Skip to content

deps: enable OpenSSL asm support for riscv64#62606

Open
JamieMagee wants to merge 1 commit intonodejs:mainfrom
JamieMagee:riscv64-openssl-asm
Open

deps: enable OpenSSL asm support for riscv64#62606
JamieMagee wants to merge 1 commit intonodejs:mainfrom
JamieMagee:riscv64-openssl-asm

Conversation

@JamieMagee
Copy link
Copy Markdown
Contributor

@JamieMagee JamieMagee commented Apr 5, 2026

When riscv64 was added to the OpenSSL config in 2021 (#40063), OpenSSL had no RISC-V assembly at all, so it went into NO_ASM_ARCHS. OpenSSL 3.5.x now has perlasm generators for AES, SHA-256/512, GHASH/GCM, ChaCha, SM3, SM4, and CPUID. All with runtime extension detection via riscvcap.c and the Linux hwprobe syscall, so there's no risk on hardware without the crypto extensions.

This moves linux64-riscv64 from NO_ASM_ARCHS to ASM_ARCHS in deps/openssl/config/Makefile, regenerates the config (adding asm/ and asm_avx2/ variants with 16 generated assembly files each), and adds riscv64 entries to the six gypi selector files.

Generated with nix shell nixpkgs#nasm -c make linux64-riscv64 in deps/openssl/config/.

Refs: nodejs/build#4099

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

nodejs-github-bot commented Apr 5, 2026

Review requested:

  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added dependencies Pull requests that update a dependency file. needs-ci PRs that need a full CI run. openssl Issues and PRs related to the OpenSSL dependency. labels Apr 5, 2026
@JamieMagee JamieMagee mentioned this pull request Apr 5, 2026
Open
10 tasks
@sxa
Copy link
Copy Markdown
Member

sxa commented Apr 9, 2026

Have just spent a lot of today trying to unbreak my cross-compile environment but it's now working again. Will do some tests with this (natively and with the cross-compile) and see how it goes but this will be great if we can enable the assembly stuff now.

@kxxt
Copy link
Copy Markdown
Member

kxxt commented Apr 10, 2026

I encountered a strange OpenSSL compilation problem where it appears that the build system incorrectly fall-backs to x86_64 asm for a native riscv64 build: https://github.com/riscv-forks/node-riscv/actions/runs/24225505014/job/70735319923

I will give this PR a try in my new experimental CI system for riscv64: riscv-forks/node-riscv#1

@sxa
Copy link
Copy Markdown
Member

sxa commented Apr 10, 2026

I encountered a strange OpenSSL compilation problem where it appears that the build system incorrectly fall-backs to x86_64 asm for a native riscv64 build: https://github.com/riscv-forks/node-riscv/actions/runs/24225505014/job/70735319923

I will give this PR a try in my new experimental CI system for riscv64: riscv-forks/node-riscv#1

FYI I initially hit that as well when I hadn't included the --dest-cpu=riscv64 in the configure command when cross compiling (I typically run with CC and CXX set to clang with the appropriate --target and -march flags)

@kxxt
Copy link
Copy Markdown
Member

kxxt commented Apr 10, 2026

I encountered a strange OpenSSL compilation problem where it appears that the build system incorrectly fall-backs to x86_64 asm for a native riscv64 build: https://github.com/riscv-forks/node-riscv/actions/runs/24225505014/job/70735319923
I will give this PR a try in my new experimental CI system for riscv64: riscv-forks/node-riscv#1

FYI I initially hit that as well when I hadn't included the --dest-cpu=riscv64 in the configure command when cross compiling (I typically run with CC and CXX set to clang with the appropriate --target and -march flags)

Yeah, that might be expected in a cross-compilation setup. But I find it surprising because I am compiling natively on riscv64.

@panva
Copy link
Copy Markdown
Member

panva commented Apr 10, 2026

note: #62629 just landed with OpenSSL update to 3.5.6

@sxa
Copy link
Copy Markdown
Member

sxa commented Apr 10, 2026

Yeah, that might be expected in a cross-compilation setup. But I find it surprising because I am compiling natively on riscv64.

Interesting - my native build (clang21 with -march=rv64gc) seemed to go ok from this branch.

@JamieMagee JamieMagee force-pushed the riscv64-openssl-asm branch from 428839b to 3359202 Compare April 10, 2026 18:19
@JamieMagee
Copy link
Copy Markdown
Contributor Author

JamieMagee commented Apr 10, 2026

note: #62629 just landed with OpenSSL update to 3.5.6

Rebased on top of main and regenerated the riscv64 configs for 3.5.6.

@JamieMagee JamieMagee force-pushed the riscv64-openssl-asm branch from 3359202 to 9ad173a Compare April 21, 2026 06:18
kxxt
kxxt reviewed Apr 21, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@kxxt kxxt left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you also update the GN build recipe to add linux64-riscv64 ?

node/deps/openssl/unofficial.gni

Lines 105 to 115 in a6e8368

} else if (is_linux) {
if (current_cpu == "x86") {
config_path_name = "linux-elf"
} else if (current_cpu == "x64") {
config_path_name = "linux-x86_64"
} else if (current_cpu == "arm") {
config_path_name = "linux-armv4"
} else if (current_cpu == "arm64") {
config_path_name = "linux-aarch64"
}
} else if (is_apple) {

I am preparing patches to enable GN built Node.js for riscv64 and this would be necessary.

@JamieMagee JamieMagee force-pushed the riscv64-openssl-asm branch from 9ad173a to 5ea800d Compare April 21, 2026 15:29
@JamieMagee
Copy link
Copy Markdown
Contributor Author

JamieMagee commented Apr 21, 2026

@kxxt Done, added linux64-riscv64 to unofficial.gni. Thanks for the heads up.

@JamieMagee JamieMagee requested a review from kxxt April 21, 2026 15:31
kxxt
kxxt reviewed Apr 22, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@kxxt kxxt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we also need to update the following files?

node/deps/openssl/config/include_asm.h.tmpl

Lines 6 to 44 in 7e5e60b

#if defined(OPENSSL_LINUX) && defined(__i386__)
# include "./archs/linux-elf/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(OPENSSL_LINUX) && defined(__ILP32__)
# include "./archs/linux-x32/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(OPENSSL_LINUX) && defined(__x86_64__)
# include "./archs/linux-x86_64/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(OPENSSL_LINUX) && defined(__arm__)
# include "./archs/linux-armv4/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(OPENSSL_LINUX) && defined(__aarch64__)
# include "./archs/linux-aarch64/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(__APPLE__) && defined(__MACH__) && defined(__i386__)
# include "./archs/darwin-i386-cc/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(__APPLE__) && defined(__MACH__) && defined(__x86_64__)
# include "./archs/darwin64-x86_64-cc/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(__APPLE__) && defined(__MACH__) && defined(__arm64__)
# include "./archs/darwin64-arm64-cc/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(_WIN32) && defined(_M_IX86)
# include "./archs/VC-WIN32/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(_WIN32) && defined(_M_X64)
# include "./archs/VC-WIN64A/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif (defined(__FreeBSD__) || defined(__OpenBSD__)) && defined(__i386__)
# include "./archs/BSD-x86/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif (defined(__FreeBSD__) || defined(__OpenBSD__)) && defined(__x86_64__)
# include "./archs/BSD-x86_64/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(__sun) && defined(__i386__)
# include "./archs/solaris-x86-gcc/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(__sun) && defined(__x86_64__)
# include "./archs/solaris64-x86_64-gcc/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(OPENSSL_LINUX) && defined(__PPC64__) && defined(L_ENDIAN)
# include "./archs/linux-ppc64le/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(_AIX) && defined(_ARCH_PPC64)
# include "./archs/aix64-gcc-as/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(OPENSSL_LINUX) && defined(__s390x__)
# include "./archs/linux64-s390x/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(OPENSSL_LINUX) && defined(__s390__)
# include "./archs/linux32-s390x/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#else
# include "./archs/linux-elf/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#endif

node/deps/openssl/config/include_no-asm.h.tmpl

Lines 6 to 18 in 7e5e60b

#if defined(OPENSSL_LINUX) && defined(__i386__)
# include "./archs/linux-elf/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(OPENSSL_LINUX) && defined(__ILP32__)
# include "./archs/linux-x32/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(OPENSSL_LINUX) && defined(__x86_64__)
# include "./archs/linux-x86_64/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(OPENSSL_LINUX) && defined(__arm__)
# include "./archs/linux-armv4/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(OPENSSL_LINUX) && defined(__aarch64__)
# include "./archs/linux-aarch64/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(OPENSSL_LINUX) && defined(__loongarch64)
# include "./archs/linux64-loongarch64/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
#elif defined(__APPLE__) && defined(__MACH__) && defined(__i386__)

Comment thread deps/openssl/config/Makefile
Comment thread deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm Outdated
sxa
sxa reviewed Apr 22, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@sxa sxa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmmm I've built with this and if I've tested correctly it doesn't seem to show an improvement on the https tests (run without autocannon). I'd have hoped it would improve that a bit (as it does on x64).
I might also try and compare with a version using the system openssl on my boards to see if that shows any difference but do you have any tests where the results are noticeable?

@JamieMagee
deps: enable OpenSSL asm support for riscv64
77a251a 
Move linux64-riscv64 from NO_ASM_ARCHS to ASM_ARCHS in the OpenSSL
config Makefile and regenerate the configuration. This adds asm/ and
asm_avx2/ config variants alongside the existing no-asm/ variant.

When riscv64 was first added to the OpenSSL config in 2021 (nodejs#40063),
OpenSSL had no RISC-V assembly support. OpenSSL 3.5.x now ships 17
perlasm generators covering AES (zvkned, zvkb, zkn), SHA-256/512
(zvknha, zvknhb), GHASH/GCM (zvkg, zvbc), ChaCha (v, zbb), SM3
(zvksh), SM4 (zvksed), and CPUID detection. Runtime capability
detection via riscvcap.c and the Linux hwprobe syscall ensures safe
fallback to generic C code on hardware without these extensions.

Also add riscv64 entries to the six asm gypi selector files:
openssl_asm.gypi, openssl_asm_avx2.gypi, openssl-cl_asm.gypi,
openssl-cl_asm_avx2.gypi, openssl-fips_asm.gypi, and
openssl-fips_asm_avx2.gypi.

Refs: nodejs/build#4099
Signed-off-by: Jamie Magee <jamie.magee@gmail.com>
@JamieMagee JamieMagee force-pushed the riscv64-openssl-asm branch from 5ea800d to 77a251a Compare April 22, 2026 18:34
@JamieMagee
Copy link
Copy Markdown
Contributor Author

JamieMagee commented Apr 22, 2026

Do we also need to update the following files?

@kxxt Yes, they did need updating. Added __riscv && __riscv_xlen == 64 to both templates, then regenerated the headers with make gen-openssl.

Hmmm I've built with this and if I've tested correctly it doesn't seem to show an improvement on the https tests (run without autocannon). I'd have hoped it would improve that a bit (as it does on x64). I might also try and compare with a version using the system openssl on my boards to see if that shows any difference but do you have any tests where the results are noticeable?

@sxa The asm codepaths for riscv64 in OpenSSL 3.5 are mostly scalar optimizations and AES/SHA intrinsics. The gains are probably more modest than x86 where you get AVX/AES-NI. If you're seeing no difference on HTTPS benchmarks specifically, it might be worth checking openssl speed aes-256-gcm sha256 with and without the asm build to isolate whether the crypto layer itself is faster, separate from the HTTP overhead.

@JamieMagee JamieMagee requested review from kxxt, richardlau and sxa April 22, 2026 18:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kxxt kxxt Awaiting requested review from kxxt

@sxa sxa Awaiting requested review from sxa

@richardlau richardlau Awaiting requested review from richardlau

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file. needs-ci PRs that need a full CI run. openssl Issues and PRs related to the OpenSSL dependency.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@JamieMagee @nodejs-github-bot @sxa @kxxt @panva @richardlau