Date: Wed, 01 Dec 2010 10:16:39 -0800 From: Chuck Swiger <cswiger@mac.com> To: Devin Teske <dteske@vicor.com> Cc: FreeBSD-Questions@freebsd.org Subject: Re: OpenSSL Optimizations Message-ID: <B0E98D45-EFC6-4D4A-B952-2014A0684E4E@mac.com> In-Reply-To: <1291168126.17868.47.camel@localhost.localdomain> References: <1291159176.17868.23.camel@localhost.localdomain> <46F19FD7-5666-4CD2-81DE-5CD8C82799E3@mac.com> <1291168126.17868.47.camel@localhost.localdomain>
next in thread | previous in thread | raw e-mail | index | archive | help
On Nov 30, 2010, at 5:48 PM, Devin Teske wrote:
> On Tue, 2010-11-30 at 16:00 -0800, Chuck Swiger wrote:
>> On Nov 30, 2010, at 3:19 PM, Devin Teske wrote:
>>> I'm trying to determine what -- if any -- compiler optimizations are
>>> applied to crytpo libs/engines in FreeBSD, and the following output is
>>> not very helpful:
>>
>> The default compiler flags are:
>>
>> cc -O2 -fno-strict-aliasing
>
> That's not the type of optimizations I was referring to.
Well, I can only respond to what you've written. :-)
> Rather, I was referring to OpenSSL specific optimizations such as the *_ASM compile-
> time directives et cetera.
>
> When pitting the following (built from source via openssl.org):
>
> OpenSSL 0.9.8k 25 Mar 2009
> built on: Tue Sep 1 07:48:40 PDT 2009
> platform: BSD-x86-elf
> options: bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) idea(int) blowfish(idx)
> compiler: gcc -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -pthread -D_THREAD_SAFE -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -Wall -DOPENSSL_BN_ASM_PART_WORDS -DSHA1_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM
> OPENSSLDIR: "/etc/ssl"
>
> against the default (provided by FreeBSD):
>
> OpenSSL 0.9.8k 25 Mar 2009
> built on: date not available
> platform: FreeBSD-i386
> options: bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) blowfish(idx)
> compiler: cc
> OPENSSLDIR: "/etc/ssl"
>
> The baseline FreeBSD version (which reports only "cc") is _faster_ than
> the same exact version of OpenSSL taken from OpenSSL.org compiled with
> optimizations.
>
> I can't possibly believe that the FreeBSD baseline version is _not_
> optimized given empirical testing. I also doubt that `-O2' and `-fno-
> strict-aliasing' are the only optimization flags used (and I can prove
> that this is not the case).
Well, I did a "nohup make buildworld" using 7-STABLE sources and grep'ed for obvious strings, and I see:
[ ... ]
cc -O2 -fno-strict-aliasing -pipe -DTERMIOS -DANSI_SOURCE -I/usr/src/secure/usr.bin/openssl/../../../crypto/openssl -I/usr/src/secure/usr.bin/openssl/../../../crypto/openssl/crypto -I/usr/obj/usr/src/secure/usr.bin/openssl -DOPENSSL_THREADS -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_IDEA -DL_ENDIAN -DMONOLITH -I/usr/src/secure/usr.bin/openssl -DNO_IDEA -c /usr/src/secure/usr.bin/openssl/../../../crypto/openssl/apps/x509.c
cc -O2 -fno-strict-aliasing -pipe -DTERMIOS -DANSI_SOURCE -I/usr/src/secure/usr.bin/openssl/../../../crypto/openssl -I/usr/src/secure/usr.bin/openssl/../../../crypto/openssl/crypto -I/usr/obj/usr/src/secure/usr.bin/openssl -DOPENSSL_THREADS -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_IDEA -DL_ENDIAN -DMONOLITH -I/usr/src/secure/usr.bin/openssl -DNO_IDEA -o openssl app_rand.o apps.o asn1pars.o ca.o ciphers.o cms.o crl.o crl2p7.o dgst.o dh.o dhparam.o dsa.o dsaparam.o ec.o ecparam.o enc.o engine.o errstr.o gendh.o gendsa.o genrsa.o nseq.o ocsp.o openssl.o passwd.o pkcs12.o pkcs7.o pkcs8.o prime.o rand.o req.o rsa.o rsautl.o s_cb.o s_client.o s_server.o s_socket.o s_time.o sess_id.o smime.o speed.o spkac.o verify.o version.o x509.o -lssl -lcrypto
I also grep'ed for the "_ASM" strings you seem to be interested in, and libmd is built with:
mkdep -f .depend -a -I/usr/src/lib/libmd -DSHA1_ASM -DELF -DRMD160_ASM -DELF /usr/src/lib/libmd/md2c.c /usr/src/lib/libmd/md4c.c /usr/src/lib/libmd/md5c.c md2hl.c md4hl.c md5hl.c /usr/src/lib/libmd/rmd160c.c rmd160hl.c /usr/src/lib/libmd/sha0c.c sha0hl.c /usr/src/lib/libmd/sha1c.c sha1hl.c /usr/src/lib/libmd/sha256c.c sha256hl.c /usr/src/lib/libmd/i386/sha.S /usr/src/lib/libmd/i386/rmd160.S
cc -O2 -fno-strict-aliasing -pipe -I/usr/src/lib/libmd -DSHA1_ASM -DELF -DRMD160_ASM -DELF -c /usr/src/lib/libmd/md2c.c
> [ ... ]
> I'm seriously considering the following patch:
>
> --- Makefile.inc.orig Wed Aug 7 09:31:48 2002
> +++ Makefile.inc Tue Nov 30 17:45:53 2010
> @@ -39,7 +39,7 @@ CLEANDIRS+= openssl
> buildinf.h:
> ( echo "#ifndef MK1MF_BUILD"; \
> echo " /* auto-generated by crypto/Makefile.ssl for crypto/cversion.c */"; \
> - echo " #define CFLAGS \"$(CC)\""; \
> + echo " #define CFLAGS \"$(CC) $(CFLAGS)\""; \
> echo " #define PLATFORM \"`uname -s`-`uname -m`\""; \
> echo " #define DATE \"`LC_ALL=C date`\""; \
> echo "#endif" ) > ${.TARGET}
>
> Although, there surely must be a reason as to why this hasn't been done in the past, No?
That seems like a good idea. The version of openssl from ports includes the compiler flags:
# /usr/local/bin/openssl version -a
OpenSSL 1.0.0b 16 Nov 2010
built on: Wed Nov 17 15:13:42 EST 2010
platform: BSD-x86-elf
options: bn(64,32) md2(int) rc4(4x,int) des(ptr,risc1,16,long) idea(int) blowfish(idx)
compiler: cc -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -Wall -O2 -fno-strict-aliasing -pipe -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM
OPENSSLDIR: "/usr/local/openssl"
Regards,
--
-Chuck
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?B0E98D45-EFC6-4D4A-B952-2014A0684E4E>