Reconfigurable computing circuit

Abstract

The invention relates to a reconfigurable computing circuit. A reconfigurable computing circuit that performs fully homomorphic encryption (FHE) enables full utilization of computing resources and data movement resources by mapping a plurality of N * 1024 polynomials onto (M * N) * 1024 polynomials. To counteract scrambling of coefficients during number-theoretical transform (NTT) and inverse NTT operations, a computing element in a computing circuit operates in a bypass mode that is enabled by a data shift instruction to transition from a scrambled form to a continuous form without modifying the values of the coefficients.

Description

[0001] STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH AND DEVELOPMENT

[0002] This invention was made with Government support under Contract No. HR0011-21-3-0003-0104 awarded by the Department of Defense. The Government has certain rights in this invention. Technical Field

[0003] The present disclosure relates to reconfigurable computing circuits that perform fully homomorphic encryption (FHE) to map unconstrained power-of-two FHE polynomials. Background Art

[0004] Homomorphic encryption is a form of encryption that allows computations to be performed on encrypted data without first decrypting it. Computations are performed on polynomials. The degree of a polynomial is the highest degree of the individual terms of the polynomial that have non-zero coefficients. The degree of a term is the sum of the exponents of the variables in the term. The degree of a polynomial is the highest exponent in the polynomial.

[0005] For example, the polynomial 5x 2 y 4 +3x-10 has three terms, two variables (x, y), and two coefficients (numbers by which the variables are multiplied). The degree of the first term is 6 (the sum of exponent 2 and exponent 4), the degree of the second term is 1, and the degree of the third term is 0. The degree of the polynomial is 6 (the highest exponent in a polynomial).

[0006] Fully Homomorphic Encryption (FHE) enables computations to be performed on encrypted data, or ciphertext, rather than on plaintext, or unencrypted data, so that data is always protected. FHE uses lattice cryptography, which presents a complex mathematical challenge to potential attackers.

[0007] The FHE standard supports a wide variety of polynomials, the degree of the polynomial ranges from 1024 (1K) to 128K, and each coefficient in the polynomial can range from 32 bits to 2K bits, depending on the degree of the polynomial. Summary of the invention

[0008] One aspect of the present disclosure provides a device, including: a reconfigurable fully homomorphic encryption accelerator, including: a plurality of computing elements for supporting operations on polynomials of degree (N*M)*1024, where M is greater than 1; an array of tiles, each tile including one or more of the plurality of computing elements; wherein the computing elements perform the following operations: perform number theoretic transform (NTT) and inverse NTT operations on one or more independent polynomials of degree N*1024, and convert output coefficients of the one or more independent polynomials into word-interleaved form, wherein the plurality of computing elements operate in a bypass mode to convert the word-interleaved form of the output coefficients into a continuous form without modifying and affecting the values ​​of the output coefficients; and a scratch pad memory for storing coefficients used by the plurality of computing elements to perform number theoretic transform (NTT) and inverse NTT (iNTT) operations; and a memory for storing data to be processed by the reconfigurable fully homomorphic encryption accelerator.

[0009] Another aspect of the present disclosure provides a system, comprising: a processor core; a reconfigurable fully homomorphic encryption accelerator, comprising: a plurality of computing elements for supporting operations on polynomials of degree (N*M)*1024, where M is greater than 1; an array of tiles, each tile comprising one or more of the plurality of computing elements; wherein the computing elements perform the following operations: perform number theoretic transform (NTT) and inverse NTT operations on one or more independent polynomials of degree N*1024, and convert output coefficients of the one or more independent polynomials into word-interleaved form, wherein the plurality of computing elements operate in a bypass mode to convert the word-interleaved form of the output coefficients into a continuous form without modifying and affecting the values ​​of the output coefficients; and a scratch pad memory for storing coefficients used by the plurality of computing elements to perform number theoretic transform (NTT) and inverse NTT (iNTT) operations; and a memory for storing data to be processed by the reconfigurable fully homomorphic encryption accelerator.

[0010] Another aspect of the present disclosure provides a method, including: a reconfigurable fully homomorphic encryption accelerator, including: supporting operations on polynomials of degree (N*M)*1024 through multiple computing elements in an array of tiles in the reconfigurable fully homomorphic encryption accelerator, where M is greater than 1; performing number theoretic transform (NTT) and inverse NTT operations on one or more independent polynomials of degree N*1024 through the computing elements; converting output coefficients of the one or more independent polynomials into word-interleaved form through the computing elements, wherein the multiple computing elements operate in a bypass mode to convert the word-interleaved form of the output coefficients into a continuous form without modifying and affecting the values ​​of the output coefficients; storing coefficients used by the multiple computing elements to perform number theoretic transform (NTT) and inverse NTT (iNTT) operations in a scratch pad memory; and storing data to be processed by the reconfigurable fully homomorphic encryption accelerator in a memory.

[0011] Yet another aspect of the present disclosure provides a device, comprising means for executing the method described in any aspect.

[0012] Yet another aspect of the present disclosure provides a machine-readable medium, comprising codes, which, when executed, cause the machine to perform the method as described in any one of the aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Various examples according to the present disclosure will be described with reference to the accompanying drawings, in which:

[0014] Figure 1 is a block diagram of a computational circuit for performing FHE optimized for 16K polynomials;

[0015] Figure 2 A block diagram of a computational circuit optimized for performing FHE for a 1024 (1K) coefficient polynomial is illustrated;

[0016] Figure 3 An example system is illustrated;

[0017] Figure 4 An example of a FHE accelerator is illustrated;

[0018] Figure 5 An example of an FHE compute engine tile is illustrated;

[0019] Figure 6 is a block diagram of an FHE accelerator that performs FHE computations on multiple independent N*1024 polynomials mapped onto a (M*N)*1024 polynomial;

[0020] Figure 7The block diagram illustrates a computing element having a configurable output data bypass mode in a tile in a tile array in a computing engine in a FHE accelerator;

[0021] Figure 8 is a block diagram of an FHE accelerator that performs computations on multiple independent NK polynomials mapped onto (M*N)*1024 polynomials, illustrating that after performing NTT operations on four 1024 polynomials, Figure 6 The distribution of the output coefficients of the four 1024 polynomials shown;

[0022] Fig. 9A An example of an instruction format is illustrated;

[0023] Fig. 9B The polynomial iNTT data movement instruction is used to move Figure 6 The word interleaving coefficients shown are converted to continuous form;

[0024] Fig.10 The iNTT data movement command will Figure 8 Block diagram of an FHE accelerator that performs computations on multiple independent N*1024 polynomials mapped onto a (M*N)*1024 polynomial after converting word-interleaved coefficients into continuous form;

[0025] Fig.11 The diagram shows Fig.10 As shown Figure 8 The word interleaved coefficients are converted to continuous form and then stored in a scratch pad memory;

[0026] Fig.12 The table shows how to combine Figure 6 and Figure 7 As described, for (M*N)*1024 polynomials, the FHE accelerator performs computational improvements on multiple independent N*1024 polynomials mapped onto the computation engine;

[0027] Fig.13 An example computing system is illustrated; and

[0028] Fig.14 A block diagram of an example SoC that may have one or more processor cores and with an integrated memory controller is illustrated.

[0029] FIG. 15(A) is a block diagram illustrating both an example in-order pipeline and an example register renaming, out-of-order issue / execution pipeline according to an example.

[0030] FIG. 15(B) is a block diagram illustrating both an example in-order architecture core and an example register renaming, out-of-order issue / execution architecture core to be included in a processor according to an example.

[0031] Fig.16 Examples of execution unit(s) circuitry are illustrated.

[0032] Fig.17 is a block diagram of a register architecture according to some examples.

[0033] Fig.18 An example of an addressing information field is illustrated.

[0034] Fig.19 An example of the first prefix is ​​illustrated.

[0035] Figure 20(A)-20(D) Illustration of how to use Fig.19 Example of the R, X, and B fields of the first prefix in .

[0036] Figure 21(A)-21(B) An example of the second prefix is ​​illustrated.

[0037] Fig. 22 An example of the third prefix is ​​illustrated.

[0038] Fig.23 The block diagram illustrates the use of a software instruction converter to convert binary instructions in a source instruction set architecture to binary instructions in a target instruction set architecture according to an example. DETAILED DESCRIPTION

[0039] Typically, computational circuits performing fully homomorphic encryption (FHE) have computational elements optimized for polynomials of a particular size (e.g., 8192 (8K) computational elements operating on polynomials of degree 16K (16384)). Computational circuits performing fully homomorphic encryption also include specialized data movement techniques (point-to-point or 2D mesh interconnects) to scramble coefficients during Number-Theoretic-Transform (NTT) and Inverse NTT operations, which are key operations in FHE workloads.

[0040] However, when smaller polynomials of degree 1024 (1K) to <16*1024 (1K) are mapped to a computational circuit (FHE accelerator) that performs FHE, the computational circuit that performs FHE optimized for polynomials of a specific degree suffers from a serious underutilization of computational resources and data movement resources. For example, mapping a 1K polynomial to a computational circuit on an FHE accelerator optimized for polynomials of degree 16K results in a 16-fold reduction in the utilization of computational elements in the FHE accelerator.

[0041] Figure 1 1 is a block diagram of an FHE accelerator 100 optimized for 16K polynomials. The FHE accelerator 100 has a scratch pad memory 106 and a compute engine having 64 tiles organized into an array having 8 rows and 8 columns. Each tile 102 has 128 compute elements, and the array of 64 tiles in the compute engine provides 8192 (8K) compute elements to perform 16K polynomial operations. Column 104 stores 1K polynomials (coefficients A0...A 1023 ), which uses 512 computational elements in the four tiles in the odd rows (coefficients A0…A 255 Stored in row 1, coefficient A 256 …A 511 Stored in row 3, coefficient A 512 …A 767 stored in row 5, and the coefficient A 768 …A 1023 The 1K polynomial is padded with zeros so that the length matches the number of tiles with zeros stored in all other tiles (60 tiles) to match the 16K coefficients, which results in a 16x underutilization of the computational elements in the FHE accelerator 100. After the 16K polynomial is computed, the result of the 1K polynomial operation can be extracted by tracking the number of zeros added to the 1K polynomial. The zero padding results in severe underutilization of computational and data movement resources in the computational circuitry that performs the FHE 100.

[0042] Figure 2A block diagram of an FHE accelerator 200 optimized for 1024 (1K) coefficient polynomials is illustrated. Larger polynomials are decomposed into several chunks based on the number of computational elements, and these chunks are processed serially by the FHE accelerator 200 optimized for 1024 (1K) coefficient polynomials. For example, an FHE accelerator that executes 1024 coefficient polynomials can execute larger polynomials, such as 16K polynomials, by decomposing the 16K polynomials into 16×1K coefficient chunks. The 16×1K chunks are serially streamed into the FHE accelerator 200, resulting in 16×1K output chunks. Reducing the number of computational elements in the FHE accelerator 200 has a significant impact on number theoretic transform (NTT) / inverse NTT (iNTT) performance when large polynomials are decomposed into chunks and executed serially in the FHE accelerator 200. This may affect the real-time latency of the workload / program executed in the FHE accelerator 200.

[0043] The reconfigurable FHE accelerator enables full utilization of computing resources and data movement resources by mapping multiple independent N*1024 polynomials (polynomials of degree N*1024) to (M*N)*1024 polynomials (polynomials of degree (M*N)*1024, i.e., the maximum degree supported by the FHE accelerator). In order to counteract the scrambling of coefficients during number theoretic transform (NTT) and inverse NTT operations, a computing element in the computing circuit (also referred to as a butterfly computing element or "butterfly") operates in a bypass mode enabled by a new data movement instruction to convert from a scrambled form of the coefficients to a continuous form without modifying the value of the coefficient.

[0044] The example computer architecture is described in detail below. Other system designs and configurations for laptops, desktop computers, handheld personal computers (personal computers, PCs), personal digital assistants, engineering workstations, servers, decomposed servers, network devices, network hubs, switches, routers, embedded processors, digital signal processors (digitalsignal processors, DSPs), graphics devices, video game devices, set-top boxes, microcontrollers, cellular phones, portable media players, handheld devices, and various other electronic devices known in the art are also appropriate. In a word, various systems or electronic devices that can include processors disclosed herein and / or other execution logics are generally appropriate.

[0045] Figure 3An example system 300 is illustrated. In some examples, the system 300 may be included in and / or operated within a computing platform. The computing platform may, for example, be located in a data center that is included in, for example, a cloud computing infrastructure, although examples are not limited to the system 300 being included in a computing platform located in a data center. Figure 3 As shown, system 300 includes compute express link (CXL) input / output (I / O) circuit 310, high bandwidth memory (HBM) 320, scratch pad memory 302, and a tile array (also referred to as a tile array) in a compute engine 340.

[0046] In some examples, the system 300 may be configured as a parallel processing device or accelerator to perform NTT / iNTT operations / computations to accelerate FHE workloads. For these examples, the CXL I / O circuitry 310 may be configured to couple with one or more host central processing units (CPUs—not shown) to receive instructions and / or data via circuits designed to operate in accordance with one or more CXL specifications published by the CXL Consortium, including but not limited to CXL Specification Revision 2.0 Version 1.0 published on October 26, 2020, or CXL Specification Revision 3.0 Version 1.0 published on August 1, 2022. In addition, the CXL I / O circuitry 310 may be configured to enable one or more host CPUs to obtain data associated with the execution of accelerated FHE workloads by computing elements included in interconnected tiles of the compute engine 340. For example, data (e.g., ciphertext or processed ciphertext) may be moved to or from the HBM 320, and the CXL I / O circuitry 310 may facilitate the movement of data into or out of the HBM 320 as part of the execution of the accelerated FHE workload. Additionally, the scratch pad memory 302 may be a type of memory (e.g., a register file) that may be proportionally allocated to tiles included in a tile array in the compute engine 340 to facilitate execution of accelerated FHE workloads and perform NTT / iNTT operations.

[0047] In some examples, as described in more detail below, the tile arrays in the compute engine 340 may be arranged as follows: Figure 3 The 8×8 tile configuration shown includes tiles 0 to 63. For these examples, each tile may include, but is not limited to, 128 computing elements ( Figure 3 (not shown). In addition, as described in more detail below, the 128 computational elements may be 128 individually reconfigurable butterfly circuits configured to compute output terms associated with polynomial coefficients of NTT / iNTT operations / computations. Figure 3As shown, tiles 0 to 63 can be interconnected through point-to-point connections via a 2-dimensional (2D) mesh interconnect-based architecture. The 2D mesh structure enables communication between adjacent tiles using single-hop links. Tiles included in the tile array in the computing engine 340 can be enhanced with router circuits that can route data received via input or sent via output in all 4 directions.

[0048] Examples are not limited to using CXL I / O circuits (e.g., CXL I / O circuits 310) to facilitate receiving instructions and / or data, or providing execution results associated with FHE workloads. Other types of I / O circuits and / or additional circuits are contemplated to receive instructions and / or data or provide execution results.

[0049] Examples are not limited to HBM (e.g., HBM 320) to receive data to be processed (memory for storing data to be processed), or to store information associated with instructions to execute a FHE workload or the results of execution of a FHE workload. Other types of volatile memory or non-volatile memory are contemplated for use in system 300. Other types of volatile memory may include, but are not limited to, dynamic RAM (DRAM), DDR synchronous dynamic RAM (DDR SDRAM), GDDR, static random-access memory (SRAM), thyristor RAM (T-RAM), or zero-capacitor RAM (Z-RAM). The non-volatile type of memory may include a byte or block addressable type of non-volatile memory, such as but not limited to multi-threshold level NAND flash memory, NOR flash memory, single-level or multi-level phase change memory (PCM), resistive memory, nanowire memory, ferroelectric transistor random access memory (FeTRAM), antiferroelectric memory, resistive memory including metal oxide-based, oxygen vacancy-based and conductive bridge random access memory (CB-RAM), spin electronic magnetic junction memory, magnetic tunneling junction (MTJ) memory, domain wall (DW) and spin orbit transfer (SOT) memory, thyristor-based memory, magnetoresistive random access memory (MRAM) combined with memristor technology, spin transfer torque MRAM (STT-MRAM), or a combination of any of the above.

[0050] According to some examples, system 300 may be included in a system-on-a-chip (SoC). SoC is a term commonly used to describe a device or system having computing elements and associated circuits (e.g., I / O circuits, butterfly circuits, power delivery circuits, memory controller circuits, memory circuits, etc.) monolithically integrated into a single integrated circuit ("IC") die or chip. For example, a device, computing platform, or computing system may have one or more computing elements (e.g., butterfly circuits) and associated circuits (e.g., I / O circuits, power delivery circuits, memory controller circuits, memory circuits, etc.) arranged in a disaggregated collection of discrete dies, tiles, and / or chiplets (e.g., one or more discrete computing dies are arranged adjacent to one or more other dies (e.g., memory dies, I / O dies, etc.)). In such disaggregated devices and systems, various dies, tiles, and / or chiplets may be physically and electrically coupled together by a packaging structure, which includes, for example, various packaging substrates, interposers, interconnect bridges, and the like. Additionally, these disaggregated devices may also be referred to as system-on-a-package (SoP).

[0051] Figure 4 An example of an FHE accelerator 403 is illustrated. As shown, the FHE accelerator 403 is coupled via one or more interconnects 413 to one or more host processors 401, such as one or more central processing unit (CPU) cores.

[0052] One or more interconnects 413 are coupled to scratch pad memory 302, which handles loading / storing of data and provides data for execution by compute engine 340, which includes multiple tiles 409. In some examples, tiles 409 are coupled to memory, interconnects 413, and / or compute engine control blocks 415.

[0053] Scratch pad memory 302 is coupled to high bandwidth memory (HBM) 320, which stores larger amounts of data. In some examples, the data is distributed across banks of HBM 320 and scratch pad memory 302. In some examples, the HBM is external to FHE accelerator 403. In some examples, some of the HBM is external to FHE accelerator 403 and some of the HBM is internal to FHE accelerator 403.

[0054] In some examples, the compute engine control block 415 dispatches instructions from the HBM 320 and the scratch pad 302 for the compute engine 340 and handles synchronization of data. In some examples, memory loads and stores are tracked in the compute engine control block 415 and dispatched on the scratch pad 302 to achieve coordinated data retrieval. These loads and stores are processed locally in the scratch pad 302 and written to the scratch pad 302 and / or HBM 320. In some examples, the compute engine control block 415 includes an instruction decoder to decode the instructions detailed herein. In some examples, the decoder of the host processor 401 decodes the instructions to be executed by the compute engine 340.

[0055] In some examples, the basic organizational structure of the FHE compute engine 340 is a wide and flexible array of functional units organized in a butterfly configuration. The array of butterfly units is tightly coupled with a register file that can store one or more of FHE operation objects (e.g., entire input and output ciphertexts), twiddle factor constants, related public key materials, etc. In some examples, the FHE operation objects, twiddle factors, key information, etc. are stored as polynomial coefficients.

[0056] The FHE compute engine 340 performs polynomial multiplication, addition, modulo reduction, etc. Given a i and b i , two polynomials a(x) and b(x) on the ring can be expressed as

[0057] a(x)=a0+a1x+a2x 2 +…a n-1 x n-1

[0058] b(x)=b0+b1x+b2x 2 +…b n-1 x n-1

[0059] In some examples, the initial configuration of the array relative to the register file allows full reuse of the register file when processing ring-LWE polynomials of order up to N=16384 and log q=512 bit-long coefficients; and partial reuse beyond such parameters, for which processing the ciphertext would require moving data from or to upper levels of the memory hierarchy.

[0060] In some examples, the FHE compute engine 340 consists of 512-bit Large Arithmetic Word Size (LAWS) units organized as vector butterfly data paths. The butterfly unit (whether LAWS or not) is designed to natively support operations on operands, where the operands are either in a positional form or using the Chinese Remainder Theorem (CRT) representation. In some examples, a dual CRT representation is used. The first CRT layer uses the Residue Number System (RNS) to decompose the polynomial into a tuple of polynomials with smaller moduli. The second layer converts each small polynomial into a vector of modulus integers via NTT. In the dual CRT representation, any polynomial is identified using a matrix consisting of small integers, and this enables efficient polynomial arithmetic by performing component-wise modulo operations. RNS decomposition provides the dual advantages of improved performance using Single Instruction / Multiple Data (SIMD) operations and quadratic reduction in area as the width of the operands is reduced.

[0061] Figure 5 An example of an FHE compute engine tile is illustrated. In some examples, this is an illustration of an FHE compute engine tile 409.

[0062] As shown, each FHE compute engine tile 409 consists of a subset of register files (shown as multiple register file bank groups 501) coupled with a computing element 503 (e.g., 64 such elements in this illustration allow different numbers of register file bank groups and computing elements to be used in some examples). In some examples, each computing element consumes up to 3 input operands and produces 2 output operands per cycle.

[0063] In some examples, the register file subsets are organized into 4 banks, each bank group is 18KB, where each memory bank group includes 16 physical storage modules with a depth of 72 words and has a 128-bit 1 read / 1 write port. The register file bank group 501 of 1 read / 1 write port feeds "a", "b", "c" and / or "ω" inputs for each computing element. Two outputs (a+ω*b and a-ω*b) are written to any of the four register file bank groups simultaneously for NTT or iNTT.

[0064] Figure 64 is a block diagram of an FHE accelerator 403 that performs FHE computations on multiple independent N*1024 polynomials mapped onto a (M*N)*1024 polynomial. The FHE accelerator 403 includes the scratch pad memory 302 in the system 300 and a tile array in the compute engine 340.

[0065] exist Figure 6 In the example shown, N is 1 and M is 16. Multiple smaller polynomials (1K) are mapped (also called packing) to one large polynomial (degree 16K). Four 1K polynomials (labeled A, B, C, and D) are mapped to one degree 16K polynomial. Mapping NK polynomials (polynomials of degree N*1024) to M*N*1024 polynomials (polynomials of degree (M*N)*1024, which is the maximum degree supported by the FHE accelerator) is scalable and Figure 6 In the example shown, up to 16×1K (16 polynomials of degree 1K) polynomials can be packed into a single polynomial of degree 16K. The coefficients of the four 1K polynomials of degree 1K (labeled A, B, C, and D) are distributed in a consecutive manner to facilitate the memory access required for the NTT operation.

[0066] The FHE accelerator 403 has a scratch pad memory 302 and a tile array in a compute engine 340 having 64 tiles organized in an array having 8 rows and 8 columns. Each tile 409 has 128 computational elements. The array of 64 tiles provides 8192 (8K) computational elements to perform polynomial operations on polynomials of degree 16K. Four polynomials of degree 1K (labeled A, B, C, and D) are stored in tiles in columns 604, 606, 608, and 610 in the tile array in the compute engine 340.

[0067] Column 604 stores 1K polynomials (A, with coefficients A0...A 1023 ), which uses 512 computational elements in the four tiles in the odd rows (coefficients A0…A 255 Stored in row 1, coefficient A 256 …A 511 Stored in row 3, coefficient A 512 …A 767 stored in row 5, and the coefficient A 768 …A 1023 stored in row 7).

[0068] Column 606 stores 1K polynomials (B, with coefficients B0...B 1023 ), which uses 512 computational elements in the four tiles in the odd rows (coefficients B0…B 255 Stored in row 1, coefficient B 256…B 511 Stored in row 3, coefficient B 512 …B 767 stored in row 5, and the coefficient B 768 …B 1023 stored in row 7).

[0069] Column 608 stores 1K polynomials (C, coefficients C0...C 1023 ), which uses 512 computational elements in the four tiles in the odd rows (coefficients C0…C 255 Stored in row 1, coefficient C 256 …C 511 Stored in row 3, coefficient C 512 …C 767 stored in row 5, and the coefficient C 768 …C 1023 stored in row 7).

[0070] Column 610 stores 1K polynomials (D, with coefficients D0...D 1023 ), which uses 512 computational elements in the four tiles in the odd rows (coefficients D0…D 255 Stored in row 1, coefficient D 256 …D 511 Stored in row 3, coefficient D 512 …D 767 stored in row 5, and the coefficient D 768 …D 1023 stored in row 7).

[0071] In the example of 16 1K polynomials (polynomials of degree 1K) stored in an array of 64 tiles, the FHE accelerator 403 will perform single instruction / multiple data (SIMD) execution on all 16 degree 1K polynomials simultaneously, thereby utilizing the available computational resources in the FHE accelerator 403. The FHE accelerator 403 performs operations such as addition, multiplication, and multiplication and accumulation, which do not involve any data movement between the polynomial coefficients. The FHE accelerator 403 also performs NTT and iNTT operations, which involve fixed permutations of coefficients implemented by constant geometry NTT / iNTT networks. NTT is a FHE operation used to convert a polynomial ring operand to its Chinese Theorem (CRT) counterpart, which converts polynomial multiplication from O(n 2 ) simplifies to O(nlogn) multiplications, where n is the degree of the polynomial.

[0072] Figure 7The block diagram of FIG. 4 illustrates a computing element 710 having a configurable output data bypass mode in a tile in a tile array in a computing engine 340 in an FHE accelerator 403. The number of computing elements 710 in the computing engine 340 is denoted as N. CE The degree of the polynomial is N (eg, 1K or 16K). Since the degree of the polynomial mapped on the compute engine 340 is fixed during runtime, the degree value is streamed into the compute engine 340 as metadata before executing the workload.

[0073] The computing element 710 is configured to perform NTT or iNTT to generate a+ω*b and a−ω*b.

[0074] The values ​​of a, b, and ω can be of any size, such as 32 bits, 512 bits, etc. Typically, the values ​​of a, b, and ω are integers. NTT and iNTT are key operations for accelerating FHE workloads. NTT / iNTT converts polynomial ring operation objects into their Chinese Remainder Theorem (CRT) representation, thereby speeding up polynomial multiplication operations from O(n) to O(n). 2 ) is improved to O(nlogn). A reconfigurable fully homomorphic encryption accelerator is used to configure multiple computing elements to operate in a bypass mode in response to receiving a polynomial iNTT data movement instruction.

[0075] The computational element 710 has two inputs, the first input is a, and the second input is b. The outputs of the computational element 710 are a+b*w and ab*w, where a and b correspond to the polynomial input coefficients of the NTT / iNTT operation, and w corresponds to the rotation factor. There are two 2:1 multiplexers 702, 702. Multiplexer 702 receives two inputs (a+b*w, a), and multiplexer 704 receives two inputs (ab*w, b). Multiplexer 702 selects between the two inputs (a+b*w, a). Multiplexer 704 selects between the two inputs (ab*w, a). The state of the bypass signal 712 selects one of the two inputs received by the multiplexer 702 to be provided on the output port 706 of the computational element 710. When configured in bypass mode, the state of bypass signal 712 selects one of the two inputs received by multiplexer 704 to be provided on output port 708 of computational element 710 .

[0076] When the degree of the polynomial (N) is greater than the number of computing elements 710 in the computing engine 340 (N CE ). For example, N is 16K and N CEThe computing element 710 operates in a normal NTT mode and an iNTT mode to process an input polynomial so as to generate outputs a+b*w and ab*w, where a and b correspond to the polynomial input coefficients of the NTT / iNTT operation and w corresponds to the rotation factor. The state of the bypass signal 712 selects a+b*w received by the multiplexer 702 to be provided on the output port 706 of the computing element 710. The state of the bypass signal 712 selects ab*w received by the multiplexer 704 to be provided on the output port 708 of the computing element 710.

[0077] When the degree of the polynomial (N) is less than the number of computing elements 710 in the computing engine 340 (N CE ). For example, N is 1K and N CE For 8K, the computing element 710 operates in the iNTT data shift in data bypass mode to rearrange the coefficients. During the bypass mode, the computing engine 340 provides the input coefficients a and b on the output ports 706, 708 without performing calculations on the input coefficients a and b. The state of the bypass signal 712 selects the "a" received by the multiplexer 702 to be provided on the output port 706 of the computing element 710. The state of the bypass signal 712 selects the "b" received by the multiplexer 704 to be provided on the output port 708 of the computing element 710. In the bypass mode, the computing element 710 converts the word interleaved form of the output coefficients to a continuous form without modifying the value of the output coefficients.

[0078] Figure 8 is a block diagram of an FHE accelerator 403 that performs computations on multiple independent N*1024 polynomials mapped onto a (M*N)*1024 polynomial, illustrating that after performing NTT operations on four 1K polynomials, Figure 6 Distribution of output coefficients of four 1K polynomials shown.

[0079] Will combine Figure 6 and Figure 7 To describe Figure 8 .

[0080] When the pair is mapped to Figure 6 When performing NTT operations on multiple independent N*1024 polynomials on the (M*N)*1024 polynomials shown, the constant geometry network scrambles the outputs (a+b*w, ab*w) from the computational element 710 in the tiles in columns 604, 606, 608, 610, so that the output coefficients are converted to Figure 8 The word interleaving form shown. The word interleaving form means that the coefficients of multiple independent polynomials are interleaved in the same storage block.

[0081] The output coefficients of the four 1K polynomials labeled A, B, C, and D are distributed so that the tiles in columns 604, 606, 608, 610 contain a subset of the output coefficients from all 1K polynomials (each tile contains 64 coefficients of each 1K polynomial).

[0082] Column 604 stores the output coefficients (0-255) of the four 1K polynomials labeled A, B, C, and D in tiles 802, 804, 806, 808. Tile 802 stores the output coefficients 0-63 of the polynomials labeled A, B, C, and D. Tile 804 stores the output coefficients 64-127 of the polynomials labeled A, B, C, and D. Tile 806 stores the output coefficients 128-191 of the polynomials labeled A, B, C, and D. Tile 808 stores the output coefficients 192-255 of the polynomials labeled A, B, C, and D.

[0083] Column 606 stores the output coefficients (256-511) of the four 1K polynomials labeled A, B, C, and D in tiles 810, 812, 814, 816. Tile 810 stores the output coefficients 256-319 of the polynomials labeled A, B, C, and D. Tile 812 stores the output coefficients 320-383 of the polynomials labeled A, B, C, and D. Tile 814 stores the output coefficients 384-447 of the polynomials labeled A, B, C, and D. Tile 816 stores the output coefficients 448-767 of the polynomials labeled A, B, C, and D.

[0084] Column 608 stores the output coefficients (512-767) of the four 1K polynomials labeled A, B, C, and D in tiles 818, 820, 822, 824. Tile 818 stores the output coefficients 512-575 of the polynomials labeled A, B, C, and D. Tile 820 stores the output coefficients 576-639 of the polynomials labeled A, B, C, and D. Tile 822 stores the output coefficients 640-703 of the polynomials labeled A, B, C, and D. Tile 824 stores the output coefficients 704-767 of the polynomials labeled A, B, C, and D.

[0085] Column 610 stores the output coefficients (768-1023) of the four 1K polynomials labeled A, B, C, and D in tiles 826, 828, 830, 832. Tile 826 stores the output coefficients 768-831 of the polynomials labeled A, B, C, and D. Tile 828 stores the output coefficients 832-895 of the polynomials labeled A, B, C, and D. Tile 830 stores the output coefficients 896-959 of the polynomials labeled A, B, C, and D. Tile 832 stores the output coefficients 960-1023 of the polynomials labeled A, B, C, and D.

[0086] When a single large polynomial is mapped onto the FHE compute engine, there is no interaction between coefficients distributed within the tile for SIMD operations on the FHE compute engine. However, when multiple smaller polynomials are packed into a large polynomial, FHE operations (e.g., addition / multiplication on a subset of polynomials) require interaction between coefficients distributed within the tile.

[0087] Instruction set architecture.

[0088] An instruction set architecture (ISA) may include one or more instruction formats. A given instruction format may define various fields (e.g., the number of bits, the position of the bits) to specify the operation to be performed (e.g., opcode) and the (one or more) operands and / or other (one or more) data fields (e.g., mask) on which the operation is to be performed, etc. Some instruction formats are further decomposed by the definition of instruction templates (or subformats). For example, an instruction template of a given instruction format may be defined as having different subsets of the fields of the instruction format (the included fields are usually in the same order, but at least some have different bit positions because there are fewer included fields) and / or defined as having a given field interpreted in a different manner. Thus, each instruction of the ISA is expressed using a given instruction format (and, if defined, expressed in a given instruction template in the instruction format), and includes fields for specifying the operation and the operand. For example, the example ADD instruction has a specific opcode and instruction format, which includes an opcode field to specify the opcode and an operand field to select the operand (source 1 / destination and source 2); and the appearance of this ADD instruction in the instruction stream will have specific content in the operand field to select the specific operand.

[0089] Example instruction format.

[0090] The examples of the (one or more) instructions described herein may be implemented in different formats. In addition, example systems, architectures, and pipelines are described in detail below. The examples of (one or more) instructions may be executed on these systems, architectures, and pipelines, but are not limited to those described in detail.

[0091] Fig. 9AAn example of an instruction format is illustrated. As shown, an instruction may include multiple components, including, but not limited to, one or more fields for: one or more prefixes 901, an opcode 903, addressing information 905 (e.g., a register identifier, memory addressing information, etc.), a displacement value 907, and / or an immediate value 909. Note that some instructions utilize some or all of the fields of the format, while other instructions may only use the opcode 903 field. In some examples, the illustrated order is the order in which the fields are to be encoded, however, it should be understood that in other examples, the fields may be encoded in another order, combined, etc.

[0092] (One or more) prefix fields 901 modify the instruction when used. In some examples, one or more prefixes are used to repeat string instructions (e.g., 0xF0, 0xF2, 0xF3, etc.), provide section override (e.g., 0x2E, 0x36, 0x3E, 0x26, 0x64, 0x65, 0x2E, 0x3E, etc.), perform bus lock operations, and / or change operation objects (e.g., 0x66) and address sizes (e.g., 0x67). Some instructions require mandatory prefixes (e.g., 0x66, 0xF2, 0xF3, etc.). Some of these prefixes can be considered as "traditional" prefixes. Other prefixes (one or more examples of which are described in detail herein) indicate and / or provide further capabilities, such as specifying specific registers, etc. These other prefixes are usually followed by the "traditional" prefix.

[0093] The opcode field 903 is used to at least partially define the operation to be performed when the instruction is decoded. In some examples, the length of the primary opcode encoded in the opcode field 903 is one, two or three bytes. In other examples, the primary opcode can be other lengths. Extra 3-bit opcode fields are sometimes encoded in another field.

[0094] The addressing information field 905 is used to address one or more operands of the instruction, such as a location in memory or one or more registers.

[0095] Fig. 9B The polynomial iNTT data movement instruction is used to move Figure 6 The word interleaved coefficients shown are converted to continuous form. Continuous form means that the coefficients of the same polynomial are in the same memory block.

[0096] The instruction format is (opcode, src_address1, src_address2, src_address3, dst_address1, dst_address2, metadata). The opcode field 903 is used to define the operation (iNTT data move) to be performed after the instruction is decoded. The addressing information field 905 is used to address the operand of the iNTT data move instruction. The operand includes one or more fields (source address 1 902, source address 2 904, source address 3 906) to indicate the memory source location, and one or more fields (destination address 1 908 and destination address 2 910) to indicate the destination of the data being moved (e.g., scratch pad memory, HBM, register file, etc.). The immediate value field 909 stores metadata (e.g., the degree of the polynomial). Since the degree of the polynomial mapped on the compute engine is fixed during runtime, the degree value is flowed in as metadata before the workload is executed. In other embodiments, instructions to perform iNTT data moves may have more than Fig. 9B Fewer or more operands are shown.

[0097] Fig.10 The iNTT data movement command will Figure 8 A block diagram of an FHE accelerator 403 is shown that performs computations on multiple independent N*1024 polynomials mapped onto a (M*N)*1024 polynomial after converting word-interleaved coefficients to a continuous form.

[0098] The output coefficients of the four 1K polynomials labeled A, B, C, and D are distributed so that the tiles in each of columns 1050, 1052, 1054, 1056 contain a subset of the output coefficients from one of the 1K polynomials (each tile contains 256 coefficients of the 1K polynomial).

[0099] Column 1050 stores the output coefficients (0-1024) of the 1K polynomial labeled A in tiles 1002, 1004, 1006, 1008. Tile 1002 stores the output coefficients 0-63 of the 1K polynomial labeled A. Tile 1004 stores the output coefficients 64-127 of the 1K polynomial labeled A. Tile 1006 stores the output coefficients 128-191 of the polynomial labeled A. Tile 1008 stores the output coefficients 192-255 of the polynomial labeled A.

[0100] Column 1052 stores the output coefficients (0-1024) of the 1K polynomial labeled B in tiles 1010, 1012, 1014, 1016. Tile 1010 stores the output coefficients 0-63 of the 1K polynomial labeled B. Tile 1012 stores the output coefficients 64-127 of the 1K polynomial labeled B. Tile 1014 stores the output coefficients 128-191 of the polynomial labeled B. Tile 1016 stores the output coefficients 192-255 of the polynomial labeled B.

[0101] Column 1054 stores the output coefficients (0-1024) of the 1K polynomial labeled C in tiles 1018, 1020, 1022, 1024. Tile 1018 stores the output coefficients 0-63 of the 1K polynomial labeled C. Tile 1020 stores the output coefficients 64-127 of the 1K polynomial labeled C. Tile 1022 stores the output coefficients 128-191 of the polynomial labeled C. Tile 1024 stores the output coefficients 192-255 of the polynomial labeled C.

[0102] Column 1056 stores the output coefficients (0-1024) of the 1K polynomial labeled D in tiles 1026, 1028, 1030, 1032. Tile 1026 stores the output coefficients 0-63 of the 1K polynomial labeled D. Tile 1028 stores the output coefficients 64-127 of the 1K polynomial labeled D. Tile 1030 stores the output coefficients 128-191 of the polynomial labeled A. Tile 1032 stores the output coefficients 192-255 of the polynomial labeled D.

[0103] Fig.11 The diagram shows Fig.10 As shown Figure 8 The scratch pad memory 302 is shown as being used to store the word-interleaved coefficients after they have been converted to continuous form.

[0104] After the coefficients are arranged in a consecutive form, the degree 1K polynomials can interact with each other by streaming the coefficients to the scratch pad memory 302 and bringing the coefficients back to the computation engine to perform operations (∑) (e.g., modular addition, modular multiplication, or modular multiplication-accumulation) on subsets of the coefficients on subsets of the polynomials.

[0105] exist Fig.11In the example shown, coefficient subsets 1104, 1106, 1108, 1110 are stored in scratch pad memory 302. Tiles 1112, 1114, 1116, 1108 in column 1102 of tile array perform operations on coefficient subsets 1104, 1106, 1108, 1110. Tile 1112 performs operations on coefficient subset 1104. Tile 1114 performs operations on coefficient subset 1106. Tile 1116 performs operations on coefficient subset 1108. Tile 1118 performs operations on coefficient subset 1110.

[0106] Fig.12 The table shows how to combine Figure 6 and Figure 7 As described above, for (M*N)*1024 polynomials, the FHE accelerator 403 improves the performance of performing calculations on multiple independent N*1024 polynomials mapped to the computation engine.

[0107] Table 1200 illustrates the combination of Figure 1 As shown in Table 1200, there is a 16-fold performance improvement for 1K polynomials at 100% compute engine utilization, an 8-fold performance improvement for 2K polynomials at 100% compute engine utilization, a 4-fold performance improvement for 4K polynomials at 100% compute engine utilization, and a 2-fold performance improvement for 8K polynomials at 100% compute engine utilization.

[0108] Fig.13 An example computing system is illustrated. Multiprocessor system 1300 is an interfaced system and includes multiple processors or cores, including a first processor 1370 and a second processor 1380 coupled via an interface 1350 (e.g., a point-to-point (PP) interconnect, a fabric, and / or a bus). In some examples, first processor 1370 and second processor 1380 are isomorphic. In some examples, first processor 1370 and second processor 1380 are heterogeneous. Although example system 1300 is shown as having two processors, the system may have three or more processors, or may be a single processor system. In some examples, the computing system is a system on a chip (SoC).

[0109] Processors 1370 and 1380 are shown as including integrated memory controller (IMC) circuits 1372 and 1382, respectively. Processor 1370 also includes interface circuits 1376 and 1378; similarly, second processor 1380 includes interface circuits 1386 and 1388. Processors 1370, 1380 can exchange information via interface 1350 using interface circuits 1378, 1388. IMCs 1372 and 1382 couple processors 1370, 1380 to respective memories, namely memory 1332 and memory 1334, which can be part of the main memory (system memory) locally attached to the respective processors. Memory 1332 and memory 1334 store instructions and data.

[0110] Processors 1370, 1380 can each utilize interface circuits 1376, 1394, 1386, 1398 to exchange information with a network interface (NW I / F) 1390 via respective interfaces 1352, 1354. Network interface 1390 (e.g., one or more of an interconnect, bus, and / or structure, a chipset in some examples) can optionally exchange information with a coprocessor 1338 via interface circuit 1392. In some examples, coprocessor 1338 is a special-purpose processor, such as a high-throughput processor, a network or communication processor, a compression engine, a graphics processor, a general-purpose graphics processing unit (GPGPU), a neural-network processing unit (NPU), an embedded processor, and the like.

[0111] A shared cache (not shown) may be included in either processor 1370, 1380, or external to both processors but connected to the processors via an interface, such as a point-to-point (PP) interconnect, such that if a processor is placed in a low power mode, local cache information of either or both processors may also be stored in the shared cache.

[0112] The network interface 1390 can be coupled to the first interface 1316 via the interface circuit 1396. In some examples, the first interface 1316 can be an interface such as a Peripheral Component Interconnect (PCI) interconnect, a PCI Express interconnect, or another I / O interconnect. In some examples, the first interface 1316 is coupled to a power control unit (PCU) 1317, which can include circuits, software, and / or firmware to perform power management operations with respect to the processors 1370, 1380, and / or the coprocessor 1338. The PCU 1317 provides control information to a voltage regulator (not shown) so that the voltage regulator generates an appropriate regulated voltage. The PCU 1317 also provides control information to control the generated operating voltage. In various examples, the PCU 1317 can include various power management logic units (circuits) to perform hardware-based power management. Such power management may be entirely processor controlled (e.g., controlled by various processor hardware and may be triggered by workload and / or power constraints, thermal constraints, or other processor constraints), and / or power management may be performed in response to an external source (e.g., a platform or power management source or system software).

[0113] PCU 1317 is illustrated as existing as logic separate from processor 1370 and / or processor 1380. In other cases, PCU 1317 may execute on a given one or more of the cores (not shown) of processor 1370 or 1380. In some cases, PCU 1317 may be implemented as a microcontroller (dedicated or general purpose) or other control logic that is configured to execute its own dedicated power management code (sometimes referred to as P-code). In still other examples, the power management operations to be performed by PCU 1317 may be implemented external to the processor, such as by a separate power management integrated circuit (PMIC) or another component external to the processor. In still other examples, the power management operations to be performed by PCU 1317 may be implemented within BIOS or other system software.

[0114] Various I / O devices 1314 and a bus bridge 1318 can be coupled to the first interface 1316, which couples the first interface 1316 to the second interface 1320. In some examples, (one or more) additional processors 1315 are coupled to the first interface 1316, such as a coprocessor, a high-throughput many integrated core (MIC) processor, a GPGPU, an accelerator (such as a graphics accelerator or a digital signal processing (DSP) unit), a field programmable gate array (FPGA), or any other processor. In some examples, the second interface 1320 can be a low pin count (LPC) interface. Various devices can be coupled to the second interface 1320, including, for example, a keyboard and / or mouse 1322, a communication device 1327, and a storage circuit 1328. Storage circuit 1328 may be one or more non-transitory machine-readable storage media as described below, such as a disk drive or other mass storage device, which in some examples may include instructions / code and data 1330 and may implement storage device `ISAB03. Additionally, audio I / O 1324 may be coupled to second interface 1320. Note that other architectures are possible in addition to the point-to-point architecture described above. For example, a system such as multiprocessor system 1300 may implement a multi-drop interface or other such architecture instead of a point-to-point architecture.

[0115] Example core architectures, processors, and computer architectures.

[0116] Processor cores ("cores") may be implemented in different ways, for different purposes, and in different processors. For example, implementations of these cores may include: 1) general-purpose in-order cores, for general-purpose computing purposes; 2) high-performance general-purpose out-of-order cores, for general-purpose computing purposes; 3) special-purpose cores, primarily for graphics and / or scientific (throughput) computing purposes. Different processor implementations may include: 1) a CPU, including one or more general-purpose in-order cores for general-purpose computing purposes and / or one or more general-purpose out-of-order cores for general-purpose computing purposes; and 2) a coprocessor, including one or more special-purpose cores primarily for graphics and / or scientific (throughput) computing purposes. These different processors result in different computer system architectures, which may include: 1) the coprocessor is on a separate chip from the CPU; 2) the coprocessor is on a separate die from the CPU in the same package; 3) the coprocessor is on the same die as the CPU (in which case such coprocessors are sometimes referred to as dedicated logic, such as integrated graphics and / or scientific (throughput) logic, or as dedicated cores); and 4) a system on a chip (SoC), which may be included on the same die as the described CPU (sometimes referred to as application core(s) or application processor(s), the coprocessors described above, and additional functionality.

[0117] Fig.14 A block diagram of an example SoC 1400 is illustrated, which may have one or more cores and have an integrated memory controller. SoC 1400 includes different components (hardware elements), also referred to as "blocks" or subsystems.

[0118] The SoC 1400 illustrated in the solid line frame has a single processor core 1402(A), a system agent unit circuit 1410, and a set of one or more interface controller unit circuits 1416, while the optionally added dashed line frame illustrates an alternative SoC 1400 as having multiple cores 1402(A)-(N), a set of one or more integrated memory control unit circuits 1414 in the system agent unit circuit 1410, dedicated logic 1408, and a set of one or more interface controller unit circuits 1416. Note that the SoC 1400 may be Fig.13 processor 1370 or 1380, or one of the coprocessors 1338 or 1315.

[0119] Thus, different implementations of SoC 1400 may include: 1) a CPU, where the dedicated logic 1408 is integrated graphics and / or scientific (throughput) logic (which may include one or more cores, not shown), and cores 1402(A)-(N) are one or more general purpose cores (e.g., general purpose in-order cores, general purpose out-of-order cores, or a combination of the two); 2) a coprocessor, where cores 1402(A)-(N) are a large number of dedicated cores primarily for graphics and / or scientific (throughput) purposes; and 3) a coprocessor, where cores 1402(A)-(N) are a large number of general purpose in-order cores. Thus, SoC 1400 may be a general purpose processor, a coprocessor, or a dedicated processor, such as a network or communication processor, a compression engine, a graphics processor, a GPGPU (general purpose graphics processing unit), a high throughput many integrated core (MIC) coprocessor (including 30 or more cores), an embedded processor, and the like. The processor may be implemented on one or more chips. SoC 1400 may be part of and / or may be implemented on one or more substrates using any of a variety of process technologies, such as complementary metal oxide semiconductor (CMOS), bipolar CMOS (BiCMOS), P-type metal oxide semiconductor (PMOS), or N-type metal oxide semiconductor (NMOS).

[0120] The memory hierarchy includes one or more levels of cache unit circuits 1404(A)-(N) within the cores 1402(A)-(N), a set of one or more shared cache unit circuits 1406, and external memory (not shown) coupled to the set of integrated memory controller unit circuits 1414. The set of one or more shared cache unit circuits 1406 may include one or more intermediate level caches, such as level 2 (L2), level 3 (L3), level 4 (4), or other levels of cache, such as last level cache (LLC), and / or combinations thereof. While in some examples an interface network circuit 1412 (e.g., a ring interconnect) provides an interface to dedicated logic 1408 (e.g., integrated graphics logic), the set of shared cache unit circuits 1406, and the system agent unit circuit 1410, alternative examples use any number of well-known techniques to provide interfaces to these units. In some examples, coherency is maintained between one or more circuits in the shared cache unit circuits 1406 and the cores 1402(A)-(N). In some examples, interface controller unit circuit 1416 couples the cores 1402 to one or more other devices 1418, such as one or more I / O devices, storage, one or more communication devices (e.g., wireless network, wired network, etc.), and the like.

[0121] In some examples, one or more of the cores 1402(A)-(N) have multi-threading capabilities. System agent unit circuitry 1410 includes those components that coordinate and operate the cores 1402(A)-(N). System agent unit circuitry 1410 may include, for example, power control unit (PCU) circuitry and / or display unit circuitry (not shown). The PCU may be (or may include) logic and components required to regulate the power state of the cores 1402(A)-(N) and / or the dedicated logic 1408 (e.g., integrated graphics logic). The display unit circuitry is used to drive one or more externally connected displays.

[0122] The cores 1402(A)-(N) may be homogeneous with respect to instruction set architecture (ISA). Alternatively, the cores 1402(A)-(N) may be heterogeneous with respect to ISA; that is, a subset of the cores 1402(A)-(N) may be capable of executing one ISA, while other cores may be capable of executing only a subset of the ISA or may be capable of executing another ISA.

[0123] Example core architectures—in-order and out-of-order core block diagrams.

[0124] Figure 15(A) is a block diagram illustrating both an example in-order pipeline and an example register renaming, out-of-order issue / execution pipeline according to an example. Figure 15(B) is a block diagram illustrating both an example in-order architecture core and an example register renaming, out-of-order issue / execution architecture core to be included in a processor according to an example. Figure 15(A)-15(B) The solid line boxes in illustrate the in-order pipeline and in-order core, while the optionally added dashed line boxes illustrate the register renaming, out-of-order issue / execution pipeline and core. Considering that the in-order aspect is a subset of the out-of-order aspect, the out-of-order aspect will be described.

[0125] In FIG. 15(A), a processor pipeline 1500 includes a fetch stage 1502, an optional length decoding stage 1504, a decode stage 1506, an optional allocation (Alloc) stage 1508, an optional rename stage 1510, a dispatch (also called dispatch or issue) stage 1512, an optional register read / memory read stage 1514, an execute stage 1516, a write back / memory write stage 1518, an optional exception handling stage 1522, and an optional commit stage 1524. One or more operations may be performed in each of these processor pipeline stages. For example, during the fetch stage 1502, one or more instructions are fetched from an instruction memory, and during the decode stage 1506, the fetched one or more instructions may be decoded, an address using a forwarding register port (e.g., a load store unit (LSU) address) may be generated, and branch forwarding (e.g., an immediate offset or a link register (LR)) may be performed. In one example, the decode stage 1506 and the register read / memory read stage 1514 can be combined into one pipeline stage. In one example, during the execute stage 1516, decoded instructions can be executed, LSU address / data pipelining to an Advanced Microcontroller Bus (AMB) interface can be performed, multiplication and addition operations can be performed, arithmetic operations with branch results can be performed, and the like.

[0126] As an example, the example register renaming, out-of-order issue / execution architecture core of FIG. 15(B) may implement pipeline 1500 in the following manner: 1) instruction fetch circuit 1538 performs fetch and length decoding stages 1502 and 1504; 2) decoding circuit 1540 performs decoding stage 1506; 3) renaming / allocator unit circuit 1552 performs allocation stage 1508 and renaming stage 1510; 4) (one or more) scheduler circuit 1556 performs scheduling stage 1512; 5) (one or more) physical registers The register file circuit 1558 and the memory unit circuit 1570 perform the register read / memory read phase 1514; (one or more) execution clusters 1560 perform the execute phase 1516; 6) the memory unit circuit 1570 and (one or more) physical register file circuits 1558 perform the write back / memory write phase 1518; 7) various circuits may be involved in the exception handling phase 1522; and 8) the retirement unit circuit 1554 and (one or more) physical register file circuits 1558 perform the commit phase 1524.

[0127] 15(B) shows that the processor core 1590 includes a front end unit circuit 1530 coupled to an execution engine unit circuit 1550, and both are coupled to a memory unit circuit 1570. The core 1590 can be a reduced instruction set architecture computing (RISC) core, a complex instruction set architecture computing (CISC) core, a very long instruction word (VLIW) core, or a hybrid or alternative core type. As another option, the core 1590 can be a special-purpose core, such as a network or communication core, a compression engine, a coprocessor core, a general purpose computing graphics processing unit (GPGPU) core, a graphics core, and the like.

[0128] The front end unit circuit 1530 may include a branch prediction circuit 1532 coupled to an instruction cache circuit 1534 coupled to an instruction translation lookaside buffer (TLB) 1536 coupled to an instruction fetch circuit 1538 coupled to a decode circuit 1540. In one example, the instruction cache circuit 1534 is included in the memory unit circuit 1570 instead of the front end circuit 1530. The decode circuit 1540 (or decoder) may decode the instruction and generate one or more micro-operations, microcode entry points, micro-instructions, other instructions or other control signals as outputs, which are decoded from the original instruction, or otherwise reflect the original instruction, or are derived from the original instruction. The decode circuit 1540 may also include an address generation unit (AGU, not shown) circuit. In one example, the AGU uses the forwarded register port to generate the LSU address and may further perform branch forwarding (e.g., immediate offset branch forwarding, LR register branch forwarding, etc.). The decode circuit 1540 may be implemented using a variety of different mechanisms. Examples of suitable mechanisms include, but are not limited to, a lookup table, a hardware implementation, a programmable logic array (PLA), a microcode read only memory (ROM), and the like. In one example, the core 1590 includes a microcode ROM (not shown) or other medium that stores microcode for certain macroinstructions (e.g., in the decode circuit 1540 or otherwise within the front end circuit 1530). In one example, the decode circuit 1540 includes a micro-op or operation cache (not shown) to save / cache decoded operations, micro-tags, or micro-operations generated during decoding or other stages of the processor pipeline 1500. The decode circuit 1540 may be coupled to the rename / allocator unit circuit 1552 in the execution engine circuit 1550.

[0129] The execution engine circuit 1550 includes a rename / allocator unit circuit 1552, which is coupled to a retirement unit circuit 1554 and a set of one or more scheduler circuits 1556. The scheduler circuit 1556 represents any number of different schedulers, including reservation stations, central instruction windows, and the like. In some examples, the scheduler circuit(s) 1556 may include an arithmetic logic unit (ALU) scheduler / scheduling circuit, an ALU queue, an address generation unit (AGU) scheduler / scheduling circuit, an AGU queue, and the like. The scheduler circuit(s) 1556 are coupled to the physical register file(s) circuit(s) 1558. Each of the physical register file circuits 1558 represents one or more physical register files, different ones of which store one or more different data types, such as scalar integers, scalar floating points, packed integers, packed floating points, vector integers, vector floating points, status (e.g., an instruction pointer that is the address of the next instruction to be executed), and the like. In one example, the (one or more) physical register file circuits 1558 include vector register unit circuits, write mask register unit circuits, and scalar register unit circuits. These register units can provide architectural vector registers, vector mask registers, general registers, etc. The (one or more) physical register file circuits 1558 are coupled to the retirement unit circuit 1554 (also called the retirement queue) to demonstrate various ways that register renaming and out-of-order execution can be implemented (e.g., using (one or more) reorder buffers (ROB) and (one or more) retirement register files; using (one or more) future stacks, (one or more) history buffers, and (one or more) retirement register files; using register maps and pools of registers; etc.). The retirement unit circuit 1554 and the (one or more) physical register file circuits 1558 are coupled to (one or more) execution clusters 1560. The (one or more) execution clusters 1560 include a set of one or more execution unit circuits 1562 and a set of one or more memory access circuits 1564. The execution unit circuit(s) 1562 may perform various arithmetic, logical, floating point, or other types of operations (e.g., shifts, additions, subtractions, multiplications) on various types of data (e.g., scalar integer, scalar floating point, packed integer, packed floating point, vector integer, vector floating point). While some examples may include several execution units or execution unit circuits dedicated to a particular function or set of functions, other examples may include only one execution unit circuit or multiple execution units / execution unit circuits that all perform all functions.Scheduler circuit(s) 1556, physical register file circuit(s) 1558, and execution cluster(s) 1560 are shown as possibly multiple because some examples create separate pipelines for certain types of data / operations (e.g., a scalar integer pipeline, a scalar floating point / packed integer / packed floating point / vector integer / vector floating point pipeline, and / or a memory access pipeline, each with its own scheduler circuit(s), physical register file circuit(s), and / or execution cluster—and in the case of a separate memory access pipeline, only the execution cluster of that pipeline has memory access unit circuit(s) 1564 in some examples of the implementation). It should also be understood that where separate pipelines are used, one or more of these pipelines may be out-of-order issue / execution, while the rest are in-order.

[0130] In some examples, the execution engine unit circuit 1550 can perform load store unit (LSU) address / data pipelining to an advanced microcontroller bus (AMB) interface (not shown), as well as address stage and writeback, data stage loads, stores, and branches.

[0131] The set of memory access circuits 1564 is coupled to a memory cell circuit 1570, which includes a data TLB circuit 1572, which is coupled to a data cache circuit 1574, which is coupled to a level 2 (L2) cache circuit 1576. In one example, the memory access circuit 1564 may include a load unit circuit, a storage address unit circuit, and a storage data unit circuit, each of which is coupled to the data TLB circuit 1572 in the memory cell circuit 1570. The instruction cache circuit 1534 is further coupled to the level 2 (L2) cache circuit 1576 in the memory cell circuit 1570. In one example, the instruction cache 1534 and the data cache 1574 are combined into a single instruction and data cache in the L2 cache circuit 1576, a level 3 (L3) cache circuit (not shown), and / or a main memory (not shown). The L2 cache circuit 1576 is coupled to one or more other levels of cache and ultimately coupled to the main memory.

[0132] Core 1590 may support one or more instruction sets (e.g., x86 instruction set architecture (optionally with some extensions that have been added with newer versions); MIPS instruction set architecture; ARM instruction set architecture (optionally with optional additional extensions, such as NEON)) that include the instruction(s) described herein. In one example, core 1590 includes logic to support packed data instruction set architecture extensions (e.g., AVX1, AVX2), allowing operations used by many multimedia applications to be performed using packed data.

[0133] Example execution unit circuit(s).

[0134] Fig.16 An example of (one or more) execution unit circuits is illustrated, such as (one or more) execution unit circuits 1562 of FIG. 15 (B). As shown, (one or more) execution unit circuits 1562 may include one or more ALU circuits 1601, optional vector / single instruction multiple data (single instruction multiple data, SIMD) circuits 1603, load / store circuits 1605, branch / jump circuits 1607, and / or floating-point unit (FPU) circuits 1609. ALU circuits 1601 perform integer arithmetic and / or Boolean operations. Vector / SIMD circuits 1603 perform vector / SIMD operations on packed data (e.g., SIMD / vector registers). Load / store circuits 1605 execute load and store instructions to load data from memory into registers, or store data from registers to memory. Load / store circuits 1605 may also generate addresses. Branch / jump circuits 1607 cause branches or jumps to a certain memory address depending on the instruction. FPU circuit 1609 performs floating point arithmetic. The width of execution unit circuit(s) 1562 varies depending on the example and may range, for example, from 16 bits to 1024 bits. In some examples, two or more smaller execution units are logically combined to form a larger execution unit (e.g., two 128-bit execution units are logically combined to form a 256-bit execution unit).

[0135] Example register architecture.

[0136] Fig.171 is a block diagram of a register architecture 1700 according to some examples. As shown, the register architecture 1700 includes a vector / SIMD register 1710, whose width varies from 128 bits to 1024 bits. In some examples, the vector / SIMD register 1710 is physically 512 bits, and only some low-order bits are used depending on the mapping. For example, in some examples, the vector / SIMD register 1710 is a 512-bit ZMM register: the low-order 256 bits are used for the YMM register, and the low-order 128 bits are used for the XMM register. Therefore, there is an overlay of registers. In some examples, the vector length field selects between the maximum length and one or more other shorter lengths, wherein each such shorter length is half the length of the previous length. Scalar operations are operations performed on the lowest-order data element position in the ZMM / YMM / XMM register; higher-order data element positions are either maintained as the same as before the instruction, or are zeroed, depending on the example.

[0137] In some examples, the register architecture 1700 includes a write mask / predicate register 1715. For example, in some examples, there are 8 write mask / predicate registers (sometimes referred to as k0 to k7), each of which is 16 bits, 32 bits, 64 bits, or 128 bits in size. The write mask / predicate register 1715 can allow merging (e.g., allowing any set of elements in the destination to be protected from update during the execution of any operation) and / or zeroing (e.g., a zeroing vector mask allows any set of elements in the destination to be zeroed during the execution of any operation). In some examples, each data element position in a given write mask / predicate register 1715 corresponds to a data element position at the destination. In other examples, the write mask / predicate register 1715 is scalable and consists of a set number of enable bits for a given vector element (e.g., 8 enable bits for each 64-bit vector element).

[0138] The register architecture 1700 includes a plurality of general purpose registers 1725. These registers may be 16 bits, 32 bits, 64 bits, etc., and may be used for scalar operations. In some examples, these registers are referred to by the names RAX, RBX, RCX, RDX, RBP, RSI, RDI, RSP, and R8 to R15.

[0139] In some examples, register architecture 1700 includes a scalar floating-point (FP) register file 1745, which is used to perform scalar floating-point operations on 32 / 64 / 80-bit floating-point data using x87 instruction set architecture extensions, or as an MMX register to perform operations on 64-bit packed integer data, and to store operands for some operations performed between MMX and XMM registers.

[0140] One or more flag registers 1740 (e.g., EFLAGS, RFLAGS, etc.) store status and control information for arithmetic, comparison, and system operations. For example, one or more flag registers 1740 can store condition code information, such as carry, parity, auxiliary carry, zero, sign, and overflow. In some examples, one or more flag registers 1740 are referred to as program status and control registers.

[0141] Segment registers 1720 contain segment points for accessing memory. In some examples, these registers are referred to by the names CS, DS, SS, ES, FS, and GS.

[0142] Machine specific registers (MSRs) 1735 control and report processor performance. Most MSRs 1735 handle system-related functions and are not accessible to applications. Machine check registers 1760 consist of control, status, and error reporting MSRs used to detect and report hardware errors.

[0143] One or more instruction pointer registers 1730 store instruction pointer values. Control register(s) 1755 (e.g., CR0-CR4) determine the operating mode of the processor (e.g., processor 1370, 1380, 1338, 1315, and / or 1400) and the characteristics of the currently executing task. Debug registers 1750 control and allow monitoring of debug operations of the processor or core.

[0144] Memory (mem) management registers 1765 specify the location of data structures used in protected mode memory management. These registers may include global descriptor table registers (GDTR), interrupt descriptor table registers (IDTR), task registers, and local descriptor table registers (LDTR) registers.

[0145] Alternative examples may use wider or narrower registers. In addition, alternative examples may use more, fewer or different register files and registers. Register architecture 1700 may be used, for example, in register file / memory `ISAB08, or in physical register file circuit 15 58.

[0146] Instruction set architecture.

[0147] An instruction set architecture (ISA) may include one or more instruction formats. A given instruction format may define various fields (e.g., the number of bits, the position of the bits) to specify the operation to be performed (e.g., opcode) and the (one or more) operands and / or other (one or more) data fields (e.g., mask) on which the operation is to be performed, etc. Some instruction formats are further decomposed by the definition of instruction templates (or subformats). For example, an instruction template of a given instruction format may be defined as having different subsets of the fields of the instruction format (the included fields are usually in the same order, but at least some have different bit positions because there are fewer included fields) and / or defined as having a given field interpreted in a different manner. Thus, each instruction of the ISA is expressed using a given instruction format (and, if defined, expressed in a given instruction template in the instruction format), and includes fields for specifying the operation and the operand. For example, the example ADD instruction has a specific opcode and instruction format, the instruction format includes an opcode field to specify the opcode, and includes an operand field to select the operand (source 1 / destination and source 2); and the appearance of this ADD instruction in the instruction stream will have specific content in the operand field that selects the specific operand. In addition, although the following description is made in the context of the x86 ISA, it is within the knowledge of those skilled in the art to apply the teachings of the present disclosure to other ISAs.

[0148] Example instruction format.

[0149] The examples of the (one or more) instructions described herein may be implemented in different formats. In addition, example systems, architectures, and pipelines are described in detail below. The examples of (one or more) instructions may be executed on these systems, architectures, and pipelines, but are not limited to those described in detail.

[0150] Fig.18An example of an addressing information field 905 is illustrated. In this illustration, an optional MOD R / M byte 1802 and an optional Scale, Index, Base (SIB) byte 1804 are shown. The MOD R / M byte 1802 and SIB byte 1804 are used to encode up to two operands of the instruction, each operand being a direct register or an effective memory address. Note that these fields are optional, i.e., not all instructions include one or more of these fields. The MOD R / M byte 1802 includes a MOD field 1842, a register (reg) field 1844, and an R / M field 1846.

[0151] The content of MOD field 1842 distinguishes between memory access and non-memory access modes. In some examples, when MOD field 1842 has a binary value of 11 (11b), register direct addressing mode is utilized, otherwise register indirect addressing mode is used.

[0152] Register field 1844 may encode a destination register operand or a source register operand, or may encode an opcode extension and not be used to encode any instruction operand. The contents of register field 1844 specify the location (in a register or in memory) of the source or destination operand directly or through address generation. In some examples, register field 1844 is supplemented with additional bits from a prefix (e.g., prefix 901) to allow for greater addressing.

[0153] R / M field 1846 may be used to encode an instruction operand that references a memory address, or may be used to encode a destination register operand or a source register operand. Note that in some examples, R / M field 1846 may be combined with MOD field 1842 to specify an addressing mode.

[0154] SIB byte 1804 includes a scaling factor field 1852, an index field 1854, and a base address field 1856 for address generation. Scaling field 1852 indicates a scaling factor. Index field 1854 specifies the index register to be used. In some examples, index field 1854 is complemented with additional bits from a prefix (e.g., prefix 901) to allow for larger addressing. Base address field 1856 specifies the base address register to be used. In some examples, base address field 1856 is complemented with additional bits from a prefix (e.g., prefix 901) to allow for larger addressing. In practice, the contents of scaling field 1852 allow the contents of index field 1854 to be scaled for memory address generation (e.g., for memory addresses using 2 缩放 * address generation of index + base address).

[0155] Some addressing forms utilize a displacement value to generate a memory address. For example, a memory address may be generated based on 2 scale * index + base address + displacement, index * scale + displacement, r / m + displacement, instruction pointer (RIP / EIP) + displacement, register + displacement, etc. The displacement may be a value of 1 byte, 2 bytes, 4 bytes, etc. In some examples, the displacement field 907 provides this value. In addition, in some examples, the use of a displacement factor is encoded in the MOD field of the addressing information field 905, which indicates a compressed displacement scheme, for which the displacement value is calculated and stored in the displacement field 907.

[0156] In some examples, the immediate value field 909 specifies an immediate value for the instruction. The immediate value may be encoded as a 1-byte value, a 2-byte value, a 4-byte value, and so on.

[0157] Fig.19 An example of a first prefix 901(A) is illustrated. In some examples, the first prefix 901(A) is an example of a REX prefix. Instructions using this prefix can specify general registers, 64-bit packed data registers (e.g., single instruction, multiple data (SIMD) registers or vector registers), and / or control registers and debug registers (e.g., CR8-CR15 and DR8-DR15).

[0158] Instructions using the first prefix 901(A) can use a 3-bit field to specify up to three registers, depending on the format: 1) using the reg field 1844 and the R / M field 1846 of the MOD R / M byte 1802; 2) using the MOD R / M byte 1802 with the SIB byte 1804, including using the reg field 1844 as well as the base field 1856 and the index field 1854; or 3) using the register field of the opcode.

[0159] In the first prefix 901 (A), bit positions 7:4 are set to 0100. Bit position 3 (W) can be used to determine the operand size, but cannot determine the operand width alone. Therefore, when W=0, the operand size is determined by the code segment descriptor (CS.D), and when W=1, the operand size is 64 bits.

[0160] Note that adding another bit allows addressing 16 (2 4 ) registers, while the separate MOD R / M reg field 1844 and MOD R / MR / M field 1846 can only address 8 registers each.

[0161] In the first prefix 901(A), bit position 2 (R) may be an extension of the MOD R / M reg field 1844 and may be used to modify the MOD R / M reg field 1844 when the field encodes a general register, a 64-bit packed data register (e.g., an SSE register), or a control or debug register. When the MOD R / M byte 1802 specifies another register or defines an extended opcode, R is ignored.

[0162] Bit position 1 (X) may modify the SIB byte index field 1854 .

[0163] Bit position 0 (B) may modify the base address in R / M field 1846 or SIB byte base address field 1856 of MOD R / M; or it may modify the opcode register field used to access a general register (eg, general register 1725).

[0164] Figure 20(A)-20(D) An example of how the R, X, and B fields of the first prefix 901 (A) are used is illustrated. FIG. 20 (A) illustrates that when the SIB byte 1804 is not used for memory addressing, the R and B from the first prefix 901 (A) are used to extend the reg field 1844 and the R / M field 1846 of the MOD R / M byte 1802. FIG. 20 (B) illustrates that when the SIB byte 1804 is not used, the R and B from the first prefix 901 (A) are used to extend the reg field 1844 and the R / M field 1846 of the MOD R / M byte 1802 (register-register addressing). FIG. 20 (C) illustrates that when the SIB byte 1804 is used for memory addressing, the R, X, and B from the first prefix 901 (A) are used to extend the reg field 1844 of the MOD R / M byte 1802 and the index field 1854 and the base address field 1856. FIG. 20(D) illustrates that the B from the first prefix 901 (A) is used to extend the reg field 1844 of the MOD R / M byte 1802 when the register is encoded in the opcode 903 .

[0165] Figure 21(A)-21(B) An example of a second prefix 901(B) is illustrated. In some examples, the second prefix 901(B) is an example of a VEX prefix. The second prefix 901(B) encoding allows instructions to have more than two operands and allows SIMD vector registers (e.g., vector / SIMD registers 1710) to be longer than 64 bits (e.g., 128 bits and 256 bits). The use of the second prefix 901(B) provides a syntax for three operands (or more). For example, a previous two-operand instruction performs an operation such as A=A+B, which overwrites the source operand. The use of the second prefix 901(B) enables the operands to perform non-destructive operations, such as A=B+C.

[0166] In some examples, the second prefix 901(B) has two forms: a two-byte form and a three-byte form. The two-byte second prefix 901(B) is mainly used for 128-bit, scalar, and some 256-bit instructions; while the three-byte second prefix 901(B) provides a compact replacement for 3-byte opcode instructions and the first prefix 901(A).

[0167] Figure 21 (A) illustrates an example of a two-byte form of the second prefix 901 (B). In one example, the format field 2101 (byte 0 2103) contains the value C5H. In one example, byte 1 2105 includes an "R" value in bit [7]. This value is the complement of the "R" value of the first prefix 901 (A). Bit [2] is used to specify the length (L) of the vector (wherein the value of 0 is a scalar or 128-bit vector, and the value of 1 is a 256-bit vector). Bit [1:0] provides an operation code extensibility equivalent to some traditional prefixes (e.g., 00=no prefix, 01=66H, 10=F3H, and 11=F2H). Bits [6:3], shown as vvvv, can be used to: 1) encode a first source register operand, which is specified in inverted (complement) form, valid for instructions with 2 or more source operands; 2) encode a destination register operand, which is specified in complement form, used for certain vector shifts; or 3) not encode any operand, the field is reserved and should contain a value, such as 1111b.

[0168] Instructions using this prefix may use MOD R / MR / M field 1846 to encode instruction operands that reference memory addresses, or to encode destination register operands or source register operands.

[0169] Instructions using this prefix may use MOD R / M reg field 1844 to encode a destination register operand or a source register operand, or be treated as an opcode extension and not used to encode any instruction operand.

[0170] For instruction syntax supporting four operands, three of the four operands are encoded by vvvv, MOD R / MR / M field 1846, and MOD R / M reg field 1844. Bits [7:4] of immediate value field 909 are then used to encode the third source register operand.

[0171] Figure 21 (B) illustrates an example of a three-byte form of the second prefix 901 (B). In one example, the format field 2111 (byte 0 2113) contains the value C4H. Byte 1 2115 includes "R", "X" and "B" in bit [7:5], which are the complements of these values ​​of the first prefix 901 (A). Bit [4:0] (shown as mmmm) of byte 1 2115 includes the content of encoding one or more implicit leading operation code bytes as needed. For example, 00001 means 0FH leading operation code, 00010 means 0F38H leading operation code, 00011 means 0F3AH leading operation code, etc.

[0172] The use of bit [7] of byte 2 2117 is similar to W of the first prefix 901 (A), including helping to determine the size of the operand that can be promoted. Bit [2] is used to specify the length (L) of the vector (where a value of 0 is a scalar or 128-bit vector, and a value of 1 is a 256-bit vector). Bits [1:0] provide opcode extensibility equivalent to some traditional prefixes (e.g., 00=no prefix, 01=66H, 10=F3H, and 11=F2H). Bits [6:3], shown as vvvv, can be used to: 1) encode the first source register operand, which is specified in inverted (inverse) form, valid for instructions with 2 or more source operands; 2) encode the destination register operand, which is specified in inverse form for certain vector shifts; or 3) do not encode any operand, this field is reserved and should contain a value, such as 1111b.

[0173] Instructions using this prefix may use MOD R / MR / M field 1846 to encode instruction operands that reference memory addresses, or to encode destination register operands or source register operands.

[0174] Instructions using this prefix may use MOD R / M reg field 1844 to encode a destination register operand or a source register operand, or be treated as an opcode extension and not used to encode any instruction operand.

[0175] For instruction syntax supporting four operands, three of the four operands are encoded by vvvv, MOD R / MR / M field 1846, and MOD R / M reg field 1844. Bits [7:4] of immediate value field 909 are then used to encode the third source register operand.

[0176] Fig. 22An example of a third prefix 901(C) is illustrated. In some examples, the third prefix 901(C) is an example of an EVEX prefix. The third prefix 901(C) is a four-byte prefix.

[0177] The third prefix 901 (C) can encode 32 vector registers (e.g., 128-bit, 256-bit, and 512-bit registers) in 64-bit mode. In some examples, write masks / operation masks are used (see the discussion of registers in previous figures, e.g. Fig.17 ) or predicate instructions utilize this prefix. The operation mask register allows conditional processing or selection control. Operation mask instructions whose source / destination operands are operation mask registers and treat the contents of the operation mask register as a single value are encoded using the second prefix 901 (B).

[0178] The third prefix 901(C) may encode functionality specific to the instruction class (e.g., a packed instruction with “load+operation” semantics may support an embedded broadcast functionality, a floating-point instruction with rounding semantics may support a static rounding functionality, a floating-point instruction with non-rounding arithmetic semantics may support a “suppress all exceptions” functionality, etc.).

[0179] The first byte of the third prefix 901 (C) is the format field 2211, which in one example has a value of 62 H. The subsequent bytes are called payload bytes 2215-2219, and together form a 24-bit value of P[23:0], providing specific capabilities in the form of one or more fields (described in detail herein).

[0180] In some examples, P[1:0] of payload byte 2219 is the same as the two mm bits in the lower order. In some examples, P[3:2] is reserved. Bit P[4] (R') allows access to the upper 16 vector register sets when combined with P[7] and the reg field 1844 of MOD R / M. When SIB type addressing is not required, P[6] can also provide access to the upper 16 vector registers. P[7:5] consists of R, X, and B, which are operand specifier modifier bits for vector registers, general registers, and memory addressing, and when combined with the MOD R / M register field 1844 and the MOD R / MR / M field 1846, allows access to the next set of 8 registers beyond the lower 8 registers. P[9:8] provides opcode extensibility equivalent to some traditional prefixes (e.g., 00=no prefix, 01=66H, 10=F3H, and 11=F2H). P

[10] is a fixed value of 1 in some examples. P[14:11], shown as vvvv, can be used to: 1) encode a first source register operand, which is specified in inverted (complement) form, valid for instructions with 2 or more source operands; 2) encode a destination register operand, which is specified in complement form, used for certain vector shifts; or 3) not encode any operand, the field is reserved and should contain a value, such as 1111b.

[0181] P

[15] is similar to W of the first prefix 901 (A) and the second prefix 911 (B), and can be used as an opcode extension bit or an operand size increase.

[0182] P[18:16] specifies the index of a register in the operation mask (write mask) register (e.g., write mask / predicate register 1715). In one example, the particular value aaa=000 has special behavior, implying that no operation mask is used for this particular instruction (this can be implemented in a variety of ways, including using an operation mask hardwired to all ones or hardware that bypasses the masking hardware). When merging, the vector mask allows any set of elements in the destination to be protected from update during the execution of any operation (specified by the basic operation and the enhanced operation); in another example, the old value of each element of the destination is retained (if the corresponding mask bit has a value of 0). In contrast, when zeroing, the vector mask allows any set of elements in the destination to be zeroed during the execution of any operation (specified by the basic operation and the enhanced operation); in one example, the elements of the destination are set to 0 when the corresponding mask bit has a value of 0. A subset of this functionality is the ability to control the vector length of the operation being performed (i.e., the span of elements modified, from first to last); however, the elements modified do not have to be consecutive. Thus, the operation mask field enables a subset of vector operations, including loads, stores, arithmetic, logical, etc. Although in the described examples, the contents of the operation mask field select which of several operation mask registers contains the operation mask to be used (so that the contents of the operation mask field indirectly identify the masking to be performed), alternative examples alternatively or additionally allow the contents of the mask write field to directly specify the masking to be performed.

[0183] P

[19] can be combined with P[14:11] to encode a second source vector register in a non-destructive source syntax that can utilize P

[19] to access the upper 16 vector registers. P

[20] encodes various features that vary in different classes of instructions and can affect the meaning of the vector length / rounding control specifier field (P[22:21]). P

[23] indicates support for merge-write masking (e.g., when set to 0) or support for zeroing and merge-write masking (e.g., when set to 1).

[0184] An example of the encoding of registers in instructions using the third prefix 901 (C) is detailed in the table below.

[0185]

[0186]

[0187] Table 1: 32-register support in 64-bit mode

[0188]

[0189] Table 2: Encoding register specifiers in 32-bit mode

[0190]

[0191] Table 3: Operation Mask Register Specifier Encoding

[0192] Emulation (including binary translation, code deformation, etc.).

[0193] In some cases, the instruction converter can be used to convert instructions from a source instruction set architecture to a target instruction set architecture. For example, the instruction converter can translate (e.g., using static binary translation, dynamic binary translation including dynamic compilation), deform, simulate or otherwise convert instructions to one or more other instructions to be processed by the core. The instruction converter can be implemented with software, hardware, firmware or a combination thereof. The instruction converter can be on the processor, outside the processor, or partly on the processor and partly outside the processor.

[0194] Fig.23 The block diagram of illustrates the use of a software instruction converter according to an example, the software instruction converter is used to convert binary instructions in a source ISA into binary instructions in a target ISA. In the illustrated example, the instruction converter is a software instruction converter, but alternatively, the instruction converter can be implemented in software, firmware, hardware, or various combinations thereof. Fig.23 It is shown that a program in a high-level language 2302 can be compiled using a first ISA compiler 2304 to generate first ISA binary code 2306 that can be natively executed by a processor having at least one first ISA core 2316. The processor having at least one first ISA core 2316 represents any processor that is capable of executing or otherwise processing (1) a substantial portion of the first ISA or (2) a program that is natively executed by a processor having at least one first ISA core. The first ISA compiler 2304 represents a compiler operable to generate first ISA binary code 2306 (e.g., object code) that can be executed on a processor 2316 having at least one first ISA core with or without additional linking processing. Similarly, Fig.23It is shown that a program in a high-level language 2302 can be compiled using an alternative ISA compiler 2308 to generate an alternative ISA binary code 2310, which can be executed natively by a processor 2314 without a first ISA core. An instruction converter 2312 is used to convert the first ISA binary code 2306 into code that can be executed natively by a processor 2314 without a first ISA core. This converted code will not necessarily be the same as the alternative ISA binary code 2310; however, the converted code will implement the overall operation and be composed of instructions from the alternative ISA. Thus, the instruction converter 2312 represents software, firmware, hardware, or a combination thereof that allows a processor or other electronic device without a first ISA processor or core to execute the first ISA binary code 2306 through simulation, emulation, or any other process.

[0195] Program code can be applied to input information to perform the functions described herein and generate output information. Output information can be applied to one or more output devices in a known manner. For the present application, a processing system includes any system having a processor, such as a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a microprocessor, or any combination thereof.

[0196] Program code can be implemented in a process-oriented or object-oriented high-level programming language to communicate with the processing system. If desired, program code can also be implemented in assembly or machine language. In fact, the mechanism described herein is not limited to any specific programming language in scope. In any case, the language can be a compiled language or an interpreted language.

[0197] Examples of the mechanisms disclosed herein can be implemented in hardware, software, firmware, or a combination of these implementation approaches. Examples can be implemented as computer programs or program codes, executed on a programmable system including at least one processor, a storage system (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device.

[0198] One or more aspects of at least one example can be implemented by representative instructions stored on a machine-readable medium, which represent various logics within a processor, and when these instructions are read by a machine, the machine makes logic for performing the technology described herein. These representations are called "intellectual property (IP) cores" and can be stored on a tangible machine-readable medium and provided to various customers or manufacturing facilities to be loaded into a manufacturing machine that makes the logic or processor.

[0199] These machine-readable storage media may include, but are not limited to, non-transitory tangible arrangements of items manufactured or formed by a machine or device, including storage media such as: hard disks, any other type of disk (including floppy disks, optical disks, compact disk read-only memory (CD-ROM), compact disk rewritable (CD-RW), and magneto-optical disks), semiconductor devices (e.g., read-only memory (ROM), random access memory (RAM) such as dynamic random access memory (DRAM), static random access memory (SRAM), erasable programmable read-only memory (EPROM), flash memory, electrically erasable programmable read-only memory (EEPROM), phase change memory (PCM)), magnetic cards or optical cards, or any other type of medium suitable for storing electronic instructions.

[0200] Therefore, examples also include non-transitory tangible machine-readable media containing instructions or design data, such as hardware description languages ​​(HDL), that define the structures, circuits, devices, processors and / or system features described herein. Such examples may also be referred to as program products.

[0201] Emulation (including binary translation, code deformation, etc.).

[0202] In some cases, the instruction converter can be used to convert instructions from a source instruction set architecture to a target instruction set architecture. For example, the instruction converter can translate (e.g., using static binary translation, dynamic binary translation including dynamic compilation), deform, simulate or otherwise convert instructions to one or more other instructions to be processed by the core. The instruction converter can be implemented with software, hardware, firmware or a combination thereof. The instruction converter can be on the processor, outside the processor, or partly on the processor and partly outside the processor.

[0203] Reference to "an example", "an example", etc. indicates that the example being described may include a particular feature, structure, or characteristic, but not every example may include the particular feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same example. In addition, when a particular feature, structure, or characteristic is described in conjunction with one example, it should be considered that it is within the knowledge of those skilled in the art to implement such feature, structure, or characteristic in conjunction with other examples (whether or not explicitly described).

[0204] In addition, in the various examples described above, unless otherwise specifically noted, selection language such as phrases "at least one of A, B, or C" or "A, B and / or C" should be understood to refer to A, B, or C, or any combination thereof (i.e., A and B, A and C, B and C, and A, B and C).

[0205] Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the present disclosure as set forth in the claims.

[0206] Example

[0207] Illustrative examples of the techniques disclosed herein are provided below. Implementations of these techniques may include any one or more of the examples described below, as well as any combination thereof.

[0208] Example 1 is a device comprising a reconfigurable fully homomorphic encryption accelerator and a memory. The reconfigurable fully homomorphic encryption accelerator comprises a plurality of computing elements for supporting operations on polynomials of degree (N*M)*1024, where M is greater than 1; an array of tiles, each tile comprising one or more of the plurality of computing elements; and a scratch pad memory. The computing elements perform number theoretic transform (NTT) and inverse NTT operations on one or more independent polynomials of degree N*1024, and convert the output coefficients of the one or more independent polynomials into word interleaved form. The plurality of computing elements operate in a bypass mode to convert the word interleaved form of the output coefficients into a continuous form without modifying and affecting the values ​​of the output coefficients. The scratch pad memory stores coefficients used by the plurality of computing elements to perform number theoretic transform (NTT) and inverse NTT (iNTT) operations. The memory stores data to be processed by the reconfigurable fully homomorphic encryption accelerator.

[0209] Example 2 includes the apparatus of Example 1, wherein, optionally, the reconfigurable fully homomorphic encryption accelerator configures the plurality of computing elements to operate in a bypass mode in response to a received polynomial iNTT data movement instruction.

[0210] Example 3 includes the apparatus of Example 2, optionally comprising: a first 2:1 multiplexer coupled to a first output of a computing element and a first input of the computing element, the first 2:1 multiplexer selecting between the first input and the first output; and a second 2:1 multiplexer coupled to a second output of the computing element and a second input of the computing element, the second 2:1 multiplexer selecting between the second input and the second output.

[0211] Example 4 includes the apparatus of Example 3, optionally wherein when configured in a bypass mode, the first 2:1 multiplexer selects the first input and the second 2:1 multiplexer selects the second input.

[0212] Example 5 includes the apparatus of Example 4, optionally wherein the first input is a, the second input is b, the first output is a+b*twiddle factor, and the second output is ab*the twiddle factor.

[0213] Example 6 includes the apparatus of Example 5, optionally wherein a is 32 bits and b is 32 bits.

[0214] Example 7 includes the apparatus of Example 1, optionally wherein N is fixed during runtime and included as metadata in the received polynomial iNTT data movement instruction prior to executing the workload.

[0215] Example 8 includes the apparatus of Example 1, wherein optionally, the input to the computation element is a polynomial input coefficient of an NTT / iNTT operation.

[0216] Example 9 includes the apparatus of Example 1, wherein, optionally, M is 16.

[0217] Example 10 is a system comprising a processor core, a reconfigurable fully homomorphic encryption accelerator, and a memory. The reconfigurable fully homomorphic encryption accelerator comprises a plurality of computing elements for supporting operations on polynomials of degree (N*M)*1024, where M is greater than 1; an array of tiles, each tile comprising one or more of the plurality of computing elements; and a scratch pad memory. The computing elements perform number theoretic transform (NTT) and inverse NTT operations on one or more independent polynomials of degree N*1024, and convert the output coefficients of the one or more independent polynomials into word interleaved form. The plurality of computing elements operate in a bypass mode to convert the word interleaved form of the output coefficients into a continuous form without modifying and affecting the values ​​of the output coefficients. The scratch pad memory stores coefficients used by the plurality of computing elements to perform number theoretic transform (NTT) and inverse NTT (iNTT) operations. The memory stores data to be processed by the reconfigurable fully homomorphic encryption accelerator.

[0218] Example 11 includes the system of Example 10, optionally wherein the reconfigurable fully homomorphic encryption accelerator configures the plurality of computing elements to operate in a bypass mode in response to a received polynomial iNTT data movement instruction.

[0219] Example 12 includes the system of Example 11, optionally including: a first 2:1 multiplexer coupled to a first output of a computing element and a first input of the computing element, the first 2:1 multiplexer selecting between the first input and the first output; and a second 2:1 multiplexer coupled to a second output of the computing element and a second input of the computing element, the second 2:1 multiplexer selecting between the second input and the second output.

[0220] Example 13 includes the system of Example 12, optionally wherein when configured in a bypass mode, the first 2:1 multiplexer selects the first input and the second 2:1 multiplexer selects the second input.

[0221] Example 14 includes the system of Example 13, optionally, the first input is a, the second input is b, the first output is a+b*twiddle factor, and the second output is ab*the twiddle factor.

[0222] Example 15 includes the system of Example 14, optionally, a is 32 bits and b is 32 bits.

[0223] Example 16 includes the system of Example 10, optionally wherein N is fixed during runtime and included as metadata in the received polynomial iNTT data movement instruction prior to executing the workload.

[0224] Example 17 includes the system of Example 10, optionally wherein the input to the computation element is a polynomial input coefficient of an NTT / iNTT operation.

[0225] Example 18 includes the system of Example 10, optionally wherein M is 16.

[0226] Example 19 includes the system of Example 10, optionally wherein the reconfigurable fully homomorphic encryption accelerator includes high bandwidth memory.

[0227] Example 20 includes the system of Example 10, optionally wherein a high bandwidth memory is coupled to the reconfigurable fully homomorphic encryption accelerator.

Claims

1. A device comprising: Reconfigurable fully homomorphic encryption accelerator, including: A plurality of computing elements for supporting operations on polynomials of degree (N*M)*1024, M is greater than 1; an array of tiles, each tile comprising one or more of the plurality of computing elements; The computing element performs the following operations: performing number theoretic transformation (NTT) and inverse NTT operations on one or more independent polynomials of degree N*1024, and converting output coefficients of the one or more independent polynomials into a word-interleaved form, wherein the plurality of computational elements operate in a bypass mode to convert the word-interleaved form of the output coefficients into a continuous form without modifying and without affecting values ​​of the output coefficients; and a scratch pad memory for storing coefficients used by the plurality of computational elements to perform number theoretic transform (NTT) and inverse NTT (iNTT) operations; and A memory for storing data to be processed by the reconfigurable fully homomorphic encryption accelerator.

2. The device according to claim 1, wherein: The reconfigurable fully homomorphic encryption accelerator configures the plurality of computing elements to operate in a bypass mode in response to a received polynomial iNTT data movement instruction.

3. The apparatus of claim 2, further comprising: a first 2:1 multiplexer coupled to a first output of a computational element and a first input of the computational element, the first 2:1 multiplexer selecting between the first input and the first output; as well as A second 2:1 multiplexer is coupled to the second output of the computing element and the second input of the computing element, the second 2:1 multiplexer selecting between the second input and the second output.

4. The device according to claim 3, wherein: When configured in bypass mode, the first 2:1 multiplexer selects the first input and the second 2:1 multiplexer selects the second input.

5. The device according to claim 4, wherein: The first input is a, the second input is b, the first output is a+b*twiddle factor, and the second output is ab*the twiddle factor.

6. The device according to claim 5, wherein: a is 32 bits and b is 32 bits.

7. The device according to any one of claims 1 to 6, wherein: N is fixed during runtime and is included as metadata in the received polynomial iNTT data move instructions before executing the workload.

8. The device according to any one of claims 1 to 6, wherein: The input to the computational element is the polynomial input coefficients for the NTT / iNTT operation.

9. The device according to any one of claims 1 to 6, wherein: M is 16.

10. A system comprising: Processor core; Reconfigurable fully homomorphic encryption accelerator, including: A plurality of computing elements for supporting operations on polynomials of degree (N*M)*1024, M is greater than 1; an array of tiles, each tile comprising one or more of the plurality of computing elements; The computing element performs the following operations: performing number theoretic transformation (NTT) and inverse NTT operations on one or more independent polynomials of degree N*1024, and converting output coefficients of the one or more independent polynomials into a word-interleaved form, wherein the plurality of computational elements operate in a bypass mode to convert the word-interleaved form of the output coefficients into a continuous form without modifying and without affecting values ​​of the output coefficients; and a scratch pad memory for storing coefficients used by the plurality of computational elements to perform number theoretic transform (NTT) and inverse NTT (iNTT) operations; and A memory for storing data to be processed by the reconfigurable fully homomorphic encryption accelerator.

11. The system of claim 10, wherein: The reconfigurable fully homomorphic encryption accelerator configures the plurality of computing elements to operate in a bypass mode in response to a received polynomial iNTT data movement instruction.

12. The system of claim 11, further comprising: a first 2:1 multiplexer coupled to a first output of a computational element and a first input of the computational element, the first 2:1 multiplexer selecting between the first input and the first output; as well as A second 2:1 multiplexer is coupled to the second output of the computing element and the second input of the computing element, the second 2:1 multiplexer selecting between the second input and the second output.

13. The system of claim 12, wherein: When configured in bypass mode, the first 2:1 multiplexer selects the first input and the second 2:1 multiplexer selects the second input.

14. The system of claim 13, wherein: The first input is a, the second input is b, the first output is a+b*twiddle factor, and the second output is ab*the twiddle factor.

15. The system of claim 14, wherein: a is 32 bits and b is 32 bits.

16. The system of any one of claims 10 to 15, wherein: N is fixed during runtime and is included as metadata in the received polynomial iNTT data move instructions before executing the workload.

17. The system of any one of claims 10 to 15, wherein: The input to the computational element is the polynomial input coefficients for the NTT / iNTT operation.

18. The system of any one of claims 10 to 15, wherein: M is 16.

19. The system of any one of claims 10 to 15, wherein: The reconfigurable fully homomorphic encryption accelerator includes a high bandwidth memory.

20. The system of any one of claims 10 to 15, further comprising a high bandwidth memory coupled to the reconfigurable fully homomorphic encryption accelerator.

21. A method comprising: Reconfigurable fully homomorphic encryption accelerator, including: Supporting operations on polynomials of degree (N*M)*1024 by a plurality of computing elements in an array of tiles in the reconfigurable fully homomorphic encryption accelerator, where M is greater than 1; performing, by the computing element, a number theoretic transform (NTT) and an inverse NTT operation on one or more independent polynomials of degree N*1024; converting, by the computational elements, output coefficients of the one or more independent polynomials into a word-interleaved form, wherein the plurality of computational elements operate in a bypass mode to convert the word-interleaved form of the output coefficients into a continuous form without modifying and without affecting the values ​​of the output coefficients; storing coefficients used by the plurality of computational elements to perform number theoretic transform (NTT) and inverse NTT (iNTT) operations in a scratch pad memory; and Data to be processed by the reconfigurable fully homomorphic encryption accelerator is stored in a memory.

22. The method of claim 21, further comprising: The plurality of computing elements are configured, by the reconfigurable fully homomorphic encryption accelerator, to operate in a bypass mode in response to a received polynomial iNTT data movement instruction.

23. The method of claim 21, wherein: N is fixed during runtime and is included as metadata in the received polynomial iNTT data move instructions before executing the workload.

24. An apparatus comprising means for performing the method of any one of claims 21-23.

25. A machine-readable medium comprising code, which when executed causes a machine to perform the method of any one of claims 21-23.

Images