278 	const __m128i *KEY = (const __m128i *)key;  in AES_GCM_encrypt()  local
294 		tmp1 = _mm_xor_si128(X, KEY[0]);  in AES_GCM_encrypt()
295 		tmp2 = _mm_xor_si128(Y, KEY[0]);  in AES_GCM_encrypt()
297 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j]);  in AES_GCM_encrypt()
298 			tmp2 = _mm_aesenc_si128(tmp2, KEY[j]);  in AES_GCM_encrypt()
300 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j+1]);  in AES_GCM_encrypt()
301 			tmp2 = _mm_aesenc_si128(tmp2, KEY[j+1]);  in AES_GCM_encrypt()
303 		tmp1 = _mm_aesenc_si128(tmp1, KEY[nr-1]);  in AES_GCM_encrypt()
304 		tmp2 = _mm_aesenc_si128(tmp2, KEY[nr-1]);  in AES_GCM_encrypt()
306 		H = _mm_aesenclast_si128(tmp1, KEY[nr]);  in AES_GCM_encrypt()
307 		T = _mm_aesenclast_si128(tmp2, KEY[nr]);  in AES_GCM_encrypt()
311 		tmp1 = _mm_xor_si128(X, KEY[0]);  in AES_GCM_encrypt()
313 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j]);  in AES_GCM_encrypt()
314 		H = _mm_aesenclast_si128(tmp1, KEY[nr]);  in AES_GCM_encrypt()
339 		tmp1 = _mm_xor_si128(Y, KEY[0]);  in AES_GCM_encrypt()
341 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j]);  in AES_GCM_encrypt()
342 		T = _mm_aesenclast_si128(tmp1, KEY[nr]);  in AES_GCM_encrypt()
408 		tmp1 =_mm_xor_si128(tmp1, KEY[0]);  in AES_GCM_encrypt()
409 		tmp2 =_mm_xor_si128(tmp2, KEY[0]);  in AES_GCM_encrypt()
410 		tmp3 =_mm_xor_si128(tmp3, KEY[0]);  in AES_GCM_encrypt()
411 		tmp4 =_mm_xor_si128(tmp4, KEY[0]);  in AES_GCM_encrypt()
412 		tmp5 =_mm_xor_si128(tmp5, KEY[0]);  in AES_GCM_encrypt()
413 		tmp6 =_mm_xor_si128(tmp6, KEY[0]);  in AES_GCM_encrypt()
414 		tmp7 =_mm_xor_si128(tmp7, KEY[0]);  in AES_GCM_encrypt()
415 		tmp8 =_mm_xor_si128(tmp8, KEY[0]);  in AES_GCM_encrypt()
418 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j]);  in AES_GCM_encrypt()
419 			tmp2 = _mm_aesenc_si128(tmp2, KEY[j]);  in AES_GCM_encrypt()
420 			tmp3 = _mm_aesenc_si128(tmp3, KEY[j]);  in AES_GCM_encrypt()
421 			tmp4 = _mm_aesenc_si128(tmp4, KEY[j]);  in AES_GCM_encrypt()
422 			tmp5 = _mm_aesenc_si128(tmp5, KEY[j]);  in AES_GCM_encrypt()
423 			tmp6 = _mm_aesenc_si128(tmp6, KEY[j]);  in AES_GCM_encrypt()
424 			tmp7 = _mm_aesenc_si128(tmp7, KEY[j]);  in AES_GCM_encrypt()
425 			tmp8 = _mm_aesenc_si128(tmp8, KEY[j]);  in AES_GCM_encrypt()
427 		tmp1 =_mm_aesenclast_si128(tmp1, KEY[nr]);  in AES_GCM_encrypt()
428 		tmp2 =_mm_aesenclast_si128(tmp2, KEY[nr]);  in AES_GCM_encrypt()
429 		tmp3 =_mm_aesenclast_si128(tmp3, KEY[nr]);  in AES_GCM_encrypt()
430 		tmp4 =_mm_aesenclast_si128(tmp4, KEY[nr]);  in AES_GCM_encrypt()
431 		tmp5 =_mm_aesenclast_si128(tmp5, KEY[nr]);  in AES_GCM_encrypt()
432 		tmp6 =_mm_aesenclast_si128(tmp6, KEY[nr]);  in AES_GCM_encrypt()
433 		tmp7 =_mm_aesenclast_si128(tmp7, KEY[nr]);  in AES_GCM_encrypt()
434 		tmp8 =_mm_aesenclast_si128(tmp8, KEY[nr]);  in AES_GCM_encrypt()
481 		tmp1 = _mm_xor_si128(tmp1, KEY[0]);  in AES_GCM_encrypt()
483 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j]);  in AES_GCM_encrypt()
484 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j+1]);  in AES_GCM_encrypt()
486 		tmp1 = _mm_aesenc_si128(tmp1, KEY[nr-1]);  in AES_GCM_encrypt()
487 		tmp1 = _mm_aesenclast_si128(tmp1, KEY[nr]);  in AES_GCM_encrypt()
498 		tmp1 = _mm_xor_si128(tmp1, KEY[0]);  in AES_GCM_encrypt()
500 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j]);  in AES_GCM_encrypt()
501 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j+1]);  in AES_GCM_encrypt()
503 		tmp1 = _mm_aesenc_si128(tmp1, KEY[nr-1]);  in AES_GCM_encrypt()
504 		tmp1 = _mm_aesenclast_si128(tmp1, KEY[nr]);  in AES_GCM_encrypt()
539 	const __m128i *KEY = (const __m128i *)key;  in AES_GCM_decrypt()  local
555 		tmp1 = _mm_xor_si128(X, KEY[0]);  in AES_GCM_decrypt()
556 		tmp2 = _mm_xor_si128(Y, KEY[0]);  in AES_GCM_decrypt()
558 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j]);  in AES_GCM_decrypt()
559 			tmp2 = _mm_aesenc_si128(tmp2, KEY[j]);  in AES_GCM_decrypt()
561 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j+1]);  in AES_GCM_decrypt()
562 			tmp2 = _mm_aesenc_si128(tmp2, KEY[j+1]);  in AES_GCM_decrypt()
564 		tmp1 = _mm_aesenc_si128(tmp1, KEY[nr-1]);  in AES_GCM_decrypt()
565 		tmp2 = _mm_aesenc_si128(tmp2, KEY[nr-1]);  in AES_GCM_decrypt()
567 		H = _mm_aesenclast_si128(tmp1, KEY[nr]);  in AES_GCM_decrypt()
568 		T = _mm_aesenclast_si128(tmp2, KEY[nr]);  in AES_GCM_decrypt()
572 		tmp1 = _mm_xor_si128(X, KEY[0]);  in AES_GCM_decrypt()
574 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j]);  in AES_GCM_decrypt()
575 		H = _mm_aesenclast_si128(tmp1, KEY[nr]);  in AES_GCM_decrypt()
600 		tmp1 = _mm_xor_si128(Y, KEY[0]);  in AES_GCM_decrypt()
602 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j]);  in AES_GCM_decrypt()
603 		T = _mm_aesenclast_si128(tmp1, KEY[nr]);  in AES_GCM_decrypt()
713 		tmp1 =_mm_xor_si128(tmp1, KEY[0]);  in AES_GCM_decrypt()
714 		tmp2 =_mm_xor_si128(tmp2, KEY[0]);  in AES_GCM_decrypt()
715 		tmp3 =_mm_xor_si128(tmp3, KEY[0]);  in AES_GCM_decrypt()
716 		tmp4 =_mm_xor_si128(tmp4, KEY[0]);  in AES_GCM_decrypt()
717 		tmp5 =_mm_xor_si128(tmp5, KEY[0]);  in AES_GCM_decrypt()
718 		tmp6 =_mm_xor_si128(tmp6, KEY[0]);  in AES_GCM_decrypt()
719 		tmp7 =_mm_xor_si128(tmp7, KEY[0]);  in AES_GCM_decrypt()
720 		tmp8 =_mm_xor_si128(tmp8, KEY[0]);  in AES_GCM_decrypt()
723 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j]);  in AES_GCM_decrypt()
724 			tmp2 = _mm_aesenc_si128(tmp2, KEY[j]);  in AES_GCM_decrypt()
725 			tmp3 = _mm_aesenc_si128(tmp3, KEY[j]);  in AES_GCM_decrypt()
726 			tmp4 = _mm_aesenc_si128(tmp4, KEY[j]);  in AES_GCM_decrypt()
727 			tmp5 = _mm_aesenc_si128(tmp5, KEY[j]);  in AES_GCM_decrypt()
728 			tmp6 = _mm_aesenc_si128(tmp6, KEY[j]);  in AES_GCM_decrypt()
729 			tmp7 = _mm_aesenc_si128(tmp7, KEY[j]);  in AES_GCM_decrypt()
730 			tmp8 = _mm_aesenc_si128(tmp8, KEY[j]);  in AES_GCM_decrypt()
732 		tmp1 =_mm_aesenclast_si128(tmp1, KEY[nr]);  in AES_GCM_decrypt()
733 		tmp2 =_mm_aesenclast_si128(tmp2, KEY[nr]);  in AES_GCM_decrypt()
734 		tmp3 =_mm_aesenclast_si128(tmp3, KEY[nr]);  in AES_GCM_decrypt()
735 		tmp4 =_mm_aesenclast_si128(tmp4, KEY[nr]);  in AES_GCM_decrypt()
736 		tmp5 =_mm_aesenclast_si128(tmp5, KEY[nr]);  in AES_GCM_decrypt()
737 		tmp6 =_mm_aesenclast_si128(tmp6, KEY[nr]);  in AES_GCM_decrypt()
738 		tmp7 =_mm_aesenclast_si128(tmp7, KEY[nr]);  in AES_GCM_decrypt()
739 		tmp8 =_mm_aesenclast_si128(tmp8, KEY[nr]);  in AES_GCM_decrypt()
779 		tmp1 = _mm_xor_si128(tmp1, KEY[0]);  in AES_GCM_decrypt()
781 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j]);  in AES_GCM_decrypt()
782 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j+1]);  in AES_GCM_decrypt()
784 		tmp1 = _mm_aesenc_si128(tmp1, KEY[nr-1]);  in AES_GCM_decrypt()
785 		tmp1 = _mm_aesenclast_si128(tmp1, KEY[nr]);  in AES_GCM_decrypt()
793 		tmp1 = _mm_xor_si128(tmp1, KEY[0]);  in AES_GCM_decrypt()
795 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j]);  in AES_GCM_decrypt()
796 			tmp1 = _mm_aesenc_si128(tmp1, KEY[j+1]);  in AES_GCM_decrypt()
798 		tmp1 = _mm_aesenc_si128(tmp1, KEY[nr-1]);  in AES_GCM_decrypt()
799 		tmp1 = _mm_aesenclast_si128(tmp1, KEY[nr]);  in AES_GCM_decrypt()