5 * ternlogi <https://bugs.libre-soc.org/show_bug.cgi?id=745>
6 * grev <https://bugs.libre-soc.org/show_bug.cgi?id=755>
7 * remove Rc=1 from ternlog due to conflicts in encoding as well
8 as saving space <https://bugs.libre-soc.org/show_bug.cgi?id=753#c5>
9 * GF2^M <https://bugs.libre-soc.org/show_bug.cgi?id=782>
15 pseudocode: <https://libre-soc.org/openpower/isa/bitmanip/>
17 this extension amalgamates bitmanipulation primitives from many sources, including RISC-V bitmanip, Packed SIMD, AVX-512 and OpenPOWER VSX. Vectorisation and SIMD are removed: these are straight scalar (element) operations making them suitable for embedded applications.
18 Vectorisation Context is provided by [[openpower/sv]].
20 When combined with SV, scalar variants of bitmanip operations found in VSX are added so that VSX may be retired as "legacy" in the far future (10 to 20 years). Also, VSX is hundreds of opcodes, requires 128 bit pathways, and is wholly unsuited to low power or embedded scenarios.
22 ternlogv is experimental and is the only operation that may be considered a "Packed SIMD". It is added as a variant of the already well-justified ternlog operation (done in AVX512 as an immediate only) "because it looks fun". As it is based on the LUT4 concept it will allow accelerated emulation of FPGAs. Other vendors of ISAs are buying FPGA companies to achieve similar objectives.
24 general-purpose Galois Field 2^M operations are added so as to avoid huge custom opcode proliferation across many areas of Computer Science. however for convenience and also to avoid setup costs, some of the more common operations (clmul, crc32) are also added. The expectation is that these operations would all be covered by the same pipeline.
26 note that there are brownfield spaces below that could incorporate some of the set-before-first and other scalar operations listed in [[sv/vector_ops]], and
27 the [[sv/av_opcodes]] as well as [[sv/setvl]]
31 * <https://en.wikiversity.org/wiki/Reed%E2%80%93Solomon_codes_for_coders>
32 * <https://maths-people.anu.edu.au/~brent/pd/rpb232tr.pdf>
36 two major opcodes are needed
38 ternlog has its own major opcode
41 | ------ |--| --------- |
46 2nd major opcode for other bitmanip: minor opcode allocation
49 | ------ |--| --------- |
54 | 011 | | gf/cl madd* |
61 | dest | src1 | subop | op |
62 | ---- | ---- | ----- | -------- |
63 | RT | RA | .. | bmatflip |
67 | dest | src1 | src2 | subop | op |
68 | ---- | ---- | ---- | ----- | -------- |
69 | RT | RA | RB | or | bmatflip |
70 | RT | RA | RB | xor | bmatflip |
71 | RT | RA | RB | | grev |
72 | RT | RA | RB | | clmul* |
73 | RT | RA | RB | | gorc |
74 | RT | RA | RB | shuf | shuffle |
75 | RT | RA | RB | unshuf| shuffle |
76 | RT | RA | RB | width | xperm |
77 | RT | RA | RB | type | minmax |
78 | RT | RA | RB | | av abs avgadd |
79 | RT | RA | RB | type | vmask ops |
88 TODO: convert all instructions to use RT and not RS
90 | 0.5|6.10|11.15|16.20 |21..25 | 26....30 |31| name |
91 | -- | -- | --- | --- | ----- | -------- |--| ------ |
92 | NN | RT | RA |itype/| im0-4 | im5-7 00 |0 | xpermi |
93 | NN | RT | RA | RB | im0-4 | im5-7 00 |1 | grevlog |
94 | NN | RT | RA | s0-4 | im0-4 | im5-7 01 |s5| grevlogi |
95 | NN | RT | RA | RB | RC | mode 010 |Rc| bitmask* |
96 | NN | RS | RA | RB | RC | 00 011 |0 | gfbmadd |
97 | NN | RS | RA | RB | RC | 00 011 |1 | gfbmaddsub |
98 | NN | RS | RA | RB | RC | 01 011 |0 | clmadd |
99 | NN | RS | RA | RB | RC | 01 011 |1 | clmaddsub |
100 | NN | RS | RA | RB | RC | 10 011 |0 | gfpmadd |
101 | NN | RS | RA | RB | RC | 10 011 |1 | gfpmaddsub |
102 | NN | RS | RA | RB | RC | 11 011 | | rsvd |
103 | NN | RT | RA | RB | sh0-4 | sh5 1 111 |Rc| bmrevi |
105 ops (note that av avg and abs as well as vec scalar mask
108 TODO: convert from RA, RB, and RC to correct field names of RT, RA, and RB, and
109 double check that instructions didn't need 3 inputs.
111 | 0.5|6.10|11.15|16.20| 21 | 22.23 | 24....30 |31| name |
112 | -- | -- | --- | --- | -- | ----- | -------- |--| ---- |
113 | NN | RT | RA | RB | 0 | | 0000 110 |Rc| rsvd |
114 | NN | RT | RA | RB | 1 | itype | 0000 110 |Rc| xperm |
115 | NN | RA | RB | RC | 0 | itype | 0100 110 |Rc| minmax |
116 | NN | RA | RB | RC | 1 | 00 | 0100 110 |Rc| av avgadd |
117 | NN | RA | RB | RC | 1 | 01 | 0100 110 |Rc| av abs |
118 | NN | RA | RB | | 1 | 10 | 0100 110 |Rc| rsvd |
119 | NN | RA | RB | | 1 | 11 | 0100 110 |Rc| rsvd |
120 | NN | RA | RB | sh | SH | itype | 1000 110 |Rc| bmopsi |
121 | NN | RT | RA | RB | | | 1100 110 |Rc| srsvd |
122 | NN | RT | RA | RB | 1 | 00 | 0001 110 |Rc| cldiv |
123 | NN | RT | RA | RB | 1 | 01 | 0001 110 |Rc| clmod |
124 | NN | RT | RA | RB | 1 | 10 | 0001 110 |Rc| |
125 | NN | RT | RB | RB | 1 | 11 | 0001 110 |Rc| clinv |
126 | NN | RA | RB | RC | 0 | 00 | 0001 110 |Rc| vec sbfm |
127 | NN | RA | RB | RC | 0 | 01 | 0001 110 |Rc| vec sofm |
128 | NN | RA | RB | RC | 0 | 10 | 0001 110 |Rc| vec sifm |
129 | NN | RA | RB | RC | 0 | 11 | 0001 110 |Rc| vec cprop |
130 | NN | RA | RB | | 0 | | 0101 110 |Rc| rsvd |
131 | NN | RA | RB | RC | 0 | 00 | 0010 110 |Rc| gorc |
132 | NN | RA | RB | sh | SH | 00 | 1010 110 |Rc| gorci |
133 | NN | RA | RB | RC | 0 | 00 | 0110 110 |Rc| gorcw |
134 | NN | RA | RB | sh | 0 | 00 | 1110 110 |Rc| gorcwi |
135 | NN | RA | RB | RC | 1 | 00 | 1110 110 |Rc| bmator |
136 | NN | RA | RB | RC | 0 | 01 | 0010 110 |Rc| grev |
137 | NN | RA | RB | RC | 1 | 01 | 0010 110 |Rc| clmul |
138 | NN | RA | RB | sh | SH | 01 | 1010 110 |Rc| grevi |
139 | NN | RA | RB | RC | 0 | 01 | 0110 110 |Rc| grevw |
140 | NN | RA | RB | sh | 0 | 01 | 1110 110 |Rc| grevwi |
141 | NN | RA | RB | RC | 1 | 01 | 1110 110 |Rc| bmatxor |
142 | NN | RA | RB | RC | 0 | 10 | 0010 110 |Rc| shfl |
143 | NN | RA | RB | sh | SH | 10 | 1010 110 |Rc| shfli |
144 | NN | RA | RB | RC | 0 | 10 | 0110 110 |Rc| shflw |
145 | NN | RA | RB | RC | | 10 | 1110 110 |Rc| rsvd |
146 | NN | RA | RB | RC | 0 | 11 | 1110 110 |Rc| clmulr |
147 | NN | RA | RB | RC | 1 | 11 | 1110 110 |Rc| clmulh |
148 | NN | | | | | | --11 110 |Rc| setvl |
152 Similar to FPGA LUTs: for every bit perform a lookup into a table using an 8bit immediate, or in another register.
154 Like the x86 AVX512F [vpternlogd/vpternlogq](https://www.felixcloutier.com/x86/vpternlogd:vpternlogq) instructions.
159 | 0.5|6.10|11.15|16.20| 21..28|29.30|31|
160 | -- | -- | --- | --- | ----- | --- |--|
161 | NN | RT | RA | RB | im0-7 | 00 |Rc|
164 idx = c << 2 | b << 1 | a
165 return imm[idx] # idx by LSB0 order
168 RT[i] = lut3(imm, RB[i], RA[i], RT[i])
172 also, another possible variant involving swizzle-like selection
173 and masking, this only requires 3 64 bit registers (RA, RS, RB) and
176 Note however that unless XLEN matches sz, this instruction
177 is a Read-Modify-Write: RS must be read as a second operand
178 and all unmodified bits preserved. SVP64 may provide limited
179 alternative destination for RS from RS-as-source, but again
180 all unmodified bits must still be copied.
182 | 0.5|6.10|11.15|16.20|21.28 | 29.30 |31|
183 | -- | -- | --- | --- | ---- | ----- |--|
184 | NN | RS | RA | RB |idx0-3| 01 |sz|
186 SZ = (1+sz) * 8 # 8 or 16
187 raoff = MIN(XLEN, idx0 * SZ)
188 rboff = MIN(XLEN, idx1 * SZ)
189 rcoff = MIN(XLEN, idx2 * SZ)
190 rsoff = MIN(XLEN, idx3 * SZ)
192 for i in range(MIN(XLEN, SZ)):
196 res = lut3(imm, ra, rb, rc)
201 another mode selection would be CRs not Ints.
203 | 0.5|6.8 | 9.11|12.14|15.17|18.20|21.28 | 29.30|31|
204 | -- | -- | --- | --- | --- |-----|----- | -----|--|
205 | NN | BT | BA | BB | BC |m0-3 | imm | 10 |m4|
209 if not mask[i] continue
210 crregs[BT][i] = lut3(imm,
218 signed and unsigned min/max for integer. this is sort-of partly synthesiseable in [[sv/svp64]] with pred-result as long as the dest reg is one of the sources, but not both signed and unsigned. when the dest is also one of the srces and the mv fails due to the CR bittest failing this will only overwrite the dest where the src is greater (or less).
220 signed/unsigned min/max gives more flexibility.
223 uint_xlen_t min(uint_xlen_t rs1, uint_xlen_t rs2)
224 { return (int_xlen_t)rs1 < (int_xlen_t)rs2 ? rs1 : rs2;
226 uint_xlen_t max(uint_xlen_t rs1, uint_xlen_t rs2)
227 { return (int_xlen_t)rs1 > (int_xlen_t)rs2 ? rs1 : rs2;
229 uint_xlen_t minu(uint_xlen_t rs1, uint_xlen_t rs2)
230 { return rs1 < rs2 ? rs1 : rs2;
232 uint_xlen_t maxu(uint_xlen_t rs1, uint_xlen_t rs2)
233 { return rs1 > rs2 ? rs1 : rs2;
240 based on RV bitmanip, covered by ternlog bitops
243 uint_xlen_t cmix(uint_xlen_t RA, uint_xlen_t RB, uint_xlen_t RC) {
244 return (RA & RB) | (RC & ~RB);
251 based on RV bitmanip singlebit set, instruction format similar to shift
252 [[isa/fixedshift]]. bmext is actually covered already (shift-with-mask rldicl but only immediate version).
253 however bitmask-invert is not, and set/clr are not covered, although they can use the same Shift ALU.
255 bmext (RB) version is not the same as rldicl because bmext is a right shift by RC, where rldicl is a left rotate. for the immediate version this does not matter, so a bmexti is not required.
256 bmrev however there is no direct equivalent and consequently a bmrevi is required.
258 bmset (register for mask amount) is particularly useful for creating
259 predicate masks where the length is a dynamic runtime quantity.
260 bmset(RA=0, RB=0, RC=mask) will produce a run of ones of length "mask" in a single instruction without needing to initialise or depend on any other registers.
262 | 0.5|6.10|11.15|16.20|21.25| 26..30 |31| name |
263 | -- | -- | --- | --- | --- | ------- |--| ----- |
264 | NN | RS | RA | RB | RC | mode 010 |Rc| bm* |
266 Immediate-variant is an overwrite form:
268 | 0.5|6.10|11.15|16.20| 21 | 22.23 | 24....30 |31| name |
269 | -- | -- | --- | --- | -- | ----- | -------- |--| ---- |
270 | NN | RS | RB | sh | SH | itype | 1000 110 |Rc| bm*i |
273 uint_xlen_t bmset(RS, RB, sh)
275 int shamt = RB & (XLEN - 1);
277 return RS | (mask << shamt);
280 uint_xlen_t bmclr(RS, RB, sh)
282 int shamt = RB & (XLEN - 1);
284 return RS & ~(mask << shamt);
287 uint_xlen_t bminv(RS, RB, sh)
289 int shamt = RB & (XLEN - 1);
291 return RS ^ (mask << shamt);
294 uint_xlen_t bmext(RS, RB, sh)
296 int shamt = RB & (XLEN - 1);
298 return mask & (RS >> shamt);
302 bitmask extract with reverse. can be done by bitinverting all of RB and getting bits of RB from the opposite end.
304 when RA is zero, no shift occurs. this makes bmextrev useful for
305 simply reversing all bits of a register.
309 rev[0:msb] = rb[msb:0];
312 uint_xlen_t bmextrev(RA, RB, sh)
315 if (RA != 0) (GPR(RA) & (XLEN - 1));
316 shamt = (XLEN-1)-shamt; # shift other end
317 bra = bitreverse(RB) # swap LSB-MSB
319 return mask & (bra >> shamt);
323 | 0.5|6.10|11.15|16.20|21.26| 27..30 |31| name |
324 | -- | -- | --- | --- | --- | ------- |--| ------ |
325 | NN | RT | RA | RB | sh | 1 011 |Rc| bmrevi |
330 generalised reverse combined with a pair of LUT2s and allowing
331 zero when RA=0 provides a wide range of instructions
332 and a means to set regular 64 bit patterns in one
335 the two LUT2s are applied left-half (when not swapping)
336 and right-half (when swapping) so as to allow a wider
339 grevlut should be arranged so as to produce the constants
340 needed to put into bext (bitextract) so as in turn to
341 be able to emulate x86 pmovmask instructions <https://www.felixcloutier.com/x86/pmovmskb>
343 <img src="/openpower/sv/grevlut2x2.jpg" width=700 />
348 return imm[idx] # idx by LSB0 order
350 dorow(imm8, step_i, chunksize):
352 if (j&chunk_size) == 0
356 step_o[j] = lut2(imm, step_i[j], step_i[j ^ chunk_size])
359 uint64_t grevlut64(uint64_t RA, uint64_t RB, uint8 imm)
365 if (shamt & step) x = dorow(imm, x, step)
373 based on RV bitmanip, this is also known as a butterfly network. however
374 where a butterfly network allows setting of every crossbar setting in
375 every row and every column, generalised-reverse (grev) only allows
376 a per-row decision: every entry in the same row must either switch or
379 <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/8/8c/Butterfly_Network.jpg/474px-Butterfly_Network.jpg" />
382 uint64_t grev64(uint64_t RA, uint64_t RB)
386 if (shamt & 1) x = ((x & 0x5555555555555555LL) << 1) |
387 ((x & 0xAAAAAAAAAAAAAAAALL) >> 1);
388 if (shamt & 2) x = ((x & 0x3333333333333333LL) << 2) |
389 ((x & 0xCCCCCCCCCCCCCCCCLL) >> 2);
390 if (shamt & 4) x = ((x & 0x0F0F0F0F0F0F0F0FLL) << 4) |
391 ((x & 0xF0F0F0F0F0F0F0F0LL) >> 4);
392 if (shamt & 8) x = ((x & 0x00FF00FF00FF00FFLL) << 8) |
393 ((x & 0xFF00FF00FF00FF00LL) >> 8);
394 if (shamt & 16) x = ((x & 0x0000FFFF0000FFFFLL) << 16) |
395 ((x & 0xFFFF0000FFFF0000LL) >> 16);
396 if (shamt & 32) x = ((x & 0x00000000FFFFFFFFLL) << 32) |
397 ((x & 0xFFFFFFFF00000000LL) >> 32);
403 # shuffle / unshuffle
408 uint32_t shfl32(uint32_t RA, uint32_t RB)
412 if (shamt & 8) x = shuffle32_stage(x, 0x00ff0000, 0x0000ff00, 8);
413 if (shamt & 4) x = shuffle32_stage(x, 0x0f000f00, 0x00f000f0, 4);
414 if (shamt & 2) x = shuffle32_stage(x, 0x30303030, 0x0c0c0c0c, 2);
415 if (shamt & 1) x = shuffle32_stage(x, 0x44444444, 0x22222222, 1);
418 uint32_t unshfl32(uint32_t RA, uint32_t RB)
422 if (shamt & 1) x = shuffle32_stage(x, 0x44444444, 0x22222222, 1);
423 if (shamt & 2) x = shuffle32_stage(x, 0x30303030, 0x0c0c0c0c, 2);
424 if (shamt & 4) x = shuffle32_stage(x, 0x0f000f00, 0x00f000f0, 4);
425 if (shamt & 8) x = shuffle32_stage(x, 0x00ff0000, 0x0000ff00, 8);
429 uint64_t shuffle64_stage(uint64_t src, uint64_t maskL, uint64_t maskR, int N)
431 uint64_t x = src & ~(maskL | maskR);
432 x |= ((src << N) & maskL) | ((src >> N) & maskR);
435 uint64_t shfl64(uint64_t RA, uint64_t RB)
439 if (shamt & 16) x = shuffle64_stage(x, 0x0000ffff00000000LL,
440 0x00000000ffff0000LL, 16);
441 if (shamt & 8) x = shuffle64_stage(x, 0x00ff000000ff0000LL,
442 0x0000ff000000ff00LL, 8);
443 if (shamt & 4) x = shuffle64_stage(x, 0x0f000f000f000f00LL,
444 0x00f000f000f000f0LL, 4);
445 if (shamt & 2) x = shuffle64_stage(x, 0x3030303030303030LL,
446 0x0c0c0c0c0c0c0c0cLL, 2);
447 if (shamt & 1) x = shuffle64_stage(x, 0x4444444444444444LL,
448 0x2222222222222222LL, 1);
451 uint64_t unshfl64(uint64_t RA, uint64_t RB)
455 if (shamt & 1) x = shuffle64_stage(x, 0x4444444444444444LL,
456 0x2222222222222222LL, 1);
457 if (shamt & 2) x = shuffle64_stage(x, 0x3030303030303030LL,
458 0x0c0c0c0c0c0c0c0cLL, 2);
459 if (shamt & 4) x = shuffle64_stage(x, 0x0f000f000f000f00LL,
460 0x00f000f000f000f0LL, 4);
461 if (shamt & 8) x = shuffle64_stage(x, 0x00ff000000ff0000LL,
462 0x0000ff000000ff00LL, 8);
463 if (shamt & 16) x = shuffle64_stage(x, 0x0000ffff00000000LL,
464 0x00000000ffff0000LL, 16);
471 based on RV bitmanip.
473 RB contains a vector of indices to select parts of RA to be
477 uint_xlen_t xperm(uint_xlen_t RA, uint_xlen_t RB, int sz_log2)
480 uint_xlen_t sz = 1LL << sz_log2;
481 uint_xlen_t mask = (1LL << sz) - 1;
482 for (int i = 0; i < XLEN; i += sz) {
483 uint_xlen_t pos = ((RB >> i) & mask) << sz_log2;
485 r |= ((RA >> pos) & mask) << i;
489 uint_xlen_t xperm_n (uint_xlen_t RA, uint_xlen_t RB)
490 { return xperm(RA, RB, 2); }
491 uint_xlen_t xperm_b (uint_xlen_t RA, uint_xlen_t RB)
492 { return xperm(RA, RB, 3); }
493 uint_xlen_t xperm_h (uint_xlen_t RA, uint_xlen_t RB)
494 { return xperm(RA, RB, 4); }
495 uint_xlen_t xperm_w (uint_xlen_t RA, uint_xlen_t RB)
496 { return xperm(RA, RB, 5); }
504 uint32_t gorc32(uint32_t RA, uint32_t RB)
508 if (shamt & 1) x |= ((x & 0x55555555) << 1) | ((x & 0xAAAAAAAA) >> 1);
509 if (shamt & 2) x |= ((x & 0x33333333) << 2) | ((x & 0xCCCCCCCC) >> 2);
510 if (shamt & 4) x |= ((x & 0x0F0F0F0F) << 4) | ((x & 0xF0F0F0F0) >> 4);
511 if (shamt & 8) x |= ((x & 0x00FF00FF) << 8) | ((x & 0xFF00FF00) >> 8);
512 if (shamt & 16) x |= ((x & 0x0000FFFF) << 16) | ((x & 0xFFFF0000) >> 16);
515 uint64_t gorc64(uint64_t RA, uint64_t RB)
519 if (shamt & 1) x |= ((x & 0x5555555555555555LL) << 1) |
520 ((x & 0xAAAAAAAAAAAAAAAALL) >> 1);
521 if (shamt & 2) x |= ((x & 0x3333333333333333LL) << 2) |
522 ((x & 0xCCCCCCCCCCCCCCCCLL) >> 2);
523 if (shamt & 4) x |= ((x & 0x0F0F0F0F0F0F0F0FLL) << 4) |
524 ((x & 0xF0F0F0F0F0F0F0F0LL) >> 4);
525 if (shamt & 8) x |= ((x & 0x00FF00FF00FF00FFLL) << 8) |
526 ((x & 0xFF00FF00FF00FF00LL) >> 8);
527 if (shamt & 16) x |= ((x & 0x0000FFFF0000FFFFLL) << 16) |
528 ((x & 0xFFFF0000FFFF0000LL) >> 16);
529 if (shamt & 32) x |= ((x & 0x00000000FFFFFFFFLL) << 32) |
530 ((x & 0xFFFFFFFF00000000LL) >> 32);
536 # Instructions for Carry-less Operations aka. Polynomials with coefficients in `GF(2)`
538 Carry-less addition/subtraction is simply XOR, so a `cladd`
539 instruction is not provided since the `xor[i]` instruction can be used instead.
541 These are operations on polynomials with coefficients in `GF(2)`, with the
542 polynomial's coefficients packed into integers with the following algorithm:
546 """`poly` is a list where `poly[i]` is the coefficient for `x ** i`"""
548 for i, v in enumerate(poly):
553 """returns a list `poly`, where `poly[i]` is the coefficient for `x ** i`.
562 ## Carry-less Multiply Instructions
565 see <https://en.wikipedia.org/wiki/CLMUL_instruction_set> and
566 <https://www.felixcloutier.com/x86/pclmulqdq> and
567 <https://en.m.wikipedia.org/wiki/Carry-less_product>
569 They are worth adding as their own non-overwrite operations
570 (in the same pipeline).
572 ### `clmul` Carry-less Multiply
575 uint_xlen_t clmul(uint_xlen_t RA, uint_xlen_t RB)
578 for (int i = 0; i < XLEN; i++)
585 ### `clmulh` Carry-less Multiply High
588 uint_xlen_t clmulh(uint_xlen_t RA, uint_xlen_t RB)
591 for (int i = 1; i < XLEN; i++)
598 ### `clmulr` Carry-less Multiply (Reversed)
600 Useful for CRCs. Equivalent to bit-reversing the result of `clmul` on
604 uint_xlen_t clmulr(uint_xlen_t RA, uint_xlen_t RB)
607 for (int i = 0; i < XLEN; i++)
609 x ^= RA >> (XLEN-i-1);
614 ## `clmadd` Carry-less Multiply-Add
617 clmadd RT, RA, RB, RC
621 (RT) = clmul((RA), (RB)) ^ (RC)
624 ## `cltmadd` Twin Carry-less Multiply-Add (for FFTs)
627 cltmadd RT, RA, RB, RC
630 TODO: add link to explanation for where `RS` comes from.
633 temp = clmul((RA), (RB)) ^ (RC)
638 ## `cldiv` Carry-less Division
644 TODO: decide what happens on division by zero
647 (RT) = cldiv((RA), (RB))
650 ## `clrem` Carry-less Remainder
656 TODO: decide what happens on division by zero
659 (RT) = clrem((RA), (RB))
662 # Instructions for Binary Galois Fields `GF(2^m)`
666 * <https://courses.csail.mit.edu/6.857/2016/files/ffield.py>
667 * <https://engineering.purdue.edu/kak/compsec/NewLectures/Lecture7.pdf>
668 * <https://foss.heptapod.net/math/libgf2/-/blob/branch/default/src/libgf2/gf2.py>
670 Binary Galois Field addition/subtraction is simply XOR, so a `gfbadd`
671 instruction is not provided since the `xor[i]` instruction can be used instead.
673 ## `GFBREDPOLY` SPR -- Reducing Polynomial
675 In order to save registers and to make operations orthogonal with standard
676 arithmetic, the reducing polynomial is stored in a dedicated SPR `GFBREDPOLY`.
677 This also allows hardware to pre-compute useful parameters (such as the
678 degree, or look-up tables) based on the reducing polynomial, and store them
679 alongside the SPR in hidden registers, only recomputing them whenever the SPR
680 is written to, rather than having to recompute those values for every
683 Because Galois Fields require the reducing polynomial to be an irreducible
684 polynomial, that guarantees that any polynomial of `degree > 1` must have
685 the LSB set, since otherwise it would be divisible by the polynomial `x`,
686 making it reducible, making whatever we're working on no longer a Field.
687 Therefore, we can reuse the LSB to indicate `degree == XLEN`.
690 def decode_reducing_polynomial(GFBREDPOLY, XLEN):
691 """returns the decoded coefficient list in LSB to MSB order,
692 len(retval) == degree + 1"""
693 v = GFBREDPOLY & ((1 << XLEN) - 1) # mask to XLEN bits
694 if v == 0 or v == 2: # GF(2)
695 return [0, 1] # degree = 1, poly = x
697 degree = floor_log2(v)
699 # all reducing polynomials of degree > 1 must have the LSB set,
700 # because they must be irreducible polynomials (meaning they
701 # can't be factored), if the LSB was clear, then they would
702 # have `x` as a factor. Therefore, we can reuse the LSB clear
703 # to instead mean the polynomial has degree XLEN.
706 v |= 1 # LSB must be set
707 return [(v >> i) & 1 for i in range(1 + degree)]
710 ## `gfbredpoly` -- Set the Reducing Polynomial SPR `GFBREDPOLY`
712 unless this is an immediate op, `mtspr` is completely sufficient.
714 ## `gfbmul` -- Binary Galois Field `GF(2^m)` Multiplication
721 (RT) = gfbmul((RA), (RB))
724 ## `gfbmadd` -- Binary Galois Field `GF(2^m)` Multiply-Add
727 gfbmadd RT, RA, RB, RC
731 (RT) = gfbadd(gfbmul((RA), (RB)), (RC))
734 ## `gfbtmadd` -- Binary Galois Field `GF(2^m)` Twin Multiply-Add (for FFT)
737 gfbtmadd RT, RA, RB, RC
740 TODO: add link to explanation for where `RS` comes from.
743 temp = gfbadd(gfbmul((RA), (RB)), (RC))
748 ## `gfbinv` -- Binary Galois Field `GF(2^m)` Inverse
758 # Instructions for Prime Galois Fields `GF(p)`
763 def int_to_gfp(int_value, prime):
764 return int_value % prime # follows Python remainder semantics
767 ## `GFPRIME` SPR -- Prime Modulus For `gfp*` Instructions
769 ## `gfpadd` Prime Galois Field `GF(p)` Addition
776 (RT) = int_to_gfp((RA) + (RB), GFPRIME)
779 the addition happens on infinite-precision integers
781 ## `gfpsub` Prime Galois Field `GF(p)` Subtraction
788 (RT) = int_to_gfp((RA) - (RB), GFPRIME)
791 the subtraction happens on infinite-precision integers
793 ## `gfpmul` Prime Galois Field `GF(p)` Multiplication
800 (RT) = int_to_gfp((RA) * (RB), GFPRIME)
803 the multiplication happens on infinite-precision integers
805 ## `gfpinv` Prime Galois Field `GF(p)` Invert
811 Some potential hardware implementations are found in:
812 <https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.5233&rep=rep1&type=pdf>
815 (RT) = gfpinv((RA), GFPRIME)
818 the multiplication happens on infinite-precision integers
820 ## `gfpmadd` Prime Galois Field `GF(p)` Multiply-Add
823 gfpmadd RT, RA, RB, RC
827 (RT) = int_to_gfp((RA) * (RB) + (RC), GFPRIME)
830 the multiplication and addition happens on infinite-precision integers
832 ## `gfpmsub` Prime Galois Field `GF(p)` Multiply-Subtract
835 gfpmsub RT, RA, RB, RC
839 (RT) = int_to_gfp((RA) * (RB) - (RC), GFPRIME)
842 the multiplication and subtraction happens on infinite-precision integers
844 ## `gfpmsubr` Prime Galois Field `GF(p)` Multiply-Subtract-Reversed
847 gfpmsubr RT, RA, RB, RC
851 (RT) = int_to_gfp((RC) - (RA) * (RB), GFPRIME)
854 the multiplication and subtraction happens on infinite-precision integers
856 ## `gfpmaddsubr` Prime Galois Field `GF(p)` Multiply-Add and Multiply-Sub-Reversed (for FFT)
859 gfpmaddsubr RT, RA, RB, RC
862 TODO: add link to explanation for where `RS` comes from.
865 product = (RA) * (RB)
867 (RT) = int_to_gfp(product + term, GFPRIME)
868 (RS) = int_to_gfp(term - product, GFPRIME)
871 the multiplication, addition, and subtraction happens on infinite-precision integers
873 ## Twin Butterfly (Tukey-Cooley) Mul-add-sub
875 used in combination with SV FFT REMAP to perform
876 a full NTT in-place. possible by having 3-in 2-out,
877 to avoid the need for a temp register. RS is written
880 gffmadd RT,RA,RC,RB (Rc=0)
881 gffmadd. RT,RA,RC,RB (Rc=1)
885 RT <- GFADD(GFMUL(RA, RC), RB))
886 RS <- GFADD(GFMUL(RA, RC), RB))
891 with the modulo and degree being in an SPR, multiply can be identical
892 equivalent to standard integer add
896 | 0.5|6.10|11.15|16.20|21.25| 26..30 |31|
897 | -- | -- | --- | --- | --- | ------ |--|
898 | NN | RT | RA | RB |11000| 01110 |Rc|
903 from functools import reduce
913 # constants used in the multGF2 function
914 mask1 = mask2 = polyred = None
917 """Define parameters of binary finite field GF(2^m)/g(x)
918 - irPoly: coefficients of irreducible polynomial g(x)
920 # degree: extension degree of binary field
921 degree = gf_degree(irPoly)
924 """Convert an integer into a polynomial"""
925 return [(sInt >> i) & 1
926 for i in reversed(range(sInt.bit_length()))]
928 global mask1, mask2, polyred
929 mask1 = mask2 = 1 << degree
931 polyred = reduce(lambda x, y: (x << 1) + y, i2P(irPoly)[1:])
934 """Multiply two polynomials in GF(2^m)/g(x)"""
937 # standard long-multiplication: check LSB and add
941 # standard modulo: check MSB and add polynomial
947 if __name__ == "__main__":
949 # Define binary field GF(2^3)/x^3 + x + 1
950 setGF2(0b1011) # degree 3
952 # Evaluate the product (x^2 + x + 1)(x^2 + 1)
953 print("{:02x}".format(multGF2(0b111, 0b101)))
955 # Define binary field GF(2^8)/x^8 + x^4 + x^3 + x + 1
956 # (used in the Advanced Encryption Standard-AES)
957 setGF2(0b100011011) # degree 8
959 # Evaluate the product (x^7)(x^7 + x + 1)
960 print("{:02x}".format(multGF2(0b10000000, 0b10000011)))
966 # https://bugs.libre-soc.org/show_bug.cgi?id=782#c33
967 # https://ftp.libre-soc.org/ARITH18_Kobayashi.pdf
970 s = getGF2() # get the full polynomial (including the MSB)
976 for i in range(1, 2*degree+1):
977 # could use count-trailing-1s here to skip ahead
978 if r & mask1: # test MSB of r
979 if s & mask1: # test MSB of s
982 s <<= 1 # shift left 1
984 r, s = s, r # swap r,s
985 u, v = v<<1, u # shift v and swap
988 u >>= 1 # right shift left
991 r <<= 1 # shift left 1
992 u <<= 1 # shift left 1
1000 ## GF2 (carryless) div and mod
1011 def FullDivision(self, f, v):
1013 Takes two arguments, f, v
1014 fDegree and vDegree are the degrees of the field elements
1015 f and v represented as a polynomials.
1016 This method returns the field elements a and b such that
1018 f(x) = a(x) * v(x) + b(x).
1020 That is, a is the divisor and b is the remainder, or in
1021 other words a is like floor(f/v) and b is like f modulo v.
1024 fDegree, vDegree = gf_degree(f), gf_degree(v)
1026 for i in reversed(range(vDegree, fDegree+1):
1027 if ((rem >> i) & 1): # check bit
1028 res ^= (1 << (i - vDegree))
1029 rem ^= ( v << (i - vDegree)))
1033 | 0.5|6.10|11.15|16.20| 21 | 22.23 | 24....30 |31| name |
1034 | -- | -- | --- | --- | -- | ----- | -------- |--| ---- |
1035 | NN | RT | RA | RB | 1 | 00 | 0001 110 |Rc| cldiv |
1036 | NN | RT | RA | RB | 1 | 01 | 0001 110 |Rc| clmod |
1038 ## GF2 carryless mul
1040 based on RV bitmanip
1041 see <https://en.wikipedia.org/wiki/CLMUL_instruction_set> and
1042 <https://www.felixcloutier.com/x86/pclmulqdq> and
1043 <https://en.m.wikipedia.org/wiki/Carry-less_product>
1045 these are GF2 operations with the modulo set to 2^degree.
1046 they are worth adding as their own non-overwrite operations
1047 (in the same pipeline).
1050 uint_xlen_t clmul(uint_xlen_t RA, uint_xlen_t RB)
1053 for (int i = 0; i < XLEN; i++)
1058 uint_xlen_t clmulh(uint_xlen_t RA, uint_xlen_t RB)
1061 for (int i = 1; i < XLEN; i++)
1063 x ^= RA >> (XLEN-i);
1066 uint_xlen_t clmulr(uint_xlen_t RA, uint_xlen_t RB)
1069 for (int i = 0; i < XLEN; i++)
1071 x ^= RA >> (XLEN-i-1);
1075 ## carryless Twin Butterfly (Tukey-Cooley) Mul-add-sub
1077 used in combination with SV FFT REMAP to perform
1078 a full NTT in-place. possible by having 3-in 2-out,
1079 to avoid the need for a temp register. RS is written
1082 clfmadd RT,RA,RC,RB (Rc=0)
1083 clfmadd. RT,RA,RC,RB (Rc=1)
1087 RT <- CLMUL(RA, RC) ^ RB
1088 RS <- CLMUL(RA, RC) ^ RB
1094 uint64_t bmatflip(uint64_t RA)
1102 uint64_t bmatxor(uint64_t RA, uint64_t RB)
1105 uint64_t RBt = bmatflip(RB);
1106 uint8_t u[8]; // rows of RA
1107 uint8_t v[8]; // cols of RB
1108 for (int i = 0; i < 8; i++) {
1110 v[i] = RBt >> (i*8);
1113 for (int i = 0; i < 64; i++) {
1114 if (pcnt(u[i / 8] & v[i % 8]) & 1)
1119 uint64_t bmator(uint64_t RA, uint64_t RB)
1122 uint64_t RBt = bmatflip(RB);
1123 uint8_t u[8]; // rows of RA
1124 uint8_t v[8]; // cols of RB
1125 for (int i = 0; i < 8; i++) {
1127 v[i] = RBt >> (i*8);
1130 for (int i = 0; i < 64; i++) {
1131 if ((u[i / 8] & v[i % 8]) != 0)
1139 # Already in POWER ISA
1141 ## count leading/trailing zeros with mask
1147 do i = 0 to 63 if((RB)i=1) then do
1148 if((RS)i=1) then break end end count ← count + 1
1154 vpdepd VRT,VRA,VRB, identical to RV bitmamip bdep, found already in v3.1 p106
1157 if VSR[VRB+32].dword[i].bit[63-m]=1 then do
1158 result = VSR[VRA+32].dword[i].bit[63-k]
1159 VSR[VRT+32].dword[i].bit[63-m] = result
1165 uint_xlen_t bdep(uint_xlen_t RA, uint_xlen_t RB)
1168 for (int i = 0, j = 0; i < XLEN; i++)
1169 if ((RB >> i) & 1) {
1171 r |= uint_xlen_t(1) << i;
1181 other way round: identical to RV bext, found in v3.1 p196
1184 uint_xlen_t bext(uint_xlen_t RA, uint_xlen_t RB)
1187 for (int i = 0, j = 0; i < XLEN; i++)
1188 if ((RB >> i) & 1) {
1190 r |= uint_xlen_t(1) << j;
1199 found in v3.1 p106 so not to be added here
1209 if((RB)63-i==1) then do
1210 result63-ptr1 = (RS)63-i
1216 # bit to byte permute
1218 similar to matrix permute in RV bitmanip, which has XOR and OR variants,
1219 these perform a transpose.
1223 b = VSR[VRB+32].dword[i].byte[k].bit[j]
1224 VSR[VRT+32].dword[i].byte[j].bit[k] = b