Cycle modeling system for post-quantum cryptography dedicated hardware accelerators
By integrating a periodic modeling system into the gem5 simulation framework, the problems of slow accelerator design speed and inaccurate quantitative indicators in existing technologies are solved, enabling fast and accurate performance evaluation and optimization, and supporting the microarchitecture design of post-quantum cryptography accelerators.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HARBIN INST OF TECH
- Filing Date
- 2026-03-30
- Publication Date
- 2026-06-23
AI Technical Summary
Existing technologies cannot quickly evaluate the performance and functionality of post-quantum cryptography accelerators during the hardware design phase. RTL-level simulations are slow and quantitative metrics are inaccurate. Functional simulations lack timing information and cannot effectively optimize the architecture.
A cycle modeling system integrated into the gem5 architecture simulation framework is provided, including a top-level control unit, a pipelined processing unit, a dedicated execution unit, and a storage unit. It simulates instruction execution, memory access latency, and bandwidth contention, and supports the precise cycle execution of cryptographic primitives such as Montgomery modular reduction and NTT butterfly operation.
It enables rapid evaluation of the performance impact of different hardware implementation schemes without modifying the simulator code, improves simulation speed by 100 times, provides quantitative performance indicators to support architecture optimization, and achieves 100% simulation accuracy.
Smart Images
Figure CN122264150A_ABST
Abstract
Description
Technical Field
[0001] This application belongs to the field of computer architecture simulators, and in particular relates to a periodic modeling method for dedicated hardware accelerators for post-quantum cryptography (PQC). Background Technology
[0002] With the continuous advancement of quantum computing technology, classical public-key cryptosystems (such as RSA and ECDSA) based on mathematical problems such as large integer factorization and discrete logarithms face the threat of being efficiently broken by quantum computers. The proposal of Shor's algorithm shows that a sufficiently large quantum computer can solve the above difficult problems in polynomial time, thereby rendering the currently widely deployed public-key cryptographic infrastructure insecure.
[0003] To address this potential threat, the international cryptography community has proposed post-quantum cryptography schemes, aiming to design new cryptographic algorithms that can resist attacks from quantum computers. In 2016, the National Institute of Standards and Technology (NIST) launched the post-quantum cryptography standardization process. After multiple rounds of evaluation, the first batch of standards was officially released in 2024: FIPS 203 (ML-KEM, based on CRYSTALS-Kyber), FIPS 204 (ML-DSA, based on CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, based on SPHINCS+).
[0004] In the design process of domain-specific accelerators, precise performance evaluation, functional verification, and design space exploration of the microarchitecture design before actual hardware manufacturing are crucial steps. Existing methods mainly include:
[0005] RTL-level simulation, using register-transfer level descriptions written in Verilog / SystemVerilog, is performed periodically with precise simulation through simulators such as VCS and ModelSim. While RTL simulation offers high timing accuracy, it is extremely slow—for a typical PQC accelerator design, executing a complete Kyber key generation operation can take several minutes of simulation time. This makes large-scale architecture design space exploration, functional verification, and microarchitectural performance trade-offs highly inefficient. Before the RTL implementation is complete, designers need to quickly evaluate the performance impact of different architectural options (such as the number of functional units, memory hierarchy configuration, interconnect topology, pipeline depth, etc.), and RTL-level simulation cannot meet this iterative speed requirement.
[0006] Functional simulation, using behavioral models written in C / C++ or Python, is fast but completely lacks timing information. While functional simulation can verify algorithm correctness, it cannot reflect microarchitecture-level performance characteristics such as pipeline conflict pauses, memory access contention, functional unit utilization, and interconnect arbitration latency. Designers cannot obtain accurate quantitative performance metrics such as cycle count, throughput, and the percentage of various pauses based on functional simulation, thus hindering effective architecture optimization decisions. Summary of the Invention
[0007] This application aims to address the problems of existing accelerator simulation methods failing to meet iteration speed requirements and having inaccurate quantitative performance indicators. It provides a periodic modeling system for dedicated hardware accelerators for post-quantum cryptography.
[0008] This application provides a periodic modeling system for dedicated hardware accelerators in post-quantum cryptography. The periodic modeling system is integrated into the gem5 architecture simulation framework and includes:
[0009] The top-level control unit is used to register periodic callback events within the gem5 clock domain, driving the pipeline processing unit to perform each stage of operation with a single clock cycle as the time granularity.
[0010] The pipelined processing unit is used to sequentially perform instruction fetching, operand updating and conflict detection, and dispatch conflict-free instructions to different dedicated execution units;
[0011] A dedicated execution unit is used to determine the execution delay based on the dispatched instructions and return a completion signal to the pipeline processing unit after execution is completed;
[0012] Storage units are used to simulate storage access latency and bandwidth contention.
[0013] In one possible design, the pipeline processing unit includes a fetch subunit, an update subunit, and a scheduling subunit connected in sequence, with instructions and control signals being transmitted between two connected subunits through a forward time buffer and a reverse time buffer.
[0014] The instruction fetching subunit is used to parse the instruction word into a static instruction through a decoder, encapsulate it into a dynamic instruction instance carrying a sequence number, write it into the forward time buffer, and send it to the update subunit.
[0015] The update subunit is used to update all non-executable instructions and to lock, modify, and unlock operands of executable instructions.
[0016] The scheduling subunit is used to perform conflict detection on instructions and dispatch conflict-free instructions to different dedicated execution units.
[0017] In one possible design, the locking, modification, and unlocking transformation of operands of executable instructions includes:
[0018] When the instruction fetch subunit fetches an instruction marked with a lock bit, the instruction word marked with the lock bit is cached in the lock register;
[0019] When the update subunit receives an operand update instruction, it performs addition, subtraction, inverse subtraction, or replacement operations on a specified bit field of the instruction word in the locking register to modify the instruction.
[0020] When the update subunit receives the unlock command, it releases the modified command word and passes it to the scheduling subunit.
[0021] In one possible design, the conflict detection of instructions includes:
[0022] Barrier conflict detection is used to block the dispatch of all subsequent instructions when the sequence flag is set;
[0023] Configuration conflict detection is used to block the dispatch of all subsequent instructions when the current configuration instruction conflicts with an instruction being executed by the same dedicated execution unit.
[0024] Structural conflict detection is used to block the dispatch of new instructions in the same dedicated execution unit when the target unit resources are occupied or the target storage port is full.
[0025] Data conflict detection is used to detect dependency conflicts of three types of data: read-after-write, write-after-write, and write-after-read, based on overlapping address ranges.
[0026] In one possible design, the dedicated execution unit includes:
[0027] The arithmetic operation subunit, with a reconfigurable computing unit at its core, is used for number theory forward or inverse transformations, as well as polynomial operations.
[0028] Combinational logic subunits are used for data format conversion and bit manipulation;
[0029] The hash operation subunit is used to accelerate secure hash algorithms;
[0030] Mathematical operation subunit, used for lattice cryptography-specific mathematical operations;
[0031] The communication subunit is used for data transfer between storage rooms.
[0032] In one possible design, the reconfigurable computing unit parses multiple control parameters through two 128-bit configuration codes to achieve multi-mode configurable computing of Montgomery modular reduction and number theory transformation butterfly operations, wherein the execution delay of each operation mode is determined during the configuration phase.
[0033] In one possible design, the storage unit adopts a dual-port sequential memory model, which can independently process multiple read and write requests in each simulation cycle and generate a back pressure signal when the request exceeds the bandwidth limit.
[0034] The storage unit includes:
[0035] The on-chip note-taking memory includes multiple independent memory banks and supports single-bank, multi-bank interleaving, and number-theory transformation access modes.
[0036] An arithmetic buffer, comprising multiple storage banks of configurable capacity, is used to cache intermediate computation data;
[0037] Main memory, which includes multiple address spaces.
[0038] In one possible design, the cycle modeling system for a post-quantum cryptography dedicated hardware accelerator also includes interconnect units, which include read cross switches and write cross switches.
[0039] The interconnection unit connects the read / write ports of each dedicated execution unit to the corresponding ports of the storage unit, thereby enabling data interaction between different dedicated execution units and the storage unit.
[0040] In one possible design, the cycle modeling system for a dedicated hardware accelerator for post-quantum cryptography also includes a debug interface unit based on the GDB remote serial protocol, which supports breakpoint setting, single-step execution, register reading, memory reading, and continuation of execution operations.
[0041] In one possible design, the key timing parameters of the cycle modeling system are configurable through a configuration file, including memory access latency, interconnect network segment latency, dedicated execution unit task latency, and storage bandwidth limitations.
[0042] The periodic modeling system for dedicated hardware accelerators for post-quantum cryptography proposed in this application has the following technical advantages over existing technologies in terms of simulation accuracy, modeling completeness, and design space exploration efficiency:
[0043] Existing general-purpose architecture simulators (such as the O3CPU and MinorCPU built into gem5) have pipeline models, instruction set interfaces, and functional units designed for general-purpose processor architectures, and cannot be directly used for modeling PQC-specific accelerators. Addressing the core computational requirements of PQC algorithms, this application models an arithmetic operation cluster centered on reconfigurable computing units, supporting the precise execution timing of cryptographic primitives such as Montgomery modular reduction and NTT butterfly operations; it also models a SHA-3 / SHAKE hash cluster and a lattice cryptography-specific mathematical operation cluster, covering the core computational paths of mainstream PQC standard algorithms such as ML-KEM and ML-DSA. Modeling with a 128-bit wide instruction word format and approximately 60 configurable control parameters supports precise measurement of the configuration overhead of reconfigurable computing units. This dedicated modeling enables the simulation system to reflect the computational characteristics of PQC accelerators that distinguish them from general-purpose processors, providing an effective performance evaluation basis for the microarchitecture design of PQC accelerators.
[0044] Within the gem5 event-driven framework, the accelerator is modeled with a single clock cycle as the basic time granularity. This includes inter-stage propagation delays at each stage of the three-stage pipeline, pause cycles caused by various conflicts, task execution delays in the execution cluster, access delays and backpressure responses in the storage system, and front-end delays, forwarding delays, and response delays in the interconnect network. During simulation, all the above timing parameters are precisely measured in cycles. After simulation, quantitative performance indicators such as the total number of execution cycles, the number and percentage of various pause cycles, functional unit utilization, and the number of storage access contention cycles can be output. Compared with functional-level simulation, the PQC simulator can provide complete microarchitecture-level timing information, making up for the lack of timing data in functional simulation. Compared with RTL-level simulation, this application improves simulation speed by at least 100 times while maintaining cycle accuracy, enabling large-scale architectural design space exploration iterations.
[0045] All key timing parameters in the simulator are implemented in a configurable manner, including memory access latency, interconnect network segment latency, cluster task execution latency, and storage bandwidth limitations. This application enables the exploration of the impact of different hardware implementation schemes on overall performance by adjusting parameter configuration files without modifying the simulator code. This parameterized design allows the system to adapt to various PQC accelerator microarchitecture schemes under different design parameters, providing quantitative periodic performance reference data for architecture decisions before RTL implementation is completed. Attached Figure Description
[0046] Figure 1 A schematic diagram illustrating the stages of the instruction execution pipeline.
[0047] Figure 2This is an overall framework diagram of the periodic modeling system for a dedicated hardware accelerator for post-quantum cryptography, as described in the embodiment.
[0048] Figure 3 This is a schematic diagram of the timing sequence for reverse evaluation and reverse control signal processing at each stage of the pipeline.
[0049] Figure 4 A flowchart illustrating the dynamic instruction modification mechanism for the lock-modify-unlock phase during updates.
[0050] Figure 5 This is a flowchart for performing hierarchical conflict detection during the scheduling phase. Detailed Implementation
[0051] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of this application can be combined with each other.
[0052] Architecture-level simulators, such as gem5, provide processor models with approximate cycle life, supporting detailed microarchitecture modeling and performance evaluation. However, the processor models built into gem5 (such as O3CPU and MinorCPU) are designed for general-purpose processor architectures, and their pipeline structures, instruction set interfaces, memory hierarchy models, and performance statistics frameworks are not suitable for dedicated PQC accelerators. Extending gem5 into a cycle-accurate simulation platform for PQC accelerators requires addressing the following key issues:
[0053] The classic five-stage pipelined or out-of-order execution model of general-purpose processors differs fundamentally from the task-level parallel execution model of PQC accelerators. The instruction format and register model of general-purpose ISAs (such as x86, ARM, and RISC-V) cannot represent the wide instruction word and dedicated functional unit configurations of PQC accelerators. General-purpose cache hierarchy models are not suitable for the multi-bank on-chip note memory and dedicated arithmetic cache designs of PQC accelerators. There is a lack of modeling support for cryptographic primitives such as NTT butterfly operations, Montgomery modular reduction, and SHAKE hashing.
[0054] In view of this, the embodiments of this application provide a periodic modeling system for dedicated hardware accelerators for post-quantum cryptography, in order to solve the above-mentioned problems. The following will refer to the appendix... Figures 1 to 5 The implementation scheme of this application will be described in detail.
[0055] Specific Implementation Method 1: The periodic modeling system for post-quantum cryptography dedicated hardware accelerators described in this implementation method is integrated into the gem5 architecture simulation framework and includes:
[0056] The top-level control unit is used to register periodic callback events within the gem5 clock domain, driving the pipeline processing unit to perform each stage of operation with a single clock cycle as the time granularity.
[0057] The pipelined processing unit is used to sequentially perform instruction fetching, operand updating and conflict detection, and dispatch conflict-free instructions to different dedicated execution units;
[0058] A dedicated execution unit is used to determine the execution delay based on the dispatched instructions and return a completion signal to the pipeline processing unit after execution is completed;
[0059] Storage units are used to simulate storage access latency and bandwidth contention.
[0060] In one embodiment, the pipeline processing unit includes a fetch subunit, an update subunit, and a scheduling subunit connected in sequence, with instructions and control signals being transmitted between two connected subunits through a forward time buffer and a reverse time buffer.
[0061] The instruction fetching subunit is used to parse the instruction word into a static instruction through a decoder, encapsulate it into a dynamic instruction instance carrying a sequence number, write it into the forward time buffer, and send it to the update subunit.
[0062] The update subunit is used to update all non-executable instructions and to lock, modify, and unlock operands of executable instructions.
[0063] The scheduling subunit is used to perform conflict detection on instructions and dispatch conflict-free instructions to different dedicated execution units.
[0064] In one implementation, the locking, modification, and unlocking transformation of the operands of the executable instructions includes:
[0065] When the instruction fetch subunit fetches an instruction marked with a lock bit, the instruction word marked with the lock bit is cached in the lock register;
[0066] When the update subunit receives an operand update instruction, it performs addition, subtraction, inverse subtraction, or replacement operations on a specified bit field of the instruction word in the locking register to modify the instruction.
[0067] When the update subunit receives the unlock command, it releases the modified command word and passes it to the scheduling subunit.
[0068] In one implementation, the conflict detection of instructions includes:
[0069] Barrier conflict detection is used to block the dispatch of all subsequent instructions when the sequence flag is set;
[0070] Configuration conflict detection is used to block the dispatch of all subsequent instructions when the current configuration instruction conflicts with an instruction being executed by the same dedicated execution unit.
[0071] Structural conflict detection is used to block the dispatch of new instructions in the same dedicated execution unit when the target unit resources are occupied or the target storage port is full.
[0072] Data conflict detection is used to detect dependency conflicts of three types of data: read-after-write, write-after-write, and write-after-read, based on overlapping address ranges.
[0073] In one embodiment, the dedicated execution unit includes:
[0074] The arithmetic operation subunit, with a reconfigurable computing unit at its core, is used for number theory forward or inverse transformations, as well as polynomial operations.
[0075] Combinational logic subunits are used for data format conversion and bit manipulation;
[0076] The hash operation subunit is used to accelerate secure hash algorithms;
[0077] Mathematical operation subunit, used for lattice cryptography-specific mathematical operations;
[0078] The communication subunit is used for data transfer between storage rooms.
[0079] In one implementation, the reconfigurable computing unit parses multiple control parameters through two 128-bit configuration codes to achieve multi-mode configurable computing of Montgomery modular reduction and number theory transformation butterfly operations, wherein the execution delay of each operation mode is determined during the configuration phase.
[0080] In one embodiment, the storage unit adopts a dual-port sequential memory model, which can independently process multiple read and write requests in each simulation cycle and generate a back pressure signal when the request exceeds the bandwidth limit.
[0081] The storage unit includes:
[0082] The on-chip note-taking memory includes multiple independent memory banks and supports single-bank, multi-bank interleaving, and number-theory transformation access modes.
[0083] An arithmetic buffer, comprising multiple storage banks of configurable capacity, is used to cache intermediate computation data;
[0084] Main memory, which includes multiple address spaces.
[0085] In one embodiment, the periodic modeling system for post-quantum cryptography dedicated hardware accelerators further includes interconnection units, the interconnection units including read cross switches and write cross switches;
[0086] The interconnection unit connects the read / write ports of each dedicated execution unit to the corresponding ports of the storage unit, thereby enabling data interaction between different dedicated execution units and the storage unit.
[0087] In one embodiment, the periodic modeling system for post-quantum cryptography dedicated hardware accelerators further includes a debug interface unit, which is based on the GDB remote serial protocol and supports breakpoint setting, single-step execution, register reading, memory reading, and continuation of execution operations.
[0088] In one implementation, the key timing parameters of the periodic modeling system are configurable through a configuration file, including memory access latency, interconnect network segment latency, dedicated execution unit task latency, and storage bandwidth limitation.
[0089] To further illustrate the implementation scheme of this application, this embodiment provides a periodic modeling system for a post-quantum cryptography dedicated hardware accelerator integrated into the gem5 architecture simulation framework. This system employs an event-driven hybrid modeling method. Under the clock event scheduling mechanism of gem5, it uses a single cycle as the basic time granularity to perform precise timing modeling of the accelerator's control path, storage hierarchy, and interconnection network. The execution latency of operators is obtained through formula fitting. Finally, the simulator can output precise performance statistics for each cycle, including quantitative indicators such as the total number of execution cycles, the proportion of various pause cycles, functional unit utilization, and memory access contention. Each step is described in detail below:
[0090] The top-level controller, acting as the main body for periodic event scheduling, registers periodic callback events within the gem5 clock domain. Each clock cycle drives the pipeline stages sequentially and manages the lifecycle and state synchronization of all sub-components (pipeline stages, execution clusters). The execution process of each instruction is divided into multiple stages, including fetch, update, scheduling, execution, and commit, as shown in the appendix. Figure 1 As shown, instruction states are transferred between stages through a dynamic instruction object (PQCDynInst). The dynamic instruction object records the current stage of the instruction, operand information, and target resource. Each sub-component completes the state handover and timing tracking between stages by reading and writing the corresponding fields of the dynamic instruction object. The overall framework is attached. Figure 2 As shown.
[0091] The system implements three pipelined stages: Fetch, Updater, and Scheduler. Instructions and control signals are passed between adjacent stages via forward and reverse time buffers. The delay parameters of the time buffers correspond to the propagation delay of the inter-stage latches in the hardware, ensuring the timing accuracy of inter-stage communication. Each stage evaluates in reverse order within each clock cycle to correctly handle reverse control signals within the same cycle, as shown in the appendix. Figure 3 As shown.
[0092] The fetch phase requests a 128-bit instruction word from the instruction memory via a port. The read latency is determined by the instruction memory access latency parameter. The fetch phase pauses until the instruction memory responds, and this pause is counted in the pause cycle. The fetch phase decodes the instruction word into a static instruction object, encapsulates it into a dynamic instruction instance carrying a sequence number, and writes it to the forward latch. The fetch phase maintains a program counter (PC), incrementing by 16 bytes each time (corresponding to a 128-bit instruction width), and listens for a reverse branch notification signal from the update phase. Upon receiving a jump signal, the pipeline flushes at the corresponding time step, and the bubble cycles caused by the flushing are counted in the branch pause statistics.
[0093] The update phase is responsible for processing all non-executable instructions and performing lock-modify-unlock transformations on operands for executable instructions. Non-executable instructions include configuration instructions, jump instructions, register update instructions, and instructions that dynamically modify operands. (See attached...) Figure 4 As shown, this stage maintains a set of 32 general-purpose address / length register files, supporting arithmetic, logical, comparison, and shift operations, and supporting scalar, dual-channel, and quad-channel parallel operation modes. All register operations in the update stage are completed within a single cycle, without introducing additional pauses.
[0094] The update phase features a dynamic instruction modification mechanism that implements lock-modify-unlock. When an instruction marked with a lock bit is fetched during the instruction fetch phase, the update phase caches the 128-bit instruction word of that instruction in the lock register, temporarily withholding it from the scheduling phase; this cycle is recorded as the lock wait cycle. Subsequent operand update instructions (OPERAND_UPDATE) perform addition, subtraction, inverse subtraction, or replacement operations on specified bit fields of the instruction word in the lock register, with each update instruction consuming one cycle. When the unlock instruction arrives, the modified instruction word is released and delivered to the scheduling phase in the current cycle. This mechanism allows for dynamic calculation of instruction operands based on register values at runtime, avoiding the need to design independent instruction codes for each address mode and effectively compressing the instruction coding space.
[0095] During the scheduling phase, hierarchical conflict detection is performed on each instruction to be dispatched. All types of conflicts will cause the instruction to be blocked in the current cycle and will be included in the corresponding type of pause statistics. The process is as follows: Figure 5As shown. Barrier conflicts: When the sequence flag is set, all subsequent instruction dispatches are blocked; configuration conflicts: When a configuration instruction conflicts with an instruction currently being executed in the same cluster, dispatch is blocked; structural conflicts: When the target cluster resource is occupied or the target bank port is full, new instructions in the same cluster are blocked; data conflicts: Based on address range overlap detection, there are three types of data dependency conflicts: RAW (read-after-write), WAW (write-after-write), and WAR (write-after-read). Address range overlap detection supports three granularities: single-bank, double-bank expansion, and four-bank expansion to adapt to different storage access modes. During the scheduling phase, the scheduler maintains an execution entry table and a communication entry table, recording the start period and target resource information of all currently executing tasks. It supports sequential launch and out-of-order submission, and updates the entry status in each period to accurately reflect the resource release time.
[0096] The simulator comprises multiple execution clusters and one communication cluster. Upon receiving a task dispatched during the scheduling phase, each cluster determines its execution latency based on the task type and configuration parameters, returns a completion signal to the scheduling phase after the corresponding number of cycles, and releases resources. The arithmetic operation cluster, centered on reconfigurable computing units, supports NTT forward / inverse transformations and polynomial operations. These reconfigurable computing units parse approximately 60 control parameters using two 128-bit configuration codes, enabling configurable computations in multiple modes, including Montgomery modular reduction and NTT butterfly operations. The execution latency of each operation mode is determined during the configuration phase and accurately reflected in performance statistics during simulation. The combinational logic cluster supports data format conversion and bit manipulation. The hash cluster supports accelerated SHA-3 / SHAKE hash operations. The mathematical operation cluster supports lattice-based mathematical operations, including factorization and norm checking. The communication cluster supports inter-memory data transfer, including nine transfer modes such as Mem2Buf, Buf2Mem, and Buf2Buf. The number of execution cycles for each transfer operation is determined by the data volume and storage access bandwidth.
[0097] This embodiment models a complete accelerator memory hierarchy. The on-chip note memory contains eight independent banks, each with 128 rows × 64 bytes, totaling 64KB in capacity. It supports four access modes: single-bank, dual-bank interleaved, quad-bank interleaved, and NTT-specific. The arithmetic cache contains two banks with configurable capacity, used to cache intermediate computational data such as rotation factors. The main memory is divided into two address spaces, XMEM and EMEM, with automatic routing via the 13th bit of the address and a data width of 512 bits. A dual-port sequential memory model is implemented, providing two independent response ports and supporting configured bandwidth limits and backpressure handling. The dual-port sequential memory independently handles two read / write requests in each simulation cycle. When a request exceeds the bandwidth limit, a backpressure signal is generated. Access latency is precisely controlled by configuration parameters, realistically reflecting the timing characteristics of parallel memory access and the pause periods caused by bandwidth contention.
[0098] A read-write separated dual-crossbar interconnect network was implemented between the execution cluster and the multi-bank on-chip note memory. The read and write crossbars connect the read and write ports of all execution and communication clusters to the corresponding ports of each bank's memory, enabling many-to-many data routing. Address mappers are inserted between the crossbars and the dual-port memory of each bank, transparently translating logical bank addresses from the cluster into physical storage addresses. Each bank is connected to the crossbar via an independent address mapper, and the crossbar makes routing decisions based on the request address within the current cycle. The crossbar model supports configurable data bit width, front-end latency, forwarding latency, and response latency parameters. Each latency parameter is directly mapped to the corresponding simulation cycle number, ensuring that the timing behavior of the interconnect network remains consistent with the target architecture design. The read-write separation design allows read and write requests to concurrently pass through their respective crossbars within the same cycle, improving the cycle-level parallelism of storage access. The corresponding bandwidth improvement can be directly observed in simulation statistics.
[0099] To support dynamic debugging, a debugging interface based on the GDB Remote Serial Protocol (RSP) is implemented. The debugging interface supports the following standard GDB debugging operations: breakpoint setting (allowing setting execution breakpoints at specified instruction numbers; the simulation pauses and reports the current processor status when the corresponding instruction reaches the scheduling phase); single-step execution (advancing one simulation cycle at a time and refreshing the register and memory status views); register read (returning the contents of the general address / length register files within the current cycle); memory read (supporting reading data from specified areas of the on-chip note memory by address); and resume execution (resuming the simulation from the current pause position until the next breakpoint).
[0100] The simulator execution includes the following steps:
[0101] 1. Configure simulation system parameters according to the microarchitecture specifications of the target PQC accelerator, including clock frequency, memory access latency, latency of each execution cluster task, latency of each segment of the interconnect network, and storage bandwidth limit.
[0102] 2. Encode the instruction sequence of the target PQC algorithm into a 128-bit wide instruction word format and write it into the instruction memory as simulation input.
[0103] 3. Start gem5 simulation.
[0104] 4. After the simulation is completed, output quantitative performance indicators such as the total number of execution cycles, the number and percentage of various types of pause cycles, functional unit utilization, and the number of memory access contention cycles, to provide designers with microarchitecture optimization decisions.
[0105] Simulation experiments were conducted using the ML-KEM (CRYSTALS-Kyber) key encapsulation algorithm with the Kyber key generation algorithm as the target payload. The simulation system is configured as follows: clock frequency is 0.625MHz (cycle 1600ns); five execution clusters are ALU_CLUSTER, ARITH_CLUSTER, COMP_LOGIC_CLUSTER, HASH_CLUSTER, and MATH_CLUSTER; the communication cluster is COM_CLUSTER; the on-chip note memory is configured with 8 banks, each bank containing 128 rows × 64 bytes, totaling 64KB; memory access latency is 10ns (approximately one simulation cycle); memory bandwidth is 12.8GB / s; the read / write crossbar switch data width is 64 bytes each; front-end latency, forwarding latency, and response latency are all 0 cycles; instruction memory (ESRAM) capacity is 64KB, access latency is 4800ns (corresponding to 3 simulation cycles), bandwidth is 12.8GiB / s; main memory is divided into two address spaces, XMEM and EMEM, each 256KB, with access latency of 4800ns (3 simulation cycles); the arithmetic cache is configured with 2 banks, each bank containing 128 rows × 64 bytes, totaling 64KB; the memory access latency is 10ns (approximately one simulation cycle); the memory access latency is 4800ns (approximately one simulation cycle ... memory access latency is 4800ns (approximately one simulation cycle); the memory access latency is 4800ns (approximately one simulation cycle); the arithmetic cache is configured with 2 banks, each bank containing 128 rows × 64 bytes, totaling 64KB; the memory access latency is 128 rows × 64 bytes, totaling 64KB; the The system consists of 128 lines x 64 bytes, totaling 16KB. The fetch buffer queue depth is 5, the maximum number of incomplete fetch requests is 4, and the scheduler input buffer depth is 8. The operator execution latency for each execution cluster is specified in the `instruction_latencies.yaml` configuration file and loaded by the top-level controller at simulation startup. The pipeline stage latency configuration is as follows: fetch to update forward latency of 1 cycle, update to schedule forward latency of 1 cycle, update to fetch reverse latency of 1 cycle; update phase flush recovery latency of 3 cycles, and fetch phase branch flush latency of 2 cycles.
[0106] After the simulation, the simulation system output that the total number of simulation cycles required for the complete execution of the Kyber key generation algorithm was 1401 cycles. This result is completely consistent with the RTL-level simulation results based on the same microarchitecture parameters, and the cycle accuracy reaches 100%. Meanwhile, some microarchitecture-related information output by the simulator is shown in Table 1.
[0107] Table 1 shows some statistical information from the simulator output.
[0108]
[0109] While specific embodiments of this application have been described herein with reference to them, it should be understood that these embodiments are merely examples of the principles and applications of this application. Therefore, it should be understood that many modifications can be made to the exemplary embodiments, and other arrangements can be designed without departing from the spirit and scope of this application as defined by the appended claims. It should be understood that different dependent claims and features described herein can be combined in ways different from those described in the original claims. It is also understood that features described in conjunction with individual embodiments can be used in other described embodiments.
Claims
1. A periodic modeling system for dedicated hardware accelerators for post-quantum cryptography, characterized in that, The periodic modeling system is integrated into the gem5 architecture simulation framework, including: The top-level control unit is used to register periodic callback events within the gem5 clock domain, driving the pipeline processing unit to perform each stage of operation with a single clock cycle as the time granularity. The pipelined processing unit is used to sequentially perform instruction fetching, operand updating and conflict detection, and dispatch conflict-free instructions to different dedicated execution units; A dedicated execution unit is used to determine the execution delay based on the dispatched instructions and return a completion signal to the pipeline processing unit after execution is completed; Storage units are used to simulate storage access latency and bandwidth contention.
2. The periodic modeling system for post-quantum cryptography dedicated hardware accelerators according to claim 1, characterized in that, The pipeline processing unit includes a fetch subunit, an update subunit, and a scheduling subunit connected in sequence. The instructions and control signals are transmitted between two connected subunits through a forward time buffer and a reverse time buffer. The instruction fetching subunit is used to parse the instruction word into a static instruction through a decoder, encapsulate it into a dynamic instruction instance carrying a sequence number, write it into the forward time buffer, and send it to the update subunit. The update subunit is used to update all non-executable instructions and to lock, modify, and unlock operands of executable instructions. The scheduling subunit is used to perform conflict detection on instructions and dispatch conflict-free instructions to different dedicated execution units.
3. The periodic modeling system for post-quantum cryptography dedicated hardware accelerators according to claim 2, characterized in that, The locking, modification, and unlocking transformation of operands of executable instructions includes: When the instruction fetch subunit fetches an instruction marked with a lock bit, the instruction word marked with the lock bit is cached in the lock register; When the update subunit receives an operand update instruction, it performs addition, subtraction, inverse subtraction, or replacement operations on a specified bit field of the instruction word in the locking register to modify the instruction. When the update subunit receives the unlock command, it releases the modified command word and passes it to the scheduling subunit.
4. The periodic modeling system for post-quantum cryptography dedicated hardware accelerators according to claim 2, characterized in that, The conflict detection of instructions includes: Barrier conflict detection is used to block the dispatch of all subsequent instructions when the sequence flag is set; Configuration conflict detection is used to block the dispatch of all subsequent instructions when the current configuration instruction conflicts with an instruction being executed by the same dedicated execution unit. Structural conflict detection is used to block the dispatch of new instructions in the same dedicated execution unit when the target unit resources are occupied or the target storage port is full. Data conflict detection is used to detect dependency conflicts of three types of data: read-after-write, write-after-write, and write-after-read, based on overlapping address ranges.
5. The periodic modeling system for post-quantum cryptography dedicated hardware accelerators according to claim 1, characterized in that, The dedicated execution unit includes: The arithmetic operation subunit, with a reconfigurable computing unit at its core, is used for number theory forward or inverse transformations, as well as polynomial operations. Combinational logic subunits are used for data format conversion and bit manipulation; The hash operation subunit is used to accelerate secure hash algorithms; Mathematical operation subunit, used for lattice cryptography-specific mathematical operations; The communication subunit is used for data transfer between storage rooms.
6. The periodic modeling system for post-quantum cryptography dedicated hardware accelerators according to claim 5, characterized in that, The reconfigurable computing unit parses multiple control parameters through two 128-bit configuration codes to realize multi-mode configurable computing of Montgomery modular reduction and number theory transformation butterfly operations, wherein the execution delay of each operation mode is determined during the configuration phase.
7. The periodic modeling system for post-quantum cryptography dedicated hardware accelerators according to claim 1, characterized in that, The storage unit adopts a dual-port sequential memory model, which can independently process multiple read and write requests in each simulation cycle and generate a back pressure signal when the request exceeds the bandwidth limit. The storage unit includes: The on-chip note-taking memory includes multiple independent memory banks and supports single-bank, multi-bank interleaving, and number-theory transformation access modes. An arithmetic buffer, comprising multiple storage banks of configurable capacity, is used to cache intermediate computation data; Main memory, which includes multiple address spaces.
8. The periodic modeling system for post-quantum cryptography dedicated hardware accelerators according to claim 1, characterized in that, It also includes interconnection units, which include read crossbar switches and write crossbar switches; The interconnection unit connects the read / write ports of each dedicated execution unit to the corresponding ports of the storage unit, thereby enabling data interaction between different dedicated execution units and the storage unit.
9. The periodic modeling system for dedicated hardware accelerators for post-quantum cryptography according to claim 1 or 8, characterized in that, It also includes a debug interface unit, which is based on the GDB remote serial protocol and supports breakpoint setting, single-step execution, register reading, memory reading and continue execution operations.
10. The periodic modeling system for post-quantum cryptography dedicated hardware accelerators according to claim 1, characterized in that, The key timing parameters of the cycle modeling system are configurable through a configuration file. These key timing parameters include memory access latency, interconnect network segment latency, dedicated execution unit task latency, and storage bandwidth limitation.