Cryptonight variant 2

Contains two modifications to improve ASIC resistance: shuffle and integer math.

Shuffle makes use of the whole 64-byte cache line instead of 16 bytes only, making Cryptonight 4 times more demanding for memory bandwidth.

Integer math adds 64:32 bit integer division followed by 64 bit integer square root, adding large and unavoidable computational latency to the main loop.

More details and performance numbers: https://github.com/SChernykh/xmr-stak-cpu/blob/master/README.md

3 files changed, 216 insertions, 2 deletions

diff --git a/tests/hash/CMakeLists.txt b/tests/hash/CMakeLists.txt
index 92abeca20..433cf94e9 100644
--- a/tests/hash/CMakeLists.txt
+++ b/tests/hash/CMakeLists.txt
@@ -43,8 +43,12 @@ set_property(TARGET hash-tests
   PROPERTY
     FOLDER "tests")
 
-foreach (hash IN ITEMS fast slow slow-1 tree extra-blake extra-groestl extra-jh extra-skein)
+foreach (hash IN ITEMS fast slow slow-1 slow-2 tree extra-blake extra-groestl extra-jh extra-skein)
   add_test(
     NAME    "hash-${hash}"
     COMMAND hash-tests "${hash}" "${CMAKE_CURRENT_SOURCE_DIR}/tests-${hash}.txt")
 endforeach ()
+
+add_test(
+  NAME    "hash-variant2-int-sqrt"
+  COMMAND hash-tests "variant2_int_sqrt")
diff --git a/tests/hash/main.cpp b/tests/hash/main.cpp
index cc5b9ba66..7767d0d3b 100644
--- a/tests/hash/main.cpp
+++ b/tests/hash/main.cpp
@@ -33,9 +33,11 @@
 #include <iomanip>
 #include <ios>
 #include <string>
+#include <cfenv>
 
 #include "warnings.h"
 #include "crypto/hash.h"
+#include "crypto/variant2_int_sqrt.h"
 #include "../io.h"
 
 using namespace std;
@@ -57,6 +59,9 @@ extern "C" {
   static void cn_slow_hash_1(const void *data, size_t length, char *hash) {
     return cn_slow_hash(data, length, hash, 1/*variant*/, 0/*prehashed*/);
   }
+  static void cn_slow_hash_2(const void *data, size_t length, char *hash) {
+    return cn_slow_hash(data, length, hash, 2/*variant*/, 0/*prehashed*/);
+  }
 }
 POP_WARNINGS
 
@@ -67,7 +72,10 @@ struct hash_func {
 } hashes[] = {{"fast", cn_fast_hash}, {"slow", cn_slow_hash_0}, {"tree", hash_tree},
   {"extra-blake", hash_extra_blake}, {"extra-groestl", hash_extra_groestl},
   {"extra-jh", hash_extra_jh}, {"extra-skein", hash_extra_skein},
-  {"slow-1", cn_slow_hash_1}};
+  {"slow-1", cn_slow_hash_1}, {"slow-2", cn_slow_hash_2}};
+
+int test_variant2_int_sqrt();
+int test_variant2_int_sqrt_ref();
 
 int main(int argc, char *argv[]) {
   hash_f *f;
@@ -78,6 +86,36 @@ int main(int argc, char *argv[]) {
   size_t test = 0;
   bool error = false;
   if (argc != 3) {
+    if ((argc == 2) && (strcmp(argv[1], "variant2_int_sqrt") == 0)) {
+      if (test_variant2_int_sqrt_ref() != 0) {
+        return 1;
+      }
+      const int round_modes[3] = { FE_DOWNWARD, FE_TONEAREST, FE_UPWARD };
+      for (int i = 0; i < 3; ++i) {
+        std::fesetround(round_modes[i]);
+        const int result = test_variant2_int_sqrt();
+        if (result != 0) {
+          cerr << "FPU round mode was set to ";
+          switch (round_modes[i]) {
+            case FE_DOWNWARD:
+              cerr << "FE_DOWNWARD";
+              break;
+            case FE_TONEAREST:
+              cerr << "FE_TONEAREST";
+              break;
+            case FE_UPWARD:
+              cerr << "FE_UPWARD";
+              break;
+            default:
+              cerr << "unknown";
+              break;
+          }
+          cerr << endl;
+          return result;
+        }
+      }
+      return 0;
+    }
     cerr << "Wrong number of arguments" << endl;
     return 1;
   }
@@ -127,3 +165,165 @@ int main(int argc, char *argv[]) {
   }
   return error ? 1 : 0;
 }
+
+#if defined(__x86_64__) || (defined(_MSC_VER) && defined(_WIN64))
+
+#include <emmintrin.h>
+
+#if defined(_MSC_VER) || defined(__MINGW32__)
+  #include <intrin.h>
+#else
+  #include <wmmintrin.h>
+#endif
+
+#endif
+
+static inline bool test_variant2_int_sqrt_sse(const uint64_t sqrt_input, const uint64_t correct_result)
+{
+#if defined(__x86_64__) || (defined(_MSC_VER) && defined(_WIN64))
+  uint64_t sqrt_result;
+  VARIANT2_INTEGER_MATH_SQRT_STEP_SSE2();
+  VARIANT2_INTEGER_MATH_SQRT_FIXUP(sqrt_result);
+  if (sqrt_result != correct_result) {
+    cerr << "Integer sqrt (SSE2 version) returned incorrect result for N = " << sqrt_input << endl;
+    cerr << "Expected result: " << correct_result << endl;
+    cerr << "Returned result: " << sqrt_result << endl;
+    return false;
+  }
+#endif
+
+  return true;
+}
+
+static inline bool test_variant2_int_sqrt_fp64(const uint64_t sqrt_input, const uint64_t correct_result)
+{
+#if defined DBL_MANT_DIG && (DBL_MANT_DIG >= 50)
+  uint64_t sqrt_result;
+  VARIANT2_INTEGER_MATH_SQRT_STEP_FP64();
+  VARIANT2_INTEGER_MATH_SQRT_FIXUP(sqrt_result);
+  if (sqrt_result != correct_result) {
+    cerr << "Integer sqrt (FP64 version) returned incorrect result for N = " << sqrt_input << endl;
+    cerr << "Expected result: " << correct_result << endl;
+    cerr << "Returned result: " << sqrt_result << endl;
+    return false;
+  }
+#endif
+
+  return true;
+}
+
+static inline bool test_variant2_int_sqrt_ref(const uint64_t sqrt_input, const uint64_t correct_result)
+{
+  uint64_t sqrt_result;
+  VARIANT2_INTEGER_MATH_SQRT_STEP_REF();
+  if (sqrt_result != correct_result) {
+    cerr << "Integer sqrt (reference version) returned incorrect result for N = " << sqrt_input << endl;
+    cerr << "Expected result: " << correct_result << endl;
+    cerr << "Returned result: " << sqrt_result << endl;
+    return false;
+  }
+
+  return true;
+}
+
+static inline bool test_variant2_int_sqrt(const uint64_t sqrt_input, const uint64_t correct_result)
+{
+  if (!test_variant2_int_sqrt_sse(sqrt_input, correct_result)) {
+    return false;
+  }
+  if (!test_variant2_int_sqrt_fp64(sqrt_input, correct_result)) {
+    return false;
+  }
+
+  return true;
+}
+
+int test_variant2_int_sqrt()
+{
+  if (!test_variant2_int_sqrt(0, 0)) {
+    return 1;
+  }
+  if (!test_variant2_int_sqrt(1ULL << 63, 1930543745UL)) {
+    return 1;
+  }
+  if (!test_variant2_int_sqrt(uint64_t(-1), 3558067407UL)) {
+    return 1;
+  }
+
+  for (uint64_t i = 1; i <= 3558067407UL; ++i) {
+    // "i" is integer part of "sqrt(2^64 + n) * 2 - 2^33"
+    // n = (i/2 + 2^32)^2 - 2^64
+
+    const uint64_t i0 = i >> 1;
+    uint64_t n1;
+    if ((i & 1) == 0) {
+      // n = (i/2 + 2^32)^2 - 2^64
+      // n = i^2/4 + 2*2^32*i/2 + 2^64 - 2^64
+      // n = i^2/4 + 2^32*i
+      // i is even, so i^2 is divisible by 4:
+      // n = (i^2 >> 2) + (i << 32)
+
+      // int_sqrt_v2(i^2/4 + 2^32*i - 1) must be equal to i - 1
+      // int_sqrt_v2(i^2/4 + 2^32*i) must be equal to i
+      n1 = i0 * i0 + (i << 32) - 1;
+    }
+    else {
+      // n = (i/2 + 2^32)^2 - 2^64
+      // n = i^2/4 + 2*2^32*i/2 + 2^64 - 2^64
+      // n = i^2/4 + 2^32*i
+      // i is odd, so i = i0*2+1 (i0 = i >> 1)
+      // n = (i0*2+1)^2/4 + 2^32*i
+      // n = (i0^2*4+i0*4+1)/4 + 2^32*i
+      // n = i0^2+i0+1/4 + 2^32*i
+      // i0^2+i0 + 2^32*i < n < i0^2+i0+1 + 2^32*i
+
+      // int_sqrt_v2(i0^2+i0 + 2^32*i) must be equal to i - 1
+      // int_sqrt_v2(i0^2+i0+1 + 2^32*i) must be equal to i
+      n1 = i0 * i0 + i0 + (i << 32);
+    }
+
+    if (!test_variant2_int_sqrt(n1, i - 1)) {
+      return 1;
+    }
+    if (!test_variant2_int_sqrt(n1 + 1, i)) {
+      return 1;
+    }
+  }
+
+  return 0;
+}
+
+int test_variant2_int_sqrt_ref()
+{
+  if (!test_variant2_int_sqrt_ref(0, 0)) {
+    return 1;
+  }
+  if (!test_variant2_int_sqrt_ref(1ULL << 63, 1930543745UL)) {
+    return 1;
+  }
+  if (!test_variant2_int_sqrt_ref(uint64_t(-1), 3558067407UL)) {
+    return 1;
+  }
+
+  // Reference version is slow, so we test only every 83th edge case
+  // "i += 83" because 1 + 83 * 42868282 = 3558067407
+  for (uint64_t i = 1; i <= 3558067407UL; i += 83) {
+    const uint64_t i0 = i >> 1;
+    uint64_t n1;
+    if ((i & 1) == 0) {
+      n1 = i0 * i0 + (i << 32) - 1;
+    }
+    else {
+      n1 = i0 * i0 + i0 + (i << 32);
+    }
+
+    if (!test_variant2_int_sqrt_ref(n1, i - 1)) {
+      return 1;
+    }
+    if (!test_variant2_int_sqrt_ref(n1 + 1, i)) {
+      return 1;
+    }
+  }
+
+  return 0;
+}
diff --git a/tests/hash/tests-slow-2.txt b/tests/hash/tests-slow-2.txt
new file mode 100644
index 000000000..8f90d05c9
--- /dev/null
+++ b/tests/hash/tests-slow-2.txt
@@ -0,0 +1,10 @@
+4cf1ff9ca46eb433b36cd9f70e02b14cc06bfd18ca77fa9ccaafd1fd96c674b0 5468697320697320612074657374205468697320697320612074657374205468697320697320612074657374
+7d292e43f4751714ec07dbcb0e4bbffe2a7afb6066420960684ff57d7474c871 4c6f72656d20697073756d20646f6c6f722073697420616d65742c20636f6e73656374657475722061646970697363696e67
+335563425256edebf1d92dc342369c2f4770ebb4112ba975659bd8a0f210abd0 656c69742c2073656420646f20656975736d6f642074656d706f7220696e6369646964756e74207574206c61626f7265
+47758e86d2f57210366cec36fff26f9464d89efd116fe6ef28b718b5da120801 657420646f6c6f7265206d61676e6120616c697175612e20557420656e696d206164206d696e696d2076656e69616d2c
+48787b48d5c68f0c1dd825c32580af741cc0ee314f08133135c1e86d87a24a95 71756973206e6f737472756420657865726369746174696f6e20756c6c616d636f206c61626f726973206e697369
+93bdf47495854f7cfaaca1af8c0f39ef4a3024c10eb0dea23726b0e06ef29e84 757420616c697175697020657820656120636f6d6d6f646f20636f6e7365717561742e20447569732061757465
+a375a71d0541057ccc96719150dfe10b6e6f486b19cf4a0835e19605413a8417 697275726520646f6c6f7220696e20726570726568656e646572697420696e20766f6c7570746174652076656c6974
+163478a76f8f1432533fbdd1284d65c89f37479e54f20841c6ce4eba56c73854 657373652063696c6c756d20646f6c6f726520657520667567696174206e756c6c612070617269617475722e
+356b0470c6eea75cad7a108179e232905b23bdaf03c2824c6e619d503ee93677 4578636570746575722073696e74206f6363616563617420637570696461746174206e6f6e2070726f6964656e742c
+a47e2b007dc25bb279e197a1b91f67ecebe2ddd8791cd32dd2cb76dd21ed943f 73756e7420696e2063756c706120717569206f666669636961206465736572756e74206d6f6c6c697420616e696d20696420657374206c61626f72756d2e