XCRYPTCBC

via = cpuid_leaf(0xC0000001, 0)[3]
if via >> 6 & 3 != 3:
    fault(UD)                    # CPUID: no ACE, or it is off
if not cr4 >> 9 & 1:
    fault(UD)                    # no SSE
c = low(rdx, ASIZE)              # the control word, 16 bytes
k = low(rbx, ASIZE)              # the key, or the round keys
if not key_loaded:               # RFLAGS bit 30 clear: the engine
    if (c | k) & 15:             # loads both, 16-byte aligned,
        fault(GP, 0)             # and keeps them for the next
    ace_load(c, k)
    key_loaded = 1
cw = ace_cw
n = aCX                          # blocks of 16 bytes
s = aSI
d = aDI
v = low(rax, ASIZE)              # the IV
dec = cw >> 9 & 1                # CW[9]: decryption
mac = cw >> 4 & 1                # CW[4]: every block to [rDI]
if ace_defined():
    if v & 15:                   # the IV: 16-byte aligned
        fault(GP, 0)
    if (s | d) & 15 and not cw >> 5 & 1:
        fault(GP, 0)             # CW[5]: data at any alignment
    iv = load(v, 128)
    o = d
    for i in range(n):
        x = load(s + 16 * i, 128)
        o = d if mac else d + 16 * i
        if dec:
            y = ace_decrypt(x) ^ iv
            iv = x               # the next block's chaining
        else:                    # value: the ciphertext
            y = ace_encrypt(x ^ iv)
            iv = y
        store(o, 128, y)
    if dec and n:
        store(v, 128, iv)        # the last ciphertext block,
    elif n and ASIZE == 64:      # in memory or by its address
        rax = o
    elif n:
        eax = o
    aSI = s + 16 * n
    aDI = d if mac else d + 16 * n
    aCX = 0
else:                            # what VIA leaves undefined
    for i in range(n):
        store(d + 16 * i, 128, UNDEFINED)
    store(v, 128, UNDEFINED)
    aSI = aDI = aCX = UNDEFINED
    rax = UNDEFINED
# so that the next REP XCRYPTCBC goes on with the chain. With CW[4]
# the result is a CBC-MAC at [rDI], encrypting or not