cryptlib.c: OPENSSL_ia32cap environment variable to interpret ~ as cpuid mask.

crypto/cryptlib.c

@@ -144,12 +144,15 @@ void OPENSSL_cpuid_setup(void)
     if (trigger)	return;
 
     trigger=1;
-    if ((env=getenv("OPENSSL_ia32cap")))
+    if ((env=getenv("OPENSSL_ia32cap"))) {
+	int off = (env[0]=='~')?1:0;
 #if defined(_WIN32)
-    {	if (!sscanf(env,"%I64i",&vec)) vec = strtoul(env,NULL,0);   }
+    	if (!sscanf(env+off,"%I64i",&vec)) vec = strtoul(env+off,NULL,0);
 #else
-	vec = strtoull(env,NULL,0);
+	vec = strtoull(env+off,NULL,0);
 #endif
+	if (off) vec = OPENSSL_ia32_cpuid()&~vec;
+    }
     else
 	vec = OPENSSL_ia32_cpuid();
 

doc/crypto/OPENSSL_ia32cap.pod

@@ -61,10 +61,10 @@ capable CPU, but under control of OS that does not enable XMM
 registers. Even though you can manipulate the value programmatically,
 you most likely will find it more appropriate to set up an environment
 variable with the same name prior starting target application, e.g. on
-Intel P4 processor 'env OPENSSL_ia32cap=0x16980010 apps/openssl', to
-achieve same effect without modifying the application source code.
-Alternatively you can reconfigure the toolkit with no-sse2 option and
-recompile.
+Intel P4 processor 'env OPENSSL_ia32cap=0x16980010 apps/openssl', or
+better yet 'env OPENSSL_ia32cap=~0x1000000 apps/openssl' to achieve same
+effect without modifying the application source code. Alternatively you
+can reconfigure the toolkit with no-sse2 option and recompile.
 
 Less intuituve is clearing bit #28. The truth is that it's not copied
 from CPUID output verbatim, but is adjusted to reflect whether or not