Instruction execution method and device for use in SHA256, data processing system for use in SHA256, and chip

Abstract

An instruction execution method and device for use in SHA256, a data processing system for use in SHA256, and a chip. During message word extension, message extension is carried out on the basis of a first source operand, a second source operand and a destination operand respectively stored in three registers of at least 256 bits, to obtain one or two newly-generated message words, wherein the first source operand and the second source operand each comprise eight 32-bit message words.

Description

Instruction execution method, device, data processing system and chip that can be used for SHA256

[0001] This application claims priority to patent application number 2023110447561, filed on August 17, 2023, entitled “Instruction execution method, device, data processing system and chip that can be used for SHA256”, the contents of which should be understood as incorporated into this application by reference. Technical Field

[0002] The embodiments of the present disclosure relate to, but are not limited to, the implementation of a secure hash algorithm. More specifically, they relate to an instruction execution method, device, data processing system, and chip that can be used for SHA256. Background Art

[0003] SHA-2 (Security Hash Algorithm-2) is a cryptographic hash algorithm used to achieve one-way mapping between data. It can map messages of any length into message digests of fixed length, and the mapping process is irreversible. According to the length of the output message digest, SHA-2 is divided into SHA-224, SHA-256, SHA-384, SHA-512 and other algorithms, which are mainly used in digital signatures, fingerprint verification and network security protocols. Among them, SHA-256 is a one-way hash algorithm that can convert any length less than 2 64 The SHA-256 algorithm converts a 256-bit input message into a 256-bit message digest, which has high security. However, when the SHA-256 algorithm is applied in the chip, its performance needs to be improved. Technical Solutions

[0004] The following is an overview of the subject matter described in detail in this disclosure. This overview is not intended to limit the scope of protection.

[0005] The present disclosure provides an instruction execution device that can be used for secure hash algorithm SHA256, including:

[0006] Multiple registers of at least 256 bits;

[0007] an instruction decoder configured to receive and decode an instruction for a SHA256 calculation, the instruction comprising a message word extension instruction, the message word extension instruction comprising three fields for respectively indicating a first source register storing a first source operand, a second source register storing a second source operand, and a destination register for storing a destination operand;

[0008] an execution unit, coupled to the instruction decoder, configured to, in response to a decoding result of the message word extension instruction, perform a message word extension operation based on the first source operand stored in the first source register and the second source operand stored in the second source register, obtain a destination operand including a newly generated message word, and store the result in a destination register;

[0009] Wherein, the first source register, the second source register and the destination register are all registers of at least 256 bits;

[0010] The first source operand includes eight 32-bit generated message words W j-9 , W j-10 ,...,W j-16 ;

[0011] The second source operand includes eight 32-bit generated message words W j-1 , W j-2 ,...,W j-8 ;

[0012] The target operand includes N 32-bit newly generated message words and (8-N) 32-bit generated message words W j-1 , W j-2 ,...,W j+N-8 , j = 16, 17, ..., 63; N = 1 or 2, when N = 1, the newly generated message word is W j , when N=2, the newly generated message word is W j+1 , W j .

[0013] An embodiment of the present disclosure also provides a data processing system that can be used for the secure hash algorithm SHA256, including: a bus; an instruction execution device as described in any embodiment of the present disclosure, coupled to the bus; and a dynamic random access memory DRAM, coupled to the bus.

[0014] An embodiment of the present disclosure further provides a chip, comprising a processor, wherein the processor is capable of executing the secure hash algorithm SHA256 as the instruction execution device described in any embodiment of the present disclosure.

[0015] The present disclosure also provides an instruction execution method that can be used for SHA256, including:

[0016] An instruction decoder receives and decodes an instruction for a SHA256 calculation, wherein the instruction includes a message word extension instruction, and the message word extension instruction includes three fields for respectively indicating a first source register storing a first source operand, a second source register storing a second source operand, and a target register for storing a target operand.

[0017] An execution unit coupled to the instruction decoder performs a message word extension operation based on the first source operand stored in the first source register and the second source operand stored in the second source register in response to a decoding result of the message word extension instruction, obtains a target operand including a newly generated message word, and stores the target operand in a target register;

[0018] Wherein, the first source register, the second source register and the destination register are all registers of at least 256 bits;

[0019] The first source operand includes eight 32-bit generated message words W j-9 , W j-10 ,...,W j-16 ;

[0020] The second source operand includes eight 32-bit generated message words W j-1 , W j-2 ,...,W j-8 ;

[0021] The target operand includes N 32-bit newly generated message words and (8-N) 32-bit generated message words W j-1 , W j-2 ,...,W j+N-8 , j = 16, 17, ..., 63; N = 1 or 2, when N = 1, the newly generated message word is W j , when N=2, the newly generated message word is W j+1 , W j .

[0022] An embodiment of the present disclosure further provides a non-transitory computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, wherein when the computer instructions are executed by a machine, the machine executes the instruction execution method described in any embodiment of the present disclosure.

[0023] Still other aspects will become apparent upon reading and understanding the accompanying drawings and detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings are used to provide an understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the technical solutions of the present disclosure and do not constitute a limitation to the technical solutions of the present disclosure.

[0025] Figure 1 is a schematic diagram of message padding in SHA-256;

[0026] FIG2 is a schematic diagram of an instruction execution device that can be used for SHA-256 according to an embodiment of the present disclosure;

[0027] FIG3 is a schematic diagram of performing a message expansion operation to obtain a newly generated message word according to an embodiment of the present disclosure;

[0028] FIG4 is a schematic diagram of another embodiment of the present disclosure performing a message expansion operation to obtain two newly generated message characters;

[0029] FIG5 is a schematic diagram of an embodiment of the present disclosure performing an iterative compression operation;

[0030] FIG6 is a schematic diagram of a data processing system according to an embodiment of the present disclosure;

[0031] FIG7 is a flowchart of a method for executing instructions that can be used for SHA-256 according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0032] The present disclosure describes multiple embodiments, but the description is exemplary rather than restrictive, and it is obvious to those skilled in the art that there may be more embodiments and implementations within the scope of the embodiments described in the present disclosure.

[0033] In the description of the present disclosure, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment described in the present disclosure as "exemplary" or "for example" should not be interpreted as being more preferred or advantageous than other embodiments. "And / or" in this article is a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. "Multiple" means two or more than two. Words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not limit them to be necessarily different.

[0034] The specific order of the steps set forth in the specification should not be construed as limiting the claims. Furthermore, claims directed to the method and / or process should not be limited to performing their steps in the order written, and those skilled in the art will readily understand that these orders can be varied and still remain within the spirit and scope of the disclosed embodiments.

[0035] The SHA-256 algorithm can convert length less than 2 64 The input message of 10 bits (also called input data) is converted into a 256-bit message digest, the message block length is 512 bits, and the message word length of the iterative compression process is 32 bits.

[0036] The SHA-256 algorithm uses the functions Ch(x, y, z), Maj(x, y, z), ∑0(x), and ∑1(x) for data compression, and the functions σ0(x) and σ1(x) for data expansion. These functions are defined as follows:

[0037] The symbols in the above function have the following meanings:

[0038] ∧ Bitwise AND operation

[0039] ∨ Bitwise OR operation

[0040] Bitwise XOR operation

[0041] Bitwise inversion operation

[0042] ROTR n (x) Circular right shift operation, circularly shift x right by n bits

[0043] SHR n (x) right shift operation, shift x right by n bits and fill the left side with 0

[0044] The SHA-256 algorithm mainly consists of three parts: message padding, data expansion and data compression.

[0045] ■Message filling

[0046] First, a 1-bit is appended to the end of the input message of length L. K 0-bits are then added until the length is equal to 448 after modulo 512. Finally, 64 bits of length information are appended. This is shown in Figure 1. For example, when padding the plaintext hexadecimal message "616263," according to the padding rules, the first step is to append a 1-bit to the end of the message, and the second step is to append 0-bits, resulting in a total of 512-24-1-64 = 423 bits. The third step is to append 64 bits of length information. The length of the input message is 6 x 4 = 24 bits. The decimal value 24 is represented as 18 in hexadecimal. Therefore, the 64-bit length information is "0000 0000 0000 0018."

[0047] Data expansion

[0048] The padded message can be divided into multiple 512-bit message blocks. The SHA-256 algorithm uses two message words during iterative compression. One is a fixed constant of 32 bits, referred to as the fixed message word K in this article. There are 64 fixed message words in total, represented as K0, K1..., K 63 The other is to generate message words based on the message block. First, divide the message block into 16 message words W0, W1…, W 15 ; According to the round function, take out the 1st, 2nd, 9th, and 15th message words in the current round (i.e. W0, W1, W8, W 14 ) is calculated to obtain the 17th message word W16 , the 18th word W 17 It is through W1, W2, W9, W 15 Calculate and calculate, and so on to get all the subsequent message words. In this paper, each message block is divided or expanded to get 64 32-bit message words W0, W1..., W 63 The extended message word W can also be called changing constants or message schedule constants.

[0049] Message words denoted by "W" or a subscript "W" are extended message words, while those denoted by "K" or a subscript "K" are fixed message words. When describing message extensions, all message words mentioned are extended message words. For example, "generated message word" refers to an already generated extended message word, and "newly generated message word" refers to a newly generated extended message word.

[0050] The rule of message block expansion is as follows: first divide the message block into 16 message words W0, W1…, W 15 ; Then use the following message word expansion formula to get the remaining 48 message words W 16 , W 17 …, W 63 : W j =σ1(W j-2 )+W i-7 +σ0(W j-15 )+W j-16 j = 16, 17, ..., 63

[0051] The functions σ0 and σ1 used are as described above and will not be repeated here.

[0052] Data compression

[0053] The data compression of the SHA-256 algorithm is an iterative compression process. A message block is iterated and compressed for 64 rounds to output a 256-bit hash value. The iterative compression process uses 8 variables a, b, c, d, e, f, g, h, and 64 fixed message words K. n , and the 64 message words W generated by the expansion of the message block n , n=0,1,…,63.

[0054] In the SHA-256 algorithm, each round of iterative compression performs the same operation. The single-round iterative function is expressed as follows: n+1 =g n g n+1 =f n f n+1 =e n e n+1 =dn +h n +∑1e n +Ch(e n , f n , g n )+K n +W n d n+1 =c n c n+1 =b n b n+1 =a n a n+1 =∑0a n +Maj(a n , b n , c n )+h n +∑1e n +Ch(e n , f n , g n )+K n +W n

[0055] Throughout this document, symbols such as a and b, c and c, d and d, e and e, f and f, g and g, h and h, i and i, j and j, and n and n in different fonts represent the same variable. Variables and message words are both 32 bits.

[0056] After the input message is divided into multiple message blocks, when compressing the first message block, the initial values ​​of the eight variables a0, b0, c0, d0, e0, f0, g0, and h0 are fixed and set as follows: a = 0x6a09e667; b = 0xbb67ae85; c = 0x3c6ef372; d = 0xa54ff53a; e = 0x510e527f; f = 0x9b05688c; g = 0x1f83d9ab; and h = 0x5be0cd19. After 64 rounds of iterative compression, the output values ​​of the eight variables a 63 , b 63 , c 63 , d 63 , e 63 , f 63 , g 63 , h 63 Modulo 2 with the corresponding initial value 32 After addition and concatenation, the compressed output of the first message block is obtained, which is a 256-bit hash value. Starting from the second message block, when compressing each message block, the output of the previous message block is used as the initial value of the eight variables. The compression method is repeated until all message blocks are compressed. The 256-bit message digest of the input message is output.

[0057] In some embodiments, a SIMD-based SHA instruction—an extended instruction set—is implemented to complete the processing steps of the SHA-256 algorithm. To perform iterative compression of 256-bit data using SHA-256, at least 256-bit registers are used to store SHA-256 variables (e.g., A, B, C, D, E, F, G, and H) and the message word required for iterative compression. One or more rounds of iterative compression of SHA-256 can be executed by the processor in response to SIMD instructions of the complex instruction set. These embodiments use 128-bit registers for message word expansion. To obtain the expanded message word, these embodiments require the sequential execution of two message word expansion instructions: sha256msg1 and sha256msg2. By executing sha256msg1, an intermediate result is first obtained, and then the intermediate result is used in sha256msg1 to calculate the newly expanded message word. In addition, corresponding load operations and addition operations need to be performed, resulting in a large number of instructions and a high time consumption for executing the instructions.

[0058] To this end, an embodiment of the present disclosure provides an instruction execution device that can be used for the secure hash algorithm SHA256, including:

[0059] Multiple registers of at least 256 bits;

[0060] an instruction decoder configured to receive and decode an instruction for a SHA256 calculation, the instruction comprising a message word extension instruction, the message word extension instruction comprising three fields for respectively indicating a first source register storing a first source operand, a second source register storing a second source operand, and a destination register for storing a destination operand;

[0061] an execution unit, coupled to the instruction decoder, configured to, in response to a decoding result of the message word extension instruction, perform a message word extension operation based on the first source operand stored in the first source register and the second source operand stored in the second source register, obtain a destination operand including a newly generated message word, and store the result in a destination register;

[0062] Wherein, the first source register, the second source register and the destination register are all registers of at least 256 bits;

[0063] The first source operand includes eight 32-bit generated message words W j-9 , W j-10 ,...,W j-16 ;

[0064] The second source operand includes eight 32-bit generated message words W j-1 , W j-2 ,...,Wj-8 ;

[0065] The target operand includes N 32-bit newly generated message words and (8-N) 32-bit generated message words W j-1 , W j-2 ,...,W j+N-8 , j = 16, 17, ..., 63; N = 1 or 2, when N = 1, the newly generated message word is W j , when N=2, the newly generated message word is W j+1 , W j .

[0066] The embodiment of the present disclosure designs a message word extension instruction sha256Msg that is more suitable for 256-bit registers. Based on multiple registers of at least 256 bits storing operands, a new message word W can be obtained by decoding and executing a message word extension instruction. 16 , W 17 ,...,W 63 ,The number of instructions used is small, the instruction execution time required for message expansion is short, and the efficiency is high.

[0067] 2 is a schematic diagram of an instruction execution device according to an embodiment of the present disclosure, which can be implemented using a processor. The processor can be a general-purpose processor. Any of various complex instruction set computing (CISC) processors, various reduced instruction set computing (RISC) processors, and various very long instruction word (VLIW) processors, or a mixture of one or more of the above types of processors, or other types of processors. The processor can also be one or more processor cores. Such as a general-purpose in-order core intended for general-purpose computing, a high-performance general-purpose out-of-order core intended for general-purpose computing, or a dedicated core primarily used for graphics and / or scientific (throughput) computing. For example, the processor can be a central processing unit (CPU) including one or more general-purpose in-order cores and / or one or more general-purpose out-of-order cores, or a coprocessor including one or more dedicated cores, such as a coprocessor on a chip separate from the CPU, a coprocessor on a separate die in the same package as the CPU, a coprocessor on the same die as the CPU, and the like.

[0068] In the example shown in FIG2 , the instruction execution device includes an instruction decoder 11 and one or more execution units 13 (only one is shown). The instruction decoder 11 is used to receive and decode instructions from an instruction fetch unit (not shown). The instruction decoder 11 can generate and output a decoded result of the instruction. When the processor adopts a RISC (Reduced Instruction Set Computing) architecture, the decoded result of the instruction can be a control signal generated based on the instruction to control the hardware in the execution unit to perform the logical operations defined by the instruction, implementing operations such as message word expansion and iterative compression of variables. When the processor adopts a CISC (Complex Instruction Set Computing) architecture, the decoded result of the instruction can be one or more micro-operations, microcodes, entry points, microinstructions, or other instructions that reflect the instruction or are derived from the instruction. The instruction decoder 11 can be implemented using various mechanisms, including but not limited to: a microcode read-only memory (ROM), a lookup table, hardware implementation, a programmable logic array (PLA), and so on. The execution unit 13 can include an arithmetic logic unit (ALU) or any other type of logic unit capable of performing operations based on instructions. As a result of the instruction decoder 11 decoding the instruction, the execution unit 13 can be connected to the 256-bit register group through the addressing system, receive control signals reflecting the instruction or derived from the instruction or one or more micro-operations, microcodes, entry points, microinstructions, other instructions, perform corresponding operations based on the source operands in one or more source registers indicated in the instruction, and store the resulting target operands in the target registers. The execution unit 13 includes circuits operable to execute the instruction (such as each operator used for message word expansion and iterative compression in SHA256) or other execution logic (for example, software combined with hardware and / or firmware) and perform operations accordingly. The execution unit 13 can represent any type of execution unit such as a logic unit, an arithmetic logic unit (ALL), an arithmetic unit, an integer unit, etc.

[0069] When executing an instruction, part or all of the source operands and target operands may be stored in a register set and / or memory. The register set may be part of the 256-bit register bank 15, or may be other registers such as a status register and a flag register. A register is a storage device that can store data. The register set may be physically located in a chip with an execution unit 13. The instruction may specify data to be stored in a register, and each different type of register may be available as long as they are capable of storing and providing the data required by this embodiment. Examples of suitable registers include, but are not limited to, dedicated physical registers, dynamically allocated physical registers using register renaming, a combination of dedicated registers and dynamically allocated physical registers, and the like.

[0070] In the example shown in Figure 2, the execution unit 13 includes one or more SHA256 units. The SHA256 unit can respond to the instruction decoding result provided by the instruction decoder 11 and perform a message word expansion operation using the generated message word stored in the 256-bit register group 15. It can also perform SHA256 iterative compression using the sum of the SHA256 variable and the corresponding message word stored in the 256-bit register group 15.

[0071] The decoding and execution of the message extension related instructions of this embodiment can be started before the iterative compression of the SHA256 variable requires the generation of a new extended message word. Before executing the first message extension instruction, the first 8 message words W7 to W0 obtained by dividing the 512-bit message block are loaded into the first source register src1, and the last 8 message words W 15 The execution unit performs the message word extension operation based on the decoding result of the message word extension instruction, which can directly cause the corresponding hardware logic to generate a new 32-bit message word.

[0072] In an exemplary embodiment of the present disclosure, a newly generated extended message word is obtained by executing a message word extension instruction once. That is, when N=1, performing a message word extension operation based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a target operand including the newly generated message word and store it in the target register includes:

[0073] The following expansion operation is performed based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a newly generated message word W: j and stored in dst[255:224]: W j =σ1(W j-2 )+W i-7 +σ0(W j-15 )+W j-16 ;

[0074] The generated message word W in the second source operand is j-1 , W j-2 ,...,W j-7 Stored to dst[223:192], dst[192:160], dst[159:128], dst[127:96], dst[95:64], dst[63:32] and dst[31:00] respectively; where dst[n:m] represents the nth to mth bits of the destination register used to store the destination operand;

[0075] The second source register and the target register are the same or different, and the first source register is different from the second source register and the target register.

[0076] In one example, the second source register and the destination register are the same, that is, scr2 and dst are equal. In another example, the second source register and the destination register are different, that is, scr2 and dst are not equal. In both examples, the first source register is different from the second source register and the destination register.

[0077] The message word extension instruction including three fields in this embodiment can be expressed as:

[0078] sha256Msg dst, src1, src2 / / RF-type

[0079] Wherein, sha256Msg represents the opcode of the 256-bit message word extension instruction, scr1 represents the first source register, scr2 represents the second source register, and dst represents the destination register. scr1, scr2, and dst are all registers of 256 bits or greater. scr1, scr2, and dst are usually register numbers, that is, scr1 is the register number of the first source register, src2 is the register number of the second source register, and dst is the register number of the destination register. The RF-type (Register-Register / Immediate-Format) in the above formula indicates an instruction format for operations that require reading and writing registers, as well as for reading and operating immediate values.

[0080] The above src1[n:m] represents the nth to mth bits of the first source register, and src2[n:m] represents the nth to mth bits of the second source register. i represents the sequence number of w[i] to be generated by the current message expansion operation. In one example, dst is the first source operand W j-9 , W j-10 ,...,W j-16 The storage situation in the first source register src1 can be expressed as:

[0081] src1[255:224]=w[i-9]; src1[223:192]=w[i-10]; src1[192:160]=w[i-11];

[0082] src1[159:128]=w[i-12]; src1[127:96]=w[i-13]; src1[95:64]=w[i-14];

[0083] src1[63:32]=w[i-15]; src1[31:00]=w[i-16];

[0084] Accordingly, the second source operand W j-1 , W j-2 ,...,W j-8 The storage situation in the second source register src2 can be expressed as:

[0085] src2[255:224]=w[i-1]; src2[223:192]=w[i-2]; src2[192:160]=w[i-3];

[0086] src2[159:128]=w[i-4]; src2[127:96]=w[i-5]; src2[95:64]=w[i-6];

[0087] src2[63:32]=w[i-7]; src2[31:00]=w[i-8];

[0088] The target operand W obtained after the sha256Msg instruction is operated j , W j-1 ,...,W j-7 The storage situation in the destination register dst can be expressed as:

[0089] dst[255:224]=w[i]=w[i-2]+σ1(w[i-7])+σ0(w[i-15])+w[i-16];

[0090] dst[223:192]=w[i-1]; dst[192:160]=w[i-2]; dst[159:128]=w[i-3];

[0091] dst[127:96]=w[i-4]; dst[95:64]=w[i-5]; dst[63:32]=w[i-6];

[0092] dst[31:00]=w[i-7].

[0093] The above w[i-7] is W j-7 , w[i-6] is W j-6 ,……,w[i] is W j , and so on.

[0094] The example in Figure 3 shows the operands and corresponding operators involved in executing the message extension operation, such as σ0 and σ1, adders (represented by a rectangular box marked with "+"), etc. Among them, σ0 is used to implement the operation of the function σ0(x), and σ1 is used to implement the operation of the function σ1(x). The connection between each operator is determined based on the message word expansion formula above, and together constitutes the hardware circuit for message word expansion in the execution unit. It should be noted that the connection between the above operators and registers is only for convenience of representation. In hardware implementation, the first source register, the second source register and the target register can be selected from the register set, and the input and output ends of the circuit composed of these operators can be connected to the set port. The execution unit determines the register actually accessed by the port through addressing based on the register number given in the instruction. Therefore, in the message extension instruction, different register numbers are set for scr1 and scr2 to access the corresponding registers to read the operands required for this message word expansion. In the message extension instructions executed successively, scr1, scr2 and dst can be made to correspond to different registers by setting different numbers for scr1, scr2 and dst.

[0095] The example shown in FIG3 is to divide a message block into 16 32-bit message words, load W7, W6 . . . , W0 into the first source register, and then load W 15 , W 14 ..., after W8 is loaded into the second source register. The situation when the first message extension operation is executed. The message extension instruction and the operands in the relevant registers at this time can be expressed as:

[0096] sha256Msg dst, src1, src2 / / RF-type

[0097] src1: [w7 w6 w5 w4 w3 w2 w1 w0] [high->low]

[0098] src2: [w15 w14 w13 w12 w11 w10 w9 w8] [high->low]

[0099] dst: [w16 w15 w14 w13 w12 w11 w10 w9] [high->low]

[0100] As shown in the figure, among the target operands obtained by executing sha256Msg, starting from the high bit of dst, the first one is the newly generated message word w16 (i.e. W 16 ), the others are all generated message words, which can be copied or moved from the corresponding bits of the second source register src2.

[0101] 3, the target register of the illustrated example is different from the first source register and the second source register. j Save to the highest 32 bits of dst, and W j-1 ,...,W j-7 Copy to the remaining position of dst to obtain the target operand stored in dst, which is also the second source operand required for the next message word expansion. In another embodiment, the target register dst is the same as the second source register scr2, and dst and src2 in the message word expansion instruction use the same register number. When performing the expansion operation, first temporarily store the calculated w16 in a register, shift the message word in src2 right by 32 bits, and then copy w16 to the highest 32 bits of src2. The target operand can also be obtained but stored in src2. The second source register src2 of this embodiment is the target register dst. The specific operation of message expansion can have many variations, which are not limited by this disclosure. For example, the target operand can also be temporarily stored in an intermediate register and then copied back to src2.

[0102] In another exemplary embodiment of the present disclosure, two newly generated message words are obtained by executing a message word extension instruction once. That is, when N=2, performing a message word extension operation based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a target operand including the newly generated message word and store it in the target register includes:

[0103] The following expansion operation is performed based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a newly generated message word W: j+1 and stored in dst[255:224]: W j+1 =σ1(W j-1 )+W i-6 +σ0(W j-14 )+W j-15 ;

[0104] The following expansion operation is performed based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a newly generated message word W: j and stored in dst[223:192]: W j =σ1(W j-2 )+W i-7 +σ0(W j-15 )+W j-16 ;

[0105] The generated message word W in the second source operand isj-1 , W j-2 ,...,W j-6 Stored to dst[192:160], dst[159:128], dst[127:96], dst[95:64], dst[63:32] and dst[31:00] respectively;

[0106] Wherein, dst[n:m] represents the nth to mth bits of the destination register used to store the destination operand;

[0107] The second source register is the same as or different from the target register, and the first source register is different from the second source register and the target register.

[0108] 4 , this embodiment is different from the embodiment shown in FIG3 , based on the first source operand W j-9 , W j-10 ,...,W j-16 and the second source operand W j-1 , W j-2 ,...,W j-8 , use the message word to expand a set of operators related to time-sharing calculation (or use two sets of operators to calculate simultaneously), and expand to obtain 2 newly generated message words.

[0109] After executing a message word extension instruction in this embodiment, the target operand obtained and its storage status in the target register can be expressed as follows: dst[255:224]=w[i+1]=w[i-1]+σ1(w[i-6])+σ0(w[i-14])+w[i-15]; dst[223:192]=w[i]=w[i-2]+σ1(w[i-7])+σ0(w[i-15])+w[i-16]; dst[192:160]=w[i-1]; dst[159:128]=w[i-2]; dst[127:96]=w[i-3]; dst[95:64]=w[i-4]; dst[63:32]=w[i-5]; dst[31:00]=w[i-6].

[0110] Different from the previous embodiment, this embodiment obtains two newly generated message words w[i+1] and w[i] by executing a message word extension instruction once, which saves the number of instructions and improves the operation efficiency. In an example of this embodiment, the target register is different from the second source register, dst is not equal to src2, and the newly generated message word w[i+1] is stored in the highest 32 bits of the 256-bit target register, namely dst[255:224], and the newly generated message word w[i] is stored in the second highest 32 bits of the 256-bit target register, namely dst[223:192]. The other message words in the target register are generated message words, which can be copied from the corresponding bits of the second source register, and the target operand in the target register can be directly used as the second source operand of the next extension operation. In another example, the target register is the same as the second source register, and dst and src2 in the message word extension instruction are equal. When performing the expansion operation, you can first temporarily store the calculated w[i+1] and w[i] in a register, shift the message word in src2 right by 64 bits, and then copy w[i+1] and w[i] to the highest 64 bits of src2 to obtain the target operand stored in src2 as the second source operand required for the next message word expansion.

[0111] In the example of Figure 4, the first execution of the message extension instruction is taken as an example. Therefore, the first operand in the first source register and the second source operand in the second source register are the same as the example shown in Figure 3, but the destination operand is different. The message extension instruction and the operands in the relevant registers can be expressed as follows: sha256Msg dst, src1, src2 / / RF-type src1: [w7 w6 w5 w4 w3 w2 w1 w0] [high->low] src2: [w15 w14 w13 w12 w11 w10 w9 w8] [high->low] dst: [w17 w16 w15 w14 w13 w12 w11 w10] [high->low]

[0112] As shown in the figure, in the target operand obtained by executing sha256Msg, starting from the high bit, the first and second message words are the newly generated message words w17 (i.e. W 17 ) and w16 (ie W 16 ), the others are generated message words w15 to w10.

[0113] In an exemplary embodiment of the present disclosure, after the extension operation is executed, in order to continue using the original first source register when the message word extension instruction is executed next time, the first source operand needs to be updated. The high bit of the updated first source operand comes from the original second source operand, and the low bit comes from the original first source operand. This can be achieved through two move instructions and one merge instruction.

[0114] In this embodiment, the instruction decoder is further configured to continue decoding the following received instructions after decoding the message word extension instruction:

[0115] Left shift instruction, used to indicate that the data in the second source register is shifted left by k bits and padded with 0 on the right; when N=1, k=224; when N=2, k=192

[0116] The right shift instruction is used to instruct the data in the first source register to be shifted right by 256-k bits and padded with 0 on the left;

[0117] A merge instruction is used to instruct to perform an OR operation on the data in the second source register after the left shift and the data in the first source register after the right shift, and the result is stored in the first source register;

[0118] The execution unit is further configured to, after obtaining the target operand including the newly generated message word and storing it in the target register, respond to the decoding results of the left shift instruction, the right shift instruction and the merge instruction to perform a first source operand update operation, updating the first source operand in the first source register to W j+N-9 , W j+N-10 ,...,W j+N-16 ; Wherein, the message word extension instruction, left shift instruction, right shift instruction and merge instruction constitute an extension instruction group.

[0119] In this embodiment, the instructions for the SHA256 calculation are instructions of a reduced instruction set, and no microinstructions or microcodes are generated during instruction decoding, resulting in a faster execution speed. However, the present disclosure is not limited thereto.

[0120] In this embodiment, the number of bits of left shift and right shift varies depending on the value of N. When N=1, a left shift operation is performed in response to the decoding result of the left shift instruction, and the message word in the second source register is shifted left by 224 bits, which is the length of 7 message words, so that the last message word stored in the second source register is moved to the highest 32 bits of the first source register. By performing a right shift operation in response to the decoding result of the right shift instruction, all message words stored in the first source register can be shifted right by 32 bits, and the last message word is removed. The order of left shift and right shift can be interchanged or performed simultaneously. Finally, a merge operation is performed in response to the decoding result of the merge instruction to obtain the first source operand W required for the next message word expansion.j-8 , W j-9 ,...,W j-15 . When N=2, when the left shift operation is performed in response to the decoding result of the left shift instruction, the message word in the second source register is shifted left by 192 bits, which is the length of 6 message words, so that the last two message words stored in the second source register are moved to the highest 64 bits of the first source register. By performing the right shift operation in response to the decoding result of the right shift instruction, all the message words stored in the first source register can be shifted right by 64 bits, and the last two message words are removed. The order of left shift and right shift can be interchanged or performed simultaneously. Finally, a merge operation is performed in response to the decoding result of the merge instruction to obtain the first source operand W required for the next message word expansion. j-7 , W j-8 ,...,W j-14 .

[0121] In one example, taking N=2 as an example, an extended instruction group including a message word extension instruction, a left shift instruction, a right shift instruction, and a merge instruction can be expressed as follows:

[0122] In the above sha256msg instruction, gf30 is the number of the first source register src1, gf31 is the number of the second source register src2, and gf32 is the number of the destination register dst. These registers are all registers of at least 256 bits. The gfslli instruction is used to instruct the execution of an immediate left shift operation on a 256-bit register. gf31, gf31 represents the register src2 to which the data is to be shifted, and "192" represents the number of bits to be shifted left. The gfsrli instruction is used to instruct the execution of an immediate right shift operation on a 256-bit register. gf30, gf30 represents the register src1 to which the data is to be shifted, and "64" represents the number of bits to be shifted right. The gfor instruction indicates the execution of an "OR" operation on the data of two 256-bit registers. The last two register numbers gf31, gf30 in gfor gf30, gf31, gf30 are the numbers of the source registers to be "ORed", and the first register number gf30 is the number of the destination register used to store the result of the "OR" operation.

[0123] When N=1, the number of shift bits in the gfslli instruction can be adjusted to 224, and the number of shift bits in the gfsrli instruction can be adjusted to 32 to complete the update operation on the first source operand.

[0124] The updating of the first source operand is not limited to the above method. In other embodiments, other operation methods can be used to implement the updating of the first source operand. For example, the first source register src1 and the second source register src2 can be set as two adjacent registers, and the low bit of src2 is adjacent to the high bit of src1. In this way, a 32-bit (when N=1) or 64-bit (when N=2) right shift operation is performed on src1 and src2 together to obtain the first source operand stored in src1.

[0125] In an exemplary embodiment of the present disclosure, the instruction decoder is configured to decode p consecutively received extended instruction groups, wherein the first source register, the second source register, and the target register in the same extended instruction group are different from each other, and in two adjacent extended instruction groups, the number of the second source register in the previous extended instruction group is used as the target register in the next extended instruction group, and the target register in the previous extended instruction group is used as the second source register in the next extended instruction group. The first source register in the previous extended instruction group and the next extended instruction group are the same;

[0126] The execution unit is configured to respond to the decoding results of the p extended instruction groups, perform a message word extension operation and a first source operand update operation, and obtain q newly generated message words W j+q-1 , W j+q-2 ,...,W j The destination operand is stored in the destination register;

[0127] Among them, when N=1, 2≤p≤8, q=p; when N=2, 2≤p≤4, q=2p.

[0128] In this embodiment, after executing a message word extension instruction once, the destination operand stored in the destination register is the second source operand required for the next message word extension. For example, the first message extension instruction is: sha256msg gf32, gf30, gf31; the first source register is numbered gf30, the second source register is numbered gf31, and the destination register is numbered gf32. After this message extension instruction is decoded and executed, the next message extension instruction is: sha256msg gf31, gf30, gf32. That is, for two consecutive message extension instructions, the target register (indicated by a number) in the previous message extension instruction is used as the second source register (indicated by a number) in the next message extension instruction, so that the target operand obtained after the previous message extension instruction is executed is used as the second source operand in the next message extension instruction; and the second source register in the previous message extension instruction is used as the target register in the next message extension instruction to save the target operand obtained after the next message extension instruction is executed. By changing the register number in the message word extension instruction, there is no need to perform a data copy operation between registers (no need to copy the data in dst to src2), thereby speeding up the instruction execution speed. In other embodiments, the target register and the second source register are the same, so there is no need to exchange the numbers, but the message word extension operation performed when the target register and the second source register are the same is relatively complex (needing to temporarily store the newly generated message word).

[0129] In this embodiment, when N=1, the value of p can be any value from 2 to 8, that is, 2 to 8 newly generated message words are obtained by performing p message word expansion operations. In the case of N=2, the value of p can be any value from 2 to 4, and 4 to 8 newly generated message words are obtained by performing p message word expansion operations. The multiple newly generated message words obtained can be used for multiple rounds of iterative compression calculations. In other embodiments, when N=2, it is also possible to perform 1 message word expansion operation, and after obtaining 2 newly generated message words, the iterative compression instruction is executed to iteratively compress the variable. When this embodiment performs the message word expansion operation and the first source operand update operation, when generating the message word W 63 Previously, each time a message word expansion operation was performed, a first source operand update operation was performed, and when generating a message word W 63 After the message word extension operation, the first source operand update operation may no longer be performed.

[0130] In an example of this embodiment, N=2, p=4 is taken as an example, and the corresponding four extended instruction groups are as follows:

[0131] In the above example, the generation of 8 extended message words can be completed through 16 instructions (including 4 message word extension instructions, 4 left shift instructions, 4 right shift instructions and 4 merge instructions), and when these 16 instructions use instructions in the reduced instruction set, there are no microinstructions and the delays caused by them, and the instruction execution speed is faster.

[0132] In an exemplary embodiment of the present disclosure, in order to speed up iterative compression, the fixed message word K and the extended message word W required for iterative compression may be pre-added.

[0133] The instruction decoder is further configured to decode a received addition instruction after decoding the p consecutively received extended instruction groups. The addition instruction may be a SIMD (Single Instruction Multiple Data) instruction. The three fields included in the instruction are used to indicate the storage of W j+q-1 , W j+q-2 ,...,W j The destination register stores q 32-bit constants K j+q-1 , K j+q-2 , ..., K j A constant register for storing q addition results W j+q-1 +K j+q-1 , W j+q-2 +K j+q-2 ,...,W j +K j The result register;

[0134] The execution unit is further configured to respond to a decoding result of the addition instruction and to perform the addition operation based on the W stored in the target register. j+q-1 , W j+q-2 ,...,W j and K stored in the constant register j+q-1 , K j+q-2 , ..., K j Perform the addition operation and get the addition result W j+q-1 +K j+q-1 , W j+q-2 +K j+q-2 ,...,W j +K j and stored in the result register;

[0135] Wherein, the constant register and the result register are both 256-bit registers.

[0136] The above-mentioned addition instruction of this embodiment can be expressed as: vuadd32 gf10, gf00, gf32; the addition instruction can be executed after executing 4 extended instruction groups totaling 16 instructions. According to the SIMD format, vuadd32 is an opcode (the addition instruction can also be called the vuadd32 instruction), which means that the 8 32-bit message words stored in the two source registers gf00 and gf32 are added together to complete the operation of w[i]+k[i] in the SHA256 algorithm, and generate the parameter w+k required for 8 rounds of iterative compression. Among them, the target register gf32 stores multiple newly generated message words obtained by the message word expansion operation, and gf00 stores the corresponding fixed message words. The addition operation performed by the above-mentioned vuadd32 is to add the 32-bit data at the corresponding positions in the two registers, and save the result to the corresponding position of the gf10 register. Except for the vuadd32 instruction, the other instructions of the embodiment of the present disclosure can all use 256-bit overall calculation instructions.

[0137] In an exemplary embodiment of the present disclosure, after obtaining the addition results of multiple fixed message words and extended message words, multiple rounds of iterative compression can be performed on the SHA256 variables. The instruction decoder is further configured to continue decoding q consecutively received compression instruction groups after decoding the received addition instruction, wherein the first q-1 compression instruction groups each include an iterative compression instruction and a right shift instruction, and the qth compression instruction group includes an iterative compression instruction, wherein:

[0138] The iterative compression instruction includes three fields, which are used to indicate the storage of W j+q-1 +K j+q-1 , W j+q-2 +K j+q-2 ,...,W j +K j a result register, a first variable register storing eight variables to be iterated, and a second variable register for storing a result of performing a SHA256 iterative compression on the eight variables to be iterated, wherein the right shift instruction is used to instruct to shift the data in the result register right by 32 bits;

[0139] The execution unit is further configured to respond to decoding results of the q compression instruction groups, perform iterative compression on variables and right shift operations on data in the result register, and obtain 8 variables after q times of iterative compression.

[0140] In one example, between two adjacent compression instruction groups, the first variable register in the previous compression instruction group serves as the second variable register in the next compression instruction group, and the second variable register in the previous compression instruction group serves as the first variable register in the next compression instruction group, and the result registers in the previous compression instruction group and the next compression instruction group are the same. In another example, the first variable register and the second variable register in multiple compression instruction groups are the same.

[0141] In one example, eight newly generated message words w16 to w23 are obtained and then added to eight fixed constants K16 to K23 for eight iterations of compression. The iterative compression instruction is represented by sha256rng, and the format is as follows:

[0142] sha256rng dst, src1, src2 / / RF-type

[0143] src1: [Hold Gold Fold Eold Dold Cold Bold Aold]

[0144] src2: [wk23 wk22 wk21 wk20 wk19 wk18 wk17 wk16]

[0145] dst: [Hnew Gnew Fnew Enew Dnew Cnew Bnew Anew]

[0146] Among them, the sha256rng instruction contains 3 fields, indicating 3 registers respectively. Src1 is the first variable register that stores 8 variables to be iterated, which can also be called the first source register in this instruction. Hold Gold Fold Eold Dold Cold Bold Aold are the 8 variables h, g, f, e, d, c, b, a used in the SHA256 algorithm mentioned above. Sr2 is the result register that stores the addition result of message word W and message word K, which can also be called the second source register in this instruction. The above wk23 to wk16 are only exemplary. As iterative compression is executed, sr2 can store wk31 to wk24, wk39 to wk32, ... and so on. Among them, wk23 is W 23 +K 23 , wk22 is W 22 +K 22 , and so on. dst is the second variable register used to store the result of a SHA256 iterative compression of the eight variables to be iterated, and is also called the destination register in this instruction.

[0147] In two adjacent sha256rng instructions, the iterative compression result stored in dst in the previous sha256rng instruction is the eight variables to be iterated in the next iterative compression. In the example where the first variable register is different from the second variable register (dst≠src1), the first variable register in the previous sha256rng instruction can be used as the second variable register in the next sha256rng instruction, and the second variable register in the previous sha256rng instruction can be used as the first variable register in the next sha256rng instruction. This allows the use of three registers to complete multiple rounds of sha256 iterative compression without the need for data swapping between registers. In the example where the first and second variable registers are the same (dst=src1), the iterative results of variables e and a can be temporarily stored in an intermediate register, the variables in src1 can be left-shifted 32 bits, and then the iterative results of variables e and a can be copied back to the fourth and eighth variable positions in src1.

[0148] The iterative compression process of this embodiment based on the sha256rng instruction can be seen in Figure 5. The Ch, Maj, ∑0 and ∑1 shown in the figure represent operators for implementing the functions Ch(x, y, z), Maj(x, y, z), ∑0(x) and ∑1(x), respectively. The boxes with the "+" sign represent operators for implementing addition operations (i.e., adders). These operators can be designed in the processor and constitute the hardware part of the execution unit for implementing iterative compression. When iteratively compressing the iterative variables h, g, f, d, c, b in src1, it is not necessary to use operator operations. The iterative variables g, f, e, c, b, a in src1 are beat and saved in dst as the iteratively compressed variables h, g, f, d, c, b respectively.

[0149] The operators in Figure 5 are merely illustrative. The iterative compression implemented by these operators is described in the single-round iterative function described above for the data compression section of the SHA-256 algorithm, and will not be further elaborated here. However, there are many variations of iterative compression for the SHA-256 algorithm, and these operators can also use the operators used in these variations, not limited to the standard formula. Although these operators are connected to registers in the figure, in hardware implementation, the inputs and outputs of the iterative compression circuit formed by these operators can be connected to designated ports, and the registers specified in the instruction can be accessed through addressing.

[0150] The sha256rng instruction of this embodiment is an instruction in the reduced instruction set, and a round of iterative compression process is directly completed by hardware. Since the register of at least 256 bits used can directly accommodate the sum of all variables and message words required for calculation, no redundant operations are required, and this function can be implemented on the processor with a single instruction.

[0151] Because the sum of the message words used in two adjacent rounds of iterative compression differs, a right shift instruction must be executed after each sha256rng instruction, except for the sha256rng instruction used to perform the final iterative compression of SHA256. This shifts the data in the result register right by 32 bits, removing the last message word sum used from the register. The sum of the last message word stored in the result register after the right shift is the message word sum required for the next sha256rng instruction to perform iterative compression. In one example, the right shift instruction is represented as gfsrli gf10, gf10, 32, where gfsrli is the opcode for the right shift instruction, gf10 indicates the register to be right-shifted, and 32 indicates the number of bits to be right-shifted.

[0152] In one example, in a single compression cycle, four expansion instruction groups are executed to generate eight newly generated extended message words. These eight newly generated extended message words are then added to the corresponding fixed message words to obtain the sum of the eight message words. Then, eight compression instruction groups are executed to perform eight rounds of iterative compression on the SHA256 variable. In this example, the first and second variable registers of the compression instruction groups are different. The eight compression instruction groups can be represented as follows:

[0153] sha256rng gf34, gf33, gf10

[0154] gfsrli gf10,gf10,32

[0155] sha256rng gf33, gf34, gf10

[0156] gfsrli gf10,gf10,32

[0157] sha256rng gf34, gf33, gf10

[0158] gfsrli gf10,gf10,32

[0159] sha256rng gf33, gf34, gf10

[0160] gfsrli gf10,gf10,32

[0161] The sha256rng and gfsrli have been described above and will not be repeated here. The first variable register number is gf33 and the second variable register number is gf34. In adjacent compression instruction groups, the first variable register number and the second variable register number are interchanged.

[0162] In another example, the first variable register and the second variable register of the compressed instruction group are the same. In this case, the eight compressed instruction groups can be represented as follows:

[0163] sha256rng gf33, gf33, gf10

[0164] gfsrli gf10,gf10,32

[0165] sha256rng gf33, gf33, gf10

[0166] gfsrli gf10,gf10,32

[0167] sha256rng gf33, gf33, gf10

[0168] gfsrli gf10,gf10,32

[0169] sha256rng gf33, gf33, gf10

[0170] gfsrli gf10,gf10,32

[0171] The numbers of the first variable register and the second variable register are both gf33.

[0172] Compared with the aforementioned implementation scheme using a 128-bit register and two message word extension instructions for message word extension, the above-mentioned embodiment of the present disclosure more fully utilizes the advantages of a processor with a large bit-width register, so that the bit width of the operand is more in line with the characteristics of the algorithm itself, thereby requiring fewer instructions to complete the sha256 algorithm and improving processor utilization.

[0173] In the aforementioned implementation scheme, each round of operation indicated by an iterative compression instruction can complete two rounds of iterative compression, but it is not directly implemented by hardware at once internally, and needs to be decoded into microinstructions first. The actual time of the instruction operation is greater than the running time of one instruction. Each round of iterative compression in the above embodiment of the present disclosure executes an RND instruction (i.e., sha256rng instruction) once. The instruction execution device is a processor using a RISC architecture. The instructions used to perform SHA256 calculations are all instructions in the reduced instruction set, which can be directly implemented by hardware without decoding into microinstructions or microcodes. Therefore, the actual time consumption of the instructions is less than that of the aforementioned implementation scheme. In addition, in another embodiment of the present disclosure, after obtaining multiple extended message words, two or more rounds of iterative compression can also be achieved through an iterative compression instruction in the manner of the aforementioned implementation scheme. The present disclosure is not limited to this.

[0174] The above-mentioned embodiment of the present disclosure implements the SHA-256 algorithm based on a register of at least 256 bits, and designs the sha256msg (also expressed as SHA356MSG) instruction, sha256rng (also expressed as SHA256RNG) instruction and vadd32 instruction adapted to the 256-bit register to complete related operations, which can reduce the operation time and improve the utilization of the processor.

[0175] An embodiment of the present disclosure further provides a data processing system that can be used for secure hash algorithm SHA256, as shown in FIG6 , including: a bus 51;

[0176] The instruction execution device 53 described in any embodiment of the present disclosure is coupled to the bus; and

[0177] Dynamic random access memory DRAM 55 is coupled to bus 51 .

[0178] The present disclosure also provides a chip including a processor, wherein the processor can execute the secure hash algorithm SHA256 as the instruction execution device described in any embodiment of the present disclosure. The chip can integrate a memory controller unit and the processor to form a system on a chip.

[0179] An embodiment of the present disclosure further provides an instruction execution method that can be used for the secure hash algorithm SHA256, as shown in FIG7 , including:

[0180] Step 110: An instruction decoder receives and decodes an instruction for a SHA256 calculation, wherein the instruction includes a message word extension instruction. The message word extension instruction includes three fields, each of which indicates a first source register storing a first source operand, a second source register storing a second source operand, and a destination register for storing a destination operand.

[0181] Step 120: In response to the decoding result of the message word extension instruction, the execution unit performs a message word extension operation based on the first source operand stored in the first source register and the second source operand stored in the second source register, obtains a target operand including a newly generated message word, and stores the target operand in the target register.

[0182] Wherein, the first source register, the second source register and the destination register are all registers of at least 256 bits;

[0183] The first source operand includes eight 32-bit generated message words W j-9 , W j-10 ,...,W j-16 ;

[0184] The second source operand includes eight 32-bit generated message words W j-1 , Wj-2 ,...,W j-8 ;

[0185] The target operand includes N 32-bit newly generated message words and (8-N) 32-bit generated message words W j-1 , W j-2 ,...,W j+N-8 , j = 16, 17, ..., 63; N = 1 or 2, when N = 1, the newly generated message word is W j , when N=2, the newly generated message word is W j+1 , W j .

[0186] In an exemplary embodiment of the present disclosure, performing a message word extension operation based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a target operand including a newly generated message word and storing the target operand in the target register includes:

[0187] In the case of N=1, the following expansion operation is performed based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a newly generated message word W j and stored in dst[255:224]: W j =σ1(W j-2 )+W i-7 +σ0(W j-15 )+W j-16 ;

[0188] The generated message word W in the second source operand is j-1 , W j-2 ,...,W j-7 Stored to dst[223:192], dst[192:160], dst[159:128], dst[127:96], dst[95:64], dst[63:32] and dst[31:00] respectively; or including:

[0189] In the case of N=2, the following expansion operation is performed based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a newly generated message word W j+1 and stored in dst[255:224]: W j+1 =σ1(W j-1 )+W i-6 +σ0(W j-14 )+W j-15 ;

[0190] The following expansion operation is performed based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a newly generated message word W: j and stored in dst[223:192]: W j =σ1(W j-2 )+W i-7 +σ0(W j-15 )+W j-16 ;

[0191] The generated message word W in the second source operand is j-1 , W j-2 ,...,W j-6 Stored to dst[192:160], dst[159:128], dst[127:96], dst[95:64], dst[63:32] and dst[31:00] respectively;

[0192] Wherein, dst[n:m] represents the nth to mth bits of the destination register used to store the destination operand, the second source register is the same as or different from the destination register, and the first source register is different from the second source register and the destination register.

[0193] In an exemplary embodiment of the present disclosure, after decoding the message word extension instruction, the instruction decoder continues to decode the following received 256-bit computing instruction:

[0194] Left shift instruction, used to indicate that the data in the second source register is shifted left by k bits and padded with 0 on the right; when N=1, k=224; when N=2, k=192;

[0195] The right shift instruction is used to instruct the data in the first source register to be shifted right by 256-k bits and padded with 0 on the left;

[0196] A merge instruction is used to instruct to perform an OR operation on the data in the second source register after the left shift and the data in the first source register after the right shift, and the result is stored in the first source register;

[0197] After obtaining the target operand including the newly generated message word and storing it in the target register, the execution unit further responds to the decoding results of the left shift instruction, the right shift instruction and the merge instruction to perform a first source operand update operation, updating the first source operand in the first source register to W j+N-9 , W j+N-10 ,...,W j+N-16 ;

[0198] The message word extension instruction, left shift instruction, right shift instruction and merge instruction constitute an extended instruction group, and the SHA256 calculation instruction is an instruction of a reduced instruction set.

[0199] In an exemplary embodiment of the present disclosure, the instruction decoder decodes p consecutively received extended instruction groups, wherein the first source register, the second source register, and the target register in the same extended instruction group are different from each other, and in two adjacent extended instruction groups, the second source register in the previous extended instruction group serves as the target register in the next extended instruction group, the target register in the previous extended instruction group serves as the second source register in the next extended instruction group, and the first source register in the previous extended instruction group and the next extended instruction group are the same;

[0200] The execution unit responds to the decoding results of the p extended instruction groups, performs a message word expansion operation and a first source operand update operation, and obtains q newly generated message words W j+q-1 , W j+q-2 ,...,W j The target operand is stored in the target register; where, when N=1, 2≤p≤8, q=p; when N=2, 2≤p≤4, q=2p.

[0201] In an exemplary embodiment of the present disclosure, after decoding the p consecutively received extended instruction groups, the instruction decoder continues to decode a received addition instruction, wherein the addition instruction includes three fields for indicating the storage of W j+q-1 , W j+q-2 ,...,W j The target register stores q 32-bit fixed constants K j+q-1 , K j+q-2 , ..., K j A constant register for storing q addition results W j+q-1 +K j+q-1 , W j+q-2 +K j+q-2 ,...,W j +K j The execution unit also responds to the decoding result of the addition instruction, based on the W stored in the target register j+q-1 , W j+q-2 ,...,W j and K stored in the constant register j+q-1 , K j+q-2 , ..., K j Perform the addition operation and get the addition result W j+q-1 +K j+q-1 , W j+q-2 +K j+q-2,...,W j +K j and stored in the result register; wherein, the constant register and the result register are both 256-bit registers.

[0202] In an exemplary embodiment of the present disclosure, after decoding the received addition instruction, the instruction decoder continues to decode q compressed instruction groups received continuously, the first q-1 compressed instruction groups each include an iterative compression instruction and a right shift instruction, the qth compressed instruction group includes an iterative compression instruction, wherein: the iterative compression instruction includes 3 fields, respectively used to indicate the storage of W j+q-1 +K j+q-1 , W j+q-2 +K j+q-2 ,...,W j +K j a result register, a first variable register storing eight variables to be iterated, and a second variable register for storing a result of performing a SHA256 iterative compression on the eight variables to be iterated, wherein the right shift instruction is used to instruct to shift the data in the result register right by 32 bits;

[0203] The execution unit further performs iterative compression of variables and right shift of data in the result register in response to the decoding results of the q compression instruction groups, thereby obtaining 8 variables after q times of iterative compression;

[0204] In this embodiment, in two adjacent compression instruction groups, the first variable register in the previous compression instruction group serves as the second variable register in the next compression instruction group, and the second variable register in the previous compression instruction group serves as the first variable register in the next compression instruction group. The result registers in the two adjacent compression instruction groups are the same. In other embodiments, the first variable register and the second variable register in multiple compression instruction groups are the same and do not need to be changed.

[0205] In one or more exemplary embodiments above, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored as one or more instructions or codes on a computer-readable medium or transmitted via a computer-readable medium and executed by a hardware-based processing unit. The computer-readable medium may include a computer-readable storage medium corresponding to a tangible medium such as a data storage medium, or a communication medium that facilitates the transfer of a computer program from one place to another, such as according to a communication protocol. In this way, a computer-readable medium may generally correspond to a non-transitory tangible computer-readable storage medium or a communication medium such as a signal or carrier wave. The data storage medium may be any available medium that can be accessed by one or more computers or one or more processors to retrieve instructions, codes, and / or data structures for implementing the technology described in this disclosure. A computer program product may include a computer-readable medium.

[0206] In some aspects, the functionality described herein may be provided within dedicated hardware and / or software modules configured for encoding and decoding, or incorporated into a combined codec. Also, the techniques may be fully implemented in one or more circuits or logic elements.

[0207] The technical solutions of the embodiments of the present disclosure can be implemented in a wide variety of devices or equipment, including wireless mobile phones, integrated circuits (ICs), or a group of ICs (e.g., chipsets). Various components, modules, or units are described in the embodiments of the present disclosure to emphasize the functional aspects of the devices configured to perform the described techniques, but they do not necessarily need to be implemented by different hardware units. Instead, as described above, the various units can be combined in a codec hardware unit or provided by a collection of interoperable hardware units (including one or more processors as described above) in combination with appropriate software and / or firmware.

Claims

1. An instruction execution device that can be used for secure hash algorithm SHA256, wherein: include: Multiple registers of at least 256 bits; an instruction decoder, configured to receive and decode an instruction for SHA256 calculation, the instruction comprising a message word extension instruction, the message word extension instruction comprising three fields for respectively indicating a first source register storing a first source operand, a second source register storing a second source operand, and a target register for storing a target operand; an execution unit, coupled to the instruction decoder, configured to, in response to a decoding result of the message word extension instruction, perform a message word extension operation based on the first source operand stored in the first source register and the second source operand stored in the second source register, obtain a target operand including a newly generated message word and store it in a target register; Wherein, the first source register, the second source register and the target register are all registers of at least 256 bits; The first source operand includes eight 32-bit generated message words W j-9 , W j-10 , ..., W j-16 ; The second source operand includes eight 32-bit generated message words W j-1 , W j-2 , ..., W j-8 ; The target operand includes N 32-bit newly generated message words and (8-N) 32-bit generated message words W j-1 , W j-2 , ..., W j+N-8 , j = 16, 17, ..., 63; N = 1 or 2, when N = 1, the newly generated message word is W j , when N=2, the newly generated message word is W j+1 , W j .

2. The instruction execution device according to claim 1, wherein: In the case where N=1, performing a message word extension operation based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a target operand including a newly generated message word and store it in a target register comprises: The following expansion operation is performed based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a newly generated message word W: i and stored in dst[255:224]: IN j =σ1(W j-2 )+W i-7 +σ0(W j-15 )+W j-16 ; The generated message word W in the second source operand is j-1 , W j-2 , ..., W j-7 Stored to dst[223:192], dst[192:160], dst[159:128], dst[127:96], dst[95:64], dst[63:32] and dst[31:00] respectively; Among them, dst[n:m] represents the nth to mth bits of the target register used to store the target operand, the second source register is the same as or different from the target register, and the first source register is different from the second source register and the target register.

3. The instruction execution device according to claim 1, wherein: In the case of N=2, the first source operand stored in the first source register and the second source register stored in the first source register are The method further comprises: performing a message word extension operation on the second source operand stored in the storage to obtain a target operand including a newly generated message word and storing it in a target register, comprising: The following expansion operation is performed based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a newly generated message word W: j+1 and stored in dst[255:224]: IN j+1 =σ1(W j-1 )+W i-6 +σ0(W j-14 )+W j-15 ; The following expansion operation is performed based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a newly generated message word W: i and stored in dst[223:192]: IN j =σ1(W j-2 )+W i-7 +σ0(W j-15 )+W j-16 ; The generated message word W in the second source operand is j-1 , W j-2 , ..., W j-6 Stored to dst[192:160], dst[159:128], dst[127:96], dst[95:64], dst[63:32] and dst[31:0] respectively; Among them, dst[n:m] represents the nth to mth bits of the target register used to store the target operand, the second source register is the same as or different from the target register, and the first source register is different from the second source register and the target register.

4. The instruction execution device according to claim 1, wherein: The instruction decoder is further configured to continue decoding the following SHA256 calculation instructions received after decoding the message word extension instruction: The left shift instruction is used to indicate that the data in the second source register is shifted left by k bits and filled with 0 on the right; when N=1, k=224; when N=2, k=192; The right shift instruction is used to instruct the data in the first source register to be shifted right by 256-k bits and filled with 0 on the left; A merge instruction, used to instruct to perform an "OR" operation on the data in the second source register after the left shift and the data in the first source register after the right shift, and the result is stored in the first source register; The execution unit is further configured to, after obtaining the target operand including the newly generated message word and storing it in the target register, respond to the decoding results of the left shift instruction, the right shift instruction and the merge instruction to perform a first source operand update operation, updating the first source operand in the first source register to W j+N-9 , W j+N-10 , ..., W j+N-16 ; The message word extension instruction, left shift instruction, right shift instruction and merge instruction constitute an extended instruction group; the SHA256 calculation instruction is an instruction of a reduced instruction set.

5. The instruction execution device according to claim 4, wherein: The instruction decoder is configured to decode p consecutively received extended instruction groups, wherein the first source register, the second source register and the target register in the same extended instruction group are different from each other, and in two adjacent extended instruction groups, the second source register in the previous extended instruction group is used as the target register in the next extended instruction group, and the previous extended instruction group is used as the target register. The target register in the instruction group is used as the second source register in the next extended instruction group, and the first source register in the previous extended instruction group and the next extended instruction group are the same; The execution unit is configured to respond to the decoding results of the p extended instruction groups, perform a message word extension operation and a first source operand update operation, and obtain q newly generated message words W j+q-1 , W j+q-2 , ..., W j The destination operand is stored in the destination register; Among them, when N=1, 2≤p≤8, q=p; when N=2, 2≤p≤4, q=2p.

6. The instruction execution device according to claim 5, wherein: The instruction decoder is further configured to continue decoding a received addition instruction after decoding p consecutively received extended instruction groups, wherein the addition instruction includes three fields for indicating the storage of W j+q-1 , W j+q-2 , ..., W j The destination register stores q 32-bit constants K j+q-1 , K j+q-2 , ..., K j A constant register for storing q addition results W j+q-1 +K j+q-1 , W j+q-2 +K j+q-2 , ..., W j +K j The result register; The execution unit is further configured to respond to the decoding result of the addition instruction and to perform the addition operation based on the W stored in the target register. j+q-1 , W j+q-2 , ..., W j and constant registers storing K j+q-1 , K j+q-2 , ..., K j Perform the addition operation and get the addition result W j+q-1 +K j+q-1 , W j+q-2 +K j+q-2 , ..., W j +K j and stored in the result register; Wherein, the constant register and the result register are both registers of at least 256 bits.

7. The instruction execution device according to claim 6, wherein: The instruction decoder is further configured to continue decoding q compressed instruction groups received continuously after decoding the received addition instruction, wherein the first q-1 compressed instruction groups each include an iterative compression instruction and a right shift instruction, and the qth compressed instruction group includes an iterative compression instruction, wherein: the iterative compression instruction includes 3 fields, which are respectively used to indicate the storage of W j+q-1 +K j+q-1 , W j+q-2 +K j+q-2 , ..., W j +K j a result register, a first variable register storing eight variables to be iterated, and a second variable register for storing a result of performing a SHA256 iterative compression on the eight variables to be iterated, wherein the right shift instruction is used to instruct to shift the data in the result register right by 32 bits; The execution unit is further configured to respond to the decoding results of the q compression instruction groups, perform iterative compression of variables and right shift operations on data in the result register, and obtain 8 variables after q times of iterative compression; Among them, in two adjacent compression instruction groups, the first variable register in the previous compression instruction group serves as the second variable register in the next compression instruction group, and the second variable register in the previous compression instruction group serves as the first variable register in the next compression instruction group, and the result registers in the two adjacent compression instruction groups are the same.

8. A data processing system for secure hash algorithm SHA256, wherein: include: bus; The instruction execution device according to any one of claims 1 to 7, coupled to the bus; and a dynamic random access memory DRAM coupled to the bus.

9. A chip comprising a processor, wherein: The processor is capable of executing the secure hash algorithm SHA256 as the instruction execution device according to any one of claims 1 to 7.

10. A method for executing instructions that can be used for secure hash algorithm SHA256, comprising: The instruction decoder receives and decodes an instruction for SHA256 calculation, wherein the instruction includes a message word extension instruction, and the message word extension instruction includes three fields for respectively indicating a first source register storing a first source operand, a second source register storing a second source operand, and a target register for storing a target operand; The execution unit performs a message word extension operation based on the first source operand stored in the first source register and the second source operand stored in the second source register in response to the decoding result of the message word extension instruction, obtains a target operand including a newly generated message word and stores it in a target register; Wherein, the first source register, the second source register and the target register are all registers of at least 256 bits; The first source operand includes eight 32-bit generated message words W j-9 , W j-10 , ..., W j-16 ; The second source operand includes eight 32-bit generated message words W j-1 , W j-2 , ..., W j-8 ; The target operand includes N 32-bit newly generated message words and (8-N) 32-bit generated message words W j-1 , W j-2 , ..., W j+N-8 , j = 16, 17, ..., 63, N = 1 or 2, when N = 1, the newly generated message word is W j , when N=2, the newly generated message word is W j+1 , W j .

11. The instruction execution method according to claim 10, wherein: The method of performing a message word extension operation based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a target operand including a newly generated message word and store it in a target register comprises: In the case of N=1, the following expansion operation is performed based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a newly generated message word W j and stored in dst[255:224]: IN j =σ1(W j-2 )+W i-7 +σ0(W j-15 )+W j-16 ; The generated message word W in the second source operand is j-1 , W j-2 , ..., W j-7 Stored to dst[223:192], dst[192:160], dst[159:128], dst[127:96], dst[95:64], dst[63:32] and dst[31:00] respectively; Or include: In the case of N=2, the following expansion operation is performed based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a newly generated message word W j+1 and stored in dst[255:224]: IN j+1 =σ1(W j-1 )+W i-6 +σ0(W j-14 )+W j-15 ; The following expansion operation is performed based on the first source operand stored in the first source register and the second source operand stored in the second source register to obtain a newly generated message word W: j and stored in dst[223:192]: IN j =σ1(W j-2 )+W i-7 +σ0(W j-15 )+W j-16 ; The generated message word W in the second source operand is j-1 , W j-2 , ..., W j-6 Stored to dst[192:160], dst[159:128], dst[127:96], dst[95:64], dst[63:32] and dst[31:00] respectively; Among them, dst[n:m] represents the nth to mth bits of the target register used to store the target operand, the second source register is the same as or different from the target register, and the first source register is different from the second source register and the target register.

12. The instruction execution method according to claim 11, wherein: After decoding the message word extension instruction, the instruction decoder continues to decode the following SHA256 calculation instruction received: The left shift instruction is used to indicate that the data in the second source register is shifted left by k bits and filled with 0 on the right; when N=1, k=224; when N=2, k=192; The right shift instruction is used to instruct the data in the first source register to be shifted right by 256-k bits and filled with 0 on the left; A merge instruction, used to instruct to perform an "OR" operation on the data in the second source register after the left shift and the data in the first source register after the right shift, and the result is stored in the first source register; After obtaining the target operand including the newly generated message word and storing it in the target register, the execution unit further responds to the decoding results of the left shift instruction, the right shift instruction and the merge instruction to perform a first source operand update operation, updating the first source operand in the first source register to W j+N-9 , W j+N-10 , ..., W j+N-16 ; The message word extension instruction, left shift instruction, right shift instruction and merge instruction constitute an extended instruction group; the SHA256 calculation instruction is an instruction of a reduced instruction set.

13. A non-transitory computer-readable storage medium storing computer instructions, wherein: When the computer instructions are executed by a machine, the machine executes the instruction execution method according to any one of claims 10 to 12.

Images