crypto/aes/asm/aes-586.pl

   1 #!/usr/bin/env perl
   2 #
   3 # ====================================================================
   4 # Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
   5 # project. Rights for redistribution and usage in source and binary
   6 # forms are granted according to the OpenSSL license.
   7 # ====================================================================
   8 #
   9 # Version 3.7.
  10 #
  11 # You might fail to appreciate this module performance from the first
  12 # try. If compared to "vanilla" linux-ia32-icc target, i.e. considered
  13 # to be *the* best Intel C compiler without -KPIC, performance appears
  14 # to be virtually identical... But try to re-configure with shared
  15 # library support... Aha! Intel compiler "suddenly" lags behind by 30%
  16 # [on P4, more on others]:-) And if compared to position-independent
  17 # code generated by GNU C, this code performs *more* than *twice* as
  18 # fast! Yes, all this buzz about PIC means that unlike other hand-
  19 # coded implementations, this one was explicitly designed to be safe
  20 # to use even in shared library context... This also means that this
  21 # code isn't necessarily absolutely fastest "ever," because in order
  22 # to achieve position independence an extra register has to be
  23 # off-loaded to stack, which affects the benchmark result.
  24 #
  25 # Special note about instruction choice. Do you recall RC4_INT code
  26 # performing poorly on P4? It might be the time to figure out why.
  27 # RC4_INT code implies effective address calculations in base+offset*4
  28 # form. Trouble is that it seems that offset scaling turned to be
  29 # critical path... At least eliminating scaling resulted in 2.8x RC4
  30 # performance improvement [as you might recall]. As AES code is hungry
  31 # for scaling too, I [try to] avoid the latter by favoring off-by-2
  32 # shifts and masking the result with 0xFF<<2 instead of "boring" 0xFF.
  33 #
  34 # As was shown by Dean Gaudet <dean@arctic.org>, the above note turned
  35 # void. Performance improvement with off-by-2 shifts was observed on
  36 # intermediate implementation, which was spilling yet another register
  37 # to stack... Final offset*4 code below runs just a tad faster on P4,
  38 # but exhibits up to 10% improvement on other cores.
  39 #
  40 # Second version is "monolithic" replacement for aes_core.c, which in
  41 # addition to AES_[de|en]crypt implements AES_set_[de|en]cryption_key.
  42 # This made it possible to implement little-endian variant of the
  43 # algorithm without modifying the base C code. Motivating factor for
  44 # the undertaken effort was that it appeared that in tight IA-32
  45 # register window little-endian flavor could achieve slightly higher
  46 # Instruction Level Parallelism, and it indeed resulted in up to 15%
  47 # better performance on most recent µ-archs...
  48 #
  49 # Third version adds AES_cbc_encrypt implementation, which resulted in
  50 # up to 40% performance imrovement of CBC benchmark results. 40% was
  51 # observed on P4 core, where "overall" imrovement coefficient, i.e. if
  52 # compared to PIC generated by GCC and in CBC mode, was observed to be
  53 # as large as 4x:-) CBC performance is virtually identical to ECB now
  54 # and on some platforms even better, e.g. 17.6 "small" cycles/byte on
  55 # Opteron, because certain function prologues and epilogues are
  56 # effectively taken out of the loop...
  57 #
  58 # Version 3.2 implements compressed tables and prefetch of these tables
  59 # in CBC[!] mode. Former means that 3/4 of table references are now
  60 # misaligned, which unfortunately has negative impact on elder IA-32
  61 # implementations, Pentium suffered 30% penalty, PIII - 10%.
  62 #
  63 # Version 3.3 avoids L1 cache aliasing between stack frame and
  64 # S-boxes, and 3.4 - L1 cache aliasing even between key schedule. The
  65 # latter is achieved by copying the key schedule to controlled place in
  66 # stack. This unfortunately has rather strong impact on small block CBC
  67 # performance, ~2x deterioration on 16-byte block if compared to 3.3.
  68 #
  69 # Version 3.5 checks if there is L1 cache aliasing between user-supplied
  70 # key schedule and S-boxes and abstains from copying the former if
  71 # there is no. This allows end-user to consciously retain small block
  72 # performance by aligning key schedule in specific manner.
  73 #
  74 # Version 3.6 compresses Td4 to 256 bytes and prefetches it in ECB.
  75 #
  76 # Current ECB performance numbers for 128-bit key in CPU cycles per
  77 # processed byte [measure commonly used by AES benchmarkers] are:
  78 #
  79 #               small footprint         fully unrolled
  80 # P4            24                      22
  81 # AMD K8        20                      19
  82 # PIII          25                      23
  83 # Pentium       81                      78
  84 #
  85 # Version 3.7 reimplements outer rounds as "compact." Meaning that
  86 # first and last rounds reference compact 256 bytes S-box. This means
  87 # that first round consumes a lot more CPU cycles and that encrypt
  88 # and decrypt performance becomes asymmetric. Encrypt performance
  89 # drops by 10-12%, while decrypt - by 20-25%:-( 256 bytes S-box is
  90 # aggressively pre-fetched.
  91
  92 push(@INC,"perlasm","../../perlasm");
  93 require "x86asm.pl";
  94
  95 &asm_init($ARGV[0],"aes-586.pl",$ARGV[$#ARGV] eq "386");
  96
  97 $s0="eax";
  98 $s1="ebx";
  99 $s2="ecx";
 100 $s3="edx";
 101 $key="edi";
 102 $acc="esi";
 103
 104 $compromise=0;          # $compromise=128 abstains from copying key
 105                         # schedule to stack when encrypting inputs
 106                         # shorter than 128 bytes at the cost of
 107                         # risksing aliasing with S-boxes. In return
 108                         # you get way better, up to +70%, small block
 109                         # performance.
 110 $small_footprint=1;     # $small_footprint=1 code is ~5% slower [on
 111                         # recent µ-archs], but ~5 times smaller!
 112                         # I favor compact code to minimize cache
 113                         # contention and in hope to "collect" 5% back
 114                         # in real-life applications...
 115 $vertical_spin=0;       # shift "verticaly" defaults to 0, because of
 116                         # its proof-of-concept status...
 117
 118 # Note that there is no decvert(), as well as last encryption round is
 119 # performed with "horizontal" shifts. This is because this "vertical"
 120 # implementation [one which groups shifts on a given $s[i] to form a
 121 # "column," unlike "horizontal" one, which groups shifts on different
 122 # $s[i] to form a "row"] is work in progress. It was observed to run
 123 # few percents faster on Intel cores, but not AMD. On AMD K8 core it's
 124 # whole 12% slower:-( So we face a trade-off... Shall it be resolved
 125 # some day? Till then the code is considered experimental and by
 126 # default remains dormant...
 127
 128 sub encvert()
 129 { my ($te,@s) = @_;
 130   my $v0 = $acc, $v1 = $key;
 131
 132         &mov    ($v0,$s[3]);                            # copy s3
 133         &mov    (&DWP(4,"esp"),$s[2]);                  # save s2
 134         &mov    ($v1,$s[0]);                            # copy s0
 135         &mov    (&DWP(8,"esp"),$s[1]);                  # save s1
 136
 137         &movz   ($s[2],&HB($s[0]));
 138         &and    ($s[0],0xFF);
 139         &mov    ($s[0],&DWP(0,$te,$s[0],8));            # s0>>0
 140         &shr    ($v1,16);
 141         &mov    ($s[3],&DWP(3,$te,$s[2],8));            # s0>>8
 142         &movz   ($s[1],&HB($v1));
 143         &and    ($v1,0xFF);
 144         &mov    ($s[2],&DWP(2,$te,$v1,8));              # s0>>16
 145          &mov   ($v1,$v0);
 146         &mov    ($s[1],&DWP(1,$te,$s[1],8));            # s0>>24
 147
 148         &and    ($v0,0xFF);
 149         &xor    ($s[3],&DWP(0,$te,$v0,8));              # s3>>0
 150         &movz   ($v0,&HB($v1));
 151         &shr    ($v1,16);
 152         &xor    ($s[2],&DWP(3,$te,$v0,8));              # s3>>8
 153         &movz   ($v0,&HB($v1));
 154         &and    ($v1,0xFF);
 155         &xor    ($s[1],&DWP(2,$te,$v1,8));              # s3>>16
 156          &mov   ($v1,&DWP(4,"esp"));                    # restore s2
 157         &xor    ($s[0],&DWP(1,$te,$v0,8));              # s3>>24
 158
 159         &mov    ($v0,$v1);
 160         &and    ($v1,0xFF);
 161         &xor    ($s[2],&DWP(0,$te,$v1,8));              # s2>>0
 162         &movz   ($v1,&HB($v0));
 163         &shr    ($v0,16);
 164         &xor    ($s[1],&DWP(3,$te,$v1,8));              # s2>>8
 165         &movz   ($v1,&HB($v0));
 166         &and    ($v0,0xFF);
 167         &xor    ($s[0],&DWP(2,$te,$v0,8));              # s2>>16
 168          &mov   ($v0,&DWP(8,"esp"));                    # restore s1
 169         &xor    ($s[3],&DWP(1,$te,$v1,8));              # s2>>24
 170
 171         &mov    ($v1,$v0);
 172         &and    ($v0,0xFF);
 173         &xor    ($s[1],&DWP(0,$te,$v0,8));              # s1>>0
 174         &movz   ($v0,&HB($v1));
 175         &shr    ($v1,16);
 176         &xor    ($s[0],&DWP(3,$te,$v0,8));              # s1>>8
 177         &movz   ($v0,&HB($v1));
 178         &and    ($v1,0xFF);
 179         &xor    ($s[3],&DWP(2,$te,$v1,8));              # s1>>16
 180          &mov   ($key,&DWP(20,"esp"));                  # reincarnate v1 as key
 181         &xor    ($s[2],&DWP(1,$te,$v0,8));              # s1>>24
 182 }
 183
 184 sub encstep()
 185 { my ($i,$te,@s) = @_;
 186   my $tmp = $key;
 187   my $out = $i==3?$s[0]:$acc;
 188
 189         # lines marked with #%e?x[i] denote "reordered" instructions...
 190         if ($i==3)  {   &mov    ($key,&DWP(20,"esp"));          }##%edx
 191         else        {   &mov    ($out,$s[0]);
 192                         &and    ($out,0xFF);                    }
 193         if ($i==1)  {   &shr    ($s[0],16);                     }#%ebx[1]
 194         if ($i==2)  {   &shr    ($s[0],24);                     }#%ecx[2]
 195                         &mov    ($out,&DWP(0,$te,$out,8));
 196
 197         if ($i==3)  {   $tmp=$s[1];                             }##%eax
 198                         &movz   ($tmp,&HB($s[1]));
 199                         &xor    ($out,&DWP(3,$te,$tmp,8));
 200
 201         if ($i==3)  {   $tmp=$s[2]; &mov ($s[1],&DWP(4,"esp")); }##%ebx
 202         else        {   &mov    ($tmp,$s[2]);
 203                         &shr    ($tmp,16);                      }
 204         if ($i==2)  {   &and    ($s[1],0xFF);                   }#%edx[2]
 205                         &and    ($tmp,0xFF);
 206                         &xor    ($out,&DWP(2,$te,$tmp,8));
 207
 208         if ($i==3)  {   $tmp=$s[3]; &mov ($s[2],&DWP(8,"esp")); }##%ecx
 209         elsif($i==2){   &movz   ($tmp,&HB($s[3]));              }#%ebx[2]
 210         else        {   &mov    ($tmp,$s[3]);
 211                         &shr    ($tmp,24)                       }
 212                         &xor    ($out,&DWP(1,$te,$tmp,8));
 213         if ($i<2)   {   &mov    (&DWP(4+4*$i,"esp"),$out);      }
 214         if ($i==3)  {   &mov    ($s[3],$acc);                   }
 215                         &comment();
 216 }
 217
 218 sub enclast()
 219 { my $Fn = mov;
 220   while ($#_>5) { pop(@_); $Fn=sub{}; }
 221   my ($i,$te,@s)=@_;
 222   my $tmp = $key;
 223   my $out = $i==3?$s[0]:$acc;
 224
 225         if ($i==0)      # prefetch 256-byte Te4
 226         {   &lea        ($te,&DWP(2048+128,$te));
 227             &mov        ($tmp,&DWP(0-128,$te));
 228             &mov        ($acc,&DWP(32-128,$te));
 229             &mov        ($tmp,&DWP(64-128,$te));
 230             &mov        ($acc,&DWP(96-128,$te));
 231             &mov        ($tmp,&DWP(128-128,$te));
 232             &mov        ($acc,&DWP(160-128,$te));
 233             &mov        ($tmp,&DWP(192-128,$te));
 234             &mov        ($acc,&DWP(224-128,$te));
 235             &lea        ($te,&DWP(-128,$te));
 236         }
 237
 238         # $Fn is used in first compact round and its purpose is to
 239         # void restoration of some values from stack, so that after
 240         # 4xenclast with extra argument $key value is left there...
 241         if ($i==3)  {   &$Fn    ($key,&DWP(20,"esp"));          }##%edx
 242         else        {   &mov    ($out,$s[0]);                   }
 243                         &and    ($out,0xFF);
 244         if ($i==1)  {   &shr    ($s[0],16);                     }#%ebx[1]
 245         if ($i==2)  {   &shr    ($s[0],24);                     }#%ecx[2]
 246                         &movz   ($out,&DWP(0,$te,$out,1));
 247
 248         if ($i==3)  {   $tmp=$s[1];                             }##%eax
 249                         &movz   ($tmp,&HB($s[1]));
 250                         &movz   ($tmp,&DWP(0,$te,$tmp,1));
 251                         &shl    ($tmp,8);
 252                         &xor    ($out,$tmp);
 253
 254         if ($i==3)  {   $tmp=$s[2]; &mov ($s[1],&DWP(4,"esp")); }##%ebx
 255         else        {   &mov    ($tmp,$s[2]);
 256                         &shr    ($tmp,16);                      }
 257         if ($i==2)  {   &and    ($s[1],0xFF);                   }#%edx[2]
 258                         &and    ($tmp,0xFF);
 259                         &movz   ($tmp,&DWP(0,$te,$tmp,1));
 260                         &shl    ($tmp,16);
 261                         &xor    ($out,$tmp);
 262
 263         if ($i==3)  {   $tmp=$s[3]; &mov ($s[2],&DWP(8,"esp")); }##%ecx
 264         elsif($i==2){   &movz   ($tmp,&HB($s[3]));              }#%ebx[2]
 265         else        {   &mov    ($tmp,$s[3]);
 266                         &shr    ($tmp,24);                      }
 267                         &movz   ($tmp,&DWP(0,$te,$tmp,1));
 268                         &shl    ($tmp,24);
 269                         &xor    ($out,$tmp);
 270         if ($i<2)   {   &mov    (&DWP(4+4*$i,"esp"),$out);      }
 271         if ($i==3)  {   &mov    ($s[3],$acc);
 272                         &lea    ($te,&DWP(-2048,$te));          }
 273         &comment();
 274 }
 275
 276 sub enctransform()
 277 { my @s = ($s0,$s1,$s2,$s3);
 278   my $i = shift;
 279   my $tmp = $key;
 280   my $r2 = "ebp";
 281
 282         &mov    ($acc,$s[$i]);
 283         &and    ($acc,0x80808080);
 284         &mov    ($tmp,$acc);
 285         &mov    ($r2,$s[$i]);
 286         &shr    ($tmp,7);
 287         &and    ($r2,0x7f7f7f7f);
 288         &sub    ($acc,$tmp);
 289         &lea    ($r2,&DWP(0,$r2,$r2));
 290         &and    ($acc,0x1b1b1b1b);
 291         &mov    ($tmp,$s[$i]);
 292         &xor    ($r2,$acc);     # r2
 293
 294         &xor    ($s[$i],$r2);   # r0 ^ r2
 295         &rotl   ($s[$i],24);
 296         &xor    ($s[$i],$r2)    # ROTATE(r2^r0,24) ^ r2
 297         &rotr   ($tmp,16);
 298         &xor    ($s[$i],$tmp);
 299         &rotr   ($tmp,8);
 300         &xor    ($s[$i],$tmp);
 301 }
 302
 303 sub enclast_large()
 304 { my ($i,$te,@s)=@_;
 305   my $tmp = $key;
 306   my $out = $i==3?$s[0]:$acc;
 307
 308         if ($i==3)  {   &mov    ($key,&DWP(20,"esp"));          }##%edx
 309         else        {   &mov    ($out,$s[0]);                   }
 310                         &and    ($out,0xFF);
 311         if ($i==1)  {   &shr    ($s[0],16);                     }#%ebx[1]
 312         if ($i==2)  {   &shr    ($s[0],24);                     }#%ecx[2]
 313                         &mov    ($out,&DWP(2,$te,$out,8));
 314                         &and    ($out,0x000000ff);
 315
 316         if ($i==3)  {   $tmp=$s[1];                             }##%eax
 317                         &movz   ($tmp,&HB($s[1]));
 318                         &mov    ($tmp,&DWP(0,$te,$tmp,8));
 319                         &and    ($tmp,0x0000ff00);
 320                         &xor    ($out,$tmp);
 321
 322         if ($i==3)  {   $tmp=$s[2]; &mov ($s[1],&DWP(4,"esp")); }##%ebx
 323         else        {   &mov    ($tmp,$s[2]);
 324                         &shr    ($tmp,16);                      }
 325         if ($i==2)  {   &and    ($s[1],0xFF);                   }#%edx[2]
 326                         &and    ($tmp,0xFF);
 327                         &mov    ($tmp,&DWP(0,$te,$tmp,8));
 328                         &and    ($tmp,0x00ff0000);
 329                         &xor    ($out,$tmp);
 330
 331         if ($i==3)  {   $tmp=$s[3]; &mov ($s[2],&DWP(8,"esp")); }##%ecx
 332         elsif($i==2){   &movz   ($tmp,&HB($s[3]));              }#%ebx[2]
 333         else        {   &mov    ($tmp,$s[3]);
 334                         &shr    ($tmp,24);                      }
 335                         &mov    ($tmp,&DWP(2,$te,$tmp,8));
 336                         &and    ($tmp,0xff000000);
 337                         &xor    ($out,$tmp);
 338         if ($i<2)   {   &mov    (&DWP(4+4*$i,"esp"),$out);      }
 339         if ($i==3)  {   &mov    ($s[3],$acc);                   }
 340 }
 341
 342 sub _data_word() { my $i; while(defined($i=shift)) { &data_word($i,$i); } }
 343
 344 &public_label("AES_Te");
 345 &function_begin_B("_x86_AES_encrypt");
 346         if ($vertical_spin) {
 347                 # I need high parts of volatile registers to be accessible...
 348                 &exch   ($s1="edi",$key="ebx");
 349                 &mov    ($s2="esi",$acc="ecx");
 350         }
 351
 352         # note that caller is expected to allocate stack frame for me!
 353         &mov    (&DWP(20,"esp"),$key);          # save key
 354
 355         &xor    ($s0,&DWP(0,$key));             # xor with key
 356         &xor    ($s1,&DWP(4,$key));
 357         &xor    ($s2,&DWP(8,$key));
 358         &xor    ($s3,&DWP(12,$key));
 359
 360         # not really last round, just "compact" one...
 361         &enclast(0,"ebp",$s0,$s1,$s2,$s3,1);
 362         &enclast(1,"ebp",$s1,$s2,$s3,$s0,1);
 363         &enclast(2,"ebp",$s2,$s3,$s0,$s1,1);
 364         &enclast(3,"ebp",$s3,$s0,$s1,$s2,1);
 365         &enctransform(2);
 366         &enctransform(3);
 367         &enctransform(0);
 368         &enctransform(1);
 369         &mov    ($key,&DWP(20,"esp"));
 370         &mov    ("ebp",&DWP(28,"esp"));
 371         &xor    ($s0,&DWP(16,$key));
 372         &xor    ($s1,&DWP(20,$key));
 373         &xor    ($s2,&DWP(24,$key));
 374         &xor    ($s3,&DWP(28,$key));
 375
 376         &mov    ($acc,&DWP(240,$key));          # load key->rounds
 377
 378         if ($small_footprint) {
 379             &lea        ($acc,&DWP(-2,$acc,$acc));
 380             &lea        ($acc,&DWP(0,$key,$acc,8));
 381             &add        ($key,16);
 382             &mov        (&DWP(20,"esp"),$key);
 383             &mov        (&DWP(24,"esp"),$acc);  # end of key schedule
 384
 385             &align      (4);
 386             &set_label("loop");
 387                 if ($vertical_spin) {
 388                     &encvert("ebp",$s0,$s1,$s2,$s3);
 389                 } else {
 390                     &encstep(0,"ebp",$s0,$s1,$s2,$s3);
 391                     &encstep(1,"ebp",$s1,$s2,$s3,$s0);
 392                     &encstep(2,"ebp",$s2,$s3,$s0,$s1);
 393                     &encstep(3,"ebp",$s3,$s0,$s1,$s2);
 394                 }
 395                 &add    ($key,16);              # advance rd_key
 396                 &xor    ($s0,&DWP(0,$key));
 397                 &xor    ($s1,&DWP(4,$key));
 398                 &xor    ($s2,&DWP(8,$key));
 399                 &xor    ($s3,&DWP(12,$key));
 400             &cmp        ($key,&DWP(24,"esp"));
 401             &mov        (&DWP(20,"esp"),$key);
 402             &jb         (&label("loop"));
 403         }
 404         else {
 405             &cmp        ($acc,10);
 406             &jle        (&label("10rounds"));
 407             &cmp        ($acc,12);
 408             &jle        (&label("12rounds"));
 409
 410         &set_label("14rounds");
 411             for ($i=2;$i<4;$i++) {
 412                 if ($vertical_spin) {
 413                     &encvert("ebp",$s0,$s1,$s2,$s3);
 414                 } else {
 415                     &encstep(0,"ebp",$s0,$s1,$s2,$s3);
 416                     &encstep(1,"ebp",$s1,$s2,$s3,$s0);
 417                     &encstep(2,"ebp",$s2,$s3,$s0,$s1);
 418                     &encstep(3,"ebp",$s3,$s0,$s1,$s2);
 419                 }
 420                 &xor    ($s0,&DWP(16*$i+0,$key));
 421                 &xor    ($s1,&DWP(16*$i+4,$key));
 422                 &xor    ($s2,&DWP(16*$i+8,$key));
 423                 &xor    ($s3,&DWP(16*$i+12,$key));
 424             }
 425             &add        ($key,32);
 426             &mov        (&DWP(20,"esp"),$key);  # advance rd_key
 427         &set_label("12rounds");
 428             for ($i=2;$i<4;$i++) {
 429                 if ($vertical_spin) {
 430                     &encvert("ebp",$s0,$s1,$s2,$s3);
 431                 } else {
 432                     &encstep(0,"ebp",$s0,$s1,$s2,$s3);
 433                     &encstep(1,"ebp",$s1,$s2,$s3,$s0);
 434                     &encstep(2,"ebp",$s2,$s3,$s0,$s1);
 435                     &encstep(3,"ebp",$s3,$s0,$s1,$s2);
 436                 }
 437                 &xor    ($s0,&DWP(16*$i+0,$key));
 438                 &xor    ($s1,&DWP(16*$i+4,$key));
 439                 &xor    ($s2,&DWP(16*$i+8,$key));
 440                 &xor    ($s3,&DWP(16*$i+12,$key));
 441             }
 442             &add        ($key,32);
 443             &mov        (&DWP(20,"esp"),$key);  # advance rd_key
 444         &set_label("10rounds");
 445             for ($i=2;$i<10;$i++) {
 446                 if ($vertical_spin) {
 447                     &encvert("ebp",$s0,$s1,$s2,$s3);
 448                 } else {
 449                     &encstep(0,"ebp",$s0,$s1,$s2,$s3);
 450                     &encstep(1,"ebp",$s1,$s2,$s3,$s0);
 451                     &encstep(2,"ebp",$s2,$s3,$s0,$s1);
 452                     &encstep(3,"ebp",$s3,$s0,$s1,$s2);
 453                 }
 454                 &xor    ($s0,&DWP(16*$i+0,$key));
 455                 &xor    ($s1,&DWP(16*$i+4,$key));
 456                 &xor    ($s2,&DWP(16*$i+8,$key));
 457                 &xor    ($s3,&DWP(16*$i+12,$key));
 458             }
 459         }
 460
 461         if ($vertical_spin) {
 462             # "reincarnate" some registers for "horizontal" spin...
 463             &mov        ($s1="ebx",$key="edi");
 464             &mov        ($s2="ecx",$acc="esi");
 465         }
 466         &enclast(0,"ebp",$s0,$s1,$s2,$s3);
 467         &enclast(1,"ebp",$s1,$s2,$s3,$s0);
 468         &enclast(2,"ebp",$s2,$s3,$s0,$s1);
 469         &enclast(3,"ebp",$s3,$s0,$s1,$s2);
 470
 471         &add    ($key,$small_footprint?16:160);
 472         &xor    ($s0,&DWP(0,$key));
 473         &xor    ($s1,&DWP(4,$key));
 474         &xor    ($s2,&DWP(8,$key));
 475         &xor    ($s3,&DWP(12,$key));
 476
 477         &ret    ();
 478
 479 &set_label("AES_Te",64);        # Yes! I keep it in the code segment!
 480         &_data_word(0xa56363c6, 0x847c7cf8, 0x997777ee, 0x8d7b7bf6);
 481         &_data_word(0x0df2f2ff, 0xbd6b6bd6, 0xb16f6fde, 0x54c5c591);
 482         &_data_word(0x50303060, 0x03010102, 0xa96767ce, 0x7d2b2b56);
 483         &_data_word(0x19fefee7, 0x62d7d7b5, 0xe6abab4d, 0x9a7676ec);
 484         &_data_word(0x45caca8f, 0x9d82821f, 0x40c9c989, 0x877d7dfa);
 485         &_data_word(0x15fafaef, 0xeb5959b2, 0xc947478e, 0x0bf0f0fb);
 486         &_data_word(0xecadad41, 0x67d4d4b3, 0xfda2a25f, 0xeaafaf45);
 487         &_data_word(0xbf9c9c23, 0xf7a4a453, 0x967272e4, 0x5bc0c09b);
 488         &_data_word(0xc2b7b775, 0x1cfdfde1, 0xae93933d, 0x6a26264c);
 489         &_data_word(0x5a36366c, 0x413f3f7e, 0x02f7f7f5, 0x4fcccc83);
 490         &_data_word(0x5c343468, 0xf4a5a551, 0x34e5e5d1, 0x08f1f1f9);
 491         &_data_word(0x937171e2, 0x73d8d8ab, 0x53313162, 0x3f15152a);
 492         &_data_word(0x0c040408, 0x52c7c795, 0x65232346, 0x5ec3c39d);
 493         &_data_word(0x28181830, 0xa1969637, 0x0f05050a, 0xb59a9a2f);
 494         &_data_word(0x0907070e, 0x36121224, 0x9b80801b, 0x3de2e2df);
 495         &_data_word(0x26ebebcd, 0x6927274e, 0xcdb2b27f, 0x9f7575ea);
 496         &_data_word(0x1b090912, 0x9e83831d, 0x742c2c58, 0x2e1a1a34);
 497         &_data_word(0x2d1b1b36, 0xb26e6edc, 0xee5a5ab4, 0xfba0a05b);
 498         &_data_word(0xf65252a4, 0x4d3b3b76, 0x61d6d6b7, 0xceb3b37d);
 499         &_data_word(0x7b292952, 0x3ee3e3dd, 0x712f2f5e, 0x97848413);
 500         &_data_word(0xf55353a6, 0x68d1d1b9, 0x00000000, 0x2cededc1);
 501         &_data_word(0x60202040, 0x1ffcfce3, 0xc8b1b179, 0xed5b5bb6);
 502         &_data_word(0xbe6a6ad4, 0x46cbcb8d, 0xd9bebe67, 0x4b393972);
 503         &_data_word(0xde4a4a94, 0xd44c4c98, 0xe85858b0, 0x4acfcf85);
 504         &_data_word(0x6bd0d0bb, 0x2aefefc5, 0xe5aaaa4f, 0x16fbfbed);
 505         &_data_word(0xc5434386, 0xd74d4d9a, 0x55333366, 0x94858511);
 506         &_data_word(0xcf45458a, 0x10f9f9e9, 0x06020204, 0x817f7ffe);
 507         &_data_word(0xf05050a0, 0x443c3c78, 0xba9f9f25, 0xe3a8a84b);
 508         &_data_word(0xf35151a2, 0xfea3a35d, 0xc0404080, 0x8a8f8f05);
 509         &_data_word(0xad92923f, 0xbc9d9d21, 0x48383870, 0x04f5f5f1);
 510         &_data_word(0xdfbcbc63, 0xc1b6b677, 0x75dadaaf, 0x63212142);
 511         &_data_word(0x30101020, 0x1affffe5, 0x0ef3f3fd, 0x6dd2d2bf);
 512         &_data_word(0x4ccdcd81, 0x140c0c18, 0x35131326, 0x2fececc3);
 513         &_data_word(0xe15f5fbe, 0xa2979735, 0xcc444488, 0x3917172e);
 514         &_data_word(0x57c4c493, 0xf2a7a755, 0x827e7efc, 0x473d3d7a);
 515         &_data_word(0xac6464c8, 0xe75d5dba, 0x2b191932, 0x957373e6);
 516         &_data_word(0xa06060c0, 0x98818119, 0xd14f4f9e, 0x7fdcdca3);
 517         &_data_word(0x66222244, 0x7e2a2a54, 0xab90903b, 0x8388880b);
 518         &_data_word(0xca46468c, 0x29eeeec7, 0xd3b8b86b, 0x3c141428);
 519         &_data_word(0x79dedea7, 0xe25e5ebc, 0x1d0b0b16, 0x76dbdbad);
 520         &_data_word(0x3be0e0db, 0x56323264, 0x4e3a3a74, 0x1e0a0a14);
 521         &_data_word(0xdb494992, 0x0a06060c, 0x6c242448, 0xe45c5cb8);
 522         &_data_word(0x5dc2c29f, 0x6ed3d3bd, 0xefacac43, 0xa66262c4);
 523         &_data_word(0xa8919139, 0xa4959531, 0x37e4e4d3, 0x8b7979f2);
 524         &_data_word(0x32e7e7d5, 0x43c8c88b, 0x5937376e, 0xb76d6dda);
 525         &_data_word(0x8c8d8d01, 0x64d5d5b1, 0xd24e4e9c, 0xe0a9a949);
 526         &_data_word(0xb46c6cd8, 0xfa5656ac, 0x07f4f4f3, 0x25eaeacf);
 527         &_data_word(0xaf6565ca, 0x8e7a7af4, 0xe9aeae47, 0x18080810);
 528         &_data_word(0xd5baba6f, 0x887878f0, 0x6f25254a, 0x722e2e5c);
 529         &_data_word(0x241c1c38, 0xf1a6a657, 0xc7b4b473, 0x51c6c697);
 530         &_data_word(0x23e8e8cb, 0x7cdddda1, 0x9c7474e8, 0x211f1f3e);
 531         &_data_word(0xdd4b4b96, 0xdcbdbd61, 0x868b8b0d, 0x858a8a0f);
 532         &_data_word(0x907070e0, 0x423e3e7c, 0xc4b5b571, 0xaa6666cc);
 533         &_data_word(0xd8484890, 0x05030306, 0x01f6f6f7, 0x120e0e1c);
 534         &_data_word(0xa36161c2, 0x5f35356a, 0xf95757ae, 0xd0b9b969);
 535         &_data_word(0x91868617, 0x58c1c199, 0x271d1d3a, 0xb99e9e27);
 536         &_data_word(0x38e1e1d9, 0x13f8f8eb, 0xb398982b, 0x33111122);
 537         &_data_word(0xbb6969d2, 0x70d9d9a9, 0x898e8e07, 0xa7949433);
 538         &_data_word(0xb69b9b2d, 0x221e1e3c, 0x92878715, 0x20e9e9c9);
 539         &_data_word(0x49cece87, 0xff5555aa, 0x78282850, 0x7adfdfa5);
 540         &_data_word(0x8f8c8c03, 0xf8a1a159, 0x80898909, 0x170d0d1a);
 541         &_data_word(0xdabfbf65, 0x31e6e6d7, 0xc6424284, 0xb86868d0);
 542         &_data_word(0xc3414182, 0xb0999929, 0x772d2d5a, 0x110f0f1e);
 543         &_data_word(0xcbb0b07b, 0xfc5454a8, 0xd6bbbb6d, 0x3a16162c);
 544 #Te4
 545         &data_byte(0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5);
 546         &data_byte(0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76);
 547         &data_byte(0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0);
 548         &data_byte(0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0);
 549         &data_byte(0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc);
 550         &data_byte(0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15);
 551         &data_byte(0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a);
 552         &data_byte(0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75);
 553         &data_byte(0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0);
 554         &data_byte(0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84);
 555         &data_byte(0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b);
 556         &data_byte(0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf);
 557         &data_byte(0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85);
 558         &data_byte(0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8);
 559         &data_byte(0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5);
 560         &data_byte(0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2);
 561         &data_byte(0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17);
 562         &data_byte(0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73);
 563         &data_byte(0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88);
 564         &data_byte(0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb);
 565         &data_byte(0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c);
 566         &data_byte(0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79);
 567         &data_byte(0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9);
 568         &data_byte(0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08);
 569         &data_byte(0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6);
 570         &data_byte(0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a);
 571         &data_byte(0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e);
 572         &data_byte(0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e);
 573         &data_byte(0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94);
 574         &data_byte(0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf);
 575         &data_byte(0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68);
 576         &data_byte(0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16);
 577 #rcon:
 578         &data_word(0x00000001, 0x00000002, 0x00000004, 0x00000008);
 579         &data_word(0x00000010, 0x00000020, 0x00000040, 0x00000080);
 580         &data_word(0x0000001b, 0x00000036, 0, 0, 0, 0, 0, 0);
 581 &function_end_B("_x86_AES_encrypt");
 582
 583 # void AES_encrypt (const void *inp,void *out,const AES_KEY *key);
 584 &public_label("AES_Te");
 585 &function_begin("AES_encrypt");
 586         &mov    ($acc,&wparam(0));              # load inp
 587         &mov    ($key,&wparam(2));              # load key
 588
 589         &mov    ($s0,"esp");
 590         &sub    ("esp",36);
 591         &and    ("esp",-64);
 592         &add    ("esp",4);
 593         &mov    (&DWP(28,"esp"),$s0);
 594
 595         &call   (&label("pic_point"));          # make it PIC!
 596         &set_label("pic_point");
 597         &blindpop("ebp");
 598         &lea    ("ebp",&DWP(&label("AES_Te")."-".&label("pic_point"),"ebp"));
 599
 600         &mov    ($s0,&DWP(0,$acc));             # load input data
 601         &mov    ($s1,&DWP(4,$acc));
 602         &mov    ($s2,&DWP(8,$acc));
 603         &mov    ($s3,&DWP(12,$acc));
 604
 605         &mov    (&DWP(24,"esp"),"ebp");
 606
 607         &call   ("_x86_AES_encrypt");
 608
 609         &mov    ("esp",&DWP(28,"esp"));
 610
 611         &mov    ($acc,&wparam(1));              # load out
 612         &mov    (&DWP(0,$acc),$s0);             # write output data
 613         &mov    (&DWP(4,$acc),$s1);
 614         &mov    (&DWP(8,$acc),$s2);
 615         &mov    (&DWP(12,$acc),$s3);
 616 &function_end("AES_encrypt");
 617
 618 #------------------------------------------------------------------#
 619
 620 sub decstep()
 621 { my ($i,$td,@s) = @_;
 622   my $tmp = $key;
 623   my $out = $i==3?$s[0]:$acc;
 624
 625         # no instructions are reordered, as performance appears
 626         # optimal... or rather that all attempts to reorder didn't
 627         # result in better performance [which by the way is not a
 628         # bit lower than ecryption].
 629         if($i==3)   {   &mov    ($key,&DWP(20,"esp"));          }
 630         else        {   &mov    ($out,$s[0]);                   }
 631                         &and    ($out,0xFF);
 632                         &mov    ($out,&DWP(0,$td,$out,8));
 633
 634         if ($i==3)  {   $tmp=$s[1];                             }
 635                         &movz   ($tmp,&HB($s[1]));
 636                         &xor    ($out,&DWP(3,$td,$tmp,8));
 637
 638         if ($i==3)  {   $tmp=$s[2]; &mov ($s[1],$acc);          }
 639         else        {   &mov    ($tmp,$s[2]);                   }
 640                         &shr    ($tmp,16);
 641                         &and    ($tmp,0xFF);
 642                         &xor    ($out,&DWP(2,$td,$tmp,8));
 643
 644         if ($i==3)  {   $tmp=$s[3]; &mov ($s[2],&DWP(8,"esp")); }
 645         else        {   &mov    ($tmp,$s[3]);                   }
 646                         &shr    ($tmp,24);
 647                         &xor    ($out,&DWP(1,$td,$tmp,8));
 648         if ($i<2)   {   &mov    (&DWP(4+4*$i,"esp"),$out);      }
 649         if ($i==3)  {   &mov    ($s[3],&DWP(4,"esp"));          }
 650                         &comment();
 651 }
 652
 653 sub declast()
 654 { my $Fn = mov;
 655   while ($#_>5) { pop(@_); $Fn=sub{}; }
 656   my ($i,$td,@s)=@_;
 657   my $tmp = $key;
 658   my $out = $i==3?$s[0]:$acc;
 659
 660         if ($i==0)      # prefetch 256-byte Td4
 661         {   &lea        ($td,&DWP(2048+128,$td));
 662             &mov        ($tmp,&DWP(0-128,$td));
 663             &mov        ($acc,&DWP(32-128,$td));
 664             &mov        ($tmp,&DWP(64-128,$td));
 665             &mov        ($acc,&DWP(96-128,$td));
 666             &mov        ($tmp,&DWP(128-128,$td));
 667             &mov        ($acc,&DWP(160-128,$td));
 668             &mov        ($tmp,&DWP(192-128,$td));
 669             &mov        ($acc,&DWP(224-128,$td));
 670             &lea        ($td,&DWP(-128,$td));
 671         }
 672
 673         # $Fn is used in first compact round and its purpose is to
 674         # void restoration of some values from stack, so that after
 675         # 4xenclast with extra argument $key, $s0 and $s1 values
 676         # are left there...
 677         if($i==3)   {   &$Fn    ($key,&DWP(20,"esp"));          }
 678         else        {   &mov    ($out,$s[0]);                   }
 679                         &and    ($out,0xFF);
 680                         &movz   ($out,&DWP(0,$td,$out,1));
 681
 682         if ($i==3)  {   $tmp=$s[1];                             }
 683                         &movz   ($tmp,&HB($s[1]));
 684                         &movz   ($tmp,&DWP(0,$td,$tmp,1));
 685                         &shl    ($tmp,8);
 686                         &xor    ($out,$tmp);
 687
 688         if ($i==3)  {   $tmp=$s[2]; &mov ($s[1],$acc);          }
 689         else        {   mov     ($tmp,$s[2]);                   }
 690                         &shr    ($tmp,16);
 691                         &and    ($tmp,0xFF);
 692                         &movz   ($tmp,&DWP(0,$td,$tmp,1));
 693                         &shl    ($tmp,16);
 694                         &xor    ($out,$tmp);
 695
 696         if ($i==3)  {   $tmp=$s[3]; &$Fn ($s[2],&DWP(8,"esp")); }
 697         else        {   &mov    ($tmp,$s[3]);                   }
 698                         &shr    ($tmp,24);
 699                         &movz   ($tmp,&DWP(0,$td,$tmp,1));
 700                         &shl    ($tmp,24);
 701                         &xor    ($out,$tmp);
 702         if ($i<2)   {   &mov    (&DWP(4+4*$i,"esp"),$out);      }
 703         if ($i==3)  {   &$Fn    ($s[3],&DWP(4,"esp"));
 704                         &lea    ($td,&DWP(-2048,$td));          }
 705 }
 706
 707 # must be called with 2,3,0,1 as argument sequence!!!
 708 sub dectransform()
 709 { my @s = ($s0,$s1,$s2,$s3);
 710   my $i = shift;
 711   my $tmp = $key;
 712   my $tp2 = @s[($i+2)%4]; $tp2 = @s[2] if ($i==1);
 713   my $tp4 = @s[($i+3)%4]; $tp4 = @s[3] if ($i==1);
 714   my $tp8 = "ebp";
 715
 716         &mov    ($acc,$s[$i]);
 717         &and    ($acc,0x80808080);
 718         &mov    ($tmp,$acc);
 719         &mov    ($tp2,$s[$i]);
 720         &shr    ($tmp,7);
 721         &and    ($tp2,0x7f7f7f7f);
 722         &sub    ($acc,$tmp);
 723         &lea    ($tp2,&DWP(0,$tp2,$tp2));
 724         &and    ($acc,0x1b1b1b1b);
 725         &xor    ($acc,$tp2);
 726         &mov    ($tp2,$acc);
 727
 728         &and    ($acc,0x80808080);
 729         &mov    ($tmp,$acc);
 730         &mov    ($tp4,$tp2);
 731         &shr    ($tmp,7);
 732         &and    ($tp4,0x7f7f7f7f);
 733         &sub    ($acc,$tmp);
 734         &lea    ($tp4,&DWP(0,$tp4,$tp4));
 735         &and    ($acc,0x1b1b1b1b);
 736         &xor    ($acc,$tp4);
 737         &mov    ($tp4,$acc);
 738
 739         &and    ($acc,0x80808080);
 740         &mov    ($tmp,$acc);
 741         &mov    ($tp8,$tp4);
 742         &shr    ($tmp,7);
 743         &and    ($tp8,0x7f7f7f7f);
 744         &sub    ($acc,$tmp);
 745         &lea    ($tp8,&DWP(0,$tp8,$tp8));
 746         &and    ($acc,0x1b1b1b1b);
 747         &xor    ($tp8,$acc);
 748
 749         &exch   ($s[$i],$tp8);
 750         &xor    ($tp8,$s[$i]);  # tp8 ^ tp1
 751         &xor    ($s[$i],$tp4);
 752         &xor    ($s[$i],$tp2);  # tp8 ^ tp4 ^ tp2
 753         &xor    ($tp4,$tp8);
 754         &xor    ($tp2,$tp8);
 755         &rotl   ($tp4,16);
 756         &xor    ($s[$i],$tp4);
 757         &rotl   ($tp2,24);
 758         &xor    ($s[$i],$tp2);
 759         &rotl   ($tp8,8);
 760         &xor    ($s[$i],$tp8);
 761
 762         &mov    ($s[0],&DWP(4,"esp"))           if($i==2); #prefetch $s0
 763         &mov    ($s[1],&DWP(8,"esp"))           if($i==3); #prefetch $s1
 764         &mov    (&DWP(4+4*$i,"esp"),$s[$i])     if($i>=2);
 765 }
 766
 767 &public_label("AES_Td");
 768 &function_begin_B("_x86_AES_decrypt");
 769         # note that caller is expected to allocate stack frame for me!
 770         &mov    (&DWP(20,"esp"),$key);          # save key
 771
 772         &xor    ($s0,&DWP(0,$key));             # xor with key
 773         &xor    ($s1,&DWP(4,$key));
 774         &xor    ($s2,&DWP(8,$key));
 775         &xor    ($s3,&DWP(12,$key));
 776
 777         # not really last round, just "compact" one...
 778         &declast(0,"ebp",$s0,$s3,$s2,$s1,1);
 779         &declast(1,"ebp",$s1,$s0,$s3,$s2,1);
 780         &declast(2,"ebp",$s2,$s1,$s0,$s3,1);
 781         &declast(3,"ebp",$s3,$s2,$s1,$s0,1);
 782         &dectransform(2);
 783         &dectransform(3);
 784         &dectransform(0);
 785         &dectransform(1);
 786         &mov    ($key,&DWP(20,"esp"));
 787         &mov    ($s2,&DWP(12,"esp"));
 788         &mov    ($s3,&DWP(16,"esp"));
 789         &mov    ("ebp",&DWP(28,"esp"));
 790         &xor    ($s0,&DWP(16,$key));
 791         &xor    ($s1,&DWP(20,$key));
 792         &xor    ($s2,&DWP(24,$key));
 793         &xor    ($s3,&DWP(28,$key));
 794
 795         &mov    ($acc,&DWP(240,$key));          # load key->rounds
 796
 797         if ($small_footprint) {
 798             &lea        ($acc,&DWP(-2,$acc,$acc));
 799             &lea        ($acc,&DWP(0,$key,$acc,8));
 800             &add        ($key,16);
 801             &mov        (&DWP(20,"esp"),$key);
 802             &mov        (&DWP(24,"esp"),$acc);  # end of key schedule
 803             &align      (4);
 804             &set_label("loop");
 805                 &decstep(0,"ebp",$s0,$s3,$s2,$s1);
 806                 &decstep(1,"ebp",$s1,$s0,$s3,$s2);
 807                 &decstep(2,"ebp",$s2,$s1,$s0,$s3);
 808                 &decstep(3,"ebp",$s3,$s2,$s1,$s0);
 809                 &add    ($key,16);              # advance rd_key
 810                 &xor    ($s0,&DWP(0,$key));
 811                 &xor    ($s1,&DWP(4,$key));
 812                 &xor    ($s2,&DWP(8,$key));
 813                 &xor    ($s3,&DWP(12,$key));
 814             &cmp        ($key,&DWP(24,"esp"));
 815             &mov        (&DWP(20,"esp"),$key);
 816             &jb         (&label("loop"));
 817         }
 818         else {
 819             &cmp        ($acc,10);
 820             &jle        (&label("10rounds"));
 821             &cmp        ($acc,12);
 822             &jle        (&label("12rounds"));
 823
 824         &set_label("14rounds");
 825             for ($i=2;$i<4;$i++) {
 826                 &decstep(0,"ebp",$s0,$s3,$s2,$s1);
 827                 &decstep(1,"ebp",$s1,$s0,$s3,$s2);
 828                 &decstep(2,"ebp",$s2,$s1,$s0,$s3);
 829                 &decstep(3,"ebp",$s3,$s2,$s1,$s0);
 830                 &xor    ($s0,&DWP(16*$i+0,$key));
 831                 &xor    ($s1,&DWP(16*$i+4,$key));
 832                 &xor    ($s2,&DWP(16*$i+8,$key));
 833                 &xor    ($s3,&DWP(16*$i+12,$key));
 834             }
 835             &add        ($key,32);
 836             &mov        (&DWP(20,"esp"),$key);  # advance rd_key
 837         &set_label("12rounds");
 838             for ($i=2;$i<4;$i++) {
 839                 &decstep(0,"ebp",$s0,$s3,$s2,$s1);
 840                 &decstep(1,"ebp",$s1,$s0,$s3,$s2);
 841                 &decstep(2,"ebp",$s2,$s1,$s0,$s3);
 842                 &decstep(3,"ebp",$s3,$s2,$s1,$s0);
 843                 &xor    ($s0,&DWP(16*$i+0,$key));
 844                 &xor    ($s1,&DWP(16*$i+4,$key));
 845                 &xor    ($s2,&DWP(16*$i+8,$key));
 846                 &xor    ($s3,&DWP(16*$i+12,$key));
 847             }
 848             &add        ($key,32);
 849             &mov        (&DWP(20,"esp"),$key);  # advance rd_key
 850         &set_label("10rounds");
 851             for ($i=2;$i<10;$i++) {
 852                 &decstep(0,"ebp",$s0,$s3,$s2,$s1);
 853                 &decstep(1,"ebp",$s1,$s0,$s3,$s2);
 854                 &decstep(2,"ebp",$s2,$s1,$s0,$s3);
 855                 &decstep(3,"ebp",$s3,$s2,$s1,$s0);
 856                 &xor    ($s0,&DWP(16*$i+0,$key));
 857                 &xor    ($s1,&DWP(16*$i+4,$key));
 858                 &xor    ($s2,&DWP(16*$i+8,$key));
 859                 &xor    ($s3,&DWP(16*$i+12,$key));
 860             }
 861         }
 862
 863         &declast(0,"ebp",$s0,$s3,$s2,$s1);
 864         &declast(1,"ebp",$s1,$s0,$s3,$s2);
 865         &declast(2,"ebp",$s2,$s1,$s0,$s3);
 866         &declast(3,"ebp",$s3,$s2,$s1,$s0);
 867
 868         &add    ($key,$small_footprint?16:160);
 869         &xor    ($s0,&DWP(0,$key));
 870         &xor    ($s1,&DWP(4,$key));
 871         &xor    ($s2,&DWP(8,$key));
 872         &xor    ($s3,&DWP(12,$key));
 873
 874         &ret    ();
 875
 876 &set_label("AES_Td",64);        # Yes! I keep it in the code segment!
 877         &_data_word(0x50a7f451, 0x5365417e, 0xc3a4171a, 0x965e273a);
 878         &_data_word(0xcb6bab3b, 0xf1459d1f, 0xab58faac, 0x9303e34b);
 879         &_data_word(0x55fa3020, 0xf66d76ad, 0x9176cc88, 0x254c02f5);
 880         &_data_word(0xfcd7e54f, 0xd7cb2ac5, 0x80443526, 0x8fa362b5);
 881         &_data_word(0x495ab1de, 0x671bba25, 0x980eea45, 0xe1c0fe5d);
 882         &_data_word(0x02752fc3, 0x12f04c81, 0xa397468d, 0xc6f9d36b);
 883         &_data_word(0xe75f8f03, 0x959c9215, 0xeb7a6dbf, 0xda595295);
 884         &_data_word(0x2d83bed4, 0xd3217458, 0x2969e049, 0x44c8c98e);
 885         &_data_word(0x6a89c275, 0x78798ef4, 0x6b3e5899, 0xdd71b927);
 886         &_data_word(0xb64fe1be, 0x17ad88f0, 0x66ac20c9, 0xb43ace7d);
 887         &_data_word(0x184adf63, 0x82311ae5, 0x60335197, 0x457f5362);
 888         &_data_word(0xe07764b1, 0x84ae6bbb, 0x1ca081fe, 0x942b08f9);
 889         &_data_word(0x58684870, 0x19fd458f, 0x876cde94, 0xb7f87b52);
 890         &_data_word(0x23d373ab, 0xe2024b72, 0x578f1fe3, 0x2aab5566);
 891         &_data_word(0x0728ebb2, 0x03c2b52f, 0x9a7bc586, 0xa50837d3);
 892         &_data_word(0xf2872830, 0xb2a5bf23, 0xba6a0302, 0x5c8216ed);
 893         &_data_word(0x2b1ccf8a, 0x92b479a7, 0xf0f207f3, 0xa1e2694e);
 894         &_data_word(0xcdf4da65, 0xd5be0506, 0x1f6234d1, 0x8afea6c4);
 895         &_data_word(0x9d532e34, 0xa055f3a2, 0x32e18a05, 0x75ebf6a4);
 896         &_data_word(0x39ec830b, 0xaaef6040, 0x069f715e, 0x51106ebd);
 897         &_data_word(0xf98a213e, 0x3d06dd96, 0xae053edd, 0x46bde64d);
 898         &_data_word(0xb58d5491, 0x055dc471, 0x6fd40604, 0xff155060);
 899         &_data_word(0x24fb9819, 0x97e9bdd6, 0xcc434089, 0x779ed967);
 900         &_data_word(0xbd42e8b0, 0x888b8907, 0x385b19e7, 0xdbeec879);
 901         &_data_word(0x470a7ca1, 0xe90f427c, 0xc91e84f8, 0x00000000);
 902         &_data_word(0x83868009, 0x48ed2b32, 0xac70111e, 0x4e725a6c);
 903         &_data_word(0xfbff0efd, 0x5638850f, 0x1ed5ae3d, 0x27392d36);
 904         &_data_word(0x64d90f0a, 0x21a65c68, 0xd1545b9b, 0x3a2e3624);
 905         &_data_word(0xb1670a0c, 0x0fe75793, 0xd296eeb4, 0x9e919b1b);
 906         &_data_word(0x4fc5c080, 0xa220dc61, 0x694b775a, 0x161a121c);
 907         &_data_word(0x0aba93e2, 0xe52aa0c0, 0x43e0223c, 0x1d171b12);
 908         &_data_word(0x0b0d090e, 0xadc78bf2, 0xb9a8b62d, 0xc8a91e14);
 909         &_data_word(0x8519f157, 0x4c0775af, 0xbbdd99ee, 0xfd607fa3);
 910         &_data_word(0x9f2601f7, 0xbcf5725c, 0xc53b6644, 0x347efb5b);
 911         &_data_word(0x7629438b, 0xdcc623cb, 0x68fcedb6, 0x63f1e4b8);
 912         &_data_word(0xcadc31d7, 0x10856342, 0x40229713, 0x2011c684);
 913         &_data_word(0x7d244a85, 0xf83dbbd2, 0x1132f9ae, 0x6da129c7);
 914         &_data_word(0x4b2f9e1d, 0xf330b2dc, 0xec52860d, 0xd0e3c177);
 915         &_data_word(0x6c16b32b, 0x99b970a9, 0xfa489411, 0x2264e947);
 916         &_data_word(0xc48cfca8, 0x1a3ff0a0, 0xd82c7d56, 0xef903322);
 917         &_data_word(0xc74e4987, 0xc1d138d9, 0xfea2ca8c, 0x360bd498);
 918         &_data_word(0xcf81f5a6, 0x28de7aa5, 0x268eb7da, 0xa4bfad3f);
 919         &_data_word(0xe49d3a2c, 0x0d927850, 0x9bcc5f6a, 0x62467e54);
 920         &_data_word(0xc2138df6, 0xe8b8d890, 0x5ef7392e, 0xf5afc382);
 921         &_data_word(0xbe805d9f, 0x7c93d069, 0xa92dd56f, 0xb31225cf);
 922         &_data_word(0x3b99acc8, 0xa77d1810, 0x6e639ce8, 0x7bbb3bdb);
 923         &_data_word(0x097826cd, 0xf418596e, 0x01b79aec, 0xa89a4f83);
 924         &_data_word(0x656e95e6, 0x7ee6ffaa, 0x08cfbc21, 0xe6e815ef);
 925         &_data_word(0xd99be7ba, 0xce366f4a, 0xd4099fea, 0xd67cb029);
 926         &_data_word(0xafb2a431, 0x31233f2a, 0x3094a5c6, 0xc066a235);
 927         &_data_word(0x37bc4e74, 0xa6ca82fc, 0xb0d090e0, 0x15d8a733);
 928         &_data_word(0x4a9804f1, 0xf7daec41, 0x0e50cd7f, 0x2ff69117);
 929         &_data_word(0x8dd64d76, 0x4db0ef43, 0x544daacc, 0xdf0496e4);
 930         &_data_word(0xe3b5d19e, 0x1b886a4c, 0xb81f2cc1, 0x7f516546);
 931         &_data_word(0x04ea5e9d, 0x5d358c01, 0x737487fa, 0x2e410bfb);
 932         &_data_word(0x5a1d67b3, 0x52d2db92, 0x335610e9, 0x1347d66d);
 933         &_data_word(0x8c61d79a, 0x7a0ca137, 0x8e14f859, 0x893c13eb);
 934         &_data_word(0xee27a9ce, 0x35c961b7, 0xede51ce1, 0x3cb1477a);
 935         &_data_word(0x59dfd29c, 0x3f73f255, 0x79ce1418, 0xbf37c773);
 936         &_data_word(0xeacdf753, 0x5baafd5f, 0x146f3ddf, 0x86db4478);
 937         &_data_word(0x81f3afca, 0x3ec468b9, 0x2c342438, 0x5f40a3c2);
 938         &_data_word(0x72c31d16, 0x0c25e2bc, 0x8b493c28, 0x41950dff);
 939         &_data_word(0x7101a839, 0xdeb30c08, 0x9ce4b4d8, 0x90c15664);
 940         &_data_word(0x6184cb7b, 0x70b632d5, 0x745c6c48, 0x4257b8d0);
 941 #Td4:
 942         &data_byte(0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38);
 943         &data_byte(0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb);
 944         &data_byte(0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87);
 945         &data_byte(0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb);
 946         &data_byte(0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d);
 947         &data_byte(0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e);
 948         &data_byte(0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2);
 949         &data_byte(0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25);
 950         &data_byte(0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16);
 951         &data_byte(0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92);
 952         &data_byte(0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda);
 953         &data_byte(0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84);
 954         &data_byte(0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a);
 955         &data_byte(0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06);
 956         &data_byte(0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02);
 957         &data_byte(0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b);
 958         &data_byte(0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea);
 959         &data_byte(0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73);
 960         &data_byte(0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85);
 961         &data_byte(0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e);
 962         &data_byte(0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89);
 963         &data_byte(0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b);
 964         &data_byte(0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20);
 965         &data_byte(0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4);
 966         &data_byte(0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31);
 967         &data_byte(0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f);
 968         &data_byte(0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d);
 969         &data_byte(0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef);
 970         &data_byte(0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0);
 971         &data_byte(0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61);
 972         &data_byte(0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26);
 973         &data_byte(0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d);
 974 &function_end_B("_x86_AES_decrypt");
 975
 976 # void AES_decrypt (const void *inp,void *out,const AES_KEY *key);
 977 &public_label("AES_Td");
 978 &function_begin("AES_decrypt");
 979         &mov    ($acc,&wparam(0));              # load inp
 980         &mov    ($key,&wparam(2));              # load key
 981
 982         &mov    ($s0,"esp");
 983         &sub    ("esp",36);
 984         &and    ("esp",-64);
 985         &add    ("esp",4);
 986         &mov    (&DWP(28,"esp"),$s0);
 987
 988         &call   (&label("pic_point"));          # make it PIC!
 989         &set_label("pic_point");
 990         &blindpop("ebp");
 991         &lea    ("ebp",&DWP(&label("AES_Td")."-".&label("pic_point"),"ebp"));
 992
 993         &mov    ($s0,&DWP(0,$acc));             # load input data
 994         &mov    ($s1,&DWP(4,$acc));
 995         &mov    ($s2,&DWP(8,$acc));
 996         &mov    ($s3,&DWP(12,$acc));
 997
 998         &mov    (&DWP(24,"esp"),"ebp");
 999
1000         &call   ("_x86_AES_decrypt");
1001
1002         &mov    ("esp",&DWP(28,"esp"));
1003
1004         &mov    ($acc,&wparam(1));              # load out
1005         &mov    (&DWP(0,$acc),$s0);             # write output data
1006         &mov    (&DWP(4,$acc),$s1);
1007         &mov    (&DWP(8,$acc),$s2);
1008         &mov    (&DWP(12,$acc),$s3);
1009 &function_end("AES_decrypt");
1010
1011 # void AES_cbc_encrypt (const void char *inp, unsigned char *out,
1012 #                       size_t length, const AES_KEY *key,
1013 #                       unsigned char *ivp,const int enc);
1014 {
1015 # stack frame layout
1016 # -4(%esp)      0(%esp)         return address
1017 # 0(%esp)       4(%esp)         s0 backup
1018 # 4(%esp)       8(%esp)         s1 backup
1019 # 8(%esp)       12(%esp)        s2 backup
1020 # 12(%esp)      16(%esp)        s3 backup
1021 # 16(%esp)      20(%esp)        key backup
1022 # 20(%esp)      24(%esp)        end of key schedule
1023 # 24(%esp)      28(%esp)        ebp backup
1024 my $_esp=&DWP(28,"esp");        #saved %esp
1025 my $_inp=&DWP(32,"esp");        #copy of wparam(0)
1026 my $_out=&DWP(36,"esp");        #copy of wparam(1)
1027 my $_len=&DWP(40,"esp");        #copy of wparam(2)
1028 my $_key=&DWP(44,"esp");        #copy of wparam(3)
1029 my $_ivp=&DWP(48,"esp");        #copy of wparam(4)
1030 my $_tmp=&DWP(52,"esp");        #volatile variable
1031 my $ivec=&DWP(56,"esp");        #ivec[16]
1032 my $aes_key=&DWP(72,"esp");     #copy of aes_key
1033 my $mark=&DWP(72+240,"esp");    #copy of aes_key->rounds
1034
1035 &public_label("AES_Te");
1036 &public_label("AES_Td");
1037 &function_begin("AES_cbc_encrypt");
1038         &mov    ($s2 eq "ecx"? $s2 : "",&wparam(2));    # load len
1039         &cmp    ($s2,0);
1040         &je     (&label("enc_out"));
1041
1042         &call   (&label("pic_point"));          # make it PIC!
1043         &set_label("pic_point");
1044         &blindpop("ebp");
1045
1046         &pushf  ();
1047         &cld    ();
1048
1049         &cmp    (&wparam(5),0);
1050         &je     (&label("DECRYPT"));
1051
1052         &lea    ("ebp",&DWP(&label("AES_Te")."-".&label("pic_point"),"ebp"));
1053
1054         # allocate aligned stack frame...
1055         &lea    ($key,&DWP(-76-244,"esp"));
1056         &and    ($key,-64);
1057
1058         # ... and make sure it doesn't alias with AES_Te modulo 4096
1059         &mov    ($s0,"ebp");
1060         &lea    ($s1,&DWP(2048+256,"ebp"));
1061         &mov    ($s3,$key);
1062         &and    ($s0,0xfff);            # s = %ebp&0xfff
1063         &and    ($s1,0xfff);            # e = (%ebp+2048+256)&0xfff
1064         &and    ($s3,0xfff);            # p = %esp&0xfff
1065
1066         &cmp    ($s3,$s1);              # if (p>=e) %esp =- (p-e);
1067         &jb     (&label("te_break_out"));
1068         &sub    ($s3,$s1);
1069         &sub    ($key,$s3);
1070         &jmp    (&label("te_ok"));
1071         &set_label("te_break_out");     # else %esp -= (p-s)&0xfff + framesz;
1072         &sub    ($s3,$s0);
1073         &and    ($s3,0xfff);
1074         &add    ($s3,72+256);
1075         &sub    ($key,$s3);
1076         &align  (4);
1077         &set_label("te_ok");
1078
1079         &mov    ($s0,&wparam(0));       # load inp
1080         &mov    ($s1,&wparam(1));       # load out
1081         &mov    ($s3,&wparam(3));       # load key
1082         &mov    ($acc,&wparam(4));      # load ivp
1083
1084         &exch   ("esp",$key);
1085         &add    ("esp",4);              # reserve for return address!
1086         &mov    ($_esp,$key);           # save %esp
1087
1088         &mov    ($_inp,$s0);            # save copy of inp
1089         &mov    ($_out,$s1);            # save copy of out
1090         &mov    ($_len,$s2);            # save copy of len
1091         &mov    ($_key,$s3);            # save copy of key
1092         &mov    ($_ivp,$acc);           # save copy of ivp
1093
1094         &mov    ($mark,0);              # copy of aes_key->rounds = 0;
1095         if ($compromise) {
1096                 &cmp    ($s2,$compromise);
1097                 &jb     (&label("skip_ecopy"));
1098         }
1099         # do we copy key schedule to stack?
1100         &mov    ($s1 eq "ebx" ? $s1 : "",$s3);
1101         &mov    ($s2 eq "ecx" ? $s2 : "",244/4);
1102         &sub    ($s1,"ebp");
1103         &mov    ("esi",$s3);
1104         &and    ($s1,0xfff);
1105         &lea    ("edi",$aes_key);
1106         &cmp    ($s1,2048+256);
1107         &jb     (&label("do_ecopy"));
1108         &cmp    ($s1,4096-244);
1109         &jb     (&label("skip_ecopy"));
1110         &align  (4);
1111         &set_label("do_ecopy");
1112                 &mov    ($_key,"edi");
1113                 &data_word(0xA5F3F689); # rep movsd
1114         &set_label("skip_ecopy");
1115
1116         &mov    ($acc,$s0);
1117         &mov    ($key,18);
1118         &align  (4);
1119         &set_label("prefetch_te");
1120                 &mov    ($s0,&DWP(0,"ebp"));
1121                 &mov    ($s1,&DWP(32,"ebp"));
1122                 &mov    ($s2,&DWP(64,"ebp"));
1123                 &mov    ($s3,&DWP(96,"ebp"));
1124                 &lea    ("ebp",&DWP(128,"ebp"));
1125                 &dec    ($key);
1126         &jnz    (&label("prefetch_te"));
1127         &sub    ("ebp",2048+256);
1128         &mov    (&DWP(24,"esp"),"ebp");
1129
1130         &mov    ($s2,$_len);
1131         &mov    ($key,$_ivp);
1132         &test   ($s2,0xFFFFFFF0);
1133         &jz     (&label("enc_tail"));           # short input...
1134
1135         &mov    ($s0,&DWP(0,$key));             # load iv
1136         &mov    ($s1,&DWP(4,$key));
1137
1138         &align  (4);
1139         &set_label("enc_loop");
1140                 &mov    ($s2,&DWP(8,$key));
1141                 &mov    ($s3,&DWP(12,$key));
1142
1143                 &xor    ($s0,&DWP(0,$acc));     # xor input data
1144                 &xor    ($s1,&DWP(4,$acc));
1145                 &xor    ($s2,&DWP(8,$acc));
1146                 &xor    ($s3,&DWP(12,$acc));
1147
1148                 &mov    ($key,$_key);           # load key
1149                 &call   ("_x86_AES_encrypt");
1150
1151                 &mov    ($acc,$_inp);           # load inp
1152                 &mov    ($key,$_out);           # load out
1153
1154                 &mov    (&DWP(0,$key),$s0);     # save output data
1155                 &mov    (&DWP(4,$key),$s1);
1156                 &mov    (&DWP(8,$key),$s2);
1157                 &mov    (&DWP(12,$key),$s3);
1158
1159                 &mov    ($s2,$_len);            # load len
1160
1161                 &lea    ($acc,&DWP(16,$acc));
1162                 &mov    ($_inp,$acc);           # save inp
1163
1164                 &lea    ($s3,&DWP(16,$key));
1165                 &mov    ($_out,$s3);            # save out
1166
1167                 &sub    ($s2,16);
1168                 &test   ($s2,0xFFFFFFF0);
1169                 &mov    ($_len,$s2);            # save len
1170         &jnz    (&label("enc_loop"));
1171         &test   ($s2,15);
1172         &jnz    (&label("enc_tail"));
1173         &mov    ($acc,$_ivp);           # load ivp
1174         &mov    ($s2,&DWP(8,$key));     # restore last dwords
1175         &mov    ($s3,&DWP(12,$key));
1176         &mov    (&DWP(0,$acc),$s0);     # save ivec
1177         &mov    (&DWP(4,$acc),$s1);
1178         &mov    (&DWP(8,$acc),$s2);
1179         &mov    (&DWP(12,$acc),$s3);
1180
1181         &cmp    ($mark,0);              # was the key schedule copied?
1182         &mov    ("edi",$_key);
1183         &mov    ("esp",$_esp);
1184         &je     (&label("skip_ezero"));
1185         # zero copy of key schedule
1186         &mov    ("ecx",240/4);
1187         &xor    ("eax","eax");
1188         &align  (4);
1189         &data_word(0xABF3F689); # rep stosd
1190         &set_label("skip_ezero")
1191         &popf   ();
1192     &set_label("enc_out");
1193         &function_end_A();
1194         &pushf  ();                     # kludge, never executed
1195
1196     &align      (4);
1197     &set_label("enc_tail");
1198         &push   ($key eq "edi" ? $key : "");    # push ivp
1199         &mov    ($key,$_out);                   # load out
1200         &mov    ($s1,16);
1201         &sub    ($s1,$s2);
1202         &cmp    ($key,$acc);                    # compare with inp
1203         &je     (&label("enc_in_place"));
1204         &align  (4);
1205         &data_word(0xA4F3F689); # rep movsb     # copy input
1206         &jmp    (&label("enc_skip_in_place"));
1207     &set_label("enc_in_place");
1208         &lea    ($key,&DWP(0,$key,$s2));
1209     &set_label("enc_skip_in_place");
1210         &mov    ($s2,$s1);
1211         &xor    ($s0,$s0);
1212         &align  (4);
1213         &data_word(0xAAF3F689); # rep stosb     # zero tail
1214         &pop    ($key);                         # pop ivp
1215
1216         &mov    ($acc,$_out);                   # output as input
1217         &mov    ($s0,&DWP(0,$key));
1218         &mov    ($s1,&DWP(4,$key));
1219         &mov    ($_len,16);                     # len=16
1220         &jmp    (&label("enc_loop"));           # one more spin...
1221
1222 #----------------------------- DECRYPT -----------------------------#
1223 &align  (4);
1224 &set_label("DECRYPT");
1225         &lea    ("ebp",&DWP(&label("AES_Td")."-".&label("pic_point"),"ebp"));
1226
1227         # allocate aligned stack frame...
1228         &lea    ($key,&DWP(-64-244,"esp"));
1229         &and    ($key,-64);
1230
1231         # ... and make sure it doesn't alias with AES_Td modulo 4096
1232         &mov    ($s0,"ebp");
1233         &lea    ($s1,&DWP(2048+256,"ebp"));
1234         &mov    ($s3,$key);
1235         &and    ($s0,0xfff);            # s = %ebp&0xfff
1236         &and    ($s1,0xfff);            # e = (%ebp+2048+256)&0xfff
1237         &and    ($s3,0xfff);            # p = %esp&0xfff
1238
1239         &cmp    ($s3,$s1);              # if (p>=e) %esp =- (p-e);
1240         &jb     (&label("td_break_out"));
1241         &sub    ($s3,$s1);
1242         &sub    ($key,$s3);
1243         &jmp    (&label("td_ok"));
1244         &set_label("td_break_out");     # else %esp -= (p-s)&0xfff + framesz;
1245         &sub    ($s3,$s0);
1246         &and    ($s3,0xfff);
1247         &add    ($s3,72+256);
1248         &sub    ($key,$s3);
1249         &align  (4);
1250         &set_label("td_ok");
1251
1252         &mov    ($s0,&wparam(0));       # load inp
1253         &mov    ($s1,&wparam(1));       # load out
1254         &mov    ($s3,&wparam(3));       # load key
1255         &mov    ($acc,&wparam(4));      # load ivp
1256
1257         &exch   ("esp",$key);
1258         &add    ("esp",4);              # reserve for return address!
1259         &mov    ($_esp,$key);           # save %esp
1260
1261         &mov    ($_inp,$s0);            # save copy of inp
1262         &mov    ($_out,$s1);            # save copy of out
1263         &mov    ($_len,$s2);            # save copy of len
1264         &mov    ($_key,$s3);            # save copy of key
1265         &mov    ($_ivp,$acc);           # save copy of ivp
1266
1267         &mov    ($mark,0);              # copy of aes_key->rounds = 0;
1268         if ($compromise) {
1269                 &cmp    ($s2,$compromise);
1270                 &jb     (&label("skip_dcopy"));
1271         }
1272         # do we copy key schedule to stack?
1273         &mov    ($s1 eq "ebx" ? $s1 : "",$s3);
1274         &mov    ($s2 eq "ecx" ? $s2 : "",244/4);
1275         &sub    ($s1,"ebp");
1276         &mov    ("esi",$s3);
1277         &and    ($s1,0xfff);
1278         &lea    ("edi",$aes_key);
1279         &cmp    ($s1,2048+256);
1280         &jb     (&label("do_dcopy"));
1281         &cmp    ($s1,4096-244);
1282         &jb     (&label("skip_dcopy"));
1283         &align  (4);
1284         &set_label("do_dcopy");
1285                 &mov    ($_key,"edi");
1286                 &data_word(0xA5F3F689); # rep movsd
1287         &set_label("skip_dcopy");
1288
1289         &mov    ($acc,$s0);
1290         &mov    ($key,18);
1291         &align  (4);
1292         &set_label("prefetch_td");
1293                 &mov    ($s0,&DWP(0,"ebp"));
1294                 &mov    ($s1,&DWP(32,"ebp"));
1295                 &mov    ($s2,&DWP(64,"ebp"));
1296                 &mov    ($s3,&DWP(96,"ebp"));
1297                 &lea    ("ebp",&DWP(128,"ebp"));
1298                 &dec    ($key);
1299         &jnz    (&label("prefetch_td"));
1300         &sub    ("ebp",2048+256);
1301         &mov    (&DWP(24,"esp"),"ebp");
1302
1303         &cmp    ($acc,$_out);
1304         &je     (&label("dec_in_place"));       # in-place processing...
1305
1306         &mov    ($key,$_ivp);           # load ivp
1307         &mov    ($_tmp,$key);
1308
1309         &align  (4);
1310         &set_label("dec_loop");
1311                 &mov    ($s0,&DWP(0,$acc));     # read input
1312                 &mov    ($s1,&DWP(4,$acc));
1313                 &mov    ($s2,&DWP(8,$acc));
1314                 &mov    ($s3,&DWP(12,$acc));
1315
1316                 &mov    ($key,$_key);           # load key
1317                 &call   ("_x86_AES_decrypt");
1318
1319                 &mov    ($key,$_tmp);           # load ivp
1320                 &mov    ($acc,$_len);           # load len
1321                 &xor    ($s0,&DWP(0,$key));     # xor iv
1322                 &xor    ($s1,&DWP(4,$key));
1323                 &xor    ($s2,&DWP(8,$key));
1324                 &xor    ($s3,&DWP(12,$key));
1325
1326                 &sub    ($acc,16);
1327                 &jc     (&label("dec_partial"));
1328                 &mov    ($_len,$acc);           # save len
1329                 &mov    ($acc,$_inp);           # load inp
1330                 &mov    ($key,$_out);           # load out
1331
1332                 &mov    (&DWP(0,$key),$s0);     # write output
1333                 &mov    (&DWP(4,$key),$s1);
1334                 &mov    (&DWP(8,$key),$s2);
1335                 &mov    (&DWP(12,$key),$s3);
1336
1337                 &mov    ($_tmp,$acc);           # save ivp
1338                 &lea    ($acc,&DWP(16,$acc));
1339                 &mov    ($_inp,$acc);           # save inp
1340
1341                 &lea    ($key,&DWP(16,$key));
1342                 &mov    ($_out,$key);           # save out
1343
1344         &jnz    (&label("dec_loop"));
1345         &mov    ($key,$_tmp);           # load temp ivp
1346     &set_label("dec_end");
1347         &mov    ($acc,$_ivp);           # load user ivp
1348         &mov    ($s0,&DWP(0,$key));     # load iv
1349         &mov    ($s1,&DWP(4,$key));
1350         &mov    ($s2,&DWP(8,$key));
1351         &mov    ($s3,&DWP(12,$key));
1352         &mov    (&DWP(0,$acc),$s0);     # copy back to user
1353         &mov    (&DWP(4,$acc),$s1);
1354         &mov    (&DWP(8,$acc),$s2);
1355         &mov    (&DWP(12,$acc),$s3);
1356         &jmp    (&label("dec_out"));
1357
1358     &align      (4);
1359     &set_label("dec_partial");
1360         &lea    ($key,$ivec);
1361         &mov    (&DWP(0,$key),$s0);     # dump output to stack
1362         &mov    (&DWP(4,$key),$s1);
1363         &mov    (&DWP(8,$key),$s2);
1364         &mov    (&DWP(12,$key),$s3);
1365         &lea    ($s2 eq "ecx" ? $s2 : "",&DWP(16,$acc));
1366         &mov    ($acc eq "esi" ? $acc : "",$key);
1367         &mov    ($key eq "edi" ? $key : "",$_out);      # load out
1368         &data_word(0xA4F3F689); # rep movsb             # copy output
1369         &mov    ($key,$_inp);                           # use inp as temp ivp
1370         &jmp    (&label("dec_end"));
1371
1372     &align      (4);
1373     &set_label("dec_in_place");
1374         &set_label("dec_in_place_loop");
1375                 &lea    ($key,$ivec);
1376                 &mov    ($s0,&DWP(0,$acc));     # read input
1377                 &mov    ($s1,&DWP(4,$acc));
1378                 &mov    ($s2,&DWP(8,$acc));
1379                 &mov    ($s3,&DWP(12,$acc));
1380
1381                 &mov    (&DWP(0,$key),$s0);     # copy to temp
1382                 &mov    (&DWP(4,$key),$s1);
1383                 &mov    (&DWP(8,$key),$s2);
1384                 &mov    (&DWP(12,$key),$s3);
1385
1386                 &mov    ($key,$_key);           # load key
1387                 &call   ("_x86_AES_decrypt");
1388
1389                 &mov    ($key,$_ivp);           # load ivp
1390                 &mov    ($acc,$_out);           # load out
1391                 &xor    ($s0,&DWP(0,$key));     # xor iv
1392                 &xor    ($s1,&DWP(4,$key));
1393                 &xor    ($s2,&DWP(8,$key));
1394                 &xor    ($s3,&DWP(12,$key));
1395
1396                 &mov    (&DWP(0,$acc),$s0);     # write output
1397                 &mov    (&DWP(4,$acc),$s1);
1398                 &mov    (&DWP(8,$acc),$s2);
1399                 &mov    (&DWP(12,$acc),$s3);
1400
1401                 &lea    ($acc,&DWP(16,$acc));
1402                 &mov    ($_out,$acc);           # save out
1403
1404                 &lea    ($acc,$ivec);
1405                 &mov    ($s0,&DWP(0,$acc));     # read temp
1406                 &mov    ($s1,&DWP(4,$acc));
1407                 &mov    ($s2,&DWP(8,$acc));
1408                 &mov    ($s3,&DWP(12,$acc));
1409
1410                 &mov    (&DWP(0,$key),$s0);     # copy iv
1411                 &mov    (&DWP(4,$key),$s1);
1412                 &mov    (&DWP(8,$key),$s2);
1413                 &mov    (&DWP(12,$key),$s3);
1414
1415                 &mov    ($acc,$_inp);           # load inp
1416
1417                 &lea    ($acc,&DWP(16,$acc));
1418                 &mov    ($_inp,$acc);           # save inp
1419
1420                 &mov    ($s2,$_len);            # load len
1421                 &sub    ($s2,16);
1422                 &jc     (&label("dec_in_place_partial"));
1423                 &mov    ($_len,$s2);            # save len
1424         &jnz    (&label("dec_in_place_loop"));
1425         &jmp    (&label("dec_out"));
1426
1427     &align      (4);
1428     &set_label("dec_in_place_partial");
1429         # one can argue if this is actually required...
1430         &mov    ($key eq "edi" ? $key : "",$_out);
1431         &lea    ($acc eq "esi" ? $acc : "",$ivec);
1432         &lea    ($key,&DWP(0,$key,$s2));
1433         &lea    ($acc,&DWP(16,$acc,$s2));
1434         &neg    ($s2 eq "ecx" ? $s2 : "");
1435         &data_word(0xA4F3F689); # rep movsb     # restore tail
1436
1437     &align      (4);
1438     &set_label("dec_out");
1439     &cmp        ($mark,0);              # was the key schedule copied?
1440     &mov        ("edi",$_key);
1441     &mov        ("esp",$_esp);
1442     &je         (&label("skip_dzero"));
1443     # zero copy of key schedule
1444     &mov        ("ecx",240/4);
1445     &xor        ("eax","eax");
1446     &align      (4);
1447     &data_word(0xABF3F689);     # rep stosd
1448     &set_label("skip_dzero")
1449     &popf       ();
1450 &function_end("AES_cbc_encrypt");
1451 }
1452
1453 #------------------------------------------------------------------#
1454
1455 sub enckey()
1456 {
1457         &movz   ("esi",&LB("edx"));             # rk[i]>>0
1458         &mov    ("ebx",&DWP(2,"ebp","esi",8));
1459         &movz   ("esi",&HB("edx"));             # rk[i]>>8
1460         &and    ("ebx",0xFF000000);
1461         &xor    ("eax","ebx");
1462
1463         &mov    ("ebx",&DWP(2,"ebp","esi",8));
1464         &shr    ("edx",16);
1465         &and    ("ebx",0x000000FF);
1466         &movz   ("esi",&LB("edx"));             # rk[i]>>16
1467         &xor    ("eax","ebx");
1468
1469         &mov    ("ebx",&DWP(0,"ebp","esi",8));
1470         &movz   ("esi",&HB("edx"));             # rk[i]>>24
1471         &and    ("ebx",0x0000FF00);
1472         &xor    ("eax","ebx");
1473
1474         &mov    ("ebx",&DWP(0,"ebp","esi",8));
1475         &and    ("ebx",0x00FF0000);
1476         &xor    ("eax","ebx");
1477
1478         &xor    ("eax",&DWP(2048+256,"ebp","ecx",4));   # rcon
1479 }
1480
1481 # int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
1482 #                        AES_KEY *key)
1483 &public_label("AES_Te");
1484 &function_begin("AES_set_encrypt_key");
1485         &mov    ("esi",&wparam(0));             # user supplied key
1486         &mov    ("edi",&wparam(2));             # private key schedule
1487
1488         &test   ("esi",-1);
1489         &jz     (&label("badpointer"));
1490         &test   ("edi",-1);
1491         &jz     (&label("badpointer"));
1492
1493         &call   (&label("pic_point"));
1494         &set_label("pic_point");
1495         &blindpop("ebp");
1496         &lea    ("ebp",&DWP(&label("AES_Te")."-".&label("pic_point"),"ebp"));
1497
1498         &mov    ("ecx",&wparam(1));             # number of bits in key
1499         &cmp    ("ecx",128);
1500         &je     (&label("10rounds"));
1501         &cmp    ("ecx",192);
1502         &je     (&label("12rounds"));
1503         &cmp    ("ecx",256);
1504         &je     (&label("14rounds"));
1505         &mov    ("eax",-2);                     # invalid number of bits
1506         &jmp    (&label("exit"));
1507
1508     &set_label("10rounds");
1509         &mov    ("eax",&DWP(0,"esi"));          # copy first 4 dwords
1510         &mov    ("ebx",&DWP(4,"esi"));
1511         &mov    ("ecx",&DWP(8,"esi"));
1512         &mov    ("edx",&DWP(12,"esi"));
1513         &mov    (&DWP(0,"edi"),"eax");
1514         &mov    (&DWP(4,"edi"),"ebx");
1515         &mov    (&DWP(8,"edi"),"ecx");
1516         &mov    (&DWP(12,"edi"),"edx");
1517
1518         &xor    ("ecx","ecx");
1519         &jmp    (&label("10shortcut"));
1520
1521         &align  (4);
1522         &set_label("10loop");
1523                 &mov    ("eax",&DWP(0,"edi"));          # rk[0]
1524                 &mov    ("edx",&DWP(12,"edi"));         # rk[3]
1525         &set_label("10shortcut");
1526                 &enckey ();
1527
1528                 &mov    (&DWP(16,"edi"),"eax");         # rk[4]
1529                 &xor    ("eax",&DWP(4,"edi"));
1530                 &mov    (&DWP(20,"edi"),"eax");         # rk[5]
1531                 &xor    ("eax",&DWP(8,"edi"));
1532                 &mov    (&DWP(24,"edi"),"eax");         # rk[6]
1533                 &xor    ("eax",&DWP(12,"edi"));
1534                 &mov    (&DWP(28,"edi"),"eax");         # rk[7]
1535                 &inc    ("ecx");
1536                 &add    ("edi",16);
1537                 &cmp    ("ecx",10);
1538         &jl     (&label("10loop"));
1539
1540         &mov    (&DWP(80,"edi"),10);            # setup number of rounds
1541         &xor    ("eax","eax");
1542         &jmp    (&label("exit"));
1543
1544     &set_label("12rounds");
1545         &mov    ("eax",&DWP(0,"esi"));          # copy first 6 dwords
1546         &mov    ("ebx",&DWP(4,"esi"));
1547         &mov    ("ecx",&DWP(8,"esi"));
1548         &mov    ("edx",&DWP(12,"esi"));
1549         &mov    (&DWP(0,"edi"),"eax");
1550         &mov    (&DWP(4,"edi"),"ebx");
1551         &mov    (&DWP(8,"edi"),"ecx");
1552         &mov    (&DWP(12,"edi"),"edx");
1553         &mov    ("ecx",&DWP(16,"esi"));
1554         &mov    ("edx",&DWP(20,"esi"));
1555         &mov    (&DWP(16,"edi"),"ecx");
1556         &mov    (&DWP(20,"edi"),"edx");
1557
1558         &xor    ("ecx","ecx");
1559         &jmp    (&label("12shortcut"));
1560
1561         &align  (4);
1562         &set_label("12loop");
1563                 &mov    ("eax",&DWP(0,"edi"));          # rk[0]
1564                 &mov    ("edx",&DWP(20,"edi"));         # rk[5]
1565         &set_label("12shortcut");
1566                 &enckey ();
1567
1568                 &mov    (&DWP(24,"edi"),"eax");         # rk[6]
1569                 &xor    ("eax",&DWP(4,"edi"));
1570                 &mov    (&DWP(28,"edi"),"eax");         # rk[7]
1571                 &xor    ("eax",&DWP(8,"edi"));
1572                 &mov    (&DWP(32,"edi"),"eax");         # rk[8]
1573                 &xor    ("eax",&DWP(12,"edi"));
1574                 &mov    (&DWP(36,"edi"),"eax");         # rk[9]
1575
1576                 &cmp    ("ecx",7);
1577                 &je     (&label("12break"));
1578                 &inc    ("ecx");
1579
1580                 &xor    ("eax",&DWP(16,"edi"));
1581                 &mov    (&DWP(40,"edi"),"eax");         # rk[10]
1582                 &xor    ("eax",&DWP(20,"edi"));
1583                 &mov    (&DWP(44,"edi"),"eax");         # rk[11]
1584
1585                 &add    ("edi",24);
1586         &jmp    (&label("12loop"));
1587
1588         &set_label("12break");
1589         &mov    (&DWP(72,"edi"),12);            # setup number of rounds
1590         &xor    ("eax","eax");
1591         &jmp    (&label("exit"));
1592
1593     &set_label("14rounds");
1594         &mov    ("eax",&DWP(0,"esi"));          # copy first 8 dwords
1595         &mov    ("ebx",&DWP(4,"esi"));
1596         &mov    ("ecx",&DWP(8,"esi"));
1597         &mov    ("edx",&DWP(12,"esi"));
1598         &mov    (&DWP(0,"edi"),"eax");
1599         &mov    (&DWP(4,"edi"),"ebx");
1600         &mov    (&DWP(8,"edi"),"ecx");
1601         &mov    (&DWP(12,"edi"),"edx");
1602         &mov    ("eax",&DWP(16,"esi"));
1603         &mov    ("ebx",&DWP(20,"esi"));
1604         &mov    ("ecx",&DWP(24,"esi"));
1605         &mov    ("edx",&DWP(28,"esi"));
1606         &mov    (&DWP(16,"edi"),"eax");
1607         &mov    (&DWP(20,"edi"),"ebx");
1608         &mov    (&DWP(24,"edi"),"ecx");
1609         &mov    (&DWP(28,"edi"),"edx");
1610
1611         &xor    ("ecx","ecx");
1612         &jmp    (&label("14shortcut"));
1613
1614         &align  (4);
1615         &set_label("14loop");
1616                 &mov    ("edx",&DWP(28,"edi"));         # rk[7]
1617         &set_label("14shortcut");
1618                 &mov    ("eax",&DWP(0,"edi"));          # rk[0]
1619
1620                 &enckey ();
1621
1622                 &mov    (&DWP(32,"edi"),"eax");         # rk[8]
1623                 &xor    ("eax",&DWP(4,"edi"));
1624                 &mov    (&DWP(36,"edi"),"eax");         # rk[9]
1625                 &xor    ("eax",&DWP(8,"edi"));
1626                 &mov    (&DWP(40,"edi"),"eax");         # rk[10]
1627                 &xor    ("eax",&DWP(12,"edi"));
1628                 &mov    (&DWP(44,"edi"),"eax");         # rk[11]
1629
1630                 &cmp    ("ecx",6);
1631                 &je     (&label("14break"));
1632                 &inc    ("ecx");
1633
1634                 &mov    ("edx","eax");
1635                 &mov    ("eax",&DWP(16,"edi"));         # rk[4]
1636                 &movz   ("esi",&LB("edx"));             # rk[11]>>0
1637                 &mov    ("ebx",&DWP(2,"ebp","esi",8));
1638                 &movz   ("esi",&HB("edx"));             # rk[11]>>8
1639                 &and    ("ebx",0x000000FF);
1640                 &xor    ("eax","ebx");
1641
1642                 &mov    ("ebx",&DWP(0,"ebp","esi",8));
1643                 &shr    ("edx",16);
1644                 &and    ("ebx",0x0000FF00);
1645                 &movz   ("esi",&LB("edx"));             # rk[11]>>16
1646                 &xor    ("eax","ebx");
1647
1648                 &mov    ("ebx",&DWP(0,"ebp","esi",8));
1649                 &movz   ("esi",&HB("edx"));             # rk[11]>>24
1650                 &and    ("ebx",0x00FF0000);
1651                 &xor    ("eax","ebx");
1652
1653                 &mov    ("ebx",&DWP(2,"ebp","esi",8));
1654                 &and    ("ebx",0xFF000000);
1655                 &xor    ("eax","ebx");
1656
1657                 &mov    (&DWP(48,"edi"),"eax");         # rk[12]
1658                 &xor    ("eax",&DWP(20,"edi"));
1659                 &mov    (&DWP(52,"edi"),"eax");         # rk[13]
1660                 &xor    ("eax",&DWP(24,"edi"));
1661                 &mov    (&DWP(56,"edi"),"eax");         # rk[14]
1662                 &xor    ("eax",&DWP(28,"edi"));
1663                 &mov    (&DWP(60,"edi"),"eax");         # rk[15]
1664
1665                 &add    ("edi",32);
1666         &jmp    (&label("14loop"));
1667
1668         &set_label("14break");
1669         &mov    (&DWP(48,"edi"),14);            # setup number of rounds
1670         &xor    ("eax","eax");
1671         &jmp    (&label("exit"));
1672
1673     &set_label("badpointer");
1674         &mov    ("eax",-1);
1675     &set_label("exit");
1676 &function_end("AES_set_encrypt_key");
1677
1678 sub deckey()
1679 { my ($i,$ptr,$te,$td) = @_;
1680
1681         &mov    ("eax",&DWP($i,$ptr));
1682         &mov    ("edx","eax");
1683         &movz   ("ebx",&HB("eax"));
1684         &shr    ("edx",16);
1685         &and    ("eax",0xFF);
1686         &movz   ("eax",&BP(2,$te,"eax",8));
1687         &movz   ("ebx",&BP(2,$te,"ebx",8));
1688         &mov    ("eax",&DWP(0,$td,"eax",8));
1689         &xor    ("eax",&DWP(3,$td,"ebx",8));
1690         &movz   ("ebx",&HB("edx"));
1691         &and    ("edx",0xFF);
1692         &movz   ("edx",&BP(2,$te,"edx",8));
1693         &movz   ("ebx",&BP(2,$te,"ebx",8));
1694         &xor    ("eax",&DWP(2,$td,"edx",8));
1695         &xor    ("eax",&DWP(1,$td,"ebx",8));
1696         &mov    (&DWP($i,$ptr),"eax");
1697 }
1698
1699 # int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
1700 #                        AES_KEY *key)
1701 &public_label("AES_Td");
1702 &public_label("AES_Te");
1703 &function_begin_B("AES_set_decrypt_key");
1704         &mov    ("eax",&wparam(0));
1705         &mov    ("ecx",&wparam(1));
1706         &mov    ("edx",&wparam(2));
1707         &sub    ("esp",12);
1708         &mov    (&DWP(0,"esp"),"eax");
1709         &mov    (&DWP(4,"esp"),"ecx");
1710         &mov    (&DWP(8,"esp"),"edx");
1711         &call   ("AES_set_encrypt_key");
1712         &add    ("esp",12);
1713         &cmp    ("eax",0);
1714         &je     (&label("proceed"));
1715         &ret    ();
1716
1717     &set_label("proceed");
1718         &push   ("ebp");
1719         &push   ("ebx");
1720         &push   ("esi");
1721         &push   ("edi");
1722
1723         &mov    ("esi",&wparam(2));
1724         &mov    ("ecx",&DWP(240,"esi"));        # pull number of rounds
1725         &lea    ("ecx",&DWP(0,"","ecx",4));
1726         &lea    ("edi",&DWP(0,"esi","ecx",4));  # pointer to last chunk
1727
1728         &align  (4);
1729         &set_label("invert");                   # invert order of chunks
1730                 &mov    ("eax",&DWP(0,"esi"));
1731                 &mov    ("ebx",&DWP(4,"esi"));
1732                 &mov    ("ecx",&DWP(0,"edi"));
1733                 &mov    ("edx",&DWP(4,"edi"));
1734                 &mov    (&DWP(0,"edi"),"eax");
1735                 &mov    (&DWP(4,"edi"),"ebx");
1736                 &mov    (&DWP(0,"esi"),"ecx");
1737                 &mov    (&DWP(4,"esi"),"edx");
1738                 &mov    ("eax",&DWP(8,"esi"));
1739                 &mov    ("ebx",&DWP(12,"esi"));
1740                 &mov    ("ecx",&DWP(8,"edi"));
1741                 &mov    ("edx",&DWP(12,"edi"));
1742                 &mov    (&DWP(8,"edi"),"eax");
1743                 &mov    (&DWP(12,"edi"),"ebx");
1744                 &mov    (&DWP(8,"esi"),"ecx");
1745                 &mov    (&DWP(12,"esi"),"edx");
1746                 &add    ("esi",16);
1747                 &sub    ("edi",16);
1748                 &cmp    ("esi","edi");
1749         &jne    (&label("invert"));
1750
1751         &call   (&label("pic_point"));
1752         &set_label("pic_point");
1753         blindpop("ebp");
1754         &lea    ("edi",&DWP(&label("AES_Td")."-".&label("pic_point"),"ebp"));
1755         &lea    ("ebp",&DWP(&label("AES_Te")."-".&label("pic_point"),"ebp"));
1756
1757         &mov    ("esi",&wparam(2));
1758         &mov    ("ecx",&DWP(240,"esi"));        # pull number of rounds
1759         &dec    ("ecx");
1760         &align  (4);
1761         &set_label("permute");                  # permute the key schedule
1762                 &add    ("esi",16);
1763                 &deckey (0,"esi","ebp","edi");
1764                 &deckey (4,"esi","ebp","edi");
1765                 &deckey (8,"esi","ebp","edi");
1766                 &deckey (12,"esi","ebp","edi");
1767                 &dec    ("ecx");
1768         &jnz    (&label("permute"));
1769
1770         &xor    ("eax","eax");                  # return success
1771 &function_end("AES_set_decrypt_key");
1772
1773 &asm_finish();