aes.cpp

/*
   Copyright (c) 2005, 2012, Oracle and/or its affiliates

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; version 2 of the License.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program; see the file COPYING. If not, write to the
   Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
   MA  02110-1301  USA.
*/

/* C++ based on Wei Dai's aes.cpp from CryptoPP */
/* x86 asm original */

#if defined(TAOCRYPT_KERNEL_MODE)
    #define DO_TAOCRYPT_KERNEL_MODE
#endif                                  // only some modules now support this

#include "runtime.hpp"
#include "aes.hpp"


namespace TaoCrypt {


#if defined(DO_AES_ASM)

// ia32 optimized version
void AES::Process(byte* out, const byte* in, word32 sz)
{
    if (!isMMX) {
        Mode_BASE::Process(out, in, sz);
        return;
    }

    word32 blocks = sz / BLOCK_SIZE;

    if (mode_ == ECB)
        while (blocks--) {
            if (dir_ == ENCRYPTION)
                AsmEncrypt(in, out, (void*)Te0);
            else
                AsmDecrypt(in, out, (void*)Td0);               
            out += BLOCK_SIZE;
            in  += BLOCK_SIZE;
        }
    else if (mode_ == CBC) {
        if (dir_ == ENCRYPTION) {
            while (blocks--) {
                r_[0] ^= *(word32*)in;
                r_[1] ^= *(word32*)(in +  4);
                r_[2] ^= *(word32*)(in +  8);
                r_[3] ^= *(word32*)(in + 12);

                AsmEncrypt((byte*)r_, (byte*)r_, (void*)Te0);

                memcpy(out, r_, BLOCK_SIZE);
                out += BLOCK_SIZE;
                in  += BLOCK_SIZE;
            }
        }
        else {
            while (blocks--) {
                AsmDecrypt(in, out, (void*)Td0);
                
                *(word32*)out        ^= r_[0];
                *(word32*)(out +  4) ^= r_[1];
                *(word32*)(out +  8) ^= r_[2];
                *(word32*)(out + 12) ^= r_[3];

                memcpy(r_, in, BLOCK_SIZE);
                out += BLOCK_SIZE;
                in  += BLOCK_SIZE;
            }
        }
    }
}

#endif // DO_AES_ASM


void AES::SetKey(const byte* userKey, word32 keylen, CipherDir /*dummy*/)
{
    if (keylen <= 16)
        keylen = 16;
    else if (keylen >= 32)
        keylen = 32;
    else if (keylen != 24)
        keylen = 24;
    
    rounds_ = keylen/4 + 6;

    word32 temp, *rk = key_;
    unsigned int i=0;

    GetUserKey(BigEndianOrder, rk, keylen/4, userKey, keylen);

    switch(keylen)
    {
    case 16:
        while (true)
        {
            temp  = rk[3];
            rk[4] = rk[0] ^
                (Te2[GETBYTE(temp, 2)] & 0xff000000) ^
                (Te3[GETBYTE(temp, 1)] & 0x00ff0000) ^
                (Te0[GETBYTE(temp, 0)] & 0x0000ff00) ^
                (Te1[GETBYTE(temp, 3)] & 0x000000ff) ^
                rcon_[i];
            rk[5] = rk[1] ^ rk[4];
            rk[6] = rk[2] ^ rk[5];
            rk[7] = rk[3] ^ rk[6];
            if (++i == 10)
                break;
            rk += 4;
        }
        break;

    case 24:
        while (true)    // for (;;) here triggers a bug in VC60 SP4 w/ Pro Pack
        {
            temp = rk[ 5];
            rk[ 6] = rk[ 0] ^
                (Te2[GETBYTE(temp, 2)] & 0xff000000) ^
                (Te3[GETBYTE(temp, 1)] & 0x00ff0000) ^
                (Te0[GETBYTE(temp, 0)] & 0x0000ff00) ^
                (Te1[GETBYTE(temp, 3)] & 0x000000ff) ^
                rcon_[i];
            rk[ 7] = rk[ 1] ^ rk[ 6];
            rk[ 8] = rk[ 2] ^ rk[ 7];
            rk[ 9] = rk[ 3] ^ rk[ 8];
            if (++i == 8)
                break;
            rk[10] = rk[ 4] ^ rk[ 9];
            rk[11] = rk[ 5] ^ rk[10];
            rk += 6;
        }
        break;

    case 32:
        while (true)
        {
            temp = rk[ 7];
            rk[ 8] = rk[ 0] ^
                (Te2[GETBYTE(temp, 2)] & 0xff000000) ^
                (Te3[GETBYTE(temp, 1)] & 0x00ff0000) ^
                (Te0[GETBYTE(temp, 0)] & 0x0000ff00) ^
                (Te1[GETBYTE(temp, 3)] & 0x000000ff) ^
                rcon_[i];
            rk[ 9] = rk[ 1] ^ rk[ 8];
            rk[10] = rk[ 2] ^ rk[ 9];
            rk[11] = rk[ 3] ^ rk[10];
            if (++i == 7)
                break;
            temp = rk[11];
            rk[12] = rk[ 4] ^
                (Te2[GETBYTE(temp, 3)] & 0xff000000) ^
                (Te3[GETBYTE(temp, 2)] & 0x00ff0000) ^
                (Te0[GETBYTE(temp, 1)] & 0x0000ff00) ^
                (Te1[GETBYTE(temp, 0)] & 0x000000ff);
            rk[13] = rk[ 5] ^ rk[12];
            rk[14] = rk[ 6] ^ rk[13];
            rk[15] = rk[ 7] ^ rk[14];

            rk += 8;
        }
        break;
    }

    if (dir_ == DECRYPTION)
    {
        unsigned int i, j;
        rk = key_;

        /* invert the order of the round keys: */
        for (i = 0, j = 4*rounds_; i < j; i += 4, j -= 4) {
            temp = rk[i    ]; rk[i    ] = rk[j    ]; rk[j    ] = temp;
            temp = rk[i + 1]; rk[i + 1] = rk[j + 1]; rk[j + 1] = temp;
            temp = rk[i + 2]; rk[i + 2] = rk[j + 2]; rk[j + 2] = temp;
            temp = rk[i + 3]; rk[i + 3] = rk[j + 3]; rk[j + 3] = temp;
        }
        // apply the inverse MixColumn transform to all round keys but the
        // first and the last:
        for (i = 1; i < rounds_; i++) {
            rk += 4;
            rk[0] =
                Td0[Te1[GETBYTE(rk[0], 3)] & 0xff] ^
                Td1[Te1[GETBYTE(rk[0], 2)] & 0xff] ^
                Td2[Te1[GETBYTE(rk[0], 1)] & 0xff] ^
                Td3[Te1[GETBYTE(rk[0], 0)] & 0xff];
            rk[1] =
                Td0[Te1[GETBYTE(rk[1], 3)] & 0xff] ^
                Td1[Te1[GETBYTE(rk[1], 2)] & 0xff] ^
                Td2[Te1[GETBYTE(rk[1], 1)] & 0xff] ^
                Td3[Te1[GETBYTE(rk[1], 0)] & 0xff];
            rk[2] =
                Td0[Te1[GETBYTE(rk[2], 3)] & 0xff] ^
                Td1[Te1[GETBYTE(rk[2], 2)] & 0xff] ^
                Td2[Te1[GETBYTE(rk[2], 1)] & 0xff] ^
                Td3[Te1[GETBYTE(rk[2], 0)] & 0xff];
            rk[3] =
                Td0[Te1[GETBYTE(rk[3], 3)] & 0xff] ^
                Td1[Te1[GETBYTE(rk[3], 2)] & 0xff] ^
                Td2[Te1[GETBYTE(rk[3], 1)] & 0xff] ^
                Td3[Te1[GETBYTE(rk[3], 0)] & 0xff];
        }
    }
}


void AES::ProcessAndXorBlock(const byte* in, const byte* xOr, byte* out) const
{
    if (dir_ == ENCRYPTION)
        encrypt(in, xOr, out);
    else
        decrypt(in, xOr, out);
}


typedef BlockGetAndPut<word32, BigEndian> gpBlock;

	
void AES::encrypt(const byte* inBlock, const byte* xorBlock,
                  byte* outBlock) const
{
    word32 s0, s1, s2, s3;
    word32 t0, t1, t2, t3;

    const word32 *rk = key_;
    /*
     * map byte array block to cipher state
     * and add initial round key:
     */
    gpBlock::Get(inBlock)(s0)(s1)(s2)(s3);
    s0 ^= rk[0];
    s1 ^= rk[1];
    s2 ^= rk[2];
    s3 ^= rk[3];
   
    s0 |= PreFetchTe();
    /*
     * Nr - 1 full rounds:
     */

    unsigned int r = rounds_ >> 1;
    for (;;) {
        t0 =
            Te0[GETBYTE(s0, 3)] ^
            Te1[GETBYTE(s1, 2)]  ^
            Te2[GETBYTE(s2, 1)]  ^
            Te3[GETBYTE(s3, 0)]  ^
            rk[4];
        t1 =
            Te0[GETBYTE(s1, 3)] ^
            Te1[GETBYTE(s2, 2)]  ^
            Te2[GETBYTE(s3, 1)]  ^
            Te3[GETBYTE(s0, 0)]  ^
            rk[5];
        t2 =
            Te0[GETBYTE(s2, 3)] ^
            Te1[GETBYTE(s3, 2)]  ^
            Te2[GETBYTE(s0, 1)]  ^
            Te3[GETBYTE(s1, 0)]  ^
            rk[6];
        t3 =
            Te0[GETBYTE(s3, 3)] ^
            Te1[GETBYTE(s0, 2)]  ^
            Te2[GETBYTE(s1, 1)]  ^
            Te3[GETBYTE(s2, 0)]  ^
            rk[7];

        rk += 8;
        if (--r == 0) {
            break;
        }
        
        s0 =
            Te0[GETBYTE(t0, 3)] ^
            Te1[GETBYTE(t1, 2)] ^
            Te2[GETBYTE(t2, 1)] ^
            Te3[GETBYTE(t3, 0)] ^
            rk[0];
        s1 =
            Te0[GETBYTE(t1, 3)] ^
            Te1[GETBYTE(t2, 2)] ^
            Te2[GETBYTE(t3, 1)] ^
            Te3[GETBYTE(t0, 0)] ^
            rk[1];
        s2 =
            Te0[GETBYTE(t2, 3)] ^
            Te1[GETBYTE(t3, 2)] ^
            Te2[GETBYTE(t0, 1)] ^
            Te3[GETBYTE(t1, 0)] ^
            rk[2];
        s3 =
            Te0[GETBYTE(t3, 3)] ^
            Te1[GETBYTE(t0, 2)] ^
            Te2[GETBYTE(t1, 1)] ^
            Te3[GETBYTE(t2, 0)] ^
            rk[3];
    }

    /*
     * apply last round and
     * map cipher state to byte array block:
     */

    s0 =
        (Te2[GETBYTE(t0, 3)] & 0xff000000) ^
        (Te3[GETBYTE(t1, 2)] & 0x00ff0000) ^
        (Te0[GETBYTE(t2, 1)] & 0x0000ff00) ^
        (Te1[GETBYTE(t3, 0)] & 0x000000ff) ^
        rk[0];
    s1 =
        (Te2[GETBYTE(t1, 3)] & 0xff000000) ^
        (Te3[GETBYTE(t2, 2)] & 0x00ff0000) ^
        (Te0[GETBYTE(t3, 1)] & 0x0000ff00) ^
        (Te1[GETBYTE(t0, 0)] & 0x000000ff) ^
        rk[1];
    s2 =
        (Te2[GETBYTE(t2, 3)] & 0xff000000) ^
        (Te3[GETBYTE(t3, 2)] & 0x00ff0000) ^
        (Te0[GETBYTE(t0, 1)] & 0x0000ff00) ^
        (Te1[GETBYTE(t1, 0)] & 0x000000ff) ^
        rk[2];
    s3 =
        (Te2[GETBYTE(t3, 3)] & 0xff000000) ^
        (Te3[GETBYTE(t0, 2)] & 0x00ff0000) ^
        (Te0[GETBYTE(t1, 1)] & 0x0000ff00) ^
        (Te1[GETBYTE(t2, 0)] & 0x000000ff) ^
        rk[3];


    gpBlock::Put(xorBlock, outBlock)(s0)(s1)(s2)(s3);
}


void AES::decrypt(const byte* inBlock, const byte* xorBlock,
                  byte* outBlock) const
{
    word32 s0, s1, s2, s3;
    word32 t0, t1, t2, t3;
    const word32* rk = key_;

    /*
     * map byte array block to cipher state
     * and add initial round key:
     */
    gpBlock::Get(inBlock)(s0)(s1)(s2)(s3);
    s0 ^= rk[0];
    s1 ^= rk[1];
    s2 ^= rk[2];
    s3 ^= rk[3];

    s0 |= PreFetchTd();

    /*
     * Nr - 1 full rounds:
     */

    unsigned int r = rounds_ >> 1;
    for (;;) {
        t0 =
            Td0[GETBYTE(s0, 3)] ^
            Td1[GETBYTE(s3, 2)] ^
            Td2[GETBYTE(s2, 1)] ^
            Td3[GETBYTE(s1, 0)] ^
            rk[4];
        t1 =
            Td0[GETBYTE(s1, 3)] ^
            Td1[GETBYTE(s0, 2)] ^
            Td2[GETBYTE(s3, 1)] ^
            Td3[GETBYTE(s2, 0)] ^
            rk[5];
        t2 =
            Td0[GETBYTE(s2, 3)] ^
            Td1[GETBYTE(s1, 2)] ^
            Td2[GETBYTE(s0, 1)] ^
            Td3[GETBYTE(s3, 0)] ^
            rk[6];
        t3 =
            Td0[GETBYTE(s3, 3)] ^
            Td1[GETBYTE(s2, 2)] ^
            Td2[GETBYTE(s1, 1)] ^
            Td3[GETBYTE(s0, 0)] ^
            rk[7];

        rk += 8;
        if (--r == 0) {
            break;
        }

        s0 =
            Td0[GETBYTE(t0, 3)] ^
            Td1[GETBYTE(t3, 2)] ^
            Td2[GETBYTE(t2, 1)] ^
            Td3[GETBYTE(t1, 0)] ^
            rk[0];
        s1 =
            Td0[GETBYTE(t1, 3)] ^
            Td1[GETBYTE(t0, 2)] ^
            Td2[GETBYTE(t3, 1)] ^
            Td3[GETBYTE(t2, 0)] ^
            rk[1];
        s2 =
            Td0[GETBYTE(t2, 3)] ^
            Td1[GETBYTE(t1, 2)] ^
            Td2[GETBYTE(t0, 1)] ^
            Td3[GETBYTE(t3, 0)] ^
            rk[2];
        s3 =
            Td0[GETBYTE(t3, 3)] ^
            Td1[GETBYTE(t2, 2)] ^
            Td2[GETBYTE(t1, 1)] ^
            Td3[GETBYTE(t0, 0)] ^
            rk[3];
    }
    /*
     * apply last round and
     * map cipher state to byte array block:
     */

    t0 |= PreFetchCTd4();

    s0 =
        ((word32)CTd4[GETBYTE(t0, 3)] << 24) ^
        ((word32)CTd4[GETBYTE(t3, 2)] << 16) ^
        ((word32)CTd4[GETBYTE(t2, 1)] <<  8) ^
        ((word32)CTd4[GETBYTE(t1, 0)]) ^
        rk[0];
    s1 =
        ((word32)CTd4[GETBYTE(t1, 3)]  << 24) ^
        ((word32)CTd4[GETBYTE(t0, 2)]  << 16) ^
        ((word32)CTd4[GETBYTE(t3, 1)]  <<  8) ^
        ((word32)CTd4[GETBYTE(t2, 0)]) ^
        rk[1];
    s2 =
        ((word32)CTd4[GETBYTE(t2, 3)] << 24  ) ^
        ((word32)CTd4[GETBYTE(t1, 2)] << 16 ) ^
        ((word32)CTd4[GETBYTE(t0, 1)] <<  8 ) ^
        ((word32)CTd4[GETBYTE(t3, 0)]) ^
        rk[2];
    s3 =
        ((word32)CTd4[GETBYTE(t3, 3)] << 24) ^
        ((word32)CTd4[GETBYTE(t2, 2)] << 16) ^
        ((word32)CTd4[GETBYTE(t1, 1)] <<  8) ^
        ((word32)CTd4[GETBYTE(t0, 0)]) ^
        rk[3];

    gpBlock::Put(xorBlock, outBlock)(s0)(s1)(s2)(s3);
}


#if defined(DO_AES_ASM)
    #ifdef __GNUC__
        #define AS1(x)    #x ";"
        #define AS2(x, y) #x ", " #y ";"

        #define PROLOG()  \
        __asm__ __volatile__ \
        ( \
            ".intel_syntax noprefix;" \
            "push ebx;" \
            "push ebp;" \
            "movd mm7, ebp;" \
            "movd mm4, eax;" \
            "mov  ebp, edx;"  \
            "sub  esp, 4;" 
        #define EPILOG()  \
            "add esp, 4;" \
            "pop ebp;" \
            "pop ebx;" \
       	    "emms;" \
       	    ".att_syntax;" \
                : \
                : "c" (this), "S" (inBlock), "d" (boxes), "a" (outBlock) \
                : "%edi", "memory", "cc" \
        );

    #else
        #define AS1(x)    __asm x
        #define AS2(x, y) __asm x, y

        #define PROLOG() \
            AS1(    push  ebp                           )   \
            AS2(    mov   ebp, esp                      )   \
            AS2(    movd  mm3, edi                      )   \
            AS2(    movd  mm4, ebx                      )   \
            AS2(    sub   esp, 4                        )   \
            AS2(    movd  mm7, ebp                      )   \
            AS2(    mov   [ebp - 4], esi                )   \
            AS2(    mov   esi, DWORD PTR [ebp +  8]     )   \
            AS2(    mov   ebp, DWORD PTR [ebp + 16]     )

        // ebp is restored at end
        #define EPILOG()  \
            AS2(    mov   esi, [ebp - 4]                )   \
            AS2(    movd  ebx, mm4                      )   \
            AS2(    movd  edi, mm3                      )   \
            AS2(    mov   esp, ebp                      )   \
            AS1(    pop   ebp                           )   \
            AS1(    emms                                )   \
            AS1(    ret   12                            )
            
            
    #endif


#ifdef _MSC_VER
    __declspec(naked) 
#else
    __attribute__ ((noinline))
#endif
void AES::AsmEncrypt(const byte* inBlock, byte* outBlock, void* boxes) const
{

    PROLOG()

    #ifdef OLD_GCC_OFFSET
        AS2(    mov   edx, DWORD PTR [ecx + 60]     )   // rounds
        AS2(    lea   edi, [ecx + 64]               )   // rk
    #else
        AS2(    mov   edx, DWORD PTR [ecx + 56]     )   // rounds
        AS2(    lea   edi, [ecx + 60]               )   // rk
    #endif

    AS1(    dec   edx                           )
    AS2(    movd  mm6, edi                      )   // save rk
    AS2(    movd  mm5, edx                      )   // save rounds
  
    AS2(    mov   eax, DWORD PTR [esi]                                  )
    AS2(    mov   ebx, DWORD PTR [esi + 4]                              )
    AS2(    mov   ecx, DWORD PTR [esi + 8]                              )
    AS2(    mov   edx, DWORD PTR [esi + 12]                             )

    AS1(    bswap eax                                                   )
    AS1(    bswap ebx                                                   )
    AS1(    bswap ecx                                                   )
    AS1(    bswap edx                                                   )

    AS2(    xor   eax, DWORD PTR [edi]               )   // s0
    AS2(    xor   ebx, DWORD PTR [edi +  4]          )   // s1
    AS2(    xor   ecx, DWORD PTR [edi +  8]          )   // s2
    AS2(    xor   edx, DWORD PTR [edi + 12]          )   // s3

#ifdef _MSC_VER
    AS1( loop1: )  // loop1
#else
    AS1(1:  )      // loop1
#endif
            /* Put0 (mm0) =  
                Te0[get0,rs 24] ^
                Te1[get1,rs 16] ^
                Te2[get2,rs  8] ^
                Te3[get3,rs  0]
            */
       
    AS2(    mov   esi, eax                                              )
    AS2(    shr   esi, 24                                               )
    AS2(    mov   esi, DWORD PTR [ebp + esi*4]                          )
                                                    
    AS2(    mov   edi, ebx                                              )
    AS2(    shr   edi, 16                                               )
    AS2(    and   edi, 255                                              )
    AS2(    xor   esi, DWORD PTR [ebp + 1024 + edi*4]                   )

    AS2(    movzx edi, ch                                               )
    AS2(    xor   esi, DWORD PTR [ebp + 2048 + edi*4]                   )

    AS2(    movzx edi, dl                                               )
    AS2(    xor   esi, DWORD PTR [ebp + 3072 + edi*4]                   )

    AS2(    movd  mm0, esi                                              )

             /* Put1 (mm1) =  
                Te0[get1,rs 24] ^
                Te1[get2,rs 16] ^
                Te2[get3,rs  8] ^
                Te3[get0,rs  0]
            */

    AS2(    mov   esi, ebx                                              )
    AS2(    shr   esi, 24                                               )
    AS2(    mov   esi, DWORD PTR [ebp + esi*4]                          )

    AS2(    mov   edi, ecx                                              )
    AS2(    shr   edi, 16                                               )
    AS2(    and   edi, 255                                              )
    AS2(    xor   esi, DWORD PTR [ebp + 1024 + edi*4]                   )

    AS2(    movzx edi, dh                                               )
    AS2(    xor   esi, DWORD PTR [ebp + 2048 + edi*4]                   )

    AS2(    movzx edi, al                                               )
    AS2(    xor   esi, DWORD PTR [ebp + 3072 + edi*4]                   )

    AS2(    movd  mm1, esi                                              )


             /* Put2 (mm2) =  
                Te0[get2,rs 24] ^
                Te1[get3,rs 16] ^
                Te2[get0,rs  8] ^
                Te3[get1,rs  0] 
            */

    AS2(    mov   esi, ecx                                              )
    AS2(    shr   esi, 24                                               )
    AS2(    mov   esi, DWORD PTR [ebp + esi*4]                          )

    AS2(    mov   edi, edx                                              )
    AS2(    shr   edi, 16                                               )
    AS2(    and   edi, 255                                              )
    AS2(    xor   esi, DWORD PTR [ebp + 1024 + edi*4]                   )

    AS2(    movzx edi, ah                                               )
    AS2(    xor   esi, DWORD PTR [ebp + 2048 + edi*4]                   )

    AS2(    movzx edi, bl                                               )
    AS2(    xor   esi, DWORD PTR [ebp + 3072 + edi*4]                   )

    AS2(    movd  mm2, esi                                              )

             /* Put3 (edx) =  
                Te0[get3,rs 24] ^
                Te1[get0,rs 16] ^
                Te2[get1,rs  8] ^
                Te3[get2,rs  0] 
            */

    AS2(    mov   esi, edx                                              )
    AS2(    shr   esi, 24                                               )
    AS2(    mov   edx, DWORD PTR [ebp + esi*4]                          )

    AS2(    mov   edi, eax                                              )
    AS2(    shr   edi, 16                                               )
    AS2(    and   edi, 255                                              )
    AS2(    xor   edx, DWORD PTR [ebp + 1024 + edi*4]                   )

    AS2(    movzx esi, bh                                               )
    AS2(    xor   edx, DWORD PTR [ebp + 2048 + esi*4]                   )

    AS2(    movzx edi, cl                                               )
    AS2(    xor   edx, DWORD PTR [ebp + 3072 + edi*4]                   )

            // xOr

    AS2(    movd   esi, mm6                      )   //  rk

    AS2(    movd   eax, mm0                                             )
    AS2(    add    esi, 16                                              )
    AS2(    movd   ebx, mm1                                             )
    AS2(    movd   mm6, esi                      )   //  save back
    AS2(    movd   ecx, mm2                                             )

    AS2(    xor   eax, DWORD PTR [esi]                                  )
    AS2(    xor   ebx, DWORD PTR [esi +  4]                             )
    AS2(    movd  edi, mm5                                              )
    AS2(    xor   ecx, DWORD PTR [esi +  8]                             )
    AS2(    xor   edx, DWORD PTR [esi + 12]                             )

    AS1(    dec   edi                                                   )
    AS2(    movd  mm5, edi                                              )

#ifdef _MSC_VER
    AS1(    jnz   loop1)  // loop1
#else
    AS1(    jnz   1b )    // loop1
#endif

            // last round
            /*
            Put0 (mm0) =
                (Te4[get0, rs24] & 0xff000000) ^  h = 4278190080
                (Te4[get1, rs16] & 0x00ff0000) ^  h =   16711680
                (Te4[get2, rs 8] & 0x0000ff00) ^  h =      65280
                (Te4[get3, rs 0] & 0x000000ff)    h =        255
            */
    AS2(    mov   esi, eax                                              )
    AS2(    shr   esi, 24                                               )
    AS2(    mov   esi, DWORD PTR [ebp + 4096 + esi*4]                   )
    AS2(    and   esi, 4278190080                                       )

    AS2(    mov   edi, ebx                                              )
    AS2(    shr   edi, 16                                               )
    AS2(    and   edi, 255                                              )
    AS2(    mov   edi, DWORD PTR [ebp + 4096 + edi*4]                   )
    AS2(    and   edi, 16711680                                         )
    AS2(    xor   esi, edi                                              )

    AS2(    movzx edi, ch                                               )
    AS2(    mov   edi, DWORD PTR [ebp + 4096 + edi*4]                   )
    AS2(    and   edi, 65280                                            )
    AS2(    xor   esi, edi                                              )

    AS2(    movzx edi, dl                                               )
    AS2(    mov   edi, DWORD PTR [ebp + 4096 + edi*4]                   )
    AS2(    and   edi, 255                                              )
    AS2(    xor   esi, edi                                              )

    AS2(    movd  mm0, esi                                              )

            /*
            Put1 (mm1) =
                (Te4[get1, rs24] & 0xff000000) ^  h = 4278190080
                (Te4[get2, rs16] & 0x00ff0000) ^  h =   16711680
                (Te4[get3, rs 8] & 0x0000ff00) ^  h =      65280
                (Te4[get0, rs 0] & 0x000000ff)    h =        255
            */
    AS2(    mov   esi, ebx                                              )
    AS2(    shr   esi, 24                                               )
    AS2(    mov   esi, DWORD PTR [ebp + 4096 + esi*4]                   )
    AS2(    and   esi, 4278190080                                       )

    AS2(    mov   edi, ecx                                              )
    AS2(    shr   edi, 16                                               )
    AS2(    and   edi, 255                                              )
    AS2(    mov   edi, DWORD PTR [ebp + 4096 + edi*4]                   )
    AS2(    and   edi, 16711680                                         )
    AS2(    xor   esi, edi                                              )

    AS2(    movzx edi, dh                                               )
    AS2(    mov   edi, DWORD PTR [ebp + 4096 + edi*4]                   )
    AS2(    and   edi, 65280                                            )
    AS2(    xor   esi, edi                                              )

    AS2(    movzx edi, al                                               )
    AS2(    mov   edi, DWORD PTR [ebp + 4096 + edi*4]                   )
    AS2(    and   edi, 255                                              )
    AS2(    xor   esi, edi                                              )

    AS2(    movd  mm1, esi                                              )

            /*
            Put2 (mm2) =
                (Te4[get2, rs24] & 0xff000000) ^  h = 4278190080
                (Te4[get3, rs16] & 0x00ff0000) ^  h =   16711680
                (Te4[get0, rs 8] & 0x0000ff00) ^  h =      65280
                (Te4[get1, rs 0] & 0x000000ff)    h =        255
            */
    AS2(    mov   esi, ecx                                              )
    AS2(    shr   esi, 24                                               )
    AS2(    mov   esi, DWORD PTR [ebp + 4096 + esi*4]                   )
    AS2(    and   esi, 4278190080                                       )

    AS2(    mov   edi, edx                                              )
    AS2(    shr   edi, 16                                               )
    AS2(    and   edi, 255                                              )
    AS2(    mov   edi, DWORD PTR [ebp + 4096 + edi*4]                   )
    AS2(    and   edi, 16711680                                         )
    AS2(    xor   esi, edi                                              )

    AS2(    movzx edi, ah                                               )
    AS2(    mov   edi, DWORD PTR [ebp + 4096 + edi*4]                   )
    AS2(    and   edi, 65280                                            )
    AS2(    xor   esi, edi                                              )

    AS2(    movzx edi, bl                                               )
    AS2(    mov   edi, DWORD PTR [ebp + 4096 + edi*4]                   )
    AS2(    and   edi, 255                                              )
    AS2(    xor   esi, edi                                              )

    AS2(    movd  mm2, esi                                              )

            /*
            Put3 (edx) =
                (Te4[get3, rs24] & 0xff000000) ^  h = 4278190080
                (Te4[get0, rs16] & 0x00ff0000) ^  h =   16711680
                (Te4[get1, rs 8] & 0x0000ff00) ^  h =      65280
                (Te4[get2, rs 0] & 0x000000ff)    h =        255
            */
    AS2(    mov   esi, edx                                              )
    AS2(    shr   esi, 24                                               )
    AS2(    mov   edx, DWORD PTR [ebp + 4096 + esi*4]                   )
    AS2(    and   edx, 4278190080                                       )

    AS2(    mov   edi, eax                                              )
    AS2(    shr   edi, 16                                               )
    AS2(    and   edi, 255                                              )
    AS2(    mov   esi, DWORD PTR [ebp + 4096 + edi*4]                   )
    AS2(    and   esi, 16711680                                         )
    AS2(    xor   edx, esi                                              )

    AS2(    movzx esi, bh                                               )
    AS2(    mov   edi, DWORD PTR [ebp + 4096 + esi*4]                   )
    AS2(    and   edi, 65280                                            )
    AS2(    xor   edx, edi                                              )

    AS2(    movzx edi, cl                                               )
    AS2(    mov   esi, DWORD PTR [ebp + 4096 + edi*4]                   )
    AS2(    and   esi, 255                                              )
    AS2(    xor   edx, esi                                              )

    
            // xOr
    AS2(    movd   eax, mm0                                             )
    AS2(    movd   esi, mm6                      )   //  rk
    AS2(    movd   ebx, mm1                                             )
    AS2(    add    esi, 16                                               )
    AS2(    movd   ecx, mm2                                             )

    AS2(    xor   eax, DWORD PTR [esi]                                  )
    AS2(    xor   ebx, DWORD PTR [esi +  4]                             )
    AS2(    xor   ecx, DWORD PTR [esi +  8]                             )
    AS2(    xor   edx, DWORD PTR [esi + 12]                             )

    // end
    AS2(    movd  ebp, mm7                                              )

            // swap
    AS1(    bswap eax                                                   )
    AS1(    bswap ebx                                                   )

            // store
    #ifdef __GNUC__
        AS2(    movd esi, mm4                       )   //  outBlock
    #else
        AS2(    mov  esi, DWORD PTR [ebp + 12]      )   //  outBlock
    #endif

    AS1(    bswap ecx                                                   )
    AS1(    bswap edx                                                   )

    AS2(    mov DWORD PTR [esi],      eax                               )
    AS2(    mov DWORD PTR [esi +  4], ebx                               )
    AS2(    mov DWORD PTR [esi +  8], ecx                               )
    AS2(    mov DWORD PTR [esi + 12], edx                               )


    EPILOG()
}


#ifdef _MSC_VER
    __declspec(naked) 
#else
    __attribute__ ((noinline))
#endif
void AES::AsmDecrypt(const byte* inBlock, byte* outBlock, void* boxes) const
{

    PROLOG()

    #ifdef OLD_GCC_OFFSET
        AS2(    mov   edx, DWORD PTR [ecx + 60]     )   // rounds
        AS2(    lea   edi, [ecx + 64]               )   // rk 
    #else
        AS2(    mov   edx, DWORD PTR [ecx + 56]     )   // rounds
        AS2(    lea   edi, [ecx + 60]               )   // rk 
    #endif
   
    AS1(    dec   edx                           )
    AS2(    movd  mm6, edi                      )   // save rk
    AS2(    movd  mm5, edx                      )   // save rounds

    AS2(    mov   eax, DWORD PTR [esi]                                  )
    AS2(    mov   ebx, DWORD PTR [esi + 4]                              )
    AS2(    mov   ecx, DWORD PTR [esi + 8]                              )
    AS2(    mov   edx, DWORD PTR [esi + 12]                             )

    AS1(    bswap eax                                                   )
    AS1(    bswap ebx                                                   )
    AS1(    bswap ecx                                                   )
    AS1(    bswap edx                                                   )

    AS2(    xor   eax, DWORD PTR [edi]               )   // s0
    AS2(    xor   ebx, DWORD PTR [edi +  4]          )   // s1
    AS2(    xor   ecx, DWORD PTR [edi +  8]          )   // s2
    AS2(    xor   edx, DWORD PTR [edi + 12]          )   // s3


#ifdef _MSC_VER
    AS1( loop2: )  // loop2
#else
    AS1(2:  )      // loop2
#endif
       /*   Put0 (mm0) =
            Td0[GETBYTE(get0, rs24)] ^
            Td1[GETBYTE(get3, rs16)] ^
            Td2[GETBYTE(get2, rs 8)] ^
            Td3[GETBYTE(tet1,     )]  
        */
    AS2(    mov   esi, eax                                              )
    AS2(    shr   esi, 24                                               )
    AS2(    mov   esi, DWORD PTR [ebp + esi*4]                          )
                                                    
    AS2(    mov   edi, edx                                              )
    AS2(    shr   edi, 16                                               )
    AS2(    and   edi, 255                                              )
    AS2(    xor   esi, DWORD PTR [ebp + 1024 + edi*4]                   )

    AS2(    movzx edi, ch                                               )
    AS2(    xor   esi, DWORD PTR [ebp + 2048 + edi*4]                   )

    AS2(    movzx edi, bl                                               )
    AS2(    xor   esi, DWORD PTR [ebp + 3072 + edi*4]                   )

    AS2(    movd  mm0, esi                                              )

      /*    Put1 (mm1) =
            Td0[GETBYTE(get1, rs24)] ^
            Td1[GETBYTE(get0, rs16)] ^
            Td2[GETBYTE(get3, rs 8)] ^
            Td3[GETBYTE(tet2,     )]  
        */
    AS2(    mov   esi, ebx                                              )
    AS2(    shr   esi, 24                                               )
    AS2(    mov   esi, DWORD PTR [ebp + esi*4]                          )
                                                    
    AS2(    mov   edi, eax                                              )
    AS2(    shr   edi, 16                                               )
    AS2(    and   edi, 255                                              )
    AS2(    xor   esi, DWORD PTR [ebp + 1024 + edi*4]                   )

    AS2(    movzx edi, dh                                               )
    AS2(    xor   esi, DWORD PTR [ebp + 2048 + edi*4]                   )

    AS2(    movzx edi, cl                                               )
    AS2(    xor   esi, DWORD PTR [ebp + 3072 + edi*4]                   )

    AS2(    movd  mm1, esi                                              )

      /*    Put2 (mm2) =
            Td0[GETBYTE(get2, rs24)] ^
            Td1[GETBYTE(get1, rs16)] ^
            Td2[GETBYTE(get0, rs 8)] ^
            Td3[GETBYTE(tet3,     )]  
      */
    AS2(    mov   esi, ecx                                              )
    AS2(    shr   esi, 24                                               )
    AS2(    mov   esi, DWORD PTR [ebp + esi*4]                          )
                                                    
    AS2(    mov   edi, ebx                                              )
    AS2(    shr   edi, 16                                               )
    AS2(    and   edi, 255                                              )
    AS2(    xor   esi, DWORD PTR [ebp + 1024 + edi*4]                   )

    AS2(    movzx edi, ah                                               )
    AS2(    xor   esi, DWORD PTR [ebp + 2048 + edi*4]                   )

    AS2(    movzx edi, dl                                               )
    AS2(    xor   esi, DWORD PTR [ebp + 3072 + edi*4]                   )

    AS2(    movd  mm2, esi                                              )

      /*    Put3 (edx) =
            Td0[GETBYTE(get3, rs24)] ^
            Td1[GETBYTE(get2, rs16)] ^
            Td2[GETBYTE(get1, rs 8)] ^
            Td3[GETBYTE(tet0,     )]  
      */
    AS2(    mov   esi, edx                                              )
    AS2(    shr   esi, 24                                               )
    AS2(    mov   edx, DWORD PTR [ebp + esi*4]                          )
                                                    
    AS2(    mov   edi, ecx                                              )
    AS2(    shr   edi, 16                                               )
    AS2(    and   edi, 255                                              )
    AS2(    xor   edx, DWORD PTR [ebp + 1024 + edi*4]                   )

    AS2(    movzx esi, bh                                               )
    AS2(    xor   edx, DWORD PTR [ebp + 2048 + esi*4]                   )

    AS2(    movzx edi, al                                               )
    AS2(    xor   edx, DWORD PTR [ebp + 3072 + edi*4]                   )


            // xOr

    AS2(    movd  esi, mm6                      )   //  rk
    AS2(    add   esi, 16                                               )
    AS2(    movd  mm6, esi                      )   //  save back

    AS2(    movd  eax, mm0                                              )
    AS2(    movd  ebx, mm1                                              )
    AS2(    movd  ecx, mm2                                              )

    AS2(    xor   eax, DWORD PTR [esi]                                  )
    AS2(    xor   ebx, DWORD PTR [esi +  4]                             )
    AS2(    xor   ecx, DWORD PTR [esi +  8]                             )
    AS2(    xor   edx, DWORD PTR [esi + 12]                             )

    AS2(    movd  edi, mm5                                              )
    AS1(    dec   edi                                                   )
    AS2(    movd  mm5, edi                                              )

#ifdef _MSC_VER
    AS1(    jnz   loop2)  // loop2
#else
    AS1(    jnz   2b )    // loop2
#endif

            // last round