expression: enable SHA2 function pushdown to TiKV

[joechenrh]

What problem does this PR solve?

Issue Number: close #67087

Problem Summary: The SHA2 function is not pushed down to TiKV for coprocessor evaluation, even though TiKV already implements it. This causes unnecessary data transfer when SHA2 is used in WHERE clauses.

Related: pingcap/tidb-tools#886 (from customer)

What changed and how does it work?

Added ast.SHA2 to the scalarExprSupportedByTiKV allowlist in pkg/expression/infer_pushdown.go, alongside the already-supported MD5 and SHA1.

All infrastructure was already in place:

• TiKV: SHA2 implemented in components/tidb_query_expr/src/impl_encryption.rs (SHA-0/224/256/384/512)
• tipb: ScalarFuncSig_SHA2 defined in protobuf
• TiDB: PbCode mapping (builtin_encryption.go) and distsql deserialization (distsql_builtin.go) already existed

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)

  Verified with tiup playground (PD + TiKV + two TiDB instances: stock vs modified) that:

  • EXPLAIN shows Selection moves from root to cop[tikv] after the change
  • All hash lengths (0/224/256/384/512) produce identical results
  • All column types (varchar, char, text, blob, binary, int, bigint, double, decimal, datetime, date, time, bit, enum, set) produce identical results
  • NULL handling and invalid hash length (123) produce identical results

• No need to test

  • I checked and no code files have been changed.

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

The `SHA2` function can now be pushed down to TiKV for coprocessor evaluation, improving performance for queries that use `SHA2` in `WHERE` clauses.

Summary by CodeRabbit

• New Features

  • SHA2 hashing is now eligible for push-down execution to TiKV, improving query performance for SHA-2–based predicates.

• Tests

  • Updated and added integration tests to cover SHA2 query planning and plan_tree expectations for pushed-down execution.

[pantheon-ai]

@joechenrh I've received your pull request and will start the review. I'll conduct a thorough review covering code quality, potential issues, and implementation details.

⏳ This process typically takes 10-30 minutes depending on the complexity of the changes.

_{ℹ️ Learn more details on Pantheon AI.}

[tiprow]

Hi @joechenrh. Thanks for your PR.

PRs from untrusted users cannot be marked as trusted with /ok-to-test in this repo meaning untrusted PR authors can never trigger tests themselves. Collaborators can still trigger tests on the PR using /test all.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds ast.SHA2 to the TiKV-supported scalar functions allowlist so expressions using SHA2 can be considered for pushdown; test expectations updated to include plan_tree outputs reflecting SHA2 pushdown.

Changes

Cohort / File(s)	Summary
Core Pushdown Logic pkg/expression/infer_pushdown.go	Added ast.SHA2 to the scalarExprSupportedByTiKV allowlist so SHA2 expressions pass the initial TiKV support check.
Tests / Expected Results tests/integrationtest/t/planner/core/casetest/pushdown/push_down.test, tests/integrationtest/r/planner/core/casetest/pushdown/push_down.result	Added a plan_tree explain test for sha2(s, 256) and updated expected plan_tree outputs to show TableReader/Selection nodes for SHA2 and related queries.

Sequence Diagram(s)

mermaid
sequenceDiagram
participant Client as Client
participant TiDB as TiDB Planner
participant Push as Pushdown Checker
participant TiKV as TiKV Coprocessor
participant Store as Storage
rect rgba(200,230,255,0.5)
Client->>TiDB: submit SQL with SHA2 condition
end
rect rgba(220,255,200,0.5)
TiDB->>Push: evaluate expression pushability (includes ast.SHA2)
Push-->>TiDB: mark SHA2 as pushable
end
rect rgba(255,230,200,0.5)
TiDB->>TiKV: send coprocessor request with SHA2 expression
TiKV->>Store: evaluate SHA2 on data pages
TiKV-->>TiDB: return filtered results
end

Estimated Code Review Effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐇 I nibble on bytes and hum a new tune,

SHA2 now hops down to TiKV's dune,
Fewer trips, less rustle, fewer springs to do,
A rabbit's wink — the planner said "push through!" 🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: enabling SHA2 function pushdown to TiKV, which matches the core objective of the PR.
Linked Issues check	✅ Passed	The PR fully addresses issue #67087 by adding SHA2 to scalarExprSupportedByTiKV allowlist, enabling pushdown to TiKV as required.
Out of Scope Changes check	✅ Passed	All changes are directly related to enabling SHA2 pushdown: one line added to allowlist, integration test updated to verify pushdown behavior, no extraneous modifications detected.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Description check	✅ Passed	PR description comprehensively covers the problem, solution, testing, and release notes with all required template sections completed.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

CodeRabbit can generate a title for your PR based on the changes.

Add @coderabbitai placeholder anywhere in the title of your PR and CodeRabbit will replace it with a title based on the changes in the PR. You can change the placeholder by changing the reviews.auto_title_placeholder setting.

[hawkingrei]

/ok-to-test

[hawkingrei]

/retest

[joechenrh]

/retest-required

[joechenrh]

/retest

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.4730%. Comparing base (16df0d1) to head (5feb1e7).
⚠️ Report is 15 commits behind head on master.

Additional details and impacted files

@@               Coverage Diff                @@
##             master     #67088        +/-   ##
================================================
- Coverage   77.7026%   77.4730%   -0.2296%     
================================================
  Files          2016       1936        -80     
  Lines        551903     540997     -10906     
================================================
- Hits         428843     419127      -9716     
- Misses       121314     121841       +527     
+ Partials       1746         29      -1717     

Flag	Coverage Δ
integration	41.2189% <ø> (-6.9102%)	⬇️
unit	76.6970% <ø> (+0.4504%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
dumpling	57.0098% <ø> (+0.2124%)	⬆️
parser	∅ <ø> (∅)
br	48.0629% <ø> (-12.7968%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ingress-bot]

This review was generated by AI and should be verified by a human reviewer.
Manual follow-up is recommended before merge.

Summary

• Total findings: 3
• Inline comments: 3
• Summary-only findings (no inline anchor): 0

Findings (highest risk first)

⚠️ [Major] (1)

1. SHA2 TiKV pushdown is enabled without mixed-version capability gating (pkg/expression/infer_pushdown.go:244; mixed-version rolling-upgrade path with new TiDB and not-yet-upgraded TiKV nodes)

🟡 [Minor] (1)

1. New SHA2 pushdown coverage does not validate semantic parity or boundary modes (tests/integrationtest/t/planner/core/casetest/pushdown/push_down.test:38; tests/integrationtest/r/planner/core/casetest/pushdown/push_down.result:126)

🧹 [Nit] (1)

1. Pushdown category comment no longer matches grouped function semantics (pkg/expression/infer_pushdown.go:243-244)

[windtalker]

lgtm

[zanmato1984]

lgtm

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: windtalker, zanmato1984

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [windtalker,zanmato1984]
• pkg/expression/OWNERS [windtalker,zanmato1984]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-03-18 04:04:44.665087946 +0000 UTC m=+329811.752745493: ☑️ agreed by windtalker.
• 2026-03-18 04:56:11.145720518 +0000 UTC m=+332898.233378045: ☑️ agreed by zanmato1984.

[hawkingrei]

/retest

[hawkingrei]

/retest