128                       __m128i *cc, __m128i *dd)  in gcm_clmul()  argument
135     *dd = _mm_clmulepi64_si128(aa, bb, 0x11); // a1*b1 = d1:d0  in gcm_clmul()
142     *dd = _mm_xor_si128(*dd, ff);                    // d1:d0+e1+f1  in gcm_clmul()
146 static void gcm_shift(__m128i *cc, __m128i *dd)  in gcm_shift()  argument
153     __m128i dd_lo = _mm_slli_epi64(*dd, 1);   // r3<<1:r2<<1  in gcm_shift()
155     __m128i dd_hi = _mm_srli_epi64(*dd, 63);  // r3>>63:r2>>63  in gcm_shift()
161     *dd = _mm_or_si128(_mm_or_si128(dd_lo, dd_hi), xmm5); // r3<<1|r2>>62:r2<<1|r1>>63  in gcm_shift()
171     __m128i dd = _mm_slli_si128(_mm_xor_si128(_mm_xor_si128(aa, bb), cc), 8); // a+b+c:0  in gcm_reduce()  local
172     return _mm_xor_si128(dd, xx);                 // x1+a+b+c:x0 = d:x0  in gcm_reduce()
196     __m128i aa = { 0 }, bb = { 0 }, cc, dd;  in mbedtls_aesni_gcm_mult()  local
204     gcm_clmul(aa, bb, &cc, &dd);  in mbedtls_aesni_gcm_mult()
205     gcm_shift(&cc, &dd);  in mbedtls_aesni_gcm_mult()
213     cc = _mm_xor_si128(xh, dd); // x3+h1:x2+h0  in mbedtls_aesni_gcm_mult()