polyval_acc_to_ghash
polyval_acc_to_ghash(&ctx->acc, out);
polyval_acc_to_ghash(acc, ghash_acc);
polyval_acc_to_ghash(acc, ghash_acc);
polyval_acc_to_ghash(acc, ghash_acc);
polyval_acc_to_ghash(acc, ctx[0]);