MIPS assembler pack: enable it in Configure, add SHA2 module, fix make rules,
authorAndy Polyakov <appro@openssl.org>
Sat, 2 Oct 2010 11:47:17 +0000 (11:47 +0000)
committerAndy Polyakov <appro@openssl.org>
Sat, 2 Oct 2010 11:47:17 +0000 (11:47 +0000)
update commentary...

Configure
TABLE
crypto/bn/Makefile
crypto/bn/asm/mips-mont.pl
crypto/bn/asm/mips.pl
crypto/sha/Makefile
crypto/sha/asm/sha512-mips.pl [new file with mode: 0644]

index 03ddc6a..57a7b1c 100755 (executable)
--- a/Configure
+++ b/Configure
@@ -132,7 +132,8 @@ my $ia64_asm="ia64cpuid.o:bn-ia64.o ia64-mont.o::aes_core.o aes_cbc.o aes-ia64.o
 my $sparcv9_asm="sparcv9cap.o sparccpuid.o:bn-sparcv9.o sparcv9-mont.o sparcv9a-mont.o:des_enc-sparc.o fcrypt_b.o:aes_core.o aes_cbc.o aes-sparcv9.o:::sha1-sparcv9.o sha256-sparcv9.o sha512-sparcv9.o:::::::ghash-sparcv9.o:void";
 my $sparcv8_asm=":sparcv8.o:des_enc-sparc.o fcrypt_b.o::::::::::::void";
 my $alpha_asm="alphacpuid.o:bn_asm.o alpha-mont.o:::::sha1-alpha.o:::::::ghash-alpha.o:void";
-my $mips3_asm=":bn-mips3.o:::::::::::::void";
+my $mips32_asm=":bn-mips.o:::::sha1-mips.o sha256-mips.o:::::::";
+my $mips64_asm=":bn-mips.o mips-mont.o:::::sha1-mips.o sha256-mips.o sha512-mips.o:::::::";
 my $s390x_asm="s390xcap.o s390xcpuid.o:bn-s390x.o s390x-mont.o::aes_ctr.o aes-s390x.o:::sha1-s390x.o sha256-s390x.o sha512-s390x.o::rc4-s390x.o:::::ghash-s390x.o:void";
 my $armv4_asm=":bn_asm.o armv4-mont.o::aes_cbc.o aes-armv4.o:::sha1-armv4-large.o sha256-armv4.o sha512-armv4.o:::::::ghash-armv4.o:void";
 my $parisc11_asm="pariscid.o:bn_asm.o parisc-mont.o::aes_core.o aes_cbc.o aes-parisc.o:::sha1-parisc.o sha256-parisc.o sha512-parisc.o::rc4-parisc.o:::::ghash-parisc.o:32";
@@ -250,16 +251,16 @@ my %table=(
 
 #### IRIX 5.x configs
 # -mips2 flag is added by ./config when appropriate.
-"irix-gcc","gcc:-O3 -DTERMIOS -DB_ENDIAN::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK DES_UNROLL DES_RISC2 DES_PTR BF_PTR:${no_asm}:dlfcn:irix-shared:::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"irix-cc", "cc:-O2 -use_readonly_const -DTERMIOS -DB_ENDIAN::(unknown):::BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC2 DES_UNROLL BF_PTR:${no_asm}:dlfcn:irix-shared:::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"irix-gcc","gcc:-O3 -DTERMIOS -DB_ENDIAN::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK DES_UNROLL DES_RISC2 DES_PTR BF_PTR:${mips32_asm}:o32:dlfcn:irix-shared:::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"irix-cc", "cc:-O2 -use_readonly_const -DTERMIOS -DB_ENDIAN::(unknown):::BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC2 DES_UNROLL BF_PTR:${mips32_asm}:o32:dlfcn:irix-shared:::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 #### IRIX 6.x configs
 # Only N32 and N64 ABIs are supported. If you need O32 ABI build, invoke
 # './Configure irix-cc -o32' manually.
-"irix-mips3-gcc","gcc:-mabi=n32 -O3 -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK_LL DES_UNROLL DES_RISC2 DES_PTR BF_PTR SIXTY_FOUR_BIT:${mips3_asm}:dlfcn:irix-shared::-mabi=n32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::32",
-"irix-mips3-cc", "cc:-n32 -mips3 -O2 -use_readonly_const -G0 -rdata_shared -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::DES_PTR RC4_CHAR RC4_CHUNK_LL DES_RISC2 DES_UNROLL BF_PTR SIXTY_FOUR_BIT:${mips3_asm}:dlfcn:irix-shared::-n32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::32",
+"irix-mips3-gcc","gcc:-mabi=n32 -O3 -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK_LL DES_UNROLL DES_RISC2 DES_PTR BF_PTR SIXTY_FOUR_BIT:${mips64_asm}:n32:dlfcn:irix-shared::-mabi=n32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::32",
+"irix-mips3-cc", "cc:-n32 -mips3 -O2 -use_readonly_const -G0 -rdata_shared -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::DES_PTR RC4_CHAR RC4_CHUNK_LL DES_RISC2 DES_UNROLL BF_PTR SIXTY_FOUR_BIT:${mips64_asm}:n32:dlfcn:irix-shared::-n32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::32",
 # N64 ABI builds.
-"irix64-mips4-gcc","gcc:-mabi=64 -mips4 -O3 -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG:${mips3_asm}:dlfcn:irix-shared::-mabi=64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
-"irix64-mips4-cc", "cc:-64 -mips4 -O2 -use_readonly_const -G0 -rdata_shared -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG:${mips3_asm}:dlfcn:irix-shared::-64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
+"irix64-mips4-gcc","gcc:-mabi=64 -mips4 -O3 -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG:${mips64_asm}:64:dlfcn:irix-shared::-mabi=64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
+"irix64-mips4-cc", "cc:-64 -mips4 -O2 -use_readonly_const -G0 -rdata_shared -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG:${mips64_asm}:64:dlfcn:irix-shared::-64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
 
 #### Unified HP-UX ANSI C configs.
 # Special notes:
diff --git a/TABLE b/TABLE
index 57d67f0..753011e 100644 (file)
--- a/TABLE
+++ b/TABLE
@@ -3209,12 +3209,12 @@ $sys_id       =
 $lflags       = 
 $bn_ops       = BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC2 DES_UNROLL BF_PTR
 $cpuid_obj    = 
-$bn_obj       = 
+$bn_obj       = bn-mips.o
 $des_obj      = 
 $aes_obj      = 
 $bf_obj       = 
 $md5_obj      = 
-$sha1_obj     = 
+$sha1_obj     = sha1-mips.o sha256-mips.o
 $cast_obj     = 
 $rc4_obj      = 
 $rmd160_obj   = 
@@ -3222,7 +3222,7 @@ $rc5_obj      =
 $wp_obj       = 
 $cmll_obj     = 
 $modes_obj    = 
-$perlasm_scheme = void
+$perlasm_scheme = o32
 $dso_scheme   = dlfcn
 $shared_target= irix-shared
 $shared_cflag = 
@@ -3241,12 +3241,12 @@ $sys_id       =
 $lflags       = 
 $bn_ops       = BN_LLONG MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK DES_UNROLL DES_RISC2 DES_PTR BF_PTR
 $cpuid_obj    = 
-$bn_obj       = 
+$bn_obj       = bn-mips.o
 $des_obj      = 
 $aes_obj      = 
 $bf_obj       = 
 $md5_obj      = 
-$sha1_obj     = 
+$sha1_obj     = sha1-mips.o sha256-mips.o
 $cast_obj     = 
 $rc4_obj      = 
 $rmd160_obj   = 
@@ -3254,7 +3254,7 @@ $rc5_obj      =
 $wp_obj       = 
 $cmll_obj     = 
 $modes_obj    = 
-$perlasm_scheme = void
+$perlasm_scheme = o32
 $dso_scheme   = dlfcn
 $shared_target= irix-shared
 $shared_cflag = 
@@ -3273,12 +3273,12 @@ $sys_id       =
 $lflags       = 
 $bn_ops       = DES_PTR RC4_CHAR RC4_CHUNK_LL DES_RISC2 DES_UNROLL BF_PTR SIXTY_FOUR_BIT
 $cpuid_obj    = 
-$bn_obj       = bn-mips3.o
+$bn_obj       = bn-mips.o mips-mont.o
 $des_obj      = 
 $aes_obj      = 
 $bf_obj       = 
 $md5_obj      = 
-$sha1_obj     = 
+$sha1_obj     = sha1-mips.o sha256-mips.o sha512-mips.o
 $cast_obj     = 
 $rc4_obj      = 
 $rmd160_obj   = 
@@ -3286,7 +3286,7 @@ $rc5_obj      =
 $wp_obj       = 
 $cmll_obj     = 
 $modes_obj    = 
-$perlasm_scheme = void
+$perlasm_scheme = n32
 $dso_scheme   = dlfcn
 $shared_target= irix-shared
 $shared_cflag = 
@@ -3305,12 +3305,12 @@ $sys_id       =
 $lflags       = 
 $bn_ops       = MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK_LL DES_UNROLL DES_RISC2 DES_PTR BF_PTR SIXTY_FOUR_BIT
 $cpuid_obj    = 
-$bn_obj       = bn-mips3.o
+$bn_obj       = bn-mips.o mips-mont.o
 $des_obj      = 
 $aes_obj      = 
 $bf_obj       = 
 $md5_obj      = 
-$sha1_obj     = 
+$sha1_obj     = sha1-mips.o sha256-mips.o sha512-mips.o
 $cast_obj     = 
 $rc4_obj      = 
 $rmd160_obj   = 
@@ -3318,7 +3318,7 @@ $rc5_obj      =
 $wp_obj       = 
 $cmll_obj     = 
 $modes_obj    = 
-$perlasm_scheme = void
+$perlasm_scheme = n32
 $dso_scheme   = dlfcn
 $shared_target= irix-shared
 $shared_cflag = 
@@ -3337,12 +3337,12 @@ $sys_id       =
 $lflags       = 
 $bn_ops       = RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG
 $cpuid_obj    = 
-$bn_obj       = bn-mips3.o
+$bn_obj       = bn-mips.o mips-mont.o
 $des_obj      = 
 $aes_obj      = 
 $bf_obj       = 
 $md5_obj      = 
-$sha1_obj     = 
+$sha1_obj     = sha1-mips.o sha256-mips.o sha512-mips.o
 $cast_obj     = 
 $rc4_obj      = 
 $rmd160_obj   = 
@@ -3350,7 +3350,7 @@ $rc5_obj      =
 $wp_obj       = 
 $cmll_obj     = 
 $modes_obj    = 
-$perlasm_scheme = void
+$perlasm_scheme = 64
 $dso_scheme   = dlfcn
 $shared_target= irix-shared
 $shared_cflag = 
@@ -3369,12 +3369,12 @@ $sys_id       =
 $lflags       = 
 $bn_ops       = RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG
 $cpuid_obj    = 
-$bn_obj       = bn-mips3.o
+$bn_obj       = bn-mips.o mips-mont.o
 $des_obj      = 
 $aes_obj      = 
 $bf_obj       = 
 $md5_obj      = 
-$sha1_obj     = 
+$sha1_obj     = sha1-mips.o sha256-mips.o sha512-mips.o
 $cast_obj     = 
 $rc4_obj      = 
 $rmd160_obj   = 
@@ -3382,7 +3382,7 @@ $rc5_obj      =
 $wp_obj       = 
 $cmll_obj     = 
 $modes_obj    = 
-$perlasm_scheme = void
+$perlasm_scheme = 64
 $dso_scheme   = dlfcn
 $shared_target= irix-shared
 $shared_cflag = 
index 272dd48..baed3d5 100644 (file)
@@ -82,6 +82,11 @@ bn-mips3.o:  asm/mips3.s
                as -$$ABI -O -o $@ asm/mips3.s; \
        else    $(CC) -c $(CFLAGS) -o $@ asm/mips3.s; fi
 
+bn-mips.s:     asm/mips.pl
+       $(PERL) asm/mips.pl $(PERLASM_SCHEME) $@
+mips-mont.s:   asm/mips-mont.pl
+       $(PERL) asm/mips-mont.pl $(PERLASM_SCHEME) $@
+
 bn-s390x.o:    asm/s390x.S
        $(CC) $(CFLAGS) -c -o $@ asm/s390x.S
 
index e2395f4..b944a12 100644 (file)
@@ -1,19 +1,23 @@
 #!/usr/bin/env perl
 #
 # ====================================================================
-# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
 # project. The module is, however, dual licensed under OpenSSL and
 # CRYPTOGAMS licenses depending on where you obtain it. For further
 # details see http://www.openssl.org/~appro/cryptogams/.
 # ====================================================================
 
 # This module doesn't present direct interest for OpenSSL, because it
-# doesn't provide better performance for longer keys. While 512-bit
-# RSA private key operations are 40% faster, 1024-bit ones are hardly
-# faster at all, while longer key operations are slower by up to 20%.
-# It might be of interest to embedded system developers though, as
-# it's smaller than 1KB, yet offers ~3x improvement over compiler
-# generated code.
+# doesn't provide better performance for longer keys, at least not on
+# in-order-execution cores. While 512-bit RSA sign operations can be
+# 65% faster in 64-bit mode, 1024-bit ones are only 15% faster, and
+# 4096-bit ones are up to 15% slower. In 32-bit mode it varies from
+# 16% improvement for 512-bit RSA sign to -33% for 4096-bit RSA
+# verify:-( All comparisons are against bn_mul_mont-free assembler.
+# The module might be of interest to embedded system developers, as
+# the code is smaller than 1KB, yet offers >3x improvement on MIPS64
+# and 75-30% [less for longer keys] on MIPS32 over compiler-generated
+# code.
 
 ######################################################################
 # There is a number of MIPS ABI in use, O32 and N32/64 are most
@@ -126,9 +130,12 @@ $code.=<<___ if ($flavour =~ /o32/i);
 ___
 $code.=<<___;
        slt     $at,$num,4
-       beqzl   $at,bn_mul_mont_internal
+       bnez    $at,1f
        li      $t0,0
-       jr      $ra
+       slt     $at,$num,17     # on in-order CPU
+       bnezl   $at,bn_mul_mont_internal
+       nop
+1:     jr      $ra
        li      $a0,0
 .end   bn_mul_mont
 
index eb3ece5..acfd359 100644 (file)
@@ -49,6 +49,8 @@
 # key length, more for longer keys.
 
 $flavour = shift;
+while (($output=shift) && ($output!~/^\w[\w\-]*\.\w+$/)) {}
+open STDOUT,">$output";
 
 if ($flavour =~ /64|n32/i) {
        $LD="ld";
index 75a1d46..64aefda 100644 (file)
@@ -78,6 +78,10 @@ sha1-parisc.s:       asm/sha1-parisc.pl;     $(PERL) asm/sha1-parisc.pl $(PERLASM_SCHEME)
 sha256-parisc.s:asm/sha512-parisc.pl;  $(PERL) asm/sha512-parisc.pl $(PERLASM_SCHEME) $@
 sha512-parisc.s:asm/sha512-parisc.pl;  $(PERL) asm/sha512-parisc.pl $(PERLASM_SCHEME) $@
 
+sha1-mips.s:   asm/sha1-mips.pl;       $(PERL) asm/sha1-mips.pl $(PERLASM_SCHEME) $@
+sha256-mips.s: asm/sha512-mips.pl;     $(PERL) asm/sha512-mips.pl $(PERLASM_SCHEME) $@
+sha512-mips.s: asm/sha512-mips.pl;     $(PERL) asm/sha512-mips.pl $(PERLASM_SCHEME) $@
+
 # GNU make "catch all"
 sha1-%.s:      asm/sha1-%.pl;          $(PERL) $< $(PERLASM_SCHEME) $@
 sha256-%.s:    asm/sha512-%.pl;        $(PERL) $< $(PERLASM_SCHEME) $@
diff --git a/crypto/sha/asm/sha512-mips.pl b/crypto/sha/asm/sha512-mips.pl
new file mode 100644 (file)
index 0000000..41f4e7f
--- /dev/null
@@ -0,0 +1,424 @@
+#!/usr/bin/env perl
+
+# ====================================================================
+# Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# project. The module is, however, dual licensed under OpenSSL and
+# CRYPTOGAMS licenses depending on where you obtain it. For further
+# details see http://www.openssl.org/~appro/cryptogams/.
+# ====================================================================
+
+# SHA2 block procedures for MIPS.
+
+# October 2010.
+#
+# SHA256 performance improvement on MIPS R5000 CPU is ~27% over gcc-
+# generated code in o32 build and ~55% in n32/64 build. SHA512 [which
+# for now can only be compiled for MIPS64 ISA] improvement is modest
+# ~17%, but it comes for free, because it's same instruction sequence.
+# Improvement coefficients are for aligned input.
+
+######################################################################
+# There is a number of MIPS ABI in use, O32 and N32/64 are most
+# widely used. Then there is a new contender: NUBI. It appears that if
+# one picks the latter, it's possible to arrange code in ABI neutral
+# manner. Therefore let's stick to NUBI register layout:
+#
+($zero,$at,$t0,$t1,$t2)=map("\$$_",(0..2,24,25));
+($a0,$a1,$a2,$a3,$a4,$a5,$a6,$a7)=map("\$$_",(4..11));
+($s0,$s1,$s2,$s3,$s4,$s5,$s6,$s7,$s8,$s9,$s10,$s11)=map("\$$_",(12..23));
+($gp,$tp,$sp,$fp,$ra)=map("\$$_",(3,28..31));
+#
+# The return value is placed in $a0. Following coding rules facilitate
+# interoperability:
+#
+# - never ever touch $tp, "thread pointer", former $gp;
+# - copy return value to $t0, former $v0 [or to $a0 if you're adapting
+#   old code];
+# - on O32 populate $a4-$a7 with 'lw $aN,4*N($sp)' if necessary;
+#
+# For reference here is register layout for N32/64 MIPS ABIs:
+#
+# ($zero,$at,$v0,$v1)=map("\$$_",(0..3));
+# ($a0,$a1,$a2,$a3,$a4,$a5,$a6,$a7)=map("\$$_",(4..11));
+# ($t0,$t1,$t2,$t3,$t8,$t9)=map("\$$_",(12..15,24,25));
+# ($s0,$s1,$s2,$s3,$s4,$s5,$s6,$s7)=map("\$$_",(16..23));
+# ($gp,$sp,$fp,$ra)=map("\$$_",(28..31));
+#
+$flavour = shift; # supported flavours are o32,n32,64,nubi32,nubi64
+
+if ($flavour =~ /64|n32/i) {
+       $PTR_ADD="dadd";        # incidentally works even on n32
+       $PTR_SUB="dsub";        # incidentally works even on n32
+       $REG_S="sd";
+       $REG_L="ld";
+       $PTR_SLL="dsll";        # incidentally works even on n32
+       $SZREG=8;
+} else {
+       $PTR_ADD="add";
+       $PTR_SUB="sub";
+       $REG_S="sw";
+       $REG_L="lw";
+       $PTR_SLL="sll";
+       $SZREG=4;
+}
+#
+# <appro@openssl.org>
+#
+######################################################################
+
+$output=shift;
+open STDOUT,">$output";
+
+if ($output =~ /512/) {
+       $label="512";
+       $SZ=8;
+       $LD="ld";               # load from memory
+       $ST="sd";               # store to memory
+       $SLL="dsll";            # shift left logical
+       $SRL="dsrl";            # shift right logical
+       $ADDU="daddu";
+       @Sigma0=(28,34,39);
+       @Sigma1=(14,18,41);
+       @sigma0=( 7, 1, 8);     # right shift first
+       @sigma1=( 6,19,61);     # right shift first
+       $lastK=0x817;
+       $rounds=80;
+} else {
+       $label="256";
+       $SZ=4;
+       $LD="lw";               # load from memory
+       $ST="sw";               # store to memory
+       $SLL="sll";             # shift left logical
+       $SRL="srl";             # shift right logical
+       $ADDU="addu";
+       @Sigma0=( 2,13,22);
+       @Sigma1=( 6,11,25);
+       @sigma0=( 3, 7,18);     # right shift first
+       @sigma1=(10,17,19);     # right shift first
+       $lastK=0x8f2;
+       $rounds=64;
+}
+
+@V=($A,$B,$C,$D,$E,$F,$G,$H)=map("\$$_",(1,2,3,7,24,25,30,31));
+@X=map("\$$_",(8..23));
+
+$ctx=$a0;
+$inp=$a1;
+$len=$a2;      $Ktbl=$len;
+
+sub BODY_00_15 {
+my ($i,$a,$b,$c,$d,$e,$f,$g,$h)=@_;
+my ($T1,$tmp0,$tmp1,$tmp2)=(@X[4],@X[5],@X[6],@X[7]);
+
+$code.=<<___ if ($i<15);
+       ${LD}l  @X[1],`($i+1)*$SZ+$MSB`($inp)
+       ${LD}r  @X[1],`($i+1)*$SZ+$LSB`($inp)
+___
+$code.=<<___   if ($little_endian && $i<16);   # XXX no 64-bit byte swap yet
+       srl     $tmp0,@X[0],24  # byte swap($i)
+       srl     $tmp1,@X[0],8
+       andi    $tmp2,@X[0],0xFF00
+       sll     @X[0],@X[0],24
+       andi    $tmp1,0xFF00
+       sll     $tmp2,$tmp2,8
+       or      @X[0],$tmp0
+       or      $tmp1,$t2
+       or      @X[0],$tmp1
+___
+$code.=<<___;
+       $ADDU   $T1,$X[0],$h                    # $i
+       $SRL    $h,$e,@Sigma1[0]
+       xor     $tmp2,$f,$g
+       $SLL    $tmp1,$e,`$SZ*8-@Sigma1[2]`
+       and     $tmp2,$e
+       $SRL    $tmp0,$e,@Sigma1[1]
+       xor     $h,$tmp1
+       $SLL    $tmp1,$e,`$SZ*8-@Sigma1[1]`
+       xor     $h,$tmp0
+       $SRL    $tmp0,$e,@Sigma1[2]
+       xor     $h,$tmp1
+       $SLL    $tmp1,$e,`$SZ*8-@Sigma1[0]`
+       xor     $h,$tmp0
+       xor     $tmp2,$g                        # Ch(e,f,g)
+       xor     $tmp0,$tmp1,$h                  # Sigma1(e)
+
+       $SRL    $h,$a,@Sigma0[0]
+       $ADDU   $T1,$tmp2
+       $LD     $tmp2,`$i*$SZ`($Ktbl)           # K[$i]
+       $SLL    $tmp1,$a,`$SZ*8-@Sigma0[2]`
+       $ADDU   $T1,$tmp0
+       $SRL    $tmp0,$a,@Sigma0[1]
+       xor     $h,$tmp1
+       $SLL    $tmp1,$a,`$SZ*8-@Sigma0[1]`
+       xor     $h,$tmp0
+       $SRL    $tmp0,$a,@Sigma0[2]
+       xor     $h,$tmp1
+       $SLL    $tmp1,$a,`$SZ*8-@Sigma0[0]`
+       xor     $h,$tmp0
+       $ST     @X[0],`($i%16)*$SZ`($sp)
+       xor     $h,$tmp1                        # Sigma0(a)
+
+       or      $tmp0,$a,$b
+       and     $tmp1,$a,$b
+       and     $tmp0,$c
+       or      $tmp1,$tmp0                     # Maj(a,b,c)
+       $ADDU   $T1,$tmp2                       # +=K[$i]
+       $ADDU   $h,$tmp1
+
+       $ADDU   $d,$T1
+       $ADDU   $h,$T1
+___
+$code.=<<___ if ($i>=13);
+       $LD     @X[3],`(($i+3)%16)*$SZ`($sp)    # prefetch
+___
+}
+
+sub BODY_16_XX {
+my $i=@_[0];
+my ($tmp0,$tmp1,$tmp2,$tmp3)=(@X[4],@X[5],@X[6],@X[7]);
+
+$code.=<<___;
+       $SRL    $tmp2,@X[1],@sigma0[0]          # Xupdate($i)
+       $ADDU   @X[0],@X[9]                     # +=X[i+9]
+       $SLL    $tmp1,@X[1],`$SZ*8-@sigma0[2]`
+       $SRL    $tmp0,@X[1],@sigma0[1]
+       xor     $tmp2,$tmp1
+       $SLL    $tmp1,`@sigma0[2]-@sigma0[1]`
+       xor     $tmp2,$tmp0
+       $SRL    $tmp0,@X[1],@sigma0[2]
+       xor     $tmp2,$tmp1
+
+       $SRL    $tmp3,@X[14],@sigma1[0]
+       xor     $tmp2,$tmp0                     # sigma0(X[i+1])
+       $SLL    $tmp1,@X[14],`$SZ*8-@sigma1[2]`
+       $ADDU   @X[0],$tmp2
+       $SRL    $tmp0,@X[14],@sigma1[1]
+       xor     $tmp3,$tmp1
+       $SLL    $tmp1,`@sigma1[2]-@sigma1[1]`
+       xor     $tmp3,$tmp0
+       $SRL    $tmp0,@X[14],@sigma1[2]
+       xor     $tmp3,$tmp1
+
+       xor     $tmp3,$tmp0                     # sigma1(X[i+14])
+       $ADDU   @X[0],$tmp3
+
+___
+       &BODY_00_15(@_);
+}
+
+$FRAMESIZE=16*$SZ+16*$SZREG;
+$SAVED_REGS_MASK = ($flavour =~ /nubi/i) ? 0xc0fff008 : 0xc0ff0000;
+$pf = ($flavour =~ /nubi/i) ? $t0 : $t2;
+$MSB = 0;
+$LSB = ($SZ-1)&~$MSB;
+
+$code.=<<___;
+.text
+.set   noat
+.option        pic2
+
+.align 5
+.globl sha${label}_block_data_order
+.ent   sha${label}_block_data_order
+sha${label}_block_data_order:
+       .frame  $sp,$FRAMESIZE,$ra
+       .mask   $SAVED_REGS_MASK,-$SZREG
+       .set    noreorder
+___
+$code.=<<___ if ($flavour =~ /o32/i);  # o32 PIC-ification
+       .cpload $pf
+___
+$code.=<<___;
+       $PTR_SUB $sp,$FRAMESIZE
+       $REG_S  $ra,$FRAMESIZE-1*$SZREG($sp)
+       $REG_S  $fp,$FRAMESIZE-2*$SZREG($sp)
+       $REG_S  $s11,$FRAMESIZE-3*$SZREG($sp)
+       $REG_S  $s10,$FRAMESIZE-4*$SZREG($sp)
+       $REG_S  $s9,$FRAMESIZE-5*$SZREG($sp)
+       $REG_S  $s8,$FRAMESIZE-6*$SZREG($sp)
+       $REG_S  $s7,$FRAMESIZE-7*$SZREG($sp)
+       $REG_S  $s6,$FRAMESIZE-8*$SZREG($sp)
+       $REG_S  $s5,$FRAMESIZE-9*$SZREG($sp)
+       $REG_S  $s4,$FRAMESIZE-10*$SZREG($sp)
+___
+$code.=<<___ if ($flavour =~ /nubi/i); # optimize non-nubi prologue
+       $REG_S  $s3,$FRAMESIZE-11*$SZREG($sp)
+       $REG_S  $s2,$FRAMESIZE-12*$SZREG($sp)
+       $REG_S  $s1,$FRAMESIZE-13*$SZREG($sp)
+       $REG_S  $s0,$FRAMESIZE-14*$SZREG($sp)
+       $REG_S  $gp,$FRAMESIZE-15*$SZREG($sp)
+___
+$code.=<<___;
+       $PTR_SLL @X[15],$len,`log(16*$SZ)/log(2)`
+___
+$code.=<<___ if ($flavour !~ /o32/i);  # non-o32 PIC-ification
+       .cplocal        $Ktbl
+       .cpsetup        $pf,$zero,sha${label}_block_data_order
+___
+$code.=<<___;
+       .set    reorder
+       la      $Ktbl,K${label}         # PIC-ified 'load address'
+
+       $LD     $A,0*$SZ($ctx)          # load context
+       $LD     $B,1*$SZ($ctx)
+       $LD     $C,2*$SZ($ctx)
+       $LD     $D,3*$SZ($ctx)
+       $LD     $E,4*$SZ($ctx)
+       $LD     $F,5*$SZ($ctx)
+       $LD     $G,6*$SZ($ctx)
+       $LD     $H,7*$SZ($ctx)
+
+       $PTR_ADD @X[15],$inp            # pointer to the end of input
+       $REG_S  @X[15],16*$SZ($sp)
+       b       .Loop
+
+.align 5
+.Loop:
+       ${LD}l  @X[0],$MSB($inp)
+       ${LD}r  @X[0],$LSB($inp)
+___
+for ($i=0;$i<16;$i++)
+{ &BODY_00_15($i,@V); unshift(@V,pop(@V)); push(@X,shift(@X)); }
+$code.=<<___;
+       b       .L16_xx
+.align 4
+.L16_xx:
+___
+for (;$i<32;$i++)
+{ &BODY_16_XX($i,@V); unshift(@V,pop(@V)); push(@X,shift(@X)); }
+$code.=<<___;
+       and     @X[6],0xfff
+       li      @X[7],$lastK
+       $PTR_ADD $Ktbl,16*$SZ           # Ktbl+=16
+       bne     @X[6],@X[7],.L16_xx
+
+       $LD     @X[0],0*$SZ($ctx)
+       $LD     @X[1],1*$SZ($ctx)
+       $LD     @X[2],2*$SZ($ctx)
+       $LD     @X[3],3*$SZ($ctx)
+       $ADDU   $A,@X[0]
+       $LD     @X[4],4*$SZ($ctx)
+       $ADDU   $B,@X[1]
+       $LD     @X[5],5*$SZ($ctx)
+       $ADDU   $C,@X[2]
+       $LD     @X[6],6*$SZ($ctx)
+       $ADDU   $D,@X[3]
+       $LD     @X[7],7*$SZ($ctx)
+       $ADDU   $E,@X[4]
+       $ST     $A,0*$SZ($ctx)
+       $ADDU   $F,@X[5]
+       $ST     $B,1*$SZ($ctx)
+       $ADDU   $G,@X[6]
+       $ST     $C,2*$SZ($ctx)
+       $ADDU   $H,@X[7]
+       $ST     $D,3*$SZ($ctx)
+       $PTR_ADD $inp,16*$SZ
+       $ST     $E,4*$SZ($ctx)
+       $REG_L  @X[15],16*$SZ($sp)      # restore pointer to the end of input
+       $ST     $F,5*$SZ($ctx)
+       $ST     $G,6*$SZ($ctx)
+       $ST     $H,7*$SZ($ctx)
+
+       $PTR_SUB $Ktbl,`($rounds-16)*$SZ`       # rewind $Ktbl
+       bne     $inp,@X[15],.Loop
+
+       .set    noreorder
+       $REG_L  $ra,$FRAMESIZE-1*$SZREG($sp)
+       $REG_L  $fp,$FRAMESIZE-2*$SZREG($sp)
+       $REG_L  $s11,$FRAMESIZE-3*$SZREG($sp)
+       $REG_L  $s10,$FRAMESIZE-4*$SZREG($sp)
+       $REG_L  $s9,$FRAMESIZE-5*$SZREG($sp)
+       $REG_L  $s8,$FRAMESIZE-6*$SZREG($sp)
+       $REG_L  $s7,$FRAMESIZE-7*$SZREG($sp)
+       $REG_L  $s6,$FRAMESIZE-8*$SZREG($sp)
+       $REG_L  $s5,$FRAMESIZE-9*$SZREG($sp)
+       $REG_L  $s4,$FRAMESIZE-10*$SZREG($sp)
+___
+$code.=<<___ if ($flavour =~ /nubi/i);
+       $REG_L  $s3,$FRAMESIZE-11*$SZREG($sp)
+       $REG_L  $s2,$FRAMESIZE-12*$SZREG($sp)
+       $REG_L  $s1,$FRAMESIZE-13*$SZREG($sp)
+       $REG_L  $s0,$FRAMESIZE-14*$SZREG($sp)
+       $REG_L  $gp,$FRAMESIZE-15*$SZREG($sp)
+___
+$code.=<<___;
+       jr      $ra
+       $PTR_ADD $sp,$FRAMESIZE
+.end   sha${label}_block_data_order
+
+.rdata
+.align 5
+K${label}:
+___
+if ($SZ==4) {
+$code.=<<___;
+       .word   0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5
+       .word   0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5
+       .word   0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3
+       .word   0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174
+       .word   0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc
+       .word   0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da
+       .word   0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7
+       .word   0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967
+       .word   0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13
+       .word   0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85
+       .word   0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3
+       .word   0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070
+       .word   0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5
+       .word   0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3
+       .word   0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208
+       .word   0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+___
+} else {
+$code.=<<___;
+       .dword  0x428a2f98d728ae22, 0x7137449123ef65cd
+       .dword  0xb5c0fbcfec4d3b2f, 0xe9b5dba58189dbbc
+       .dword  0x3956c25bf348b538, 0x59f111f1b605d019
+       .dword  0x923f82a4af194f9b, 0xab1c5ed5da6d8118
+       .dword  0xd807aa98a3030242, 0x12835b0145706fbe
+       .dword  0x243185be4ee4b28c, 0x550c7dc3d5ffb4e2
+       .dword  0x72be5d74f27b896f, 0x80deb1fe3b1696b1
+       .dword  0x9bdc06a725c71235, 0xc19bf174cf692694
+       .dword  0xe49b69c19ef14ad2, 0xefbe4786384f25e3
+       .dword  0x0fc19dc68b8cd5b5, 0x240ca1cc77ac9c65
+       .dword  0x2de92c6f592b0275, 0x4a7484aa6ea6e483
+       .dword  0x5cb0a9dcbd41fbd4, 0x76f988da831153b5
+       .dword  0x983e5152ee66dfab, 0xa831c66d2db43210
+       .dword  0xb00327c898fb213f, 0xbf597fc7beef0ee4
+       .dword  0xc6e00bf33da88fc2, 0xd5a79147930aa725
+       .dword  0x06ca6351e003826f, 0x142929670a0e6e70
+       .dword  0x27b70a8546d22ffc, 0x2e1b21385c26c926
+       .dword  0x4d2c6dfc5ac42aed, 0x53380d139d95b3df
+       .dword  0x650a73548baf63de, 0x766a0abb3c77b2a8
+       .dword  0x81c2c92e47edaee6, 0x92722c851482353b
+       .dword  0xa2bfe8a14cf10364, 0xa81a664bbc423001
+       .dword  0xc24b8b70d0f89791, 0xc76c51a30654be30
+       .dword  0xd192e819d6ef5218, 0xd69906245565a910
+       .dword  0xf40e35855771202a, 0x106aa07032bbd1b8
+       .dword  0x19a4c116b8d2d0c8, 0x1e376c085141ab53
+       .dword  0x2748774cdf8eeb99, 0x34b0bcb5e19b48a8
+       .dword  0x391c0cb3c5c95a63, 0x4ed8aa4ae3418acb
+       .dword  0x5b9cca4f7763e373, 0x682e6ff3d6b2b8a3
+       .dword  0x748f82ee5defb2fc, 0x78a5636f43172f60
+       .dword  0x84c87814a1f0ab72, 0x8cc702081a6439ec
+       .dword  0x90befffa23631e28, 0xa4506cebde82bde9
+       .dword  0xbef9a3f7b2c67915, 0xc67178f2e372532b
+       .dword  0xca273eceea26619c, 0xd186b8c721c0c207
+       .dword  0xeada7dd6cde0eb1e, 0xf57d4f7fee6ed178
+       .dword  0x06f067aa72176fba, 0x0a637dc5a2c898a6
+       .dword  0x113f9804bef90dae, 0x1b710b35131c471b
+       .dword  0x28db77f523047d84, 0x32caab7b40c72493
+       .dword  0x3c9ebe0a15c9bebc, 0x431d67c49c100d4c
+       .dword  0x4cc5d4becb3e42b6, 0x597f299cfc657e2a
+       .dword  0x5fcb6fab3ad6faec, 0x6c44198c4a475817
+___
+}
+$code.=<<___;
+.asciiz        "SHA${label} for MIPS, CRYPTOGAMS by <appro\@openssl.org>"
+.align 5
+
+___
+
+$code =~ s/\`([^\`]*)\`/eval $1/gem;
+print $code;
+close STDOUT;