Daniel Lemire
175cd52c3b
Node.js ships two pre-generated sets of OpenSSL assembly: `asm`, which contains the AVX-512 routines, and `asm_avx2`, which does not. The set is picked in deps/openssl/openssl.gyp based on `gas_version` or `nasm_version`, but configure.py only reports `gas_version` when the compiler is not clang, because clang uses its own integrated assembler and has no GNU assembler version to report. Consequently every clang build silently falls back to the AVX-512-less `asm_avx2` set, with no warning. The result is that `ossl_vaes_vpclmulqdq_capable()` is assembled as a stub that always returns 0, so OpenSSL never selects `ossl_aes_gcm_encrypt_avx512()` and uses the older AES-NI path instead. On an Intel Xeon Gold 6548N this costs roughly 1.6x on AES-256-GCM and 1.8x on both ChaCha20-Poly1305 and RSA-2048 signing. This is not limited to custom builds: BUILDING.md documents that the official linux-x64 binaries are produced with clang, and the shipped v25.x and v26.x binaries contain the stub. Accept `llvm_version` in the condition, the way deps/openssl/openssl.gypi already does for the AVX2 set. clang's integrated assembler has handled AVX512IFMA since 3.9 and VAES / VPCLMULQDQ since 6.0; 8.0 is used as a conservative floor, well below the clang 19.1 that Node.js already requires. PR-URL: https://github.com/nodejs/node/pull/65136 Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
This has a new binding scheme in building OpenSSL-3.0.0 library with
Node.js. OpenSSL-3.0.0 uses a new build system with Perl for various
supported platforms. See openssl/Configurations/README and
openssl/Configurations/README-design.md in the OpenSSL source for
details.
In order to build OpenSSL library without Perl in the build of Node.js
for various supported platforms, platform dependent files (e.g. asm
and header files ) are pre-generated and stored into the
config/archs directory.
-
config/Makefileandconfig/generate_gypi.plMakefile has supported platform list and generates and copies platform dependent files (e.g. asm files) into arch directory with
generate_gypi.pl. Platform dependent gypi files are also created obtaining build information fromconfigdata.pmthat is generated withConfigurein the OpenSSL build system.For Windows,
Configuregeneratesmakefilethat is only available tonmakecommand.config/Makefile_VC-WIN32andconfig/Makefile_VC-WIN64Aare made by hand for the use of GNU make. Ifmakefilerules or targets are changed in the version up of OpenSSL, they should be also updated. -
gyp and gypi files (
openssl*.{gyp,gypi})openssl.gyphas two targets of openssl and openssl-cli referred fromnode.gyp. They include asm and no_asm gypi files with arch dependent gypi according to its build options and platforms. The gyp data which is common with asm and no_asm are stored inopenssl_common.gypi. -
header files (
config/*.{h,h.tmpl})bn_conf.h,dso_conf.handopensslconf.hare platform dependent in the OpenSSL sources. They are replaced withconfig/*.h.tmplfiles to include the file in the../../../config/and referred to each arch file that depends on asm and no-asm option. These headers are generated by the make targetgenerate_headers.
Supported architectures for use of ASM
Here is a list of supported architectures for use of ASM in OpenSSL.
| --dest-os | --dest-cpu | OpenSSL target arch | CI |
|---|---|---|---|
| aix | ppc64 | aix64-gcc | o |
| linux | ia32 | linux-elf | o |
| linux | x32 | linux-x32 | - |
| linux | x64 | linux-x86_64 | o |
| linux | arm | linux-armv4 | o |
| linux | arm64 | linux-aarch64 | o |
| linux | ppc64(*1) | linux-ppc64le | o |
| linux | s390 | linux32-s390x | o |
| linux | s390x | linux64-s390x | o |
| linux | riscv64 | linux64-riscv64 | - |
| mac | ia32 | darwin-i386-cc | - |
| mac | x64 | darwin64-x86-cc | o |
| win | ia32 | VC-WIN32 | - |
| win | x64 | VC-WIN64A | o |
| solaris | ia32 | solaris-x86-gcc | o |
| solaris | x64 | solaris64-x86_64-gcc | o |
| freebsd | ia32 | BSD-x86 | - |
| freebsd | x64 | BSD-x86_64 | o |
| openbsd | ia32 | BSD-x86 | - |
| openbsd | x64 | BSD-x86_64 | - |
| others | others | linux-elf | - |
(*1: This needs to be configured with the variable of node_byteorder: little)
These are listed in config/Makefile. Please refer config/opensslconf_asm.h for details.
To remove or add an architecture the templates need to be updated for which there are two:
- include_asm.h.tmpl
- include_no-asm.h.tmpl
Remove the architecture in question from these files and then run:
$ make generate-headers
Also remove the architecture from the list of supported ASM architectures in README.md
Upgrading OpenSSL
Please refer to maintaining-openssl.