deps: enable AVX-512 OpenSSL asm with clang

[lemire]

I was trying to find out which compile was better for compiling Node.js : GCC or LLVM/clang. One of my benchmark showed that GCC was massively better. After investigating, I found that it was a configuration issue that disabled part of OpenSSL under AVX-512. Note that I am using Linux.

We don't need to worry about Apple Clang because AVX-512 on Apple systems is a narrow niche.

Node.js ships two pre-generated sets of OpenSSL assembly: asm, which contains the AVX-512 routines, and asm_avx2, which does not. The set is picked in deps/openssl/openssl.gyp based on gas_version or nasm_version, but configure.py only reports gas_version when the compiler is not clang, because clang uses its own integrated assembler and has no GNU assembler version to report. Consequently every clang build silently falls back to the AVX-512-less asm_avx2 set, with no warning.

The result is that ossl_vaes_vpclmulqdq_capable() is assembled as a stub that always returns 0, so OpenSSL never selects ossl_aes_gcm_encrypt_avx512() and uses the older AES-NI path instead. On a Zen 5 machine this costs roughly 1.6x on AES-256-GCM, 1.7x on ChaCha20-Poly1305 and 1.8x on RSA-2048 signing.

Accept llvm_version in the condition, the way deps/openssl/openssl.gypi already does for the AVX2 set. clang's integrated assembler has handled AVX512IFMA since 7.0 at least and VAES / VPCLMULQDQ since 7.0 at least; 8.0 is used as a conservative floor, well below the clang that Node.js is built with today.

[nodejs-github-bot]

Review requested:

• @nodejs/gyp
• @nodejs/security-wg

[Copilot]

Pull request overview

This PR updates OpenSSL build selection logic so clang builds can use the AVX-512-capable pre-generated OpenSSL assembly set, aligning performance-sensitive crypto paths with gcc builds and avoiding silent fallback to the AVX2-only asm set.

Changes:

• Extend the deps/openssl/openssl.gyp condition that selects openssl_asm*.gypi to also accept sufficiently new llvm_version (LLVM/clang integrated assembler).
• Apply the same selection logic to both the main OpenSSL target and the FIPS module target.

Suppressed comments (1)

deps/openssl/openssl.gyp:119

• Same issue as above for the FIPS target: llvm_version can bypass the nasm_version check on Windows, but Windows still uses nasm.exe to assemble these files. This may incorrectly select the AVX-512 asm set when NASM is unavailable/too old.

        }, 'gas_version and v(gas_version) >= v("2.26") or '
           'nasm_version and v(nasm_version) >= v("2.11.8") or '
           'llvm_version and v(llvm_version) >= v("8.0")', {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lemire]

I expect that if llvm_version indicates a recent version, then nasm should be adequate to build the resulting objects. You'd have a misconfigured system otherwise.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/75647/