286635 - Performance optimizations in libssl

Status: NEW

(NSS :: Libraries, defect, P3)

Description

[Julien Pierre]

After analyzing runtime code paths with dtrace, I came up with some quick and
dirty optimizations to accelerate libssl . I will attach a set of patches for
them. Most of those patches delete code that I deemed unnecessary for
benchmarking. They would need to be cleaned up to make that code optional. They
are not currently ready for checkin by any means, but I wanted to have a record
of them.

Comment 1

[Julien Pierre]

Attachment: remove safety locks

This patch removes the creation, deletion, and use of locks on SSL sockets.
These locks aren't strictly necessary. They are mostly there to avoid crashes
for applications that share sockets between multiple threads, and for
full-duplex operation. We should have a way for an application to turn these
locks off.

Comment 2

[Julien Pierre]

Attachment: don't create RSA stepdown keys

This is a quick and dirty hack to prevent RSA stepdown key creation. The reason
it improves SSL server performance is that those stepdown keys get duplicated
on every socket if they exist in the model or listen socket. Avoiding their
creation is thus a big win. The proper fix is to resolve bug 148452 .

Comment 3

[Julien Pierre]

Attachment: don't erase the security info structure multiple times

This is a quick and dirty hack for bug 285525

Comment 4

[Julien Pierre]

Attachment: start SSL buffer at 18KB

Quick fix for bug 283763

Comment 5

[Julien Pierre]

Attachment: don't copy unused fields

These SECItems don't appear to be used in the SSL server codepath . Avoid
copying them.

Comment 6

[Julien Pierre]

Attachment: avoid some memset calls

Better fix for bug 283763

Comment 7

[Julien Pierre]

Attachment: don't copy the server cert list

It should be possible to just refer to the cert list from the model/listen
socket, with slight semantic changes, rather than copying it and destrying it
for every socket. This patch just removes the copy. It's obviously not correct,
but that was done to measure the performance win.

Comment 8

[Julien Pierre]

Attachment: refer to the server's private key from model instead of copying

This isn't really safe to do if the application gets rid of the model socket
before the connection sockets. But we should have a way to avoid the copy.
Maybe lock the model/listen socket to read-only, and refcount it.

Comment 9

[Nelson Bolyard (seldom reads bugmail)]

Some of the above ideas were implemented in NSS 3.11.
The rest of these ideas can wait for the next big performance push.

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last 7 months, so the assignee is being reset.