summaryrefslogblamecommitdiff
path: root/streebog_hash/streebog_core_lps.v
blob: a668f167616650d5689480d4e3a65816687da098 (plain) (tree)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405




















































































































































































































































































































































































































                                                                                                                                                                                                     
`timescale 1ns / 1ps

module streebog_core_lps
	(
		clk,
		ena, rdy, last,
		din, dout
	);
	
	
		//
		// Parameters
		//
	parameter	PS_PIPELINE_STAGES	=  8;	// 2, 4, 8
	parameter	L_PIPELINE_STAGES		=  8;	// 2, 4, 8, 16, 32, 64


		//
		// Ports
		//
	input		wire				clk;		// core clock
	input		wire				ena;		// start transformation flag
	output	wire				rdy;		// transformation done flag (dout is valid)
	output	wire				last;		// transformation about to complete (rdy flag will be asserted during the next cycle)
	input		wire	[511:0]	din;		// input data to transform
	output	wire	[511:0]	dout;		// output data (result of transformation)
	
				
		/*
		 * This LPS core has parametrized internal pipeline. P and S transformations are combined into one PS transformation and
		 * have common pipeline. L transformation has its own separate pipeline. The total latency of this core is thus
		 * PS_PIPELINE_STAGES*L_PIPELINE_STAGES. The fastest version completes the tranformation in 2*2=4 cycles, the slowest
		 * version requires 8*64=512 cycles. S transformation substitutes bytes according to a lookup table. P transformation does
		 * permutation of input bytes. L transformation multiplies input data by a special predefined matrix. If you don't understand
		 * how matrices are multiplied, you should not try to understand how the following code works. This may damage your brain.
		 * You've been warned. Seriously.
		 *
		 */


		//
		// Constants
		//
		
		/*
		 * PS transformation operates on 64-bit words. Input data contains 512/64=8 such words.
		 * Depending on PS pipeline stage count we can transform 1, 2 or 4 words at a time.
		 *
		 * L transformation operates on 64-bit words. Depending on L pipeline stage count we
		 * can transform 1, 2, 4, 8, 16 or 32 bits of a word at a time.
		 *
		 */

	localparam	PS_WORDS_AT_ONCE	=  8 / PS_PIPELINE_STAGES;
	localparam	L_BITS_AT_ONCE		= 64 / L_PIPELINE_STAGES;
	
		/*
		 * These functions return number of bytes needed to store pipeline stage counters. They will
		 * also prevent users from specifying illegal pipeline widths . This module will not synthesize
		 * with invalid pipeline stage count, because counter width will not be explicitely defined.
		 *
		 */
	
	function	integer	PS_NUM_COUNT_BITS;
		input	integer	x;
		begin
			case (x)
				2:	PS_NUM_COUNT_BITS = 1;
				4:	PS_NUM_COUNT_BITS = 2;
				8:	PS_NUM_COUNT_BITS = 3;
			endcase
		end
	endfunction
	
	function	integer	L_NUM_COUNT_BITS;
		input	integer	y;
		begin
			case (y)
				 2:	L_NUM_COUNT_BITS = 1;
				 4:	L_NUM_COUNT_BITS = 2;
				 8:	L_NUM_COUNT_BITS = 3;
				16:	L_NUM_COUNT_BITS = 4;
				32:	L_NUM_COUNT_BITS = 5;
				64:	L_NUM_COUNT_BITS = 6;
			endcase
		end
	endfunction
	
	
		//
		// Counter Widths
		//
	localparam	L_CNT_BITS	= L_NUM_COUNT_BITS(L_PIPELINE_STAGES);		// width of L counter
	localparam	PS_CNT_BITS	= PS_NUM_COUNT_BITS(PS_PIPELINE_STAGES);	// width of PS counter
	
	
		//
		// Input Multiplexor
		//
	wire	[63: 0]	din_mux[0:7];		// eight 64-bit words
	
		/*
		 * This multiplexor does the P transformation. P transformation is effectively a matrix
		 * transposition. Input 512-bit word is treated as a 8x8 byte matrix. Multiplexor outputs
		 * a set of 8 64-bit words. These words are columns of the original matrix (transposition
		 * turns rows into colums).
		 *
		 */
	
	genvar i, j;
	generate for (i=0; i<8; i=i+1)
		begin: gen_din_mux_i
			for (j=0; j<8; j=j+1) begin: gen_din_mux_j
				assign din_mux[i][8*j + 7 : 8*j] = din[64*j + 8*i + 7 : 64*j + 8*i];
			end
		end
	endgenerate
	
	
		//
		// Output Multiplexor
		//
	reg	[63: 0]	dout_mux[0:7];		// eight 64-bit words
	
		/*
		 * Output 64-bit subwords are concatenated to form output 512-bit word.
		 *
		 */
		 
	genvar k;
	generate for (k=0; k<8; k=k+1)
		begin: gen_dout_mux
			assign dout[64*k+63:64*k] = dout_mux[k];
		end
	endgenerate
	
	
		//
		// PS and L Counters
		//
		
		/*
		 * These counters control internal data flow of this core. For example, if PS has 2 stages and
		 * L has 4 stages, then the count will look like this:
		 *     ____
		 * ENA     \\\________________________________
		 *     _____                                 _
		 * RDY  ^   \_______________________________/
		 *      |   |   |   |   |   |   |   |   |   |
		 * +----+---+---+---+---+---+---+---+---+---+-
		 * | PS | 0 | 0 | 0 | 0 | 1 | 1 | 1 | 1 | 0 |
		 * +----+---+---+---+---+---+---+---+---+---+-
		 * |  L | 0 | 1 | 2 | 3 | 0 | 1 | 2 | 3 | 0 |
		 * +----+---+---+---+---+---+---+---+---+---+-
		 *        ^               ^               |
		 *        |               |               +--> both counters will be zero during the last cycle
		 *        |               |
		 *        +---------------+------------------> preloading of new word(s) into S lookup table(s)
		 *
		 */
		 
	reg	[ L_CNT_BITS-1:0]	l_count	= { L_CNT_BITS{1'b0}};
	reg	[PS_CNT_BITS-1:0]	ps_count	= {PS_CNT_BITS{1'b0}};


		//
		// Handy Flags
		//
		
		/*
		 * These flags are used instead of lengthy (z_count == {Z_CNT_BITS{1'bZ}}) comparisons.
		 *
		 */

	wire	 l_count_done	= ( l_count == { L_CNT_BITS{1'b1}}) ? 1 : 0;
	wire	ps_count_done	= (ps_count == {PS_CNT_BITS{1'b1}}) ? 1 : 0;
	
	wire	 l_count_zero	= ( l_count == { L_CNT_BITS{1'b0}}) ? 1 : 0;
	wire	ps_count_zero	= (ps_count == {PS_CNT_BITS{1'b0}}) ? 1 : 0;
	
	
		//
		// Preload Flags
		//
		
		/*
		 * These flags are used as clock enables for S lookup table.
		 *
		 */
		
	wire	ps_preload_first	= (rdy && ena);
	wire	ps_preload_next	= (!rdy && !ps_count_zero && l_count_zero);
	
	
		//
		// Last Flag
		//
		
		/*
		 * This flag indicates that core operation is about to complete.
		 *
		 */
	assign last = !rdy && ps_count_zero && l_count_zero;

	
		//
		// Counter Logic
		//
	always @(posedge clk) begin
		//
		if (!rdy && l_count_done)								ps_count	<= ps_count + 1'b1;	// next word(s)
		//
		if (rdy && ena)				 							 l_count	<=  l_count + 1'b1;	// start of transformation
		//
		if (!rdy && !(ps_count_zero && l_count_zero))	 l_count	<=  l_count + 1'b1;	// next part of word(s)
		//
	end
	
	
		//
		// Ready Output Register
		//
	reg rdy_reg = 1'b1;
	assign rdy = rdy_reg;
	
	
		//
		// Ready Set and Clear Logic
		//
	always @(posedge clk) begin
		//
		if (rdy && ena)										rdy_reg <= 0;	// start of transformation
		//
		if (!rdy && l_count_zero && ps_count_zero)	rdy_reg <= 1;	// end of transformation
		//
	end
		
		
		//
		// S Table Indices
		//
		
		/*
		 * To transform several words at once a set of indices is required.
		 *
		 */
		
	wire	[ 2: 0]	s_in_offset	[0:PS_WORDS_AT_ONCE-1];		// indices of words being transformed
	wire	[63: 0]	s_out			[0:PS_WORDS_AT_ONCE-1];		// output words of S transformation
	
	assign s_in_offset[0] = ps_count * PS_WORDS_AT_ONCE;	// the first index is defined by PS counter,
																			// following indices are linearly increasing
	
	genvar sw, sb;														// word and byte counter
	generate for (sw=1; sw<PS_WORDS_AT_ONCE; sw=sw+1)
		begin: gen_s_in_offset
			assign s_in_offset[sw] = s_in_offset[sw-1] + 1'b1;
		end
	endgenerate
	
	
		//
		// S Lookup Table
		//
	generate for (sw=0; sw<PS_WORDS_AT_ONCE; sw=sw+1)
		begin: gen_s_out_word
			for (sb=0; sb<8; sb=sb+1) begin: gen_s_out_byte
				//
				(* ROM_STYLE="BLOCK" *)
				//
				streebog_rom_s_table s_table
				(
					.clk		(clk),
					.ena		(ps_preload_first | ps_preload_next),
					.din		(din_mux[s_in_offset[sw]][8*sb + 7 : 8*sb]),
					.dout		(s_out[sw][8*sb + 7 : 8*sb])
				);
				//
			end
		end
	endgenerate
	
	
	
		//
		// A Matrix Indices
		//
		
		/*
		 * To transform several bits at once a set of indices is required.
		 *
		 */		
		 
	wire	[ 5: 0]	l_in_offset	[0:L_BITS_AT_ONCE-1];	// indices of bits being transformed
	wire	[63: 0]	l_out			[0:L_BITS_AT_ONCE-1];	// output bits of L transformation

	assign l_in_offset[0] = l_count * L_BITS_AT_ONCE;	// the first index is defined by L counter,
																		// following indices are linearly increasing
	
	genvar l;
	generate for (l=1; l<L_BITS_AT_ONCE; l=l+1)
		begin: gen_l_in_offset
			assign l_in_offset[l] = l_in_offset[l-1] + 1'b1;
		end
	endgenerate
	
	
		//
		// A Matrix
		//
	generate for (l=0; l<L_BITS_AT_ONCE; l=l+1)
		begin: gen_l_out		
			//
			(* ROM_STYLE="BLOCK" *)
			//
			streebog_rom_a_matrix a_matrix
			(
				.clk		(clk),
				.din		(l_in_offset[l]),
				.dout		(l_out[l])
			);
			//
		end
	endgenerate
	
	
		//
		// Multiplication Logic
		//
		
		/*
		 * Original specification describes multiplication method that effectively adds
		 * matrix rows based on source vector items. Instead of that multiplication is
		 * done column-by-column.
		 *
		 */
		 
	wire	[L_BITS_AT_ONCE-1:0]	l_out_part[0:PS_WORDS_AT_ONCE-1];
	
	genvar lw, lb;
	generate for (lw=0; lw<PS_WORDS_AT_ONCE; lw=lw+1)
		begin: gen_l_out_part
			for (lb=0; lb<L_BITS_AT_ONCE; lb=lb+1) begin: gen_l_out_bit
				//
				assign l_out_part[lw][lb] = ^(l_out[lb] & s_out[lw]);
				//
			end
		end
	endgenerate
	
	
		/*
		 * PS and L transformations have 1-cycle latency, so delayed versions
		 * of offsets are needed to update output registers accordingly.
		 *
		 */
		 
	reg	[PS_CNT_BITS-1:0]	ps_count_dly	= 0;	// delayed PS counter
	reg	[ L_CNT_BITS-1:0]	 l_count_dly	= 0;	// delayed L counter
	
	always @(posedge clk) ps_count_dly <= ps_count;
	always @(posedge clk)  l_count_dly <=  l_count;
	
	
		//
		// Output Offset Tables
		//
	wire	[ 2: 0]	dout_offset_word	[0:PS_WORDS_AT_ONCE-1];
	wire	[ 5: 0]	dout_offset_bit	[0:L_BITS_AT_ONCE  -1];

	assign dout_offset_word[0] = ps_count_dly * PS_WORDS_AT_ONCE;
	assign dout_offset_bit[0]  =  l_count_dly * L_BITS_AT_ONCE;
	
	genvar z;
	
	generate for (z=1; z<PS_WORDS_AT_ONCE; z=z+1)
		begin: gen_dout_offset_word
			assign dout_offset_word[z] = dout_offset_word[z-1] + 1'b1;
		end
	endgenerate
	
	generate for (z=1; z<L_BITS_AT_ONCE; z=z+1)
		begin: gen_dout_offset_bit
			assign dout_offset_bit[z] = dout_offset_bit[z-1] + 1'b1;
		end
	endgenerate
	
	
	
		//
		// Output Logic
		//
	integer lps_w, lps_b;
	
	always @(posedge clk)
		//
		if (! rdy)
			//
			for (lps_w=0; lps_w<PS_WORDS_AT_ONCE; lps_w=lps_w+1)
				for (lps_b=0; lps_b<L_BITS_AT_ONCE; lps_b=lps_b+1)
					dout_mux[dout_offset_word[lps_w]][dout_offset_bit[lps_b]] <= l_out_part[lps_w][lps_b];
					//dout_mux[dout_offset_word[lps_w]][L_BITS_AT_ONCE*l_count_dly+lps_b] <= l_out_part[lps_w][lps_b];
	
	
endmodule