      "adcx %%rax, %%r11\n\t"
 1397|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1398|      9|      "adox %%r10, %%rax\n\t"
 1399|      9|      "adcx %%rax, %%r12\n\t"
 1400|      9|      "mulx 24(%[x]), %%rax, %%r10\n\t"
 1401|      9|      "adox %%rcx, %%rax\n\t"
 1402|      9|      "adcx %%rax, %%r13\n\t"
 1403|      9|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1404|      9|      "adox %%r10, %%rax\n\t"
 1405|      9|      "adcx %%rax, %%r14\n\t"
 1406|      9|      "mulx 40(%[x]), %%rax, %%r10\n\t"
 1407|      9|      "adox %%rcx, %%rax\n\t"
 1408|      9|      "adcx %%rax, %%r15\n\t"
 1409|      9|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1410|      9|      "adox %%r10, %%rax\n\t"
 1411|      9|      "adcx %%rax, %%rbx\n\t"
 1412|      9|      "mulx 56(%[x]), %%rax, %%r10\n\t"
 1413|      9|      "adox %%rcx, %%rax\n\t"
 1414|      9|      "adcx %%rax, %%r8\n\t"
 1415|      9|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1416|      9|      "adox %%r10, %%rax\n\t"
 1417|      9|      "adcx %%rax, %%r9\n\t"
 1418|      9|      "movl $0, %%eax\n\t"
 1419|      9|      "adox %%rax, %%rcx\n\t"
 1420|      9|      "adcx %%rax, %%rcx\n\t"
 1421|      9|      "movq %%rcx, %%r10\n\t"
 1422|       |
 1423|      9|      "movq 96(%[z]), %%rdx\n\t"  // row 3: x * y[3]
 1424|      9|      "xorl %%eax, %%eax\n\t"
 1425|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1426|      9|      "adcx %%rax, %%r11\n\t"
 1427|      9|      "movq %%r11, 24(%[z])\n\t"
 1428|      9|      "mulx 8(%[x]), %%rax, %%r11\n\t"
 1429|      9|      "adox %%rcx, %%rax\n\t"
 1430|      9|      "adcx %%rax, %%r12\n\t"
 1431|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1432|      9|      "adox %%r11, %%rax\n\t"
 1433|      9|      "adcx %%rax, %%r13\n\t"
 1434|      9|      "mulx 24(%[x]), %%rax, %%r11\n\t"
 1435|      9|      "adox %%rcx, %%rax\n\t"
 1436|      9|      "adcx %%rax, %%r14\n\t"
 1437|      9|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1438|      9|      "adox %%r11, %%rax\n\t"
 1439|      9|      "adcx %%rax, %%r15\n\t"
 1440|      9|      "mulx 40(%[x]), %%rax, %%r11\n\t"
 1441|      9|      "adox %%rcx, %%rax\n\t"
 1442|      9|      "adcx %%rax, %%rbx\n\t"
 1443|      9|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1444|      9|      "adox %%r11, %%rax\n\t"
 1445|      9|      "adcx %%rax, %%r8\n\t"
 1446|      9|      "mulx 56(%[x]), %%rax, %%r11\n\t"
 1447|      9|      "adox %%rcx, %%rax\n\t"
 1448|      9|      "adcx %%rax, %%r9\n\t"
 1449|      9|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1450|      9|      "adox %%r11, %%rax\n\t"
 1451|      9|      "adcx %%rax, %%r10\n\t"
 1452|      9|      "movl $0, %%eax\n\t"
 1453|      9|      "adox %%rax, %%rcx\n\t"
 1454|      9|      "adcx %%rax, %%rcx\n\t"
 1455|      9|      "movq %%rcx, %%r11\n\t"
 1456|       |
 1457|      9|      "movq 104(%[z]), %%rdx\n\t"  // row 4: x * y[4]
 1458|      9|      "xorl %%eax, %%eax\n\t"
 1459|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1460|      9|      "adcx %%rax, %%r12\n\t"
 1461|      9|      "movq %%r12, 32(%[z])\n\t"
 1462|      9|      "mulx 8(%[x]), %%rax, %%r12\n\t"
 1463|      9|      "adox %%rcx, %%rax\n\t"
 1464|      9|      "adcx %%rax, %%r13\n\t"
 1465|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1466|      9|      "adox %%r12, %%rax\n\t"
 1467|      9|      "adcx %%rax, %%r14\n\t"
 1468|      9|      "mulx 24(%[x]), %%rax, %%r12\n\t"
 1469|      9|      "adox %%rcx, %%rax\n\t"
 1470|      9|      "adcx %%rax, %%r15\n\t"
 1471|      9|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1472|      9|      "adox %%r12, %%rax\n\t"
 1473|      9|      "adcx %%rax, %%rbx\n\t"
 1474|      9|      "mulx 40(%[x]), %%rax, %%r12\n\t"
 1475|      9|      "adox %%rcx, %%rax\n\t"
 1476|      9|      "adcx %%rax, %%r8\n\t"
 1477|      9|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1478|      9|      "adox %%r12, %%rax\n\t"
 1479|      9|      "adcx %%rax, %%r9\n\t"
 1480|      9|      "mulx 56(%[x]), %%rax, %%r12\n\t"
 1481|      9|      "adox %%rcx, %%rax\n\t"
 1482|      9|      "adcx %%rax, %%r10\n\t"
 1483|      9|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1484|      9|      "adox %%r12, %%rax\n\t"
 1485|      9|      "adcx %%rax, %%r11\n\t"
 1486|      9|      "movl $0, %%eax\n\t"
 1487|      9|      "adox %%rax, %%rcx\n\t"
 1488|      9|      "adcx %%rax, %%rcx\n\t"
 1489|      9|      "movq %%rcx, %%r12\n\t"
 1490|       |
 1491|      9|      "movq 112(%[z]), %%rdx\n\t"  // row 5: x * y[5]
 1492|      9|      "xorl %%eax, %%eax\n\t"
 1493|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1494|      9|      "adcx %%rax, %%r13\n\t"
 1495|      9|      "movq %%r13, 40(%[z])\n\t"
 1496|      9|      "mulx 8(%[x]), %%rax, %%r13\n\t"
 1497|      9|      "adox %%rcx, %%rax\n\t"
 1498|      9|      "adcx %%rax, %%r14\n\t"
 1499|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1500|      9|      "adox %%r13, %%rax\n\t"
 1501|      9|      "adcx %%rax, %%r15\n\t"
 1502|      9|      "mulx 24(%[x]), %%rax, %%r13\n\t"
 1503|      9|      "adox %%rcx, %%rax\n\t"
 1504|      9|      "adcx %%rax, %%rbx\n\t"
 1505|      9|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1506|      9|      "adox %%r13, %%rax\n\t"
 1507|      9|      "adcx %%rax, %%r8\n\t"
 1508|      9|      "mulx 40(%[x]), %%rax, %%r13\n\t"
 1509|      9|      "adox %%rcx, %%rax\n\t"
 1510|      9|      "adcx %%rax, %%r9\n\t"
 1511|      9|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1512|      9|      "adox %%r13, %%rax\n\t"
 1513|      9|      "adcx %%rax, %%r10\n\t"
 1514|      9|      "mulx 56(%[x]), %%rax, %%r13\n\t"
 1515|      9|      "adox %%rcx, %%rax\n\t"
 1516|      9|      "adcx %%rax, %%r11\n\t"
 1517|      9|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1518|      9|      "adox %%r13, %%rax\n\t"
 1519|      9|      "adcx %%rax, %%r12\n\t"
 1520|      9|      "movl $0, %%eax\n\t"
 1521|      9|      "adox %%rax, %%rcx\n\t"
 1522|      9|      "adcx %%rax, %%rcx\n\t"
 1523|      9|      "movq %%rcx, %%r13\n\t"
 1524|       |
 1525|      9|      "movq 120(%[z]), %%rdx\n\t"  // row 6: x * y[6]
 1526|      9|      "xorl %%eax, %%eax\n\t"
 1527|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1528|      9|      "adcx %%rax, %%r14\n\t"
 1529|      9|      "movq %%r14, 48(%[z])\n\t"
 1530|      9|      "mulx 8(%[x]), %%rax, %%r14\n\t"
 1531|      9|      "adox %%rcx, %%rax\n\t"
 1532|      9|      "adcx %%rax, %%r15\n\t"
 1533|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1534|      9|      "adox %%r14, %%rax\n\t"
 1535|      9|      "adcx %%rax, %%rbx\n\t"
 1536|      9|      "mulx 24(%[x]), %%rax, %%r14\n\t"
 1537|      9|      "adox %%rcx, %%rax\n\t"
 1538|      9|      "adcx %%rax, %%r8\n\t"
 1539|      9|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1540|      9|      "adox %%r14, %%rax\n\t"
 1541|      9|      "adcx %%rax, %%r9\n\t"
 1542|      9|      "mulx 40(%[x]), %%rax, %%r14\n\t"
 1543|      9|      "adox %%rcx, %%rax\n\t"
 1544|      9|      "adcx %%rax, %%r10\n\t"
 1545|      9|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1546|      9|      "adox %%r14, %%rax\n\t"
 1547|      9|      "adcx %%rax, %%r11\n\t"
 1548|      9|      "mulx 56(%[x]), %%rax, %%r14\n\t"
 1549|      9|      "adox %%rcx, %%rax\n\t"
 1550|      9|      "adcx %%rax, %%r12\n\t"
 1551|      9|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1552|      9|      "adox %%r14, %%rax\n\t"
 1553|      9|      "adcx %%rax, %%r13\n\t"
 1554|      9|      "movl $0, %%eax\n\t"
 1555|      9|      "adox %%rax, %%rcx\n\t"
 1556|      9|      "adcx %%rax, %%rcx\n\t"
 1557|      9|      "movq %%rcx, %%r14\n\t"
 1558|       |
 1559|      9|      "movq 128(%[z]), %%rdx\n\t"  // row 7: x * y[7]
 1560|      9|      "xorl %%eax, %%eax\n\t"
 1561|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1562|      9|      "adcx %%rax, %%r15\n\t"
 1563|      9|      "movq %%r15, 56(%[z])\n\t"
 1564|      9|      "mulx 8(%[x]), %%rax, %%r15\n\t"
 1565|      9|      "adox %%rcx, %%rax\n\t"
 1566|      9|      "adcx %%rax, %%rbx\n\t"
 1567|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1568|      9|      "adox %%r15, %%rax\n\t"
 1569|      9|      "adcx %%rax, %%r8\n\t"
 1570|      9|      "mulx 24(%[x]), %%rax, %%r15\n\t"
 1571|      9|      "adox %%rcx, %%rax\n\t"
 1572|      9|      "adcx %%rax, %%r9\n\t"
 1573|      9|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1574|      9|      "adox %%r15, %%rax\n\t"
 1575|      9|      "adcx %%rax, %%r10\n\t"
 1576|      9|      "mulx 40(%[x]), %%rax, %%r15\n\t"
 1577|      9|      "adox %%rcx, %%rax\n\t"
 1578|      9|      "adcx %%rax, %%r11\n\t"
 1579|      9|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1580|      9|      "adox %%r15, %%rax\n\t"
 1581|      9|      "adcx %%rax, %%r12\n\t"
 1582|      9|      "mulx 56(%[x]), %%rax, %%r15\n\t"
 1583|      9|      "adox %%rcx, %%rax\n\t"
 1584|      9|      "adcx %%rax, %%r13\n\t"
 1585|      9|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1586|      9|      "adox %%r15, %%rax\n\t"
 1587|      9|      "adcx %%rax, %%r14\n\t"
 1588|      9|      "movl $0, %%eax\n\t"
 1589|      9|      "adox %%rax, %%rcx\n\t"
 1590|      9|      "adcx %%rax, %%rcx\n\t"
 1591|      9|      "movq %%rcx, %%r15\n\t"
 1592|       |
 1593|      9|      "movq 136(%[z]), %%rdx\n\t"  // row 8: x * y[8]
 1594|      9|      "xorl %%eax, %%eax\n\t"
 1595|      9|      "mulx 0(%[x]), %%rax, %%rcx\n\t"
 1596|      9|      "adcx %%rax, %%rbx\n\t"
 1597|      9|      "movq %%rbx, 64(%[z])\n\t"
 1598|      9|      "mulx 8(%[x]), %%rax, %%rbx\n\t"
 1599|      9|      "adox %%rcx, %%rax\n\t"
 1600|      9|      "adcx %%rax, %%r8\n\t"
 1601|      9|      "mulx 16(%[x]), %%rax, %%rcx\n\t"
 1602|      9|      "adox %%rbx, %%rax\n\t"
 1603|      9|      "adcx %%rax, %%r9\n\t"
 1604|      9|      "mulx 24(%[x]), %%rax, %%rbx\n\t"
 1605|      9|      "adox %%rcx, %%rax\n\t"
 1606|      9|      "adcx %%rax, %%r10\n\t"
 1607|      9|      "mulx 32(%[x]), %%rax, %%rcx\n\t"
 1608|      9|      "adox %%rbx, %%rax\n\t"
 1609|      9|      "adcx %%rax, %%r11\n\t"
 1610|      9|      "mulx 40(%[x]), %%rax, %%rbx\n\t"
 1611|      9|      "adox %%rcx, %%rax\n\t"
 1612|      9|      "adcx %%rax, %%r12\n\t"
 1613|      9|      "mulx 48(%[x]), %%rax, %%rcx\n\t"
 1614|      9|      "adox %%rbx, %%rax\n\t"
 1615|      9|      "adcx %%rax, %%r13\n\t"
 1616|      9|      "mulx 56(%[x]), %%rax, %%rbx\n\t"
 1617|      9|      "adox %%rcx, %%rax\n\t"
 1618|      9|      "adcx %%rax, %%r14\n\t"
 1619|      9|      "mulx 64(%[x]), %%rax, %%rcx\n\t"
 1620|      9|      "adox %%rbx, %%rax\n\t"
 1621|      9|      "adcx %%rax, %%r15\n\t"
 1622|      9|      "movl $0, %%eax\n\t"
 1623|      9|      "adox %%rax, %%rcx\n\t"
 1624|      9|      "adcx %%rax, %%rcx\n\t"
 1625|      9|      "movq %%rcx, %%rbx\n\t"
 1626|       |
 1627|      9|      "movq %%r8, 72(%[z])\n\t"
 1628|      9|      "movq %%r9, 80(%[z])\n\t"
 1629|      9|      "movq %%r10, 88(%[z])\n\t"
 1630|      9|      "movq %%r11, 96(%[z])\n\t"
 1631|      9|      "movq %%r12, 104(%[z])\n\t"
 1632|      9|      "movq %%r13, 112(%[z])\n\t"
 1633|      9|      "movq %%r14, 120(%[z])\n\t"
 1634|      9|      "movq %%r15, 128(%[z])\n\t"
 1635|      9|      "movq %%rbx, 136(%[z])\n\t"
 1636|      9|      :
 1637|      9|      : [z] "r"(z), [x] "r"(x)
 1638|      9|      : "rax", "rcx", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "rbx", "cc", "memory");
 1639|       |   // clang-format on
 1640|      9|}

_ZN5Botan15allocate_memoryEmm:
   21|  11.4k|BOTAN_MALLOC_FN void* allocate_memory(size_t elems, size_t elem_size) {
   22|  11.4k|   if(elems == 0 || elem_size == 0) {
  ------------------
  |  Branch (22:7): [True: 0, False: 11.4k]
  |  Branch (22:21): [True: 0, False: 11.4k]
  ------------------
   23|      0|      return nullptr;
   24|      0|   }
   25|       |
   26|       |   // Some calloc implementations do not check for overflow (?!?)
   27|  11.4k|   if(!checked_mul(elems, elem_size).has_value()) {
  ------------------
  |  Branch (27:7): [True: 0, False: 11.4k]
  ------------------
   28|      0|      throw std::bad_alloc();
   29|      0|   }
   30|       |
   31|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   32|       |   // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy
   33|       |   if(void* p = mlock_allocator::instance().allocate(elems, elem_size)) {
   34|       |      return p;
   35|       |   }
   36|       |#endif
   37|       |
   38|       |#if defined(BOTAN_TARGET_OS_HAS_ALLOC_CONCEAL)
   39|       |   void* ptr = ::calloc_conceal(elems, elem_size);
   40|       |#else
   41|       |   // NOLINTNEXTLINE(*-const-correctness) bug in clang-tidy
   42|  11.4k|   void* ptr = std::calloc(elems, elem_size);  // NOLINT(*-no-malloc,*-owning-memory)
   43|  11.4k|#endif
   44|  11.4k|   if(ptr == nullptr) {
  ------------------
  |  Branch (44:7): [True: 0, False: 11.4k]
  ------------------
   45|      0|      [[unlikely]] throw std::bad_alloc();
   46|      0|   }
   47|  11.4k|   return ptr;
   48|  11.4k|}
_ZN5Botan17deallocate_memoryEPvmm:
   50|  11.4k|void deallocate_memory(void* p, size_t elems, size_t elem_size) {
   51|  11.4k|   if(p == nullptr) {
  ------------------
  |  Branch (51:7): [True: 0, False: 11.4k]
  ------------------
   52|      0|      [[unlikely]] return;
   53|      0|   }
   54|       |
   55|  11.4k|   secure_scrub_memory(p, elems * elem_size);
   56|       |
   57|       |#if defined(BOTAN_HAS_LOCKING_ALLOCATOR)
   58|       |   if(mlock_allocator::instance().deallocate(p, elems, elem_size)) {
   59|       |      return;
   60|       |   }
   61|       |#endif
   62|       |
   63|  11.4k|   std::free(p);  // NOLINT(*-no-malloc,*-owning-memory)
   64|  11.4k|}

_ZN5Botan5CPUID10CPUID_DataC2Ev:
   80|      1|CPUID::CPUID_Data::CPUID_Data() {
   81|       |   // NOLINTBEGIN(*-prefer-member-initializer)
   82|      1|#if defined(BOTAN_HAS_CPUID_DETECTION)
   83|      1|   m_processor_features = detect_cpu_features(~cleared_cpuid_bits());
   84|       |#else
   85|       |   m_processor_features = 0;
   86|       |#endif
   87|       |   // NOLINTEND(*-prefer-member-initializer)
   88|      1|}
cpuid.cpp:_ZN5Botan12_GLOBAL__N_118cleared_cpuid_bitsEv:
   59|      1|uint32_t cleared_cpuid_bits() {
   60|      1|   uint32_t cleared = 0;
   61|       |
   62|      1|   #if defined(BOTAN_HAS_OS_UTILS)
   63|      1|   std::string clear_cpuid_env;
   64|      1|   if(OS::read_env_variable(clear_cpuid_env, "BOTAN_CLEAR_CPUID")) {
  ------------------
  |  Branch (64:7): [True: 0, False: 1]
  ------------------
   65|      0|      for(const auto& cpuid : split_on(clear_cpuid_env, ',')) {
  ------------------
  |  Branch (65:29): [True: 0, False: 0]
  ------------------
   66|      0|         if(auto bit = CPUID::bit_from_string(cpuid)) {
  ------------------
  |  Branch (66:18): [True: 0, False: 0]
  ------------------
   67|      0|            cleared |= bit->as_u32();
   68|      0|         }
   69|      0|      }
   70|      0|   }
   71|      1|   #endif
   72|       |
   73|      1|   return cleared;
   74|      1|}

_ZN5Botan5CPUID10CPUID_Data19detect_cpu_featuresEj:
   62|      1|uint32_t CPUID::CPUID_Data::detect_cpu_features(uint32_t allowed) {
   63|      1|   enum class x86_CPUID_1_bits : uint64_t {
   64|      1|      RDTSC = (1ULL << 4),
   65|      1|      SSE2 = (1ULL << 26),
   66|      1|      CLMUL = (1ULL << 33),
   67|      1|      SSSE3 = (1ULL << 41),
   68|      1|      SSE41 = (1ULL << 51),
   69|      1|      POPCNT = (1ULL << 55),
   70|      1|      AESNI = (1ULL << 57),
   71|       |      // AVX + OSXSAVE
   72|      1|      OSXSAVE = (1ULL << 59) | (1ULL << 60),
   73|      1|      RDRAND = (1ULL << 62)
   74|      1|   };
   75|       |
   76|      1|   enum class x86_CPUID_7_bits : uint64_t {
   77|      1|      BMI1 = (1ULL << 3),
   78|      1|      AVX2 = (1ULL << 5),
   79|      1|      BMI2 = (1ULL << 8),
   80|      1|      BMI_1_AND_2 = BMI1 | BMI2,
   81|      1|      AVX512_F = (1ULL << 16),
   82|      1|      AVX512_DQ = (1ULL << 17),
   83|      1|      RDSEED = (1ULL << 18),
   84|      1|      ADX = (1ULL << 19),
   85|      1|      AVX512_IFMA = (1ULL << 21),
   86|      1|      SHA = (1ULL << 29),
   87|      1|      AVX512_BW = (1ULL << 30),
   88|      1|      AVX512_VL = (1ULL << 31),
   89|      1|      AVX512_VBMI = (1ULL << 33),
   90|      1|      AVX512_VBMI2 = (1ULL << 38),
   91|      1|      GFNI = (1ULL << 40),
   92|      1|      AVX512_VAES = (1ULL << 41),
   93|      1|      AVX512_VCLMUL = (1ULL << 42),
   94|      1|      AVX512_VBITALG = (1ULL << 44),
   95|       |
   96|       |      /*
   97|       |      We only enable AVX512 support if all of the below flags are available
   98|       |
   99|       |      This is more than we strictly need for most uses, however it also has
  100|       |      the effect of preventing execution of AVX512 codepaths on cores that
  101|       |      have serious downclocking problems when AVX512 code executes,
  102|       |      especially Intel Skylake.
  103|       |
  104|       |      VBMI2/VBITALG are the key flags here as they restrict us to Intel Ice
  105|       |      Lake/Rocket Lake, or AMD Zen4, all of which do not have penalties for
  106|       |      executing AVX512.
  107|       |
  108|       |      There is nothing stopping some future processor from supporting the
  109|       |      above flags and having AVX512 penalties, but maybe you should not have
  110|       |      bought such a processor.
  111|       |      */
  112|      1|      AVX512_PROFILE =
  113|      1|         AVX512_F | AVX512_DQ | AVX512_IFMA | AVX512_BW | AVX512_VL | AVX512_VBMI | AVX512_VBMI2 | AVX512_VBITALG,
  114|      1|   };
  115|       |
  116|       |   // NOLINTNEXTLINE(performance-enum-size)
  117|      1|   enum class x86_CPUID_7_1_bits : uint64_t {
  118|      1|      SHA512 = (1 << 0),
  119|      1|      SM3 = (1 << 1),
  120|      1|      SM4 = (1 << 2),
  121|      1|   };
  122|       |
  123|      1|   uint32_t feat = 0;
  124|      1|   uint32_t cpuid[4] = {0};
  125|      1|   bool has_sse41 = false;
  126|      1|   bool has_os_ymm_support = false;
  127|      1|   bool has_os_zmm_support = false;
  128|       |
  129|       |   // CPUID 0: vendor identification, max sublevel
  130|      1|   invoke_cpuid(0, cpuid);
  131|       |
  132|      1|   const uint32_t max_supported_sublevel = cpuid[0];
  133|       |
  134|      1|   if(max_supported_sublevel >= 1) {
  ------------------
  |  Branch (134:7): [True: 1, False: 0]
  ------------------
  135|       |      // CPUID 1: feature bits
  136|      1|      invoke_cpuid(1, cpuid);
  137|      1|      const uint64_t flags0 = (static_cast<uint64_t>(cpuid[2]) << 32) | cpuid[3];
  138|       |
  139|      1|      feat |= if_set(flags0, x86_CPUID_1_bits::RDTSC, CPUFeature::Bit::RDTSC, allowed);
  140|       |
  141|      1|      feat |= if_set(flags0, x86_CPUID_1_bits::RDRAND, CPUFeature::Bit::RDRAND, allowed);
  142|       |
  143|      1|      feat |= if_set(flags0, x86_CPUID_1_bits::POPCNT, CPUFeature::Bit::POPCNT, allowed);
  144|       |
  145|      1|      feat |= if_set(flags0, x86_CPUID_1_bits::SSE2, CPUFeature::Bit::SSE2, allowed);
  146|       |
  147|      1|      if(is_set(feat, CPUFeature::Bit::SSE2)) {
  ------------------
  |  Branch (147:10): [True: 1, False: 0]
  ------------------
  148|      1|         feat |= if_set(flags0, x86_CPUID_1_bits::SSSE3, CPUFeature::Bit::SSSE3, allowed);
  149|       |
  150|      1|         if(is_set(feat, CPUFeature::Bit::SSSE3)) {
  ------------------
  |  Branch (150:13): [True: 1, False: 0]
  ------------------
  151|      1|            feat |= if_set(flags0, x86_CPUID_1_bits::CLMUL, CPUFeature::Bit::CLMUL, allowed);
  152|      1|            feat |= if_set(flags0, x86_CPUID_1_bits::AESNI, CPUFeature::Bit::AESNI, allowed);
  153|       |
  154|       |            // SSE4.1 is not tracked as a feature, but is required by the SHA-NI code
  155|      1|            const uint64_t sse41 = static_cast<uint64_t>(x86_CPUID_1_bits::SSE41);
  156|      1|            has_sse41 = (flags0 & sse41) == sse41;
  157|      1|         }
  158|       |
  159|      1|         const uint64_t osxsave64 = static_cast<uint64_t>(x86_CPUID_1_bits::OSXSAVE);
  160|      1|         if((flags0 & osxsave64) == osxsave64) {
  ------------------
  |  Branch (160:13): [True: 1, False: 0]
  ------------------
  161|      1|            const uint64_t xcr_flags = xgetbv();
  162|      1|            if((xcr_flags & 0x6) == 0x6) {
  ------------------
  |  Branch (162:16): [True: 1, False: 0]
  ------------------
  163|      1|               has_os_ymm_support = true;
  164|      1|               has_os_zmm_support = (xcr_flags & 0xE0) == 0xE0;
  165|      1|            }
  166|      1|         }
  167|      1|      }
  168|      1|   }
  169|       |
  170|      1|   if(max_supported_sublevel >= 7) {
  ------------------
  |  Branch (170:7): [True: 1, False: 0]
  ------------------
  171|      1|      clear_mem(cpuid, 4);
  172|      1|      invoke_cpuid_sublevel(7, 0, cpuid);
  173|       |
  174|      1|      const uint64_t flags7 = (static_cast<uint64_t>(cpuid[2]) << 32) | cpuid[1];
  175|       |
  176|      1|      clear_mem(cpuid, 4);
  177|      1|      invoke_cpuid_sublevel(7, 1, cpuid);
  178|      1|      const uint32_t flags7_1 = cpuid[0];
  179|       |
  180|      1|      feat |= if_set(flags7, x86_CPUID_7_bits::RDSEED, CPUFeature::Bit::RDSEED, allowed);
  181|      1|      feat |= if_set(flags7, x86_CPUID_7_bits::ADX, CPUFeature::Bit::ADX, allowed);
  182|       |
  183|       |      /*
  184|       |      We only set the BMI bit if both BMI1 and BMI2 are supported, since
  185|       |      typically we want to use both extensions in the same code.
  186|       |      */
  187|      1|      feat |= if_set(flags7, x86_CPUID_7_bits::BMI_1_AND_2, CPUFeature::Bit::BMI, allowed);
  188|       |
  189|      1|      if(is_set(feat, CPUFeature::Bit::SSSE3)) {
  ------------------
  |  Branch (189:10): [True: 1, False: 0]
  ------------------
  190|       |         // The SHA-NI code uses SSE4.1 instructions in addition to SSSE3
  191|      1|         if(has_sse41) {
  ------------------
  |  Branch (191:13): [True: 1, False: 0]
  ------------------
  192|      1|            feat |= if_set(flags7, x86_CPUID_7_bits::SHA, CPUFeature::Bit::SHA, allowed);
  193|      1|         }
  194|       |
  195|       |         // We only consider AVX2 if SSSE3 is supported
  196|      1|         if(has_os_ymm_support) {
  ------------------
  |  Branch (196:13): [True: 1, False: 0]
  ------------------
  197|      1|            feat |= if_set(flags7, x86_CPUID_7_bits::AVX2, CPUFeature::Bit::AVX2, allowed);
  198|       |
  199|      1|            if(is_set(feat, CPUFeature::Bit::AVX2)) {
  ------------------
  |  Branch (199:16): [True: 1, False: 0]
  ------------------
  200|      1|               feat |= if_set(flags7, x86_CPUID_7_bits::GFNI, CPUFeature::Bit::GFNI, allowed);
  201|      1|               feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VAES, CPUFeature::Bit::AVX2_AES, allowed);
  202|      1|               feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SHA512, CPUFeature::Bit::SHA512, allowed);
  203|       |               // The SM3/SM4 instructions are VEX encoded and the code using them also uses AVX2
  204|      1|               feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SM3, CPUFeature::Bit::SM3, allowed);
  205|      1|               feat |= if_set(flags7_1, x86_CPUID_7_1_bits::SM4, CPUFeature::Bit::SM4, allowed);
  206|       |
  207|       |               // The VPCLMULQDQ code also uses the legacy 128-bit PCLMULQDQ instruction
  208|      1|               if(is_set(feat, CPUFeature::Bit::CLMUL)) {
  ------------------
  |  Branch (208:19): [True: 1, False: 0]
  ------------------
  209|      1|                  feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VCLMUL, CPUFeature::Bit::AVX2_CLMUL, allowed);
  210|      1|               }
  211|       |
  212|       |               // Likewise we only consider AVX-512 if AVX2 is supported
  213|      1|               if(has_os_zmm_support) {
  ------------------
  |  Branch (213:19): [True: 0, False: 1]
  ------------------
  214|      0|                  feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_PROFILE, CPUFeature::Bit::AVX512, allowed);
  215|       |
  216|      0|                  if(is_set(feat, CPUFeature::Bit::AVX512)) {
  ------------------
  |  Branch (216:22): [True: 0, False: 0]
  ------------------
  217|      0|                     feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VAES, CPUFeature::Bit::AVX512_AES, allowed);
  218|      0|                     if(is_set(feat, CPUFeature::Bit::CLMUL)) {
  ------------------
  |  Branch (218:25): [True: 0, False: 0]
  ------------------
  219|      0|                        feat |= if_set(flags7, x86_CPUID_7_bits::AVX512_VCLMUL, CPUFeature::Bit::AVX512_CLMUL, allowed);
  220|      0|                     }
  221|      0|                  }
  222|      0|               }
  223|      1|            }
  224|      1|         }
  225|      1|      }
  226|      1|   }
  227|       |
  228|       |/*
  229|       |   * If we don't have access to CPUID, we can still safely assume that
  230|       |   * any x86-64 processor has SSE2 and RDTSC
  231|       |   */
  232|      1|#if defined(BOTAN_TARGET_ARCH_IS_X86_64)
  233|      1|   if(feat == 0) {
  ------------------
  |  Branch (233:7): [True: 0, False: 1]
  ------------------
  234|      0|      feat |= CPUFeature::Bit::SSE2 & allowed;
  235|      0|      feat |= CPUFeature::Bit::RDTSC & allowed;
  236|      0|   }
  237|      1|#endif
  238|       |
  239|      1|   return feat;
  240|      1|}
cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_112invoke_cpuidEjPj:
   24|      2|void invoke_cpuid(uint32_t type, uint32_t out[4]) {
   25|      2|   clear_mem(out, 4);
   26|       |
   27|      2|#if defined(BOTAN_USE_GCC_INLINE_ASM)
   28|       |   // NOLINTNEXTLINE(*-no-assembler)
   29|      2|   asm volatile("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type));
   30|       |
   31|       |#elif defined(BOTAN_BUILD_COMPILER_IS_MSVC)
   32|       |   __cpuid((int*)out, type);
   33|       |
   34|       |#else
   35|       |   BOTAN_UNUSED(type);
   36|       |   #warning "No way of calling x86 cpuid instruction for this compiler"
   37|       |#endif
   38|      2|}
cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_16xgetbvEv:
   56|      1|BOTAN_FUNC_ISA("xsave") uint64_t xgetbv() {
   57|       |   return _xgetbv(0);
   58|      1|}
cpuid_x86.cpp:_ZN5Botan12_GLOBAL__N_121invoke_cpuid_sublevelEjjPj:
   40|      2|void invoke_cpuid_sublevel(uint32_t type, uint32_t level, uint32_t out[4]) {
   41|      2|   clear_mem(out, 4);
   42|       |
   43|      2|#if defined(BOTAN_USE_GCC_INLINE_ASM)
   44|       |   // NOLINTNEXTLINE(*-no-assembler)
   45|      2|   asm volatile("cpuid\n\t" : "=a"(out[0]), "=b"(out[1]), "=c"(out[2]), "=d"(out[3]) : "0"(type), "2"(level));
   46|       |
   47|       |#elif defined(BOTAN_BUILD_COMPILER_IS_MSVC)
   48|       |   __cpuidex((int*)out, type, level);
   49|       |
   50|       |#else
   51|       |   BOTAN_UNUSED(type, level);
   52|       |   #warning "No way of calling x86 cpuid instruction for this compiler"
   53|       |#endif
   54|      2|}

_ZN5Botan19secure_scrub_memoryEPvm:
   24|  11.4k|void secure_scrub_memory(void* ptr, size_t n) {
   25|  11.4k|   return secure_zeroize_buffer(ptr, n);
   26|  11.4k|}
_ZN5Botan21secure_zeroize_bufferEPvm:
   28|  11.4k|void secure_zeroize_buffer(void* ptr, size_t n) {
   29|  11.4k|   if(n == 0) {
  ------------------
  |  Branch (29:7): [True: 0, False: 11.4k]
  ------------------
   30|      0|      return;
   31|      0|   }
   32|       |
   33|       |#if defined(BOTAN_TARGET_OS_HAS_RTLSECUREZEROMEMORY)
   34|       |   ::RtlSecureZeroMemory(ptr, n);
   35|       |
   36|       |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_BZERO)
   37|  11.4k|   ::explicit_bzero(ptr, n);
   38|       |
   39|       |#elif defined(BOTAN_TARGET_OS_HAS_EXPLICIT_MEMSET)
   40|       |   (void)::explicit_memset(ptr, 0, n);
   41|       |
   42|       |#else
   43|       |   /*
   44|       |   * Call memset through a static volatile pointer, which the compiler should
   45|       |   * not elide. This construct should be safe in conforming compilers, but who
   46|       |   * knows. This has been checked to generate the expected code, which saves the
   47|       |   * memset address in the data segment and unconditionally loads and jumps to
   48|       |   * that address, with the following targets:
   49|       |   *
   50|       |   * x86-64: Clang 19, GCC 6, 11, 13, 14
   51|       |   * riscv64: GCC 14
   52|       |   * aarch64: GCC 14
   53|       |   * armv7: GCC 14
   54|       |   *
   55|       |   * Actually all of them generated the expected jump even without marking the
   56|       |   * function pointer as volatile. However this seems worth including as an
   57|       |   * additional precaution.
   58|       |   */
   59|       |   static void* (*const volatile memset_ptr)(void*, int, size_t) = std::memset;
   60|       |   (memset_ptr)(ptr, 0, n);
   61|       |#endif
   62|  11.4k|}

_ZN5Botan2OS17read_env_variableERNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEENS1_17basic_string_viewIcS4_EE:
  471|      1|bool OS::read_env_variable(std::string& value_out, std::string_view name_view) {
  472|      1|   value_out = "";
  473|       |
  474|      1|   if(running_in_privileged_state()) {
  ------------------
  |  Branch (474:7): [True: 0, False: 1]
  ------------------
  475|      0|      return false;
  476|      0|   }
  477|       |
  478|       |#if defined(BOTAN_TARGET_OS_HAS_WIN32) && \
  479|       |   (defined(BOTAN_BUILD_COMPILER_IS_MSVC) || defined(BOTAN_BUILD_COMPILER_IS_CLANGCL))
  480|       |   const std::string name(name_view);
  481|       |
  482|       |   // First query the required buffer size; req_size is 0 if the variable is not set
  483|       |   size_t req_size = 0;
  484|       |   if(getenv_s(&req_size, nullptr, 0, name.c_str()) != 0 || req_size == 0) {
  485|       |      return false;
  486|       |   }
  487|       |
  488|       |   // The reported size includes the terminating \0
  489|       |   std::string val(req_size, '\0');
  490|       |   if(getenv_s(&req_size, val.data(), val.size(), name.c_str()) != 0) {
  491|       |      return false;
  492|       |   }
  493|       |
  494|       |   value_out = std::string(val.c_str());
  495|       |   return true;
  496|       |#else
  497|      1|   const std::string name(name_view);
  498|      1|   if(const char* val = std::getenv(name.c_str())) {
  ------------------
  |  Branch (498:19): [True: 0, False: 1]
  ------------------
  499|      0|      value_out = val;
  500|      0|      return true;
  501|      0|   }
  502|      1|#endif
  503|       |
  504|      1|   return false;
  505|      1|}
os_utils.cpp:_ZN5Botan12_GLOBAL__N_110get_auxvalENSt3__18optionalImEE:
  120|      1|std::optional<unsigned long> get_auxval(std::optional<unsigned long> id) {
  121|      1|   if(id) {
  ------------------
  |  Branch (121:7): [True: 1, False: 0]
  ------------------
  122|      1|#if defined(BOTAN_TARGET_OS_HAS_GETAUXVAL)
  123|      1|      return ::getauxval(*id);
  124|       |#elif defined(BOTAN_TARGET_OS_HAS_ELF_AUX_INFO)
  125|       |      unsigned long auxinfo = 0;
  126|       |      if(::elf_aux_info(static_cast<int>(*id), &auxinfo, sizeof(auxinfo)) == 0) {
  127|       |         return auxinfo;
  128|       |      }
  129|       |#endif
  130|      1|   }
  131|       |
  132|      0|   return {};
  133|      1|}
os_utils.cpp:_ZN5Botan12_GLOBAL__N_127running_in_privileged_stateEv:
  154|      1|bool running_in_privileged_state() {
  155|      1|#if defined(AT_SECURE)
  156|      1|   if(const auto at_secure = get_auxval(AT_SECURE)) {
  ------------------
  |  Branch (156:18): [True: 1, False: 0]
  ------------------
  157|      1|      return at_secure != 0;
  158|      1|   }
  159|      0|#endif
  160|       |
  161|      0|#if defined(BOTAN_TARGET_OS_HAS_POSIX1)
  162|      0|   return (::getuid() != ::geteuid()) || (::getgid() != ::getegid());
  ------------------
  |  Branch (162:11): [True: 0, False: 0]
  |  Branch (162:42): [True: 0, False: 0]
  ------------------
  163|       |#else
  164|       |   return false;
  165|       |#endif
  166|      1|}