Commit ebc1c263b44d084052ec1d7610f25632a19baee3 | zig

author	Frank Denis <124872+jedisct1@users.noreply.github.com> 2026-09-07 21:03:22+02:00
committer	Frank Denis <124872+jedisct1@users.noreply.github.com> 2026-10-04 16:56:00+02:00
log	ebc1c263b44d084052ec1d7610f25632a19baee3
tree	c97f0ef5805c67b2c038628bafa44c37e1846b37
parent	e38b151e614eecf572f791b5712d2e6edd33dd84

Hide the selection mask so LLVM can't replace it with a branch
around the calling loop.

Fixes #37023

1 files changed, 9 insertions(+), 1 deletions(-)

lib/std/crypto/ff.zig+9-1

 @@ -1083,12 +1083,20 @@ pub fn Modulus(comptime max_bits: comptime_int) type {
     };
 }
+fn valueBarrier(x: Limb) Limb {
+    if (@inComptime() or builtin.zig_backend == .stage2_c) return x;
+    return asm (""
+        : [ret] "=r" (-> Limb),
+        : [x] "0" (x),
+    );
+}
 const ct = if (std.options.side_channels_mitigations == .none) ct_unprotected else ct_protected;
 const ct_protected = struct {
     // Returns x if on is true, otherwise y.
     fn select(on: bool, x: Limb, y: Limb) Limb {
-        const mask = @as(Limb, 0) -% @intFromBool(on);
+        const mask = valueBarrier(@as(Limb, 0) -% @intFromBool(on));
         return y ^ (mask & (y ^ x));
     }