diff -up ./configure.ac.ghash ./configure.ac

--- ./configure.ac.ghash	2021-07-14 14:11:58.126891572 +0200

+++ ./configure.ac	2021-07-14 14:11:58.130891552 +0200

@@ -211,6 +211,22 @@ AC_C_BIGENDIAN([AC_DEFINE([WORDS_BIGENDI

 		ASM_WORDS_BIGENDIAN=yes],

 	[ASM_WORDS_BIGENDIAN=no])

+AC_CACHE_CHECK([for __builtin_bswap64],

+		nettle_cv_c_builtin_bswap64,

+[AC_TRY_LINK([

+#include <stdint.h>

+],[

+uint64_t x = 17;

+uint64_t y = __builtin_bswap64(x);

+],

+nettle_cv_c_builtin_bswap64=yes,

+nettle_cv_c_builtin_bswap64=no)])

+

+AH_TEMPLATE([HAVE_BUILTIN_BSWAP64], [Define if __builtin_bswap64 is available])

+if test "x$nettle_cv_c_builtin_bswap64" = "xyes" ; then

+  AC_DEFINE(HAVE_BUILTIN_BSWAP64)

+fi

+

 LSH_GCC_ATTRIBUTES

 # According to Simon Josefsson, looking for uint32_t and friends in

@@ -472,7 +488,7 @@ asm_replace_list="aes-encrypt-internal.a

 		sha3-permute.asm umac-nh.asm umac-nh-n.asm machine.m4"

 # Assembler files which generate additional object files if they are used.

-asm_nettle_optional_list="gcm-hash8.asm cpuid.asm \

+asm_nettle_optional_list="gcm-hash.asm gcm-hash8.asm cpuid.asm \

   aes-encrypt-internal-2.asm aes-decrypt-internal-2.asm memxor-2.asm \

   salsa20-core-internal-2.asm sha1-compress-2.asm sha256-compress-2.asm \

   sha3-permute-2.asm sha512-compress-2.asm \

@@ -588,6 +604,10 @@ AH_VERBATIM([HAVE_NATIVE],

 #undef HAVE_NATIVE_ecc_384_redc

 #undef HAVE_NATIVE_ecc_521_modp

 #undef HAVE_NATIVE_ecc_521_redc

+#undef HAVE_NATIVE_gcm_init_key

+#undef HAVE_NATIVE_fat_gcm_init_key

+#undef HAVE_NATIVE_gcm_hash

+#undef HAVE_NATIVE_fat_gcm_hash

 #undef HAVE_NATIVE_gcm_hash8

 #undef HAVE_NATIVE_salsa20_core

 #undef HAVE_NATIVE_sha1_compress

diff -up ./ctr16.c.ghash ./ctr16.c

--- ./ctr16.c.ghash	2021-07-14 14:11:58.130891552 +0200

+++ ./ctr16.c	2021-07-14 14:11:58.130891552 +0200

@@ -0,0 +1,106 @@

+/* ctr16.c

+

+   Cipher counter mode, optimized for 16-byte blocks.

+

+   Copyright (C) 2005-2018 Niels Möller

+   Copyright (C) 2018 Red Hat, Inc.

+

+   This file is part of GNU Nettle.

+

+   GNU Nettle is free software: you can redistribute it and/or

+   modify it under the terms of either:

+

+     * the GNU Lesser General Public License as published by the Free

+       Software Foundation; either version 3 of the License, or (at your

+       option) any later version.

+

+   or

+

+     * the GNU General Public License as published by the Free

+       Software Foundation; either version 2 of the License, or (at your

+       option) any later version.

+

+   or both in parallel, as here.

+

+   GNU Nettle is distributed in the hope that it will be useful,

+   but WITHOUT ANY WARRANTY; without even the implied warranty of

+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+   General Public License for more details.

+

+   You should have received copies of the GNU General Public License and

+   the GNU Lesser General Public License along with this program.  If

+   not, see http://www.gnu.org/licenses/.

+*/

+

+#if HAVE_CONFIG_H

+# include "config.h"

+#endif

+

+#include <assert.h>

+

+#include "ctr.h"

+

+#include "ctr-internal.h"

+#include "memxor.h"

+#include "nettle-internal.h"

+

+#define MIN(a,b) (((a) < (b)) ? (a) : (b))

+

+void

+_ctr_crypt16(const void *ctx, nettle_cipher_func *f,

+	     nettle_fill16_func *fill, uint8_t *ctr,

+	     size_t length, uint8_t *dst,

+	     const uint8_t *src)

+{

+  if (dst != src && !((uintptr_t) dst % sizeof(uint64_t)))

+    {

+      size_t blocks = length / 16u;

+      size_t done;

+      fill (ctr, blocks, (union nettle_block16 *) dst);

+

+      done = blocks * 16;

+      f(ctx, done, dst, dst);

+      memxor (dst, src, done);

+

+      length -= done;

+      if (length > 0)

+	{ /* Left-over partial block */

+	  union nettle_block16 block;

+	  dst += done;

+	  src += done;

+	  assert (length < 16);

+	  /* Use fill, to update ctr value in the same way in all cases. */

+	  fill (ctr, 1, &block);

+	  f (ctx, 16, block.b, block.b);

+	  memxor3 (dst, src, block.b, length);

+	}

+    }

+  else

+    {

+      /* Construct an aligned buffer of consecutive counter values, of

+	 size at most CTR_BUFFER_LIMIT. */

+      TMP_DECL(buffer, union nettle_block16, CTR_BUFFER_LIMIT / 16);

+      size_t blocks = (length + 15) / 16u;

+      size_t i;

+      TMP_ALLOC(buffer, MIN(blocks, CTR_BUFFER_LIMIT / 16));

+

+      for (i = 0; blocks >= CTR_BUFFER_LIMIT / 16;

+	   i += CTR_BUFFER_LIMIT, blocks -= CTR_BUFFER_LIMIT / 16)

+	{

+	  fill (ctr, CTR_BUFFER_LIMIT / 16, buffer);

+	  f(ctx, CTR_BUFFER_LIMIT, buffer->b, buffer->b);

+	  if (length - i < CTR_BUFFER_LIMIT)

+	    goto done;

+	  memxor3 (dst + i, src + i, buffer->b, CTR_BUFFER_LIMIT);

+	}

+

+      if (blocks > 0)

+	{

+	  assert (length - i < CTR_BUFFER_LIMIT);

+	  fill (ctr, blocks, buffer);

+	  f(ctx, blocks * 16, buffer->b, buffer->b);

+	done:

+	  memxor3 (dst + i, src + i, buffer->b, length - i);

+	}

+    }

+}

diff -up ./ctr.c.ghash ./ctr.c

--- ./ctr.c.ghash	2018-12-04 21:56:05.000000000 +0100

+++ ./ctr.c	2021-07-14 14:13:07.714539484 +0200

@@ -41,11 +41,83 @@

 #include "ctr.h"

+#include "ctr-internal.h"

 #include "macros.h"

 #include "memxor.h"

 #include "nettle-internal.h"

-#define NBLOCKS 4

+#define MIN(a,b) (((a) < (b)) ? (a) : (b))

+

+/* The 'u64' member has been added in the public header

+   (nettle-types.h).  Check that the alignment is not affected with

+   it using _Static_assert. */

+union nettle_block16_

+{

+  uint8_t b[16];

+  unsigned long w[16 / sizeof(unsigned long)];

+};

+_Static_assert(__alignof(union nettle_block16_) == __alignof(union nettle_block16),

+	       "nettle_block16 alignment should be preserved");

+

+static size_t

+ctr_fill (size_t block_size, uint8_t *ctr, size_t length, uint8_t *buffer)

+{

+  size_t i;

+  for (i = 0; i + block_size <= length; i += block_size)

+    {

+      memcpy (buffer + i, ctr, block_size);

+      INCREMENT(block_size, ctr);

+    }

+  return i;

+}

+

+#if WORDS_BIGENDIAN

+# define USE_CTR_CRYPT16 1

+static nettle_fill16_func ctr_fill16;

+static void

+ctr_fill16(uint8_t *ctr, size_t blocks, union nettle_block16 *buffer)

+{

+  uint64_t hi, lo;

+  size_t i;

+  hi = READ_UINT64(ctr);

+  lo = READ_UINT64(ctr + 8);

+

+  for (i = 0; i < blocks; i++)

+    {

+      buffer[i].u64[0] = hi;

+      buffer[i].u64[1] = lo;

+      hi += !(++lo);

+    }

+  WRITE_UINT64(ctr, hi);

+  WRITE_UINT64(ctr + 8, lo);

+}

+#else /* !WORDS_BIGENDIAN */

+# if HAVE_BUILTIN_BSWAP64

+#  define USE_CTR_CRYPT16 1

+static nettle_fill16_func ctr_fill16;

+static void

+ctr_fill16(uint8_t *ctr, size_t blocks, union nettle_block16 *buffer)

+{

+  uint64_t hi, lo;

+  size_t i;

+  /* Read hi in native endianness */

+  hi = LE_READ_UINT64(ctr);

+  lo = READ_UINT64(ctr + 8);

+

+  for (i = 0; i < blocks; i++)

+    {

+      buffer[i].u64[0] = hi;

+      buffer[i].u64[1] = __builtin_bswap64(lo);

+      if (!++lo)

+	hi = __builtin_bswap64(__builtin_bswap64(hi) + 1);

+    }

+  LE_WRITE_UINT64(ctr, hi);

+  WRITE_UINT64(ctr + 8, lo);

+}

+# else /* ! HAVE_BUILTIN_BSWAP64 */

+#  define USE_CTR_CRYPT16 0

+# endif

+#endif /* !WORDS_BIGENDIAN */

 void

 ctr_crypt(const void *ctx, nettle_cipher_func *f,

@@ -53,84 +125,64 @@ ctr_crypt(const void *ctx, nettle_cipher

 	  size_t length, uint8_t *dst,

 	  const uint8_t *src)

 {

-  if (src != dst)

+#if USE_CTR_CRYPT16

+  if (block_size == 16)

     {

-      if (length == block_size)

-	{

-	  f(ctx, block_size, dst, ctr);

-	  INCREMENT(block_size, ctr);

-	  memxor(dst, src, block_size);

-	}

-      else

+      _ctr_crypt16(ctx, f, ctr_fill16, ctr, length, dst, src);

+      return;

+    }

+#endif

+

+  if(src != dst)

+    {

+      size_t filled = ctr_fill (block_size, ctr, length, dst);

+

+      f(ctx, filled, dst, dst);

+      memxor(dst, src, filled);

+

+      if (filled < length)

 	{

-	  size_t left;

-	  uint8_t *p;	  

+	  TMP_DECL(block, uint8_t, NETTLE_MAX_CIPHER_BLOCK_SIZE);

+	  TMP_ALLOC(block, block_size);

-	  for (p = dst, left = length;

-	       left >= block_size;

-	       left -= block_size, p += block_size)

-	    {

-	      memcpy (p, ctr, block_size);

-	      INCREMENT(block_size, ctr);

-	    }

-

-	  f(ctx, length - left, dst, dst);

-	  memxor(dst, src, length - left);

-

-	  if (left)

-	    {

-	      TMP_DECL(buffer, uint8_t, NETTLE_MAX_CIPHER_BLOCK_SIZE);

-	      TMP_ALLOC(buffer, block_size);

-

-	      f(ctx, block_size, buffer, ctr);

-	      INCREMENT(block_size, ctr);

-	      memxor3(dst + length - left, src + length - left, buffer, left);

-	    }

+	  f(ctx, block_size, block, ctr);

+	  INCREMENT(block_size, ctr);

+	  memxor3(dst + filled, src + filled, block, length - filled);

 	}

     }

   else

     {

-      if (length > block_size)

-	{

-	  TMP_DECL(buffer, uint8_t, NBLOCKS * NETTLE_MAX_CIPHER_BLOCK_SIZE);

-	  size_t chunk = NBLOCKS * block_size;

+      /* For in-place CTR, construct a buffer of consecutive counter

+	 values, of size at most CTR_BUFFER_LIMIT. */

+      TMP_DECL(buffer, uint8_t, CTR_BUFFER_LIMIT);

+

+      size_t buffer_size;

+      if (length < block_size)

+	buffer_size = block_size;

+      else if (length <= CTR_BUFFER_LIMIT)

+	buffer_size = length;

+      else

+	buffer_size = CTR_BUFFER_LIMIT;

-	  TMP_ALLOC(buffer, chunk);

+      TMP_ALLOC(buffer, buffer_size);

-	  for (; length >= chunk;

-	       length -= chunk, src += chunk, dst += chunk)

-	    {

-	      unsigned n;

-	      uint8_t *p;	  

-	      for (n = 0, p = buffer; n < NBLOCKS; n++, p += block_size)

-		{

-		  memcpy (p, ctr, block_size);

-		  INCREMENT(block_size, ctr);

-		}

-	      f(ctx, chunk, buffer, buffer);

-	      memxor(dst, buffer, chunk);

-	    }

-

-	  if (length > 0)

-	    {

-	      /* Final, possibly partial, blocks */

-	      for (chunk = 0; chunk < length; chunk += block_size)

-		{

-		  memcpy (buffer + chunk, ctr, block_size);

-		  INCREMENT(block_size, ctr);

-		}

-	      f(ctx, chunk, buffer, buffer);

-	      memxor3(dst, src, buffer, length);

-	    }

+      while (length >= block_size)

+	{

+	  size_t filled

+	    = ctr_fill (block_size, ctr, MIN(buffer_size, length), buffer);

+	  assert (filled > 0);

+	  f(ctx, filled, buffer, buffer);

+	  memxor(dst, buffer, filled);

+	  length -= filled;

+	  dst += filled;

 	}

-      else if (length > 0)

-      	{

-	  TMP_DECL(buffer, uint8_t, NETTLE_MAX_CIPHER_BLOCK_SIZE);

-	  TMP_ALLOC(buffer, block_size);

+      /* Final, possibly partial, block. */

+      if (length > 0)

+	{

 	  f(ctx, block_size, buffer, ctr);

 	  INCREMENT(block_size, ctr);

-	  memxor3(dst, src, buffer, length);

+	  memxor(dst, buffer, length);

 	}

     }

 }

diff -up ./ctr-internal.h.ghash ./ctr-internal.h

--- ./ctr-internal.h.ghash	2021-07-14 14:11:58.130891552 +0200

+++ ./ctr-internal.h	2021-07-14 14:11:58.130891552 +0200

@@ -0,0 +1,56 @@

+/* ctr-internal.h

+

+   Copyright (C) 2018 Niels Möller

+

+   This file is part of GNU Nettle.

+

+   GNU Nettle is free software: you can redistribute it and/or

+   modify it under the terms of either:

+

+     * the GNU Lesser General Public License as published by the Free

+       Software Foundation; either version 3 of the License, or (at your

+       option) any later version.

+

+   or

+

+     * the GNU General Public License as published by the Free

+       Software Foundation; either version 2 of the License, or (at your

+       option) any later version.

+

+   or both in parallel, as here.

+

+   GNU Nettle is distributed in the hope that it will be useful,

+   but WITHOUT ANY WARRANTY; without even the implied warranty of

+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+   General Public License for more details.

+

+   You should have received copies of the GNU General Public License and

+   the GNU Lesser General Public License along with this program.  If

+   not, see http://www.gnu.org/licenses/.

+*/

+

+#ifndef NETTLE_CTR_INTERNAL_H_INCLUDED

+#define NETTLE_CTR_INTERNAL_H_INCLUDED

+

+#include "nettle-types.h"

+

+/* Name mangling */

+#define _ctr_crypt16 _nettle_ctr_crypt16

+

+/* Size limit for temporary stack buffers. */

+#define CTR_BUFFER_LIMIT 512

+

+/* Fill BUFFER (n blocks) with incrementing CTR values. It would be

+   nice if CTR was always 64-bit aligned, but it isn't when called

+   from ctr_crypt. */

+typedef void

+nettle_fill16_func(uint8_t *ctr, size_t n, union nettle_block16 *buffer);

+

+void

+_ctr_crypt16(const void *ctx, nettle_cipher_func *f,

+	     nettle_fill16_func *fill, uint8_t *ctr,

+	     size_t length, uint8_t *dst,

+	     const uint8_t *src);

+

+

+#endif /* NETTLE_CTR_INTERNAL_H_INCLUDED */

diff -up ./fat-ppc.c.ghash ./fat-ppc.c

--- ./fat-ppc.c.ghash	2021-07-14 14:11:58.126891572 +0200

+++ ./fat-ppc.c	2021-07-14 14:11:58.130891552 +0200

@@ -49,6 +49,7 @@

 #include "aes-internal.h"

 #include "gcm.h"

+#include "gcm-internal.h"

 #include "fat-setup.h"

 /* Define from arch/powerpc/include/uapi/asm/cputable.h in Linux kernel */

@@ -87,6 +88,16 @@ DECLARE_FAT_FUNC(_nettle_aes_decrypt, ae

 DECLARE_FAT_FUNC_VAR(aes_decrypt, aes_crypt_internal_func, c)

 DECLARE_FAT_FUNC_VAR(aes_decrypt, aes_crypt_internal_func, ppc64)

+#if GCM_TABLE_BITS == 8

+DECLARE_FAT_FUNC(_nettle_gcm_init_key, gcm_init_key_func)

+DECLARE_FAT_FUNC_VAR(gcm_init_key, gcm_init_key_func, c)

+DECLARE_FAT_FUNC_VAR(gcm_init_key, gcm_init_key_func, ppc64)

+

+DECLARE_FAT_FUNC(_nettle_gcm_hash, gcm_hash_func)

+DECLARE_FAT_FUNC_VAR(gcm_hash, gcm_hash_func, c)

+DECLARE_FAT_FUNC_VAR(gcm_hash, gcm_hash_func, ppc64)

+#endif /* GCM_TABLE_BITS == 8 */

+

 static void CONSTRUCTOR

 fat_init (void)

 {

@@ -101,17 +112,29 @@ fat_init (void)

      features.have_crypto_ext ? "crypto extensions" : "");

   if (features.have_crypto_ext)

-  {

-     if (verbose)

-        fprintf (stderr, "libnettle: enabling arch 2.07 code.\n");

-     _nettle_aes_encrypt_vec = _nettle_aes_encrypt_ppc64;

-     _nettle_aes_decrypt_vec = _nettle_aes_decrypt_ppc64;

-  }

+    {

+      if (verbose)

+	fprintf (stderr, "libnettle: enabling arch 2.07 code.\n");

+      _nettle_aes_encrypt_vec = _nettle_aes_encrypt_ppc64;

+      _nettle_aes_decrypt_vec = _nettle_aes_decrypt_ppc64;

+#if GCM_TABLE_BITS == 8

+      /* Make sure _nettle_gcm_init_key_vec function is compatible

+         with _nettle_gcm_hash_vec function e.g. _nettle_gcm_init_key_c()

+         fills gcm_key table with values that are incompatible with

+         _nettle_gcm_hash_ppc64() */

+      _nettle_gcm_init_key_vec = _nettle_gcm_init_key_ppc64;

+      _nettle_gcm_hash_vec = _nettle_gcm_hash_ppc64;

+#endif /* GCM_TABLE_BITS == 8 */

+    }

   else

-  {

-     _nettle_aes_encrypt_vec = _nettle_aes_encrypt_c;

-     _nettle_aes_decrypt_vec = _nettle_aes_decrypt_c;

-  }

+    {

+      _nettle_aes_encrypt_vec = _nettle_aes_encrypt_c;

+      _nettle_aes_decrypt_vec = _nettle_aes_decrypt_c;

+#if GCM_TABLE_BITS == 8

+      _nettle_gcm_init_key_vec = _nettle_gcm_init_key_c;

+      _nettle_gcm_hash_vec = _nettle_gcm_hash_c;

+#endif /* GCM_TABLE_BITS == 8 */

+    }

 }

 DEFINE_FAT_FUNC(_nettle_aes_encrypt, void,

@@ -127,3 +150,14 @@ DEFINE_FAT_FUNC(_nettle_aes_decrypt, voi

  size_t length, uint8_t *dst,

  const uint8_t *src),

  (rounds, keys, T, length, dst, src))

+

+#if GCM_TABLE_BITS == 8

+DEFINE_FAT_FUNC(_nettle_gcm_init_key, void,

+		(union nettle_block16 *table),

+		(table))

+

+DEFINE_FAT_FUNC(_nettle_gcm_hash, void,

+		(const struct gcm_key *key, union nettle_block16 *x,

+		 size_t length, const uint8_t *data),

+		(key, x, length, data))

+#endif /* GCM_TABLE_BITS == 8 */

diff -up ./fat-setup.h.ghash ./fat-setup.h

--- ./fat-setup.h.ghash	2018-12-04 21:56:06.000000000 +0100

+++ ./fat-setup.h	2021-07-14 14:11:58.130891552 +0200

@@ -159,6 +159,11 @@ typedef void aes_crypt_internal_func (un

 				      size_t length, uint8_t *dst,

 				      const uint8_t *src);

+typedef void gcm_init_key_func (union nettle_block16 *table);

+

+typedef void gcm_hash_func (const struct gcm_key *key, union nettle_block16 *x,

+			    size_t length, const uint8_t *data);

+

 typedef void *(memxor_func)(void *dst, const void *src, size_t n);

 typedef void salsa20_core_func (uint32_t *dst, const uint32_t *src, unsigned rounds);

diff -up ./gcm.c.ghash ./gcm.c

--- ./gcm.c.ghash	2018-12-04 21:56:05.000000000 +0100

+++ ./gcm.c	2021-07-14 14:11:58.131891547 +0200

@@ -6,8 +6,9 @@

    See also the gcm paper at

    http://www.cryptobarn.com/papers/gcm-spec.pdf.

-   Copyright (C) 2011, 2013 Niels Möller

    Copyright (C) 2011 Katholieke Universiteit Leuven

+   Copyright (C) 2011, 2013, 2018 Niels Möller

+   Copyright (C) 2018 Red Hat, Inc.

    Contributed by Nikos Mavrogiannopoulos

@@ -48,9 +49,11 @@

 #include "gcm.h"

+#include "gcm-internal.h"

 #include "memxor.h"

 #include "nettle-internal.h"

 #include "macros.h"

+#include "ctr-internal.h"

 #define GHASH_POLYNOMIAL 0xE1UL

@@ -112,7 +115,17 @@ gcm_gf_shift (union nettle_block16 *r, c

 #endif /* ! WORDS_BIGENDIAN */

 }

-#if GCM_TABLE_BITS == 0

+#if GCM_TABLE_BITS != 8

+/* The native implementations (currently ppc64 only) depend on the

+   GCM_TABLE_BITS == 8 layout */

+#undef HAVE_NATIVE_gcm_hash

+#undef HAVE_NATIVE_gcm_init_key

+#undef HAVE_NATIVE_fat_gcm_hash

+#undef HAVE_NATIVE_fat_gcm_init_key

+#endif

+

+#if !HAVE_NATIVE_gcm_hash

+# if GCM_TABLE_BITS == 0

 /* Sets x <- x * y mod r, using the plain bitwise algorithm from the

    specification. y may be shorter than a full block, missing bytes

    are assumed zero. */

@@ -140,15 +153,15 @@ gcm_gf_mul (union nettle_block16 *x, con

     }

   memcpy (x->b, Z.b, sizeof(Z));

 }

-#else /* GCM_TABLE_BITS != 0 */

+# else /* GCM_TABLE_BITS != 0 */

-# if WORDS_BIGENDIAN

-#  define W(left,right) (0x##left##right)

-# else

-#  define W(left,right) (0x##right##left)

-# endif

+#  if WORDS_BIGENDIAN

+#   define W(left,right) (0x##left##right)

+#  else

+#   define W(left,right) (0x##right##left)

+#  endif

-# if GCM_TABLE_BITS == 4

+#  if GCM_TABLE_BITS == 4

 static const uint16_t

 shift_table[0x10] = {

   W(00,00),W(1c,20),W(38,40),W(24,60),W(70,80),W(6c,a0),W(48,c0),W(54,e0),

@@ -177,26 +190,13 @@ gcm_gf_shift_4(union nettle_block16 *x)

 #  error Unsupported word size. */

 #endif

 #else /* ! WORDS_BIGENDIAN */

-# if SIZEOF_LONG == 4

-#define RSHIFT_WORD(x) \

-  ((((x) & 0xf0f0f0f0UL) >> 4)			\

-   | (((x) & 0x000f0f0f) << 12))

-  reduce = shift_table[(w[3] >> 24) & 0xf];

-  w[3] = RSHIFT_WORD(w[3]) | ((w[2] >> 20) & 0xf0);

-  w[2] = RSHIFT_WORD(w[2]) | ((w[1] >> 20) & 0xf0);

-  w[1] = RSHIFT_WORD(w[1]) | ((w[0] >> 20) & 0xf0);

-  w[0] = RSHIFT_WORD(w[0]) ^ reduce;

-# elif SIZEOF_LONG == 8

-#define RSHIFT_WORD(x) \

-  ((((x) & 0xf0f0f0f0f0f0f0f0UL) >> 4) \

-   | (((x) & 0x000f0f0f0f0f0f0fUL) << 12))

-  reduce = shift_table[(w[1] >> 56) & 0xf];

-  w[1] = RSHIFT_WORD(w[1]) | ((w[0] >> 52) & 0xf0);

-  w[0] = RSHIFT_WORD(w[0]) ^ reduce;

-# else

-#  error Unsupported word size. */

-# endif

-# undef RSHIFT_WORD

+# define RSHIFT_WORD_4(x) \

+  ((((x) & UINT64_C(0xf0f0f0f0f0f0f0f0)) >> 4) \

+   | (((x) & UINT64_C(0x000f0f0f0f0f0f0f)) << 12))

+  reduce = shift_table[(u64[1] >> 56) & 0xf];

+  u64[1] = RSHIFT_WORD_4(u64[1]) | ((u64[0] >> 52) & 0xf0);

+  u64[0] = RSHIFT_WORD_4(u64[0]) ^ reduce;

+# undef RSHIFT_WORD_4

 #endif /* ! WORDS_BIGENDIAN */

 }

@@ -219,10 +219,10 @@ gcm_gf_mul (union nettle_block16 *x, con

     }

   memcpy (x->b, Z.b, sizeof(Z));

 }

-# elif GCM_TABLE_BITS == 8

-#  if HAVE_NATIVE_gcm_hash8

+#  elif GCM_TABLE_BITS == 8

+#   if HAVE_NATIVE_gcm_hash8

-#define gcm_hash _nettle_gcm_hash8

+#define _nettle_gcm_hash _nettle_gcm_hash8

 void

 _nettle_gcm_hash8 (const struct gcm_key *key, union nettle_block16 *x,

 		   size_t length, const uint8_t *data);

@@ -317,18 +317,46 @@ gcm_gf_mul (union nettle_block16 *x, con

   gcm_gf_shift_8(&Z);

   gcm_gf_add(x, &Z, &table[x->b[0]]);

 }

-#  endif /* ! HAVE_NATIVE_gcm_hash8 */

-# else /* GCM_TABLE_BITS != 8 */

-#  error Unsupported table size. 

-# endif /* GCM_TABLE_BITS != 8 */

+#   endif /* ! HAVE_NATIVE_gcm_hash8 */

+#  else /* GCM_TABLE_BITS != 8 */

+#   error Unsupported table size.

+#  endif /* GCM_TABLE_BITS != 8 */

+

+#  undef W

+# endif /* GCM_TABLE_BITS != 0 */

+#endif /* !HAVE_NATIVE_gcm_hash */

-#undef W

-

-#endif /* GCM_TABLE_BITS */

 /* Increment the rightmost 32 bits. */

 #define INC32(block) INCREMENT(4, (block.b) + GCM_BLOCK_SIZE - 4)

+#if !HAVE_NATIVE_gcm_init_key

+# if !HAVE_NATIVE_fat_gcm_hash

+#  define _nettle_gcm_init_key _nettle_gcm_init_key_c

+static

+# endif

+void

+_nettle_gcm_init_key_c(union nettle_block16 *table)

+{

+#if GCM_TABLE_BITS

+  /* Middle element if GCM_TABLE_BITS > 0, otherwise the first

+     element */

+  unsigned i = (1<

+

+  /* Algorithm 3 from the gcm paper. First do powers of two, then do

+     the rest by adding. */

+  while (i /= 2)

+    gcm_gf_shift(&table[i], &table[2*i]);

+  for (i = 2; i < 1<

+    {

+      unsigned j;

+      for (j = 1; j < i; j++)

+        gcm_gf_add(&table[i+j], &table[i], &table[j]);

+    }

+#endif

+}

+#endif /* !HAVE_NATIVE_gcm_init_key */

+

 /* Initialization of GCM.

  * @ctx: The context of GCM

  * @cipher: The context of the underlying block cipher

@@ -345,25 +373,18 @@ gcm_set_key(struct gcm_key *key,

   /* H */  

   memset(key->h[0].b, 0, GCM_BLOCK_SIZE);

   f (cipher, GCM_BLOCK_SIZE, key->h[i].b, key->h[0].b);

-  

-#if GCM_TABLE_BITS

-  /* Algorithm 3 from the gcm paper. First do powers of two, then do

-     the rest by adding. */

-  while (i /= 2)

-    gcm_gf_shift(&key->h[i], &key->h[2*i]);

-  for (i = 2; i < 1<

-    {

-      unsigned j;

-      for (j = 1; j < i; j++)

-	gcm_gf_add(&key->h[i+j], &key->h[i],&key->h[j]);

-    }

-#endif