salsa20: SIMD-accelerated backends via fearless_simd#576
Conversation
Add opt-in SIMD backends (`simd` feature) that process 4 blocks (SSE2/NEON) or 8 blocks (AVX2) in parallel, plus a diagonal single-block path for HSalsa20 and tail processing. The `std` feature implies `simd` and adds runtime SIMD level detection via LazyLock. Without `simd`, the soft backend is used as before and the MSRV stays at 1.85. Backend4 (ParBlocksSize=U4) uses u32x4 for 128-bit SIMD. Backend8 (ParBlocksSize=U8) uses the native-width vector for 256-bit SIMD, with chunked fallback for narrower levels. HSalsa20 uses diagonal SIMD layout where each u32x4 holds one role across all four quarter rounds, with byte shuffles to rotate between column and row rounds. Adds dudect constant-time verification example (ctbench). Restricts --all-features CI test to stable (fearless_simd requires rustc 1.89, above the crate MSRV). Benchmarked on i7-8700B (AVX2), Salsa20/20 throughput: 16B: 372 -> 372 MB/s (1.0x) 256B: 533 -> 579 MB/s (1.1x) 1KB: 537 -> 1855 MB/s (3.5x) 16KB: 542 -> 1949 MB/s (3.6x)
|
We generally aim to minimize third-party dependencies. I would strongly prefer to have a proper self-contained intrinsics-based implementation instead. |
|
Yeah, we generally eschew crate dependencies for this sort of thing beyond our own ARX algorithms like Salsa/ChaCha in particular use a very limited number of operations (literally the three add-rotate-xor of ARX). Before looping in a crate dependency I'd be curious to see what is possible with auto-vectorization alone, just by using The |
|
Naive auto-vectorization performs worse because of register spills. I'll follow the the chacha20 example and do the diagonal layout trick. |
3 participants
fearless_simd(SSE2/AVX2/NEON)Backend4(4 parallel blocks, 128-bit) andBackend8(8 parallel blocks, 256-bit), selected at runtime by lane count
u32x4instruction sequence, byte shuffles between column/row rounds)stdfeature for runtime SIMD level detection viaLazyLock;without it, level is determined at compile time
dudect-bencherconstant-time verification example (ctbench)Benchmarked on i7-8700B (AVX2), Salsa20/20: