path: root/rtl/modular/ecdsa256_modular_multiplier.v

//------------------------------------------------------------------------------
//
// ecdsa256_modular_multiplier.v
// -----------------------------------------------------------------------------
// Modular multiplier for P-256 prime.
//
// Authors: Pavel Shatov
//
// Copyright (c) 2015-2016, 2018 NORDUnet A/S
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are met:
//
// - Redistributions of source code must retain the above copyright notice,
//   this list of conditions and the following disclaimer.
//
// - Redistributions in binary form must reproduce the above copyright notice,
//   this list of conditions and the following disclaimer in the documentation
//   and/or other materials provided with the distribution.
//
// - Neither the name of the NORDUnet nor the names of its contributors may be
//   used to endorse or promote products derived from this software without
//   specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
// ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
// LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
// SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
// CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
// POSSIBILITY OF SUCH DAMAGE.
//
//------------------------------------------------------------------------------

module ecdsa256_modular_multiplier
  (
   clk, rst_n,
   ena, rdy,
   a_addr, b_addr, p_addr, p_wren,
   a_din, b_din, p_dout
   );


    //
    // Settings
    //
    `include "cryptech_primitive_switch.vh"
    

   //
   // Constants
   //
   localparam	OPERAND_NUM_WORDS				= 8;
   localparam	WORD_COUNTER_WIDTH				= 3;


   //
   // Handy Numbers
   //
   localparam	[WORD_COUNTER_WIDTH-1:0]	WORD_INDEX_ZERO	= 0;
   localparam	[WORD_COUNTER_WIDTH-1:0]	WORD_INDEX_LAST	= OPERAND_NUM_WORDS - 1;


   //
   // Handy Functions
   //
   function	[WORD_COUNTER_WIDTH-1:0]	WORD_INDEX_NEXT_OR_ZERO;
      input	[WORD_COUNTER_WIDTH-1:0]	WORD_INDEX_CURRENT;
      begin
	 WORD_INDEX_NEXT_OR_ZERO = (WORD_INDEX_CURRENT < WORD_INDEX_LAST) ?
				   WORD_INDEX_CURRENT + 1'b1 : WORD_INDEX_ZERO;
      end
   endfunction

   function	[WORD_COUNTER_WIDTH-1:0]	WORD_INDEX_PREVIOUS_OR_LAST;
      input	[WORD_COUNTER_WIDTH-1:0]	WORD_INDEX_CURRENT;
      begin
	 WORD_INDEX_PREVIOUS_OR_LAST = (WORD_INDEX_CURRENT > WORD_INDEX_ZERO) ?
				       WORD_INDEX_CURRENT - 1'b1 : WORD_INDEX_LAST;
      end
   endfunction


   //
   // Ports
   //
   input	wire					clk;	// system clock
   input	wire					rst_n;	// active-low async reset

   input	wire 					ena;	// enable input
   output	wire 					rdy;	// ready output

   output	wire [WORD_COUNTER_WIDTH-1:0] 		a_addr;	// index of current A word
   output	wire [WORD_COUNTER_WIDTH-1:0] 		b_addr;	// index of current B word
   output	wire [WORD_COUNTER_WIDTH-1:0] 		p_addr;	// index of current P word
   output	wire 					p_wren;	// store current P word now

   input	wire [                  31:0] 		a_din;	// A
   input	wire [                  31:0] 		b_din;	// B
   output	wire [                  31:0] 		p_dout;	// P = A * B mod N


   //
   // Word Indices
   //
   reg [WORD_COUNTER_WIDTH-1:0] 			index_a;
   reg [WORD_COUNTER_WIDTH-1:0] 			index_b;

   /* map registers to output ports */
   assign a_addr	= index_a;
   assign b_addr	= index_b;

   //
   // FSM
   //
   localparam	FSM_SHREG_WIDTH	= (1 * OPERAND_NUM_WORDS + 1) + (2 * OPERAND_NUM_WORDS + 1) + (2 * OPERAND_NUM_WORDS + 2) + (0 * OPERAND_NUM_WORDS + 2) + 1;

   reg [FSM_SHREG_WIDTH-1:0] 				fsm_shreg;

   assign rdy = fsm_shreg[0];

   wire [1 * OPERAND_NUM_WORDS-1:0] 			fsm_shreg_inc_index_a	= fsm_shreg[FSM_SHREG_WIDTH - (0 * OPERAND_NUM_WORDS + 1) : FSM_SHREG_WIDTH - (1 * OPERAND_NUM_WORDS + 0)];
   wire [1 * OPERAND_NUM_WORDS-1:0] 			fsm_shreg_store_word_a	= fsm_shreg[FSM_SHREG_WIDTH - (0 * OPERAND_NUM_WORDS + 2) : FSM_SHREG_WIDTH - (1 * OPERAND_NUM_WORDS + 1)];
   wire [2 * OPERAND_NUM_WORDS-1:0] 			fsm_shreg_inc_index_b	= fsm_shreg[FSM_SHREG_WIDTH - (1 * OPERAND_NUM_WORDS + 1) : FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 1)];
   wire [2 * OPERAND_NUM_WORDS-2:0] 			fsm_shreg_store_si_msb	= fsm_shreg[FSM_SHREG_WIDTH - (1 * OPERAND_NUM_WORDS + 2) : FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 1)];
   wire [0 * OPERAND_NUM_WORDS-0:0] 			fsm_shreg_store_si_lsb	= fsm_shreg[FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 2) : FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 2)];
   wire [2 * OPERAND_NUM_WORDS-2:0] 			fsm_shreg_shift_si	= fsm_shreg[FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 3) : FSM_SHREG_WIDTH - (5 * OPERAND_NUM_WORDS + 1)];
   wire [0 * OPERAND_NUM_WORDS-0:0] 			fsm_shreg_mask_cw1_sum	= fsm_shreg[FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 4) : FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 4)];
   wire [2 * OPERAND_NUM_WORDS-1:0] 			fsm_shreg_store_c_word	= fsm_shreg[FSM_SHREG_WIDTH - (3 * OPERAND_NUM_WORDS + 5) : FSM_SHREG_WIDTH - (5 * OPERAND_NUM_WORDS + 4)];
   wire [0 * OPERAND_NUM_WORDS-0:0] 			fsm_shreg_reduce_start	= fsm_shreg[FSM_SHREG_WIDTH - (5 * OPERAND_NUM_WORDS + 5) : FSM_SHREG_WIDTH - (5 * OPERAND_NUM_WORDS + 5)];
   wire [0 * OPERAND_NUM_WORDS-0:0] 			fsm_shreg_reduce_stop	= fsm_shreg[FSM_SHREG_WIDTH - (5 * OPERAND_NUM_WORDS + 6) : FSM_SHREG_WIDTH - (5 * OPERAND_NUM_WORDS + 6)];

   wire 						inc_index_a		= |fsm_shreg_inc_index_a;
   wire 						store_word_a		= |fsm_shreg_store_word_a;
   wire 						inc_index_b		= |fsm_shreg_inc_index_b;
   wire 						clear_mac_ab		= |fsm_shreg_inc_index_b;
   wire 						shift_wide_a		= |fsm_shreg_inc_index_b;
   wire 						enable_mac_ab		= |fsm_shreg_inc_index_b;
   wire 						store_si_msb		= |fsm_shreg_store_si_msb;
   wire 						store_si_lsb		=  fsm_shreg_store_si_lsb;
   wire 						shift_si		= |fsm_shreg_shift_si;
   wire 						mask_cw1_sum		=  fsm_shreg_mask_cw1_sum;
   wire 						store_c_word		= |fsm_shreg_store_c_word;
   wire 						reduce_start		=  fsm_shreg_reduce_start;
   wire 						reduce_stop		=  fsm_shreg_reduce_stop;


   //
   // FSM Logic
   //
   wire 						reduce_done;

   always @(posedge clk or negedge rst_n)
     //
     if (rst_n == 1'b0)
       //
       fsm_shreg <= {{FSM_SHREG_WIDTH-1{1'b0}}, 1'b1};
   //
     else begin
	//
	if (rdy)
	  fsm_shreg <= {ena, {FSM_SHREG_WIDTH-2{1'b0}}, ~ena};
	//
	else if (!reduce_stop || reduce_done)
	  fsm_shreg <= {1'b0, fsm_shreg[FSM_SHREG_WIDTH-1:1]};
	//
     end


   //
   // Word Index Increment Logic
   //
   reg	index_b_ff;

   always @(posedge clk)
     //
     if (inc_index_b) index_b_ff <= ~index_b_ff;
     else index_b_ff <= 1'b0;

   always @(posedge clk)
     //
     if (rdy) begin
	//
	index_a		<= WORD_INDEX_ZERO;
	index_b		<= WORD_INDEX_LAST;
	//
     end else begin
	//
	if (inc_index_a)		index_a	<= WORD_INDEX_NEXT_OR_ZERO(index_a);
	if (inc_index_b && !index_b_ff)	index_b	<= WORD_INDEX_PREVIOUS_OR_LAST(index_b);
	//
     end


   //
   // Wide Operand Buffer
   //
   reg	[255:0]	buf_a_wide;

   always @(posedge clk)
     //
     if (store_word_a)
       buf_a_wide <= {buf_a_wide[16 +: 256 - 3 * 16], {a_din[15:0], a_din[31:16]}, buf_a_wide[256 - 2 * 16 +: 16]};
     else if (shift_wide_a)
       buf_a_wide <= {buf_a_wide[256-(16+1):0], buf_a_wide[256-16+:16]};


   //
   // Multiplier Array
   //
   wire 	mac_inhibit;	// control signal to pause all accumulators

   wire [46: 0] mac[0:15];	// outputs of all accumulators
   reg [15: 0] 	mac_clear;	// individual per-accumulator clear flag

   assign mac_inhibit = ~enable_mac_ab;

   always @(posedge clk)
     //
     if (!clear_mac_ab)
       mac_clear <= {16{1'b1}};
     else begin

	if (mac_clear == {16{1'b1}})
	  mac_clear <= {{14{1'b0}}, 1'b1, {1'b0}};
	else
	  mac_clear <= (mac_clear[15] == 1'b0) ? {mac_clear[14:0], 1'b0} : {16{1'b1}};


     end

     //
     // Array of parallel multipliers
     //
     genvar i;
     generate for (i=0; i<16; i=i+1)
       begin : gen_mac_array
	  //
	  `CRYPTECH_PRIMITIVE_MAC16 mac16_inst
		     (
		      .clk		(clk),
		      .ce		(~mac_inhibit),

		      .clr		(mac_clear[i]),

		      .a		(buf_a_wide[16*i+:16]),
		      .b		(index_b_ff ? b_din[15:0] : b_din[31:16]),
		      .s		(mac[i])
		      );
	  //
       end
     endgenerate

     //
     // Intermediate Words
     //
     reg	[47*(2*OPERAND_NUM_WORDS-1)-1:0]	si_msb;
     reg	[47*(2*OPERAND_NUM_WORDS-0)-1:0]	si_lsb;


     wire	[47*(2*OPERAND_NUM_WORDS-1)-1:0]	si_msb_new;
     wire	[47*(2*OPERAND_NUM_WORDS-0)-1:0]	si_lsb_new;

     generate for (i=0; i<16; i=i+1)
       begin : gen_si_lsb_new
	  assign si_lsb_new[47*i+:47] = mac[15-i];
       end
     endgenerate

     generate for (i=1; i<16; i=i+1)
       begin : gen_si_msb_new
	  assign si_msb_new[47*(15-i)+:47] = mac_clear[i] ? mac[i] : si_msb[47*(15-i)+:47];
       end
     endgenerate

     always @(posedge clk) begin
	//
	if (shift_si) begin
	   si_msb <= {{2*47{1'b0}}, si_msb[15*47-1:2*47]};
	   si_lsb <= {si_msb[2*47-1:0], si_lsb[16*47-1:2*47]};
	end else begin

	   if (store_si_msb)
	     si_msb <= si_msb_new;

	   if (store_si_lsb)
	     si_lsb <= si_lsb_new;
	end

     end


     //
     // Accumulators
     //
     wire	[46: 0]	add47_cw0_s;
     wire	[46: 0]	add47_cw1_s;


     //
     // cw0, b, cw1, b
     //
     reg	[30: 0]	si_prev_dly;
     reg	[15: 0]	si_next_dly;

     always @(posedge clk)
       //
       if (shift_si)
	 si_prev_dly <= si_lsb[93:63];
       else
	 si_prev_dly <= {31{1'b0}};

       always @(posedge clk)
	 //
	 si_next_dly <= si_lsb[62:47];

       wire	[46: 0]	add47_cw0_a = si_lsb[46:0];
       wire	[46: 0]	add47_cw0_b = {{16{1'b0}}, si_prev_dly};

       wire	[46: 0]	add47_cw1_a = add47_cw0_s;
       wire	[46: 0]	add47_cw1_b = {{15{1'b0}}, si_next_dly, mask_cw1_sum ? {16{1'b0}} : {1'b0, add47_cw1_s[46:32]}};

       `CRYPTECH_PRIMITIVE_ADD47 add47_cw0_inst
	 (
	  .clk	(clk),
	  .a		(add47_cw0_a),
	  .b		(add47_cw0_b),
	  .s		(add47_cw0_s)
	  );

       `CRYPTECH_PRIMITIVE_ADD47 add47_cw1_inst
	 (
	  .clk	(clk),
	  .a		(add47_cw1_a),
	  .b		(add47_cw1_b),
	  .s		(add47_cw1_s)
	  );



       //
       // Full-Size Product
       //
       reg	[WORD_COUNTER_WIDTH:0]	bram_c_addr;

       wire	[WORD_COUNTER_WIDTH:0]	reduce_c_addr;
       wire	[                31:0]	reduce_c_word;

       always @(posedge clk)
	 //
	 if (store_c_word)
	   bram_c_addr <= bram_c_addr + 1'b1;
	 else
	   bram_c_addr <= {2*WORD_COUNTER_WIDTH{1'b0}};

	 bram_1rw_1ro_readfirst #
	   (
	    .MEM_WIDTH		(32),
	    .MEM_ADDR_BITS	(WORD_COUNTER_WIDTH + 1)
	    )
	 bram_c_inst
	   (
	    .clk		(clk),

	    .a_addr		(bram_c_addr),
	    .a_wr		(store_c_word),
	    .a_in		(add47_cw1_s[31:0]),
	    .a_out		(),

	    .b_addr		(reduce_c_addr),
	    .b_out		(reduce_c_word)
	    );


	 //
	 // Reduction Stage
	 //
	 ecdsa256_modular_reductor mod_redc_inst
	   (
	    .clk		(clk),
	    .rst_n		(rst_n),

	    .ena		(reduce_start),
	    .rdy		(reduce_done),

	    .x_addr		(reduce_c_addr),
	    .p_addr		(p_addr),
	    .p_wren		(p_wren),

	    .x_din		(reduce_c_word),
	    .p_dout		(p_dout)
	    );


	 endmodule


//------------------------------------------------------------------------------
// End-of-File
//------------------------------------------------------------------------------