[openssl-users] Build OpenSSL on SUSE Linux Enterprise Server for z Systems

[Michael Wojcik]

> From: openssl-users [mailto:openssl-users-bounces at openssl.org] On Behalf
> Of Thomas Francis, Jr.
> Sent: Friday, May 12, 2017 15:55
> 
> On 5/10/17 3:55 AM, 共通基盤ＳＳＬ［業務ＩＤ］ / COMMONSSL，GYOUMU wrote:
> >
> > I will build OpenSSL on SUSE Linux Enterprise Server for z Systems.

What version of OpenSSL?

> > But, there is not yet the machine for build, so I cannot do actual
> > machine verification.
> >
> > The CPU is not Intel architecture, is probably z/Architecture.

Yes, Linux for System z runs on z-architecture CPUs.

> > I want to know beforehand the appropriate command-line parameters for
> > executing "Configure".
> >
> > Is it right to specify "linux64-s390x" as follows?
> >
> > (1)cd /<source_root>/openssl-1.0.2k
> >
> > (2)./Configure linux64-s390x
> 
> I'd suggest just running "./config".  That will pick the appropriate
> 64-bit target.  Only use Configure if you want to do something
> non-standard. :)

That's certainly the place to start. Whether it will work is another question.

When we build OpenSSL for z Linux (RHEL and SLES), we use a modified Configure that:

* Adds -fPIC and -mbackchain. This is because we compile OpenSSL into an archive library that is then linked into a shared object, so we have to force on the shared-object flags in Configure.

* Replaces -O3 with -O1, preferring robustness (or, if you prefer, toleration for sloppiness and error) and ease of problem determination over performance.

* Replaces the asm setting[1] with ${no_asm}, for the same reason.

* For 32-bit, removes /highgprs. According to my notes, highgprs does not work correctly with some glibc versions on zLinux.

The OP probably doesn't need the first three and may well not need the last. Depending on how clever one gets with building and using OpenSSL, though, config+Configure aren't always sufficient as supplied. That's not a criticism - trying to accommodate every use case is not a good use of the OpenSSL development team's time.

But unless you're happy with the default build parameters and comfortable with your platform, be prepared to learn how the OpenSSL build works.


[1] There are two zLinux targets in the 1.0.2 Configure, for 64- and 32-bit. The linux64-s390x target uses ${s390x_asm} for its asm section, but the linux32-s90x uses an eval expression that edits $s390x_asm. We disable asm for both.


Michael Wojcik 
Distinguished Engineer, Micro Focus