This commit was generated by cvs2git to track changes on a CVS vendor

branch.

19 files changed, 3913 insertions, 607 deletions

diff --git a/src/lib/libcrypto/sha/asm/sha1-alpha.pl b/src/lib/libcrypto/sha/asm/sha1-alpha.pl
new file mode 100644
index 0000000000..6c4b9251fd
--- /dev/null
+++ b/src/lib/libcrypto/sha/asm/sha1-alpha.pl
@@ -0,0 +1,322 @@
+#!/usr/bin/env perl
+
+# ====================================================================
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# project. The module is, however, dual licensed under OpenSSL and
+# CRYPTOGAMS licenses depending on where you obtain it. For further
+# details see http://www.openssl.org/~appro/cryptogams/.
+# ====================================================================
+
+# SHA1 block procedure for Alpha.
+
+# On 21264 performance is 33% better than code generated by vendor
+# compiler, and 75% better than GCC [3.4], and in absolute terms is
+# 8.7 cycles per processed byte. Implementation features vectorized
+# byte swap, but not Xupdate.
+
+@X=(    "\$0",  "\$1",  "\$2",  "\$3",  "\$4",  "\$5",  "\$6",  "\$7",
+        "\$8",  "\$9",  "\$10", "\$11", "\$12", "\$13", "\$14", "\$15");
+$ctx="a0";      # $16
+$inp="a1";
+$num="a2";
+$A="a3";
+$B="a4";        # 20
+$C="a5";
+$D="t8";
+$E="t9";        @V=($A,$B,$C,$D,$E);
+$t0="t10";      # 24
+$t1="t11";
+$t2="ra";
+$t3="t12";
+$K="AT";        # 28
+
+sub BODY_00_19 {
+my ($i,$a,$b,$c,$d,$e)=@_;
+my $j=$i+1;
+$code.=<<___ if ($i==0);
+        ldq_u   @X[0],0+0($inp)
+        ldq_u   @X[1],0+7($inp)
+___
+$code.=<<___ if (!($i&1) && $i<14);
+        ldq_u   @X[$i+2],($i+2)*4+0($inp)
+        ldq_u   @X[$i+3],($i+2)*4+7($inp)
+___
+$code.=<<___ if (!($i&1) && $i<15);
+        extql   @X[$i],$inp,@X[$i]
+        extqh   @X[$i+1],$inp,@X[$i+1]
+
+        or      @X[$i+1],@X[$i],@X[$i]  # pair of 32-bit values are fetched
+
+        srl     @X[$i],24,$t0           # vectorized byte swap
+        srl     @X[$i],8,$t2
+
+        sll     @X[$i],8,$t3
+        sll     @X[$i],24,@X[$i]
+        zapnot  $t0,0x11,$t0
+        zapnot  $t2,0x22,$t2
+
+        zapnot  @X[$i],0x88,@X[$i]
+        or      $t0,$t2,$t0
+        zapnot  $t3,0x44,$t3
+        sll     $a,5,$t1
+
+        or      @X[$i],$t0,@X[$i]
+        addl    $K,$e,$e
+        and     $b,$c,$t2
+        zapnot  $a,0xf,$a
+
+        or      @X[$i],$t3,@X[$i]
+        srl     $a,27,$t0
+        bic     $d,$b,$t3
+        sll     $b,30,$b
+
+        extll   @X[$i],4,@X[$i+1]       # extract upper half
+        or      $t2,$t3,$t2
+        addl    @X[$i],$e,$e
+
+        addl    $t1,$e,$e
+        srl     $b,32,$t3
+        zapnot  @X[$i],0xf,@X[$i]
+
+        addl    $t0,$e,$e
+        addl    $t2,$e,$e
+        or      $t3,$b,$b
+___
+$code.=<<___ if (($i&1) && $i<15);
+        sll     $a,5,$t1
+        addl    $K,$e,$e
+        and     $b,$c,$t2
+        zapnot  $a,0xf,$a
+
+        srl     $a,27,$t0
+        addl    @X[$i%16],$e,$e
+        bic     $d,$b,$t3
+        sll     $b,30,$b
+
+        or      $t2,$t3,$t2
+        addl    $t1,$e,$e
+        srl     $b,32,$t3
+        zapnot  @X[$i],0xf,@X[$i]
+
+        addl    $t0,$e,$e
+        addl    $t2,$e,$e
+        or      $t3,$b,$b
+___
+$code.=<<___ if ($i>=15);       # with forward Xupdate
+        sll     $a,5,$t1
+        addl    $K,$e,$e
+        and     $b,$c,$t2
+        xor     @X[($j+2)%16],@X[$j%16],@X[$j%16]
+
+        zapnot  $a,0xf,$a
+        addl    @X[$i%16],$e,$e
+        bic     $d,$b,$t3
+        xor     @X[($j+8)%16],@X[$j%16],@X[$j%16]
+
+        srl     $a,27,$t0
+        addl    $t1,$e,$e
+        or      $t2,$t3,$t2
+        xor     @X[($j+13)%16],@X[$j%16],@X[$j%16]
+
+        sll     $b,30,$b
+        addl    $t0,$e,$e
+        srl     @X[$j%16],31,$t1
+
+        addl    $t2,$e,$e
+        srl     $b,32,$t3
+        addl    @X[$j%16],@X[$j%16],@X[$j%16]
+
+        or      $t3,$b,$b
+        zapnot  @X[$i%16],0xf,@X[$i%16]
+        or      $t1,@X[$j%16],@X[$j%16]
+___
+}
+
+sub BODY_20_39 {
+my ($i,$a,$b,$c,$d,$e)=@_;
+my $j=$i+1;
+$code.=<<___ if ($i<79);        # with forward Xupdate
+        sll     $a,5,$t1
+        addl    $K,$e,$e
+        zapnot  $a,0xf,$a
+        xor     @X[($j+2)%16],@X[$j%16],@X[$j%16]
+
+        sll     $b,30,$t3
+        addl    $t1,$e,$e
+        xor     $b,$c,$t2
+        xor     @X[($j+8)%16],@X[$j%16],@X[$j%16]
+
+        srl     $b,2,$b
+        addl    @X[$i%16],$e,$e
+        xor     $d,$t2,$t2
+        xor     @X[($j+13)%16],@X[$j%16],@X[$j%16]
+
+        srl     @X[$j%16],31,$t1
+        addl    $t2,$e,$e
+        srl     $a,27,$t0
+        addl    @X[$j%16],@X[$j%16],@X[$j%16]
+
+        or      $t3,$b,$b
+        addl    $t0,$e,$e
+        or      $t1,@X[$j%16],@X[$j%16]
+___
+$code.=<<___ if ($i<77);
+        zapnot  @X[$i%16],0xf,@X[$i%16]
+___
+$code.=<<___ if ($i==79);       # with context fetch
+        sll     $a,5,$t1
+        addl    $K,$e,$e
+        zapnot  $a,0xf,$a
+        ldl     @X[0],0($ctx)
+
+        sll     $b,30,$t3
+        addl    $t1,$e,$e
+        xor     $b,$c,$t2
+        ldl     @X[1],4($ctx)
+
+        srl     $b,2,$b
+        addl    @X[$i%16],$e,$e
+        xor     $d,$t2,$t2
+        ldl     @X[2],8($ctx)
+
+        srl     $a,27,$t0
+        addl    $t2,$e,$e
+        ldl     @X[3],12($ctx)
+
+        or      $t3,$b,$b
+        addl    $t0,$e,$e
+        ldl     @X[4],16($ctx)
+___
+}
+
+sub BODY_40_59 {
+my ($i,$a,$b,$c,$d,$e)=@_;
+my $j=$i+1;
+$code.=<<___;   # with forward Xupdate
+        sll     $a,5,$t1
+        addl    $K,$e,$e
+        zapnot  $a,0xf,$a
+        xor     @X[($j+2)%16],@X[$j%16],@X[$j%16]
+
+        srl     $a,27,$t0
+        and     $b,$c,$t2
+        and     $b,$d,$t3
+        xor     @X[($j+8)%16],@X[$j%16],@X[$j%16]
+
+        sll     $b,30,$b
+        addl    $t1,$e,$e
+        xor     @X[($j+13)%16],@X[$j%16],@X[$j%16]
+
+        srl     @X[$j%16],31,$t1
+        addl    $t0,$e,$e
+        or      $t2,$t3,$t2
+        and     $c,$d,$t3
+
+        or      $t2,$t3,$t2
+        srl     $b,32,$t3
+        addl    @X[$i%16],$e,$e
+        addl    @X[$j%16],@X[$j%16],@X[$j%16]
+
+        or      $t3,$b,$b
+        addl    $t2,$e,$e
+        or      $t1,@X[$j%16],@X[$j%16]
+        zapnot  @X[$i%16],0xf,@X[$i%16]
+___
+}
+
+$code=<<___;
+#ifdef __linux__
+#include <asm/regdef.h>
+#else
+#include <asm.h>
+#include <regdef.h>
+#endif
+
+.text
+
+.set    noat
+.set    noreorder
+.globl  sha1_block_data_order
+.align  5
+.ent    sha1_block_data_order
+sha1_block_data_order:
+        lda     sp,-64(sp)
+        stq     ra,0(sp)
+        stq     s0,8(sp)
+        stq     s1,16(sp)
+        stq     s2,24(sp)
+        stq     s3,32(sp)
+        stq     s4,40(sp)
+        stq     s5,48(sp)
+        stq     fp,56(sp)
+        .mask   0x0400fe00,-64
+        .frame  sp,64,ra
+        .prologue 0
+
+        ldl     $A,0($ctx)
+        ldl     $B,4($ctx)
+        sll     $num,6,$num
+        ldl     $C,8($ctx)
+        ldl     $D,12($ctx)
+        ldl     $E,16($ctx)
+        addq    $inp,$num,$num
+
+.Lloop:
+        .set    noreorder
+        ldah    $K,23170(zero)
+        zapnot  $B,0xf,$B
+        lda     $K,31129($K)    # K_00_19
+___
+for ($i=0;$i<20;$i++) { &BODY_00_19($i,@V); unshift(@V,pop(@V)); }
+
+$code.=<<___;
+        ldah    $K,28378(zero)
+        lda     $K,-5215($K)    # K_20_39
+___
+for (;$i<40;$i++) { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
+
+$code.=<<___;
+        ldah    $K,-28900(zero)
+        lda     $K,-17188($K)   # K_40_59
+___
+for (;$i<60;$i++) { &BODY_40_59($i,@V); unshift(@V,pop(@V)); }
+
+$code.=<<___;
+        ldah    $K,-13725(zero)
+        lda     $K,-15914($K)   # K_60_79
+___
+for (;$i<80;$i++) { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
+
+$code.=<<___;
+        addl    @X[0],$A,$A
+        addl    @X[1],$B,$B
+        addl    @X[2],$C,$C
+        addl    @X[3],$D,$D
+        addl    @X[4],$E,$E
+        stl     $A,0($ctx)
+        stl     $B,4($ctx)
+        addq    $inp,64,$inp
+        stl     $C,8($ctx)
+        stl     $D,12($ctx)
+        stl     $E,16($ctx)
+        cmpult  $inp,$num,$t1
+        bne     $t1,.Lloop
+
+        .set    noreorder
+        ldq     ra,0(sp)
+        ldq     s0,8(sp)
+        ldq     s1,16(sp)
+        ldq     s2,24(sp)
+        ldq     s3,32(sp)
+        ldq     s4,40(sp)
+        ldq     s5,48(sp)
+        ldq     fp,56(sp)
+        lda     sp,64(sp)
+        ret     (ra)
+.end    sha1_block_data_order
+.ascii  "SHA1 block transform for Alpha, CRYPTOGAMS by <appro\@openssl.org>"
+.align  2
+___
+$output=shift and open STDOUT,">$output";
+print $code;
+close STDOUT;
diff --git a/src/lib/libcrypto/sha/asm/sha1-armv4-large.pl b/src/lib/libcrypto/sha/asm/sha1-armv4-large.pl
index 6e65fe3e01..fe8207f77f 100644
--- a/src/lib/libcrypto/sha/asm/sha1-armv4-large.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-armv4-large.pl
@@ -47,6 +47,10 @@
 # Cortex A8 core and in absolute terms ~870 cycles per input block
 # [or 13.6 cycles per byte].
 
+# February 2011.
+#
+# Profiler-assisted and platform-specific optimization resulted in 10%
+# improvement on Cortex A8 core and 12.2 cycles per byte.
 
 while (($output=shift) && ($output!~/^\w[\w\-]*\.\w+$/)) {}
 open STDOUT,">$output";
@@ -76,31 +80,41 @@ $code.=<<___;
         add     $e,$K,$e,ror#2                  @ E+=K_xx_xx
         ldr     $t3,[$Xi,#2*4]
         eor     $t0,$t0,$t1
-        eor     $t2,$t2,$t3
+        eor     $t2,$t2,$t3                     @ 1 cycle stall
         eor     $t1,$c,$d                       @ F_xx_xx
         mov     $t0,$t0,ror#31
         add     $e,$e,$a,ror#27                 @ E+=ROR(A,27)
         eor     $t0,$t0,$t2,ror#31
+        str     $t0,[$Xi,#-4]!
         $opt1                                   @ F_xx_xx
         $opt2                                   @ F_xx_xx
         add     $e,$e,$t0                       @ E+=X[i]
-        str     $t0,[$Xi,#-4]!
 ___
 }
 
 sub BODY_00_15 {
 my ($a,$b,$c,$d,$e)=@_;
 $code.=<<___;
-        ldrb    $t0,[$inp],#4
-        ldrb    $t1,[$inp,#-1]
-        ldrb    $t2,[$inp,#-2]
+#if __ARM_ARCH__<7
+        ldrb    $t1,[$inp,#2]
+        ldrb    $t0,[$inp,#3]
+        ldrb    $t2,[$inp,#1]
         add     $e,$K,$e,ror#2                  @ E+=K_00_19
-        ldrb    $t3,[$inp,#-3]
+        ldrb    $t3,[$inp],#4
+        orr     $t0,$t0,$t1,lsl#8
+        eor     $t1,$c,$d                       @ F_xx_xx
+        orr     $t0,$t0,$t2,lsl#16
         add     $e,$e,$a,ror#27                 @ E+=ROR(A,27)
-        orr     $t0,$t1,$t0,lsl#24
+        orr     $t0,$t0,$t3,lsl#24
+#else
+        ldr     $t0,[$inp],#4                   @ handles unaligned
+        add     $e,$K,$e,ror#2                  @ E+=K_00_19
         eor     $t1,$c,$d                       @ F_xx_xx
-        orr     $t0,$t0,$t2,lsl#8
-        orr     $t0,$t0,$t3,lsl#16
+        add     $e,$e,$a,ror#27                 @ E+=ROR(A,27)
+#ifdef __ARMEL__
+        rev     $t0,$t0                         @ byte swap
+#endif
+#endif
         and     $t1,$b,$t1,ror#2
         add     $e,$e,$t0                       @ E+=X[i]
         eor     $t1,$t1,$d,ror#2                @ F_00_19(B,C,D)
@@ -136,6 +150,8 @@ ___
 }
 
 $code=<<___;
+#include "arm_arch.h"
+
 .text
 
 .global sha1_block_data_order
@@ -209,10 +225,14 @@ $code.=<<___;
         teq     $inp,$len
         bne     .Lloop                  @ [+18], total 1307
 
+#if __ARM_ARCH__>=5
+        ldmia   sp!,{r4-r12,pc}
+#else
         ldmia   sp!,{r4-r12,lr}
         tst     lr,#1
         moveq   pc,lr                   @ be binary compatible with V4, yet
         bx      lr                      @ interoperable with Thumb ISA:-)
+#endif
 .align  2
 .LK_00_19:      .word   0x5a827999
 .LK_20_39:      .word   0x6ed9eba1
diff --git a/src/lib/libcrypto/sha/asm/sha1-ia64.pl b/src/lib/libcrypto/sha/asm/sha1-ia64.pl
index 51c4f47ecb..db28f0805a 100644
--- a/src/lib/libcrypto/sha/asm/sha1-ia64.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-ia64.pl
@@ -15,7 +15,7 @@
 # is >50% better than HP C and >2x better than gcc.
 
 $code=<<___;
-.ident  \"sha1-ia64.s, version 1.2\"
+.ident  \"sha1-ia64.s, version 1.3\"
 .ident  \"IA-64 ISA artwork by Andy Polyakov <appro\@fy.chalmers.se>\"
 .explicit
 
@@ -26,14 +26,10 @@ if ($^O eq "hpux") {
     $ADDP="addp4";
     for (@ARGV) { $ADDP="add" if (/[\+DD|\-mlp]64/); }
 } else { $ADDP="add"; }
-for (@ARGV) {   $big_endian=1 if (/\-DB_ENDIAN/);
-                $big_endian=0 if (/\-DL_ENDIAN/);   }
-if (!defined($big_endian))
-            {   $big_endian=(unpack('L',pack('N',1))==1);   }
 
 #$human=1;
 if ($human) {   # useful for visual code auditing...
-        ($A,$B,$C,$D,$E,$T)   = ("A","B","C","D","E","T");
+        ($A,$B,$C,$D,$E)   = ("A","B","C","D","E");
         ($h0,$h1,$h2,$h3,$h4) = ("h0","h1","h2","h3","h4");
         ($K_00_19, $K_20_39, $K_40_59, $K_60_79) =
             (   "K_00_19","K_20_39","K_40_59","K_60_79" );
@@ -41,47 +37,50 @@ if ($human) {	# useful for visual code auditing...
                 "X8", "X9","X10","X11","X12","X13","X14","X15"  );
 }
 else {
-        ($A,$B,$C,$D,$E,$T)   = ("loc0","loc1","loc2","loc3","loc4","loc5");
-        ($h0,$h1,$h2,$h3,$h4) = ("loc6","loc7","loc8","loc9","loc10");
+        ($A,$B,$C,$D,$E)   =    ("loc0","loc1","loc2","loc3","loc4");
+        ($h0,$h1,$h2,$h3,$h4) = ("loc5","loc6","loc7","loc8","loc9");
         ($K_00_19, $K_20_39, $K_40_59, $K_60_79) =
-            (   "r14", "r15", "loc11", "loc12"  );
+            (   "r14", "r15", "loc10", "loc11"  );
         @X= (   "r16", "r17", "r18", "r19", "r20", "r21", "r22", "r23",
                 "r24", "r25", "r26", "r27", "r28", "r29", "r30", "r31"  );
 }
 
 sub BODY_00_15 {
 local   *code=shift;
-local   ($i,$a,$b,$c,$d,$e,$f)=@_;
+my      ($i,$a,$b,$c,$d,$e)=@_;
+my      $j=$i+1;
+my      $Xn=@X[$j%16];
 
 $code.=<<___ if ($i==0);
-{ .mmi; ld1     $X[$i&0xf]=[inp],2          // MSB
+{ .mmi; ld1     $X[$i]=[inp],2              // MSB
         ld1     tmp2=[tmp3],2           };;
 { .mmi; ld1     tmp0=[inp],2
         ld1     tmp4=[tmp3],2               // LSB
-        dep     $X[$i&0xf]=$X[$i&0xf],tmp2,8,8  };;
+        dep     $X[$i]=$X[$i],tmp2,8,8  };;
 ___
 if ($i<15) {
         $code.=<<___;
-{ .mmi; ld1     $X[($i+1)&0xf]=[inp],2      // +1
+{ .mmi; ld1     $Xn=[inp],2                 // forward Xload
+        nop.m   0x0
         dep     tmp1=tmp0,tmp4,8,8      };;
-{ .mmi; ld1     tmp2=[tmp3],2               // +1
+{ .mmi; ld1     tmp2=[tmp3],2               // forward Xload
         and     tmp4=$c,$b
-        dep     $X[$i&0xf]=$X[$i&0xf],tmp1,16,16        } //;;
-{ .mmi; andcm   tmp1=$d,$b
-        add     tmp0=$e,$K_00_19
+        dep     $X[$i]=$X[$i],tmp1,16,16} //;;
+{ .mmi; add     $e=$e,$K_00_19              // e+=K_00_19
+        andcm   tmp1=$d,$b
         dep.z   tmp5=$a,5,27            };; // a<<5
-{ .mmi; or      tmp4=tmp4,tmp1              // F_00_19(b,c,d)=(b&c)|(~b&d)
-        add     $f=tmp0,$X[$i&0xf]          // f=xi+e+K_00_19
+{ .mmi; add     $e=$e,$X[$i]                // e+=Xload
+        or      tmp4=tmp4,tmp1              // F_00_19(b,c,d)=(b&c)|(~b&d)
         extr.u  tmp1=$a,27,5            };; // a>>27
-{ .mmi; ld1     tmp0=[inp],2                // +1
-        add     $f=$f,tmp4                  // f+=F_00_19(b,c,d)
+{ .mmi; ld1     tmp0=[inp],2                // forward Xload
+        add     $e=$e,tmp4                  // e+=F_00_19(b,c,d)
         shrp    $b=tmp6,tmp6,2          }   // b=ROTATE(b,30)
-{ .mmi; ld1     tmp4=[tmp3],2               // +1
+{ .mmi; ld1     tmp4=[tmp3],2               // forward Xload
         or      tmp5=tmp1,tmp5              // ROTATE(a,5)
         mux2    tmp6=$a,0x44            };; // see b in next iteration
-{ .mii; add     $f=$f,tmp5                  // f+=ROTATE(a,5)
-        dep     $X[($i+1)&0xf]=$X[($i+1)&0xf],tmp2,8,8  // +1
-        mux2    $X[$i&0xf]=$X[$i&0xf],0x44      } //;;
+{ .mii; add     $e=$e,tmp5                  // e+=ROTATE(a,5)
+        dep     $Xn=$Xn,tmp2,8,8            // forward Xload
+        mux2    $X[$i]=$X[$i],0x44      } //;;
 
 ___
         }
@@ -89,24 +88,24 @@ else	{
         $code.=<<___;
 { .mii; and     tmp3=$c,$b
         dep     tmp1=tmp0,tmp4,8,8;;
-        dep     $X[$i&0xf]=$X[$i&0xf],tmp1,16,16        } //;;
-{ .mmi; andcm   tmp1=$d,$b
-        add     tmp0=$e,$K_00_19
+        dep     $X[$i]=$X[$i],tmp1,16,16} //;;
+{ .mmi; add     $e=$e,$K_00_19              // e+=K_00_19
+        andcm   tmp1=$d,$b
         dep.z   tmp5=$a,5,27            };; // a<<5
-{ .mmi; or      tmp4=tmp3,tmp1              // F_00_19(b,c,d)=(b&c)|(~b&d)
-        add     $f=tmp0,$X[$i&0xf]          // f=xi+e+K_00_19
+{ .mmi; add     $e=$e,$X[$i]                // e+=Xupdate
+        or      tmp4=tmp3,tmp1              // F_00_19(b,c,d)=(b&c)|(~b&d)
         extr.u  tmp1=$a,27,5            }   // a>>27
-{ .mmi; xor     tmp2=$X[($i+0+1)&0xf],$X[($i+2+1)&0xf]  // +1
-        xor     tmp3=$X[($i+8+1)&0xf],$X[($i+13+1)&0xf] // +1
+{ .mmi; xor     $Xn=$Xn,$X[($j+2)%16]       // forward Xupdate
+        xor     tmp3=$X[($j+8)%16],$X[($j+13)%16] // forward Xupdate
         nop.i   0                       };;
-{ .mmi; add     $f=$f,tmp4                  // f+=F_00_19(b,c,d)
-        xor     tmp2=tmp2,tmp3              // +1
+{ .mmi; add     $e=$e,tmp4                  // e+=F_00_19(b,c,d)
+        xor     $Xn=$Xn,tmp3                // forward Xupdate
         shrp    $b=tmp6,tmp6,2          }   // b=ROTATE(b,30)
 { .mmi; or      tmp1=tmp1,tmp5              // ROTATE(a,5)
         mux2    tmp6=$a,0x44            };; // see b in next iteration
-{ .mii; add     $f=$f,tmp1                  // f+=ROTATE(a,5)
-        shrp    $e=tmp2,tmp2,31             // f+1=ROTATE(x[0]^x[2]^x[8]^x[13],1)
-        mux2    $X[$i&0xf]=$X[$i&0xf],0x44  };;
+{ .mii; add     $e=$e,tmp1                  // e+=ROTATE(a,5)
+        shrp    $Xn=$Xn,$Xn,31              // ROTATE(x[0]^x[2]^x[8]^x[13],1)
+        mux2    $X[$i]=$X[$i],0x44      };;
 
 ___
         }
@@ -114,27 +113,28 @@ ___
 
 sub BODY_16_19 {
 local   *code=shift;
-local   ($i,$a,$b,$c,$d,$e,$f)=@_;
+my      ($i,$a,$b,$c,$d,$e)=@_;
+my      $j=$i+1;
+my      $Xn=@X[$j%16];
 
 $code.=<<___;
-{ .mmi; mov     $X[$i&0xf]=$f               // Xupdate
-        and     tmp0=$c,$b
+{ .mib; add     $e=$e,$K_00_19              // e+=K_00_19
         dep.z   tmp5=$a,5,27            }   // a<<5
-{ .mmi; andcm   tmp1=$d,$b
-        add     tmp4=$e,$K_00_19        };;
-{ .mmi; or      tmp0=tmp0,tmp1              // F_00_19(b,c,d)=(b&c)|(~b&d)
-        add     $f=$f,tmp4                  // f+=e+K_00_19
+{ .mib; andcm   tmp1=$d,$b
+        and     tmp0=$c,$b              };;
+{ .mmi; add     $e=$e,$X[$i%16]             // e+=Xupdate
+        or      tmp0=tmp0,tmp1              // F_00_19(b,c,d)=(b&c)|(~b&d)
         extr.u  tmp1=$a,27,5            }   // a>>27
-{ .mmi; xor     tmp2=$X[($i+0+1)&0xf],$X[($i+2+1)&0xf]  // +1
-        xor     tmp3=$X[($i+8+1)&0xf],$X[($i+13+1)&0xf] // +1
+{ .mmi; xor     $Xn=$Xn,$X[($j+2)%16]       // forward Xupdate
+        xor     tmp3=$X[($j+8)%16],$X[($j+13)%16]       // forward Xupdate
         nop.i   0                       };;
-{ .mmi; add     $f=$f,tmp0                  // f+=F_00_19(b,c,d)
-        xor     tmp2=tmp2,tmp3              // +1
+{ .mmi; add     $e=$e,tmp0                  // f+=F_00_19(b,c,d)
+        xor     $Xn=$Xn,tmp3                // forward Xupdate
         shrp    $b=tmp6,tmp6,2          }   // b=ROTATE(b,30)
 { .mmi; or      tmp1=tmp1,tmp5              // ROTATE(a,5)
         mux2    tmp6=$a,0x44            };; // see b in next iteration
-{ .mii; add     $f=$f,tmp1                  // f+=ROTATE(a,5)
-        shrp    $e=tmp2,tmp2,31             // f+1=ROTATE(x[0]^x[2]^x[8]^x[13],1)
+{ .mii; add     $e=$e,tmp1                  // e+=ROTATE(a,5)
+        shrp    $Xn=$Xn,$Xn,31              // ROTATE(x[0]^x[2]^x[8]^x[13],1)
         nop.i   0                       };;
 
 ___
@@ -142,49 +142,47 @@ ___
 
 sub BODY_20_39 {
 local   *code=shift;
-local   ($i,$a,$b,$c,$d,$e,$f,$Konst)=@_;
+my      ($i,$a,$b,$c,$d,$e,$Konst)=@_;
         $Konst = $K_20_39 if (!defined($Konst));
+my      $j=$i+1;
+my      $Xn=@X[$j%16];
 
 if ($i<79) {
 $code.=<<___;
-{ .mib; mov     $X[$i&0xf]=$f               // Xupdate
+{ .mib; add     $e=$e,$Konst                // e+=K_XX_XX
         dep.z   tmp5=$a,5,27            }   // a<<5
 { .mib; xor     tmp0=$c,$b
-        add     tmp4=$e,$Konst          };;
-{ .mmi; xor     tmp0=tmp0,$d                // F_20_39(b,c,d)=b^c^d
-        add     $f=$f,tmp4                  // f+=e+K_20_39
+        xor     $Xn=$Xn,$X[($j+2)%16]   };; // forward Xupdate
+{ .mib; add     $e=$e,$X[$i%16]             // e+=Xupdate
         extr.u  tmp1=$a,27,5            }   // a>>27
-{ .mmi; xor     tmp2=$X[($i+0+1)&0xf],$X[($i+2+1)&0xf]  // +1
-        xor     tmp3=$X[($i+8+1)&0xf],$X[($i+13+1)&0xf] // +1
-        nop.i   0                       };;
-{ .mmi; add     $f=$f,tmp0                  // f+=F_20_39(b,c,d)
-        xor     tmp2=tmp2,tmp3              // +1
+{ .mib; xor     tmp0=tmp0,$d                // F_20_39(b,c,d)=b^c^d
+        xor     $Xn=$Xn,$X[($j+8)%16]   };; // forward Xupdate
+{ .mmi; add     $e=$e,tmp0                  // e+=F_20_39(b,c,d)
+        xor     $Xn=$Xn,$X[($j+13)%16]      // forward Xupdate
         shrp    $b=tmp6,tmp6,2          }   // b=ROTATE(b,30)
 { .mmi; or      tmp1=tmp1,tmp5              // ROTATE(a,5)
         mux2    tmp6=$a,0x44            };; // see b in next iteration
-{ .mii; add     $f=$f,tmp1                  // f+=ROTATE(a,5)
-        shrp    $e=tmp2,tmp2,31             // f+1=ROTATE(x[0]^x[2]^x[8]^x[13],1)
+{ .mii; add     $e=$e,tmp1                  // e+=ROTATE(a,5)
+        shrp    $Xn=$Xn,$Xn,31              // ROTATE(x[0]^x[2]^x[8]^x[13],1)
         nop.i   0                       };;
 
 ___
 }
 else {
 $code.=<<___;
-{ .mib; mov     $X[$i&0xf]=$f               // Xupdate
+{ .mib; add     $e=$e,$Konst                // e+=K_60_79
         dep.z   tmp5=$a,5,27            }   // a<<5
 { .mib; xor     tmp0=$c,$b
-        add     tmp4=$e,$Konst          };;
-{ .mib; xor     tmp0=tmp0,$d                // F_20_39(b,c,d)=b^c^d
-        extr.u  tmp1=$a,27,5            }   // a>>27
-{ .mib; add     $f=$f,tmp4                  // f+=e+K_20_39
         add     $h1=$h1,$a              };; // wrap up
-{ .mmi; add     $f=$f,tmp0                  // f+=F_20_39(b,c,d)
-        shrp    $b=tmp6,tmp6,2          }   // b=ROTATE(b,30) ;;?
-{ .mmi; or      tmp1=tmp1,tmp5              // ROTATE(a,5)
+{ .mib; add     $e=$e,$X[$i%16]             // e+=Xupdate
+        extr.u  tmp1=$a,27,5            }   // a>>27
+{ .mib; xor     tmp0=tmp0,$d                // F_20_39(b,c,d)=b^c^d
         add     $h3=$h3,$c              };; // wrap up
-{ .mib; add     tmp3=1,inp                  // used in unaligned codepath
-        add     $f=$f,tmp1              }   // f+=ROTATE(a,5)
-{ .mib; add     $h2=$h2,$b                  // wrap up
+{ .mmi; add     $e=$e,tmp0                  // e+=F_20_39(b,c,d)
+        or      tmp1=tmp1,tmp5              // ROTATE(a,5)
+        shrp    $b=tmp6,tmp6,2          };; // b=ROTATE(b,30) ;;?
+{ .mmi; add     $e=$e,tmp1                  // e+=ROTATE(a,5)
+        add     tmp3=1,inp                  // used in unaligned codepath
         add     $h4=$h4,$d              };; // wrap up
 
 ___
@@ -193,29 +191,29 @@ ___
 
 sub BODY_40_59 {
 local   *code=shift;
-local   ($i,$a,$b,$c,$d,$e,$f)=@_;
+my      ($i,$a,$b,$c,$d,$e)=@_;
+my      $j=$i+1;
+my      $Xn=@X[$j%16];
 
 $code.=<<___;
-{ .mmi; mov     $X[$i&0xf]=$f               // Xupdate
-        and     tmp0=$c,$b
+{ .mib; add     $e=$e,$K_40_59              // e+=K_40_59
         dep.z   tmp5=$a,5,27            }   // a<<5
-{ .mmi; and     tmp1=$d,$b
-        add     tmp4=$e,$K_40_59        };;
-{ .mmi; or      tmp0=tmp0,tmp1              // (b&c)|(b&d)
-        add     $f=$f,tmp4                  // f+=e+K_40_59
+{ .mib; and     tmp1=$c,$d
+        xor     tmp0=$c,$d              };;
+{ .mmi; add     $e=$e,$X[$i%16]             // e+=Xupdate
+        add     tmp5=tmp5,tmp1              // a<<5+(c&d)
         extr.u  tmp1=$a,27,5            }   // a>>27
-{ .mmi; and     tmp4=$c,$d
-        xor     tmp2=$X[($i+0+1)&0xf],$X[($i+2+1)&0xf]  // +1
-        xor     tmp3=$X[($i+8+1)&0xf],$X[($i+13+1)&0xf] // +1
-        };;
-{ .mmi; or      tmp1=tmp1,tmp5              // ROTATE(a,5)
-        xor     tmp2=tmp2,tmp3              // +1
+{ .mmi; and     tmp0=tmp0,$b
+        xor     $Xn=$Xn,$X[($j+2)%16]       // forward Xupdate
+        xor     tmp3=$X[($j+8)%16],$X[($j+13)%16] };;   // forward Xupdate
+{ .mmi; add     $e=$e,tmp0                  // e+=b&(c^d)
+        add     tmp5=tmp5,tmp1              // ROTATE(a,5)+(c&d)
         shrp    $b=tmp6,tmp6,2          }   // b=ROTATE(b,30)
-{ .mmi; or      tmp0=tmp0,tmp4              // F_40_59(b,c,d)=(b&c)|(b&d)|(c&d)
+{ .mmi; xor     $Xn=$Xn,tmp3
         mux2    tmp6=$a,0x44            };; // see b in next iteration
-{ .mii; add     $f=$f,tmp0                  // f+=F_40_59(b,c,d)
-        shrp    $e=tmp2,tmp2,31;;           // f+1=ROTATE(x[0]^x[2]^x[8]^x[13],1)
-        add     $f=$f,tmp1              };; // f+=ROTATE(a,5)
+{ .mii; add     $e=$e,tmp5                  // e+=ROTATE(a,5)+(c&d)
+        shrp    $Xn=$Xn,$Xn,31              // ROTATE(x[0]^x[2]^x[8]^x[13],1)
+        nop.i   0x0                     };;
 
 ___
 }
@@ -237,7 +235,7 @@ inp=r33;	// in1
 .align  32
 sha1_block_data_order:
         .prologue
-{ .mmi; alloc   tmp1=ar.pfs,3,15,0,0
+{ .mmi; alloc   tmp1=ar.pfs,3,14,0,0
         $ADDP   tmp0=4,ctx
         .save   ar.lc,r3
         mov     r3=ar.lc                }
@@ -245,8 +243,8 @@ sha1_block_data_order:
         $ADDP   inp=0,inp
         mov     r2=pr                   };;
 tmp4=in2;
-tmp5=loc13;
-tmp6=loc14;
+tmp5=loc12;
+tmp6=loc13;
         .body
 { .mlx; ld4     $h0=[ctx],8
         movl    $K_00_19=0x5a827999     }
@@ -273,7 +271,7 @@ tmp6=loc14;
 
 ___
 
-{ my $i,@V=($A,$B,$C,$D,$E,$T);
+{ my $i,@V=($A,$B,$C,$D,$E);
 
         for($i=0;$i<16;$i++)    { &BODY_00_15(\$code,$i,@V); unshift(@V,pop(@V)); }
         for(;$i<20;$i++)        { &BODY_16_19(\$code,$i,@V); unshift(@V,pop(@V)); }
@@ -281,12 +279,12 @@ ___
         for(;$i<60;$i++)        { &BODY_40_59(\$code,$i,@V); unshift(@V,pop(@V)); }
         for(;$i<80;$i++)        { &BODY_60_79(\$code,$i,@V); unshift(@V,pop(@V)); }
 
-        (($V[5] eq $D) and ($V[0] eq $E)) or die;       # double-check
+        (($V[0] eq $A) and ($V[4] eq $E)) or die;       # double-check
 }
 
 $code.=<<___;
-{ .mmb; add     $h0=$h0,$E
-        nop.m   0
+{ .mmb; add     $h0=$h0,$A
+        add     $h2=$h2,$C
         br.ctop.dptk.many       .Ldtop  };;
 .Ldend:
 { .mmi; add     tmp0=4,ctx
diff --git a/src/lib/libcrypto/sha/asm/sha1-mips.pl b/src/lib/libcrypto/sha/asm/sha1-mips.pl
new file mode 100644
index 0000000000..f1a702f38f
--- /dev/null
+++ b/src/lib/libcrypto/sha/asm/sha1-mips.pl
@@ -0,0 +1,354 @@
+#!/usr/bin/env perl
+
+# ====================================================================
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# project. The module is, however, dual licensed under OpenSSL and
+# CRYPTOGAMS licenses depending on where you obtain it. For further
+# details see http://www.openssl.org/~appro/cryptogams/.
+# ====================================================================
+
+# SHA1 block procedure for MIPS.
+
+# Performance improvement is 30% on unaligned input. The "secret" is
+# to deploy lwl/lwr pair to load unaligned input. One could have
+# vectorized Xupdate on MIPSIII/IV, but the goal was to code MIPS32-
+# compatible subroutine. There is room for minor optimization on
+# little-endian platforms...
+
+######################################################################
+# There is a number of MIPS ABI in use, O32 and N32/64 are most
+# widely used. Then there is a new contender: NUBI. It appears that if
+# one picks the latter, it's possible to arrange code in ABI neutral
+# manner. Therefore let's stick to NUBI register layout:
+#
+($zero,$at,$t0,$t1,$t2)=map("\$$_",(0..2,24,25));
+($a0,$a1,$a2,$a3,$a4,$a5,$a6,$a7)=map("\$$_",(4..11));
+($s0,$s1,$s2,$s3,$s4,$s5,$s6,$s7,$s8,$s9,$s10,$s11)=map("\$$_",(12..23));
+($gp,$tp,$sp,$fp,$ra)=map("\$$_",(3,28..31));
+#
+# The return value is placed in $a0. Following coding rules facilitate
+# interoperability:
+#
+# - never ever touch $tp, "thread pointer", former $gp;
+# - copy return value to $t0, former $v0 [or to $a0 if you're adapting
+#   old code];
+# - on O32 populate $a4-$a7 with 'lw $aN,4*N($sp)' if necessary;
+#
+# For reference here is register layout for N32/64 MIPS ABIs:
+#
+# ($zero,$at,$v0,$v1)=map("\$$_",(0..3));
+# ($a0,$a1,$a2,$a3,$a4,$a5,$a6,$a7)=map("\$$_",(4..11));
+# ($t0,$t1,$t2,$t3,$t8,$t9)=map("\$$_",(12..15,24,25));
+# ($s0,$s1,$s2,$s3,$s4,$s5,$s6,$s7)=map("\$$_",(16..23));
+# ($gp,$sp,$fp,$ra)=map("\$$_",(28..31));
+#
+$flavour = shift; # supported flavours are o32,n32,64,nubi32,nubi64
+
+if ($flavour =~ /64|n32/i) {
+        $PTR_ADD="dadd";        # incidentally works even on n32
+        $PTR_SUB="dsub";        # incidentally works even on n32
+        $REG_S="sd";
+        $REG_L="ld";
+        $PTR_SLL="dsll";        # incidentally works even on n32
+        $SZREG=8;
+} else {
+        $PTR_ADD="add";
+        $PTR_SUB="sub";
+        $REG_S="sw";
+        $REG_L="lw";
+        $PTR_SLL="sll";
+        $SZREG=4;
+}
+#
+# <appro@openssl.org>
+#
+######################################################################
+
+$big_endian=(`echo MIPSEL | $ENV{CC} -E -P -`=~/MIPSEL/)?1:0;
+
+for (@ARGV) {   $output=$_ if (/^\w[\w\-]*\.\w+$/);   }
+open STDOUT,">$output";
+
+if (!defined($big_endian))
+            {   $big_endian=(unpack('L',pack('N',1))==1);   }
+
+# offsets of the Most and Least Significant Bytes
+$MSB=$big_endian?0:3;
+$LSB=3&~$MSB;
+
+@X=map("\$$_",(8..23)); # a4-a7,s0-s11
+
+$ctx=$a0;
+$inp=$a1;
+$num=$a2;
+$A="\$1";
+$B="\$2";
+$C="\$3";
+$D="\$7";
+$E="\$24";      @V=($A,$B,$C,$D,$E);
+$t0="\$25";
+$t1=$num;       # $num is offloaded to stack
+$t2="\$30";     # fp
+$K="\$31";      # ra
+
+sub BODY_00_14 {
+my ($i,$a,$b,$c,$d,$e)=@_;
+my $j=$i+1;
+$code.=<<___    if (!$big_endian);
+        srl     $t0,@X[$i],24   # byte swap($i)
+        srl     $t1,@X[$i],8
+        andi    $t2,@X[$i],0xFF00
+        sll     @X[$i],@X[$i],24
+        andi    $t1,0xFF00
+        sll     $t2,$t2,8
+        or      @X[$i],$t0
+        or      $t1,$t2
+        or      @X[$i],$t1
+___
+$code.=<<___;
+         lwl    @X[$j],$j*4+$MSB($inp)
+        sll     $t0,$a,5        # $i
+        addu    $e,$K
+         lwr    @X[$j],$j*4+$LSB($inp)
+        srl     $t1,$a,27
+        addu    $e,$t0
+        xor     $t0,$c,$d
+        addu    $e,$t1
+        sll     $t2,$b,30
+        and     $t0,$b
+        srl     $b,$b,2
+        xor     $t0,$d
+        addu    $e,@X[$i]
+        or      $b,$t2
+        addu    $e,$t0
+___
+}
+
+sub BODY_15_19 {
+my ($i,$a,$b,$c,$d,$e)=@_;
+my $j=$i+1;
+
+$code.=<<___    if (!$big_endian && $i==15);
+        srl     $t0,@X[$i],24   # byte swap($i)
+        srl     $t1,@X[$i],8
+        andi    $t2,@X[$i],0xFF00
+        sll     @X[$i],@X[$i],24
+        andi    $t1,0xFF00
+        sll     $t2,$t2,8
+        or      @X[$i],$t0
+        or      @X[$i],$t1
+        or      @X[$i],$t2
+___
+$code.=<<___;
+         xor    @X[$j%16],@X[($j+2)%16]
+        sll     $t0,$a,5        # $i
+        addu    $e,$K
+        srl     $t1,$a,27
+        addu    $e,$t0
+         xor    @X[$j%16],@X[($j+8)%16]
+        xor     $t0,$c,$d
+        addu    $e,$t1
+         xor    @X[$j%16],@X[($j+13)%16]
+        sll     $t2,$b,30
+        and     $t0,$b
+         srl    $t1,@X[$j%16],31
+         addu   @X[$j%16],@X[$j%16]
+        srl     $b,$b,2
+        xor     $t0,$d
+         or     @X[$j%16],$t1
+        addu    $e,@X[$i%16]
+        or      $b,$t2
+        addu    $e,$t0
+___
+}
+
+sub BODY_20_39 {
+my ($i,$a,$b,$c,$d,$e)=@_;
+my $j=$i+1;
+$code.=<<___ if ($i<79);
+         xor    @X[$j%16],@X[($j+2)%16]
+        sll     $t0,$a,5        # $i
+        addu    $e,$K
+        srl     $t1,$a,27
+        addu    $e,$t0
+         xor    @X[$j%16],@X[($j+8)%16]
+        xor     $t0,$c,$d
+        addu    $e,$t1
+         xor    @X[$j%16],@X[($j+13)%16]
+        sll     $t2,$b,30
+        xor     $t0,$b
+         srl    $t1,@X[$j%16],31
+         addu   @X[$j%16],@X[$j%16]
+        srl     $b,$b,2
+        addu    $e,@X[$i%16]
+         or     @X[$j%16],$t1
+        or      $b,$t2
+        addu    $e,$t0
+___
+$code.=<<___ if ($i==79);
+         lw     @X[0],0($ctx)
+        sll     $t0,$a,5        # $i
+        addu    $e,$K
+         lw     @X[1],4($ctx)
+        srl     $t1,$a,27
+        addu    $e,$t0
+         lw     @X[2],8($ctx)
+        xor     $t0,$c,$d
+        addu    $e,$t1
+         lw     @X[3],12($ctx)
+        sll     $t2,$b,30
+        xor     $t0,$b
+         lw     @X[4],16($ctx)
+        srl     $b,$b,2
+        addu    $e,@X[$i%16]
+        or      $b,$t2
+        addu    $e,$t0
+___
+}
+
+sub BODY_40_59 {
+my ($i,$a,$b,$c,$d,$e)=@_;
+my $j=$i+1;
+$code.=<<___ if ($i<79);
+         xor    @X[$j%16],@X[($j+2)%16]
+        sll     $t0,$a,5        # $i
+        addu    $e,$K
+        srl     $t1,$a,27
+        addu    $e,$t0
+         xor    @X[$j%16],@X[($j+8)%16]
+        and     $t0,$c,$d
+        addu    $e,$t1
+         xor    @X[$j%16],@X[($j+13)%16]
+        sll     $t2,$b,30
+        addu    $e,$t0
+         srl    $t1,@X[$j%16],31
+        xor     $t0,$c,$d
+         addu   @X[$j%16],@X[$j%16]
+        and     $t0,$b
+        srl     $b,$b,2
+         or     @X[$j%16],$t1
+        addu    $e,@X[$i%16]
+        or      $b,$t2
+        addu    $e,$t0
+___
+}
+
+$FRAMESIZE=16;  # large enough to accomodate NUBI saved registers
+$SAVED_REGS_MASK = ($flavour =~ /nubi/i) ? 0xc0fff008 : 0xc0ff0000;
+
+$code=<<___;
+#ifdef OPENSSL_FIPSCANISTER
+# include <openssl/fipssyms.h>
+#endif
+
+.text
+
+.set    noat
+.set    noreorder
+.align  5
+.globl  sha1_block_data_order
+.ent    sha1_block_data_order
+sha1_block_data_order:
+        .frame  $sp,$FRAMESIZE*$SZREG,$ra
+        .mask   $SAVED_REGS_MASK,-$SZREG
+        .set    noreorder
+        $PTR_SUB $sp,$FRAMESIZE*$SZREG
+        $REG_S  $ra,($FRAMESIZE-1)*$SZREG($sp)
+        $REG_S  $fp,($FRAMESIZE-2)*$SZREG($sp)
+        $REG_S  $s11,($FRAMESIZE-3)*$SZREG($sp)
+        $REG_S  $s10,($FRAMESIZE-4)*$SZREG($sp)
+        $REG_S  $s9,($FRAMESIZE-5)*$SZREG($sp)
+        $REG_S  $s8,($FRAMESIZE-6)*$SZREG($sp)
+        $REG_S  $s7,($FRAMESIZE-7)*$SZREG($sp)
+        $REG_S  $s6,($FRAMESIZE-8)*$SZREG($sp)
+        $REG_S  $s5,($FRAMESIZE-9)*$SZREG($sp)
+        $REG_S  $s4,($FRAMESIZE-10)*$SZREG($sp)
+___
+$code.=<<___ if ($flavour =~ /nubi/i);  # optimize non-nubi prologue
+        $REG_S  $s3,($FRAMESIZE-11)*$SZREG($sp)
+        $REG_S  $s2,($FRAMESIZE-12)*$SZREG($sp)
+        $REG_S  $s1,($FRAMESIZE-13)*$SZREG($sp)
+        $REG_S  $s0,($FRAMESIZE-14)*$SZREG($sp)
+        $REG_S  $gp,($FRAMESIZE-15)*$SZREG($sp)
+___
+$code.=<<___;
+        $PTR_SLL $num,6
+        $PTR_ADD $num,$inp
+        $REG_S  $num,0($sp)
+        lw      $A,0($ctx)
+        lw      $B,4($ctx)
+        lw      $C,8($ctx)
+        lw      $D,12($ctx)
+        b       .Loop
+        lw      $E,16($ctx)
+.align  4
+.Loop:
+        .set    reorder
+        lwl     @X[0],$MSB($inp)
+        lui     $K,0x5a82
+        lwr     @X[0],$LSB($inp)
+        ori     $K,0x7999       # K_00_19
+___
+for ($i=0;$i<15;$i++)   { &BODY_00_14($i,@V); unshift(@V,pop(@V)); }
+for (;$i<20;$i++)       { &BODY_15_19($i,@V); unshift(@V,pop(@V)); }
+$code.=<<___;
+        lui     $K,0x6ed9
+        ori     $K,0xeba1       # K_20_39
+___
+for (;$i<40;$i++)       { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
+$code.=<<___;
+        lui     $K,0x8f1b
+        ori     $K,0xbcdc       # K_40_59
+___
+for (;$i<60;$i++)       { &BODY_40_59($i,@V); unshift(@V,pop(@V)); }
+$code.=<<___;
+        lui     $K,0xca62
+        ori     $K,0xc1d6       # K_60_79
+___
+for (;$i<80;$i++)       { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
+$code.=<<___;
+        $PTR_ADD $inp,64
+        $REG_L  $num,0($sp)
+
+        addu    $A,$X[0]
+        addu    $B,$X[1]
+        sw      $A,0($ctx)
+        addu    $C,$X[2]
+        addu    $D,$X[3]
+        sw      $B,4($ctx)
+        addu    $E,$X[4]
+        sw      $C,8($ctx)
+        sw      $D,12($ctx)
+        sw      $E,16($ctx)
+        .set    noreorder
+        bne     $inp,$num,.Loop
+        nop
+
+        .set    noreorder
+        $REG_L  $ra,($FRAMESIZE-1)*$SZREG($sp)
+        $REG_L  $fp,($FRAMESIZE-2)*$SZREG($sp)
+        $REG_L  $s11,($FRAMESIZE-3)*$SZREG($sp)
+        $REG_L  $s10,($FRAMESIZE-4)*$SZREG($sp)
+        $REG_L  $s9,($FRAMESIZE-5)*$SZREG($sp)
+        $REG_L  $s8,($FRAMESIZE-6)*$SZREG($sp)
+        $REG_L  $s7,($FRAMESIZE-7)*$SZREG($sp)
+        $REG_L  $s6,($FRAMESIZE-8)*$SZREG($sp)
+        $REG_L  $s5,($FRAMESIZE-9)*$SZREG($sp)
+        $REG_L  $s4,($FRAMESIZE-10)*$SZREG($sp)
+___
+$code.=<<___ if ($flavour =~ /nubi/i);
+        $REG_L  $s3,($FRAMESIZE-11)*$SZREG($sp)
+        $REG_L  $s2,($FRAMESIZE-12)*$SZREG($sp)
+        $REG_L  $s1,($FRAMESIZE-13)*$SZREG($sp)
+        $REG_L  $s0,($FRAMESIZE-14)*$SZREG($sp)
+        $REG_L  $gp,($FRAMESIZE-15)*$SZREG($sp)
+___
+$code.=<<___;
+        jr      $ra
+        $PTR_ADD $sp,$FRAMESIZE*$SZREG
+.end    sha1_block_data_order
+.rdata
+.asciiz "SHA1 for MIPS, CRYPTOGAMS by <appro\@openssl.org>"
+___
+print $code;
+close STDOUT;
diff --git a/src/lib/libcrypto/sha/asm/sha1-parisc.pl b/src/lib/libcrypto/sha/asm/sha1-parisc.pl
new file mode 100644
index 0000000000..6d7bf495b2
--- /dev/null
+++ b/src/lib/libcrypto/sha/asm/sha1-parisc.pl
@@ -0,0 +1,259 @@
+#!/usr/bin/env perl
+
+# ====================================================================
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# project. The module is, however, dual licensed under OpenSSL and
+# CRYPTOGAMS licenses depending on where you obtain it. For further
+# details see http://www.openssl.org/~appro/cryptogams/.
+# ====================================================================
+
+# SHA1 block procedure for PA-RISC.
+
+# June 2009.
+#
+# On PA-7100LC performance is >30% better than gcc 3.2 generated code
+# for aligned input and >50% better for unaligned. Compared to vendor
+# compiler on PA-8600 it's almost 60% faster in 64-bit build and just
+# few percent faster in 32-bit one (this for aligned input, data for
+# unaligned input is not available).
+#
+# Special thanks to polarhome.com for providing HP-UX account.
+
+$flavour = shift;
+$output = shift;
+open STDOUT,">$output";
+
+if ($flavour =~ /64/) {
+        $LEVEL          ="2.0W";
+        $SIZE_T         =8;
+        $FRAME_MARKER   =80;
+        $SAVED_RP       =16;
+        $PUSH           ="std";
+        $PUSHMA         ="std,ma";
+        $POP            ="ldd";
+        $POPMB          ="ldd,mb";
+} else {
+        $LEVEL          ="1.0";
+        $SIZE_T         =4;
+        $FRAME_MARKER   =48;
+        $SAVED_RP       =20;
+        $PUSH           ="stw";
+        $PUSHMA         ="stwm";
+        $POP            ="ldw";
+        $POPMB          ="ldwm";
+}
+
+$FRAME=14*$SIZE_T+$FRAME_MARKER;# 14 saved regs + frame marker
+                                #                 [+ argument transfer]
+$ctx="%r26";            # arg0
+$inp="%r25";            # arg1
+$num="%r24";            # arg2
+
+$t0="%r28";
+$t1="%r29";
+$K="%r31";
+
+@X=("%r1", "%r2", "%r3", "%r4", "%r5", "%r6", "%r7", "%r8",
+    "%r9", "%r10","%r11","%r12","%r13","%r14","%r15","%r16",$t0);
+
+@V=($A,$B,$C,$D,$E)=("%r19","%r20","%r21","%r22","%r23");
+
+sub BODY_00_19 {
+my ($i,$a,$b,$c,$d,$e)=@_;
+my $j=$i+1;
+$code.=<<___ if ($i<15);
+        addl    $K,$e,$e        ; $i
+        shd     $a,$a,27,$t1
+        addl    @X[$i],$e,$e
+        and     $c,$b,$t0
+        addl    $t1,$e,$e
+        andcm   $d,$b,$t1
+        shd     $b,$b,2,$b
+        or      $t1,$t0,$t0
+        addl    $t0,$e,$e
+___
+$code.=<<___ if ($i>=15);       # with forward Xupdate
+        addl    $K,$e,$e        ; $i
+        shd     $a,$a,27,$t1
+        xor     @X[($j+2)%16],@X[$j%16],@X[$j%16]
+        addl    @X[$i%16],$e,$e
+        and     $c,$b,$t0
+        xor     @X[($j+8)%16],@X[$j%16],@X[$j%16]
+        addl    $t1,$e,$e
+        andcm   $d,$b,$t1
+        shd     $b,$b,2,$b
+        or      $t1,$t0,$t0
+        xor     @X[($j+13)%16],@X[$j%16],@X[$j%16]
+        add     $t0,$e,$e
+        shd     @X[$j%16],@X[$j%16],31,@X[$j%16]
+___
+}
+
+sub BODY_20_39 {
+my ($i,$a,$b,$c,$d,$e)=@_;
+my $j=$i+1;
+$code.=<<___ if ($i<79);
+        xor     @X[($j+2)%16],@X[$j%16],@X[$j%16]       ; $i
+        addl    $K,$e,$e
+        shd     $a,$a,27,$t1
+        xor     @X[($j+8)%16],@X[$j%16],@X[$j%16]
+        addl    @X[$i%16],$e,$e
+        xor     $b,$c,$t0
+        xor     @X[($j+13)%16],@X[$j%16],@X[$j%16]
+        addl    $t1,$e,$e
+        shd     $b,$b,2,$b
+        xor     $d,$t0,$t0
+        shd     @X[$j%16],@X[$j%16],31,@X[$j%16]
+        addl    $t0,$e,$e
+___
+$code.=<<___ if ($i==79);       # with context load
+        ldw     0($ctx),@X[0]   ; $i
+        addl    $K,$e,$e
+        shd     $a,$a,27,$t1
+        ldw     4($ctx),@X[1]
+        addl    @X[$i%16],$e,$e
+        xor     $b,$c,$t0
+        ldw     8($ctx),@X[2]
+        addl    $t1,$e,$e
+        shd     $b,$b,2,$b
+        xor     $d,$t0,$t0
+        ldw     12($ctx),@X[3]
+        addl    $t0,$e,$e
+        ldw     16($ctx),@X[4]
+___
+}
+
+sub BODY_40_59 {
+my ($i,$a,$b,$c,$d,$e)=@_;
+my $j=$i+1;
+$code.=<<___;
+        shd     $a,$a,27,$t1    ; $i
+        addl    $K,$e,$e
+        xor     @X[($j+2)%16],@X[$j%16],@X[$j%16]
+        xor     $d,$c,$t0
+        addl    @X[$i%16],$e,$e
+        xor     @X[($j+8)%16],@X[$j%16],@X[$j%16]
+        and     $b,$t0,$t0
+        addl    $t1,$e,$e
+        shd     $b,$b,2,$b
+        xor     @X[($j+13)%16],@X[$j%16],@X[$j%16]
+        addl    $t0,$e,$e
+        and     $d,$c,$t1
+        shd     @X[$j%16],@X[$j%16],31,@X[$j%16]
+        addl    $t1,$e,$e
+___
+}
+
+$code=<<___;
+        .LEVEL  $LEVEL
+        .SPACE  \$TEXT\$
+        .SUBSPA \$CODE\$,QUAD=0,ALIGN=8,ACCESS=0x2C,CODE_ONLY
+
+        .EXPORT sha1_block_data_order,ENTRY,ARGW0=GR,ARGW1=GR,ARGW2=GR
+sha1_block_data_order
+        .PROC
+        .CALLINFO       FRAME=`$FRAME-14*$SIZE_T`,NO_CALLS,SAVE_RP,ENTRY_GR=16
+        .ENTRY
+        $PUSH   %r2,-$SAVED_RP(%sp)     ; standard prologue
+        $PUSHMA %r3,$FRAME(%sp)
+        $PUSH   %r4,`-$FRAME+1*$SIZE_T`(%sp)
+        $PUSH   %r5,`-$FRAME+2*$SIZE_T`(%sp)
+        $PUSH   %r6,`-$FRAME+3*$SIZE_T`(%sp)
+        $PUSH   %r7,`-$FRAME+4*$SIZE_T`(%sp)
+        $PUSH   %r8,`-$FRAME+5*$SIZE_T`(%sp)
+        $PUSH   %r9,`-$FRAME+6*$SIZE_T`(%sp)
+        $PUSH   %r10,`-$FRAME+7*$SIZE_T`(%sp)
+        $PUSH   %r11,`-$FRAME+8*$SIZE_T`(%sp)
+        $PUSH   %r12,`-$FRAME+9*$SIZE_T`(%sp)
+        $PUSH   %r13,`-$FRAME+10*$SIZE_T`(%sp)
+        $PUSH   %r14,`-$FRAME+11*$SIZE_T`(%sp)
+        $PUSH   %r15,`-$FRAME+12*$SIZE_T`(%sp)
+        $PUSH   %r16,`-$FRAME+13*$SIZE_T`(%sp)
+
+        ldw     0($ctx),$A
+        ldw     4($ctx),$B
+        ldw     8($ctx),$C
+        ldw     12($ctx),$D
+        ldw     16($ctx),$E
+
+        extru   $inp,31,2,$t0           ; t0=inp&3;
+        sh3addl $t0,%r0,$t0             ; t0*=8;
+        subi    32,$t0,$t0              ; t0=32-t0;
+        mtctl   $t0,%cr11               ; %sar=t0;
+
+L\$oop
+        ldi     3,$t0
+        andcm   $inp,$t0,$t0            ; 64-bit neutral
+___
+        for ($i=0;$i<15;$i++) {         # load input block
+        $code.="\tldw   `4*$i`($t0),@X[$i]\n";          }
+$code.=<<___;
+        cmpb,*= $inp,$t0,L\$aligned
+        ldw     60($t0),@X[15]
+        ldw     64($t0),@X[16]
+___
+        for ($i=0;$i<16;$i++) {         # align input
+        $code.="\tvshd  @X[$i],@X[$i+1],@X[$i]\n";      }
+$code.=<<___;
+L\$aligned
+        ldil    L'0x5a827000,$K         ; K_00_19
+        ldo     0x999($K),$K
+___
+for ($i=0;$i<20;$i++)   { &BODY_00_19($i,@V); unshift(@V,pop(@V)); }
+$code.=<<___;
+        ldil    L'0x6ed9e000,$K         ; K_20_39
+        ldo     0xba1($K),$K
+___
+
+for (;$i<40;$i++)       { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
+$code.=<<___;
+        ldil    L'0x8f1bb000,$K         ; K_40_59
+        ldo     0xcdc($K),$K
+___
+
+for (;$i<60;$i++)       { &BODY_40_59($i,@V); unshift(@V,pop(@V)); }
+$code.=<<___;
+        ldil    L'0xca62c000,$K         ; K_60_79
+        ldo     0x1d6($K),$K
+___
+for (;$i<80;$i++)       { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
+
+$code.=<<___;
+        addl    @X[0],$A,$A
+        addl    @X[1],$B,$B
+        addl    @X[2],$C,$C
+        addl    @X[3],$D,$D
+        addl    @X[4],$E,$E
+        stw     $A,0($ctx)
+        stw     $B,4($ctx)
+        stw     $C,8($ctx)
+        stw     $D,12($ctx)
+        stw     $E,16($ctx)
+        addib,*<> -1,$num,L\$oop
+        ldo     64($inp),$inp
+
+        $POP    `-$FRAME-$SAVED_RP`(%sp),%r2    ; standard epilogue
+        $POP    `-$FRAME+1*$SIZE_T`(%sp),%r4
+        $POP    `-$FRAME+2*$SIZE_T`(%sp),%r5
+        $POP    `-$FRAME+3*$SIZE_T`(%sp),%r6
+        $POP    `-$FRAME+4*$SIZE_T`(%sp),%r7
+        $POP    `-$FRAME+5*$SIZE_T`(%sp),%r8
+        $POP    `-$FRAME+6*$SIZE_T`(%sp),%r9
+        $POP    `-$FRAME+7*$SIZE_T`(%sp),%r10
+        $POP    `-$FRAME+8*$SIZE_T`(%sp),%r11
+        $POP    `-$FRAME+9*$SIZE_T`(%sp),%r12
+        $POP    `-$FRAME+10*$SIZE_T`(%sp),%r13
+        $POP    `-$FRAME+11*$SIZE_T`(%sp),%r14
+        $POP    `-$FRAME+12*$SIZE_T`(%sp),%r15
+        $POP    `-$FRAME+13*$SIZE_T`(%sp),%r16
+        bv      (%r2)
+        .EXIT
+        $POPMB  -$FRAME(%sp),%r3
+        .PROCEND
+        .STRINGZ "SHA1 block transform for PA-RISC, CRYPTOGAMS by <appro\@openssl.org>"
+___
+
+$code =~ s/\`([^\`]*)\`/eval $1/gem;
+$code =~ s/,\*/,/gm if ($SIZE_T==4);
+print $code;
+close STDOUT;
diff --git a/src/lib/libcrypto/sha/asm/sha1-ppc.pl b/src/lib/libcrypto/sha/asm/sha1-ppc.pl
index dcd0fcdfcf..2140dd2f8d 100755
--- a/src/lib/libcrypto/sha/asm/sha1-ppc.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-ppc.pl
@@ -24,12 +24,14 @@ $flavour = shift;
 
 if ($flavour =~ /64/) {
         $SIZE_T =8;
+        $LRSAVE =2*$SIZE_T;
         $UCMP   ="cmpld";
         $STU    ="stdu";
         $POP    ="ld";
         $PUSH   ="std";
 } elsif ($flavour =~ /32/) {
         $SIZE_T =4;
+        $LRSAVE =$SIZE_T;
         $UCMP   ="cmplw";
         $STU    ="stwu";
         $POP    ="lwz";
@@ -43,7 +45,8 @@ die "can't locate ppc-xlate.pl";
 
 open STDOUT,"| $^X $xlate $flavour ".shift || die "can't call $xlate: $!";
 
-$FRAME=24*$SIZE_T;
+$FRAME=24*$SIZE_T+64;
+$LOCALS=6*$SIZE_T;
 
 $K  ="r0";
 $sp ="r1";
@@ -162,9 +165,8 @@ $code=<<___;
 .globl  .sha1_block_data_order
 .align  4
 .sha1_block_data_order:
+        $STU    $sp,-$FRAME($sp)
         mflr    r0
-        $STU    $sp,`-($FRAME+64)`($sp)
-        $PUSH   r0,`$FRAME-$SIZE_T*18`($sp)
         $PUSH   r15,`$FRAME-$SIZE_T*17`($sp)
         $PUSH   r16,`$FRAME-$SIZE_T*16`($sp)
         $PUSH   r17,`$FRAME-$SIZE_T*15`($sp)
@@ -182,6 +184,7 @@ $code=<<___;
         $PUSH   r29,`$FRAME-$SIZE_T*3`($sp)
         $PUSH   r30,`$FRAME-$SIZE_T*2`($sp)
         $PUSH   r31,`$FRAME-$SIZE_T*1`($sp)
+        $PUSH   r0,`$FRAME+$LRSAVE`($sp)
         lwz     $A,0($ctx)
         lwz     $B,4($ctx)
         lwz     $C,8($ctx)
@@ -192,37 +195,14 @@ $code=<<___;
 Laligned:
         mtctr   $num
         bl      Lsha1_block_private
-Ldone:
-        $POP    r0,`$FRAME-$SIZE_T*18`($sp)
-        $POP    r15,`$FRAME-$SIZE_T*17`($sp)
-        $POP    r16,`$FRAME-$SIZE_T*16`($sp)
-        $POP    r17,`$FRAME-$SIZE_T*15`($sp)
-        $POP    r18,`$FRAME-$SIZE_T*14`($sp)
-        $POP    r19,`$FRAME-$SIZE_T*13`($sp)
-        $POP    r20,`$FRAME-$SIZE_T*12`($sp)
-        $POP    r21,`$FRAME-$SIZE_T*11`($sp)
-        $POP    r22,`$FRAME-$SIZE_T*10`($sp)
-        $POP    r23,`$FRAME-$SIZE_T*9`($sp)
-        $POP    r24,`$FRAME-$SIZE_T*8`($sp)
-        $POP    r25,`$FRAME-$SIZE_T*7`($sp)
-        $POP    r26,`$FRAME-$SIZE_T*6`($sp)
-        $POP    r27,`$FRAME-$SIZE_T*5`($sp)
-        $POP    r28,`$FRAME-$SIZE_T*4`($sp)
-        $POP    r29,`$FRAME-$SIZE_T*3`($sp)
-        $POP    r30,`$FRAME-$SIZE_T*2`($sp)
-        $POP    r31,`$FRAME-$SIZE_T*1`($sp)
-        mtlr    r0
-        addi    $sp,$sp,`$FRAME+64`
-        blr
-___
+        b       Ldone
 
-# PowerPC specification allows an implementation to be ill-behaved
-# upon unaligned access which crosses page boundary. "Better safe
-# than sorry" principle makes me treat it specially. But I don't
-# look for particular offending word, but rather for 64-byte input
-# block which crosses the boundary. Once found that block is aligned
-# and hashed separately...
-$code.=<<___;
+; PowerPC specification allows an implementation to be ill-behaved
+; upon unaligned access which crosses page boundary. "Better safe
+; than sorry" principle makes me treat it specially. But I don't
+; look for particular offending word, but rather for 64-byte input
+; block which crosses the boundary. Once found that block is aligned
+; and hashed separately...
 .align  4
 Lunaligned:
         subfic  $t1,$inp,4096
@@ -237,7 +217,7 @@ Lunaligned:
 Lcross_page:
         li      $t1,16
         mtctr   $t1
-        addi    r20,$sp,$FRAME  ; spot below the frame
+        addi    r20,$sp,$LOCALS ; spot within the frame
 Lmemcpy:
         lbz     r16,0($inp)
         lbz     r17,1($inp)
@@ -251,15 +231,40 @@ Lmemcpy:
         addi    r20,r20,4
         bdnz    Lmemcpy
 
-        $PUSH   $inp,`$FRAME-$SIZE_T*19`($sp)
+        $PUSH   $inp,`$FRAME-$SIZE_T*18`($sp)
         li      $t1,1
-        addi    $inp,$sp,$FRAME
+        addi    $inp,$sp,$LOCALS
         mtctr   $t1
         bl      Lsha1_block_private
-        $POP    $inp,`$FRAME-$SIZE_T*19`($sp)
+        $POP    $inp,`$FRAME-$SIZE_T*18`($sp)
         addic.  $num,$num,-1
         bne-    Lunaligned
-        b       Ldone
+
+Ldone:
+        $POP    r0,`$FRAME+$LRSAVE`($sp)
+        $POP    r15,`$FRAME-$SIZE_T*17`($sp)
+        $POP    r16,`$FRAME-$SIZE_T*16`($sp)
+        $POP    r17,`$FRAME-$SIZE_T*15`($sp)
+        $POP    r18,`$FRAME-$SIZE_T*14`($sp)
+        $POP    r19,`$FRAME-$SIZE_T*13`($sp)
+        $POP    r20,`$FRAME-$SIZE_T*12`($sp)
+        $POP    r21,`$FRAME-$SIZE_T*11`($sp)
+        $POP    r22,`$FRAME-$SIZE_T*10`($sp)
+        $POP    r23,`$FRAME-$SIZE_T*9`($sp)
+        $POP    r24,`$FRAME-$SIZE_T*8`($sp)
+        $POP    r25,`$FRAME-$SIZE_T*7`($sp)
+        $POP    r26,`$FRAME-$SIZE_T*6`($sp)
+        $POP    r27,`$FRAME-$SIZE_T*5`($sp)
+        $POP    r28,`$FRAME-$SIZE_T*4`($sp)
+        $POP    r29,`$FRAME-$SIZE_T*3`($sp)
+        $POP    r30,`$FRAME-$SIZE_T*2`($sp)
+        $POP    r31,`$FRAME-$SIZE_T*1`($sp)
+        mtlr    r0
+        addi    $sp,$sp,$FRAME
+        blr
+        .long   0
+        .byte   0,12,4,1,0x80,18,3,0
+        .long   0
 ___
 
 # This is private block function, which uses tailored calling
@@ -309,6 +314,8 @@ $code.=<<___;
         addi    $inp,$inp,`16*4`
         bdnz-   Lsha1_block_private
         blr
+        .long   0
+        .byte   0,12,0x14,0,0,0,0,0
 ___
 $code.=<<___;
 .asciz  "SHA1 block transform for PPC, CRYPTOGAMS by <appro\@fy.chalmers.se>"
diff --git a/src/lib/libcrypto/sha/asm/sha1-s390x.pl b/src/lib/libcrypto/sha/asm/sha1-s390x.pl
index 4b17848287..9193dda45e 100644
--- a/src/lib/libcrypto/sha/asm/sha1-s390x.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-s390x.pl
@@ -21,9 +21,28 @@
 # instructions to favour dual-issue z10 pipeline. On z10 hardware is
 # "only" ~2.3x faster than software.
 
+# November 2010.
+#
+# Adapt for -m31 build. If kernel supports what's called "highgprs"
+# feature on Linux [see /proc/cpuinfo], it's possible to use 64-bit
+# instructions and achieve "64-bit" performance even in 31-bit legacy
+# application context. The feature is not specific to any particular
+# processor, as long as it's "z-CPU". Latter implies that the code
+# remains z/Architecture specific.
+
 $kimdfunc=1;    # magic function code for kimd instruction
 
-$output=shift;
+$flavour = shift;
+
+if ($flavour =~ /3[12]/) {
+        $SIZE_T=4;
+        $g="";
+} else {
+        $SIZE_T=8;
+        $g="g";
+}
+
+while (($output=shift) && ($output!~/^\w[\w\-]*\.\w+$/)) {}
 open STDOUT,">$output";
 
 $K_00_39="%r0"; $K=$K_00_39;
@@ -42,13 +61,14 @@ $t1="%r11";
 @X=("%r12","%r13","%r14");
 $sp="%r15";
 
-$frame=160+16*4;
+$stdframe=16*$SIZE_T+4*8;
+$frame=$stdframe+16*4;
 
 sub Xupdate {
 my $i=shift;
 
 $code.=<<___ if ($i==15);
-        lg      $prefetch,160($sp)      ### Xupdate(16) warm-up
+        lg      $prefetch,$stdframe($sp)        ### Xupdate(16) warm-up
         lr      $X[0],$X[2]
 ___
 return if ($i&1);       # Xupdate is vectorized and executed every 2nd cycle
@@ -58,8 +78,8 @@ $code.=<<___ if ($i<16);
 ___
 $code.=<<___ if ($i>=16);
         xgr     $X[0],$prefetch         ### Xupdate($i)
-        lg      $prefetch,`160+4*(($i+2)%16)`($sp)
-        xg      $X[0],`160+4*(($i+8)%16)`($sp)
+        lg      $prefetch,`$stdframe+4*(($i+2)%16)`($sp)
+        xg      $X[0],`$stdframe+4*(($i+8)%16)`($sp)
         xgr     $X[0],$prefetch
         rll     $X[0],$X[0],1
         rllg    $X[1],$X[0],32
@@ -68,7 +88,7 @@ $code.=<<___ if ($i>=16);
         lr      $X[2],$X[1]             # feedback
 ___
 $code.=<<___ if ($i<=70);
-        stg     $X[0],`160+4*($i%16)`($sp)
+        stg     $X[0],`$stdframe+4*($i%16)`($sp)
 ___
 unshift(@X,pop(@X));
 }
@@ -148,9 +168,9 @@ $code.=<<___ if ($kimdfunc);
         tmhl    %r0,0x4000      # check for message-security assist
         jz      .Lsoftware
         lghi    %r0,0
-        la      %r1,16($sp)
+        la      %r1,`2*$SIZE_T`($sp)
         .long   0xb93e0002      # kimd %r0,%r2
-        lg      %r0,16($sp)
+        lg      %r0,`2*$SIZE_T`($sp)
         tmhh    %r0,`0x8000>>$kimdfunc`
         jz      .Lsoftware
         lghi    %r0,$kimdfunc
@@ -165,11 +185,11 @@ $code.=<<___ if ($kimdfunc);
 ___
 $code.=<<___;
         lghi    %r1,-$frame
-        stg     $ctx,16($sp)
-        stmg    %r6,%r15,48($sp)
+        st${g}  $ctx,`2*$SIZE_T`($sp)
+        stm${g} %r6,%r15,`6*$SIZE_T`($sp)
         lgr     %r0,$sp
         la      $sp,0(%r1,$sp)
-        stg     %r0,0($sp)
+        st${g}  %r0,0($sp)
 
         larl    $t0,Ktable
         llgf    $A,0($ctx)
@@ -199,7 +219,7 @@ ___
 for (;$i<80;$i++)       { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
 $code.=<<___;
 
-        lg      $ctx,`$frame+16`($sp)
+        l${g}   $ctx,`$frame+2*$SIZE_T`($sp)
         la      $inp,64($inp)
         al      $A,0($ctx)
         al      $B,4($ctx)
@@ -211,13 +231,13 @@ $code.=<<___;
         st      $C,8($ctx)
         st      $D,12($ctx)
         st      $E,16($ctx)
-        brct    $len,.Lloop
+        brct${g} $len,.Lloop
 
-        lmg     %r6,%r15,`$frame+48`($sp)
+        lm${g}  %r6,%r15,`$frame+6*$SIZE_T`($sp)
         br      %r14
 .size   sha1_block_data_order,.-sha1_block_data_order
 .string "SHA1 block transform for s390x, CRYPTOGAMS by <appro\@openssl.org>"
-.comm   OPENSSL_s390xcap_P,8,8
+.comm   OPENSSL_s390xcap_P,16,8
 ___
 
 $code =~ s/\`([^\`]*)\`/eval $1/gem;
diff --git a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
index 4edc5ea9ad..f27c1e3fb0 100755
--- a/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-x86_64.pl
@@ -16,7 +16,7 @@
 # There was suggestion to mechanically translate 32-bit code, but I
 # dismissed it, reasoning that x86_64 offers enough register bank
 # capacity to fully utilize SHA-1 parallelism. Therefore this fresh
-# implementation:-) However! While 64-bit code does performs better
+# implementation:-) However! While 64-bit code does perform better
 # on Opteron, I failed to beat 32-bit assembler on EM64T core. Well,
 # x86_64 does offer larger *addressable* bank, but out-of-order core
 # reaches for even more registers through dynamic aliasing, and EM64T
@@ -29,6 +29,38 @@
 # Xeon P4       +65%            +0%             9.9
 # Core2         +60%            +10%            7.0
 
+# August 2009.
+#
+# The code was revised to minimize code size and to maximize
+# "distance" between instructions producing input to 'lea'
+# instruction and the 'lea' instruction itself, which is essential
+# for Intel Atom core.
+
+# October 2010.
+#
+# Add SSSE3, Supplemental[!] SSE3, implementation. The idea behind it
+# is to offload message schedule denoted by Wt in NIST specification,
+# or Xupdate in OpenSSL source, to SIMD unit. See sha1-586.pl module
+# for background and implementation details. The only difference from
+# 32-bit code is that 64-bit code doesn't have to spill @X[] elements
+# to free temporary registers.
+
+# April 2011.
+#
+# Add AVX code path. See sha1-586.pl for further information.
+
+######################################################################
+# Current performance is summarized in following table. Numbers are
+# CPU clock cycles spent to process single byte (less is better).
+#
+#               x86_64          SSSE3           AVX
+# P4            9.8             -
+# Opteron       6.6             -
+# Core2         6.7             6.1/+10%        -
+# Atom          11.0            9.7/+13%        -
+# Westmere      7.1             5.6/+27%        -
+# Sandy Bridge  7.9             6.3/+25%        5.2/+51%
+
 $flavour = shift;
 $output  = shift;
 if ($flavour =~ /\./) { $output = $flavour; undef $flavour; }
@@ -40,6 +72,16 @@ $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
 ( $xlate="${dir}../../perlasm/x86_64-xlate.pl" and -f $xlate) or
 die "can't locate x86_64-xlate.pl";
 
+$avx=1 if (`$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
+                =~ /GNU assembler version ([2-9]\.[0-9]+)/ &&
+           $1>=2.19);
+$avx=1 if (!$avx && $win64 && ($flavour =~ /nasm/ || $ENV{ASM} =~ /nasm/) &&
+           `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)/ &&
+           $1>=2.09);
+$avx=1 if (!$avx && $win64 && ($flavour =~ /masm/ || $ENV{ASM} =~ /ml64/) &&
+           `ml64 2>&1` =~ /Version ([0-9]+)\./ &&
+           $1>=10);
+
 open STDOUT,"| $^X $xlate $flavour $output";
 
 $ctx="%rdi";    # 1st arg
@@ -51,196 +93,994 @@ $ctx="%r8";
 $inp="%r9";
 $num="%r10";
 
-$xi="%eax";
-$t0="%ebx";
-$t1="%ecx";
-$A="%edx";
-$B="%esi";
-$C="%edi";
-$D="%ebp";
-$E="%r11d";
-$T="%r12d";
-
-@V=($A,$B,$C,$D,$E,$T);
+$t0="%eax";
+$t1="%ebx";
+$t2="%ecx";
+@xi=("%edx","%ebp");
+$A="%esi";
+$B="%edi";
+$C="%r11d";
+$D="%r12d";
+$E="%r13d";
 
-sub PROLOGUE {
-my $func=shift;
-$code.=<<___;
-.globl  $func
-.type   $func,\@function,3
-.align  16
-$func:
-        push    %rbx
-        push    %rbp
-        push    %r12
-        mov     %rsp,%r11
-        mov     %rdi,$ctx       # reassigned argument
-        sub     \$`8+16*4`,%rsp
-        mov     %rsi,$inp       # reassigned argument
-        and     \$-64,%rsp
-        mov     %rdx,$num       # reassigned argument
-        mov     %r11,`16*4`(%rsp)
-.Lprologue:
-
-        mov     0($ctx),$A
-        mov     4($ctx),$B
-        mov     8($ctx),$C
-        mov     12($ctx),$D
-        mov     16($ctx),$E
-___
-}
-
-sub EPILOGUE {
-my $func=shift;
-$code.=<<___;
-        mov     `16*4`(%rsp),%rsi
-        mov     (%rsi),%r12
-        mov     8(%rsi),%rbp
-        mov     16(%rsi),%rbx
-        lea     24(%rsi),%rsp
-.Lepilogue:
-        ret
-.size   $func,.-$func
-___
-}
+@V=($A,$B,$C,$D,$E);
 
 sub BODY_00_19 {
-my ($i,$a,$b,$c,$d,$e,$f,$host)=@_;
+my ($i,$a,$b,$c,$d,$e)=@_;
 my $j=$i+1;
 $code.=<<___ if ($i==0);
-        mov     `4*$i`($inp),$xi        
-        `"bswap $xi"    if(!defined($host))`
-        mov     $xi,`4*$i`(%rsp)
+        mov     `4*$i`($inp),$xi[0]
+        bswap   $xi[0]
+        mov     $xi[0],`4*$i`(%rsp)
 ___
 $code.=<<___ if ($i<15);
-        lea     0x5a827999($xi,$e),$f
         mov     $c,$t0
-        mov     `4*$j`($inp),$xi
-        mov     $a,$e
+        mov     `4*$j`($inp),$xi[1]
+        mov     $a,$t2
         xor     $d,$t0
-        `"bswap $xi"    if(!defined($host))`    
-        rol     \$5,$e
+        bswap   $xi[1]
+        rol     \$5,$t2
+        lea     0x5a827999($xi[0],$e),$e
         and     $b,$t0
-        mov     $xi,`4*$j`(%rsp)
-        add     $e,$f
+        mov     $xi[1],`4*$j`(%rsp)
+        add     $t2,$e
         xor     $d,$t0
         rol     \$30,$b
-        add     $t0,$f
+        add     $t0,$e
 ___
 $code.=<<___ if ($i>=15);
-        lea     0x5a827999($xi,$e),$f
-        mov     `4*($j%16)`(%rsp),$xi
+        mov     `4*($j%16)`(%rsp),$xi[1]
         mov     $c,$t0
-        mov     $a,$e
-        xor     `4*(($j+2)%16)`(%rsp),$xi
+        mov     $a,$t2
+        xor     `4*(($j+2)%16)`(%rsp),$xi[1]
         xor     $d,$t0
-        rol     \$5,$e
-        xor     `4*(($j+8)%16)`(%rsp),$xi
+        rol     \$5,$t2
+        xor     `4*(($j+8)%16)`(%rsp),$xi[1]
         and     $b,$t0
-        add     $e,$f
-        xor     `4*(($j+13)%16)`(%rsp),$xi
+        lea     0x5a827999($xi[0],$e),$e
+        xor     `4*(($j+13)%16)`(%rsp),$xi[1]
         xor     $d,$t0
+        rol     \$1,$xi[1]
+        add     $t2,$e
         rol     \$30,$b
-        add     $t0,$f
-        rol     \$1,$xi
-        mov     $xi,`4*($j%16)`(%rsp)
+        mov     $xi[1],`4*($j%16)`(%rsp)
+        add     $t0,$e
 ___
+unshift(@xi,pop(@xi));
 }
 
 sub BODY_20_39 {
-my ($i,$a,$b,$c,$d,$e,$f)=@_;
+my ($i,$a,$b,$c,$d,$e)=@_;
 my $j=$i+1;
 my $K=($i<40)?0x6ed9eba1:0xca62c1d6;
 $code.=<<___ if ($i<79);
-        lea     $K($xi,$e),$f
-        mov     `4*($j%16)`(%rsp),$xi
+        mov     `4*($j%16)`(%rsp),$xi[1]
         mov     $c,$t0
-        mov     $a,$e
-        xor     `4*(($j+2)%16)`(%rsp),$xi
+        mov     $a,$t2
+        xor     `4*(($j+2)%16)`(%rsp),$xi[1]
         xor     $b,$t0
-        rol     \$5,$e
-        xor     `4*(($j+8)%16)`(%rsp),$xi
+        rol     \$5,$t2
+        lea     $K($xi[0],$e),$e
+        xor     `4*(($j+8)%16)`(%rsp),$xi[1]
         xor     $d,$t0
-        add     $e,$f
-        xor     `4*(($j+13)%16)`(%rsp),$xi
+        add     $t2,$e
+        xor     `4*(($j+13)%16)`(%rsp),$xi[1]
         rol     \$30,$b
-        add     $t0,$f
-        rol     \$1,$xi
+        add     $t0,$e
+        rol     \$1,$xi[1]
 ___
 $code.=<<___ if ($i<76);
-        mov     $xi,`4*($j%16)`(%rsp)
+        mov     $xi[1],`4*($j%16)`(%rsp)
 ___
 $code.=<<___ if ($i==79);
-        lea     $K($xi,$e),$f
         mov     $c,$t0
-        mov     $a,$e
+        mov     $a,$t2
         xor     $b,$t0
-        rol     \$5,$e
+        lea     $K($xi[0],$e),$e
+        rol     \$5,$t2
         xor     $d,$t0
-        add     $e,$f
+        add     $t2,$e
         rol     \$30,$b
-        add     $t0,$f
+        add     $t0,$e
 ___
+unshift(@xi,pop(@xi));
 }
 
 sub BODY_40_59 {
-my ($i,$a,$b,$c,$d,$e,$f)=@_;
+my ($i,$a,$b,$c,$d,$e)=@_;
 my $j=$i+1;
 $code.=<<___;
-        lea     0x8f1bbcdc($xi,$e),$f
-        mov     `4*($j%16)`(%rsp),$xi
-        mov     $b,$t0
-        mov     $b,$t1
-        xor     `4*(($j+2)%16)`(%rsp),$xi
-        mov     $a,$e
-        and     $c,$t0
-        xor     `4*(($j+8)%16)`(%rsp),$xi
-        or      $c,$t1
-        rol     \$5,$e
-        xor     `4*(($j+13)%16)`(%rsp),$xi
-        and     $d,$t1
-        add     $e,$f
-        rol     \$1,$xi
-        or      $t1,$t0
+        mov     `4*($j%16)`(%rsp),$xi[1]
+        mov     $c,$t0
+        mov     $c,$t1
+        xor     `4*(($j+2)%16)`(%rsp),$xi[1]
+        and     $d,$t0
+        mov     $a,$t2
+        xor     `4*(($j+8)%16)`(%rsp),$xi[1]
+        xor     $d,$t1
+        lea     0x8f1bbcdc($xi[0],$e),$e
+        rol     \$5,$t2
+        xor     `4*(($j+13)%16)`(%rsp),$xi[1]
+        add     $t0,$e
+        and     $b,$t1
+        rol     \$1,$xi[1]
+        add     $t1,$e
         rol     \$30,$b
-        mov     $xi,`4*($j%16)`(%rsp)
-        add     $t0,$f
+        mov     $xi[1],`4*($j%16)`(%rsp)
+        add     $t2,$e
 ___
+unshift(@xi,pop(@xi));
 }
 
-$code=".text\n";
+$code.=<<___;
+.text
+.extern OPENSSL_ia32cap_P
 
-&PROLOGUE("sha1_block_data_order");
-$code.=".align  4\n.Lloop:\n";
+.globl  sha1_block_data_order
+.type   sha1_block_data_order,\@function,3
+.align  16
+sha1_block_data_order:
+        mov     OPENSSL_ia32cap_P+0(%rip),%r9d
+        mov     OPENSSL_ia32cap_P+4(%rip),%r8d
+        test    \$`1<<9`,%r8d           # check SSSE3 bit
+        jz      .Lialu
+___
+$code.=<<___ if ($avx);
+        and     \$`1<<28`,%r8d          # mask AVX bit
+        and     \$`1<<30`,%r9d          # mask "Intel CPU" bit
+        or      %r9d,%r8d
+        cmp     \$`1<<28|1<<30`,%r8d
+        je      _avx_shortcut
+___
+$code.=<<___;
+        jmp     _ssse3_shortcut
+
+.align  16
+.Lialu:
+        push    %rbx
+        push    %rbp
+        push    %r12
+        push    %r13
+        mov     %rsp,%r11
+        mov     %rdi,$ctx       # reassigned argument
+        sub     \$`8+16*4`,%rsp
+        mov     %rsi,$inp       # reassigned argument
+        and     \$-64,%rsp
+        mov     %rdx,$num       # reassigned argument
+        mov     %r11,`16*4`(%rsp)
+.Lprologue:
+
+        mov     0($ctx),$A
+        mov     4($ctx),$B
+        mov     8($ctx),$C
+        mov     12($ctx),$D
+        mov     16($ctx),$E
+        jmp     .Lloop
+
+.align  16
+.Lloop:
+___
 for($i=0;$i<20;$i++)    { &BODY_00_19($i,@V); unshift(@V,pop(@V)); }
 for(;$i<40;$i++)        { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
 for(;$i<60;$i++)        { &BODY_40_59($i,@V); unshift(@V,pop(@V)); }
 for(;$i<80;$i++)        { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
 $code.=<<___;
-        add     0($ctx),$E
-        add     4($ctx),$T
-        add     8($ctx),$A
-        add     12($ctx),$B
-        add     16($ctx),$C
-        mov     $E,0($ctx)
-        mov     $T,4($ctx)
-        mov     $A,8($ctx)
-        mov     $B,12($ctx)
-        mov     $C,16($ctx)
-
-        xchg    $E,$A   # mov   $E,$A
-        xchg    $T,$B   # mov   $T,$B
-        xchg    $E,$C   # mov   $A,$C
-        xchg    $T,$D   # mov   $B,$D
-                        # mov   $C,$E
-        lea     `16*4`($inp),$inp
+        add     0($ctx),$A
+        add     4($ctx),$B
+        add     8($ctx),$C
+        add     12($ctx),$D
+        add     16($ctx),$E
+        mov     $A,0($ctx)
+        mov     $B,4($ctx)
+        mov     $C,8($ctx)
+        mov     $D,12($ctx)
+        mov     $E,16($ctx)
+
         sub     \$1,$num
+        lea     `16*4`($inp),$inp
         jnz     .Lloop
+
+        mov     `16*4`(%rsp),%rsi
+        mov     (%rsi),%r13
+        mov     8(%rsi),%r12
+        mov     16(%rsi),%rbp
+        mov     24(%rsi),%rbx
+        lea     32(%rsi),%rsp
+.Lepilogue:
+        ret
+.size   sha1_block_data_order,.-sha1_block_data_order
 ___
-&EPILOGUE("sha1_block_data_order");
+{{{
+my $Xi=4;
+my @X=map("%xmm$_",(4..7,0..3));
+my @Tx=map("%xmm$_",(8..10));
+my @V=($A,$B,$C,$D,$E)=("%eax","%ebx","%ecx","%edx","%ebp");    # size optimization
+my @T=("%esi","%edi");
+my $j=0;
+my $K_XX_XX="%r11";
+
+my $_rol=sub { &rol(@_) };
+my $_ror=sub { &ror(@_) };
+
+$code.=<<___;
+.type   sha1_block_data_order_ssse3,\@function,3
+.align  16
+sha1_block_data_order_ssse3:
+_ssse3_shortcut:
+        push    %rbx
+        push    %rbp
+        push    %r12
+        lea     `-64-($win64?5*16:0)`(%rsp),%rsp
+___
+$code.=<<___ if ($win64);
+        movaps  %xmm6,64+0(%rsp)
+        movaps  %xmm7,64+16(%rsp)
+        movaps  %xmm8,64+32(%rsp)
+        movaps  %xmm9,64+48(%rsp)
+        movaps  %xmm10,64+64(%rsp)
+.Lprologue_ssse3:
+___
+$code.=<<___;
+        mov     %rdi,$ctx       # reassigned argument
+        mov     %rsi,$inp       # reassigned argument
+        mov     %rdx,$num       # reassigned argument
+
+        shl     \$6,$num
+        add     $inp,$num
+        lea     K_XX_XX(%rip),$K_XX_XX
+
+        mov     0($ctx),$A              # load context
+        mov     4($ctx),$B
+        mov     8($ctx),$C
+        mov     12($ctx),$D
+        mov     $B,@T[0]                # magic seed
+        mov     16($ctx),$E
+
+        movdqa  64($K_XX_XX),@X[2]      # pbswap mask
+        movdqa  0($K_XX_XX),@Tx[1]      # K_00_19
+        movdqu  0($inp),@X[-4&7]        # load input to %xmm[0-3]
+        movdqu  16($inp),@X[-3&7]
+        movdqu  32($inp),@X[-2&7]
+        movdqu  48($inp),@X[-1&7]
+        pshufb  @X[2],@X[-4&7]          # byte swap
+        add     \$64,$inp
+        pshufb  @X[2],@X[-3&7]
+        pshufb  @X[2],@X[-2&7]
+        pshufb  @X[2],@X[-1&7]
+        paddd   @Tx[1],@X[-4&7]         # add K_00_19
+        paddd   @Tx[1],@X[-3&7]
+        paddd   @Tx[1],@X[-2&7]
+        movdqa  @X[-4&7],0(%rsp)        # X[]+K xfer to IALU
+        psubd   @Tx[1],@X[-4&7]         # restore X[]
+        movdqa  @X[-3&7],16(%rsp)
+        psubd   @Tx[1],@X[-3&7]
+        movdqa  @X[-2&7],32(%rsp)
+        psubd   @Tx[1],@X[-2&7]
+        jmp     .Loop_ssse3
+___
+
+sub AUTOLOAD()          # thunk [simplified] 32-bit style perlasm
+{ my $opcode = $AUTOLOAD; $opcode =~ s/.*:://;
+  my $arg = pop;
+    $arg = "\$$arg" if ($arg*1 eq $arg);
+    $code .= "\t$opcode\t".join(',',$arg,reverse @_)."\n";
+}
+
+sub Xupdate_ssse3_16_31()               # recall that $Xi starts wtih 4
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 40 instructions
+  my ($a,$b,$c,$d,$e);
+
+        &movdqa (@X[0],@X[-3&7]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &movdqa (@Tx[0],@X[-1&7]);
+        &palignr(@X[0],@X[-4&7],8);     # compose "X[-14]" in "X[0]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+          &paddd        (@Tx[1],@X[-1&7]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &psrldq (@Tx[0],4);             # "X[-3]", 3 dwords
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &pxor   (@X[0],@X[-4&7]);       # "X[0]"^="X[-16]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &pxor   (@Tx[0],@X[-2&7]);      # "X[-3]"^"X[-8]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &pxor   (@X[0],@Tx[0]);         # "X[0]"^="X[-3]"^"X[-8]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+          &movdqa       (eval(16*(($Xi-1)&3))."(%rsp)",@Tx[1]); # X[]+K xfer to IALU
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &movdqa (@Tx[2],@X[0]);
+        &movdqa (@Tx[0],@X[0]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &pslldq (@Tx[2],12);            # "X[0]"<<96, extract one dword
+        &paddd  (@X[0],@X[0]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &psrld  (@Tx[0],31);
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &movdqa (@Tx[1],@Tx[2]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &psrld  (@Tx[2],30);
+        &por    (@X[0],@Tx[0]);         # "X[0]"<<<=1
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &pslld  (@Tx[1],2);
+        &pxor   (@X[0],@Tx[2]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+          &movdqa       (@Tx[2],eval(16*(($Xi)/5))."($K_XX_XX)");       # K_XX_XX
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &pxor   (@X[0],@Tx[1]);         # "X[0]"^=("X[0]">>96)<<<2
+
+         foreach (@insns) { eval; }     # remaining instructions [if any]
+
+  $Xi++;        push(@X,shift(@X));     # "rotate" X[]
+                push(@Tx,shift(@Tx));
+}
+
+sub Xupdate_ssse3_32_79()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 to 48 instructions
+  my ($a,$b,$c,$d,$e);
+
+        &movdqa (@Tx[0],@X[-1&7])       if ($Xi==8);
+         eval(shift(@insns));           # body_20_39
+        &pxor   (@X[0],@X[-4&7]);       # "X[0]"="X[-32]"^"X[-16]"
+        &palignr(@Tx[0],@X[-2&7],8);    # compose "X[-6]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+
+        &pxor   (@X[0],@X[-7&7]);       # "X[0]"^="X[-28]"
+         eval(shift(@insns));
+         eval(shift(@insns))    if (@insns[0] !~ /&ro[rl]/);
+        if ($Xi%5) {
+          &movdqa       (@Tx[2],@Tx[1]);# "perpetuate" K_XX_XX...
+        } else {                        # ... or load next one
+          &movdqa       (@Tx[2],eval(16*($Xi/5))."($K_XX_XX)");
+        }
+          &paddd        (@Tx[1],@X[-1&7]);
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+        &pxor   (@X[0],@Tx[0]);         # "X[0]"^="X[-6]"
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+
+        &movdqa (@Tx[0],@X[0]);
+          &movdqa       (eval(16*(($Xi-1)&3))."(%rsp)",@Tx[1]); # X[]+K xfer to IALU
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+        &pslld  (@X[0],2);
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+        &psrld  (@Tx[0],30);
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+        &por    (@X[0],@Tx[0]);         # "X[0]"<<<=2
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+          &movdqa       (@Tx[1],@X[0])  if ($Xi<19);
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+         eval(shift(@insns));
+
+         foreach (@insns) { eval; }     # remaining instructions
+
+  $Xi++;        push(@X,shift(@X));     # "rotate" X[]
+                push(@Tx,shift(@Tx));
+}
+
+sub Xuplast_ssse3_80()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 instructions
+  my ($a,$b,$c,$d,$e);
+
+         eval(shift(@insns));
+          &paddd        (@Tx[1],@X[-1&7]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+          &movdqa       (eval(16*(($Xi-1)&3))."(%rsp)",@Tx[1]); # X[]+K xfer IALU
+
+         foreach (@insns) { eval; }             # remaining instructions
+
+        &cmp    ($inp,$num);
+        &je     (".Ldone_ssse3");
+
+        unshift(@Tx,pop(@Tx));
+
+        &movdqa (@X[2],"64($K_XX_XX)");         # pbswap mask
+        &movdqa (@Tx[1],"0($K_XX_XX)");         # K_00_19
+        &movdqu (@X[-4&7],"0($inp)");           # load input
+        &movdqu (@X[-3&7],"16($inp)");
+        &movdqu (@X[-2&7],"32($inp)");
+        &movdqu (@X[-1&7],"48($inp)");
+        &pshufb (@X[-4&7],@X[2]);               # byte swap
+        &add    ($inp,64);
+
+  $Xi=0;
+}
+
+sub Xloop_ssse3()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 instructions
+  my ($a,$b,$c,$d,$e);
+
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &pshufb (@X[($Xi-3)&7],@X[2]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &paddd  (@X[($Xi-4)&7],@Tx[1]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &movdqa (eval(16*$Xi)."(%rsp)",@X[($Xi-4)&7]);  # X[]+K xfer to IALU
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &psubd  (@X[($Xi-4)&7],@Tx[1]);
+
+        foreach (@insns) { eval; }
+  $Xi++;
+}
+
+sub Xtail_ssse3()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 instructions
+  my ($a,$b,$c,$d,$e);
+
+        foreach (@insns) { eval; }
+}
+
+sub body_00_19 () {
+        (
+        '($a,$b,$c,$d,$e)=@V;'.
+        '&add   ($e,eval(4*($j&15))."(%rsp)");',        # X[]+K xfer
+        '&xor   ($c,$d);',
+        '&mov   (@T[1],$a);',   # $b in next round
+        '&$_rol ($a,5);',
+        '&and   (@T[0],$c);',   # ($b&($c^$d))
+        '&xor   ($c,$d);',      # restore $c
+        '&xor   (@T[0],$d);',
+        '&add   ($e,$a);',
+        '&$_ror ($b,$j?7:2);',  # $b>>>2
+        '&add   ($e,@T[0]);'    .'$j++; unshift(@V,pop(@V)); unshift(@T,pop(@T));'
+        );
+}
+
+sub body_20_39 () {
+        (
+        '($a,$b,$c,$d,$e)=@V;'.
+        '&add   ($e,eval(4*($j++&15))."(%rsp)");',      # X[]+K xfer
+        '&xor   (@T[0],$d);',   # ($b^$d)
+        '&mov   (@T[1],$a);',   # $b in next round
+        '&$_rol ($a,5);',
+        '&xor   (@T[0],$c);',   # ($b^$d^$c)
+        '&add   ($e,$a);',
+        '&$_ror ($b,7);',       # $b>>>2
+        '&add   ($e,@T[0]);'    .'unshift(@V,pop(@V)); unshift(@T,pop(@T));'
+        );
+}
+
+sub body_40_59 () {
+        (
+        '($a,$b,$c,$d,$e)=@V;'.
+        '&mov   (@T[1],$c);',
+        '&xor   ($c,$d);',
+        '&add   ($e,eval(4*($j++&15))."(%rsp)");',      # X[]+K xfer
+        '&and   (@T[1],$d);',
+        '&and   (@T[0],$c);',   # ($b&($c^$d))
+        '&$_ror ($b,7);',       # $b>>>2
+        '&add   ($e,@T[1]);',
+        '&mov   (@T[1],$a);',   # $b in next round
+        '&$_rol ($a,5);',
+        '&add   ($e,@T[0]);',
+        '&xor   ($c,$d);',      # restore $c
+        '&add   ($e,$a);'       .'unshift(@V,pop(@V)); unshift(@T,pop(@T));'
+        );
+}
 $code.=<<___;
-.asciz  "SHA1 block transform for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
 .align  16
+.Loop_ssse3:
+___
+        &Xupdate_ssse3_16_31(\&body_00_19);
+        &Xupdate_ssse3_16_31(\&body_00_19);
+        &Xupdate_ssse3_16_31(\&body_00_19);
+        &Xupdate_ssse3_16_31(\&body_00_19);
+        &Xupdate_ssse3_32_79(\&body_00_19);
+        &Xupdate_ssse3_32_79(\&body_20_39);
+        &Xupdate_ssse3_32_79(\&body_20_39);
+        &Xupdate_ssse3_32_79(\&body_20_39);
+        &Xupdate_ssse3_32_79(\&body_20_39);
+        &Xupdate_ssse3_32_79(\&body_20_39);
+        &Xupdate_ssse3_32_79(\&body_40_59);
+        &Xupdate_ssse3_32_79(\&body_40_59);
+        &Xupdate_ssse3_32_79(\&body_40_59);
+        &Xupdate_ssse3_32_79(\&body_40_59);
+        &Xupdate_ssse3_32_79(\&body_40_59);
+        &Xupdate_ssse3_32_79(\&body_20_39);
+        &Xuplast_ssse3_80(\&body_20_39);        # can jump to "done"
+
+                                $saved_j=$j; @saved_V=@V;
+
+        &Xloop_ssse3(\&body_20_39);
+        &Xloop_ssse3(\&body_20_39);
+        &Xloop_ssse3(\&body_20_39);
+
+$code.=<<___;
+        add     0($ctx),$A                      # update context
+        add     4($ctx),@T[0]
+        add     8($ctx),$C
+        add     12($ctx),$D
+        mov     $A,0($ctx)
+        add     16($ctx),$E
+        mov     @T[0],4($ctx)
+        mov     @T[0],$B                        # magic seed
+        mov     $C,8($ctx)
+        mov     $D,12($ctx)
+        mov     $E,16($ctx)
+        jmp     .Loop_ssse3
+
+.align  16
+.Ldone_ssse3:
+___
+                                $j=$saved_j; @V=@saved_V;
+
+        &Xtail_ssse3(\&body_20_39);
+        &Xtail_ssse3(\&body_20_39);
+        &Xtail_ssse3(\&body_20_39);
+
+$code.=<<___;
+        add     0($ctx),$A                      # update context
+        add     4($ctx),@T[0]
+        add     8($ctx),$C
+        mov     $A,0($ctx)
+        add     12($ctx),$D
+        mov     @T[0],4($ctx)
+        add     16($ctx),$E
+        mov     $C,8($ctx)
+        mov     $D,12($ctx)
+        mov     $E,16($ctx)
+___
+$code.=<<___ if ($win64);
+        movaps  64+0(%rsp),%xmm6
+        movaps  64+16(%rsp),%xmm7
+        movaps  64+32(%rsp),%xmm8
+        movaps  64+48(%rsp),%xmm9
+        movaps  64+64(%rsp),%xmm10
+___
+$code.=<<___;
+        lea     `64+($win64?5*16:0)`(%rsp),%rsi
+        mov     0(%rsi),%r12
+        mov     8(%rsi),%rbp
+        mov     16(%rsi),%rbx
+        lea     24(%rsi),%rsp
+.Lepilogue_ssse3:
+        ret
+.size   sha1_block_data_order_ssse3,.-sha1_block_data_order_ssse3
+___
+
+if ($avx) {
+my $Xi=4;
+my @X=map("%xmm$_",(4..7,0..3));
+my @Tx=map("%xmm$_",(8..10));
+my @V=($A,$B,$C,$D,$E)=("%eax","%ebx","%ecx","%edx","%ebp");    # size optimization
+my @T=("%esi","%edi");
+my $j=0;
+my $K_XX_XX="%r11";
+
+my $_rol=sub { &shld(@_[0],@_) };
+my $_ror=sub { &shrd(@_[0],@_) };
+
+$code.=<<___;
+.type   sha1_block_data_order_avx,\@function,3
+.align  16
+sha1_block_data_order_avx:
+_avx_shortcut:
+        push    %rbx
+        push    %rbp
+        push    %r12
+        lea     `-64-($win64?5*16:0)`(%rsp),%rsp
+___
+$code.=<<___ if ($win64);
+        movaps  %xmm6,64+0(%rsp)
+        movaps  %xmm7,64+16(%rsp)
+        movaps  %xmm8,64+32(%rsp)
+        movaps  %xmm9,64+48(%rsp)
+        movaps  %xmm10,64+64(%rsp)
+.Lprologue_avx:
+___
+$code.=<<___;
+        mov     %rdi,$ctx       # reassigned argument
+        mov     %rsi,$inp       # reassigned argument
+        mov     %rdx,$num       # reassigned argument
+        vzeroall
+
+        shl     \$6,$num
+        add     $inp,$num
+        lea     K_XX_XX(%rip),$K_XX_XX
+
+        mov     0($ctx),$A              # load context
+        mov     4($ctx),$B
+        mov     8($ctx),$C
+        mov     12($ctx),$D
+        mov     $B,@T[0]                # magic seed
+        mov     16($ctx),$E
+
+        vmovdqa 64($K_XX_XX),@X[2]      # pbswap mask
+        vmovdqa 0($K_XX_XX),@Tx[1]      # K_00_19
+        vmovdqu 0($inp),@X[-4&7]        # load input to %xmm[0-3]
+        vmovdqu 16($inp),@X[-3&7]
+        vmovdqu 32($inp),@X[-2&7]
+        vmovdqu 48($inp),@X[-1&7]
+        vpshufb @X[2],@X[-4&7],@X[-4&7] # byte swap
+        add     \$64,$inp
+        vpshufb @X[2],@X[-3&7],@X[-3&7]
+        vpshufb @X[2],@X[-2&7],@X[-2&7]
+        vpshufb @X[2],@X[-1&7],@X[-1&7]
+        vpaddd  @Tx[1],@X[-4&7],@X[0]   # add K_00_19
+        vpaddd  @Tx[1],@X[-3&7],@X[1]
+        vpaddd  @Tx[1],@X[-2&7],@X[2]
+        vmovdqa @X[0],0(%rsp)           # X[]+K xfer to IALU
+        vmovdqa @X[1],16(%rsp)
+        vmovdqa @X[2],32(%rsp)
+        jmp     .Loop_avx
+___
+
+sub Xupdate_avx_16_31()         # recall that $Xi starts wtih 4
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 40 instructions
+  my ($a,$b,$c,$d,$e);
+
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vpalignr(@X[0],@X[-3&7],@X[-4&7],8);   # compose "X[-14]" in "X[0]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+          &vpaddd       (@Tx[1],@Tx[1],@X[-1&7]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vpsrldq(@Tx[0],@X[-1&7],4);    # "X[-3]", 3 dwords
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vpxor  (@X[0],@X[0],@X[-4&7]);         # "X[0]"^="X[-16]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpxor  (@Tx[0],@Tx[0],@X[-2&7]);       # "X[-3]"^"X[-8]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpxor  (@X[0],@X[0],@Tx[0]);           # "X[0]"^="X[-3]"^"X[-8]"
+         eval(shift(@insns));
+         eval(shift(@insns));
+          &vmovdqa      (eval(16*(($Xi-1)&3))."(%rsp)",@Tx[1]); # X[]+K xfer to IALU
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpsrld (@Tx[0],@X[0],31);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpslldq(@Tx[2],@X[0],12);              # "X[0]"<<96, extract one dword
+        &vpaddd (@X[0],@X[0],@X[0]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpsrld (@Tx[1],@Tx[2],30);
+        &vpor   (@X[0],@X[0],@Tx[0]);           # "X[0]"<<<=1
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpslld (@Tx[2],@Tx[2],2);
+        &vpxor  (@X[0],@X[0],@Tx[1]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        &vpxor  (@X[0],@X[0],@Tx[2]);           # "X[0]"^=("X[0]">>96)<<<2
+         eval(shift(@insns));
+         eval(shift(@insns));
+          &vmovdqa      (@Tx[2],eval(16*(($Xi)/5))."($K_XX_XX)");       # K_XX_XX
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+
+         foreach (@insns) { eval; }     # remaining instructions [if any]
+
+  $Xi++;        push(@X,shift(@X));     # "rotate" X[]
+                push(@Tx,shift(@Tx));
+}
+
+sub Xupdate_avx_32_79()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 to 48 instructions
+  my ($a,$b,$c,$d,$e);
+
+        &vpalignr(@Tx[0],@X[-1&7],@X[-2&7],8);  # compose "X[-6]"
+        &vpxor  (@X[0],@X[0],@X[-4&7]);         # "X[0]"="X[-32]"^"X[-16]"
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+
+        &vpxor  (@X[0],@X[0],@X[-7&7]);         # "X[0]"^="X[-28]"
+         eval(shift(@insns));
+         eval(shift(@insns))    if (@insns[0] !~ /&ro[rl]/);
+        if ($Xi%5) {
+          &vmovdqa      (@Tx[2],@Tx[1]);# "perpetuate" K_XX_XX...
+        } else {                        # ... or load next one
+          &vmovdqa      (@Tx[2],eval(16*($Xi/5))."($K_XX_XX)");
+        }
+          &vpaddd       (@Tx[1],@Tx[1],@X[-1&7]);
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+        &vpxor  (@X[0],@X[0],@Tx[0]);           # "X[0]"^="X[-6]"
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+
+        &vpsrld (@Tx[0],@X[0],30);
+          &vmovdqa      (eval(16*(($Xi-1)&3))."(%rsp)",@Tx[1]); # X[]+K xfer to IALU
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+        &vpslld (@X[0],@X[0],2);
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # ror
+         eval(shift(@insns));
+
+        &vpor   (@X[0],@X[0],@Tx[0]);           # "X[0]"<<<=2
+         eval(shift(@insns));           # body_20_39
+         eval(shift(@insns));
+          &vmovdqa      (@Tx[1],@X[0])  if ($Xi<19);
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));           # rol
+         eval(shift(@insns));
+
+         foreach (@insns) { eval; }     # remaining instructions
+
+  $Xi++;        push(@X,shift(@X));     # "rotate" X[]
+                push(@Tx,shift(@Tx));
+}
+
+sub Xuplast_avx_80()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 instructions
+  my ($a,$b,$c,$d,$e);
+
+         eval(shift(@insns));
+          &vpaddd       (@Tx[1],@Tx[1],@X[-1&7]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+          &movdqa       (eval(16*(($Xi-1)&3))."(%rsp)",@Tx[1]); # X[]+K xfer IALU
+
+         foreach (@insns) { eval; }             # remaining instructions
+
+        &cmp    ($inp,$num);
+        &je     (".Ldone_avx");
+
+        unshift(@Tx,pop(@Tx));
+
+        &vmovdqa(@X[2],"64($K_XX_XX)");         # pbswap mask
+        &vmovdqa(@Tx[1],"0($K_XX_XX)");         # K_00_19
+        &vmovdqu(@X[-4&7],"0($inp)");           # load input
+        &vmovdqu(@X[-3&7],"16($inp)");
+        &vmovdqu(@X[-2&7],"32($inp)");
+        &vmovdqu(@X[-1&7],"48($inp)");
+        &vpshufb(@X[-4&7],@X[-4&7],@X[2]);      # byte swap
+        &add    ($inp,64);
+
+  $Xi=0;
+}
+
+sub Xloop_avx()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 instructions
+  my ($a,$b,$c,$d,$e);
+
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vpshufb(@X[($Xi-3)&7],@X[($Xi-3)&7],@X[2]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vpaddd (@X[$Xi&7],@X[($Xi-4)&7],@Tx[1]);
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+         eval(shift(@insns));
+        &vmovdqa(eval(16*$Xi)."(%rsp)",@X[$Xi&7]);      # X[]+K xfer to IALU
+         eval(shift(@insns));
+         eval(shift(@insns));
+
+        foreach (@insns) { eval; }
+  $Xi++;
+}
+
+sub Xtail_avx()
+{ use integer;
+  my $body = shift;
+  my @insns = (&$body,&$body,&$body,&$body);    # 32 instructions
+  my ($a,$b,$c,$d,$e);
+
+        foreach (@insns) { eval; }
+}
+
+$code.=<<___;
+.align  16
+.Loop_avx:
+___
+        &Xupdate_avx_16_31(\&body_00_19);
+        &Xupdate_avx_16_31(\&body_00_19);
+        &Xupdate_avx_16_31(\&body_00_19);
+        &Xupdate_avx_16_31(\&body_00_19);
+        &Xupdate_avx_32_79(\&body_00_19);
+        &Xupdate_avx_32_79(\&body_20_39);
+        &Xupdate_avx_32_79(\&body_20_39);
+        &Xupdate_avx_32_79(\&body_20_39);
+        &Xupdate_avx_32_79(\&body_20_39);
+        &Xupdate_avx_32_79(\&body_20_39);
+        &Xupdate_avx_32_79(\&body_40_59);
+        &Xupdate_avx_32_79(\&body_40_59);
+        &Xupdate_avx_32_79(\&body_40_59);
+        &Xupdate_avx_32_79(\&body_40_59);
+        &Xupdate_avx_32_79(\&body_40_59);
+        &Xupdate_avx_32_79(\&body_20_39);
+        &Xuplast_avx_80(\&body_20_39);  # can jump to "done"
+
+                                $saved_j=$j; @saved_V=@V;
+
+        &Xloop_avx(\&body_20_39);
+        &Xloop_avx(\&body_20_39);
+        &Xloop_avx(\&body_20_39);
+
+$code.=<<___;
+        add     0($ctx),$A                      # update context
+        add     4($ctx),@T[0]
+        add     8($ctx),$C
+        add     12($ctx),$D
+        mov     $A,0($ctx)
+        add     16($ctx),$E
+        mov     @T[0],4($ctx)
+        mov     @T[0],$B                        # magic seed
+        mov     $C,8($ctx)
+        mov     $D,12($ctx)
+        mov     $E,16($ctx)
+        jmp     .Loop_avx
+
+.align  16
+.Ldone_avx:
+___
+                                $j=$saved_j; @V=@saved_V;
+
+        &Xtail_avx(\&body_20_39);
+        &Xtail_avx(\&body_20_39);
+        &Xtail_avx(\&body_20_39);
+
+$code.=<<___;
+        vzeroall
+
+        add     0($ctx),$A                      # update context
+        add     4($ctx),@T[0]
+        add     8($ctx),$C
+        mov     $A,0($ctx)
+        add     12($ctx),$D
+        mov     @T[0],4($ctx)
+        add     16($ctx),$E
+        mov     $C,8($ctx)
+        mov     $D,12($ctx)
+        mov     $E,16($ctx)
+___
+$code.=<<___ if ($win64);
+        movaps  64+0(%rsp),%xmm6
+        movaps  64+16(%rsp),%xmm7
+        movaps  64+32(%rsp),%xmm8
+        movaps  64+48(%rsp),%xmm9
+        movaps  64+64(%rsp),%xmm10
+___
+$code.=<<___;
+        lea     `64+($win64?5*16:0)`(%rsp),%rsi
+        mov     0(%rsi),%r12
+        mov     8(%rsi),%rbp
+        mov     16(%rsi),%rbx
+        lea     24(%rsi),%rsp
+.Lepilogue_avx:
+        ret
+.size   sha1_block_data_order_avx,.-sha1_block_data_order_avx
+___
+}
+$code.=<<___;
+.align  64
+K_XX_XX:
+.long   0x5a827999,0x5a827999,0x5a827999,0x5a827999     # K_00_19
+.long   0x6ed9eba1,0x6ed9eba1,0x6ed9eba1,0x6ed9eba1     # K_20_39
+.long   0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc     # K_40_59
+.long   0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6     # K_60_79
+.long   0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f     # pbswap mask
+___
+}}}
+$code.=<<___;
+.asciz  "SHA1 block transform for x86_64, CRYPTOGAMS by <appro\@openssl.org>"
+.align  64
 ___
 
 # EXCEPTION_DISPOSITION handler (EXCEPTION_RECORD *rec,ULONG64 frame,
@@ -272,25 +1112,75 @@ se_handler:
 
         lea     .Lprologue(%rip),%r10
         cmp     %r10,%rbx               # context->Rip<.Lprologue
-        jb      .Lin_prologue
+        jb      .Lcommon_seh_tail
 
         mov     152($context),%rax      # pull context->Rsp
 
         lea     .Lepilogue(%rip),%r10
         cmp     %r10,%rbx               # context->Rip>=.Lepilogue
-        jae     .Lin_prologue
+        jae     .Lcommon_seh_tail
 
         mov     `16*4`(%rax),%rax       # pull saved stack pointer
-        lea     24(%rax),%rax
+        lea     32(%rax),%rax
 
         mov     -8(%rax),%rbx
         mov     -16(%rax),%rbp
         mov     -24(%rax),%r12
+        mov     -32(%rax),%r13
         mov     %rbx,144($context)      # restore context->Rbx
         mov     %rbp,160($context)      # restore context->Rbp
         mov     %r12,216($context)      # restore context->R12
+        mov     %r13,224($context)      # restore context->R13
+
+        jmp     .Lcommon_seh_tail
+.size   se_handler,.-se_handler
 
-.Lin_prologue:
+.type   ssse3_handler,\@abi-omnipotent
+.align  16
+ssse3_handler:
+        push    %rsi
+        push    %rdi
+        push    %rbx
+        push    %rbp
+        push    %r12
+        push    %r13
+        push    %r14
+        push    %r15
+        pushfq
+        sub     \$64,%rsp
+
+        mov     120($context),%rax      # pull context->Rax
+        mov     248($context),%rbx      # pull context->Rip
+
+        mov     8($disp),%rsi           # disp->ImageBase
+        mov     56($disp),%r11          # disp->HandlerData
+
+        mov     0(%r11),%r10d           # HandlerData[0]
+        lea     (%rsi,%r10),%r10        # prologue label
+        cmp     %r10,%rbx               # context->Rip<prologue label
+        jb      .Lcommon_seh_tail
+
+        mov     152($context),%rax      # pull context->Rsp
+
+        mov     4(%r11),%r10d           # HandlerData[1]
+        lea     (%rsi,%r10),%r10        # epilogue label
+        cmp     %r10,%rbx               # context->Rip>=epilogue label
+        jae     .Lcommon_seh_tail
+
+        lea     64(%rax),%rsi
+        lea     512($context),%rdi      # &context.Xmm6
+        mov     \$10,%ecx
+        .long   0xa548f3fc              # cld; rep movsq
+        lea     `24+64+5*16`(%rax),%rax # adjust stack pointer
+
+        mov     -8(%rax),%rbx
+        mov     -16(%rax),%rbp
+        mov     -24(%rax),%r12
+        mov     %rbx,144($context)      # restore context->Rbx
+        mov     %rbp,160($context)      # restore context->Rbp
+        mov     %r12,216($context)      # restore cotnext->R12
+
+.Lcommon_seh_tail:
         mov     8(%rax),%rdi
         mov     16(%rax),%rsi
         mov     %rax,152($context)      # restore context->Rsp
@@ -328,19 +1218,38 @@ se_handler:
         pop     %rdi
         pop     %rsi
         ret
-.size   se_handler,.-se_handler
+.size   ssse3_handler,.-ssse3_handler
 
 .section        .pdata
 .align  4
         .rva    .LSEH_begin_sha1_block_data_order
         .rva    .LSEH_end_sha1_block_data_order
         .rva    .LSEH_info_sha1_block_data_order
-
+        .rva    .LSEH_begin_sha1_block_data_order_ssse3
+        .rva    .LSEH_end_sha1_block_data_order_ssse3
+        .rva    .LSEH_info_sha1_block_data_order_ssse3
+___
+$code.=<<___ if ($avx);
+        .rva    .LSEH_begin_sha1_block_data_order_avx
+        .rva    .LSEH_end_sha1_block_data_order_avx
+        .rva    .LSEH_info_sha1_block_data_order_avx
+___
+$code.=<<___;
 .section        .xdata
 .align  8
 .LSEH_info_sha1_block_data_order:
         .byte   9,0,0,0
         .rva    se_handler
+.LSEH_info_sha1_block_data_order_ssse3:
+        .byte   9,0,0,0
+        .rva    ssse3_handler
+        .rva    .Lprologue_ssse3,.Lepilogue_ssse3       # HandlerData[]
+___
+$code.=<<___ if ($avx);
+.LSEH_info_sha1_block_data_order_avx:
+        .byte   9,0,0,0
+        .rva    ssse3_handler
+        .rva    .Lprologue_avx,.Lepilogue_avx           # HandlerData[]
 ___
 }
 
diff --git a/src/lib/libcrypto/sha/asm/sha256-586.pl b/src/lib/libcrypto/sha/asm/sha256-586.pl
index ecc8b69c75..928ec53123 100644
--- a/src/lib/libcrypto/sha/asm/sha256-586.pl
+++ b/src/lib/libcrypto/sha/asm/sha256-586.pl
@@ -14,8 +14,8 @@
 #               Pentium PIII    P4      AMD K8  Core2
 # gcc           46      36      41      27      26
 # icc           57      33      38      25      23      
-# x86 asm       40      30      35      20      20
-# x86_64 asm(*) -       -       21      15.8    16.5
+# x86 asm       40      30      33      20      18
+# x86_64 asm(*) -       -       21      16      16
 #
 # (*) x86_64 assembler performance is presented for reference
 #     purposes.
@@ -48,20 +48,19 @@ sub BODY_00_15() {
     my $in_16_63=shift;
 
         &mov    ("ecx",$E);
-         &add   ($T,&DWP(4*(8+15+16-9),"esp"))  if ($in_16_63); # T += X[-7]
-        &ror    ("ecx",6);
-        &mov    ("edi",$E);
-        &ror    ("edi",11);
+         &add   ($T,"edi")                      if ($in_16_63); # T += sigma1(X[-2])
+        &ror    ("ecx",25-11);
          &mov   ("esi",$Foff);
-        &xor    ("ecx","edi");
-        &ror    ("edi",25-11);
+        &xor    ("ecx",$E);
+        &ror    ("ecx",11-6);
          &mov   (&DWP(4*(8+15),"esp"),$T)       if ($in_16_63); # save X[0]
-        &xor    ("ecx","edi");  # Sigma1(e)
+        &xor    ("ecx",$E);
+        &ror    ("ecx",6);      # Sigma1(e)
          &mov   ("edi",$Goff);
         &add    ($T,"ecx");     # T += Sigma1(e)
-         &mov   ($Eoff,$E);     # modulo-scheduled
 
         &xor    ("esi","edi");
+         &mov   ($Eoff,$E);     # modulo-scheduled
          &mov   ("ecx",$A);
         &and    ("esi",$E);
          &mov   ($E,$Doff);     # e becomes d, which is e in next iteration
@@ -69,14 +68,14 @@ sub BODY_00_15() {
          &mov   ("edi",$A);
         &add    ($T,"esi");     # T += Ch(e,f,g)
 
-        &ror    ("ecx",2);
+        &ror    ("ecx",22-13);
          &add   ($T,$Hoff);     # T += h
-        &ror    ("edi",13);
+        &xor    ("ecx",$A);
+        &ror    ("ecx",13-2);
          &mov   ("esi",$Boff);
-        &xor    ("ecx","edi");
-        &ror    ("edi",22-13);
+        &xor    ("ecx",$A);
+        &ror    ("ecx",2);      # Sigma0(a)
          &add   ($E,$T);        # d += T
-        &xor    ("ecx","edi");  # Sigma0(a)
          &mov   ("edi",$Coff);
 
         &add    ($T,"ecx");     # T += Sigma0(a)
@@ -168,23 +167,22 @@ sub BODY_00_15() {
 &set_label("16_63",16);
         &mov    ("esi",$T);
          &mov   ("ecx",&DWP(4*(8+15+16-14),"esp"));
-        &shr    ($T,3);
-        &ror    ("esi",7);
-        &xor    ($T,"esi");
         &ror    ("esi",18-7);
          &mov   ("edi","ecx");
-        &xor    ($T,"esi");                     # T = sigma0(X[-15])
+        &xor    ("esi",$T);
+        &ror    ("esi",7);
+        &shr    ($T,3);
 
-        &shr    ("ecx",10);
-         &mov   ("esi",&DWP(4*(8+15+16),"esp"));
-        &ror    ("edi",17);
-        &xor    ("ecx","edi");
         &ror    ("edi",19-17);
-         &add   ($T,"esi");                     # T += X[-16]
-        &xor    ("edi","ecx")                   # sigma1(X[-2])
+         &xor   ($T,"esi");                     # T = sigma0(X[-15])
+        &xor    ("edi","ecx");
+        &ror    ("edi",17);
+        &shr    ("ecx",10);
+         &add   ($T,&DWP(4*(8+15+16),"esp"));   # T += X[-16]
+        &xor    ("edi","ecx");                  # sigma1(X[-2])
 
-        &add    ($T,"edi");                     # T += sigma1(X[-2])
-        # &add  ($T,&DWP(4*(8+15+16-9),"esp")); # T += X[-7], moved to BODY_00_15(1)
+         &add   ($T,&DWP(4*(8+15+16-9),"esp")); # T += X[-7]
+        # &add  ($T,"edi");                     # T += sigma1(X[-2])
         # &mov  (&DWP(4*(8+15),"esp"),$T);      # save X[0]
 
         &BODY_00_15(1);
diff --git a/src/lib/libcrypto/sha/asm/sha256-armv4.pl b/src/lib/libcrypto/sha/asm/sha256-armv4.pl
index 492cb62bc0..9c84e8d93c 100644
--- a/src/lib/libcrypto/sha/asm/sha256-armv4.pl
+++ b/src/lib/libcrypto/sha/asm/sha256-armv4.pl
@@ -18,11 +18,16 @@
 # Rescheduling for dual-issue pipeline resulted in 22% improvement on
 # Cortex A8 core and ~20 cycles per processed byte.
 
+# February 2011.
+#
+# Profiler-assisted and platform-specific optimization resulted in 16%
+# improvement on Cortex A8 core and ~17 cycles per processed byte.
+
 while (($output=shift) && ($output!~/^\w[\w\-]*\.\w+$/)) {}
 open STDOUT,">$output";
 
 $ctx="r0";      $t0="r0";
-$inp="r1";
+$inp="r1";      $t3="r1";
 $len="r2";      $t1="r2";
 $T1="r3";
 $A="r4";
@@ -46,6 +51,9 @@ sub BODY_00_15 {
 my ($i,$a,$b,$c,$d,$e,$f,$g,$h) = @_;
 
 $code.=<<___ if ($i<16);
+#if __ARM_ARCH__>=7
+        ldr     $T1,[$inp],#4
+#else
         ldrb    $T1,[$inp,#3]                   @ $i
         ldrb    $t2,[$inp,#2]
         ldrb    $t1,[$inp,#1]
@@ -53,16 +61,24 @@ $code.=<<___ if ($i<16);
         orr     $T1,$T1,$t2,lsl#8
         orr     $T1,$T1,$t1,lsl#16
         orr     $T1,$T1,$t0,lsl#24
-        `"str   $inp,[sp,#17*4]"        if ($i==15)`
+#endif
 ___
 $code.=<<___;
-        ldr     $t2,[$Ktbl],#4                  @ *K256++
         mov     $t0,$e,ror#$Sigma1[0]
-        str     $T1,[sp,#`$i%16`*4]
+        ldr     $t2,[$Ktbl],#4                  @ *K256++
         eor     $t0,$t0,$e,ror#$Sigma1[1]
         eor     $t1,$f,$g
+#if $i>=16
+        add     $T1,$T1,$t3                     @ from BODY_16_xx
+#elif __ARM_ARCH__>=7 && defined(__ARMEL__)
+        rev     $T1,$T1
+#endif
+#if $i==15
+        str     $inp,[sp,#17*4]                 @ leave room for $t3
+#endif
         eor     $t0,$t0,$e,ror#$Sigma1[2]       @ Sigma1(e)
         and     $t1,$t1,$e
+        str     $T1,[sp,#`$i%16`*4]
         add     $T1,$T1,$t0
         eor     $t1,$t1,$g                      @ Ch(e,f,g)
         add     $T1,$T1,$h
@@ -71,6 +87,9 @@ $code.=<<___;
         eor     $h,$h,$a,ror#$Sigma0[1]
         add     $T1,$T1,$t2
         eor     $h,$h,$a,ror#$Sigma0[2]         @ Sigma0(a)
+#if $i>=15
+        ldr     $t3,[sp,#`($i+2)%16`*4]         @ from BODY_16_xx
+#endif
         orr     $t0,$a,$b
         and     $t1,$a,$b
         and     $t0,$t0,$c
@@ -85,24 +104,26 @@ sub BODY_16_XX {
 my ($i,$a,$b,$c,$d,$e,$f,$g,$h) = @_;
 
 $code.=<<___;
-        ldr     $t1,[sp,#`($i+1)%16`*4]         @ $i
+        @ ldr   $t3,[sp,#`($i+1)%16`*4]         @ $i
         ldr     $t2,[sp,#`($i+14)%16`*4]
+        mov     $t0,$t3,ror#$sigma0[0]
         ldr     $T1,[sp,#`($i+0)%16`*4]
-        mov     $t0,$t1,ror#$sigma0[0]
-        ldr     $inp,[sp,#`($i+9)%16`*4]
-        eor     $t0,$t0,$t1,ror#$sigma0[1]
-        eor     $t0,$t0,$t1,lsr#$sigma0[2]      @ sigma0(X[i+1])
-        mov     $t1,$t2,ror#$sigma1[0]
+        eor     $t0,$t0,$t3,ror#$sigma0[1]
+        ldr     $t1,[sp,#`($i+9)%16`*4]
+        eor     $t0,$t0,$t3,lsr#$sigma0[2]      @ sigma0(X[i+1])
+        mov     $t3,$t2,ror#$sigma1[0]
         add     $T1,$T1,$t0
-        eor     $t1,$t1,$t2,ror#$sigma1[1]
-        add     $T1,$T1,$inp
-        eor     $t1,$t1,$t2,lsr#$sigma1[2]      @ sigma1(X[i+14])
+        eor     $t3,$t3,$t2,ror#$sigma1[1]
         add     $T1,$T1,$t1
+        eor     $t3,$t3,$t2,lsr#$sigma1[2]      @ sigma1(X[i+14])
+        @ add   $T1,$T1,$t3
 ___
         &BODY_00_15(@_);
 }
 
 $code=<<___;
+#include "arm_arch.h"
+
 .text
 .code   32
 
@@ -132,7 +153,7 @@ K256:
 sha256_block_data_order:
         sub     r3,pc,#8                @ sha256_block_data_order
         add     $len,$inp,$len,lsl#6    @ len to point at the end of inp
-        stmdb   sp!,{$ctx,$inp,$len,r4-r12,lr}
+        stmdb   sp!,{$ctx,$inp,$len,r4-r11,lr}
         ldmia   $ctx,{$A,$B,$C,$D,$E,$F,$G,$H}
         sub     $Ktbl,r3,#256           @ K256
         sub     sp,sp,#16*4             @ alloca(X[16])
@@ -171,10 +192,14 @@ $code.=<<___;
         bne     .Loop
 
         add     sp,sp,#`16+3`*4 @ destroy frame
-        ldmia   sp!,{r4-r12,lr}
+#if __ARM_ARCH__>=5
+        ldmia   sp!,{r4-r11,pc}
+#else
+        ldmia   sp!,{r4-r11,lr}
         tst     lr,#1
         moveq   pc,lr                   @ be binary compatible with V4, yet
         bx      lr                      @ interoperable with Thumb ISA:-)
+#endif
 .size   sha256_block_data_order,.-sha256_block_data_order
 .asciz  "SHA256 block transform for ARMv4, CRYPTOGAMS by <appro\@openssl.org>"
 .align  2
diff --git a/src/lib/libcrypto/sha/asm/sha512-armv4.pl b/src/lib/libcrypto/sha/asm/sha512-armv4.pl
index 3a35861ac6..7faf37b147 100644
--- a/src/lib/libcrypto/sha/asm/sha512-armv4.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-armv4.pl
@@ -18,22 +18,33 @@
 # Rescheduling for dual-issue pipeline resulted in 6% improvement on
 # Cortex A8 core and ~40 cycles per processed byte.
 
+# February 2011.
+#
+# Profiler-assisted and platform-specific optimization resulted in 7%
+# improvement on Coxtex A8 core and ~38 cycles per byte.
+
+# March 2011.
+#
+# Add NEON implementation. On Cortex A8 it was measured to process
+# one byte in 25.5 cycles or 47% faster than integer-only code.
+
 # Byte order [in]dependence. =========================================
 #
-# Caller is expected to maintain specific *dword* order in h[0-7],
-# namely with most significant dword at *lower* address, which is
-# reflected in below two parameters. *Byte* order within these dwords
-# in turn is whatever *native* byte order on current platform.
-$hi=0;
-$lo=4;
+# Originally caller was expected to maintain specific *dword* order in
+# h[0-7], namely with most significant dword at *lower* address, which
+# was reflected in below two parameters as 0 and 4. Now caller is
+# expected to maintain native byte order for whole 64-bit values.
+$hi="HI";
+$lo="LO";
 # ====================================================================
 
 while (($output=shift) && ($output!~/^\w[\w\-]*\.\w+$/)) {}
 open STDOUT,">$output";
 
-$ctx="r0";
+$ctx="r0";      # parameter block
 $inp="r1";
 $len="r2";
+
 $Tlo="r3";
 $Thi="r4";
 $Alo="r5";
@@ -61,15 +72,17 @@ $Xoff=8*8;
 sub BODY_00_15() {
 my $magic = shift;
 $code.=<<___;
-        ldr     $t2,[sp,#$Hoff+0]       @ h.lo
-        ldr     $t3,[sp,#$Hoff+4]       @ h.hi
         @ Sigma1(x)     (ROTR((x),14) ^ ROTR((x),18)  ^ ROTR((x),41))
         @ LO            lo>>14^hi<<18 ^ lo>>18^hi<<14 ^ hi>>9^lo<<23
         @ HI            hi>>14^lo<<18 ^ hi>>18^lo<<14 ^ lo>>9^hi<<23
         mov     $t0,$Elo,lsr#14
+        str     $Tlo,[sp,#$Xoff+0]
         mov     $t1,$Ehi,lsr#14
+        str     $Thi,[sp,#$Xoff+4]
         eor     $t0,$t0,$Ehi,lsl#18
+        ldr     $t2,[sp,#$Hoff+0]       @ h.lo
         eor     $t1,$t1,$Elo,lsl#18
+        ldr     $t3,[sp,#$Hoff+4]       @ h.hi
         eor     $t0,$t0,$Elo,lsr#18
         eor     $t1,$t1,$Ehi,lsr#18
         eor     $t0,$t0,$Ehi,lsl#14
@@ -96,25 +109,24 @@ $code.=<<___;
         and     $t1,$t1,$Ehi
         str     $Ahi,[sp,#$Aoff+4]
         eor     $t0,$t0,$t2
-        ldr     $t2,[$Ktbl,#4]          @ K[i].lo
+        ldr     $t2,[$Ktbl,#$lo]        @ K[i].lo
         eor     $t1,$t1,$t3             @ Ch(e,f,g)
-        ldr     $t3,[$Ktbl,#0]          @ K[i].hi
+        ldr     $t3,[$Ktbl,#$hi]        @ K[i].hi
 
         adds    $Tlo,$Tlo,$t0
         ldr     $Elo,[sp,#$Doff+0]      @ d.lo
         adc     $Thi,$Thi,$t1           @ T += Ch(e,f,g)
         ldr     $Ehi,[sp,#$Doff+4]      @ d.hi
         adds    $Tlo,$Tlo,$t2
+        and     $t0,$t2,#0xff
         adc     $Thi,$Thi,$t3           @ T += K[i]
         adds    $Elo,$Elo,$Tlo
+        ldr     $t2,[sp,#$Boff+0]       @ b.lo
         adc     $Ehi,$Ehi,$Thi          @ d += T
-
-        and     $t0,$t2,#0xff
         teq     $t0,#$magic
-        orreq   $Ktbl,$Ktbl,#1
 
-        ldr     $t2,[sp,#$Boff+0]       @ b.lo
         ldr     $t3,[sp,#$Coff+0]       @ c.lo
+        orreq   $Ktbl,$Ktbl,#1
         @ Sigma0(x)     (ROTR((x),28) ^ ROTR((x),34) ^ ROTR((x),39))
         @ LO            lo>>28^hi<<4  ^ hi>>2^lo<<30 ^ hi>>7^lo<<25
         @ HI            hi>>28^lo<<4  ^ lo>>2^hi<<30 ^ lo>>7^hi<<25
@@ -131,80 +143,100 @@ $code.=<<___;
         eor     $t0,$t0,$Alo,lsl#25
         eor     $t1,$t1,$Ahi,lsl#25     @ Sigma0(a)
         adds    $Tlo,$Tlo,$t0
+        and     $t0,$Alo,$t2
         adc     $Thi,$Thi,$t1           @ T += Sigma0(a)
 
-        and     $t0,$Alo,$t2
-        orr     $Alo,$Alo,$t2
         ldr     $t1,[sp,#$Boff+4]       @ b.hi
+        orr     $Alo,$Alo,$t2
         ldr     $t2,[sp,#$Coff+4]       @ c.hi
         and     $Alo,$Alo,$t3
-        orr     $Alo,$Alo,$t0           @ Maj(a,b,c).lo
         and     $t3,$Ahi,$t1
         orr     $Ahi,$Ahi,$t1
+        orr     $Alo,$Alo,$t0           @ Maj(a,b,c).lo
         and     $Ahi,$Ahi,$t2
-        orr     $Ahi,$Ahi,$t3           @ Maj(a,b,c).hi
         adds    $Alo,$Alo,$Tlo
-        adc     $Ahi,$Ahi,$Thi          @ h += T
-
+        orr     $Ahi,$Ahi,$t3           @ Maj(a,b,c).hi
         sub     sp,sp,#8
+        adc     $Ahi,$Ahi,$Thi          @ h += T
+        tst     $Ktbl,#1
         add     $Ktbl,$Ktbl,#8
 ___
 }
 $code=<<___;
+#include "arm_arch.h"
+#ifdef __ARMEL__
+# define LO 0
+# define HI 4
+# define WORD64(hi0,lo0,hi1,lo1)        .word   lo0,hi0, lo1,hi1
+#else
+# define HI 0
+# define LO 4
+# define WORD64(hi0,lo0,hi1,lo1)        .word   hi0,lo0, hi1,lo1
+#endif
+
 .text
 .code   32
 .type   K512,%object
 .align  5
 K512:
-.word   0x428a2f98,0xd728ae22, 0x71374491,0x23ef65cd
-.word   0xb5c0fbcf,0xec4d3b2f, 0xe9b5dba5,0x8189dbbc
-.word   0x3956c25b,0xf348b538, 0x59f111f1,0xb605d019
-.word   0x923f82a4,0xaf194f9b, 0xab1c5ed5,0xda6d8118
-.word   0xd807aa98,0xa3030242, 0x12835b01,0x45706fbe
-.word   0x243185be,0x4ee4b28c, 0x550c7dc3,0xd5ffb4e2
-.word   0x72be5d74,0xf27b896f, 0x80deb1fe,0x3b1696b1
-.word   0x9bdc06a7,0x25c71235, 0xc19bf174,0xcf692694
-.word   0xe49b69c1,0x9ef14ad2, 0xefbe4786,0x384f25e3
-.word   0x0fc19dc6,0x8b8cd5b5, 0x240ca1cc,0x77ac9c65
-.word   0x2de92c6f,0x592b0275, 0x4a7484aa,0x6ea6e483
-.word   0x5cb0a9dc,0xbd41fbd4, 0x76f988da,0x831153b5
-.word   0x983e5152,0xee66dfab, 0xa831c66d,0x2db43210
-.word   0xb00327c8,0x98fb213f, 0xbf597fc7,0xbeef0ee4
-.word   0xc6e00bf3,0x3da88fc2, 0xd5a79147,0x930aa725
-.word   0x06ca6351,0xe003826f, 0x14292967,0x0a0e6e70
-.word   0x27b70a85,0x46d22ffc, 0x2e1b2138,0x5c26c926
-.word   0x4d2c6dfc,0x5ac42aed, 0x53380d13,0x9d95b3df
-.word   0x650a7354,0x8baf63de, 0x766a0abb,0x3c77b2a8
-.word   0x81c2c92e,0x47edaee6, 0x92722c85,0x1482353b
-.word   0xa2bfe8a1,0x4cf10364, 0xa81a664b,0xbc423001
-.word   0xc24b8b70,0xd0f89791, 0xc76c51a3,0x0654be30
-.word   0xd192e819,0xd6ef5218, 0xd6990624,0x5565a910
-.word   0xf40e3585,0x5771202a, 0x106aa070,0x32bbd1b8
-.word   0x19a4c116,0xb8d2d0c8, 0x1e376c08,0x5141ab53
-.word   0x2748774c,0xdf8eeb99, 0x34b0bcb5,0xe19b48a8
-.word   0x391c0cb3,0xc5c95a63, 0x4ed8aa4a,0xe3418acb
-.word   0x5b9cca4f,0x7763e373, 0x682e6ff3,0xd6b2b8a3
-.word   0x748f82ee,0x5defb2fc, 0x78a5636f,0x43172f60
-.word   0x84c87814,0xa1f0ab72, 0x8cc70208,0x1a6439ec
-.word   0x90befffa,0x23631e28, 0xa4506ceb,0xde82bde9
-.word   0xbef9a3f7,0xb2c67915, 0xc67178f2,0xe372532b
-.word   0xca273ece,0xea26619c, 0xd186b8c7,0x21c0c207
-.word   0xeada7dd6,0xcde0eb1e, 0xf57d4f7f,0xee6ed178
-.word   0x06f067aa,0x72176fba, 0x0a637dc5,0xa2c898a6
-.word   0x113f9804,0xbef90dae, 0x1b710b35,0x131c471b
-.word   0x28db77f5,0x23047d84, 0x32caab7b,0x40c72493
-.word   0x3c9ebe0a,0x15c9bebc, 0x431d67c4,0x9c100d4c
-.word   0x4cc5d4be,0xcb3e42b6, 0x597f299c,0xfc657e2a
-.word   0x5fcb6fab,0x3ad6faec, 0x6c44198c,0x4a475817
+WORD64(0x428a2f98,0xd728ae22, 0x71374491,0x23ef65cd)
+WORD64(0xb5c0fbcf,0xec4d3b2f, 0xe9b5dba5,0x8189dbbc)
+WORD64(0x3956c25b,0xf348b538, 0x59f111f1,0xb605d019)
+WORD64(0x923f82a4,0xaf194f9b, 0xab1c5ed5,0xda6d8118)
+WORD64(0xd807aa98,0xa3030242, 0x12835b01,0x45706fbe)
+WORD64(0x243185be,0x4ee4b28c, 0x550c7dc3,0xd5ffb4e2)
+WORD64(0x72be5d74,0xf27b896f, 0x80deb1fe,0x3b1696b1)
+WORD64(0x9bdc06a7,0x25c71235, 0xc19bf174,0xcf692694)
+WORD64(0xe49b69c1,0x9ef14ad2, 0xefbe4786,0x384f25e3)
+WORD64(0x0fc19dc6,0x8b8cd5b5, 0x240ca1cc,0x77ac9c65)
+WORD64(0x2de92c6f,0x592b0275, 0x4a7484aa,0x6ea6e483)
+WORD64(0x5cb0a9dc,0xbd41fbd4, 0x76f988da,0x831153b5)
+WORD64(0x983e5152,0xee66dfab, 0xa831c66d,0x2db43210)
+WORD64(0xb00327c8,0x98fb213f, 0xbf597fc7,0xbeef0ee4)
+WORD64(0xc6e00bf3,0x3da88fc2, 0xd5a79147,0x930aa725)
+WORD64(0x06ca6351,0xe003826f, 0x14292967,0x0a0e6e70)
+WORD64(0x27b70a85,0x46d22ffc, 0x2e1b2138,0x5c26c926)
+WORD64(0x4d2c6dfc,0x5ac42aed, 0x53380d13,0x9d95b3df)
+WORD64(0x650a7354,0x8baf63de, 0x766a0abb,0x3c77b2a8)
+WORD64(0x81c2c92e,0x47edaee6, 0x92722c85,0x1482353b)
+WORD64(0xa2bfe8a1,0x4cf10364, 0xa81a664b,0xbc423001)
+WORD64(0xc24b8b70,0xd0f89791, 0xc76c51a3,0x0654be30)
+WORD64(0xd192e819,0xd6ef5218, 0xd6990624,0x5565a910)
+WORD64(0xf40e3585,0x5771202a, 0x106aa070,0x32bbd1b8)
+WORD64(0x19a4c116,0xb8d2d0c8, 0x1e376c08,0x5141ab53)
+WORD64(0x2748774c,0xdf8eeb99, 0x34b0bcb5,0xe19b48a8)
+WORD64(0x391c0cb3,0xc5c95a63, 0x4ed8aa4a,0xe3418acb)
+WORD64(0x5b9cca4f,0x7763e373, 0x682e6ff3,0xd6b2b8a3)
+WORD64(0x748f82ee,0x5defb2fc, 0x78a5636f,0x43172f60)
+WORD64(0x84c87814,0xa1f0ab72, 0x8cc70208,0x1a6439ec)
+WORD64(0x90befffa,0x23631e28, 0xa4506ceb,0xde82bde9)
+WORD64(0xbef9a3f7,0xb2c67915, 0xc67178f2,0xe372532b)
+WORD64(0xca273ece,0xea26619c, 0xd186b8c7,0x21c0c207)
+WORD64(0xeada7dd6,0xcde0eb1e, 0xf57d4f7f,0xee6ed178)
+WORD64(0x06f067aa,0x72176fba, 0x0a637dc5,0xa2c898a6)
+WORD64(0x113f9804,0xbef90dae, 0x1b710b35,0x131c471b)
+WORD64(0x28db77f5,0x23047d84, 0x32caab7b,0x40c72493)
+WORD64(0x3c9ebe0a,0x15c9bebc, 0x431d67c4,0x9c100d4c)
+WORD64(0x4cc5d4be,0xcb3e42b6, 0x597f299c,0xfc657e2a)
+WORD64(0x5fcb6fab,0x3ad6faec, 0x6c44198c,0x4a475817)
 .size   K512,.-K512
+.LOPENSSL_armcap:
+.word   OPENSSL_armcap_P-sha512_block_data_order
+.skip   32-4
 
 .global sha512_block_data_order
 .type   sha512_block_data_order,%function
 sha512_block_data_order:
         sub     r3,pc,#8                @ sha512_block_data_order
         add     $len,$inp,$len,lsl#7    @ len to point at the end of inp
+#if __ARM_ARCH__>=7
+        ldr     r12,.LOPENSSL_armcap
+        ldr     r12,[r3,r12]            @ OPENSSL_armcap_P
+        tst     r12,#1
+        bne     .LNEON
+#endif
         stmdb   sp!,{r4-r12,lr}
-        sub     $Ktbl,r3,#640           @ K512
+        sub     $Ktbl,r3,#672           @ K512
         sub     sp,sp,#9*8
 
         ldr     $Elo,[$ctx,#$Eoff+$lo]
@@ -238,6 +270,7 @@ sha512_block_data_order:
         str     $Thi,[sp,#$Foff+4]
 
 .L00_15:
+#if __ARM_ARCH__<7
         ldrb    $Tlo,[$inp,#7]
         ldrb    $t0, [$inp,#6]
         ldrb    $t1, [$inp,#5]
@@ -252,26 +285,30 @@ sha512_block_data_order:
         orr     $Thi,$Thi,$t3,lsl#8
         orr     $Thi,$Thi,$t0,lsl#16
         orr     $Thi,$Thi,$t1,lsl#24
-        str     $Tlo,[sp,#$Xoff+0]
-        str     $Thi,[sp,#$Xoff+4]
+#else
+        ldr     $Tlo,[$inp,#4]
+        ldr     $Thi,[$inp],#8
+#ifdef __ARMEL__
+        rev     $Tlo,$Tlo
+        rev     $Thi,$Thi
+#endif
+#endif
 ___
         &BODY_00_15(0x94);
 $code.=<<___;
         tst     $Ktbl,#1
         beq     .L00_15
-        bic     $Ktbl,$Ktbl,#1
-
-.L16_79:
         ldr     $t0,[sp,#`$Xoff+8*(16-1)`+0]
         ldr     $t1,[sp,#`$Xoff+8*(16-1)`+4]
-        ldr     $t2,[sp,#`$Xoff+8*(16-14)`+0]
-        ldr     $t3,[sp,#`$Xoff+8*(16-14)`+4]
-
+        bic     $Ktbl,$Ktbl,#1
+.L16_79:
         @ sigma0(x)     (ROTR((x),1)  ^ ROTR((x),8)  ^ ((x)>>7))
         @ LO            lo>>1^hi<<31  ^ lo>>8^hi<<24 ^ lo>>7^hi<<25
         @ HI            hi>>1^lo<<31  ^ hi>>8^lo<<24 ^ hi>>7
         mov     $Tlo,$t0,lsr#1
+        ldr     $t2,[sp,#`$Xoff+8*(16-14)`+0]
         mov     $Thi,$t1,lsr#1
+        ldr     $t3,[sp,#`$Xoff+8*(16-14)`+4]
         eor     $Tlo,$Tlo,$t1,lsl#31
         eor     $Thi,$Thi,$t0,lsl#31
         eor     $Tlo,$Tlo,$t0,lsr#8
@@ -295,25 +332,24 @@ $code.=<<___;
         eor     $t1,$t1,$t3,lsl#3
         eor     $t0,$t0,$t2,lsr#6
         eor     $t1,$t1,$t3,lsr#6
+        ldr     $t2,[sp,#`$Xoff+8*(16-9)`+0]
         eor     $t0,$t0,$t3,lsl#26
 
-        ldr     $t2,[sp,#`$Xoff+8*(16-9)`+0]
         ldr     $t3,[sp,#`$Xoff+8*(16-9)`+4]
         adds    $Tlo,$Tlo,$t0
+        ldr     $t0,[sp,#`$Xoff+8*16`+0]
         adc     $Thi,$Thi,$t1
 
-        ldr     $t0,[sp,#`$Xoff+8*16`+0]
         ldr     $t1,[sp,#`$Xoff+8*16`+4]
         adds    $Tlo,$Tlo,$t2
         adc     $Thi,$Thi,$t3
         adds    $Tlo,$Tlo,$t0
         adc     $Thi,$Thi,$t1
-        str     $Tlo,[sp,#$Xoff+0]
-        str     $Thi,[sp,#$Xoff+4]
 ___
         &BODY_00_15(0x17);
 $code.=<<___;
-        tst     $Ktbl,#1
+        ldreq   $t0,[sp,#`$Xoff+8*(16-1)`+0]
+        ldreq   $t1,[sp,#`$Xoff+8*(16-1)`+4]
         beq     .L16_79
         bic     $Ktbl,$Ktbl,#1
 
@@ -324,12 +360,12 @@ $code.=<<___;
         ldr     $t2, [$ctx,#$Boff+$lo]
         ldr     $t3, [$ctx,#$Boff+$hi]
         adds    $t0,$Alo,$t0
-        adc     $t1,$Ahi,$t1
-        adds    $t2,$Tlo,$t2
-        adc     $t3,$Thi,$t3
         str     $t0, [$ctx,#$Aoff+$lo]
+        adc     $t1,$Ahi,$t1
         str     $t1, [$ctx,#$Aoff+$hi]
+        adds    $t2,$Tlo,$t2
         str     $t2, [$ctx,#$Boff+$lo]
+        adc     $t3,$Thi,$t3
         str     $t3, [$ctx,#$Boff+$hi]
 
         ldr     $Alo,[sp,#$Coff+0]
@@ -341,12 +377,12 @@ $code.=<<___;
         ldr     $t2, [$ctx,#$Doff+$lo]
         ldr     $t3, [$ctx,#$Doff+$hi]
         adds    $t0,$Alo,$t0
-        adc     $t1,$Ahi,$t1
-        adds    $t2,$Tlo,$t2
-        adc     $t3,$Thi,$t3
         str     $t0, [$ctx,#$Coff+$lo]
+        adc     $t1,$Ahi,$t1
         str     $t1, [$ctx,#$Coff+$hi]
+        adds    $t2,$Tlo,$t2
         str     $t2, [$ctx,#$Doff+$lo]
+        adc     $t3,$Thi,$t3
         str     $t3, [$ctx,#$Doff+$hi]
 
         ldr     $Tlo,[sp,#$Foff+0]
@@ -356,12 +392,12 @@ $code.=<<___;
         ldr     $t2, [$ctx,#$Foff+$lo]
         ldr     $t3, [$ctx,#$Foff+$hi]
         adds    $Elo,$Elo,$t0
-        adc     $Ehi,$Ehi,$t1
-        adds    $t2,$Tlo,$t2
-        adc     $t3,$Thi,$t3
         str     $Elo,[$ctx,#$Eoff+$lo]
+        adc     $Ehi,$Ehi,$t1
         str     $Ehi,[$ctx,#$Eoff+$hi]
+        adds    $t2,$Tlo,$t2
         str     $t2, [$ctx,#$Foff+$lo]
+        adc     $t3,$Thi,$t3
         str     $t3, [$ctx,#$Foff+$hi]
 
         ldr     $Alo,[sp,#$Goff+0]
@@ -373,12 +409,12 @@ $code.=<<___;
         ldr     $t2, [$ctx,#$Hoff+$lo]
         ldr     $t3, [$ctx,#$Hoff+$hi]
         adds    $t0,$Alo,$t0
-        adc     $t1,$Ahi,$t1
-        adds    $t2,$Tlo,$t2
-        adc     $t3,$Thi,$t3
         str     $t0, [$ctx,#$Goff+$lo]
+        adc     $t1,$Ahi,$t1
         str     $t1, [$ctx,#$Goff+$hi]
+        adds    $t2,$Tlo,$t2
         str     $t2, [$ctx,#$Hoff+$lo]
+        adc     $t3,$Thi,$t3
         str     $t3, [$ctx,#$Hoff+$hi]
 
         add     sp,sp,#640
@@ -388,13 +424,156 @@ $code.=<<___;
         bne     .Loop
 
         add     sp,sp,#8*9              @ destroy frame
+#if __ARM_ARCH__>=5
+        ldmia   sp!,{r4-r12,pc}
+#else
         ldmia   sp!,{r4-r12,lr}
         tst     lr,#1
         moveq   pc,lr                   @ be binary compatible with V4, yet
         bx      lr                      @ interoperable with Thumb ISA:-)
-.size   sha512_block_data_order,.-sha512_block_data_order
-.asciz  "SHA512 block transform for ARMv4, CRYPTOGAMS by <appro\@openssl.org>"
+#endif
+___
+
+{
+my @Sigma0=(28,34,39);
+my @Sigma1=(14,18,41);
+my @sigma0=(1, 8, 7);
+my @sigma1=(19,61,6);
+
+my $Ktbl="r3";
+my $cnt="r12";  # volatile register known as ip, intra-procedure-call scratch
+
+my @X=map("d$_",(0..15));
+my @V=($A,$B,$C,$D,$E,$F,$G,$H)=map("d$_",(16..23));
+
+sub NEON_00_15() {
+my $i=shift;
+my ($a,$b,$c,$d,$e,$f,$g,$h)=@_;
+my ($t0,$t1,$t2,$T1,$K,$Ch,$Maj)=map("d$_",(24..31));   # temps
+
+$code.=<<___ if ($i<16 || $i&1);
+        vshr.u64        $t0,$e,#@Sigma1[0]      @ $i
+#if $i<16
+        vld1.64         {@X[$i%16]},[$inp]!     @ handles unaligned
+#endif
+        vshr.u64        $t1,$e,#@Sigma1[1]
+        vshr.u64        $t2,$e,#@Sigma1[2]
+___
+$code.=<<___;
+        vld1.64         {$K},[$Ktbl,:64]!       @ K[i++]
+        vsli.64         $t0,$e,#`64-@Sigma1[0]`
+        vsli.64         $t1,$e,#`64-@Sigma1[1]`
+        vsli.64         $t2,$e,#`64-@Sigma1[2]`
+#if $i<16 && defined(__ARMEL__)
+        vrev64.8        @X[$i],@X[$i]
+#endif
+        vadd.i64        $T1,$K,$h
+        veor            $Ch,$f,$g
+        veor            $t0,$t1
+        vand            $Ch,$e
+        veor            $t0,$t2                 @ Sigma1(e)
+        veor            $Ch,$g                  @ Ch(e,f,g)
+        vadd.i64        $T1,$t0
+        vshr.u64        $t0,$a,#@Sigma0[0]
+        vadd.i64        $T1,$Ch
+        vshr.u64        $t1,$a,#@Sigma0[1]
+        vshr.u64        $t2,$a,#@Sigma0[2]
+        vsli.64         $t0,$a,#`64-@Sigma0[0]`
+        vsli.64         $t1,$a,#`64-@Sigma0[1]`
+        vsli.64         $t2,$a,#`64-@Sigma0[2]`
+        vadd.i64        $T1,@X[$i%16]
+        vorr            $Maj,$a,$c
+        vand            $Ch,$a,$c
+        veor            $h,$t0,$t1
+        vand            $Maj,$b
+        veor            $h,$t2                  @ Sigma0(a)
+        vorr            $Maj,$Ch                @ Maj(a,b,c)
+        vadd.i64        $h,$T1
+        vadd.i64        $d,$T1
+        vadd.i64        $h,$Maj
+___
+}
+
+sub NEON_16_79() {
+my $i=shift;
+
+if ($i&1)       { &NEON_00_15($i,@_); return; }
+
+# 2x-vectorized, therefore runs every 2nd round
+my @X=map("q$_",(0..7));                        # view @X as 128-bit vector
+my ($t0,$t1,$s0,$s1) = map("q$_",(12..15));     # temps
+my ($d0,$d1,$d2) = map("d$_",(24..26));         # temps from NEON_00_15
+my $e=@_[4];                                    # $e from NEON_00_15
+$i /= 2;
+$code.=<<___;
+        vshr.u64        $t0,@X[($i+7)%8],#@sigma1[0]
+        vshr.u64        $t1,@X[($i+7)%8],#@sigma1[1]
+        vshr.u64        $s1,@X[($i+7)%8],#@sigma1[2]
+        vsli.64         $t0,@X[($i+7)%8],#`64-@sigma1[0]`
+        vext.8          $s0,@X[$i%8],@X[($i+1)%8],#8    @ X[i+1]
+        vsli.64         $t1,@X[($i+7)%8],#`64-@sigma1[1]`
+        veor            $s1,$t0
+        vshr.u64        $t0,$s0,#@sigma0[0]
+        veor            $s1,$t1                         @ sigma1(X[i+14])
+        vshr.u64        $t1,$s0,#@sigma0[1]
+        vadd.i64        @X[$i%8],$s1
+        vshr.u64        $s1,$s0,#@sigma0[2]
+        vsli.64         $t0,$s0,#`64-@sigma0[0]`
+        vsli.64         $t1,$s0,#`64-@sigma0[1]`
+        vext.8          $s0,@X[($i+4)%8],@X[($i+5)%8],#8        @ X[i+9]
+        veor            $s1,$t0
+        vshr.u64        $d0,$e,#@Sigma1[0]              @ from NEON_00_15
+        vadd.i64        @X[$i%8],$s0
+        vshr.u64        $d1,$e,#@Sigma1[1]              @ from NEON_00_15
+        veor            $s1,$t1                         @ sigma0(X[i+1])
+        vshr.u64        $d2,$e,#@Sigma1[2]              @ from NEON_00_15
+        vadd.i64        @X[$i%8],$s1
+___
+        &NEON_00_15(2*$i,@_);
+}
+
+$code.=<<___;
+#if __ARM_ARCH__>=7
+.fpu    neon
+
+.align  4
+.LNEON:
+        dmb                             @ errata #451034 on early Cortex A8
+        vstmdb  sp!,{d8-d15}            @ ABI specification says so
+        sub     $Ktbl,r3,#672           @ K512
+        vldmia  $ctx,{$A-$H}            @ load context
+.Loop_neon:
+___
+for($i=0;$i<16;$i++)    { &NEON_00_15($i,@V); unshift(@V,pop(@V)); }
+$code.=<<___;
+        mov             $cnt,#4
+.L16_79_neon:
+        subs            $cnt,#1
+___
+for(;$i<32;$i++)        { &NEON_16_79($i,@V); unshift(@V,pop(@V)); }
+$code.=<<___;
+        bne             .L16_79_neon
+
+        vldmia          $ctx,{d24-d31}  @ load context to temp
+        vadd.i64        q8,q12          @ vectorized accumulate
+        vadd.i64        q9,q13
+        vadd.i64        q10,q14
+        vadd.i64        q11,q15
+        vstmia          $ctx,{$A-$H}    @ save context
+        teq             $inp,$len
+        sub             $Ktbl,#640      @ rewind K512
+        bne             .Loop_neon
+
+        vldmia  sp!,{d8-d15}            @ epilogue
+        bx      lr
+#endif
+___
+}
+$code.=<<___;
+.size   sha512_block_data_order,.-sha512_block_data_order
+.asciz  "SHA512 block transform for ARMv4/NEON, CRYPTOGAMS by <appro\@openssl.org>"
 .align  2
+.comm   OPENSSL_armcap_P,4,4
 ___
 
 $code =~ s/\`([^\`]*)\`/eval $1/gem;
diff --git a/src/lib/libcrypto/sha/asm/sha512-mips.pl b/src/lib/libcrypto/sha/asm/sha512-mips.pl
new file mode 100644
index 0000000000..ba5b250890
--- /dev/null
+++ b/src/lib/libcrypto/sha/asm/sha512-mips.pl
@@ -0,0 +1,455 @@
+#!/usr/bin/env perl
+
+# ====================================================================
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# project. The module is, however, dual licensed under OpenSSL and
+# CRYPTOGAMS licenses depending on where you obtain it. For further
+# details see http://www.openssl.org/~appro/cryptogams/.
+# ====================================================================
+
+# SHA2 block procedures for MIPS.
+
+# October 2010.
+#
+# SHA256 performance improvement on MIPS R5000 CPU is ~27% over gcc-
+# generated code in o32 build and ~55% in n32/64 build. SHA512 [which
+# for now can only be compiled for MIPS64 ISA] improvement is modest
+# ~17%, but it comes for free, because it's same instruction sequence.
+# Improvement coefficients are for aligned input.
+
+######################################################################
+# There is a number of MIPS ABI in use, O32 and N32/64 are most
+# widely used. Then there is a new contender: NUBI. It appears that if
+# one picks the latter, it's possible to arrange code in ABI neutral
+# manner. Therefore let's stick to NUBI register layout:
+#
+($zero,$at,$t0,$t1,$t2)=map("\$$_",(0..2,24,25));
+($a0,$a1,$a2,$a3,$a4,$a5,$a6,$a7)=map("\$$_",(4..11));
+($s0,$s1,$s2,$s3,$s4,$s5,$s6,$s7,$s8,$s9,$s10,$s11)=map("\$$_",(12..23));
+($gp,$tp,$sp,$fp,$ra)=map("\$$_",(3,28..31));
+#
+# The return value is placed in $a0. Following coding rules facilitate
+# interoperability:
+#
+# - never ever touch $tp, "thread pointer", former $gp [o32 can be
+#   excluded from the rule, because it's specified volatile];
+# - copy return value to $t0, former $v0 [or to $a0 if you're adapting
+#   old code];
+# - on O32 populate $a4-$a7 with 'lw $aN,4*N($sp)' if necessary;
+#
+# For reference here is register layout for N32/64 MIPS ABIs:
+#
+# ($zero,$at,$v0,$v1)=map("\$$_",(0..3));
+# ($a0,$a1,$a2,$a3,$a4,$a5,$a6,$a7)=map("\$$_",(4..11));
+# ($t0,$t1,$t2,$t3,$t8,$t9)=map("\$$_",(12..15,24,25));
+# ($s0,$s1,$s2,$s3,$s4,$s5,$s6,$s7)=map("\$$_",(16..23));
+# ($gp,$sp,$fp,$ra)=map("\$$_",(28..31));
+#
+$flavour = shift; # supported flavours are o32,n32,64,nubi32,nubi64
+
+if ($flavour =~ /64|n32/i) {
+        $PTR_ADD="dadd";        # incidentally works even on n32
+        $PTR_SUB="dsub";        # incidentally works even on n32
+        $REG_S="sd";
+        $REG_L="ld";
+        $PTR_SLL="dsll";        # incidentally works even on n32
+        $SZREG=8;
+} else {
+        $PTR_ADD="add";
+        $PTR_SUB="sub";
+        $REG_S="sw";
+        $REG_L="lw";
+        $PTR_SLL="sll";
+        $SZREG=4;
+}
+$pf = ($flavour =~ /nubi/i) ? $t0 : $t2;
+#
+# <appro@openssl.org>
+#
+######################################################################
+
+$big_endian=(`echo MIPSEL | $ENV{CC} -E -P -`=~/MIPSEL/)?1:0;
+
+for (@ARGV) {   $output=$_ if (/^\w[\w\-]*\.\w+$/);     }
+open STDOUT,">$output";
+
+if (!defined($big_endian)) { $big_endian=(unpack('L',pack('N',1))==1); }
+
+if ($output =~ /512/) {
+        $label="512";
+        $SZ=8;
+        $LD="ld";               # load from memory
+        $ST="sd";               # store to memory
+        $SLL="dsll";            # shift left logical
+        $SRL="dsrl";            # shift right logical
+        $ADDU="daddu";
+        @Sigma0=(28,34,39);
+        @Sigma1=(14,18,41);
+        @sigma0=( 7, 1, 8);     # right shift first
+        @sigma1=( 6,19,61);     # right shift first
+        $lastK=0x817;
+        $rounds=80;
+} else {
+        $label="256";
+        $SZ=4;
+        $LD="lw";               # load from memory
+        $ST="sw";               # store to memory
+        $SLL="sll";             # shift left logical
+        $SRL="srl";             # shift right logical
+        $ADDU="addu";
+        @Sigma0=( 2,13,22);
+        @Sigma1=( 6,11,25);
+        @sigma0=( 3, 7,18);     # right shift first
+        @sigma1=(10,17,19);     # right shift first
+        $lastK=0x8f2;
+        $rounds=64;
+}
+
+$MSB = $big_endian ? 0 : ($SZ-1);
+$LSB = ($SZ-1)&~$MSB;
+
+@V=($A,$B,$C,$D,$E,$F,$G,$H)=map("\$$_",(1,2,3,7,24,25,30,31));
+@X=map("\$$_",(8..23));
+
+$ctx=$a0;
+$inp=$a1;
+$len=$a2;       $Ktbl=$len;
+
+sub BODY_00_15 {
+my ($i,$a,$b,$c,$d,$e,$f,$g,$h)=@_;
+my ($T1,$tmp0,$tmp1,$tmp2)=(@X[4],@X[5],@X[6],@X[7]);
+
+$code.=<<___ if ($i<15);
+        ${LD}l  @X[1],`($i+1)*$SZ+$MSB`($inp)
+        ${LD}r  @X[1],`($i+1)*$SZ+$LSB`($inp)
+___
+$code.=<<___    if (!$big_endian && $i<16 && $SZ==4);
+        srl     $tmp0,@X[0],24          # byte swap($i)
+        srl     $tmp1,@X[0],8
+        andi    $tmp2,@X[0],0xFF00
+        sll     @X[0],@X[0],24
+        andi    $tmp1,0xFF00
+        sll     $tmp2,$tmp2,8
+        or      @X[0],$tmp0
+        or      $tmp1,$tmp2
+        or      @X[0],$tmp1
+___
+$code.=<<___    if (!$big_endian && $i<16 && $SZ==8);
+        ori     $tmp0,$zero,0xFF
+        dsll    $tmp2,$tmp0,32
+        or      $tmp0,$tmp2             # 0x000000FF000000FF
+        and     $tmp1,@X[0],$tmp0       # byte swap($i)
+        dsrl    $tmp2,@X[0],24
+        dsll    $tmp1,24
+        and     $tmp2,$tmp0
+        dsll    $tmp0,8                 # 0x0000FF000000FF00
+        or      $tmp1,$tmp2
+        and     $tmp2,@X[0],$tmp0
+        dsrl    @X[0],8
+        dsll    $tmp2,8
+        and     @X[0],$tmp0
+        or      $tmp1,$tmp2
+        or      @X[0],$tmp1
+        dsrl    $tmp1,@X[0],32
+        dsll    @X[0],32
+        or      @X[0],$tmp1
+___
+$code.=<<___;
+        $ADDU   $T1,$X[0],$h                    # $i
+        $SRL    $h,$e,@Sigma1[0]
+        xor     $tmp2,$f,$g
+        $SLL    $tmp1,$e,`$SZ*8-@Sigma1[2]`
+        and     $tmp2,$e
+        $SRL    $tmp0,$e,@Sigma1[1]
+        xor     $h,$tmp1
+        $SLL    $tmp1,$e,`$SZ*8-@Sigma1[1]`
+        xor     $h,$tmp0
+        $SRL    $tmp0,$e,@Sigma1[2]
+        xor     $h,$tmp1
+        $SLL    $tmp1,$e,`$SZ*8-@Sigma1[0]`
+        xor     $h,$tmp0
+        xor     $tmp2,$g                        # Ch(e,f,g)
+        xor     $tmp0,$tmp1,$h                  # Sigma1(e)
+
+        $SRL    $h,$a,@Sigma0[0]
+        $ADDU   $T1,$tmp2
+        $LD     $tmp2,`$i*$SZ`($Ktbl)           # K[$i]
+        $SLL    $tmp1,$a,`$SZ*8-@Sigma0[2]`
+        $ADDU   $T1,$tmp0
+        $SRL    $tmp0,$a,@Sigma0[1]
+        xor     $h,$tmp1
+        $SLL    $tmp1,$a,`$SZ*8-@Sigma0[1]`
+        xor     $h,$tmp0
+        $SRL    $tmp0,$a,@Sigma0[2]
+        xor     $h,$tmp1
+        $SLL    $tmp1,$a,`$SZ*8-@Sigma0[0]`
+        xor     $h,$tmp0
+        $ST     @X[0],`($i%16)*$SZ`($sp)        # offload to ring buffer
+        xor     $h,$tmp1                        # Sigma0(a)
+
+        or      $tmp0,$a,$b
+        and     $tmp1,$a,$b
+        and     $tmp0,$c
+        or      $tmp1,$tmp0                     # Maj(a,b,c)
+        $ADDU   $T1,$tmp2                       # +=K[$i]
+        $ADDU   $h,$tmp1
+
+        $ADDU   $d,$T1
+        $ADDU   $h,$T1
+___
+$code.=<<___ if ($i>=13);
+        $LD     @X[3],`(($i+3)%16)*$SZ`($sp)    # prefetch from ring buffer
+___
+}
+
+sub BODY_16_XX {
+my $i=@_[0];
+my ($tmp0,$tmp1,$tmp2,$tmp3)=(@X[4],@X[5],@X[6],@X[7]);
+
+$code.=<<___;
+        $SRL    $tmp2,@X[1],@sigma0[0]          # Xupdate($i)
+        $ADDU   @X[0],@X[9]                     # +=X[i+9]
+        $SLL    $tmp1,@X[1],`$SZ*8-@sigma0[2]`
+        $SRL    $tmp0,@X[1],@sigma0[1]
+        xor     $tmp2,$tmp1
+        $SLL    $tmp1,`@sigma0[2]-@sigma0[1]`
+        xor     $tmp2,$tmp0
+        $SRL    $tmp0,@X[1],@sigma0[2]
+        xor     $tmp2,$tmp1
+
+        $SRL    $tmp3,@X[14],@sigma1[0]
+        xor     $tmp2,$tmp0                     # sigma0(X[i+1])
+        $SLL    $tmp1,@X[14],`$SZ*8-@sigma1[2]`
+        $ADDU   @X[0],$tmp2
+        $SRL    $tmp0,@X[14],@sigma1[1]
+        xor     $tmp3,$tmp1
+        $SLL    $tmp1,`@sigma1[2]-@sigma1[1]`
+        xor     $tmp3,$tmp0
+        $SRL    $tmp0,@X[14],@sigma1[2]
+        xor     $tmp3,$tmp1
+
+        xor     $tmp3,$tmp0                     # sigma1(X[i+14])
+        $ADDU   @X[0],$tmp3
+___
+        &BODY_00_15(@_);
+}
+
+$FRAMESIZE=16*$SZ+16*$SZREG;
+$SAVED_REGS_MASK = ($flavour =~ /nubi/i) ? 0xc0fff008 : 0xc0ff0000;
+
+$code.=<<___;
+#ifdef OPENSSL_FIPSCANISTER
+# include <openssl/fipssyms.h>
+#endif
+
+.text
+.set    noat
+#if !defined(__vxworks) || defined(__pic__)
+.option pic2
+#endif
+
+.align  5
+.globl  sha${label}_block_data_order
+.ent    sha${label}_block_data_order
+sha${label}_block_data_order:
+        .frame  $sp,$FRAMESIZE,$ra
+        .mask   $SAVED_REGS_MASK,-$SZREG
+        .set    noreorder
+___
+$code.=<<___ if ($flavour =~ /o32/i);   # o32 PIC-ification
+        .cpload $pf
+___
+$code.=<<___;
+        $PTR_SUB $sp,$FRAMESIZE
+        $REG_S  $ra,$FRAMESIZE-1*$SZREG($sp)
+        $REG_S  $fp,$FRAMESIZE-2*$SZREG($sp)
+        $REG_S  $s11,$FRAMESIZE-3*$SZREG($sp)
+        $REG_S  $s10,$FRAMESIZE-4*$SZREG($sp)
+        $REG_S  $s9,$FRAMESIZE-5*$SZREG($sp)
+        $REG_S  $s8,$FRAMESIZE-6*$SZREG($sp)
+        $REG_S  $s7,$FRAMESIZE-7*$SZREG($sp)
+        $REG_S  $s6,$FRAMESIZE-8*$SZREG($sp)
+        $REG_S  $s5,$FRAMESIZE-9*$SZREG($sp)
+        $REG_S  $s4,$FRAMESIZE-10*$SZREG($sp)
+___
+$code.=<<___ if ($flavour =~ /nubi/i);  # optimize non-nubi prologue
+        $REG_S  $s3,$FRAMESIZE-11*$SZREG($sp)
+        $REG_S  $s2,$FRAMESIZE-12*$SZREG($sp)
+        $REG_S  $s1,$FRAMESIZE-13*$SZREG($sp)
+        $REG_S  $s0,$FRAMESIZE-14*$SZREG($sp)
+        $REG_S  $gp,$FRAMESIZE-15*$SZREG($sp)
+___
+$code.=<<___;
+        $PTR_SLL @X[15],$len,`log(16*$SZ)/log(2)`
+___
+$code.=<<___ if ($flavour !~ /o32/i);   # non-o32 PIC-ification
+        .cplocal        $Ktbl
+        .cpsetup        $pf,$zero,sha${label}_block_data_order
+___
+$code.=<<___;
+        .set    reorder
+        la      $Ktbl,K${label}         # PIC-ified 'load address'
+
+        $LD     $A,0*$SZ($ctx)          # load context
+        $LD     $B,1*$SZ($ctx)
+        $LD     $C,2*$SZ($ctx)
+        $LD     $D,3*$SZ($ctx)
+        $LD     $E,4*$SZ($ctx)
+        $LD     $F,5*$SZ($ctx)
+        $LD     $G,6*$SZ($ctx)
+        $LD     $H,7*$SZ($ctx)
+
+        $PTR_ADD @X[15],$inp            # pointer to the end of input
+        $REG_S  @X[15],16*$SZ($sp)
+        b       .Loop
+
+.align  5
+.Loop:
+        ${LD}l  @X[0],$MSB($inp)
+        ${LD}r  @X[0],$LSB($inp)
+___
+for ($i=0;$i<16;$i++)
+{ &BODY_00_15($i,@V); unshift(@V,pop(@V)); push(@X,shift(@X)); }
+$code.=<<___;
+        b       .L16_xx
+.align  4
+.L16_xx:
+___
+for (;$i<32;$i++)
+{ &BODY_16_XX($i,@V); unshift(@V,pop(@V)); push(@X,shift(@X)); }
+$code.=<<___;
+        and     @X[6],0xfff
+        li      @X[7],$lastK
+        .set    noreorder
+        bne     @X[6],@X[7],.L16_xx
+        $PTR_ADD $Ktbl,16*$SZ           # Ktbl+=16
+
+        $REG_L  @X[15],16*$SZ($sp)      # restore pointer to the end of input
+        $LD     @X[0],0*$SZ($ctx)
+        $LD     @X[1],1*$SZ($ctx)
+        $LD     @X[2],2*$SZ($ctx)
+        $PTR_ADD $inp,16*$SZ
+        $LD     @X[3],3*$SZ($ctx)
+        $ADDU   $A,@X[0]
+        $LD     @X[4],4*$SZ($ctx)
+        $ADDU   $B,@X[1]
+        $LD     @X[5],5*$SZ($ctx)
+        $ADDU   $C,@X[2]
+        $LD     @X[6],6*$SZ($ctx)
+        $ADDU   $D,@X[3]
+        $LD     @X[7],7*$SZ($ctx)
+        $ADDU   $E,@X[4]
+        $ST     $A,0*$SZ($ctx)
+        $ADDU   $F,@X[5]
+        $ST     $B,1*$SZ($ctx)
+        $ADDU   $G,@X[6]
+        $ST     $C,2*$SZ($ctx)
+        $ADDU   $H,@X[7]
+        $ST     $D,3*$SZ($ctx)
+        $ST     $E,4*$SZ($ctx)
+        $ST     $F,5*$SZ($ctx)
+        $ST     $G,6*$SZ($ctx)
+        $ST     $H,7*$SZ($ctx)
+
+        bnel    $inp,@X[15],.Loop
+        $PTR_SUB $Ktbl,`($rounds-16)*$SZ`       # rewind $Ktbl
+
+        $REG_L  $ra,$FRAMESIZE-1*$SZREG($sp)
+        $REG_L  $fp,$FRAMESIZE-2*$SZREG($sp)
+        $REG_L  $s11,$FRAMESIZE-3*$SZREG($sp)
+        $REG_L  $s10,$FRAMESIZE-4*$SZREG($sp)
+        $REG_L  $s9,$FRAMESIZE-5*$SZREG($sp)
+        $REG_L  $s8,$FRAMESIZE-6*$SZREG($sp)
+        $REG_L  $s7,$FRAMESIZE-7*$SZREG($sp)
+        $REG_L  $s6,$FRAMESIZE-8*$SZREG($sp)
+        $REG_L  $s5,$FRAMESIZE-9*$SZREG($sp)
+        $REG_L  $s4,$FRAMESIZE-10*$SZREG($sp)
+___
+$code.=<<___ if ($flavour =~ /nubi/i);
+        $REG_L  $s3,$FRAMESIZE-11*$SZREG($sp)
+        $REG_L  $s2,$FRAMESIZE-12*$SZREG($sp)
+        $REG_L  $s1,$FRAMESIZE-13*$SZREG($sp)
+        $REG_L  $s0,$FRAMESIZE-14*$SZREG($sp)
+        $REG_L  $gp,$FRAMESIZE-15*$SZREG($sp)
+___
+$code.=<<___;
+        jr      $ra
+        $PTR_ADD $sp,$FRAMESIZE
+.end    sha${label}_block_data_order
+
+.rdata
+.align  5
+K${label}:
+___
+if ($SZ==4) {
+$code.=<<___;
+        .word   0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5
+        .word   0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5
+        .word   0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3
+        .word   0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174
+        .word   0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc
+        .word   0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da
+        .word   0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7
+        .word   0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967
+        .word   0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13
+        .word   0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85
+        .word   0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3
+        .word   0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070
+        .word   0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5
+        .word   0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3
+        .word   0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208
+        .word   0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+___
+} else {
+$code.=<<___;
+        .dword  0x428a2f98d728ae22, 0x7137449123ef65cd
+        .dword  0xb5c0fbcfec4d3b2f, 0xe9b5dba58189dbbc
+        .dword  0x3956c25bf348b538, 0x59f111f1b605d019
+        .dword  0x923f82a4af194f9b, 0xab1c5ed5da6d8118
+        .dword  0xd807aa98a3030242, 0x12835b0145706fbe
+        .dword  0x243185be4ee4b28c, 0x550c7dc3d5ffb4e2
+        .dword  0x72be5d74f27b896f, 0x80deb1fe3b1696b1
+        .dword  0x9bdc06a725c71235, 0xc19bf174cf692694
+        .dword  0xe49b69c19ef14ad2, 0xefbe4786384f25e3
+        .dword  0x0fc19dc68b8cd5b5, 0x240ca1cc77ac9c65
+        .dword  0x2de92c6f592b0275, 0x4a7484aa6ea6e483
+        .dword  0x5cb0a9dcbd41fbd4, 0x76f988da831153b5
+        .dword  0x983e5152ee66dfab, 0xa831c66d2db43210
+        .dword  0xb00327c898fb213f, 0xbf597fc7beef0ee4
+        .dword  0xc6e00bf33da88fc2, 0xd5a79147930aa725
+        .dword  0x06ca6351e003826f, 0x142929670a0e6e70
+        .dword  0x27b70a8546d22ffc, 0x2e1b21385c26c926
+        .dword  0x4d2c6dfc5ac42aed, 0x53380d139d95b3df
+        .dword  0x650a73548baf63de, 0x766a0abb3c77b2a8
+        .dword  0x81c2c92e47edaee6, 0x92722c851482353b
+        .dword  0xa2bfe8a14cf10364, 0xa81a664bbc423001
+        .dword  0xc24b8b70d0f89791, 0xc76c51a30654be30
+        .dword  0xd192e819d6ef5218, 0xd69906245565a910
+        .dword  0xf40e35855771202a, 0x106aa07032bbd1b8
+        .dword  0x19a4c116b8d2d0c8, 0x1e376c085141ab53
+        .dword  0x2748774cdf8eeb99, 0x34b0bcb5e19b48a8
+        .dword  0x391c0cb3c5c95a63, 0x4ed8aa4ae3418acb
+        .dword  0x5b9cca4f7763e373, 0x682e6ff3d6b2b8a3
+        .dword  0x748f82ee5defb2fc, 0x78a5636f43172f60
+        .dword  0x84c87814a1f0ab72, 0x8cc702081a6439ec
+        .dword  0x90befffa23631e28, 0xa4506cebde82bde9
+        .dword  0xbef9a3f7b2c67915, 0xc67178f2e372532b
+        .dword  0xca273eceea26619c, 0xd186b8c721c0c207
+        .dword  0xeada7dd6cde0eb1e, 0xf57d4f7fee6ed178
+        .dword  0x06f067aa72176fba, 0x0a637dc5a2c898a6
+        .dword  0x113f9804bef90dae, 0x1b710b35131c471b
+        .dword  0x28db77f523047d84, 0x32caab7b40c72493
+        .dword  0x3c9ebe0a15c9bebc, 0x431d67c49c100d4c
+        .dword  0x4cc5d4becb3e42b6, 0x597f299cfc657e2a
+        .dword  0x5fcb6fab3ad6faec, 0x6c44198c4a475817
+___
+}
+$code.=<<___;
+.asciiz "SHA${label} for MIPS, CRYPTOGAMS by <appro\@openssl.org>"
+.align  5
+
+___
+
+$code =~ s/\`([^\`]*)\`/eval $1/gem;
+print $code;
+close STDOUT;
diff --git a/src/lib/libcrypto/sha/asm/sha512-parisc.pl b/src/lib/libcrypto/sha/asm/sha512-parisc.pl
new file mode 100755
index 0000000000..e24ee58ae9
--- /dev/null
+++ b/src/lib/libcrypto/sha/asm/sha512-parisc.pl
@@ -0,0 +1,791 @@
+#!/usr/bin/env perl
+
+# ====================================================================
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# project. The module is, however, dual licensed under OpenSSL and
+# CRYPTOGAMS licenses depending on where you obtain it. For further
+# details see http://www.openssl.org/~appro/cryptogams/.
+# ====================================================================
+
+# SHA256/512 block procedure for PA-RISC.
+
+# June 2009.
+#
+# SHA256 performance is >75% better than gcc 3.2 generated code on
+# PA-7100LC. Compared to code generated by vendor compiler this
+# implementation is almost 70% faster in 64-bit build, but delivers
+# virtually same performance in 32-bit build on PA-8600.
+#
+# SHA512 performance is >2.9x better than gcc 3.2 generated code on
+# PA-7100LC, PA-RISC 1.1 processor. Then implementation detects if the
+# code is executed on PA-RISC 2.0 processor and switches to 64-bit
+# code path delivering adequate peformance even in "blended" 32-bit
+# build. Though 64-bit code is not any faster than code generated by
+# vendor compiler on PA-8600...
+#
+# Special thanks to polarhome.com for providing HP-UX account.
+
+$flavour = shift;
+$output = shift;
+open STDOUT,">$output";
+
+if ($flavour =~ /64/) {
+        $LEVEL          ="2.0W";
+        $SIZE_T         =8;
+        $FRAME_MARKER   =80;
+        $SAVED_RP       =16;
+        $PUSH           ="std";
+        $PUSHMA         ="std,ma";
+        $POP            ="ldd";
+        $POPMB          ="ldd,mb";
+} else {
+        $LEVEL          ="1.0";
+        $SIZE_T         =4;
+        $FRAME_MARKER   =48;
+        $SAVED_RP       =20;
+        $PUSH           ="stw";
+        $PUSHMA         ="stwm";
+        $POP            ="ldw";
+        $POPMB          ="ldwm";
+}
+
+if ($output =~ /512/) {
+        $func="sha512_block_data_order";
+        $SZ=8;
+        @Sigma0=(28,34,39);
+        @Sigma1=(14,18,41);
+        @sigma0=(1,  8, 7);
+        @sigma1=(19,61, 6);
+        $rounds=80;
+        $LAST10BITS=0x017;
+        $LD="ldd";
+        $LDM="ldd,ma";
+        $ST="std";
+} else {
+        $func="sha256_block_data_order";
+        $SZ=4;
+        @Sigma0=( 2,13,22);
+        @Sigma1=( 6,11,25);
+        @sigma0=( 7,18, 3);
+        @sigma1=(17,19,10);
+        $rounds=64;
+        $LAST10BITS=0x0f2;
+        $LD="ldw";
+        $LDM="ldwm";
+        $ST="stw";
+}
+
+$FRAME=16*$SIZE_T+$FRAME_MARKER;# 16 saved regs + frame marker
+                                #                 [+ argument transfer]
+$XOFF=16*$SZ+32;                # local variables
+$FRAME+=$XOFF;
+$XOFF+=$FRAME_MARKER;           # distance between %sp and local variables
+
+$ctx="%r26";    # zapped by $a0
+$inp="%r25";    # zapped by $a1
+$num="%r24";    # zapped by $t0
+
+$a0 ="%r26";
+$a1 ="%r25";
+$t0 ="%r24";
+$t1 ="%r29";
+$Tbl="%r31";
+
+@V=($A,$B,$C,$D,$E,$F,$G,$H)=("%r17","%r18","%r19","%r20","%r21","%r22","%r23","%r28");
+
+@X=("%r1", "%r2", "%r3", "%r4", "%r5", "%r6", "%r7", "%r8",
+    "%r9", "%r10","%r11","%r12","%r13","%r14","%r15","%r16",$inp);
+
+sub ROUND_00_15 {
+my ($i,$a,$b,$c,$d,$e,$f,$g,$h)=@_;
+$code.=<<___;
+        _ror    $e,$Sigma1[0],$a0
+        and     $f,$e,$t0
+        _ror    $e,$Sigma1[1],$a1
+        addl    $t1,$h,$h
+        andcm   $g,$e,$t1
+        xor     $a1,$a0,$a0
+        _ror    $a1,`$Sigma1[2]-$Sigma1[1]`,$a1
+        or      $t0,$t1,$t1             ; Ch(e,f,g)
+        addl    @X[$i%16],$h,$h
+        xor     $a0,$a1,$a1             ; Sigma1(e)
+        addl    $t1,$h,$h
+        _ror    $a,$Sigma0[0],$a0
+        addl    $a1,$h,$h
+
+        _ror    $a,$Sigma0[1],$a1
+        and     $a,$b,$t0
+        and     $a,$c,$t1
+        xor     $a1,$a0,$a0
+        _ror    $a1,`$Sigma0[2]-$Sigma0[1]`,$a1
+        xor     $t1,$t0,$t0
+        and     $b,$c,$t1
+        xor     $a0,$a1,$a1             ; Sigma0(a)
+        addl    $h,$d,$d
+        xor     $t1,$t0,$t0             ; Maj(a,b,c)
+        `"$LDM  $SZ($Tbl),$t1" if ($i<15)`
+        addl    $a1,$h,$h
+        addl    $t0,$h,$h
+
+___
+}
+
+sub ROUND_16_xx {
+my ($i,$a,$b,$c,$d,$e,$f,$g,$h)=@_;
+$i-=16;
+$code.=<<___;
+        _ror    @X[($i+1)%16],$sigma0[0],$a0
+        _ror    @X[($i+1)%16],$sigma0[1],$a1
+        addl    @X[($i+9)%16],@X[$i],@X[$i]
+        _ror    @X[($i+14)%16],$sigma1[0],$t0
+        _ror    @X[($i+14)%16],$sigma1[1],$t1
+        xor     $a1,$a0,$a0
+        _shr    @X[($i+1)%16],$sigma0[2],$a1
+        xor     $t1,$t0,$t0
+        _shr    @X[($i+14)%16],$sigma1[2],$t1
+        xor     $a1,$a0,$a0             ; sigma0(X[(i+1)&0x0f])
+        xor     $t1,$t0,$t0             ; sigma1(X[(i+14)&0x0f])
+        $LDM    $SZ($Tbl),$t1
+        addl    $a0,@X[$i],@X[$i]
+        addl    $t0,@X[$i],@X[$i]
+___
+$code.=<<___ if ($i==15);
+        extru   $t1,31,10,$a1
+        comiclr,<> $LAST10BITS,$a1,%r0
+        ldo     1($Tbl),$Tbl            ; signal end of $Tbl
+___
+&ROUND_00_15($i+16,$a,$b,$c,$d,$e,$f,$g,$h);
+}
+
+$code=<<___;
+        .LEVEL  $LEVEL
+        .SPACE  \$TEXT\$
+        .SUBSPA \$CODE\$,QUAD=0,ALIGN=8,ACCESS=0x2C,CODE_ONLY
+
+        .ALIGN  64
+L\$table
+___
+$code.=<<___ if ($SZ==8);
+        .WORD   0x428a2f98,0xd728ae22,0x71374491,0x23ef65cd
+        .WORD   0xb5c0fbcf,0xec4d3b2f,0xe9b5dba5,0x8189dbbc
+        .WORD   0x3956c25b,0xf348b538,0x59f111f1,0xb605d019
+        .WORD   0x923f82a4,0xaf194f9b,0xab1c5ed5,0xda6d8118
+        .WORD   0xd807aa98,0xa3030242,0x12835b01,0x45706fbe
+        .WORD   0x243185be,0x4ee4b28c,0x550c7dc3,0xd5ffb4e2
+        .WORD   0x72be5d74,0xf27b896f,0x80deb1fe,0x3b1696b1
+        .WORD   0x9bdc06a7,0x25c71235,0xc19bf174,0xcf692694
+        .WORD   0xe49b69c1,0x9ef14ad2,0xefbe4786,0x384f25e3
+        .WORD   0x0fc19dc6,0x8b8cd5b5,0x240ca1cc,0x77ac9c65
+        .WORD   0x2de92c6f,0x592b0275,0x4a7484aa,0x6ea6e483
+        .WORD   0x5cb0a9dc,0xbd41fbd4,0x76f988da,0x831153b5
+        .WORD   0x983e5152,0xee66dfab,0xa831c66d,0x2db43210
+        .WORD   0xb00327c8,0x98fb213f,0xbf597fc7,0xbeef0ee4
+        .WORD   0xc6e00bf3,0x3da88fc2,0xd5a79147,0x930aa725
+        .WORD   0x06ca6351,0xe003826f,0x14292967,0x0a0e6e70
+        .WORD   0x27b70a85,0x46d22ffc,0x2e1b2138,0x5c26c926
+        .WORD   0x4d2c6dfc,0x5ac42aed,0x53380d13,0x9d95b3df
+        .WORD   0x650a7354,0x8baf63de,0x766a0abb,0x3c77b2a8
+        .WORD   0x81c2c92e,0x47edaee6,0x92722c85,0x1482353b
+        .WORD   0xa2bfe8a1,0x4cf10364,0xa81a664b,0xbc423001
+        .WORD   0xc24b8b70,0xd0f89791,0xc76c51a3,0x0654be30
+        .WORD   0xd192e819,0xd6ef5218,0xd6990624,0x5565a910
+        .WORD   0xf40e3585,0x5771202a,0x106aa070,0x32bbd1b8
+        .WORD   0x19a4c116,0xb8d2d0c8,0x1e376c08,0x5141ab53
+        .WORD   0x2748774c,0xdf8eeb99,0x34b0bcb5,0xe19b48a8
+        .WORD   0x391c0cb3,0xc5c95a63,0x4ed8aa4a,0xe3418acb
+        .WORD   0x5b9cca4f,0x7763e373,0x682e6ff3,0xd6b2b8a3
+        .WORD   0x748f82ee,0x5defb2fc,0x78a5636f,0x43172f60
+        .WORD   0x84c87814,0xa1f0ab72,0x8cc70208,0x1a6439ec
+        .WORD   0x90befffa,0x23631e28,0xa4506ceb,0xde82bde9
+        .WORD   0xbef9a3f7,0xb2c67915,0xc67178f2,0xe372532b
+        .WORD   0xca273ece,0xea26619c,0xd186b8c7,0x21c0c207
+        .WORD   0xeada7dd6,0xcde0eb1e,0xf57d4f7f,0xee6ed178
+        .WORD   0x06f067aa,0x72176fba,0x0a637dc5,0xa2c898a6
+        .WORD   0x113f9804,0xbef90dae,0x1b710b35,0x131c471b
+        .WORD   0x28db77f5,0x23047d84,0x32caab7b,0x40c72493
+        .WORD   0x3c9ebe0a,0x15c9bebc,0x431d67c4,0x9c100d4c
+        .WORD   0x4cc5d4be,0xcb3e42b6,0x597f299c,0xfc657e2a
+        .WORD   0x5fcb6fab,0x3ad6faec,0x6c44198c,0x4a475817
+___
+$code.=<<___ if ($SZ==4);
+        .WORD   0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5
+        .WORD   0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5
+        .WORD   0xd807aa98,0x12835b01,0x243185be,0x550c7dc3
+        .WORD   0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174
+        .WORD   0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc
+        .WORD   0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da
+        .WORD   0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7
+        .WORD   0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967
+        .WORD   0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13
+        .WORD   0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85
+        .WORD   0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3
+        .WORD   0xd192e819,0xd6990624,0xf40e3585,0x106aa070
+        .WORD   0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5
+        .WORD   0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3
+        .WORD   0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208
+        .WORD   0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
+___
+$code.=<<___;
+
+        .EXPORT $func,ENTRY,ARGW0=GR,ARGW1=GR,ARGW2=GR
+        .ALIGN  64
+$func
+        .PROC
+        .CALLINFO       FRAME=`$FRAME-16*$SIZE_T`,NO_CALLS,SAVE_RP,ENTRY_GR=18
+        .ENTRY
+        $PUSH   %r2,-$SAVED_RP(%sp)     ; standard prologue
+        $PUSHMA %r3,$FRAME(%sp)
+        $PUSH   %r4,`-$FRAME+1*$SIZE_T`(%sp)
+        $PUSH   %r5,`-$FRAME+2*$SIZE_T`(%sp)
+        $PUSH   %r6,`-$FRAME+3*$SIZE_T`(%sp)
+        $PUSH   %r7,`-$FRAME+4*$SIZE_T`(%sp)
+        $PUSH   %r8,`-$FRAME+5*$SIZE_T`(%sp)
+        $PUSH   %r9,`-$FRAME+6*$SIZE_T`(%sp)
+        $PUSH   %r10,`-$FRAME+7*$SIZE_T`(%sp)
+        $PUSH   %r11,`-$FRAME+8*$SIZE_T`(%sp)
+        $PUSH   %r12,`-$FRAME+9*$SIZE_T`(%sp)
+        $PUSH   %r13,`-$FRAME+10*$SIZE_T`(%sp)
+        $PUSH   %r14,`-$FRAME+11*$SIZE_T`(%sp)
+        $PUSH   %r15,`-$FRAME+12*$SIZE_T`(%sp)
+        $PUSH   %r16,`-$FRAME+13*$SIZE_T`(%sp)
+        $PUSH   %r17,`-$FRAME+14*$SIZE_T`(%sp)
+        $PUSH   %r18,`-$FRAME+15*$SIZE_T`(%sp)
+
+        _shl    $num,`log(16*$SZ)/log(2)`,$num
+        addl    $inp,$num,$num          ; $num to point at the end of $inp
+
+        $PUSH   $num,`-$FRAME_MARKER-4*$SIZE_T`(%sp)    ; save arguments
+        $PUSH   $inp,`-$FRAME_MARKER-3*$SIZE_T`(%sp)
+        $PUSH   $ctx,`-$FRAME_MARKER-2*$SIZE_T`(%sp)
+
+        blr     %r0,$Tbl
+        ldi     3,$t1
+L\$pic
+        andcm   $Tbl,$t1,$Tbl           ; wipe privilege level
+        ldo     L\$table-L\$pic($Tbl),$Tbl
+___
+$code.=<<___ if ($SZ==8 && $SIZE_T==4);
+        ldi     31,$t1
+        mtctl   $t1,%cr11
+        extrd,u,*= $t1,%sar,1,$t1       ; executes on PA-RISC 1.0
+        b       L\$parisc1
+        nop
+___
+$code.=<<___;
+        $LD     `0*$SZ`($ctx),$A        ; load context
+        $LD     `1*$SZ`($ctx),$B
+        $LD     `2*$SZ`($ctx),$C
+        $LD     `3*$SZ`($ctx),$D
+        $LD     `4*$SZ`($ctx),$E
+        $LD     `5*$SZ`($ctx),$F
+        $LD     `6*$SZ`($ctx),$G
+        $LD     `7*$SZ`($ctx),$H
+
+        extru   $inp,31,`log($SZ)/log(2)`,$t0
+        sh3addl $t0,%r0,$t0
+        subi    `8*$SZ`,$t0,$t0
+        mtctl   $t0,%cr11               ; load %sar with align factor
+
+L\$oop
+        ldi     `$SZ-1`,$t0
+        $LDM    $SZ($Tbl),$t1
+        andcm   $inp,$t0,$t0            ; align $inp
+___
+        for ($i=0;$i<15;$i++) {         # load input block
+        $code.="\t$LD   `$SZ*$i`($t0),@X[$i]\n";                }
+$code.=<<___;
+        cmpb,*= $inp,$t0,L\$aligned
+        $LD     `$SZ*15`($t0),@X[15]
+        $LD     `$SZ*16`($t0),@X[16]
+___
+        for ($i=0;$i<16;$i++) {         # align data
+        $code.="\t_align        @X[$i],@X[$i+1],@X[$i]\n";      }
+$code.=<<___;
+L\$aligned
+        nop     ; otherwise /usr/ccs/bin/as is confused by below .WORD
+___
+
+for($i=0;$i<16;$i++)    { &ROUND_00_15($i,@V); unshift(@V,pop(@V)); }
+$code.=<<___;
+L\$rounds
+        nop     ; otherwise /usr/ccs/bin/as is confused by below .WORD
+___
+for(;$i<32;$i++)        { &ROUND_16_xx($i,@V); unshift(@V,pop(@V)); }
+$code.=<<___;
+        bb,>=   $Tbl,31,L\$rounds       ; end of $Tbl signalled?
+        nop
+
+        $POP    `-$FRAME_MARKER-2*$SIZE_T`(%sp),$ctx    ; restore arguments
+        $POP    `-$FRAME_MARKER-3*$SIZE_T`(%sp),$inp
+        $POP    `-$FRAME_MARKER-4*$SIZE_T`(%sp),$num
+        ldo     `-$rounds*$SZ-1`($Tbl),$Tbl             ; rewind $Tbl
+
+        $LD     `0*$SZ`($ctx),@X[0]     ; load context
+        $LD     `1*$SZ`($ctx),@X[1]
+        $LD     `2*$SZ`($ctx),@X[2]
+        $LD     `3*$SZ`($ctx),@X[3]
+        $LD     `4*$SZ`($ctx),@X[4]
+        $LD     `5*$SZ`($ctx),@X[5]
+        addl    @X[0],$A,$A
+        $LD     `6*$SZ`($ctx),@X[6]
+        addl    @X[1],$B,$B
+        $LD     `7*$SZ`($ctx),@X[7]
+        ldo     `16*$SZ`($inp),$inp     ; advance $inp
+
+        $ST     $A,`0*$SZ`($ctx)        ; save context
+        addl    @X[2],$C,$C
+        $ST     $B,`1*$SZ`($ctx)
+        addl    @X[3],$D,$D
+        $ST     $C,`2*$SZ`($ctx)
+        addl    @X[4],$E,$E
+        $ST     $D,`3*$SZ`($ctx)
+        addl    @X[5],$F,$F
+        $ST     $E,`4*$SZ`($ctx)
+        addl    @X[6],$G,$G
+        $ST     $F,`5*$SZ`($ctx)
+        addl    @X[7],$H,$H
+        $ST     $G,`6*$SZ`($ctx)
+        $ST     $H,`7*$SZ`($ctx)
+
+        cmpb,*<>,n $inp,$num,L\$oop
+        $PUSH   $inp,`-$FRAME_MARKER-3*$SIZE_T`(%sp)    ; save $inp
+___
+if ($SZ==8 && $SIZE_T==4)       # SHA512 for 32-bit PA-RISC 1.0
+{{
+$code.=<<___;
+        b       L\$done
+        nop
+
+        .ALIGN  64
+L\$parisc1
+___
+
+@V=(  $Ahi,  $Alo,  $Bhi,  $Blo,  $Chi,  $Clo,  $Dhi,  $Dlo,
+      $Ehi,  $Elo,  $Fhi,  $Flo,  $Ghi,  $Glo,  $Hhi,  $Hlo) = 
+   ( "%r1", "%r2", "%r3", "%r4", "%r5", "%r6", "%r7", "%r8",
+     "%r9","%r10","%r11","%r12","%r13","%r14","%r15","%r16");
+$a0 ="%r17";
+$a1 ="%r18";
+$a2 ="%r19";
+$a3 ="%r20";
+$t0 ="%r21";
+$t1 ="%r22";
+$t2 ="%r28";
+$t3 ="%r29";
+$Tbl="%r31";
+
+@X=("%r23","%r24","%r25","%r26");       # zaps $num,$inp,$ctx
+
+sub ROUND_00_15_pa1 {
+my ($i,$ahi,$alo,$bhi,$blo,$chi,$clo,$dhi,$dlo,
+       $ehi,$elo,$fhi,$flo,$ghi,$glo,$hhi,$hlo,$flag)=@_;
+my ($Xhi,$Xlo,$Xnhi,$Xnlo) = @X;
+
+$code.=<<___ if (!$flag);
+        ldw     `-$XOFF+8*(($i+1)%16)`(%sp),$Xnhi
+        ldw     `-$XOFF+8*(($i+1)%16)+4`(%sp),$Xnlo     ; load X[i+1]
+___
+$code.=<<___;
+        shd     $ehi,$elo,$Sigma1[0],$t0
+         add    $Xlo,$hlo,$hlo
+        shd     $elo,$ehi,$Sigma1[0],$t1
+         addc   $Xhi,$hhi,$hhi          ; h += X[i]
+        shd     $ehi,$elo,$Sigma1[1],$t2
+         ldwm   8($Tbl),$Xhi
+        shd     $elo,$ehi,$Sigma1[1],$t3
+         ldw    -4($Tbl),$Xlo           ; load K[i]
+        xor     $t2,$t0,$t0
+        xor     $t3,$t1,$t1
+         and    $flo,$elo,$a0
+         and    $fhi,$ehi,$a1
+        shd     $ehi,$elo,$Sigma1[2],$t2
+         andcm  $glo,$elo,$a2
+        shd     $elo,$ehi,$Sigma1[2],$t3
+         andcm  $ghi,$ehi,$a3
+        xor     $t2,$t0,$t0
+        xor     $t3,$t1,$t1             ; Sigma1(e)
+        add     $Xlo,$hlo,$hlo
+         xor    $a2,$a0,$a0
+        addc    $Xhi,$hhi,$hhi          ; h += K[i]
+         xor    $a3,$a1,$a1             ; Ch(e,f,g)
+
+         add    $t0,$hlo,$hlo
+        shd     $ahi,$alo,$Sigma0[0],$t0
+         addc   $t1,$hhi,$hhi           ; h += Sigma1(e)
+        shd     $alo,$ahi,$Sigma0[0],$t1        
+         add    $a0,$hlo,$hlo
+        shd     $ahi,$alo,$Sigma0[1],$t2
+         addc   $a1,$hhi,$hhi           ; h += Ch(e,f,g)
+        shd     $alo,$ahi,$Sigma0[1],$t3
+
+        xor     $t2,$t0,$t0
+        xor     $t3,$t1,$t1
+        shd     $ahi,$alo,$Sigma0[2],$t2
+        and     $alo,$blo,$a0
+        shd     $alo,$ahi,$Sigma0[2],$t3
+        and     $ahi,$bhi,$a1
+        xor     $t2,$t0,$t0
+        xor     $t3,$t1,$t1             ; Sigma0(a)
+
+        and     $alo,$clo,$a2
+        and     $ahi,$chi,$a3
+        xor     $a2,$a0,$a0
+         add    $hlo,$dlo,$dlo
+        xor     $a3,$a1,$a1
+         addc   $hhi,$dhi,$dhi          ; d += h
+        and     $blo,$clo,$a2
+         add    $t0,$hlo,$hlo
+        and     $bhi,$chi,$a3
+         addc   $t1,$hhi,$hhi           ; h += Sigma0(a)
+        xor     $a2,$a0,$a0
+         add    $a0,$hlo,$hlo
+        xor     $a3,$a1,$a1             ; Maj(a,b,c)
+         addc   $a1,$hhi,$hhi           ; h += Maj(a,b,c)
+
+___
+$code.=<<___ if ($i==15 && $flag);
+        extru   $Xlo,31,10,$Xlo
+        comiclr,= $LAST10BITS,$Xlo,%r0
+        b       L\$rounds_pa1
+        nop
+___
+push(@X,shift(@X)); push(@X,shift(@X));
+}
+
+sub ROUND_16_xx_pa1 {
+my ($Xhi,$Xlo,$Xnhi,$Xnlo) = @X;
+my ($i)=shift;
+$i-=16;
+$code.=<<___;
+        ldw     `-$XOFF+8*(($i+1)%16)`(%sp),$Xnhi
+        ldw     `-$XOFF+8*(($i+1)%16)+4`(%sp),$Xnlo     ; load X[i+1]
+        ldw     `-$XOFF+8*(($i+9)%16)`(%sp),$a1
+        ldw     `-$XOFF+8*(($i+9)%16)+4`(%sp),$a0       ; load X[i+9]
+        ldw     `-$XOFF+8*(($i+14)%16)`(%sp),$a3
+        ldw     `-$XOFF+8*(($i+14)%16)+4`(%sp),$a2      ; load X[i+14]
+        shd     $Xnhi,$Xnlo,$sigma0[0],$t0
+        shd     $Xnlo,$Xnhi,$sigma0[0],$t1
+         add    $a0,$Xlo,$Xlo
+        shd     $Xnhi,$Xnlo,$sigma0[1],$t2
+         addc   $a1,$Xhi,$Xhi
+        shd     $Xnlo,$Xnhi,$sigma0[1],$t3
+        xor     $t2,$t0,$t0
+        shd     $Xnhi,$Xnlo,$sigma0[2],$t2
+        xor     $t3,$t1,$t1
+        extru   $Xnhi,`31-$sigma0[2]`,`32-$sigma0[2]`,$t3
+        xor     $t2,$t0,$t0
+         shd    $a3,$a2,$sigma1[0],$a0
+        xor     $t3,$t1,$t1             ; sigma0(X[i+1)&0x0f])
+         shd    $a2,$a3,$sigma1[0],$a1
+        add     $t0,$Xlo,$Xlo
+         shd    $a3,$a2,$sigma1[1],$t2
+        addc    $t1,$Xhi,$Xhi
+         shd    $a2,$a3,$sigma1[1],$t3
+        xor     $t2,$a0,$a0
+        shd     $a3,$a2,$sigma1[2],$t2
+        xor     $t3,$a1,$a1
+        extru   $a3,`31-$sigma1[2]`,`32-$sigma1[2]`,$t3
+        xor     $t2,$a0,$a0
+        xor     $t3,$a1,$a1             ; sigma0(X[i+14)&0x0f])
+        add     $a0,$Xlo,$Xlo
+        addc    $a1,$Xhi,$Xhi
+
+        stw     $Xhi,`-$XOFF+8*($i%16)`(%sp)
+        stw     $Xlo,`-$XOFF+8*($i%16)+4`(%sp)
+___
+&ROUND_00_15_pa1($i,@_,1);
+}
+$code.=<<___;
+        ldw     `0*4`($ctx),$Ahi                ; load context
+        ldw     `1*4`($ctx),$Alo
+        ldw     `2*4`($ctx),$Bhi
+        ldw     `3*4`($ctx),$Blo
+        ldw     `4*4`($ctx),$Chi
+        ldw     `5*4`($ctx),$Clo
+        ldw     `6*4`($ctx),$Dhi
+        ldw     `7*4`($ctx),$Dlo
+        ldw     `8*4`($ctx),$Ehi
+        ldw     `9*4`($ctx),$Elo
+        ldw     `10*4`($ctx),$Fhi
+        ldw     `11*4`($ctx),$Flo
+        ldw     `12*4`($ctx),$Ghi
+        ldw     `13*4`($ctx),$Glo
+        ldw     `14*4`($ctx),$Hhi
+        ldw     `15*4`($ctx),$Hlo
+
+        extru   $inp,31,2,$t0
+        sh3addl $t0,%r0,$t0
+        subi    32,$t0,$t0
+        mtctl   $t0,%cr11               ; load %sar with align factor
+
+L\$oop_pa1
+        extru   $inp,31,2,$a3
+        comib,= 0,$a3,L\$aligned_pa1
+        sub     $inp,$a3,$inp
+
+        ldw     `0*4`($inp),$X[0]
+        ldw     `1*4`($inp),$X[1]
+        ldw     `2*4`($inp),$t2
+        ldw     `3*4`($inp),$t3
+        ldw     `4*4`($inp),$a0
+        ldw     `5*4`($inp),$a1
+        ldw     `6*4`($inp),$a2
+        ldw     `7*4`($inp),$a3
+        vshd    $X[0],$X[1],$X[0]
+        vshd    $X[1],$t2,$X[1]
+        stw     $X[0],`-$XOFF+0*4`(%sp)
+        ldw     `8*4`($inp),$t0
+        vshd    $t2,$t3,$t2
+        stw     $X[1],`-$XOFF+1*4`(%sp)
+        ldw     `9*4`($inp),$t1
+        vshd    $t3,$a0,$t3
+___
+{
+my @t=($t2,$t3,$a0,$a1,$a2,$a3,$t0,$t1);
+for ($i=2;$i<=(128/4-8);$i++) {
+$code.=<<___;
+        stw     $t[0],`-$XOFF+$i*4`(%sp)
+        ldw     `(8+$i)*4`($inp),$t[0]
+        vshd    $t[1],$t[2],$t[1]
+___
+push(@t,shift(@t));
+}
+for (;$i<(128/4-1);$i++) {
+$code.=<<___;
+        stw     $t[0],`-$XOFF+$i*4`(%sp)
+        vshd    $t[1],$t[2],$t[1]
+___
+push(@t,shift(@t));
+}
+$code.=<<___;
+        b       L\$collected_pa1
+        stw     $t[0],`-$XOFF+$i*4`(%sp)
+
+___
+}
+$code.=<<___;
+L\$aligned_pa1
+        ldw     `0*4`($inp),$X[0]
+        ldw     `1*4`($inp),$X[1]
+        ldw     `2*4`($inp),$t2
+        ldw     `3*4`($inp),$t3
+        ldw     `4*4`($inp),$a0
+        ldw     `5*4`($inp),$a1
+        ldw     `6*4`($inp),$a2
+        ldw     `7*4`($inp),$a3
+        stw     $X[0],`-$XOFF+0*4`(%sp)
+        ldw     `8*4`($inp),$t0
+        stw     $X[1],`-$XOFF+1*4`(%sp)
+        ldw     `9*4`($inp),$t1
+___
+{
+my @t=($t2,$t3,$a0,$a1,$a2,$a3,$t0,$t1);
+for ($i=2;$i<(128/4-8);$i++) {
+$code.=<<___;
+        stw     $t[0],`-$XOFF+$i*4`(%sp)
+        ldw     `(8+$i)*4`($inp),$t[0]
+___
+push(@t,shift(@t));
+}
+for (;$i<128/4;$i++) {
+$code.=<<___;
+        stw     $t[0],`-$XOFF+$i*4`(%sp)
+___
+push(@t,shift(@t));
+}
+$code.="L\$collected_pa1\n";
+}
+
+for($i=0;$i<16;$i++)    { &ROUND_00_15_pa1($i,@V); unshift(@V,pop(@V)); unshift(@V,pop(@V)); }
+$code.="L\$rounds_pa1\n";
+for(;$i<32;$i++)        { &ROUND_16_xx_pa1($i,@V); unshift(@V,pop(@V)); unshift(@V,pop(@V)); }
+
+$code.=<<___;
+        $POP    `-$FRAME_MARKER-2*$SIZE_T`(%sp),$ctx    ; restore arguments
+        $POP    `-$FRAME_MARKER-3*$SIZE_T`(%sp),$inp
+        $POP    `-$FRAME_MARKER-4*$SIZE_T`(%sp),$num
+        ldo     `-$rounds*$SZ`($Tbl),$Tbl               ; rewind $Tbl
+
+        ldw     `0*4`($ctx),$t1         ; update context
+        ldw     `1*4`($ctx),$t0
+        ldw     `2*4`($ctx),$t3
+        ldw     `3*4`($ctx),$t2
+        ldw     `4*4`($ctx),$a1
+        ldw     `5*4`($ctx),$a0
+        ldw     `6*4`($ctx),$a3
+        add     $t0,$Alo,$Alo
+        ldw     `7*4`($ctx),$a2
+        addc    $t1,$Ahi,$Ahi
+        ldw     `8*4`($ctx),$t1
+        add     $t2,$Blo,$Blo
+        ldw     `9*4`($ctx),$t0
+        addc    $t3,$Bhi,$Bhi
+        ldw     `10*4`($ctx),$t3
+        add     $a0,$Clo,$Clo
+        ldw     `11*4`($ctx),$t2
+        addc    $a1,$Chi,$Chi
+        ldw     `12*4`($ctx),$a1
+        add     $a2,$Dlo,$Dlo
+        ldw     `13*4`($ctx),$a0
+        addc    $a3,$Dhi,$Dhi
+        ldw     `14*4`($ctx),$a3
+        add     $t0,$Elo,$Elo
+        ldw     `15*4`($ctx),$a2
+        addc    $t1,$Ehi,$Ehi
+        stw     $Ahi,`0*4`($ctx)
+        add     $t2,$Flo,$Flo
+        stw     $Alo,`1*4`($ctx)
+        addc    $t3,$Fhi,$Fhi
+        stw     $Bhi,`2*4`($ctx)
+        add     $a0,$Glo,$Glo
+        stw     $Blo,`3*4`($ctx)
+        addc    $a1,$Ghi,$Ghi
+        stw     $Chi,`4*4`($ctx)
+        add     $a2,$Hlo,$Hlo
+        stw     $Clo,`5*4`($ctx)
+        addc    $a3,$Hhi,$Hhi
+        stw     $Dhi,`6*4`($ctx)
+        ldo     `16*$SZ`($inp),$inp     ; advance $inp
+        stw     $Dlo,`7*4`($ctx)
+        stw     $Ehi,`8*4`($ctx)
+        stw     $Elo,`9*4`($ctx)
+        stw     $Fhi,`10*4`($ctx)
+        stw     $Flo,`11*4`($ctx)
+        stw     $Ghi,`12*4`($ctx)
+        stw     $Glo,`13*4`($ctx)
+        stw     $Hhi,`14*4`($ctx)
+        comb,=  $inp,$num,L\$done
+        stw     $Hlo,`15*4`($ctx)
+        b       L\$oop_pa1
+        $PUSH   $inp,`-$FRAME_MARKER-3*$SIZE_T`(%sp)    ; save $inp
+L\$done
+___
+}}
+$code.=<<___;
+        $POP    `-$FRAME-$SAVED_RP`(%sp),%r2            ; standard epilogue
+        $POP    `-$FRAME+1*$SIZE_T`(%sp),%r4
+        $POP    `-$FRAME+2*$SIZE_T`(%sp),%r5
+        $POP    `-$FRAME+3*$SIZE_T`(%sp),%r6
+        $POP    `-$FRAME+4*$SIZE_T`(%sp),%r7
+        $POP    `-$FRAME+5*$SIZE_T`(%sp),%r8
+        $POP    `-$FRAME+6*$SIZE_T`(%sp),%r9
+        $POP    `-$FRAME+7*$SIZE_T`(%sp),%r10
+        $POP    `-$FRAME+8*$SIZE_T`(%sp),%r11
+        $POP    `-$FRAME+9*$SIZE_T`(%sp),%r12
+        $POP    `-$FRAME+10*$SIZE_T`(%sp),%r13
+        $POP    `-$FRAME+11*$SIZE_T`(%sp),%r14
+        $POP    `-$FRAME+12*$SIZE_T`(%sp),%r15
+        $POP    `-$FRAME+13*$SIZE_T`(%sp),%r16
+        $POP    `-$FRAME+14*$SIZE_T`(%sp),%r17
+        $POP    `-$FRAME+15*$SIZE_T`(%sp),%r18
+        bv      (%r2)
+        .EXIT
+        $POPMB  -$FRAME(%sp),%r3
+        .PROCEND
+        .STRINGZ "SHA`64*$SZ` block transform for PA-RISC, CRYPTOGAMS by <appro\@openssl.org>"
+___
+
+# Explicitly encode PA-RISC 2.0 instructions used in this module, so
+# that it can be compiled with .LEVEL 1.0. It should be noted that I
+# wouldn't have to do this, if GNU assembler understood .ALLOW 2.0
+# directive...
+
+my $ldd = sub {
+  my ($mod,$args) = @_;
+  my $orig = "ldd$mod\t$args";
+
+    if ($args =~ /(\-?[0-9]+)\(%r([0-9]+)\),%r([0-9]+)/) # format 3 suffices
+    {   my $opcode=(0x14<<26)|($2<<21)|($3<<16)|(($1&0x1FF8)<<1)|(($1>>13)&1);
+        $opcode|=(1<<3) if ($mod =~ /^,m/);
+        $opcode|=(1<<2) if ($mod =~ /^,mb/);
+        sprintf "\t.WORD\t0x%08x\t; %s",$opcode,$orig;
+    }
+    else { "\t".$orig; }
+};
+
+my $std = sub {
+  my ($mod,$args) = @_;
+  my $orig = "std$mod\t$args";
+
+    if ($args =~ /%r([0-9]+),(\-?[0-9]+)\(%r([0-9]+)\)/) # format 3 suffices
+    {   my $opcode=(0x1c<<26)|($3<<21)|($1<<16)|(($2&0x1FF8)<<1)|(($2>>13)&1);
+        sprintf "\t.WORD\t0x%08x\t; %s",$opcode,$orig;
+    }
+    else { "\t".$orig; }
+};
+
+my $extrd = sub {
+  my ($mod,$args) = @_;
+  my $orig = "extrd$mod\t$args";
+
+    # I only have ",u" completer, it's implicitly encoded...
+    if ($args =~ /%r([0-9]+),([0-9]+),([0-9]+),%r([0-9]+)/)     # format 15
+    {   my $opcode=(0x36<<26)|($1<<21)|($4<<16);
+        my $len=32-$3;
+        $opcode |= (($2&0x20)<<6)|(($2&0x1f)<<5);               # encode pos
+        $opcode |= (($len&0x20)<<7)|($len&0x1f);                # encode len
+        sprintf "\t.WORD\t0x%08x\t; %s",$opcode,$orig;
+    }
+    elsif ($args =~ /%r([0-9]+),%sar,([0-9]+),%r([0-9]+)/)      # format 12
+    {   my $opcode=(0x34<<26)|($1<<21)|($3<<16)|(2<<11)|(1<<9);
+        my $len=32-$2;
+        $opcode |= (($len&0x20)<<3)|($len&0x1f);                # encode len
+        $opcode |= (1<<13) if ($mod =~ /,\**=/);
+        sprintf "\t.WORD\t0x%08x\t; %s",$opcode,$orig;
+    }
+    else { "\t".$orig; }
+};
+
+my $shrpd = sub {
+  my ($mod,$args) = @_;
+  my $orig = "shrpd$mod\t$args";
+
+    if ($args =~ /%r([0-9]+),%r([0-9]+),([0-9]+),%r([0-9]+)/)   # format 14
+    {   my $opcode=(0x34<<26)|($2<<21)|($1<<16)|(1<<10)|$4;
+        my $cpos=63-$3;
+        $opcode |= (($cpos&0x20)<<6)|(($cpos&0x1f)<<5);         # encode sa
+        sprintf "\t.WORD\t0x%08x\t; %s",$opcode,$orig;
+    }
+    elsif ($args =~ /%r([0-9]+),%r([0-9]+),%sar,%r([0-9]+)/)    # format 11
+    {   sprintf "\t.WORD\t0x%08x\t; %s",
+                (0x34<<26)|($2<<21)|($1<<16)|(1<<9)|$3,$orig;
+    }
+    else { "\t".$orig; }
+};
+
+sub assemble {
+  my ($mnemonic,$mod,$args)=@_;
+  my $opcode = eval("\$$mnemonic");
+
+    ref($opcode) eq 'CODE' ? &$opcode($mod,$args) : "\t$mnemonic$mod\t$args";
+}
+
+foreach (split("\n",$code)) {
+        s/\`([^\`]*)\`/eval $1/ge;
+
+        s/shd\s+(%r[0-9]+),(%r[0-9]+),([0-9]+)/
+                $3>31 ? sprintf("shd\t%$2,%$1,%d",$3-32)        # rotation for >=32
+                :       sprintf("shd\t%$1,%$2,%d",$3)/e                 or
+        # translate made up instructons: _ror, _shr, _align, _shl
+        s/_ror(\s+)(%r[0-9]+),/
+                ($SZ==4 ? "shd" : "shrpd")."$1$2,$2,"/e                 or
+
+        s/_shr(\s+%r[0-9]+),([0-9]+),/
+                $SZ==4 ? sprintf("extru%s,%d,%d,",$1,31-$2,32-$2)
+                :        sprintf("extrd,u%s,%d,%d,",$1,63-$2,64-$2)/e   or
+
+        s/_align(\s+%r[0-9]+,%r[0-9]+),/
+                ($SZ==4 ? "vshd$1," : "shrpd$1,%sar,")/e                or
+
+        s/_shl(\s+%r[0-9]+),([0-9]+),/
+                $SIZE_T==4 ? sprintf("zdep%s,%d,%d,",$1,31-$2,32-$2)
+                :            sprintf("depd,z%s,%d,%d,",$1,63-$2,64-$2)/e;
+
+        s/^\s+([a-z]+)([\S]*)\s+([\S]*)/&assemble($1,$2,$3)/e if ($SIZE_T==4);
+
+        s/cmpb,\*/comb,/ if ($SIZE_T==4);
+
+        print $_,"\n";
+}
+
+close STDOUT;
diff --git a/src/lib/libcrypto/sha/asm/sha512-ppc.pl b/src/lib/libcrypto/sha/asm/sha512-ppc.pl
index 768a6a6fad..6b44a68e59 100755
--- a/src/lib/libcrypto/sha/asm/sha512-ppc.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-ppc.pl
@@ -40,6 +40,7 @@ $output =shift;
 
 if ($flavour =~ /64/) {
         $SIZE_T=8;
+        $LRSAVE=2*$SIZE_T;
         $STU="stdu";
         $UCMP="cmpld";
         $SHL="sldi";
@@ -47,6 +48,7 @@ if ($flavour =~ /64/) {
         $PUSH="std";
 } elsif ($flavour =~ /32/) {
         $SIZE_T=4;
+        $LRSAVE=$SIZE_T;
         $STU="stwu";
         $UCMP="cmplw";
         $SHL="slwi";
@@ -87,7 +89,8 @@ if ($output =~ /512/) {
         $SHR="srwi";
 }
 
-$FRAME=32*$SIZE_T;
+$FRAME=32*$SIZE_T+16*$SZ;
+$LOCALS=6*$SIZE_T;
 
 $sp ="r1";
 $toc="r2";
@@ -179,13 +182,12 @@ $code=<<___;
 .globl  $func
 .align  6
 $func:
+        $STU    $sp,-$FRAME($sp)
         mflr    r0
-        $STU    $sp,`-($FRAME+16*$SZ)`($sp)
         $SHL    $num,$num,`log(16*$SZ)/log(2)`
 
         $PUSH   $ctx,`$FRAME-$SIZE_T*22`($sp)
 
-        $PUSH   r0,`$FRAME-$SIZE_T*21`($sp)
         $PUSH   $toc,`$FRAME-$SIZE_T*20`($sp)
         $PUSH   r13,`$FRAME-$SIZE_T*19`($sp)
         $PUSH   r14,`$FRAME-$SIZE_T*18`($sp)
@@ -206,6 +208,7 @@ $func:
         $PUSH   r29,`$FRAME-$SIZE_T*3`($sp)
         $PUSH   r30,`$FRAME-$SIZE_T*2`($sp)
         $PUSH   r31,`$FRAME-$SIZE_T*1`($sp)
+        $PUSH   r0,`$FRAME+$LRSAVE`($sp)
 
         $LD     $A,`0*$SZ`($ctx)
         mr      $inp,r4                         ; incarnate $inp
@@ -217,7 +220,7 @@ $func:
         $LD     $G,`6*$SZ`($ctx)
         $LD     $H,`7*$SZ`($ctx)
 
-        b       LPICmeup
+        bl      LPICmeup
 LPICedup:
         andi.   r0,$inp,3
         bne     Lunaligned
@@ -226,40 +229,14 @@ Laligned:
         $PUSH   $num,`$FRAME-$SIZE_T*24`($sp)   ; end pointer
         $PUSH   $inp,`$FRAME-$SIZE_T*23`($sp)   ; inp pointer
         bl      Lsha2_block_private
-Ldone:
-        $POP    r0,`$FRAME-$SIZE_T*21`($sp)
-        $POP    $toc,`$FRAME-$SIZE_T*20`($sp)
-        $POP    r13,`$FRAME-$SIZE_T*19`($sp)
-        $POP    r14,`$FRAME-$SIZE_T*18`($sp)
-        $POP    r15,`$FRAME-$SIZE_T*17`($sp)
-        $POP    r16,`$FRAME-$SIZE_T*16`($sp)
-        $POP    r17,`$FRAME-$SIZE_T*15`($sp)
-        $POP    r18,`$FRAME-$SIZE_T*14`($sp)
-        $POP    r19,`$FRAME-$SIZE_T*13`($sp)
-        $POP    r20,`$FRAME-$SIZE_T*12`($sp)
-        $POP    r21,`$FRAME-$SIZE_T*11`($sp)
-        $POP    r22,`$FRAME-$SIZE_T*10`($sp)
-        $POP    r23,`$FRAME-$SIZE_T*9`($sp)
-        $POP    r24,`$FRAME-$SIZE_T*8`($sp)
-        $POP    r25,`$FRAME-$SIZE_T*7`($sp)
-        $POP    r26,`$FRAME-$SIZE_T*6`($sp)
-        $POP    r27,`$FRAME-$SIZE_T*5`($sp)
-        $POP    r28,`$FRAME-$SIZE_T*4`($sp)
-        $POP    r29,`$FRAME-$SIZE_T*3`($sp)
-        $POP    r30,`$FRAME-$SIZE_T*2`($sp)
-        $POP    r31,`$FRAME-$SIZE_T*1`($sp)
-        mtlr    r0
-        addi    $sp,$sp,`$FRAME+16*$SZ`
-        blr
-___
+        b       Ldone
 
-# PowerPC specification allows an implementation to be ill-behaved
-# upon unaligned access which crosses page boundary. "Better safe
-# than sorry" principle makes me treat it specially. But I don't
-# look for particular offending word, but rather for the input
-# block which crosses the boundary. Once found that block is aligned
-# and hashed separately...
-$code.=<<___;
+; PowerPC specification allows an implementation to be ill-behaved
+; upon unaligned access which crosses page boundary. "Better safe
+; than sorry" principle makes me treat it specially. But I don't
+; look for particular offending word, but rather for the input
+; block which crosses the boundary. Once found that block is aligned
+; and hashed separately...
 .align  4
 Lunaligned:
         subfic  $t1,$inp,4096
@@ -278,7 +255,7 @@ Lunaligned:
 Lcross_page:
         li      $t1,`16*$SZ/4`
         mtctr   $t1
-        addi    r20,$sp,$FRAME                  ; aligned spot below the frame
+        addi    r20,$sp,$LOCALS                 ; aligned spot below the frame
 Lmemcpy:
         lbz     r16,0($inp)
         lbz     r17,1($inp)
@@ -293,8 +270,8 @@ Lmemcpy:
         bdnz    Lmemcpy
 
         $PUSH   $inp,`$FRAME-$SIZE_T*26`($sp)   ; save real inp
-        addi    $t1,$sp,`$FRAME+16*$SZ`         ; fictitious end pointer
-        addi    $inp,$sp,$FRAME                 ; fictitious inp pointer
+        addi    $t1,$sp,`$LOCALS+16*$SZ`        ; fictitious end pointer
+        addi    $inp,$sp,$LOCALS                ; fictitious inp pointer
         $PUSH   $num,`$FRAME-$SIZE_T*25`($sp)   ; save real num
         $PUSH   $t1,`$FRAME-$SIZE_T*24`($sp)    ; end pointer
         $PUSH   $inp,`$FRAME-$SIZE_T*23`($sp)   ; inp pointer
@@ -303,10 +280,36 @@ Lmemcpy:
         $POP    $num,`$FRAME-$SIZE_T*25`($sp)   ; restore real num
         addic.  $num,$num,`-16*$SZ`             ; num--
         bne-    Lunaligned
-        b       Ldone
-___
 
-$code.=<<___;
+Ldone:
+        $POP    r0,`$FRAME+$LRSAVE`($sp)
+        $POP    $toc,`$FRAME-$SIZE_T*20`($sp)
+        $POP    r13,`$FRAME-$SIZE_T*19`($sp)
+        $POP    r14,`$FRAME-$SIZE_T*18`($sp)
+        $POP    r15,`$FRAME-$SIZE_T*17`($sp)
+        $POP    r16,`$FRAME-$SIZE_T*16`($sp)
+        $POP    r17,`$FRAME-$SIZE_T*15`($sp)
+        $POP    r18,`$FRAME-$SIZE_T*14`($sp)
+        $POP    r19,`$FRAME-$SIZE_T*13`($sp)
+        $POP    r20,`$FRAME-$SIZE_T*12`($sp)
+        $POP    r21,`$FRAME-$SIZE_T*11`($sp)
+        $POP    r22,`$FRAME-$SIZE_T*10`($sp)
+        $POP    r23,`$FRAME-$SIZE_T*9`($sp)
+        $POP    r24,`$FRAME-$SIZE_T*8`($sp)
+        $POP    r25,`$FRAME-$SIZE_T*7`($sp)
+        $POP    r26,`$FRAME-$SIZE_T*6`($sp)
+        $POP    r27,`$FRAME-$SIZE_T*5`($sp)
+        $POP    r28,`$FRAME-$SIZE_T*4`($sp)
+        $POP    r29,`$FRAME-$SIZE_T*3`($sp)
+        $POP    r30,`$FRAME-$SIZE_T*2`($sp)
+        $POP    r31,`$FRAME-$SIZE_T*1`($sp)
+        mtlr    r0
+        addi    $sp,$sp,$FRAME
+        blr
+        .long   0
+        .byte   0,12,4,1,0x80,18,3,0
+        .long   0
+
 .align  4
 Lsha2_block_private:
 ___
@@ -372,6 +375,8 @@ $code.=<<___;
         $ST     $H,`7*$SZ`($ctx)
         bne     Lsha2_block_private
         blr
+        .long   0
+        .byte   0,12,0x14,0,0,0,0,0
 ___
 
 # Ugly hack here, because PPC assembler syntax seem to vary too
@@ -379,22 +384,15 @@ ___
 $code.=<<___;
 .align  6
 LPICmeup:
-        bl      LPIC
-        addi    $Tbl,$Tbl,`64-4`        ; "distance" between . and last nop
-        b       LPICedup
-        nop
-        nop
-        nop
-        nop
-        nop
-LPIC:   mflr    $Tbl
+        mflr    r0
+        bcl     20,31,\$+4
+        mflr    $Tbl    ; vvvvvv "distance" between . and 1st data entry
+        addi    $Tbl,$Tbl,`64-8`
+        mtlr    r0
         blr
-        nop
-        nop
-        nop
-        nop
-        nop
-        nop
+        .long   0
+        .byte   0,12,0x14,0,0,0,0,0
+        .space  `64-9*4`
 ___
 $code.=<<___ if ($SZ==8);
         .long   0x428a2f98,0xd728ae22,0x71374491,0x23ef65cd
diff --git a/src/lib/libcrypto/sha/asm/sha512-s390x.pl b/src/lib/libcrypto/sha/asm/sha512-s390x.pl
index e7ef2d5a9f..079a3fc78a 100644
--- a/src/lib/libcrypto/sha/asm/sha512-s390x.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-s390x.pl
@@ -26,6 +26,26 @@
 # favour dual-issue z10 pipeline. Hardware SHA256/512 is ~4.7x faster
 # than software.
 
+# November 2010.
+#
+# Adapt for -m31 build. If kernel supports what's called "highgprs"
+# feature on Linux [see /proc/cpuinfo], it's possible to use 64-bit
+# instructions and achieve "64-bit" performance even in 31-bit legacy
+# application context. The feature is not specific to any particular
+# processor, as long as it's "z-CPU". Latter implies that the code
+# remains z/Architecture specific. On z900 SHA256 was measured to
+# perform 2.4x and SHA512 - 13x better than code generated by gcc 4.3.
+
+$flavour = shift;
+
+if ($flavour =~ /3[12]/) {
+        $SIZE_T=4;
+        $g="";
+} else {
+        $SIZE_T=8;
+        $g="g";
+}
+
 $t0="%r0";
 $t1="%r1";
 $ctx="%r2";     $t2="%r2";
@@ -44,7 +64,7 @@ $tbl="%r13";
 $T1="%r14";
 $sp="%r15";
 
-$output=shift;
+while (($output=shift) && ($output!~/^\w[\w\-]*\.\w+$/)) {}
 open STDOUT,">$output";
 
 if ($output =~ /512/) {
@@ -78,7 +98,8 @@ if ($output =~ /512/) {
 }
 $Func="sha${label}_block_data_order";
 $Table="K${label}";
-$frame=160+16*$SZ;
+$stdframe=16*$SIZE_T+4*8;
+$frame=$stdframe+16*$SZ;
 
 sub BODY_00_15 {
 my ($i,$a,$b,$c,$d,$e,$f,$g,$h) = @_;
@@ -93,9 +114,9 @@ $code.=<<___;
         xgr     $t0,$t1
         $ROT    $t1,$t1,`$Sigma1[2]-$Sigma1[1]`
          xgr    $t2,$g
-        $ST     $T1,`160+$SZ*($i%16)`($sp)
+        $ST     $T1,`$stdframe+$SZ*($i%16)`($sp)
         xgr     $t0,$t1                 # Sigma1(e)
-        la      $T1,0($T1,$h)           # T1+=h
+        algr    $T1,$h                  # T1+=h
          ngr    $t2,$e
          lgr    $t1,$a
         algr    $T1,$t0                 # T1+=Sigma1(e)
@@ -113,7 +134,7 @@ $code.=<<___;
          ngr    $t2,$b
         algr    $h,$T1                  # h+=T1
          ogr    $t2,$t1                 # Maj(a,b,c)
-        la      $d,0($d,$T1)            # d+=T1
+        algr    $d,$T1                  # d+=T1
         algr    $h,$t2                  # h+=Maj(a,b,c)
 ___
 }
@@ -122,19 +143,19 @@ sub BODY_16_XX {
 my ($i,$a,$b,$c,$d,$e,$f,$g,$h) = @_;
 
 $code.=<<___;
-        $LD     $T1,`160+$SZ*(($i+1)%16)`($sp)  ### $i
-        $LD     $t1,`160+$SZ*(($i+14)%16)`($sp)
+        $LD     $T1,`$stdframe+$SZ*(($i+1)%16)`($sp)    ### $i
+        $LD     $t1,`$stdframe+$SZ*(($i+14)%16)`($sp)
         $ROT    $t0,$T1,$sigma0[0]
         $SHR    $T1,$sigma0[2]
         $ROT    $t2,$t0,`$sigma0[1]-$sigma0[0]`
         xgr     $T1,$t0
         $ROT    $t0,$t1,$sigma1[0]
-        xgr     $T1,$t2                         # sigma0(X[i+1])
+        xgr     $T1,$t2                                 # sigma0(X[i+1])
         $SHR    $t1,$sigma1[2]
-        $ADD    $T1,`160+$SZ*($i%16)`($sp)      # +=X[i]
+        $ADD    $T1,`$stdframe+$SZ*($i%16)`($sp)        # +=X[i]
         xgr     $t1,$t0
         $ROT    $t0,$t0,`$sigma1[1]-$sigma1[0]`
-        $ADD    $T1,`160+$SZ*(($i+9)%16)`($sp)  # +=X[i+9]
+        $ADD    $T1,`$stdframe+$SZ*(($i+9)%16)`($sp)    # +=X[i+9]
         xgr     $t1,$t0                         # sigma1(X[i+14])
         algr    $T1,$t1                         # +=sigma1(X[i+14])
 ___
@@ -212,6 +233,7 @@ $code.=<<___;
 .globl  $Func
 .type   $Func,\@function
 $Func:
+        sllg    $len,$len,`log(16*$SZ)/log(2)`
 ___
 $code.=<<___ if ($kimdfunc);
         larl    %r1,OPENSSL_s390xcap_P
@@ -219,15 +241,15 @@ $code.=<<___ if ($kimdfunc);
         tmhl    %r0,0x4000      # check for message-security assist
         jz      .Lsoftware
         lghi    %r0,0
-        la      %r1,16($sp)
+        la      %r1,`2*$SIZE_T`($sp)
         .long   0xb93e0002      # kimd %r0,%r2
-        lg      %r0,16($sp)
+        lg      %r0,`2*$SIZE_T`($sp)
         tmhh    %r0,`0x8000>>$kimdfunc`
         jz      .Lsoftware
         lghi    %r0,$kimdfunc
         lgr     %r1,$ctx
         lgr     %r2,$inp
-        sllg    %r3,$len,`log(16*$SZ)/log(2)`
+        lgr     %r3,$len
         .long   0xb93e0002      # kimd %r0,%r2
         brc     1,.-4           # pay attention to "partial completion"
         br      %r14
@@ -235,13 +257,12 @@ $code.=<<___ if ($kimdfunc);
 .Lsoftware:
 ___
 $code.=<<___;
-        sllg    $len,$len,`log(16*$SZ)/log(2)`
         lghi    %r1,-$frame
-        agr     $len,$inp
-        stmg    $ctx,%r15,16($sp)
+        la      $len,0($len,$inp)
+        stm${g} $ctx,%r15,`2*$SIZE_T`($sp)
         lgr     %r0,$sp
         la      $sp,0(%r1,$sp)
-        stg     %r0,0($sp)
+        st${g}  %r0,0($sp)
 
         larl    $tbl,$Table
         $LD     $A,`0*$SZ`($ctx)
@@ -265,7 +286,7 @@ $code.=<<___;
         clgr    $len,$t0
         jne     .Lrounds_16_xx
 
-        lg      $ctx,`$frame+16`($sp)
+        l${g}   $ctx,`$frame+2*$SIZE_T`($sp)
         la      $inp,`16*$SZ`($inp)
         $ADD    $A,`0*$SZ`($ctx)
         $ADD    $B,`1*$SZ`($ctx)
@@ -283,14 +304,14 @@ $code.=<<___;
         $ST     $F,`5*$SZ`($ctx)
         $ST     $G,`6*$SZ`($ctx)
         $ST     $H,`7*$SZ`($ctx)
-        clg     $inp,`$frame+32`($sp)
+        cl${g}  $inp,`$frame+4*$SIZE_T`($sp)
         jne     .Lloop
 
-        lmg     %r6,%r15,`$frame+48`($sp)       
+        lm${g}  %r6,%r15,`$frame+6*$SIZE_T`($sp)        
         br      %r14
 .size   $Func,.-$Func
 .string "SHA${label} block transform for s390x, CRYPTOGAMS by <appro\@openssl.org>"
-.comm   OPENSSL_s390xcap_P,8,8
+.comm   OPENSSL_s390xcap_P,16,8
 ___
 
 $code =~ s/\`([^\`]*)\`/eval $1/gem;
diff --git a/src/lib/libcrypto/sha/asm/sha512-sparcv9.pl b/src/lib/libcrypto/sha/asm/sha512-sparcv9.pl
index ec5d78135e..585740789e 100644
--- a/src/lib/libcrypto/sha/asm/sha512-sparcv9.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-sparcv9.pl
@@ -305,9 +305,9 @@ $code.=<<___;
         srlx    @X[(($i+9)/2)%8],32,$tmp1       ! X[i+9]
         xor     $tmp0,$tmp2,$tmp2               ! sigma1(X[i+14])
         srl     @X[($i/2)%8],0,$tmp0
+        add     $tmp2,$tmp1,$tmp1
         add     $xi,$T1,$T1                     ! +=X[i]
         xor     $tmp0,@X[($i/2)%8],@X[($i/2)%8]
-        add     $tmp2,$T1,$T1
         add     $tmp1,$T1,$T1
 
         srl     $T1,0,$T1
@@ -318,9 +318,9 @@ ___
 $code.=<<___;
         srlx    @X[($i/2)%8],32,$tmp1           ! X[i]
         xor     $tmp0,$tmp2,$tmp2               ! sigma1(X[i+14])
-        srl     @X[($i/2)%8],0,@X[($i/2)%8]
         add     $xi,$T1,$T1                     ! +=X[i+9]
-        add     $tmp2,$T1,$T1
+        add     $tmp2,$tmp1,$tmp1
+        srl     @X[($i/2)%8],0,@X[($i/2)%8]
         add     $tmp1,$T1,$T1
 
         sllx    $T1,32,$tmp0
diff --git a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
index e6643f8cf6..f611a2d898 100755
--- a/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-x86_64.pl
@@ -95,50 +95,44 @@ sub ROUND_00_15()
 { my ($i,$a,$b,$c,$d,$e,$f,$g,$h) = @_;
 
 $code.=<<___;
-        mov     $e,$a0
-        mov     $e,$a1
+        ror     \$`$Sigma1[2]-$Sigma1[1]`,$a0
         mov     $f,$a2
+        mov     $T1,`$SZ*($i&0xf)`(%rsp)
 
-        ror     \$$Sigma1[0],$a0
-        ror     \$$Sigma1[1],$a1
+        ror     \$`$Sigma0[2]-$Sigma0[1]`,$a1
+        xor     $e,$a0
         xor     $g,$a2                  # f^g
 
-        xor     $a1,$a0
-        ror     \$`$Sigma1[2]-$Sigma1[1]`,$a1
+        ror     \$`$Sigma1[1]-$Sigma1[0]`,$a0
+        add     $h,$T1                  # T1+=h
+        xor     $a,$a1
+
+        add     ($Tbl,$round,$SZ),$T1   # T1+=K[round]
         and     $e,$a2                  # (f^g)&e
-        mov     $T1,`$SZ*($i&0xf)`(%rsp)
+        mov     $b,$h
 
-        xor     $a1,$a0                 # Sigma1(e)
+        ror     \$`$Sigma0[1]-$Sigma0[0]`,$a1
+        xor     $e,$a0
         xor     $g,$a2                  # Ch(e,f,g)=((f^g)&e)^g
-        add     $h,$T1                  # T1+=h
-
-        mov     $a,$h
-        add     $a0,$T1                 # T1+=Sigma1(e)
 
+        xor     $c,$h                   # b^c
+        xor     $a,$a1
         add     $a2,$T1                 # T1+=Ch(e,f,g)
-        mov     $a,$a0
-        mov     $a,$a1
+        mov     $b,$a2
 
-        ror     \$$Sigma0[0],$h
-        ror     \$$Sigma0[1],$a0
-        mov     $a,$a2
-        add     ($Tbl,$round,$SZ),$T1   # T1+=K[round]
+        ror     \$$Sigma1[0],$a0        # Sigma1(e)
+        and     $a,$h                   # h=(b^c)&a
+        and     $c,$a2                  # b&c
 
-        xor     $a0,$h
-        ror     \$`$Sigma0[2]-$Sigma0[1]`,$a0
-        or      $c,$a1                  # a|c
+        ror     \$$Sigma0[0],$a1        # Sigma0(a)
+        add     $a0,$T1                 # T1+=Sigma1(e)
+        add     $a2,$h                  # h+=b&c (completes +=Maj(a,b,c)
 
-        xor     $a0,$h                  # h=Sigma0(a)
-        and     $c,$a2                  # a&c
         add     $T1,$d                  # d+=T1
-
-        and     $b,$a1                  # (a|c)&b
         add     $T1,$h                  # h+=T1
-
-        or      $a2,$a1                 # Maj(a,b,c)=((a|c)&b)|(a&c)
         lea     1($round),$round        # round++
+        add     $a1,$h                  # h+=Sigma0(a)
 
-        add     $a1,$h                  # h+=Maj(a,b,c)
 ___
 }
 
@@ -147,32 +141,30 @@ sub ROUND_16_XX()
 
 $code.=<<___;
         mov     `$SZ*(($i+1)&0xf)`(%rsp),$a0
-        mov     `$SZ*(($i+14)&0xf)`(%rsp),$T1
-
-        mov     $a0,$a2
+        mov     `$SZ*(($i+14)&0xf)`(%rsp),$a1
+        mov     $a0,$T1
+        mov     $a1,$a2
 
+        ror     \$`$sigma0[1]-$sigma0[0]`,$T1
+        xor     $a0,$T1
         shr     \$$sigma0[2],$a0
-        ror     \$$sigma0[0],$a2
-
-        xor     $a2,$a0
-        ror     \$`$sigma0[1]-$sigma0[0]`,$a2
 
-        xor     $a2,$a0                 # sigma0(X[(i+1)&0xf])
-        mov     $T1,$a1
+        ror     \$$sigma0[0],$T1
+        xor     $T1,$a0                 # sigma0(X[(i+1)&0xf])
+        mov     `$SZ*(($i+9)&0xf)`(%rsp),$T1
 
-        shr     \$$sigma1[2],$T1
-        ror     \$$sigma1[0],$a1
-
-        xor     $a1,$T1
-        ror     \$`$sigma1[1]-$sigma1[0]`,$a1
-
-        xor     $a1,$T1                 # sigma1(X[(i+14)&0xf])
+        ror     \$`$sigma1[1]-$sigma1[0]`,$a2
+        xor     $a1,$a2
+        shr     \$$sigma1[2],$a1
 
+        ror     \$$sigma1[0],$a2
         add     $a0,$T1
-
-        add     `$SZ*(($i+9)&0xf)`(%rsp),$T1
+        xor     $a2,$a1                 # sigma1(X[(i+14)&0xf])
 
         add     `$SZ*($i&0xf)`(%rsp),$T1
+        mov     $e,$a0
+        add     $a1,$T1
+        mov     $a,$a1
 ___
         &ROUND_00_15(@_);
 }
@@ -219,6 +211,8 @@ $func:
 ___
         for($i=0;$i<16;$i++) {
                 $code.="        mov     $SZ*$i($inp),$T1\n";
+                $code.="        mov     @ROT[4],$a0\n";
+                $code.="        mov     @ROT[0],$a1\n";
                 $code.="        bswap   $T1\n";
                 &ROUND_00_15($i,@ROT);
                 unshift(@ROT,pop(@ROT));
diff --git a/src/lib/libcrypto/sha/sha256.c b/src/lib/libcrypto/sha/sha256.c
index 8952d87673..f88d3d6dad 100644
--- a/src/lib/libcrypto/sha/sha256.c
+++ b/src/lib/libcrypto/sha/sha256.c
@@ -16,7 +16,7 @@
 
 const char SHA256_version[]="SHA-256" OPENSSL_VERSION_PTEXT;
 
-int SHA224_Init (SHA256_CTX *c)
+fips_md_init_ctx(SHA224, SHA256)
         {
         memset (c,0,sizeof(*c));
         c->h[0]=0xc1059ed8UL;   c->h[1]=0x367cd507UL;
@@ -27,7 +27,7 @@ int SHA224_Init (SHA256_CTX *c)
         return 1;
         }
 
-int SHA256_Init (SHA256_CTX *c)
+fips_md_init(SHA256)
         {
         memset (c,0,sizeof(*c));
         c->h[0]=0x6a09e667UL;   c->h[1]=0xbb67ae85UL;
diff --git a/src/lib/libcrypto/sha/sha512.c b/src/lib/libcrypto/sha/sha512.c
index cbc0e58c48..50dd7dc744 100644
--- a/src/lib/libcrypto/sha/sha512.c
+++ b/src/lib/libcrypto/sha/sha512.c
@@ -59,21 +59,8 @@ const char SHA512_version[]="SHA-512" OPENSSL_VERSION_PTEXT;
 #define SHA512_BLOCK_CAN_MANAGE_UNALIGNED_DATA
 #endif
 
-int SHA384_Init (SHA512_CTX *c)
+fips_md_init_ctx(SHA384, SHA512)
         {
-#if defined(SHA512_ASM) && (defined(__arm__) || defined(__arm))
-        /* maintain dword order required by assembler module */
-        unsigned int *h = (unsigned int *)c->h;
-
-        h[0]  = 0xcbbb9d5d; h[1]  = 0xc1059ed8;
-        h[2]  = 0x629a292a; h[3]  = 0x367cd507;
-        h[4]  = 0x9159015a; h[5]  = 0x3070dd17;
-        h[6]  = 0x152fecd8; h[7]  = 0xf70e5939;
-        h[8]  = 0x67332667; h[9]  = 0xffc00b31;
-        h[10] = 0x8eb44a87; h[11] = 0x68581511;
-        h[12] = 0xdb0c2e0d; h[13] = 0x64f98fa7;
-        h[14] = 0x47b5481d; h[15] = 0xbefa4fa4;
-#else
         c->h[0]=U64(0xcbbb9d5dc1059ed8);
         c->h[1]=U64(0x629a292a367cd507);
         c->h[2]=U64(0x9159015a3070dd17);
@@ -82,27 +69,14 @@ int SHA384_Init (SHA512_CTX *c)
         c->h[5]=U64(0x8eb44a8768581511);
         c->h[6]=U64(0xdb0c2e0d64f98fa7);
         c->h[7]=U64(0x47b5481dbefa4fa4);
-#endif
+
         c->Nl=0;        c->Nh=0;
         c->num=0;       c->md_len=SHA384_DIGEST_LENGTH;
         return 1;
         }
 
-int SHA512_Init (SHA512_CTX *c)
+fips_md_init(SHA512)
         {
-#if defined(SHA512_ASM) && (defined(__arm__) || defined(__arm))
-        /* maintain dword order required by assembler module */
-        unsigned int *h = (unsigned int *)c->h;
-
-        h[0]  = 0x6a09e667; h[1]  = 0xf3bcc908;
-        h[2]  = 0xbb67ae85; h[3]  = 0x84caa73b;
-        h[4]  = 0x3c6ef372; h[5]  = 0xfe94f82b;
-        h[6]  = 0xa54ff53a; h[7]  = 0x5f1d36f1;
-        h[8]  = 0x510e527f; h[9]  = 0xade682d1;
-        h[10] = 0x9b05688c; h[11] = 0x2b3e6c1f;
-        h[12] = 0x1f83d9ab; h[13] = 0xfb41bd6b;
-        h[14] = 0x5be0cd19; h[15] = 0x137e2179;
-#else
         c->h[0]=U64(0x6a09e667f3bcc908);
         c->h[1]=U64(0xbb67ae8584caa73b);
         c->h[2]=U64(0x3c6ef372fe94f82b);
@@ -111,7 +85,7 @@ int SHA512_Init (SHA512_CTX *c)
         c->h[5]=U64(0x9b05688c2b3e6c1f);
         c->h[6]=U64(0x1f83d9abfb41bd6b);
         c->h[7]=U64(0x5be0cd19137e2179);
-#endif
+
         c->Nl=0;        c->Nh=0;
         c->num=0;       c->md_len=SHA512_DIGEST_LENGTH;
         return 1;
@@ -160,24 +134,6 @@ int SHA512_Final (unsigned char *md, SHA512_CTX *c)
 
         if (md==0) return 0;
 
-#if defined(SHA512_ASM) && (defined(__arm__) || defined(__arm))
-        /* recall assembler dword order... */
-        n = c->md_len;
-        if (n == SHA384_DIGEST_LENGTH || n == SHA512_DIGEST_LENGTH)
-                {
-                unsigned int *h = (unsigned int *)c->h, t;
-
-                for (n/=4;n;n--)
-                        {
-                        t = *(h++);
-                        *(md++) = (unsigned char)(t>>24);
-                        *(md++) = (unsigned char)(t>>16);
-                        *(md++) = (unsigned char)(t>>8);
-                        *(md++) = (unsigned char)(t);
-                        }
-                }
-        else    return 0;
-#else
         switch (c->md_len)
                 {
                 /* Let compiler decide if it's appropriate to unroll... */
@@ -214,7 +170,7 @@ int SHA512_Final (unsigned char *md, SHA512_CTX *c)
                 /* ... as well as make sure md_len is not abused. */
                 default:        return 0;
                 }
-#endif
+
         return 1;
         }