OpenSSL Optimizations

[Chuck Swiger]

On Nov 30, 2010, at 5:48 PM, Devin Teske wrote:
> On Tue, 2010-11-30 at 16:00 -0800, Chuck Swiger wrote:
>> On Nov 30, 2010, at 3:19 PM, Devin Teske wrote:
>>> I'm trying to determine what -- if any -- compiler optimizations are
>>> applied to crytpo libs/engines in FreeBSD, and the following output is
>>> not very helpful:
>> 
>> The default compiler flags are:
>> 
>>  cc -O2 -fno-strict-aliasing
> 
> That's not the type of optimizations I was referring to.

Well, I can only respond to what you've written.  :-)

> Rather, I was referring to OpenSSL specific optimizations such as the *_ASM compile-
> time directives et cetera.
> 
> When pitting the following (built from source via openssl.org):
> 
> OpenSSL 0.9.8k 25 Mar 2009
> built on: Tue Sep  1 07:48:40 PDT 2009
> platform: BSD-x86-elf
> options:  bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) idea(int) blowfish(idx)
> compiler: gcc -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -pthread -D_THREAD_SAFE -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -Wall -DOPENSSL_BN_ASM_PART_WORDS -DSHA1_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM
> OPENSSLDIR: "/etc/ssl"
> 
> against the default (provided by FreeBSD):
> 
> OpenSSL 0.9.8k 25 Mar 2009
> built on: date not available
> platform: FreeBSD-i386
> options:  bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) blowfish(idx)
> compiler: cc
> OPENSSLDIR: "/etc/ssl"
> 
> The baseline FreeBSD version (which reports only "cc") is _faster_ than
> the same exact version of OpenSSL taken from OpenSSL.org compiled with
> optimizations.
> 
> I can't possibly believe that the FreeBSD baseline version is _not_
> optimized given empirical testing. I also doubt that `-O2' and `-fno-
> strict-aliasing' are the only optimization flags used (and I can prove
> that this is not the case).

Well, I did a "nohup make buildworld" using 7-STABLE sources and grep'ed for obvious strings, and I see:

[ ... ]
cc -O2 -fno-strict-aliasing -pipe -DTERMIOS -DANSI_SOURCE -I/usr/src/secure/usr.bin/openssl/../../../crypto/openssl -I/usr/src/secure/usr.bin/openssl/../../../crypto/openssl/crypto -I/usr/obj/usr/src/secure/usr.bin/openssl -DOPENSSL_THREADS -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_IDEA -DL_ENDIAN -DMONOLITH -I/usr/src/secure/usr.bin/openssl -DNO_IDEA  -c /usr/src/secure/usr.bin/openssl/../../../crypto/openssl/apps/x509.c
cc -O2 -fno-strict-aliasing -pipe -DTERMIOS -DANSI_SOURCE -I/usr/src/secure/usr.bin/openssl/../../../crypto/openssl -I/usr/src/secure/usr.bin/openssl/../../../crypto/openssl/crypto -I/usr/obj/usr/src/secure/usr.bin/openssl -DOPENSSL_THREADS -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_IDEA -DL_ENDIAN -DMONOLITH -I/usr/src/secure/usr.bin/openssl -DNO_IDEA   -o openssl app_rand.o apps.o asn1pars.o ca.o ciphers.o cms.o crl.o crl2p7.o dgst.o dh.o dhparam.o dsa.o dsaparam.o ec.o ecparam.o enc.o engine.o errstr.o gendh.o gendsa.o genrsa.o nseq.o ocsp.o openssl.o passwd.o pkcs12.o pkcs7.o pkcs8.o prime.o rand.o req.o rsa.o rsautl.o s_cb.o s_client.o s_server.o s_socket.o s_time.o sess_id.o smime.o speed.o spkac.o verify.o version.o x509.o -lssl -lcrypto

I also grep'ed for the "_ASM" strings you seem to be interested in, and libmd is built with:

mkdep -f .depend -a    -I/usr/src/lib/libmd -DSHA1_ASM -DELF -DRMD160_ASM -DELF /usr/src/lib/libmd/md2c.c /usr/src/lib/libmd/md4c.c /usr/src/lib/libmd/md5c.c md2hl.c md4hl.c md5hl.c /usr/src/lib/libmd/rmd160c.c rmd160hl.c /usr/src/lib/libmd/sha0c.c sha0hl.c /usr/src/lib/libmd/sha1c.c sha1hl.c /usr/src/lib/libmd/sha256c.c sha256hl.c /usr/src/lib/libmd/i386/sha.S /usr/src/lib/libmd/i386/rmd160.S
cc -O2 -fno-strict-aliasing -pipe -I/usr/src/lib/libmd -DSHA1_ASM -DELF -DRMD160_ASM -DELF  -c /usr/src/lib/libmd/md2c.c

> [ ... ]
> I'm seriously considering the following patch:
> 
> --- Makefile.inc.orig   Wed Aug  7 09:31:48 2002
> +++ Makefile.inc        Tue Nov 30 17:45:53 2010
> @@ -39,7 +39,7 @@ CLEANDIRS+=   openssl
> buildinf.h:
> 	( echo "#ifndef MK1MF_BUILD"; \
> 	echo "  /* auto-generated by crypto/Makefile.ssl for crypto/cversion.c */"; \
> -	echo "  #define CFLAGS \"$(CC)\""; \
> +	echo "  #define CFLAGS \"$(CC) $(CFLAGS)\""; \
> 	echo "  #define PLATFORM \"`uname -s`-`uname -m`\""; \
> 	echo "  #define DATE \"`LC_ALL=C date`\""; \
> 	echo "#endif" ) > ${.TARGET}
> 
> Although, there surely must be a reason as to why this hasn't been done in the past, No?

That seems like a good idea.  The version of openssl from ports includes the compiler flags:

# /usr/local/bin/openssl version -a
OpenSSL 1.0.0b 16 Nov 2010
built on: Wed Nov 17 15:13:42 EST 2010
platform: BSD-x86-elf
options:  bn(64,32) md2(int) rc4(4x,int) des(ptr,risc1,16,long) idea(int) blowfish(idx) 
compiler: cc -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -Wall -O2 -fno-strict-aliasing -pipe -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_BN_ASM_MONT -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM
OPENSSLDIR: "/usr/local/openssl"

Regards,
-- 
-Chuck