grpc 1.81.1 → 1.85.0

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bn/div.cc.inc

@@ -33,9 +33,12 @@
 #endif
 
 
-// bn_div_words divides a double-width |h|,|l| by |d| and returns the result,
-// which must fit in a |BN_ULONG|, i.e. |h < d|.
-static inline BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d) {
+using namespace bssl;
+
+// bn_div_words divides a double-width `h`,`l` by `d` and returns the result,
+// which must fit in a `BN_ULONG`, i.e. `h < d`.
+[[maybe_unused]]
+static BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d) {
   assert(h < d);
   BN_ULONG dh, dl, q, ret = 0, th, tl, t;
   int i, count = 2;
@@ -105,18 +108,18 @@ static inline BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d) {
   return ret;
 }
 
-// bn_div_rem_words divides a double-width numerator (high half |nh| and low
-// half |nl|) with a single-width divisor. It sets |*quotient_out| and
-// |*rem_out| to be the quotient and numerator, respectively. The quotient must
-// fit in a |BN_ULONG|, i.e. |nh < d|.
-static inline void bn_div_rem_words(BN_ULONG *quotient_out, BN_ULONG *rem_out,
-                                    BN_ULONG nh, BN_ULONG nl, BN_ULONG d) {
+// bn_div_rem_words divides a double-width numerator (high half `nh` and low
+// half `nl`) with a single-width divisor. It sets `*quotient_out` and
+// `*rem_out` to be the quotient and numerator, respectively. The quotient must
+// fit in a `BN_ULONG`, i.e. `nh < d`.
+static void bn_div_rem_words(BN_ULONG *quotient_out, BN_ULONG *rem_out,
+                             BN_ULONG nh, BN_ULONG nl, BN_ULONG d) {
   assert(nh < d);
   // This operation is the x86 and x86_64 DIV instruction, but it is difficult
-  // for the compiler to emit it. Dividing a |BN_ULLONG| by a |BN_ULONG| does
-  // not work because, a priori, the quotient may not fit in |BN_ULONG| and DIV
+  // for the compiler to emit it. Dividing a `BN_ULLONG` by a `BN_ULONG` does
+  // not work because, a priori, the quotient may not fit in `BN_ULONG` and DIV
   // will trap on overflow, not truncate. The compiler will instead emit a call
-  // to a more expensive support function (e.g. |__udivdi3|). Thus we use inline
+  // to a more expensive support function (e.g. `__udivdi3`). Thus we use inline
   // assembly or intrinsics to get the instruction.
   //
   // These is specific to x86 and x86_64; Arm and RISC-V do not have double-wide
@@ -166,14 +169,14 @@ int BN_div(BIGNUM *quotient, BIGNUM *rem, const BIGNUM *numerator,
     return 0;
   }
 
-  bssl::BN_CTXScope scope(ctx);
+  BN_CTXScope scope(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
   BIGNUM *snum = BN_CTX_get(ctx);
   BIGNUM *sdiv = BN_CTX_get(ctx);
-  BIGNUM *res = quotient == NULL ? BN_CTX_get(ctx) : quotient;
+  BIGNUM *res = quotient == nullptr ? BN_CTX_get(ctx) : quotient;
   int norm_shift, num_n, loop, div_n;
   BN_ULONG d0, d1;
-  if (tmp == NULL || snum == NULL || sdiv == NULL || res == NULL) {
+  if (tmp == nullptr || snum == nullptr || sdiv == nullptr || res == nullptr) {
     return 0;
   }
 
@@ -186,8 +189,8 @@ int BN_div(BIGNUM *quotient, BIGNUM *rem, const BIGNUM *numerator,
     return 0;
   }
 
-  // This algorithm relies on |sdiv| being minimal width. We do not use this
-  // function on secret inputs, so leaking this is fine. Also minimize |snum| to
+  // This algorithm relies on `sdiv` being minimal width. We do not use this
+  // function on secret inputs, so leaking this is fine. Also minimize `snum` to
   // avoid looping on leading zeros, as we're not trying to be leak-free.
   bn_set_minimal_width(sdiv);
   bn_set_minimal_width(snum);
@@ -196,10 +199,10 @@ int BN_div(BIGNUM *quotient, BIGNUM *rem, const BIGNUM *numerator,
   d1 = (div_n == 1) ? 0 : sdiv->d[div_n - 2];
   assert(d0 & (((BN_ULONG)1) << (BN_BITS2 - 1)));
 
-  // Extend |snum| with zeros to satisfy the long division invariants:
-  // - |snum| must have at least |div_n| + 1 words.
-  // - |snum|'s most significant word must be zero to guarantee the first loop
-  //   iteration works with a prefix greater than |sdiv|. (This is the extra u0
+  // Extend `snum` with zeros to satisfy the long division invariants:
+  // - `snum` must have at least `div_n` + 1 words.
+  // - `snum`'s most significant word must be zero to guarantee the first loop
+  //   iteration works with a prefix greater than `sdiv`. (This is the extra u0
   //   digit in Knuth step D1.)
   num_n = snum->width <= div_n ? div_n + 1 : snum->width + 1;
   if (!bn_resize_words(snum, num_n)) {
@@ -330,7 +333,7 @@ int BN_div(BIGNUM *quotient, BIGNUM *rem, const BIGNUM *numerator,
   bn_set_minimal_width(res);
 
   // Knuth step D8: Unnormalize. snum now contains the remainder.
-  if (rem != NULL && !BN_rshift(rem, snum, norm_shift)) {
+  if (rem != nullptr && !BN_rshift(rem, snum, norm_shift)) {
     return 0;
   }
 
@@ -350,37 +353,38 @@ int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx) {
   return BN_usub(r, d, r);
 }
 
-BN_ULONG bn_reduce_once(BN_ULONG *r, const BN_ULONG *a, BN_ULONG carry,
-                        const BN_ULONG *m, size_t num) {
+BN_ULONG bssl::bn_reduce_once(BN_ULONG *r, const BN_ULONG *a, BN_ULONG carry,
+                              const BN_ULONG *m, size_t num) {
   assert(r != a);
-  // |r| = |a| - |m|. |bn_sub_words| performs the bulk of the subtraction, and
-  // then we apply the borrow to |carry|.
+  // `r` = `a` - `m`. `bn_sub_words` performs the bulk of the subtraction, and
+  // then we apply the borrow to `carry`.
   carry -= bn_sub_words(r, a, m, num);
-  // We know 0 <= |a| < 2*|m|, so -|m| <= |r| < |m|.
+  // We know 0 <= `a` < 2*`m`, so -`m` <= `r` < `m`.
   //
-  // If 0 <= |r| < |m|, |r| fits in |num| words and |carry| is zero. We then
-  // wish to select |r| as the answer. Otherwise -m <= r < 0 and we wish to
-  // return |r| + |m|, or |a|. |carry| must then be -1 or all ones. In both
-  // cases, |carry| is a suitable input to |bn_select_words|.
+  // If 0 <= `r` < `m`, `r` fits in `num` words and `carry` is zero. We then
+  // wish to select `r` as the answer. Otherwise -m <= r < 0 and we wish to
+  // return `r` + `m`, or `a`. `carry` must then be -1 or all ones. In both
+  // cases, `carry` is a suitable input to `bn_select_words`.
   //
-  // Although |carry| may be one if it was one on input and |bn_sub_words|
-  // returns zero, this would give |r| > |m|, violating our input assumptions.
+  // Although `carry` may be one if it was one on input and `bn_sub_words`
+  // returns zero, this would give `r` > `m`, violating our input assumptions.
   declassify_assert(carry + 1 <= 1);
   bn_select_words(r, carry, a /* r < 0 */, r /* r >= 0 */, num);
   return carry;
 }
 
-BN_ULONG bn_reduce_once_in_place(BN_ULONG *r, BN_ULONG carry, const BN_ULONG *m,
-                                 BN_ULONG *tmp, size_t num) {
-  // See |bn_reduce_once| for why this logic works.
+BN_ULONG bssl::bn_reduce_once_in_place(BN_ULONG *r, BN_ULONG carry,
+                                       const BN_ULONG *m, BN_ULONG *tmp,
+                                       size_t num) {
+  // See `bn_reduce_once` for why this logic works.
   carry -= bn_sub_words(tmp, r, m, num);
   declassify_assert(carry + 1 <= 1);
   bn_select_words(r, carry, r /* tmp < 0 */, tmp /* tmp >= 0 */, num);
   return carry;
 }
 
-void bn_mod_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
-                      const BN_ULONG *m, BN_ULONG *tmp, size_t num) {
+void bssl::bn_mod_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
+                            const BN_ULONG *m, BN_ULONG *tmp, size_t num) {
   // r = a - b
   BN_ULONG borrow = bn_sub_words(r, a, b, num);
   // tmp = a - b + m
@@ -388,15 +392,15 @@ void bn_mod_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
   bn_select_words(r, 0 - borrow, tmp /* r < 0 */, r /* r >= 0 */, num);
 }
 
-void bn_mod_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
-                      const BN_ULONG *m, BN_ULONG *tmp, size_t num) {
+void bssl::bn_mod_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
+                            const BN_ULONG *m, BN_ULONG *tmp, size_t num) {
   BN_ULONG carry = bn_add_words(r, a, b, num);
   bn_reduce_once_in_place(r, carry, m, tmp, num);
 }
 
-int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
-                     const BIGNUM *numerator, const BIGNUM *divisor,
-                     unsigned divisor_min_bits, BN_CTX *ctx) {
+int bssl::bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
+                           const BIGNUM *numerator, const BIGNUM *divisor,
+                           unsigned divisor_min_bits, BN_CTX *ctx) {
   if (BN_is_negative(numerator) || BN_is_negative(divisor)) {
     OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
     return 0;
@@ -410,17 +414,17 @@ int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
   // but it is simple, easy to make constant-time, and performant enough for RSA
   // key generation.
 
-  bssl::BN_CTXScope scope(ctx);
+  BN_CTXScope scope(ctx);
   BIGNUM *q = quotient, *r = remainder;
-  if (quotient == NULL || quotient == numerator || quotient == divisor) {
+  if (quotient == nullptr || quotient == numerator || quotient == divisor) {
     q = BN_CTX_get(ctx);
   }
-  if (remainder == NULL || remainder == numerator || remainder == divisor) {
+  if (remainder == nullptr || remainder == numerator || remainder == divisor) {
     r = BN_CTX_get(ctx);
   }
   BIGNUM *tmp = BN_CTX_get(ctx);
   int initial_words;
-  if (q == NULL || r == NULL || tmp == NULL ||
+  if (q == nullptr || r == nullptr || tmp == nullptr ||
       !bn_wexpand(q, numerator->width) || !bn_wexpand(r, divisor->width) ||
       !bn_wexpand(tmp, divisor->width)) {
     return 0;
@@ -434,14 +438,14 @@ int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
   r->width = divisor->width;
   r->neg = 0;
 
-  // Incorporate |numerator| into |r|, one bit at a time, reducing after each
-  // step. We maintain the invariant that |0 <= r < divisor| and
-  // |q * divisor + r = n| where |n| is the portion of |numerator| incorporated
+  // Incorporate `numerator` into `r`, one bit at a time, reducing after each
+  // step. We maintain the invariant that `0 <= r < divisor` and
+  // `q * divisor + r = n` where `n` is the portion of `numerator` incorporated
   // so far.
   //
-  // First, we short-circuit the loop: if we know |divisor| has at least
-  // |divisor_min_bits| bits, the top |divisor_min_bits - 1| can be incorporated
-  // without reductions. This significantly speeds up |RSA_check_key|. For
+  // First, we short-circuit the loop: if we know `divisor` has at least
+  // `divisor_min_bits` bits, the top `divisor_min_bits - 1` can be incorporated
+  // without reductions. This significantly speeds up `RSA_check_key`. For
   // simplicity, we round down to a whole number of words.
   declassify_assert(divisor_min_bits <= BN_num_bits(divisor));
   initial_words = 0;
@@ -458,13 +462,13 @@ int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
     for (int bit = BN_BITS2 - 1; bit >= 0; bit--) {
       // Incorporate the next bit of the numerator, by computing
       // r = 2*r or 2*r + 1. Note the result fits in one more word. We store the
-      // extra word in |carry|.
+      // extra word in `carry`.
       BN_ULONG carry = bn_add_words(r->d, r->d, r->d, divisor->width);
       r->d[0] |= (numerator->d[i] >> bit) & 1;
-      // |r| was previously fully-reduced, so we know:
+      // `r` was previously fully-reduced, so we know:
       //      2*0 <= r <= 2*(divisor-1) + 1
       //        0 <= r <= 2*divisor - 1 < 2*divisor.
-      // Thus |r| satisfies the preconditions for |bn_reduce_once_in_place|.
+      // Thus `r` satisfies the preconditions for `bn_reduce_once_in_place`.
       BN_ULONG subtracted = bn_reduce_once_in_place(r->d, carry, divisor->d,
                                                     tmp->d, divisor->width);
       // The corresponding bit of the quotient is set iff we needed to subtract.
@@ -472,8 +476,8 @@ int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
     }
   }
 
-  if ((quotient != NULL && !BN_copy(quotient, q)) ||
-      (remainder != NULL && !BN_copy(remainder, r))) {
+  if ((quotient != nullptr && !BN_copy(quotient, q)) ||
+      (remainder != nullptr && !BN_copy(remainder, r))) {
     return 0;
   }
 
@@ -482,19 +486,19 @@ int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
 
 static BIGNUM *bn_scratch_space_from_ctx(size_t width, BN_CTX *ctx) {
   BIGNUM *ret = BN_CTX_get(ctx);
-  if (ret == NULL || !bn_wexpand(ret, width)) {
-    return NULL;
+  if (ret == nullptr || !bn_wexpand(ret, width)) {
+    return nullptr;
   }
   ret->neg = 0;
   ret->width = (int)width;
   return ret;
 }
 
-// bn_resized_from_ctx returns |bn| with width at least |width| or NULL on
+// bn_resized_from_ctx returns `bn` with width at least `width` or NULL on
 // error. This is so it may be used with low-level "words" functions. If
-// necessary, it allocates a new |BIGNUM| with a lifetime of the current scope
-// in |ctx|, so the caller does not need to explicitly free it. |bn| must fit in
-// |width| words.
+// necessary, it allocates a new `BIGNUM` with a lifetime of the current scope
+// in `ctx`, so the caller does not need to explicitly free it. `bn` must fit in
+// `width` words.
 static const BIGNUM *bn_resized_from_ctx(const BIGNUM *bn, size_t width,
                                          BN_CTX *ctx) {
   if ((size_t)bn->width >= width) {
@@ -503,8 +507,8 @@ static const BIGNUM *bn_resized_from_ctx(const BIGNUM *bn, size_t width,
     return bn;
   }
   BIGNUM *ret = bn_scratch_space_from_ctx(width, ctx);
-  if (ret == NULL || !BN_copy(ret, bn) || !bn_resize_words(ret, width)) {
-    return NULL;
+  if (ret == nullptr || !BN_copy(ret, bn) || !bn_resize_words(ret, width)) {
+    return nullptr;
   }
   return ret;
 }
@@ -519,13 +523,13 @@ int BN_mod_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
 
 int BN_mod_add_quick(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
                      const BIGNUM *m) {
-  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
+  UniquePtr<BN_CTX> ctx(BN_CTX_new());
   return ctx != nullptr && bn_mod_add_consttime(r, a, b, m, ctx.get());
 }
 
-int bn_mod_add_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
-                         const BIGNUM *m, BN_CTX *ctx) {
-  bssl::BN_CTXScope scope(ctx);
+int bssl::bn_mod_add_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
+                               const BIGNUM *m, BN_CTX *ctx) {
+  BN_CTXScope scope(ctx);
   a = bn_resized_from_ctx(a, m->width, ctx);
   b = bn_resized_from_ctx(b, m->width, ctx);
   BIGNUM *tmp = bn_scratch_space_from_ctx(m->width, ctx);
@@ -547,9 +551,9 @@ int BN_mod_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
   return BN_nnmod(r, r, m, ctx);
 }
 
-int bn_mod_sub_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
-                         const BIGNUM *m, BN_CTX *ctx) {
-  bssl::BN_CTXScope scope(ctx);
+int bssl::bn_mod_sub_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
+                               const BIGNUM *m, BN_CTX *ctx) {
+  BN_CTXScope scope(ctx);
   a = bn_resized_from_ctx(a, m->width, ctx);
   b = bn_resized_from_ctx(b, m->width, ctx);
   BIGNUM *tmp = bn_scratch_space_from_ctx(m->width, ctx);
@@ -565,15 +569,15 @@ int bn_mod_sub_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
 
 int BN_mod_sub_quick(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
                      const BIGNUM *m) {
-  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
+  UniquePtr<BN_CTX> ctx(BN_CTX_new());
   return ctx != nullptr && bn_mod_sub_consttime(r, a, b, m, ctx.get());
 }
 
 int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
                BN_CTX *ctx) {
-  bssl::BN_CTXScope scope(ctx);
+  BN_CTXScope scope(ctx);
   BIGNUM *t = BN_CTX_get(ctx);
-  if (t == NULL) {
+  if (t == nullptr) {
     return 0;
   }
 
@@ -609,7 +613,7 @@ int BN_mod_lshift(BIGNUM *r, const BIGNUM *a, int n, const BIGNUM *m,
     return 0;
   }
 
-  bssl::UniquePtr<BIGNUM> abs_m;
+  UniquePtr<BIGNUM> abs_m;
   if (m->neg) {
     abs_m.reset(BN_dup(m));
     if (abs_m == nullptr) {
@@ -621,13 +625,13 @@ int BN_mod_lshift(BIGNUM *r, const BIGNUM *a, int n, const BIGNUM *m,
   return bn_mod_lshift_consttime(r, r, n, (abs_m ? abs_m.get() : m), ctx);
 }
 
-int bn_mod_lshift_consttime(BIGNUM *r, const BIGNUM *a, int n, const BIGNUM *m,
-                            BN_CTX *ctx) {
+int bssl::bn_mod_lshift_consttime(BIGNUM *r, const BIGNUM *a, int n,
+                                  const BIGNUM *m, BN_CTX *ctx) {
   if (!BN_copy(r, a) || !bn_resize_words(r, m->width)) {
     return 0;
   }
 
-  bssl::BN_CTXScope scope(ctx);
+  BN_CTXScope scope(ctx);
   BIGNUM *tmp = bn_scratch_space_from_ctx(m->width, ctx);
   if (tmp == nullptr) {
     return 0;
@@ -640,7 +644,7 @@ int bn_mod_lshift_consttime(BIGNUM *r, const BIGNUM *a, int n, const BIGNUM *m,
 }
 
 int BN_mod_lshift_quick(BIGNUM *r, const BIGNUM *a, int n, const BIGNUM *m) {
-  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
+  UniquePtr<BN_CTX> ctx(BN_CTX_new());
   return ctx != nullptr && bn_mod_lshift_consttime(r, a, n, m, ctx.get());
 }
 
@@ -652,13 +656,13 @@ int BN_mod_lshift1(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx) {
   return BN_nnmod(r, r, m, ctx);
 }
 
-int bn_mod_lshift1_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *m,
-                             BN_CTX *ctx) {
+int bssl::bn_mod_lshift1_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *m,
+                                   BN_CTX *ctx) {
   return bn_mod_add_consttime(r, a, a, m, ctx);
 }
 
 int BN_mod_lshift1_quick(BIGNUM *r, const BIGNUM *a, const BIGNUM *m) {
-  bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
+  UniquePtr<BN_CTX> ctx(BN_CTX_new());
   return ctx != nullptr && bn_mod_lshift1_consttime(r, a, m, ctx.get());
 }
 
@@ -675,7 +679,7 @@ BN_ULONG BN_div_word(BIGNUM *a, BN_ULONG w) {
     return 0;
   }
 
-  // normalize input for |bn_div_rem_words|.
+  // normalize input for `bn_div_rem_words`.
   j = BN_BITS2 - BN_num_bits_word(w);
   w <<= j;
   if (!BN_lshift(a, a, j)) {
@@ -709,11 +713,11 @@ BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w) {
   }
 
 #ifndef BN_CAN_DIVIDE_ULLONG
-  // If |w| is too long and we don't have |BN_ULLONG| division then we need to
-  // fall back to using |BN_div_word|.
+  // If `w` is too long and we don't have `BN_ULLONG` division then we need to
+  // fall back to using `BN_div_word`.
   if (w > ((BN_ULONG)1 << BN_BITS4)) {
     BIGNUM *tmp = BN_dup(a);
-    if (tmp == NULL) {
+    if (tmp == nullptr) {
       return (BN_ULONG)-1;
     }
     ret = BN_div_word(tmp, w);
@@ -732,82 +736,3 @@ BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w) {
   }
   return (BN_ULONG)ret;
 }
-
-int BN_mod_pow2(BIGNUM *r, const BIGNUM *a, size_t e) {
-  if (e == 0 || a->width == 0) {
-    BN_zero(r);
-    return 1;
-  }
-
-  size_t num_words = 1 + ((e - 1) / BN_BITS2);
-
-  // If |a| definitely has less than |e| bits, just BN_copy.
-  if ((size_t)a->width < num_words) {
-    return BN_copy(r, a) != NULL;
-  }
-
-  // Otherwise, first make sure we have enough space in |r|.
-  // Note that this will fail if num_words > INT_MAX.
-  if (!bn_wexpand(r, num_words)) {
-    return 0;
-  }
-
-  // Copy the content of |a| into |r|.
-  OPENSSL_memcpy(r->d, a->d, num_words * sizeof(BN_ULONG));
-
-  // If |e| isn't word-aligned, we have to mask off some of our bits.
-  size_t top_word_exponent = e % (sizeof(BN_ULONG) * 8);
-  if (top_word_exponent != 0) {
-    r->d[num_words - 1] &= (((BN_ULONG)1) << top_word_exponent) - 1;
-  }
-
-  // Fill in the remaining fields of |r|.
-  r->neg = a->neg;
-  r->width = (int)num_words;
-  bn_set_minimal_width(r);
-  return 1;
-}
-
-int BN_nnmod_pow2(BIGNUM *r, const BIGNUM *a, size_t e) {
-  if (!BN_mod_pow2(r, a, e)) {
-    return 0;
-  }
-
-  // If the returned value was non-negative, we're done.
-  if (BN_is_zero(r) || !r->neg) {
-    return 1;
-  }
-
-  size_t num_words = 1 + (e - 1) / BN_BITS2;
-
-  // Expand |r| to the size of our modulus.
-  if (!bn_wexpand(r, num_words)) {
-    return 0;
-  }
-
-  // Clear the upper words of |r|.
-  OPENSSL_memset(&r->d[r->width], 0, (num_words - r->width) * BN_BYTES);
-
-  // Set parameters of |r|.
-  r->neg = 0;
-  r->width = (int)num_words;
-
-  // Now, invert every word. The idea here is that we want to compute 2^e-|x|,
-  // which is actually equivalent to the twos-complement representation of |x|
-  // in |e| bits, which is -x = ~x + 1.
-  for (int i = 0; i < r->width; i++) {
-    r->d[i] = ~r->d[i];
-  }
-
-  // If our exponent doesn't span the top word, we have to mask the rest.
-  size_t top_word_exponent = e % BN_BITS2;
-  if (top_word_exponent != 0) {
-    r->d[r->width - 1] &= (((BN_ULONG)1) << top_word_exponent) - 1;
-  }
-
-  // Keep the minimal-width invariant for |BIGNUM|.
-  bn_set_minimal_width(r);
-
-  // Finally, add one, for the reason described above.
-  return BN_add(r, r, BN_value_one());
-}

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bn/div_extra.cc.inc

@@ -19,17 +19,20 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 // The following functions use a Barrett reduction variant to avoid leaking the
-// numerator. See http://ridiculousfish.com/blog/posts/labor-of-division-episode-i.html
+// numerator. See
+// http://ridiculousfish.com/blog/posts/labor-of-division-episode-i.html
 //
 // We use 32-bit numerator and 16-bit divisor for simplicity. This allows
-// computing |m| and |q| without architecture-specific code.
+// computing `m` and `q` without architecture-specific code.
 
-// mod_u16 returns |n| mod |d|. |p| and |m| are the "magic numbers" for |d| (see
+// mod_u16 returns `n` mod `d`. `p` and `m` are the "magic numbers" for `d` (see
 // reference). For proof of correctness in Coq, see
 // https://github.com/davidben/fiat-crypto/blob/barrett/src/Arithmetic/BarrettReduction/RidiculousFish.v
-// Note the Coq version of |mod_u16| additionally includes the computation of
-// |p| and |m| from |bn_mod_u16_consttime| below.
+// Note the Coq version of `mod_u16` additionally includes the computation of
+// `p` and `m` from `bn_mod_u16_consttime` below.
 static uint16_t mod_u16(uint32_t n, uint16_t d, uint32_t p, uint32_t m) {
   // Compute floor(n/d) per steps 3 through 5.
   uint32_t q = ((uint64_t)m * n) >> 32;
@@ -43,11 +46,11 @@ static uint16_t mod_u16(uint32_t n, uint16_t d, uint32_t p, uint32_t m) {
   return n;
 }
 
-// shift_and_add_mod_u16 returns |r| * 2^32 + |a| mod |d|. |p| and |m| are the
-// "magic numbers" for |d| (see reference).
+// shift_and_add_mod_u16 returns `r` * 2^32 + `a` mod `d`. `p` and `m` are the
+// "magic numbers" for `d` (see reference).
 static uint16_t shift_and_add_mod_u16(uint16_t r, uint32_t a, uint16_t d,
                                       uint32_t p, uint32_t m) {
-  // Incorporate |a| in two 16-bit chunks.
+  // Incorporate `a` in two 16-bit chunks.
   uint32_t t = r;
   t <<= 16;
   t |= a >> 16;
@@ -59,16 +62,16 @@ static uint16_t shift_and_add_mod_u16(uint16_t r, uint32_t a, uint16_t d,
   return t;
 }
 
-uint16_t bn_mod_u16_consttime(const BIGNUM *bn, uint16_t d) {
+uint16_t bssl::bn_mod_u16_consttime(const BIGNUM *bn, uint16_t d) {
   if (d <= 1) {
     return 0;
   }
 
-  // Compute the "magic numbers" for |d|. See steps 1 and 2.
+  // Compute the "magic numbers" for `d`. See steps 1 and 2.
   // This computes p = ceil(log_2(d)).
   uint32_t p = BN_num_bits_word(d - 1);
-  // This operation is not constant-time, but |p| and |d| are public values.
-  // Note that |p| is at most 16, so the computation fits in |uint64_t|.
+  // This operation is not constant-time, but `p` and `d` are public values.
+  // Note that `p` is at most 16, so the computation fits in `uint64_t`.
   assert(p <= 16);
   uint32_t m = (uint32_t)(((UINT64_C(1) << (32 + p)) + d - 1) / d);