Hardware-based Galois multiplication

Abstract

A processor includes an instruction fetch unit to fetch an instruction to be executed; the architecture register file comprises a plurality of registers and is used for storing source and target operands; and an execution unit to execute the Galois multiplication instruction. The execution unit includes a no-carry multiplier configured to multiply an operand of a Galois multiplication instruction to generate a product. The execution unit also includes a modular reduction circuit to receive the product and determine a reduced product having fewer bits than the product based on a logical combination of the product and the fixed polynomial. The execution unit is configured to store the reduced product to the architectural register file as a result of the Galois multiplication instruction.

Description

Background Art

[0001] The present disclosure relates generally to data processing and, more particularly, to Galois multiplication.

[0002] An important aspect of data security is the protection of data at rest (e.g., when stored in a data storage device) or in transit (e.g., during transmission) through encryption. In general, encryption involves converting unencrypted data (called plaintext) into encrypted data (called ciphertext) by combining the plaintext with one or more encryption keys using an encryption function. To recover the plaintext from the ciphertext, the ciphertext is processed by a decryption function using one or more decryption keys. Thus, encryption provides data security by requiring a party to know an additional secret (i.e., a decryption key) before the party can access the protected plaintext.

[0003] In many implementations, data encryption is performed using software executed on a general-purpose processor. While implementing encryption in software offers the advantage of being able to select different encryption functions and easily adapt the selected encryption algorithm to use plaintexts and encryption keys of various lengths, performing encryption in software has the attendant disadvantage of relatively poor performance. As the volume of data sets continues to increase dramatically in the "big data" era, the performance achieved by encryption implemented in software may be unacceptable when encrypting large data sets. Therefore, it is often desirable to provide support for encryption in hardware to achieve improved performance.

[0004] Another prior art solution particularly suitable for disk encryption is to implement a physical encryption engine connected to the memory hierarchy. Compared to hardware solutions in the processor core, a physical encryption engine coupled to the memory hierarchy can be more expensive to implement. In addition, such solutions are generally not applicable to data in flight. Summary of the invention

[0005] The present disclosure recognizes that many commonly used encryption functions, such as AES (Advanced Encryption Standard)-GCM (Galois Counter Mode) and AES-XTS (XEX-based Adjusted Codebook Mode with Ciphertext Stealing), use Galois multiplication (i.e., carry-less multiplication and modular reduction) to logically combine encryption operands. For example, both AES-GCM and AES-XTS use Galois multiplication in the GF(2^128) domain defined by the fixed polynomial g(x)=1+X+x^2+x^7+x^128. In AES-GCM, Galois multiplication is used to generate a signature for an encrypted message, which can be used to detect whether the ciphertext or signature has been tampered with during the decryption process. In AES-XTS, Galois multiplication is used to encrypt and decrypt the message itself. The present disclosure discloses various circuit embodiments for implementing Galois multiplication in hardware and associated Galois multiplication instructions.

[0006] In an embodiment, a processor includes an instruction fetch unit for fetching instructions to be executed; an architectural register file including a plurality of registers for storing source and destination operands; and an execution unit configured to execute a Galois multiplication instruction. The execution unit includes a carry-less multiplier configured to multiply the operands of the Galois multiplication instruction to generate a product. The execution unit also includes a modular reduction circuit configured to receive the product and determine a reduced product having fewer bits than the product based on a logical combination of the product and a fixed polynomial. The execution unit is configured to store the reduced product to the architectural register file as a result of the Galois multiplication instruction.

[0007] In some embodiments, the processor may be part of a larger data processing system and may also be implemented as design structure in a machine-readable storage device.

[0008] According to a method of data processing, an instruction fetch unit of a processor fetches instructions to be executed by the processor, including a Galois multiplication instruction. Based on receiving the Galois multiplication instruction, an execution unit of the processor executes the Galois multiplication instruction. Executing the Galois multiplication instruction includes: multiplying operands of the Galois multiplication instruction by a carry-less multiplier to generate a product; a modular reduction circuit receives the product and determines a reduced product having fewer bits than the product based on a logical combination of the product and a fixed polynomial; and then the processor stores the reduced product in an architectural register file of the processor as a result of the Galois multiplication instruction.

[0009] In at least one embodiment, the fixed polynomial is g(x)=1+X+x^2+x^7+x^128.

[0010] In at least one embodiment, the product of the carry-less multiplication includes a high portion, which includes high-order bits of the product, and a low portion, which includes low-order bits of the product, and the modular reduction circuit is configured to calculate a first result of the carry-less multiplication that is equivalent to the high portion and the fixed polynomial. The modular reduction circuit includes a shift circuit that applies a plurality of different bit position shifts to the high portion of the product that are consistent with asserted bits in the fixed polynomial; and a bitwise exclusive OR (XOR) circuit that logically combines multiple instances of the high portion of the product with respective different bit position shifts applied by the shift circuit.

[0011] In at least one embodiment, the shift circuit is further configured to apply a plurality of different bit position shifts to the high portion of the first result consistent with the asserted bits in the fixed polynomial, and the bitwise exclusive OR (XOR) circuit is further configured to logically combine the plurality of instances of the high portion of the first result having the respective different bit position shifts applied by the shift circuit to obtain the second result. The bitwise XOR circuit generates a reduced product based on the first result, the second result, and the low portion of the product.

[0012] In at least one embodiment, a bitwise exclusive OR (XOR) circuit includes at least two stages of bitwise XOR circuits.

[0013] In at least one embodiment, the processor includes conditional bit reversal circuitry configured to conditionally reverse the bit order of bytes of one of the operands based on a pattern indicated by a Galois multiplication instruction prior to multiplication of the operands.

[0014] In at least one embodiment, the carry-less multiplier is a first multiply-multiply engine, the execution unit includes a second multiply-multiply engine, the first multiply-multiply engine and the second multiply-multiply engine both have a first data width, and the operands include a first operand and a second operand having a second data width, the second data width being an integer multiple of the first data width. In this case, the first multiply-multiply engine and the second multiply-multiply engine are configured to multiply subsets of the first operand and the second operand in parallel. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 is a high-level block diagram of a data processing system including a processor according to one embodiment;

[0016] Figure 2 is a high-level block diagram of a processor core according to one embodiment;

[0017] Figure 3 is a high-level block diagram of an exemplary execution unit of a processor core according to one embodiment;

[0018] Figure 4 is a more detailed block diagram of a cryptographic unit within a processor core according to one embodiment;

[0019] Figure 5 It is a time-space diagram of the encryption and authentication process using AES-GCM (Advanced Encryption Standard-Galois Counter Mode);

[0020] Figure 6 is a block diagram of a modular reduction circuit for performing modular reduction in a Galois field according to one embodiment;

[0021] Figure 7 An optimization of carry-less multiplication according to one embodiment is shown;

[0022] Figure 8 Describes the Figure 7 The carry-less multiplication technique in is applied to Figure 6 The circuit in

[0023] Fig. 9is a schematic diagram of an exemplary multiplication array illustrating the positions of a first group of bits in a carry-free product affected by a one-stage modular reduction and a second group of bits in a carry-free product affected by a two-stage modular reduction;

[0024] Fig.10 is a high-level block diagram of a carry-less multiplication circuit according to one embodiment;

[0025] Fig.11 yes Fig.10 A more detailed block diagram of an exemplary embodiment of a conditional bit inversion circuit in;

[0026] Fig.12 yes Fig.10 A more detailed block diagram of an exemplary embodiment of a modular reduction circuit in;

[0027] Fig.13 depicts an exemplary Galois multiplication instruction according to one embodiment;

[0028] Fig.14 A prior art single instruction multiple data (SIMD) carry-less multiplication circuit is shown;

[0029] Fig.15 depicts an exemplary SIMD carry-less multiplication circuit supporting Galois multiplication according to one embodiment;

[0030] Fig.16 is a high-level logic flow chart of an exemplary method of Galois multiplication according to one embodiment;

[0031] Fig.17 An exemplary design process according to one embodiment is depicted. DETAILED DESCRIPTION

[0032] With reference to the accompanying drawings, in particular with reference to Figure 1 , shows a high-level block diagram of a data processing system 100 according to one embodiment. In some implementations, data processing system 100 may be, for example, a server computer system (such as one of the POWER series servers provided by International Business Machines Corporation), a mainframe computer system, a mobile computing device (such as a smart phone or tablet computer), a notebook or desktop personal computer system, or an embedded processor system.

[0033] As shown, data processing system 100 includes one or more processors 102 for processing instructions and data. Each processor 102 can be implemented as a respective integrated circuit having a semiconductor substrate, wherein an integrated circuit is formed, as known in the art. In at least some embodiments, processor 102 can generally implement any commercially available processor architecture, for example, POWER, ARM, Intel x86, NVidia, Apple silicon, etc. In the example shown in the figure, each processor 102 includes one or more processor cores 104 and cache memory 106, providing low latency access to instructions and operands that processor core 104 may read and / or write. Processor 102 is coupled for communication via system interconnect 110, which may include one or more buses, switches, bridges, and / or hybrid interconnects in various implementations.

[0034] Data processing system 100 may also include a number of other components that are coupled via system interconnect 110. These components may include, for example, a memory controller 112 for controlling access by processor 102 and other components to system memory 114. Additionally, data processing system 100 may include an input / output (I / O) adapter 116 for connecting one or more I / O devices to system interconnect 110, a non-volatile storage system 118, and a network adapter 120 for coupling data processing system 100 to a communications network (e.g., a wired or wireless local area network and / or the Internet).

[0035] Those skilled in the art will also appreciate that the data processing system 100 shown in FIG. Figure 1 Many additional components that are not shown may be included. Because these additional components are not necessary for understanding the described embodiments, they are not described in detail. Figure 1 However, it should be understood that the enhancements described herein are applicable to data processing systems and processors of various architectures and are not limited to Figure 1 The general data processing system architecture is shown.

[0036] See also Figure 2 , shows a high-level block diagram of an exemplary processor core 200 according to one embodiment. The processor core 200 may be used to implement Figure 1 any processor core 104 in .

[0037] In the example shown in the figure, the processor core 200 includes an instruction fetch unit 202 for fetching instructions from a storage device 230 (which may include, for example, Figure 1The processor core 200 may further include an instruction decode unit 204, which may be combined with the instruction fetch unit 202, and in some embodiments, decodes instructions retrieved from the storage device 230 by the instruction fetch unit 202, and forwards branch instructions that control the execution flow to the branch processing unit 206. In some embodiments, the processing of branch instructions performed by the branch processing unit 206 may include speculating the results of conditional branch instructions. The branch processing results (whether speculative or non-speculative) of the branch processing unit 206 may in turn be used to redirect the fetching of one or more instruction streams by the instruction fetch unit 202 .

[0038] Instruction decode unit 204 forwards non-branch instructions (commonly referred to as "sequential instructions") to mapping circuitry 210. Mapping circuitry 210 is responsible for assigning physical registers in register files in processor core 200 to instructions to support instruction execution. Mapping circuitry 210 preferably implements register renaming. Thus, for at least some classes of instructions, mapping circuitry 210 establishes a transient mapping between a set of logical (or architectural) registers referenced by the instruction and a larger set of physical registers in register files in processor core 200. Thus, processor core 200 can avoid unnecessary instruction serialization that might otherwise occur due to the reuse of a limited set of architectural registers due to the proximity of instructions in program order.

[0039] Still see Figure 2 , the processor core 200 additionally includes a dispatch circuit 216 configured to ensure that any data dependencies between instructions are observed and that instructions are dispatched when they are ready for execution. Instructions dispatched by the dispatch circuit 216 are temporarily buffered in an issue queue 218 until the execution units of the processor core 200 have resources available to execute the dispatched instructions. As appropriate execution resources become available, the issue queue 218 issues instructions from the issue queue 218 to the execution units of the processor core 200, which instructions may be opportunistic and may differ from the original program order of the instructions.

[0040] In the example shown in the figure, the processor core 200 includes several different types of execution units for executing different categories of instructions. In this example, the execution units include one or more fixed-point units 220 for executing instructions that access fixed-point operands; one or more floating-point units 222 for executing instructions that access floating-point operands; one or more load-store units 224 for loading data from and storing data in storage devices 230; and one or more vector-scalar units 226 for executing instructions that access vector and / or scalar operands. In a typical embodiment, each execution unit is implemented as a multi-stage pipeline in which multiple instructions can be processed simultaneously at different stages of execution. Each execution unit preferably includes or is coupled to at least one register file, which includes a plurality of physical registers for temporarily buffering operands accessed during or generated by instruction execution.

[0041] Those skilled in the art will appreciate that processor core 200 may include other components not shown, such as logic for managing the completion and retirement of instructions that have completed execution by execution units 220-226. Because these additional components are not necessary for understanding the described embodiments, they are not described in detail. Figure 2 It is not shown nor discussed further.

[0042] See also Figure 3 , shows a high-level block diagram of an exemplary execution unit of processor 102 according to an embodiment. In this example, vector-scalar unit 226 of processor core 200 is shown in more detail. Figure 3 In the illustrated embodiment, the vector-scalar unit 226 is configured to execute multiple different classes of instructions that operate on and generate different types of operands. For example, the vector-scalar unit 226 is configured to execute a first class of instructions that operate on vector and scalar source operands and generate vector and scalar destination operands. The vector-scalar unit 226 executes the first class of instructions in functional units 302-312, which in the illustrated embodiment include: an arithmetic logic unit / rotation unit 302 for performing addition, subtraction, and rotation operations; a multiplication unit 304 for performing binary multiplication; a division unit 306 for performing binary division; an encryption unit 308 for performing encryption functions; a permutation unit 310 for performing operand permutations; and a binary coded decimal (BCD) unit 312 for performing decimal mathematical operations. The vector and scalar source operands performed by these operations and the vector and scalar destination operands generated by these operations are buffered in physical registers of the architecture register file 300.

[0043] In this example, the vector-scalar unit 226 is additionally configured to execute a second class of instructions that operate on matrix operands and generate matrix operands. The vector-scalar unit 226 executes the second class of instructions in a matrix multiply-accumulate (MMA) unit 314. The matrix operands performed by these operations and the matrix operands generated by these operations are buffered and accumulated in physical registers of the non-architectural register file 316.

[0044] In operation, an instruction is received by the vector-scalar unit 226 from the issue queue 218. If the instruction belongs to the first class of instructions (e.g., vector-scalar instructions), the associated source operand(s) are accessed for the instruction in the architectural register file 300 using the mapping between logical and physical registers established by the mapping circuit 210 and then forwarded with the instruction to the associated functional unit 302-312 for execution. The target operand(s) generated by the execution are then stored back in the physical register(s) of the architectural register file 300 as determined by the mapping established by the mapping circuit 210. On the other hand, if the instruction belongs to the second class of instructions (e.g., MMA instructions), the instruction is forwarded to the MMA unit 314 for execution with respect to the operand(s) buffered in the physical registers of the designated non-architectural register file 316. In this case, execution by the MMA unit 314 includes performing a matrix multiplication operation followed by accumulating (e.g., summing) the resulting product with the contents of one or more physical registers designated in the non-architectural register file 316.

[0045] See also Figure 4 , a more detailed block diagram of an exemplary encryption unit 308 according to one embodiment is shown. In this example, the encryption unit 308 includes a circuit for performing encryption and decryption according to AES (Advanced Encryption Standard) in hardware. For example, AES is defined in International Organization for Standardization (ISO) / International Electrotechnical Commission (IEC) Standard 18033-3, Edition 2, December 15, 2010, which is incorporated herein by reference. As shown, the circuit includes an AES encryption / decryption circuit 400, which combines an encryption key with a plaintext to obtain a ciphertext, and combines a decryption key with the ciphertext to obtain a plaintext. The encryption unit 308 additionally includes an AES key generation circuit 402, which generates a key for the AES encryption / decryption circuit 400 to encrypt and decrypt data. The encryption unit 308 also includes a carry-less multiplication circuit 404, as described in detail below. The carry-less multiplication circuit 404 can be used, for example, in the process of generating a signature for authenticating an encrypted message in AES-GCM (Galois counter multiplication). The carry-less multiplication circuit 404 may also be used to perform Galois multiplication in the process of encrypting and decrypting messages, such as in AES-XTS (XEX-based adjusted codebook mode with ciphertext stealing).

[0046] See also Figure 5 , shows a time-space diagram of an encryption and authentication process 500 using AES-GCM (Advanced Encryption Standard-Galois Counter Mode). AES-GCM is used to encrypt n plaintext blocks 502 (each is a 128-bit input string) to obtain n 128-bit ciphertext blocks 522 and a signature 532, which can be used to authenticate that the n ciphertext blocks 522 have not been modified. AES-GCM is therefore suitable for protecting data in flight.

[0047] In addition to plaintext 502, encryption process 500 also starts with initial value 504 (e.g., a random value extended to 128 bits), encryption key K 506 (here assumed to be a 128-bit value), authentication data 508 (here assumed to be a single 128-bit block), 128-bit authentication key H 510, and a positive integer n determined by the number of 128-bit blocks in the plaintext (and ciphertext). Initial value 504 is a 128-bit value used to initialize the value of counter0 512. The value of counter0 512 is iteratively increased n times by increment function 514 to generate a series of 128-bit counter values, which are repeated n times in a row. Figure 5 506. These n+1 counter values ​​and encryption key K 506 are processed in n+1 instantiations of AES encryption functions 516 to produce respective n+1 128-bit encrypted outputs X0 through Xn 518.

[0048] like Figure 5 As further shown, plaintext 1 502 is logically combined with the encrypted output X1 518 via an exclusive OR (XOR) function 520 to generate ciphertext 1 522. Plaintext 2 502 is also logically combined with the encrypted output X2 via an XOR function 520 to generate ciphertext 2. This process continues for n iterations until the final ciphertext n 522 is obtained.

[0049] The authentication data 508 and the authentication key H 510 form two inputs to a Galois counter multiplication (GCM) 0 function 524, which produces a 128-bit authentication value Y1 526. This authentication value Y1 526 is logically combined with the ciphertext 1 522 by an XOR function 528 to produce the input to the next GCM multiplication 1 function 524. The GCM multiplication 1 function 524 multiplies this input by the authentication key H 510. This process continues iteratively for n rounds of multiplication until the authentication value Yn+1 526 is obtained. The authentication value Yn+1 is logically combined with a 128-bit length indicator 530 by an XOR function 528, which is formed by the concatenation of the authentication data 508 and the length of the ciphertext 522. The output of this XOR function 528 provides the first input to the GCM multiplication n+1 function 524, which multiplies this input by the authentication key H 510. The 128-bit product produced by the GCM multiplication n+1 function 524 is then logically combined with the encrypted output X0 518 via an XOR function 528 to obtain a signature 532 that can be used to authenticate the n-block ciphertext.

[0050] As mentioned above, performance issues make it more difficult to directly support such Figure 5 The AES-GCM function shown becomes desirable. One of the complex issues in implementing hardware-supported encryption algorithms is the different byte orders and bit orders used between various processor hardware and various encryption algorithms. For example, Table I below summarizes the byte orders and bit orders of three common encryption functions, namely AES, GCM, and XTS. As shown in the figure, under AES, the leading (leftmost) bit of each byte is the most significant bit, and the leading (leftmost) byte of each data word is the most significant byte. This combination of bit and byte order can be called big-big endian (BBE). GCM, on the other hand, stipulates that the leading bit of each byte and the leading byte of each data word are the least significant. This byte order is called little-little endian (LLE). XTS uses a third byte order, called big-little endian (BLE), in which the leading bit of each byte is the most significant bit, but the leading byte of the data word is the least significant byte.

[0051] Table I

[0052]

[0053] In general, each physical processor implements a native option of these three endian options, with BBE and BLE hardware being the most common commercial implementations. Regardless of which native endian the hardware implements, in order to provide hardware support for encryption algorithms with different endianness (e.g., AES, GCM, and XTS), some reformatting of the data is required to compensate for the endianness differences. In general, such data reformatting can be implemented, for example, directly before and after each GCM function 524 when passing data from the AES-Counter Encryption portion of process 500 (shown on the left side of the dashed line) to the Authentication portion (shown on the right side of the dashed line), or as part of the GCM function 524 itself.

[0054] In cryptographic software libraries, encryption and authentication are typically implemented as separate functions. In such a software implementation, the encrypted output X0 518 and ciphertext 1 to ciphertext n are passed through memory, which is automatically reformatted as part of the memory read and write accesses. However, for hardware-implemented encryption functions, data reformatting must be applied to the register file data to obtain acceptable performance. In the following description, a processor with a local BBE byte order and hardware support for Galois multiplication used in AES-GCM and AES-XTS is described in detail. The processor accepts data represented in a machine-local byte order (e.g., BBE) and performs Galois multiplication for LLE or BLE format. From the following description, those skilled in the art will understand that the disclosed technology can also be applied to a processor with a local BLE byte order by implementing a circuit to reverse the bit order in a byte for GCM encryption.

[0055] Galois multiplication, for example in Figure 5 The GCM multiplication function 524 in FIG. 5 involves a carry-less multiplication followed by a modular reduction. For example, in one embodiment, a carry-less multiplication of two 128-bit input operands A and B produces a 255-bit product P. The modular reduction modulo the polynomial g(x) reduces P to a 128-bit number through an iterative process.

[0056] For ease of understanding, we first explain the reduction of natural numbers modulo G, and then apply it to the modular reduction of Galois Field (GF) (2^128) modulo g(x). In the following reduction, variables G and J are first defined as follows:

[0057] G = 2^128 + (2^7 + 2^2 + 2^1 + 1) = 2^128 + J, where

[0058] J=2^7+2^2+2^1+1

[0059] Given these definitions of G and J, the first step of the reduction divides an arbitrary 255-bit number P into a 128-bit lower part PL and a 127-bit upper part PH, where PL < G. This division results in the following relationship:

[0060] P = PH * 2^128 + PL

[0061] In the second step of the reduction, P is reduced to a number T with at most 135 bits, according to the following set of relationships:

[0062] P = PL + PH * (2^128 + (J - J)) = PL + PH * (G – J) === PL + PH * (-J) = T

[0063] where "===" means equivalence modulo G (not equality). In the third step of the reduction, T is again divided into a 7-bit upper part (TH) and a 128-bit lower part (TL), as follows:

[0064] T = TL + TH * 2^128

[0065] Finally, in the fourth step of the reduction, T is reduced to T' in the same manner as in step 2 to obtain a result less than G, by the following relationship:

[0066] T' = TL + TH * (-J)

[0067] Given an understanding of the modulo reduction process, now refer to Figure 6 , which is a block diagram of a modulo reduction circuit 600 for a polynomial g(x) in a Galois field according to an embodiment.

[0068] In a Galois field, multiplication is a carry-less operation, and addition and subtraction are performed using bitwise XOR. A carry-less multiplication of two w-bit numbers produces a (2w-1)-bit product. Thus, for example, a multiplication of two 128-bit numbers produces a product P having 255 bits. As described above, in the first step of the reduction, the product P is divided into a 128-bit low-order part PL 602 and a 127-bit high-order part PH 604. PH 604 forms the input to a carry-less multiplier 606a, which multiplies PH 604 by the equivalent value of (-J). For GF(2^128) in LLE format, this multiplier is R='1110.0001'. The carry-less multiplication of PH 604 and R 608 produces a 134-bit product T 610, which is divided into a 128-bit low-order portion TL 610a and a 6-bit high-order portion TH 610b. A second carry-less multiplier 606b multiplies TH 610b by R 608 to produce a 13-bit product T' 614. A bitwise XOR circuit 612 performs a left-justified bitwise exclusive OR of PL 602, TL 610a, and T' 614 to produce a fully reduced 128-bit product M 618. In various embodiments, carry-less multipliers 606a and 606b may be implemented using full-size 128x128-bit LLE multipliers, or using 127x8-bit multipliers and 6x8-bit multipliers, respectively. When different 8-bit values ​​of R are applied, Figure 6 The modular reduction circuit 600 can also be used for other Galois fields (2^k) and f(x), as long as k is less than or equal to 128 and f(x) is in the form of f(x) = x^k + a7*x^7 + a6*x^6… + a1*x^1 + a0, where all a(i) are in the set {0, 1, -1}.

[0069] See also Figure 7 , shows a further optimization of carry-less multiplication according to one embodiment. As shown, the carry-less multiplication of the 127-bit PH 604 with the 8-bit constant R 608 will produce eight partial products PP 700a-700h. However, since R 608 is a constant with only four ones (i.e., '1110.0001'), the carry-less multiplication of PH 604 with R 608 can omit the four partial products PP 700d-700g multiplied by zero. Therefore, the product can be obtained from the remaining partial products PP 700a-PP 700c and PP 700h using a four-input bitwise XOR circuit 702, which performs the following exclusive OR operation:

[0070] PL*R=PL XOR(PL>>1)XOR(PL>>2)XOR(PL>>7), where ">>" indicates shifting the indicated number of bit positions to the right

[0071] This optimization can achieve Figure 6 The hardware cost of the carry-less multiplier 606a is reduced by more than a factor of two.

[0072] Figure 8 Describes the Figure 7 The carry-less multiplication technique shown in is applied to Figure 6 The modular reduction circuit 600. In particular, Figure 8 It is illustrated that the multiplication PH*R by the carryless multiplier 606a produces four reduction terms: PH 802, PH 804 shifted right by 1 bit position, PH 806 shifted right by 2 bit positions, and PH 808 shifted right by 7 bit positions. The most significant bit of PH 806 and the most significant 6 bits of PH 808 are combined to form TH 610b, which is the high-order portion of the first reduction result. More specifically,

[0073] TH(0)=PH(126)XOR PH(121) and

[0074] TH(1:5)=PH(122:126)

[0075] The second reduction term T'=TH*R 614 can be similarly expanded into four terms, namely, TH 610b, TH 812 shifted right by 1 bit position, TH 814 shifted right by 2 bit positions, and TH 816 shifted right by 7 bit positions. These four reduction terms, the four reduction terms of the reduction result T 610, and PL 602 form a set of all reduction terms 818, which are logically combined by the bitwise XOR circuit 612 according to the value of each of the 128 bit positions to produce the full reduction product M 618. Regarding the implementation Figure 8 A detailed description of an embodiment of a modular reduction circuit for a carry-less multiplication technique is given below with reference to Fig.12 described.

[0076] See also Fig. 9 , a schematic diagram of an exemplary 128-bit by 128-bit multiplication array 900 is shown, showing Figure 8 614. As shown in the figure, the high-order product bits 902 that form TH 610b and the low-order product bits 904 that combine with TH 610b to form T' 614 are located at the extreme ends of the multiplication array 900, where the depth of the gate is the shallowest. Therefore, the calculation of the product bit 902 and the logical combination of the product bit 902 and the product bit 904 are not the limiting factors of the carry-free multiplication performance performed by the modular reduction circuit 600.

[0077] See also Fig.10, shows a high-level block diagram of a carry-less multiplication circuit 404 according to an embodiment. The carry-less multiplication circuit 404 implements Galois multiplication, supports GCM and XTS, and is connected to the architecture register file 300, which stores operand data in a native BBE format. As described above, GCM and XTS interpret data in LLE format and BLE format, respectively.

[0078] In the embodiment shown in the figure, the carry-less multiplication circuit 404 includes two conditional bit reversal circuits 1102a, 1102b at its input ports, and an additional conditional bit reversal circuit 1102c at its output port. The conditional bit reversal circuits 1102a, 1102b receive two 128-bit operands A and B from registers XA and XB in the architecture register file 300, respectively, and conditionally reverse the order of bits within bytes in operands A and B based on, for example, a mode input indicating whether the carry-less multiplication circuit 404 is used to perform GCM or XTS multiplication. The conditional bit reversal circuits 1002a, 1002b output a 128-bit multiplicand 1004a and a 128-bit multiplier 1004b.

[0079] The carry-less multiplication circuit 404 includes a carry-less multiplier 1006 that performs a 128-bit by 128-bit multiplication of the multiplicand 1004a by the multiplier 1004b to produce a 255-bit product P 1008. The product P 1008 is received by the modular reduction circuit 1010 and reduced to a 128-bit reduced product M 618. Fig.12 An embodiment of this circuit is shown in more detail in This reduced product M 618 is then stored back into register XT of the architectural register file 300, possibly after reversing the bit order by conditional bit reversal circuit 1002c.

[0080] In the embodiment shown in the figure, the data operands in the architecture register file 300 and the carry-less multiplier 1006 implement the BBE data format. For LLE carry-less multiplication as required by GCM, the multiplication in the BBE format can be simply performed in the carry-less multiplier 1006 in the BBE format, and then the product P 1008 is shifted left by one bit position. Since the product P 1008 flows directly into the modular reduction circuit 1010, the left shift of 1 bit can be conveniently implemented by the modular reduction circuit 1010.

[0081] For XTS, on the other hand, operands A and B are reformatted by conditional bit reversal circuits 1002 a, 1002 b to match the LLE data format of GCM. (As described in Table I above, GCM and LLE share the same byte order, but have different bit orders.) Conditional bit reversal circuit 1002 c also reverses the bit order of the reduced product M 1012 of the XTS multiplication before writing it to register XT in the architectural register file 300.

[0082] See also Fig.11 , showing that it can be used to implement Fig.10 100. In this example, the conditional bit reversal circuit 1100 has a 128-bit (i.e., 16-byte) input 1102 that is coupled to one input of a two-input 128-bit multiplexer 1106. Each of the sixteen bytes of the 128-bit input 1102 is additionally coupled to sixteen bit reversal circuits 1104, which may be implemented, for example, by wiring that reverses the order of the bits in the associated byte of the input 1102. The outputs of all bit reversal circuits 1104 together form a second 128-bit input to the multiplexer 1106.

[0083] Multiplexer 1106 selects between the data presented at its two inputs based on a mode input indicating whether big-endian or little-endian bit ordering is to be applied. The mode input may be determined, for example, by a corresponding field of a Galois multiplication instruction, as described below with reference to Fig.13 The data selected by multiplexer 1106 is presented on 128-bit output 1108 .

[0084] See also Fig.12 , showing Fig.10 A more detailed block diagram of an exemplary embodiment of the modular reduction circuit 1010 in FIG. This exemplary circuit compactly implements the above-mentioned reference Figure 6 The two-stage reduction described here makes use of the reference Figure 8 Discussion optimization.

[0085] Modular reduction circuit 1010 receives the 255-bit product P1008 generated by carry-less multiplier 1006, as shown in FIG. Fig.10 As shown in the above reference Figure 6 As shown, product P 1008 includes a 128-bit low portion PL 602 and a 127-bit high portion PH 604. After preliminary bit shifting and padding, modular reduction circuit 1010 operates on the left-aligned inputs using four bitwise XOR circuits 1200, 1202, 1204 and 612 to reduce product P 1008 to a reduced product M 618.

[0086] The bitwise XOR circuit 1200 includes three 128-bit inputs coupled to receive Figure 8 The first to third reduction terms 818 in bitwise XOR circuit 612 are PL 602, PH 802 (PH 604 padded with trailing zeros in bit position 127 by pad circuit 1210), and PH 804 (PH 604 shifted right by one bit position by shift circuit 1212). The bitwise exclusive OR of these three inputs produces the first 128-bit input of bitwise XOR circuit 612.

[0087] The bitwise XOR circuit 1202 similarly logically combines the fourth and fifth reduction terms 818, namely PH 806 (PH 604 shifted right by two bit positions by shift circuit 1214) and PH 808 (PH 604 shifted right by seven bit positions by shift circuit 1216). The XOR of these two inputs generates a 134-bit result. Bits 0:127 of this XOR result form TL 610a, which is the second 128-bit input of the bitwise XOR circuit 612. Bits 128:133 of the XOR result generated by the bitwise XOR circuit 1202 form TH 610b, which is passed to the bitwise XOR circuit 1204 and shift circuits 1216, 1218, and 1220.

[0088] The bitwise XOR circuit 1204 logically combines the sixth to ninth reduction terms 818 that form the second reduction result T'614. That is, the bitwise XOR 1204 logically combines TH 610b, TH 810 (TH 610b shifted right by one bit position by the shift circuit 1216), TH 812 (TH 610b shifted right by one bit position by the shift circuit 1218), and TH 814 (TH 610b shifted right by one bit position by the shift circuit 1220). The bitwise XOR of these four inputs, i.e., the 13-bit second reduction result 614', forms the third input of the bitwise XOR circuit 612. The bitwise XOR circuit 612 performs a left-aligned bitwise XOR on its three inputs to generate a reduction product M 618.

[0089] See also Fig.13 , shows an exemplary Galois multiplication instruction 1300 according to one embodiment. In a preferred embodiment, a single Galois multiplication instruction 1300 may be executed in the encryption unit 308 of the vector-scalar unit 226 to enable Fig.10 The carry-less multiplication circuit 404 performs the above reference Fig.12 Carry-less multiplication with modular reduction on the polynomial g(x) described.

[0090] In this example, the Galois multiplication instruction 1300 includes an opcode field 1302 that specifies an architecture-specific opcode representing a Galois carry-less multiplication with modular reduction. The Galois multiplication instruction 1300 also includes an operand field 1304 that directly or indirectly indicates one or more registers XA, XB, XT in the architecture register file 300 for storing source and target operands for the Galois carry-less multiplication and modular reduction operations. Finally, the Galois multiplication instruction 1300 includes a mode field 1306 that specifies a data format (e.g., BLE / XTS or LLE / GCM) suitable for Galois carry-less multiplication and modular reduction operations. As described above, the setting of the mode field 1306 can be used by the conditional bit reversal circuit 1100 to select whether to apply a bit order reversal to the bytes of the input data word.

[0091] The above description has described aspects of the disclosed invention with reference to a carry-less multiplication circuit 404 having a wide (e.g., 128-bit by 128-bit in the current art) carry-less multiplier 1006. However, some commercial processors may not include a wide carry-less multiplier, but rather include multiple narrower carry-less multipliers that operate in parallel on smaller data elements. For example, Fig.14 A prior art single instruction multiple data (SIMD) multiply-multiply engine 1400 is shown, including two 64-bit carry-less multipliers 1406, 1408 operating in parallel on 128-bit SIMD operands A 1402 and B 1404. In this example, the SIMD multiply-multiply instruction causes the carry-less multiplier 1406 to multiply the 64-bit high portions of the SIMD operands 1402, 1404 to generate a 128-bit high portion PH 1414 of the product, causes the carry-less multiplier 1408 to multiply the 64-bit low portions of the SIMD operands 1402, 1404 to generate a 128-bit low portion PL 1416 of the product, and causes the bitwise XOR circuit 1410 to perform a 128-bit bitwise exclusive OR of the PH 1414 and the PL 1416 to produce a product Q 1412. Of course, this conventional SIMD architecture can be extended to add additional lanes to support larger data widths (eg, 256-bit operands).

[0092] According to one or more embodiments, Fig.14 The conventional SIMD architecture given in can also be extended to support the above Galois multiplication. For example, Fig.15 An exemplary SIMD carry-less multiplication circuit 1500 is depicted that supports Galois multiplication as described herein.

[0093] SIMD carry-less multiplication circuit 1500 includes conditional bit reversal circuits 1506 and 1508 that conditionally reverse the order of bits in each byte of SIMD operands A 1502 and B 1504, respectively. Each of conditional bit reversal circuits 1506 and 1508 may be referenced by Fig.11 The conditional bit inversion circuit 1100 is described as being implemented.

[0094] The SIMD carry-less multiplication circuit 1500 also includes two 128-bit SIMD multiplication-multiplication engines 1512, 1514, each of which can be used, for example, Fig.14 1502 (i.e., AH, AL and BH, BL) to generate a 255-bit product P1, including a 127-bit high part P1H and a 128-bit low part P1L. The XOR result of P1H and P1L is Q1. In order to compensate for the data format difference between BBE and LLE, bit 0 is discarded from P1H to achieve a 1-bit left shift. The first input of the multiplication-multiplication engine 1514 is coupled to receive the SIMD operand A 1502 (i.e., AH, AL), and the second input is coupled to receive the output of the exchange doubleword circuit 1510, which exchanges the high and low 64-bit doublewords of the SIMD operand B 1504 (i.e., BL, BH). The multiply-multiply engine 1514 multiplies and combines the two inputs in a carry-less manner to generate a 128-bit result Q2 (where Q2 corresponds to AL*BH+AH*BL, i.e., the 128-bit result of a 64-bit multiply-multiply operation with its B operand inverted).

[0095] The SIMD carry-less multiplication circuit 1500 additionally includes a reduction circuit 1516 that reduces the 255-bit product P derived from the result Q2 and the partial products P1L, P1H to 128 bits, and a multiplexer 1518 that selects between the 128-bit result Q1 and the 128-bit output of the reduction circuit 1516 as a result 1520 of the SIMD carry-less multiplication circuit 1500. Fig.15 As further shown, the reduction circuit 1516 logically combines the products P1H, P1L, and Q2 using a left-aligned 255-bit bitwise XOR circuit 1534, the three inputs of which are: 127-bit P1H, a 255-bit value obtained by applying a 127-bit right shift to P1L using shift circuit 1530, and a 191-bit value obtained by applying a 63-bit right shift to Q2 using shift circuit 1532. These three left-aligned inputs are logically combined by the bitwise XOR circuit 1534 to generate a 255-bit carry-free product P. This 255-bit carry-free product P is reduced to a 128-bit reduced product M by the modular reduction circuit 1010, as described above with reference to Fig.10The bit order of each byte in the reduced product M is conditionally reversed by conditional bit reversal circuit 1536 to produce a 128-bit output, which forms a second input to multiplexer 1518. Multiplexer 1518 selects result Q1 as result 1520 if SIMD carry-less multiplication circuit 1500 is used to execute SIMD multiplication instructions, and selects the output of reduction circuit 1516 as result 1520 if SIMD carry-less multiplication circuit 1500 is used to execute Galois multiplication instructions.

[0096] Those skilled in the art will appreciate that the SIMD carry-less multiplication circuit 1500 employs optimizations (and additional optimizations may be employed) to reduce circuit size. For example, the SIMD carry-less multiplication circuit 1500 may employ the Karatsuba algorithm to simplify the calculation of AH*BL+AL*BH to (AH+AL)*(BH+BL)+PH+PL. This simplification may be computed by a 64-bit carry-less multiplier, two 64-bit bitwise XOR circuits operating on operands A and B, and performing three-way 128-bit XOR on the three product terms. Further optimization may be performed by combining the conditional bit inversion circuits 1506, 1508 and the swap doubleword circuit 1510, and by combining the conditional bit inversion circuit 1536 with the multiplexer 1518. In general, if the Karatsuba algorithm is implemented for 128-bit SIMD, Fig.10 The carry-free multiplication circuit 404 in the embodiment can be used with no more than Fig.14 The multiplication-multiplication engine in the 1400 is implemented in 1.5 times the area, Fig.15 The SIMD carry-less multiplication circuit 1500 in FIG. 1 can be implemented with an area no greater than twice that of the multiplication-multiplication engine 1400. If a 64-bit multiplication-multiplication engine is used in a 256-bit or higher SIMD, a 128-bit Galois multiplication can be implemented with less hardware overhead. Two 128-bit multiplication-multiplication engines in such a 256-bit SIMD engine can be similar to Fig.15 128-bit Galois multiplication can be performed on either the upper 128-bit SIMD elements or the lower 128-bit SIMD elements. The only overhead is the multiplexing and conditional bit reversal and reduction circuitry 1516 for the Galois multiplication operands.

[0097] See also Fig.16 , shows a high-level logic flow chart of Galois multiplication according to one embodiment. For ease of understanding, refer to Fig.10 The embodiment of the carry-less multiplication circuit 404 is described in Fig.16 The process in .

[0098] The flow shown in the figure starts at block 1600 and then proceeds to block 1602, which shows that the processor core 200 of the vector-scalar unit 226 receives an instruction requiring a Galois multiplication, such as Fig.13 In response to receiving the instruction, the vector-scalar unit 226 reads operand A and operand B from the architectural register file 300 and passes operand A and operand B to the input port of the carry-less multiplication circuit 404 (block 1604). At block 1606, the vector-scalar unit 226 determines whether the instruction specifies (e.g., in the mode field 1306) XTS mode, which requires a BLE data format instead of an LLE data format. In response to the affirmative determination at block 1606, the vector-scalar unit 226 utilizes the conditional bit reversal circuits 1002a, 1002b of the carry-less multiplication circuit 404 to reverse the bit order of each byte in operand A and operand B (block 1608).

[0099] After block 1608, or in response to a negative determination at block 1606, the vector-scalar unit 226 performs a carry-less multiplication on operand A and operand B using the carry-less multiplier 1006 to obtain a 255-bit product P 1008 (block 1610). The multiplication uses the BBE data format. At block 1612, the vector-scalar unit 226 reduces the product P according to the polynomial g(x) to obtain a reduced product M618 through two or more bitwise XOR stages, as shown in FIG. Fig.12 As shown in blocks 1614-1616, if the instruction specifies that XTS mode requires a BLE data format instead of an LLE data format, the vector-scalar unit 226 again utilizes the conditional bit reversal circuit 1002c to reverse the bit order of each byte in the reduced product M 618. After block 1616, or if the instruction does not specify XTS mode, the vector-scalar unit 226 writes the reduced product M back to the register file 300 (block 1618). After block 1618, Fig.16 The process ends at block 1620.

[0100] See now Fig.17, a block diagram of an exemplary design process 1700 is shown, which is used, for example, for semiconductor integrated circuit logic design, simulation, testing, layout and manufacturing. The design process 1700 includes a process, machine and / or mechanism for processing a design structure or device to generate a logical or functional equivalent representation of the design structure and / or device. The design structure processed and / or generated by the design process 1700 can be encoded on a machine-readable transmission or storage medium to include data and / or instructions that, when executed or processed by a data processing system, generate a logical, structural, mechanical or functional equivalent representation of a hardware component, circuit, device or system. Machines include, but are not limited to, any machine used in an integrated circuit design process, such as a machine that designs, manufactures or simulates a circuit, component, device or system. For example, a machine may include: a lithography machine, a machine and / or device for generating a mask (such as an electron beam writer), a computer or device for simulating a design structure, any device for a manufacturing or testing process, or any machine for programming a functional equivalent representation of a design structure into any medium (such as a machine for programming a programmable gate array).

[0101] The design process 1700 may differ depending on the type of representation being designed. For example, the design process 1700 for building an application specific integrated circuit (ASIC) may differ from the design process 1700 for designing a standard component or from the design process 1700 for instantiating a design into a programmable array, such as a programmable gate array (PGA) or a field programmable gate array (FPGA), by Inc. or Inc.

[0102] Fig.17A plurality of such design structures are shown, including an input design structure 1020, which is preferably processed by the design process 1710. The design structure 1720 may be a logic simulation design structure generated and processed by the design process 1710 to produce a logically equivalent functional representation of a hardware device. The design structure 1720 may also or alternatively include data and / or program instructions that, when processed by the design process 1710, generate a functional representation of the physical structure of the hardware device. Whether representing functional and / or structural design features, the design structure 1720 may be generated using electronic computer-aided design (ECAD) such as implemented by a core developer / designer. When encoded on a machine-readable data transmission, gate array, or storage medium, the design structure 1720 may be accessed and processed by one or more hardware and / or software modules within the design process 1710 to simulate or otherwise functionally represent an electronic component, circuit, electronic or logic module, device, apparatus, or system, as described herein. Thus, design structure 1720 may include files or other data structures, including human and / or machine readable source code, compiled structures, and computer executable code structures, that when processed by a design or simulation data processing system, functionally simulate or otherwise represent a circuit or other hardware logic design level. Such data structures may include hardware description language (HDL) design entities or other data structures that conform to lower level HDL design languages ​​(such as Verilog and VHDL) and / or conform to and / or are compatible with higher level design languages ​​(such as C or C++).

[0103] Design process 1710 preferably employs and incorporates hardware and / or software modules for synthesizing, translating or otherwise processing the design / simulation functional equivalent of components, circuits, devices or logic structures as shown herein to generate a netlist 1780, which may contain a design structure such as design structure 1720. Netlist 1780 may include, for example, a compiled or otherwise processed data structure representing a list of wires, discrete components, logic gates, control circuits, I / O devices, models, etc. connected to other elements and circuits in the integrated circuit design. Netlist 1780 may be synthesized using an iterative process that resynthesizes netlist 1780 one or more times based on the design specifications and parameters of the device. As with other design structure types described herein, netlist 1780 may be recorded on a machine-readable storage medium or programmed into a programmable gate array. The medium may be a non-volatile storage medium, such as a magnetic or optical drive, a programmable gate array, a compact flash or other flash memory. Additionally or alternatively, the medium may be a system or cache memory, or a buffer space.

[0104] The design process 1710 may include hardware and software modules for processing various input data structure types, including netlists 1780. Such data structure types may reside, for example, in library elements 1730 and include a set of commonly used elements, circuits, and devices, including models, layouts, and symbolic representations of given manufacturing technologies (e.g., different technology nodes, 32nm, 45nm, 170nm, etc.). The data structure types may further include design specifications 1740, characterization data 1750, verification data 1760, design rules 1790, and test data files 1785, which may include input test patterns, output test results, and other test information. The design process 1710 may also include, for example, standard mechanical design processes such as stress analysis, thermal analysis, mechanical event simulation, process simulation for operations such as casting, molding, and stamping. One of ordinary skill in the art will appreciate the range of mechanical design tools and applications that may be used in the design process 1710 without departing from the scope and spirit of the present invention. The design process 1710 may also include modules that perform standard circuit design processes, such as timing analysis, verification, design rule checking, place and route operations, etc.

[0105] Design process 1710 employs and incorporates logical and physical design tools, such as HDL compilers and simulation model building tools, to process design structure 1720 and or all of the supporting data structures shown, along with any additional mechanical design or data (if applicable), to generate a second design structure 1790. Design structure 1790 resides in a storage medium or programmable gate array in a data format for exchanging mechanical device and structure data (e.g., information stored in IGES, DXF, Parasolid XT, JT, DRG, or any other format suitable for storing or rendering such mechanical design structures). Similar to design structure 1720, design structure 1790 preferably includes one or more files, data structures, or other computer-encoded data or instructions that reside on a transmission or data storage medium and, when processed by an ECAD system, generate a logical or functional equivalent of one or more of the embodiments of the present invention shown herein. In one embodiment, design structure 1790 may include a compiled, executable HDL simulation model that functionally simulates the device shown herein.

[0106] Design structure 1790 may also be in a data format for exchanging integrated circuit layout data and / or symbol data formats (e.g., information stored in GDSII (GDS2), GL1, OASIS, map files, or any other format suitable for storing such design data structures). Design structure 1790 may include, for example, symbol data, map files, test data files, design content files, manufacturing data, layout parameters, wires, metal layers, vias, shapes, data for routing through manufacturing lines, and any other data required by a manufacturer or other designer / developer to produce the devices or structures shown and described herein. Design structure 1790 may then proceed to stage 1795, where, for example, design structure 1790 is: taped out, released to manufacturing, released to a mask shop, sent to another design shop, sent back to a customer, etc.

[0107] As described above, in at least one embodiment, the processor includes an instruction fetch unit that fetches instructions to be executed; an architectural register file that includes a plurality of registers for storing source and target operands; and an execution unit that is configured to execute a Galois multiplication instruction. The execution unit includes a carry-less multiplier that is configured to multiply the operands of the Galois multiplication instruction to generate a product. The execution unit also includes a modular reduction circuit that is configured to receive the product and determine a reduced product having fewer bits than the product based on a logical combination of the product and a fixed polynomial. The execution unit is configured to store the reduced product to the architectural register file as a result of the Galois multiplication instruction.

[0108] In some embodiments, the processor may be part of a larger data processing system and may also be implemented as design structure in a machine-readable storage device.

[0109] According to a method of data processing, an instruction fetch unit of a processor fetches instructions to be executed by the processor, including a Galois multiplication instruction. Based on receiving the Galois multiplication instruction, an execution unit of the processor executes the instruction. Executing the Galois multiplication instruction includes: multiplying operands of the instruction by a carry-less multiplier to generate a product; a modular reduction circuit receives the product and determines a reduced product having fewer bits than the product based on a logical combination of the product and a fixed polynomial; and then the processor stores the reduced product in an architectural register file of the processor as a result of the Galois multiplication instruction.

[0110] In at least one embodiment, the fixed polynomial is g(x)=1+X+x^2+x^7+x^128.

[0111] In at least one embodiment, the product of the carry-less multiplication includes a high portion and a low portion, the high portion including high-order bits of the product, the low portion including low-order bits of the product, and the modular reduction circuit is configured to calculate a first result of the carry-less multiplication that is equivalent to the high portion and the fixed polynomial. The modular reduction circuit includes a shift circuit that applies a plurality of different bit position shifts to the high portion of the product that are consistent with asserted bits in the fixed polynomial, and a bitwise exclusive OR (XOR) circuit that logically combines multiple instances of the high portion of the product, the multiple instances having respective different bit position shifts applied by the shift circuit.

[0112] In at least one embodiment, the shift circuit is further configured to apply a plurality of different bit position shifts to the high portion of the first result consistent with the asserted bits in the fixed polynomial, and the bitwise exclusive OR (XOR) circuit is further configured to logically combine the plurality of instances of the high portion of the first result of the respective different bit position shifts applied by the shift circuit to obtain the second result. The bitwise XOR circuit generates a reduced product based on the first result, the second result, and the low portion of the product.

[0113] In at least one embodiment, a bitwise exclusive OR (XOR) circuit includes at least two stages of bitwise XOR circuits.

[0114] In at least one embodiment, the processor includes conditional bit reversal circuitry for conditionally reversing the bit order of bytes of one of the operands based on a pattern indicated by a Galois multiplication instruction prior to multiplying the operands.

[0115] In at least one embodiment, the carry-less multiplier is a first multiply-multiply engine, the execution unit includes a second multiply-multiply engine, the first and second carry-less multiply-multiply engines both have a first data width, and the operands include a first operand and a second operand having a second data width, the second data width being an integer multiple of the first data width. In this case, the first multiply-multiply engine and the second multiply-multiply engine are configured to multiply subsets of the first operand and the second operand in parallel.

[0116] Although various embodiments have been particularly shown and described, those skilled in the art will appreciate that various changes in form and detail may be made without departing from the spirit and scope of the appended claims. For example, although the present invention has been described with reference to specific encryption algorithms (e.g., AES, GCM, XTS) and data widths, those skilled in the art will appreciate that the disclosed invention is also applicable to other encryption algorithms and data widths.

[0117] The diagrams in the flow charts and block diagrams illustrate the architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flow chart or block diagram can represent a module, segment or partial instruction, which includes one or more executable instructions for implementing a specified (multiple) logical function. In some alternative implementations, the functions noted in the blocks may occur in an order different from the order shown in the figure. For example, two consecutively displayed blocks can actually be executed substantially simultaneously, or the blocks can sometimes be executed in reverse order, depending on the functions involved. It will also be noted that each block in the flow chart and / or block diagram and the combination of blocks in the flow chart and / or block diagram can be implemented by a special purpose hardware-based system that performs a specified function or action, or by a combination of special purpose hardware and computer instructions.

[0118] Further, although aspects have been described with reference to program code executed by a computer system, the program code directing the functions of the present invention, it should be understood that the present invention may alternatively be implemented as a program product, including a computer-readable storage device that stores program code that can be processed by a data processing system. The computer-readable storage device may include volatile or non-volatile memory, optical or magnetic disks, etc. However, as used herein, "storage device" is specifically defined to include only legal articles of manufacture, and excludes signal media itself, transient propagation signals themselves, and energy itself.

[0119] The program product may include data and / or instructions that, when executed on a data processing system or otherwise processed, generate a logical, structural, or functionally equivalent representation (including a simulation model) of a hardware component, circuit, device, or system. Such data and / or instructions may include hardware description language (HDL) design entities or other data structures that conform to lower-level HDL design languages ​​(such as Verilog and VHDL) and / or conform to and / or are compatible with higher-level design languages ​​(such as C or C++). In addition, the data and / or instructions may also be in a data format used to exchange integrated circuit layout data and / or symbolic data formats (e.g., information stored in GDSII (GDS2), GL1, OASIS, map files, or any other format suitable for storing such design data structures).

Claims

1. A processor, comprising: an instruction fetch unit that fetches instructions to be executed; an architectural register file including a plurality of registers for storing source and destination operands; as well as An execution unit for executing a Galois multiplication instruction, wherein the execution unit comprises: a carry-less multiplier configured to multiply operands of the Galois multiplication instruction to generate a product; as well as a modular reduction circuit configured to receive the product and determine a reduced product having fewer bits than the product based on a logical combination of the product and a fixed polynomial, wherein the execution unit is configured to store the reduced product to the architectural register file as a result of the Galois multiplication instruction. 2 . The processor according to claim 1 , wherein the fixed polynomial is g(x)=1+X+x^2+x^7+x^128.

3. A processor according to any one of claims 1 or 2, wherein: The product includes a high portion and a low portion, the high portion includes high-order bits of the product, and the low portion includes low-order bits of the product; The modular reduction circuit is configured to calculate a first result that is equivalent to a carry-less multiplication of the high portion and the fixed polynomial, wherein the modular reduction circuit comprises: a shift circuit that applies a plurality of different bit position shifts to the high portion of the product consistent with asserted bits in the fixed polynomial; as well as A bitwise exclusive OR (XOR) circuit logically combines multiple instances of the high portion of the product, the multiple instances having respective different bit position shifts applied by the shift circuit.

4. The processor of claim 3, wherein: The shift circuit is further configured to apply a plurality of different bit position shifts to the high portion of the first result consistent with asserted bits in the fixed polynomial; The bitwise exclusive OR (XOR) circuit is also configured to logically combine multiple instances of the high portion of the first result to obtain a second result, the multiple instances having respective different bit position shifts applied by the shift circuit, wherein the bitwise XOR circuit generates the reduced product based on the first result, the second result, and the low portion of the product.

5. The processor of claim 3, wherein the bitwise exclusive OR (XOR) circuit comprises at least two stages of bitwise XOR circuits.

6. The processor according to any one of claims 1 to 5, further comprising: Conditional bit reversal circuitry is configured to conditionally reverse the bit order of bytes of one of the operands based on an endian mode indicated by the Galois multiplication instruction prior to multiplication of the operands.

7. A processor according to any one of claims 1 to 6, wherein: The carry-less multiplier is a first multiply-multiply engine; The execution unit includes a second multiply-multiply engine, wherein the first multiply-multiply engine and the second multiply-multiply engine have a first data width; The operands include a first operand and a second operand having a second data width, the second data width being an integer multiple of the first data width; as well as The first multiply-multiply engine and the second multiply-multiply engine are configured to multiply subsets of the first operands and the second operands in parallel.

8. A data processing system comprising: A plurality of processors, comprising a processor according to any one of claims 1 to 7; Shared memory; as well as A system interconnect communicatively couples the shared memory and the plurality of processors.

9. A method for data processing in a processor, the method comprising: fetching, by an instruction fetch unit, instructions to be executed by the processor, wherein the instructions include Galois multiplication instructions; as well as Based on receiving the Galois multiplication instruction, an execution unit of the processor executes the Galois multiplication instruction, wherein the execution includes: multiplying the operand of the Galois multiplication instruction by a carry-less multiplier to generate a product; A modular reduction circuit receives the product and determines a reduced product having fewer bits than the product based on a logical combination of the product and a fixed polynomial; and The reduced product is stored in an architectural register file of the processor as a result of the Galois multiplication instruction.

10. The method according to claim 9, wherein the fixed polynomial is g(x)=1+X+x^2+x^7+x^128.

11. The method according to any one of claims 9 or 10, wherein: The product includes a high portion and a low portion, the high portion includes high-order bits of the product, and the low portion includes low-order bits of the product; Determining the reduced product includes computing a first result that is equivalent to a carry-less multiplication of the high portion and the fixed polynomial, wherein the computing includes: applying, by a shift circuit, to the high portion of the product a plurality of different bit position shifts consistent with asserted bits in the fixed polynomial; as well as Multiple instances of the high portion of the product are logically combined by a bitwise exclusive OR (XOR) circuit, the multiple instances having respective different bit position shifts applied by the shift circuit.

12. The method according to claim 11, further comprising: applying, by the shift circuit, a plurality of different bit position shifts to the high portion of the first result consistent with asserted bits in the fixed polynomial; as well as logically combining, by the bitwise exclusive OR (XOR) circuit, a plurality of instances of the high portion of the first result to obtain a second result, the plurality of instances having respective different bit position shifts applied by the shift circuit; Wherein determining the reduced product comprises determining the reduced product based on the first result, the second result, and the low portion of the product.

13. The method according to any one of claims 9 to 12, further comprising: Prior to multiplication of the operands, a bit order of bytes of one of the operands is conditionally reversed based on an endian mode indicated by the Galois multiplication instruction.

14. A method according to any one of claims 9 to 13, wherein: The carry-less multiplier is a first multiply-multiply engine; The execution unit includes a second multiply-multiply engine, wherein the first multiply-multiply engine and the second multiply-multiply engine have a first data width; The operands include a first operand and a second operand having a second data width, the second data width being an integer multiple of the first data width; as well as Multiplying the operands includes the first multiply-multiply engine and the second multiply-multiply engine multiplying a subset of the first operands and the second operands in parallel.

15. A design structure tangibly embodied in a machine-readable storage device for use in designing, manufacturing or testing an integrated circuit, the design structure comprising: Processor, including: an instruction fetch unit that fetches instructions to be executed; an architectural register file comprising a plurality of registers for storing source and destination operands; and An execution unit for executing a Galois multiplication instruction, wherein the execution unit comprises: a carry-less multiplier configured to multiply operands of the Galois multiplication instruction to generate a product; and a modular reduction circuit configured to receive the product and determine a reduced product having fewer bits than the product based on a logical combination of the product and a fixed polynomial, wherein the execution unit is configured to store the reduced product to the architectural register file as a result of the Galois multiplication instruction.

16. The design structure of claim 15, wherein the fixed polynomial is g(x)=1+X+x^2+x^7+x^128.

17. A design structure according to any one of claims 15 or 16, wherein: The product includes a high portion and a low portion, the high portion includes high-order bits of the product, and the low portion includes low-order bits of the product; The modular reduction circuit is configured to calculate a first result that is equivalent to a carry-less multiplication of the high portion and the fixed polynomial, wherein the modular reduction circuit comprises: a shift circuit that applies a plurality of different bit position shifts to the high portion of the product consistent with asserted bits in the fixed polynomial; as well as A bitwise exclusive OR (XOR) circuit logically combines multiple instances of the high portion of the product, the multiple instances having respective different bit position shifts applied by the shift circuit.

18. The design structure according to claim 17, wherein: The shift circuit is further configured to apply a plurality of different bit position shifts to the high portion of the first result consistent with asserted bits in the fixed polynomial; The bitwise exclusive OR (XOR) circuit is also configured to logically combine multiple instances of the high portion of the first result to obtain a second result, the multiple instances having respective different bit position shifts applied by the shift circuit, wherein the bitwise XOR circuit generates the reduced product based on the first result, the second result, and the low portion of the product.

19. The design structure according to any one of claims 15 to 18, further comprising: Conditional bit reversal circuitry is configured to conditionally reverse the bit order of bytes of one of the operands based on an endian mode indicated by the Galois multiplication instruction prior to multiplication of the operands.

20. A design structure according to any one of claims 15 to 19, wherein: The carry-less multiplier is a first multiply-multiply engine; The execution unit includes a second multiply-multiply engine, wherein the first multiply-multiply engine and the second multiply-multiply engine have a first data width; The operands include a first operand and a second operand having a second data width, the second data width being an integer multiple of the first data width; as well as The first multiply-multiply engine and the second multiply-multiply engine are configured to multiply subsets of the first operands and the second operands in parallel.

Images