Module sha512 

SHA-512 compression worker and multi-worker request pool.

SHA-512 Modules

The fast signer contains full hardware SHA-512 block compression. The signer builds and pads fixed-format blocks; the modules on this page apply the FIPS 180-4 compression function to one 1024-bit block and a supplied 512-bit chaining state.

sha512_compress_3phase

Source: crates/rhdl_ed25519_fast_sha512/rtl/sha512_compress_3phase.sv.

One worker executes one SHA-512 round over three registered phases and reuses that datapath for all 80 rounds. It stores only sixteen schedule words in a circular array. One block occupies a worker for 242 cycles: 240 round-phase cycles, one accumulation cycle, and the handoff back to the ready state. This is iterative occupancy, not 242 physical pipeline stages. It is also not a 512-stage pipeline: 512 is the digest width in bits, while the physical round datapath has three reusable phase boundaries.

The module has no overridable parameters. Its state local parameters are:

State	Function
ST_IDLE	Assert ready; capture state_in and the first 16 schedule words when start is high
ST_A	Read or begin extending W[t]; compute Sigma/choice, Sigma/majority, and h + K[t] partial sums
ST_B	Finish an extended schedule word and form registered T1/T2 bases
ST_C	Compute the new a and e, rotate the eight working words, and advance the round
ST_ACCUM	Add the original chaining words to the final working words and pulse valid_out

For every round t, the phase functions are exact:

1. ST_A reads W[t] for rounds 0-15 or registers the two halves of the circular-schedule recurrence for rounds 16-79. In parallel it calculates Sigma1(e)+Ch(e,f,g), Sigma0(a)+Maj(a,b,c), and h+K[t].
2. ST_B finishes an expanded schedule word when needed, writes that word back into the circular slot, and registers T1 and T2 bases.
3. ST_C forms T1, updates a=T1+T2 and e=d+T1, shifts the other six working words, and advances to the next round or accumulation.

The three phases reduce the longest 64-bit adder chain while retaining one compact iterative worker. Throughput comes from four workers operating on different blocks, not from unrolling 80 SHA rounds.

Ports

Port	Direction	Meaning
clk	input	Rising-edge clock
rst	input	Synchronously returns the worker to ST_IDLE and clears output validity
start	input	Starts a block when ready is high
ready	output	High only in ST_IDLE
state_in	input, 512 bits	Eight big-endian 64-bit chaining words packed from the most significant end
block_in	input, 1024 bits	Sixteen big-endian 64-bit message words packed from the most significant end
valid_out	output	One-cycle pulse when state_out is complete
state_out	output, 512 bits	Updated chaining state after one compression block

Helper functions

Function	Inputs	Result
rotate_right	64-bit value, integer amount	Circular right rotation: right-shifted and wrapped portions combined with bitwise OR
small_sigma0	64-bit value	ROTR1(value) xor ROTR8(value) xor SHR7(value), used by the schedule
small_sigma1	64-bit value	ROTR19(value) xor ROTR61(value) xor SHR6(value), used by the schedule
big_sigma0	64-bit value	ROTR28(value) xor ROTR34(value) xor ROTR39(value), used in T2
big_sigma1	64-bit value	ROTR14(value) xor ROTR18(value) xor ROTR41(value), used in T1

The 80 constants are initialized in k_rom. In the current matching-source U280 OOC build, each worker accounts for one RAMB36 constant ROM and 12 DSP48E2s. The DSPs implement registered 64-bit state and adder operations marked with use_dsp; rotate, choice, majority, and XOR logic remains in LUTs. No message padding occurs in this module.

sha512_compress_pool

Source: crates/rhdl_ed25519_fast_sha512/rtl/sha512_compress_pool4.sv.

The pool instantiates multiple sha512_compress_3phase workers, accepts up to two block requests in one cycle, and emits up to two completions in one cycle. The current signer sets WORKERS=4.

Parameters

Parameter	Default	Meaning
TAG_BITS	8	Width of opaque metadata stored beside each accepted block
WORKERS	4	Number of physical compression workers generated
WORKER_BITS	3	Width of internal worker indices; it must represent every configured worker index

Ports

The suffix 0 or 1 identifies one of two independent request/return lanes.

Port family	Direction	Meaning
clk, rst	input	Shared clock and synchronous reset
request0_valid, request1_valid	input	Request-lane validity
request0_ready, request1_ready	output	A free worker has been allocated to that lane
request0_state, request1_state	input, 512 bits	Starting chaining state
request0_block, request1_block	input, 1024 bits	Message block
request0_tag, request1_tag	input, TAG_BITS	Metadata retained in the allocated worker slot
result0_valid, result1_valid	output	Completion-lane pulse
result0_state, result1_state	output, 512 bits	Completed chaining state
result0_tag, result1_tag	output, TAG_BITS	Tag belonging to the completed state

allocate_rr is a round-robin starting point. Request lane 0 chooses the first ready worker; request lane 1 chooses another ready worker and cannot take the worker selected by an active lane-0 request. Tags remain in per-worker registers. The result combiner scans workers in index order and places the first two simultaneous completions on result lanes 0 and 1. There is no output-ready signal, so downstream FIFOs must absorb every completion. Four current workers therefore use four RAMB36s and 48 DSP48E2s in matching OOC synthesis.