Support for Intel SHA extensions

[kholia]

References,

• https://software.intel.com/en-us/articles/intel-sha-extensions-implementations (has sample code)

• https://en.wikipedia.org/wiki/Intel_SHA_extensions

It seems that Intel Software Development Emulator can be used to development and testing.

intel-sha-extensions_1.zip <- code from Intel.

[magnumripper]

"The SHA instructions are non-SIMD although they are defined with XMM width operands"

I had a look at this some time ago. As far as I understood it, the extensions are fast at producing a single SHA-1 or SHA-256 digest, as opposed to our current code producing eg. eight in parallel. At the time, my conclusion was we wouldn't gain anything (unless they are several times faster than our current code). I hope someone can prove me wrong!

[magnumripper]

@solardiz do you have insights?

[solardiz]

It's hard to tell without testing on real hardware, including interleaving of several instances of SHA using those instructions and maybe our usual SIMD at once. We might gain something. Without access to hardware yet, we could review documentation for what uop port(s) those instructions are issued on - do they fully conflict with SIMD or not. Also need their latency & throughput numbers, to compare that against what we achieve with SIMD.

At four (SHA-1) or two (SHA-256) rounds per instructions and interleaving of several instances (to be friendly to CPU's pipelining), these might be competitive with AVX2 or AVX-512 even despite of computing fewer instances.

AMD Ryzen hardware is already available, cheaply. So maybe one of us should get a machine like that and try? Then we'll also need to try/tune on Intel, which might or might not require different tuning - interleaving factor and whether and how much SIMD to use as well.

Per http://instlatx64.atw.hu it looks like on Ryzen the 4 rounds of SHA-1 may only be issued once per 4 cycles, and the 2 rounds of SHA-256 only once per 2 cycles. If so, I wouldn't expect them to be useful for us on those CPUs unless we can efficiently interleave with SIMD.

[magnumripper]

This would be a great GSoC project, or the like.

[solardiz]

Closing this in favor of #5437.