Limit SHA-NI compiler flags to implementation

[dajiaohuang]

Keep runtime SHA-NI dispatch enabled while applying -msse4 -msha only to the SHA-NI implementation. Baseline objects retain their ordinary compiler flags, so enabling runtime dispatch does not require every CPU to support those instructions.

Fixes #312.

The shared-library build compiles sha_ni.c as a separate position-independent object with the SHA-NI flags. This fixes the earlier undefined SHA-NI references. The current head also fixes the reported BSD make recipe by naming sha_ni.c explicitly; the prior recipe expanded $< to an empty source argument.

Validation on Linux x86-64 / GCC 13.3:

• Reproduced all four undefined SHA-NI references at the previous PR head.
• With SHA-NI enabled: the shared CLI build, static/shared library tests, and all 26 full CLI test groups pass.
• The BSD make recipe was exercised on Linux with SHA-NI enabled; the shared build, library tests, and 26 CLI groups pass.
• With SHA-NI disabled: the same builds and tests pass.
• nm finds no unresolved SHA-NI functions in the enabled shared library. Disassembly shows no SHA-NI instructions in the baseline dispatch object and the expected instructions in the implementation objects.
• All three current PR CI checks pass.

External validation: the original reporter confirmed the FreeBSD 14.5 / Intel Atom D525 Ports build completes at this head; the complete build log is attached in the reporter's PR comment. I did not run this environment locally.

[transpetaflops]

Thank you for the patch. Trying to compile it on my Intel Atom D525 and FreeBSD 14.5 the compilation ends with the following error:

rm -f librhash.a
ar -cqs librhash.a algorithms.o byte_order.o plug_openssl.o rhash.o rhash_torrent.o aich.o blake2b.o blake2s.o blake3.o crc32.o ed2k.o edonr.o hex.o md4.o md5.o sha1.o sha_ni.o sha256.o sha512.o sha3.o ripemd-160.o gost12.o gost94.o has160.o snefru.o tiger.o tiger_sbox.o tth.o torrent.o util.o whirlpool.o whirlpool_sbox.o
--- rhash ---
cc calc_sums.o hash_print.o common_func.o hash_update.o file.o file_mask.o file_set.o find_file.o hash_check.o output.o parse_cmdline.o rhash_main.o win_utils.o librhash/librhash.so.1.4.6  -L/usr/local/lib -lintl -o rhash
ld.lld: error: undefined reference: rhash_sha1_ni_update
>>> referenced by librhash/librhash.so.1.4.6 (disallowed by --no-allow-shlib-undefined)

ld.lld: error: undefined reference: rhash_sha1_ni_final
>>> referenced by librhash/librhash.so.1.4.6 (disallowed by --no-allow-shlib-undefined)

ld.lld: error: undefined reference: rhash_sha256_ni_update
>>> referenced by librhash/librhash.so.1.4.6 (disallowed by --no-allow-shlib-undefined)

ld.lld: error: undefined reference: rhash_sha256_ni_final
>>> referenced by librhash/librhash.so.1.4.6 (disallowed by --no-allow-shlib-undefined)
cc: error: linker command failed with exit code 1 (use -v to see invocation)
*** [rhash] Error code 1

make: stopped making "all" in /usr/ports/security/rhash/work/RHash-1.4.6
make: 1 error

make: stopped making "all" in /usr/ports/security/rhash/work/RHash-1.4.6
===> Compilation failed unexpectedly.

[dajiaohuang]

Thank you for the build report. I reproduced the same four undefined SHA-NI references on Linux at the previous PR head. The shared-library recipe compiled all source files in one invocation, so the new per-object flags were never applied there.

The update compiles the shared SHA-NI implementation as a separate PIC object with its ISA flags, while leaving the other sources on baseline flags. Enabled and disabled SHA-NI configurations now pass static/shared library tests and all 26 full CLI groups on Linux/GCC 13.3. I have not run the FreeBSD 14.5 / Atom environment or BSD make; please treat that original-platform validation as outstanding.

[transpetaflops]

I have not run the FreeBSD 14.5 / Atom environment or BSD make; please treat that original-platform validation as outstanding.

No worries, that's why I'm here for :) I ran into a different error this time but have also included the complete build.log if you need it.

EDIT: Attach didn't seem to work for me so I put the build log here -> https://bpa.st/raw/S3PQ

cc -c -DOPENSSL_RUNTIME -DNDEBUG -pipe -ffunction-sections -fdata-sections -fomit-frame-pointer -DRHASH_SSE4_SHANI -Wall -W -Wstrict-prototypes -Wnested-externs -Winline -Wpointer-arith -Wbad-function-cast -Wmissing-prototypes -Wmissing-declarations -O2 -pipe -fstack-protector-strong -isystem /usr/local/include -fno-strict-aliasing -msse4 -msha sha_ni.c -o sha_ni.o
--- librhash/librhash.so.1.4.6 ---
cd librhash && /usr/bin/make lib-shared
--- librhash.so ---
test "xlibrhash.so.1" = "xlibrhash.so.1.4.6" || (  rm -f librhash.so.1 &&  ln -s librhash.so.1.4.6 librhash.so.1 )
rm -f librhash.so
ln -s librhash.so.1 librhash.so
--- sha_ni_shared.o ---
cc -c -DOPENSSL_RUNTIME -DNDEBUG -pipe -ffunction-sections -fdata-sections -fomit-frame-pointer -DRHASH_SSE4_SHANI -Wall -W -Wstrict-prototypes -Wnested-externs -Winline -Wpointer-arith -Wbad-function-cast -Wmissing-prototypes -Wmissing-declarations -O2 -pipe -fstack-protector-strong -isystem /usr/local/include -fno-strict-aliasing -fpic -msse4 -msha -DRHASH_XVERSION=0x01040600  -o sha_ni_shared.o
cc: error: no input files
*** [sha_ni_shared.o] Error code 1

make[1]: stopped making "lib-shared" in /usr/ports/security/rhash/work/RHash-1.4.6/librhash
make[1]: 1 error

And just for completeness in case you wondered, I create the FreeBSD patches by creating a diff between tag v1.4.6 and the commit in question.

git fetch origin 7ed85b96d9c2965e17ffce1022e0f530d30b8d57
git checkout 7ed85b96d9c2965e17ffce1022e0f530d30b8d57
git diff v1.4.6 7ed85b96d9c2965e17ffce1022e0f530d30b8d57 > /tmp/changes_since_1.4.6.patch

I unpack the original source, apply the patch and use FreeBSD's mechanism to produce Ports patches from it which then goes into /usr/ports/security/rhash/files. I then build the port as usual. And yes, I clean out the patches from my previous attempts first. :)

cd /usr/ports/security/rhash
make extract
cd work/RHash-1.4.6
patch </tmp/changes_since_1.4.6.patch
cd /usr/ports/security/rhash
make makepatch
make clean
make

Regards
Morgan

[dajiaohuang]

Thanks for testing the follow-up on FreeBSD and sharing the log. It exposed a BSD make difference in the new sha_ni_shared.o rule: $< was empty for that target, so the compile command omitted its source file. I changed the rule to pass sha_ni.c explicitly in commit a14f302.

The updated shared-library build, static/shared library tests, and all 26 CLI groups pass on Linux/GCC 13.3 with SHA-NI enabled. I still cannot run FreeBSD 14.5 / Atom or BSD make here. Could you retry the same Ports build against this head and let me know whether it completes?

[transpetaflops]

Could you retry the same Ports build against this head and let me know whether it completes?

a14f302 compiles with no errors. Complete build log attached for the record.
rhash-a14f302944e5a3ca3fc7bc5f47b8a211b62c424d.txt
I will update my FreeBSD bugreport and refer it to this commit. Many thanks for your help. :)
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=298879

Regards
Morgan

[dajiaohuang]

Thanks for rerunning the FreeBSD Ports build and sharing the full log. I updated the PR description to record your successful FreeBSD 14.5 / Intel Atom D525 result at this head.