Apparatus, method and system for hashing instructions

Abstract

Apparatuses, methods, and systems are disclosed for hashing instructions. A processor includes a decode circuit and an execution circuit. The decode circuit is to decode an instruction including at least one first field for 32-bit state elements A, B, C, D, E, F, G, and H of a round of the SM3 hash standard and at least one second field identifying an input message. The execution circuit is to execute the decoded instruction to: left circular shift state elements C, D, G, H by 9 bits, 9 bits, 19 bits, 19 bits, respectively; perform two rounds of the SM3 hash standard on the input message, state elements A, B, the circularly shifted state elements C, D, state elements E, F, the circularly shifted state elements G, H to generate updated state elements A, B, E, F; and store the updated state elements A, B, E, F into locations specified by the instruction.

Description

[0001] This application is a divisional application of the invention patent application filed on March 3, 2020, with application number 202010139487.7, entitled "Apparatus, Method and System for Hash Instructions". Technical Field

[0002] This disclosure is generally about electronics, and more specifically, embodiments of this disclosure relate to processor circuitry for hash operations. Background Technology

[0003] A processor or set of processors executes instructions from an instruction set (e.g., an instruction set architecture (ISA)). An instruction set is the programming-related part of a computer architecture and generally includes primitive data types, instructions, register architecture, addressing modes, memory architecture, interrupt and exception handling, and external input and output (I / O). It should be noted that the term "instruction" in this document can refer to macro-instructions or micro-instructions, such as macro-instructions provided to the processor for execution, or micro-instructions generated by the processor's decoding circuitry from macro-instructions. Attached Figure Description

[0004] The present disclosure is illustrated by way of example and not by way of limitation in the accompanying drawings, in which similar reference numerals indicate similar elements, and wherein:

[0005] Figure 1 The figure illustrates a hardware processor coupled to a memory according to an embodiment of the present disclosure.

[0006] Figure 2 The illustration shows a hardware processor according to an embodiment of the present disclosure, coupled to a storage including one or more hash instructions.

[0007] Figure 3 The figure illustrates a compression function of the SM3 hash standard according to an embodiment of the present disclosure.

[0008] Figure 4A The illustration shows a pseudocode segment for performing hashing according to the SM3 hash standard, according to an embodiment of the present disclosure.

[0009] Figure 4B The illustration shows another pseudocode segment for performing hashing according to the SM3 hash standard, according to an embodiment of the present disclosure.

[0010] Figure 5 The illustration shows a method for processing hash instructions according to the SM3 hash standard, based on an embodiment of the present disclosure.

[0011] Figure 6 The diagram illustrates a circuit according to an embodiment of the present disclosure, the circuit including an execution circuit having a cyclic shift circuit and an SM3 hash wheel circuit.

[0012] Figure 7 The illustration shows a method for processing pre-cyclic shift instructions according to the SM3 hash standard, based on an embodiment of the present disclosure.

[0013] Figure 8 The diagram illustrates a circuit according to an embodiment of the present disclosure, the circuit including an execution circuit having a cyclic shift circuit.

[0014] Figure 9 The illustration shows a method for processing post-circular shift instructions according to the SM3 hash standard, based on an embodiment of the present disclosure.

[0015] Figure 10 The diagram illustrates a circuit according to an embodiment of the present disclosure, the circuit including an execution circuit having a cyclic shift circuit.

[0016] Figure 11 The illustration shows a method for processing intermediate message instructions according to the SM3 hash standard, based on an embodiment of the present disclosure.

[0017] Figure 12 The diagram illustrates a circuit according to an embodiment of the present disclosure, the circuit including an execution circuit having an intermediate SM3 message calculation circuit.

[0018] Figure 13 The diagram illustrates an intermediate SM3 message calculation circuit according to an embodiment of the present disclosure.

[0019] Figure 14 The illustration shows a method for processing final message instructions according to the SM3 hash standard, based on an embodiment of the present disclosure.

[0020] Figure 15 The diagram illustrates a circuit according to an embodiment of the present disclosure, the circuit including an execution circuit having a final SM3 message calculation circuit.

[0021] Figure 16 The diagram illustrates the final SM3 message calculation circuit according to an embodiment of the present disclosure.

[0022] Figure 17 The diagram illustrates an SHA512 hash circuit according to an embodiment of the present disclosure.

[0023] Figure 18 The illustration shows a method for processing hash instructions according to the SHA512 hash standard, based on an embodiment of the present disclosure.

[0024] Figure 19 The diagram illustrates a circuit according to an embodiment of the present disclosure, the circuit including an execution circuit having an SHA512 hash wheel circuit.

[0025] Figure 20 The illustration shows a method for processing intermediate message instructions according to the SHA512 hash standard, based on an embodiment of the present disclosure.

[0026] Figure 21 The diagram illustrates a circuit according to an embodiment of the present disclosure, the circuit including an execution circuit having an intermediate SHA512 message calculation circuit.

[0027] Figure 22 The illustration shows a method for processing a final message instruction according to the SHA512 hash standard, based on an embodiment of the present disclosure.

[0028] Figure 23 The diagram illustrates a circuit according to an embodiment of the present disclosure, the circuit including an execution circuit having a final SHA512 message calculation circuit.

[0029] Figure 24A This is a block diagram illustrating a general vector-friendly instruction format and its Class A instruction template according to embodiments of the present disclosure.

[0030] Figure 24B This is a block diagram illustrating a general vector-friendly instruction format and its Class B instruction template according to embodiments of the present disclosure.

[0031] Figure 25A The illustration shows an embodiment of the present disclosure for use Figure 24A and Figure 24B A diagram of fields in the generic vector-friendly instruction format.

[0032] Figure 25B The diagram illustrates a complete opcode field according to an embodiment of this disclosure. Figure 25A A diagram of the fields in the dedicated vector-friendly instruction format.

[0033] Figure 25C The diagram illustrates the configuration of a register index field according to an embodiment of this disclosure. Figure 25A A diagram of the fields in the dedicated vector-friendly instruction format.

[0034] Figure 25D The diagram illustrates the configuration of an extended operation field 2450 according to an embodiment of this disclosure. Figure 25A A diagram of the fields in the dedicated vector-friendly instruction format.

[0035] Figure 26 This is a block diagram of a register architecture according to an embodiment of the present disclosure.

[0036] Figure 27A This is a block diagram illustrating both an exemplary ordered pipeline and an exemplary out-of-order release / execution pipeline for register renaming, according to embodiments of the present disclosure.

[0037] Figure 27BThis is a block diagram illustrating both an exemplary embodiment of an ordered architecture core to be included in a processor according to embodiments of the present disclosure and an exemplary out-of-order release / execution architecture core with register renaming.

[0038] Figure 28A This is a block diagram of a single processor core according to an embodiment of the present disclosure, its connection to the on-die interconnect network, and a local subset of its Level 2 (L2) cache.

[0039] Figure 28B According to embodiments of this disclosure Figure 28A An expanded diagram of a portion of the processor core.

[0040] Figure 29 This is a block diagram of a processor according to embodiments of the present disclosure, which may have more than one core, may have an integrated memory controller, and may have an integrated graphics device.

[0041] Figure 30 This is a block diagram of a system according to an embodiment of the present disclosure.

[0042] Figure 31 This is a block diagram of a more specific exemplary system according to embodiments of the present disclosure.

[0043] Figure 32 The diagram shown is a block diagram of a second, more specific exemplary system according to an embodiment of the present disclosure.

[0044] Figure 33 The diagram shown is a block diagram of a system-on-a-chip (SoC) according to an embodiment of the present disclosure.

[0045] Figure 34 This is a block diagram illustrating the use of a software instruction converter to convert binary instructions in a source instruction set into binary instructions in a target instruction set, according to embodiments of the present disclosure. Detailed Implementation

[0046] Numerous specific details are set forth in the following description. However, it should be understood that embodiments of this disclosure can be practiced without utilizing these specific details. In other instances, well-known circuits, structures, and techniques have not been shown in detail so as not to obscure the understanding of this description.

[0047] References to "an embodiment," "embodiment," "example embodiment," etc., in the specification indicate that the described embodiment may include a specific feature, structure, or characteristic; however, each embodiment may not necessarily include that specific feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. Additionally, when a specific feature, structure, or characteristic is described in connection with an embodiment, it is believed that the influence of such feature, structure, or characteristic on such feature, structure, or characteristic in conjunction with other embodiments, whether explicitly described or not, is within the knowledge of those skilled in the art.

[0048] For example, a processor (e.g., hardware) with one or more cores can execute instructions (e.g., instruction threads) to manipulate data, thereby performing one or more hash operations, for example. For instance, software can request a hash operation, and a hardware processor (e.g., one or more cores of the hardware processor) can perform the operation in response to the request. A non-limiting example of a hash operation is a round (or multiple rounds) of hashes based on hashes in a hash table (e.g., a cryptography). A hash standard may include one or more hash functions that take a message as input, generate a corresponding hash value or digest by applying the hash function(s) to the message, and output the hash value or digest. The hash value may include an updated status word. Typically, if the same hash function is evaluated with the same message, the same hash value (or digest) should be generated. Such hash functions are used for various purposes, such as verification (e.g., verifying the integrity of a file, data, or message), identification (e.g., identifying a file, data, or message), authentication (e.g., generating a message authentication code), generating digital signatures, generating pseudo-random numbers, and so on. As an illustrative example, a hash function is used to generate a hash value for a given (input) message. At a later time, the same hash function can be used to recalculate the hash value for that given message. If the hash values ​​are exactly the same, it can be assumed that the message has not been modified. Conversely, if the hash values ​​are different, it can be assumed that the message has been altered.

[0049] An example of a hash standard is the SM3 hash standard. The SM3 hash standard has been released by the Office of the China Commercial Cryptography Association and approved by the Chinese government. The English description of the SM3 hash standard was released by S. Shen et al. on January 8, 2018, as part of the Internet Engineering Task Force (IETF) and named "SM3 Cryptographic Hash Function". In one embodiment, the SM3 hash standard takes the input message as a 512-bit block (e.g., with 32-bit elements) and generates a 256-bit hash (or digest) value. Some embodiments herein provide one or more instructions (e.g., as referenced in the documentation) as improvements to the operation of the processor itself (e.g., a computer's processor). Figures 3-16(As discussed herein). For example, including (multiple) dedicated instructions for the SM3 hash standard reduces power consumption, reduces the total number of instructions to be decoded / executed to generate a hash (or digest) output value, and increases the performance (e.g., execution speed) of hash operations according to the SM3 hash standard. Instruction decoding circuitry (e.g., decoder) that does not have such instructions as part of its instruction set will not perform decoding as discussed herein. Execution circuitry that does not have such instructions as part of its instruction set will not execute as discussed herein.

[0050] Another example of a hash standard is the SHA512 (or SHA384) hash standard. The SHA512 (and SHA384) hash standard was published by the National Institute of Standards and Technology (NIST) in August 2015 as a "Federal Information Processing Standard (FIPS)" and is named the "Secure Hash Standard (SHS)". In one embodiment, the SHA512 hash standard takes an input message as a 1024-bit block (e.g., with 64-bit elements) and generates a 512-bit hash (or message digest) value. Some embodiments herein provide one or more instructions (e.g., as referenced in [reference]) as improvements to the operation of the processor itself. Figures 17-23 (As discussed herein). For example, including (multiple) dedicated instructions for the SHA512 hash standard reduces power consumption, reduces the total number of instructions to be decoded / executed to generate a hash (or digest) output value, and increases the performance (e.g., execution speed) of hash operations according to the SHA512 hash standard. Instruction decoding circuitry (e.g., decoder) that does not have such instructions as part of its instruction set will not perform decoding as discussed herein. Execution circuitry that does not have such instructions as part of its instruction set will not execute as discussed herein.

[0051] Figure 1 The illustration depicts a hardware processor 100 coupled to memory 110 according to an embodiment of this disclosure. The depicted hardware processor 100 includes hardware decoding circuitry 102 (e.g., a decoding unit or decoder) and hardware execution unit 104 (e.g., an execution unit). The depicted hardware processor 100 includes register(s) 106. Registers may include one or more registers for performing operations, such as appended to or substituted for access to data in memory 110 (e.g., loading or storing). Note that the figures herein may not depict all data communication connections. Those skilled in the art will appreciate that this is to avoid obscuring certain details in the figures. Note that bidirectional arrows in the figures may not require bidirectional communication; for example, they may indicate unidirectional communication (e.g., to or from that component or device). Any path or all combinations of communication paths may be utilized in the embodiments herein.

[0052] Hardware decoding circuit 102 can receive (e.g., a single) instruction (e.g., a macro instruction) and decode the instruction into, for example, micro instructions and / or micro-operations. Hardware execution circuit 104 can execute the decoded instruction (e.g., a macro instruction) to perform one or more operations. For example, the instruction to be decoded by decoding circuit 102 and the decoded instruction to be executed by execution circuit 104 can be, for example, the kind discussed herein, such as in... Figures 3-23 Any instruction in the diagram. The hardware execution circuit 104 can be any execution circuit in the execution circuits shown in the figures. In some embodiments, the hardware execution circuit 104 is (e.g., only) a hash execution circuit that is used separately from general-purpose execution circuits or execution units (e.g., general-purpose execution circuits or execution units that execute non-hash-specific instructions).

[0053] The decoding circuit 102, the execution circuit 104, and the register 106 may be elements of a single core of the processor, and multiple cores, for example, each having instances of circuitry, may be included. The processor (and, for example, the core of the processor) may be a processor and / or a core according to any of the disclosures herein.

[0054] Figure 2 The illustration depicts a hardware processor 200 according to an embodiment of the present disclosure, coupled to a memory 202 including one or more hash instructions 204. In some embodiments, the hash instructions are based on anything disclosed herein. In one embodiment, for example, in response to a request to perform an operation, an instruction (e.g., a macro instruction) is fetched from memory 202 and sent to decoding circuitry 206. In the depicted embodiment, decoding circuitry 206 (e.g., a decoder) decodes the instruction into decoded instructions (e.g., one or more microinstructions or one or more microoperations). The decoded instructions are then sent for execution, for example, scheduled for execution via scheduler circuitry 208.

[0055] In some embodiments (e.g., where the processor / core supports out-of-order (OoO) execution), the processor includes register renaming / allocator circuitry coupled to register file / memory circuitry 210 (e.g., cells) for allocating resources and performing register renaming on registers (e.g., vector registers associated with logical operations and test instructions). In some embodiments (e.g., for out-of-order execution), the processor includes one or more scheduler circuits 208 coupled to decoding circuitry. The scheduler circuitry(s) can schedule one or more operations associated with decoded instructions (including one or more operations decoded from logical operations and test instructions) for execution on execution circuitry 212.

[0056] In some embodiments, write-back circuitry 214 is included to write the results of instructions back to their destination (e.g., to write them to registers and / or memory), such that those results are visible within the processor (e.g., visible outside the execution circuitry that produced those results).

[0057] One or more of these components (e.g., decoding circuitry 206, register renaming / register allocator / scheduler 208, execution circuitry 212, register file / memory 210, or write-back circuitry) may reside in a single core of the hardware processor (and, for example, in multiple cores, each having instances of these components). Hash instruction 204 may be (multiple) dedicated instructions for the SM3 hash standard. Hash instruction 204 may be (multiple) dedicated instructions for the SHA512 hash standard.

[0058] Instructions for the SM3 hash standard

[0059] In some embodiments, the SM3 hash function accepts a message as input. This message can represent a bit string of any length. The SM3 hash function performs multiple operations using the input message and generates a hash value or digest of 256 bits after padding and iterative compression.

[0060] Figure 3 The figure illustrates a compression function 312 of the SM3 hash standard according to an embodiment of the present disclosure.

[0061] Initially, the 256-bit state value V(i) is divided into eight 32-bit state elements (e.g., words) A, B, C, D, E, F, G, and H. The initial state value V(0) used for the first iteration is a constant defined by the SM3 hash function. State words A through H are processed according to the SM3 hash function in a most significant bit-first format, but their format in the implementation may differ if required.

[0062] The sequence of blocks is then iterated. The depicted SM3 hash standard comprises 64 iterations or "rounds" (i.e., through j ranging from 0 to 63). As shown in the figure, a single round 313 includes several different operations. The left-pointing arrow symbol (←) stores the value or parameter on the right into the value or parameter on the left, assigns the value or parameter on the right to the value or parameter on the left, or makes the value or parameter on the right equal to the value or parameter on the left. The symbol "<<<" indicates a circular left shift operation, followed by the number of bits to be circularly shifted. The symbol ">>>" indicates a circular right shift operation, followed by the number of bits to be circularly shifted. The circled plus sign symbol... This represents a logical XOR operation. Tj is a constant with a value that depends on the iteration (i.e., the value of j), as specified in the SM3 hash function. For example, Tj can have the value 79cc4519. The variables SS1, SS2, TT1, and TT2 are internal values ​​of 79cc4519 for 0 ≤ j ≤ 15, and the intermediate value 7a879d8a for 16 ≤ j ≤ 63 used in the iteration.

[0063] FFj is a Boolean function that varies with the cycle number (j) based on function 1:

[0064] FFj(X,Y,Z) = X XOR Y XOR Z (0≤j≤15); or function 1

[0065] =(X AND Y)OR(X AND Z)OR(Y AND Z)(16≤j≤63)

[0066] GGj is a Boolean function based on function 2 changing with the cycle number (j):

[0067] GGj(X,Y,Z)=X XOR Y XOR Z(0≤j≤15); or function 2

[0068] =(X AND Y)OR(NOT X AND Z)(16≤j≤63)

[0069] P0 is the permutation function based on the compression function of function 3:

[0070] P0(X) = X XOR(X<<<9) XOR(X<<<17) Function 3

[0071] Note that item Wj is added to the evaluation of the Boolean function GGj. Similarly, item W'j is added to the evaluation of the Boolean function FFj. Items Wj and W'j represent message items, message inputs, or simply messages. For iterations 0 to 15, items W0 to W15 are obtained from a compressed 512-bit block. Specifically, the compressed 512-bit message block is split or divided into sixteen 32-bit words referenced in big-endian format as W0 to W15. The remaining messages Wj and W'j are computed in the message expansion or message augmentation part of the SM3 hash function.

[0072] The Wj messages used for iterations 16 to 67 can be calculated using the following function 4:

[0073] Wj = P1(Wj-16 XOR Wj-9 XOR(Wj-3<<<15)) XOR function 4

[0074] (Wj-13<<<7)XOR Wj-6

[0075] In function 4, P1(X) is a substitution function used for message expansion as defined by function 5 below:

[0076] P1(X) = X XOR(X<<<15) XOR(X<<<23) Function 5

[0077] The Wj messages for iterations 16 to 67 can be calculated using function 4 and the permutation function P1 according to function 5. Note that the calculation of the Wj message for a given round (e.g., round j) depends on messages from earlier rounds. Specifically, as is readily apparent in function 4, the Wj message for a given round (e.g., round j) depends on previous round messages Wj-16, Wj-13, Wj-9, Wj-6, and Wj-3. Wj-3 is a message from three rounds back relative to round j, Wj-16 is a message from sixteen rounds back relative to round j, and so on.

[0078] The W'j message can be calculated or derived from the Wj message using the following function 6:

[0079] W'j = Wj XOR Wj + 4 (Function 6)

[0080] Note that message W'j depends on message Wj from the same round and message Wj+4 from the previous four rounds. Since W0 to W15 are split or obtained from the compressed 512-bit message block, messages W'0 to W'11 can be determined using function 6 based on the initially known messages W0 to W15. The remaining messages W'12 to W'63 can be determined from messages W16 to W67, which can be calculated using equations 4-5. Note that even if W64 to W67 are not directly input into the compression function, they can still be calculated because they are needed to calculate W'60 to W'63.

[0081] As in the shorthand described herein, a value may or may not include a wheel indicator for itself (e.g., W[0] for wheel 0 of a word value, or W

[63] for wheel 63 of a word value), but it should be understood that hashing by wheels allows those values ​​to be referenced by wheels. Thus, in this disclosure, a value indicator may be assigned to a specific wheel. As an example, values ​​W[i], W[i+1], W[i+4], W[i+5], where index i indicates the current wheel. For example, the first wheel (i=0) includes values ​​(e.g., data words) of values ​​W[0], W[1], W[4], and W[5], and the third wheel (i=3) includes indicator values ​​W[2], W[3], W[6], and W[7] (e.g., four different message words each time). As another example, the value AH can be a specific value for each round (e.g., "i") (e.g., depending on the naming format of the round reference, A[i], B[i], C[i], D[i], E[i], F[i], G[i], H[i], or A i B i C i D i E i F i G i H i ).

[0082] Figure 4AThe illustration shows a pseudocode segment 400 for performing hashing according to the SM3 hash standard, according to an embodiment of the present disclosure. Pseudocode 400 is used to perform a hash operation according to the SM3 hash standard for each data block (e.g., which may be 512 bits, i.e., 64 bytes). Therefore, for each block 402, a message computation 404 (e.g., one or more message computation instructions) is performed, followed by two rounds of hashing operations 406, a circular shift 408 of status words C, D, G, and H (e.g., for that particular round), an additional segment of two rounds of hashing operations 410 and a circular shift 412 of status words C, D, G, and H (e.g., for that particular round), followed by a logical XOR according to 414 and 416 (e.g., for the position of each bit). (For example, within the same segment of each value being compared) if an odd number of arguments in each segment are true, the logical XOR operation produces an output "true" (e.g., logic 1) for each segment (e.g., bit position), otherwise it produces "false" (e.g., logic 0). In one embodiment, each circular shift performed (408, 412, etc.) requires its own instruction and thus consumes resources of a set of multiple stages of the instruction pipeline, such as fetch, decode, schedule, execute, and commit. In some embodiments, the circular shifts (e.g., 408, 412) are repeated (e.g., sixteen times) until all (e.g., 64) rounds for each data block are completed. For example, according to the SM3 hash standard, each input block may include 64 bytes of input, thus using 32 calls to the instruction for performing a two-round hash operation (e.g., 406 or 410) and a corresponding 32 calls to the circular shift instruction (e.g., 408 or 412).

[0083] In one embodiment, block 402 computation includes 64 rounds of block digest computation, as well as message word computation and the rounds performed. In one embodiment, message computation (e.g., 404) uses either an input word or previously computed words to compute multiple (e.g., four) message words, thereby computing the next multiple (e.g., four) words relevant to subsequent rounds of computation. In some embodiments, there are two (e.g., parallel) workloads: (i) message word computation for computing message words (e.g., using VSM3MSG1 and VSM3MSG2 instructions or input loading); and (ii) round computation using the computed message words. In one embodiment, these operations are performed for each round iteration (e.g., except for the first 16 words read from the input instead of by executing VSM3MSG1 and VSM3MSG2 instructions).

[0084] Figure 4B The illustration shows another pseudocode segment 401 for performing hashing according to the SM3 hash standard, according to an embodiment of this disclosure. Figure 4A Compared to pseudocode 400, Figure 4B The pseudocode 401 includes a single instruction that performs both a circular shift of state elements C, D, G, and H and a two-round hash operation. Thus, for each block 405, a message computation 407 is performed (e.g., from the input data block or one or more message computation instructions as discussed herein), followed by a two-round hash operation 409 (e.g., before the hash operation) that also performs a circular shift of state words C, D, G, and H, followed by one or more instances of additional instructions, each performing two rounds of hash operations and (e.g., before the hash operation) a circular shift of state words C, D, G, and H (411), followed by (e.g., for each individual data block) a logical XOR according to 413 and 415 (e.g., for the position of each bit). In one embodiment, (e.g., when each block is started such that the first AH value is an initial value defined by the SM3 hash standard at the beginning) the old values ​​(e.g., OLD_ABEF and OLD_CDGH) are derived from the first value of AH.

[0085] For example, according to the SM3 hash standard, each input block can include 64 bytes of input, so 32 calls to an instruction that performs two rounds of hashing operations would be used. This instruction also (e.g., before the hashing operations) performs circular shifts (e.g., 409 or 411) of the status words C, D, G, and H without utilizing processor resources for circular shift instructions (e.g., ...). Figure 4A The corresponding 32 calls (408 or 412 in the original text). Therefore, the embodiment that performs two rounds of SM3 hash operations and (e.g., before the hash operations) also performs instructions for the circular shift of SM3 status words C, D, G, and H reduces the total number of instructions in pseudocode 401, which is achieved by removing, for example, instructions for circular shift instructions (e.g., ... Figure 4A The removal of 32 calls (408 or 412) for, for example, decoding, scheduling, committing, etc., for each block with the additional pre-circular shift 403 and post-circular shift 417 when iterating through the loop saves power, processing resources, and time. An example of instructions that perform two rounds of SM3 hashing and (e.g., before the hashing) also perform circular shifts of the SM3 status words C, D, G, and H is referenced below. Figure 5 and Figure 6 Let's discuss this. The pre-circular shift instruction 403 is referenced below. Figures 7-8 Let's discuss this further, and the post-circular shift instruction 417 will be referenced below. Figures 9-10 Let's discuss this.

[0086] In one embodiment, block 405 computation includes 64 rounds of block digest computation, as well as message word computation and the rounds performed. In one embodiment, message computation (e.g., 407) uses either an input word or previously computed words to compute multiple (e.g., four) message words, thereby computing the next multiple (e.g., four) words in relation to subsequent rounds of computation. In some embodiments, there are two (e.g., parallel) workloads: (i) message word computation for computing message words (e.g., using VSM3MSG1 and VSM3MSG2 instructions or input loading); and (ii) round computation using the computed message words. In one embodiment, these operations are performed for each round iteration (e.g., except for the first 16 words read from the input instead of by executing VSM3MSG1 and VSM3MSG2 instructions).

[0087] Figure 5The illustration depicts a method 500 for processing (e.g., two-round) hash instructions according to the SM3 hash standard, based on an embodiment of this disclosure. A processor (or, for example, a processor core) may execute method 500, for example, in response to receiving a request to execute instructions from software. The described method 500 includes processing an SM3 hash standard instruction by means of the following steps: at 502, retrieving a single instruction having an opcode, at least one first field, and at least one second field, the opcode indicating to perform a two-round hash according to the SM3 hash standard, the at least one first field identifying eight (e.g., 32-bit) state elements A, B, C, D, E, F, G, and H for a round (e.g., "i") according to the SM3 hash standard, and the at least one second field identifying an input message (and, for example, a location for writing the result); at 504, decoding the instruction into a decoded instruction; at 506, retrieving data associated with the identified source operand; (optionally) at 508, scheduling the decoded instruction for execution; at 510, executing the decoded instruction to: circularly left-shift state element C by 9 bits to form a circularly shifted state element C, and shifting the state element... The state element D is circularly shifted left by 9 bits to form a circularly shifted state element D, the state element G is circularly shifted left by 19 bits to form a circularly shifted state element G, the state element H is circularly shifted left by 19 bits to form a circularly shifted state element H, and (for example, after those circular shifts) two rounds according to the SM3 hash standard are performed on the input message, state element A, state element B, circularly shifted state element C, circularly shifted state element D, state element E, state element F, circularly shifted state element G, and circularly shifted state element H to generate updated state elements A, B, E, and F; and at 512, the executed instruction is committed to store the updated state elements A, B, E, and F into the destination specified by a single instruction.

[0088] The opcode may correspond to (e.g., identify) the vector instruction mnemonic of VSM3RNDS2 (where “V” (optional use) indicates a vector operation (e.g., VEX discussed below), “SM3” indicates that the hash standard is SM3, and “RNDS2” indicates a two-round hash formed by a single instruction (e.g., only).

[0089] In one embodiment, the instruction has the following format for its fields:

[0090] VSM3RNDS2 SOURCE / DESTINATION,SOURCE 1,SOURCE 2

[0091] (VSM3RNDS2 source / destination, source1, source2) / /

[0092] Wherein, SOURCE / DESTINATION is the first compressed data source (e.g., a register) and destination, SOURCE 1 is the second compressed data source (e.g., a register), and SOURCE 2 is the third compressed data source (e.g., it may be a register or a memory address). In one embodiment, each of the registers used is an XMM register (e.g., XMM1, XMM2, etc.), which is a 128-bit XMM register.

[0093] The pseudocode for executing this instruction could be as follows (for example, where dword is a 32-bit double word size for each element; [x] is the element position indexed by x from 0 to n, where n-1 is the total number of elements; << is a circular left shift of a given number of bits (around); >> is a circular right shift of a given number of bits (around); ^ is a logical (e.g., binary) XOR operator; | is a logical (e.g., binary) OR operator that outputs the high bit (1) if any one or two bits in the corresponding bit position are set to high (1); & is a logical (e.g., binary) AND operator; and ? is a conditional operator (e.g., value X if condition is true ? otherwise value Y)):

[0094] / / definition

[0095] #define ROTL32(x,n)(((x)<<(n))^((x)>>(32-(n))))

[0096] #define P0(x)(x^rotl32(x,9)^rotl32(x,17))

[0097] #define P1(x)(x^rotl32(x,15)^rotl32(x,23))

[0098] #define FF0(x,y,z)(x^y^z)

[0099] #define FF1(x,y,z)(((x)&(y))|((x)&(z))|((y)&(z)))

[0100] #define GG0(x,y,z)(x^y^z)

[0101] #define GG1(x,y,z)(((x)&(y))^(~(x)&(z)))

[0102] #define FF(x, y, z, i) (i < 16? FF0(x, y, z) : FF1(x, y, z))

[0103] #define GG(x, y, z, i) (i < 16? GG0(x, y, z) : GG1(x, y, z))

[0104] / / Instruction stream

[0105] A[0] = SRC1.dword[0]

[0106] B[0] = SRC1.dword[1]

[0107] C[0] = SRCDST.dword[0]

[0108] D[0] = SRCDST.dword[1]

[0109] E[0] = SRC1.dword[2]

[0110] F[0] = SRC1.dword[3]

[0111] G[0] = SRCDST.dword[2]

[0112] H[0] = SRCDST.dword[3]

[0113] W[0] = SRC2.dword[0]

[0114] W[1] = SRC2.dword[1]

[0115] W[4] = SRC2.dword[2]

[0116] W[5] = SRC2.dword[3]

[0117] C[0] = ROTL32(C[0], 9)

[0118] D[0] = ROTL32(D[0], 9)

[0119] G[0] = ROTL32(G[0], 19)

[0120] H[0] = ROTL32(H[0], 19)

[0121] CONST = IMM < 16? (0x79cc4519 : 0x7a879d8a);

[0122] CONST = ROTL32(CONST, IMM)

[0123] FOR i in 0 to 1:

[0124] S1=ROTL32((ROTL32(A[i],12)+E[i]+CONST),7)

[0125] S2 = S1^ROTL32(A[i], 12)

[0126] T1=FF(A[i],B[i],C[i],IMM)+D[i]+S2+W[i]^W[i+4]

[0127] T2=GG(E[i],F[i],G[i],IMM)+H[i]+S1+W[i]

[0128] D[i+1] = C[i]

[0129] C[i+1] = ROTL32[B,9]

[0130] B[i+1] = A[i]

[0131] A[i+1]=T1

[0132] H[i+1] = G[i]

[0133] G[i+1] = ROTL32(F[i], 19)

[0134] F[i+1]=E[i]

[0135] E[i+1] = PO(T2)

[0136] SRCDST.dword[0] = A[2]

[0137] SRCDST.dword[1]=B[2]

[0138] SRCDST.dword[2]=E[2]

[0139] SRCDST.dword[3]=F[2]

[0140] Including such cyclic shift operations (underlined in the example above) with a single instruction that also performs the SM3 hash standard (e.g., 2 rounds) improves the performance of the computer (e.g., the computer's processor).

[0141] However, in some embodiments, a cyclic shift (e.g., underlined in the example above) is correct for all rounds (e.g., 64 rounds) of the data block of the input message, with the exception of SM3 hash standards that perform (e.g., underlined in the example above) this cyclic shift and also (e.g., only) two rounds (e.g., as referenced) Figures 5-6The discussion concerns the start and end calls of this single instruction in SM3RNDS2. Therefore, to correct this problem, (for example, as referenced...) Figures 9-10 The pre-circular shift instruction (as discussed) Figure 4B The pre-rotate CDGH instruction at position 403 and the subsequent circular shift instruction (e.g., Figure 4B The post-rotate CDGH at position 417 is added to support the execution (e.g., the underlined example above) of this circular shift and also performs two rounds of the SM3 hash standard (e.g., as referenced). Figures 5-6 The instruction set architecture of the processor with a single instruction (SM3RNDS2) is discussed.

[0142] As an example, each input data block (e.g., 64 bytes of input) uses the circular shift (e.g., underlined in the example above) and also performs two rounds of the SM3 hash standard (e.g., as referenced). Figures 5-6 The 32 calls to a single instruction of the SM3RNDS2 discussed (e.g., requesting decoding / execution, etc.) and the intermediate scheduling instructions (e.g., as referred to below) Figures 11-13 The 13 calls to VSM3MSG1 discussed, and the final scheduling instruction (for example, as referenced below). Figures 14-16 The 13 calls to VSM3MSG2 discussed, and the pre-circular shift instruction (e.g., Figure 4B The pre-rotate CDGH at position 403 (e.g., see reference) Figures 7-8 A single call to (as discussed), and a subsequent circular shift instruction (e.g., Figure 4B Post-rotate CDGH at 417 (e.g., see reference) Figures 9-10 (The one call discussed).

[0143] In one embodiment, there are 13 calls to each of the VSM3MSG1 and VSM3MSG2 instructions for each input data block, because in the first four rounds, the input data message words (e.g., the first 16 message words) are read directly from the input data block. For example, in an embodiment where four words are calculated for each pair of VSM3MSG1 and VSM3MSG2 instructions, and there are a total of 68 words, the first 16 message words are derived from the input data block, and the remaining 52 words are calculated using 13 calls to the VSM3MSG1 and VSM3MSG2 instruction pairs.

[0144] In one embodiment, each element in the input operands is 32 bits wide. See the accompanying figures (e.g., Figure 4-) for details. Figure 23In this process, data can be loaded from registers / memory and stored in registers or memory. In some embodiments, the first compressed data source (input) and the second compressed data source (input) each have the same number of bits. In some embodiments, the resulting compressed data destination (output) has the same number of bits as the first compressed data source (input) or the second compressed data source (input).

[0145] In some embodiments, the VSM3RNDS2 instruction (e.g., its opcode) indicates the above cyclic shift values ​​(e.g., 12 for functions S1 and S2; 9 for underscore functions C[i] and D[i]; 19 for underscore functions G[i] and G[i]; 9 for function C[i+1]; 19 for function G[i+1]; 9 and 17 for function P0; and 15 and 23 for function P1). This improves computer operation because these values ​​are therefore not supplied as operands to those embodiments of the instruction (and therefore, the computer will not utilize the time and energy spent loading those operands).

[0146] In some embodiments, some or all of the data may be accessed in (e.g., system) memory. The values ​​and dimensions of the input and output vectors described herein are also examples, and other values ​​and dimensions may be utilized. Data may be ordered according to either most significant bit order or least significant bit order.

[0147] Figure 6 The diagram illustrates a circuit 600 according to an embodiment of the present disclosure, which includes an execution circuit 610 having a cyclic shift circuit 612 and an SM3 hash wheel circuit 614. In some embodiments, a decoding circuit (e.g., Figure 1 Decoding circuit 102 or Figure 2The decoding circuit 206 decodes the instruction into a decoded instruction that causes the execution circuit 610 to perform a circular shift operation using the circular shift circuit 612 and the SM3 hash wheel circuit 614 (e.g., the decoded instruction instructs the execution circuit 610 to use which components (e.g., here, the circular shift circuit 612 and the SM3 hash wheel circuit 614), the direction(s) of the circular shift, and the values ​​of the circular shift constant and the hash constant). In the depicted embodiment, the instruction format may include one or more fields identifying the first compressed data destination / source 601, the second compressed data source 602, and the third compressed data source 603. In the depicted embodiment, the first compressed data destination / source 601, the second compressed data source 602, and the third compressed data source 603 each include four elements (indexed as 0-3). However, it should be understood that any number of elements or any suitable subset of any number of elements may be used for the (multiple) instructions disclosed herein. In some embodiments, each element in a compressed data source has the same bit width (e.g., one or more bytes) and / or each element in another compressed data source has the same bit width (e.g., one or more bytes).

[0148] In one embodiment, the first compressed data destination / source 601 stores the four-element positions of state elements C, D, G, and H respectively; the second compressed data source 602 stores the four-element positions of state elements A, B, E, and F respectively; and the third compressed data source 603 stores the four-element positions of input message elements W[i], W[i+1], W[i+4], and W[i+5] for each round "i". The input message elements may originate from (multiple) scheduling instructions.

[0149] In some embodiments, the circular shift circuit 612 of the execution circuit 610 performs a circular shift operation on each element as instructed by an instruction (e.g., by an opcode), such that element C of the first element from the first compressed data source 601 is circularly shifted left by 9 bits with a 32-bit granularity, element D of the second element from the first compressed data source 601 is circularly shifted left by 9 bits with a 32-bit granularity, element G of the third element from the first compressed data source 601 is circularly shifted left by 19 bits with a 32-bit granularity, and element H of the fourth element from the first compressed data source 601 is circularly shifted left by 19 bits with a 32-bit granularity. In one embodiment, the circular shift operation is performed on each element in parallel.

[0150] The execution circuit 610 then sends the result of the circular shift from the circular shift circuit 612, along with other operands (e.g., other operands that bypass the circular shift circuit 612), to the SM3 hash wheel circuit 614. In some embodiments, the SM3 hash wheel circuit 614 performs a hash operation (e.g., two rounds as discussed above) on the result of the circular shift from the circular shift circuit 612, state elements A, B, E, and F from the second compact data source 602, and input message elements W[i], W[i+1], W[i+4], and W[i+5] from the third compact data source 603 to generate a two-round hash result (e.g., including updated state elements A, B, E, and F). The compact data hash result (e.g., updated state elements A, B, E, and F) can then be stored in the destination 601 (e.g., submitted for visibility to other instructions).

[0151] Figure 7 The illustration depicts a method 700 for processing a pre-circular shift instruction according to the SM3 hash standard, according to an embodiment of the present disclosure. A processor (or, for example, a processor core) may execute method 700, for example, in response to receiving a request to execute instructions from software. The depicted method 700 includes processing an SM3 hash standard instruction by the following steps: at 702, retrieving a single instruction having an opcode and at least one field indicating that a pre-circular shift according to the SM3 hash standard is to be performed, the at least one field identifying four (e.g., 32-bit) initial state elements C, D, G, and H (and, for example, a position for writing the result) for the initial round of a data block according to the SM3 hash standard (e.g., for being entered into the single instruction VSM3RNDS2 in a supposedly correct format); at 704, decoding the instruction into a decoded instruction; at 706, retrieving data associated with the identified source operand; (optionally) in At 708, the decoded instruction is scheduled for execution; at 710, the decoded instruction is executed to: circularly shift the initial state element C 9 bits to the right to form the pre-circular shifted state element C, circularly shift the initial state element D 9 bits to the right to form the pre-circular shifted state element D, circularly shift the initial state element G 19 bits to the right to form the pre-circular shifted state element G, and circularly shift the initial state element H 19 bits to the right to form the pre-circular shifted state element H; and at 712, the executed instruction is committed to store the pre-circular shifted state elements C, D, G, and H into the location specified by a single instruction.

[0152] The opcode may correspond to (e.g., identify) the vector instruction mnemonic of PREROTATESM3 (e.g., where “PREROTATESM3” represents the pre-circular shift (e.g., reverse circular shift) state elements C, D, G, and H according to the SM3 hash standard).

[0153] In one embodiment, the instruction has the following format for its fields:

[0154] PREROTATESM3 SOURCE / DESTINATION

[0155] (PREROTATESM3 source / destination) / /

[0156] Here, SOURCE / DESTINATION is the first compressed data source (e.g., a register) and destination. In one embodiment, each SOURCE / DESTINATION is a register (e.g., an XMM register).

[0157] Therefore, such embodiments of the pre-cyclic shift instruction provide data that, when input to perform (e.g., underlined in the example above) the cyclic shift and also perform two rounds of the SM3 hash standard (e.g., as referenced...). Figures 5-6 In a single instruction of the SM3RNDS2 discussed herein, the correct output is produced for the first of a plurality of rounds used for the input message. In one embodiment, the width of each element in the input operands is 32 bits. See the accompanying figures (e.g., Figure 4-) Figure 23 In this process, data can be loaded from registers / memory and stored in registers or memory. In some embodiments, the first compressed data source (input) and the second compressed data source (input) each have the same number of bits. In some embodiments, the resulting compressed data destination (output) has the same number of bits as the first compressed data source (input) or the second compressed data source (input).

[0158] In some embodiments, some or all of the data may be accessed in (e.g., system) memory. The values ​​and dimensions of the input and output vectors described herein are also examples, and other values ​​and dimensions may be utilized. Data may be ordered according to either most significant bit order or least significant bit order.

[0159] Figure 8 The diagram illustrates a circuit 800 according to an embodiment of the present disclosure, which includes an execution circuit 810 having a cyclic shift circuit 812. In some embodiments, a decoding circuit (e.g., Figure 1 Decoding circuit 102 or Figure 2The decoding circuit 206 decodes the instruction into a decoded instruction, which causes the execution circuit 810 to perform a pre-circuit shift operation using the circuit shift circuit 812 for the initial SM3 hash round (e.g., the decoded instruction indicates to the execution circuit 810 which components to use (e.g., here, the circuit shift circuit 812), the direction of the circuit shift(s), and the value of the circuit shift constant). In the depicted embodiment, the instruction format may include one or more fields identifying a first compressed data destination / source 801. In the depicted embodiment, the first compressed data destination / source 801 includes four elements (indexed 0-3). However, it should be understood that any number of elements or any suitable subset of any number of elements may be used for the (multiple) instructions disclosed herein. In some embodiments, each element in the compressed data source has the same bit width (e.g., one or more bytes) and / or each element in each of the other compressed data sources has the same bit width (e.g., one or more bytes).

[0160] In one embodiment, the first compressed data destination / source 801 is a four-element location that stores state elements C, D, G, and H respectively. Input message elements may originate from (multiple) scheduling instructions.

[0161] In some embodiments, the cyclic shift circuit 812 of the execution circuit 810 performs a pre-cyclic shift operation on each element as instructed by an instruction (e.g., by an opcode), such that element C of the first element from the first compressed data source 801 is cyclically shifted right by 9 bits with a 32-bit granularity, element D of the second element from the first compressed data source 801 is cyclically shifted right by 9 bits with a 32-bit granularity, element G of the third element from the first compressed data source 801 is cyclically shifted right by 19 bits with a 32-bit granularity, and element H of the fourth element from the first compressed data source 801 is cyclically shifted right by 19 bits with a 32-bit granularity. In one embodiment, the pre-cyclic shift operation is performed on each element in parallel.

[0162] The results of the compressed data pre-circular shift (e.g., the pre-circular shifted state elements C, D, G, and H) can then be stored in destination 801 (e.g., submitted so that they are visible to other instructions (e.g., which include the SM3RNDS2 instruction)).

[0163] Figure 9The illustration depicts a method 900 for processing a post-circular shift instruction according to the SM3 hash standard, according to an embodiment of the present disclosure. A processor (or, for example, a processor core) may execute method 900, for example, in response to receiving a request to execute instructions from software. The depicted method 900 includes processing an SM3 hash standard instruction by the following steps: at 902, retrieving a single instruction having an opcode and at least one field indicating that a post-circular shift according to the SM3 hash standard is to be performed, the at least one field identifying four (e.g., 32-bit) updated state elements C, D, G, and H (e.g., C, D, G, and H from the final round output of a single instruction VSM3RNDS2) for the final round of a data block according to the SM3 hash standard (and, for example, a position for writing the result); at 904, decoding the instruction into a decoded instruction; and at 906, retrieving data associated with the identified source operand. (Optionally) at 908, the decoded instruction is scheduled for execution; at 910, the decoded instruction is executed to: circularly shift the updated state element C to the left by 9 bits to form the final state element C of the data block, circularly shift the updated state element D to the left by 9 bits to form the final state element D of the data block, circularly shift the updated state element G to the left by 19 bits to form the final state element G of the data block, and circularly shift the updated state element H to the left by 19 bits to form the final state element H of the data block; and at 912, the executed instruction is committed to store the final state elements C, D, G, and H into the location specified by a single instruction.

[0164] The opcode may correspond to (e.g., identify) the vector instruction mnemonic of POSTROTATESM3 (e.g., where “POSTROTATESM3” represents the post-circular shift state elements C, D, G, and H according to the SM3 hash standard).

[0165] In one embodiment, the instruction has the following format for its fields:

[0166] POSTROTATESM3 SOURCE / DESTINATION

[0167] (POSTROTATESM3 source / destination) / /

[0168] Here, SOURCE / DESTINATION is the first compressed data element (e.g., a register) and the destination. In one embodiment, each SOURCE / DESTINATION is a register (e.g., an XMM register).

[0169] Therefore, such embodiments of the post-circular shift instruction provide data that, when performing (e.g., underlined in the example above) the circular shift and also performing two rounds of the SM3 hash standard (e.g., as referenced...), provide data that... Figures 5-6 When a single instruction of the SM3RNDS2 discussed above fetches output, it produces the correct output for the last of a plurality of rounds used for the input message. In one embodiment, each element in the input operands is 32 bits wide. See the accompanying figures (e.g., Figure 4-) for details. Figure 23 In this process, data can be loaded from registers / memory and stored in registers or memory. In some embodiments, the first compressed data source (input) and the second compressed data source (input) each have the same number of bits. In some embodiments, the resulting compressed data destination (output) has the same number of bits as the first compressed data source (input) or the second compressed data source (input).

[0170] In some embodiments, some or all of the data may be accessed in (e.g., system) memory. The values ​​and dimensions of the input and output vectors described herein are also examples, and other values ​​and dimensions may be utilized. Data may be ordered according to either most significant bit order or least significant bit order.

[0171] Figure 10 The diagram illustrates a circuit 1000 according to an embodiment of the present disclosure, which includes an execution circuit 1010 having a cyclic shift circuit 1012. In some embodiments, a decoding circuit (e.g., Figure 1 Decoding circuit 102 or Figure 2 The decoding circuit 206 decodes the instruction into a decoded instruction, which causes the execution circuit 1010 to perform a post-circuit shift operation using the circular shift circuit 1012 for the final SM3 hash round (e.g., the decoded instruction indicates to the execution circuit 1010 which components to use (e.g., here, the circular shift circuit 1012), the direction of the circular shift(s), and the value of the circular shift constant). In the depicted embodiment, the instruction format may include one or more fields identifying a first compressed data destination / source 1001. In the depicted embodiment, the first compressed data destination / source 1001 includes four elements (indexed 0-3). However, it should be understood that any number of elements or any suitable subset of any number of elements may be used for the (multiple) instructions disclosed herein. In some embodiments, each element in the compressed data source has the same bit width (e.g., one or more bytes) and / or each element in each of the other compressed data sources has the same bit width (e.g., one or more bytes).

[0172] In one embodiment, the first compressed data destination / source 1001 is a four-element location that stores state elements C, D, G, and H respectively. The input message elements may originate from the SM3RNDS2 instruction.

[0173] In some embodiments, the circular shift circuit 1012 of the execution circuit 1010 performs a post-circular shift operation on each element as instructed by an instruction (e.g., by an opcode), such that element C of the first element from the first compressed data source 1001 is circularly shifted left by 9 bits with a 32-bit granularity, element D of the second element from the first compressed data source 1001 is circularly shifted left by 9 bits with a 32-bit granularity, element G of the third element from the first compressed data source 1001 is circularly shifted left by 19 bits with a 32-bit granularity, and element H of the fourth element from the first compressed data source 1001 is circularly shifted left by 19 bits with a 32-bit granularity. In one embodiment, the post-circular shift operation is performed on each element in parallel.

[0174] The results of the compressed data and the cyclic shift (e.g., the cyclic shifted state elements C, D, G, and H) can then be stored in destination 1001 (e.g., submitted so that they are visible to other instructions).

[0175] For reference Figure 4A and Figure 4B As discussed herein, some embodiments utilize (multiple) scheduling instructions to generate input message elements (e.g., for consumption by SM3RNDS2 instructions). Figures 11-13 An embodiment for intermediate message instructions is described, and Figure 14-16 An example of a final message instruction is described.

[0176] Figure 11The illustration depicts a method 1100 for processing intermediate message instructions according to the SM3 hash standard, according to an embodiment of the present disclosure. A processor (or, for example, a processor core) may execute method 1100, for example, in response to receiving a request to execute instructions from software. The depicted method 1100 includes processing SM3 hash standard instructions by the following steps: at 1102, retrieving a single instruction having an opcode and at least one first field, the opcode indicating to perform intermediate computation for an input message according to the SM3 hash standard, the at least one first field identifying eleven (e.g., 32-bit) message elements W[i], W[i+1], W[i+2], W[i+3], W[i+7], W[i+8], W[i+9], W[i+10], W[i+13], W[i+14], and W[i] for round "i" (e.g., the immediately preceding round) according to the SM3 hash standard. +15] (and, for example, the location for writing the result); at 1104, the instruction is decoded into a decoded instruction; at 1106, the data associated with the identified source operand is retrieved; (optionally) at 1108, the decoded instruction is scheduled for execution; at 1110, the decoded instruction is executed to determine four (e.g., 32-bit) intermediate message elements (e.g., from eleven (e.g., 32-bit) message elements W[i], W[i+1], W[i+2], W[i+3], W[i+7], W[i+8], W[i+9], W[i+10], W[i+13], W[i+14], and W[i+15] Figure 13 X[3], X[2], X[1] and X[0]); and at 1112, submit the executed instruction to store these four intermediate message elements in the location specified by a single instruction.

[0177] The opcode may correspond to (e.g., identify) the vector instruction mnemonic of VSM3MSG1 (e.g., where “V” (optional use) represents a vector operation (e.g., VEX as discussed below), “SM3” indicates that the hash standard is SM3, and “MSG1” represents intermediate message “1” used to generate final message “2” using data from the final message which is used as input to the SM3RNDS2 instruction).

[0178] In one embodiment, the instruction has the following format for its fields:

[0179] VSM3MSG1 SOURCE / DESTINATION,SOURCE 1,SOURCE 2

[0180] (VSM3MSG1 source / destination, source1, source2) / /

[0181] Wherein, SOURCE / DESTINATION is the first compressed data source (e.g., a register) and destination, SOURCE 1 is the second compressed data source (e.g., a register), and SOURCE 2 is the third compressed data source (e.g., it may be a register or a memory address). In one embodiment, each of the registers used is an XMM register (e.g., XMM1, XMM2, etc.), which is a 128-bit XMM register.

[0182] The pseudocode for executing this instruction could be as follows (for example, where dword is a 32-bit double word size for each element; [x] is the element position indexed by x from 0 to n, where n-1 is the total number of elements; << is a circular left shift of a given number of bits (around); >> is a circular right shift of a given number of bits (around); ^ is a logical (e.g., binary) XOR operator; | is a logical (e.g., binary) OR operator that outputs the high bit (1) if any one or two bits in the corresponding bit position are set to high (1); & is a logical (e.g., binary) AND operator; and ? is a conditional operator (e.g., value X if condition is true ? otherwise value Y)):

[0183] / / definition

[0184] #define ROTL32(x,n)(((x)<<(n))^((x)>>(32-(n))))

[0185] #define P1(x)(x^rotl32(x,15)^rotl32(x,23))

[0186] / / Instruction Stream

[0187] W[7] = SRCDST.dword[0]

[0188] W[8] = SRCDST.dword[1]

[0189] W[9] = SRCDST.dword[2]

[0190] W

[10] =SRCDST.dword[3]

[0191] W

[13] = SRC1.dword[0]

[0192] W

[14] = SRC1.dword[1]

[0193] W

[15] = SRC1.dword[2]

[0194] W[0] = SRC2.dword[0]

[0195] W[1] = SRC2.dword[1]

[0196] W[2] = SRC2.dword[2]

[0197] W[3] = SRC2.dword[3]

[0198] TMP3 = W

[10] ^W[3]

[0199] TMP2=W[9]^W[2]^ROTL32(W

[15] ,15)

[0200] TMP1=W[8]^W[1]^ROTL32(W

[14] ,15)

[0201] TMP0=W[7]^W[0]^ROTL32(W

[13] ,15)

[0202] SRCDST.dword[0] = P1(TMP0)

[0203] SRCDST.dword[1] = P1(TMP1)

[0204] SRCDST.dword[2] = P1(TMP2)

[0205] SRCDST.dword[3] = P1(TMP3)

[0206] Figure 12 The diagram illustrates a circuit 1200 according to an embodiment of the present disclosure, which includes an execution circuit 1210 having an intermediate SM3 message calculation circuit 1212. In some embodiments, a decoding circuit (e.g., Figure 1 Decoding circuit 102 or Figure 2The decoding circuit 206 decodes the instruction into a decoded instruction that causes the execution circuit 1210 to perform an SM3 message calculation operation using the intermediate SM3 message calculation circuit 1212 (e.g., the decoded instruction indicates to the execution circuit 1210 which components to use, e.g., the intermediate SM3 message calculation circuit 1212 in this case). In the depicted embodiment, the instruction format may include one or more fields identifying the first compressed data destination / source 1201, the second compressed data source 1202, and the third compressed data source 1203. In the depicted embodiment, the first compressed data destination / source 1201, the second compressed data source 1202, and the third compressed data source 1203 each include four elements (indexed as 0-3). However, it should be understood that any number of elements or any suitable subset of any number of elements may be used for the (multiple) instructions disclosed herein. In some embodiments, each element in a compressed data source has the same bit width (e.g., one or more bytes) and / or each element in another compressed data source has the same bit width (e.g., one or more bytes).

[0207] In one embodiment, the first compressed data destination / source 1201 stores the four-element positions of input message elements W[i+7], W[i+8], W[i+9], and W[i+10], respectively; the second compressed data source 1202 stores the three (or, for example, four, where one element is not used) element positions of input message elements W[i+13], W[i+14], and W[i+15], respectively; and the third compressed data source 1203 stores the four-element positions of input message elements W[i+0], W[i+1], W[i+2], and W[i+3], respectively. Input message elements may originate from input messages (e.g., hashed inputs). Input messages may originate from previous messages (e.g., the previous round relative to the round of the current message being determined).

[0208] In some embodiments, the intermediate SM3 message calculation circuit 1212 of the execution circuit 1210 performs a message generation operation on the input message elements as instructed by an instruction (e.g., by an opcode) to generate a plurality of (e.g., four) intermediate message elements. In one embodiment, the message generation operation is performed on each element in parallel. In one embodiment, the intermediate SM3 message calculation circuit 1212 is Figure 13 An example of intermediate message calculation circuit 1300 in the middle. The compressed data intermediate message results (e.g., X[3], X[2], X[1] and X[0]) can then be stored in destination 1201 (e.g., submitted to be visible to other instructions), for example, for use by the next in the message scheduling instruction pair (e.g., in program order).

[0209] Figure 13The figure illustrates an intermediate SM3 message calculation circuit 1300 according to an embodiment of this disclosure. Note that the element reference format W[x] can be... Figure 13 W in i+x The same applies, where X is an integer and i is the round number. In one embodiment, the first compacted data destination / source 1301 is a four-element location (e.g., a register) storing the input message elements W[i+7], W[i+8], W[i+9], and W[i+10] respectively; the second compacted data source 1202 is a three-element location (e.g., a register) storing the input message elements W[i+13], W[i+14], and W[i+15] respectively; and the third compacted data source 1303 is a four-element location (e.g., a register) storing the input message elements W[i+0], W[i+1], W[i+2], and W[i+3] respectively. The input message elements may originate from an input message (e.g., a hashed input). The input message may originate from a previous message (e.g., the round preceding the current message being determined).

[0210] In the depicted embodiment, as shown, the input message element is routed according to coupling (e.g., lines) to: left (e.g., 15 bits to the left for a 32-bit element size) shifter circuits 1304B-1304D, XOR logic gate circuits 1306A-1306D, and (e.g., for executing the permutation function in function 5 above) permutation function circuits 1308A-1308D. The outputs of the four intermediate message elements (e.g., X[0], X[1], X[2], and X[3]) from the intermediate SM3 message calculation circuit 1300 can then be stored in the first compressed data destination / source 1301. The logic gate circuits can be implemented using positive or negative logic gates.

[0211] Figure 14The illustration depicts a method 1400 for processing a final message instruction according to the SM3 hash standard, based on an embodiment of the present disclosure. The final message instruction may (e.g., in program order) follow an intermediate message instruction that is providing its output as input to the final message instruction. A processor (or, for example, a processor core) may execute method 1400, for example, in response to receiving a request to execute instructions from software. The described method 1400 includes processing SM3 hash standard instructions by means of the following steps: at 1402, a single instruction is retrieved, which has an opcode and at least one first field indicating that a final computation for an input message according to the SM3 hash standard is to be performed, the at least one first field identifying twelve (e.g., 32-bit) message elements W[i+3], W[i+4], W[i+5], W[i+6], W[i+10], W[i+11], W[i+12], W[i+13], and four intermediate message elements from intermediate computations (e.g., from instruction VSM3MSG1) for rounds according to the SM3 hash standard (and, for example, for writing) At 1404, the instruction is decoded into a decoded instruction; at 1406, the data associated with the identified source operand is retrieved; (optionally) at 1408, the decoded instruction is scheduled for execution; at 1410, the decoded instruction is executed to determine four (e.g., 32-bit) final message elements from twelve (e.g., 32-bit) message elements W[i+3], W[i+4], W[i+5], W[i+6], W[i+10], W[i+11], W[i+12], W[i+13] and four intermediate message elements from intermediate computation; and at 1412, these four final message elements are stored in the location specified by a single instruction.

[0212] The opcode may correspond to (e.g., identify) the vector instruction mnemonic of VSM3MSG2 (e.g., where “V” (optional use) represents a vector operation (e.g., VEX discussed below), “SM3” indicates that the hash standard is SM3, and “MSG2” represents the final message “2” generated from the intermediate message “1” using data from the final message used as input to the SM3RNDS2 instruction).

[0213] In one embodiment, the instruction has the following format for its fields:

[0214] VSM3MSG2 SOURCE / DESTINATION,SOURCE 1,SOURCE 2

[0215] (VSM3MSG2 source / destination, source1, source2) / /

[0216] Wherein, SOURCE / DESTINATION is the first compressed data source (e.g., a register) and destination, SOURCE 1 is the second compressed data source (e.g., a register), and SOURCE 2 is the third compressed data source (e.g., it may be a register or a memory address). In one embodiment, each of the registers used is an XMM register (e.g., XMM1, XMM2, etc.), which is a 128-bit XMM register.

[0217] The pseudocode for executing this instruction could be as follows (for example, where dword is a 32-bit double word size for each element; [x] is the element position indexed by x from 0 to n, where n-1 is the total number of elements; << is a circular left shift of a given number of bits (around); >> is a circular right shift of a given number of bits (around); ^ is a logical (e.g., binary) XOR operator; | is a logical (e.g., binary) OR operator that outputs the high bit (1) if any one or two bits in the corresponding bit position are set to high (1); & is a logical (e.g., binary) AND operator; and ? is a conditional operator (e.g., value X if condition is true ? otherwise value Y)):

[0218] / / definition

[0219] #define ROTL32(x,n)(((x)<<(n))^((x)>>(32-(n))))

[0220] / / Instruction Stream

[0221] WTMP[0] = SRCDST.dword[0]

[0222] WTMP[1] = SRCDST.dword[1]

[0223] WTMP[2] = SRCDST.dword[2]

[0224] WTMP[3] = SRCDST.dword[3]

[0225] W[3] = SRC1.dword[0]

[0226] W[4] = SRC1.dword[1]

[0227] W[5] = SRC1.dword[2]

[0228] W[6] = SRC1.dword[3]

[0229] W

[10] = SRC2.dword[0]

[0230] W

[11] = SRC2.dword[1]

[0231] W

[12] = SRC2.dword[2]

[0232] W

[13] = SRC2.dword[3]

[0233] W

[16] =(ROTL32(W[3],7)^W

[10] ^WTMP[0]

[0234] W

[17] =(ROTL32(W[4],7)^W

[11] ^WTMP[1]

[0235] W

[18] =(ROTL32(W[5],7)^W

[12] ^WTMP[2]

[0236] W

[19] =(ROTL32(W[6],7)^W

[13] ^WTMP[3]

[0237] W

[19] =(W

[19] ^ROTL32(W

[16] ,6)^ROTL32(W

[16] ,15)^ROTL32(W

[16] ,30))

[0238] SRCDST.dword[0] = W

[16]

[0239] SRCDST.dword[1] = W

[17]

[0240] SRCDST.dword[2] = W

[18]

[0241] SRCDST.dword[3] = W

[19]

[0242] Figure 15 The diagram illustrates a circuit 1500 according to an embodiment of the present disclosure, which includes an execution circuit 1510 having a final SM3 message calculation circuit 1512. In some embodiments, a decoding circuit (e.g., Figure 1 Decoding circuit 102 or Figure 2The decoding circuit 206 decodes the instruction into a decoded instruction that causes the execution circuit 1510 to perform an SM3 message calculation operation using the final SM3 message calculation circuit 1512 (e.g., the decoded instruction indicates to the execution circuit 1510 which components to use, e.g., the final SM3 message calculation circuit 1512 in this case). In the depicted embodiment, the instruction format may include one or more fields identifying the first compressed data destination / source 1501, the second compressed data source 1502, and the third compressed data source 1503. In the depicted embodiment, the first compressed data destination / source 1501, the second compressed data source 1502, and the third compressed data source 1503 each include four elements (indexed as 0-3). However, it should be understood that any number of elements or any suitable subset of any number of elements may be used for the (multiple) instructions disclosed herein. In some embodiments, each element in a compressed data source has the same bit width (e.g., one or more bytes) and / or each element in another compressed data source has the same bit width (e.g., one or more bytes).

[0243] In one embodiment, a first compressed data destination / source 1501 stores the four-element positions of intermediate message elements (e.g., X[0], X[1], X[2], and X[3]) from an intermediate SM3 message computation instruction (e.g., VSM3MSG1), a second compressed data source 1502 stores the four-element positions of input message elements W[i+3], W[i+4], W[i+5], and W[i+6], and a third compressed data source 1503 stores the four-element positions of input message elements W[i+10], W[i+11], W[i+12], and W[i+13]. Input message elements may originate from input messages (e.g., hash inputs) and previous intermediate SM3 message computation instructions (e.g., VSM3MSG1). Input messages may originate from previous messages (e.g., the previous round relative to the round of the current message being determined).

[0244] In some embodiments, the final SM3 message calculation circuit 1512 of the execution circuit 1510 performs a message generation operation on the input message elements and intermediate message elements as instructed by instructions (e.g., by opcodes) to generate a plurality of (e.g., four) final message elements. In one embodiment, the message generation operation is performed on each element in parallel. In one embodiment, the final SM3 message calculation circuit 1512 is Figure 16An example of the final message calculation circuit 1600 in the process. The compressed data final message result (e.g., W[i+16], W[i+17], W[i+18], and W[i+19]) can then be stored in destination 1501 (e.g., submitted to be visible to other instructions), for example, for use by the next instruction in the message scheduling pair (e.g., in program order).

[0245] Figure 16 The diagram illustrates the final SM3 message calculation circuit 1600 according to an embodiment of this disclosure. Note that the element reference format W[x] can be... Figure 16 W in i+x The same applies, where X is an integer and i is a round number. In one embodiment, the first compact data destination / source 1601 is a four-element location (e.g., a register) storing intermediate message elements (e.g., X[0], X[1], X[2], and X[3] from intermediate SM3 message calculation instructions), the second compact data source 1202 is a four-element location (e.g., a register) storing input message elements W[i+3], W[i+4], W[i+5], and W[i+6], respectively, and the third compact data source 1603 is a four-element location (e.g., a register) storing input message elements W[i+10], W[i+11], W[i+12], and W[i+13], respectively. Input message elements may originate from input messages (e.g., hash inputs). Input message elements may originate from input messages (e.g., hash inputs) and previous intermediate SM3 message calculation instructions (e.g., VSM3MSG1). Input messages can come from previous messages (e.g., the previous round relative to the current round being determined).

[0246] In the depicted embodiment, as shown, the input message element is routed according to coupling (e.g., lines) to: left (e.g., 7 bits left for a 32-bit element size) shifter circuits 1604B-1604D, left (e.g., 6 bits left for a 32-bit element size) shifter circuit 1608A, left (e.g., 15 bits left for a 32-bit element size) shifter circuit 1608B, left (e.g., 30 bits left for a 32-bit element size) shifter circuit 1608C, XOR logic gate circuit 1610, and XOR logic gate circuit 1612. The outputs of the four final message elements W[i+16], W[i+17], W[i+18], and W[i+19] from the final SM3 message calculation circuit 1600 can then be stored in the first compressed data destination / source 1601 (e.g., for use as input to the SM3RNDS2 instruction). The logic gates can be implemented using positive or negative logic gates.

[0247] In some embodiments, the execution circuitry includes circuitry for both the SM3 hash standard and the SHA512 hash standard.

[0248] Instructions for the SHA512 hash standard

[0249] Figure 17 The diagram illustrates an SHA512 hash circuit 1700 according to an embodiment of this disclosure. Circuits (e.g., as execution circuitry for SHA512 hash instructions) for each of Ch(x,y,z), Maj(x,y,z), Σ0, Σ1 (as defined below) implement various compression functions defined according to the SHA512 (i.e., SHA-512) specification, and each state (e.g., state vector AH) is initialized with a corresponding 64-bit (e.g., non-32-bit) initial value, and Wi (i = 0 to 79 (e.g., not 63)) is a (e.g., 64-bit) value derived from a (e.g., 1024-bit) message. Kt in constant storage 1706 represents a constant value of iteration t to be used for hash computation. In the following text, “∧” represents a bitwise AND operation. It is a bitwise XOR (exclusive OR) operation. It's a two's complement operation (for example, it changes 1 to 0 and 0 to 1), ROTR n Indicates a circular right shift of "n" bits (e.g., a circular shift around), and SHR n Indicates a right shift of "n" bits (e.g., a non-wrap shift). A circuit depicted as a square with a plus sign is an adder circuit that modulo (e.g., modulo 2) the corresponding addend of a given value. 32 or modulo 2 64 Adding them together produces their corresponding sums.

[0250]

[0251]

[0252]

[0253]

[0254]

[0255]

[0256] In some embodiments, (e.g., at 1702) intermediate message instructions (e.g., VSHA512MSG1) and final message instructions (e.g., VSHA512MSG2) according to the SHA512 hash standard are executed to provide (e.g., for one or two rounds of hashing) an input message, and the input message is stored, for example, in storage 1704. In some embodiments, execution circuitry 1708 (e.g., via decoding and executing the VSHA512RNDS2 instruction at 1710) generates two rounds (or one round in another embodiment) of updated state elements (e.g., updated state elements A, B, E, and F). The updated state elements can then be used by hashing circuitry 1700 to generate (e.g., 512-bit) SHA512 message digests (e.g., signatures) (e.g., message digests generated after 80 rounds of hashing of the input block).

[0257] In some embodiments, the VSHA512RNDS2 executes (e.g., its opcodes) the above cyclic shift values ​​and shift values ​​(e.g., 28, 34, and 39 for function 9; 14, 18, and 41 for function 10; 1, 8, and 7 for function 11; and 19, 61, and 6 for function 12). This improves computer operation because these values ​​are therefore not supplied as operands to the instructions in those embodiments (and thus the computer will not utilize the time and energy spent loading those operands).

[0258] In one embodiment, the SHA384 hash standard is the same as the SHA-512 hash standard, except that the initial hash values ​​h0 to h7 are different (e.g., taken from the ninth to the sixteenth prime numbers), and the output is constructed by ignoring h6 and h7.

[0259] Figure 18The illustration depicts a method 1800 for processing hash (e.g., round) instructions according to the SHA512 hash standard, according to an embodiment of the present disclosure. A processor (or, for example, a processor core) may execute method 1800, for example, in response to receiving a request to execute instructions from software. The depicted method 1800 includes processing SHA512 hash standard instructions by the following steps: at 1802, retrieving a single instruction having an opcode, at least one first field, and at least one second field (and, for example, a field indicating the location for writing the result), the opcode indicating to perform a two-round hash according to the SHA512 hash standard, the at least one first field identifying eight (e.g., 64-bit) state elements (e.g., work variables) A, B, C, D, E, F, G, and H for the round according to the SHA512 hash standard, the at least one second field identifying (e.g., message scheduling) an input message; at 1804, decoding the instruction into a decoded... The instructions are as follows: at 1806, data associated with the identified source operand is retrieved; (optionally) at 1808, the decoded instructions are scheduled for execution; at 1810, the decoded instructions are executed to perform two rounds of hashing according to the SHA512 standard on the input message and state elements A, B, C, D, E, F, G, and H, thereby generating updated state elements A, B, E, and F; and at 1812, the executed instructions are committed to store the updated state elements A, B, E, and F in the location specified by a single instruction.

[0260] The opcode may correspond to (e.g., identify) the vector instruction mnemonic of VSHA512RNDS2 (where “V” (optional use) indicates a vector operation (e.g., VEX discussed below), “SHA512” indicates that the hash standard is SHA512, and “RNDS2” indicates a hash formed by a single instruction (e.g., only) two rounds).

[0261] In one embodiment, the instruction has the following format for its fields:

[0262] VSHA512RNDS2 SOURCE / DESTINATION,SOURCE 1,SOURCE 2

[0263] VSHA512RNDS2 source / destination, source1, source2 / /

[0264] Wherein, SOURCE / DESTINATION is the first compressed data source (e.g., a register) and destination, SOURCE 1 is the second compressed data source (e.g., a register), and SOURCE 2 is the third compressed data source (e.g., it may be a register or a memory address). In one embodiment, each of the registers used is a (e.g., a 256-bit) YMM register (e.g., YMM1, YMM2, etc.). The memory address may be a reference to 256 bits of data, for example, referred to as "m256".

[0265] The pseudocode for executing this instruction could be as follows (for example, where qword is a 64-bit four-word size for each element; [x] is the element position indexed by x from 0 to n, where n-1 is the total number of elements; << is a circular left shift of a given number of bits (around); >> is a circular right shift of a given number of bits (around); ^ is a logical (e.g., binary) XOR operator; | is a logical (e.g., binary) OR operator that outputs the high bit (1) if any one or two bits in the corresponding bit position are set to high (1); & is a logical (e.g., binary) AND operator; and ? is a conditional operator (e.g., value X if condition is true ? otherwise value Y)):

[0266] / / definition

[0267] #define ROL64(x,n)(((x)<<(n))^((x)>>(64-(n))))

[0268] #define ROR64(x,n)(((x)>>(n))^((x)<<(64-(n))))

[0269] #define SHR64(x,n)((x)>>(n))

[0270] #define S0(a)(ROR64(a,28)^ROR64(a,34)^ROR64(a,39))

[0271] #define S1(e)(ROR64(e,14)^ROR64(e,18)^ROR64(e,41))

[0272] #define MAJ(a,b,c)(((a)&(b))^((a)&(c))^((b)&(c)))

[0273] #define CH(e,f,g)(((e)&(f))^((g)&~(e)))

[0274] / / Instruction stream

[0275] A[0]:=SRC1.qword[3]

[0276] B[0]:=SRC1.qword[2]

[0277] C[0]:=SRCDST.qword[3]

[0278] D[0]:=SRCDST.qword[2]

[0279] E[0]:=SRC1.qword[1]

[0280] F[0]:=SRC1.qword[0]

[0281] G[0]:=SRCDST.qword[1]

[0282] H[0]:=SRCDST.qword[0]

[0283] WK[0]:=SRC2.qword[0]

[0284] WK[1]:=SRC2.qword[1]

[0285] FOR i in 0 to 1:

[0286] A[i + 1]:=CH(E[i], F[i], G[i]) + S1(E[i]) + WK[i] + H[i] + MAJ(A[i], B[i], C[i]) + S0(A[i])

[0287] B[i + 1]:=A[i]

[0288] C[i + 1]:=B[i]

[0289] D[i + 1]:=C[i]

[0290] E[i + 1]:=CH(E[i], F[i], G[i]) + S1(E[i]) + WK[i] + H[i] + D[i]

[0291] F[i + 1]:=E[i]

[0292] G[i + 1]:=F[i]

[0293] H[i + 1]:=G[i]

[0294] SRCDST.qword[3]=A[2]

[0295] SRCDST.qword[2]=B[2]

[0296] SRCDST.qword[1]=E[2]

[0297] SRCDST.qword[0]=F[2]

[0298] In some embodiments, VSHA512RNDS2 performs (e.g., only) two rounds of SHA512 operations using an initial SHA512 state (C, D, G, H) from a first operand, an initial SHA512 state (A, B, E, F) from a second operand, and a pre-computed sum of the next two round message four-words and corresponding round constants (e.g., from the implicit operand xmm0). In one embodiment, only the two lower four-words of xmm0 are instructed to be used. In some embodiments, the updated SHA512 state (A, B, E, F) is written to the first operand, and the second operand can be used as the updated state (C, D, G, H) in a later round.

[0299] Figure 19 The diagram illustrates a circuit 1900 according to an embodiment of the present disclosure, which includes an execution circuit 1910 having an SHA512 hash wheel circuit 1912. In some embodiments, the decoding circuit (e.g., Figure 1 Decoding circuit 102 or Figure 2 The decoding circuit 206 decodes the instruction into a decoded instruction that causes the execution circuit 1910 to perform a hash operation using the SHA512 hash wheel circuit 1912 (e.g., the decoded instruction instructs the execution circuit 1910 to use which components (e.g., in this case, the SHA512 hash wheel circuit), the direction(s) of the cyclic shift(s), and the values ​​of the cyclic shift constant and the shift constant). In the depicted embodiment, the instruction format may include one or more fields identifying the first compressed data destination / source 1901, the second compressed data source 1902, and the third compressed data source 1903. In the depicted embodiment, the first compressed data destination / source 1901, the second compressed data source 1902, and the third compressed data source 1903 each include four elements (indexed as 0-3). However, it should be understood that any number of elements or any suitable subset of any number of elements may be used for the (multiple) instructions disclosed herein. In some embodiments, each element in a compressed data source has the same bit width (e.g., one or more bytes) and / or each element in another compressed data source has the same bit width (e.g., one or more bytes).

[0300] In one embodiment, the first compressed data destination / source 1901 is a four-element position storing state elements C, D, G, and H respectively; the second compressed data source 1902 is a four-element position storing state elements A, B, E, and F respectively; and the third compressed data source 1903 is a two-element position (e.g., the first two elements of the four-element position) storing input message elements (e.g., each element is a pre-computed sum of the message elements for the next round "0" and the round after next "1" and the corresponding round constant) respectively (e.g., WK[0] and WK[1]), where "WK" refers to W XOR K for a specific round. In one embodiment, WK[i] uses the message word [i] (referred to as "K") XORed with the key constant [i] (referred to as "K") for a specific round [i]. In some embodiments, the message word is a source of either: (1) input to the hash (e.g., for the first 16 words); or (2) the result of computation for other message words (e.g., for the remaining 64 words) (e.g., using VSHA512MSG1 / VSHA512MSG2 instructions). Input state elements (e.g., C, D, G, and H) may originate from (multiple) scheduling instructions.

[0301] In some embodiments, the SHA512 hash round circuit 1914 pre-computes and performs a hash operation (e.g., two rounds as discussed herein) on state elements C, D, G, and H from a first compressed data destination / source 1901, state elements A, B, E, and F from a second compressed data source 1902, and message elements (e.g., 64-bit quadwords) from a third compressed data source 1903 for the next two rounds, and performs the corresponding round constants to generate a two-round hash result (e.g., including updated state elements A, B, E, and F). The compressed data hash result (e.g., updated state elements A, B, E, and F) can then be stored in destination 1901 (e.g., committed to be visible to other instructions).

[0302] Figure 20The illustration depicts a method 2000 for processing intermediate message instructions according to the SHA512 hash standard, according to an embodiment of the present disclosure. A processor (or, for example, a processor core) may execute method 2000, for example, in response to receiving a request to execute instructions from software. The depicted method 2000 includes processing SHA512 hash standard instructions by the following steps: at 2002, retrieving a single instruction having an opcode and at least one first field, the opcode indicating to perform intermediate computation for an input message according to the SHA512 hash standard, the at least one first field identifying five (e.g., 64-bit) message elements W[i+0], W[i+1], W[i+2], W[i+3], and W[i+4] (and, for example, a position for writing the result) for round "i" (e.g., the immediately preceding round) according to the SHA512 hash standard; at 2004 At 2006, the instruction is decoded into a decoded instruction; at 2007, data associated with the identified source operand is retrieved; (optionally) at 2008, the decoded instruction is scheduled for execution; at 2010, the decoded instruction is executed to determine four (e.g., 64-bit) intermediate message elements (where “i” is the round number of another scheduling index) from five (e.g., 64-bit) message elements W[i+0], W[i+1], W[i+2], W[i+3], and W[i+4); and at 2012, the executed instruction is committed to store these four intermediate message elements in the location specified by a single instruction.

[0303] The opcode may correspond to (e.g., identify) the vector instruction mnemonic of VSHA512MSG1 (e.g., where “V” (optional use) represents a vector operation (e.g., VEX discussed below), “SHA512” indicates that the hash standard is SHA512, and “MSG1” represents intermediate message “1” used to generate final message “2” using data from the final message that is used as input to the VSHA512RNDS2 instruction).

[0304] In one embodiment, the instruction has the following format for its fields:

[0305] VSHA512MSG1 SOURCE / DESTINATION,SOURCE 1

[0306] (VSHA512MSG1 source / destination, source1) / /

[0307] Wherein, SOURCE / DESTINATION is the first compressed data source (e.g., a register) and destination, and SOURCE 1 is the second compressed data source (e.g., it may be a register or a memory address). In one embodiment, each of the registers used is a (e.g., a 256-bit) YMM register (e.g., YMM1, YMM2, etc.).

[0308] The pseudocode for executing this instruction could be as follows (for example, where qword is a 64-bit four-word size for each element; [x] is the element position indexed by x from 0 to n, where n-1 is the total number of elements; << is a circular left shift of a given number of bits (around); >> is a circular right shift of a given number of bits (around); ^ is a logical (e.g., binary) XOR operator; | is a logical (e.g., binary) OR operator that outputs the high bit (1) if any one or two bits in the corresponding bit position are set to high (1); & is a logical (e.g., binary) AND operator; and ? is a conditional operator (e.g., value X if condition is true ? otherwise value Y)):

[0309] / / definition

[0310] #define ROL64(x,n)(((x)<<(n))^((x)>>(64-(n))))

[0311] #define ROR64(x,n)(((x)>>(n))^((x)<<(64-(n))))

[0312] #define SHR64(x,n)((x)>>(n))

[0313] #define s0(w)(ROR64(w,1)^ROR64(w,8)^SHR64(w,7))

[0314] / / Instruction Stream

[0315] W[4]:=SRC1.qword[0]

[0316] W[3]:=SRCDST.qword[3]

[0317] W[2]:=SRCDST.qword[2]

[0318] W[1]:=SRCDST.qword[1]

[0319] W[0]:=SRCDST.qword[0]

[0320] SRCDST.qword[3]:=W[3]+s0(W[4])

[0321] SRCDST.qword[2]:=W[2]+s0(W[3])

[0322] SRCDST.qword[1]:=W[1]+s0(W[2])

[0323] SRCDST.qword[0]:=W[0]+s0(W[1])

[0324] In some embodiments, VSHA512MSG1 is one of two SHA512 message scheduling instructions. In some embodiments, the VSHA512MSG1 instruction performs intermediate computations to obtain the next four SHA512 message quads.

[0325] Figure 21 The diagram illustrates a circuit 2100 according to an embodiment of the present disclosure, which includes an execution circuit 2110 having an intermediate SHA512 message calculation circuit 2112. In some embodiments, the decoding circuit (e.g., Figure 1 Decoding circuit 102 or Figure 2 The decoding circuit 206 decodes the instruction into a decoded instruction that causes the execution circuit 2110 to perform a SHA512 message computation operation using the intermediate SHA512 message computation circuit 2112 (e.g., the decoded instruction indicates to the execution circuit 2110 which components to use, e.g., the intermediate SHA512 message computation circuit 2112 in this case). In the depicted embodiments, the instruction format may include one or more fields identifying the first compressed data destination / source 2101 and the second compressed data source 2102. In the depicted embodiments, the first compressed data destination / source 2101 and the second compressed data source 2102 each include four elements (indexed from 0 to 3). However, it should be understood that any number of elements or any suitable subset of any number of elements may be used for the (multiple) instructions disclosed herein. In some embodiments, each element in the compressed data source has the same bit width (e.g., one or more bytes) and / or each element in each of the other compressed data sources has the same bit width (e.g., one or more bytes).

[0326] In one embodiment, the first compressed data destination / source 2101 is a four-element position storing the input message elements W[i], W[i+1], W[2], and W[i+3] respectively, and the second compressed data source 2102 is a one-element position storing the input message element W[i+4] (or, for example, a four-element position where three elements are not used). The input message elements may originate from an input message (e.g., a hashed input). The input message may originate from a previous message (e.g., the previous round relative to the round of the current message being determined).

[0327] In some embodiments, the intermediate SHA512 message calculation circuit 2112 of the execution circuit 2110 performs a message generation operation on the input message elements as instructed by instructions (e.g., by opcodes) to generate multiple (e.g., four) intermediate message elements. In one embodiment, the message generation operation is performed on each element in parallel. The compressed data intermediate message results may be stored in destination 2101 (e.g., submitted to be visible to other instructions), for example, for use by the next in a message scheduling instruction pair (e.g., in program order).

[0328] Figure 22 The illustration depicts a method 2200 for processing a final message instruction according to the SHA512 hash standard, according to an embodiment of the present disclosure. The final message instruction may (e.g., in program order) follow intermediate message instructions that are providing their outputs as input to the final message instruction. A processor (or, for example, a processor core) may execute method 2200, for example, in response to receiving a request to execute instructions from software. The depicted method 2200 includes processing SHA512 hash standard instructions by the following steps: at 2222, retrieving a single instruction having an opcode and at least one first field indicating that a final computation for an input message according to the SHA512 hash standard is to be performed, the at least one first field identifying six (e.g., 64-bit) message elements W[i+14], W[i+15], and four intermediate message elements from the intermediate computations for a round according to the SHA512 hash standard; at 2204, decoding the instruction into a decoded instruction; at 2206... Retrieve data associated with the identified source operand; (optionally) at 2208, schedule the decoded instruction for execution; at 2210, execute the decoded instruction to determine four (e.g., 64-bit) final message elements from six (e.g., 64-bit) message elements W[i+14], W[i+15] and four intermediate message elements from intermediate computation; and at 2212, commit the executed instruction to store the four final messages (e.g., W[i+16], W[i+17], W[i+18] and W[i+19]) into the location specified by a single instruction.

[0329] The opcode may correspond to (e.g., identify) the vector instruction mnemonic of VSHA512MSG2 (e.g., where “V” (optional use) represents a vector operation (e.g., VEX discussed below), “SHA512” indicates that the hash standard is SHA512, and “MSG2” represents the final message “2” generated from the intermediate message “1” using data from the final message used as input to the VSHA512RNDS2 instruction).

[0330] In one embodiment, the instruction has the following format for its fields:

[0331] VSHA512MSG2 SOURCE / DESTINATION,SOURCE 1

[0332] (VSHA512MSG2 source / destination, source1) / /

[0333] Wherein, SOURCE / DESTINATION is the first compressed data source (e.g., a register) and destination, and SOURCE 1 is the second compressed data source (e.g., it may be a register or a memory address). In one embodiment, each of the registers used is a (e.g., a 256-bit) YMM register (e.g., YMM1, YMM2, etc.).

[0334] The pseudocode for executing this instruction could be as follows (for example, where qword is a 62-bit four-word size for each element; [x] is the element position indexed by x from 0 to n, where n-1 is the total number of elements; << is a circular left shift of a given number of bits (around); >> is a circular right shift of a given number of bits (around); ^ is a logical (e.g., binary) XOR operator; | is a logical (e.g., binary) OR operator that outputs the high bit (1) if any one or two bits in the corresponding bit position are set to high (1); & is a logical (e.g., binary) AND operator; and ? is a conditional operator (e.g., value X if condition is true ? otherwise value Y)):

[0335] / / definition

[0336] #define ROL64(x,n)(((x)<<(n))^((x)>>(64-(n))))

[0337] #define ROR64(x,n)(((x)>>(n))^((x)<<(64-(n))))

[0338] #define SHR64(x,n)((x)>>(n))

[0339] #define s1(w)(ROR64(w,19)^ROR64(w,61)^SHR64(w,6))

[0340] / / Instruction Stream

[0341] W

[14] :=SRC1.qword[2]

[0342] W

[15] :=SRC1.qword[3]

[0343] W

[16] :=SRCDST.qword[0]+s1(W

[14] )

[0344] W

[17] :=SRCDST.qword[1]+s1(W

[15] )

[0345] W

[18] :=SRCDST.qword[2]+s1(W

[16] )

[0346] W

[19] :=SRCDST.qword[3]+s1(W

[17] )

[0347] SRCDST.qword[3]:=W

[19]

[0348] SRCDST.qword[2]:=W

[18]

[0349] SRCDST.qword[1]:=W

[17]

[0350] SRCDST.qword[0]:=W

[16]

[0351] In some embodiments, VSHA512MSG2 is one of two SHA512 message scheduling instructions. In some embodiments, the VSHA512MSG2 instruction performs a final computation to obtain the next four SHA512 message quads.

[0352] Figure 23 The diagram illustrates a circuit 2300 according to an embodiment of the present disclosure, which includes an execution circuit 2310 having an intermediate SHA512 message calculation circuit 2312. In some embodiments, the decoding circuit (e.g., Figure 1 Decoding circuit 102 or Figure 2The decoding circuit 206 decodes the instruction into a decoded instruction that causes the execution circuit 2310 to perform a SHA512 message computation operation using the final SHA512 message computation circuit 2312 (e.g., the decoded instruction indicates to the execution circuit 2310 which components to use, e.g., the final SHA512 message computation circuit 2312 in this case). In the depicted embodiments, the instruction format may include one or more fields identifying the first compressed data destination / source 2301 and the second compressed data source 2302. In the depicted embodiments, the first compressed data destination / source 2301 and the second compressed data source 2302 each include four elements (indexed 0-3). However, it should be understood that any number of elements or any suitable subset of any number of elements may be used for the (multiple) instructions disclosed herein. In some embodiments, each element in the compressed data source has the same bit width (e.g., one or more bytes) and / or each element in each of the other compressed data sources has the same bit width (e.g., one or more bytes).

[0353] In one embodiment, the first compressed data destination / source 2301 stores four-element positions of intermediate message elements from intermediate SHA512 message computation instructions (e.g., VSHA512MSG1), and the second compressed data source 2302 stores two-element positions (or, for example, four-element positions, where two elements are not utilized) of input message elements W[i+14] and W[i+15]. The input message elements may originate from an input message (e.g., a hash input) and a previous intermediate SHA512 message computation instruction (e.g., VSHA512MSG1). The input message may come from a previous message (e.g., the previous round relative to the round of the current message being determined).

[0354] In some embodiments, the final SHA512 message calculation circuit 2312 of the execution circuit 2310 performs a message generation operation on the input message elements and intermediate message elements as instructed by instructions (e.g., by opcodes) to generate multiple (e.g., four) final message elements. In one embodiment, the message generation operation is performed on each element in parallel. The compressed data final message results (e.g., W[i+16], W[i+17], W[i+18], and W[i+19]) can then be stored in destination 2301 (e.g., submitted to be visible to other instructions), for example, for use by the next in a message scheduling instruction pair (e.g., in program order).

[0355] At least some embodiments of the disclosed technology can be described with reference to the following examples:

[0356] Example 1: A processor includes: a decoding circuit for decoding a single instruction into a decoded single instruction, the single instruction including at least one first field and at least one second field, the at least one first field identifying eight 32-bit state elements A, B, C, D, E, F, G, and H for rounds according to the SM3 hash standard, the at least one second field identifying an input message; and an execution circuit for executing the decoded instruction to: circularly shift state element C left by 9 bits to form a circularly shifted state element C; circularly shift state element D left by 9 bits to form a circularly shifted state element D; and circularly shift state element G left by 9 bits. Shift by 19 bits to form a circularly shifted state element G; circularly shift state element H left by 19 bits to form a circularly shifted state element H; perform two rounds according to the SM3 hash standard on the input message and state elements A, B, C, D, E, F, G, and H to generate updated state elements A, B, E, and F; and store the updated state elements A, B, E, and F in the location specified by a single instruction.

[0357] Example 2: The processor of Example 1, wherein at least one first field includes: a first register field that identifies a first register storing state elements C, D, G and H; and a second register field that identifies a second register storing state elements A, B, E and F.

[0358] Example 3: A processor as in Example 2, wherein at least one second field includes a third register field that identifies an input message.

[0359] Example 4: The processor as in Example 3, wherein the input message is four 32-bit message elements at the zeroth, first, fourth, and fifth element positions of the input message from sixteen 32-bit message elements.

[0360] Example 5: A processor as in Example 2, wherein the location specified by a single instruction for storing updated state element A, updated state element B, updated state element E, and updated state element F is the first register.

[0361] Example 6: A processor as in Example 1, wherein: a decoding circuit is configured to decode a second instruction into a decoded second instruction, the second instruction including at least one field identifying four 32-bit initial state elements C, D, G, and H for the initial round of a data block according to the SM3 hash standard; and an execution circuit is configured to execute the decoded second instruction to: circularly right-shift initial state element C by 9 bits to form state element C; circularly right-shift initial state element D by 9 bits to form state element D; circularly right-shift initial state element G by 19 bits to form state element G; circularly right-shift initial state element H by 19 bits to form state element H; and store state elements C, D, G, and H in a location specified by at least one first field of a single instruction.

[0362] Example 7: A processor similar to that in Example 6, where the location is the first register.

[0363] Example 8: A processor as in Example 1, wherein: a decoding circuit is configured to decode a second instruction into a decoded second instruction comprising at least one field identifying updated state elements C, D, G, and H of the final round of a data block generated from a single instruction according to the SM3 hash standard; and an execution circuit is configured to execute the decoded second instruction to: circularly shift the updated state element C left by 9 bits to form the final state element C of the data block; circularly shift the updated state element D left by 9 bits to form the final state element D of the data block; circularly shift the updated state element G left by 19 bits to form the final state element G of the data block; circularly shift the updated state element H left by 19 bits to form the final state element H of the data block; and store the final state elements C, D, G, and H in the positions specified by at least one field of the second instruction.

[0364] Example 9: A method comprising: decoding a single instruction into a decoded single instruction using a processor's decoding circuitry, the single instruction including at least one first field and at least one second field, the at least one first field identifying eight 32-bit state elements A, B, C, D, E, F, G, and H for a round according to the SM3 hash standard, the at least one second field identifying an input message; and executing the decoded single instruction using the processor's execution circuitry to: circularly left-shift state element C by 9 bits to form a circularly shifted state element C; circularly left-shift state element D by 9 bits to form a circularly shifted state element D; and then executing the decoded single instruction to: circularly left-shift state element C ... Shift state element G left by 19 bits to form a circularly shifted state element G; Shift state element H left by 19 bits to form a circularly shifted state element H; Perform two rounds of hashing according to the SM3 hash standard on the input message and state elements A, B, C, D, E, F, G, and H to generate updated state elements A, B, E, and F; and store the updated state elements A, B, E, and F in the location specified by a single instruction.

[0365] Example 10: The method of Example 9, wherein at least one first field includes: a first register field that identifies a first register storing state elements C, D, G and H; and a second register field that identifies a second register storing state elements A, B, E and F.

[0366] Example 11: The method of Example 10, wherein at least one second field includes a third register field that identifies the input message.

[0367] Example 12: The method of Example 11, wherein the input message is four 32-bit message elements at the zeroth, first, fourth, and fifth element positions of the input message from sixteen 32-bit message elements.

[0368] Example 13: As in Example 10, the location specified by a single instruction for storing the updated state element A, updated state element B, updated state element E, and updated state element F is the first register.

[0369] Example 14: The method of Example 9 further includes: decoding a second instruction into a decoded second instruction using a decoding circuit, the second instruction including at least one field identifying four 32-bit initial state elements C, D, G, and H for the initial round of a data block according to the SM3 hash standard; and executing the decoded second instruction using an execution circuit to: circularly right-shift initial state element C by 9 bits to form state element C; circularly right-shift initial state element D by 9 bits to form state element D; circularly right-shift initial state element G by 19 bits to form state element G; circularly right-shift initial state element H by 19 bits to form state element H; and storing state elements C, D, G, and H in a location specified by at least one first field of a single instruction.

[0370] Example 15: The method of Example 14 further includes: repeatedly decoding and executing a single instruction for multiple rounds of data blocks according to the SM3 hash standard.

[0371] Example 16: The method of Example 15 further includes: decoding a third instruction into a decoded third instruction using a decoding circuit, the third instruction including at least one field identifying an updated state element C, an updated state element D, an updated state element G, and an updated state element H of a plurality of rounds of data blocks generated from a single instruction according to the SM3 hash standard; and executing the third instruction using an execution circuit to: circularly shift the updated state element C left by 9 bits to form the final state element C of the data block; circularly shift the updated state element D left by 9 bits to form the final state element D of the data block; circularly shift the updated state element G left by 19 bits to form the final state element G of the data block; circularly shift the updated state element H left by 19 bits to form the final state element H of the data block; and storing the final state elements C, D, G, and H in a location specified by at least one field of the third instruction.

[0372] Example 17: A non-transitory machine-readable medium storing code that, when executed by a machine, causes the machine to perform a method comprising the steps of: decoding a single instruction into a decoded single instruction using a processor's decoding circuitry, the single instruction comprising at least one first field and at least one second field, the at least one first field identifying eight 32-bit state elements A, B, C, D, E, F, G, and H for a round according to the SM3 hash standard, the at least one second field identifying an input message; and executing the decoded single instruction using a processor's execution circuitry to: circularly shift state element C left by 9 bits to form a circularly shifted state element C; circularly shift state element D left by 9 bits to form a circularly shifted state element C; and ... Form a circularly shifted state element D; circularly shift state element G left by 19 bits to form a circularly shifted state element G; circularly shift state element H left by 19 bits to form a circularly shifted state element H; perform two rounds according to the SM3 hash standard on the input message and state elements A, B, C, D, E, F, G, and H to generate updated state elements A, B, E, and F; and store the updated state elements A, B, E, and F in the location specified by a single instruction.

[0373] Example 18: A non-transitory machine-readable medium as in Example 17, wherein at least one first field includes: a first register field that identifies a first register storing state elements C, D, G, and H; and a second register field that identifies a second register storing state elements A, B, E, and F.

[0374] Example 19: A non-transitory machine-readable medium as in Example 18, wherein at least one second field includes a third register field that identifies an input message.

[0375] Example 20: A non-transient machine-readable medium as in Example 19, wherein the input message is four 32-bit message elements at the zeroth, first, fourth, and fifth element positions of the input message from sixteen 32-bit message elements.

[0376] Example 21: A non-transitory machine-readable medium as in Example 18, wherein the location specified by a single instruction for storing updated state element A, updated state element B, updated state element E, and updated state element F is the first register.

[0377] Example 22: A non-transitory machine-readable medium as in Example 17, further comprising: decoding a second instruction into a decoded second instruction using decoding circuitry, the second instruction including at least one field identifying four 32-bit initial state elements C, D, G, and H for an initial round of a data block according to the SM3 hash standard; and executing the decoded second instruction using execution circuitry to: circularly right-shift initial state element C by 9 bits to form state element C; circularly right-shift initial state element D by 9 bits to form state element D; circularly right-shift initial state element G by 19 bits to form state element G; circularly right-shift initial state element H by 19 bits to form state element H; and storing state elements C, D, G, and H in a location specified by at least one first field of a single instruction.

[0378] Example 23: A non-transient machine-readable medium as in Example 22, further comprising: repeatedly decoding and executing a single instruction for multiple rounds of data blocks according to the SM3 hash standard.

[0379] Example 24: A non-transitory machine-readable medium as in Example 23, further comprising: decoding a third instruction into a decoded third instruction using decoding circuitry, the third instruction including at least one field identifying an updated state element C, an updated state element D, an updated state element G, and an updated state element H of a plurality of rounds of data blocks generated from a single instruction according to the SM3 hash standard; and executing the third instruction using execution circuitry to: circularly shift the updated state element C left by 9 bits to form the final state element C of the data block; circularly shift the updated state element D left by 9 bits to form the final state element D of the data block; circularly shift the updated state element G left by 19 bits to form the final state element G of the data block; circularly shift the updated state element H left by 19 bits to form the final state element H of the data block; and storing the final state elements C, D, G, and H in a location specified by at least one field of the third instruction.

[0380] In yet another embodiment, an apparatus includes a data storage device that stores code that, when executed by a hardware processor, causes the hardware processor to perform any of the methods disclosed herein. The apparatus may be as described in the detailed embodiments. The methods may be as described in the detailed embodiments.

[0381] An instruction set may include one or more instruction formats. A given instruction format may define various fields (e.g., number of bits, bit positions) to specify the operation to be performed (e.g., opcode) and operand(s) and / or other data fields (e.g., mask) to which the operation will be performed, and so on. Some instruction formats are further decomposed by defining instruction templates (or subformats). For example, an instruction template for a given instruction format may be defined as a different subset of the fields of that instruction format (the included fields are generally in the same order, but at least some fields have different bit positions because fewer fields are included), and / or defined as a given field that is interpreted in a different way. Thus, each instruction of the ISA is expressed using a given instruction format (and, if defined, according to a given instruction template in the instruction template of that instruction format) and includes fields for specifying the operation and operands. For example, the exemplary ADD (addition) instruction has a specific opcode and instruction format, which includes an opcode field for specifying the opcode and an operand field for selecting operands (source 1 / destination and source 2); and the appearance of the ADD instruction in the instruction stream will cause the operand field to contain specific content for selecting specific operands. Sets of SIMD extensions known as Advanced Vector Extensions (AVX) (AVX1 and AVX2) and utilizing Vector Extensions (VEX) encoding schemes have been introduced and / or released (see, for example, November 2018). See the IA-64 and IA-32 architecture software developer manual; and also refer to the October 2018 edition. (Architecture Instruction Set Extension Programming Reference).

[0382] Exemplary instruction format

[0383] Examples of the instructions described herein can be embodied in different formats. Furthermore, exemplary systems, architectures, and pipelines are detailed below. Examples of the instructions can be executed on such systems, architectures, and pipelines, but are not limited to those detailed herein.

[0384] General Vector-Friendly Instruction Format

[0385] A vector-friendly instruction format is an instruction format suitable for vector instructions (e.g., the existence of specific fields dedicated to vector operations). Although an embodiment in which both vector and scalar operations are supported via a vector-friendly instruction format has been described, alternative embodiments use only vector operations via the vector-friendly instruction format.

[0386] Figures 24A-24B This is a block diagram illustrating a general vector-friendly instruction format and instruction template according to embodiments of the present disclosure. Figure 24AThis is a block diagram illustrating a general vector-friendly instruction format and its Class A instruction template according to embodiments of the present disclosure; and Figure 24B This is a block diagram illustrating a general vector-friendly instruction format and its Class B instruction template according to an embodiment of the present disclosure. Specifically, Class A and Class B instruction templates are defined for the general vector-friendly instruction format 2400, both of which include instruction templates for no memory access 2405 and instruction templates for memory access 2420. In the context of the vector-friendly instruction format, the term "general" means an instruction format that is not bound to any particular instruction set.

[0387] Although embodiments of this disclosure will be described in which the vector-friendly instruction format supports the following: 64-byte vector operand length (or size) with a 32-bit (4-byte) or 64-bit (8-byte) data element width (or size) (and thus, the 64-byte vector consists of 16 double-word-sized elements, or alternatively, 8 quad-word-sized elements); 64-byte vector operand length (or size) with a 16-bit (2-byte) or 8-bit (1-byte) data element width (or size); 32-byte vector operand length (or size) with a 32-bit (4-byte) or 64-bit (8-byte) data element width (or size); Byte), 64-bit (8-byte), 16-bit (2-byte), or 8-bit (1-byte) data element widths (or sizes); and 16-byte vector operand lengths (or sizes) with 32-bit (4-byte), 64-bit (8-byte), 16-bit (2-byte), or 8-bit (1-byte) data element widths (or sizes); however, alternative embodiments may support larger, smaller, and / or different vector operand sizes (e.g., 256-byte vector operands) with larger, smaller, or different data element widths (e.g., 128-bit (16-byte) data element widths).

[0388] Figure 24A The Class A instruction templates include: 1) within the instruction template for no memory access 2405, an instruction template for a fully round-control operation 2410 without memory access and an instruction template for a data transformation operation 2415 without memory access are shown; and 2) within the instruction template for memory access 2420, an instruction template for memory access timeliness 2425 and an instruction template for memory access non-timeliness 2430 are shown. Figure 24B The B-type instruction templates include: 1) within the instruction template for no memory access 2405, an instruction template showing a partial rounding control type operation 2412 for write mask control without memory access and an instruction template showing a vsize type operation 2417 for write mask control without memory access; and 2) within the instruction template for memory access 2420, an instruction template showing a write mask control 2427 for memory access.

[0389] General Vector Friendly Instruction Format 2400 includes the following as listed in Figures 24A-24BThe fields in the order shown in the diagram are as follows.

[0390] Format field 2440 – A specific value (instruction format identifier value) in this field uniquely identifies the vector-friendly instruction format, and thus indicates that the instruction appears in the instruction stream in the vector-friendly instruction format. Therefore, this field is not required for instruction sets that only have a general vector-friendly instruction format, and in this sense, it is optional.

[0391] Basic operation field 2442 — its content distinguishes different basic operations.

[0392] Register index field 2444—its contents, either directly or generated from addresses, specify the location of the source or destination operand in a register or in memory. These fields include a sufficient number of bits to select N registers from a PxQ (e.g., 32x512, 16x128, 32x1024, 64x1024) register file. Although in one embodiment N can be up to three source registers and one destination register, alternative embodiments may support more or fewer source and destination registers (e.g., up to two sources, where one of these sources also serves as the destination; up to three sources, where one of these sources also serves as the destination; up to two sources and one destination).

[0393] The modifier field 2446 distinguishes between instructions in the generic vector instruction format that specify memory access and those that do not; that is, it differentiates between instruction templates with no memory access 2405 and instruction templates with memory access 2420. Memory access operations read and / or write to the memory hierarchy (in some cases, using values ​​in registers to specify the source and / or destination addresses), while non-memory access operations do not (e.g., the source and / or destination is a register). Although in one embodiment, this field also selects between three different ways to perform memory address calculations, alternative embodiments may support more, fewer, or different ways to perform memory address calculations.

[0394] The extended operation field 2450 distinguishes which of the various operations to be performed in addition to the basic operation. This field is context-dependent. In one embodiment of this disclosure, this field is divided into a class field 2468, an α field 2452, and a β field 2454. The extended operation field 2450 allows multiple sets of common operations to be performed in a single instruction, rather than two, three, or four instructions.

[0395] Ratio field 2460—its contents allow for use in memory address generation (e.g., for use with (2...) 比例The content of the index field is scaled proportionally by the address generated by the index + base address.

[0396] Displacement field 244462A – its contents are used as part of memory address generation (e.g., for use with (2 比例 Address generation (index + base address + offset).

[0397] The displacement factor field 2462B (note that the offset field 2462A directly indicates the use of one or the other on the offset factor field 2462B) – its contents are used as part of address generation; it specifies the displacement factor that will scale the size (N) of the memory access – where N is the number of bytes in the memory access (e.g., for use with (2 比例 *Address generation (index + base address + scaled displacement). Redundant low-order bits are ignored, and therefore the contents of the displacement factor field are multiplied by the total memory operand size (N) to generate the final displacement that will be used in calculating the effective address. The value of N is determined by the processor hardware at runtime based on the full opcode field 2474 (described later herein) and the data manipulation field 2454C. Displacement field 2462A and displacement factor field 2462B are not used in the instruction template of no memory access 2405 and / or different embodiments may implement only one of them or neither of them; in this sense, displacement field 2462A and displacement factor field 2462B are optional.

[0398] The data element width field 2464—its content distinguishes which of the multiple data element widths will be used (in some embodiments for all instructions; in other embodiments for only some instructions). This field is unnecessary if only one data element width is supported and / or if one aspect of the opcode is used to support the data element width; in this sense, the field is optional.

[0399] The write mask field 2470—its contents control, element-by-element position, whether the position of data elements in the destination vector operand reflects the results of the base and augmentation operations. Type A instruction templates support merge-write masks, while Type B instruction templates support both merge-write masks and zero-write masks. When merging, the vector mask allows protecting any set of elements in the destination from updates during the execution of any operation (specified by the base and augmentation operations); in another embodiment, it preserves the old value of each element in the destination where the corresponding mask bit has a 0. Conversely, when zeroing, the vector mask allows zeroing any set of elements in the destination during the execution of any operation (specified by the base and augmentation operations); in one embodiment, the elements in the destination are set to 0 when the corresponding mask bit has a 0 value. A subset of this functionality is the ability to control the vector length of the operation being performed (i.e., the span from the first to the last element being modified), however, the modified elements do not necessarily have to be consecutive. Thus, the write mask field 2470 allows for partial vector operations, including load, store, arithmetic, logical, etc. Although an embodiment of this disclosure is described in which the content of the write mask field 2470 selects one of a plurality of write mask registers containing the write mask to be used (and thus the content of the write mask field 2470 indirectly identifies the mask to be performed), alternative embodiments may alternatively or additionally allow the content of the mask write field 2470 to directly specify the mask to be performed.

[0400] The immediate number field 2472—its contents allow for the specification of an immediate number. This field is optional in implementations of generic vector-friendly formats that do not support immediate numbers and in instructions that do not use immediate numbers.

[0401] Class field 2468 – its content distinguishes instructions from different classes. (See reference) Figures 24A-24B The content of this field allows selection between Class A and Class B instructions. Figures 24A-24B In this context, rounded rectangles are used to indicate that a specific value exists in a field (e.g., in...). Figures 24A-24B The two fields are used for class field 2468, namely class A 2468A and class B 2468B.

[0402] Type A Instruction Template

[0403] In the case of the instruction template for Class A non-memory access 2405, the α field 2452 is interpreted as the RS field 2452A, whose content distinguishes which of the different extended operation types to be performed (e.g., the instruction templates for rounding operation 2410 and data transformation operation 2415 without memory access specify rounding 2452A.1 and data transformation 2452A.2, respectively). The β field 2454 distinguishes which of the specified types of operations to be performed. In the instruction template for non-memory access 2405, the scaling field 2460, the displacement field 2462A, and the displacement-scale field 2462B are absent.

[0404] Instruction template without memory access – fully round-control operation

[0405] In the instruction template of a fully round-controlled operation 2410 without memory access, the β field 2454 is interpreted as a round control field 2454A that provides static rounding for its(plural) contents. Although the round control field 2454A includes a suppress all floating-point exception (SAE) field 2456 and a round operation control field 2458 in the embodiments described in this disclosure, alternative embodiments may support both concepts, which may be encoded as the same field, or only one or the other of these concepts / fields may be present (e.g., only the round operation control field 2458 may be present).

[0406] SAE field 2456 – its content distinguishes whether exception event reporting is disabled; when the content of SAE field 2456 indicates that suppression is enabled, the given instruction does not report any kind of floating-point exception flag and does not invoke any floating-point exception handler.

[0407] The rounding operation control field 2458—its contents distinguish which of a set of rounding operations (e.g., round up, round down, round to zero, and round to nearest) should be performed. Thus, the rounding operation control field 2458 allows the rounding mode to be changed instruction-by-instruction. In one embodiment of this disclosure, where the processor includes a control register for specifying the rounding mode, the contents of the rounding operation control field 2450 override that register value.

[0408] Instruction template without memory access – data transformation operations

[0409] In the instruction template of the data transformation operation 2415 without memory access, the β field 2454 is interpreted as the data transformation field 2454B, the contents of which distinguish which of the multiple data transformations to be performed (e.g., no data transformation, mixing, broadcasting).

[0410] In the case of the instruction template for Class A memory access 2420, the α field 2452 is interpreted as the eviction hint field 2452B, the content of which distinguishes which eviction hint to use (in... Figure 24A In the instruction template for memory access timing 2425 and memory access non-timing 2430, timing 2452B.1 and non-timing 2452B.2 are specified respectively, while the β field 2454 is interpreted as a data manipulation field 2454C, the contents of which distinguish which of the multiple data manipulation operations (also called primitives) to be performed (e.g., no manipulation, broadcast, source upcast, and destination downcast). The instruction template for memory access 2420 includes a scaling field 2460 and optionally includes a displacement field 2462A or a displacement scaling field 2462B.

[0411] Vector memory instructions use translation support to perform vector loads from and vector stores to memory. Like regular vector instructions, vector memory instructions transfer data to / from memory in an element-by-element manner, where the actual elements transferred are specified by the contents of a vector mask selected as the write mask.

[0412] Instruction templates for memory access – time-sensitive

[0413] Time-sensitive data is data that can be reused quickly enough to benefit from cache operations. However, this is a hint, and different processors can implement it in different ways, including ignoring the hint entirely.

[0414] Instruction templates for memory access – non-time-sensitive

[0415] Non-time-sensitive data is data that is unlikely to be reused quickly enough to benefit from cache operations in the L1 cache and should be given eviction priority. However, this is a hint, and different processors can implement it in different ways, including ignoring the hint entirely.

[0416] Type B Instruction Template

[0417] In the case of the B-type instruction template, the α field 2452 is interpreted as the write mask control (Z) field 2452C, the content of which distinguishes whether the write mask controlled by the write mask field 2470 should be merged or zeroed.

[0418] In the case of instruction template 2405 for non-memory access of type B, a portion of the β field 2454 is interpreted as the RL field 2457A, the content of which distinguishes which of the different extended operation types to be performed (for example, the instruction template for the write mask control type operation 2412 for non-memory access and the instruction template for the write mask control type operation 2417 for non-memory access specify rounding 2457A.1 and vector length (VSIZE) 2457A.2, respectively), while the remaining portion of the β field 2454 distinguishes which of the specified types of operations to be performed. In the instruction template for non-memory access 2405, the scaling field 2460, the displacement field 2462A, and the displacement-scale field 2462B are absent.

[0419] In the instruction template of the write mask control section round control type operation 2410 without memory access, the remainder of the β field 2454 is interpreted as the round operation field 2459A, and exception event reporting is disabled (the given instruction does not report any kind of floating-point exception flag and does not invoke any floating-point exception handler).

[0420] Rounding operation control field 2459A—like rounding operation control field 2458, its contents distinguish which of a set of rounding operations to perform (e.g., round up, round down, round to zero, and round to nearest). Thus, rounding operation control field 2459A allows the rounding mode to be changed instruction-by-instruction. In one embodiment of this disclosure, where the processor includes a control register for specifying the rounding mode, the contents of rounding operation control field 2450 override that register value.

[0421] In the instruction template of the write mask control VSIZE type operation 2417 without memory access, the remainder of the β field 2454 is interpreted as the vector length field 2459B, the contents of which distinguish which of the multiple data vector lengths to be executed (e.g., 128 bytes, 256 bytes, or 512 bytes).

[0422] In the case of the instruction template for Class B memory access 2420, a portion of the β field 2454 is interpreted as a broadcast field 2457B, the content of which distinguishes whether a broadcast data manipulation operation is to be performed, while the remainder of the β field 2454 is interpreted as a vector length field 2459B. The instruction template for memory access 2420 includes a scaling field 2460 and optionally includes a displacement field 2462A or a displacement-scaling field 2462B.

[0423] For the general vector-friendly instruction format 2400, the complete opcode field 2474 is shown to include a format field 2440, a basic operation field 2442, and a data element width field 2464. Although one embodiment is shown in which the complete opcode field 2474 includes all of these fields, in embodiments that do not support all of these fields, the complete opcode field 2474 includes fewer than all of them. The complete opcode field 2474 provides the operation code (opcode).

[0424] The expanded operation field 2450, data element width field 2464, and write mask field 2470 allow these features to be specified on an instruction-by-instruction basis in a generic vector-friendly instruction format.

[0425] Combining the write mask field and the data element width field creates various types of instructions, as these instructions allow the mask to be applied based on different data element widths.

[0426] The various instruction templates appearing within classes A and B are advantageous in different situations. In some embodiments of this disclosure, different processors or different cores within a processor may support only class A, only class B, or both classes. For example, a high-performance general-purpose out-of-order core designed for general-purpose computing may support only class B, a core designed primarily for graphics and / or scientific (throughput) computing may support only class A, and a core designed for both general-purpose computing and graphics and / or scientific (throughput) computing may support both class A and class B (of course, cores with some mixture of templates and instructions from both classes, but not all templates and instructions from both classes, are within the scope of this disclosure). Similarly, a single processor may include multiple cores, all of which support the same class, or different cores that support different classes. For example, in a processor with separate graphics cores and general-purpose cores, one graphics core designed primarily for graphics and / or scientific computing may support only class A, while one or more general-purpose cores may be high-performance general-purpose cores with out-of-order execution and register renaming designed for general-purpose computing and supporting only class B. Another processor, which does not have a separate graphics core, may include one or more general-purpose ordered or out-of-order cores that support both Class A and Class B. Of course, in different embodiments of this disclosure, features from one class may also be implemented in other classes. This will enable programs written in a high-level language to take various executable forms (e.g., just-in-time or statically compiled), including: 1) forms having only instructions from the class(s) supported by the target processor(s) for execution; or 2) forms having alternative routines and control flow code that uses different combinations of instructions from all classes, the control flow code selecting these routines for execution based on instructions supported by the processor currently executing the code.

[0427] Exemplary dedicated vector-friendly instruction format

[0428] Figure 25A This is a block diagram illustrating an exemplary dedicated vector-friendly instruction format according to an embodiment of the present disclosure. Figure 25A This illustrates a dedicated vector-friendly instruction format 2500, which specifies the position, size, interpretation, and order of fields, as well as the values ​​of some of those fields. In this sense, the dedicated vector-friendly instruction format 2500 is dedicated. The dedicated vector-friendly instruction format 2500 can be used to extend the x86 instruction set, and thus some of its fields are similar to or identical to those used in existing x86 instruction sets and their extensions (e.g., AVX). This format maintains consistency with the prefix-coded fields, actual opcode byte fields, MOD R / M fields, SIB fields, shift fields, and immediate numeric fields of existing x86 instruction sets with extensions. (Illustration from...) Figures 24A-24B The field comes from Figure 25A Fields mapped to from Figures 24A-24B The field.

[0429] It should be understood that although embodiments of this disclosure have been described in the context of the general vector-friendly instruction format 2400 with reference to the dedicated vector-friendly instruction format 2500 for illustrative purposes, this disclosure is not limited to the dedicated vector-friendly instruction format 2500 unless otherwise stated. For example, the general vector-friendly instruction format 2400 envisions various possible sizes for various fields, while the dedicated vector-friendly instruction format 2500 is shown as a field with a specific size. As a specific example, although the data element width field 2464 is illustrated as a one-bit field in the dedicated vector-friendly instruction format 2500, this disclosure is not limited to this (i.e., other sizes for the data element width field 2464 are envisioned in the general vector-friendly instruction format 2400).

[0430] General Vector Friendly Instruction Format 2400 includes the following according to Figure 25A The fields in the order shown in the diagram are as follows.

[0431] EVEX prefix (bytes 0-3) 2502 — encoded in four-byte format.

[0432] Format field 2440 (EVEX byte 0, bits [7:0]) — The first byte (EVEX byte 0) is format field 2440, and it contains 0x62 (in one embodiment of this disclosure, a unique value used to distinguish vector-friendly instruction formats).

[0433] The second to fourth bytes (EVEX bytes 1-3) include multiple bit fields that provide specialized capabilities.

[0434] The REX field 2505 (EVEX byte 1, bits [7-5]) consists of the EVEX.R bit field (EVEX byte 1, bits [7]–R), the EVEX.X bit field (EVEX byte 1, bits [6]–X), and (2457BEX byte 1, bits [5]–B). The EVEX.R, EVEX.X, and EVEX.B bit fields provide the same functionality as the corresponding VEX bit fields and are encoded in two's complement form, i.e., ZMM0 is encoded as 1111B and ZMM15 is encoded as 0000B. The other fields of these instructions encode the lower three bits (rrr, xxx, and bbb) of the register index as known in the art, thereby forming Rrrr, Xxxx, and Bbbb by adding EVEX.R, EVEX.X, and EVEX.B.

[0435] REX' field 2410 — This is the first part of REX' field 2410 and is the EVEX.R' bit field (EVEX byte 1, bit [4] – R') used to encode the higher 16 or lower 16 registers of the extended 32-register set. In one embodiment of this disclosure, this bit, along with other bits indicated below, is stored in a bit-inverted format to distinguish it from the BOUND instruction (in the known x86 32-bit mode), whose actual opcode byte is 62, but which does not accept the value 11 in the MOD field in the MODR / M field (described below); an alternative embodiment of this disclosure does not store the bit of this indication and the bits of the other indications below in an inverted format. The value 1 is used to encode the lower 16 registers. In other words, R'Rrrr is formed by combining EVEX.R', EVEX.R, and other RRRs from other fields.

[0436] Opcode mapping field 2515 (EVEX byte 1, bits [3:0] – mmmm) – its contents encode the implicit preamble opcode byte (0F, 0F 38, or 0F 3).

[0437] The width field of the data element is 2464 (EVEX byte 2, bits [7] – W) – represented by the notation EVEX.W. EVEX.W is used to define the granularity (size) of a data type (32-bit data element or 64-bit data element).

[0438] EVEX.vvvv 2520 (EVEX byte 2, bits [6:3] -vvvv) — The function of EVEX.vvvv can include the following: 1) EVEX.vvvv encodes the first source register operand specified in reverse (two's complement) form, and is valid for instructions with two or more source operands; 2) EVEX.vvvv encodes the destination register operand specified in two's complement form for a specific vector shift; or 3) EVEX.vvvv does not encode any operands, this field is reserved, and should contain 1111b. Thus, the EVEX.vvvv field 2520 encodes the four lower-order bits of the first source register specifier stored in reverse (two's complement) form. Depending on the instruction, additional different EVEX bit fields are used to extend the specifier size to 32 registers.

[0439] EVEX.U 2468 Class field (EVEX byte 2, bit [2]-U) — If EVEX.U = 0, it indicates class A or EVEX.U0; if EVEX.U = 1, it indicates class B or EVEX.U1.

[0440] The prefix-encoded field 2525 (EVEX byte 2, bits [1:0]-pp) provides additional bits for the underlying operation field. This not only provides support for legacy SSE instructions in EVEX prefix format but also has the benefit of compressing the SIMD prefix (EVEX prefixes require only 2 bits instead of bytes to represent SIMD prefixes). In one embodiment, to support legacy SSE instructions using SIMD prefixes (66H, F2H, F3H) in both legacy and EVEX prefix formats, these legacy SIMD prefixes are encoded into a SIMD prefix-encoded field; and at runtime, they are extended to the legacy SIMD prefix before being provided to the PLA for decoding circuitry (thus, the PLA can execute both legacy instructions in legacy format and legacy instructions in EVEX format without modification). While newer instructions can use the contents of the EVEX prefix-encoded field directly as opcode extensions, certain embodiments extend them in a similar manner for consistency, but allow for different meanings specified by these legacy SIMD prefixes. Alternative embodiments may redesign the PLA to support 2-bit SIMD prefix encoding, thus eliminating the need for extension.

[0441] α field 2452 (EVEX byte 3, bit [7] – EH, also known as EVEX.EH, EVEX.rs, EVEX.RL, EVEX.writemask control, and EVEX.N; also illustrated as α) – as previously stated, this field is context-sensitive.

[0442] β field 2454 (EVEX byte 3, bits [6:4] - SSS, also known as EVEX.s 2-0 EVEX.r 2-0 EVEX.rr1, EVEX.LL0, EVEX.LLB (also illustrated in βββ diagram) — as mentioned before, this field is context-sensitive.

[0443] REX' field 2410 — This is the remainder of the REX' field and is the EVEX.V' bit field (EVEX byte 3, bit [3] – V') that can be used to encode either the higher 16 or lower 16 registers of the extended 32-register set. This bit is stored in a bit-inverted format. A value of 1 is used to encode the lower 16 registers. In other words, V'VVVV is formed by combining EVEX.V' and EVEX.vvvv.

[0444] Write mask field 2470 (EVEX byte 3, bits [2:0]-kkk) – its contents specify the index of the register in the write mask register, as previously described. In one embodiment of this disclosure, the specific value EVEX.kkk = 000 has the special behavior of implying that no write mask is used for a particular instruction (this can be implemented in various ways, including using a write mask hardwired to all objects or hardware that bypasses the mask hardware).

[0445] The actual opcode field 2530 (byte 4) is also known as the opcode byte. Part of the opcode is specified in this field.

[0446] The MOD R / M field 2540 (byte 5) includes MOD field 2542, Reg field 2544, and R / M field 2546. As previously described, the content of MOD field 2542 distinguishes between memory access operations and non-memory access operations. The function of Reg field 2544 can be summarized in two cases: encoding the destination register operand or the source register operand; or it can be treated as an opcode extension and not used to encode any instruction operand. The function of R / M field 2546 can include encoding instruction operands referencing memory addresses; or encoding the destination register operand or the source register operand.

[0447] Scale, Index, Base (SIB) Byte (Byte 6) – As previously mentioned, the contents of scale field 2450 are used for memory address generation. SIB.xxx 2554 and SIB.bbb 2556 – The contents of these fields have already been mentioned for register indices Xxxx and Bbbb.

[0448] Displacement field 2462A (bytes 7-10) — When MOD field 2542 contains 10, bytes 7-10 are displacement field 2462A, and it works the same as a traditional 32-bit displacement (disp32), and works at the byte granularity.

[0449] Byte 7 (disp8) is the shift factor segment 2462B – when MOD field 2542 contains 0s and 1s, byte 7 is the shift factor segment 2462B. This field is located in the same position as the traditional x86 instruction set 8-bit shift (disp8) that operates at byte granularity. Because disp8 is sign-extended, it can only address between -128 and 127 byte offsets; in the case of a 64-byte cache line, disp8 uses 8 bits that can be set to only four truly useful values: -128, -64, 0, and 64; since a larger range is often required, disp32 is used; however, disp32 requires 4 bytes. In contrast to disp8 and disp32, the shift factor segment 2462B is a reinterpretation of disp8; when using the shift factor segment 2462B, the actual shift is determined by multiplying the contents of the shift factor segment by the size (N) of the memory operand access. This type of shift is called disp8*N. This reduces the average instruction length (a single byte is used for the shift, but with a much larger range). This type of compressed displacement is based on the assumption that the effective displacement is a multiple of the granularity of the memory access, and therefore the redundant low-order bits of the address offset do not need to be encoded. In other words, the displacement is replaced by digital segment 2462B instead of the traditional x86 instruction set 8-bit displacement. Thus, the displacement is encoded by digital segment 2462B in the same way as the x86 instruction set 8-bit displacement (therefore, there is no change in the ModRM / SIB encoding rules), the only difference being that disp8 is overloaded to disp8*N. In other words, there is no change in the encoding rules or encoding length, only in the hardware interpretation of the displacement value (which requires scaling the displacement to the size of the memory operand to obtain a byte-level address offset). Immediate segment 2472 operates as previously described.

[0450] Full opcode field

[0451] Figure 25B This is a block diagram illustrating a field having a dedicated vector-friendly instruction format 2500 constituting a complete opcode field 2474 according to an embodiment of the present disclosure. Specifically, the complete opcode field 2474 includes a format field 2440, a basic opcode field 2442, and a data element width (W) field 2464. The basic opcode field 2442 includes a prefix encoding field 2525, an opcode mapping field 2515, and a real opcode field 2530.

[0452] Register index field

[0453] Figure 25C This is a block diagram illustrating the fields constituting register index field 2444 with a dedicated vector-friendly instruction format 2500 according to an embodiment of the present disclosure. Specifically, register index field 2444 includes REX field 2505, REX' field 2510, MODR / M.reg field 2544, MODR / Mr / m field 2546, VVVV field 2520, xxx field 2554, and bbb field 2556.

[0454] Expand operation fields

[0455] Figure 25D This is a block diagram illustrating the fields of an extended operation field 2450 with a dedicated vector-friendly instruction format 2500 according to an embodiment of the present disclosure. When the class (U) field 2468 contains 0, it indicates EVEX.U0 (Class A 2468A); when it contains 1, it indicates EVEX.U1 (Class B 2468B). When U = 0 and the MOD field 2542 contains 11 (indicating no memory access operation), the α field 2452 (EVEX byte 3, bits [7] – EH) is interpreted as the rs field 2452A. When the rs field 2452A contains 1 (rounded 2452A.1), the β field 2454 (EVEX byte 3, bits [6:4] – SSS) is interpreted as the rounding control field 2454A. The rounding control field 2454A includes a one-bit SAE field 2456 and a two-bit rounding operation field 2458. When rs field 2452A contains 0 (data transformation 2452A.2), β field 2454 (EVEX byte 3, bits [6:4] – SSS) is interpreted as a three-bit data transformation field 2454B. When U = 0 and MOD field 2542 contains 00, 01, or 10 (indicating a memory access operation), α field 2452 (EVEX byte 3, bits [7] – EH) is interpreted as an eviction hint (EH) field 2452B, and β field 2454 (EVEX byte 3, bits [6:4] – SSS) is interpreted as a three-bit data manipulation field 2454C.

[0456] When U = 1, α field 2452 (EVEX byte 3, bit [7] – EH) is interpreted as write mask control (Z) field 2452C. When U = 1 and MOD field 2542 contains 11 (indicating no memory access operation), a portion of β field 2454 (EVEX byte 3, bit [4] – S0) is interpreted as RL field 2457A; when it contains 1 (rounded to 2457A.1), the remainder of β field 2454 (EVEX byte 3, bit [6-5] – S0) is interpreted as RL field 2457A. 2-1The remainder of the β field 2454 (EVEX byte 3, bit [6-5]-S) is interpreted as a rounding operation field 2459A, while when the RL field 2457A contains 0 (VSIZE2457.A2), the remainder of the β field 2454 (EVEX byte 3, bit [6-5]-S) is interpreted as a rounding operation field 2459A, and ... 2-1 ) is interpreted as the vector length field 2459B (EVEX byte 3, bits [6-5] – L 1-0 When U=1 and MOD field 2542 contains 00, 01, or 10 (indicating a memory access operation), β field 2454 (EVEX byte 3, bits [6:4]–SSS) is interpreted as vector length field 2459B (EVEX byte 3, bits [6-5]–L). 1-0 ) and broadcast field 2457B (EVEX byte 3, bit [4]–B).

[0457] Exemplary Register Architecture

[0458] Figure 26 This is a block diagram of a register architecture 2600 according to one embodiment of the present disclosure. In the illustrated embodiment, there are 32 512-bit wide vector registers 2610; these registers are referenced as zmm0 to zmm31. The lower-order 256 bits of the lower 16 zmm registers are overlaid on registers ymm0-16. The lower-order 128 bits of the lower 16 zmm registers (the lower-order 128 bits of the ymm registers) are overlaid on registers xmm0-15. The dedicated vector-friendly instruction format 2500 operates on these overlaid registers as illustrated in the following table.

[0459]

[0460] In other words, the vector length field 2459B selects between a maximum length and one or more other shorter lengths, each of which is half the length of the previous one, and instruction templates without the vector length field 2459B operate on the maximum vector length. Furthermore, in one embodiment, the Class B instruction template of the dedicated vector-friendly instruction format 2500 operates on compressed or scalar single / double-precision floating-point data and compressed or scalar integer data. Scalar operations are performed on the lowest-order data element positions in the zmm / ymm / xmm registers; depending on the embodiment, higher-order data element positions either remain the same as before the instruction or are zeroed out.

[0461] Write mask register 2615—In the illustrated embodiment, there are eight write mask registers (k0 to k7), each 64 bits in size. In an alternative embodiment, write mask register 2615 is 16 bits in size. As previously described, in one embodiment of this disclosure, vector mask register k0 cannot be used as a write mask; when the encoding of the normal indicator k0 is used as the write mask, it selects the hardwired write mask 0xFFFF, thereby effectively disabling the write mask for that instruction.

[0462] General Purpose Register 2625 — In the illustrated embodiment, there are sixteen 64-bit general purpose registers that are used in conjunction with existing x86 addressing modes for addressing memory operands. These registers are referenced by the names RAX, RBX, RCX, RDX, RBP, RSI, RDI, RSP, and R8 through R15.

[0463] A scalar floating-point stack register file (x87 stack) 2645 is overlaid with an MMX compact integer flat register file 2650. In the illustrated embodiment, the x87 stack is an octal stack used to perform scalar floating-point operations on 32 / 64 / 80-bit floating-point data using x87 instruction set extensions; while the MMX registers are used to perform operations on 64-bit compact integer data and to store operands for some operations performed between the MMX and XMM registers.

[0464] Alternative embodiments of this disclosure may use wider or narrower registers. Furthermore, alternative embodiments of this disclosure may use more, fewer, or different register files and registers.

[0465] Exemplary core architectures, processors, and computer architectures

[0466] Processor cores can be implemented in different ways, for different purposes, and in different processors. For example, implementations of such cores may include: 1) general-purpose ordered cores intended for general-purpose computing; 2) high-performance general-purpose out-of-order cores intended for general-purpose computing; and 3) dedicated cores intended primarily for graphics and / or scientific (throughput) computing. Implementations of different processors may include: 1) CPUs, which include one or more general-purpose ordered cores and / or one or more general-purpose out-of-order cores intended for general-purpose computing; and 2) coprocessors, which include one or more dedicated cores intended primarily for graphics and / or scientific (throughput) computing. These different processors result in different computer system architectures, which may include: 1) a coprocessor on a separate chip from the CPU; 2) a coprocessor in the same package as the CPU but on a separate die; 3) a coprocessor on the same die as the CPU (in which case such a coprocessor is sometimes referred to as dedicated logic or a dedicated core, such as integrated graphics and / or scientific (throughput) logic); and 4) a system-on-a-chip that may include the described CPU (sometimes referred to as application cores or application processors), the coprocessors described above, and additional functionality on the same die. Exemplary core architectures are then described, followed by exemplary processors and computer architectures.

[0467] Exemplary core architecture

[0468] Ordered and disordered kernel diagrams

[0469] Figure 27A This is a block diagram illustrating an exemplary ordered pipeline and an exemplary out-of-order release / execution pipeline with register renaming according to various embodiments of the present disclosure. Figure 27B This is a block diagram illustrating exemplary embodiments of ordered architecture cores to be included in a processor according to various embodiments of the present disclosure and exemplary out-of-order release / execution architecture cores with register renaming. Figures 27A-27B The solid-line boxes in the diagram illustrate ordered pipelines and ordered cores, while the optional additions to the dashed boxes illustrate register renaming, out-of-order release / execution pipelines, and cores. Since the ordered aspect is a subset of the out-of-order aspect, the out-of-order aspect will be described.

[0470] exist Figure 27A In the processor pipeline 2700, there are fetch stage 2702, length decoding stage 2704, decoding stage 2706, allocation stage 2708, renaming stage 2710, scheduling (also known as dispatch or issue) stage 2712, register read / memory read stage 2714, execution stage 2716, write-back / memory write stage 2718, exception handling stage 2722, and commit stage 2724.

[0471] Figure 27BA processor core 2790 is shown, which includes a front-side unit 2730 coupled to an execution engine unit 2750, and both the front-side unit 2730 and the execution engine unit 2750 are coupled to a memory unit 2770. Core 2790 can be a Reduced Instruction Set Computing (RISC) core, a Complex Instruction Set Computing (CISC) core, a Very Long Instruction Word (VLIW) core, or a hybrid or alternative core type. Alternatively, core 2790 can be a dedicated core, such as, for example, a network or communication core, a compression engine, a coprocessor core, a general-purpose computing graphics processing unit (GPGPU) core, a graphics core, etc.

[0472] Front-end unit 2730 includes branch prediction unit 2732 coupled to instruction cache unit 2734 coupled to instruction translation lookup buffer (TLB) 2736 coupled to instruction fetch unit 2738 coupled to decoding unit 2740. Decoding unit 2740 (e.g., decoding circuitry) decodes instructions (e.g., macro instructions) and generates one or more micro-operations, microcode entry points, microinstructions, other instructions, or other control signals as output, which are decoded from, or otherwise reflect, the original instruction or derived from it. Decoding unit 2740 can be implemented using various mechanisms. Examples of suitable mechanisms include, but are not limited to, lookup tables, hardware implementations, programmable logic arrays (PLAs), microcode read-only memory (ROM), etc. In one embodiment, core 2790 includes a microcode ROM or other medium (e.g., in decoding unit 2740, or otherwise within front-end unit 2730) storing microcode for certain macro instructions. Decoding unit 2740 is coupled to rename / allocator unit 2752 in execution engine unit 2750.

[0473] Execution engine unit 2750 includes a renaming / allocator unit 2752 coupled to a retirement unit 2754 and a set 2756 of one or more scheduler units. The scheduler units 2756 represent any number of different schedulers, including reservation stations, central instruction windows, etc. The scheduler units 2756 are coupled to physical register file units 2758. Each physical register file unit in the physical register file units 2758 represents one or more physical register files, where different physical register files store one or more different data types, such as scalar integers, scalar floating-point numbers, compressed integers, compressed floating-point numbers, vector integers, vector floating-point numbers, status (e.g., an instruction pointer as the address of the next instruction to be executed), etc. In one embodiment, the physical register file units 2758 include vector register units, write mask register units, and scalar register units. These register units can provide architecture vector registers, vector mask registers, and general-purpose registers. Multiple physical register file units 2758 are overlapped by retirement units 2754 to illustrate various ways in which register renaming and out-of-order execution can be implemented (e.g., using multiple reordering buffers and multiple retirement register files; using multiple future files, multiple history buffers, and multiple retirement register files; using register mappings and register pools, etc.). Retirement units 2754 and multiple physical register file units 2758 are coupled to multiple execution clusters 2760. Multiple execution clusters 2760 include a set 2762 of one or more execution units (e.g., execution circuitry) and a set 2764 of one or more memory access units. Execution units 2762 can perform various operations (e.g., shift, addition, subtraction, multiplication) and can perform operations on various data types (e.g., scalar floating-point, compressed integer, compressed floating-point, vector integer, vector floating-point). While some embodiments may include multiple execution units dedicated to a particular function or set of functions, other embodiments may include only one execution unit or multiple execution units that all perform all functions. Multiple scheduler units 2756, multiple physical register file units 2758, and multiple execution clusters 2760 are shown as possibly multiple, because some embodiments create separate pipelines for certain types of data / operations (e.g., scalar integer pipelines, scalar floating-point / compact integer / compact floating-point / vector integer / vector floating-point pipelines, and / or memory access pipelines each having their own scheduler unit, multiple physical register file units, and / or execution clusters—and in the case of separate memory access pipelines, implement certain embodiments in which only the execution cluster of that pipeline has multiple memory access units 2764).It should also be understood that when using separate pipelines, one or more of these pipelines may be out-of-order releases / executions, while the remaining pipelines may be ordered.

[0474] A set of memory access units 2764 is coupled to a memory unit 2770, which includes a data TLB unit 2772, which is coupled to a data cache unit 2774, which is coupled to a Level 2 (L2) cache unit 2776. In one exemplary embodiment, the memory access unit 2764 may include a load unit, a memory address unit, and a memory data unit, each of which is coupled to the data TLB unit 2772 in the memory unit 2770. An instruction cache unit 2734 is also coupled to the Level 2 (L2) cache unit 2776 in the memory unit 2770. The L2 cache unit 2776 is coupled to one or more other levels of cache and ultimately to main memory.

[0475] As an example, the exemplary register renaming out-of-order release / execution core architecture can implement pipeline 2700 as follows: 1) Instruction fetch 2738 executes fetch stage 2702 and length decoding stage 2704; 2) Decoding unit 2740 executes decoding stage 2706; 3) Rename / allocator unit 2752 executes allocation stage 2708 and rename stage 2710; 4) (multiple) scheduler units 2756 execute scheduling stage 2712; 5) (multiple) physical register file units 2758 and memory unit 2770 execute register read / memory read stage 2714; execution cluster 2760 executes execution stage 2716; 6) memory unit 2770 and (multiple) physical register file units 2758 execute write-back / memory write stage 2718; 7) each unit may involve exception handling stage 2722; and 8) retirement unit 2754 and (multiple) physical register file units 2758 execute commit stage 2724.

[0476] Core 2790 may support one or more instruction sets (e.g., the x86 instruction set (with some extensions added with newer versions); the MIPS instruction set of MIPS Technologies, Inc., Sunnyvale, California; the ARM instruction set of ARM Holdings, Inc., Sunnyvale, California (with optional additional extensions such as NEON)), including the instructions described herein. In one embodiment, Core 2790 includes logic for supporting compressed data instruction set extensions (e.g., AVX1, AVX2), thereby allowing the use of compressed data to perform operations used by many multimedia applications.

[0477] It should be understood that a core can support multithreading (execution of two or more parallel operations or a set of threads), and this multithreading can be accomplished in various ways, including time-division multithreading, simultaneous multithreading (where a single physical core provides a logical core for each thread in the simultaneous multithreading of the physical core), or combinations thereof (e.g., time-division fetching and decoding, and subsequent operations such as...). Simultaneous multithreading in hyper-threading technology.

[0478] Although register renaming is described in the context of out-of-order execution, it should be understood that register renaming can also be used in ordered architectures. While the illustrated processor embodiment also includes separate instruction and data cache units 2734 / 2774 and a shared L2 cache unit 2776, alternative embodiments may have a single internal cache for both instructions and data, such as, for example, a Level 1 (L1) internal cache or multiple levels of internal caches. In some embodiments, the system may include a combination of internal caches and external caches located outside the core and / or processor. Alternatively, all caches may be located outside the core and / or processor.

[0479] Specific exemplary ordered core architecture

[0480] Figures 28A-28B The diagram illustrates a more specific exemplary ordered core architecture, where the core is one of several logic blocks within a chip (including other cores of the same and / or different types). Depending on the application, the logic block communicates with some fixed functional logic, memory I / O interfaces, and other necessary I / O logic via a high-bandwidth interconnect network (e.g., a ring network).

[0481] Figure 28A This is a block diagram of a single processor core according to embodiments of the present disclosure, its connection to an on-die interconnect network 2802, and a local subset 2804 of its second-level (L2) cache. In one embodiment, the instruction decoding unit 2800 supports the x86 instruction set with a compact data instruction set extension. The L1 cache 2806 allows low-latency access to cache memory into the scalar and vector units. Although in one embodiment (for design simplification), the scalar unit 2808 and the vector unit 2810 use separate sets of registers (scalar register 2812 and vector register 2814, respectively), and data transferred between these registers is written to memory and subsequently read back from the first-level (L1) cache 2806, alternative embodiments of the present disclosure may use different methods (e.g., using a single set of registers or including a communication path that allows data to be transferred between these two register sets without being written and read back).

[0482] The local subset 2804 of the L2 cache is part of the global L2 cache, which is divided into multiple separate local subsets, one for each processor core. Each processor core has a direct access path to its own local subset 2804 of the L2 cache. Data read by a processor core is stored in its L2 cache subset 2804 and can be accessed quickly in parallel with other processor cores accessing their own local L2 cache subsets. Data written by a processor core is stored in its own L2 cache subset 2804 and is dumped from other subsets if necessary. A ring network ensures the consistency of shared data. The ring network is bidirectional to allow agents such as processor cores, L2 caches, and other logic blocks to communicate with each other within the chip. Each ring data path is 1012 bits wide in each direction.

[0483] Figure 28B According to embodiments of this disclosure Figure 28A An expanded diagram of a portion of the processor core. Figure 28B This includes the L1 data cache 2806A portion of the L1 cache 2804, and further details regarding the vector unit 2810 and vector register 2814. Specifically, the vector unit 2810 is a 16-wide vector processing unit (VPU) (see 16-wide ALU 2828) that executes one or more of integer, single-precision floating-point, and double-precision floating-point instructions. This VPU supports mixing of register inputs via mixing unit 2820, numerical conversion via value conversion units 2822A-B, and copying of memory inputs via copy unit 2824. A write mask register 2826 allows masked vector writes.

[0484] Figure 29 This is a block diagram of a processor 2900 according to embodiments of the present disclosure, which may have more than one core, may have an integrated memory controller, and may have an integrated graphics device. Figure 29 The solid-line box illustration shows a processor 2900 having a single core 2902A, a system agent 2910, and a set of one or more bus controller units 2916, while the optional additional illustration with dashed boxes shows an alternative processor 2900 having multiple cores 2902A-N, a set of one or more integrated memory controller units 2914 from the system agent units 2910, and dedicated logic 2908.

[0485] Therefore, different implementations of processor 2900 may include: 1) a CPU, wherein dedicated logic 2908 is integrated graphics and / or scientific (throughput) logic (which may include one or more cores), and cores 2902A-N are one or more general-purpose cores (e.g., general-purpose ordered cores, general-purpose out-of-order cores, or a combination of both); 2) a coprocessor, wherein cores 2902A-N are a large number of dedicated cores designed primarily for graphics and / or scientific (throughput); and 3) a coprocessor, wherein cores 2902A-N are a large number of general-purpose ordered cores. Thus, processor 2900 may be a general-purpose processor, coprocessor, or dedicated processor, such as, for example, a network or communication processor, a compression engine, a graphics processor, a GPGPU (General-Purpose Graphics Processing Unit), a high-throughput integrated many-core (MIC) coprocessor (including 30 or more cores), an embedded processor, etc. The processor may be implemented on one or more chips. Processor 2900 may be part of one or more substrates, and / or may be implemented on one or more substrates using any of a variety of process technologies (e.g., BiCMOS, CMOS, or NMOS).

[0486] The memory hierarchy includes one or more levels of cache within the core, a set 2906 of one or more shared cache units, and external memory (not shown) coupled to a set 2914 of integrated memory controller units. The set 2906 of shared cache units may include one or more intermediate levels of cache, such as Level 2 (L2), Level 3 (L3), Level 4 (L4), or other levels of cache, Last Level Cache (LLC), and / or combinations thereof. While in one embodiment, ring-based interconnect units 2912 interconnect integrated graphics logic 2908, the set 2906 of shared cache units, and system proxy units 2910 / (multiple) of integrated memory controller units 2914, alternative embodiments may use any number of known techniques to interconnect such units. In one embodiment, consistency is maintained between one or more cache units 2906 and cores 2902A-N.

[0487] In some embodiments, one or more cores 2902A-N can be multithreaded. System agent 2910 includes those components that coordinate and operate core 2902A-N. System agent unit 2910 may include, for example, a power control unit (PCU) and a display unit. The PCU may be, or may include, the logic and components required to regulate the power state of core 2902A-N and integrated graphics logic 2908. The display unit is used to drive one or more externally connected displays.

[0488] The 2902A-N cores can be homogeneous or heterogeneous in terms of their instruction set architecture; that is, two or more cores in the 2902A-N cores may be able to execute the same instruction set, while other cores may be able to execute only a subset of that instruction set or a different instruction set.

[0489] Exemplary computer architecture

[0490] Figures 30-33 This is a block diagram of an exemplary computer architecture. Other system designs and configurations known in the art for laptops, desktops, handheld PCs, personal digital assistants, engineering workstations, servers, network devices, network hubs, switches, embedded processors, digital signal processors (DSPs), graphics devices, video game devices, set-top boxes, microcontrollers, cellular phones, portable media players, handheld devices, and various other electronic devices are also suitable. Generally, a wide variety of systems or electronic devices capable of incorporating processors and / or other execution logic as disclosed herein are generally suitable.

[0491] Now for reference Figure 30 The diagram illustrates a system 3000 according to one embodiment of the present disclosure. System 3000 may include one or more processors 3010, 3015 coupled to a controller hub 3020. In one embodiment, controller hub 3020 includes a graphics memory controller hub (GMCH) 3090 and an input / output hub (IOH) 3050 (which may be on separate chips); GMCH 3090 includes memory and a graphics controller, to which memory 3040 and a coprocessor 3045 are coupled; IOH 3050 couples an input / output (I / O) device 3060 to GMCH 3090. Alternatively, one or both of the memory and graphics controller may be integrated within a processor (as described herein), with memory 3040 and coprocessor 3045 directly coupled to processor 3010, and controller hub 3020 and IOH 3050 residing on a single chip. The memory 3040 may include a hash module 3040A, for example for storing code that, when executed, causes the processor to perform any of the methods disclosed herein.

[0492] The optionality of the additional processor 3015 is in Figure 30 The numbers are indicated by dashed lines. Each processor 3010, 3015 may include one or more of the processing cores described herein, and may be a version of processor 2900.

[0493] The memory 3040 may be, for example, dynamic random access memory (DRAM), phase-change memory (PCM), or a combination of both. In at least one embodiment, the controller hub 3020 communicates with the processors(s) 3010, 3015 via a multi-branch bus such as a front-side bus (FSB), a point-to-point interface such as a fast path interconnect (QPI), or a similar connection 3095.

[0494] In one embodiment, the coprocessor 3045 is a dedicated processor, such as, for example, a high-throughput MIC processor, a network or communication processor, a compression engine, a graphics processor, a GPGPU, an embedded processor, and so on. In one embodiment, the controller hub 3020 may include an integrated graphics accelerator.

[0495] There can be various differences between physical resources 3010 and 3015 in terms of a range of quality metrics, including architecture, microarchitecture, thermal and power consumption characteristics.

[0496] In one embodiment, processor 3010 executes instructions that control general-type data processing operations. Embedded within these instructions may be coprocessor instructions. Processor 3010 recognizes these coprocessor instructions as having a type that should be executed by an attached coprocessor 3045. Therefore, processor 3010 issues these coprocessor instructions (or control signals representing coprocessor instructions) to coprocessor 3045 on a coprocessor bus or other interconnect. Coprocessors 3045(a) receive and execute the received coprocessor instructions.

[0497] See now Figure 31 The diagram shown is a block diagram of a first, more specific, exemplary system 3100 according to an embodiment of the present disclosure. Figure 31 As shown, the multiprocessor system 3100 is a point-to-point interconnect system and includes a first processor 3170 and a second processor 3180 coupled via a point-to-point interconnect 3150. Each of processors 3170 and 3180 may be a version of processor 2900. In one embodiment of this disclosure, processors 3170 and 3180 are processors 3010 and 3015, respectively, and coprocessor 3138 is coprocessor 3045. In another embodiment, processors 3170 and 3180 are processor 3010 and coprocessor 3045, respectively.

[0498] Processors 3170 and 3180 are shown as including integrated memory controller (IMC) units 3172 and 3182, respectively. Processor 3170 also includes point-to-point (PP) interfaces 3176 and 3178 as part of its bus controller unit; similarly, the second processor 3180 includes PP interfaces 3186 and 3188. Processors 3170 and 3180 can exchange information via PP interface 3150 using point-to-point (PP) interface circuitry 3178 and 3188. Figure 31 As shown, IMC 3172 and 3182 couple the processor to the corresponding memory, namely memory 3132 and memory 3134, which may be portions of the main memory locally attached to the corresponding processor.

[0499] Processors 3170 and 3180 can exchange information with chipset 3190 via respective PP interfaces 3152 and 3154 using point-to-point interface circuits 3176, 3194, 3186, and 3198. Chipset 3190 can optionally exchange information with coprocessor 3138 via high-performance interface 3139. In one embodiment, coprocessor 3138 is a dedicated processor, such as, for example, a high-throughput MIC processor, a network or communication processor, a compression engine, a graphics processor, a GPGPU, an embedded processor, etc.

[0500] A shared cache (not shown) may be included in either processor or external to both processors but connected to them via a PP interconnect, such that if the processors are in a low-power mode, the local cache information of either or both processors may be stored in the shared cache.

[0501] Chipset 3190 can be coupled to first bus 3116 via interface 3196. In one embodiment, first bus 3116 may be a peripheral component interconnect (PCI) bus or a bus such as PCI fast bus or another third-generation I / O interconnect bus, but the scope of this disclosure is not limited thereto.

[0502] like Figure 31As shown, various I / O devices 3114 may be coupled to a first bus 3116 together with a bus bridge 3118, which couples the first bus 3116 to a second bus 3120. In one embodiment, one or more additional processors 3115, such as a coprocessor, a high-throughput MIC processor, a GPGPU, an accelerator (such as, for example, a graphics accelerator or digital signal processing (DSP) unit), a field-programmable gate array, or any other processor, are coupled to the first bus 3116. In one embodiment, the second bus 3120 may be a low pin count (LPC) bus. In one embodiment, various devices may be coupled to the second bus 3120, including, for example, a keyboard and / or mouse 3122, a communication device 3127, and a storage unit 3128, such as a disk drive that may include instruction / code and data 3130, or other mass storage devices. Additionally, audio I / O 3124 may be coupled to the second bus 3120. Note that other architectures are possible. For example, instead of… Figure 31 The point-to-point architecture allows the system to implement multi-branch buses or other similar architectures.

[0503] Now for reference Figure 32 The diagram shown is a block diagram of a second, more specific, exemplary system 3200 according to an embodiment of the present disclosure. Figure 31 and 32 Similar elements in the figure use similar reference numerals, and from Figure 32 The middle part is omitted Figure 31 certain aspects to avoid confusion Figure 32 Other aspects.

[0504] Figure 32 The illustrated processors 3170 and 3180 may include integrated memory and I / O control logic (“CL”) 3172 and 3182, respectively. Therefore, CL 3172 and 3182 include an integrated memory controller unit and I / O control logic. Figure 32 The diagram shows that not only are the memories 3132 and 3134 coupled to CLs 3172 and 3182, but the I / O device 3214 is also coupled to the control logic 3172 and 3182. The conventional I / O device 3215 is coupled to the chipset 3190.

[0505] Now for reference Figure 33 The diagram shown is a block diagram of a SoC 3300 according to an embodiment of the present disclosure. Figure 29 Similar elements in the figure use similar reference numerals. Additionally, dashed boxes are optional features on more advanced SoCs. Figure 33In this configuration, multiple interconnect units 332 are coupled to: an application processor 3310, which includes a set of one or more cores 202A-N and multiple shared cache units 2906; a system proxy unit 2910; multiple bus controller units 2916; multiple integrated memory controller units 2914; a set of one or more coprocessors 3320, which may include integrated graphics logic, an image processor, an audio processor, and a video processor; a static random access memory (SRAM) unit 3330; a direct memory access (DMA) unit 3332; and a display unit 3340 for coupling to one or more external displays. In one embodiment, the multiple coprocessors 3320 include dedicated processors, such as, for example, network or communication processors, compression engines, GPGPUs, high-throughput MIC processors, or embedded processors, etc.

[0506] The embodiments disclosed herein (e.g., mechanisms) can be implemented in hardware, software, firmware, or a combination of such implementations. Embodiments of this disclosure can be implemented as computer programs or program code executable on a programmable system including at least one processor, a storage system (including volatile and non-volatile memories and / or storage elements), at least one input device, and at least one output device.

[0507] Program code (such as, Figure 31 The code 3130 shown in the diagram is applied to input instructions to perform the functions described herein and generate output information. The output information can be applied to one or more output devices in a known manner. For the purposes of this application, the processing system includes any system having a processor, such as, for example, a digital signal processor (DSP), a microcontroller, an application-specific integrated circuit (ASIC), or a microprocessor.

[0508] The program code can be implemented using a high-level procedural or object-oriented programming language to communicate with the processing system. Assembly or machine language can also be used if needed. In fact, the mechanisms described herein are not limited to any particular programming language. In any case, the language can be a compiled or interpreted language.

[0509] One or more aspects of at least one embodiment can be implemented by representational instructions stored on a machine-readable medium, which represent various logics in a processor, and which, when read by a machine, cause the machine to manufacture logic for performing the techniques described herein. Such representations, referred to as “IP cores,” can be stored on tangible machine-readable media and can be supplied to various customers or production facilities for loading into manufacturing machines that actually manufacture the logic or processor.

[0510] Such machine-readable storage media can include, but are not limited to, non-transitory, tangible arrangements of articles made or formed by a machine or device, including storage media such as hard disks; any other type of disk, including floppy disks, optical disks, compact disc read-only memory (CD-ROM), rewritable compact discs (CD-RW), and magneto-optical disks; semiconductor devices such as read-only memory (ROM), random access memory (RAM) such as dynamic random access memory (DRAM) and static random access memory (SRAM), erasable programmable read-only memory (EPROM), flash memory, electrically erasable programmable read-only memory (EEPROM); phase-change memory (PCM); magnetic cards or optical cards; or any other type of medium suitable for storing electronic instructions.

[0511] Therefore, embodiments of this disclosure also include non-transitory tangible machine-readable media containing instructions or design data, such as a hardware description language (HDL), that defines the architectures, circuits, devices, processors, and / or system characteristics described herein. These embodiments are also referred to as program products.

[0512] Simulation (including binary transformation, code transformation, etc.)

[0513] In some cases, instruction translators can be used to translate instructions from a source instruction set to a target instruction set. For example, an instruction translator can transform instructions (e.g., using static binary transformation, including dynamically compiled binary transformation), modify, emulate, or otherwise convert them into one or more other instructions to be processed by the kernel. Instruction translators can be implemented in software, hardware, firmware, or a combination thereof. Instruction translators can be on the processor, off the processor, or partially on and partially off the processor.

[0514] Figure 34 This is a block diagram illustrating the use of a software instruction converter to convert binary instructions in a source instruction set into binary instructions in a target instruction set, according to embodiments of the present disclosure. In the illustrated embodiment, the instruction converter is a software instruction converter; however, alternatively, the instruction converter may be implemented using software, firmware, hardware, or various combinations thereof. Figure 34 This illustrates the use of an x86 compiler 3404 to compile a program of the form of a high-level language 3402 to generate x86 binary code 3406 that can be natively executed by a processor 3416 having at least one x86 instruction set core. The processor 3416 having at least one x86 instruction set core indicates that it executes programs with at least one x86 instruction set core by compatibly executing or otherwise processing the following... Any processor with essentially the same functionality as the processor: 1) The substantial portion of the instruction set of the instruction set core, or 2) the objective is to have at least one x86 instruction set core. Running on the processor to achieve compatibility with at least one x86 instruction set core The target code version of the application or other software with substantially the same processor. x86 compiler 3404 refers to a compiler operable to generate x86 binary code 3406 (e.g., target code), which can or cannot be executed on a processor 3416 having at least one x86 instruction set core through additional linking. Similarly, Figure 34 A program in the form of a high-level language 3402 can be compiled using an alternative instruction set compiler 3408 to generate alternative instruction set binary code 3410 that can be natively executed by a processor 3414 that does not have at least one x86 instruction set core (e.g., a processor with a core that executes the MIPS instruction set of MIPS Technologies, Inc., Sunnyvale, California, and / or the ARM instruction set of ARM Holdings, Inc., Sunnyvale, California). An instruction converter 3412 is used to translate the x86 binary code 3406 into code that can be natively executed by the processor 3414 that does not have an x86 instruction set core. This translated code is unlikely to be identical to the alternative instruction set binary code 3410 because an instruction converter capable of doing so would be difficult to manufacture; however, the translated code will perform general operations and consists of instructions from the alternative instruction set. Therefore, the instruction converter 3412 represents, through emulation, simulation, or any other process, software, firmware, hardware, or a combination thereof that allows a processor or other electronic device without an x86 instruction set processor or core to execute the x86 binary code 3406.

Claims

1. A processor, comprising: A decoding circuit is used to decode a first instruction, which is used to calculate the input message for the next round of hashing according to the SHA512 hash standard. The first instruction includes multiple fields for specifying a first vector register and a second vector register. The first vector register is used to store a first 64-bit data element, a second 64-bit data element, a third 64-bit data element, and a fourth 64-bit data element. The second vector register is used to store a fifth 64-bit data element and a sixth 64-bit data element. as well as An execution circuit, coupled to the decoding circuit, is used to perform an operation corresponding to the first instruction, including: Generate results, the results being used to include: The first 64-bit result element is equal to the first 64-bit data element plus the value of the following operations: XORing the fifth 64-bit data element rotated right by 19 bits with the fifth 64-bit data element rotated right by 61 bits, and XORing the fifth 64-bit data element rotated right by 6 bits. The second 64-bit result element is equal to the second 64-bit data element plus the value equal to the following operations: XORing the sixth 64-bit data element rotated right by nineteen bits with the sixth 64-bit data element rotated right by sixty-one bits, and XORing the sixth 64-bit data element rotated right by six bits. The third 64-bit result element is equal to the third 64-bit data element plus the value of the following operations: XORing the first 64-bit result element rotated right by 19 bits with the first 64-bit result element rotated right by 61 bits, and XORing the first 64-bit result element rotated right by 6 bits. The fourth 64-bit result element is equal to the fourth 64-bit data element plus the value of the following operations: XORing the second 64-bit result element circularly right-shifted by 19 bits with the second 64-bit result element circularly right-shifted by 61 bits, and XORing the second 64-bit result element right-shifted by 6 bits; and The result is stored in the first vector register.

2. The processor as claimed in claim 1, wherein, The fifth 64-bit data element and the sixth 64-bit data element are message elements according to the SHA512 hash standard.

3. The processor as claimed in claim 1, wherein, The first instruction is one of two instructions used to generate four SHA512 messages.

4. The processor as claimed in claim 1, wherein, The first 64-bit data element is used to be stored in bits [63:0] of the first vector register, the second 64-bit data element is used to be stored in bits [127:64] of the first vector register, the third 64-bit data element is used to be stored in bits [191:128] of the first vector register, and the fourth 64-bit data element is used to be stored in bits [255:192] of the first vector register.

5. The processor as claimed in claim 1, wherein, The execution circuit is used to store the first 64-bit result element in bits [63:0] of the first vector register, store the second 64-bit result element in bits [127:64] of the first vector register, store the third 64-bit result element in bits [191:128] of the first vector register, and store the fourth 64-bit result element in bits [255:192] of the first vector register.

6. The processor of claim 1, wherein, The first vector register is a 256-bit vector register.

7. The processor as claimed in claim 1, wherein, The first vector register is a YMM register.

8. The processor of claim 1, wherein, The processor is a Complex Instruction Set Computing (CISC) processor.

9. A method for instruction processing, comprising: Decode the first instruction, which is used to calculate the input message for the next round of hashing according to the SHA512 hash standard. The first instruction includes multiple fields specifying a first vector register and a second vector register. The first vector register stores a first 64-bit data element, a second 64-bit data element, a third 64-bit data element, and a fourth 64-bit data element. The second vector register stores a fifth 64-bit data element and a sixth 64-bit data element. as well as Execute the operation corresponding to the first instruction, including: The generated results include: The first 64-bit result element is equal to the first 64-bit data element plus the value of the following operations: XORing the fifth 64-bit data element rotated right by 19 bits with the fifth 64-bit data element rotated right by 61 bits, and XORing the fifth 64-bit data element rotated right by 6 bits. The second 64-bit result element is equal to the second 64-bit data element plus the value equal to the following operations: XORing the sixth 64-bit data element rotated right by nineteen bits with the sixth 64-bit data element rotated right by sixty-one bits, and XORing the sixth 64-bit data element rotated right by six bits. The third 64-bit result element is equal to the third 64-bit data element plus the value of the following operations: XORing the first 64-bit result element rotated right by 19 bits with the first 64-bit result element rotated right by 61 bits, and XORing the first 64-bit result element rotated right by 6 bits. The fourth 64-bit result element is equal to the fourth 64-bit data element plus the value of the following operations: XORing the second 64-bit result element circularly right-shifted by 19 bits with the second 64-bit result element circularly right-shifted by 61 bits, and XORing the second 64-bit result element right-shifted by 6 bits; and The result is stored in the first vector register.

10. The method of claim 9, wherein, The first 64-bit data element is used to be stored in bits [63:0] of the first vector register, the second 64-bit data element is used to be stored in bits [127:64] of the first vector register, the third 64-bit data element is used to be stored in bits [191:128] of the first vector register, and the fourth 64-bit data element is used to be stored in bits [255:192] of the first vector register.

11. The method of claim 9, wherein, Storing the result in the first vector register includes: storing the first 64-bit result element in bits [63:0] of the first vector register, storing the second 64-bit result element in bits [127:64] of the first vector register, storing the third 64-bit result element in bits [191:128] of the first vector register, and storing the fourth 64-bit result element in bits [255:192] of the first vector register.

12. The method of claim 9, wherein, Storing the result in the first vector register includes storing the result in a 256-bit vector register.

13. The method of claim 9, wherein, Storing the result in the first vector register includes storing the result in the YMM register.

14. A system for instruction processing, comprising: A non-transitory machine-readable storage medium stores code that, when executed by the system, causes the system to convert a first instruction of a first instruction set into one or more instructions of a different second instruction set. The first instruction is used to compute the input message for the next round of hashing according to the SHA512 hash standard. The first instruction includes multiple fields for specifying a first vector register and a second vector register. The first vector register is used to store a first 64-bit data element, a second 64-bit data element, a third 64-bit data element, and a fourth 64-bit data element. The second vector register is used to store a fifth 64-bit data element and a sixth 64-bit data element. A processor, coupled to the non-transitory machine-readable storage medium, is configured to execute one or more instructions of the second instruction set to perform an operation corresponding to the first instruction, including: Generate results, the results being used to include: The first 64-bit result element is equal to the first 64-bit data element plus the value of the following operations: XORing the fifth 64-bit data element rotated right by 19 bits with the fifth 64-bit data element rotated right by 61 bits, and XORing the fifth 64-bit data element rotated right by 6 bits. The second 64-bit result element is equal to the second 64-bit data element plus the value equal to the following operations: XORing the sixth 64-bit data element rotated right by nineteen bits with the sixth 64-bit data element rotated right by sixty-one bits, and XORing the sixth 64-bit data element rotated right by six bits. The third 64-bit result element is equal to the third 64-bit data element plus the value of the following operations: XORing the first 64-bit result element rotated right by 19 bits with the first 64-bit result element rotated right by 61 bits, and XORing the first 64-bit result element rotated right by 6 bits. The fourth 64-bit result element is equal to the fourth 64-bit data element plus the value of the following operations: XORing the second 64-bit result element circularly right-shifted by 19 bits with the second 64-bit result element circularly right-shifted by 61 bits, and XORing the second 64-bit result element right-shifted by 6 bits; and The results are stored in the destination.

15. The system of claim 14, wherein, The fifth 64-bit data element and the sixth 64-bit data element are message elements according to the SHA512 hash standard, and wherein the first instruction is one of two instructions for generating four SHA512 messages.

16. The system of claim 14, wherein, The first 64-bit data element is used to be stored in bits [63:0] of the first vector register, the second 64-bit data element is used to be stored in bits [127:64] of the first vector register, the third 64-bit data element is used to be stored in bits [191:128] of the first vector register, and the fourth 64-bit data element is used to be stored in bits [255:192] of the first vector register.

17. The system of claim 14, wherein, The processor is configured to store the first 64-bit result element in bits [63:0] of the destination, store the second 64-bit result element in bits [127:64] of the destination, store the third 64-bit result element in bits [191:128] of the destination, and store the fourth 64-bit result element in bits [255:192] of the destination.

18. The system of claim 14, wherein, The first vector register is a YMM register.

19. A non-transitory machine-readable storage medium storing code, the code including first instructions, the first instructions causing the machine to perform a method when executed by a machine, the method comprising: Decoding the first instruction, which is used to calculate the input message for the next round of hashing according to the SHA512 hash standard, the first instruction includes multiple fields specifying a first vector register and a second vector register, the first vector register storing a first 64-bit data element, a second 64-bit data element, a third 64-bit data element and a fourth 64-bit data element, and the second vector register storing a fifth 64-bit data element and a sixth 64-bit data element; as well as Execute the operation corresponding to the first instruction, including: The generated results include: The first 64-bit result element is equal to the first 64-bit data element plus the value of the following operations: XORing the fifth 64-bit data element rotated right by 19 bits with the fifth 64-bit data element rotated right by 61 bits, and XORing the fifth 64-bit data element rotated right by 6 bits. The second 64-bit result element is equal to the second 64-bit data element plus the value equal to the following operations: XORing the sixth 64-bit data element rotated right by nineteen bits with the sixth 64-bit data element rotated right by sixty-one bits, and XORing the sixth 64-bit data element rotated right by six bits. The third 64-bit result element is equal to the third 64-bit data element plus the value of the following operations: XORing the first 64-bit result element rotated right by 19 bits with the first 64-bit result element rotated right by 61 bits, and XORing the first 64-bit result element rotated right by 6 bits. The fourth 64-bit result element is equal to the fourth 64-bit data element plus the value of the following operations: XORing the second 64-bit result element circularly right-shifted by 19 bits with the second 64-bit result element circularly right-shifted by 61 bits, and XORing the second 64-bit result element right-shifted by 6 bits; and The results are stored in the destination.

20. The non-transitory machine-readable storage medium of claim 19, wherein, The first 64-bit data element is used to be stored in bits [63:0] of the first vector register, the second 64-bit data element is used to be stored in bits [127:64] of the first vector register, the third 64-bit data element is used to be stored in bits [191:128] of the first vector register, and the fourth 64-bit data element is used to be stored in bits [255:192] of the first vector register, wherein the first instruction specifies the YMM register.

Images