XSHA256

via = cpuid_leaf(0xC0000001, 0)[3]
if via >> 10 & 3 != 3:
    fault(UD)                    # CPUID: no PHE, or it is off
if not cr4 >> 9 & 1:
    fault(UD)                    # no SSE
h = aDI                          # the state: 8 doublewords, 16-
if h & 15:                       # byte aligned, 128 bytes at it
    fault(GP, 0)                 # free for the engine
key_loaded = 0                   # it changes the AES engine's CW
hs = load(h, 256)
n = aCX                          # the message's length in bytes
p = eax                          # bytes hashed so far: 0 at first
if p == 0xFFFFFFFF:              # (Linux, VIA Nano) rCX blocks of
    for i in range(n):           # 64 bytes, no padding
        w = load(aSI + 64 * i, 512)
        hs = sha256_block(hs, w)
    aSI = aSI + 64 * n
    eax = UNDEFINED              # no document says what EAX and
    aCX = UNDEFINED              # rCX hold after
else:
    rest = n - p
    for i in range(rest // 64):  # whole blocks
        w = load(aSI + 64 * i, 512)
        hs = sha256_block(hs, w)
    r = rest % 64                # the last bytes, a 1 bit, zeros,
    t = load(aSI + rest - r, 8 * r)  # and the length in bits,
    t |= 0x80 << 8 * r           # 64 bits big-endian, at the end
    b = 1 if r < 56 else 2       # of 1 or 2 blocks
    for j in range(8):
        x = 8 * n >> 56 - 8 * j & 0xFF
        t |= x << 8 * (64 * b - 8 + j)
    for i in range(b):
        hs = sha256_block(hs, t >> 512 * i)
    aSI = aSI + rest             # rDI and rCX do not change
    eax = n                      # all bytes hashed
store(h, 256, hs)                # the hash, each doubleword in the
                                 # processor's order: byte-swap them
# for SHA-256's digest. The initial state is FIPS 180-4's H(0), in
# memory the same way. After each 64 bytes the engine writes the
# state and EAX, so that an interrupt resumes it