(Based on Piotr Sikora's change:
https://boringssl-review.googlesource.com/#/c/1361)

Change-Id: I7b62b81f4e4ef3064eee1b39334dc2e50d17f163
Reviewed-on: https://boringssl-review.googlesource.com/1641
Reviewed-by: Adam Langley <agl@google.com>

BUG=396787

Change-Id: I72ddb0ec3c71dbc70054403163930cbbde4b6009
Reviewed-on: https://boringssl-review.googlesource.com/1581
Reviewed-by: Adam Langley <agl@google.com>

GCM was broken in non-AESNI mode because I fluffed a #define when
moving gcm128.c across.

Change-Id: I66d5fed6a3d83d641da55c5ca434f17db0d89237

Câmara, D.; Gouvêa, C. P. L.; López, J. & Dahab, R.: Fast Software
Polynomial Multiplication on ARM Processors using the NEON Engine.

http://conradoplg.cryptoland.net/files/2010/12/mocrysen13.pdf

(Imported from upstream's 0fb3d5b4fd)

Initial fork from f2d678e6e8 (1.0.2 beta).

(This change contains substantial changes from the original and
effectively starts a new history.)