From: Bernd Edlinger <bernd.edlinger@hotmail.de>
Date: Fri, 21 Jun 2019 19:26:19 +0000 (+0200)
Subject: Add value_barriers in constant time select functions
X-Git-Tag: OpenSSL_1_1_0l~21
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=92a2f01ea40ec52f8f77893ff433dc47c1f5b9ef;p=oweals%2Fopenssl.git

Add value_barriers in constant time select functions

The barriers prevent the compiler from narrowing down the
possible value range of the mask and ~mask in the select
statements, which avoids the recognition of the select
and turning it into a conditional load or branch.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9418)
---

diff --git a/include/internal/constant_time_locl.h b/include/internal/constant_time_locl.h
index 18d2f56825..b702675db8 100644
--- a/include/internal/constant_time_locl.h
+++ b/include/internal/constant_time_locl.h
@@ -158,11 +158,29 @@ static ossl_inline unsigned char constant_time_eq_int_8(int a, int b)
     return constant_time_eq_8((unsigned)(a), (unsigned)(b));
 }
 
+/*
+ * Returns the value unmodified, but avoids optimizations.
+ * The barriers prevent the compiler from narrowing down the
+ * possible value range of the mask and ~mask in the select
+ * statements, which avoids the recognition of the select
+ * and turning it into a conditional load or branch.
+ */
+static ossl_inline unsigned int value_barrier(unsigned int a)
+{
+#if !defined(OPENSSL_NO_ASM) && defined(__GNUC__)
+    unsigned int r;
+    __asm__("" : "=r"(r) : "0"(a));
+#else
+    volatile unsigned int r = a;
+#endif
+    return r;
+}
+
 static ossl_inline unsigned int constant_time_select(unsigned int mask,
                                                      unsigned int a,
                                                      unsigned int b)
 {
-    return (mask & a) | (~mask & b);
+    return (value_barrier(mask) & a) | (value_barrier(~mask) & b);
 }
 
 static ossl_inline unsigned char constant_time_select_8(unsigned char mask,