Part 2: Improving crypto code in Rust using LLVM’s optnone

Summary: Trail of Bits describes implementing an #[optimize(never)] attribute in rustc that emits LLVM's optnone and noinline attributes, preventing the optimizer from touching a function such as a branch-free conditional_select. The post shows this works at opt-level=3, but notes that instruction selection can still lower an IR select to a conditional branch on some architectures, and that the X86CmovConverterPass converts cmov into conditional branches in certain circumstances.
Why it matters: Even with the optimizer held back, the back end can turn a constant-time cmov into a conditional branch, and AMD's integer divider has data-dependent throughput of one divide per 8 cycles, so constant-time claims for Rust crypto rest on code generation the author does not control.

Read the original at Trail of Bits Blog ↗