krypteia-silentops 0.1.0

//! ARMv7-M Thumb2 constant-time primitives (Cortex-M3/M4/M7/M33).
//!
//! Uses IT (If-Then) blocks for branchless conditional execution.
//! IT blocks execute both paths (true and false) with conditional
//! predication — no branch prediction, constant instruction count.
//!
//! Targets: STM32F1-F7, STM32H7, STM32L1-L5.

use core::arch::asm;

/// Constant-time select using IT block.
///
/// ```asm
///   cmp  condition, #0
///   ite  ne           @ If-Then-Else
///   movne result, a   @ execute if condition != 0
///   moveq result, b   @ execute if condition == 0
/// ```
/// Both MOVs are always fetched and decoded. Only one writes.
#[inline(always)]
pub fn ct_select_u8(a: u8, b: u8, condition: u8) -> u8 {
    let result: u32;
    unsafe {
        asm!(
            "cmp {cond}, #0",
            "ite ne",
            "movne {out}, {a}",
            "moveq {out}, {b}",
            a = in(reg) a as u32,
            b = in(reg) b as u32,
            cond = in(reg) condition as u32,
            out = out(reg) result,
            options(pure, nomem, nostack),
        );
    }
    result as u8
}

#[inline(always)]
pub fn ct_select_i16(a: i16, b: i16, condition: u8) -> i16 {
    let result: u32;
    unsafe {
        asm!(
            "cmp {cond}, #0",
            "ite ne",
            "movne {out}, {a}",
            "moveq {out}, {b}",
            a = in(reg) a as u32,
            b = in(reg) b as u32,
            cond = in(reg) condition as u32,
            out = out(reg) result,
            options(pure, nomem, nostack),
        );
    }
    result as i16
}

#[inline(always)]
pub fn ct_select_i32(a: i32, b: i32, condition: u8) -> i32 {
    let result: u32;
    unsafe {
        asm!(
            "cmp {cond}, #0",
            "ite ne",
            "movne {out}, {a}",
            "moveq {out}, {b}",
            a = in(reg) a as u32,
            b = in(reg) b as u32,
            cond = in(reg) condition as u32,
            out = out(reg) result,
            options(pure, nomem, nostack),
        );
    }
    result as i32
}

/// Constant-time equality of two `u32`s: returns 1 if `a == b`, 0 otherwise.
#[inline(always)]
pub fn ct_eq_u32(a: u32, b: u32) -> u8 {
    let diff = a ^ b;
    let mask = (diff | diff.wrapping_neg()) >> 31;
    ((mask as u8) ^ 1) & 1
}

#[inline(never)]
pub fn ct_eq(a: &[u8], b: &[u8]) -> u8 {
    if a.len() != b.len() {
        return 0;
    }
    let mut diff = 0u32;
    for i in 0..a.len() {
        diff |= (a[i] ^ b[i]) as u32;
    }
    let result: u32;
    unsafe {
        asm!(
            "cmp {diff}, #0",
            "ite eq",
            "moveq {out}, #1",
            "movne {out}, #0",
            diff = in(reg) diff,
            out = out(reg) result,
            options(pure, nomem, nostack),
        );
    }
    result as u8
}

#[inline(never)]
pub fn ct_copy(dst: &mut [u8], src: &[u8], condition: u8) {
    let len = dst.len().min(src.len());
    for i in 0..len {
        dst[i] = ct_select_u8(src[i], dst[i], condition);
    }
}

/// Constant-time slice select: writes `a` to `out` if `condition != 0`,
/// else writes `b`. Both `a` and `b` are read in full byte-by-byte; no
/// secret-dependent control flow or memory access. Length used is
/// `out.len().min(a.len()).min(b.len())`.
#[inline(never)]
pub fn ct_select_bytes(out: &mut [u8], a: &[u8], b: &[u8], condition: u8) {
    let len = out.len().min(a.len()).min(b.len());
    for i in 0..len {
        out[i] = ct_select_u8(a[i], b[i], condition);
    }
}

#[inline(never)]
pub fn ct_zeroize(buf: &mut [u8]) {
    for byte in buf.iter_mut() {
        unsafe { core::ptr::write_volatile(byte, 0) };
    }
    core::sync::atomic::compiler_fence(core::sync::atomic::Ordering::SeqCst);
}

#[inline(never)]
pub fn ct_zeroize_i16(buf: &mut [i16]) {
    for val in buf.iter_mut() {
        unsafe { core::ptr::write_volatile(val, 0) };
    }
    core::sync::atomic::compiler_fence(core::sync::atomic::Ordering::SeqCst);
}