[yosuke-wolfssl]

Problem

The clang copy of SP_ASM_SQR_ADD_NO in the WOLFSSL_SP_ARM_THUMB block loads both 16-bit halves of va into r6, so the high half is overwritten before it is used.

Affected builds: sp_int with WOLFSSL_SP_ARM_THUMB and 32-bit digits, compiled by clang or Arm Compiler 6 (Cortex-M0/M0+ class).

Fix (wolfcrypt/src/sp_int.c)

The high half now goes in r5, which is already in the clobber list, and the low half in r6.

Closes f-18178.

Verification

ARMv6 Thumb-1 under qemu-arm 8.2.2, --with-arm-target=thumb, comparing mp_sqr() with mp_mul(a, a) and running testwolfcrypt:

Build	256/384-bit mp_sqr	testwolfcrypt
clang 18.1.3, before	mismatch	hangs in dh_test()
clang 18.1.3, after	match	pass (mp, DH, ECC)
GCC 13.3, after	match	pass

The clang runs also needed some local workarounds for issues already on master, none of them in this PR.
They are tracked separately.

No test is added. No CI job builds clang Thumb, it's also taken as follow-up.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[yosuke-wolfssl]

@claude review

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +28 B, text +11,728 B (+4.2%, 294,228 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12123

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max

[yosuke-wolfssl]

@claude review

[claude]

I reviewed this and didn't find any bugs. The fix looks correct, but it changes bignum squaring asm in wolfCrypt, so a maintainer should still take a look.

What was reviewed:

• The arithmetic now works out. al^2 goes into l, and ah^2 goes into h with the carry from l. The cross term 2alah2^16 is split into (alah << 17) for l and (alah >> 15) for h, which is right because alah fits in 32 bits.
• The rewritten clang Thumb macro has the same instructions and register use as the other two Thumb copies of SP_ASM_SQR_ADD_NO in sp_int.c (around lines 2462 and 2945). Only the syntax differs.
• r5 and r6 are both clobbered, so the compiler cannot put the "l" operands va, vl or vh in either register.
• I only read the code. I did not build or run anything.

Extended reasoning...

The change touches 7 lines in one wolfCrypt inline-asm macro, the clang ARM Thumb SP_ASM_SQR_ADD_NO in wolfcrypt/src/sp_int.c. That macro is used for multi-precision squaring in RSA, DH and ECC. The old code loaded both 16-bit halves into r6, so the squares came out wrong. The new code matches the existing GCC and older-syntax Thumb versions of the macro exactly. I deferred rather than approved because this is crypto math that no CI job builds, and the review threads from other reviewers are not visible here.