Skip to content

Commit d510f80

Browse files
vaintroubvaintroub
committed
MDEV-33482: Optimize WolfSSL for improved performance
- Use "new" math library WOLFSSL_SP_MATH_ALL, which is now promoted by WolfSSL for faster performance. "fastmath" we used previously is going to be deprecated, it was not really always fast. - Optimize common RSA math operations with WOLFSSL_HAVE_SP_RSA - Incorporate assembly optimizations, currently for Intel x64 only This patch significantly reduces execution time for SSL tests like main.ssl-big and main.ssl_connect, which now run 2 to 3 times faster. Notably, when this patch is applied to 11.4, server startup in with ephemeral certificates becomes approximately 10x faster due to optimized wolfSSL_EVP_PKEY_keygen(). Additionally, refactored WolfSSL by removing old workarounds and consolidating wolfssl and wolfcrypt into a single library wolfssl, just like it was done in WolfSSL's own CMake.
1 parent 8a1904d commit d510f80

File tree

4 files changed

+90
-124
lines changed

4 files changed

+90
-124
lines changed

‎cmake/os/Windows.cmake‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,14 @@ INCLUDE (CheckCSourceRuns)
2424
INCLUDE (CheckSymbolExists)
2525
INCLUDE (CheckTypeSize)
2626

27+
IF(MSVC)
28+
IF(CMAKE_CXX_COMPILER_ARCHITECTURE_ID STREQUAL ARM64)
29+
SET(MSVC_ARM64 1)
30+
SET(MSVC_INTEL 0)
31+
ELSE()
32+
SET(MSVC_INTEL 1)
33+
ENDIF()
34+
ENDIF()
2735

2836
# avoid running system checks by using pre-cached check results
2937
# system checks are expensive on VS since every tiny program is to be compiled in

‎cmake/ssl.cmake‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ MACRO (MYSQL_USE_BUNDLED_SSL)
5353
${CMAKE_SOURCE_DIR}/extra/wolfssl/wolfssl
5454
${CMAKE_SOURCE_DIR}/extra/wolfssl/wolfssl/wolfssl
5555
)
56-
SET(SSL_LIBRARIES wolfssl wolfcrypt)
56+
SET(SSL_LIBRARIES wolfssl)
5757
SET(SSL_INCLUDE_DIRS ${INC_DIRS})
5858
SET(SSL_DEFINES "-DHAVE_OPENSSL -DHAVE_WOLFSSL -DWOLFSSL_USER_SETTINGS")
5959
SET(HAVE_ERR_remove_thread_state ON CACHE INTERNAL "wolfssl doesn't have ERR_remove_thread_state")

‎extra/wolfssl/CMakeLists.txt‎

Lines changed: 72 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -1,86 +1,57 @@
1-
IF(MSVC)
1+
IF(MSVC_INTEL)
22
PROJECT(wolfssl C ASM_MASM)
33
ELSEIF(CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64|amd64")
4-
PROJECT(wolfssl C ASM)
4+
PROJECT(wolfssl C ASM)
55
ELSE()
66
PROJECT(wolfssl C)
77
ENDIF()
88

99
IF(CMAKE_SIZEOF_VOID_P MATCHES 8)
10-
IF(MSVC)
10+
IF(MSVC_INTEL AND NOT (CMAKE_C_COMPILER_ID MATCHES Clang))
1111
SET(WOLFSSL_INTELASM ON)
12-
SET(WOLFSSL_X86_64_BUILD 1)
1312
SET(HAVE_INTEL_RDSEED 1)
1413
SET(HAVE_INTEL_RDRAND 1)
15-
ELSEIF(CMAKE_ASM_COMPILER_ID MATCHES "Clang" AND CMAKE_VERSION VERSION_LESS 3.16)
16-
17-
# WolfSSL 5.5.4 bug workaround below does not work, due to some CMake bug
1814
ELSEIF(CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64|amd64")
19-
SET(WOLFSSL_X86_64_BUILD 1)
2015
IF(CMAKE_C_COMPILER_ID MATCHES GNU AND CMAKE_C_COMPILER_VERSION VERSION_LESS 4.9)
2116
MESSAGE_ONCE(NO_INTEL_ASSEMBLY "Disable Intel assembly for WolfSSL - compiler is too old")
17+
ELSEIF(WITH_MSAN)
18+
MESSAGE_ONCE(MSAN_CANT_HANDLE_IT "Disable Intel assembly for WolfSSL - MSAN can't handle it")
2219
ELSE()
23-
IF(WITH_MSAN)
24-
MESSAGE_ONCE(MSAN_CANT_HANDLE_IT
25-
"Disable Intel assembly for WolfSSL - MSAN can't handle it")
26-
ELSE()
27-
MY_CHECK_C_COMPILER_FLAG(-maes)
28-
MY_CHECK_C_COMPILER_FLAG(-msse4)
29-
MY_CHECK_C_COMPILER_FLAG(-mpclmul)
30-
IF(have_C__maes AND have_C__msse4 AND have_C__mpclmul)
31-
SET(WOLFSSL_INTELASM ON)
20+
MY_CHECK_C_COMPILER_FLAG(-maes)
21+
MY_CHECK_C_COMPILER_FLAG(-msse4)
22+
MY_CHECK_C_COMPILER_FLAG(-mpclmul)
23+
IF(have_C__maes AND have_C__msse4 AND have_C__mpclmul)
24+
SET(WOLFSSL_INTELASM ON)
25+
MY_CHECK_C_COMPILER_FLAG(-mrdrnd)
26+
MY_CHECK_C_COMPILER_FLAG(-mrdseed)
27+
IF(have_C__mrdrnd)
28+
SET(HAVE_INTEL_RDRAND ON)
29+
ENDIF()
30+
IF(have_C__mrdseed)
31+
SET(HAVE_INTEL_RDSEED ON)
3232
ENDIF()
33-
ENDIF()
34-
MY_CHECK_C_COMPILER_FLAG(-mrdrnd)
35-
MY_CHECK_C_COMPILER_FLAG(-mrdseed)
36-
IF(have_C__mrdrnd)
37-
SET(HAVE_INTEL_RDRAND ON)
38-
ENDIF()
39-
IF(have_C__mrdseed)
40-
SET(HAVE_INTEL_RDSEED ON)
4133
ENDIF()
4234
ENDIF()
4335
ENDIF()
4436
ENDIF()
4537

4638
SET(WOLFSSL_SRCDIR ${CMAKE_CURRENT_SOURCE_DIR}/wolfssl/src)
39+
SET(WOLFCRYPT_SRCDIR ${CMAKE_CURRENT_SOURCE_DIR}/wolfssl/wolfcrypt/src)
4740
ADD_DEFINITIONS(${SSL_DEFINES})
48-
49-
SET(WOLFSSL_SOURCES
50-
${WOLFSSL_SRCDIR}/crl.c
51-
${WOLFSSL_SRCDIR}/internal.c
52-
${WOLFSSL_SRCDIR}/keys.c
53-
${WOLFSSL_SRCDIR}/tls.c
54-
${WOLFSSL_SRCDIR}/wolfio.c
55-
${WOLFSSL_SRCDIR}/ocsp.c
56-
${WOLFSSL_SRCDIR}/ssl.c
57-
${WOLFSSL_SRCDIR}/tls13.c)
58-
5941
ADD_DEFINITIONS(-DWOLFSSL_LIB -DBUILDING_WOLFSSL)
60-
42+
ADD_DEFINITIONS(-DWOLFSSL_SP_4096)
6143
INCLUDE_DIRECTORIES(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}/wolfssl)
62-
IF(MSVC)
63-
# size_t to long truncation warning
64-
SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -wd4267 -wd4334 -wd4028 -wd4244")
65-
ENDIF()
66-
67-
ADD_CONVENIENCE_LIBRARY(wolfssl ${WOLFSSL_SOURCES})
68-
69-
# Workaround linker crash with older Ubuntu binutils
70-
# e.g aborting at ../../bfd/merge.c line 873 in _bfd_merged_section_offset
71-
IF(CMAKE_SYSTEM_NAME MATCHES "Linux")
72-
STRING(REPLACE "-g " "-g1 " CMAKE_C_FLAGS_RELWITHDEBINFO
73-
${CMAKE_C_FLAGS_RELWITHDEBINFO})
74-
STRING(REPLACE "-g " "-g1 " CMAKE_C_FLAGS_DEBUG
75-
${CMAKE_C_FLAGS_DEBUG})
76-
STRING(REPLACE "-ggdb3 " " " CMAKE_C_FLAGS_RELWITHDEBINFO
77-
${CMAKE_C_FLAGS_RELWITHDEBINFO})
78-
STRING(REPLACE "-ggdb3 " " " CMAKE_C_FLAGS_DEBUG
79-
${CMAKE_C_FLAGS_DEBUG})
80-
ENDIF()
44+
INCLUDE_DIRECTORIES(${SSL_INCLUDE_DIRS})
8145

82-
SET(WOLFCRYPT_SRCDIR ${CMAKE_CURRENT_SOURCE_DIR}/wolfssl/wolfcrypt/src)
83-
SET(WOLFCRYPT_SOURCES
46+
add_library(wolfssl STATIC
47+
${WOLFSSL_SRCDIR}/crl.c
48+
${WOLFSSL_SRCDIR}/internal.c
49+
${WOLFSSL_SRCDIR}/keys.c
50+
${WOLFSSL_SRCDIR}/tls.c
51+
${WOLFSSL_SRCDIR}/wolfio.c
52+
${WOLFSSL_SRCDIR}/ocsp.c
53+
${WOLFSSL_SRCDIR}/ssl.c
54+
${WOLFSSL_SRCDIR}/tls13.c
8455
${WOLFCRYPT_SRCDIR}/aes.c
8556
${WOLFCRYPT_SRCDIR}/arc4.c
8657
${WOLFCRYPT_SRCDIR}/asn.c
@@ -110,69 +81,56 @@ ${WOLFCRYPT_SRCDIR}/wc_encrypt.c
11081
${WOLFCRYPT_SRCDIR}/hash.c
11182
${WOLFCRYPT_SRCDIR}/wolfmath.c
11283
${WOLFCRYPT_SRCDIR}/kdf.c
84+
${WOLFCRYPT_SRCDIR}/sp_int.c
85+
${WOLFCRYPT_SRCDIR}/sp_c32.c
86+
${WOLFCRYPT_SRCDIR}/sp_c64.c
11387
)
11488

115-
# Use fastmath large number math library.
116-
IF(NOT (MSVC AND CMAKE_C_COMPILER_ID MATCHES Clang))
117-
# Can't use clang-cl with WOLFSSL_FASTMATH
118-
# due to https://bugs.llvm.org/show_bug.cgi?id=25305
119-
SET(WOLFSSL_FASTMATH 1)
120-
ENDIF()
121-
122-
IF(WOLFSSL_FASTMATH)
123-
SET(USE_FAST_MATH 1)
124-
SET(TFM_TIMING_RESISTANT 1)
125-
# FP_MAX_BITS is set high solely to satisfy ssl_8k_key.test
126-
# WolfSSL will use more stack space with it
127-
SET(FP_MAX_BITS 16384)
128-
SET(WOLFCRYPT_SOURCES ${WOLFCRYPT_SOURCES} ${WOLFCRYPT_SRCDIR}/tfm.c)
129-
IF((CMAKE_SIZEOF_VOID_P MATCHES 4) AND (CMAKE_SYSTEM_PROCESSOR MATCHES "86")
130-
AND (NOT MSVC))
131-
# Workaround https://github.com/wolfSSL/wolfssl/issues/4245
132-
# On 32bit Intel, to satisfy inline assembly's wish for free registers
133-
# 1. use -fomit-frame-pointer
134-
# 2. With GCC 4, additionally use -fno-PIC, which works on x86
135-
# (modern GCC has PIC optimizations, that make it unnecessary)
136-
# The following assumes GCC or Clang
137-
SET(TFM_COMPILE_FLAGS "-fomit-frame-pointer")
138-
IF(CMAKE_C_COMPILER_VERSION VERSION_LESS "5")
139-
SET(TFM_COMPILE_FLAGS "${TFM_COMPILE_FLAGS} -fno-PIC")
140-
ENDIF()
141-
SET_SOURCE_FILES_PROPERTIES(${WOLFCRYPT_SRCDIR}/tfm.c
142-
PROPERTIES COMPILE_FLAGS ${TFM_COMPILE_FLAGS})
143-
ENDIF()
144-
ELSE()
145-
SET(WOLFSSL_SP_MATH_ALL 1)
146-
SET(WOLFCRYPT_SOURCES ${WOLFCRYPT_SOURCES} ${WOLFCRYPT_SRCDIR}/sp_int.c)
147-
ENDIF()
148-
149-
IF(WOLFSSL_X86_64_BUILD)
150-
LIST(APPEND WOLFCRYPT_SOURCES ${WOLFCRYPT_SRCDIR}/cpuid.c)
151-
IF(MSVC)
152-
SET(WOLFSSL_AESNI 1)
153-
LIST(APPEND WOLFCRYPT_SOURCES
154-
${WOLFCRYPT_SRCDIR}/aes_asm.asm
155-
${WOLFCRYPT_SRCDIR}/aes_gcm_asm.asm)
156-
IF(CMAKE_C_COMPILER_ID MATCHES Clang)
157-
SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -maes -msse4.2 -mpclmul -mrdrnd -mrdseed")
158-
ENDIF()
159-
ELSEIF(WOLFSSL_INTELASM)
160-
SET(WOLFSSL_AESNI 1)
161-
SET(USE_INTEL_SPEEDUP 1)
162-
LIST(APPEND WOLFCRYPT_SOURCES
89+
# Optimizations, assembly
90+
if(WOLFSSL_INTELASM)
91+
set(WOLFSSL_X86_64_BUILD 1)
92+
set(WOLFSSL_SP_X86_64 1)
93+
set(WOLFSSL_SP_X86_64_ASM 1)
94+
set(WOLFSSL_AESNI 1)
95+
target_sources(wolfssl PRIVATE
96+
${WOLFCRYPT_SRCDIR}/cpuid.c
97+
${WOLFCRYPT_SRCDIR}/sp_x86_64.c
98+
)
99+
if(MSVC_INTEL)
100+
target_sources(wolfssl PRIVATE
101+
${WOLFCRYPT_SRCDIR}/aes_asm.asm
102+
${WOLFCRYPT_SRCDIR}/aes_gcm_asm.asm
103+
${WOLFCRYPT_SRCDIR}/sp_x86_64_asm.asm
104+
)
105+
target_compile_options(wolfssl PRIVATE
106+
$<$<COMPILE_LANG_AND_ID:C,Clang>:-maes -msse4.2 -mpclmul -mrdrnd -mrdseed>
107+
$<$<COMPILE_LANGUAGE:ASM_MASM>:/Zi>
108+
)
109+
else()
110+
set(USE_INTEL_SPEEDUP 1)
111+
target_sources(wolfssl PRIVATE
163112
${WOLFCRYPT_SRCDIR}/aes_asm.S
164113
${WOLFCRYPT_SRCDIR}/aes_gcm_asm.S
165114
${WOLFCRYPT_SRCDIR}/chacha_asm.S
166115
${WOLFCRYPT_SRCDIR}/poly1305_asm.S
167116
${WOLFCRYPT_SRCDIR}/sha512_asm.S
168-
${WOLFCRYPT_SRCDIR}/sha256_asm.S)
169-
ADD_DEFINITIONS(-maes -msse4.2 -mpclmul)
170-
# WolfSSL 5.5.4 bug - user_settings.h not included into aes_asm.S
171-
SET_PROPERTY(SOURCE ${WOLFCRYPT_SRCDIR}/aes_asm.S APPEND PROPERTY COMPILE_OPTIONS "-DWOLFSSL_X86_64_BUILD")
172-
ENDIF()
173-
ENDIF()
117+
${WOLFCRYPT_SRCDIR}/sha256_asm.S
118+
${WOLFCRYPT_SRCDIR}/sp_x86_64_asm.S
119+
)
120+
target_compile_options(wolfssl PRIVATE -maes -msse4.2 -mpclmul)
121+
# Workaround 5.5.4 bug (user_settings.h not included into aes_asm.S)
122+
set_property(SOURCE ${WOLFCRYPT_SRCDIR}/aes_asm.S APPEND PROPERTY COMPILE_OPTIONS "-DWOLFSSL_X86_64_BUILD")
123+
endif()
124+
endif()
125+
126+
# Silence some warnings
127+
if(MSVC)
128+
# truncation warnings
129+
target_compile_options(wolfssl PRIVATE $<$<COMPILE_LANGUAGE:C>:/wd4244>)
130+
if(CMAKE_C_COMPILER_ID MATCHES Clang)
131+
target_compile_options(wolfssl PRIVATE $<$<COMPILE_LANGUAGE:C>:-Wno-incompatible-function-pointer-types>)
132+
endif()
133+
endif()
174134

175135
CONFIGURE_FILE(user_settings.h.in user_settings.h)
176-
INCLUDE_DIRECTORIES(${SSL_INCLUDE_DIRS})
177-
ADD_CONVENIENCE_LIBRARY(wolfcrypt ${WOLFCRYPT_SOURCES})
178136

‎extra/wolfssl/user_settings.h.in‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
#define HAVE_AESGCM
2222
#define HAVE_CHACHA
2323
#define HAVE_POLY1305
24+
#define HAVE_THREAD_LS
2425
#define WOLFSSL_AES_COUNTER
2526
#define NO_WOLFSSL_STUB
2627
#define OPENSSL_ALL
@@ -51,20 +52,19 @@
5152
#define NO_RABBIT
5253
#define NO_RC4
5354

54-
/*
55-
FP_MAX_BITS is set high solely to satisfy ssl_8k_key.test
56-
WolfSSL will use more stack space with it, with fastmath
57-
*/
58-
#cmakedefine FP_MAX_BITS 16384
5955
#define RSA_MAX_SIZE 8192
56+
#define WOLFSSL_SP_MATH_ALL
57+
#define WOLFSSL_HAVE_SP_RSA
58+
#ifndef WOLFSSL_SP_4096
59+
#define WOLFSSL_SP_4096
60+
#endif
61+
6062
#cmakedefine WOLFSSL_AESNI
61-
#cmakedefine USE_FAST_MATH
62-
#cmakedefine TFM_TIMING_RESISTANT
6363
#cmakedefine HAVE_INTEL_RDSEED
6464
#cmakedefine HAVE_INTEL_RDRAND
6565
#cmakedefine USE_INTEL_SPEEDUP
66-
#cmakedefine USE_FAST_MATH
6766
#cmakedefine WOLFSSL_X86_64_BUILD
68-
#cmakedefine WOLFSSL_SP_MATH_ALL
67+
#cmakedefine WOLFSSL_SP_X86_64
68+
#cmakedefine WOLFSSL_SP_X86_64_ASM
6969

7070
#endif /* WOLFSSL_USER_SETTINGS_H */

0 commit comments

Comments
 (0)