grpc 1.84.1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/ssl/tls_record.cc

@@ -44,7 +44,7 @@ static const size_t kMaxEarlyDataSkipped = 16384;
 // processed.
 static const uint8_t kMaxWarningAlerts = 4;
 
-// ssl_needs_record_splitting returns one if |ssl|'s current outgoing cipher
+// ssl_needs_record_splitting returns one if `ssl`'s current outgoing cipher
 // state needs record-splitting and zero otherwise.
 bool ssl_needs_record_splitting(const SSL *ssl) {
   return !CRYPTO_fuzzer_mode_enabled() &&
@@ -143,7 +143,7 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
     return ssl_open_record_partial;
   }
 
-  Span<const uint8_t> header = in.subspan(0, SSL3_RT_HEADER_LENGTH);
+  auto header = in.first(SSL3_RT_HEADER_LENGTH);
   ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_HEADER, header);
 
   *out_consumed = in.size() - CBS_len(&cbs);
@@ -238,8 +238,6 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
     }
     // Apart from the limit, empty records are returned up to the caller. This
     // allows the caller to reject records of the wrong type.
-  } else {
-    ssl->s3->empty_record_count = 0;
   }
 
   if (type == SSL3_RT_ALERT) {
@@ -254,7 +252,12 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
     return ssl_open_record_error;
   }
 
-  ssl->s3->warning_alert_count = 0;
+  // Only when at least one byte is returned, clear the counters for empty
+  // records and warnings.
+  if (!out->empty()) {
+    ssl->s3->empty_record_count = 0;
+    ssl->s3->warning_alert_count = 0;
+  }
 
   *out_type = type;
   return ssl_open_record_success;
@@ -264,7 +267,7 @@ static bool do_seal_record(SSL *ssl, uint8_t *out_prefix, uint8_t *out,
                            uint8_t *out_suffix, uint8_t type, const uint8_t *in,
                            const size_t in_len) {
   SSLAEADContext *aead = ssl->s3->aead_write_ctx.get();
-  uint8_t *extra_in = NULL;
+  uint8_t *extra_in = nullptr;
   size_t extra_in_len = 0;
   if (!aead->is_null_cipher() && ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
     // TLS 1.3 hides the actual record type inside the encrypted data.
@@ -351,12 +354,12 @@ static bool tls_seal_scatter_suffix_len(const SSL *ssl, size_t *out_suffix_len,
                                             extra_in_len);
 }
 
-// tls_seal_scatter_record seals a new record of type |type| and body |in| and
-// splits it between |out_prefix|, |out|, and |out_suffix|. Exactly
-// |tls_seal_scatter_prefix_len| bytes are written to |out_prefix|, |in_len|
-// bytes to |out|, and |tls_seal_scatter_suffix_len| bytes to |out_suffix|. It
+// tls_seal_scatter_record seals a new record of type `type` and body `in` and
+// splits it between `out_prefix`, `out`, and `out_suffix`. Exactly
+// `tls_seal_scatter_prefix_len` bytes are written to `out_prefix`, `in_len`
+// bytes to `out`, and `tls_seal_scatter_suffix_len` bytes to `out_suffix`. It
 // returns one on success and zero on error. If enabled,
-// |tls_seal_scatter_record| implements TLS 1.0 CBC 1/n-1 record splitting and
+// `tls_seal_scatter_record` implements TLS 1.0 CBC 1/n-1 record splitting and
 // may write two records concatenated.
 static bool tls_seal_scatter_record(SSL *ssl, uint8_t *out_prefix, uint8_t *out,
                                     uint8_t *out_suffix, uint8_t type,
@@ -366,7 +369,7 @@ static bool tls_seal_scatter_record(SSL *ssl, uint8_t *out_prefix, uint8_t *out,
     assert(ssl->s3->aead_write_ctx->ExplicitNonceLen() == 0);
     const size_t prefix_len = SSL3_RT_HEADER_LENGTH;
 
-    // Write the 1-byte fragment into |out_prefix|.
+    // Write the 1-byte fragment into `out_prefix`.
     uint8_t *split_body = out_prefix + prefix_len;
     uint8_t *split_suffix = split_body + 1;
 
@@ -385,8 +388,8 @@ static bool tls_seal_scatter_record(SSL *ssl, uint8_t *out_prefix, uint8_t *out,
                                        ssl->s3->aead_write_ctx->cipher()) ==
            split_record_len);
 
-    // Write the n-1-byte fragment. The header gets split between |out_prefix|
-    // (header[:-1]) and |out| (header[-1:]).
+    // Write the n-1-byte fragment. The header gets split between `out_prefix`
+    // (header[:-1]) and `out` (header[-1:]).
     uint8_t tmp_prefix[SSL3_RT_HEADER_LENGTH];
     if (!do_seal_record(ssl, tmp_prefix, out + 1, out_suffix, type, in + 1,
                         in_len - 1)) {

data/third_party/boringssl-with-bazel/third_party/fiat/bedrock_unverified_bareminimum.c.inc

@@ -0,0 +1,47 @@
+#ifndef BEDROCK_UNVERIFIED_BAREMINIMUM_INC_H_
+#define BEDROCK_UNVERIFIED_BAREMINIMUM_INC_H_
+
+static_assert(sizeof(br_word_t) == sizeof(br_signed_t), "");
+static_assert(UINTPTR_MAX <= BR_WORD_MAX, "");
+
+// "An object shall have its stored value accessed only ... a character type."
+
+static inline br_word_t _br_load1(br_word_t a) {
+  return *((uint8_t *)a);
+}
+
+static inline br_word_t _br_load2(br_word_t a) {
+  uint16_t r = 0;
+  memcpy(&r, (void *)a, sizeof(r));
+  return r;
+}
+
+static inline br_word_t _br_load4(br_word_t a) {
+  uint32_t r = 0;
+  memcpy(&r, (void *)a, sizeof(r));
+  return r;
+}
+
+static inline br_word_t _br_load(br_word_t a) {
+  br_word_t r = 0;
+  memcpy(&r, (void *)a, sizeof(r));
+  return r;
+}
+
+static inline void _br_store1(br_word_t a, uint8_t v) {
+  *((uint8_t *)a) = v;
+}
+
+static inline void _br_store2(br_word_t a, uint16_t v) {
+  memcpy((void *)a, &v, sizeof(v));
+}
+
+static inline void _br_store4(br_word_t a, uint32_t v) {
+  memcpy((void *)a, &v, sizeof(v));
+}
+
+static inline void _br_store(br_word_t a, br_word_t v) {
+  memcpy((void *)a, &v, sizeof(v));
+}
+
+#endif // BEDROCK_UNVERIFIED_BAREMINIMUM_INC_H_

data/third_party/boringssl-with-bazel/third_party/fiat/bedrock_unverified_platform.c.inc

@@ -0,0 +1,137 @@
+#ifndef BEDROCK_UNVERIFIED_PLATFORM_INC_H_
+#define BEDROCK_UNVERIFIED_PLATFORM_INC_H_
+
+// This file is a manually maintained and audited replacement for
+// bedrock_polyfill_platform.c.inc with tests in bedrock_platform_test.cc
+
+#include "../../crypto/internal.h"
+
+
+#if defined(OPENSSL_64_BIT)
+#define BR_WORD_MAX UINT64_MAX
+typedef uint64_t br_word_t;
+typedef int64_t br_signed_t;
+#elif defined(OPENSSL_32_BIT)
+#define BR_WORD_MAX UINT32_MAX
+typedef uint32_t br_word_t;
+typedef int32_t br_signed_t;
+#else
+#error "Must define either OPENSSL_32_BIT or OPENSSL_64_BIT"
+#endif
+
+static_assert(sizeof(br_word_t) == sizeof(bssl::crypto_word_t));
+
+// Scalar memory operations
+
+#include "../../third_party/fiat/bedrock_unverified_bareminimum.c.inc"
+
+// Bulk memory operations
+
+static inline void br_memcpy(br_word_t d, br_word_t s, br_word_t n) {
+  bssl::OPENSSL_memcpy((void *)d, (const void *)s, n);
+}
+
+static inline void br_memset(br_word_t d, br_word_t v, br_word_t n) {
+  bssl::OPENSSL_memset((void *)d, v, n);
+}
+
+static inline void br_memcxor(uintptr_t d, uintptr_t s, uintptr_t n,
+                              uintptr_t mask) {
+  bssl::constant_time_conditional_memxor((void *)d, (void *)s, n, mask);
+}
+
+// CPU Arithmetic
+
+static inline br_word_t br_full_add(br_word_t x, br_word_t y, br_word_t carry,
+                                    br_word_t *_sum) {
+  br_word_t carry_out = 0;
+  static_assert(sizeof(br_word_t) == sizeof(bssl::crypto_word_t));
+  *_sum = bssl::CRYPTO_addc_w(x, y, carry, &carry_out);
+  return carry_out;
+}
+
+static inline br_word_t br_full_sub(br_word_t x, br_word_t y, br_word_t borrow,
+                                    br_word_t *_diff) {
+  br_word_t borrow_out = 0;
+  static_assert(sizeof(br_word_t) == sizeof(bssl::crypto_word_t));
+  *_diff = bssl::CRYPTO_subc_w(x, y, borrow, &borrow_out);
+  return borrow_out;
+}
+
+static inline br_word_t br_full_mul(br_word_t a, br_word_t b, br_word_t *_low) {
+#if BR_WORD_MAX == UINT32_MAX
+  uint64_t r = (uint64_t)a * b;
+  *_low = r;
+  return r >> 32;
+#elif defined(BORINGSSL_HAS_UINT128)
+  bssl::uint128_t r = (bssl::uint128_t)a * b;
+  *_low = r;
+  return r >> 64;
+#elif defined(_M_X64)
+  uint64_t hi;
+  *_low = _umul128(a, b, &hi);
+  return hi;
+#elif defined(_M_ARM64)
+  *_low = a * b;
+  return __umulh(a, b);
+#else
+#error "need 64 x 64 -> 128 multiplication"
+#endif
+}
+
+// Constant-time computations
+
+static inline br_word_t br_value_barrier(br_word_t a) {
+  static_assert(sizeof(br_word_t) == sizeof(bssl::crypto_word_t));
+  return bssl::value_barrier_w(a);
+}
+
+static inline br_word_t br_declassify(br_word_t a) {
+  static_assert(sizeof(br_word_t) == sizeof(bssl::crypto_word_t));
+  return bssl::constant_time_declassify_w(a);
+}
+
+static inline br_word_t br_broadcast_negative(br_word_t x) {
+  return br_value_barrier((br_signed_t)x >> (sizeof(br_word_t) * 8 - 1));
+}
+
+static inline br_word_t br_broadcast_nonzero(br_word_t x) {
+  return br_broadcast_negative(x | (0u - x));
+}
+
+static inline br_word_t br_cmov(br_word_t c, br_word_t vnz, br_word_t vz) {
+#if !defined(OPENSSL_NO_ASM) && (defined(__GNUC__) || defined(__clang__)) && \
+    defined(__x86_64__)
+  __asm__(
+      "testq %[c], %[c]\n"
+      "cmovzq %[vz], %[vnz]"
+      : [vnz] "+r"(vnz)
+      : [vz] "r"(vz), [c] "r"(c)
+      : "cc");
+  return vnz;
+#elif !defined(OPENSSL_NO_ASM) && (defined(__GNUC__) || defined(__clang__)) && \
+    defined(__i386__)
+  __asm__(
+      "testl %[c], %[c]\n"  // test%z[c] gives "invalid operand" on clang 16.0.6
+      "cmovzl %[vz], %[vnz]"
+      : [vnz] "+r"(vnz)
+      : [vz] "r"(vz), [c] "r"(c)
+      : "cc");
+  return vnz;
+#elif !defined(OPENSSL_NO_ASM) && (defined(__GNUC__) || defined(__clang__)) && \
+    defined(__aarch64__)
+  br_word_t ret;
+  __asm__(
+      "cmp %[c], #0\n"
+      "csel %[ret], %[vz], %[vnz], EQ"
+      : [ret] "=r"(ret)
+      : [vz] "r"(vz), [vnz] "r"(vnz), [c] "r"(c)
+      : "cc");
+  return ret;
+#else
+  br_word_t m = br_broadcast_nonzero(c);
+  return (m & vnz) | (~m & vz);
+#endif
+}
+
+#endif  // BEDROCK_UNVERIFIED_PLATFORM_INC_H_

data/third_party/boringssl-with-bazel/third_party/fiat/curve25519_64_adx.h

@@ -14,14 +14,20 @@ static __inline__ uint64_t fiat_value_barrier_u64(uint64_t a) {
   return a;
 }
 
-__attribute__((target("adx,bmi2")))
-static inline void fe4_mul(fe4 out, const fe4 x, const fe4 y) { fiat_curve25519_adx_mul(out, x, y); }
+__attribute__((target("adx,bmi2"))) static inline void fe4_mul(fe4 out,
+                                                               const fe4 x,
+                                                               const fe4 y) {
+  bssl::fiat_curve25519_adx_mul(out, x, y);
+}
 
-__attribute__((target("adx,bmi2")))
-static inline void fe4_sq(fe4 out, const fe4 x) { fiat_curve25519_adx_square(out, x); }
+__attribute__((target("adx,bmi2"))) static inline void fe4_sq(fe4 out,
+                                                              const fe4 x) {
+  bssl::fiat_curve25519_adx_square(out, x);
+}
 
 /*
- * The function fiat_mulx_u64 is a multiplication, returning the full double-width result.
+ * The function fiat_mulx_u64 is a multiplication, returning the full
+ * double-width result.
  *
  * Postconditions:
  *   out1 = (arg1 * arg2) mod 2^64
@@ -79,9 +85,7 @@ static inline void fiat_addcarryx_u64(uint64_t* out1, fiat_uint1* out2, fiat_uin
   *out2 = addcarry64(arg1, arg2, arg3, &t);
   *out1 = t;
 #elif defined(_M_X64)
-  long long unsigned int t;
   *out2 = _addcarry_u64(arg1, arg2, arg3, out1);
-  *out1 = t;
 #else
   arg2 += arg1;
   arg1 = arg2 < arg1;
@@ -402,10 +406,10 @@ static void fe4_cswap(uint64_t out1[4], uint64_t out2[4], fiat_uint1 arg1, const
   out2[3] = x8;
 }
 
-// The following functions are adaped from crypto/curve25519/curve25519.c
+// The following functions are adapted from crypto/curve25519/curve25519.c
 // It would be desirable to share the code, but with the current field
 // implementations both 4-limb and 5-limb versions of the curve-level code need
-// to be included in builds targetting an unknown variant of x86_64.
+// to be included in builds targeting an unknown variant of x86_64.
 
 __attribute__((target("adx,bmi2")))
 static void fe4_invert(fe4 out, const fe4 z) {
@@ -466,11 +470,10 @@ static void fe4_invert(fe4 out, const fe4 z) {
   fe4_mul(out, t1, t0);
 }
 
-__attribute__((target("adx,bmi2")))
-void x25519_scalar_mult_adx(uint8_t out[32], const uint8_t scalar[32],
-                            const uint8_t point[32]) {
+__attribute__((target("adx,bmi2"))) void bssl::x25519_scalar_mult_adx(
+    uint8_t out[32], const uint8_t scalar[32], const uint8_t point[32]) {
   uint8_t e[32];
-  OPENSSL_memcpy(e, scalar, 32);
+  bssl::OPENSSL_memcpy(e, scalar, 32);
   e[0] &= 248;
   e[31] &= 127;
   e[31] |= 64;
@@ -493,9 +496,9 @@ void x25519_scalar_mult_adx(uint8_t out[32], const uint8_t scalar[32],
   // <https://github.com/mit-plv/fiat-crypto/blob/2456d821825521f7e03e65882cc3521795b0320f/src/Curves/Montgomery/XZProofs.v#L278>
   // preconditions: 0 <= e < 2^255 (not necessarily e < order), fe_invert(0) = 0
   fe4 x1, x2 = {1}, z2 = {0}, x3, z3 = {1}, tmp0, tmp1;
-  OPENSSL_memcpy(x1, point, sizeof(fe4));
+  bssl::OPENSSL_memcpy(x1, point, sizeof(fe4));
   x1[3] &= (uint64_t)(-1)>>1;
-  OPENSSL_memcpy(x3, x1, sizeof(fe4));
+  bssl::OPENSSL_memcpy(x3, x1, sizeof(fe4));
 
   unsigned swap = 0;
   int pos;
@@ -542,7 +545,7 @@ void x25519_scalar_mult_adx(uint8_t out[32], const uint8_t scalar[32],
   fe4_invert(z2, z2);
   fe4_mul(x2, x2, z2);
   fe4_canon(x2, x2);
-  OPENSSL_memcpy(out, x2, sizeof(fe4));
+  bssl::OPENSSL_memcpy(out, x2, sizeof(fe4));
 }
 
 typedef struct {
@@ -607,36 +610,37 @@ ge_p3_add_p3_precomp_4(ge_p3_4 *r, const ge_p3_4 *p, const ge_precomp_4 *q) {
 __attribute__((always_inline)) // 25% speedup with clang14 and zen2
 static inline void table_select_4(ge_precomp_4 *t, const int pos,
                                   const signed char b) {
-  uint8_t bnegative = constant_time_msb_w(b);
+  uint8_t bnegative = bssl::constant_time_msb_w(b);
   uint8_t babs = b - ((bnegative & b) << 1);
 
   uint8_t t_bytes[3][32] = {
-    {static_cast<uint8_t>(constant_time_is_zero_w(b) & 1)},
-    {static_cast<uint8_t>(constant_time_is_zero_w(b) & 1)},
-    {0},
+      {static_cast<uint8_t>(bssl::constant_time_is_zero_w(b) & 1)},
+      {static_cast<uint8_t>(bssl::constant_time_is_zero_w(b) & 1)},
+      {0},
   };
 #if defined(__clang__)
   __asm__("" : "+m" (t_bytes) : /*no inputs*/);
 #endif
-  static_assert(sizeof(t_bytes) == sizeof(k25519Precomp[pos][0]), "");
+  static_assert(sizeof(t_bytes) == sizeof(bssl::k25519Precomp[pos][0]), "");
   for (int i = 0; i < 8; i++) {
-    constant_time_conditional_memxor(t_bytes, k25519Precomp[pos][i],
-                                     sizeof(t_bytes),
-                                     constant_time_eq_w(babs, 1 + i));
+    bssl::constant_time_conditional_memxor(
+        t_bytes, bssl::k25519Precomp[pos][i], sizeof(t_bytes),
+        bssl::constant_time_eq_w(babs, 1 + i));
   }
 
   static_assert(sizeof(t_bytes) == sizeof(ge_precomp_4), "");
 
   // fe4 uses saturated 64-bit limbs, so converting from bytes is just a copy.
-  OPENSSL_memcpy(t, t_bytes, sizeof(ge_precomp_4));
+  bssl::OPENSSL_memcpy(t, t_bytes, sizeof(ge_precomp_4));
 
   fe4 xy2d_neg = {0};
   fe4_sub(xy2d_neg, xy2d_neg, t->xy2d);
-  constant_time_conditional_memcpy(t->yplusx, t_bytes[1], sizeof(fe4),
-                                   bnegative);
-  constant_time_conditional_memcpy(t->yminusx, t_bytes[0], sizeof(fe4),
-                                   bnegative);
-  constant_time_conditional_memcpy(t->xy2d, xy2d_neg, sizeof(fe4), bnegative);
+  bssl::constant_time_conditional_memcpy(t->yplusx, t_bytes[1], sizeof(fe4),
+                                         bnegative);
+  bssl::constant_time_conditional_memcpy(t->yminusx, t_bytes[0], sizeof(fe4),
+                                         bnegative);
+  bssl::constant_time_conditional_memcpy(t->xy2d, xy2d_neg, sizeof(fe4),
+                                         bnegative);
 }
 
 // h = a * B
@@ -645,8 +649,8 @@ static inline void table_select_4(ge_precomp_4 *t, const int pos,
 //
 // Preconditions:
 //   a[31] <= 127
-__attribute__((target("adx,bmi2")))
-void x25519_ge_scalarmult_base_adx(uint8_t h[4][32], const uint8_t a[32]) {
+__attribute__((target("adx,bmi2"))) void bssl::x25519_ge_scalarmult_base_adx(
+    uint8_t h[4][32], const uint8_t a[32]) {
   signed char e[64];
   signed char carry;
 
@@ -692,5 +696,5 @@ void x25519_ge_scalarmult_base_adx(uint8_t h[4][32], const uint8_t a[32]) {
   fe4_canon(r.Z, r.Z);
   fe4_canon(r.T, r.T);
   static_assert(sizeof(ge_p3_4) == sizeof(uint8_t[4][32]), "");
-  OPENSSL_memcpy(h, &r, sizeof(ge_p3_4));
+  bssl::OPENSSL_memcpy(h, &r, sizeof(ge_p3_4));
 }

data/third_party/boringssl-with-bazel/third_party/fiat/p256_64.h

@@ -1,13 +1,3 @@
-#include <openssl/base.h>
-#include "../../crypto/internal.h"
-
-#if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) && defined(__x86_64__)
-extern "C" {
-void fiat_p256_adx_mul(uint64_t*, const uint64_t*, const uint64_t*);
-void fiat_p256_adx_sqr(uint64_t*, const uint64_t*);
-}
-#endif
-
 /* Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --inline --static --use-value-barrier p256 64 '2^256 - 2^224 + 2^192 + 2^96 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp */
 /* curve description: p256 */
 /* machine_wordsize = 64 (from "64") */
@@ -175,13 +165,6 @@ static FIAT_P256_FIAT_INLINE void fiat_p256_cmovznz_u64(uint64_t* out1, fiat_p25
  *
  */
 static FIAT_P256_FIAT_INLINE void fiat_p256_mul(fiat_p256_montgomery_domain_field_element out1, const fiat_p256_montgomery_domain_field_element arg1, const fiat_p256_montgomery_domain_field_element arg2) {
-#if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) && defined(__x86_64__)
-  if (CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable() &&
-    CRYPTO_is_ADX_capable()) {
-      fiat_p256_adx_mul(out1, arg1, arg2);
-      return;
-  }
-#endif
   uint64_t x1;
   uint64_t x2;
   uint64_t x3;
@@ -489,13 +472,6 @@ static FIAT_P256_FIAT_INLINE void fiat_p256_mul(fiat_p256_montgomery_domain_fiel
  *
  */
 static FIAT_P256_FIAT_INLINE void fiat_p256_square(fiat_p256_montgomery_domain_field_element out1, const fiat_p256_montgomery_domain_field_element arg1) {
-#if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) && defined(__x86_64__)
-  if (CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable() &&
-    CRYPTO_is_ADX_capable()) {
-      fiat_p256_adx_sqr(out1, arg1);
-      return;
-  }
-#endif
   uint64_t x1;
   uint64_t x2;
   uint64_t x3;
@@ -804,45 +780,8 @@ static FIAT_P256_FIAT_INLINE void fiat_p256_square(fiat_p256_montgomery_domain_f
  *
  */
 static FIAT_P256_FIAT_INLINE void fiat_p256_add(fiat_p256_montgomery_domain_field_element out1, const fiat_p256_montgomery_domain_field_element arg1, const fiat_p256_montgomery_domain_field_element arg2) {
-  uint64_t x1;
-  fiat_p256_uint1 x2;
-  uint64_t x3;
-  fiat_p256_uint1 x4;
-  uint64_t x5;
-  fiat_p256_uint1 x6;
-  uint64_t x7;
-  fiat_p256_uint1 x8;
-  uint64_t x9;
-  fiat_p256_uint1 x10;
-  uint64_t x11;
-  fiat_p256_uint1 x12;
-  uint64_t x13;
-  fiat_p256_uint1 x14;
-  uint64_t x15;
-  fiat_p256_uint1 x16;
-  uint64_t x17;
-  fiat_p256_uint1 x18;
-  uint64_t x19;
-  uint64_t x20;
-  uint64_t x21;
-  uint64_t x22;
-  fiat_p256_addcarryx_u64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
-  fiat_p256_addcarryx_u64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
-  fiat_p256_addcarryx_u64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
-  fiat_p256_addcarryx_u64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
-  fiat_p256_subborrowx_u64(&x9, &x10, 0x0, x1, UINT64_C(0xffffffffffffffff));
-  fiat_p256_subborrowx_u64(&x11, &x12, x10, x3, UINT32_C(0xffffffff));
-  fiat_p256_subborrowx_u64(&x13, &x14, x12, x5, 0x0);
-  fiat_p256_subborrowx_u64(&x15, &x16, x14, x7, UINT64_C(0xffffffff00000001));
-  fiat_p256_subborrowx_u64(&x17, &x18, x16, x8, 0x0);
-  fiat_p256_cmovznz_u64(&x19, x18, x9, x1);
-  fiat_p256_cmovznz_u64(&x20, x18, x11, x3);
-  fiat_p256_cmovznz_u64(&x21, x18, x13, x5);
-  fiat_p256_cmovznz_u64(&x22, x18, x15, x7);
-  out1[0] = x19;
-  out1[1] = x20;
-  out1[2] = x21;
-  out1[3] = x22;
+  // NOTE: edited by hand, see third_party/fiat/README.md
+  p256_coord_add((br_word_t)out1, (br_word_t)arg1, (br_word_t)arg2);
 }
 
 /*
@@ -857,36 +796,8 @@ static FIAT_P256_FIAT_INLINE void fiat_p256_add(fiat_p256_montgomery_domain_fiel
  *
  */
 static FIAT_P256_FIAT_INLINE void fiat_p256_sub(fiat_p256_montgomery_domain_field_element out1, const fiat_p256_montgomery_domain_field_element arg1, const fiat_p256_montgomery_domain_field_element arg2) {
-  uint64_t x1;
-  fiat_p256_uint1 x2;
-  uint64_t x3;
-  fiat_p256_uint1 x4;
-  uint64_t x5;
-  fiat_p256_uint1 x6;
-  uint64_t x7;
-  fiat_p256_uint1 x8;
-  uint64_t x9;
-  uint64_t x10;
-  fiat_p256_uint1 x11;
-  uint64_t x12;
-  fiat_p256_uint1 x13;
-  uint64_t x14;
-  fiat_p256_uint1 x15;
-  uint64_t x16;
-  fiat_p256_uint1 x17;
-  fiat_p256_subborrowx_u64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
-  fiat_p256_subborrowx_u64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
-  fiat_p256_subborrowx_u64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
-  fiat_p256_subborrowx_u64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
-  fiat_p256_cmovznz_u64(&x9, x8, 0x0, UINT64_C(0xffffffffffffffff));
-  fiat_p256_addcarryx_u64(&x10, &x11, 0x0, x1, x9);
-  fiat_p256_addcarryx_u64(&x12, &x13, x11, x3, (x9 & UINT32_C(0xffffffff)));
-  fiat_p256_addcarryx_u64(&x14, &x15, x13, x5, 0x0);
-  fiat_p256_addcarryx_u64(&x16, &x17, x15, x7, (x9 & UINT64_C(0xffffffff00000001)));
-  out1[0] = x10;
-  out1[1] = x12;
-  out1[2] = x14;
-  out1[3] = x16;
+  // NOTE: edited by hand, see third_party/fiat/README.md
+  p256_coord_sub((br_word_t)out1, (br_word_t)arg1, (br_word_t)arg2);
 }
 
 /*

data/third_party/boringssl-with-bazel/third_party/fiat/p256_64_msvc.h

@@ -771,45 +771,8 @@ static FIAT_P256_FIAT_INLINE void fiat_p256_square(fiat_p256_montgomery_domain_f
  *
  */
 static FIAT_P256_FIAT_INLINE void fiat_p256_add(fiat_p256_montgomery_domain_field_element out1, const fiat_p256_montgomery_domain_field_element arg1, const fiat_p256_montgomery_domain_field_element arg2) {
-  uint64_t x1;
-  fiat_p256_uint1 x2;
-  uint64_t x3;
-  fiat_p256_uint1 x4;
-  uint64_t x5;
-  fiat_p256_uint1 x6;
-  uint64_t x7;
-  fiat_p256_uint1 x8;
-  uint64_t x9;
-  fiat_p256_uint1 x10;
-  uint64_t x11;
-  fiat_p256_uint1 x12;
-  uint64_t x13;
-  fiat_p256_uint1 x14;
-  uint64_t x15;
-  fiat_p256_uint1 x16;
-  uint64_t x17;
-  fiat_p256_uint1 x18;
-  uint64_t x19;
-  uint64_t x20;
-  uint64_t x21;
-  uint64_t x22;
-  fiat_p256_addcarryx_u64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
-  fiat_p256_addcarryx_u64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
-  fiat_p256_addcarryx_u64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
-  fiat_p256_addcarryx_u64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
-  fiat_p256_subborrowx_u64(&x9, &x10, 0x0, x1, UINT64_C(0xffffffffffffffff));
-  fiat_p256_subborrowx_u64(&x11, &x12, x10, x3, UINT32_C(0xffffffff));
-  fiat_p256_subborrowx_u64(&x13, &x14, x12, x5, 0x0);
-  fiat_p256_subborrowx_u64(&x15, &x16, x14, x7, UINT64_C(0xffffffff00000001));
-  fiat_p256_subborrowx_u64(&x17, &x18, x16, x8, 0x0);
-  fiat_p256_cmovznz_u64(&x19, x18, x9, x1);
-  fiat_p256_cmovznz_u64(&x20, x18, x11, x3);
-  fiat_p256_cmovznz_u64(&x21, x18, x13, x5);
-  fiat_p256_cmovznz_u64(&x22, x18, x15, x7);
-  out1[0] = x19;
-  out1[1] = x20;
-  out1[2] = x21;
-  out1[3] = x22;
+  // NOTE: edited by hand, see third_party/fiat/README.md
+  p256_coord_add((br_word_t)out1, (br_word_t)arg1, (br_word_t)arg2);
 }
 
 /*
@@ -824,36 +787,8 @@ static FIAT_P256_FIAT_INLINE void fiat_p256_add(fiat_p256_montgomery_domain_fiel
  *
  */
 static FIAT_P256_FIAT_INLINE void fiat_p256_sub(fiat_p256_montgomery_domain_field_element out1, const fiat_p256_montgomery_domain_field_element arg1, const fiat_p256_montgomery_domain_field_element arg2) {
-  uint64_t x1;
-  fiat_p256_uint1 x2;
-  uint64_t x3;
-  fiat_p256_uint1 x4;
-  uint64_t x5;
-  fiat_p256_uint1 x6;
-  uint64_t x7;
-  fiat_p256_uint1 x8;
-  uint64_t x9;
-  uint64_t x10;
-  fiat_p256_uint1 x11;
-  uint64_t x12;
-  fiat_p256_uint1 x13;
-  uint64_t x14;
-  fiat_p256_uint1 x15;
-  uint64_t x16;
-  fiat_p256_uint1 x17;
-  fiat_p256_subborrowx_u64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
-  fiat_p256_subborrowx_u64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
-  fiat_p256_subborrowx_u64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
-  fiat_p256_subborrowx_u64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
-  fiat_p256_cmovznz_u64(&x9, x8, 0x0, UINT64_C(0xffffffffffffffff));
-  fiat_p256_addcarryx_u64(&x10, &x11, 0x0, x1, x9);
-  fiat_p256_addcarryx_u64(&x12, &x13, x11, x3, (x9 & UINT32_C(0xffffffff)));
-  fiat_p256_addcarryx_u64(&x14, &x15, x13, x5, 0x0);
-  fiat_p256_addcarryx_u64(&x16, &x17, x15, x7, (x9 & UINT64_C(0xffffffff00000001)));
-  out1[0] = x10;
-  out1[1] = x12;
-  out1[2] = x14;
-  out1[3] = x16;
+  // NOTE: edited by hand, see third_party/fiat/README.md
+  p256_coord_sub((br_word_t)out1, (br_word_t)arg1, (br_word_t)arg2);
 }
 
 /*