31 #define REDUCE1BIT(V)   do { \  argument
33                 u64 T = U64(0xe100000000000000) & (0-(V.lo&1)); \
34                 V.lo  = (V.hi<<63)|(V.lo>>1); \
35                 V.hi  = (V.hi>>1 )^T; \
38                 u32 T = 0xe1000000U & (0-(u32)(V.lo&1)); \
39                 V.lo  = (V.hi<<63)|(V.lo>>1); \
40                 V.hi  = (V.hi>>1 )^((u64)T<<32); \
83     u128 V;  in gcm_init_8bit()  local
87     V.hi = H[0];  in gcm_init_8bit()
88     V.lo = H[1];  in gcm_init_8bit()
90     for (Htable[128] = V, i = 64; i > 0; i >>= 1) {  in gcm_init_8bit()
91         REDUCE1BIT(V);  in gcm_init_8bit()
92         Htable[i] = V;  in gcm_init_8bit()
223     u128 V;  in gcm_init_4bit()  local
230     V.hi = H[0];  in gcm_init_4bit()
231     V.lo = H[1];  in gcm_init_4bit()
234     for (Htable[8] = V, i = 4; i > 0; i >>= 1) {  in gcm_init_4bit()
235         REDUCE1BIT(V);  in gcm_init_4bit()
236         Htable[i] = V;  in gcm_init_4bit()
242         for (V = *Hi, j = 1; j < i; ++j) {  in gcm_init_4bit()
243             Hi[j].hi = V.hi ^ Htable[j].hi;  in gcm_init_4bit()
244             Hi[j].lo = V.lo ^ Htable[j].lo;  in gcm_init_4bit()
248     Htable[8] = V;  in gcm_init_4bit()
249     REDUCE1BIT(V);  in gcm_init_4bit()
250     Htable[4] = V;  in gcm_init_4bit()
251     REDUCE1BIT(V);  in gcm_init_4bit()
252     Htable[2] = V;  in gcm_init_4bit()
253     REDUCE1BIT(V);  in gcm_init_4bit()
254     Htable[1] = V;  in gcm_init_4bit()
255     Htable[3].hi = V.hi ^ Htable[2].hi, Htable[3].lo = V.lo ^ Htable[2].lo;  in gcm_init_4bit()
256     V = Htable[4];  in gcm_init_4bit()
257     Htable[5].hi = V.hi ^ Htable[1].hi, Htable[5].lo = V.lo ^ Htable[1].lo;  in gcm_init_4bit()
258     Htable[6].hi = V.hi ^ Htable[2].hi, Htable[6].lo = V.lo ^ Htable[2].lo;  in gcm_init_4bit()
259     Htable[7].hi = V.hi ^ Htable[3].hi, Htable[7].lo = V.lo ^ Htable[3].lo;  in gcm_init_4bit()
260     V = Htable[8];  in gcm_init_4bit()
261     Htable[9].hi = V.hi ^ Htable[1].hi, Htable[9].lo = V.lo ^ Htable[1].lo;  in gcm_init_4bit()
262     Htable[10].hi = V.hi ^ Htable[2].hi, Htable[10].lo = V.lo ^ Htable[2].lo;  in gcm_init_4bit()
263     Htable[11].hi = V.hi ^ Htable[3].hi, Htable[11].lo = V.lo ^ Htable[3].lo;  in gcm_init_4bit()
264     Htable[12].hi = V.hi ^ Htable[4].hi, Htable[12].lo = V.lo ^ Htable[4].lo;  in gcm_init_4bit()
265     Htable[13].hi = V.hi ^ Htable[5].hi, Htable[13].lo = V.lo ^ Htable[5].lo;  in gcm_init_4bit()
266     Htable[14].hi = V.hi ^ Htable[6].hi, Htable[14].lo = V.lo ^ Htable[6].lo;  in gcm_init_4bit()
267     Htable[15].hi = V.hi ^ Htable[7].hi, Htable[15].lo = V.lo ^ Htable[7].lo;  in gcm_init_4bit()
279                 V = Htable[j];  in gcm_init_4bit()
280                 Htable[j].hi = V.lo;  in gcm_init_4bit()
281                 Htable[j].lo = V.hi;  in gcm_init_4bit()
284                 V = Htable[j];  in gcm_init_4bit()
285                 Htable[j].hi = V.lo << 32 | V.lo >> 32;  in gcm_init_4bit()
286                 Htable[j].lo = V.hi << 32 | V.hi >> 32;  in gcm_init_4bit()
564     u128 V, Z = { 0, 0 };  local
570     V.hi = H[0];                /* H is in host byte order, no byte swapping */
571     V.lo = H[1];
591             Z.hi ^= V.hi & M;
592             Z.lo ^= V.lo & M;
594             REDUCE1BIT(V);