XCRYPTCTR

via = cpuid_leaf(0xC0000001, 0)[3]
if via >> 6 & 3 != 3:
    fault(UD)                    # CPUID: no ACE, or it is off
if not cr4 >> 9 & 1:
    fault(UD)                    # no SSE
c = low(rdx, ASIZE)              # the control word, 16 bytes
k = low(rbx, ASIZE)              # the key, or the round keys
if not key_loaded:               # RFLAGS bit 30 clear: the engine
    if (c | k) & 15:             # loads both, 16-byte aligned,
        fault(GP, 0)             # and keeps them for the next
    ace_load(c, k)
    key_loaded = 1
cw = ace_cw
n = aCX                          # blocks of 16 bytes
s = aSI
d = aDI
v = low(rax, ASIZE)              # the counter block
if ace_defined():
    if v & 15:                   # the IV: 16-byte aligned
        fault(GP, 0)
    if (s | d) & 15 and not cw >> 5 & 1:
        fault(GP, 0)             # CW[5]: data at any alignment
    iv = load(v, 128)
    for i in range(n):
        x = load(s + 16 * i, 128)
        y = x ^ ace_encrypt(iv)
        store(d + 16 * i, 128, y)
        t = iv >> 112            # bytes 14 and 15: a big-endian
        t = (t & 0xFF) << 8 | t >> 8  # counter, the rest a nonce
        t = t + 1 & 0xFFFF
        t = (t & 0xFF) << 8 | t >> 8
        iv = low(iv, 112) | t << 112
    if n:
        store(v, 128, iv)        # the counter, for the next
    aSI = s + 16 * n
    aDI = d + 16 * n
    aCX = 0
else:                            # what VIA leaves undefined
    for i in range(n):
        store(d + 16 * i, 128, UNDEFINED)
    store(v, 128, UNDEFINED)
    aSI = aDI = aCX = UNDEFINED
# the same both ways (the counter mode of 802.11i's CCM); the
# counter wraps within its 16 bits, as far as the guide says