238   ctx->Yi.u[0] = 0;  in CRYPTO_gcm128_setiv()
239   ctx->Yi.u[1] = 0;  in CRYPTO_gcm128_setiv()
249     OPENSSL_memcpy(ctx->Yi.c, iv, 12);  in CRYPTO_gcm128_setiv()
250     ctx->Yi.c[15] = 1;  in CRYPTO_gcm128_setiv()
257         ctx->Yi.c[i] ^= iv[i];  in CRYPTO_gcm128_setiv()
259       GCM_MUL(ctx, Yi);  in CRYPTO_gcm128_setiv()
265         ctx->Yi.c[i] ^= iv[i];  in CRYPTO_gcm128_setiv()
267       GCM_MUL(ctx, Yi);  in CRYPTO_gcm128_setiv()
270     ctx->Yi.u[1] ^= CRYPTO_bswap8(len0);  in CRYPTO_gcm128_setiv()
272     GCM_MUL(ctx, Yi);  in CRYPTO_gcm128_setiv()
273     ctr = CRYPTO_bswap4(ctx->Yi.d[3]);  in CRYPTO_gcm128_setiv()
276   (*ctx->gcm_key.block)(ctx->Yi.c, ctx->EK0.c, key);  in CRYPTO_gcm128_setiv()
278   ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_setiv()
372   uint32_t ctr = CRYPTO_bswap4(ctx->Yi.d[3]);  in CRYPTO_gcm128_encrypt()
377       (*block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_encrypt()
379       ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_encrypt()
395       (*block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_encrypt()
397       ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_encrypt()
410     (*block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_encrypt()
412     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_encrypt()
464   uint32_t ctr = CRYPTO_bswap4(ctx->Yi.d[3]);  in CRYPTO_gcm128_decrypt()
470       (*block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_decrypt()
472       ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_decrypt()
488       (*block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_decrypt()
490       ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_decrypt()
502     (*block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_decrypt()
504     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_decrypt()
560     size_t bulk = aesni_gcm_encrypt(in, out, len, key, ctx->Yi.c, ctx->Xi.u);  in CRYPTO_gcm128_encrypt_ctr32()
567   uint32_t ctr = CRYPTO_bswap4(ctx->Yi.d[3]);  in CRYPTO_gcm128_encrypt_ctr32()
569     (*stream)(in, out, GHASH_CHUNK / 16, key, ctx->Yi.c);  in CRYPTO_gcm128_encrypt_ctr32()
571     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_encrypt_ctr32()
581     (*stream)(in, out, j, key, ctx->Yi.c);  in CRYPTO_gcm128_encrypt_ctr32()
583     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_encrypt_ctr32()
590     (*ctx->gcm_key.block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_encrypt_ctr32()
592     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_encrypt_ctr32()
648     size_t bulk = aesni_gcm_decrypt(in, out, len, key, ctx->Yi.c, ctx->Xi.u);  in CRYPTO_gcm128_decrypt_ctr32()
655   uint32_t ctr = CRYPTO_bswap4(ctx->Yi.d[3]);  in CRYPTO_gcm128_decrypt_ctr32()
658     (*stream)(in, out, GHASH_CHUNK / 16, key, ctx->Yi.c);  in CRYPTO_gcm128_decrypt_ctr32()
660     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_decrypt_ctr32()
670     (*stream)(in, out, j, key, ctx->Yi.c);  in CRYPTO_gcm128_decrypt_ctr32()
672     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_decrypt_ctr32()
678     (*ctx->gcm_key.block)(ctx->Yi.c, ctx->EKi.c, key);  in CRYPTO_gcm128_decrypt_ctr32()
680     ctx->Yi.d[3] = CRYPTO_bswap4(ctr);  in CRYPTO_gcm128_decrypt_ctr32()