1 NOTES FOR THE HPE NONSTOP PLATFORM 2 ============================== 3 4 Requirement details 5 ------------------- 6 7 In addition to the requirements and instructions listed 8 in [INSTALL.md](INSTALL.md), the following are required as well: 9 10 * The TNS/X platform supports hardware randomization. 11 Specify the `--with-rand-seed=rdcpu` option to the `./Configure` script. 12 This is recommended but not required. `egd` is supported at 3.0 but cannot 13 be used if FIPS is selected. 14 * The TNS/E platform does not support hardware randomization, so 15 specify the `--with-rand-seed=egd` option to the `./Configure` script. 16 17 About c99 compiler 18 ------------------ 19 20 The c99 compiler is required for building OpenSSL from source. While c11 21 may work, it has not been broadly tested. c99 is the only compiler 22 prerequisite needed to build OpenSSL 3.0 on this platform. 23 24 Threading Models 25 ---------------- 26 27 OpenSSL can be built either using the POSIX User Threads (PUT) threading model, 28 or with threading support disabled. Select the following build configuration 29 for each on the TNS/X (L-Series) platform: 30 31 * `nonstop-nsx` or default will select an unthreaded 32-bit build. 32 * `nonstop-nsx_64` selects an unthreaded 64-bit memory and file length build. 33 * `nonstop-nsx_64_klt` selects the 64-bit memory and file length KLT build. 34 * `nonstop-nsx_put` selects the PUT build. 35 * `nonstop-nsx_64_put` selects the 64-bit memory and file length PUT build. 36 37 The KLT threading model is a newly released model on NonStop. It implements 38 kernel-level threading. KLT provides much closer threading to what OpenSSL 39 uses for Linux-like threading models. KLT continues to use the pthread library 40 API. There is no supported 32-bit or Guardian builds for KLT. 41 42 The SPT threading model is no longer supported as of OpenSSL 3.2. 43 44 The PUT model is incompatible with the QUIC capability. This capability should 45 be disabled when building with PUT. 46 47 ### TNS/E Considerations 48 49 The TNS/E platform is build using the same set of builds specifying `nse` 50 instead of `nsx` in the set above. 51 52 You cannot build for TNS/E for FIPS, so you must specify the `no-fips` 53 option to `./Configure`. 54 55 TNS/E has moved to a limited support state, so fixes for this platform will not 56 be guaranteed in future. 57 58 Linking and Loading Considerations 59 ---------------------------------- 60 61 Because of how the NonStop Common Runtime Environment (CRE) works, there are 62 restrictions on how programs can link and load with OpenSSL libraries. 63 On current NonStop platforms, programs cannot both statically link OpenSSL 64 libraries and dynamically load OpenSSL shared libraries concurrently. If this 65 is done, there is a high probability of encountering a SIGSEGV condition 66 relating to `atexit()` processing when a shared library is unloaded and when 67 the program terminates. This limitation applies to all OpenSSL shared library 68 components. 69 70 A control has been added as of 3.3.x to disable calls to `atexit()` within the 71 `libcrypto` builds (specifically in `crypto/init.c`). This switch can be 72 controlled using `disable-atexit` or `enable-atexit`, and is disabled by default 73 for NonStop builds. If you need to have `atexit()` functionality, set 74 `enabled-atexit` when configuring OpenSSL to enable the `atexit()` call to 75 register `OPENSSL_cleanup()` automatically. Preferably, you can explicitly call 76 `OPENSSL_cleanup()` from your application. 77 78 Secure Memory 79 ------------- 80 81 The mechanism used by OpenSSL for secure memory is not supported on NonStop. 82 Use the `no-secure-memory` option when running `Configure`. 83 84 About Prefix and OpenSSLDir 85 --------------------------- 86 87 Because there are many potential builds that must co-exist on any given 88 NonStop node, managing the location of your build distribution is crucial. 89 Keep each destination separate and distinct. Mixing any mode described in 90 this document can cause application instability. The recommended approach 91 is to specify the OpenSSL version and threading model in your configuration 92 options, and keeping your memory and float options consistent, for example: 93 94 * For 1.1 `--prefix=/usr/local-ssl1.1 --openssldir=/usr/local-ssl1.1/ssl` 95 * For 1.1 PUT `--prefix=/usr/local-ssl1.1_put --openssldir=/usr/local-ssl1.1_put/ssl` 96 97 As of 3.0, the NonStop configurations use the multilib attribute to distinguish 98 between different models: 99 100 * For 3.0 `--prefix=/usr/local-ssl3.0 --openssldir=/usr/local-ssl3.0/ssl` 101 102 The PUT model is placed in `${prefix}/lib-put` for 32-bit models and 103 `${prefix}/lib64-put` for 64-bit models. 104 105 Use the `_RLD_LIB_PATH` environment variable in OSS to select the appropriate 106 directory containing `libcrypto.so` and `libssl.so`. In GUARDIAN, use the 107 `=_RLD_LIB_PATH` search define to locate the GUARDIAN subvolume where OpenSSL 108 is installed. 109 110 Float Considerations 111 -------------------- 112 113 OpenSSL is built using IEEE Float mode by default. If you need a different 114 IEEE mode, create a new configuration specifying `tfloat-x86-64` (for Tandem 115 Float) or `nfloat-x86-64` (for Neutral Float). 116 117 Memory Models 118 ------------- 119 120 The current OpenSSL default memory model uses the default platform address 121 model. If you need a different address model, you must specify the appropriate 122 c99 options for compile (`CFLAGS`) and linkers (`LDFLAGS`). 123 124 Cross Compiling on Windows 125 -------------------------- 126 127 To configure and compile OpenSSL, you will need to set up a Cygwin environment. 128 The Cygwin tools should include bash, make, and any other normal tools required 129 for building programs. 130 131 Your `PATH` must include the bin directory for the c99 cross-compiler, as in: 132 133 export PATH=/cygdrive/c/Program\ Files\ \(x86\)/HPE\ NonStop/L16.05/usr/bin:$PATH 134 135 This should be set before Configure is run. For the c99 cross-compiler to work 136 correctly, you also need the `COMP_ROOT` set, as in: 137 138 export COMP_ROOT="C:\Program Files (x86)\HPE NonStop\L16.05" 139 140 `COMP_ROOT` needs to be in Windows form. 141 142 An example of a `Configure` command to be run from the OpenSSL directory is: 143 144 ./Configure nonstop-nsx_64 --with-rand-seed=rdcpu 145 146 Do not forget to include any OpenSSL cross-compiling prefix and certificate 147 options when creating your libraries. 148 149 The OpenSSL test suite will not run on your workstation. In order to verify the 150 build, you will need to perform the build and test steps in OSS in your NonStop 151 server. You can also build under gcc and run the test suite for Windows but that 152 is not equivalent. 153 154 **Note:** In the event that you are attempting a FIPS-compliant cross-compile, 155 be aware that signatures may not match between builds done under OSS and under 156 cross-compiles as the compilers do not necessarily generate identical objects. 157 Anything and everything to do with FIPS is outside the scope of this document. 158 Refer to the FIPS security policy for more information. 159 160 The following build configurations have been successfully attempted at one 161 point or another. If you are successful in your cross-compile efforts, please 162 update this list: 163 164 - nonstop-nsx_64 165 - nonstop-nsx_64_put 166 167 **Note:** Cross-compile builds for TNS/E have not been attempted, but should 168 follow the same considerations as for TNS/X above. 169 170 Also see the NSDEE discussion below for more historical information. 171 172 Cross Compiling with NSDEE 173 -------------------------- 174 175 **Note:** None of these builds have been tested by the platform maintainer and 176 are supplied for historical value. Please submit a Pull Request to OpenSSL 177 should these need to be adjusted. 178 179 If you are attempting to build OpenSSL with NSDEE, you will need to specify 180 the following variables. The following set of compiler defines are required: 181 182 # COMP_ROOT must be a full path for the build system (e.g. windows) 183 COMP_ROOT=$(cygpath -w /path/to/comp_root) 184 # CC must be executable by your shell 185 CC=/path/to/c99 186 187 ### Optional Build Variables 188 189 DBGFLAG="--debug" 190 CIPHENABLES="enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-rc4" 191 192 ### Internal Known TNS/X to TNS/E Cross Compile Variables 193 194 The following definition is required if you are building on TNS/X for TNS/E 195 and have access to a TNS/E machine on your EXPAND network - with an example 196 node named `\CS3`: 197 198 SYSTEMLIBS="-L/E/cs3/usr/local/lib" 199 200 Version Procedure (VPROC) Considerations 201 ---------------------------------------- 202 203 If you require a VPROC entry for platform version identification, use the 204 following variables: 205 206 ### For Itanium 207 208 OPENSSL_VPROC_PREFIX=T0085H06 209 210 ### For x86 211 212 OPENSSL_VPROC_PREFIX=T0085L01 213 214 ### Common Definition 215 216 export OPENSSL_VPROC=${OPENSSL_VPROC_PREFIX}_$( 217 . VERSION.dat 218 if [ -n "$PRE_RELEASE_TAG" ]; then 219 PRE_RELEASE_TAG="-$PRE_RELEASE_TAG" 220 fi 221 if [ -n "$BUILD_METADATA" ]; then 222 BUILD_METADATA="+$BUILD_METADATA" 223 fi 224 echo "$MAJOR.$MINOR.$PATCH$PRE_RELEASE_TAG$BUILD_METADATA" |\ 225 sed -e 's/[-.+]/_/g' 226 ) 227 228 Example Configure Targets 229 ------------------------- 230 231 For OSS targets, the main DLL names will be `libssl.so` and `libcrypto.so`. 232 The following assumes that your PWD is set according to your installation 233 standards. 234 235 ./Configure nonstop-nsx --prefix=${PWD} \ 236 --openssldir=${PWD}/ssl no-threads \ 237 --with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS} 238 ./Configure nonstop-nsx_put --prefix=${PWD} \ 239 --openssldir=${PWD}/ssl threads "-D_REENTRANT" \ 240 --with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS} 241 ./Configure nonstop-nsx_64 --prefix=${PWD} \ 242 --openssldir=${PWD}/ssl no-threads \ 243 --with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS} 244 ./Configure nonstop-nsx_64_put --prefix=${PWD} \ 245 --openssldir=${PWD}/ssl threads "-D_REENTRANT" \ 246 --with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS} 247 248 ./Configure nonstop-nse --prefix=${PWD} \ 249 --openssldir=${PWD}/ssl no-threads \ 250 --with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS} 251 ./Configure nonstop-nse_g --prefix=${PWD} \ 252 --openssldir=${PWD}/ssl no-threads \ 253 --with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS} 254 ./Configure nonstop-nse_put --prefix=${PWD} \ 255 --openssldir=${PWD}/ssl threads "-D_REENTRANT" \ 256 --with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS} 257 ./Configure nonstop-nse_64 --prefix=${PWD} \ 258 --openssldir=${PWD}/ssl no-threads \ 259 --with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS} 260 ./Configure nonstop-nse_64_put --prefix=${PWD} \ 261 --openssldir=${PWD}/ssl threads "-D_REENTRANT" 262 --with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS} 263
Indexes created Mon Aug 03 00:25:36 UTC 2026