7f0747
diff -up openssl-1.0.0-beta4/Configure.aesni openssl-1.0.0-beta4/Configure
7f0747
--- openssl-1.0.0-beta4/Configure.aesni	2010-01-07 23:38:31.000000000 +0100
7f0747
+++ openssl-1.0.0-beta4/Configure	2010-01-12 22:18:06.000000000 +0100
7f0747
@@ -123,11 +123,11 @@ my $tlib="-lnsl -lsocket";
7f0747
 my $bits1="THIRTY_TWO_BIT ";
7f0747
 my $bits2="SIXTY_FOUR_BIT ";
7f0747
 
7f0747
-my $x86_asm="x86cpuid.o:bn-586.o co-586.o x86-mont.o:des-586.o crypt586.o:aes-586.o:bf-586.o:md5-586.o:sha1-586.o sha256-586.o sha512-586.o:cast-586.o:rc4-586.o:rmd-586.o:rc5-586.o:wp_block.o wp-mmx.o:cmll-x86.o";
7f0747
+my $x86_asm="x86cpuid.o:bn-586.o co-586.o x86-mont.o:des-586.o crypt586.o:aes-586.o aesni-x86.o:bf-586.o:md5-586.o:sha1-586.o sha256-586.o sha512-586.o:cast-586.o:rc4-586.o:rmd-586.o:rc5-586.o:wp_block.o wp-mmx.o:cmll-x86.o";
7f0747
 
7f0747
 my $x86_elf_asm="$x86_asm:elf";
7f0747
 
7f0747
-my $x86_64_asm="x86_64cpuid.o:x86_64-gcc.o x86_64-mont.o::aes-x86_64.o::md5-x86_64.o:sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o::rc4-x86_64.o:::wp-x86_64.o:cmll-x86_64.o cmll_misc.o";
7f0747
+my $x86_64_asm="x86_64cpuid.o:x86_64-gcc.o x86_64-mont.o::aes-x86_64.o aesni-x86_64.o::md5-x86_64.o:sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o::rc4-x86_64.o:::wp-x86_64.o:cmll-x86_64.o cmll_misc.o";
7f0747
 my $ia64_asm="ia64cpuid.o:bn-ia64.o::aes_core.o aes_cbc.o aes-ia64.o::md5-ia64.o:sha1-ia64.o sha256-ia64.o sha512-ia64.o::rc4-ia64.o rc4_skey.o:::::void";
7f0747
 my $sparcv9_asm="sparcv9cap.o sparccpuid.o:bn-sparcv9.o sparcv9-mont.o sparcv9a-mont.o:des_enc-sparc.o fcrypt_b.o:aes_core.o aes_cbc.o aes-sparcv9.o:::sha1-sparcv9.o sha256-sparcv9.o sha512-sparcv9.o:::::::void";
7f0747
 my $sparcv8_asm=":sparcv8.o:des_enc-sparc.o fcrypt_b.o:::::::::::void";
7f0747
@@ -491,7 +491,7 @@ my %table=(
7f0747
 #
7f0747
 # Win64 targets, WIN64I denotes IA-64 and WIN64A - AMD64
7f0747
 "VC-WIN64I","cl:-W3 -Gs0 -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DUNICODE -D_UNICODE -D_CRT_SECURE_NO_DEPRECATE:::WIN64I::SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT EXPORT_VAR_AS_FN:ia64cpuid.o:ia64.o::aes_core.o aes_cbc.o aes-ia64.o::md5-ia64.o:sha1-ia64.o sha256-ia64.o sha512-ia64.o:::::::ias:win32",
7f0747
-"VC-WIN64A","cl:-W3 -Gs0 -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DUNICODE -D_UNICODE -D_CRT_SECURE_NO_DEPRECATE:::WIN64A::SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT EXPORT_VAR_AS_FN:x86_64cpuid.o:bn_asm.o x86_64-mont.o::aes-x86_64.o::md5-x86_64.o:sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o::rc4-x86_64.o:::wp-x86_64.o:cmll-x86_64.o cmll_misc.o:auto:win32",
7f0747
+"VC-WIN64A","cl:-W3 -Gs0 -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DUNICODE -D_UNICODE -D_CRT_SECURE_NO_DEPRECATE:::WIN64A::SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT EXPORT_VAR_AS_FN:x86_64cpuid.o:bn_asm.o x86_64-mont.o::aes-x86_64.o aesni-x86_64.o::md5-x86_64.o:sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o::rc4-x86_64.o:::wp-x86_64.o:cmll-x86_64.o cmll_misc.o:auto:win32",
7f0747
 # x86 Win32 target defaults to ANSI API, if you want UNICODE, complement
7f0747
 # 'perl Configure VC-WIN32' with '-DUNICODE -D_UNICODE'
7f0747
 "VC-WIN32","cl:-W3 -WX -Gs0 -GF -Gy -nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -D_CRT_SECURE_NO_DEPRECATE:::WIN32::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}:${x86_asm}:win32n:win32",
7f0747
@@ -1410,6 +1410,7 @@ if ($rmd160_obj =~ /\.o$/)
7f0747
 if ($aes_obj =~ /\.o$/)
7f0747
 	{
7f0747
 	$cflags.=" -DAES_ASM";
7f0747
+	$aes_obj =~ s/\s*aesni\-x86\.o// if ($no_sse2);
7f0747
 	}
7f0747
 else	{
7f0747
 	$aes_obj=$aes_enc;
7f0747
diff -up openssl-1.0.0-beta4/crypto/aes/asm/aesni-x86.pl.aesni openssl-1.0.0-beta4/crypto/aes/asm/aesni-x86.pl
7f0747
--- openssl-1.0.0-beta4/crypto/aes/asm/aesni-x86.pl.aesni	2010-01-12 22:18:06.000000000 +0100
7f0747
+++ openssl-1.0.0-beta4/crypto/aes/asm/aesni-x86.pl	2010-01-12 22:18:06.000000000 +0100
7f0747
@@ -0,0 +1,765 @@
7f0747
+#!/usr/bin/env perl
7f0747
+
7f0747
+# ====================================================================
7f0747
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
7f0747
+# project. The module is, however, dual licensed under OpenSSL and
7f0747
+# CRYPTOGAMS licenses depending on where you obtain it. For further
7f0747
+# details see http://www.openssl.org/~appro/cryptogams/.
7f0747
+# ====================================================================
7f0747
+#
7f0747
+# This module implements support for Intel AES-NI extension. In
7f0747
+# OpenSSL context it's used with Intel engine, but can also be used as
7f0747
+# drop-in replacement for crypto/aes/asm/aes-586.pl [see below for
7f0747
+# details].
7f0747
+
7f0747
+$PREFIX="aesni";	# if $PREFIX is set to "AES", the script
7f0747
+			# generates drop-in replacement for
7f0747
+			# crypto/aes/asm/aes-586.pl:-)
7f0747
+
7f0747
+$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
7f0747
+push(@INC,"${dir}","${dir}../../perlasm");
7f0747
+require "x86asm.pl";
7f0747
+
7f0747
+&asm_init($ARGV[0],$0);
7f0747
+
7f0747
+$movekey = eval($RREFIX eq "aseni" ? "*movaps" : "*movups");
7f0747
+
7f0747
+$len="eax";
7f0747
+$rounds="ecx";
7f0747
+$key="edx";
7f0747
+$inp="esi";
7f0747
+$out="edi";
7f0747
+$rounds_="ebx";	# backup copy for $rounds
7f0747
+$key_="ebp";	# backup copy for $key
7f0747
+
7f0747
+$inout0="xmm0";
7f0747
+$inout1="xmm1";
7f0747
+$inout2="xmm2";
7f0747
+$rndkey0="xmm3";
7f0747
+$rndkey1="xmm4";
7f0747
+$ivec="xmm5";
7f0747
+$in0="xmm6";
7f0747
+$in1="xmm7";	$inout3="xmm7";
7f0747
+
7f0747
+# Inline version of internal aesni_[en|de]crypt1
7f0747
+sub aesni_inline_generate1
7f0747
+{ my $p=shift;
7f0747
+
7f0747
+    &$movekey		($rndkey0,&QWP(0,$key));
7f0747
+    &$movekey		($rndkey1,&QWP(16,$key));
7f0747
+    &lea		($key,&DWP(32,$key));
7f0747
+    &pxor		($inout0,$rndkey0);
7f0747
+    &set_label("${p}1_loop");
7f0747
+	eval"&aes${p}	($inout0,$rndkey1)";
7f0747
+	&dec		($rounds);
7f0747
+	&$movekey	($rndkey1,&QWP(0,$key));
7f0747
+	&lea		($key,&DWP(16,$key));
7f0747
+    &jnz		(&label("${p}1_loop"));
7f0747
+    eval"&aes${p}last	($inout0,$rndkey1)";
7f0747
+}
7f0747
+
7f0747
+sub aesni_generate1	# fully unrolled loop
7f0747
+{ my $p=shift;
7f0747
+
7f0747
+    &function_begin_B("_aesni_${p}rypt1");
7f0747
+	&$movekey	($rndkey0,&QWP(0,$key));
7f0747
+	&$movekey	($rndkey1,&QWP(0x10,$key));
7f0747
+	&cmp		($rounds,11);
7f0747
+	&pxor		($inout0,$rndkey0);
7f0747
+	&$movekey	($rndkey0,&QWP(0x20,$key));
7f0747
+	&lea		($key,&DWP(0x30,$key));
7f0747
+	&jb		(&label("${p}128"));
7f0747
+	&lea		($key,&DWP(0x20,$key));
7f0747
+	&je		(&label("${p}192"));
7f0747
+	&lea		($key,&DWP(0x20,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey1)";
7f0747
+	&$movekey	($rndkey1,&QWP(-0x40,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey0)";
7f0747
+	&$movekey	($rndkey0,&QWP(-0x30,$key));
7f0747
+    &set_label("${p}192");
7f0747
+	eval"&aes${p}	($inout0,$rndkey1)";
7f0747
+	&$movekey	($rndkey1,&QWP(-0x20,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey0)";
7f0747
+	&$movekey	($rndkey0,&QWP(-0x10,$key));
7f0747
+    &set_label("${p}128");
7f0747
+	eval"&aes${p}	($inout0,$rndkey1)";
7f0747
+	&$movekey	($rndkey1,&QWP(0,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey0)";
7f0747
+	&$movekey	($rndkey0,&QWP(0x10,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey1)";
7f0747
+	&$movekey	($rndkey1,&QWP(0x20,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey0)";
7f0747
+	&$movekey	($rndkey0,&QWP(0x30,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey1)";
7f0747
+	&$movekey	($rndkey1,&QWP(0x40,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey0)";
7f0747
+	&$movekey	($rndkey0,&QWP(0x50,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey1)";
7f0747
+	&$movekey	($rndkey1,&QWP(0x60,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey0)";
7f0747
+	&$movekey	($rndkey0,&QWP(0x70,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey1)";
7f0747
+    eval"&aes${p}last	($inout0,$rndkey0)";
7f0747
+    &ret();
7f0747
+    &function_end_B("_aesni_${p}rypt1");
7f0747
+}
7f0747
+
7f0747
+# void $PREFIX_encrypt (const void *inp,void *out,const AES_KEY *key);
7f0747
+# &aesni_generate1("dec");
7f0747
+&function_begin_B("${PREFIX}_encrypt");
7f0747
+	&mov	("eax",&wparam(0));
7f0747
+	&mov	($key,&wparam(2));
7f0747
+	&movups	($inout0,&QWP(0,"eax"));
7f0747
+	&mov	($rounds,&DWP(240,$key));
7f0747
+	&mov	("eax",&wparam(1));
7f0747
+	&aesni_inline_generate1("enc");	# &call	("_aesni_encrypt1");
7f0747
+	&movups	(&QWP(0,"eax"),$inout0);
7f0747
+	&ret	();
7f0747
+&function_end_B("${PREFIX}_encrypt");
7f0747
+
7f0747
+# void $PREFIX_decrypt (const void *inp,void *out,const AES_KEY *key);
7f0747
+# &aesni_generate1("dec");
7f0747
+&function_begin_B("${PREFIX}_decrypt");
7f0747
+	&mov	("eax",&wparam(0));
7f0747
+	&mov	($key,&wparam(2));
7f0747
+	&movups	($inout0,&QWP(0,"eax"));
7f0747
+	&mov	($rounds,&DWP(240,$key));
7f0747
+	&mov	("eax",&wparam(1));
7f0747
+	&aesni_inline_generate1("dec");	# &call	("_aesni_decrypt1");
7f0747
+	&movups	(&QWP(0,"eax"),$inout0);
7f0747
+	&ret	();
7f0747
+&function_end_B("${PREFIX}_decrypt");
7f0747
+
7f0747
+# _aesni_[en|de]crypt[34] are private interfaces, N denotes interleave
7f0747
+# factor. Why 3x subroutine is used in loops? Even though aes[enc|dec]
7f0747
+# latency is 6, it turned out that it can be scheduled only every
7f0747
+# *second* cycle. Thus 3x interleave is the one providing optimal
7f0747
+# utilization, i.e. when subroutine's throughput is virtually same as
7f0747
+# of non-interleaved subroutine [for number of input blocks up to 3].
7f0747
+# This is why it makes no sense to implement 2x subroutine. As soon
7f0747
+# as/if Intel improves throughput by making it possible to schedule
7f0747
+# the instructions in question *every* cycles I would have to
7f0747
+# implement 6x interleave and use it in loop...
7f0747
+sub aesni_generate3
7f0747
+{ my $p=shift;
7f0747
+
7f0747
+    &function_begin_B("_aesni_${p}rypt3");
7f0747
+	&$movekey	($rndkey0,&QWP(0,$key));
7f0747
+	&shr		($rounds,1);
7f0747
+	&$movekey	($rndkey1,&QWP(16,$key));
7f0747
+	&lea		($key,&DWP(32,$key));
7f0747
+	&pxor		($inout0,$rndkey0);
7f0747
+	&pxor		($inout1,$rndkey0);
7f0747
+	&pxor		($inout2,$rndkey0);
7f0747
+	&jmp		(&label("${p}3_loop"));
7f0747
+    &set_label("${p}3_loop",16);
7f0747
+	eval"&aes${p}	($inout0,$rndkey1)";
7f0747
+	&$movekey	($rndkey0,&QWP(0,$key));
7f0747
+	eval"&aes${p}	($inout1,$rndkey1)";
7f0747
+	&dec		($rounds);
7f0747
+	eval"&aes${p}	($inout2,$rndkey1)";
7f0747
+	&$movekey	($rndkey1,&QWP(16,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey0)";
7f0747
+	&lea		($key,&DWP(32,$key));
7f0747
+	eval"&aes${p}	($inout1,$rndkey0)";
7f0747
+	eval"&aes${p}	($inout2,$rndkey0)";
7f0747
+	&jnz		(&label("${p}3_loop"));
7f0747
+    eval"&aes${p}	($inout0,$rndkey1)";
7f0747
+    &$movekey		($rndkey0,&QWP(0,$key));
7f0747
+    eval"&aes${p}	($inout1,$rndkey1)";
7f0747
+    eval"&aes${p}	($inout2,$rndkey1)";
7f0747
+    eval"&aes${p}last	($inout0,$rndkey0)";
7f0747
+    eval"&aes${p}last	($inout1,$rndkey0)";
7f0747
+    eval"&aes${p}last	($inout2,$rndkey0)";
7f0747
+    &ret();
7f0747
+    &function_end_B("_aesni_${p}rypt3");
7f0747
+}
7f0747
+
7f0747
+# 4x interleave is implemented to improve small block performance,
7f0747
+# most notably [and naturally] 4 block by ~30%. One can argue that one
7f0747
+# should have implemented 5x as well, but improvement  would be <20%,
7f0747
+# so it's not worth it...
7f0747
+sub aesni_generate4
7f0747
+{ my $p=shift;
7f0747
+
7f0747
+    &function_begin_B("_aesni_${p}rypt4");
7f0747
+	&$movekey	($rndkey0,&QWP(0,$key));
7f0747
+	&$movekey	($rndkey1,&QWP(16,$key));
7f0747
+	&shr		($rounds,1);
7f0747
+	&lea		($key,&DWP(32,$key));
7f0747
+	&pxor		($inout0,$rndkey0);
7f0747
+	&pxor		($inout1,$rndkey0);
7f0747
+	&pxor		($inout2,$rndkey0);
7f0747
+	&pxor		($inout3,$rndkey0);
7f0747
+	&jmp		(&label("${p}3_loop"));
7f0747
+    &set_label("${p}3_loop",16);
7f0747
+	eval"&aes${p}	($inout0,$rndkey1)";
7f0747
+	&$movekey	($rndkey0,&QWP(0,$key));
7f0747
+	eval"&aes${p}	($inout1,$rndkey1)";
7f0747
+	&dec		($rounds);
7f0747
+	eval"&aes${p}	($inout2,$rndkey1)";
7f0747
+	eval"&aes${p}	($inout3,$rndkey1)";
7f0747
+	&$movekey	($rndkey1,&QWP(16,$key));
7f0747
+	eval"&aes${p}	($inout0,$rndkey0)";
7f0747
+	&lea		($key,&DWP(32,$key));
7f0747
+	eval"&aes${p}	($inout1,$rndkey0)";
7f0747
+	eval"&aes${p}	($inout2,$rndkey0)";
7f0747
+	eval"&aes${p}	($inout3,$rndkey0)";
7f0747
+	&jnz		(&label("${p}3_loop"));
7f0747
+    eval"&aes${p}	($inout0,$rndkey1)";
7f0747
+    &$movekey		($rndkey0,&QWP(0,$key));
7f0747
+    eval"&aes${p}	($inout1,$rndkey1)";
7f0747
+    eval"&aes${p}	($inout2,$rndkey1)";
7f0747
+    eval"&aes${p}	($inout3,$rndkey1)";
7f0747
+    eval"&aes${p}last	($inout0,$rndkey0)";
7f0747
+    eval"&aes${p}last	($inout1,$rndkey0)";
7f0747
+    eval"&aes${p}last	($inout2,$rndkey0)";
7f0747
+    eval"&aes${p}last	($inout3,$rndkey0)";
7f0747
+    &ret();
7f0747
+    &function_end_B("_aesni_${p}rypt4");
7f0747
+}
7f0747
+&aesni_generate3("enc") if ($PREFIX eq "aesni");
7f0747
+&aesni_generate3("dec");
7f0747
+&aesni_generate4("enc") if ($PREFIX eq "aesni");
7f0747
+&aesni_generate4("dec");
7f0747
+
7f0747
+if ($PREFIX eq "aesni") {
7f0747
+# void aesni_ecb_encrypt (const void *in, void *out,
7f0747
+#                         size_t length, const AES_KEY *key,
7f0747
+#                         int enc);
7f0747
+&function_begin("aesni_ecb_encrypt");
7f0747
+	&mov	($inp,&wparam(0));
7f0747
+	&mov	($out,&wparam(1));
7f0747
+	&mov	($len,&wparam(2));
7f0747
+	&mov	($key,&wparam(3));
7f0747
+	&mov	($rounds,&wparam(4));
7f0747
+	&cmp	($len,16);
7f0747
+	&jb	(&label("ecb_ret"));
7f0747
+	&and	($len,-16);
7f0747
+	&test	($rounds,$rounds)
7f0747
+	&mov	($rounds,&DWP(240,$key));
7f0747
+	&mov	($key_,$key);		# backup $key
7f0747
+	&mov	($rounds_,$rounds);	# backup $rounds
7f0747
+	&jz	(&label("ecb_decrypt"));
7f0747
+
7f0747
+	&sub	($len,0x40);
7f0747
+	&jbe	(&label("ecb_enc_tail"));
7f0747
+	&jmp	(&label("ecb_enc_loop3"));
7f0747
+
7f0747
+&set_label("ecb_enc_loop3",16);
7f0747
+	&movups	($inout0,&QWP(0,$inp));
7f0747
+	&movups	($inout1,&QWP(0x10,$inp));
7f0747
+	&movups	($inout2,&QWP(0x20,$inp));
7f0747
+	&call	("_aesni_encrypt3");
7f0747
+	&sub	($len,0x30);
7f0747
+	&lea	($inp,&DWP(0x30,$inp));
7f0747
+	&lea	($out,&DWP(0x30,$out));
7f0747
+	&movups	(&QWP(-0x30,$out),$inout0);
7f0747
+	&mov	($key,$key_);		# restore $key
7f0747
+	&movups	(&QWP(-0x20,$out),$inout1);
7f0747
+	&mov	($rounds,$rounds_);	# restore $rounds
7f0747
+	&movups	(&QWP(-0x10,$out),$inout2);
7f0747
+	&ja	(&label("ecb_enc_loop3"));
7f0747
+
7f0747
+&set_label("ecb_enc_tail");
7f0747
+	&add	($len,0x40);
7f0747
+	&jz	(&label("ecb_ret"));
7f0747
+
7f0747
+	&cmp	($len,0x10);
7f0747
+	&movups	($inout0,&QWP(0,$inp));
7f0747
+	&je	(&label("ecb_enc_one"));
7f0747
+	&cmp	($len,0x20);
7f0747
+	&movups	($inout1,&QWP(0x10,$inp));
7f0747
+	&je	(&label("ecb_enc_two"));
7f0747
+	&cmp	($len,0x30);
7f0747
+	&movups	($inout2,&QWP(0x20,$inp));
7f0747
+	&je	(&label("ecb_enc_three"));
7f0747
+	&movups	($inout3,&QWP(0x30,$inp));
7f0747
+	&call	("_aesni_encrypt4");
7f0747
+	&movups	(&QWP(0,$out),$inout0);
7f0747
+	&movups	(&QWP(0x10,$out),$inout1);
7f0747
+	&movups	(&QWP(0x20,$out),$inout2);
7f0747
+	&movups	(&QWP(0x30,$out),$inout3);
7f0747
+	jmp	(&label("ecb_ret"));
7f0747
+
7f0747
+&set_label("ecb_enc_one",16);
7f0747
+	&aesni_inline_generate1("enc");	# &call	("_aesni_encrypt1");
7f0747
+	&movups	(&QWP(0,$out),$inout0);
7f0747
+	&jmp	(&label("ecb_ret"));
7f0747
+
7f0747
+&set_label("ecb_enc_two",16);
7f0747
+	&call	("_aesni_encrypt3");
7f0747
+	&movups	(&QWP(0,$out),$inout0);
7f0747
+	&movups	(&QWP(0x10,$out),$inout1);
7f0747
+	&jmp	(&label("ecb_ret"));
7f0747
+
7f0747
+&set_label("ecb_enc_three",16);
7f0747
+	&call	("_aesni_encrypt3");
7f0747
+	&movups	(&QWP(0,$out),$inout0);
7f0747
+	&movups	(&QWP(0x10,$out),$inout1);
7f0747
+	&movups	(&QWP(0x20,$out),$inout2);
7f0747
+	&jmp	(&label("ecb_ret"));
7f0747
+
7f0747
+&set_label("ecb_decrypt",16);
7f0747
+	&sub	($len,0x40);
7f0747
+	&jbe	(&label("ecb_dec_tail"));
7f0747
+	&jmp	(&label("ecb_dec_loop3"));
7f0747
+
7f0747
+&set_label("ecb_dec_loop3",16);
7f0747
+	&movups	($inout0,&QWP(0,$inp));
7f0747
+	&movups	($inout1,&QWP(0x10,$inp));
7f0747
+	&movups	($inout2,&QWP(0x20,$inp));
7f0747
+	&call	("_aesni_decrypt3");
7f0747
+	&sub	($len,0x30);
7f0747
+	&lea	($inp,&DWP(0x30,$inp));
7f0747
+	&lea	($out,&DWP(0x30,$out));
7f0747
+	&movups	(&QWP(-0x30,$out),$inout0);
7f0747
+	&mov	($key,$key_);		# restore $key
7f0747
+	&movups	(&QWP(-0x20,$out),$inout1);
7f0747
+	&mov	($rounds,$rounds_);	# restore $rounds
7f0747
+	&movups	(&QWP(-0x10,$out),$inout2);
7f0747
+	&ja	(&label("ecb_dec_loop3"));
7f0747
+
7f0747
+&set_label("ecb_dec_tail");
7f0747
+	&add	($len,0x40);
7f0747
+	&jz	(&label("ecb_ret"));
7f0747
+
7f0747
+	&cmp	($len,0x10);
7f0747
+	&movups	($inout0,&QWP(0,$inp));
7f0747
+	&je	(&label("ecb_dec_one"));
7f0747
+	&cmp	($len,0x20);
7f0747
+	&movups	($inout1,&QWP(0x10,$inp));
7f0747
+	&je	(&label("ecb_dec_two"));
7f0747
+	&cmp	($len,0x30);
7f0747
+	&movups	($inout2,&QWP(0x20,$inp));
7f0747
+	&je	(&label("ecb_dec_three"));
7f0747
+	&movups	($inout3,&QWP(0x30,$inp));
7f0747
+	&call	("_aesni_decrypt4");
7f0747
+	&movups	(&QWP(0,$out),$inout0);
7f0747
+	&movups	(&QWP(0x10,$out),$inout1);
7f0747
+	&movups	(&QWP(0x20,$out),$inout2);
7f0747
+	&movups	(&QWP(0x30,$out),$inout3);
7f0747
+	&jmp	(&label("ecb_ret"));
7f0747
+
7f0747
+&set_label("ecb_dec_one",16);
7f0747
+	&aesni_inline_generate1("dec");	# &call	("_aesni_decrypt3");
7f0747
+	&movups	(&QWP(0,$out),$inout0);
7f0747
+	&jmp	(&label("ecb_ret"));
7f0747
+
7f0747
+&set_label("ecb_dec_two",16);
7f0747
+	&call	("_aesni_decrypt3");
7f0747
+	&movups	(&QWP(0,$out),$inout0);
7f0747
+	&movups	(&QWP(0x10,$out),$inout1);
7f0747
+	&jmp	(&label("ecb_ret"));
7f0747
+
7f0747
+&set_label("ecb_dec_three",16);
7f0747
+	&call	("_aesni_decrypt3");
7f0747
+	&movups	(&QWP(0,$out),$inout0);
7f0747
+	&movups	(&QWP(0x10,$out),$inout1);
7f0747
+	&movups	(&QWP(0x20,$out),$inout2);
7f0747
+
7f0747
+&set_label("ecb_ret");
7f0747
+&function_end("aesni_ecb_encrypt");
7f0747
+}
7f0747
+
7f0747
+# void $PREFIX_cbc_encrypt (const void *inp, void *out,
7f0747
+#                           size_t length, const AES_KEY *key,
7f0747
+#                           unsigned char *ivp,const int enc);
7f0747
+&function_begin("${PREFIX}_cbc_encrypt");
7f0747
+	&mov	($inp,&wparam(0));
7f0747
+	&mov	($out,&wparam(1));
7f0747
+	&mov	($len,&wparam(2));
7f0747
+	&mov	($key,&wparam(3));
7f0747
+	&test	($len,$len);
7f0747
+	&mov	($key_,&wparam(4));
7f0747
+	&jz	(&label("cbc_ret"));
7f0747
+
7f0747
+	&cmp	(&wparam(5),0);
7f0747
+	&movups	($ivec,&QWP(0,$key_));	# load IV
7f0747
+	&mov	($rounds,&DWP(240,$key));
7f0747
+	&mov	($key_,$key);		# backup $key
7f0747
+	&mov	($rounds_,$rounds);	# backup $rounds
7f0747
+	&je	(&label("cbc_decrypt"));
7f0747
+
7f0747
+	&movaps	($inout0,$ivec);
7f0747
+	&cmp	($len,16);
7f0747
+	&jb	(&label("cbc_enc_tail"));
7f0747
+	&sub	($len,16);
7f0747
+	&jmp	(&label("cbc_enc_loop"));
7f0747
+
7f0747
+&set_label("cbc_enc_loop",16);
7f0747
+	&movups	($ivec,&QWP(0,$inp));
7f0747
+	&lea	($inp,&DWP(16,$inp));
7f0747
+	&pxor	($inout0,$ivec);
7f0747
+	&aesni_inline_generate1("enc");	# &call	("_aesni_encrypt3");
7f0747
+	&sub	($len,16);
7f0747
+	&lea	($out,&DWP(16,$out));
7f0747
+	&mov	($rounds,$rounds_);	# restore $rounds
7f0747
+	&mov	($key,$key_);		# restore $key
7f0747
+	&movups	(&QWP(-16,$out),$inout0);
7f0747
+	&jnc	(&label("cbc_enc_loop"));
7f0747
+	&add	($len,16);
7f0747
+	&jnz	(&label("cbc_enc_tail"));
7f0747
+	&movaps	($ivec,$inout0);
7f0747
+	&jmp	(&label("cbc_ret"));
7f0747
+
7f0747
+&set_label("cbc_enc_tail");
7f0747
+	&mov	("ecx",$len);		# zaps $rounds
7f0747
+	&data_word(0xA4F3F689);		# rep movsb
7f0747
+	&mov	("ecx",16);		# zero tail
7f0747
+	&sub	("ecx",$len);
7f0747
+	&xor	("eax","eax");		# zaps $len
7f0747
+	&data_word(0xAAF3F689);		# rep stosb
7f0747
+	&lea	($out,&DWP(-16,$out));	# rewind $out by 1 block
7f0747
+	&mov	($rounds,$rounds_);	# restore $rounds
7f0747
+	&mov	($inp,$out);		# $inp and $out are the same
7f0747
+	&mov	($key,$key_);		# restore $key
7f0747
+	&jmp	(&label("cbc_enc_loop"));
7f0747
+
7f0747
+&set_label("cbc_decrypt",16);
7f0747
+	&sub	($len,0x40);
7f0747
+	&jbe	(&label("cbc_dec_tail"));
7f0747
+	&jmp	(&label("cbc_dec_loop3"));
7f0747
+
7f0747
+&set_label("cbc_dec_loop3",16);
7f0747
+	&movups	($inout0,&QWP(0,$inp));
7f0747
+	&movups	($inout1,&QWP(0x10,$inp));
7f0747
+	&movups	($inout2,&QWP(0x20,$inp));
7f0747
+	&movaps	($in0,$inout0);
7f0747
+	&movaps	($in1,$inout1);
7f0747
+	&call	("_aesni_decrypt3");
7f0747
+	&sub	($len,0x30);
7f0747
+	&lea	($inp,&DWP(0x30,$inp));
7f0747
+	&lea	($out,&DWP(0x30,$out));
7f0747
+	&pxor	($inout0,$ivec);
7f0747
+	&pxor	($inout1,$in0);
7f0747
+	&movups	($ivec,&QWP(-0x10,$inp));
7f0747
+	&pxor	($inout2,$in1);
7f0747
+	&movups	(&QWP(-0x30,$out),$inout0);
7f0747
+	&mov	($rounds,$rounds_)	# restore $rounds
7f0747
+	&movups	(&QWP(-0x20,$out),$inout1);
7f0747
+	&mov	($key,$key_);		# restore $key
7f0747
+	&movups	(&QWP(-0x10,$out),$inout2);
7f0747
+	&ja	(&label("cbc_dec_loop3"));
7f0747
+
7f0747
+&set_label("cbc_dec_tail");
7f0747
+	&add	($len,0x40);
7f0747
+	&jz	(&label("cbc_ret"));
7f0747
+
7f0747
+	&movups	($inout0,&QWP(0,$inp));
7f0747
+	&cmp	($len,0x10);
7f0747
+	&movaps	($in0,$inout0);
7f0747
+	&jbe	(&label("cbc_dec_one"));
7f0747
+	&movups	($inout1,&QWP(0x10,$inp));
7f0747
+	&cmp	($len,0x20);
7f0747
+	&movaps	($in1,$inout1);
7f0747
+	&jbe	(&label("cbc_dec_two"));
7f0747
+	&movups	($inout2,&QWP(0x20,$inp));
7f0747
+	&cmp	($len,0x30);
7f0747
+	&jbe	(&label("cbc_dec_three"));
7f0747
+	&movups	($inout3,&QWP(0x30,$inp));
7f0747
+	&call	("_aesni_decrypt4");
7f0747
+	&movups	($rndkey0,&QWP(0x10,$inp));
7f0747
+	&movups	($rndkey1,&QWP(0x20,$inp));
7f0747
+	&pxor	($inout0,$ivec);
7f0747
+	&pxor	($inout1,$in0);
7f0747
+	&movups	($ivec,&QWP(0x30,$inp));
7f0747
+	&movups	(&QWP(0,$out),$inout0);
7f0747
+	&pxor	($inout2,$rndkey0);
7f0747
+	&pxor	($inout3,$rndkey1);
7f0747
+	&movups	(&QWP(0x10,$out),$inout1);
7f0747
+	&movups	(&QWP(0x20,$out),$inout2);
7f0747
+	&movaps	($inout0,$inout3);
7f0747
+	&lea	($out,&DWP(0x30,$out));
7f0747
+	&jmp	(&label("cbc_dec_tail_collected"));
7f0747
+
7f0747
+&set_label("cbc_dec_one");
7f0747
+	&aesni_inline_generate1("dec");	# &call	("_aesni_decrypt3");
7f0747
+	&pxor	($inout0,$ivec);
7f0747
+	&movaps	($ivec,$in0);
7f0747
+	&jmp	(&label("cbc_dec_tail_collected"));
7f0747
+
7f0747
+&set_label("cbc_dec_two");
7f0747
+	&call	("_aesni_decrypt3");
7f0747
+	&pxor	($inout0,$ivec);
7f0747
+	&pxor	($inout1,$in0);
7f0747
+	&movups	(&QWP(0,$out),$inout0);
7f0747
+	&movaps	($inout0,$inout1);
7f0747
+	&movaps	($ivec,$in1);
7f0747
+	&lea	($out,&DWP(0x10,$out));
7f0747
+	&jmp	(&label("cbc_dec_tail_collected"));
7f0747
+
7f0747
+&set_label("cbc_dec_three");
7f0747
+	&call	("_aesni_decrypt3");
7f0747
+	&pxor	($inout0,$ivec);
7f0747
+	&pxor	($inout1,$in0);
7f0747
+	&pxor	($inout2,$in1);
7f0747
+	&movups	(&QWP(0,$out),$inout0);
7f0747
+	&movups	(&QWP(0x10,$out),$inout1);
7f0747
+	&movaps	($inout0,$inout2);
7f0747
+	&movups	($ivec,&QWP(0x20,$inp));
7f0747
+	&lea	($out,&DWP(0x20,$out));
7f0747
+
7f0747
+&set_label("cbc_dec_tail_collected");
7f0747
+	&and	($len,15);
7f0747
+	&jnz	(&label("cbc_dec_tail_partial"));
7f0747
+	&movups	(&QWP(0,$out),$inout0);
7f0747
+	&jmp	(&label("cbc_ret"));
7f0747
+
7f0747
+&set_label("cbc_dec_tail_partial");
7f0747
+	&mov	($key_,"esp");
7f0747
+	&sub	("esp",16);
7f0747
+	&and	("esp",-16);
7f0747
+	&movaps	(&QWP(0,"esp"),$inout0);
7f0747
+	&mov	($inp,"esp");
7f0747
+	&mov	("ecx",$len);
7f0747
+	&data_word(0xA4F3F689);		# rep movsb
7f0747
+	&mov	("esp",$key_);
7f0747
+
7f0747
+&set_label("cbc_ret");
7f0747
+	&mov	($key_,&wparam(4));
7f0747
+	&movups	(&QWP(0,$key_),$ivec);	# output IV
7f0747
+&function_end("${PREFIX}_cbc_encrypt");
7f0747
+
7f0747
+# Mechanical port from aesni-x86_64.pl.
7f0747
+#
7f0747
+# _aesni_set_encrypt_key is private interface,
7f0747
+# input:
7f0747
+#	"eax"	const unsigned char *userKey
7f0747
+#	$rounds	int bits
7f0747
+#	$key	AES_KEY *key
7f0747
+# output:
7f0747
+#	"eax"	return code
7f0747
+#	$round	rounds
7f0747
+
7f0747
+&function_begin_B("_aesni_set_encrypt_key");
7f0747
+	&test	("eax","eax");
7f0747
+	&jz	(&label("bad_pointer"));
7f0747
+	&test	($key,$key);
7f0747
+	&jz	(&label("bad_pointer"));
7f0747
+
7f0747
+	&movups	("xmm0",&QWP(0,"eax"));	# pull first 128 bits of *userKey
7f0747
+	&pxor	("xmm4","xmm4");	# low dword of xmm4 is assumed 0
7f0747
+	&lea	($key,&DWP(16,$key));
7f0747
+	&cmp	($rounds,256);
7f0747
+	&je	(&label("14rounds"));
7f0747
+	&cmp	($rounds,192);
7f0747
+	&je	(&label("12rounds"));
7f0747
+	&cmp	($rounds,128);
7f0747
+	&jne	(&label("bad_keybits"));
7f0747
+
7f0747
+&set_label("10rounds",16);
7f0747
+	&mov		($rounds,9);
7f0747
+	&$movekey	(&QWP(-16,$key),"xmm0");	# round 0
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x01);		# round 1
7f0747
+	&call		(&label("key_128_cold"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x2);		# round 2
7f0747
+	&call		(&label("key_128"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x04);		# round 3
7f0747
+	&call		(&label("key_128"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x08);		# round 4
7f0747
+	&call		(&label("key_128"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x10);		# round 5
7f0747
+	&call		(&label("key_128"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x20);		# round 6
7f0747
+	&call		(&label("key_128"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x40);		# round 7
7f0747
+	&call		(&label("key_128"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x80);		# round 8
7f0747
+	&call		(&label("key_128"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x1b);		# round 9
7f0747
+	&call		(&label("key_128"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x36);		# round 10
7f0747
+	&call		(&label("key_128"));
7f0747
+	&$movekey	(&QWP(0,$key),"xmm0");
7f0747
+	&mov		(&DWP(80,$key),$rounds);
7f0747
+	&xor		("eax","eax");
7f0747
+	&ret();
7f0747
+
7f0747
+&set_label("key_128",16);
7f0747
+	&$movekey	(&QWP(0,$key),"xmm0");
7f0747
+	&lea		($key,&DWP(16,$key));
7f0747
+&set_label("key_128_cold");
7f0747
+	&shufps		("xmm4","xmm0",0b00010000);
7f0747
+	&pxor		("xmm0","xmm4");
7f0747
+	&shufps		("xmm4","xmm0",0b10001100,);
7f0747
+	&pxor		("xmm0","xmm4");
7f0747
+	&pshufd		("xmm1","xmm1",0b11111111);	# critical path
7f0747
+	&pxor		("xmm0","xmm1");
7f0747
+	&ret();
7f0747
+
7f0747
+&set_label("12rounds",16);
7f0747
+	&movq		("xmm2",&QWP(16,"eax"));	# remaining 1/3 of *userKey
7f0747
+	&mov		($rounds,11);
7f0747
+	&$movekey	(&QWP(-16,$key),"xmm0")		# round 0
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x01);		# round 1,2
7f0747
+	&call		(&label("key_192a_cold"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x02);		# round 2,3
7f0747
+	&call		(&label("key_192b"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x04);		# round 4,5
7f0747
+	&call		(&label("key_192a"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x08);		# round 5,6
7f0747
+	&call		(&label("key_192b"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x10);		# round 7,8
7f0747
+	&call		(&label("key_192a"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x20);		# round 8,9
7f0747
+	&call		(&label("key_192b"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x40);		# round 10,11
7f0747
+	&call		(&label("key_192a"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x80);		# round 11,12
7f0747
+	&call		(&label("key_192b"));
7f0747
+	&$movekey	(&QWP(0,$key),"xmm0");
7f0747
+	&mov		(&DWP(48,$key),$rounds);
7f0747
+	&xor		("eax","eax");
7f0747
+	&ret();
7f0747
+
7f0747
+&set_label("key_192a",16);
7f0747
+	&$movekey	(&QWP(0,$key),"xmm0");
7f0747
+	&lea		($key,&DWP(16,$key));
7f0747
+&set_label("key_192a_cold",16);
7f0747
+	&movaps		("xmm5","xmm2");
7f0747
+&set_label("key_192b_warm");
7f0747
+	&shufps		("xmm4","xmm0",0b00010000);
7f0747
+	&movaps		("xmm3","xmm2");
7f0747
+	&pxor		("xmm0","xmm4");
7f0747
+	&shufps		("xmm4","xmm0",0b10001100);
7f0747
+	&pslldq		("xmm3",4);
7f0747
+	&pxor		("xmm0","xmm4");
7f0747
+	&pshufd		("xmm1","xmm1",0b01010101);	# critical path
7f0747
+	&pxor		("xmm2","xmm3");
7f0747
+	&pxor		("xmm0","xmm1");
7f0747
+	&pshufd		("xmm3","xmm0",0b11111111);
7f0747
+	&pxor		("xmm2","xmm3");
7f0747
+	&ret();
7f0747
+
7f0747
+&set_label("key_192b",16);
7f0747
+	&movaps		("xmm3","xmm0");
7f0747
+	&shufps		("xmm5","xmm0",0b01000100);
7f0747
+	&$movekey	(&QWP(0,$key),"xmm5");
7f0747
+	&shufps		("xmm3","xmm2",0b01001110);
7f0747
+	&$movekey	(&QWP(16,$key),"xmm3");
7f0747
+	&lea		($key,&DWP(32,$key));
7f0747
+	&jmp		(&label("key_192b_warm"));
7f0747
+
7f0747
+&set_label("14rounds",16);
7f0747
+	&movups		("xmm2",&QWP(16,"eax"));	# remaining half of *userKey
7f0747
+	&mov		($rounds,13);
7f0747
+	&lea		($key,&DWP(16,$key));
7f0747
+	&$movekey	(&QWP(-32,$key),"xmm0");	# round 0
7f0747
+	&$movekey	(&QWP(-16,$key),"xmm2");	# round 1
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x01);		# round 2
7f0747
+	&call		(&label("key_256a_cold"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x01);		# round 3
7f0747
+	&call		(&label("key_256b"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x02);		# round 4
7f0747
+	&call		(&label("key_256a"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x02);		# round 5
7f0747
+	&call		(&label("key_256b"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x04);		# round 6
7f0747
+	&call		(&label("key_256a"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x04);		# round 7
7f0747
+	&call		(&label("key_256b"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x08);		# round 8
7f0747
+	&call		(&label("key_256a"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x08);		# round 9
7f0747
+	&call		(&label("key_256b"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x10);		# round 10
7f0747
+	&call		(&label("key_256a"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x10);		# round 11
7f0747
+	&call		(&label("key_256b"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x20);		# round 12
7f0747
+	&call		(&label("key_256a"));
7f0747
+	&aeskeygenassist("xmm1","xmm0",0x20);		# round 13
7f0747
+	&call		(&label("key_256b"));
7f0747
+	&aeskeygenassist("xmm1","xmm2",0x40);		# round 14
7f0747
+	&call		(&label("key_256a"));
7f0747
+	&$movekey	(&QWP(0,$key),"xmm0");
7f0747
+	&mov		(&DWP(16,$key),$rounds);
7f0747
+	&xor		("eax","eax");
7f0747
+	&ret();
7f0747
+
7f0747
+&set_label("key_256a",16);
7f0747
+	&$movekey	(&QWP(0,$key),"xmm2");
7f0747
+	&lea		($key,&DWP(16,$key));
7f0747
+&set_label("key_256a_cold");
7f0747
+	&shufps		("xmm4","xmm0",0b00010000);
7f0747
+	&pxor		("xmm0","xmm4");
7f0747
+	&shufps		("xmm4","xmm0",0b10001100);
7f0747
+	&pxor		("xmm0","xmm4");
7f0747
+	&pshufd		("xmm1","xmm1",0b11111111);	# critical path
7f0747
+	&pxor		("xmm0","xmm1");
7f0747
+	&ret();
7f0747
+
7f0747
+&set_label("key_256b",16);
7f0747
+	&$movekey	(&QWP(0,$key),"xmm0");
7f0747
+	&lea		($key,&DWP(16,$key));
7f0747
+
7f0747
+	&shufps		("xmm4","xmm2",0b00010000);
7f0747
+	&pxor		("xmm2","xmm4");
7f0747
+	&shufps		("xmm4","xmm2",0b10001100);
7f0747
+	&pxor		("xmm2","xmm4");
7f0747
+	&pshufd		("xmm1","xmm1",0b10101010);	# critical path
7f0747
+	&pxor		("xmm2","xmm1");
7f0747
+	&ret();
7f0747
+
7f0747
+&set_label("bad_pointer",4);
7f0747
+	&mov	("eax",-1);
7f0747
+	&ret	();
7f0747
+&set_label("bad_keybits",4);
7f0747
+	&mov	("eax",-2);
7f0747
+	&ret	();
7f0747
+&function_end_B("_aesni_set_encrypt_key");
7f0747
+
7f0747
+# int $PREFIX_set_encrypt_key (const unsigned char *userKey, int bits,
7f0747
+#                              AES_KEY *key)
7f0747
+&function_begin_B("${PREFIX}_set_encrypt_key");
7f0747
+	&mov	("eax",&wparam(0));
7f0747
+	&mov	($rounds,&wparam(1));
7f0747
+	&mov	($key,&wparam(2));
7f0747
+	&call	("_aesni_set_encrypt_key");
7f0747
+	&ret	();
7f0747
+&function_end_B("${PREFIX}_set_encrypt_key");
7f0747
+
7f0747
+# int $PREFIX_set_decrypt_key (const unsigned char *userKey, int bits,
7f0747
+#                              AES_KEY *key)
7f0747
+&function_begin_B("${PREFIX}_set_decrypt_key");
7f0747
+	&mov	("eax",&wparam(0));
7f0747
+	&mov	($rounds,&wparam(1));
7f0747
+	&mov	($key,&wparam(2));
7f0747
+	&call	("_aesni_set_encrypt_key");
7f0747
+	&mov	($key,&wparam(2));
7f0747
+	&shl	($rounds,4)	# rounds-1 after _aesni_set_encrypt_key
7f0747
+	&test	("eax","eax");
7f0747
+	&jnz	(&label("dec_key_ret"));
7f0747
+	&lea	("eax",&DWP(16,$key,$rounds));	# end of key schedule
7f0747
+
7f0747
+	&$movekey	("xmm0",&QWP(0,$key));	# just swap
7f0747
+	&$movekey	("xmm1",&QWP(0,"eax"));
7f0747
+	&$movekey	(&QWP(0,"eax"),"xmm0");
7f0747
+	&$movekey	(&QWP(0,$key),"xmm1");
7f0747
+	&lea		($key,&DWP(16,$key));
7f0747
+	&lea		("eax",&DWP(-16,"eax"));
7f0747
+
7f0747
+&set_label("dec_key_inverse");
7f0747
+	&$movekey	("xmm0",&QWP(0,$key));	# swap and inverse
7f0747
+	&$movekey	("xmm1",&QWP(0,"eax"));
7f0747
+	&aesimc		("xmm0","xmm0");
7f0747
+	&aesimc		("xmm1","xmm1");
7f0747
+	&lea		($key,&DWP(16,$key));
7f0747
+	&lea		("eax",&DWP(-16,"eax"));
7f0747
+	&cmp		("eax",$key);
7f0747
+	&$movekey	(&QWP(16,"eax"),"xmm0");
7f0747
+	&$movekey	(&QWP(-16,$key),"xmm1");
7f0747
+	&ja		(&label("dec_key_inverse"));
7f0747
+
7f0747
+	&$movekey	("xmm0",&QWP(0,$key));	# inverse middle
7f0747
+	&aesimc		("xmm0","xmm0");
7f0747
+	&$movekey	(&QWP(0,$key),"xmm0");
7f0747
+
7f0747
+	&xor		("eax","eax");		# return success
7f0747
+&set_label("dec_key_ret");
7f0747
+	&ret	();
7f0747
+&function_end_B("${PREFIX}_set_decrypt_key");
7f0747
+&asciz("AES for Intel AES-NI, CRYPTOGAMS by <appro\@openssl.org>");
7f0747
+
7f0747
+&asm_finish();
7f0747
diff -up openssl-1.0.0-beta4/crypto/aes/asm/aesni-x86_64.pl.aesni openssl-1.0.0-beta4/crypto/aes/asm/aesni-x86_64.pl
7f0747
--- openssl-1.0.0-beta4/crypto/aes/asm/aesni-x86_64.pl.aesni	2010-01-12 22:18:06.000000000 +0100
7f0747
+++ openssl-1.0.0-beta4/crypto/aes/asm/aesni-x86_64.pl	2010-01-12 22:18:06.000000000 +0100
7f0747
@@ -0,0 +1,991 @@
7f0747
+#!/usr/bin/env perl
7f0747
+#
7f0747
+# ====================================================================
7f0747
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
7f0747
+# project. The module is, however, dual licensed under OpenSSL and
7f0747
+# CRYPTOGAMS licenses depending on where you obtain it. For further
7f0747
+# details see http://www.openssl.org/~appro/cryptogams/.
7f0747
+# ====================================================================
7f0747
+#
7f0747
+# This module implements support for Intel AES-NI extension. In
7f0747
+# OpenSSL context it's used with Intel engine, but can also be used as
7f0747
+# drop-in replacement for crypto/aes/asm/aes-x86_64.pl [see below for
7f0747
+# details].
7f0747
+
7f0747
+$PREFIX="aesni";	# if $PREFIX is set to "AES", the script
7f0747
+			# generates drop-in replacement for
7f0747
+			# crypto/aes/asm/aes-x86_64.pl:-)
7f0747
+
7f0747
+$flavour = shift;
7f0747
+$output  = shift;
7f0747
+if ($flavour =~ /\./) { $output = $flavour; undef $flavour; }
7f0747
+
7f0747
+$win64=0; $win64=1 if ($flavour =~ /[nm]asm|mingw64/ || $output =~ /\.asm$/);
7f0747
+
7f0747
+$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
7f0747
+( $xlate="${dir}x86_64-xlate.pl" and -f $xlate ) or
7f0747
+( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or
7f0747
+die "can't locate x86_64-xlate.pl";
7f0747
+
7f0747
+open STDOUT,"| $^X $xlate $flavour $output";
7f0747
+
7f0747
+$movkey = $PREFIX eq "aesni" ? "movaps" : "movups";
7f0747
+@_4args=$win64?	("%rcx","%rdx","%r8", "%r9") :	# Win64 order
7f0747
+		("%rdi","%rsi","%rdx","%rcx");	# Unix order
7f0747
+
7f0747
+$code=".text\n";
7f0747
+
7f0747
+$rounds="%eax";	# input to and changed by aesni_[en|de]cryptN !!!
7f0747
+# this is natural Unix argument order for public $PREFIX_[ecb|cbc]_encrypt ...
7f0747
+$inp="%rdi";
7f0747
+$out="%rsi";
7f0747
+$len="%rdx";
7f0747
+$key="%rcx";	# input to and changed by aesni_[en|de]cryptN !!!
7f0747
+$ivp="%r8";	# cbc
7f0747
+
7f0747
+$rnds_="%r10d";	# backup copy for $rounds
7f0747
+$key_="%r11";	# backup copy for $key
7f0747
+
7f0747
+# %xmm register layout
7f0747
+$inout0="%xmm0";	$inout1="%xmm1";
7f0747
+$inout2="%xmm2";	$inout3="%xmm3";
7f0747
+$rndkey0="%xmm4";	$rndkey1="%xmm5";
7f0747
+
7f0747
+$iv="%xmm6";		$in0="%xmm7";	# used in CBC decrypt
7f0747
+$in1="%xmm8";		$in2="%xmm9";
7f0747
+
7f0747
+# Inline version of internal aesni_[en|de]crypt1.
7f0747
+#
7f0747
+# Why folded loop? Because aes[enc|dec] is slow enough to accommodate
7f0747
+# cycles which take care of loop variables...
7f0747
+{ my $sn;
7f0747
+sub aesni_generate1 {
7f0747
+my ($p,$key,$rounds)=@_;
7f0747
+++$sn;
7f0747
+$code.=<<___;
7f0747
+	$movkey	($key),$rndkey0
7f0747
+	$movkey	16($key),$rndkey1
7f0747
+	lea	32($key),$key
7f0747
+	pxor	$rndkey0,$inout0
7f0747
+.Loop_${p}1_$sn:
7f0747
+	aes${p}	$rndkey1,$inout0
7f0747
+	dec	$rounds
7f0747
+	$movkey	($key),$rndkey1
7f0747
+	lea	16($key),$key
7f0747
+	jnz	.Loop_${p}1_$sn	# loop body is 16 bytes
7f0747
+	aes${p}last	$rndkey1,$inout0
7f0747
+___
7f0747
+}}
7f0747
+# void $PREFIX_[en|de]crypt (const void *inp,void *out,const AES_KEY *key);
7f0747
+#
7f0747
+{ my ($inp,$out,$key) = @_4args;
7f0747
+
7f0747
+$code.=<<___;
7f0747
+.globl	${PREFIX}_encrypt
7f0747
+.type	${PREFIX}_encrypt,\@abi-omnipotent
7f0747
+.align	16
7f0747
+${PREFIX}_encrypt:
7f0747
+	movups	($inp),$inout0		# load input
7f0747
+	mov	240($key),$rounds	# pull $rounds
7f0747
+___
7f0747
+	&aesni_generate1("enc",$key,$rounds);
7f0747
+$code.=<<___;
7f0747
+	movups	$inout0,($out)		# output
7f0747
+	ret
7f0747
+.size	${PREFIX}_encrypt,.-${PREFIX}_encrypt
7f0747
+
7f0747
+.globl	${PREFIX}_decrypt
7f0747
+.type	${PREFIX}_decrypt,\@abi-omnipotent
7f0747
+.align	16
7f0747
+${PREFIX}_decrypt:
7f0747
+	movups	($inp),$inout0		# load input
7f0747
+	mov	240($key),$rounds	# pull $rounds
7f0747
+___
7f0747
+	&aesni_generate1("dec",$key,$rounds);
7f0747
+$code.=<<___;
7f0747
+	movups	$inout0,($out)		# output
7f0747
+	ret
7f0747
+.size	${PREFIX}_decrypt, .-${PREFIX}_decrypt
7f0747
+___
7f0747
+}
7f0747
+
7f0747
+# _aesni_[en|de]crypt[34] are private interfaces, N denotes interleave
7f0747
+# factor. Why 3x subroutine is used in loops? Even though aes[enc|dec]
7f0747
+# latency is 6, it turned out that it can be scheduled only every
7f0747
+# *second* cycle. Thus 3x interleave is the one providing optimal
7f0747
+# utilization, i.e. when subroutine's throughput is virtually same as
7f0747
+# of non-interleaved subroutine [for number of input blocks up to 3].
7f0747
+# This is why it makes no sense to implement 2x subroutine. As soon
7f0747
+# as/if Intel improves throughput by making it possible to schedule
7f0747
+# the instructions in question *every* cycles I would have to
7f0747
+# implement 6x interleave and use it in loop...
7f0747
+sub aesni_generate3 {
7f0747
+my $dir=shift;
7f0747
+# As already mentioned it takes in $key and $rounds, which are *not*
7f0747
+# preserved. $inout[0-2] is cipher/clear text...
7f0747
+$code.=<<___;
7f0747
+.type	_aesni_${dir}rypt3,\@abi-omnipotent
7f0747
+.align	16
7f0747
+_aesni_${dir}rypt3:
7f0747
+	$movkey	($key),$rndkey0
7f0747
+	shr	\$1,$rounds
7f0747
+	$movkey	16($key),$rndkey1
7f0747
+	lea	32($key),$key
7f0747
+	pxor	$rndkey0,$inout0
7f0747
+	pxor	$rndkey0,$inout1
7f0747
+	pxor	$rndkey0,$inout2
7f0747
+
7f0747
+.L${dir}_loop3:
7f0747
+	aes${dir}	$rndkey1,$inout0
7f0747
+	$movkey		($key),$rndkey0
7f0747
+	aes${dir}	$rndkey1,$inout1
7f0747
+	dec		$rounds
7f0747
+	aes${dir}	$rndkey1,$inout2
7f0747
+	aes${dir}	$rndkey0,$inout0
7f0747
+	$movkey		16($key),$rndkey1
7f0747
+	aes${dir}	$rndkey0,$inout1
7f0747
+	lea		32($key),$key
7f0747
+	aes${dir}	$rndkey0,$inout2
7f0747
+	jnz		.L${dir}_loop3
7f0747
+
7f0747
+	aes${dir}	$rndkey1,$inout0
7f0747
+	$movkey		($key),$rndkey0
7f0747
+	aes${dir}	$rndkey1,$inout1
7f0747
+	aes${dir}	$rndkey1,$inout2
7f0747
+	aes${dir}last	$rndkey0,$inout0
7f0747
+	aes${dir}last	$rndkey0,$inout1
7f0747
+	aes${dir}last	$rndkey0,$inout2
7f0747
+	ret
7f0747
+.size	_aesni_${dir}rypt3,.-_aesni_${dir}rypt3
7f0747
+___
7f0747
+}
7f0747
+# 4x interleave is implemented to improve small block performance,
7f0747
+# most notably [and naturally] 4 block by ~30%. One can argue that one
7f0747
+# should have implemented 5x as well, but improvement would be <20%,
7f0747
+# so it's not worth it...
7f0747
+sub aesni_generate4 {
7f0747
+my $dir=shift;
7f0747
+# As already mentioned it takes in $key and $rounds, which are *not*
7f0747
+# preserved. $inout[0-3] is cipher/clear text...
7f0747
+$code.=<<___;
7f0747
+.type	_aesni_${dir}rypt4,\@abi-omnipotent
7f0747
+.align	16
7f0747
+_aesni_${dir}rypt4:
7f0747
+	$movkey	($key),$rndkey0
7f0747
+	shr	\$1,$rounds
7f0747
+	$movkey	16($key),$rndkey1
7f0747
+	lea	32($key),$key
7f0747
+	pxor	$rndkey0,$inout0
7f0747
+	pxor	$rndkey0,$inout1
7f0747
+	pxor	$rndkey0,$inout2
7f0747
+	pxor	$rndkey0,$inout3
7f0747
+
7f0747
+.L${dir}_loop4:
7f0747
+	aes${dir}	$rndkey1,$inout0
7f0747
+	$movkey		($key),$rndkey0
7f0747
+	aes${dir}	$rndkey1,$inout1
7f0747
+	dec		$rounds
7f0747
+	aes${dir}	$rndkey1,$inout2
7f0747
+	aes${dir}	$rndkey1,$inout3
7f0747
+	aes${dir}	$rndkey0,$inout0
7f0747
+	$movkey		16($key),$rndkey1
7f0747
+	aes${dir}	$rndkey0,$inout1
7f0747
+	lea		32($key),$key
7f0747
+	aes${dir}	$rndkey0,$inout2
7f0747
+	aes${dir}	$rndkey0,$inout3
7f0747
+	jnz		.L${dir}_loop4
7f0747
+
7f0747
+	aes${dir}	$rndkey1,$inout0
7f0747
+	$movkey		($key),$rndkey0
7f0747
+	aes${dir}	$rndkey1,$inout1
7f0747
+	aes${dir}	$rndkey1,$inout2
7f0747
+	aes${dir}	$rndkey1,$inout3
7f0747
+	aes${dir}last	$rndkey0,$inout0
7f0747
+	aes${dir}last	$rndkey0,$inout1
7f0747
+	aes${dir}last	$rndkey0,$inout2
7f0747
+	aes${dir}last	$rndkey0,$inout3
7f0747
+	ret
7f0747
+.size	_aesni_${dir}rypt4,.-_aesni_${dir}rypt4
7f0747
+___
7f0747
+}
7f0747
+&aesni_generate3("enc") if ($PREFIX eq "aesni");
7f0747
+&aesni_generate3("dec");
7f0747
+&aesni_generate4("enc") if ($PREFIX eq "aesni");
7f0747
+&aesni_generate4("dec");
7f0747
+
7f0747
+if ($PREFIX eq "aesni") {
7f0747
+# void aesni_ecb_encrypt (const void *in, void *out,
7f0747
+#			  size_t length, const AES_KEY *key,
7f0747
+#			  int enc);
7f0747
+$code.=<<___;
7f0747
+.globl	aesni_ecb_encrypt
7f0747
+.type	aesni_ecb_encrypt,\@function,5
7f0747
+.align	16
7f0747
+aesni_ecb_encrypt:
7f0747
+	cmp	\$16,$len		# check length
7f0747
+	jb	.Lecb_ret
7f0747
+
7f0747
+	mov	240($key),$rounds	# pull $rounds
7f0747
+	and	\$-16,$len
7f0747
+	mov	$key,$key_		# backup $key
7f0747
+	test	%r8d,%r8d		# 5th argument
7f0747
+	mov	$rounds,$rnds_		# backup $rounds
7f0747
+	jz	.Lecb_decrypt
7f0747
+#--------------------------- ECB ENCRYPT ------------------------------#
7f0747
+	sub	\$0x40,$len
7f0747
+	jbe	.Lecb_enc_tail
7f0747
+	jmp	.Lecb_enc_loop3
7f0747
+.align 16
7f0747
+.Lecb_enc_loop3:
7f0747
+	movups	($inp),$inout0
7f0747
+	movups	0x10($inp),$inout1
7f0747
+	movups	0x20($inp),$inout2
7f0747
+	call	_aesni_encrypt3
7f0747
+	sub	\$0x30,$len
7f0747
+	lea	0x30($inp),$inp
7f0747
+	lea	0x30($out),$out
7f0747
+	movups	$inout0,-0x30($out)
7f0747
+	mov	$rnds_,$rounds		# restore $rounds
7f0747
+	movups	$inout1,-0x20($out)
7f0747
+	mov	$key_,$key		# restore $key
7f0747
+	movups	$inout2,-0x10($out)
7f0747
+	ja	.Lecb_enc_loop3
7f0747
+
7f0747
+.Lecb_enc_tail:
7f0747
+	add	\$0x40,$len
7f0747
+	jz	.Lecb_ret
7f0747
+
7f0747
+	cmp	\$0x10,$len
7f0747
+	movups	($inp),$inout0
7f0747
+	je	.Lecb_enc_one
7f0747
+	cmp	\$0x20,$len
7f0747
+	movups	0x10($inp),$inout1
7f0747
+	je	.Lecb_enc_two
7f0747
+	cmp	\$0x30,$len
7f0747
+	movups	0x20($inp),$inout2
7f0747
+	je	.Lecb_enc_three
7f0747
+	movups	0x30($inp),$inout3
7f0747
+	call	_aesni_encrypt4
7f0747
+	movups	$inout0,($out)
7f0747
+	movups	$inout1,0x10($out)
7f0747
+	movups	$inout2,0x20($out)
7f0747
+	movups	$inout3,0x30($out)
7f0747
+	jmp	.Lecb_ret
7f0747
+.align	16
7f0747
+.Lecb_enc_one:
7f0747
+___
7f0747
+	&aesni_generate1("enc",$key,$rounds);
7f0747
+$code.=<<___;
7f0747
+	movups	$inout0,($out)
7f0747
+	jmp	.Lecb_ret
7f0747
+.align	16
7f0747
+.Lecb_enc_two:
7f0747
+	call	_aesni_encrypt3
7f0747
+	movups	$inout0,($out)
7f0747
+	movups	$inout1,0x10($out)
7f0747
+	jmp	.Lecb_ret
7f0747
+.align	16
7f0747
+.Lecb_enc_three:
7f0747
+	call	_aesni_encrypt3
7f0747
+	movups	$inout0,($out)
7f0747
+	movups	$inout1,0x10($out)
7f0747
+	movups	$inout2,0x20($out)
7f0747
+	jmp	.Lecb_ret
7f0747
+#--------------------------- ECB DECRYPT ------------------------------#
7f0747
+.align	16
7f0747
+.Lecb_decrypt:
7f0747
+	sub	\$0x40,$len
7f0747
+	jbe	.Lecb_dec_tail
7f0747
+	jmp	.Lecb_dec_loop3
7f0747
+.align 16
7f0747
+.Lecb_dec_loop3:
7f0747
+	movups	($inp),$inout0
7f0747
+	movups	0x10($inp),$inout1
7f0747
+	movups	0x20($inp),$inout2
7f0747
+	call	_aesni_decrypt3
7f0747
+	sub	\$0x30,$len
7f0747
+	lea	0x30($inp),$inp
7f0747
+	lea	0x30($out),$out
7f0747
+	movups	$inout0,-0x30($out)
7f0747
+	mov	$rnds_,$rounds		# restore $rounds
7f0747
+	movups	$inout1,-0x20($out)
7f0747
+	mov	$key_,$key		# restore $key
7f0747
+	movups	$inout2,-0x10($out)
7f0747
+	ja	.Lecb_dec_loop3
7f0747
+
7f0747
+.Lecb_dec_tail:
7f0747
+	add	\$0x40,$len
7f0747
+	jz	.Lecb_ret
7f0747
+
7f0747
+	cmp	\$0x10,$len
7f0747
+	movups	($inp),$inout0
7f0747
+	je	.Lecb_dec_one
7f0747
+	cmp	\$0x20,$len
7f0747
+	movups	0x10($inp),$inout1
7f0747
+	je	.Lecb_dec_two
7f0747
+	cmp	\$0x30,$len
7f0747
+	movups	0x20($inp),$inout2
7f0747
+	je	.Lecb_dec_three
7f0747
+	movups	0x30($inp),$inout3
7f0747
+	call	_aesni_decrypt4
7f0747
+	movups	$inout0,($out)
7f0747
+	movups	$inout1,0x10($out)
7f0747
+	movups	$inout2,0x20($out)
7f0747
+	movups	$inout3,0x30($out)
7f0747
+	jmp	.Lecb_ret
7f0747
+.align	16
7f0747
+.Lecb_dec_one:
7f0747
+___
7f0747
+	&aesni_generate1("dec",$key,$rounds);
7f0747
+$code.=<<___;
7f0747
+	movups	$inout0,($out)
7f0747
+	jmp	.Lecb_ret
7f0747
+.align	16
7f0747
+.Lecb_dec_two:
7f0747
+	call	_aesni_decrypt3
7f0747
+	movups	$inout0,($out)
7f0747
+	movups	$inout1,0x10($out)
7f0747
+	jmp	.Lecb_ret
7f0747
+.align	16
7f0747
+.Lecb_dec_three:
7f0747
+	call	_aesni_decrypt3
7f0747
+	movups	$inout0,($out)
7f0747
+	movups	$inout1,0x10($out)
7f0747
+	movups	$inout2,0x20($out)
7f0747
+
7f0747
+.Lecb_ret:
7f0747
+	ret
7f0747
+.size	aesni_ecb_encrypt,.-aesni_ecb_encrypt
7f0747
+___
7f0747
+}
7f0747
+
7f0747
+# void $PREFIX_cbc_encrypt (const void *inp, void *out,
7f0747
+#			    size_t length, const AES_KEY *key,
7f0747
+#			    unsigned char *ivp,const int enc);
7f0747
+$reserved = $win64?0x40:-0x18;	# used in decrypt
7f0747
+$code.=<<___;
7f0747
+.globl	${PREFIX}_cbc_encrypt
7f0747
+.type	${PREFIX}_cbc_encrypt,\@function,6
7f0747
+.align	16
7f0747
+${PREFIX}_cbc_encrypt:
7f0747
+	test	$len,$len		# check length
7f0747
+	jz	.Lcbc_ret
7f0747
+
7f0747
+	mov	240($key),$rnds_	# pull $rounds
7f0747
+	mov	$key,$key_		# backup $key
7f0747
+	test	%r9d,%r9d		# 6th argument
7f0747
+	jz	.Lcbc_decrypt
7f0747
+#--------------------------- CBC ENCRYPT ------------------------------#
7f0747
+	movups	($ivp),$inout0		# load iv as initial state
7f0747
+	cmp	\$16,$len
7f0747
+	mov	$rnds_,$rounds
7f0747
+	jb	.Lcbc_enc_tail
7f0747
+	sub	\$16,$len
7f0747
+	jmp	.Lcbc_enc_loop
7f0747
+.align 16
7f0747
+.Lcbc_enc_loop:
7f0747
+	movups	($inp),$inout1		# load input
7f0747
+	lea	16($inp),$inp
7f0747
+	pxor	$inout1,$inout0
7f0747
+___
7f0747
+	&aesni_generate1("enc",$key,$rounds);
7f0747
+$code.=<<___;
7f0747
+	sub	\$16,$len
7f0747
+	lea	16($out),$out
7f0747
+	mov	$rnds_,$rounds		# restore $rounds
7f0747
+	mov	$key_,$key		# restore $key
7f0747
+	movups	$inout0,-16($out)	# store output
7f0747
+	jnc	.Lcbc_enc_loop
7f0747
+	add	\$16,$len
7f0747
+	jnz	.Lcbc_enc_tail
7f0747
+	movups	$inout0,($ivp)
7f0747
+	jmp	.Lcbc_ret
7f0747
+
7f0747
+.Lcbc_enc_tail:
7f0747
+	mov	$len,%rcx	# zaps $key
7f0747
+	xchg	$inp,$out	# $inp is %rsi and $out is %rdi now
7f0747
+	.long	0x9066A4F3	# rep movsb
7f0747
+	mov	\$16,%ecx	# zero tail
7f0747
+	sub	$len,%rcx
7f0747
+	xor	%eax,%eax
7f0747
+	.long	0x9066AAF3	# rep stosb
7f0747
+	lea	-16(%rdi),%rdi	# rewind $out by 1 block
7f0747
+	mov	$rnds_,$rounds	# restore $rounds
7f0747
+	mov	%rdi,%rsi	# $inp and $out are the same
7f0747
+	mov	$key_,$key	# restore $key
7f0747
+	xor	$len,$len	# len=16
7f0747
+	jmp	.Lcbc_enc_loop	# one more spin
7f0747
+#--------------------------- CBC DECRYPT ------------------------------#
7f0747
+.align	16
7f0747
+.Lcbc_decrypt:
7f0747
+___
7f0747
+$code.=<<___ if ($win64);
7f0747
+	lea	-0x58(%rsp),%rsp
7f0747
+	movaps	%xmm6,(%rsp)
7f0747
+	movaps	%xmm7,0x10(%rsp)
7f0747
+	movaps	%xmm8,0x20(%rsp)
7f0747
+	movaps	%xmm9,0x30(%rsp)
7f0747
+.Lcbc_decrypt_body:
7f0747
+___
7f0747
+$code.=<<___;
7f0747
+	movups	($ivp),$iv
7f0747
+	sub	\$0x40,$len
7f0747
+	mov	$rnds_,$rounds
7f0747
+	jbe	.Lcbc_dec_tail
7f0747
+	jmp	.Lcbc_dec_loop3
7f0747
+.align 16
7f0747
+.Lcbc_dec_loop3:
7f0747
+	movups	($inp),$inout0
7f0747
+	movups	0x10($inp),$inout1
7f0747
+	movups	0x20($inp),$inout2
7f0747
+	movaps	$inout0,$in0
7f0747
+	movaps	$inout1,$in1
7f0747
+	movaps	$inout2,$in2
7f0747
+	call	_aesni_decrypt3
7f0747
+	sub	\$0x30,$len
7f0747
+	lea	0x30($inp),$inp
7f0747
+	lea	0x30($out),$out
7f0747
+	pxor	$iv,$inout0
7f0747
+	pxor	$in0,$inout1
7f0747
+	movaps	$in2,$iv
7f0747
+	pxor	$in1,$inout2
7f0747
+	movups	$inout0,-0x30($out)
7f0747
+	mov	$rnds_,$rounds	# restore $rounds
7f0747
+	movups	$inout1,-0x20($out)
7f0747
+	mov	$key_,$key	# restore $key
7f0747
+	movups	$inout2,-0x10($out)
7f0747
+	ja	.Lcbc_dec_loop3
7f0747
+
7f0747
+.Lcbc_dec_tail:
7f0747
+	add	\$0x40,$len
7f0747
+	movups	$iv,($ivp)
7f0747
+	jz	.Lcbc_dec_ret
7f0747
+
7f0747
+	movups	($inp),$inout0
7f0747
+	cmp	\$0x10,$len
7f0747
+	movaps	$inout0,$in0
7f0747
+	jbe	.Lcbc_dec_one
7f0747
+	movups	0x10($inp),$inout1
7f0747
+	cmp	\$0x20,$len
7f0747
+	movaps	$inout1,$in1
7f0747
+	jbe	.Lcbc_dec_two
7f0747
+	movups	0x20($inp),$inout2
7f0747
+	cmp	\$0x30,$len
7f0747
+	movaps	$inout2,$in2
7f0747
+	jbe	.Lcbc_dec_three
7f0747
+	movups	0x30($inp),$inout3
7f0747
+	call	_aesni_decrypt4
7f0747
+	pxor	$iv,$inout0
7f0747
+	movups	0x30($inp),$iv
7f0747
+	pxor	$in0,$inout1
7f0747
+	movups	$inout0,($out)
7f0747
+	pxor	$in1,$inout2
7f0747
+	movups	$inout1,0x10($out)
7f0747
+	pxor	$in2,$inout3
7f0747
+	movups	$inout2,0x20($out)
7f0747
+	movaps	$inout3,$inout0
7f0747
+	lea	0x30($out),$out
7f0747
+	jmp	.Lcbc_dec_tail_collected
7f0747
+.align	16
7f0747
+.Lcbc_dec_one:
7f0747
+___
7f0747
+	&aesni_generate1("dec",$key,$rounds);
7f0747
+$code.=<<___;
7f0747
+	pxor	$iv,$inout0
7f0747
+	movaps	$in0,$iv
7f0747
+	jmp	.Lcbc_dec_tail_collected
7f0747
+.align	16
7f0747
+.Lcbc_dec_two:
7f0747
+	call	_aesni_decrypt3
7f0747
+	pxor	$iv,$inout0
7f0747
+	pxor	$in0,$inout1
7f0747
+	movups	$inout0,($out)
7f0747
+	movaps	$in1,$iv
7f0747
+	movaps	$inout1,$inout0
7f0747
+	lea	0x10($out),$out
7f0747
+	jmp	.Lcbc_dec_tail_collected
7f0747
+.align	16
7f0747
+.Lcbc_dec_three:
7f0747
+	call	_aesni_decrypt3
7f0747
+	pxor	$iv,$inout0
7f0747
+	pxor	$in0,$inout1
7f0747
+	movups	$inout0,($out)
7f0747
+	pxor	$in1,$inout2
7f0747
+	movups	$inout1,0x10($out)
7f0747
+	movaps	$in2,$iv
7f0747
+	movaps	$inout2,$inout0
7f0747
+	lea	0x20($out),$out
7f0747
+	jmp	.Lcbc_dec_tail_collected
7f0747
+.align	16
7f0747
+.Lcbc_dec_tail_collected:
7f0747
+	and	\$15,$len
7f0747
+	movups	$iv,($ivp)
7f0747
+	jnz	.Lcbc_dec_tail_partial
7f0747
+	movups	$inout0,($out)
7f0747
+	jmp	.Lcbc_dec_ret
7f0747
+.Lcbc_dec_tail_partial:
7f0747
+	movaps	$inout0,$reserved(%rsp)
7f0747
+	mov	$out,%rdi
7f0747
+	mov	$len,%rcx
7f0747
+	lea	$reserved(%rsp),%rsi
7f0747
+	.long	0x9066A4F3	# rep movsb
7f0747
+
7f0747
+.Lcbc_dec_ret:
7f0747
+___
7f0747
+$code.=<<___ if ($win64);
7f0747
+	movaps	(%rsp),%xmm6
7f0747
+	movaps	0x10(%rsp),%xmm7
7f0747
+	movaps	0x20(%rsp),%xmm8
7f0747
+	movaps	0x30(%rsp),%xmm9
7f0747
+	lea	0x58(%rsp),%rsp
7f0747
+___
7f0747
+$code.=<<___;
7f0747
+.Lcbc_ret:
7f0747
+	ret
7f0747
+.size	${PREFIX}_cbc_encrypt,.-${PREFIX}_cbc_encrypt
7f0747
+___
7f0747
+
7f0747
+# int $PREFIX_set_[en|de]crypt_key (const unsigned char *userKey,
7f0747
+#				int bits, AES_KEY *key)
7f0747
+{ my ($inp,$bits,$key) = @_4args;
7f0747
+  $bits =~ s/%r/%e/;
7f0747
+
7f0747
+$code.=<<___;
7f0747
+.globl	${PREFIX}_set_decrypt_key
7f0747
+.type	${PREFIX}_set_decrypt_key,\@abi-omnipotent
7f0747
+.align	16
7f0747
+${PREFIX}_set_decrypt_key:
7f0747
+	.byte	0x48,0x83,0xEC,0x08	# sub rsp,8
7f0747
+	call	_aesni_set_encrypt_key
7f0747
+	shl	\$4,$bits		# rounds-1 after _aesni_set_encrypt_key
7f0747
+	test	%eax,%eax
7f0747
+	jnz	.Ldec_key_ret
7f0747
+	lea	16($key,$bits),$inp	# points at the end of key schedule
7f0747
+
7f0747
+	$movkey	($key),%xmm0		# just swap
7f0747
+	$movkey	($inp),%xmm1
7f0747
+	$movkey	%xmm0,($inp)
7f0747
+	$movkey	%xmm1,($key)
7f0747
+	lea	16($key),$key
7f0747
+	lea	-16($inp),$inp
7f0747
+
7f0747
+.Ldec_key_inverse:
7f0747
+	$movkey	($key),%xmm0		# swap and inverse
7f0747
+	$movkey	($inp),%xmm1
7f0747
+	aesimc	%xmm0,%xmm0
7f0747
+	aesimc	%xmm1,%xmm1
7f0747
+	lea	16($key),$key
7f0747
+	lea	-16($inp),$inp
7f0747
+	cmp	$key,$inp
7f0747
+	$movkey	%xmm0,16($inp)
7f0747
+	$movkey	%xmm1,-16($key)
7f0747
+	ja	.Ldec_key_inverse
7f0747
+
7f0747
+	$movkey	($key),%xmm0		# inverse middle
7f0747
+	aesimc	%xmm0,%xmm0
7f0747
+	$movkey	%xmm0,($inp)
7f0747
+.Ldec_key_ret:
7f0747
+	add	\$8,%rsp
7f0747
+	ret
7f0747
+.LSEH_end_set_decrypt_key:
7f0747
+.size	${PREFIX}_set_decrypt_key,.-${PREFIX}_set_decrypt_key
7f0747
+___
7f0747
+
7f0747
+# This is based on submission by
7f0747
+#
7f0747
+#	Huang Ying <ying.huang@intel.com>
7f0747
+#	Vinodh Gopal <vinodh.gopal@intel.com>
7f0747
+#	Kahraman Akdemir
7f0747
+#
7f0747
+# Agressively optimized in respect to aeskeygenassist's critical path
7f0747
+# and is contained in %xmm0-5 to meet Win64 ABI requirement.
7f0747
+#
7f0747
+$code.=<<___;
7f0747
+.globl	${PREFIX}_set_encrypt_key
7f0747
+.type	${PREFIX}_set_encrypt_key,\@abi-omnipotent
7f0747
+.align	16
7f0747
+${PREFIX}_set_encrypt_key:
7f0747
+_aesni_set_encrypt_key:
7f0747
+	.byte	0x48,0x83,0xEC,0x08	# sub rsp,8
7f0747
+	test	$inp,$inp
7f0747
+	mov	\$-1,%rax
7f0747
+	jz	.Lenc_key_ret
7f0747
+	test	$key,$key
7f0747
+	jz	.Lenc_key_ret
7f0747
+
7f0747
+	movups	($inp),%xmm0		# pull first 128 bits of *userKey
7f0747
+	pxor	%xmm4,%xmm4		# low dword of xmm4 is assumed 0
7f0747
+	lea	16($key),%rax
7f0747
+	cmp	\$256,$bits
7f0747
+	je	.L14rounds
7f0747
+	cmp	\$192,$bits
7f0747
+	je	.L12rounds
7f0747
+	cmp	\$128,$bits
7f0747
+	jne	.Lbad_keybits
7f0747
+
7f0747
+.L10rounds:
7f0747
+	mov	\$9,$bits			# 10 rounds for 128-bit key
7f0747
+	$movkey	%xmm0,($key)			# round 0
7f0747
+	aeskeygenassist	\$0x1,%xmm0,%xmm1	# round 1
7f0747
+	call		.Lkey_expansion_128_cold
7f0747
+	aeskeygenassist	\$0x2,%xmm0,%xmm1	# round 2
7f0747
+	call		.Lkey_expansion_128
7f0747
+	aeskeygenassist	\$0x4,%xmm0,%xmm1	# round 3
7f0747
+	call		.Lkey_expansion_128
7f0747
+	aeskeygenassist	\$0x8,%xmm0,%xmm1	# round 4
7f0747
+	call		.Lkey_expansion_128
7f0747
+	aeskeygenassist	\$0x10,%xmm0,%xmm1	# round 5
7f0747
+	call		.Lkey_expansion_128
7f0747
+	aeskeygenassist	\$0x20,%xmm0,%xmm1	# round 6
7f0747
+	call		.Lkey_expansion_128
7f0747
+	aeskeygenassist	\$0x40,%xmm0,%xmm1	# round 7
7f0747
+	call		.Lkey_expansion_128
7f0747
+	aeskeygenassist	\$0x80,%xmm0,%xmm1	# round 8
7f0747
+	call		.Lkey_expansion_128
7f0747
+	aeskeygenassist	\$0x1b,%xmm0,%xmm1	# round 9
7f0747
+	call		.Lkey_expansion_128
7f0747
+	aeskeygenassist	\$0x36,%xmm0,%xmm1	# round 10
7f0747
+	call		.Lkey_expansion_128
7f0747
+	$movkey	%xmm0,(%rax)
7f0747
+	mov	$bits,80(%rax)	# 240(%rdx)
7f0747
+	xor	%eax,%eax
7f0747
+	jmp	.Lenc_key_ret
7f0747
+
7f0747
+.align	16
7f0747
+.L12rounds:
7f0747
+	movq	16($inp),%xmm2			# remaining 1/3 of *userKey
7f0747
+	mov	\$11,$bits			# 12 rounds for 192
7f0747
+	$movkey	%xmm0,($key)			# round 0
7f0747
+	aeskeygenassist	\$0x1,%xmm2,%xmm1	# round 1,2
7f0747
+	call		.Lkey_expansion_192a_cold
7f0747
+	aeskeygenassist	\$0x2,%xmm2,%xmm1	# round 2,3
7f0747
+	call		.Lkey_expansion_192b
7f0747
+	aeskeygenassist	\$0x4,%xmm2,%xmm1	# round 4,5
7f0747
+	call		.Lkey_expansion_192a
7f0747
+	aeskeygenassist	\$0x8,%xmm2,%xmm1	# round 5,6
7f0747
+	call		.Lkey_expansion_192b
7f0747
+	aeskeygenassist	\$0x10,%xmm2,%xmm1	# round 7,8
7f0747
+	call		.Lkey_expansion_192a
7f0747
+	aeskeygenassist	\$0x20,%xmm2,%xmm1	# round 8,9
7f0747
+	call		.Lkey_expansion_192b
7f0747
+	aeskeygenassist	\$0x40,%xmm2,%xmm1	# round 10,11
7f0747
+	call		.Lkey_expansion_192a
7f0747
+	aeskeygenassist	\$0x80,%xmm2,%xmm1	# round 11,12
7f0747
+	call		.Lkey_expansion_192b
7f0747
+	$movkey	%xmm0,(%rax)
7f0747
+	mov	$bits,48(%rax)	# 240(%rdx)
7f0747
+	xor	%rax, %rax
7f0747
+	jmp	.Lenc_key_ret
7f0747
+
7f0747
+.align	16
7f0747
+.L14rounds:
7f0747
+	movups	16($inp),%xmm2			# remaning half of *userKey
7f0747
+	mov	\$13,$bits			# 14 rounds for 256
7f0747
+	lea	16(%rax),%rax
7f0747
+	$movkey	%xmm0,($key)			# round 0
7f0747
+	$movkey	%xmm2,16($key)			# round 1
7f0747
+	aeskeygenassist	\$0x1,%xmm2,%xmm1	# round 2
7f0747
+	call		.Lkey_expansion_256a_cold
7f0747
+	aeskeygenassist	\$0x1,%xmm0,%xmm1	# round 3
7f0747
+	call		.Lkey_expansion_256b
7f0747
+	aeskeygenassist	\$0x2,%xmm2,%xmm1	# round 4
7f0747
+	call		.Lkey_expansion_256a
7f0747
+	aeskeygenassist	\$0x2,%xmm0,%xmm1	# round 5
7f0747
+	call		.Lkey_expansion_256b
7f0747
+	aeskeygenassist	\$0x4,%xmm2,%xmm1	# round 6
7f0747
+	call		.Lkey_expansion_256a
7f0747
+	aeskeygenassist	\$0x4,%xmm0,%xmm1	# round 7
7f0747
+	call		.Lkey_expansion_256b
7f0747
+	aeskeygenassist	\$0x8,%xmm2,%xmm1	# round 8
7f0747
+	call		.Lkey_expansion_256a
7f0747
+	aeskeygenassist	\$0x8,%xmm0,%xmm1	# round 9
7f0747
+	call		.Lkey_expansion_256b
7f0747
+	aeskeygenassist	\$0x10,%xmm2,%xmm1	# round 10
7f0747
+	call		.Lkey_expansion_256a
7f0747
+	aeskeygenassist	\$0x10,%xmm0,%xmm1	# round 11
7f0747
+	call		.Lkey_expansion_256b
7f0747
+	aeskeygenassist	\$0x20,%xmm2,%xmm1	# round 12
7f0747
+	call		.Lkey_expansion_256a
7f0747
+	aeskeygenassist	\$0x20,%xmm0,%xmm1	# round 13
7f0747
+	call		.Lkey_expansion_256b
7f0747
+	aeskeygenassist	\$0x40,%xmm2,%xmm1	# round 14
7f0747
+	call		.Lkey_expansion_256a
7f0747
+	$movkey	%xmm0,(%rax)
7f0747
+	mov	$bits,16(%rax)	# 240(%rdx)
7f0747
+	xor	%rax,%rax
7f0747
+	jmp	.Lenc_key_ret
7f0747
+
7f0747
+.align	16
7f0747
+.Lbad_keybits:
7f0747
+	mov	\$-2,%rax
7f0747
+.Lenc_key_ret:
7f0747
+	add	\$8,%rsp
7f0747
+	ret
7f0747
+.LSEH_end_set_encrypt_key:
7f0747
+
7f0747
+.align	16
7f0747
+.Lkey_expansion_128:
7f0747
+	$movkey	%xmm0,(%rax)
7f0747
+	lea	16(%rax),%rax
7f0747
+.Lkey_expansion_128_cold:
7f0747
+	shufps	\$0b00010000,%xmm0,%xmm4
7f0747
+	pxor	%xmm4, %xmm0
7f0747
+	shufps	\$0b10001100,%xmm0,%xmm4
7f0747
+	pxor	%xmm4, %xmm0
7f0747
+	pshufd	\$0b11111111,%xmm1,%xmm1	# critical path
7f0747
+	pxor	%xmm1,%xmm0
7f0747
+	ret
7f0747
+
7f0747
+.align 16
7f0747
+.Lkey_expansion_192a:
7f0747
+	$movkey	%xmm0,(%rax)
7f0747
+	lea	16(%rax),%rax
7f0747
+.Lkey_expansion_192a_cold:
7f0747
+	movaps	%xmm2, %xmm5
7f0747
+.Lkey_expansion_192b_warm:
7f0747
+	shufps	\$0b00010000,%xmm0,%xmm4
7f0747
+	movaps	%xmm2,%xmm3
7f0747
+	pxor	%xmm4,%xmm0
7f0747
+	shufps	\$0b10001100,%xmm0,%xmm4
7f0747
+	pslldq	\$4,%xmm3
7f0747
+	pxor	%xmm4,%xmm0
7f0747
+	pshufd	\$0b01010101,%xmm1,%xmm1	# critical path
7f0747
+	pxor	%xmm3,%xmm2
7f0747
+	pxor	%xmm1,%xmm0
7f0747
+	pshufd	\$0b11111111,%xmm0,%xmm3
7f0747
+	pxor	%xmm3,%xmm2
7f0747
+	ret
7f0747
+
7f0747
+.align 16
7f0747
+.Lkey_expansion_192b:
7f0747
+	movaps	%xmm0,%xmm3
7f0747
+	shufps	\$0b01000100,%xmm0,%xmm5
7f0747
+	$movkey	%xmm5,(%rax)
7f0747
+	shufps	\$0b01001110,%xmm2,%xmm3
7f0747
+	$movkey	%xmm3,16(%rax)
7f0747
+	lea	32(%rax),%rax
7f0747
+	jmp	.Lkey_expansion_192b_warm
7f0747
+
7f0747
+.align	16
7f0747
+.Lkey_expansion_256a:
7f0747
+	$movkey	%xmm2,(%rax)
7f0747
+	lea	16(%rax),%rax
7f0747
+.Lkey_expansion_256a_cold:
7f0747
+	shufps	\$0b00010000,%xmm0,%xmm4
7f0747
+	pxor	%xmm4,%xmm0
7f0747
+	shufps	\$0b10001100,%xmm0,%xmm4
7f0747
+	pxor	%xmm4,%xmm0
7f0747
+	pshufd	\$0b11111111,%xmm1,%xmm1	# critical path
7f0747
+	pxor	%xmm1,%xmm0
7f0747
+	ret
7f0747
+
7f0747
+.align 16
7f0747
+.Lkey_expansion_256b:
7f0747
+	$movkey	%xmm0,(%rax)
7f0747
+	lea	16(%rax),%rax
7f0747
+
7f0747
+	shufps	\$0b00010000,%xmm2,%xmm4
7f0747
+	pxor	%xmm4,%xmm2
7f0747
+	shufps	\$0b10001100,%xmm2,%xmm4
7f0747
+	pxor	%xmm4,%xmm2
7f0747
+	pshufd	\$0b10101010,%xmm1,%xmm1	# critical path
7f0747
+	pxor	%xmm1,%xmm2
7f0747
+	ret
7f0747
+.size	${PREFIX}_set_encrypt_key,.-${PREFIX}_set_encrypt_key
7f0747
+___
7f0747
+}
7f0747
+
7f0747
+$code.=<<___;
7f0747
+.asciz  "AES for Intel AES-NI, CRYPTOGAMS by <appro\@openssl.org>"
7f0747
+.align	64
7f0747
+___
7f0747
+
7f0747
+# EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
7f0747
+#		CONTEXT *context,DISPATCHER_CONTEXT *disp)
7f0747
+if ($win64) {
7f0747
+$rec="%rcx";
7f0747
+$frame="%rdx";
7f0747
+$context="%r8";
7f0747
+$disp="%r9";
7f0747
+
7f0747
+$code.=<<___;
7f0747
+.extern	__imp_RtlVirtualUnwind
7f0747
+.type	cbc_se_handler,\@abi-omnipotent
7f0747
+.align	16
7f0747
+cbc_se_handler:
7f0747
+	push	%rsi
7f0747
+	push	%rdi
7f0747
+	push	%rbx
7f0747
+	push	%rbp
7f0747
+	push	%r12
7f0747
+	push	%r13
7f0747
+	push	%r14
7f0747
+	push	%r15
7f0747
+	pushfq
7f0747
+	sub	\$64,%rsp
7f0747
+
7f0747
+	mov	152($context),%rax	# pull context->Rsp
7f0747
+	mov	248($context),%rbx	# pull context->Rip
7f0747
+
7f0747
+	lea	.Lcbc_decrypt(%rip),%r10
7f0747
+	cmp	%r10,%rbx		# context->Rip<"prologue" label
7f0747
+	jb	.Lin_prologue
7f0747
+
7f0747
+	lea	.Lcbc_decrypt_body(%rip),%r10
7f0747
+	cmp	%r10,%rbx		# context->Rip
7f0747
+	jb	.Lrestore_rax
7f0747
+
7f0747
+	lea	.Lcbc_ret(%rip),%r10
7f0747
+	cmp	%r10,%rbx		# context->Rip>="epilogue" label
7f0747
+	jae	.Lin_prologue
7f0747
+
7f0747
+	lea	0(%rax),%rsi		# top of stack
7f0747
+	lea	512($context),%rdi	# &context.Xmm6
7f0747
+	mov	\$8,%ecx		# 4*sizeof(%xmm0)/sizeof(%rax)
7f0747
+	.long	0xa548f3fc		# cld; rep movsq
7f0747
+	lea	0x58(%rax),%rax		# adjust stack pointer
7f0747
+	jmp	.Lin_prologue
7f0747
+
7f0747
+.Lrestore_rax:
7f0747
+	mov	120($context),%rax
7f0747
+.Lin_prologue:
7f0747
+	mov	8(%rax),%rdi
7f0747
+	mov	16(%rax),%rsi
7f0747
+	mov	%rax,152($context)	# restore context->Rsp
7f0747
+	mov	%rsi,168($context)	# restore context->Rsi
7f0747
+	mov	%rdi,176($context)	# restore context->Rdi
7f0747
+
7f0747
+	jmp	.Lcommon_seh_exit
7f0747
+.size	cbc_se_handler,.-cbc_se_handler
7f0747
+
7f0747
+.type	ecb_se_handler,\@abi-omnipotent
7f0747
+.align	16
7f0747
+ecb_se_handler:
7f0747
+	push	%rsi
7f0747
+	push	%rdi
7f0747
+	push	%rbx
7f0747
+	push	%rbp
7f0747
+	push	%r12
7f0747
+	push	%r13
7f0747
+	push	%r14
7f0747
+	push	%r15
7f0747
+	pushfq
7f0747
+	sub	\$64,%rsp
7f0747
+
7f0747
+	mov	152($context),%rax	# pull context->Rsp
7f0747
+	mov	8(%rax),%rdi
7f0747
+	mov	16(%rax),%rsi
7f0747
+	mov	%rsi,168($context)	# restore context->Rsi
7f0747
+	mov	%rdi,176($context)	# restore context->Rdi
7f0747
+
7f0747
+.Lcommon_seh_exit:
7f0747
+
7f0747
+	mov	40($disp),%rdi		# disp->ContextRecord
7f0747
+	mov	$context,%rsi		# context
7f0747
+	mov	\$154,%ecx		# sizeof(CONTEXT)
7f0747
+	.long	0xa548f3fc		# cld; rep movsq
7f0747
+
7f0747
+	mov	$disp,%rsi
7f0747
+	xor	%rcx,%rcx		# arg1, UNW_FLAG_NHANDLER
7f0747
+	mov	8(%rsi),%rdx		# arg2, disp->ImageBase
7f0747
+	mov	0(%rsi),%r8		# arg3, disp->ControlPc
7f0747
+	mov	16(%rsi),%r9		# arg4, disp->FunctionEntry
7f0747
+	mov	40(%rsi),%r10		# disp->ContextRecord
7f0747
+	lea	56(%rsi),%r11		# &disp->HandlerData
7f0747
+	lea	24(%rsi),%r12		# &disp->EstablisherFrame
7f0747
+	mov	%r10,32(%rsp)		# arg5
7f0747
+	mov	%r11,40(%rsp)		# arg6
7f0747
+	mov	%r12,48(%rsp)		# arg7
7f0747
+	mov	%rcx,56(%rsp)		# arg8, (NULL)
7f0747
+	call	*__imp_RtlVirtualUnwind(%rip)
7f0747
+
7f0747
+	mov	\$1,%eax		# ExceptionContinueSearch
7f0747
+	add	\$64,%rsp
7f0747
+	popfq
7f0747
+	pop	%r15
7f0747
+	pop	%r14
7f0747
+	pop	%r13
7f0747
+	pop	%r12
7f0747
+	pop	%rbp
7f0747
+	pop	%rbx
7f0747
+	pop	%rdi
7f0747
+	pop	%rsi
7f0747
+	ret
7f0747
+.size	cbc_se_handler,.-cbc_se_handler
7f0747
+
7f0747
+.section	.pdata
7f0747
+.align	4
7f0747
+	.rva	.LSEH_begin_${PREFIX}_ecb_encrypt
7f0747
+	.rva	.LSEH_end_${PREFIX}_ecb_encrypt
7f0747
+	.rva	.LSEH_info_ecb
7f0747
+
7f0747
+	.rva	.LSEH_begin_${PREFIX}_cbc_encrypt
7f0747
+	.rva	.LSEH_end_${PREFIX}_cbc_encrypt
7f0747
+	.rva	.LSEH_info_cbc
7f0747
+
7f0747
+	.rva	${PREFIX}_set_decrypt_key
7f0747
+	.rva	.LSEH_end_set_decrypt_key
7f0747
+	.rva	.LSEH_info_key
7f0747
+
7f0747
+	.rva	${PREFIX}_set_encrypt_key
7f0747
+	.rva	.LSEH_end_set_encrypt_key
7f0747
+	.rva	.LSEH_info_key
7f0747
+.section	.xdata
7f0747
+.align	8
7f0747
+.LSEH_info_ecb:
7f0747
+	.byte	9,0,0,0
7f0747
+	.rva	ecb_se_handler
7f0747
+.LSEH_info_cbc:
7f0747
+	.byte	9,0,0,0
7f0747
+	.rva	cbc_se_handler
7f0747
+.LSEH_info_key:
7f0747
+	.byte	0x01,0x04,0x01,0x00
7f0747
+	.byte	0x04,0x02,0x00,0x00
7f0747
+___
7f0747
+}
7f0747
+
7f0747
+sub rex {
7f0747
+ local *opcode=shift;
7f0747
+ my ($dst,$src)=@_;
7f0747
+
7f0747
+   if ($dst>=8 || $src>=8) {
7f0747
+	$rex=0x40;
7f0747
+	$rex|=0x04 if($dst>=8);
7f0747
+	$rex|=0x01 if($src>=8);
7f0747
+	push @opcode,$rex;
7f0747
+   }
7f0747
+}
7f0747
+
7f0747
+sub aesni {
7f0747
+  my $line=shift;
7f0747
+  my @opcode=(0x66);
7f0747
+
7f0747
+    if ($line=~/(aeskeygenassist)\s+\$([x0-9a-f]+),\s*%xmm([0-9]+),\s*%xmm([0-9]+)/) {
7f0747
+	rex(\@opcode,$4,$3);
7f0747
+	push @opcode,0x0f,0x3a,0xdf;
7f0747
+	push @opcode,0xc0|($3&7)|(($4&7)<<3);	# ModR/M
7f0747
+	my $c=$2;
7f0747
+	push @opcode,$c=~/^0/?oct($c):$c;
7f0747
+	return ".byte\t".join(',',@opcode);
7f0747
+    }
7f0747
+    elsif ($line=~/(aes[a-z]+)\s+%xmm([0-9]+),\s*%xmm([0-9]+)/) {
7f0747
+	my %opcodelet = (
7f0747
+		"aesimc" => 0xdb,
7f0747
+		"aesenc" => 0xdc,	"aesenclast" => 0xdd,
7f0747
+		"aesdec" => 0xde,	"aesdeclast" => 0xdf
7f0747
+	);
7f0747
+	return undef if (!defined($opcodelet{$1}));
7f0747
+	rex(\@opcode,$3,$2);
7f0747
+	push @opcode,0x0f,0x38,$opcodelet{$1};
7f0747
+	push @opcode,0xc0|($2&7)|(($3&7)<<3);	# ModR/M
7f0747
+	return ".byte\t".join(',',@opcode);
7f0747
+    }
7f0747
+    return $line;
7f0747
+}
7f0747
+
7f0747
+$code =~ s/\`([^\`]*)\`/eval($1)/gem;
7f0747
+$code =~ s/\b(aes.*%xmm[0-9]+).*$/aesni($1)/gem;
7f0747
+
7f0747
+print $code;
7f0747
+
7f0747
+close STDOUT;
7f0747
diff -up openssl-1.0.0-beta4/crypto/aes/Makefile.aesni openssl-1.0.0-beta4/crypto/aes/Makefile
7f0747
--- openssl-1.0.0-beta4/crypto/aes/Makefile.aesni	2008-12-23 12:33:00.000000000 +0100
7f0747
+++ openssl-1.0.0-beta4/crypto/aes/Makefile	2010-01-12 22:18:06.000000000 +0100
7f0747
@@ -50,9 +50,13 @@ aes-ia64.s: asm/aes-ia64.S
7f0747
 
7f0747
 aes-586.s:	asm/aes-586.pl ../perlasm/x86asm.pl
7f0747
 	$(PERL) asm/aes-586.pl $(PERLASM_SCHEME) $(CFLAGS) $(PROCESSOR) > $@
7f0747
+aesni-x86.s:	asm/aesni-x86.pl ../perlasm/x86asm.pl
7f0747
+	$(PERL) asm/aesni-x86.pl $(PERLASM_SCHEME) $(CFLAGS) $(PROCESSOR) > $@
7f0747
 
7f0747
 aes-x86_64.s: asm/aes-x86_64.pl
7f0747
 	$(PERL) asm/aes-x86_64.pl $(PERLASM_SCHEME) > $@
7f0747
+aesni-x86_64.s: asm/aesni-x86_64.pl
7f0747
+	$(PERL) asm/aesni-x86_64.pl $(PERLASM_SCHEME) > $@
7f0747
 
7f0747
 aes-sparcv9.s: asm/aes-sparcv9.pl
7f0747
 	$(PERL) asm/aes-sparcv9.pl $(CFLAGS) > $@
7f0747
diff -up openssl-1.0.0-beta4/crypto/engine/eng_aesni.c.aesni openssl-1.0.0-beta4/crypto/engine/eng_aesni.c
7f0747
--- openssl-1.0.0-beta4/crypto/engine/eng_aesni.c.aesni	2010-01-12 22:18:06.000000000 +0100
7f0747
+++ openssl-1.0.0-beta4/crypto/engine/eng_aesni.c	2010-01-12 22:18:06.000000000 +0100
7f0747
@@ -0,0 +1,413 @@
7f0747
+/*
7f0747
+ * Support for Intel AES-NI intruction set
7f0747
+ *   Author: Huang Ying <ying.huang@intel.com>
7f0747
+ *
7f0747
+ * Intel AES-NI is a new set of Single Instruction Multiple Data
7f0747
+ * (SIMD) instructions that are going to be introduced in the next
7f0747
+ * generation of Intel processor, as of 2009. These instructions
7f0747
+ * enable fast and secure data encryption and decryption, using the
7f0747
+ * Advanced Encryption Standard (AES), defined by FIPS Publication
7f0747
+ * number 197.  The architecture introduces six instructions that
7f0747
+ * offer full hardware support for AES. Four of them support high
7f0747
+ * performance data encryption and decryption, and the other two
7f0747
+ * instructions support the AES key expansion procedure.
7f0747
+ *
7f0747
+ * The white paper can be downloaded from:
7f0747
+ *   http://softwarecommunity.intel.com/isn/downloads/intelavx/AES-Instructions-Set_WP.pdf
7f0747
+ *
7f0747
+ * This file is based on engines/e_padlock.c
7f0747
+ */
7f0747
+
7f0747
+/* ====================================================================
7f0747
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
7f0747
+ *
7f0747
+ * Redistribution and use in source and binary forms, with or without
7f0747
+ * modification, are permitted provided that the following conditions
7f0747
+ * are met:
7f0747
+ *
7f0747
+ * 1. Redistributions of source code must retain the above copyright
7f0747
+ *    notice, this list of conditions and the following disclaimer.
7f0747
+ *
7f0747
+ * 2. Redistributions in binary form must reproduce the above copyright
7f0747
+ *    notice, this list of conditions and the following disclaimer in
7f0747
+ *    the documentation and/or other materials provided with the
7f0747
+ *    distribution.
7f0747
+ *
7f0747
+ * 3. All advertising materials mentioning features or use of this
7f0747
+ *    software must display the following acknowledgment:
7f0747
+ *    "This product includes software developed by the OpenSSL Project
7f0747
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
7f0747
+ *
7f0747
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
7f0747
+ *    endorse or promote products derived from this software without
7f0747
+ *    prior written permission. For written permission, please contact
7f0747
+ *    licensing@OpenSSL.org.
7f0747
+ *
7f0747
+ * 5. Products derived from this software may not be called "OpenSSL"
7f0747
+ *    nor may "OpenSSL" appear in their names without prior written
7f0747
+ *    permission of the OpenSSL Project.
7f0747
+ *
7f0747
+ * 6. Redistributions of any form whatsoever must retain the following
7f0747
+ *    acknowledgment:
7f0747
+ *    "This product includes software developed by the OpenSSL Project
7f0747
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
7f0747
+ *
7f0747
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
7f0747
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
7f0747
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
7f0747
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
7f0747
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
7f0747
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
7f0747
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
7f0747
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
7f0747
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
7f0747
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
7f0747
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
7f0747
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
7f0747
+ * ====================================================================
7f0747
+ *
7f0747
+ * This product includes cryptographic software written by Eric Young
7f0747
+ * (eay@cryptsoft.com).  This product includes software written by Tim
7f0747
+ * Hudson (tjh@cryptsoft.com).
7f0747
+ *
7f0747
+ */
7f0747
+
7f0747
+
7f0747
+#include <openssl opensslconf.h="">
7f0747
+
7f0747
+#if !defined(OPENSSL_NO_HW) && !defined(OPENSSL_NO_HW_AES_NI) && !defined(OPENSSL_NO_AES)
7f0747
+
7f0747
+#include <stdio.h>
7f0747
+#include "cryptlib.h"
7f0747
+#include <openssl dso.h="">
7f0747
+#include <openssl engine.h="">
7f0747
+#include <openssl evp.h="">
7f0747
+#include <openssl aes.h="">
7f0747
+#include <openssl err.h="">
7f0747
+#include <openssl modes.h="">
7f0747
+
7f0747
+/* AES-NI is available *ONLY* on some x86 CPUs.  Not only that it
7f0747
+   doesn't exist elsewhere, but it even can't be compiled on other
7f0747
+   platforms! */
7f0747
+#undef COMPILE_HW_AESNI
7f0747
+#if (defined(__x86_64) || defined(__x86_64__) || \
7f0747
+     defined(_M_AMD64) || defined(_M_X64) || \
7f0747
+     defined(OPENSSL_IA32_SSE2)) && !defined(OPENSSL_NO_ASM)
7f0747
+#define COMPILE_HW_AESNI
7f0747
+static ENGINE *ENGINE_aesni (void);
7f0747
+#endif
7f0747
+
7f0747
+void ENGINE_load_aesni (void)
7f0747
+{
7f0747
+/* On non-x86 CPUs it just returns. */
7f0747
+#ifdef COMPILE_HW_AESNI
7f0747
+	ENGINE *toadd = ENGINE_aesni();
7f0747
+	if (!toadd)
7f0747
+		return;
7f0747
+	ENGINE_add (toadd);
7f0747
+	ENGINE_register_complete (toadd);
7f0747
+	ENGINE_free (toadd);
7f0747
+	ERR_clear_error ();
7f0747
+#endif
7f0747
+}
7f0747
+
7f0747
+#ifdef COMPILE_HW_AESNI
7f0747
+int aesni_set_encrypt_key(const unsigned char *userKey, int bits,
7f0747
+			      AES_KEY *key);
7f0747
+int aesni_set_decrypt_key(const unsigned char *userKey, int bits,
7f0747
+			      AES_KEY *key);
7f0747
+
7f0747
+void aesni_encrypt(const unsigned char *in, unsigned char *out,
7f0747
+		       const AES_KEY *key);
7f0747
+void aesni_decrypt(const unsigned char *in, unsigned char *out,
7f0747
+		       const AES_KEY *key);
7f0747
+
7f0747
+void aesni_ecb_encrypt(const unsigned char *in,
7f0747
+			   unsigned char *out,
7f0747
+			   size_t length,
7f0747
+			   const AES_KEY *key,
7f0747
+			   int enc);
7f0747
+void aesni_cbc_encrypt(const unsigned char *in,
7f0747
+			   unsigned char *out,
7f0747
+			   size_t length,
7f0747
+			   const AES_KEY *key,
7f0747
+			   unsigned char *ivec, int enc);
7f0747
+
7f0747
+/* Function for ENGINE detection and control */
7f0747
+static int aesni_init(ENGINE *e);
7f0747
+
7f0747
+/* Cipher Stuff */
7f0747
+static int aesni_ciphers(ENGINE *e, const EVP_CIPHER **cipher,
7f0747
+				const int **nids, int nid);
7f0747
+
7f0747
+#define AESNI_MIN_ALIGN	16
7f0747
+#define AESNI_ALIGN(x) \
7f0747
+	((void *)(((unsigned long)(x)+AESNI_MIN_ALIGN-1)&~(AESNI_MIN_ALIGN-1)))
7f0747
+
7f0747
+/* Engine names */
7f0747
+static const char   aesni_id[] = "aesni",
7f0747
+		    aesni_name[] = "Intel AES-NI engine",
7f0747
+		    no_aesni_name[] = "Intel AES-NI engine (no-aesni)";
7f0747
+
7f0747
+/* ===== Engine "management" functions ===== */
7f0747
+
7f0747
+#if defined(_WIN32)
7f0747
+typedef unsigned __int64 IA32CAP;
7f0747
+#else
7f0747
+typedef unsigned long long IA32CAP;
7f0747
+#endif
7f0747
+
7f0747
+/* Prepare the ENGINE structure for registration */
7f0747
+static int
7f0747
+aesni_bind_helper(ENGINE *e)
7f0747
+{
7f0747
+	int engage;
7f0747
+	if (sizeof(OPENSSL_ia32cap_P) > 4) {
7f0747
+		engage = (OPENSSL_ia32cap_P >> 57) & 1;
7f0747
+	} else {
7f0747
+		IA32CAP OPENSSL_ia32_cpuid(void);
7f0747
+		engage = (OPENSSL_ia32_cpuid() >> 57) & 1;
7f0747
+	}
7f0747
+
7f0747
+	/* Register everything or return with an error */
7f0747
+	if (!ENGINE_set_id(e, aesni_id) ||
7f0747
+	    !ENGINE_set_name(e, engage ? aesni_name : no_aesni_name) ||
7f0747
+
7f0747
+	    !ENGINE_set_init_function(e, aesni_init) ||
7f0747
+	    (engage && !ENGINE_set_ciphers (e, aesni_ciphers))
7f0747
+	    )
7f0747
+		return 0;
7f0747
+
7f0747
+	/* Everything looks good */
7f0747
+	return 1;
7f0747
+}
7f0747
+
7f0747
+/* Constructor */
7f0747
+static ENGINE *
7f0747
+ENGINE_aesni(void)
7f0747
+{
7f0747
+	ENGINE *eng = ENGINE_new();
7f0747
+
7f0747
+	if (!eng) {
7f0747
+		return NULL;
7f0747
+	}
7f0747
+
7f0747
+	if (!aesni_bind_helper(eng)) {
7f0747
+		ENGINE_free(eng);
7f0747
+		return NULL;
7f0747
+	}
7f0747
+
7f0747
+	return eng;
7f0747
+}
7f0747
+
7f0747
+/* Check availability of the engine */
7f0747
+static int
7f0747
+aesni_init(ENGINE *e)
7f0747
+{
7f0747
+	return 1;
7f0747
+}
7f0747
+
7f0747
+#if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb)
7f0747
+#define NID_aes_128_cfb	NID_aes_128_cfb128
7f0747
+#endif
7f0747
+
7f0747
+#if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb)
7f0747
+#define NID_aes_128_ofb	NID_aes_128_ofb128
7f0747
+#endif
7f0747
+
7f0747
+#if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb)
7f0747
+#define NID_aes_192_cfb	NID_aes_192_cfb128
7f0747
+#endif
7f0747
+
7f0747
+#if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb)
7f0747
+#define NID_aes_192_ofb	NID_aes_192_ofb128
7f0747
+#endif
7f0747
+
7f0747
+#if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb)
7f0747
+#define NID_aes_256_cfb	NID_aes_256_cfb128
7f0747
+#endif
7f0747
+
7f0747
+#if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb)
7f0747
+#define NID_aes_256_ofb	NID_aes_256_ofb128
7f0747
+#endif
7f0747
+
7f0747
+/* List of supported ciphers. */
7f0747
+static int aesni_cipher_nids[] = {
7f0747
+	NID_aes_128_ecb,
7f0747
+	NID_aes_128_cbc,
7f0747
+	NID_aes_128_cfb,
7f0747
+	NID_aes_128_ofb,
7f0747
+
7f0747
+	NID_aes_192_ecb,
7f0747
+	NID_aes_192_cbc,
7f0747
+	NID_aes_192_cfb,
7f0747
+	NID_aes_192_ofb,
7f0747
+
7f0747
+	NID_aes_256_ecb,
7f0747
+	NID_aes_256_cbc,
7f0747
+	NID_aes_256_cfb,
7f0747
+	NID_aes_256_ofb,
7f0747
+};
7f0747
+static int aesni_cipher_nids_num =
7f0747
+	(sizeof(aesni_cipher_nids)/sizeof(aesni_cipher_nids[0]));
7f0747
+
7f0747
+typedef struct
7f0747
+{
7f0747
+	AES_KEY ks;
7f0747
+	unsigned int _pad1[3];
7f0747
+} AESNI_KEY;
7f0747
+
7f0747
+static int
7f0747
+aesni_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *user_key,
7f0747
+		    const unsigned char *iv, int enc)
7f0747
+{
<