Hardware accelerator for cryptographic hash operations

In an embodiment, a processor includes a hardware accelerator to receive a message to be processed using the cryptographic hash algorithm; store a plurality of digest words in a plurality of digest registers; perform a plurality of rounds of the cryptographic hash algorithm, where the plurality of rounds is divided into first and second sets of rounds; in each cycle of each round in the first set, use W bits from the first digest register for a first function and use N bits from the second digest register for a second function; in each cycle of each round in the second set, use W bits from the second digest register for the first function and use N bits from the first digest register for the second function. Other embodiments are described and claimed.

FIELD OF INVENTION

Embodiments relate generally to cryptography. More particularly, embodiments are related to cryptographic hash operations using a hardware accelerator.

BACKGROUND

Cryptographic hash functions are mathematical operations that are applied to digital data, and which can provide authentication of the digital data. For example, cryptographic hash functions may be used for digital signatures, message authentication codes (MACs), entropy extraction, and so forth. Some types of cryptographic hash algorithms include Secure Hash Algorithm 0 (SHA-0), SHA-1, SHA-2, and SHA-3.

DETAILED DESCRIPTION

The Secure Hash Algorithm 2 (SHA-2) family is a set of cryptographic hash functions standardized by the American National Institute of Standards and Test (NIST). For example, the standard of the SHA-2 family is described in Federal Information Processing Standard (FIPS) Publication 180-4. The SHA-2 family includes SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. Conventionally, devices that perform a SHA-2 algorithm include hardware elements that are sized to process a full datapath for that algorithm. For example, the SHA-256 algorithm conventionally uses a 32-bit datapath, and iteratively combines a 256-bit digest with a 512-bit message over sixty-four rounds of computation. In another example, the SHA-512 algorithm conventionally uses a 64-bit datapath, and iteratively combines a 512-bit digest with a 1024-bit message over eighty rounds of computation. However, the circuit area and power required to process the entire datapath may limit the applications or devices that incorporate SHA-2 algorithms.

In accordance with some embodiments, a hardware cryptographic accelerator may process a SHA-2 algorithm using reduced datapaths. In some embodiments, the cryptographic accelerator can perform SHA-2 operations using reduced datapaths in multiple cycles of each round. The use of a smaller datapath may reduce the circuit area and power consumption to perform the SHA-2 algorithm. In some embodiments, the cryptographic accelerator may be incorporated into small and/or simplified devices (e.g., intelligent appliances, wearable computers, etc.).

Although the following embodiments are described with reference to particular implementations, embodiments are not limited in this regard. In particular, it is contemplated that similar techniques and teachings of embodiments described herein may be applied to other types of circuits, semiconductor devices, processors, systems, etc. For example, the disclosed embodiments may be implemented in any type of computer system, including server computers (e.g., tower, rack, blade, micro-server and so forth), communications systems, storage systems, desktop computers of any configuration, laptop, notebook, and tablet computers (including 2:1 tablets, phablets and so forth).

In addition, disclosed embodiments can also be used in other devices, such as handheld devices, systems on chip (SoCs), and embedded applications. Some examples of handheld devices include cellular phones such as smartphones, Internet protocol devices, digital cameras, personal digital assistants (PDAs), and handheld PCs. Embedded applications may typically include a microcontroller, a digital signal processor (DSP), network computers (NetPC), set-top boxes, network hubs, wide area network (WAN) switches, wearable devices, or any other system that can perform the functions and operations taught below. Further, embodiments may be implemented in mobile terminals having standard voice functionality such as mobile phones, smartphones and phablets, and/or in non-mobile terminals without a standard wireless voice function communication capability, such as many wearables, tablets, notebooks, desktops, micro-servers, servers and so forth.

Referring now toFIG. 1A, shown is a block diagram of a system100in accordance with one or more embodiments. In some embodiments, the system100may be all or a portion of an electronic device or component. For example, the system100may be a cellular telephone, a computer, a server, a network device, a system on a chip (SoC), a controller, a wireless transceiver, a power supply unit, etc. Furthermore, in some embodiments, the system100may be any grouping of related or interconnected devices, such as a datacenter, a computing cluster, etc.

As shown inFIG. 1A, the system100may include a processor110operatively coupled to system memory105. Further, although not shown inFIG. 1A, the system100may include other components. The processor110may be a general purpose hardware processor (e.g., a central processing unit (CPU)). As shown, the processor110can include any number of processing cores115and a cryptographic accelerator118. Each core115may be a general purpose processing core. The system memory105can be implemented with any type(s) of computer memory (e.g., dynamic random access memory (DRAM), static random-access memory (SRAM), non-volatile memory (NVM), a combination of DRAM and NVM, etc.).

In one or more embodiments, the cryptographic accelerator118may be a hardware unit dedicated to performing cryptographic hash operations. For example, the cryptographic accelerator118may be any hardware unit such as a cryptographic co-processor, a plug-in card, a module, a chip, a processing block, etc. The cryptographic accelerator118may perform cryptographic hash operations on input data. For example, in some embodiments, the cryptographic accelerator118may perform functions based on one or more SHA-2 algorithms (e.g., the SHA-256 algorithm). Further, the cryptographic accelerator118may perform cryptographic hash operations using a reduced datapath size N. For example, the cryptographic accelerator118may perform a SHA-2 algorithm using a 2-bit datapath, a 4-bit datapath, an 8-bit datapath, and so forth. In some embodiments, the cryptographic accelerator118may perform cryptographic hash operations in multiple rounds that are each divided into a number of cycles.

Referring now toFIG. 1B, shown is a block diagram of an accelerator120in accordance with one or more embodiments. The accelerator120is an example corresponding generally to the cryptographic accelerator118(shown inFIG. 1A). In particular, the accelerator120may be an example implementation for performing a SHA-256 algorithm using a 4-bit datapath. It is noted thatFIG. 1Billustrates an example, and is not intended to limit embodiments.

As shown inFIG. 1B, the accelerator120may include digest registers121, digest logic125, message registers123, expander logic127, a first switch122, and a second switch124. Each of the digest registers121can each store a digest word of W bits (referred to herein as “word size”). Further, each of the message registers123can each store a message word of W bits.

As discussed above,FIG. 1Billustrates an example of an accelerator120to perform the SHA-256 algorithm using a 4-bit datapath. Accordingly, the digest registers121is shown inFIG. 1Bto have a total size of 256-bit, and to include eight registers (identified as A0, A1, C, D, E0, E1, G, and H) that each store a digest word with a 32-bit word size. Further, the message registers123is shown inFIG. 1Bto have a total capacity of 512-bit, and to include sixteen registers (identified as [0] to [15]) that each store a message word with a 32-bit word size.

In some embodiments, the accelerator120may perform cryptographic hash operations in multiple rounds, with each round including a number C of processing cycles. The number C of cycles in a round may be based on the word size W and/or the datapath size N. For example, in some embodiments, the number of cycles C may be equal to the word size W divided by the datapath size N. Referring to the example shown inFIG. 1B, assume that the accelerator120uses a word size W of 32-bit and a datapath size N of 4-bit. Accordingly, in the example shown inFIG. 1B, each round may include a number C of eight cycles.

As shown, in an initial round of the SHA-256 algorithm, the first switch122may provide an initial state value to the digest registers121. Further, the second switch124may provide a received message to the message registers123. In some embodiments, in each round, the digest logic125consumes the 256-bit digest stored in the digest registers121, the 32-bit message word [15], and a 32-bit constant Kt. Further, the digest logic125generates a new 256-bit digest. As shown, the new 256-bit digest is stored in the digest registers121via the first switch122. The operations performed by the digest logic125are described further below with reference toFIGS. 1C-1D.

In some embodiments, in each round, the expander logic127consumes four messages words [1], [6], [14], and [15], totaling 128-bit. Further, the expander logic127generates a new 32-bit message word. As shown, the new 32-bit message word is stored in the message registers123via the second switch124. The operations performed by the expander logic127are described further below with reference toFIG. 1E.

Referring now toFIG. 1C, shown is a block diagram130in accordance with one or more embodiments. The diagram130may correspond generally to the example shown inFIG. 1B. Specifically, the diagram130shows examples of the digest logic125and the digest registers121corresponding to the accelerator120using a SHA-256 algorithm and a 4-bit datapath. It is noted thatFIG. 1Cillustrates an example, and is not intended to limit embodiments.

As shown inFIG. 1C, the digest logic125may include inputs to receive digest words A, B, C, D, E, F, G, and H. In some embodiments, the A input receives the full 32-bit A digest word in each cycle of each round. Similarly, the E input receives the full 32-bit E digest word in each cycle. In contrast, the B, C, D, F, G, and H inputs only receive 4-bit portions of their corresponding digest words (i.e., the digest words stored in C digest register133, D digest register134, G digest register137, and H digest register138, respectively), in accordance with the reduced 4-bit datapath used in the example shown inFIG. 1C. The use of inputs A to H by the digest logic125is described further below with reference toFIG. 1D.

As shown inFIG. 1C, the data inputs and outs of A0 digest register131, A1 digest register132, E0 digest register135, and E1 digest register136are controlled by switches according to the control signal “R.” In some embodiments, the control signal “R” may be a binary signal to indicate whether the current round is even-numbered or odd-numbered. For example, in some embodiments, the control signal “R” may have a value of “1” when the current round is even-numbered, and may have a value of “0” when the current round is odd-numbered.

In some embodiments, the A0 digest register131and the A1 digest register132may alternate between storing digest word A and digest word B based on whether the current round has an even or an odd number. For example, in some embodiments, during an even-numbered round, the A0 digest register131may store digest word A and the A1 digest register132may store digest word B. Further, in such embodiments, during an odd-numbered round, the A0 digest register131may store digest word B and the A1 digest register132may store digest word A. As shown inFIG. 1C, the control signal “R” causes the switches connected to the outputs of the A0 digest register131and the A1 digest register132to provide the A and B words respectively to the A input and the B input of the digest logic125.

In some embodiments, the E0 digest register135and the E1 digest register136may alternate between storing a digest word E and digest word F based on whether the current round has an even or an odd number. For example, in some embodiments, during an even-numbered round, the E0 digest register135may store digest word E and the E1 digest register136may store digest word. Further, in such embodiments, during an odd-numbered round, the E0 digest register135may store digest word F and the E1 digest register136may store digest word E. As shown inFIG. 1C, the control signal “R” causes the switches connected to the outputs of the E0 digest register135and the E1 digest register136to provide the E and F words respectively to the E input and the F input of the digest logic125.

In some embodiments, the digest logic125may produce the 4-bit values A-New and E_new in each cycle. The A_New value is provided to the digest register that is currently storing digest word B (i.e., either the A0 digest register131or the A1 digest register132, depending on whether the round is odd or even). Further, the digest word B may be right-shifted by 4-bit, and the A_New value can be added to the most-significant bit portion of the digest word B. The least-significant 4-bit portion of the digest word B may be right-shifted into digest word C. The least-significant 4-bit portion of the digest word C may be right-shifted into digest word D.

In some embodiments, the digest register that is currently storing digest word A (i.e., either the A0 digest register131or the A1 digest register132) may perform a circular shift of 4-bit, such that the least significant 4-bit portion of digest word A is shifted back to the most significant 4-bit portion of digest word A. Thus, at the end of each round (e.g., 8 cycles), the digest word A returns to the same value as the start of the round.

In some embodiments, the E_New value is provided to the digest register that is currently storing digest word F (i.e., either the E0 digest register135or the E1 digest register136, depending on whether the round is odd or even). Further, the digest word F may be right-shifted by 4-bit, and the E_New value may be added to the most-significant bit portion of the digest word F. The least-significant 4-bit portion of the digest word F may be right-shifted into digest word G. The least-significant 4-bit portion of the digest word G may be right-shifted into digest word H.

In some embodiments, the digest register that is currently storing digest word E (i.e., either the E0 digest register135or the E1 digest register136) may perform a circular shift of 4-bit, such that the least significant 4-bit portion of digest word E is shifted back to the most significant 4-bit portion of digest word E. Thus, at the end of each round, the digest word E returns to the same value as the start of the round.

In some embodiments, the digest logic125may generate a 3-bit carry A value in each cycle. The carry A value may be stored in the Carry_A register139, and may be provided back to the digest logic125in the next cycle. Further, the digest logic125may also generate a 3-bit carry E value in each cycle. The carry E value may be stored in the Carry_E register140, and may be provided back to the digest logic125in the next cycle. At the end of eight cycles, the Carry_A register139and the Carry_E register140may be cleared to discard the respective carry values.

It is noted that the various 4-bit values discussed above with reference toFIG. 1Care in accordance with the datapath size N of 4-bit used in the example illustrated inFIG. 1C. Thus, it is contemplated that in embodiments using a different datapath size N, the various values described as 4-bit values with reference toFIG. 1Cmay also use the different datapath size N. For example, in embodiments using a different datapath size N of 2-bit, the B, C, D, F, G, and H inputs of the digest logic125may receive 2-bit portions of their corresponding digest words. Further, in such embodiments, the least-significant 2-bit portion of the digest word B may be right-shifted into digest word C, and the least-significant 2-bit portion of the digest word C may be right-shifted into digest word D. Furthermore, the carry values used by the digest logic125may be varied accordingly. Other variations in accordance to the datapath size N may be used and are contemplated herein.

Referring now toFIG. 1D, shown is a diagram150in accordance with one or more embodiments. The diagram150may correspond generally to the examples described above with reference toFIGS. 1B-1C. Specifically, the diagram150shows example operations of the digest logic125using a SHA-256 algorithm and a 4-bit datapath. It is noted thatFIG. 1Dillustrates an example, and is not intended to limit embodiments.

In some embodiments, the digest logic125may perform various functions in accordance with the SHA-2 standard. For example, referring toFIG. 1D, in each cycle, all 32-bit of digest word A are processed in the Σ0function151, which includes a series of shift and rotate operations followed by XOR. Further, in each cycle, the Maj function152includes logic operations on 4-bit portions of digest words A, B, and C. The outputs of the Σ0function151and the Maj function152are summed by addition153to provide value T2.

As shown, in each cycle, 32-bit of digest word E are processed in the Σ1function155, which also performs a series of shift and rotate operations followed by XOR. Further, in each cycle, the Ch function156performs logic operations on 4-bit portions of digest words E, F, and G. Furthermore, 4-bit portions of digest word H, message portion Mp, and constant portion Kp are summed by addition157. In some embodiments, the message portion Mp is the least significant 4-bit stored in message register [15], and the constant portion Kp is a 4-bit portion of the 32-bit constant Kt. As shown, the outputs of the addition157, the Σ1function155, and the Ch function156are summed by addition158to provide the T1 value.

In each cycle, a 4-bit portion of digest word D, the value T1, and a Carry_in_E value (from the Carry_E register140shown inFIG. 1C) are summed by addition159to generate the 4-bit E_New value (to be stored in the digest register that currently includes digest word F) and the 3-bit Carry_out_E value (to be stored in the Carry_E register140). Further, in each cycle, the T1 value, the T2 value, and the Carry_in_A value (from the Carry_A register139shown inFIG. 1C) are summed by addition154to generate the 4-bit A_New value (to be stored in the digest register that currently includes digest word B) and the 3-bit Carry_out_A value (to be stored in the Carry_A register139). In some embodiments, each of the additions153,154,157,158, and159is a 232modulo addition.

In some embodiments, the Ch function156may be formulated as:
Ch(x,y,z)=(xΛy)+(xΛz).

Further, in some embodiments, the Maj function152may be formulated as:
Maj(x,y,z)=(xΛy)+(xΛz)+(yΛz).

Assume that the “+” in the above functions may represent a 232modulo addition.

In some embodiments, the constant portion Kp may be obtained by shifting by 4-bit across a register or memory location storing the 32-bit constant Kt. Alternatively, in some embodiments, the constant portion Kp may be newly generated each cycle as a 4-bit value by a dedicated logic circuit.

It is noted that the various 4-bit values discussed above with reference toFIG. 1Dare in accordance with the datapath size N of 4-bit used in the example illustrated inFIG. 1D. Thus, it is contemplated that in embodiments using a different datapath size N, the various values described as 4-bit values with reference toFIG. 1Dmay also use the different datapath size N. Other variations in accordance to the datapath size N may be used and are contemplated herein.

Referring now toFIG. 1E, shown are diagrams of examples of SHA-2 functions in accordance with one or more embodiments. Specifically,FIG. 1Eillustrates examples of the Σ1function155performed by the digest logic125.

When performing a SHA-256 algorithm using a 4-bit datapath, the digest logic125may perform the Σ1function155by right-rotating the 32-bit digest word E by 4-bit each cycle within a 32-bit register. At cycle 0, the Σ1function155may be formulated as follows:
Σ1(E)=E[9:6]XORE[14:11]XORE[28:25]

Similarly, as shown inFIG. 1E, in each subsequent cycle, the 32-bit word E is right-rotated by 4-bit within a 32-bit register. As such, in some embodiments, the 4-bit portions of the digest word E are automatically aligned for each cycle of the Σ1function155. The output of the Σ1function155each cycle is 4-bit.

Further, the digest word A may also be right-rotated by 4-bit for each cycle within a 32-bit register. Therefore, in some embodiments, the 4-bit portions of the digest word A are automatically aligned for each cycle of the Σ0function151. The output of the Σ0function151each cycle is 4-bit.

It is noted that the various 4-bit values discussed above with reference toFIG. 1Eare in accordance with the datapath size N of 4-bit used in the example illustrated inFIG. 1E. Thus, it is contemplated that in embodiments using a different datapath size N, the various values described as 4-bit values with reference toFIG. 1Emay also use the different datapath size N. Other variations in accordance to the datapath size N may be used and are contemplated herein.

Referring now toFIG. 1F, shown is a diagram160in accordance with one or more embodiments. The diagram160may correspond generally to the example shown inFIG. 1B. Specifically, the diagram160shows examples of the expander logic127and the message registers123corresponding to the accelerator120using a SHA-256 algorithm and a 4-bit datapath. It is noted thatFIG. 1Fillustrates an example, and is not intended to limit embodiments.

As shown inFIG. 1F, in each cycle, the expander logic127may receive the full 32-bit message words W1and W14(i.e., the message words stored in message registers [1] and [14]). The expander logic127may also receive 4-bit portions of message words W6and W15(i.e., the message words stored in message registers [6] and [15]). The expander logic127may perform the SHA-2 functions σ0and σ1using the 32-bit message words W1and W14. Further, the expander logic127may perform a 232modulo addition of functions σ0and σ1and message words W6and W15. In each cycle, a circular-shift of 4-bit may be performed for each of the W1, W6, W14, and W15message words.

In each cycle, the expander logic127may also generate a 2-bit carry value. The 2-bit carry value is stored in the carry register165, and is used by the expander logic127during the next cycle in the same round. Note that the 2-bit size of the carry value and the carry register165corresponds to the 4-bit datapath used in the example shown inFIG. 1F. As such, the bit size of the carry value and the carry register165may vary according to the datapath size used by the accelerator120. In some embodiments, the carry register165may be cleared at the end of each round (e.g., after 8 cycles).

In each cycle, the expander logic127may generate 4-bit portions of a new message word. In the first seven cycles of a round, the generated portions of the new message may be stored in the temporary message register167with a 28-bit capacity. In the eighth cycle of the round, the contents of the temporary message register167and the new 4-bit portion may be combined to form a new 32-bit message word. Further, in the eighth cycle of the round, the new message word is stored in message register [0], and the message words previously stored in each register are shifted to the next higher message register (e.g., from message register [0] to [1], from message register [1] to [2], and so on). At the end of the round (i.e., after the eighth cycle of the round), the carry value in the carry register165and the message word in message register [15] may be set to zero.

In some embodiments, the expander logic127may perform a SHA-256 algorithm using the following functions:
σ0(x)=ROTR7(x)+ROTR18(x)+SHR3(x)
σ1(x)=ROTR17(x)+ROTR19(x)+SHR3(x)
SHRn(x)=x>>n
ROTRn(x)=(x>>n)v(x<<(32−n))

Assume that the “+” in the above functions may represent a 232modulo addition. In some embodiments, the 232modulo additions may be implemented by adding N bits every clock cycle, using carry bits, and clearing the carry bits every round (i.e., after C cycles).

It is noted that the various 4-bit values discussed above with reference toFIG. 1Fare in accordance with the datapath size N of 4-bit used in the example illustrated inFIG. 1F. Thus, it is contemplated that in embodiments using a different datapath size N, the various values described as 4-bit values with reference toFIG. 1Fmay also use the different datapath size N. Further, the number C of cycles in a round and/or the 2-bit carry values used by the expander logic127may be varied according to the datapath size N. Other variations in accordance to the datapath size N may be used and are contemplated herein.

It is further noted that the examples discussed above with reference toFIGS. 1B-1Fare in accordance with the use of the SHA-256 algorithm. However, it is contemplated that some embodiments may use other SHA-2 algorithms, and thus various bit sizes described above with reference toFIGS. 1B-1Fmay be varied in accordance to the SHA-2 algorithm that is used. For example, in embodiments using the SHA-512 algorithm, it is contemplated that each digest word and message word may include 64-bit. Further, in such embodiments, the number of rounds may be eighty. Furthermore, the carry values used by the digest logic125and/or the expander logic127may be varied accordingly. Other variations in accordance to the SHA-2 algorithm being used are contemplated herein.

It is also noted that, whileFIGS. 1A-1Fshow various examples, embodiments are not limited in this regard. In particular, it is contemplated that the system100and/or the accelerator120may include different components, additional components, different arrangements of components, and/or different numbers of components than shown inFIGS. 1A-1F. For example, referring toFIG. 1A, it is contemplated that the cryptographic accelerator118may be included in each core115, or may be external to the processor110. Other variations are contemplated and may be used in various embodiments.

Referring now toFIG. 2A, shown is a sequence200in accordance with one or more embodiments. In some embodiments, the sequence200may be implemented by the cryptographic accelerator118shown inFIG. 1A. The sequence200may be implemented in hardware, software, and/or firmware. In hardware embodiments it may be implemented as circuitry and/or micro-architecture. Further, in firmware and software embodiments, it may be implemented by computer executed instructions stored in a non-transitory machine readable medium, such as an optical, semiconductor, or magnetic storage device. The machine readable medium may store data, which if used by at least one machine, causes the at least one machine to fabricate at least one integrated circuit to perform a method. For the sake of illustration, the steps involved in the sequence200may be described below with reference toFIGS. 1A-1F, which show examples in accordance with some embodiments. However, the scope of the various embodiments discussed herein is not limited in this regard.

At block202, a cryptographic accelerator may receive message data to be processed using a SHA-2 algorithm. For example, referring toFIG. 1A, the cryptographic accelerator118may receive data to be processed using a SHA-2 algorithm.

At block204, a set of digest words may be stored in digest registers. For example, referring toFIG. 1B, the digest words A to H may be stored in the digest registers121. In some embodiments, the set of digest words may be obtained from an initial state value provided to the digest registers121.

At block206, a plurality of processing rounds may be performed. Each round can include a plurality of cycles, and the plurality of rounds can be divided into a first set and a second set. For example, referring toFIG. 1C, the accelerator120can perform 64 rounds of the SHA-256 algorithm, with each round being divided into 8 cycles. The rounds can be divided into even-numbered rounds and odd-numbered rounds. In some embodiments, the control signal “R” (shown inFIG. 1C) may indicate whether the current round is even or odd numbered.

At block207, in each cycle of each round of the first set of rounds, W bits from first digest register A0 are used for a Σ0function, and N bits from second digest register A1 are used for a Maj function. For example, referring toFIGS. 1C-1D, assume that the first set of rounds includes even-numbered rounds, and that the second set of rounds includes odd-numbered rounds. Assume further that, in the first set of rounds (e.g., in an even-numbered round), the A0 digest register131stores the digest word A, and the A1 digest register132stores the digest word B. Further, the Σ0function151may consume the full 32-bit of the digest word A that is currently stored in the A0 digest register131. Furthermore, the Maj function152may consume a 4-bit portion of the digest word B that is currently stored in the A1 digest register132.

At block208, in each cycle of each round of the first set of rounds, W bits from third digest register E0 are used for a Σ1function, and N bits from fourth digest register E1 are used for a Ch function. For example, referring toFIGS. 1C-1D, assume that, in the first set of rounds, the E0 digest register135stores the digest word E, and the E1 digest register136stores the digest word F. Further, the Σ1function155may consume the full 32-bit of the digest word E that is currently stored in the E0 digest register135. Furthermore, the Ch function156may consume a 4-bit portion of the digest word F that is currently stored in the E1 digest register136.

At block209, in each cycle of each round of the second set of rounds, W bits from second digest register A1 are used for the Σ0function, and N bits from the first digest register A0 are used for the Maj function. For example, referring toFIGS. 1C-1D, assume that, in the second set of rounds (e.g., in an odd-numbered round), the A1 digest register132stores the digest word A, and the A0 digest register131stores the digest word B. Further, the Σ0function151may consume the full 32-bit of the digest word A that is currently stored in the A1 digest register132. Furthermore, the Maj function152may consume a 4-bit portion of the digest word B that is currently stored in the A0 digest register131.

At block210, in each cycle of each round of the second set of rounds, W bits from fourth digest register E1 are used for the Σ1function, and N bits from third digest register E0 are used for the Ch function. For example, referring toFIGS. 1C-1D, assume that, in the first set of rounds, the E1 digest register136stores the digest word E, and the E0 digest register135stores the digest word F. Further, the Σ1function155may consume the full 32-bit of the digest word E that is currently stored in the E1 digest register136. Furthermore, the Ch function156may consume a 4-bit portion of the digest word F that is currently stored in the E0 digest register135. After block210, the sequence200is completed.

Referring now toFIG. 2B, shown is a sequence220in accordance with one or more embodiments. In some embodiments, the sequence220may be implemented by the cryptographic accelerator118shown inFIG. 1A. The sequence220may be implemented in hardware, software, and/or firmware. In hardware embodiments it may be implemented as circuitry and/or micro-architecture. Further, in firmware and software embodiments, it may be implemented by computer executed instructions stored in a non-transitory machine readable medium, such as an optical, semiconductor, or magnetic storage device. The machine readable medium may store data, which if used by at least one machine, causes the at least one machine to fabricate at least one integrated circuit to perform a method. For the sake of illustration, the steps involved in the sequence220may be described below with reference toFIGS. 1A-1F, which show examples in accordance with some embodiments. However, the scope of the various embodiments discussed herein is not limited in this regard.

At block222, a message may be received to be processed using cryptographic hash algorithm. For example, referring toFIG. 1A, the cryptographic accelerator118may receive data to be processed using a SHA-2 algorithm.

At block224, the message may be stored in a set of message registers. For example, referring toFIG. 1B, sixteen message words A to H are stored in the message registers [0:15].

At block226, a set of digest words may be stored in digest registers. For example, referring toFIG. 1B, the digest words A to H may be stored in the digest registers121.

At block228, a plurality of processing rounds may be performed. Each round can include a plurality of cycles, and the plurality of rounds can be divided into a first set and a second set. For example, referring toFIG. 1C, the accelerator120can perform 64 rounds of the SHA-256 algorithm, with each round including 8 cycles. The rounds can be identified as even-numbered or odd-numbered.

At block230, in each cycle of each round of the first set of rounds, digest word A is stored in a first digest register A0, and digest word B is stored in a second digest register A1. For example, referring toFIGS. 1C-1D, assume that the first set of rounds includes odd-numbered rounds, and that the second set of rounds includes even-numbered rounds. In some embodiments, in the first set of rounds (e.g., in an odd-numbered round), the A0 digest register131stores the digest word A, and the A1 digest register132stores the digest word B.

At block232, in each cycle of each round of the first set of rounds, digest word E is stored in a third digest register E0, and digest word F is stored in a fourth digest register E1. For example, referring toFIGS. 1C-1D, in each odd-numbered round, the E0 digest register135stores the digest word E, and the E1 digest register136stores the digest word F.

At block234, in each cycle of each round of the second set of rounds, digest word A is stored in the second digest register A1, and digest word B is stored in the first digest register A0. For example, referring toFIGS. 1C-1D, assume that, in the second set of rounds (e.g., in an even-numbered round), the A1 digest register132stores the digest word B, and the A0 digest register131stores the digest word A.

At block266, in each cycle of each round of the second set of rounds, digest word E is stored in fourth digest register E1, and digest word F is stored in third digest register E0. For example, referring toFIGS. 1C-1D, in each even-numbered round, the E0 digest register135stores the digest word F, and the E1 digest register136stores the digest word E. After block236, the sequence220is completed.

It is noted that the examples shown inFIGS. 1A-1F and 2A-2Bare provided for the sake of illustration, and are not intended to limit any embodiments. It is contemplated that specifics in the examples shown inFIGS. 1A-1F and 2A-2Bmay be used anywhere in one or more embodiments.

Referring now toFIG. 3A, shown is a block diagram of a system300in accordance with an embodiment of the present invention. As shown inFIG. 3A, system300may include various components, including a processor303which as shown is a multicore processor. Processor303may be coupled to a power supply317via an external voltage regulator316, which may perform a first voltage conversion to provide a primary regulated voltage to processor303.

As seen, processor303may be a single die processor including multiple cores304a-304n. In addition, each core304may be associated with an integrated voltage regulator (IVR)308a-308nwhich receives the primary regulated voltage and generates an operating voltage to be provided to one or more agents of the processor associated with the IVR308. Accordingly, an IVR implementation may be provided to allow for fine-grained control of voltage and thus power and performance of each individual core304. As such, each core304can operate at an independent voltage and frequency, enabling great flexibility and affording wide opportunities for balancing power consumption with performance. In some embodiments, the use of multiple IVRs308enables the grouping of components into separate power planes, such that power is regulated and supplied by the IVR308to only those components in the group. During power management, a given power plane of one IVR308may be powered down or off when the processor is placed into a certain low power state, while another power plane of another IVR308remains active, or fully powered.

Still referring toFIG. 3A, additional components may be present within the processor including an input/output interface313, another interface314, and an integrated memory controller315. As seen, each of these components may be powered by another integrated voltage regulator308x. In one embodiment, interface313may be in accordance with the Intel® Quick Path Interconnect (QPI) protocol, which provides for point-to-point (PtP) links in a cache coherent protocol that includes multiple layers including a physical layer, a link layer and a protocol layer. In turn, interface314may be in accordance with a Peripheral Component Interconnect Express (PCIe™) specification, e.g., the PCI Express™ Specification Base Specification version 2.0 (published Jan. 17, 2007).

Also shown is a power control unit (PCU)312, which may include hardware, software and/or firmware to perform power management operations with regard to processor303. As seen, PCU312provides control information to external voltage regulator316via a digital interface to cause the external voltage regulator316to generate the appropriate regulated voltage. PCU312also provides control information to IVRs308via another digital interface to control the operating voltage generated (or to cause a corresponding IVR308to be disabled in a low power mode). In some embodiments, the control information provided to IVRs308may include a power state of a corresponding core304.

In various embodiments, PCU312may include a variety of power management logic units to perform hardware-based power management. Such power management may be wholly processor controlled (e.g., by various processor hardware, and which may be triggered by workload and/or power, thermal or other processor constraints) and/or the power management may be performed responsive to external sources (such as a platform or management power management source or system software).

In some embodiments, the cryptographic accelerator310may generally correspond to the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. In some embodiments, the processor303may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B. While not shown for ease of illustration, understand that additional components may be present within processor303such as uncore logic, and other components such as internal memories, e.g., one or more levels of a cache memory hierarchy and so forth. Furthermore, while shown in the implementation ofFIG. 3Awith an external voltage regulator, embodiments are not so limited.

Embodiments can be implemented in processors for various markets including server processors, desktop processors, mobile processors and so forth. Referring now toFIG. 3B, shown is a block diagram of a multi-domain processor301in accordance with one or more embodiments. As shown in the embodiment ofFIG. 3B, processor301includes multiple domains. Specifically, a core domain321can include a plurality of cores3200-320n, a graphics domain324can include one or more graphics engines, and a system agent domain330may further be present. In some embodiments, system agent domain330may execute at an independent frequency than the core domain and may remain powered on at all times to handle power control events and power management such that domains321and324can be controlled to dynamically enter into and exit high power and low power states. Each of domains321and324may operate at different voltage and/or power. Note that while only shown with three domains, understand the scope of the present invention is not limited in this regard and additional domains can be present in other embodiments. For example, multiple core domains may be present, with each core domain including at least one core.

In general, each core320may further include low level caches in addition to various execution units and additional processing elements. In turn, the various cores may be coupled to each other and to a shared cache memory formed of a plurality of units of a last level cache (LLC)3220-322n. In various embodiments, LLC322may be shared amongst the cores and the graphics engine, as well as various media processing circuitry. As seen, a ring interconnect323thus couples the cores together, and provides interconnection between the cores320, graphics domain324and system agent domain330. In one embodiment, interconnect323can be part of the core domain321. However, in other embodiments, the ring interconnect323can be of its own domain.

As further seen, system agent domain330may include display controller332which may provide control of and an interface to an associated display. In addition, system agent domain330may include a power control unit335to perform power management.

As further seen inFIG. 3B, processor301can further include an integrated memory controller (IMC)342that can provide for an interface to a system memory, such as a dynamic random access memory (DRAM). Multiple interfaces3400-340nmay be present to enable interconnection between the processor and other circuitry. For example, in one embodiment at least one direct media interface (DMI) interface may be provided as well as one or more PCIe™ interfaces. Still further, to provide for communications between other agents such as additional processors or other circuitry, one or more interfaces in accordance with an Intel® Quick Path Interconnect (QPI) protocol may also be provided. Although shown at this high level in the embodiment ofFIG. 3B, understand the scope of the present invention is not limited in this regard.

Although not shown for ease of illustration inFIG. 3B, in some embodiments, processor301may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, processor301may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

While not shown for ease of illustration, understand that additional components may be present within processor303such as uncore logic, and other components such as internal memories, e.g., one or more levels of a cache memory hierarchy and so forth. Furthermore, while shown in the implementation ofFIG. 3Awith an external voltage regulator, embodiments are not so limited.

Referring now toFIG. 3C, shown is a block diagram of a processor302in accordance with an embodiment of the present invention. As shown inFIG. 3C, processor302may be a multicore processor including a plurality of cores370a-370n. In one embodiment, each such core may be of an independent power domain and can be configured to enter and exit active states and/or maximum performance states based on workload. The various cores may be coupled via an interconnect375to a system agent or uncore380that includes various components. As seen, the uncore380may include a shared cache382which may be a last level cache. In addition, the uncore380may include an integrated memory controller384to communicate with a system memory (not shown inFIG. 3C), e.g., via a memory bus. Uncore380also includes various interfaces386a-386nand a power control unit388, which may include logic to perform the power management techniques described herein.

In addition, by interfaces386a-386n, connection can be made to various off-chip components such as peripheral devices, mass storage and so forth. While shown with this particular implementation in the embodiment ofFIG. 3C, the scope of the present invention is not limited in this regard.

Although not shown for ease of illustration inFIG. 3C, in some embodiments, processor302may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, processor302may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

Referring toFIG. 4, an embodiment of a processor including multiple cores is illustrated. Processor400includes any processor or processing device, such as a microprocessor, an embedded processor, a digital signal processor (DSP), a network processor, a handheld processor, an application processor, a co-processor, a system on a chip (SoC), or other device to execute code. Processor400, in one embodiment, includes at least two cores—cores401and402, which may include asymmetric cores or symmetric cores (the illustrated embodiment). However, processor400may include any number of processing elements that may be symmetric or asymmetric.

Physical processor400, as illustrated inFIG. 4, includes two cores, cores401and402. Here, cores401and402are considered symmetric cores, i.e., cores with the same configurations, functional units, and/or logic. In another embodiment, core401includes an out-of-order processor core, while core402includes an in-order processor core. However, cores401and402may be individually selected from any type of core, such as a native core, a software managed core, a core adapted to execute a native instruction set architecture (ISA), a core adapted to execute a translated ISA, a co-designed core, or other known core. Yet to further the discussion, the functional units illustrated in core401are described in further detail below, as the units in core402operate in a similar manner.

As depicted, core401includes two hardware threads401aand401b, which may also be referred to as hardware thread slots401aand401b. Therefore, software entities, such as an operating system, in one embodiment potentially view processor400as four separate processors, i.e., four logical processors or processing elements capable of executing four software threads concurrently. As alluded to above, a first thread is associated with architecture state registers401a, a second thread is associated with architecture state registers401b, a third thread may be associated with architecture state registers402a, and a fourth thread may be associated with architecture state registers402b. Here, each of the architecture state registers (401a,401b,402a, and402b) may be referred to as processing elements, thread slots, or thread units, as described above. As illustrated, architecture state registers401aare replicated in architecture state registers401b, so individual architecture states/contexts are capable of being stored for logical processor401aand logical processor401b. In core401, other smaller resources, such as instruction pointers and renaming logic in allocator and renamer block430may also be replicated for threads401aand401b. Some resources, such as re-order buffers in reorder/retirement unit435, ILTB420, load/store buffers, and queues may be shared through partitioning. Other resources, such as general purpose internal registers, page-table base register(s), low-level data-cache and data-TLB415, execution unit(s)440, and portions of out-of-order unit435are potentially fully shared.

Processor400often includes other resources, which may be fully shared, shared through partitioning, or dedicated by/to processing elements. InFIG. 4, an embodiment of a purely exemplary processor with illustrative logical units/resources of a processor is illustrated. Note that a processor may include, or omit, any of these functional units, as well as include any other known functional units, logic, or firmware not depicted. As illustrated, core401includes a simplified, representative out-of-order (OOO) processor core. But an in-order processor may be utilized in different embodiments. The OOO core includes a branch target buffer420to predict branches to be executed/taken and an instruction-translation buffer (I-TLB)420to store address translation entries for instructions.

Core401further includes decode module425coupled to fetch unit420to decode fetched elements. Fetch logic, in one embodiment, includes individual sequencers associated with thread slots401a,401b, respectively. Usually core401is associated with a first ISA, which defines/specifies instructions executable on processor400. Often machine code instructions that are part of the first ISA include a portion of the instruction (referred to as an opcode), which references/specifies an instruction or operation to be performed. Decode logic425includes circuitry that recognizes these instructions from their opcodes and passes the decoded instructions on in the pipeline for processing as defined by the first ISA. For example, decoders425, in one embodiment, include logic designed or adapted to recognize specific instructions, such as transactional instruction. As a result of the recognition by decoders425, the architecture or core401takes specific, predefined actions to perform tasks associated with the appropriate instruction. It is important to note that any of the tasks, blocks, operations, and methods described herein may be performed in response to a single or multiple instructions; some of which may be new or old instructions.

In one example, allocator and renamer block430includes an allocator to reserve resources, such as register files to store instruction processing results. However, threads401aand401bare potentially capable of out-of-order execution, where allocator and renamer block430also reserves other resources, such as reorder buffers to track instruction results. Unit430may also include a register renamer to rename program/instruction reference registers to other registers internal to processor400. Reorder/retirement unit435includes components, such as the reorder buffers mentioned above, load buffers, and store buffers, to support out-of-order execution and later in-order retirement of instructions executed out-of-order.

Here, cores401and402share access to higher-level or further-out cache410, which is to cache recently fetched elements. Note that higher-level or further-out refers to cache levels increasing or getting further away from the execution unit(s). In one embodiment, higher-level cache410is a last-level data cache—last cache in the memory hierarchy on processor400—such as a second or third level data cache. However, higher level cache410is not so limited, as it may be associated with or includes an instruction cache. A trace cache—a type of instruction cache—instead may be coupled after decoder425to store recently decoded traces.

In the depicted configuration, processor400also includes bus interface module405and a power controller460, which may perform power management in accordance with an embodiment of the present invention. In this scenario, bus interface405is to communicate with devices external to processor400, such as system memory and other components.

A memory controller470may interface with other devices such as one or many memories. In an example, bus interface405includes a ring interconnect with a memory controller for interfacing with a memory and a graphics controller for interfacing with a graphics processor. In an SoC environment, even more devices, such as a network interface, coprocessors, memory, graphics processor, and any other known computer devices/interface may be integrated on a single die or integrated circuit to provide small form factor with high functionality and low power consumption.

Although not shown for ease of illustration inFIG. 4, in some embodiments, processor400may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, processor400may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

Referring now toFIG. 5, shown is a block diagram of a micro-architecture of a processor core in accordance with one embodiment of the present invention. As shown inFIG. 5, processor core500may be a multi-stage pipelined out-of-order processor. Core500may operate at various voltages based on a received operating voltage, which may be received from an integrated voltage regulator or external voltage regulator.

As seen inFIG. 5, core500includes front end units510, which may be used to fetch instructions to be executed and prepare them for use later in the processor pipeline. For example, front end units510may include a fetch unit501, an instruction cache503, and an instruction decoder505. In some implementations, front end units510may further include a trace cache, along with microcode storage as well as a micro-operation storage. Fetch unit501may fetch macro-instructions, e.g., from memory or instruction cache503, and feed them to instruction decoder505to decode them into primitives, i.e., micro-operations for execution by the processor.

Coupled between front end units510and execution units520is an out-of-order (OOO) engine515that may be used to receive the micro-instructions and prepare them for execution. More specifically OOO engine515may include various buffers to re-order micro-instruction flow and allocate various resources needed for execution, as well as to provide renaming of logical registers onto storage locations within various register files such as register file530and extended register file535. Register file530may include separate register files for integer and floating point operations. Extended register file535may provide storage for vector-sized units, e.g., 256 or 512 bits per register.

Various resources may be present in execution units520, including, for example, various integer, floating point, and single instruction multiple data (SIMD) logic units, among other specialized hardware. For example, such execution units may include one or more arithmetic logic units (ALUs)522and one or more vector execution units524, among other such execution units.

Results from the execution units may be provided to retirement logic, namely a reorder buffer (ROB)540. More specifically, ROB540may include various arrays and logic to receive information associated with instructions that are executed. This information is then examined by ROB540to determine whether the instructions can be validly retired and result data committed to the architectural state of the processor, or whether one or more exceptions occurred that prevent a proper retirement of the instructions. Of course, ROB540may handle other operations associated with retirement.

As shown inFIG. 5, ROB540is coupled to a cache550which, in one embodiment may be a low level cache (e.g., an L1 cache) although the scope of the present invention is not limited in this regard. Also, execution units520can be directly coupled to cache550. From cache550, data communication may occur with higher level caches, system memory and so forth. While shown with this high level in the embodiment ofFIG. 5, understand the scope of the present invention is not limited in this regard. For example, while the implementation ofFIG. 5is with regard to an out-of-order machine such as of an Intel® x86 instruction set architecture (ISA), the scope of the present invention is not limited in this regard. That is, other embodiments may be implemented in an in-order processor, a reduced instruction set computing (RISC) processor such as an ARM-based processor, or a processor of another type of ISA that can emulate instructions and operations of a different ISA via an emulation engine and associated logic circuitry.

Although not shown for ease of illustration inFIG. 5, in some embodiments, the core500may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, the core500may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

Referring now toFIG. 6, shown is a block diagram of a micro-architecture of a processor core in accordance with another embodiment. In the embodiment ofFIG. 6, core600may be a low power core of a different micro-architecture, such as an Intel® Atom™-based processor having a relatively limited pipeline depth designed to reduce power consumption. As seen, core600includes an instruction cache610coupled to provide instructions to an instruction decoder615. A branch predictor605may be coupled to instruction cache610. Note that instruction cache610may further be coupled to another level of a cache memory, such as an L2 cache (not shown for ease of illustration inFIG. 6). In turn, instruction decoder615provides decoded instructions to an issue queue620for storage and delivery to a given execution pipeline. A microcode ROM618is coupled to instruction decoder615.

A floating point pipeline630includes a floating point register file632which may include a plurality of architectural registers of a given bit with such as 128, 256 or 512 bits. Pipeline630includes a floating point scheduler634to schedule instructions for execution on one of multiple execution units of the pipeline. In the embodiment shown, such execution units include an ALU635, a shuffle unit636, and a floating point adder638. In turn, results generated in these execution units may be provided back to buffers and/or registers of register file632. Of course understand while shown with these few example execution units, additional or different floating point execution units may be present in another embodiment.

An integer pipeline640also may be provided. In the embodiment shown, pipeline640includes an integer register file642which may include a plurality of architectural registers of a given bit with such as 128 or 256 bits. Pipeline640includes an integer scheduler644to schedule instructions for execution on one of multiple execution units of the pipeline. In the embodiment shown, such execution units include an ALU645, a shifter unit646, and a jump execution unit648. In turn, results generated in these execution units may be provided back to buffers and/or registers of register file642. Of course understand while shown with these few example execution units, additional or different integer execution units may be present in another embodiment.

A memory execution scheduler650may schedule memory operations for execution in an address generation unit652, which is also coupled to a TLB654. As seen, these structures may couple to a data cache660, which may be a L0 and/or L1 data cache that in turn couples to additional levels of a cache memory hierarchy, including an L2 cache memory.

To provide support for out-of-order execution, an allocator/renamer670may be provided, in addition to a reorder buffer680, which is configured to reorder instructions executed out of order for retirement in order. Although shown with this particular pipeline architecture in the illustration ofFIG. 6, understand that many variations and alternatives are possible.

Note that in a processor having asymmetric cores, such as in accordance with the micro-architectures ofFIGS. 5 and 6, workloads may be dynamically swapped between the cores for power management reasons, as these cores, although having different pipeline designs and depths, may be of the same or related ISA. Such dynamic core swapping may be performed in a manner transparent to a user application (and possibly kernel also).

Although not shown for ease of illustration inFIG. 6, in some embodiments, the core600may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, the core600may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

Referring toFIG. 7, shown is a block diagram of a micro-architecture of a processor core in accordance with yet another embodiment. As illustrated inFIG. 7, a core700may include a multi-staged in-order pipeline to execute at very low power consumption levels. As one such example, processor700may have a micro-architecture in accordance with an ARM Cortex A53 design available from ARM Holdings, LTD., Sunnyvale, Calif. In an implementation, an 8-stage pipeline may be provided that is configured to execute both 32-bit and 64-bit code. Core700includes a fetch unit710that is configured to fetch instructions and provide them to a decode unit715, which may decode the instructions, e.g., macro-instructions of a given ISA such as an ARMv8 ISA. Note further that a queue730may couple to decode unit715to store decoded instructions. Decoded instructions are provided to an issue logic725, where the decoded instructions may be issued to a given one of multiple execution units.

With further reference toFIG. 7, issue logic725may issue instructions to one of multiple execution units. In the embodiment shown, these execution units include an integer unit735, a multiply unit740, a floating point/vector unit750, a dual issue unit760, and a load/store unit770. The results of these different execution units may be provided to a writeback unit780. Understand that while a single writeback unit is shown for ease of illustration, in some implementations separate writeback units may be associated with each of the execution units. Furthermore, understand that while each of the units and logic shown inFIG. 7is represented at a high level, a particular implementation may include more or different structures. A processor designed using one or more cores having a pipeline as inFIG. 7may be implemented in many different end products, extending from mobile devices to server systems.

Although not shown for ease of illustration inFIG. 7, in some embodiments, the core700may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, the core700may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

Referring now toFIG. 8, shown is a block diagram of a micro-architecture of a processor core in accordance with a still further embodiment. As illustrated inFIG. 8, a core800may include a multi-stage multi-issue out-of-order pipeline to execute at very high performance levels (which may occur at higher power consumption levels than core700ofFIG. 7). As one such example, processor800may have a microarchitecture in accordance with an ARM Cortex A57 design. In an implementation, a 15 (or greater)-stage pipeline may be provided that is configured to execute both 32-bit and 64-bit code. In addition, the pipeline may provide for 3 (or greater)-wide and 3 (or greater)-issue operation. Core800includes a fetch unit810that is configured to fetch instructions and provide them to a decoder/renamer/dispatcher815, which may decode the instructions, e.g., macro-instructions of an ARMv8 instruction set architecture, rename register references within the instructions, and dispatch the instructions (eventually) to a selected execution unit. Decoded instructions may be stored in a queue825. Note that while a single queue structure is shown for ease of illustration inFIG. 8, understand that separate queues may be provided for each of the multiple different types of execution units.

Also shown inFIG. 8is an issue logic830from which decoded instructions stored in queue825may be issued to a selected execution unit. Issue logic830also may be implemented in a particular embodiment with a separate issue logic for each of the multiple different types of execution units to which issue logic830couples.

Decoded instructions may be issued to a given one of multiple execution units. In the embodiment shown, these execution units include one or more integer units835, a multiply unit840, a floating point/vector unit850, a branch unit860, and a load/store unit870. In an embodiment, floating point/vector unit850may be configured to handle SIMD or vector data of 128 or 256 bits. Still further, floating point/vector execution unit850may perform IEEE-754 double precision floating-point operations. The results of these different execution units may be provided to a writeback unit880. Note that in some implementations separate writeback units may be associated with each of the execution units. Furthermore, understand that while each of the units and logic shown inFIG. 8is represented at a high level, a particular implementation may include more or different structures.

Note that in a processor having asymmetric cores, such as in accordance with the micro-architectures ofFIGS. 7 and 8, workloads may be dynamically swapped for power management reasons, as these cores, although having different pipeline designs and depths, may be of the same or related ISA. Such dynamic core swapping may be performed in a manner transparent to a user application (and possibly kernel also).

Although not shown for ease of illustration inFIG. 8, in some embodiments, the core800may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, the core800may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

A processor designed using one or more cores having pipelines as in any one or more ofFIGS. 5-8may be implemented in many different end products, extending from mobile devices to server systems. Referring now toFIG. 9, shown is a block diagram of a processor in accordance with another embodiment of the present invention. In the embodiment ofFIG. 9, processor900may be a SoC including multiple domains, each of which may be controlled to operate at an independent operating voltage and operating frequency. As a specific illustrative example, processor900may be an Intel® Architecture Core™-based processor such as an i3, i5, i7 or another such processor available from Intel Corporation. However, other low power processors such as available from Advanced Micro Devices, Inc. (AMD) of Sunnyvale, Calif., an ARM-based design from ARM Holdings, Ltd. or licensee thereof or a MIPS-based design from MIPS Technologies, Inc. of Sunnyvale, Calif., or their licensees or adopters may instead be present in other embodiments such as an Apple A7 processor, a Qualcomm Snapdragon processor, or Texas Instruments OMAP processor. Such SoC may be used in a low power system such as a smartphone, tablet computer, phablet computer, Ultrabook™ computer or other portable computing device.

In the high level view shown inFIG. 9, processor900includes a plurality of core units9100-910n. Each core unit may include one or more processor cores, one or more cache memories and other circuitry. Each core unit910may support one or more instructions sets (e.g., an x86 instruction set (with some extensions that have been added with newer versions); a MIPS instruction set; an ARM instruction set (with optional additional extensions such as NEON)) or other instruction set or combinations thereof. Note that some of the core units may be heterogeneous resources (e.g., of a different design). In addition, each such core may be coupled to a cache memory (not shown) which in an embodiment may be a shared level (L2) cache memory. A non-volatile storage930may be used to store various program and other data. For example, this storage may be used to store at least portions of microcode, boot information such as a BIOS, other system software or so forth.

Each core unit910may also include an interface such as a bus interface unit to enable interconnection to additional circuitry of the processor. In an embodiment, each core unit910couples to a coherent fabric that may act as a primary cache coherent on-die interconnect that in turn couples to a memory controller935. In turn, memory controller935controls communications with a memory such as a DRAM (not shown for ease of illustration inFIG. 9).

In addition to core units, additional processing engines are present within the processor, including at least one graphics unit920which may include one or more graphics processing units (GPUs) to perform graphics processing as well as to possibly execute general purpose operations on the graphics processor (so-called GPGPU operation). In addition, at least one image signal processor925may be present. Signal processor925may be configured to process incoming image data received from one or more capture devices, either internal to the SoC or off-chip.

Other accelerators also may be present. In the illustration ofFIG. 9, a video coder950may perform coding operations including encoding and decoding for video information, e.g., providing hardware acceleration support for high definition video content. A display controller955further may be provided to accelerate display operations including providing support for internal and external displays of a system. In addition, a security processor945may be present to perform security operations such as secure boot operations, various cryptography operations and so forth.

Each of the units may have its power consumption controlled via a power manager940, which may include control logic to perform the various power management techniques described herein.

In some embodiments, SoC900may further include a non-coherent fabric coupled to the coherent fabric to which various peripheral devices may couple. One or more interfaces960a-960denable communication with one or more off-chip devices. Such communications may be according to a variety of communication protocols such as PCIe™, GPIO, USB, I2C, UART, MIPI, SDIO, DDR, SPI, HDMI, among other types of communication protocols. Although shown at this high level in the embodiment ofFIG. 9, understand the scope of the present invention is not limited in this regard.

Although not shown for ease of illustration inFIG. 9, in some embodiments, the SoC900may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, the SoC900may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

Referring now toFIG. 10, shown is a block diagram of a representative SoC. In the embodiment shown, SoC1000may be a multi-core SoC configured for low power operation to be optimized for incorporation into a smartphone or other low power device such as a tablet computer or other portable computing device. As an example, SoC1000may be implemented using asymmetric or different types of cores, such as combinations of higher power and/or low power cores, e.g., out-of-order cores and in-order cores. In different embodiments, these cores may be based on an Intel® Architecture™ core design or an ARM architecture design. In yet other embodiments, a mix of Intel and ARM cores may be implemented in a given SoC.

As seen inFIG. 10, SoC1000includes a first core domain1010having a plurality of first cores10120-10123. In an example, these cores may be low power cores such as in-order cores. In one embodiment these first cores may be implemented as ARM Cortex A53 cores. In turn, these cores couple to a cache memory1015of core domain1010. In addition, SoC1000includes a second core domain1020. In the illustration ofFIG. 10, second core domain1020has a plurality of second cores10220-10223. In an example, these cores may be higher power-consuming cores than first cores1012. In an embodiment, the second cores may be out-of-order cores, which may be implemented as ARM Cortex A57 cores. In turn, these cores couple to a cache memory1025of core domain1020. Note that while the example shown inFIG. 10includes 4 cores in each domain, understand that more or fewer cores may be present in a given domain in other examples.

With further reference toFIG. 10, a graphics domain1030also is provided, which may include one or more graphics processing units (GPUs) configured to independently execute graphics workloads, e.g., provided by one or more cores of core domains1010and1020. As an example, GPU domain1030may be used to provide display support for a variety of screen sizes, in addition to providing graphics and display rendering operations.

As seen, the various domains couple to a coherent interconnect1040, which in an embodiment may be a cache coherent interconnect fabric that in turn couples to an integrated memory controller1050. Coherent interconnect1040may include a shared cache memory, such as an L3 cache, some examples. In an embodiment, memory controller1050may be a direct memory controller to provide for multiple channels of communication with an off-chip memory, such as multiple channels of a DRAM (not shown for ease of illustration inFIG. 10).

In different examples, the number of the core domains may vary. For example, for a low power SoC suitable for incorporation into a mobile computing device, a limited number of core domains such as shown inFIG. 10may be present. Still further, in such low power SoCs, core domain1020including higher power cores may have fewer numbers of such cores. For example, in one implementation two cores1022may be provided to enable operation at reduced power consumption levels. In addition, the different core domains may also be coupled to an interrupt controller to enable dynamic swapping of workloads between the different domains.

In yet other embodiments, a greater number of core domains, as well as additional optional IP logic may be present, in that an SoC can be scaled to higher performance (and power) levels for incorporation into other computing devices, such as desktops, servers, high performance computing systems, base stations forth. As one such example, 4 core domains each having a given number of out-of-order cores may be provided. Still further, in addition to optional GPU support (which as an example may take the form of a GPGPU), one or more accelerators to provide optimized hardware support for particular functions (e.g. web serving, network processing, switching or so forth) also may be provided. In addition, an input/output interface may be present to couple such accelerators to off-chip components.

Although not shown for ease of illustration inFIG. 10, in some embodiments, the SoC1000may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, the SoC1000may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

Referring now toFIG. 11, shown is a block diagram of another example SoC. In the embodiment ofFIG. 11, SoC1100may include various circuitry to enable high performance for multimedia applications, communications and other functions. As such, SoC1100is suitable for incorporation into a wide variety of portable and other devices, such as smartphones, tablet computers, smart TVs and so forth. In the example shown, SoC1100includes a central processor unit (CPU) domain1110. In an embodiment, a plurality of individual processor cores may be present in CPU domain1110. As one example, CPU domain1110may be a quad core processor having 4 multithreaded cores. Such processors may be homogeneous or heterogeneous processors, e.g., a mix of low power and high power processor cores.

In turn, a GPU domain1120is provided to perform advanced graphics processing in one or more GPUs to handle graphics and compute APIs. A DSP unit1130may provide one or more low power DSPs for handling low-power multimedia applications such as music playback, audio/video and so forth, in addition to advanced calculations that may occur during execution of multimedia instructions. In turn, a communication unit1140may include various components to provide connectivity via various wireless protocols, such as cellular communications (including 3G/4G LTE), wireless local area techniques such as Bluetooth™, IEEE 802.11, and so forth.

Still further, a multimedia processor1150may be used to perform capture and playback of high definition video and audio content, including processing of user gestures. A sensor unit1160may include a plurality of sensors and/or a sensor controller to interface to various off-chip sensors present in a given platform. An image signal processor1170may be provided with one or more separate ISPs to perform image processing with regard to captured content from one or more cameras of a platform, including still and video cameras.

A display processor1180may provide support for connection to a high definition display of a given pixel density, including the ability to wirelessly communicate content for playback on such display. Still further, a location unit1190may include a GPS receiver with support for multiple GPS constellations to provide applications highly accurate positioning information obtained using as such GPS receiver. Understand that while shown with this particular set of components in the example ofFIG. 11, many variations and alternatives are possible.

Although not shown for ease of illustration inFIG. 11, in some embodiments, the SoC1100may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, the SoC1100may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

Referring now toFIG. 12, shown is a block diagram of an example system with which embodiments can be used. As seen, system1200may be a smartphone or other wireless communicator. A baseband processor1205is configured to perform various signal processing with regard to communication signals to be transmitted from or received by the system. In turn, baseband processor1205is coupled to an application processor1210, which may be a main CPU of the system to execute an OS and other system software, in addition to user applications such as many well-known social media and multimedia apps. Application processor1210may further be configured to perform a variety of other computing operations for the device.

In turn, application processor1210can couple to a user interface/display1220, e.g., a touch screen display. In addition, application processor1210may couple to a memory system including a non-volatile memory, namely a flash memory1230and a system memory, namely a dynamic random access memory (DRAM)1235. As further seen, application processor1210further couples to a capture device1240such as one or more image capture devices that can record video and/or still images.

Still referring toFIG. 12, a universal integrated circuit card (UICC)1240comprising a subscriber identity module and possibly a secure storage and cryptoprocessor is also coupled to application processor1210. System1200may further include a security processor1250that may couple to application processor1210. A plurality of sensors1225may couple to application processor1210to enable input of a variety of sensed information such as accelerometer and other environmental information. An audio output device1295may provide an interface to output sound, e.g., in the form of voice communications, played or streaming audio data and so forth.

As further illustrated, a near field communication (NFC) contactless interface1260is provided that communicates in a NFC near field via an NFC antenna1265. While separate antennae are shown inFIG. 12, understand that in some implementations one antenna or a different set of antennae may be provided to enable various wireless functionality.

A power management integrated circuit (PMIC)1215couples to application processor1210to perform platform level power management. To this end, PMIC1215may issue power management requests to application processor1210to enter certain low power states as desired. Furthermore, based on platform constraints, PMIC1215may also control the power level of other components of system1200.

To enable communications to be transmitted and received, various circuitry may be coupled between baseband processor1205and an antenna1290. Specifically, a radio frequency (RF) transceiver1270and a wireless local area network (WLAN) transceiver1275may be present. In general, RF transceiver1270may be used to receive and transmit wireless data and calls according to a given wireless communication protocol such as 3G or 4G wireless communication protocol such as in accordance with a code division multiple access (CDMA), global system for mobile communication (GSM), long term evolution (LTE) or other protocol. In addition a GPS sensor1280may be present. Other wireless communications such as receipt or transmission of radio signals, e.g., AM/FM and other signals may also be provided. In addition, via WLAN transceiver1275, local wireless communications, such as according to a Bluetooth™ standard or an IEEE 802.11 standard such as IEEE 802.11a/b/g/n can also be realized.

Although not shown for ease of illustration inFIG. 12, in some embodiments, the system1200may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, the system1200may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

Referring now toFIG. 13, shown is a block diagram of another example system with which embodiments may be used. In the illustration ofFIG. 13, system1300may be mobile low-power system such as a tablet computer, 2:1 tablet, phablet or other convertible or standalone tablet system. As illustrated, a SoC1310is present and may be configured to operate as an application processor for the device.

A variety of devices may couple to SoC1310. In the illustration shown, a memory subsystem includes a flash memory1340and a DRAM1345coupled to SoC1310. In addition, a touch panel1320is coupled to the SoC1310to provide display capability and user input via touch, including provision of a virtual keyboard on a display of touch panel1320. To provide wired network connectivity, SoC1310couples to an Ethernet interface1330. A peripheral hub1325is coupled to SoC1310to enable interfacing with various peripheral devices, such as may be coupled to system1300by any of various ports or other connectors.

In addition to internal power management circuitry and functionality within SoC1310, a PMIC1380is coupled to SoC1310to provide platform-based power management, e.g., based on whether the system is powered by a battery1390or AC power via an AC adapter1395. In addition to this power source-based power management, PMIC1380may further perform platform power management activities based on environmental and usage conditions. Still further, PMIC1380may communicate control and status information to SoC1310to cause various power management actions within SoC1310.

Still referring toFIG. 13, to provide for wireless capabilities, a WLAN unit1350is coupled to SoC1310and in turn to an antenna1355. In various implementations, WLAN unit1350may provide for communication according to one or more wireless protocols, including an IEEE 802.11 protocol, a Bluetooth™ protocol or any other wireless protocol.

As further illustrated, a plurality of sensors1360may couple to SoC1310. These sensors may include various accelerometer, environmental and other sensors, including user gesture sensors. Finally, an audio codec1365is coupled to SoC1310to provide an interface to an audio output device1370. Of course understand that while shown with this particular implementation inFIG. 13, many variations and alternatives are possible.

Although not shown for ease of illustration inFIG. 13, in some embodiments, the system1300may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, the system1300may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

Referring now toFIG. 14, a block diagram of a representative computer system1400such as notebook, Ultrabook™ or other small form factor system. A processor1410, in one embodiment, includes a microprocessor, multi-core processor, multithreaded processor, an ultra low voltage processor, an embedded processor, or other known processing element. In the illustrated implementation, processor1410acts as a main processing unit and central hub for communication with many of the various components of the system1400. As one example, processor1410is implemented as a SoC.

Processor1410, in one embodiment, communicates with a system memory1415. As an illustrative example, the system memory1415is implemented via multiple memory devices or modules to provide for a given amount of system memory.

To provide for persistent storage of information such as data, applications, one or more operating systems and so forth, a mass storage1420may also couple to processor1410. In various embodiments, to enable a thinner and lighter system design as well as to improve system responsiveness, this mass storage may be implemented via a SSD or the mass storage may primarily be implemented using a hard disk drive (HDD) with a smaller amount of SSD storage to act as a SSD cache to enable non-volatile storage of context state and other such information during power down events so that a fast power up can occur on re-initiation of system activities. Also shown inFIG. 14, a flash device1422may be coupled to processor1410, e.g., via a serial peripheral interface (SPI). This flash device may provide for non-volatile storage of system software, including a basic input/output software (BIOS) as well as other firmware of the system.

Various input/output (I/O) devices may be present within system1400. Specifically shown in the embodiment ofFIG. 14is a display1424which may be a high definition LCD or LED panel that further provides for a touch screen1425. In one embodiment, display1424may be coupled to processor1410via a display interconnect that can be implemented as a high performance graphics interconnect. Touch screen1425may be coupled to processor1410via another interconnect, which in an embodiment can be an I2C interconnect. As further shown inFIG. 14, in addition to touch screen1425, user input by way of touch can also occur via a touch pad1430which may be configured within the chassis and may also be coupled to the same I2C interconnect as touch screen1425.

For perceptual computing and other purposes, various sensors may be present within the system and may be coupled to processor1410in different manners. Certain inertial and environmental sensors may couple to processor1410through a sensor hub1440, e.g., via an I2C interconnect. In the embodiment shown inFIG. 14, these sensors may include an accelerometer1441, an ambient light sensor (ALS)1442, a compass1443and a gyroscope1444. Other environmental sensors may include one or more thermal sensors1446which in some embodiments couple to processor1410via a system management bus (SMBus) bus.

Also seen inFIG. 14, various peripheral devices may couple to processor1410via a low pin count (LPC) interconnect. In the embodiment shown, various components can be coupled through an embedded controller1435. Such components can include a keyboard1436(e.g., coupled via a PS2 interface), a fan1437, and a thermal sensor1439. In some embodiments, touch pad1430may also couple to EC1435via a PS2 interface. In addition, a security processor such as a trusted platform module (TPM)1438in accordance with the Trusted Computing Group (TCG) TPM Specification Version 1.2, dated Oct. 2, 2003, may also couple to processor1410via this LPC interconnect.

System1400can communicate with external devices in a variety of manners, including wirelessly. In the embodiment shown inFIG. 14, various wireless modules, each of which can correspond to a radio configured for a particular wireless communication protocol, are present. One manner for wireless communication in a short range such as a near field may be via a NFC unit1445which may communicate, in one embodiment with processor1410via an SMBus. Note that via this NFC unit1445, devices in close proximity to each other can communicate.

As further seen inFIG. 14, additional wireless units can include other short range wireless engines including a WLAN unit1450and a Bluetooth unit1452. Using WLAN unit1450, Wi-Fi™ communications in accordance with a given IEEE 802.11 standard can be realized, while via Bluetooth unit1452, short range communications via a Bluetooth protocol can occur. These units may communicate with processor1410via, e.g., a USB link or a universal asynchronous receiver transmitter (UART) link. Or these units may couple to processor1410via an interconnect according to a PCIe™ protocol or another such protocol such as a serial data input/output (SDIO) standard.

In addition, wireless wide area communications, e.g., according to a cellular or other wireless wide area protocol, can occur via a WWAN unit1456which in turn may couple to a subscriber identity module (SIM)1457. In addition, to enable receipt and use of location information, a GPS module1455may also be present. Note that in the embodiment shown inFIG. 14, WWAN unit1456and an integrated capture device such as a camera module1454may communicate via a given USB protocol such as a USB 2.0 or 3.0 link, or a UART or I2C protocol.

An integrated camera module1454can be incorporated in the lid. To provide for audio inputs and outputs, an audio processor can be implemented via a digital signal processor (DSP)1460, which may couple to processor1410via a high definition audio (HDA) link. Similarly, DSP1460may communicate with an integrated coder/decoder (CODEC) and amplifier1462that in turn may couple to output speakers1463which may be implemented within the chassis. Similarly, amplifier and CODEC1462can be coupled to receive audio inputs from a microphone1465which in an embodiment can be implemented via dual array microphones (such as a digital microphone array) to provide for high quality audio inputs to enable voice-activated control of various operations within the system. Note also that audio outputs can be provided from amplifier/CODEC1462to a headphone jack1464. Although shown with these particular components in the embodiment ofFIG. 14, understand the scope of the present invention is not limited in this regard.

Although not shown for ease of illustration inFIG. 14, in some embodiments, the system1400may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, the system1400may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

Embodiments may be implemented in many different system types. Referring now toFIG. 15, shown is a block diagram of a system in accordance with an embodiment of the present invention. As shown inFIG. 15, multiprocessor system1500is a point-to-point interconnect system, and includes a first processor1570and a second processor1580coupled via a point-to-point interconnect1550. As shown inFIG. 15, each of processors1570and1580may be multicore processors, including first and second processor cores (i.e., processor cores1574aand1574band processor cores1584aand1584b), although potentially many more cores may be present in the processors. Each of the processors can include a PCU or other power management logic to perform processor-based power management as described herein.

Still referring toFIG. 15, first processor1570further includes a memory controller hub (MCH)1572and point-to-point (P-P) interfaces1576and1578. Similarly, second processor1580includes a MCH1582and P-P interfaces1586and1588. As shown inFIG. 15, MCH's1572and1582couple the processors to respective memories, namely a memory1532and a memory1534, which may be portions of system memory (e.g., DRAM) locally attached to the respective processors. First processor1570and second processor1580may be coupled to a chipset1590via P-P interconnects1562and1564, respectively. As shown inFIG. 15, chipset1590includes P-P interfaces1594and1598.

Furthermore, chipset1590includes an interface1592to couple chipset1590with a high performance graphics engine1538, by a P-P interconnect1539. In turn, chipset1590may be coupled to a first bus1516via an interface1596. As shown inFIG. 15, various input/output (I/O) devices1514may be coupled to first bus1516, along with a bus bridge1518which couples first bus1516to a second bus1520. Various devices may be coupled to second bus1520including, for example, a keyboard/mouse1522, communication devices1526and a data storage unit1528such as a disk drive or other mass storage device which may include code1530, in one embodiment. Further, an audio I/O1524may be coupled to second bus1520. Embodiments can be incorporated into other types of systems including mobile devices such as a smart cellular telephone, tablet computer, netbook, Ultrabook™, or so forth.

Although not shown for ease of illustration inFIG. 15, in some embodiments, the system1500may include the cryptographic accelerator118and/or the accelerator120described above with reference toFIGS. 1A-1B. Further, in some embodiments, the system1500may implement some or all of the components and/or functionality described above with reference toFIGS. 1A-1F and 2A-2B.

The following clauses and/or examples pertain to further embodiments.

In one example, a processor for performing cryptographic hash operations includes a hardware accelerator for performing a cryptographic hash algorithm. The hardware accelerator may: receive a message to be processed using the cryptographic hash algorithm; store a plurality of digest words in a plurality of digest registers, where each digest word has a size of W bits, where each digest word comprises a plurality of portions that each have a size of N bits, where the plurality of digest registers includes a first digest register and a second digest register; perform a plurality of rounds of the cryptographic hash algorithm, where each round comprises a plurality of C cycles, where the plurality of rounds is divided into a first set of rounds and a second set of rounds, where the first set and the second set are selected from a set of even-numbered rounds and a set of odd-numbered rounds; in each cycle of each round in the first set, use W bits from the first digest register for a first function and use N bits from the second digest register for a second function; in each cycle of each round in the second set, use W bits from the second digest register for the first function, and use N bits from the first digest register for the second function.

In an example, the hardware accelerator is further to, in each round in the first set, store a first digest word in the first digest register and store a second digest word in the second digest register; and in each round in the second set, store the first digest word in the second digest register and store the second digest word in the first digest register.

In one example, the portion size N is equal to word size W divided by number of cycles C.

In one example, the cryptographic hash algorithm is a Secure Hash Algorithm 2 (SHA-2). In one example, the first function is a Σ0function of the SHA-2 algorithm, and the second function is a Maj function of the SHA-2 algorithm.

In one example, the plurality of digest registers further includes a third digest register and a fourth digest register. The hardware accelerator is further to, in each cycle of each round in the first set, use W bits from the third digest register for a third function and use N bits from the fourth digest register for a fourth function; and in each cycle of each round in the second set, use W bits from the fourth digest register for the third function and use N bits from the third digest register for the fourth function. In one example, the hardware accelerator is further to, in each round in the first set, store a third digest word in the third digest register and store a fourth digest word in the fourth digest register; and in each round in the second set, store the third digest word in the fourth digest register and store the fourth digest word in the third digest register. In one example, the third function is a Σ1function of the cryptographic hash algorithm, and the fourth function is a Ch function of the cryptographic hash algorithm.

In another example, a method for performing cryptographic hash operations may include: receiving a message to be processed using a cryptographic hash algorithm; storing a plurality of digest words in a plurality of digest registers, where each digest word comprises W bits, where each digest word comprises a plurality of portions that each have a size of N bits, where the plurality of digest registers includes a first digest register and a second digest register; performing a plurality of rounds, where the plurality of rounds is divided into a first set and a second set, the first set and the second selected from a set of even-numbered rounds and a set of odd-numbered rounds; in each round in the first set, storing a first digest word in the first digest register and storing a second digest word in the second digest register; in each round in the second set, storing the first digest word in the second digest register and storing the second digest word in the first digest register.

In one example, the method further includes: in each cycle of each round in the first set, using W bits from the first digest register for a first function and using N bits from the second digest register for a second function; and in each cycle of each round in the second set, using W bits from the second digest register for the first function and using N bits from the first digest register for the second function. In one example, the plurality of digest registers further includes a third digest register and a fourth digest register. The method can include: in each cycle of each round in the first set, use W bits from the third digest register for a third function and use N bits from the fourth digest register for a fourth function; and in each cycle of each round in the second set, use W bits from the fourth digest register for the third function and use N bits from the third digest register for the fourth function.

In one example, the method further includes, in each round in the first set, storing a third digest word in the third digest register and storing a fourth digest word in the fourth digest register; and in each round in the second set, storing the third digest word in the fourth digest register and storing the fourth digest word in the third digest register.

In one example, the portion size N is equal to word size W divided by number of cycles C, where word size W is selected from 32 bits and 64 bits, and where portion size N is selected from 2 bits and 4 bits.

In one example, the first function is a Σ0function of the cryptographic hash algorithm; the second function is a Maj function of the cryptographic hash algorithm; the third function is a Σ1function of the cryptographic hash algorithm; and the fourth function is a Ch function of the cryptographic hash algorithm.

In another example, a machine readable medium may have stored thereon data, which if used by at least one machine, causes the at least one machine to fabricate at least one integrated circuit to perform a method according to any one of the above examples.

In another example, an apparatus for processing instructions is configured to perform the method of any one of the above examples.

In another example, a system for performing cryptographic hash operations includes a processor and an external memory coupled to the processor. The processor includes an accelerator for performing a cryptographic hash algorithm. The accelerator may be to: perform a plurality of rounds of the cryptographic hash algorithm, where each round comprises a plurality of C cycles, where the plurality of rounds is divided into a first set and a second set selected from a set of even-numbered rounds and a set of odd-numbered rounds; in each round of the first set, store a first digest word in a first digest register and store a second digest word in a third digest register; and in each round of the second set, store the first digest word in a second digest register and store the second digest word in a fourth digest register.

In one example, each digest word comprises W bits, where each digest word comprises a plurality of portions that each have a size of N bits, and where the accelerator is further to: in each cycle of each round of the first set, use W bits from the first digest register for a first function of the cryptographic hash algorithm and use N bits from the second digest register for a second function of the cryptographic hash algorithm; and in each cycle of each round of the second set, use W bits from the second digest register for the first function and use N bits from the first digest register for the second function.

In one example, the accelerator is further to: in each cycle of each round in the first set, use W bits from the third digest register for a third function of the cryptographic hash algorithm and use N bits from the fourth digest register for a fourth function of the cryptographic hash algorithm; and in each cycle of each round in the second set, use W bits from the fourth digest register for the third function and use N bits from the third digest register for the fourth function.

In one example, the third function is a Σ1function of the cryptographic hash algorithm, and the fourth function is a Ch function of the cryptographic hash algorithm.

In one example, the first function is a Σ0function of the cryptographic hash algorithm, and the second function is a Maj function of the cryptographic hash algorithm.

In one example, the cryptographic hash algorithm is SHA-2 algorithm. In one example, the SHA-2 algorithm is one selected from SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256.

In one example, the accelerator is further to, in each cycle of each round: generate a first carry value associated with the first digest word, and generate a second carry value associated with the second digest word.

In another example, a machine-readable medium may have stored thereon data, which if used by at least one machine, causes the at least one machine to fabricate at least one integrated circuit to perform a method. The method may include: receiving a message to be processed using a cryptographic hash algorithm; storing a plurality of digest words in a plurality of digest registers, where each digest word comprises W bits, where each digest word comprises a plurality of portions that each have a size of N bits, where the plurality of digest registers includes a first digest register and a second digest register; performing a plurality of rounds, where the plurality of rounds is divided into a first set and a second set, the first set and the second selected from a set of even-numbered rounds and a set of odd-numbered rounds; in each round in the first set, storing a first digest word in the first digest register and storing a second digest word in the second digest register; and in each round in the second set, storing the first digest word in the second digest register and storing the second digest word in the first digest register.

In one example, the method further includes: in each cycle of each round in the first set, using W bits from the first digest register for a first function and using N bits from the second digest register for a second function; and in each cycle of each round in the second set, using W bits from the second digest register for the first function and using N bits from the first digest register for the second function.

In one example, the plurality of digest registers further includes a third digest register and a fourth digest register, and the method further includes: in each cycle of each round in the first set, use W bits from the third digest register for a third function and use N bits from the fourth digest register for a fourth function; and in each cycle of each round in the second set, use W bits from the fourth digest register for the third function and use N bits from the third digest register for the fourth function. In one example, the method further includes: in each round in the first set, storing a third digest word in the third digest register and storing a fourth digest word in the fourth digest register; and in each round in the second set, storing the third digest word in the fourth digest register and storing the fourth digest word in the third digest register.

In one example, the portion size N is equal to word size W divided by number of cycles C, where word size W is selected from 32 bits and 64 bits, and where portion size N is selected from 2 bits and 4 bits.

In one example, the first function is a Σ0function of the cryptographic hash algorithm; the second function is a Maj function of the cryptographic hash algorithm; the third function is a Σ1function of the cryptographic hash algorithm; and the fourth function is a Ch function of the cryptographic hash algorithm.

In another example, a processor for cryptographic hash operations includes a hardware accelerator for performing a Secure Hash Algorithm 2 (SHA-2) algorithm. The hardware accelerator is to: receive a message to be processed using the SHA-2 algorithm; store digest words A to H in a plurality of digest registers, wherein each digest word has a size of W bits, wherein each digest word comprises a plurality of portions that each have a size of N bits, wherein the plurality of digest registers includes a first digest register A0 and a second digest register A1; perform a plurality of rounds of the SHA-2 algorithm, wherein each round comprises a plurality of C cycles, wherein the plurality of rounds is divided into a first set of rounds and a second set of rounds, wherein the first set and the second set are selected from a set of even-numbered rounds and a set of odd-numbered rounds; in each cycle of each round in the first set, use W bits from the first digest register A0 for a Σ0function, and use N bits from the second digest register A1 for a Maj function; and in each cycle of each round in the second set, use W bits from the second digest register A1 for the Σ0function, and use N bits from the first digest register A0 for the Maj function.

In an example, the plurality of digest registers further includes a third digest register E0 and a fourth digest register E1. The hardware accelerator is further to, in each cycle of each round in the first set, use W bits from the third digest register E0 for a Σ1function, and use N bits from the fourth digest register E1 for a Ch function. The hardware accelerator is further to, in each cycle of each round in the second set, use W bits from the fourth digest register E1 for the Σ1function, and use N bits from the third digest register E0 for the Ch function.

In an example, the hardware accelerator is further to, in each round in the first set, store digest word E in the third digest register E0 and store digest word F in the fourth digest register E1; and in each round in the second set, store digest word E in the fourth digest register E1 and store digest word F in the third digest register E0.

In an example, the hardware accelerator is further to, in each round in the first set, store digest word A in the first digest register A0 and store digest word B in the second digest register A1; and in each round in the second set, store digest word A in the second digest register A1 and store digest word B in the first digest register A0.

In an example, the portion size N is equal to word size W divided by number of cycles C.

In an example, the hardware accelerator is further to store the message in a plurality of message registers, wherein each message register is to store a message word with a size of W bits; and in each cycle of each round of the plurality of rounds, use W bits from a first message register, W bits from a second message register, N bits from a third message register, and N bits from a fourth message register for a message expander function.

In an example, the hardware accelerator is further to, in each cycle of each round, generate N bits to be added to digest word A, and generate N bits to be added to digest word E.

In an example, the hardware accelerator is further to, in each cycle of each round, use N bits from a digest word C for the Maj function, use N bits from a digest word D for a first addition function, use N bits from a digest word G for a Ch function, and use N bits from a digest word H for a second addition function.

In another example, a method for performing cryptographic hash operations includes: receiving a message to be processed using a SHA-2 algorithm; storing digest words A to H in a plurality of digest registers, wherein each digest word comprises W bits, wherein each digest word comprises a plurality of portions that each have a size of N bits, wherein the plurality of digest registers includes a first digest register A0 and a second digest register A1; performing a plurality of rounds, wherein the plurality of rounds is divided into a first set and a second set, the first set and the second selected from a set of even-numbered rounds and a set of odd-numbered rounds; in each round in the first set, storing digest word A in the first digest register A0 and storing digest word B in the second digest register A1; in each round in the second set, storing digest word A in the second digest register A1 and storing digest word B in the first digest register A0.

In an example, the method further includes, in each cycle of each round in the first set: using W bits from the first digest register A0 for a Σ0function and using N bits from the second digest register A1 for a Maj function; in each cycle of each round in the second set, using W bits from the second digest register A1 for the Σ0function and using N bits from the first digest register A0 for the Maj function.

In an example, the plurality of digest registers further includes a third digest register E0 and a fourth digest register E1, and the method further includes, in each cycle of each round in the first set, use W bits from the third digest register E0 for a Σ1function and use N bits from the fourth digest register E1 for a Ch function; and in each cycle of each round in the second set, use W bits from the fourth digest register E1 for the Σ1function and use N bits from the third digest register E0 for the Ch function.

In an example, the method further includes, in each round in the first set, storing digest word E in the third digest register E0 and storing digest word F in the fourth digest register E1; in each round in the second set, storing digest word E in the fourth digest register E1 and storing digest word F in the third digest register E0.

In an example, the portion size N is equal to word size W divided by number of cycles C, where word size W is selected from 32 bits and 64 bits, and where portion size N is selected from 2 bits and 4 bits.

In an example, the method further includes, in each cycle of each round, generating N bits to be added to digest word A and generating N bits to be added to digest word E.

In another example, a machine readable medium includes stored data, which if used by at least one machine, causes the at least one machine to fabricate at least one integrated circuit to perform the method of any of the above examples.

In another example, an apparatus for processing instructions is configured to perform the method of any of the above examples.

In another example, a system for performing cryptographic hash operations includes a processor and an external memory coupled to the processor. The processor includes an accelerator for performing a Secure Hash Algorithm 2 (SHA-2) algorithm, the accelerator to: perform a plurality of rounds, where each round comprises a plurality of C cycles, where the plurality of rounds is divided into a first set and a second set selected from a set of even-numbered rounds and a set of odd-numbered rounds; in each round of the first set, storing digest word A in a first digest register A0 and storing digest word E in a third digest register E0; in each round of the second set, store digest word A in a second digest register A1 and store digest word E in a fourth digest register E1.

In an example, each digest word comprises W bits, wherein each digest word comprises a plurality of portions that each have a size of N bits. The accelerator is further to, in each cycle of each round of the first set, use W bits from the first digest register A0 for a Σ0function, and use N bits from the second digest register A1 for a Maj function; in each cycle of each round of the second set, use W bits from the second digest register A1 for the Σ0function, and use N bits from the first digest register A0 for the Maj function.

In an example, the portion size N is equal to word size W divided by number of cycles C.

In an example, the word size W is selected from 32 bits and 64 bits, and the portion size N is selected from 2 bits and 4 bits.

In an example, the accelerator is further to, in each cycle of each round in the first set, use W bits from the third digest register E0 for a Σ1function and use N bits from the fourth digest register E1 for a Ch function; and in each cycle of each round in the second set, use W bits from the fourth digest register E1 for the Σ1function and use N bits from the third digest register E0 for the Ch function.

In an example, the accelerator is further to, in each cycle of each round, generate a first carry value associated with digest word A, and generate a second carry value associated with digest word E.

In an example, the accelerator is further to receive a message to be processed using the SHA-2 algorithm; store the message in a plurality of message registers, where each message register is to store a message word of W bits; and in each cycle of each round, generate N bits of a message expansion using W bits from a first message register, W bits from a second message register, N bits from a third message register, and N bits from a fourth message register.

In an example, the SHA-2 algorithm is one selected from SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256.

In another example, a machine-readable medium has stored thereon data, which if used by at least one machine, causes the at least one machine to fabricate at least one integrated circuit to perform a method. The method includes: receiving a message to be processed using a SHA-2 algorithm; storing digest words A to H in a plurality of digest registers, where each digest word comprises W bits, where each digest word comprises a plurality of portions that each have a size of N bits, where the plurality of digest registers includes a first digest register A0 and a second digest register A1; performing a plurality of rounds, where the plurality of rounds is divided into a first set and a second set, the first set and the second selected from a set of even-numbered rounds and a set of odd-numbered rounds; in each round in the first set, storing digest word A in the first digest register A0 and storing digest word B in the second digest register A1; in each round in the second set, storing digest word A in the second digest register A1 and storing digest word B in the first digest register A0.

In an example, the method further includes, in each cycle of each round in the first set, using W bits from the first digest register A0 for a Σ0function and using N bits from the second digest register A1 for a Maj function; in each cycle of each round in the second set, using W bits from the second digest register A1 for the Σ0function and using N bits from the first digest register A0 for the Maj function.

In an example, the plurality of digest registers further includes a third digest register E0 and a fourth digest register E1. The method further includes, in each cycle of each round in the first set, use W bits from the third digest register E0 for a Σ1function and use N bits from the fourth digest register E1 for a Ch function; in each cycle of each round in the second set, use W bits from the fourth digest register E1 for the Σ1function and use N bits from the third digest register E0 for the Ch function.

In an example, the method further includes, in each round in the first set, storing digest word E in the third digest register E0 and storing digest word F in the fourth digest register E1; in each round in the second set, storing digest word E in the fourth digest register E1 and storing digest word F in the third digest register E0.

In an example, the portion size N is equal to word size W divided by number of cycles C, where word size W is selected from 32 bits and 64 bits, and where portion size N is selected from 2 bits and 4 bits.

In an example, the method further includes, in each cycle of each round, generating N bits to be added to digest word A and generating N bits to be added to digest word E.