Experiment: backport ff_derive x86_64 assembly from fff crate

[str4d]

This is an experimental backport of the changes from https://github.com/filecoin-project/ff (published as the fff crate). I've opened this as a draft PR for discussion. I see two main additions:

• ASM for modular multiplication. This is specific to BLS12-381, and is probably unlikely to be beneficial here. When the fff fork was created, the main BLS12-381 implementation was in pairing::bls12_381, and it used ff_derive for its field logic. That implementation has been removed from pairing, and replaced with the bls12_381 crate which implements field logic directly. So we might want to consider potentially adding assembly optimisations there.

• ASM to use _addcarry_u64 and _subborrow_u64 explicitly on x86_64. I'm surprised that Rust doesn't figure this out itself; it seems like we should be able to rework ff_derive to encourage LLVM to lower to this directly.

[tarcieri]

ASM to use _addcarry_u64 and _subborrow_u64 explicitly on x86_64. I'm surprised that Rust doesn't figure this out itself; it seems like we should be able to rework ff_derive to encourage LLVM to lower to this directly.

This was definitely working at one point. Did something change?

[str4d]

IDK. @dignifiedquire implemented that in January 2020 so it's "relatively" recent; they might have more information about what they were seeing that motivated the change.

[tarcieri]

Here's a Godbolt example which shows adc lowering: https://godbolt.org/z/rq7xTsvx6

Taken from the crypto-bigint crate just to cross-check what it's doing, although the implementation is ultimately derived from and quite similar to what's in this crate (but amended to be const-friendly)

[dignifiedquire]

For add I don't remember the exact assembly difference, but back then the intrinsic implementation ended up being faster than the non intrinsic version, at least all the ones we tried.