From owner-freebsd-questions@FreeBSD.ORG Wed Dec 1 18:16:59 2010 Return-Path: Delivered-To: FreeBSD-Questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 899711065696 for ; Wed, 1 Dec 2010 18:16:59 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from asmtpout030.mac.com (asmtpout030.mac.com [17.148.16.105]) by mx1.freebsd.org (Postfix) with ESMTP id 6E5928FC0C for ; Wed, 1 Dec 2010 18:16:59 +0000 (UTC) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; charset=us-ascii Received: from cswiger1.apple.com ([17.209.4.71]) by asmtp030.mac.com (Sun Java(tm) System Messaging Server 6.3-8.01 (built Dec 16 2008; 32bit)) with ESMTPSA id <0LCR0019UHFRTRA0@asmtp030.mac.com> for FreeBSD-Questions@freebsd.org; Wed, 01 Dec 2010 10:16:42 -0800 (PST) X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 ipscore=0 suspectscore=0 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx engine=6.0.2-1010190000 definitions=main-1012010100 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.2.15,1.0.148,0.0.0000 definitions=2010-12-01_09:2010-12-01, 2010-12-01, 1970-01-01 signatures=0 From: Chuck Swiger In-reply-to: <1291168126.17868.47.camel@localhost.localdomain> Date: Wed, 01 Dec 2010 10:16:39 -0800 Message-id: References: <1291159176.17868.23.camel@localhost.localdomain> <46F19FD7-5666-4CD2-81DE-5CD8C82799E3@mac.com> <1291168126.17868.47.camel@localhost.localdomain> To: Devin Teske X-Mailer: Apple Mail (2.1082) Cc: FreeBSD-Questions@freebsd.org Subject: Re: OpenSSL Optimizations X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Dec 2010 18:16:59 -0000 On Nov 30, 2010, at 5:48 PM, Devin Teske wrote: > On Tue, 2010-11-30 at 16:00 -0800, Chuck Swiger wrote: >> On Nov 30, 2010, at 3:19 PM, Devin Teske wrote: >>> I'm trying to determine what -- if any -- compiler optimizations are >>> applied to crytpo libs/engines in FreeBSD, and the following output is >>> not very helpful: >> >> The default compiler flags are: >> >> cc -O2 -fno-strict-aliasing > > That's not the type of optimizations I was referring to. Well, I can only respond to what you've written. :-) > Rather, I was referring to OpenSSL specific optimizations such as the *_ASM compile- > time directives et cetera. > > When pitting the following (built from source via openssl.org): > > OpenSSL 0.9.8k 25 Mar 2009 > built on: Tue Sep 1 07:48:40 PDT 2009 > platform: BSD-x86-elf > options: bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) idea(int) blowfish(idx) > compiler: gcc -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -pthread -D_THREAD_SAFE -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -Wall -DOPENSSL_BN_ASM_PART_WORDS -DSHA1_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM > OPENSSLDIR: "/etc/ssl" > > against the default (provided by FreeBSD): > > OpenSSL 0.9.8k 25 Mar 2009 > built on: date not available > platform: FreeBSD-i386 > options: bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) blowfish(idx) > compiler: cc > OPENSSLDIR: "/etc/ssl" > > The baseline FreeBSD version (which reports only "cc") is _faster_ than > the same exact version of OpenSSL taken from OpenSSL.org compiled with > optimizations. > > I can't possibly believe that the FreeBSD baseline version is _not_ > optimized given empirical testing. I also doubt that `-O2' and `-fno- > strict-aliasing' are the only optimization flags used (and I can prove > that this is not the case). Well, I did a "nohup make buildworld" using 7-STABLE sources and grep'ed for obvious strings, and I see: [ ... ] cc -O2 -fno-strict-aliasing -pipe -DTERMIOS -DANSI_SOURCE -I/usr/src/secure/usr.bin/openssl/../../../crypto/openssl -I/usr/src/secure/usr.bin/openssl/../../../crypto/openssl/crypto -I/usr/obj/usr/src/secure/usr.bin/openssl -DOPENSSL_THREADS -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_IDEA -DL_ENDIAN -DMONOLITH -I/usr/src/secure/usr.bin/openssl -DNO_IDEA -c /usr/src/secure/usr.bin/openssl/../../../crypto/openssl/apps/x509.c cc -O2 -fno-strict-aliasing -pipe -DTERMIOS -DANSI_SOURCE -I/usr/src/secure/usr.bin/openssl/../../../crypto/openssl -I/usr/src/secure/usr.bin/openssl/../../../crypto/openssl/crypto -I/usr/obj/usr/src/secure/usr.bin/openssl -DOPENSSL_THREADS -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_IDEA -DL_ENDIAN -DMONOLITH -I/usr/src/secure/usr.bin/openssl -DNO_IDEA -o openssl app_rand.o apps.o asn1pars.o ca.o ciphers.o cms.o crl.o crl2p7.o dgst.o dh.o dhparam.o dsa.o dsaparam.o ec.o ecparam.o enc.o engine.o errstr.o gendh.o gendsa.o genrsa.o nseq.o ocsp.o openssl.o passwd.o pkcs12.o pkcs7.o pkcs8.o prime.o rand.o req.o rsa.o rsautl.o s_cb.o s_client.o s_server.o s_socket.o s_time.o sess_id.o smime.o speed.o spkac.o verify.o version.o x509.o -lssl -lcrypto I also grep'ed for the "_ASM" strings you seem to be interested in, and libmd is built with: mkdep -f .depend -a -I/usr/src/lib/libmd -DSHA1_ASM -DELF -DRMD160_ASM -DELF /usr/src/lib/libmd/md2c.c /usr/src/lib/libmd/md4c.c /usr/src/lib/libmd/md5c.c md2hl.c md4hl.c md5hl.c /usr/src/lib/libmd/rmd160c.c rmd160hl.c /usr/src/lib/libmd/sha0c.c sha0hl.c /usr/src/lib/libmd/sha1c.c sha1hl.c /usr/src/lib/libmd/sha256c.c sha256hl.c /usr/src/lib/libmd/i386/sha.S /usr/src/lib/libmd/i386/rmd160.S cc -O2 -fno-strict-aliasing -pipe -I/usr/src/lib/libmd -DSHA1_ASM -DELF -DRMD160_ASM -DELF -c /usr/src/lib/libmd/md2c.c > [ ... ] > I'm seriously considering the following patch: > > --- Makefile.inc.orig Wed Aug 7 09:31:48 2002 > +++ Makefile.inc Tue Nov 30 17:45:53 2010 > @@ -39,7 +39,7 @@ CLEANDIRS+= openssl > buildinf.h: > ( echo "#ifndef MK1MF_BUILD"; \ > echo " /* auto-generated by crypto/Makefile.ssl for crypto/cversion.c */"; \ > - echo " #define CFLAGS \"$(CC)\""; \ > + echo " #define CFLAGS \"$(CC) $(CFLAGS)\""; \ > echo " #define PLATFORM \"`uname -s`-`uname -m`\""; \ > echo " #define DATE \"`LC_ALL=C date`\""; \ > echo "#endif" ) > ${.TARGET} > > Although, there surely must be a reason as to why this hasn't been done in the past, No? That seems like a good idea. The version of openssl from ports includes the compiler flags: # /usr/local/bin/openssl version -a OpenSSL 1.0.0b 16 Nov 2010 built on: Wed Nov 17 15:13:42 EST 2010 platform: BSD-x86-elf options: bn(64,32) md2(int) rc4(4x,int) des(ptr,risc1,16,long) idea(int) blowfish(idx) compiler: cc -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -Wall -O2 -fno-strict-aliasing -pipe -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM OPENSSLDIR: "/usr/local/openssl" Regards, -- -Chuck