WORD_BITS
#define BIT_LEN_WORDS(nbits) (((nbits) + WORD_BITS - 1) / WORD_BITS)
#define BIT_LEN_CEIL(nbits) (BIT_LEN_WORDS(nbits) * WORD_BITS)
#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(USER_NN_BIT_LEN, WORD_BITS)
#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(CURVES_MAX_P_BIT_LEN, WORD_BITS)
#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(USER_NN_BIT_LEN, WORD_BITS)
#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(CURVES_MAX_CURVE_ORDER_BIT_LEN, WORD_BITS)
#if NN_MAX_BIT_LEN < MAX_BIT_LEN_ROUNDING(((8 * MAX_DIGEST_SIZE) / 2), WORD_BITS)
#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(((8 * MAX_DIGEST_SIZE) / 2), WORD_BITS)
#if NN_MAX_BIT_LEN < MAX_BIT_LEN_ROUNDING((8 * SHA512_DIGEST_SIZE), WORD_BITS)
#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING((8 * SHA512_DIGEST_SIZE), WORD_BITS)
#define NN_USABLE_MAX_WORD_LEN ((BIT_LEN_ROUNDING(NN_USABLE_MAX_BIT_LEN, WORD_BITS)) / WORD_BITS)
#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(CURVES_MAX_P_BIT_LEN, WORD_BITS)
#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(CURVES_MAX_CURVE_ORDER_BIT_LEN, WORD_BITS)
#define WLSHIFT(w, c) ((word_t)(((c) >= WORD_BITS) ? WORD(0) : (word_t)((w) << (c))))
#define WRSHIFT(w, c) ((word_t)(((c) >= WORD_BITS) ? WORD(0) : (word_t)((w) >> (c))))
#define WORD_HIGHBIT (WORD(1) << (WORD_BITS - 1))
#define WORD_BYTES (WORD_BITS / 8)
#define WORD_BYTES (WORD_BITS / 8)
#define WORD_BYTES (WORD_BITS / 8)
(WORD_BITS * (y.wlen + a.wlen))), ret, err);
MUST_HAVE((NN_MAX_BIT_LEN >= (2 * WORD_BITS * a.wlen)), ret, err);
(2 * WORD_BITS * y.wlen)), ret, err);
MUST_HAVE(!(!((b->val[b->wlen - 1] >> (WORD_BITS - 1)) == WORD(1))), ret, err);
MUST_HAVE((WRSHIFT((b), (WORD_BITS - 1)) == WORD(1)), ret, err);
p_rounded_bitlen = (bitcnt_t)(WORD_BITS * p.wlen);
dec = cnt / WORD_BITS;
hshift = cnt % WORD_BITS;
lshift = (bitcnt_t)(WORD_BITS - hshift);
dec = cnt / WORD_BITS;
lshift = cnt % WORD_BITS;
hshift = (bitcnt_t)(WORD_BITS - lshift);
dec = cnt / WORD_BITS;
lshift = cnt % WORD_BITS;
hshift = (bitcnt_t)(WORD_BITS - lshift);
if (((bitlen % WORD_BITS) != 0) && (out->wlen > 0)) {
word_t mask = (word_t)(((word_t)(WORD(1) << (bitlen % WORD_BITS))) - 1);
if (((bitlen % WORD_BITS) != 0) && (out->wlen > 0)) {
word_t mask = (word_t)(((word_t)(WORD(1) << (bitlen % WORD_BITS))) - 1);
u8 cnt = WORD_BITS, over = 0;
for (i = (WORD_BITS - 1); i >= 0; i--) {
dec = cnt / WORD_BITS;
hshift = cnt % WORD_BITS;
cnt = (bitcnt_t)(cnt + WORD_BITS);
lshift = (bitcnt_t)(WORD_BITS - hshift);
_blen = (bitcnt_t)((i * WORD_BITS) - wclz(in->val[i - 1]));
bitcnt_t widx = bit / WORD_BITS;
u8 bidx = bit % WORD_BITS;
cnt = (bitcnt_t)((a.wlen + b.wlen) * WORD_BITS);
bitcnt_t exp_cnt = exp % WORD_BITS;
for (; cnt < WORD_MIN(WORD_BITS, exp); cnt = (bitcnt_t)(cnt << 1)) {
if (exp > WORD_BITS) {
MUST_HAVE(((WORD_BITS * (out->wlen + 1)) <= NN_MAX_BIT_LEN), ret, err);
p_rounded_bitlen = (bitcnt_t)(WORD_BITS * p.wlen);
ret = nn_modinv_2exp(&tmp_nn1, &p, WORD_BITS, &isodd); EG(ret, err);