1 /**
2 * Constant-time functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 */
7
8 #ifndef MBEDTLS_CONSTANT_TIME_IMPL_H
9 #define MBEDTLS_CONSTANT_TIME_IMPL_H
10
11 #include <stddef.h>
12
13 #include "common.h"
14
15 #if defined(MBEDTLS_BIGNUM_C)
16 #include "mbedtls/bignum.h"
17 #endif
18
19 /*
20 * To improve readability of constant_time_internal.h, the static inline
21 * definitions are here, and constant_time_internal.h has only the declarations.
22 *
23 * This results in duplicate declarations of the form:
24 * static inline void f(); // from constant_time_internal.h
25 * static inline void f() { ... } // from constant_time_impl.h
26 * when constant_time_internal.h is included.
27 *
28 * This appears to behave as if the declaration-without-definition was not present
29 * (except for warnings if gcc -Wredundant-decls or similar is used).
30 *
31 * Disable -Wredundant-decls so that gcc does not warn about this. This is re-enabled
32 * at the bottom of this file.
33 */
34 #ifdef __GNUC__
35 #pragma GCC diagnostic push
36 #pragma GCC diagnostic ignored "-Wredundant-decls"
37 #endif
38
39 /* Disable asm under Memsan because it confuses Memsan and generates false errors.
40 *
41 * We also disable under Valgrind by default, because it's more useful
42 * for Valgrind to test the plain C implementation. MBEDTLS_TEST_CONSTANT_FLOW_ASM //no-check-names
43 * may be set to permit building asm under Valgrind.
44 */
45 #if defined(MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN) || \
46 (defined(MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND) && !defined(MBEDTLS_TEST_CONSTANT_FLOW_ASM)) //no-check-names
47 #define MBEDTLS_CT_NO_ASM
48 #elif defined(__has_feature)
49 #if __has_feature(memory_sanitizer)
50 #define MBEDTLS_CT_NO_ASM
51 #endif
52 #endif
53
54 /* armcc5 --gnu defines __GNUC__ but doesn't support GNU's extended asm */
55 #if defined(MBEDTLS_HAVE_ASM) && defined(__GNUC__) && (!defined(__ARMCC_VERSION) || \
56 __ARMCC_VERSION >= 6000000) && !defined(MBEDTLS_CT_NO_ASM)
57 #define MBEDTLS_CT_ASM
58 #if (defined(__arm__) || defined(__thumb__) || defined(__thumb2__))
59 #define MBEDTLS_CT_ARM_ASM
60 #elif defined(__aarch64__)
61 #define MBEDTLS_CT_AARCH64_ASM
62 #elif defined(__amd64__) || defined(__x86_64__)
63 #define MBEDTLS_CT_X86_64_ASM
64 #elif defined(__i386__)
65 #define MBEDTLS_CT_X86_ASM
66 #endif
67 #endif
68
69 #define MBEDTLS_CT_SIZE (sizeof(mbedtls_ct_uint_t) * 8)
70
71
72 /* ============================================================================
73 * Core const-time primitives
74 */
75
76 /* Ensure that the compiler cannot know the value of x (i.e., cannot optimise
77 * based on its value) after this function is called.
78 *
79 * If we are not using assembly, this will be fairly inefficient, so its use
80 * should be minimised.
81 */
82
83 #if !defined(MBEDTLS_CT_ASM)
84 extern volatile mbedtls_ct_uint_t mbedtls_ct_zero;
85 #endif
86
87 /**
88 * \brief Ensure that a value cannot be known at compile time.
89 *
90 * \param x The value to hide from the compiler.
91 * \return The same value that was passed in, such that the compiler
92 * cannot prove its value (even for calls of the form
93 * x = mbedtls_ct_compiler_opaque(1), x will be unknown).
94 *
95 * \note This is mainly used in constructing mbedtls_ct_condition_t
96 * values and performing operations over them, to ensure that
97 * there is no way for the compiler to ever know anything about
98 * the value of an mbedtls_ct_condition_t.
99 */
mbedtls_ct_compiler_opaque(mbedtls_ct_uint_t x)100 static inline mbedtls_ct_uint_t mbedtls_ct_compiler_opaque(mbedtls_ct_uint_t x)
101 {
102 #if defined(MBEDTLS_CT_ASM)
103 asm volatile ("" : [x] "+r" (x) :);
104 return x;
105 #else
106 return x ^ mbedtls_ct_zero;
107 #endif
108 }
109
110 /*
111 * Selecting unified syntax is needed for gcc, and harmless on clang.
112 *
113 * This is needed because on Thumb 1, condition flags are always set, so
114 * e.g. "negs" is supported but "neg" is not (on Thumb 2, both exist).
115 *
116 * Under Thumb 1 unified syntax, only the "negs" form is accepted, and
117 * under divided syntax, only the "neg" form is accepted. clang only
118 * supports unified syntax.
119 *
120 * On Thumb 2 and Arm, both compilers are happy with the "s" suffix,
121 * although we don't actually care about setting the flags.
122 *
123 * For gcc, restore divided syntax afterwards - otherwise old versions of gcc
124 * seem to apply unified syntax globally, which breaks other asm code.
125 */
126 #if !defined(__clang__)
127 #define RESTORE_ASM_SYNTAX ".syntax divided \n\t"
128 #else
129 #define RESTORE_ASM_SYNTAX
130 #endif
131
132 /* Convert a number into a condition in constant time. */
mbedtls_ct_bool(mbedtls_ct_uint_t x)133 static inline mbedtls_ct_condition_t mbedtls_ct_bool(mbedtls_ct_uint_t x)
134 {
135 /*
136 * Define mask-generation code that, as far as possible, will not use branches or conditional instructions.
137 *
138 * For some platforms / type sizes, we define assembly to assure this.
139 *
140 * Otherwise, we define a plain C fallback which (in May 2023) does not get optimised into
141 * conditional instructions or branches by trunk clang, gcc, or MSVC v19.
142 */
143 #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
144 mbedtls_ct_uint_t s;
145 asm volatile ("neg %x[s], %x[x] \n\t"
146 "orr %x[x], %x[s], %x[x] \n\t"
147 "asr %x[x], %x[x], 63 \n\t"
148 :
149 [s] "=&r" (s),
150 [x] "+&r" (x)
151 :
152 :
153 );
154 return (mbedtls_ct_condition_t) x;
155 #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
156 uint32_t s;
157 asm volatile (".syntax unified \n\t"
158 "negs %[s], %[x] \n\t"
159 "orrs %[x], %[x], %[s] \n\t"
160 "asrs %[x], %[x], #31 \n\t"
161 RESTORE_ASM_SYNTAX
162 :
163 [s] "=&l" (s),
164 [x] "+&l" (x)
165 :
166 :
167 "cc" /* clobbers flag bits */
168 );
169 return (mbedtls_ct_condition_t) x;
170 #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
171 uint64_t s;
172 asm volatile ("mov %[x], %[s] \n\t"
173 "neg %[s] \n\t"
174 "or %[x], %[s] \n\t"
175 "sar $63, %[s] \n\t"
176 :
177 [s] "=&a" (s)
178 :
179 [x] "D" (x)
180 :
181 );
182 return (mbedtls_ct_condition_t) s;
183 #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
184 uint32_t s;
185 asm volatile ("mov %[x], %[s] \n\t"
186 "neg %[s] \n\t"
187 "or %[s], %[x] \n\t"
188 "sar $31, %[x] \n\t"
189 :
190 [s] "=&c" (s),
191 [x] "+&a" (x)
192 :
193 :
194 );
195 return (mbedtls_ct_condition_t) x;
196 #else
197 const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x);
198 #if defined(_MSC_VER)
199 /* MSVC has a warning about unary minus on unsigned, but this is
200 * well-defined and precisely what we want to do here */
201 #pragma warning( push )
202 #pragma warning( disable : 4146 )
203 #endif
204 // y is negative (i.e., top bit set) iff x is non-zero
205 mbedtls_ct_int_t y = (-xo) | -(xo >> 1);
206
207 // extract only the sign bit of y so that y == 1 (if x is non-zero) or 0 (if x is zero)
208 y = (((mbedtls_ct_uint_t) y) >> (MBEDTLS_CT_SIZE - 1));
209
210 // -y has all bits set (if x is non-zero), or all bits clear (if x is zero)
211 return (mbedtls_ct_condition_t) (-y);
212 #if defined(_MSC_VER)
213 #pragma warning( pop )
214 #endif
215 #endif
216 }
217
mbedtls_ct_if(mbedtls_ct_condition_t condition,mbedtls_ct_uint_t if1,mbedtls_ct_uint_t if0)218 static inline mbedtls_ct_uint_t mbedtls_ct_if(mbedtls_ct_condition_t condition,
219 mbedtls_ct_uint_t if1,
220 mbedtls_ct_uint_t if0)
221 {
222 #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
223 asm volatile ("and %x[if1], %x[if1], %x[condition] \n\t"
224 "mvn %x[condition], %x[condition] \n\t"
225 "and %x[condition], %x[condition], %x[if0] \n\t"
226 "orr %x[condition], %x[if1], %x[condition]"
227 :
228 [condition] "+&r" (condition),
229 [if1] "+&r" (if1)
230 :
231 [if0] "r" (if0)
232 :
233 );
234 return (mbedtls_ct_uint_t) condition;
235 #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
236 asm volatile (".syntax unified \n\t"
237 "ands %[if1], %[if1], %[condition] \n\t"
238 "mvns %[condition], %[condition] \n\t"
239 "ands %[condition], %[condition], %[if0] \n\t"
240 "orrs %[condition], %[if1], %[condition] \n\t"
241 RESTORE_ASM_SYNTAX
242 :
243 [condition] "+&l" (condition),
244 [if1] "+&l" (if1)
245 :
246 [if0] "l" (if0)
247 :
248 "cc"
249 );
250 return (mbedtls_ct_uint_t) condition;
251 #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
252 asm volatile ("and %[condition], %[if1] \n\t"
253 "not %[condition] \n\t"
254 "and %[condition], %[if0] \n\t"
255 "or %[if1], %[if0] \n\t"
256 :
257 [condition] "+&D" (condition),
258 [if1] "+&S" (if1),
259 [if0] "+&a" (if0)
260 :
261 :
262 );
263 return if0;
264 #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
265 asm volatile ("and %[condition], %[if1] \n\t"
266 "not %[condition] \n\t"
267 "and %[if0], %[condition] \n\t"
268 "or %[condition], %[if1] \n\t"
269 :
270 [condition] "+&c" (condition),
271 [if1] "+&a" (if1)
272 :
273 [if0] "b" (if0)
274 :
275 );
276 return if1;
277 #else
278 mbedtls_ct_condition_t not_cond =
279 (mbedtls_ct_condition_t) (~mbedtls_ct_compiler_opaque(condition));
280 return (mbedtls_ct_uint_t) ((condition & if1) | (not_cond & if0));
281 #endif
282 }
283
mbedtls_ct_uint_lt(mbedtls_ct_uint_t x,mbedtls_ct_uint_t y)284 static inline mbedtls_ct_condition_t mbedtls_ct_uint_lt(mbedtls_ct_uint_t x, mbedtls_ct_uint_t y)
285 {
286 #if defined(MBEDTLS_CT_AARCH64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
287 uint64_t s1;
288 asm volatile ("eor %x[s1], %x[y], %x[x] \n\t"
289 "sub %x[x], %x[x], %x[y] \n\t"
290 "bic %x[x], %x[x], %x[s1] \n\t"
291 "and %x[s1], %x[s1], %x[y] \n\t"
292 "orr %x[s1], %x[x], %x[s1] \n\t"
293 "asr %x[x], %x[s1], 63"
294 :
295 [s1] "=&r" (s1),
296 [x] "+&r" (x)
297 :
298 [y] "r" (y)
299 :
300 );
301 return (mbedtls_ct_condition_t) x;
302 #elif defined(MBEDTLS_CT_ARM_ASM) && defined(MBEDTLS_CT_SIZE_32)
303 uint32_t s1;
304 asm volatile (
305 ".syntax unified \n\t"
306 #if defined(__thumb__) && !defined(__thumb2__)
307 "movs %[s1], %[x] \n\t"
308 "eors %[s1], %[s1], %[y] \n\t"
309 #else
310 "eors %[s1], %[x], %[y] \n\t"
311 #endif
312 "subs %[x], %[x], %[y] \n\t"
313 "bics %[x], %[x], %[s1] \n\t"
314 "ands %[y], %[s1], %[y] \n\t"
315 "orrs %[x], %[x], %[y] \n\t"
316 "asrs %[x], %[x], #31 \n\t"
317 RESTORE_ASM_SYNTAX
318 :
319 [s1] "=&l" (s1),
320 [x] "+&l" (x),
321 [y] "+&l" (y)
322 :
323 :
324 "cc"
325 );
326 return (mbedtls_ct_condition_t) x;
327 #elif defined(MBEDTLS_CT_X86_64_ASM) && (defined(MBEDTLS_CT_SIZE_32) || defined(MBEDTLS_CT_SIZE_64))
328 uint64_t s;
329 asm volatile ("mov %[x], %[s] \n\t"
330 "xor %[y], %[s] \n\t"
331 "sub %[y], %[x] \n\t"
332 "and %[s], %[y] \n\t"
333 "not %[s] \n\t"
334 "and %[s], %[x] \n\t"
335 "or %[y], %[x] \n\t"
336 "sar $63, %[x] \n\t"
337 :
338 [s] "=&a" (s),
339 [x] "+&D" (x),
340 [y] "+&S" (y)
341 :
342 :
343 );
344 return (mbedtls_ct_condition_t) x;
345 #elif defined(MBEDTLS_CT_X86_ASM) && defined(MBEDTLS_CT_SIZE_32)
346 uint32_t s;
347 asm volatile ("mov %[x], %[s] \n\t"
348 "xor %[y], %[s] \n\t"
349 "sub %[y], %[x] \n\t"
350 "and %[s], %[y] \n\t"
351 "not %[s] \n\t"
352 "and %[s], %[x] \n\t"
353 "or %[y], %[x] \n\t"
354 "sar $31, %[x] \n\t"
355 :
356 [s] "=&b" (s),
357 [x] "+&a" (x),
358 [y] "+&c" (y)
359 :
360 :
361 );
362 return (mbedtls_ct_condition_t) x;
363 #else
364 /* Ensure that the compiler cannot optimise the following operations over x and y,
365 * even if it knows the value of x and y.
366 */
367 const mbedtls_ct_uint_t xo = mbedtls_ct_compiler_opaque(x);
368 const mbedtls_ct_uint_t yo = mbedtls_ct_compiler_opaque(y);
369 /*
370 * Check if the most significant bits (MSB) of the operands are different.
371 * cond is true iff the MSBs differ.
372 */
373 mbedtls_ct_condition_t cond = mbedtls_ct_bool((xo ^ yo) >> (MBEDTLS_CT_SIZE - 1));
374
375 /*
376 * If the MSB are the same then the difference x-y will be negative (and
377 * have its MSB set to 1 during conversion to unsigned) if and only if x<y.
378 *
379 * If the MSB are different, then the operand with the MSB of 1 is the
380 * bigger. (That is if y has MSB of 1, then x<y is true and it is false if
381 * the MSB of y is 0.)
382 */
383
384 // Select either y, or x - y
385 mbedtls_ct_uint_t ret = mbedtls_ct_if(cond, yo, (mbedtls_ct_uint_t) (xo - yo));
386
387 // Extract only the MSB of ret
388 ret = ret >> (MBEDTLS_CT_SIZE - 1);
389
390 // Convert to a condition (i.e., all bits set iff non-zero)
391 return mbedtls_ct_bool(ret);
392 #endif
393 }
394
mbedtls_ct_uint_ne(mbedtls_ct_uint_t x,mbedtls_ct_uint_t y)395 static inline mbedtls_ct_condition_t mbedtls_ct_uint_ne(mbedtls_ct_uint_t x, mbedtls_ct_uint_t y)
396 {
397 /* diff = 0 if x == y, non-zero otherwise */
398 const mbedtls_ct_uint_t diff = mbedtls_ct_compiler_opaque(x) ^ mbedtls_ct_compiler_opaque(y);
399
400 /* all ones if x != y, 0 otherwise */
401 return mbedtls_ct_bool(diff);
402 }
403
mbedtls_ct_uchar_in_range_if(unsigned char low,unsigned char high,unsigned char c,unsigned char t)404 static inline unsigned char mbedtls_ct_uchar_in_range_if(unsigned char low,
405 unsigned char high,
406 unsigned char c,
407 unsigned char t)
408 {
409 const unsigned char co = (unsigned char) mbedtls_ct_compiler_opaque(c);
410 const unsigned char to = (unsigned char) mbedtls_ct_compiler_opaque(t);
411
412 /* low_mask is: 0 if low <= c, 0x...ff if low > c */
413 unsigned low_mask = ((unsigned) co - low) >> 8;
414 /* high_mask is: 0 if c <= high, 0x...ff if c > high */
415 unsigned high_mask = ((unsigned) high - co) >> 8;
416
417 return (unsigned char) (~(low_mask | high_mask)) & to;
418 }
419
420 /* ============================================================================
421 * Everything below here is trivial wrapper functions
422 */
423
mbedtls_ct_size_if(mbedtls_ct_condition_t condition,size_t if1,size_t if0)424 static inline size_t mbedtls_ct_size_if(mbedtls_ct_condition_t condition,
425 size_t if1,
426 size_t if0)
427 {
428 return (size_t) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1, (mbedtls_ct_uint_t) if0);
429 }
430
mbedtls_ct_uint_if(mbedtls_ct_condition_t condition,unsigned if1,unsigned if0)431 static inline unsigned mbedtls_ct_uint_if(mbedtls_ct_condition_t condition,
432 unsigned if1,
433 unsigned if0)
434 {
435 return (unsigned) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1, (mbedtls_ct_uint_t) if0);
436 }
437
mbedtls_ct_bool_if(mbedtls_ct_condition_t condition,mbedtls_ct_condition_t if1,mbedtls_ct_condition_t if0)438 static inline mbedtls_ct_condition_t mbedtls_ct_bool_if(mbedtls_ct_condition_t condition,
439 mbedtls_ct_condition_t if1,
440 mbedtls_ct_condition_t if0)
441 {
442 return (mbedtls_ct_condition_t) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) if1,
443 (mbedtls_ct_uint_t) if0);
444 }
445
446 #if defined(MBEDTLS_BIGNUM_C)
447
mbedtls_ct_mpi_uint_if(mbedtls_ct_condition_t condition,mbedtls_mpi_uint if1,mbedtls_mpi_uint if0)448 static inline mbedtls_mpi_uint mbedtls_ct_mpi_uint_if(mbedtls_ct_condition_t condition,
449 mbedtls_mpi_uint if1,
450 mbedtls_mpi_uint if0)
451 {
452 return (mbedtls_mpi_uint) mbedtls_ct_if(condition,
453 (mbedtls_ct_uint_t) if1,
454 (mbedtls_ct_uint_t) if0);
455 }
456
457 #endif
458
mbedtls_ct_size_if_else_0(mbedtls_ct_condition_t condition,size_t if1)459 static inline size_t mbedtls_ct_size_if_else_0(mbedtls_ct_condition_t condition, size_t if1)
460 {
461 return (size_t) (condition & if1);
462 }
463
mbedtls_ct_uint_if_else_0(mbedtls_ct_condition_t condition,unsigned if1)464 static inline unsigned mbedtls_ct_uint_if_else_0(mbedtls_ct_condition_t condition, unsigned if1)
465 {
466 return (unsigned) (condition & if1);
467 }
468
mbedtls_ct_bool_if_else_0(mbedtls_ct_condition_t condition,mbedtls_ct_condition_t if1)469 static inline mbedtls_ct_condition_t mbedtls_ct_bool_if_else_0(mbedtls_ct_condition_t condition,
470 mbedtls_ct_condition_t if1)
471 {
472 return (mbedtls_ct_condition_t) (condition & if1);
473 }
474
475 #if defined(MBEDTLS_BIGNUM_C)
476
mbedtls_ct_mpi_uint_if_else_0(mbedtls_ct_condition_t condition,mbedtls_mpi_uint if1)477 static inline mbedtls_mpi_uint mbedtls_ct_mpi_uint_if_else_0(mbedtls_ct_condition_t condition,
478 mbedtls_mpi_uint if1)
479 {
480 return (mbedtls_mpi_uint) (condition & if1);
481 }
482
483 #endif /* MBEDTLS_BIGNUM_C */
484
mbedtls_ct_error_if(mbedtls_ct_condition_t condition,int if1,int if0)485 static inline int mbedtls_ct_error_if(mbedtls_ct_condition_t condition, int if1, int if0)
486 {
487 /* Coverting int -> uint -> int here is safe, because we require if1 and if0 to be
488 * in the range -32767..0, and we require 32-bit int and uint types.
489 *
490 * This means that (0 <= -if0 < INT_MAX), so negating if0 is safe, and similarly for
491 * converting back to int.
492 */
493 return -((int) mbedtls_ct_if(condition, (mbedtls_ct_uint_t) (-if1),
494 (mbedtls_ct_uint_t) (-if0)));
495 }
496
mbedtls_ct_error_if_else_0(mbedtls_ct_condition_t condition,int if1)497 static inline int mbedtls_ct_error_if_else_0(mbedtls_ct_condition_t condition, int if1)
498 {
499 return -((int) (condition & (-if1)));
500 }
501
mbedtls_ct_uint_eq(mbedtls_ct_uint_t x,mbedtls_ct_uint_t y)502 static inline mbedtls_ct_condition_t mbedtls_ct_uint_eq(mbedtls_ct_uint_t x,
503 mbedtls_ct_uint_t y)
504 {
505 return ~mbedtls_ct_uint_ne(x, y);
506 }
507
mbedtls_ct_uint_gt(mbedtls_ct_uint_t x,mbedtls_ct_uint_t y)508 static inline mbedtls_ct_condition_t mbedtls_ct_uint_gt(mbedtls_ct_uint_t x,
509 mbedtls_ct_uint_t y)
510 {
511 return mbedtls_ct_uint_lt(y, x);
512 }
513
mbedtls_ct_uint_ge(mbedtls_ct_uint_t x,mbedtls_ct_uint_t y)514 static inline mbedtls_ct_condition_t mbedtls_ct_uint_ge(mbedtls_ct_uint_t x,
515 mbedtls_ct_uint_t y)
516 {
517 return ~mbedtls_ct_uint_lt(x, y);
518 }
519
mbedtls_ct_uint_le(mbedtls_ct_uint_t x,mbedtls_ct_uint_t y)520 static inline mbedtls_ct_condition_t mbedtls_ct_uint_le(mbedtls_ct_uint_t x,
521 mbedtls_ct_uint_t y)
522 {
523 return ~mbedtls_ct_uint_gt(x, y);
524 }
525
mbedtls_ct_bool_ne(mbedtls_ct_condition_t x,mbedtls_ct_condition_t y)526 static inline mbedtls_ct_condition_t mbedtls_ct_bool_ne(mbedtls_ct_condition_t x,
527 mbedtls_ct_condition_t y)
528 {
529 return (mbedtls_ct_condition_t) (x ^ y);
530 }
531
mbedtls_ct_bool_and(mbedtls_ct_condition_t x,mbedtls_ct_condition_t y)532 static inline mbedtls_ct_condition_t mbedtls_ct_bool_and(mbedtls_ct_condition_t x,
533 mbedtls_ct_condition_t y)
534 {
535 return (mbedtls_ct_condition_t) (x & y);
536 }
537
mbedtls_ct_bool_or(mbedtls_ct_condition_t x,mbedtls_ct_condition_t y)538 static inline mbedtls_ct_condition_t mbedtls_ct_bool_or(mbedtls_ct_condition_t x,
539 mbedtls_ct_condition_t y)
540 {
541 return (mbedtls_ct_condition_t) (x | y);
542 }
543
mbedtls_ct_bool_not(mbedtls_ct_condition_t x)544 static inline mbedtls_ct_condition_t mbedtls_ct_bool_not(mbedtls_ct_condition_t x)
545 {
546 return (mbedtls_ct_condition_t) (~x);
547 }
548
549 #ifdef __GNUC__
550 /* Restore warnings for -Wredundant-decls on gcc */
551 #pragma GCC diagnostic pop
552 #endif
553
554 #endif /* MBEDTLS_CONSTANT_TIME_IMPL_H */
555
