Galois multiplication encryption method and processor

Abstract

A Galois multiplication encryption method and a processor are provided. The processor includes an instruction fetch unit for fetching instructions to be executed, an architected register file including multiple registers for storing source and destination operands, and an execution unit for executing Galois multiplication instructions. The execution unit includes a carry-less multiplier configured to multiply the operands of the Galois multiplication instruction to generate a product. The execution unit further includes a modular reduction circuit configured to receive the product and determine a reduced product having a fewer number of bits than the product based on a logical combination of the product and a fixed polynomial. The execution unit is configured to store the reduced product in the architected register file as a result of the Galois multiplication instruction. (FIG. 3)

Description

[Background technology]

[0001] The present invention relates generally to data processing and, more particularly, to Galois multiplication.

[0002] An important aspect of data security is the protection of data at rest (e.g., while stored on a data storage device) or in motion (e.g., during transmission) through encryption. Generally, encryption involves using a cryptographic function to transform unencrypted data (called plaintext) into encrypted data (called ciphertext) through a combination of plaintext and one or more encryption keys. To recover the plaintext from the ciphertext, the ciphertext is processed by a decryption function using one or more decryption keys. Thus, encryption provides data security by requiring a party to know an additional secret (i.e., a decryption key) before they can access the protected plaintext.

[0003] In many implementations, data encryption is performed using software running on a general-purpose processor. While implementing encryption in software offers the advantage of being able to select different encryption functions and easily adapt the selected encryption algorithm to use plaintext and encryption key lengths of various lengths, performing encryption in software has the attendant disadvantage of relatively poor performance. In the era of "big data," as the volume of data sets continues to increase dramatically, the performance achieved by software-implemented encryption can become unacceptable when encrypting large data sets. Therefore, it is desirable to support encryption in hardware and improve performance.

[0004] Another prior art solution that is particularly applicable to disk encryption is the implementation of a physical encryption engine connected to the memory hierarchy. Compared to hardware solutions in the processor core, a physical encryption engine coupled to the memory hierarchy can be expensive to implement. Furthermore, such solutions are typically not applicable to data in flight. Summary of the Invention

[0005] This disclosure recognizes that several commonly used encryption functions, such as AES (Advanced Encryption Standard)-GCM (Galois Counter Mode) and AES-XTS (XEX-based Adjusted Codebook Mode with Ciphertext Stealing), utilize Galois multiplication (i.e., carry-less multiplication and modular reduction) to logically combine encryption operands. For example, AES-GCM and AES-XTS both use Galois multiplication in a GF(2^128) field defined by the fixed polynomial g(x)=1+X+x^2+x^7+x^128 (uppercase X is the same as x or x^1, but lowercase x is written in uppercase because it may be confused with the multiplication operator x). In AES-GCM, Galois multiplication is used to generate a signature for an encrypted message that is used during decryption to detect whether the ciphertext or signature has been tampered with. In AES-XTS, Galois multiplication is used as part of the encryption and decryption of the message itself. This disclosure discloses various embodiments of circuits for implementing Galois multiplication in hardware and associated Galois multiplication instructions.

[0006] In one embodiment, a processor includes an instruction fetch unit that fetches instructions to be executed, an architected register file that includes multiple registers for storing source and destination operands, and an execution unit for executing a Galois multiply instruction. The execution unit includes a carry-less multiplier configured to multiply the operands of the Galois multiply instruction to generate a product. The execution unit further includes a modular reduction circuit configured to receive the product and determine a reduced product having a fewer number of bits than the product based on a logical combination of the product and a fixed polynomial. The execution unit is configured to store the reduced product in the architected register file as a result of the Galois multiply instruction.

[0007] In some embodiments, the processor may form part of a larger data processing system, or may be implemented as a design structure embodied in a machine-readable storage device.

[0008] According to one method of data processing, an instruction fetch unit of a processor fetches instructions to be executed by the processor, including a Galois multiplication instruction. Upon receiving the Galois multiplication instruction, an execution unit of the processor executes the Galois multiplication instruction. Executing the Galois multiplication instruction includes multiplying operands of the Galois multiplication instruction by a carry-less multiplier to generate a product. Executing the instruction further includes a modular reduction circuit that receives the product and determines a reduced product having a fewer number of bits than the product based on a logical combination of the product and a fixed polynomial. The processor then stores the reduced product in an architected register file of the processor as a result of the Galois multiplication instruction.

[0009] In at least one embodiment, the fixed polynomial is g(x)=1+X+x^2+x^7+x^128.

[0010] In at least one embodiment, the product of the carry-less multiplication includes an upper portion including the most significant bits of the product and a lower portion including the least significant bits of the product, and the modular reduction circuit is configured to calculate a first result that is equivalent to a carry-less multiplication of the upper portion and the fixed polynomial. The modular reduction circuit includes a shift circuit that applies a plurality of different bit position shifts to the upper portion of the product that correspond to asserted bits in the fixed polynomial, and a bitwise exclusive OR (XOR) circuit that logically combines multiple instances of the upper portion of the product with the different respective bit position shifts applied by the shift circuit.

[0011] In at least one embodiment, the shift circuit is further configured to apply a plurality of different bit position shifts to an upper portion of the first result that correspond to asserted bits in the fixed polynomial, and the bitwise exclusive OR (XOR) circuit is further configured to logically combine multiple instances of the upper portion of the first result with the different respective bit position shifts applied by the shift circuit to obtain a second result. The bitwise XOR circuit generates a reduced product based on the first result, the second result, and the lower portion of the product.

[0012] In at least one embodiment, the bitwise exclusive OR (XOR) circuit includes at least two stages of bitwise XOR circuits.

[0013] In at least one embodiment, the processor includes a conditional bit reversal circuit configured to conditionally reverse the bit order of bytes in one of the operands based on a mode indicated by the Galois multiplication instruction prior to multiplication of the operands.

[0014] In at least one embodiment, the carry-less multiplier is a first multiply-multiply engine, the execution unit includes a second multiply-multiply engine, both the first and second multiply-multiply engines have a first data width, and the operands include first and second operands having a second data width that is an integer multiple of the first data width, wherein the first and second multiply-multiply engines are configured to multiply subsets of the first and second operands in parallel. [Brief explanation of the drawings]

[0015] [Figure 1] 1 is a high-level block diagram of a data processing system including a processor according to one embodiment;

[0016] [Figure 2] FIG. 2 is a high-level block diagram of a processor core according to one embodiment.

[0017] [Figure 3] FIG. 2 is a high-level block diagram of an exemplary execution unit of a processor core in accordance with one embodiment.

[0018] [Figure 4] FIG. 2 is a more detailed block diagram of a cryptographic unit within a processor core, according to one embodiment.

[0019] [Figure 5] FIG. 1 is a time-distance diagram of the encryption and authentication process using AES-GCM (Advanced Encryption Standard - Galois Counter Mode).

[0020] [Figure 6] FIG. 1 is a block diagram of a modular reduction circuit for performing modular reduction in a Galois field, according to one embodiment.

[0021] [Figure 7] 1 illustrates optimization of carry-less multiplication, according to one embodiment.

[0022] [Figure 8] 7 illustrates the application of the carry-less multiplication technique of FIG. 7 and the circuit of FIG.

[0023] [Figure 9] FIG. 1 is a schematic diagram of an example multiplication array showing the locations of a first set of bits of a carry-less product that undergoes one stage of modular reduction and a second set of bits of a carry-less product that undergoes two stages of modular reduction.

[0024] [Figure 10] FIG. 2 is a high-level block diagram of a carry-less multiplication circuit, according to one embodiment.

[0025] [Figure 11] FIG. 11 is a more detailed block diagram of an exemplary embodiment of the conditional bit inversion circuit of FIG. 10.

[0026] [Figure 12]FIG. 11 is a more detailed block diagram of an exemplary embodiment of the modular reduction circuit of FIG.

[0027] [Figure 13] 1 depicts an exemplary Galois multiplication instruction, according to one embodiment.

[0028] [Figure 14] 1 illustrates a prior art single instruction multiple data (SIMD) carry-less multiplication circuit.

[0029] [Figure 15] 1 depicts an exemplary SIMD carry-less multiplier circuit that supports Galois multiplication, according to one embodiment.

[0030] [Figure 16] 1 is a high-level logic flowchart of an exemplary method of Galois multiplication, according to one embodiment.

[0031] [Figure 17] 1 is a depiction of an exemplary design process, according to one embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0032] 1, there is depicted a high-level block diagram of a data processing system 100 according to one embodiment. In some implementations, data processing system 100 may be, for example, a server computer system (such as one of the POWER series of servers available from International Business Machines Corporation), a mainframe computer system, a mobile computing device (such as a smartphone or tablet), a laptop or desktop personal computer system, or an embedded processor system.

[0033] As shown, data processing system 100 includes one or more processors 102 that process instructions and data. Each processor 102 may be implemented as a respective integrated circuit having a semiconductor substrate on which the integrated circuit is formed, as is known in the art. In at least some embodiments, processor 102 may generally implement any one of several commercially available processor architectures, such as POWER, ARM, Intel x86, NVidia, Apple silicon, etc. In the depicted example, each processor 102 includes one or more processor cores 104 and cache memory 106 that provides low-latency access to instructions and operands likely to be read and / or written by processor cores 104. Processors 102 are coupled for communication by a system interconnect 110, which, in various implementations, may include one or more buses, switches, bridges, and / or hybrid interconnects.

[0034] Data processing system 100 may additionally include several other components coupled to system interconnect 110. These components may include, for example, a memory controller 112 that controls access to system memory 114 by processor 102 and other components of data processing system 100. In addition, data processing system 100 may include an input / output (I / O) adapter 116 for coupling one or more I / O devices to system interconnect 110, a non-volatile storage system 118, and a network adapter 120 for coupling data processing system 100 to a communications network (e.g., a wired or wireless local area network and / or the Internet).

[0035] Additionally, those skilled in the art will appreciate that data processing system 100 shown in Figure 1 may include many additional, not-shown, components. Because such additional components are not necessary to an understanding of the described embodiments, they are not shown in Figure 1 or further described herein. However, it should also be understood that the enhancements described herein are applicable to data processing systems and processors of a variety of architectures and are in no way limited to the general-purpose data processing system architecture illustrated in Figure 1.

[0036] 2, a high-level block diagram of an exemplary processor core 200 is depicted, according to one embodiment. Processor core 200 may be utilized to implement any of processor cores 104 of FIG.

[0037] In the depicted example, processor core 200 includes an instruction fetch unit 202 for fetching instructions in one or more streams of instructions from storage 230 (which may include, for example, cache memory 106 and / or system memory 114 of FIG. 1 ). In a typical implementation, each instruction has a format defined by the instruction set architecture of processor core 200 and includes at least an operation code (opcode) field that specifies the operation to be performed by processor core 200 (e.g., fixed-point or floating-point arithmetic operation, vector operation, matrix operation, logical operation, branch operation, memory access operation, cryptographic operation, etc.). Particular instructions may additionally include one or more operand fields that directly specify operands or that implicitly or explicitly reference one or more registers that store source operands used in executing the instruction and one or more registers for storing destination operands produced by execution of the instruction. In some embodiments, an instruction decode unit 204 integrated with instruction fetch unit 202 decodes instructions retrieved from storage 230 by instruction fetch unit 202 and forwards branch instructions that control the flow of execution to branch processing unit 206. In some embodiments, the processing of branch instructions performed by branch processing unit 206 may include speculating on the outcome of conditional branch instructions. The outcome of branch processing by branch processing unit 206 (both speculative and non-speculative) may then be used to redirect one or more streams of instruction fetches by instruction fetch unit 202.

[0038] Instruction decode unit 204 forwards non-branch instructions (often referred to as "sequential instructions") to mapper circuit 210. Mapper circuit 210 is responsible for allocating physical registers in processor core 200's register file to instructions as necessary to support instruction execution. Mapper circuit 210 preferably implements register renaming. Thus, for at least some classes of instructions, mapper circuit 210 establishes a temporary mapping between the set of logical (or architected) registers referenced by the instruction and a larger set of physical registers in processor core 200's register file. As a result, processor core 200 may avoid unnecessary serialization of non-data-dependent instructions that might otherwise occur due to reuse of a limited set of architected registers by instructions that are closest in program order.

[0039] 2, processor core 200 further includes dispatch circuitry 216 that is configured to ensure that any data dependencies between instructions are observed and to dispatch sequential instructions when ready for execution. Instructions dispatched by dispatch circuitry 216 are temporarily buffered in issue queue 218 until an execution unit of processor core 200 has available resources to execute the dispatched instructions. Once appropriate execution resources become available, issue queue 218 opportunistically issues instructions from issue queue 218 to the execution units of processor core 200, possibly in an order different from the original program order of the instructions.

[0040] In the depicted example, processor core 200 includes multiple different types of execution units for executing respective different classes of instructions. In this example, the execution units include one or more fixed-point units 220 for executing instructions that access fixed-point operands, one or more floating-point units 222 for executing instructions that access floating-point operands, one or more load-store units 224 for loading data from and storing data to storage 230, and one or more vector-scalar units 226 for executing instructions that access vector and / or scalar operands. In an exemplary embodiment, each execution unit is implemented as a multi-stage pipeline in which multiple instructions are processed simultaneously at different stages of execution. Each execution unit preferably includes, or is coupled to have access to, at least one register file containing multiple physical registers for temporarily buffering operands accessed or generated by instruction execution.

[0041] Those skilled in the art will appreciate that processor core 200 may include additional, not-shown, components, such as logic configured to manage the completion and retirement of instructions whose execution by execution units 220-226 is completed. Because these additional components are not necessary to an understanding of the described embodiments, they are not shown in FIG. 2 and will not be described further herein.

[0042] Referring now to FIG. 3, a high-level block diagram of an exemplary execution unit of processor 102 is shown, according to one embodiment. In this example, vector-scalar unit 226 of processor core 200 is shown in more detail. In the embodiment of FIG. 3, vector-scalar unit 226 is configured to execute multiple different classes of instructions that operate on and produce different types of operands. For example, vector-scalar unit 226 is configured to execute a first class of instructions that operate on vector and scalar source operands and produce vector and scalar destination operands. Vector-scalar unit 226 executes instructions in this first class of instructions in functional units 302-312, which, in the depicted embodiment, include an arithmetic logic unit / rotate unit 302 for performing addition, subtraction, and rotate operations, a multiply unit 304 for performing binary multiplication, a divide unit 306 for performing binary division, a cipher unit 308 for performing cryptographic functions, a permutation unit 310 for performing operand permutations, and a binary-coded decimal (BCD) unit 312 for performing decimal-point mathematical operations. The vector and scalar source operands on which these operations are performed, and the vector and scalar destination operands produced by these operations, are buffered in physical registers of architected register file 300.

[0043] In this example, vector-scalar unit 226 is additionally configured to execute a second class of instructions that operate on matrix operands to produce matrix operands. Vector-scalar unit 226 executes instructions in this second class of instructions in matrix multiply-accumulate (MMA) unit 314. The matrix operands on which these operations are performed and the matrix operands produced by these operations are buffered and accumulated in physical registers in non-architected register file 316.

[0044] During operation, an instruction is received from issue queue 218 by vector-to-scalar unit 226. If the instruction is of a first class of instruction (e.g., a vector-to-scalar instruction), the associated source operand(s) for the instruction are accessed in architected register file 300 using the mapping between logical and physical registers established by mapper circuit 210 and then forwarded along with the instruction to the associated one of functional units 302-312 for execution. Destination operands produced by that execution are then stored back into physical registers in architected register file 300 as determined by the mapping established by mapper circuit 210. On the other hand, if the instruction is of a second class of instruction (e.g., an MMA instruction), the instruction is forwarded to MMA unit 314 for execution on operand(s) buffered in designated physical registers in non-architected register file 316. In this case, execution by MMA unit 314 involves performing a matrix multiplication operation, followed by accumulating (e.g., summing) the resulting product using the contents of one or more specified physical registers in non-architected register file 316.

[0045] Referring now to FIG. 4, a more detailed block diagram of an exemplary cryptographic unit 308 according to one embodiment is depicted. In this example, the cryptographic unit 308 includes circuitry for performing encryption and decryption in hardware according to the Advanced Encryption Standard (AES). AES is defined, for example, in International Organization for Standardization (ISO) / International Electrotechnical Commission (IEC) Standard 18033-3, Second Edition, December 15, 2010, which is incorporated herein by reference. As shown, the circuitry includes an AES encryption / decryption circuit 400 that combines an encryption key with plaintext to obtain ciphertext and a decryption key with the ciphertext to obtain the plaintext. The cryptographic unit 308 additionally includes an AES key generation circuit 402 that generates keys used by the AES encryption / decryption circuit 400 to encrypt and decrypt data. The cryptographic unit 308 also includes a carry-less multiplication circuit 404, as described in detail below. The carry-less multiplication circuit 404 may be used, for example, in AES-GCM (Galois Counter Multiplication) to generate signatures used to authenticate encrypted messages. The carry-less multiplication circuit 404 may also be utilized to perform Galois multiplication in the process of encrypting and decrypting messages, for example, in AES-XTS (XEX-based adjusted codebook mode with ciphertext stealing).

[0046] 5, there is shown a time-distance diagram of an encryption and authentication process 500 using AES-GCM (Advanced Encryption Standard - Galois Counter Mode). AES-GCM is used to encrypt n plaintext blocks 502 (each a 128-bit input string) to obtain n 128-bit ciphertext blocks 522 and a signature 532 that is used to verify that the n ciphertext blocks 522 have not been modified. As such, AES-GCM is useful for protecting data in motion.

[0047] In addition to plaintext 502, encryption process 500 begins with an initial value 504 (e.g., a random value expanded to 128 bits), an encryption key K 506 (assumed here to be a 128-bit value), authentication data 508 (assumed here to be a single 128-bit block), a 128-bit authentication key H 510, and a positive integer n determined by the number of 128-bit blocks in the plaintext (and ciphertext). Initial value 504 is a 128-bit value used to initialize the value of counter 0 512. The value of counter 0 512 is iteratively incremented n times by increment function 514 to generate a sequence of 128-bit counter values ​​identified in FIG. 5 as counter 1 512 through counter n 512. Each of these n+1 counter values ​​and encryption key K 506 is processed in one of n+1 instantiations of AES encryption function 516 to produce a respective one of n+1 128-bit encrypted outputs X0 to Xn 518.

[0048] 5, plaintext 1 502 is logically combined with encrypted output X1 518 by an exclusive OR (XOR) function 520 to produce ciphertext 1 522. Plaintext 2 502 is similarly logically combined with encrypted output X2 by an XOR function 520 to produce ciphertext 2. This process continues for n iterations until the final ciphertext n 522 is obtained.

[0049] The authentication data 508 and the authentication key H 510 form two inputs to a Galois counter multiplication (GCM) 0 function 524, which produces a 128-bit authentication value Y1 526. This authentication value Y1 526 is logically combined with the ciphertext 1 522 by an XOR function 528 to produce the input to the next GCM multiplication 1 function 524, which multiplies this input by the authentication key H 510. This process continues iteratively for n rounds of multiplication until the authentication value Yn+1 526 is obtained. The authentication value Yn+1 is logically combined by an XOR function 528 with a 128-bit length indicator 530 formed by the concatenation of the length of the authentication data 508 and the length of the ciphertext 522. The output of this XOR function 528 provides the first input to the GCM multiplication n+1 function 524, which multiplies this input by the authentication key H 510. The 128-bit product produced by the GCM multiply n+1 function 524 is then logically combined with the cipher output X0 518 by an XOR function 528 to obtain a signature 532 that is used to authenticate the n block ciphertext.

[0050] As noted above, due to performance concerns, it is desirable to provide direct support for encryption algorithms, such as the AES-GCM function depicted in FIG. 5, in processor hardware. One complication in implementing hardware support for encryption algorithms is the use of different bit and byte endianness among various processor hardware and various encryption algorithms. For example, Table I below summarizes the bit and byte endianness of three common encryption functions: AES, GCM, and XTS. As shown, based on AES, the first (left-most) bit in each byte is the most significant bit, and the first (left-most) byte in each data word is the most significant byte. This combination of bit and byte ordering may be referred to as big-big endian (BBE). GCM, on the other hand, specifies that the first bit of each byte and the first byte of each data word is the least significant. This endianness is referred to as little-little endian (LLE). XTS uses a third additional endian, called big-little endian (BLE), where the first bit of each byte is the most significant bit, but the first byte of a data word is the least significant byte. Table I [Table 1]

[0051] Typically, each physical processor natively implements one of these three endianness options, using commercially most common BBE and BLE hardware. Regardless of which native endianness is implemented by the hardware, some data reformatting to compensate for differences in endianness is required to provide hardware support for encryption algorithms with diverse endianness (e.g., AES, GCM, and XTS). Typically, that data reformatting can be implemented, for example, immediately before and after each GCM function 524, or as part of the GCM function 524 itself, when passing data from the AES counter encryption portion of process 500 (shown to the left of the dotted line) to the authentication portion of the process (shown to the right of the dotted line).

[0052] In cryptographic software libraries, encryption and authentication are often implemented as separate functions. In such software implementations, the encryption output X0518 and ciphertext1 through ciphertextn are passed through memory, and these data are automatically reformatted as part of memory read and write accesses. However, for hardware implementations of cryptographic functions, data reformatting must be applied to register file data to obtain acceptable performance. The following description details a processor embodiment with hardware support for native BBE endianness and Galois multiplication used in AES-GCM and AES-XTS. The processor accepts data in machine native endianness (e.g., BBE) and performs Galois multiplication on LLE or BLE format. From the following description, one skilled in the art will understand that the disclosed techniques can be applied to processors with native BLE endianness by implementing circuitry to invert (reverse) the order of bits within a byte for GCM encryption.

[0053] For example, the Galois multiplication as used in the GCM multiplication function 524 of FIG. 5 involves carryless multiplication followed by modular reduction. For example, in one embodiment, the carryless multiplication of two 128-bit input operands A and B generates a 255-bit product P. The modular reduction modulo polynomial g(x) reduces P to a 128-bit number through an iterative process.

[0054] For ease of understanding, reduction modulo a natural number G is first explained and then applied to the modular reduction modulo g(x) in the Galois field (GF)(2^128). In the following reduction, the variables G and J are first defined as follows. G = 2^128+(2^7 + 2^2 + 2^1 + 1)=2^128+J, where J = 2^7 + 2^2 + 2^1 + 1.

[0055] Considering these definitions of G and J, the first step of modular reduction is to divide any 255-bit number P into a 128-bit lower part PL and a 127-bit upper part PH, where PL < G. As a result of this division, the following relationship occurs. P = PH*2^128+PL In the second step of reduction, P is reduced to a number T having at most 135 bits according to the following set of relationships. P = PL + PH*(2^128+(J - J))=PL + PH*(G - J)==PL + PH*(-J)=T Here, "==" means equivalent modulo G (not equal). In the third step of reduction, as given below, T is again divided into a 7-bit upper part (TH) and a 128-bit lower part (TL). T = TL + TH*2^128 Finally, in the fourth step of reduction, T is reduced to T' in the same manner as in step 2, and a result smaller than G is obtained through the following relationship. T' = TL + TH*(-J)

[0056] With this understanding of the process of modular reduction in mind, reference is now made to FIG. 6, which is a block diagram of a modular reduction circuit 600 for performing modular reduction in a Galois field using a polynomial g(x), according to one embodiment.

[0057] In a Galois field, multiplication is a carry-less operation, and addition and subtraction are performed using bitwise XOR. Carry-less multiplication of two w-bit numbers produces a (2w-1)-bit product. So, for example, multiplication of two 128-bit numbers produces a product P having 255 bits. As described above, in the first step of reduction, product P is partitioned into a 128-bit lower portion PL 602 and a 127-bit upper portion PH 604. PH 604 forms the input of carry-less multiplier 606a, which multiplies PH 604 by the equivalent of (-J). For GF(2^128) with LLE format, this multiplier has R = "1110.0001". Carry-less multiplication of PH 604 and R 608 produces a 134-bit product T 610, which is partitioned into a 128-bit lower portion TL 610a and a 6-bit upper portion TH 610b. A second carry-less multiplier 606b multiplies TH 610b by R 608 to generate a 13-bit product T' 614. A bitwise XOR circuit 612 performs a left-justified bitwise exclusive OR of PL 602, TL 610a, and T' 614 to generate a fully reduced 128-bit product M 618. In various embodiments, carry-less multipliers 606a and 606b may be implemented with full-size 128x128-bit LLE multipliers, or with 127x8-bit and 6x8-bit multipliers, respectively. When applying different 8-bit values ​​of R, the modular reduction circuit 600 of FIG. 6 can also be used for other Galois fields (2^k) with f(x), provided that k is less than or equal to 128 and f(x) is of the form f(x)=x^k+a7*x^7 +a6*x^6...+a1*x^1+a0, where all a(i) are in the set {0,1,-1}.

[0058] 7, a further optimization of carry-less multiplication is illustrated, according to one embodiment. As shown, carry-less multiplication of 127-bit PH 604 by 8-bit constant R 608 results in eight partial products PP 700a-700h. However, because R 608 is a constant with only four ones (i.e., "1110.0001"), carry-less multiplication of PH 604 by R 608 may result in four partial products PP 700d-700g being multiplied by zero. As a result, a product may be obtained from the remaining partial products PP 700a-PP 700c and PP 700h utilizing a four-input bitwise XOR circuit 702 that performs the following exclusive-OR operation: PL*R=PL XOR(PL>>1)XOR(PL>>2)XOR(PL>>7), where ">>" indicates a right shift by the indicated number of bit positions. This optimization may reduce the hardware cost of implementing carry-less multiplier 606a of FIG. 6 by a factor of two or more.

[0059] Figure 8 depicts the application of the carry-less multiplication technique shown in Figure 7 to the modular reduction circuit 600 of Figure 6. In particular, Figure 8 shows that the multiplication of PH*R by carry-less multiplier 606a results in four reduced terms: PH 802, PH 804 shifted right by one bit position, PH 806 shifted right by two bit positions, and PH 808 shifted right by seven bit positions. The most significant bit of PH 806 and the most significant six bits of PH 808 are combined to form TH 610b, the high-order portion of the first reduced result. More precisely, TH(0) = PH(126) XOR PH(121), and TH(1:5)=PH(122:126).

[0060] The second reduced term T' = TH * R 614 can similarly be expanded into four terms: TH 610b, TH shifted one bit position to the right 812, TH shifted two bit positions to the right 814, and TH shifted seven bit positions to the right 816. These four reduced terms, the four reduced terms of the reduced result T 610, and PL 602 form a set of all reduced terms 818 that are logically combined by a bitwise XOR circuit 612 according to the value of each of the 128 bit positions to generate the complete reduced product M 618. Details of an embodiment of a modular reduction circuit that implements the carry-less multiplication technique given in FIG. 8 are described below with reference to FIG. 12.

[0061] 9, there is shown a schematic representation of an exemplary 128-bit by 128-bit multiplication array 900 illustrating the location of the upper and lower product bits associated with the carry-less multiplication technique of FIG. 8. As shown, the upper product bits 902 that form TH 610b and the lower product bits 904 that combine with TH 610b to form T' 614 are located at the end of the multiplication array 900, where the gate depth is shallowest. As a result, the calculation of the product bits 902 and their logical combination with the product bits 904 are not a limiting factor in the performance of the carry-less multiplication performed by the modular reduction circuit 600.

[0062] 10, a high-level block diagram of a carry-less multiplication circuit 404 is depicted, according to one embodiment. The carry-less multiplication circuit 404, which implements Galois multiplication, is connected to an architected register file 300 that supports both GCM and XTS and holds operand data in native BBE format. As described above, GCM and XTS interpret data in LLE and BLE formats, respectively.

[0063] In the depicted embodiment, carry-less multiplier circuit 404 includes two conditional bit inverters 1102a, 1102b at its input ports and an additional conditional bit inverter 1102c at its output port. Conditional bit inverters 1102a, 1102b are each coupled to receive one of two 128-bit operands A and B, respectively, from registers XA and XB in architected register file 300, and to conditionally reverse the order of bits within the bytes of operands A and B based on a mode input indicating, for example, whether carry-less multiplier circuit 404 is being utilized to perform a multiplication for GCM or XTS. Conditional bit inverters 1002a, 1002b output a 128-bit multiplicand 1004a and a 128-bit multiplier 1004b, respectively.

[0064] Carry-less multiplication circuit 404 includes carry-less multiplier 1006, which performs a 128-bit by 128-bit multiplication of multiplicand 1004a by multiplier 1004b, resulting in a 255-bit product P 1008. Product P 1008 is received by modular reduction circuit 1010 and reduced to a 128-bit reduced product M 618, an embodiment of which is shown in more detail in FIG. 12. This reduced product M 618 is then stored back into register XT of architected register file 300, after possible bit-order reversal by conditional bit reversal circuit 1002c.

[0065] In the illustrated embodiment, the data operands in architected register file 300 and carry-less multiplier 1006 implement the BBE data format. The LLE carry-less multiplication required by GCM can be performed in BBE format carry-less multiplier 1006 by simply performing a BBE format multiplication, followed by a left shift of product P 1008 by one bit position. Because product P 1008 flows directly into modular reduction circuit 1010, the one-bit shift to the left can be conveniently implemented by modular reduction circuit 1010.

[0066] For XTS, on the other hand, operands A and B are reformatted by conditional bit reverse circuits 1002a, 1002b to match the GCM's LLE data format. (As described above in Table I, GCM and LLE share the same byte order but have different bit orders.) Conditional bit reverse circuit 1002c similarly reverses the bit order of the reduced product M 1012 of the XTS multiplication before writing the reduced product M 1012 to register XT in architected register file 300.

[0067] 11, a more detailed block diagram of an exemplary embodiment of a conditional bit inversion circuit 1100 that may be utilized to implement any of the conditional bit inversion circuits 1002a-1002c of FIG. 10 is depicted. In this example, the conditional bit inversion circuit 1100 has a 128-bit (i.e., 16 byte) input 1102 that is coupled to one input of a two-input 128-bit multiplexer 1106. Each of the 16 bytes of the 128-bit input 1102 is additionally coupled to a respective one of 16 bit inversion circuits 1104, implemented, for example, using wires that reverse the order of the bits in the associated byte of input 1102. The outputs of all of the bit inversion circuits 1104 together form a second 128-bit input of the multiplexer 1106.

[0068] Multiplexer 1106 selects between the data present at its two inputs based on a mode input indicating whether big or little endian bit ordering is applied. The mode input may be determined, for example, by a corresponding field of a Galois multiplication instruction, as described in more detail below with reference to Figure 13. The data selected by multiplexer 1106 is present on a 128-bit output 1108.

[0069] Referring now to Figure 12, there is shown a more detailed block diagram of an exemplary embodiment of the modular reduction circuit 1010 of Figure 10. This exemplary circuit compactly implements the two-stage reduction described with respect to Figure 6, utilizing the optimizations described with reference to Figure 8.

[0070] The modular reduction circuit 1010 receives as input the 255-bit product P 1008 produced by the carry-less multiplier 1006, as shown in Figure 10. As described above with reference to Figure 6, the product P 1008 includes a 128-bit lower PL 602 and a 127-bit upper PH 604. Following preliminary bit shifting and padding, the modular reduction circuit 1010 reduces the product P 1008 to a reduced product M 618 using four bitwise XOR circuits 1200, 1202, 1204, and 612 operating on left-justified inputs.

[0071] 8, namely, PL602, PH802 (PH604 padded with a trailing zero at bit position 127 by padding circuit 1210), and PH804 (PH604 shifted one bit position to the right by shift circuit 1212). A bitwise exclusive OR of these three inputs generates the first 128-bit input of bitwise XOR circuit 612.

[0072] Bitwise XOR circuit 1202 similarly logically combines the fourth and fifth reduced terms 818, namely, PH 806 (PH 604 shifted two bit positions to the right by shift circuit 1214) and PH 808 (PH 604 shifted seven bit positions to the right by shift circuit 1216). The exclusive OR of these two inputs produces a 134-bit result. Bits 0:127 of this XOR result form TL 610a, the second 128-bit input of bitwise XOR circuit 612. Bits 128:133 of the XOR result produced by bitwise XOR circuit 1202 form TH 610b, which is passed to bitwise XOR circuit 1204 and shift circuits 1216, 1218, and 1220.

[0073] Bitwise XOR circuit 1204 logically combines sixth through ninth reduced terms 818 to form second reduced result T' 614. That is, bitwise XOR 1204 logically combines TH 610b, TH 810 (TH 610b shifted one bit position to the right by shift circuit 1216), TH 812 (TH 610b shifted one bit position to the right by shift circuit 1218), and TH 814 (TH 610b shifted one bit position to the right by shift circuit 1220). The bitwise exclusive OR of these four inputs, which is the 13-bit second reduced result 614', forms the third input of bitwise XOR circuit 612. Bitwise XOR circuit 612 performs a left-justified bitwise exclusive OR on its three inputs to generate reduced product M 618.

[0074] 13, an exemplary Galois multiplication instruction 1300 is shown, according to one embodiment. In a preferred embodiment, a single Galois multiplication instruction 1300 is executed in the cryptographic unit 308 of the vector-to-scalar unit 226 to cause the carry-less multiplication circuit 404 of FIG. 10 to perform a carry-less multiplication with modular reduction on the polynomial g(x), as described with reference to FIG. 12.

[0075] In this example, Galois multiplication instruction 1300 includes an opcode field 1302 that specifies an architecture-specific opcode indicating a Galois Carry-Less multiplication with modular reduction. Galois multiplication instruction 1300 additionally includes an operand field 1304, which directly or indirectly indicates one or more registers XA, XB, XT of architected register file 300 that are utilized to store source and destination operands for the Galois Carry-Less multiplication and modular reduction operation. Finally, Galois multiplication instruction 1300 includes a mode field 1306 that specifies a data format (e.g., BLE / XTS or LLE / GCM) that is applicable to the Galois Carry-Less multiplication and modular reduction operation. As described above, the setting of mode field 1306 can be utilized by conditional bit reverse circuit 1100 to select whether to apply bit order reversal to the bytes of an input data word.

[0076] In the preceding discussion, aspects of the disclosed invention have been described with reference to a carry-less multiplication circuit 404 having a wide (e.g., 128-bit by 128-bit in current technology) carry-less multiplier 1006. However, some commercial processors may not include a wide carry-less multiplier, but rather multiple narrower carry-less multipliers that operate on smaller data elements in parallel. For example, FIG. 14 shows a prior art single instruction multiple data (SIMD) multiply-multiply engine 1400 that includes two 64-bit carry-less multipliers 1406, 1408 that operate in tandem on 128-bit SIMD operands A 1402 and B 1404. In this example, a SIMD multiply-multiply instruction causes carry-less multiplier 1406 to multiply the 64-bit upper parts of SIMD operands 1402, 1404 to produce a 128-bit upper part of the product PH 1414, carry-less multiplier 1408 to multiply the 64-bit lower parts of SIMD operands 1402, 1404 to produce a 128-bit lower part of the product PL 1416, and bitwise XOR circuit 1410 to perform a 128-bit bitwise exclusive OR of PH 1414 and PL 1416 to produce product Q 1412. Of course, this conventional SIMD architecture can be expanded to add additional lanes to support larger data widths (e.g., 256-bit operands).

[0077] According to one or more embodiments, the conventional SIMD architecture given in Figure 14 may also be extended to support Galois multiplication as described above. For example, Figure 15 depicts an exemplary SIMD carry-less multiplier circuit 1500 that supports Galois multiplication as described herein.

[0078] SIMD carry-less multiplier circuit 1500 includes conditional bit reverse circuits 1506 and 1508 that conditionally reverse the order of bits in each byte of SIMD operands A 1502 and B 1504, respectively. Each of conditional bit reverse circuits 1506 and 1508 may be implemented using conditional bit reverse circuit 1100 as described above with reference to FIG.

[0079] The SIMD carry-less multiplier circuit 1500 additionally includes two 128-bit SIMD multiply-multiply engines 1512, 1514, each of which may be implemented using, for example, the prior art multiply-multiply engine 1400 of FIG. 14. The multiply-multiply engine 1512 multiplies the operands 1502, 1504 (i.e., AH, AL, and BH, BL) to generate a 255-bit product P1 including a 127-bit upper part P1H and a 128-bit lower part P1L. The exclusive OR of P1H and P1L is the result Q1. To compensate for the difference in data formats between BBE and LLE, bit 0 is dropped from P1H and a 1-bit left shift is achieved. Multiply-multiply engine 1514 has a first input coupled to receive SIMD operand A 1502 (i.e., AH, AL) and a second input coupled to receive the output of swap doubleword circuit 1510, which swaps the upper and lower 64-bit doublewords of SIMD operand B 1504 (i.e., BL, BH). Multiply-multiply engine 1514 multiplies and combines these two inputs in a carry-less manner to produce a 128-bit result Q2 (Q2 corresponds to AL*BH+AH*BL, i.e., the 128b result of a 64-bit multiply-multiply operation with an inverted B operand).

[0080] SIMD carry-less multiplication circuit 1500 additionally includes a reduction circuit 1516 that reduces to 128 bits a 255-bit product P derived from result Q2 and partial products P1L, P1H, and a multiplexer 1518 that selects between the 128-bit result Q1 and the 128-bit output of reduction circuit 1516 as result 1520 of SIMD carry-less multiplication circuit 1500. As further shown in FIG. 15 , reduction circuit 1516 logically combines products P1H, P1L, and Q2 using a left-justified 255-bit bitwise XOR circuit 1534 that takes three inputs: the 127-bit P1H, a 255-bit value obtained by applying a 127-bit right shift to P1L using shift circuit 1530, and a 191-bit value obtained by applying a 63-bit right shift to Q2 using shift circuit 1532. These three left-justified inputs are logically combined by bitwise XOR circuit 1534 to generate a 255-bit carry-less product P. This 255-bit carry-less product P is reduced to a 128-bit reduced product M by modular reduction circuit 1510, as previously described with reference to FIG. 10. The bit order within each byte of reduced product M is conditionally reversed by conditional bit reverse circuit 1536 to generate a 128-bit output that forms a second input of multiplexer 1518. Multiplexer 1518 selects result Q1 as result 1520 when SIMD carry-less multiplier circuit 1500 is utilized to execute a SIMD multiply instruction, and selects the output of reduction circuit 1516 as result 1520 when SIMD carry-less multiplier circuit 1500 is utilized to execute a Galois multiply instruction.

[0081] Those skilled in the art will appreciate that the SIMD carry-less multiplication circuit 1500 utilizes optimizations (and may utilize additional optimizations) to reduce circuit size. For example, the SIMD carry-less multiplication circuit 1500 may utilize the Karatsuba algorithm to reduce the calculation of AH*BL+AL*BH to (AH+AL)*(BH+BL)+PH+PL. This simplification may be performed using one 64-bit carry-less multiplier, two 64-bit bitwise XOR circuits operating on operands A and B, and a 3-way 128-bit XOR for the three product terms. Further optimizations may be performed by combining the conditional bit inversion circuits 1506, 1508 and the swap doubleword circuit 1510, and by combining the conditional bit inversion circuit 1536 with the multiplexer 1518. In general, when the Karatsuba algorithm is implemented for 128-bit SIMD, the carry-less multiplier circuit 404 of FIG. 10 can be implemented in less than 1.5 times the area of ​​the multiplication-multiplication engine 1400 of FIG. 14, and the SIMD carry-less multiplication circuit 1500 of FIG. 15 can be implemented in less than twice the area of ​​the multiplication-multiplication engine 1400. When a 64-bit multiplication-multiplication engine is utilized in 256-bit or higher SIMD, 128-bit Galois multiplication can be implemented with even lower hardware overhead. Two 128-bit multiplication-multiplication engines in such a 256-bit SIMD engine can be combined along the lines of FIG. 15 to perform 128-bit Galois multiplication for upper or lower 128-bit SIMD elements. The only overhead is operand multiplexing and conditional bit reversal for the Galois multiplication and reduction circuit 1516.

[0082] 16, a high-level logic flowchart of an exemplary method of Galois multiplication according to one embodiment is depicted. For ease of understanding, the process of FIG. 16 will be described with reference to the embodiment of the carry-less multiplication circuit 404 provided in FIG.

[0083] The illustrated process begins at block 1600 and then proceeds to block 1602, which shows vector-to-scalar unit 226 of processor core 200 receiving an instruction requesting a Galois multiplication, such as Galois multiplication instruction 1300 of FIG. 13. In response to receiving the instruction, vector-to-scalar unit 226 reads operands A and B from architected register file 300 and passes operands A and B to input ports of carry-less multiplication circuit 404 (block 1604). In block 1606, vector-to-scalar unit 226 determines whether the instruction specifies XTS mode (e.g., in mode field 1306), which requests BLE data format rather than LLE data format. In response to a positive determination at block 1606, the vector-to-scalar unit 226 utilizes the conditional bit reversal circuits 1002a, 1002b of the carry-less multiplication circuit 404 to reverse the order of the bits in each byte of operands A and B (block 1608).

[0084] Following block 1608, or in response to a negative determination at block 1606, the vector-to-scalar unit 226 performs a carry-less multiplication of operands A and B using the carry-less multiplier 1006 to obtain a 255-bit product P 1008 (block 1610). The multiplication uses the BBE data format. At block 1612, the vector-to-scalar unit 226 reduces the product P according to the polynomial g(x) to obtain a reduced product M 618 through two or more bitwise XOR stages, as shown in FIG. 12. As shown in blocks 1614-1616, if the instruction specifies an XTS mode that requires the BLE data format rather than the LLE data format, the vector-to-scalar unit 226 again reverses the bit order in each byte of the reduced product M 618 using the conditional bit reversal circuit 1002c. Following block 1616, or if the instruction does not specify XTS mode, vector-to-scalar unit 226 writes the reduced product M back to register file 300 (block 1618). Following block 1618, the process of FIG. 16 ends at block 1620.

[0085] 17, a block diagram of an exemplary design flow 1700 used, for example, in semiconductor IC logic design, simulation, testing, layout, and manufacturing is shown. Design flow 1700 includes processes, machines, and / or mechanisms for processing design structures or devices to generate logically or otherwise functionally equivalent representations of the design structures and / or devices described above and shown herein. The design structures processed and / or generated by design flow 1700 include data and / or instructions that, when encoded on a machine-readable transmission or storage medium and executed or otherwise processed on a data processing system, generate logically, structurally, mechanically, or otherwise functionally equivalent representations of hardware components, circuits, devices, or systems. Machines include, but are not limited to, any machine used in an IC design process, such as designing, manufacturing, or simulating a circuit, component, device, or system. For example, the machine may include a lithography machine, a machine and / or equipment for generating a mask (e.g., an electron beam writer), a computer or equipment for simulating a design structure, any apparatus used in a manufacturing or testing process, or any machine for programming a functionally equivalent representation of a design structure into any medium (e.g., a machine for programming a programmable gate array).

[0086] Design flow 1700 may vary depending on the type of representation being designed. For example, a design flow 1700 for building an application-specific integrated circuit (ASIC) may differ from a design flow 1700 for designing a standard component, or from a design flow 1700 for instantiating a design into a programmable array, such as a programmable gate array (PGA) or field programmable gate array (FPGA) offered by Altera® Inc. or Xilinx® Inc.

[0087] FIG. 17 illustrates multiple such design structures, including input design structure 1020, preferably processed by design process 1710. Design structure 1720 may be a logic simulation design structure generated and processed by design process 1710 to generate a logically equivalent functional representation of a hardware device. Design structure 1720 may also, or alternatively, include data and / or program instructions that, when processed by design process 1710, generate a functional representation of the physical structure of a hardware device. Whether representing functional and / or structural design features, design structure 1720 may be generated using electronic computer-aided design (ECAD), such as implemented by a core developer / designer. When encoded on a machine-readable data transmission, gate array, or storage medium, design structure 1720 may be accessed and processed by one or more hardware and / or software modules in design process 1710 to simulate or otherwise functionally represent an electronic component, circuit, electronic or logic module, apparatus, device, or system, such as those described herein. Thus, design structures 1720 may include files or other data structures containing human- and / or machine-readable source code, compiled structures, and computer-executable code structures that, when processed by a design or simulation data processing system, functionally simulate or otherwise represent a circuit or other level hardware logic design. Such data structures may include hardware description language (HDL) design entities or other data structures that conform to and / or are compatible with low-level HDL design languages, such as Verilog and VHDL, and / or high-level design languages, such as C or C++.

[0088] Design process 1710 preferably utilizes and incorporates hardware and / or software modules for synthesizing, transforming, or otherwise manipulating design / simulation functional equivalents of components, circuits, devices, or logic structures shown herein to generate netlist 1780, which may include design structures such as design structure 1720. Netlist 1780 may include, for example, compiled or otherwise manipulated data structures representing a list of wires, discrete components, logic gates, control circuits, I / O devices, models, etc., describing connections with other elements and circuits in an integrated circuit design. Netlist 1780 may be synthesized using an iterative process in which netlist 1780 is resynthesized one or more times depending on design specifications and parameters for the device. As with the other design structure types described herein, netlist 1780 may be recorded on a machine-readable storage medium or programmed into a programmable gate array. The medium may be a non-volatile storage medium such as a magnetic or optical disk drive, a programmable gate array, a CompactFlash, or other flash memory. Additionally or alternatively, the medium may be system or cache memory, or buffer space.

[0089] Design process 1710 may include hardware and software modules for processing various input data structure types, including netlist 1780. Such data structure types may, for example, exist in library elements 1730 and may include sets of commonly used elements, circuits, and devices, including models, layouts, and symbolic representations, for a given manufacturing technology (e.g., different technology nodes, 32 nm, 45 nm, 170 nm, etc.). Data structure types may further include design specifications 1740, characterization data 1750, verification data 1760, design rules 1790, and test data files 1785, which may include input test patterns, output test results, and other test information. Design process 1710 may also include standard mechanical design processes, such as stress analysis, thermal analysis, mechanical event simulation, process simulation of operations such as casting, molding, and die pressing, etc. Those skilled in the art of mechanical design will understand the range of possible mechanical design tools and applications that may be used in design process 1710 without departing from the scope and spirit of the invention. Design process 1710 may also include modules for performing standard circuit design processes such as timing analysis, verification, design rule checking, place and route operations, etc.

[0090] Design process 1710 utilizes and incorporates logical and physical design tools, such as HDL compilers and simulation model build tools, to process design structure 1720, along with some or all of the depicted supporting data structures, along with any additional mechanical design or data (if applicable), to generate second design structure 1790. Design structure 1790 resides on a storage medium or programmable gate array in a data format used for the exchange of mechanical device and structure data (e.g., information stored in IGES, DXF, Parasolid XT, JT, DRG, or any other suitable format for storing or rendering such mechanical design structures). Like design structure 1720, design structure 1790 preferably resides on a transmission or data and storage medium and includes one or more files, data structures, or other computer-encoded data or instructions that, when processed by an ECAD system, generate a logically or otherwise functionally equivalent form of one or more of the embodiments of the invention described herein. In one embodiment, design structure 1790 may include a compiled executable HDL simulation model that functionally simulates the devices described herein.

[0091] Design structure 1790 may also utilize data formats used for the exchange of integrated circuit layout data and / or symbolic data formats (e.g., GDSII (GDS2), GL1, OASIS, information stored in map files, or any other suitable format for storing such design data structures). Design structure 1790 may include information such as, for example, symbolic data, map files, test data files, design content files, manufacturing data, layout parameters, wire, metal levels, vias, shapes, data for manufacturing line routing, and any other data required by a manufacturer or other designer / developer to produce a device or structure as described above and shown herein. Design structure 1790 may then proceed to stage 1795, where, for example, design structure 1790 may proceed to tapeout, be released to manufacturing, be released to a mask house, be sent to another design house, be returned to a customer, etc.

[0092] As described, in at least one embodiment, a processor includes an instruction fetch unit that fetches instructions to be executed, an architected register file that includes multiple registers for storing source and destination operands, and an execution unit for executing a Galois multiply instruction. The execution unit includes a carry-less multiplier configured to multiply operands of the Galois multiply instruction to generate a product. The execution unit further includes a modular reduction circuit configured to receive the product and determine a reduced product having a fewer number of bits than the product based on a logical combination of the product and a fixed polynomial. The execution unit is configured to store the reduced product in the architected register file as a result of the Galois multiply instruction.

[0093] In some embodiments, the processor may form part of a larger data processing system, or may be implemented as a design structure embodied in a machine-readable storage device.

[0094] According to one method of data processing, an instruction fetch unit of a processor fetches instructions to be executed by the processor, including a Galois multiplication instruction. Upon receiving the Galois multiplication instruction, an execution unit of the processor executes the Galois multiplication instruction. Executing the Galois multiplication instruction includes multiplying operands of the Galois multiplication instruction by a carry-less multiplier to generate a product. Executing the instruction further includes a modular reduction circuit that receives the product and determines a reduced product having a fewer number of bits than the product based on a logical combination of the product and a fixed polynomial. The processor then stores the reduced product in an architected register file of the processor as a result of the Galois multiplication instruction.

[0095] In at least one embodiment, the fixed polynomial is g(x)=1+X+x^2+x^7+x^128.

[0096] In at least one embodiment, the product of the carry-less multiplication includes an upper portion including the most significant bits of the product and a lower portion including the least significant bits of the product, and the modular reduction circuit is configured to calculate a first result that is equivalent to a carry-less multiplication of the upper portion and the fixed polynomial. The modular reduction circuit includes a shift circuit that applies a plurality of different bit position shifts to the upper portion of the product that correspond to asserted bits in the fixed polynomial, and a bitwise exclusive OR (XOR) circuit that logically combines multiple instances of the upper portion of the product with the different respective bit position shifts applied by the shift circuit.

[0097] In at least one embodiment, the shift circuit is further configured to apply a plurality of different bit position shifts to an upper portion of the first result that correspond to asserted bits in the fixed polynomial, and the bitwise exclusive OR (XOR) circuit is further configured to logically combine multiple instances of the upper portion of the first result with the different respective bit position shifts applied by the shift circuit to obtain a second result. The bitwise XOR circuit generates a reduced product based on the first result, the second result, and the lower portion of the product.

[0098] In at least one embodiment, the bitwise exclusive OR (XOR) circuit includes at least two stages of bitwise XOR circuits.

[0099] In at least one embodiment, the processor includes a conditional bit reversal circuit configured to conditionally reverse the bit order of bytes in one of the operands based on a mode indicated by the Galois multiplication instruction prior to multiplication of the operands.

[0100] In at least one embodiment, the carry-less multiplier is a first multiply-multiply engine, the execution unit includes a second multiply-multiply engine, both the first and second carry-less multiply-multiply engines have a first data width, and the operands include first and second operands having a second data width that is an integer multiple of the first data width, wherein the first and second multiply-multiply engines are configured to multiply subsets of the first and second operands in parallel.

[0101] While various embodiments have been specifically shown and described, those skilled in the art will recognize that various changes in form and detail can be made therein without departing from the spirit and scope of the appended claims, and that all of these alternative implementations are within the scope of the appended claims. For example, while the invention has been described with reference to particular encryption algorithms (e.g., AES, GCM, XTS) and data widths, those skilled in the art will recognize that the disclosed invention is applicable to other encryption algorithms and data widths.

[0102] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions noted in the blocks may occur in a different order than noted in the figures. For example, two blocks shown in succession may in fact be executed substantially concurrently, or the blocks may possibly be executed in the reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, are implemented by a dedicated hardware-based system that performs the specified functions or operations or executes a combination of dedicated hardware and computer instructions.

[0103] Furthermore, while aspects have been described with reference to a computer system executing program code directing the functions of the present invention, it should be understood that the present invention may alternatively be implemented as a program product including a computer-readable storage device that stores program code for processing by a data processing system. The computer-readable storage device may include volatile or non-volatile memory, optical or magnetic disks, or the like. However, "storage device" as used herein is specifically defined to include only legal articles of manufacture and to exclude the signal medium itself, the temporarily propagating signal itself, and the energy itself.

[0104] The program product may include data and / or instructions that, when executed or otherwise processed on a data processing system, generate a logical, structural, or otherwise functionally equivalent representation (including a simulation model) of a hardware component, circuit, device, or system disclosed herein. Such data and / or instructions may include Hardware Description Language (HDL) design entities or other data structures that conform to and / or are compatible with low-level HDL design languages, such as Verilog and VHDL, and / or high-level design languages, such as C or C++. Furthermore, the data and / or instructions may also utilize data formats used to exchange integrated circuit layout data and / or symbolic data formats (e.g., GDSII (GDS2), GL1, OASIS, information stored in map files, or any other suitable format for storing such design data structures).

Claims

1. an instruction fetch unit that fetches instructions to be executed; an architected register file including a plurality of registers for storing source and destination operands; and 1. An execution unit for executing a Galois multiplication instruction, said execution unit comprising: a carry-less multiplier configured to multiply operands of the Galois multiplication instruction to produce a product; and a modular reduction circuit configured to receive the product and determine a reduced product having a fewer number of bits than the product based on a logical combination of the product and a fixed polynomial, wherein the execution unit is configured to store the reduced product in the architected register file as a result of the Galois multiplication instruction. Including, A processor comprising:

2. 2. The processor of claim 1, wherein the fixed polynomial is g(x)=1+X+x^2+x^7+x^128.

3. the product includes an upper portion containing the most significant bits of the product and a lower portion containing the least significant bits of the product; The modular reduction circuit is configured to calculate a first result that is equivalent to a carryless multiplication of the upper and fixed polynomials, the modular reduction circuit comprising: a shift circuit that applies a plurality of different bit position shifts to the upper part of the product that correspond to asserted bits in the fixed polynomial; and a bitwise exclusive-OR (XOR) circuit that logically combines multiple instances of the upper portion of the product having different respective bit position shifts applied by the shift circuit; 3. The processor of claim 1, further comprising:

4. the shift circuitry is further configured to apply a plurality of different bit position shifts to the top of the first result that correspond to asserted bits in the fixed polynomial; the bitwise exclusive-OR (XOR) circuit is further configured to logically combine multiple instances of the upper portion of the first result having different respective bit position shifts applied by the shift circuit to obtain a second result, wherein the bitwise XOR circuit generates the reduced product based on the first result, the second result, and the lower portion of the product. The processor of claim 3 .

5. The processor of claim 3 , wherein the bitwise exclusive-OR (XOR) circuit comprises at least two stages of bitwise XOR circuitry.

6. 6. The processor of claim 1, further comprising a conditional bit reversal circuit configured to conditionally reverse a bit order of bytes in one of the operands based on an endian mode indicated by the Galois multiply instruction before multiplying the operands.

7. the carry-less multiplier is a first multiply-multiply engine; the execution unit includes a second multiply-multiply engine, the first and second multiply-multiply engines having a first data width; the operands include first and second operands having a second data width that is an integer multiple of the first data width; the first and second multiply-multiply engines are configured to multiply subsets of the first and second operands in parallel; A processor according to any one of claims 1 to 6.

8. A plurality of processors including the processor of any one of claims 1 to 7; shared memory; and a system interconnect communicatively coupling the shared memory and the plurality of processors; A data processing system comprising:

9. 1. A method of data processing in a processor, comprising: fetching, by an instruction fetch unit, an instruction to be executed by the processor, wherein the instruction comprises a Galois multiplication instruction; and upon receiving the Galois multiplication instruction, an execution unit of the processor executes the Galois multiplication instruction, wherein the executing step comprises: multiplying, by a carry-less multiplier, the operands of said Galois multiply instruction to produce a product; a modular reduction circuit receiving the product and determining a reduced product having a fewer number of bits than the product based on a logical combination of the product and a fixed polynomial; and storing the reduced product in an architected register file of the processor as a result of the Galois multiplication instruction. Including, A method for providing the above.

10. 10. The method of claim 9, wherein the fixed polynomial is g(x)=1+X+x^2+x^7+x^128.

11. the product includes an upper portion including the most significant bits of the product and a lower portion including the least significant bits of the product; Determining the reduced product includes calculating a first result equivalent to a carry-less multiplication of the upper and fixed polynomials, wherein the calculating step comprises: applying, by a shift circuit, a plurality of different bit position shifts to the upper part of the product that correspond to asserted bits in the fixed polynomial; and logically combining, by a bitwise exclusive OR (XOR) circuit, multiple instances of the upper part of the product having different respective bit position shifts applied by the shift circuit. Including, 11. The method of claim 9 or 10.

12. applying, by the shift circuitry, a plurality of different bit position shifts to the top of the first result that correspond to asserted bits in the fixed polynomial; and logically combining, by the bitwise exclusive OR (XOR) circuit, the upper multiple instances of the first result with different respective bit position shifts applied by the shift circuit to obtain a second result. Further provided with determining the reduced product includes determining the reduced product based on the first result, the second result, and the lower part of the product. The method of claim 11.

13. 13. The method of claim 9, further comprising conditionally reversing the bit order of bytes in one of the operands based on an endian mode indicated by the Galois multiply instruction prior to multiplying the operands.

14. the carry-less multiplier is a first multiply-multiply engine; the execution unit includes a second multiply-multiply engine, the first and second multiply-multiply engines having a first data width; the operands include first and second operands having a second data width that is an integer multiple of the first data width; multiplying the operands includes the first and second multiply-multiply engines multiplying subsets of the first and second operands in parallel; 14. The method according to any one of claims 9 to 13.

15. A design structure tangibly embodied in a machine-readable storage device for designing, manufacturing, or testing an integrated circuit, comprising: an instruction fetch unit that fetches instructions to be executed; an architected register file including a plurality of registers for storing source and destination operands; and 1. An execution unit for executing a Galois multiplication instruction, said execution unit comprising: a carry-less multiplier configured to multiply operands of the Galois multiplication instruction to produce a product; and a modular reduction circuit configured to receive the product and determine a reduced product having a fewer number of bits than the product based on a logical combination of the product and a fixed polynomial, wherein the execution unit is configured to store the reduced product in the architected register file as a result of the Galois multiplication instruction. Including, A processor having A design structure comprising:

16. 16. The design structure of claim 15, wherein the fixed polynomial is g(x)=1+X+x^2+x^7+x^128.

17. the product includes an upper portion containing the most significant bits of the product and a lower portion containing the least significant bits of the product; The modular reduction circuit is configured to calculate a first result that is equivalent to a carryless multiplication of the upper and fixed polynomials, the modular reduction circuit comprising: a shift circuit that applies a plurality of different bit position shifts to the upper part of the product that correspond to asserted bits in the fixed polynomial; and a bitwise exclusive-OR (XOR) circuit that logically combines multiple instances of the upper portion of the product having different respective bit position shifts applied by the shift circuit; 17. The design structure of claim 15 or 16, comprising:

18. the shift circuitry is further configured to apply a plurality of different bit position shifts to the top of the first result that correspond to asserted bits in the fixed polynomial; the bitwise exclusive-OR (XOR) circuit is further configured to logically combine multiple instances of the upper portion of the first result having different respective bit position shifts applied by the shift circuit to obtain a second result, wherein the bitwise XOR circuit generates the reduced product based on the first result, the second result, and the lower portion of the product.

20. The design structure of claim 17.

19. 19. The design structure of claim 15, further comprising a conditional bit reversal circuit configured to conditionally reverse a bit order of bytes in one of the operands based on an endian mode indicated by the Galois multiply instruction prior to multiplication of the operands.

20. the carry-less multiplier is a first multiply-multiply engine; the execution unit includes a second multiply-multiply engine, the first and second multiply-multiply engines having a first data width; the operands include first and second operands having a second data width that is an integer multiple of the first data width; the first and second multiply-multiply engines are configured to multiply subsets of the first and second operands in parallel; 20. A design structure according to any one of claims 15 to 19.

Images