386   ctx->Yi.u[0] = 0;  in CRYPTO_gcm128_setiv()
387   ctx->Yi.u[1] = 0;  in CRYPTO_gcm128_setiv()
397     OPENSSL_memcpy(ctx->Yi.c, iv, 12);  in CRYPTO_gcm128_setiv()
398     ctx->Yi.c[15] = 1;  in CRYPTO_gcm128_setiv()
405         ctx->Yi.c[i] ^= iv[i];  in CRYPTO_gcm128_setiv()
407       GCM_MUL(ctx, Yi);  in CRYPTO_gcm128_setiv()
413         ctx->Yi.c[i] ^= iv[i];  in CRYPTO_gcm128_setiv()
415       GCM_MUL(ctx, Yi);  in CRYPTO_gcm128_setiv()
418     ctx->Yi.u[1] ^= CRYPTO_bswap8(len0);  in CRYPTO_gcm128_setiv()
420     GCM_MUL(ctx, Yi);  in CRYPTO_gcm128_setiv()
421     ctr = CRYPTO_bswap4(ctx->Yi.d[3]);  in CRYPTO_gcm128_setiv()
424   (*ctx->gcm_key.block)(ctx->Yi.c, ctx->EK0.c, key);  in CRYPTO_gcm128_setiv()
426   ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_setiv()
522   uint32_t ctr = CRYPTO_bswap4(ctx->Yi.d[3]);  in CRYPTO_gcm128_encrypt()
527       (*block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_encrypt()
529       ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_encrypt()
544       (*block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_encrypt()
546       ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_encrypt()
558     (*block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_encrypt()
560     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_encrypt()
612   uint32_t ctr = CRYPTO_bswap4(ctx->Yi.d[3]);  in CRYPTO_gcm128_decrypt()
618       (*block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_decrypt()
620       ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_decrypt()
635       (*block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_decrypt()
637       ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_decrypt()
648     (*block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_decrypt()
650     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_decrypt()
705     size_t bulk = aesni_gcm_encrypt(in, out, len, key, ctx->Yi.c, ctx->Xi.u);  in CRYPTO_gcm128_encrypt_ctr32()
712   uint32_t ctr = CRYPTO_bswap4(ctx->Yi.d[3]);  in CRYPTO_gcm128_encrypt_ctr32()
714     (*stream)(in, out, GHASH_CHUNK / 16, key, ctx->Yi.c);  in CRYPTO_gcm128_encrypt_ctr32()
716     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_encrypt_ctr32()
726     (*stream)(in, out, j, key, ctx->Yi.c);  in CRYPTO_gcm128_encrypt_ctr32()
728     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_encrypt_ctr32()
735     (*ctx->gcm_key.block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_encrypt_ctr32()
737     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_encrypt_ctr32()
792     size_t bulk = aesni_gcm_decrypt(in, out, len, key, ctx->Yi.c, ctx->Xi.u);  in CRYPTO_gcm128_decrypt_ctr32()
799   uint32_t ctr = CRYPTO_bswap4(ctx->Yi.d[3]);  in CRYPTO_gcm128_decrypt_ctr32()
802     (*stream)(in, out, GHASH_CHUNK / 16, key, ctx->Yi.c);  in CRYPTO_gcm128_decrypt_ctr32()
804     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_decrypt_ctr32()
814     (*stream)(in, out, j, key, ctx->Yi.c);  in CRYPTO_gcm128_decrypt_ctr32()
816     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_decrypt_ctr32()
822     (*ctx->gcm_key.block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_decrypt_ctr32()
824     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_decrypt_ctr32()