diff --git a/crypto/fipsmodule/modes/asm/aesni-gcm-x86_64.pl b/crypto/fipsmodule/modes/asm/aesni-gcm-x86_64.pl
index 21dbf69..e726c04 100644
--- a/crypto/fipsmodule/modes/asm/aesni-gcm-x86_64.pl
+++ b/crypto/fipsmodule/modes/asm/aesni-gcm-x86_64.pl
@@ -71,14 +71,18 @@
 # no AVX2 instructions being used.
 if ($avx>1) {{{
 
-($inp,$out,$len,$key,$ivp,$Xip)=("%rdi","%rsi","%rdx","%rcx","%r8","%r9");
+# On Windows, only four parameters are passed in registers. The last two
+# parameters will be manually loaded into %rdi and %rsi.
+my ($inp, $out, $len, $key, $ivp, $Xip) =
+    $win64 ? ("%rcx", "%rdx", "%r8", "%r9", "%rdi", "%rsi") :
+             ("%rdi", "%rsi", "%rdx", "%rcx", "%r8", "%r9");
 
 ($Ii,$T1,$T2,$Hkey,
  $Z0,$Z1,$Z2,$Z3,$Xi) = map("%xmm$_",(0..8));
 
 ($inout0,$inout1,$inout2,$inout3,$inout4,$inout5,$rndkey) = map("%xmm$_",(9..15));
 
-($counter,$rounds,$ret,$const,$in0,$end0)=("%ebx","%ebp","%r10","%r11","%r14","%r15");
+($counter,$rounds,$const,$in0,$end0)=("%ebx","%r10d","%r11","%r14","%r15");
 
 $code=<<___;
 .text
@@ -390,7 +394,7 @@
 	  vaesenclast	$Hkey,$inout5,$inout5
 	 vpaddb		$T2,$Z3,$Hkey
 
-	add		\$0x60,$ret
+	add		\$0x60,%rax
 	sub		\$0x6,$len
 	jc		.L6x_done
 
@@ -424,46 +428,76 @@
 #		struct { u128 Xi,H,Htbl[9]; } *Xip);
 $code.=<<___;
 .globl	aesni_gcm_decrypt
-.type	aesni_gcm_decrypt,\@function,6
+.type	aesni_gcm_decrypt,\@abi-omnipotent
 .align	32
 aesni_gcm_decrypt:
 .cfi_startproc
-	xor	$ret,$ret
+.seh_startproc
+	xor	%rax,%rax
 
 	# We call |_aesni_ctr32_ghash_6x|, which requires at least 96 (0x60)
 	# bytes of input.
 	cmp	\$0x60,$len			# minimal accepted length
 	jb	.Lgcm_dec_abort
 
-	lea	(%rsp),%rax			# save stack pointer
-.cfi_def_cfa_register	%rax
-	push	%rbx
-.cfi_push	%rbx
 	push	%rbp
 .cfi_push	%rbp
+.seh_pushreg	%rbp
+	mov	%rsp, %rbp			# save stack pointer
+.cfi_def_cfa_register	%rbp
+	push	%rbx
+.cfi_push	%rbx
+.seh_pushreg	%rbx
 	push	%r12
 .cfi_push	%r12
+.seh_pushreg	%r12
 	push	%r13
 .cfi_push	%r13
+.seh_pushreg	%r13
 	push	%r14
 .cfi_push	%r14
+.seh_pushreg	%r14
 	push	%r15
 .cfi_push	%r15
+.seh_pushreg	%r15
 ___
-$code.=<<___ if ($win64);
-	lea	-0xa8(%rsp),%rsp
-	movaps	%xmm6,-0xd8(%rax)
-	movaps	%xmm7,-0xc8(%rax)
-	movaps	%xmm8,-0xb8(%rax)
-	movaps	%xmm9,-0xa8(%rax)
-	movaps	%xmm10,-0x98(%rax)
-	movaps	%xmm11,-0x88(%rax)
-	movaps	%xmm12,-0x78(%rax)
-	movaps	%xmm13,-0x68(%rax)
-	movaps	%xmm14,-0x58(%rax)
-	movaps	%xmm15,-0x48(%rax)
-.Lgcm_dec_body:
+if ($win64) {
+$code.=<<___
+	lea	-0xa8(%rsp),%rsp		# 8 extra bytes to align the stack
+.seh_allocstack	0xa8
+.seh_setframe	%rbp, 0xa8+5*8
+	# Load the last two parameters. These go into %rdi and %rsi, which are
+	# non-volatile on Windows, so stash them in the parameter stack area
+	# first.
+	mov	%rdi, 0x10(%rbp)
+.seh_savereg	%rdi, 0xa8+5*8+0x10
+	mov	%rsi, 0x18(%rbp)
+.seh_savereg	%rsi, 0xa8+5*8+0x18
+	mov	0x30(%rbp), $ivp
+	mov	0x38(%rbp), $Xip
+	# Save non-volatile XMM registers.
+	movaps	%xmm6,-0xd0(%rbp)
+.seh_savexmm128	%xmm6, 0xa8+5*8-0xd0
+	movaps	%xmm7,-0xc0(%rbp)
+.seh_savexmm128	%xmm7, 0xa8+5*8-0xc0
+	movaps	%xmm8,-0xb0(%rbp)
+.seh_savexmm128	%xmm8, 0xa8+5*8-0xb0
+	movaps	%xmm9,-0xa0(%rbp)
+.seh_savexmm128	%xmm9, 0xa8+5*8-0xa0
+	movaps	%xmm10,-0x90(%rbp)
+.seh_savexmm128	%xmm10, 0xa8+5*8-0x90
+	movaps	%xmm11,-0x80(%rbp)
+.seh_savexmm128	%xmm11, 0xa8+5*8-0x80
+	movaps	%xmm12,-0x70(%rbp)
+.seh_savexmm128	%xmm12, 0xa8+5*8-0x70
+	movaps	%xmm13,-0x60(%rbp)
+.seh_savexmm128	%xmm13, 0xa8+5*8-0x60
+	movaps	%xmm14,-0x50(%rbp)
+.seh_savexmm128	%xmm14, 0xa8+5*8-0x50
+	movaps	%xmm15,-0x40(%rbp)
+.seh_savexmm128	%xmm15, 0xa8+5*8-0x40
 ___
+}
 $code.=<<___;
 	vzeroupper
 
@@ -491,7 +525,7 @@
 .Ldec_no_key_aliasing:
 
 	vmovdqu		0x50($inp),$Z3		# I[5]
-	lea		($inp),$in0
+	mov		$inp,$in0
 	vmovdqu		0x40($inp),$Z0
 
 	# |_aesni_ctr32_ghash_6x| requires |$end0| to point to 2*96 (0xc0)
@@ -504,7 +538,7 @@
 
 	vmovdqu		0x30($inp),$Z1
 	shr		\$4,$len
-	xor		$ret,$ret
+	xor		%rax,%rax
 	vmovdqu		0x20($inp),$Z2
 	 vpshufb	$Ii,$Z3,$Z3		# passed to _aesni_ctr32_ghash_6x
 	vmovdqu		0x10($inp),$T2
@@ -535,35 +569,37 @@
 	vzeroupper
 ___
 $code.=<<___ if ($win64);
-	movaps	-0xd8(%rax),%xmm6
-	movaps	-0xc8(%rax),%xmm7
-	movaps	-0xb8(%rax),%xmm8
-	movaps	-0xa8(%rax),%xmm9
-	movaps	-0x98(%rax),%xmm10
-	movaps	-0x88(%rax),%xmm11
-	movaps	-0x78(%rax),%xmm12
-	movaps	-0x68(%rax),%xmm13
-	movaps	-0x58(%rax),%xmm14
-	movaps	-0x48(%rax),%xmm15
+	movaps	-0xd0(%rbp),%xmm6
+	movaps	-0xc0(%rbp),%xmm7
+	movaps	-0xb0(%rbp),%xmm8
+	movaps	-0xa0(%rbp),%xmm9
+	movaps	-0x90(%rbp),%xmm10
+	movaps	-0x80(%rbp),%xmm11
+	movaps	-0x70(%rbp),%xmm12
+	movaps	-0x60(%rbp),%xmm13
+	movaps	-0x50(%rbp),%xmm14
+	movaps	-0x40(%rbp),%xmm15
+	mov	0x10(%rbp),%rdi
+	mov	0x18(%rbp),%rsi
 ___
 $code.=<<___;
-	mov	-48(%rax),%r15
-.cfi_restore	%r15
-	mov	-40(%rax),%r14
-.cfi_restore	%r14
-	mov	-32(%rax),%r13
-.cfi_restore	%r13
-	mov	-24(%rax),%r12
-.cfi_restore	%r12
-	mov	-16(%rax),%rbp
-.cfi_restore	%rbp
-	mov	-8(%rax),%rbx
-.cfi_restore	%rbx
-	lea	(%rax),%rsp		# restore %rsp
-.cfi_def_cfa_register	%rsp
+	lea	-0x28(%rbp), %rsp	# restore %rsp to fixed allocation
+.cfi_def_cfa	%rsp, 0x38
+	pop	%r15
+.cfi_pop	%r15
+	pop	%r14
+.cfi_pop	%r14
+	pop	%r13
+.cfi_pop	%r13
+	pop	%r12
+.cfi_pop	%r12
+	pop	%rbx
+.cfi_pop	%rbx
+	pop	%rbp
+.cfi_pop	%rbp
 .Lgcm_dec_abort:
-	mov	$ret,%rax		# return value
 	ret
+.seh_endproc
 .cfi_endproc
 .size	aesni_gcm_decrypt,.-aesni_gcm_decrypt
 ___
@@ -663,15 +699,16 @@
 .size	_aesni_ctr32_6x,.-_aesni_ctr32_6x
 
 .globl	aesni_gcm_encrypt
-.type	aesni_gcm_encrypt,\@function,6
+.type	aesni_gcm_encrypt,\@abi-omnipotent
 .align	32
 aesni_gcm_encrypt:
 .cfi_startproc
+.seh_startproc
 #ifdef BORINGSSL_DISPATCH_TEST
 .extern	BORINGSSL_function_hit
 	movb \$1,BORINGSSL_function_hit+2(%rip)
 #endif
-	xor	$ret,$ret
+	xor	%rax,%rax
 
 	# We call |_aesni_ctr32_6x| twice, each call consuming 96 bytes of
 	# input. Then we call |_aesni_ctr32_ghash_6x|, which requires at
@@ -679,35 +716,64 @@
 	cmp	\$0x60*3,$len			# minimal accepted length
 	jb	.Lgcm_enc_abort
 
-	lea	(%rsp),%rax			# save stack pointer
-.cfi_def_cfa_register	%rax
-	push	%rbx
-.cfi_push	%rbx
 	push	%rbp
 .cfi_push	%rbp
+.seh_pushreg	%rbp
+	mov	%rsp, %rbp			# save stack pointer
+.cfi_def_cfa_register	%rbp
+	push	%rbx
+.cfi_push	%rbx
+.seh_pushreg	%rbx
 	push	%r12
 .cfi_push	%r12
+.seh_pushreg	%r12
 	push	%r13
 .cfi_push	%r13
+.seh_pushreg	%r13
 	push	%r14
 .cfi_push	%r14
+.seh_pushreg	%r14
 	push	%r15
 .cfi_push	%r15
+.seh_pushreg	%r15
 ___
-$code.=<<___ if ($win64);
-	lea	-0xa8(%rsp),%rsp
-	movaps	%xmm6,-0xd8(%rax)
-	movaps	%xmm7,-0xc8(%rax)
-	movaps	%xmm8,-0xb8(%rax)
-	movaps	%xmm9,-0xa8(%rax)
-	movaps	%xmm10,-0x98(%rax)
-	movaps	%xmm11,-0x88(%rax)
-	movaps	%xmm12,-0x78(%rax)
-	movaps	%xmm13,-0x68(%rax)
-	movaps	%xmm14,-0x58(%rax)
-	movaps	%xmm15,-0x48(%rax)
-.Lgcm_enc_body:
+if ($win64) {
+$code.=<<___
+	lea	-0xa8(%rsp),%rsp		# 8 extra bytes to align the stack
+.seh_allocstack	0xa8
+.seh_setframe	%rbp, 0xa8+5*8
+	# Load the last two parameters. These go into %rdi and %rsi, which are
+	# non-volatile on Windows, so stash them in the parameter stack area
+	# first.
+	mov	%rdi, 0x10(%rbp)
+.seh_savereg	%rdi, 0xa8+5*8+0x10
+	mov	%rsi, 0x18(%rbp)
+.seh_savereg	%rsi, 0xa8+5*8+0x18
+	mov	0x30(%rbp), $ivp
+	mov	0x38(%rbp), $Xip
+	# Save non-volatile XMM registers.
+	movaps	%xmm6,-0xd0(%rbp)
+.seh_savexmm128	%xmm6, 0xa8+5*8-0xd0
+	movaps	%xmm7,-0xc0(%rbp)
+.seh_savexmm128	%xmm7, 0xa8+5*8-0xc0
+	movaps	%xmm8,-0xb0(%rbp)
+.seh_savexmm128	%xmm8, 0xa8+5*8-0xb0
+	movaps	%xmm9,-0xa0(%rbp)
+.seh_savexmm128	%xmm9, 0xa8+5*8-0xa0
+	movaps	%xmm10,-0x90(%rbp)
+.seh_savexmm128	%xmm10, 0xa8+5*8-0x90
+	movaps	%xmm11,-0x80(%rbp)
+.seh_savexmm128	%xmm11, 0xa8+5*8-0x80
+	movaps	%xmm12,-0x70(%rbp)
+.seh_savexmm128	%xmm12, 0xa8+5*8-0x70
+	movaps	%xmm13,-0x60(%rbp)
+.seh_savexmm128	%xmm13, 0xa8+5*8-0x60
+	movaps	%xmm14,-0x50(%rbp)
+.seh_savexmm128	%xmm14, 0xa8+5*8-0x50
+	movaps	%xmm15,-0x40(%rbp)
+.seh_savexmm128	%xmm15, 0xa8+5*8-0x40
 ___
+}
 $code.=<<___;
 	vzeroupper
 
@@ -731,7 +797,7 @@
 	sub		$end0,%rsp		# avoid aliasing with key
 .Lenc_no_key_aliasing:
 
-	lea		($out),$in0
+	mov		$out,$in0
 
 	# |_aesni_ctr32_ghash_6x| requires |$end0| to point to 2*96 (0xc0)
 	# bytes before the end of the input. Note, in particular, that this is
@@ -762,7 +828,7 @@
 	vmovdqu		($Xip),$Xi		# load Xi
 	lea		0x20+0x20($Xip),$Xip	# size optimization
 	sub		\$12,$len
-	mov		\$0x60*2,$ret
+	mov		\$0x60*2,%rax
 	vpshufb		$Ii,$Xi,$Xi
 
 	call		_aesni_ctr32_ghash_6x
@@ -951,37 +1017,39 @@
 	vzeroupper
 ___
 $code.=<<___ if ($win64);
-	movaps	-0xd8(%rax),%xmm6
-	movaps	-0xc8(%rax),%xmm7
-	movaps	-0xb8(%rax),%xmm8
-	movaps	-0xa8(%rax),%xmm9
-	movaps	-0x98(%rax),%xmm10
-	movaps	-0x88(%rax),%xmm11
-	movaps	-0x78(%rax),%xmm12
-	movaps	-0x68(%rax),%xmm13
-	movaps	-0x58(%rax),%xmm14
-	movaps	-0x48(%rax),%xmm15
+	movaps	-0xd0(%rbp),%xmm6
+	movaps	-0xc0(%rbp),%xmm7
+	movaps	-0xb0(%rbp),%xmm8
+	movaps	-0xa0(%rbp),%xmm9
+	movaps	-0x90(%rbp),%xmm10
+	movaps	-0x80(%rbp),%xmm11
+	movaps	-0x70(%rbp),%xmm12
+	movaps	-0x60(%rbp),%xmm13
+	movaps	-0x50(%rbp),%xmm14
+	movaps	-0x40(%rbp),%xmm15
+	mov	0x10(%rbp),%rdi
+	mov	0x18(%rbp),%rsi
 ___
 $code.=<<___;
-	mov	-48(%rax),%r15
-.cfi_restore	%r15
-	mov	-40(%rax),%r14
-.cfi_restore	%r14
-	mov	-32(%rax),%r13
-.cfi_restore	%r13
-	mov	-24(%rax),%r12
-.cfi_restore	%r12
-	mov	-16(%rax),%rbp
-.cfi_restore	%rbp
-	mov	-8(%rax),%rbx
-.cfi_restore	%rbx
-	lea	(%rax),%rsp		# restore %rsp
-.cfi_def_cfa_register	%rsp
+	lea	-0x28(%rbp), %rsp	# restore %rsp to fixed allocation
+.cfi_def_cfa	%rsp, 0x38
+	pop	%r15
+.cfi_pop	%r15
+	pop	%r14
+.cfi_pop	%r14
+	pop	%r13
+.cfi_pop	%r13
+	pop	%r12
+.cfi_pop	%r12
+	pop	%rbx
+.cfi_pop	%rbx
+	pop	%rbp
+.cfi_pop	%rbp
 .Lgcm_enc_abort:
-	mov	$ret,%rax		# return value
 	ret
+.seh_endproc
 .cfi_endproc
-.size	aesni_gcm_encrypt,.-aesni_gcm_encrypt
+.size	aesni_gcm_decrypt,.-aesni_gcm_decrypt
 ___
 
 $code.=<<___;
@@ -999,127 +1067,6 @@
 .asciz	"AES-NI GCM module for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
 .align	64
 ___
-if ($win64) {
-$rec="%rcx";
-$frame="%rdx";
-$context="%r8";
-$disp="%r9";
-
-$code.=<<___
-.extern	__imp_RtlVirtualUnwind
-.type	gcm_se_handler,\@abi-omnipotent
-.align	16
-gcm_se_handler:
-	push	%rsi
-	push	%rdi
-	push	%rbx
-	push	%rbp
-	push	%r12
-	push	%r13
-	push	%r14
-	push	%r15
-	pushfq
-	sub	\$64,%rsp
-
-	mov	120($context),%rax	# pull context->Rax
-	mov	248($context),%rbx	# pull context->Rip
-
-	mov	8($disp),%rsi		# disp->ImageBase
-	mov	56($disp),%r11		# disp->HandlerData
-
-	mov	0(%r11),%r10d		# HandlerData[0]
-	lea	(%rsi,%r10),%r10	# prologue label
-	cmp	%r10,%rbx		# context->Rip<prologue label
-	jb	.Lcommon_seh_tail
-
-	mov	152($context),%rax	# pull context->Rsp
-
-	mov	4(%r11),%r10d		# HandlerData[1]
-	lea	(%rsi,%r10),%r10	# epilogue label
-	cmp	%r10,%rbx		# context->Rip>=epilogue label
-	jae	.Lcommon_seh_tail
-
-	mov	120($context),%rax	# pull context->Rax
-
-	mov	-48(%rax),%r15
-	mov	-40(%rax),%r14
-	mov	-32(%rax),%r13
-	mov	-24(%rax),%r12
-	mov	-16(%rax),%rbp
-	mov	-8(%rax),%rbx
-	mov	%r15,240($context)
-	mov	%r14,232($context)
-	mov	%r13,224($context)
-	mov	%r12,216($context)
-	mov	%rbp,160($context)
-	mov	%rbx,144($context)
-
-	lea	-0xd8(%rax),%rsi	# %xmm save area
-	lea	512($context),%rdi	# & context.Xmm6
-	mov	\$20,%ecx		# 10*sizeof(%xmm0)/sizeof(%rax)
-	.long	0xa548f3fc		# cld; rep movsq
-
-.Lcommon_seh_tail:
-	mov	8(%rax),%rdi
-	mov	16(%rax),%rsi
-	mov	%rax,152($context)	# restore context->Rsp
-	mov	%rsi,168($context)	# restore context->Rsi
-	mov	%rdi,176($context)	# restore context->Rdi
-
-	mov	40($disp),%rdi		# disp->ContextRecord
-	mov	$context,%rsi		# context
-	mov	\$154,%ecx		# sizeof(CONTEXT)
-	.long	0xa548f3fc		# cld; rep movsq
-
-	mov	$disp,%rsi
-	xor	%rcx,%rcx		# arg1, UNW_FLAG_NHANDLER
-	mov	8(%rsi),%rdx		# arg2, disp->ImageBase
-	mov	0(%rsi),%r8		# arg3, disp->ControlPc
-	mov	16(%rsi),%r9		# arg4, disp->FunctionEntry
-	mov	40(%rsi),%r10		# disp->ContextRecord
-	lea	56(%rsi),%r11		# &disp->HandlerData
-	lea	24(%rsi),%r12		# &disp->EstablisherFrame
-	mov	%r10,32(%rsp)		# arg5
-	mov	%r11,40(%rsp)		# arg6
-	mov	%r12,48(%rsp)		# arg7
-	mov	%rcx,56(%rsp)		# arg8, (NULL)
-	call	*__imp_RtlVirtualUnwind(%rip)
-
-	mov	\$1,%eax		# ExceptionContinueSearch
-	add	\$64,%rsp
-	popfq
-	pop	%r15
-	pop	%r14
-	pop	%r13
-	pop	%r12
-	pop	%rbp
-	pop	%rbx
-	pop	%rdi
-	pop	%rsi
-	ret
-.size	gcm_se_handler,.-gcm_se_handler
-
-.section	.pdata
-.align	4
-	.rva	.LSEH_begin_aesni_gcm_decrypt
-	.rva	.LSEH_end_aesni_gcm_decrypt
-	.rva	.LSEH_gcm_dec_info
-
-	.rva	.LSEH_begin_aesni_gcm_encrypt
-	.rva	.LSEH_end_aesni_gcm_encrypt
-	.rva	.LSEH_gcm_enc_info
-.section	.xdata
-.align	8
-.LSEH_gcm_dec_info:
-	.byte	9,0,0,0
-	.rva	gcm_se_handler
-	.rva	.Lgcm_dec_body,.Lgcm_dec_abort
-.LSEH_gcm_enc_info:
-	.byte	9,0,0,0
-	.rva	gcm_se_handler
-	.rva	.Lgcm_enc_body,.Lgcm_enc_abort
-___
-}
 }}} else {{{
 $code=<<___;	# assembler is too old
 .text
diff --git a/crypto/fipsmodule/modes/gcm_test.cc b/crypto/fipsmodule/modes/gcm_test.cc
index 8d15cc6..324d0e8 100644
--- a/crypto/fipsmodule/modes/gcm_test.cc
+++ b/crypto/fipsmodule/modes/gcm_test.cc
@@ -173,17 +173,17 @@
 
         aes_hw_set_encrypt_key(kKey, 128, &aes_key);
         for (size_t blocks : kBlockCounts) {
-          CHECK_ABI(aesni_gcm_encrypt, buf, buf, blocks * 16, &aes_key, iv,
-                    gcm.Xi.u);
-          CHECK_ABI(aesni_gcm_encrypt, buf, buf, blocks * 16 + 7, &aes_key, iv,
-                    gcm.Xi.u);
+          CHECK_ABI_SEH(aesni_gcm_encrypt, buf, buf, blocks * 16, &aes_key, iv,
+                        gcm.Xi.u);
+          CHECK_ABI_SEH(aesni_gcm_encrypt, buf, buf, blocks * 16 + 7, &aes_key,
+                        iv, gcm.Xi.u);
         }
         aes_hw_set_decrypt_key(kKey, 128, &aes_key);
         for (size_t blocks : kBlockCounts) {
-          CHECK_ABI(aesni_gcm_decrypt, buf, buf, blocks * 16, &aes_key, iv,
-                    gcm.Xi.u);
-          CHECK_ABI(aesni_gcm_decrypt, buf, buf, blocks * 16 + 7, &aes_key, iv,
-                    gcm.Xi.u);
+          CHECK_ABI_SEH(aesni_gcm_decrypt, buf, buf, blocks * 16, &aes_key, iv,
+                        gcm.Xi.u);
+          CHECK_ABI_SEH(aesni_gcm_decrypt, buf, buf, blocks * 16 + 7, &aes_key,
+                        iv, gcm.Xi.u);
         }
       }
     }