147 	u128 Z = { 0, 0};  in gcm_gmult_8bit()  local
218 		Z.hi ^= Htable[n].hi;  in gcm_gmult_8bit()
219 		Z.lo ^= Htable[n].lo;  in gcm_gmult_8bit()
225 		rem  = (size_t)Z.lo&0xff;  in gcm_gmult_8bit()
226 		Z.lo = (Z.hi<<56)|(Z.lo>>8);  in gcm_gmult_8bit()
227 		Z.hi = (Z.hi>>8);  in gcm_gmult_8bit()
229 			Z.hi ^= rem_8bit[rem];  in gcm_gmult_8bit()
231 			Z.hi ^= (u64)rem_8bit[rem]<<32;  in gcm_gmult_8bit()
236 		Xi[0] = BSWAP8(Z.hi);  in gcm_gmult_8bit()
237 		Xi[1] = BSWAP8(Z.lo);  in gcm_gmult_8bit()
241 		v = (u32)(Z.hi>>32);	PUTU32(p,v);  in gcm_gmult_8bit()
242 		v = (u32)(Z.hi);	PUTU32(p+4,v);  in gcm_gmult_8bit()
243 		v = (u32)(Z.lo>>32);	PUTU32(p+8,v);  in gcm_gmult_8bit()
244 		v = (u32)(Z.lo);	PUTU32(p+12,v);  in gcm_gmult_8bit()
248 		Xi[0] = Z.hi;  in gcm_gmult_8bit()
249 		Xi[1] = Z.lo;  in gcm_gmult_8bit()
337 	u128 Z;  in gcm_gmult_4bit()  local
346 	Z.hi = Htable[nlo].hi;  in gcm_gmult_4bit()
347 	Z.lo = Htable[nlo].lo;  in gcm_gmult_4bit()
350 		rem  = (size_t)Z.lo&0xf;  in gcm_gmult_4bit()
351 		Z.lo = (Z.hi<<60)|(Z.lo>>4);  in gcm_gmult_4bit()
352 		Z.hi = (Z.hi>>4);  in gcm_gmult_4bit()
354 			Z.hi ^= rem_4bit[rem];  in gcm_gmult_4bit()
356 			Z.hi ^= (u64)rem_4bit[rem]<<32;  in gcm_gmult_4bit()
358 		Z.hi ^= Htable[nhi].hi;  in gcm_gmult_4bit()
359 		Z.lo ^= Htable[nhi].lo;  in gcm_gmult_4bit()
367 		rem  = (size_t)Z.lo&0xf;  in gcm_gmult_4bit()
368 		Z.lo = (Z.hi<<60)|(Z.lo>>4);  in gcm_gmult_4bit()
369 		Z.hi = (Z.hi>>4);  in gcm_gmult_4bit()
371 			Z.hi ^= rem_4bit[rem];  in gcm_gmult_4bit()
373 			Z.hi ^= (u64)rem_4bit[rem]<<32;  in gcm_gmult_4bit()
375 		Z.hi ^= Htable[nlo].hi;  in gcm_gmult_4bit()
376 		Z.lo ^= Htable[nlo].lo;  in gcm_gmult_4bit()
381 		Xi[0] = BSWAP8(Z.hi);  in gcm_gmult_4bit()
382 		Xi[1] = BSWAP8(Z.lo);  in gcm_gmult_4bit()
386 		v = (u32)(Z.hi>>32);	PUTU32(p,v);  in gcm_gmult_4bit()
387 		v = (u32)(Z.hi);	PUTU32(p+4,v);  in gcm_gmult_4bit()
388 		v = (u32)(Z.lo>>32);	PUTU32(p+8,v);  in gcm_gmult_4bit()
389 		v = (u32)(Z.lo);	PUTU32(p+12,v);  in gcm_gmult_4bit()
393 		Xi[0] = Z.hi;  in gcm_gmult_4bit()
394 		Xi[1] = Z.lo;  in gcm_gmult_4bit()
409     u128 Z;  local
422 	Z.hi = Htable[nlo].hi;
423 	Z.lo = Htable[nlo].lo;
426 		rem  = (size_t)Z.lo&0xf;
427 		Z.lo = (Z.hi<<60)|(Z.lo>>4);
428 		Z.hi = (Z.hi>>4);
430 			Z.hi ^= rem_4bit[rem];
432 			Z.hi ^= (u64)rem_4bit[rem]<<32;
434 		Z.hi ^= Htable[nhi].hi;
435 		Z.lo ^= Htable[nhi].lo;
444 		rem  = (size_t)Z.lo&0xf;
445 		Z.lo = (Z.hi<<60)|(Z.lo>>4);
446 		Z.hi = (Z.hi>>4);
448 			Z.hi ^= rem_4bit[rem];
450 			Z.hi ^= (u64)rem_4bit[rem]<<32;
452 		Z.hi ^= Htable[nlo].hi;
453 		Z.lo ^= Htable[nlo].lo;
504 	Z.hi = Htable[cnt].hi;
505 	Z.lo = Htable[cnt].lo;
506 	Hshr4[cnt].lo = (Z.hi<<60)|(Z.lo>>4);
507 	Hshr4[cnt].hi = (Z.hi>>4);
508 	Hshl4[cnt]    = (u8)(Z.lo<<4);
512 	for (Z.lo=0, Z.hi=0, cnt=15; cnt; --cnt) {
518 		Z.hi ^= Htable[nlo].hi;
519 		Z.lo ^= Htable[nlo].lo;
521 		rem = (size_t)Z.lo&0xff;
523 		Z.lo = (Z.hi<<56)|(Z.lo>>8);
524 		Z.hi = (Z.hi>>8);
526 		Z.hi ^= Hshr4[nhi].hi;
527 		Z.lo ^= Hshr4[nhi].lo;
528 		Z.hi ^= (u64)rem_8bit[rem^Hshl4[nhi]]<<48;
536 	Z.hi ^= Htable[nlo].hi;
537 	Z.lo ^= Htable[nlo].lo;
539 	rem = (size_t)Z.lo&0xf;
541 	Z.lo = (Z.hi<<60)|(Z.lo>>4);
542 	Z.hi = (Z.hi>>4);
544 	Z.hi ^= Htable[nhi].hi;
545 	Z.lo ^= Htable[nhi].lo;
546 	Z.hi ^= ((u64)rem_8bit[rem<<4])<<48;
551 		Xi[0] = BSWAP8(Z.hi);
552 		Xi[1] = BSWAP8(Z.lo);
556 		v = (u32)(Z.hi>>32);	PUTU32(p,v);
557 		v = (u32)(Z.hi);	PUTU32(p+4,v);
558 		v = (u32)(Z.lo>>32);	PUTU32(p+8,v);
559 		v = (u32)(Z.lo);	PUTU32(p+12,v);
563 		Xi[0] = Z.hi;
564 		Xi[1] = Z.lo;
587 	u128 V,Z = { 0,0 };  local
616 			Z.hi ^= V.hi&M;
617 			Z.lo ^= V.lo&M;
625 		Xi[0] = BSWAP8(Z.hi);
626 		Xi[1] = BSWAP8(Z.lo);
630 		v = (u32)(Z.hi>>32);	PUTU32(p,v);
631 		v = (u32)(Z.hi);	PUTU32(p+4,v);
632 		v = (u32)(Z.lo>>32);	PUTU32(p+8,v);
633 		v = (u32)(Z.lo);	PUTU32(p+12,v);
637 		Xi[0] = Z.hi;
638 		Xi[1] = Z.lo;