Accelerate SHA256 computations in pure Go using AVX512, SHA256 and AVX2 for Intel and ARM64 for ARM. On AVX512 it provides an up to 8x improvement (over 3 GB/s per core) in comparison to AVX2. On SHA256 speeds up observed at 4x in comparison to AVX2.
Clone or download
harshavardhana Added correct copyrights for SHA CPU support
SHA instruction support was graciously provided
by Kristofer Peterson, which increased and doubled
the performance overall.
Latest commit cc1980c Jan 17, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.gitignore Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
.travis.yml Fix asmdecl errors and reserve stack space for AVX2 block function (#38) Jan 5, 2019
LICENSE Added LICENSE Jul 20, 2016
README.md Added correct copyrights for SHA CPU support Jan 17, 2019
appveyor.yml build: Add travis and appveyor CI builds. (#1) Jul 22, 2016
cpuid.go Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
cpuid_386.go Prepare automatic detection of ARM SHA extensions Jul 26, 2016
cpuid_386.s Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
cpuid_amd64.go Prepare automatic detection of ARM SHA extensions Jul 26, 2016
cpuid_amd64.s Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
cpuid_arm.go Check for sha2 feature flag. (#13) Dec 19, 2016
cpuid_linux_arm64.go Check for sha2 feature flag. (#13) Dec 19, 2016
cpuid_other.go Add support for WASM (#33) Oct 5, 2018
cpuid_others_arm64.go Check for sha2 feature flag. (#13) Dec 19, 2016
sha256.go Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
sha256_test.go Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
sha256blockAvx2_amd64.go Add support for 386(32bit) and ARM(32bit). (#3) Aug 16, 2016
sha256blockAvx2_amd64.s Fix asmdecl errors and reserve stack space for AVX2 block function (#38) Jan 5, 2019
sha256blockAvx512_amd64.asm Feature/avx512 support (#30) Dec 8, 2017
sha256blockAvx512_amd64.go Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
sha256blockAvx512_amd64.s Fix asmdecl errors and reserve stack space for AVX2 block function (#38) Jan 5, 2019
sha256blockAvx512_amd64_test.go Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
sha256blockAvx_amd64.go Add support for 386(32bit) and ARM(32bit). (#3) Aug 16, 2016
sha256blockAvx_amd64.s Fix asmdecl errors and reserve stack space for AVX2 block function (#38) Jan 5, 2019
sha256blockSha_amd64.go Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
sha256blockSha_amd64.s Added correct copyrights for SHA CPU support Jan 17, 2019
sha256blockSha_amd64_test.go Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
sha256blockSsse_amd64.go Add support for 386(32bit) and ARM(32bit). (#3) Aug 16, 2016
sha256blockSsse_amd64.s Fix asmdecl errors and reserve stack space for AVX2 block function (#38) Jan 5, 2019
sha256block_386.go Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
sha256block_amd64.go Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
sha256block_arm.go Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
sha256block_arm64.go Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
sha256block_arm64.s Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019
sha256block_noasm.go Code for generic case Jul 23, 2016
sha256block_other.go Support SHA* intrinsics on Intel CPU (#37) Jan 4, 2019

README.md

sha256-simd

Accelerate SHA256 computations in pure Go using AVX512, SHA Extensions and AVX2 for Intel and ARM64 for ARM. On AVX512 it provides an up to 8x improvement (over 3 GB/s per core) in comparison to AVX2. SHA Extensions give a performance boost of close to 4x over AVX2.

Introduction

This package is designed as a replacement for crypto/sha256. For Intel CPUs it has two flavors for AVX512 and AVX2 (AVX/SSE are also supported). For ARM CPUs with the Cryptography Extensions, advantage is taken of the SHA2 instructions resulting in a massive performance improvement.

This package uses Golang assembly. The AVX512 version is based on the Intel's "multi-buffer crypto library for IPSec" whereas the other Intel implementations are described in "Fast SHA-256 Implementations on Intel Architecture Processors" by J. Guilford et al.

New: Support for Intel SHA Extensions

Support for the Intel SHA Extensions has been added by Kristofer Peterson (@svenski123), originally developed for spacemeshos here. On CPUs that support it (known thus far Intel Celeron J3455 and AMD Ryzen) it gives a significant boost in performance (with thanks to @AudriusButkevicius for reporting the results; full results here).

$ benchcmp avx2.txt sha-ext.txt
benchmark           AVX2 MB/s    SHA Ext MB/s  speedup
BenchmarkHash5M     514.40       1975.17       3.84x

Thanks to Kristofer Peterson, we also added additional performance changes such as optimized padding, endian conversions which sped up all implementations i.e. Intel SHA alone while doubled performance for small sizes, the other changes increased everything roughly 50%.

Support for AVX512

We have added support for AVX512 which results in an up to 8x performance improvement over AVX2 (3.0 GHz Xeon Platinum 8124M CPU):

$ benchcmp avx2.txt avx512.txt
benchmark           AVX2 MB/s    AVX512 MB/s  speedup
BenchmarkHash5M     448.62       3498.20      7.80x

The original code was developed by Intel as part of the multi-buffer crypto library for IPSec or more specifically this AVX512 implementation. The key idea behind it is to process a total of 16 checksums in parallel by “transposing” 16 (independent) messages of 64 bytes between a total of 16 ZMM registers (each 64 bytes wide).

Transposing the input messages means that in order to take full advantage of the speedup you need to have a (server) workload where multiple threads are doing SHA256 calculations in parallel. Unfortunately for this algorithm it is not possible for two message blocks processed in parallel to be dependent on one another — because then the (interim) result of the first part of the message has to be an input into the processing of the second part of the message.

Whereas the original Intel C implementation requires some sort of explicit scheduling of messages to be processed in parallel, for Golang it makes sense to take advantage of channels in order to group messages together and use channels as well for sending back the results (thereby effectively decoupling the calculations). We have implemented a fairly simple scheduling mechanism that seems to work well in practice.

Due to this different way of scheduling, we decided to use an explicit method to instantiate the AVX512 version. Essentially one or more AVX512 processing servers (Avx512Server) have to be created whereby each server can hash over 3 GB/s on a single core. An hash.Hash object (Avx512Digest) is then instantiated using one of these servers and used in the regular fashion:

import "github.com/minio/sha256-simd"

func main() {
	server := sha256.NewAvx512Server()
	h512 := sha256.NewAvx512(server)
	h512.Write(fileBlock)
	digest := h512.Sum([]byte{})
}

Note that, because of the scheduling overhead, for small messages (< 1 MB) you will be better off using the regular SHA256 hashing (but those are typically not performance critical anyway). Some other tips to get the best performance:

  • Have many go routines doing SHA256 calculations in parallel.
  • Try to Write() messages in multiples of 64 bytes.
  • Try to keep the overall length of messages to a roughly similar size ie. 5 MB (this way all 16 ‘lanes’ in the AVX512 computations are contributing as much as possible).

More detailed information can be found in this blog post including scaling across cores.

Drop-In Replacement

The following code snippet shows how you can use github.com/minio/sha256-simd. This will automatically select the fastest method for the architecture on which it will be executed.

import "github.com/minio/sha256-simd"

func main() {
        ...
	shaWriter := sha256.New()
	io.Copy(shaWriter, file)
        ...
}

Performance

Below is the speed in MB/s for a single core (ranked fast to slow) for blocks larger than 1 MB.

Processor SIMD Speed (MB/s)
3.0 GHz Intel Xeon Platinum 8124M AVX512 3498
3.7 GHz AMD Ryzen 7 2700X SHA Ext 1979
1.2 GHz ARM Cortex-A53 ARM64 638
3.0 GHz Intel Xeon Platinum 8124M AVX2 449
3.1 GHz Intel Core i7 AVX 362
3.1 GHz Intel Core i7 SSE 299

asm2plan9s

In order to be able to work more easily with AVX512/AVX2 instructions, a separate tool was developed to convert SIMD instructions into the corresponding BYTE sequence as accepted by Go assembly. See asm2plan9s for more information.

Why and benefits

One of the most performance sensitive parts of the Minio object storage server is related to SHA256 hash sums calculations. For instance during multi part uploads each part that is uploaded needs to be verified for data integrity by the server.

Other applications that can benefit from enhanced SHA256 performance are deduplication in storage systems, intrusion detection, version control systems, integrity checking, etc.

ARM SHA Extensions

The 64-bit ARMv8 core has introduced new instructions for SHA1 and SHA2 acceleration as part of the Cryptography Extensions. Below you can see a small excerpt highlighting one of the rounds as is done for the SHA256 calculation process (for full code see sha256block_arm64.s).

sha256h    q2, q3, v9.4s
sha256h2   q3, q4, v9.4s
sha256su0  v5.4s, v6.4s
rev32      v8.16b, v8.16b
add        v9.4s, v7.4s, v18.4s
mov        v4.16b, v2.16b
sha256h    q2, q3, v10.4s
sha256h2   q3, q4, v10.4s
sha256su0  v6.4s, v7.4s
sha256su1  v5.4s, v7.4s, v8.4s

Detailed benchmarks

Benchmarks generated on a 1.2 Ghz Quad-Core ARM Cortex A53 equipped Pine64.

minio@minio-arm:$ benchcmp golang.txt arm64.txt
benchmark                 golang         arm64        speedup
BenchmarkHash8Bytes-4     0.68 MB/s      5.70 MB/s      8.38x
BenchmarkHash1K-4         5.65 MB/s    326.30 MB/s     57.75x
BenchmarkHash8K-4         6.00 MB/s    570.63 MB/s     95.11x
BenchmarkHash1M-4         6.05 MB/s    638.23 MB/s    105.49x

License

Released under the Apache License v2.0. You can find the complete text in the file LICENSE.

Contributing

Contributions are welcome, please send PRs for any enhancements.