Synchronised line endinge with release branch

1 files changed, 1233 insertions, 1233 deletions

diff --git a/openssl/engines/e_padlock.c b/openssl/engines/e_padlock.c
index dbeff3bb8..7d0941980 100644
--- a/openssl/engines/e_padlock.c
+++ b/openssl/engines/e_padlock.c
@@ -1,1233 +1,1233 @@
-/* 

- * Support for VIA PadLock Advanced Cryptography Engine (ACE)

- * Written by Michal Ludvig <michal@logix.cz>

- *            http://www.logix.cz/michal

- *

- * Big thanks to Andy Polyakov for a help with optimization, 

- * assembler fixes, port to MS Windows and a lot of other 

- * valuable work on this engine!

- */

-

-/* ====================================================================

- * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.

- *

- * Redistribution and use in source and binary forms, with or without

- * modification, are permitted provided that the following conditions

- * are met:

- *

- * 1. Redistributions of source code must retain the above copyright

- *    notice, this list of conditions and the following disclaimer.

- *

- * 2. Redistributions in binary form must reproduce the above copyright

- *    notice, this list of conditions and the following disclaimer in

- *    the documentation and/or other materials provided with the

- *    distribution.

- *

- * 3. All advertising materials mentioning features or use of this

- *    software must display the following acknowledgment:

- *    "This product includes software developed by the OpenSSL Project

- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

- *

- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

- *    endorse or promote products derived from this software without

- *    prior written permission. For written permission, please contact

- *    licensing@OpenSSL.org.

- *

- * 5. Products derived from this software may not be called "OpenSSL"

- *    nor may "OpenSSL" appear in their names without prior written

- *    permission of the OpenSSL Project.

- *

- * 6. Redistributions of any form whatsoever must retain the following

- *    acknowledgment:

- *    "This product includes software developed by the OpenSSL Project

- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

- *

- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

- * OF THE POSSIBILITY OF SUCH DAMAGE.

- * ====================================================================

- *

- * This product includes cryptographic software written by Eric Young

- * (eay@cryptsoft.com).  This product includes software written by Tim

- * Hudson (tjh@cryptsoft.com).

- *

- */

-

-

-#include <stdio.h>

-#include <string.h>

-

-#include <openssl/opensslconf.h>

-#include <openssl/crypto.h>

-#include <openssl/dso.h>

-#include <openssl/engine.h>

-#include <openssl/evp.h>

-#ifndef OPENSSL_NO_AES

-#include <openssl/aes.h>

-#endif

-#include <openssl/rand.h>

-#include <openssl/err.h>

-

-#ifndef OPENSSL_NO_HW

-#ifndef OPENSSL_NO_HW_PADLOCK

-

-/* Attempt to have a single source for both 0.9.7 and 0.9.8 :-) */

-#if (OPENSSL_VERSION_NUMBER >= 0x00908000L)

-#  ifndef OPENSSL_NO_DYNAMIC_ENGINE

-#    define DYNAMIC_ENGINE

-#  endif

-#elif (OPENSSL_VERSION_NUMBER >= 0x00907000L)

-#  ifdef ENGINE_DYNAMIC_SUPPORT

-#    define DYNAMIC_ENGINE

-#  endif

-#else

-#  error "Only OpenSSL >= 0.9.7 is supported"

-#endif

-

-/* VIA PadLock AES is available *ONLY* on some x86 CPUs.

-   Not only that it doesn't exist elsewhere, but it

-   even can't be compiled on other platforms!

- 

-   In addition, because of the heavy use of inline assembler,

-   compiler choice is limited to GCC and Microsoft C. */

-#undef COMPILE_HW_PADLOCK

-#if !defined(I386_ONLY) && !defined(OPENSSL_NO_INLINE_ASM)

-# if (defined(__GNUC__) && (defined(__i386__) || defined(__i386))) || \

-     (defined(_MSC_VER) && defined(_M_IX86))

-#  define COMPILE_HW_PADLOCK

-static ENGINE *ENGINE_padlock (void);

-# endif

-#endif

-

-#ifdef OPENSSL_NO_DYNAMIC_ENGINE

-

-void ENGINE_load_padlock (void)

-{

-/* On non-x86 CPUs it just returns. */

-#ifdef COMPILE_HW_PADLOCK

-	ENGINE *toadd = ENGINE_padlock ();

-	if (!toadd) return;

-	ENGINE_add (toadd);

-	ENGINE_free (toadd);

-	ERR_clear_error ();

-#endif

-}

-

-#endif

-

-#ifdef COMPILE_HW_PADLOCK

-/* We do these includes here to avoid header problems on platforms that

-   do not have the VIA padlock anyway... */

-#include <stdlib.h>

-#ifdef _WIN32

-# include <malloc.h>

-# ifndef alloca

-#  define alloca _alloca

-# endif

-#elif defined(__GNUC__)

-# ifndef alloca

-#  define alloca(s) __builtin_alloca(s)

-# endif

-#endif

-

-/* Function for ENGINE detection and control */

-static int padlock_available(void);

-static int padlock_init(ENGINE *e);

-

-/* RNG Stuff */

-static RAND_METHOD padlock_rand;

-

-/* Cipher Stuff */

-#ifndef OPENSSL_NO_AES

-static int padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid);

-#endif

-

-/* Engine names */

-static const char *padlock_id = "padlock";

-static char padlock_name[100];

-

-/* Available features */

-static int padlock_use_ace = 0;	/* Advanced Cryptography Engine */

-static int padlock_use_rng = 0;	/* Random Number Generator */

-#ifndef OPENSSL_NO_AES

-static int padlock_aes_align_required = 1;

-#endif

-

-/* ===== Engine "management" functions ===== */

-

-/* Prepare the ENGINE structure for registration */

-static int

-padlock_bind_helper(ENGINE *e)

-{

-	/* Check available features */

-	padlock_available();

-

-#if 1	/* disable RNG for now, see commentary in vicinity of RNG code */

-	padlock_use_rng=0;

-#endif

-

-	/* Generate a nice engine name with available features */

-	BIO_snprintf(padlock_name, sizeof(padlock_name),

-		"VIA PadLock (%s, %s)", 

-		 padlock_use_rng ? "RNG" : "no-RNG",

-		 padlock_use_ace ? "ACE" : "no-ACE");

-

-	/* Register everything or return with an error */ 

-	if (!ENGINE_set_id(e, padlock_id) ||

-	    !ENGINE_set_name(e, padlock_name) ||

-

-	    !ENGINE_set_init_function(e, padlock_init) ||

-#ifndef OPENSSL_NO_AES

-	    (padlock_use_ace && !ENGINE_set_ciphers (e, padlock_ciphers)) ||

-#endif

-	    (padlock_use_rng && !ENGINE_set_RAND (e, &padlock_rand))) {

-		return 0;

-	}

-

-	/* Everything looks good */

-	return 1;

-}

-

-/* Constructor */

-static ENGINE *

-ENGINE_padlock(void)

-{

-	ENGINE *eng = ENGINE_new();

-

-	if (!eng) {

-		return NULL;

-	}

-

-	if (!padlock_bind_helper(eng)) {

-		ENGINE_free(eng);

-		return NULL;

-	}

-

-	return eng;

-}

-

-/* Check availability of the engine */

-static int

-padlock_init(ENGINE *e)

-{

-	return (padlock_use_rng || padlock_use_ace);

-}

-

-/* This stuff is needed if this ENGINE is being compiled into a self-contained

- * shared-library.

- */

-#ifdef DYNAMIC_ENGINE

-static int

-padlock_bind_fn(ENGINE *e, const char *id)

-{

-	if (id && (strcmp(id, padlock_id) != 0)) {

-		return 0;

-	}

-

-	if (!padlock_bind_helper(e))  {

-		return 0;

-	}

-

-	return 1;

-}

-

-IMPLEMENT_DYNAMIC_CHECK_FN()

-IMPLEMENT_DYNAMIC_BIND_FN (padlock_bind_fn)

-#endif /* DYNAMIC_ENGINE */

-

-/* ===== Here comes the "real" engine ===== */

-

-#ifndef OPENSSL_NO_AES

-/* Some AES-related constants */

-#define AES_BLOCK_SIZE		16

-#define AES_KEY_SIZE_128	16

-#define AES_KEY_SIZE_192	24

-#define AES_KEY_SIZE_256	32

-

-/* Here we store the status information relevant to the 

-   current context. */

-/* BIG FAT WARNING:

- * 	Inline assembler in PADLOCK_XCRYPT_ASM()

- * 	depends on the order of items in this structure.

- * 	Don't blindly modify, reorder, etc!

- */

-struct padlock_cipher_data

-{

-	unsigned char iv[AES_BLOCK_SIZE];	/* Initialization vector */

-	union {	unsigned int pad[4];

-		struct {

-			int rounds:4;

-			int dgst:1;	/* n/a in C3 */

-			int align:1;	/* n/a in C3 */

-			int ciphr:1;	/* n/a in C3 */

-			unsigned int keygen:1;

-			int interm:1;

-			unsigned int encdec:1;

-			int ksize:2;

-		} b;

-	} cword;		/* Control word */

-	AES_KEY ks;		/* Encryption key */

-};

-

-/*

- * Essentially this variable belongs in thread local storage.

- * Having this variable global on the other hand can only cause

- * few bogus key reloads [if any at all on single-CPU system],

- * so we accept the penatly...

- */

-static volatile struct padlock_cipher_data *padlock_saved_context;

-#endif

-

-/*

- * =======================================================

- * Inline assembler section(s).

- * =======================================================

- * Order of arguments is chosen to facilitate Windows port

- * using __fastcall calling convention. If you wish to add

- * more routines, keep in mind that first __fastcall

- * argument is passed in %ecx and second - in %edx.

- * =======================================================

- */

-#if defined(__GNUC__) && __GNUC__>=2

-/*

- * As for excessive "push %ebx"/"pop %ebx" found all over.

- * When generating position-independent code GCC won't let

- * us use "b" in assembler templates nor even respect "ebx"

- * in "clobber description." Therefore the trouble...

- */

-

-/* Helper function - check if a CPUID instruction

-   is available on this CPU */

-static int

-padlock_insn_cpuid_available(void)

-{

-	int result = -1;

-

-	/* We're checking if the bit #21 of EFLAGS 

-	   can be toggled. If yes = CPUID is available. */

-	asm volatile (

-		"pushf\n"

-		"popl %%eax\n"

-		"xorl $0x200000, %%eax\n"

-		"movl %%eax, %%ecx\n"

-		"andl $0x200000, %%ecx\n"

-		"pushl %%eax\n"

-		"popf\n"

-		"pushf\n"

-		"popl %%eax\n"

-		"andl $0x200000, %%eax\n"

-		"xorl %%eax, %%ecx\n"

-		"movl %%ecx, %0\n"

-		: "=r" (result) : : "eax", "ecx");

-	

-	return (result == 0);

-}

-

-/* Load supported features of the CPU to see if

-   the PadLock is available. */

-static int

-padlock_available(void)

-{

-	char vendor_string[16];

-	unsigned int eax, edx;

-

-	/* First check if the CPUID instruction is available at all... */

-	if (! padlock_insn_cpuid_available())

-		return 0;

-

-	/* Are we running on the Centaur (VIA) CPU? */

-	eax = 0x00000000;

-	vendor_string[12] = 0;

-	asm volatile (

-		"pushl	%%ebx\n"

-		"cpuid\n"

-		"movl	%%ebx,(%%edi)\n"

-		"movl	%%edx,4(%%edi)\n"

-		"movl	%%ecx,8(%%edi)\n"

-		"popl	%%ebx"

-		: "+a"(eax) : "D"(vendor_string) : "ecx", "edx");

-	if (strcmp(vendor_string, "CentaurHauls") != 0)

-		return 0;

-

-	/* Check for Centaur Extended Feature Flags presence */

-	eax = 0xC0000000;

-	asm volatile ("pushl %%ebx; cpuid; popl	%%ebx"

-		: "+a"(eax) : : "ecx", "edx");

-	if (eax < 0xC0000001)

-		return 0;

-

-	/* Read the Centaur Extended Feature Flags */

-	eax = 0xC0000001;

-	asm volatile ("pushl %%ebx; cpuid; popl %%ebx"

-		: "+a"(eax), "=d"(edx) : : "ecx");

-

-	/* Fill up some flags */

-	padlock_use_ace = ((edx & (0x3<<6)) == (0x3<<6));

-	padlock_use_rng = ((edx & (0x3<<2)) == (0x3<<2));

-

-	return padlock_use_ace + padlock_use_rng;

-}

-

-#ifndef OPENSSL_NO_AES

-/* Our own htonl()/ntohl() */

-static inline void

-padlock_bswapl(AES_KEY *ks)

-{

-	size_t i = sizeof(ks->rd_key)/sizeof(ks->rd_key[0]);

-	unsigned int *key = ks->rd_key;

-

-	while (i--) {

-		asm volatile ("bswapl %0" : "+r"(*key));

-		key++;

-	}

-}

-#endif

-

-/* Force key reload from memory to the CPU microcode.

-   Loading EFLAGS from the stack clears EFLAGS[30] 

-   which does the trick. */

-static inline void

-padlock_reload_key(void)

-{

-	asm volatile ("pushfl; popfl");

-}

-

-#ifndef OPENSSL_NO_AES

-/*

- * This is heuristic key context tracing. At first one

- * believes that one should use atomic swap instructions,

- * but it's not actually necessary. Point is that if

- * padlock_saved_context was changed by another thread

- * after we've read it and before we compare it with cdata,

- * our key *shall* be reloaded upon thread context switch

- * and we are therefore set in either case...

- */

-static inline void

-padlock_verify_context(struct padlock_cipher_data *cdata)

-{

-	asm volatile (

-	"pushfl\n"

-"	btl	$30,(%%esp)\n"

-"	jnc	1f\n"

-"	cmpl	%2,%1\n"

-"	je	1f\n"

-"	popfl\n"

-"	subl	$4,%%esp\n"

-"1:	addl	$4,%%esp\n"

-"	movl	%2,%0"

-	:"+m"(padlock_saved_context)

-	: "r"(padlock_saved_context), "r"(cdata) : "cc");

-}

-

-/* Template for padlock_xcrypt_* modes */

-/* BIG FAT WARNING: 

- * 	The offsets used with 'leal' instructions

- * 	describe items of the 'padlock_cipher_data'

- * 	structure.

- */

-#define PADLOCK_XCRYPT_ASM(name,rep_xcrypt)	\

-static inline void *name(size_t cnt,		\

-	struct padlock_cipher_data *cdata,	\

-	void *out, const void *inp) 		\

-{	void *iv; 				\

-	asm volatile ( "pushl	%%ebx\n"	\

-		"	leal	16(%0),%%edx\n"	\

-		"	leal	32(%0),%%ebx\n"	\

-			rep_xcrypt "\n"		\

-		"	popl	%%ebx"		\

-		: "=a"(iv), "=c"(cnt), "=D"(out), "=S"(inp) \

-		: "0"(cdata), "1"(cnt), "2"(out), "3"(inp)  \

-		: "edx", "cc", "memory");	\

-	return iv;				\

-}

-

-/* Generate all functions with appropriate opcodes */

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb, ".byte 0xf3,0x0f,0xa7,0xc8")	/* rep xcryptecb */

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc, ".byte 0xf3,0x0f,0xa7,0xd0")	/* rep xcryptcbc */

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb, ".byte 0xf3,0x0f,0xa7,0xe0")	/* rep xcryptcfb */

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb, ".byte 0xf3,0x0f,0xa7,0xe8")	/* rep xcryptofb */

-#endif

-

-/* The RNG call itself */

-static inline unsigned int

-padlock_xstore(void *addr, unsigned int edx_in)

-{

-	unsigned int eax_out;

-

-	asm volatile (".byte 0x0f,0xa7,0xc0"	/* xstore */

-	    : "=a"(eax_out),"=m"(*(unsigned *)addr)

-	    : "D"(addr), "d" (edx_in)

-	    );

-

-	return eax_out;

-}

-

-/* Why not inline 'rep movsd'? I failed to find information on what

- * value in Direction Flag one can expect and consequently have to

- * apply "better-safe-than-sorry" approach and assume "undefined."

- * I could explicitly clear it and restore the original value upon

- * return from padlock_aes_cipher, but it's presumably too much

- * trouble for too little gain...

- *

- * In case you wonder 'rep xcrypt*' instructions above are *not*

- * affected by the Direction Flag and pointers advance toward

- * larger addresses unconditionally.

- */ 

-static inline unsigned char *

-padlock_memcpy(void *dst,const void *src,size_t n)

-{

-	long       *d=dst;

-	const long *s=src;

-

-	n /= sizeof(*d);

-	do { *d++ = *s++; } while (--n);

-

-	return dst;

-}

-

-#elif defined(_MSC_VER)

-/*

- * Unlike GCC these are real functions. In order to minimize impact

- * on performance we adhere to __fastcall calling convention in

- * order to get two first arguments passed through %ecx and %edx.

- * Which kind of suits very well, as instructions in question use

- * both %ecx and %edx as input:-)

- */

-#define REP_XCRYPT(code)		\

-	_asm _emit 0xf3			\

-	_asm _emit 0x0f _asm _emit 0xa7	\

-	_asm _emit code

-

-/* BIG FAT WARNING: 

- * 	The offsets used with 'lea' instructions

- * 	describe items of the 'padlock_cipher_data'

- * 	structure.

- */

-#define PADLOCK_XCRYPT_ASM(name,code)	\

-static void * __fastcall 		\

-	name (size_t cnt, void *cdata,	\

-	void *outp, const void *inp)	\

-{	_asm	mov	eax,edx		\

-	_asm	lea	edx,[eax+16]	\

-	_asm	lea	ebx,[eax+32]	\

-	_asm	mov	edi,outp	\

-	_asm	mov	esi,inp		\

-	REP_XCRYPT(code)		\

-}

-

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb,0xc8)

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc,0xd0)

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb,0xe0)

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb,0xe8)

-

-static int __fastcall

-padlock_xstore(void *outp,unsigned int code)

-{	_asm	mov	edi,ecx

-	_asm _emit 0x0f _asm _emit 0xa7 _asm _emit 0xc0

-}

-

-static void __fastcall

-padlock_reload_key(void)

-{	_asm pushfd _asm popfd		}

-

-static void __fastcall

-padlock_verify_context(void *cdata)

-{	_asm	{

-		pushfd

-		bt	DWORD PTR[esp],30

-		jnc	skip

-		cmp	ecx,padlock_saved_context

-		je	skip

-		popfd

-		sub	esp,4

-	skip:	add	esp,4

-		mov	padlock_saved_context,ecx

-		}

-}

-

-static int

-padlock_available(void)

-{	_asm	{

-		pushfd

-		pop	eax

-		mov	ecx,eax

-		xor	eax,1<<21

-		push	eax

-		popfd

-		pushfd

-		pop	eax

-		xor	eax,ecx

-		bt	eax,21

-		jnc	noluck

-		mov	eax,0

-		cpuid

-		xor	eax,eax

-		cmp	ebx,'tneC'

-		jne	noluck

-		cmp	edx,'Hrua'

-		jne	noluck

-		cmp	ecx,'slua'

-		jne	noluck

-		mov	eax,0xC0000000

-		cpuid

-		mov	edx,eax

-		xor	eax,eax

-		cmp	edx,0xC0000001

-		jb	noluck

-		mov	eax,0xC0000001

-		cpuid

-		xor	eax,eax

-		bt	edx,6

-		jnc	skip_a

-		bt	edx,7

-		jnc	skip_a

-		mov	padlock_use_ace,1

-		inc	eax

-	skip_a:	bt	edx,2

-		jnc	skip_r

-		bt	edx,3

-		jnc	skip_r

-		mov	padlock_use_rng,1

-		inc	eax

-	skip_r:

-	noluck:

-		}

-}

-

-static void __fastcall

-padlock_bswapl(void *key)

-{	_asm	{

-		pushfd

-		cld

-		mov	esi,ecx

-		mov	edi,ecx

-		mov	ecx,60

-	up:	lodsd

-		bswap	eax

-		stosd

-		loop	up

-		popfd

-		}

-}

-

-/* MS actually specifies status of Direction Flag and compiler even

- * manages to compile following as 'rep movsd' all by itself...

- */

-#define padlock_memcpy(o,i,n) ((unsigned char *)memcpy((o),(i),(n)&~3U))

-#endif

-

-/* ===== AES encryption/decryption ===== */

-#ifndef OPENSSL_NO_AES

-

-#if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb)

-#define NID_aes_128_cfb	NID_aes_128_cfb128

-#endif

-

-#if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb)

-#define NID_aes_128_ofb	NID_aes_128_ofb128

-#endif

-

-#if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb)

-#define NID_aes_192_cfb	NID_aes_192_cfb128

-#endif

-

-#if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb)

-#define NID_aes_192_ofb	NID_aes_192_ofb128

-#endif

-

-#if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb)

-#define NID_aes_256_cfb	NID_aes_256_cfb128

-#endif

-

-#if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb)

-#define NID_aes_256_ofb	NID_aes_256_ofb128

-#endif

-

-/* List of supported ciphers. */

-static int padlock_cipher_nids[] = {

-	NID_aes_128_ecb,

-	NID_aes_128_cbc,

-	NID_aes_128_cfb,

-	NID_aes_128_ofb,

-

-	NID_aes_192_ecb,

-	NID_aes_192_cbc,

-	NID_aes_192_cfb,

-	NID_aes_192_ofb,

-

-	NID_aes_256_ecb,

-	NID_aes_256_cbc,

-	NID_aes_256_cfb,

-	NID_aes_256_ofb,

-};

-static int padlock_cipher_nids_num = (sizeof(padlock_cipher_nids)/

-				      sizeof(padlock_cipher_nids[0]));

-

-/* Function prototypes ... */

-static int padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,

-				const unsigned char *iv, int enc);

-static int padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

-			      const unsigned char *in, size_t nbytes);

-

-#define NEAREST_ALIGNED(ptr) ( (unsigned char *)(ptr) +		\

-	( (0x10 - ((size_t)(ptr) & 0x0F)) & 0x0F )	)

-#define ALIGNED_CIPHER_DATA(ctx) ((struct padlock_cipher_data *)\

-	NEAREST_ALIGNED(ctx->cipher_data))

-

-#define EVP_CIPHER_block_size_ECB	AES_BLOCK_SIZE

-#define EVP_CIPHER_block_size_CBC	AES_BLOCK_SIZE

-#define EVP_CIPHER_block_size_OFB	1

-#define EVP_CIPHER_block_size_CFB	1

-

-/* Declaring so many ciphers by hand would be a pain.

-   Instead introduce a bit of preprocessor magic :-) */

-#define	DECLARE_AES_EVP(ksize,lmode,umode)	\

-static const EVP_CIPHER padlock_aes_##ksize##_##lmode = {	\

-	NID_aes_##ksize##_##lmode,		\

-	EVP_CIPHER_block_size_##umode,	\

-	AES_KEY_SIZE_##ksize,		\

-	AES_BLOCK_SIZE,			\

-	0 | EVP_CIPH_##umode##_MODE,	\

-	padlock_aes_init_key,		\

-	padlock_aes_cipher,		\

-	NULL,				\

-	sizeof(struct padlock_cipher_data) + 16,	\

-	EVP_CIPHER_set_asn1_iv,		\

-	EVP_CIPHER_get_asn1_iv,		\

-	NULL,				\

-	NULL				\

-}

-

-DECLARE_AES_EVP(128,ecb,ECB);

-DECLARE_AES_EVP(128,cbc,CBC);

-DECLARE_AES_EVP(128,cfb,CFB);

-DECLARE_AES_EVP(128,ofb,OFB);

-

-DECLARE_AES_EVP(192,ecb,ECB);

-DECLARE_AES_EVP(192,cbc,CBC);

-DECLARE_AES_EVP(192,cfb,CFB);

-DECLARE_AES_EVP(192,ofb,OFB);

-

-DECLARE_AES_EVP(256,ecb,ECB);

-DECLARE_AES_EVP(256,cbc,CBC);

-DECLARE_AES_EVP(256,cfb,CFB);

-DECLARE_AES_EVP(256,ofb,OFB);

-

-static int

-padlock_ciphers (ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid)

-{

-	/* No specific cipher => return a list of supported nids ... */

-	if (!cipher) {

-		*nids = padlock_cipher_nids;

-		return padlock_cipher_nids_num;

-	}

-

-	/* ... or the requested "cipher" otherwise */

-	switch (nid) {

-	  case NID_aes_128_ecb:

-	    *cipher = &padlock_aes_128_ecb;

-	    break;

-	  case NID_aes_128_cbc:

-	    *cipher = &padlock_aes_128_cbc;

-	    break;

-	  case NID_aes_128_cfb:

-	    *cipher = &padlock_aes_128_cfb;

-	    break;

-	  case NID_aes_128_ofb:

-	    *cipher = &padlock_aes_128_ofb;

-	    break;

-

-	  case NID_aes_192_ecb:

-	    *cipher = &padlock_aes_192_ecb;

-	    break;

-	  case NID_aes_192_cbc:

-	    *cipher = &padlock_aes_192_cbc;

-	    break;

-	  case NID_aes_192_cfb:

-	    *cipher = &padlock_aes_192_cfb;

-	    break;

-	  case NID_aes_192_ofb:

-	    *cipher = &padlock_aes_192_ofb;

-	    break;

-

-	  case NID_aes_256_ecb:

-	    *cipher = &padlock_aes_256_ecb;

-	    break;

-	  case NID_aes_256_cbc:

-	    *cipher = &padlock_aes_256_cbc;

-	    break;

-	  case NID_aes_256_cfb:

-	    *cipher = &padlock_aes_256_cfb;

-	    break;

-	  case NID_aes_256_ofb:

-	    *cipher = &padlock_aes_256_ofb;

-	    break;

-

-	  default:

-	    /* Sorry, we don't support this NID */

-	    *cipher = NULL;

-	    return 0;

-	}

-

-	return 1;

-}

-

-/* Prepare the encryption key for PadLock usage */

-static int

-padlock_aes_init_key (EVP_CIPHER_CTX *ctx, const unsigned char *key,

-		      const unsigned char *iv, int enc)

-{

-	struct padlock_cipher_data *cdata;

-	int key_len = EVP_CIPHER_CTX_key_length(ctx) * 8;

-

-	if (key==NULL) return 0;	/* ERROR */

-

-	cdata = ALIGNED_CIPHER_DATA(ctx);

-	memset(cdata, 0, sizeof(struct padlock_cipher_data));

-

-	/* Prepare Control word. */

-	if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE)

-		cdata->cword.b.encdec = 0;

-	else

-		cdata->cword.b.encdec = (ctx->encrypt == 0);

-	cdata->cword.b.rounds = 10 + (key_len - 128) / 32;

-	cdata->cword.b.ksize = (key_len - 128) / 64;

-

-	switch(key_len) {

-		case 128:

-			/* PadLock can generate an extended key for

-			   AES128 in hardware */

-			memcpy(cdata->ks.rd_key, key, AES_KEY_SIZE_128);

-			cdata->cword.b.keygen = 0;

-			break;

-

-		case 192:

-		case 256:

-			/* Generate an extended AES key in software.

-			   Needed for AES192/AES256 */

-			/* Well, the above applies to Stepping 8 CPUs

-			   and is listed as hardware errata. They most

-			   likely will fix it at some point and then

-			   a check for stepping would be due here. */

-			if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CFB_MODE ||

-			    EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE ||

-			    enc)

-				AES_set_encrypt_key(key, key_len, &cdata->ks);

-			else

-				AES_set_decrypt_key(key, key_len, &cdata->ks);

-#ifndef AES_ASM

-			/* OpenSSL C functions use byte-swapped extended key. */

-			padlock_bswapl(&cdata->ks);

-#endif

-			cdata->cword.b.keygen = 1;

-			break;

-

-		default:

-			/* ERROR */

-			return 0;

-	}

-

-	/*

-	 * This is done to cover for cases when user reuses the

-	 * context for new key. The catch is that if we don't do

-	 * this, padlock_eas_cipher might proceed with old key...

-	 */

-	padlock_reload_key ();

-

-	return 1;

-}

-

-/* 

- * Simplified version of padlock_aes_cipher() used when

- * 1) both input and output buffers are at aligned addresses.

- * or when

- * 2) running on a newer CPU that doesn't require aligned buffers.

- */

-static int

-padlock_aes_cipher_omnivorous(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,

-		const unsigned char *in_arg, size_t nbytes)

-{

-	struct padlock_cipher_data *cdata;

-	void  *iv;

-

-	cdata = ALIGNED_CIPHER_DATA(ctx);

-	padlock_verify_context(cdata);

-

-	switch (EVP_CIPHER_CTX_mode(ctx)) {

-	case EVP_CIPH_ECB_MODE:

-		padlock_xcrypt_ecb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);

-		break;

-

-	case EVP_CIPH_CBC_MODE:

-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

-		iv = padlock_xcrypt_cbc(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);

-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);

-		break;

-

-	case EVP_CIPH_CFB_MODE:

-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

-		iv = padlock_xcrypt_cfb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);

-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);

-		break;

-

-	case EVP_CIPH_OFB_MODE:

-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

-		padlock_xcrypt_ofb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);

-		memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);

-		break;

-

-	default:

-		return 0;

-	}

-

-	memset(cdata->iv, 0, AES_BLOCK_SIZE);

-

-	return 1;

-}

-

-#ifndef  PADLOCK_CHUNK

-# define PADLOCK_CHUNK	512	/* Must be a power of 2 larger than 16 */

-#endif

-#if PADLOCK_CHUNK<16 || PADLOCK_CHUNK&(PADLOCK_CHUNK-1)

-# error "insane PADLOCK_CHUNK..."

-#endif

-

-/* Re-align the arguments to 16-Bytes boundaries and run the 

-   encryption function itself. This function is not AES-specific. */

-static int

-padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,

-		   const unsigned char *in_arg, size_t nbytes)

-{

-	struct padlock_cipher_data *cdata;

-	const  void *inp;

-	unsigned char  *out;

-	void  *iv;

-	int    inp_misaligned, out_misaligned, realign_in_loop;

-	size_t chunk, allocated=0;

-

-	/* ctx->num is maintained in byte-oriented modes,

-	   such as CFB and OFB... */

-	if ((chunk = ctx->num)) { /* borrow chunk variable */

-		unsigned char *ivp=ctx->iv;

-

-		switch (EVP_CIPHER_CTX_mode(ctx)) {

-		case EVP_CIPH_CFB_MODE:

-			if (chunk >= AES_BLOCK_SIZE)

-				return 0; /* bogus value */

-

-			if (ctx->encrypt)

-				while (chunk<AES_BLOCK_SIZE && nbytes!=0) {

-					ivp[chunk] = *(out_arg++) = *(in_arg++) ^ ivp[chunk];

-					chunk++, nbytes--;

-				}

-			else	while (chunk<AES_BLOCK_SIZE && nbytes!=0) {

-					unsigned char c = *(in_arg++);

-					*(out_arg++) = c ^ ivp[chunk];

-					ivp[chunk++] = c, nbytes--;

-				}

-

-			ctx->num = chunk%AES_BLOCK_SIZE;

-			break;

-		case EVP_CIPH_OFB_MODE:

-			if (chunk >= AES_BLOCK_SIZE)

-				return 0; /* bogus value */

-

-			while (chunk<AES_BLOCK_SIZE && nbytes!=0) {

-				*(out_arg++) = *(in_arg++) ^ ivp[chunk];

-				chunk++, nbytes--;

-			}

-

-			ctx->num = chunk%AES_BLOCK_SIZE;

-			break;

-		}

-	}

-

-	if (nbytes == 0)

-		return 1;

-#if 0

-	if (nbytes % AES_BLOCK_SIZE)

-		return 0; /* are we expected to do tail processing? */

-#else

-	/* nbytes is always multiple of AES_BLOCK_SIZE in ECB and CBC

-	   modes and arbitrary value in byte-oriented modes, such as

-	   CFB and OFB... */

-#endif

-

-	/* VIA promises CPUs that won't require alignment in the future.

-	   For now padlock_aes_align_required is initialized to 1 and

-	   the condition is never met... */

-	/* C7 core is capable to manage unaligned input in non-ECB[!]

-	   mode, but performance penalties appear to be approximately

-	   same as for software alignment below or ~3x. They promise to

-	   improve it in the future, but for now we can just as well

-	   pretend that it can only handle aligned input... */

-	if (!padlock_aes_align_required && (nbytes%AES_BLOCK_SIZE)==0)

-		return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);

-

-	inp_misaligned = (((size_t)in_arg) & 0x0F);

-	out_misaligned = (((size_t)out_arg) & 0x0F);

-

-	/* Note that even if output is aligned and input not,

-	 * I still prefer to loop instead of copy the whole

-	 * input and then encrypt in one stroke. This is done

-	 * in order to improve L1 cache utilization... */

-	realign_in_loop = out_misaligned|inp_misaligned;

-

-	if (!realign_in_loop && (nbytes%AES_BLOCK_SIZE)==0)

-		return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);

-

-	/* this takes one "if" out of the loops */

-	chunk  = nbytes;

-	chunk %= PADLOCK_CHUNK;

-	if (chunk==0) chunk = PADLOCK_CHUNK;

-

-	if (out_misaligned) {

-		/* optmize for small input */

-		allocated = (chunk<nbytes?PADLOCK_CHUNK:nbytes);

-		out = alloca(0x10 + allocated);

-		out = NEAREST_ALIGNED(out);

-	}

-	else

-		out = out_arg;

-

-	cdata = ALIGNED_CIPHER_DATA(ctx);

-	padlock_verify_context(cdata);

-

-	switch (EVP_CIPHER_CTX_mode(ctx)) {

-	case EVP_CIPH_ECB_MODE:

-		do	{

-			if (inp_misaligned)

-				inp = padlock_memcpy(out, in_arg, chunk);

-			else

-				inp = in_arg;

-			in_arg += chunk;

-

-			padlock_xcrypt_ecb(chunk/AES_BLOCK_SIZE, cdata, out, inp);

-

-			if (out_misaligned)

-				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;

-			else

-				out     = out_arg+=chunk;

-

-			nbytes -= chunk;

-			chunk   = PADLOCK_CHUNK;

-		} while (nbytes);

-		break;

-

-	case EVP_CIPH_CBC_MODE:

-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

-		goto cbc_shortcut;

-		do	{

-			if (iv != cdata->iv)

-				memcpy(cdata->iv, iv, AES_BLOCK_SIZE);

-			chunk = PADLOCK_CHUNK;

-		cbc_shortcut: /* optimize for small input */

-			if (inp_misaligned)

-				inp = padlock_memcpy(out, in_arg, chunk);

-			else

-				inp = in_arg;

-			in_arg += chunk;

-

-			iv = padlock_xcrypt_cbc(chunk/AES_BLOCK_SIZE, cdata, out, inp);

-

-			if (out_misaligned)

-				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;

-			else

-				out     = out_arg+=chunk;

-

-		} while (nbytes -= chunk);

-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);

-		break;

-

-	case EVP_CIPH_CFB_MODE:

-		memcpy (iv = cdata->iv, ctx->iv, AES_BLOCK_SIZE);

-		chunk &= ~(AES_BLOCK_SIZE-1);

-		if (chunk)	goto cfb_shortcut;

-		else		goto cfb_skiploop;

-		do	{

-			if (iv != cdata->iv)

-				memcpy(cdata->iv, iv, AES_BLOCK_SIZE);

-			chunk = PADLOCK_CHUNK;

-		cfb_shortcut: /* optimize for small input */

-			if (inp_misaligned)

-				inp = padlock_memcpy(out, in_arg, chunk);

-			else

-				inp = in_arg;

-			in_arg += chunk;

-

-			iv = padlock_xcrypt_cfb(chunk/AES_BLOCK_SIZE, cdata, out, inp);

-

-			if (out_misaligned)

-				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;

-			else

-				out     = out_arg+=chunk;

-

-			nbytes -= chunk;

-		} while (nbytes >= AES_BLOCK_SIZE);

-

-		cfb_skiploop:

-		if (nbytes) {

-			unsigned char *ivp = cdata->iv;

-

-			if (iv != ivp) {

-				memcpy(ivp, iv, AES_BLOCK_SIZE);

-				iv = ivp;

-			}

-			ctx->num = nbytes;

-			if (cdata->cword.b.encdec) {

-				cdata->cword.b.encdec=0;

-				padlock_reload_key();

-				padlock_xcrypt_ecb(1,cdata,ivp,ivp);

-				cdata->cword.b.encdec=1;

-				padlock_reload_key();

-				while(nbytes) {

-					unsigned char c = *(in_arg++);

-					*(out_arg++) = c ^ *ivp;

-					*(ivp++) = c, nbytes--;

-				}

-			}

-			else {	padlock_reload_key();

-				padlock_xcrypt_ecb(1,cdata,ivp,ivp);

-				padlock_reload_key();

-				while (nbytes) {

-					*ivp = *(out_arg++) = *(in_arg++) ^ *ivp;

-					ivp++, nbytes--;

-				}

-			}

-		}

-

-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);

-		break;

-

-	case EVP_CIPH_OFB_MODE:

-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

-		chunk &= ~(AES_BLOCK_SIZE-1);

-		if (chunk) do	{

-			if (inp_misaligned)

-				inp = padlock_memcpy(out, in_arg, chunk);

-			else

-				inp = in_arg;

-			in_arg += chunk;

-

-			padlock_xcrypt_ofb(chunk/AES_BLOCK_SIZE, cdata, out, inp);

-

-			if (out_misaligned)

-				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;

-			else

-				out     = out_arg+=chunk;

-

-			nbytes -= chunk;

-			chunk   = PADLOCK_CHUNK;

-		} while (nbytes >= AES_BLOCK_SIZE);

-

-		if (nbytes) {

-			unsigned char *ivp = cdata->iv;

-

-			ctx->num = nbytes;

-			padlock_reload_key();	/* empirically found */

-			padlock_xcrypt_ecb(1,cdata,ivp,ivp);

-			padlock_reload_key();	/* empirically found */

-			while (nbytes) {

-				*(out_arg++) = *(in_arg++) ^ *ivp;

-				ivp++, nbytes--;

-			}

-		}

-

-		memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);

-		break;

-

-	default:

-		return 0;

-	}

-

-	/* Clean the realign buffer if it was used */

-	if (out_misaligned) {

-		volatile unsigned long *p=(void *)out;

-		size_t   n = allocated/sizeof(*p);

-		while (n--) *p++=0;

-	}

-

-	memset(cdata->iv, 0, AES_BLOCK_SIZE);

-

-	return 1;

-}

-

-#endif /* OPENSSL_NO_AES */

-

-/* ===== Random Number Generator ===== */

-/*

- * This code is not engaged. The reason is that it does not comply

- * with recommendations for VIA RNG usage for secure applications

- * (posted at http://www.via.com.tw/en/viac3/c3.jsp) nor does it

- * provide meaningful error control...

- */

-/* Wrapper that provides an interface between the API and 

-   the raw PadLock RNG */

-static int

-padlock_rand_bytes(unsigned char *output, int count)

-{

-	unsigned int eax, buf;

-

-	while (count >= 8) {

-		eax = padlock_xstore(output, 0);

-		if (!(eax&(1<<6)))	return 0; /* RNG disabled */

-		/* this ---vv--- covers DC bias, Raw Bits and String Filter */

-		if (eax&(0x1F<<10))	return 0;

-		if ((eax&0x1F)==0)	continue; /* no data, retry... */

-		if ((eax&0x1F)!=8)	return 0; /* fatal failure...  */

-		output += 8;

-		count  -= 8;

-	}

-	while (count > 0) {

-		eax = padlock_xstore(&buf, 3);

-		if (!(eax&(1<<6)))	return 0; /* RNG disabled */

-		/* this ---vv--- covers DC bias, Raw Bits and String Filter */

-		if (eax&(0x1F<<10))	return 0;

-		if ((eax&0x1F)==0)	continue; /* no data, retry... */

-		if ((eax&0x1F)!=1)	return 0; /* fatal failure...  */

-		*output++ = (unsigned char)buf;

-		count--;

-	}

-	*(volatile unsigned int *)&buf=0;

-

-	return 1;

-}

-

-/* Dummy but necessary function */

-static int

-padlock_rand_status(void)

-{

-	return 1;

-}

-

-/* Prepare structure for registration */

-static RAND_METHOD padlock_rand = {

-	NULL,			/* seed */

-	padlock_rand_bytes,	/* bytes */

-	NULL,			/* cleanup */

-	NULL,			/* add */

-	padlock_rand_bytes,	/* pseudorand */

-	padlock_rand_status,	/* rand status */

-};

-

-#else  /* !COMPILE_HW_PADLOCK */

-#ifndef OPENSSL_NO_DYNAMIC_ENGINE

-OPENSSL_EXPORT

-int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);

-OPENSSL_EXPORT

-int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }

-IMPLEMENT_DYNAMIC_CHECK_FN()

-#endif

-#endif /* COMPILE_HW_PADLOCK */

-

-#endif /* !OPENSSL_NO_HW_PADLOCK */

-#endif /* !OPENSSL_NO_HW */

+/* 
+ * Support for VIA PadLock Advanced Cryptography Engine (ACE)
+ * Written by Michal Ludvig <michal@logix.cz>
+ *            http://www.logix.cz/michal
+ *
+ * Big thanks to Andy Polyakov for a help with optimization, 
+ * assembler fixes, port to MS Windows and a lot of other 
+ * valuable work on this engine!
+ */
+
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+#include <stdio.h>
+#include <string.h>
+
+#include <openssl/opensslconf.h>
+#include <openssl/crypto.h>
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+#include <openssl/evp.h>
+#ifndef OPENSSL_NO_AES
+#include <openssl/aes.h>
+#endif
+#include <openssl/rand.h>
+#include <openssl/err.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_PADLOCK
+
+/* Attempt to have a single source for both 0.9.7 and 0.9.8 :-) */
+#if (OPENSSL_VERSION_NUMBER >= 0x00908000L)
+#  ifndef OPENSSL_NO_DYNAMIC_ENGINE
+#    define DYNAMIC_ENGINE
+#  endif
+#elif (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+#  ifdef ENGINE_DYNAMIC_SUPPORT
+#    define DYNAMIC_ENGINE
+#  endif
+#else
+#  error "Only OpenSSL >= 0.9.7 is supported"
+#endif
+
+/* VIA PadLock AES is available *ONLY* on some x86 CPUs.
+   Not only that it doesn't exist elsewhere, but it
+   even can't be compiled on other platforms!
+ 
+   In addition, because of the heavy use of inline assembler,
+   compiler choice is limited to GCC and Microsoft C. */
+#undef COMPILE_HW_PADLOCK
+#if !defined(I386_ONLY) && !defined(OPENSSL_NO_INLINE_ASM)
+# if (defined(__GNUC__) && (defined(__i386__) || defined(__i386))) || \
+     (defined(_MSC_VER) && defined(_M_IX86))
+#  define COMPILE_HW_PADLOCK
+static ENGINE *ENGINE_padlock (void);
+# endif
+#endif
+
+#ifdef OPENSSL_NO_DYNAMIC_ENGINE
+
+void ENGINE_load_padlock (void)
+{
+/* On non-x86 CPUs it just returns. */
+#ifdef COMPILE_HW_PADLOCK
+	ENGINE *toadd = ENGINE_padlock ();
+	if (!toadd) return;
+	ENGINE_add (toadd);
+	ENGINE_free (toadd);
+	ERR_clear_error ();
+#endif
+}
+
+#endif
+
+#ifdef COMPILE_HW_PADLOCK
+/* We do these includes here to avoid header problems on platforms that
+   do not have the VIA padlock anyway... */
+#include <stdlib.h>
+#ifdef _WIN32
+# include <malloc.h>
+# ifndef alloca
+#  define alloca _alloca
+# endif
+#elif defined(__GNUC__)
+# ifndef alloca
+#  define alloca(s) __builtin_alloca(s)
+# endif
+#endif
+
+/* Function for ENGINE detection and control */
+static int padlock_available(void);
+static int padlock_init(ENGINE *e);
+
+/* RNG Stuff */
+static RAND_METHOD padlock_rand;
+
+/* Cipher Stuff */
+#ifndef OPENSSL_NO_AES
+static int padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid);
+#endif
+
+/* Engine names */
+static const char *padlock_id = "padlock";
+static char padlock_name[100];
+
+/* Available features */
+static int padlock_use_ace = 0;	/* Advanced Cryptography Engine */
+static int padlock_use_rng = 0;	/* Random Number Generator */
+#ifndef OPENSSL_NO_AES
+static int padlock_aes_align_required = 1;
+#endif
+
+/* ===== Engine "management" functions ===== */
+
+/* Prepare the ENGINE structure for registration */
+static int
+padlock_bind_helper(ENGINE *e)
+{
+	/* Check available features */
+	padlock_available();
+
+#if 1	/* disable RNG for now, see commentary in vicinity of RNG code */
+	padlock_use_rng=0;
+#endif
+
+	/* Generate a nice engine name with available features */
+	BIO_snprintf(padlock_name, sizeof(padlock_name),
+		"VIA PadLock (%s, %s)", 
+		 padlock_use_rng ? "RNG" : "no-RNG",
+		 padlock_use_ace ? "ACE" : "no-ACE");
+
+	/* Register everything or return with an error */ 
+	if (!ENGINE_set_id(e, padlock_id) ||
+	    !ENGINE_set_name(e, padlock_name) ||
+
+	    !ENGINE_set_init_function(e, padlock_init) ||
+#ifndef OPENSSL_NO_AES
+	    (padlock_use_ace && !ENGINE_set_ciphers (e, padlock_ciphers)) ||
+#endif
+	    (padlock_use_rng && !ENGINE_set_RAND (e, &padlock_rand))) {
+		return 0;
+	}
+
+	/* Everything looks good */
+	return 1;
+}
+
+/* Constructor */
+static ENGINE *
+ENGINE_padlock(void)
+{
+	ENGINE *eng = ENGINE_new();
+
+	if (!eng) {
+		return NULL;
+	}
+
+	if (!padlock_bind_helper(eng)) {
+		ENGINE_free(eng);
+		return NULL;
+	}
+
+	return eng;
+}
+
+/* Check availability of the engine */
+static int
+padlock_init(ENGINE *e)
+{
+	return (padlock_use_rng || padlock_use_ace);
+}
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library.
+ */
+#ifdef DYNAMIC_ENGINE
+static int
+padlock_bind_fn(ENGINE *e, const char *id)
+{
+	if (id && (strcmp(id, padlock_id) != 0)) {
+		return 0;
+	}
+
+	if (!padlock_bind_helper(e))  {
+		return 0;
+	}
+
+	return 1;
+}
+
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN (padlock_bind_fn)
+#endif /* DYNAMIC_ENGINE */
+
+/* ===== Here comes the "real" engine ===== */
+
+#ifndef OPENSSL_NO_AES
+/* Some AES-related constants */
+#define AES_BLOCK_SIZE		16
+#define AES_KEY_SIZE_128	16
+#define AES_KEY_SIZE_192	24
+#define AES_KEY_SIZE_256	32
+
+/* Here we store the status information relevant to the 
+   current context. */
+/* BIG FAT WARNING:
+ * 	Inline assembler in PADLOCK_XCRYPT_ASM()
+ * 	depends on the order of items in this structure.
+ * 	Don't blindly modify, reorder, etc!
+ */
+struct padlock_cipher_data
+{
+	unsigned char iv[AES_BLOCK_SIZE];	/* Initialization vector */
+	union {	unsigned int pad[4];
+		struct {
+			int rounds:4;
+			int dgst:1;	/* n/a in C3 */
+			int align:1;	/* n/a in C3 */
+			int ciphr:1;	/* n/a in C3 */
+			unsigned int keygen:1;
+			int interm:1;
+			unsigned int encdec:1;
+			int ksize:2;
+		} b;
+	} cword;		/* Control word */
+	AES_KEY ks;		/* Encryption key */
+};
+
+/*
+ * Essentially this variable belongs in thread local storage.
+ * Having this variable global on the other hand can only cause
+ * few bogus key reloads [if any at all on single-CPU system],
+ * so we accept the penatly...
+ */
+static volatile struct padlock_cipher_data *padlock_saved_context;
+#endif
+
+/*
+ * =======================================================
+ * Inline assembler section(s).
+ * =======================================================
+ * Order of arguments is chosen to facilitate Windows port
+ * using __fastcall calling convention. If you wish to add
+ * more routines, keep in mind that first __fastcall
+ * argument is passed in %ecx and second - in %edx.
+ * =======================================================
+ */
+#if defined(__GNUC__) && __GNUC__>=2
+/*
+ * As for excessive "push %ebx"/"pop %ebx" found all over.
+ * When generating position-independent code GCC won't let
+ * us use "b" in assembler templates nor even respect "ebx"
+ * in "clobber description." Therefore the trouble...
+ */
+
+/* Helper function - check if a CPUID instruction
+   is available on this CPU */
+static int
+padlock_insn_cpuid_available(void)
+{
+	int result = -1;
+
+	/* We're checking if the bit #21 of EFLAGS 
+	   can be toggled. If yes = CPUID is available. */
+	asm volatile (
+		"pushf\n"
+		"popl %%eax\n"
+		"xorl $0x200000, %%eax\n"
+		"movl %%eax, %%ecx\n"
+		"andl $0x200000, %%ecx\n"
+		"pushl %%eax\n"
+		"popf\n"
+		"pushf\n"
+		"popl %%eax\n"
+		"andl $0x200000, %%eax\n"
+		"xorl %%eax, %%ecx\n"
+		"movl %%ecx, %0\n"
+		: "=r" (result) : : "eax", "ecx");
+	
+	return (result == 0);
+}
+
+/* Load supported features of the CPU to see if
+   the PadLock is available. */
+static int
+padlock_available(void)
+{
+	char vendor_string[16];
+	unsigned int eax, edx;
+
+	/* First check if the CPUID instruction is available at all... */
+	if (! padlock_insn_cpuid_available())
+		return 0;
+
+	/* Are we running on the Centaur (VIA) CPU? */
+	eax = 0x00000000;
+	vendor_string[12] = 0;
+	asm volatile (
+		"pushl	%%ebx\n"
+		"cpuid\n"
+		"movl	%%ebx,(%%edi)\n"
+		"movl	%%edx,4(%%edi)\n"
+		"movl	%%ecx,8(%%edi)\n"
+		"popl	%%ebx"
+		: "+a"(eax) : "D"(vendor_string) : "ecx", "edx");
+	if (strcmp(vendor_string, "CentaurHauls") != 0)
+		return 0;
+
+	/* Check for Centaur Extended Feature Flags presence */
+	eax = 0xC0000000;
+	asm volatile ("pushl %%ebx; cpuid; popl	%%ebx"
+		: "+a"(eax) : : "ecx", "edx");
+	if (eax < 0xC0000001)
+		return 0;
+
+	/* Read the Centaur Extended Feature Flags */
+	eax = 0xC0000001;
+	asm volatile ("pushl %%ebx; cpuid; popl %%ebx"
+		: "+a"(eax), "=d"(edx) : : "ecx");
+
+	/* Fill up some flags */
+	padlock_use_ace = ((edx & (0x3<<6)) == (0x3<<6));
+	padlock_use_rng = ((edx & (0x3<<2)) == (0x3<<2));
+
+	return padlock_use_ace + padlock_use_rng;
+}
+
+#ifndef OPENSSL_NO_AES
+/* Our own htonl()/ntohl() */
+static inline void
+padlock_bswapl(AES_KEY *ks)
+{
+	size_t i = sizeof(ks->rd_key)/sizeof(ks->rd_key[0]);
+	unsigned int *key = ks->rd_key;
+
+	while (i--) {
+		asm volatile ("bswapl %0" : "+r"(*key));
+		key++;
+	}
+}
+#endif
+
+/* Force key reload from memory to the CPU microcode.
+   Loading EFLAGS from the stack clears EFLAGS[30] 
+   which does the trick. */
+static inline void
+padlock_reload_key(void)
+{
+	asm volatile ("pushfl; popfl");
+}
+
+#ifndef OPENSSL_NO_AES
+/*
+ * This is heuristic key context tracing. At first one
+ * believes that one should use atomic swap instructions,
+ * but it's not actually necessary. Point is that if
+ * padlock_saved_context was changed by another thread
+ * after we've read it and before we compare it with cdata,
+ * our key *shall* be reloaded upon thread context switch
+ * and we are therefore set in either case...
+ */
+static inline void
+padlock_verify_context(struct padlock_cipher_data *cdata)
+{
+	asm volatile (
+	"pushfl\n"
+"	btl	$30,(%%esp)\n"
+"	jnc	1f\n"
+"	cmpl	%2,%1\n"
+"	je	1f\n"
+"	popfl\n"
+"	subl	$4,%%esp\n"
+"1:	addl	$4,%%esp\n"
+"	movl	%2,%0"
+	:"+m"(padlock_saved_context)
+	: "r"(padlock_saved_context), "r"(cdata) : "cc");
+}
+
+/* Template for padlock_xcrypt_* modes */
+/* BIG FAT WARNING: 
+ * 	The offsets used with 'leal' instructions
+ * 	describe items of the 'padlock_cipher_data'
+ * 	structure.
+ */
+#define PADLOCK_XCRYPT_ASM(name,rep_xcrypt)	\
+static inline void *name(size_t cnt,		\
+	struct padlock_cipher_data *cdata,	\
+	void *out, const void *inp) 		\
+{	void *iv; 				\
+	asm volatile ( "pushl	%%ebx\n"	\
+		"	leal	16(%0),%%edx\n"	\
+		"	leal	32(%0),%%ebx\n"	\
+			rep_xcrypt "\n"		\
+		"	popl	%%ebx"		\
+		: "=a"(iv), "=c"(cnt), "=D"(out), "=S"(inp) \
+		: "0"(cdata), "1"(cnt), "2"(out), "3"(inp)  \
+		: "edx", "cc", "memory");	\
+	return iv;				\
+}
+
+/* Generate all functions with appropriate opcodes */
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb, ".byte 0xf3,0x0f,0xa7,0xc8")	/* rep xcryptecb */
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc, ".byte 0xf3,0x0f,0xa7,0xd0")	/* rep xcryptcbc */
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb, ".byte 0xf3,0x0f,0xa7,0xe0")	/* rep xcryptcfb */
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb, ".byte 0xf3,0x0f,0xa7,0xe8")	/* rep xcryptofb */
+#endif
+
+/* The RNG call itself */
+static inline unsigned int
+padlock_xstore(void *addr, unsigned int edx_in)
+{
+	unsigned int eax_out;
+
+	asm volatile (".byte 0x0f,0xa7,0xc0"	/* xstore */
+	    : "=a"(eax_out),"=m"(*(unsigned *)addr)
+	    : "D"(addr), "d" (edx_in)
+	    );
+
+	return eax_out;
+}
+
+/* Why not inline 'rep movsd'? I failed to find information on what
+ * value in Direction Flag one can expect and consequently have to
+ * apply "better-safe-than-sorry" approach and assume "undefined."
+ * I could explicitly clear it and restore the original value upon
+ * return from padlock_aes_cipher, but it's presumably too much
+ * trouble for too little gain...
+ *
+ * In case you wonder 'rep xcrypt*' instructions above are *not*
+ * affected by the Direction Flag and pointers advance toward
+ * larger addresses unconditionally.
+ */ 
+static inline unsigned char *
+padlock_memcpy(void *dst,const void *src,size_t n)
+{
+	long       *d=dst;
+	const long *s=src;
+
+	n /= sizeof(*d);
+	do { *d++ = *s++; } while (--n);
+
+	return dst;
+}
+
+#elif defined(_MSC_VER)
+/*
+ * Unlike GCC these are real functions. In order to minimize impact
+ * on performance we adhere to __fastcall calling convention in
+ * order to get two first arguments passed through %ecx and %edx.
+ * Which kind of suits very well, as instructions in question use
+ * both %ecx and %edx as input:-)
+ */
+#define REP_XCRYPT(code)		\
+	_asm _emit 0xf3			\
+	_asm _emit 0x0f _asm _emit 0xa7	\
+	_asm _emit code
+
+/* BIG FAT WARNING: 
+ * 	The offsets used with 'lea' instructions
+ * 	describe items of the 'padlock_cipher_data'
+ * 	structure.
+ */
+#define PADLOCK_XCRYPT_ASM(name,code)	\
+static void * __fastcall 		\
+	name (size_t cnt, void *cdata,	\
+	void *outp, const void *inp)	\
+{	_asm	mov	eax,edx		\
+	_asm	lea	edx,[eax+16]	\
+	_asm	lea	ebx,[eax+32]	\
+	_asm	mov	edi,outp	\
+	_asm	mov	esi,inp		\
+	REP_XCRYPT(code)		\
+}
+
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb,0xc8)
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc,0xd0)
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb,0xe0)
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb,0xe8)
+
+static int __fastcall
+padlock_xstore(void *outp,unsigned int code)
+{	_asm	mov	edi,ecx
+	_asm _emit 0x0f _asm _emit 0xa7 _asm _emit 0xc0
+}
+
+static void __fastcall
+padlock_reload_key(void)
+{	_asm pushfd _asm popfd		}
+
+static void __fastcall
+padlock_verify_context(void *cdata)
+{	_asm	{
+		pushfd
+		bt	DWORD PTR[esp],30
+		jnc	skip
+		cmp	ecx,padlock_saved_context
+		je	skip
+		popfd
+		sub	esp,4
+	skip:	add	esp,4
+		mov	padlock_saved_context,ecx
+		}
+}
+
+static int
+padlock_available(void)
+{	_asm	{
+		pushfd
+		pop	eax
+		mov	ecx,eax
+		xor	eax,1<<21
+		push	eax
+		popfd
+		pushfd
+		pop	eax
+		xor	eax,ecx
+		bt	eax,21
+		jnc	noluck
+		mov	eax,0
+		cpuid
+		xor	eax,eax
+		cmp	ebx,'tneC'
+		jne	noluck
+		cmp	edx,'Hrua'
+		jne	noluck
+		cmp	ecx,'slua'
+		jne	noluck
+		mov	eax,0xC0000000
+		cpuid
+		mov	edx,eax
+		xor	eax,eax
+		cmp	edx,0xC0000001
+		jb	noluck
+		mov	eax,0xC0000001
+		cpuid
+		xor	eax,eax
+		bt	edx,6
+		jnc	skip_a
+		bt	edx,7
+		jnc	skip_a
+		mov	padlock_use_ace,1
+		inc	eax
+	skip_a:	bt	edx,2
+		jnc	skip_r
+		bt	edx,3
+		jnc	skip_r
+		mov	padlock_use_rng,1
+		inc	eax
+	skip_r:
+	noluck:
+		}
+}
+
+static void __fastcall
+padlock_bswapl(void *key)
+{	_asm	{
+		pushfd
+		cld
+		mov	esi,ecx
+		mov	edi,ecx
+		mov	ecx,60
+	up:	lodsd
+		bswap	eax
+		stosd
+		loop	up
+		popfd
+		}
+}
+
+/* MS actually specifies status of Direction Flag and compiler even
+ * manages to compile following as 'rep movsd' all by itself...
+ */
+#define padlock_memcpy(o,i,n) ((unsigned char *)memcpy((o),(i),(n)&~3U))
+#endif
+
+/* ===== AES encryption/decryption ===== */
+#ifndef OPENSSL_NO_AES
+
+#if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb)
+#define NID_aes_128_cfb	NID_aes_128_cfb128
+#endif
+
+#if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb)
+#define NID_aes_128_ofb	NID_aes_128_ofb128
+#endif
+
+#if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb)
+#define NID_aes_192_cfb	NID_aes_192_cfb128
+#endif
+
+#if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb)
+#define NID_aes_192_ofb	NID_aes_192_ofb128
+#endif
+
+#if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb)
+#define NID_aes_256_cfb	NID_aes_256_cfb128
+#endif
+
+#if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb)
+#define NID_aes_256_ofb	NID_aes_256_ofb128
+#endif
+
+/* List of supported ciphers. */
+static int padlock_cipher_nids[] = {
+	NID_aes_128_ecb,
+	NID_aes_128_cbc,
+	NID_aes_128_cfb,
+	NID_aes_128_ofb,
+
+	NID_aes_192_ecb,
+	NID_aes_192_cbc,
+	NID_aes_192_cfb,
+	NID_aes_192_ofb,
+
+	NID_aes_256_ecb,
+	NID_aes_256_cbc,
+	NID_aes_256_cfb,
+	NID_aes_256_ofb,
+};
+static int padlock_cipher_nids_num = (sizeof(padlock_cipher_nids)/
+				      sizeof(padlock_cipher_nids[0]));
+
+/* Function prototypes ... */
+static int padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+				const unsigned char *iv, int enc);
+static int padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+			      const unsigned char *in, size_t nbytes);
+
+#define NEAREST_ALIGNED(ptr) ( (unsigned char *)(ptr) +		\
+	( (0x10 - ((size_t)(ptr) & 0x0F)) & 0x0F )	)
+#define ALIGNED_CIPHER_DATA(ctx) ((struct padlock_cipher_data *)\
+	NEAREST_ALIGNED(ctx->cipher_data))
+
+#define EVP_CIPHER_block_size_ECB	AES_BLOCK_SIZE
+#define EVP_CIPHER_block_size_CBC	AES_BLOCK_SIZE
+#define EVP_CIPHER_block_size_OFB	1
+#define EVP_CIPHER_block_size_CFB	1
+
+/* Declaring so many ciphers by hand would be a pain.
+   Instead introduce a bit of preprocessor magic :-) */
+#define	DECLARE_AES_EVP(ksize,lmode,umode)	\
+static const EVP_CIPHER padlock_aes_##ksize##_##lmode = {	\
+	NID_aes_##ksize##_##lmode,		\
+	EVP_CIPHER_block_size_##umode,	\
+	AES_KEY_SIZE_##ksize,		\
+	AES_BLOCK_SIZE,			\
+	0 | EVP_CIPH_##umode##_MODE,	\
+	padlock_aes_init_key,		\
+	padlock_aes_cipher,		\
+	NULL,				\
+	sizeof(struct padlock_cipher_data) + 16,	\
+	EVP_CIPHER_set_asn1_iv,		\
+	EVP_CIPHER_get_asn1_iv,		\
+	NULL,				\
+	NULL				\
+}
+
+DECLARE_AES_EVP(128,ecb,ECB);
+DECLARE_AES_EVP(128,cbc,CBC);
+DECLARE_AES_EVP(128,cfb,CFB);
+DECLARE_AES_EVP(128,ofb,OFB);
+
+DECLARE_AES_EVP(192,ecb,ECB);
+DECLARE_AES_EVP(192,cbc,CBC);
+DECLARE_AES_EVP(192,cfb,CFB);
+DECLARE_AES_EVP(192,ofb,OFB);
+
+DECLARE_AES_EVP(256,ecb,ECB);
+DECLARE_AES_EVP(256,cbc,CBC);
+DECLARE_AES_EVP(256,cfb,CFB);
+DECLARE_AES_EVP(256,ofb,OFB);
+
+static int
+padlock_ciphers (ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid)
+{
+	/* No specific cipher => return a list of supported nids ... */
+	if (!cipher) {
+		*nids = padlock_cipher_nids;
+		return padlock_cipher_nids_num;
+	}
+
+	/* ... or the requested "cipher" otherwise */
+	switch (nid) {
+	  case NID_aes_128_ecb:
+	    *cipher = &padlock_aes_128_ecb;
+	    break;
+	  case NID_aes_128_cbc:
+	    *cipher = &padlock_aes_128_cbc;
+	    break;
+	  case NID_aes_128_cfb:
+	    *cipher = &padlock_aes_128_cfb;
+	    break;
+	  case NID_aes_128_ofb:
+	    *cipher = &padlock_aes_128_ofb;
+	    break;
+
+	  case NID_aes_192_ecb:
+	    *cipher = &padlock_aes_192_ecb;
+	    break;
+	  case NID_aes_192_cbc:
+	    *cipher = &padlock_aes_192_cbc;
+	    break;
+	  case NID_aes_192_cfb:
+	    *cipher = &padlock_aes_192_cfb;
+	    break;
+	  case NID_aes_192_ofb:
+	    *cipher = &padlock_aes_192_ofb;
+	    break;
+
+	  case NID_aes_256_ecb:
+	    *cipher = &padlock_aes_256_ecb;
+	    break;
+	  case NID_aes_256_cbc:
+	    *cipher = &padlock_aes_256_cbc;
+	    break;
+	  case NID_aes_256_cfb:
+	    *cipher = &padlock_aes_256_cfb;
+	    break;
+	  case NID_aes_256_ofb:
+	    *cipher = &padlock_aes_256_ofb;
+	    break;
+
+	  default:
+	    /* Sorry, we don't support this NID */
+	    *cipher = NULL;
+	    return 0;
+	}
+
+	return 1;
+}
+
+/* Prepare the encryption key for PadLock usage */
+static int
+padlock_aes_init_key (EVP_CIPHER_CTX *ctx, const unsigned char *key,
+		      const unsigned char *iv, int enc)
+{
+	struct padlock_cipher_data *cdata;
+	int key_len = EVP_CIPHER_CTX_key_length(ctx) * 8;
+
+	if (key==NULL) return 0;	/* ERROR */
+
+	cdata = ALIGNED_CIPHER_DATA(ctx);
+	memset(cdata, 0, sizeof(struct padlock_cipher_data));
+
+	/* Prepare Control word. */
+	if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE)
+		cdata->cword.b.encdec = 0;
+	else
+		cdata->cword.b.encdec = (ctx->encrypt == 0);
+	cdata->cword.b.rounds = 10 + (key_len - 128) / 32;
+	cdata->cword.b.ksize = (key_len - 128) / 64;
+
+	switch(key_len) {
+		case 128:
+			/* PadLock can generate an extended key for
+			   AES128 in hardware */
+			memcpy(cdata->ks.rd_key, key, AES_KEY_SIZE_128);
+			cdata->cword.b.keygen = 0;
+			break;
+
+		case 192:
+		case 256:
+			/* Generate an extended AES key in software.
+			   Needed for AES192/AES256 */
+			/* Well, the above applies to Stepping 8 CPUs
+			   and is listed as hardware errata. They most
+			   likely will fix it at some point and then
+			   a check for stepping would be due here. */
+			if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CFB_MODE ||
+			    EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE ||
+			    enc)
+				AES_set_encrypt_key(key, key_len, &cdata->ks);
+			else
+				AES_set_decrypt_key(key, key_len, &cdata->ks);
+#ifndef AES_ASM
+			/* OpenSSL C functions use byte-swapped extended key. */
+			padlock_bswapl(&cdata->ks);
+#endif
+			cdata->cword.b.keygen = 1;
+			break;
+
+		default:
+			/* ERROR */
+			return 0;
+	}
+
+	/*
+	 * This is done to cover for cases when user reuses the
+	 * context for new key. The catch is that if we don't do
+	 * this, padlock_eas_cipher might proceed with old key...
+	 */
+	padlock_reload_key ();
+
+	return 1;
+}
+
+/* 
+ * Simplified version of padlock_aes_cipher() used when
+ * 1) both input and output buffers are at aligned addresses.
+ * or when
+ * 2) running on a newer CPU that doesn't require aligned buffers.
+ */
+static int
+padlock_aes_cipher_omnivorous(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
+		const unsigned char *in_arg, size_t nbytes)
+{
+	struct padlock_cipher_data *cdata;
+	void  *iv;
+
+	cdata = ALIGNED_CIPHER_DATA(ctx);
+	padlock_verify_context(cdata);
+
+	switch (EVP_CIPHER_CTX_mode(ctx)) {
+	case EVP_CIPH_ECB_MODE:
+		padlock_xcrypt_ecb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
+		break;
+
+	case EVP_CIPH_CBC_MODE:
+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+		iv = padlock_xcrypt_cbc(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
+		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
+		break;
+
+	case EVP_CIPH_CFB_MODE:
+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+		iv = padlock_xcrypt_cfb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
+		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
+		break;
+
+	case EVP_CIPH_OFB_MODE:
+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+		padlock_xcrypt_ofb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
+		memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);
+		break;
+
+	default:
+		return 0;
+	}
+
+	memset(cdata->iv, 0, AES_BLOCK_SIZE);
+
+	return 1;
+}
+
+#ifndef  PADLOCK_CHUNK
+# define PADLOCK_CHUNK	512	/* Must be a power of 2 larger than 16 */
+#endif
+#if PADLOCK_CHUNK<16 || PADLOCK_CHUNK&(PADLOCK_CHUNK-1)
+# error "insane PADLOCK_CHUNK..."
+#endif
+
+/* Re-align the arguments to 16-Bytes boundaries and run the 
+   encryption function itself. This function is not AES-specific. */
+static int
+padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
+		   const unsigned char *in_arg, size_t nbytes)
+{
+	struct padlock_cipher_data *cdata;
+	const  void *inp;
+	unsigned char  *out;
+	void  *iv;
+	int    inp_misaligned, out_misaligned, realign_in_loop;
+	size_t chunk, allocated=0;
+
+	/* ctx->num is maintained in byte-oriented modes,
+	   such as CFB and OFB... */
+	if ((chunk = ctx->num)) { /* borrow chunk variable */
+		unsigned char *ivp=ctx->iv;
+
+		switch (EVP_CIPHER_CTX_mode(ctx)) {
+		case EVP_CIPH_CFB_MODE:
+			if (chunk >= AES_BLOCK_SIZE)
+				return 0; /* bogus value */
+
+			if (ctx->encrypt)
+				while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
+					ivp[chunk] = *(out_arg++) = *(in_arg++) ^ ivp[chunk];
+					chunk++, nbytes--;
+				}
+			else	while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
+					unsigned char c = *(in_arg++);
+					*(out_arg++) = c ^ ivp[chunk];
+					ivp[chunk++] = c, nbytes--;
+				}
+
+			ctx->num = chunk%AES_BLOCK_SIZE;
+			break;
+		case EVP_CIPH_OFB_MODE:
+			if (chunk >= AES_BLOCK_SIZE)
+				return 0; /* bogus value */
+
+			while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
+				*(out_arg++) = *(in_arg++) ^ ivp[chunk];
+				chunk++, nbytes--;
+			}
+
+			ctx->num = chunk%AES_BLOCK_SIZE;
+			break;
+		}
+	}
+
+	if (nbytes == 0)
+		return 1;
+#if 0
+	if (nbytes % AES_BLOCK_SIZE)
+		return 0; /* are we expected to do tail processing? */
+#else
+	/* nbytes is always multiple of AES_BLOCK_SIZE in ECB and CBC
+	   modes and arbitrary value in byte-oriented modes, such as
+	   CFB and OFB... */
+#endif
+
+	/* VIA promises CPUs that won't require alignment in the future.
+	   For now padlock_aes_align_required is initialized to 1 and
+	   the condition is never met... */
+	/* C7 core is capable to manage unaligned input in non-ECB[!]
+	   mode, but performance penalties appear to be approximately
+	   same as for software alignment below or ~3x. They promise to
+	   improve it in the future, but for now we can just as well
+	   pretend that it can only handle aligned input... */
+	if (!padlock_aes_align_required && (nbytes%AES_BLOCK_SIZE)==0)
+		return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);
+
+	inp_misaligned = (((size_t)in_arg) & 0x0F);
+	out_misaligned = (((size_t)out_arg) & 0x0F);
+
+	/* Note that even if output is aligned and input not,
+	 * I still prefer to loop instead of copy the whole
+	 * input and then encrypt in one stroke. This is done
+	 * in order to improve L1 cache utilization... */
+	realign_in_loop = out_misaligned|inp_misaligned;
+
+	if (!realign_in_loop && (nbytes%AES_BLOCK_SIZE)==0)
+		return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);
+
+	/* this takes one "if" out of the loops */
+	chunk  = nbytes;
+	chunk %= PADLOCK_CHUNK;
+	if (chunk==0) chunk = PADLOCK_CHUNK;
+
+	if (out_misaligned) {
+		/* optmize for small input */
+		allocated = (chunk<nbytes?PADLOCK_CHUNK:nbytes);
+		out = alloca(0x10 + allocated);
+		out = NEAREST_ALIGNED(out);
+	}
+	else
+		out = out_arg;
+
+	cdata = ALIGNED_CIPHER_DATA(ctx);
+	padlock_verify_context(cdata);
+
+	switch (EVP_CIPHER_CTX_mode(ctx)) {
+	case EVP_CIPH_ECB_MODE:
+		do	{
+			if (inp_misaligned)
+				inp = padlock_memcpy(out, in_arg, chunk);
+			else
+				inp = in_arg;
+			in_arg += chunk;
+
+			padlock_xcrypt_ecb(chunk/AES_BLOCK_SIZE, cdata, out, inp);
+
+			if (out_misaligned)
+				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
+			else
+				out     = out_arg+=chunk;
+
+			nbytes -= chunk;
+			chunk   = PADLOCK_CHUNK;
+		} while (nbytes);
+		break;
+
+	case EVP_CIPH_CBC_MODE:
+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+		goto cbc_shortcut;
+		do	{
+			if (iv != cdata->iv)
+				memcpy(cdata->iv, iv, AES_BLOCK_SIZE);
+			chunk = PADLOCK_CHUNK;
+		cbc_shortcut: /* optimize for small input */
+			if (inp_misaligned)
+				inp = padlock_memcpy(out, in_arg, chunk);
+			else
+				inp = in_arg;
+			in_arg += chunk;
+
+			iv = padlock_xcrypt_cbc(chunk/AES_BLOCK_SIZE, cdata, out, inp);
+
+			if (out_misaligned)
+				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
+			else
+				out     = out_arg+=chunk;
+
+		} while (nbytes -= chunk);
+		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
+		break;
+
+	case EVP_CIPH_CFB_MODE:
+		memcpy (iv = cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+		chunk &= ~(AES_BLOCK_SIZE-1);
+		if (chunk)	goto cfb_shortcut;
+		else		goto cfb_skiploop;
+		do	{
+			if (iv != cdata->iv)
+				memcpy(cdata->iv, iv, AES_BLOCK_SIZE);
+			chunk = PADLOCK_CHUNK;
+		cfb_shortcut: /* optimize for small input */
+			if (inp_misaligned)
+				inp = padlock_memcpy(out, in_arg, chunk);
+			else
+				inp = in_arg;
+			in_arg += chunk;
+
+			iv = padlock_xcrypt_cfb(chunk/AES_BLOCK_SIZE, cdata, out, inp);
+
+			if (out_misaligned)
+				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
+			else
+				out     = out_arg+=chunk;
+
+			nbytes -= chunk;
+		} while (nbytes >= AES_BLOCK_SIZE);
+
+		cfb_skiploop:
+		if (nbytes) {
+			unsigned char *ivp = cdata->iv;
+
+			if (iv != ivp) {
+				memcpy(ivp, iv, AES_BLOCK_SIZE);
+				iv = ivp;
+			}
+			ctx->num = nbytes;
+			if (cdata->cword.b.encdec) {
+				cdata->cword.b.encdec=0;
+				padlock_reload_key();
+				padlock_xcrypt_ecb(1,cdata,ivp,ivp);
+				cdata->cword.b.encdec=1;
+				padlock_reload_key();
+				while(nbytes) {
+					unsigned char c = *(in_arg++);
+					*(out_arg++) = c ^ *ivp;
+					*(ivp++) = c, nbytes--;
+				}
+			}
+			else {	padlock_reload_key();
+				padlock_xcrypt_ecb(1,cdata,ivp,ivp);
+				padlock_reload_key();
+				while (nbytes) {
+					*ivp = *(out_arg++) = *(in_arg++) ^ *ivp;
+					ivp++, nbytes--;
+				}
+			}
+		}
+
+		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
+		break;
+
+	case EVP_CIPH_OFB_MODE:
+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+		chunk &= ~(AES_BLOCK_SIZE-1);
+		if (chunk) do	{
+			if (inp_misaligned)
+				inp = padlock_memcpy(out, in_arg, chunk);
+			else
+				inp = in_arg;
+			in_arg += chunk;
+
+			padlock_xcrypt_ofb(chunk/AES_BLOCK_SIZE, cdata, out, inp);
+
+			if (out_misaligned)
+				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
+			else
+				out     = out_arg+=chunk;
+
+			nbytes -= chunk;
+			chunk   = PADLOCK_CHUNK;
+		} while (nbytes >= AES_BLOCK_SIZE);
+
+		if (nbytes) {
+			unsigned char *ivp = cdata->iv;
+
+			ctx->num = nbytes;
+			padlock_reload_key();	/* empirically found */
+			padlock_xcrypt_ecb(1,cdata,ivp,ivp);
+			padlock_reload_key();	/* empirically found */
+			while (nbytes) {
+				*(out_arg++) = *(in_arg++) ^ *ivp;
+				ivp++, nbytes--;
+			}
+		}
+
+		memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);
+		break;
+
+	default:
+		return 0;
+	}
+
+	/* Clean the realign buffer if it was used */
+	if (out_misaligned) {
+		volatile unsigned long *p=(void *)out;
+		size_t   n = allocated/sizeof(*p);
+		while (n--) *p++=0;
+	}
+
+	memset(cdata->iv, 0, AES_BLOCK_SIZE);
+
+	return 1;
+}
+
+#endif /* OPENSSL_NO_AES */
+
+/* ===== Random Number Generator ===== */
+/*
+ * This code is not engaged. The reason is that it does not comply
+ * with recommendations for VIA RNG usage for secure applications
+ * (posted at http://www.via.com.tw/en/viac3/c3.jsp) nor does it
+ * provide meaningful error control...
+ */
+/* Wrapper that provides an interface between the API and 
+   the raw PadLock RNG */
+static int
+padlock_rand_bytes(unsigned char *output, int count)
+{
+	unsigned int eax, buf;
+
+	while (count >= 8) {
+		eax = padlock_xstore(output, 0);
+		if (!(eax&(1<<6)))	return 0; /* RNG disabled */
+		/* this ---vv--- covers DC bias, Raw Bits and String Filter */
+		if (eax&(0x1F<<10))	return 0;
+		if ((eax&0x1F)==0)	continue; /* no data, retry... */
+		if ((eax&0x1F)!=8)	return 0; /* fatal failure...  */
+		output += 8;
+		count  -= 8;
+	}
+	while (count > 0) {
+		eax = padlock_xstore(&buf, 3);
+		if (!(eax&(1<<6)))	return 0; /* RNG disabled */
+		/* this ---vv--- covers DC bias, Raw Bits and String Filter */
+		if (eax&(0x1F<<10))	return 0;
+		if ((eax&0x1F)==0)	continue; /* no data, retry... */
+		if ((eax&0x1F)!=1)	return 0; /* fatal failure...  */
+		*output++ = (unsigned char)buf;
+		count--;
+	}
+	*(volatile unsigned int *)&buf=0;
+
+	return 1;
+}
+
+/* Dummy but necessary function */
+static int
+padlock_rand_status(void)
+{
+	return 1;
+}
+
+/* Prepare structure for registration */
+static RAND_METHOD padlock_rand = {
+	NULL,			/* seed */
+	padlock_rand_bytes,	/* bytes */
+	NULL,			/* cleanup */
+	NULL,			/* add */
+	padlock_rand_bytes,	/* pseudorand */
+	padlock_rand_status,	/* rand status */
+};
+
+#else  /* !COMPILE_HW_PADLOCK */
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE
+OPENSSL_EXPORT
+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);
+OPENSSL_EXPORT
+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }
+IMPLEMENT_DYNAMIC_CHECK_FN()
+#endif
+#endif /* COMPILE_HW_PADLOCK */
+
+#endif /* !OPENSSL_NO_HW_PADLOCK */
+#endif /* !OPENSSL_NO_HW */