[libreriscv.git] / openpower / sv / bitmanip.mdwn

[[!tag standards]]

# Implementation Log

* ternlogi <https://bugs.libre-soc.org/show_bug.cgi?id=745>
* grev <https://bugs.libre-soc.org/show_bug.cgi?id=755>
* remove Rc=1 from ternlog due to conflicts in encoding as well
  as saving space <https://bugs.libre-soc.org/show_bug.cgi?id=753#c5>
* GF2^M <https://bugs.libre-soc.org/show_bug.cgi?id=782>

# bitmanipulation

**DRAFT STATUS**

pseudocode: <https://libre-soc.org/openpower/isa/bitmanip/>

this extension amalgamates bitmanipulation primitives from many sources, including RISC-V bitmanip, Packed SIMD, AVX-512 and OpenPOWER VSX.  Vectorisation and SIMD are removed: these are straight scalar (element) operations making them suitable for embedded applications.
Vectorisation Context is provided by [[openpower/sv]].

When combined with SV, scalar variants of bitmanip operations found in VSX are added so that VSX may be retired as "legacy" in the far future (10 to 20 years).  Also, VSX is hundreds of opcodes, requires 128 bit pathways, and is wholly unsuited to low power or embedded scenarios.

ternlogv is experimental and is the only operation that may be considered a "Packed SIMD".  It is added as a variant of the already well-justified ternlog operation (done in AVX512 as an immediate only) "because it looks fun". As it is based on the LUT4 concept it will allow accelerated emulation of FPGAs.  Other vendors of ISAs are buying FPGA companies to achieve similar objectives.

general-purpose Galois Field 2^M operations are added so as to avoid huge custom opcode proliferation across many areas of Computer Science.  however for convenience and also to avoid setup costs, some of the more common operations (clmul, crc32) are also added.  The expectation is that these operations would all be covered by the same pipeline.

note that there are brownfield spaces below that could incorporate some of the set-before-first and other scalar operations listed in [[sv/vector_ops]], and
the [[sv/av_opcodes]] as well as [[sv/setvl]]

Useful resource: 

* <https://en.wikiversity.org/wiki/Reed%E2%80%93Solomon_codes_for_coders>
* <https://maths-people.anu.edu.au/~brent/pd/rpb232tr.pdf>

# summary

ternlog has its own major opcode

|  29.30 |31| name      |
| ------ |--| --------- |
|   00   |Rc| ternlogi  |
|   01   |0 | ternlog   |
|   01   |1 | ternlogv  |
|   10   |0 | crternlog |

2nd major opcode for other bitmanip: minor opcode allocation

|  28.30 |31| name      |
| ------ |--| --------- |
|  -00   |0 |           |
|  -00   |1 | grevlog   |
|  -01   |  | grevlogi  |
|  010   |Rc| bitmask   |
|  011   |0 | gfbmadd*  |
|  011   |1 | clmadd*   |
|  110   |Rc| 1/2-op    |
|  111   |  |           |


1-op and variants

| dest | src1 | subop | op       |
| ---- | ---- | ----- | -------- |
| RT   | RA   | ..    | bmatflip | 

2-op and variants

| dest | src1 | src2 | subop | op       |
| ---- | ---- | ---- | ----- | -------- |
| RT   | RA   | RB   | or    | bmatflip | 
| RT   | RA   | RB   | xor   | bmatflip | 
| RT   | RA   | RB   |       | grev  |
| RT   | RA   | RB   |       | clmul*  |
| RT   | RA   | RB   |       | gorc |  
| RT   | RA   | RB   | shuf  | shuffle | 
| RT   | RA   | RB   | unshuf| shuffle | 
| RT   | RA   | RB   | width | xperm  | 
| RT   | RA   | RB   | type | minmax | 
| RT   | RA   | RB   |      | av abs avgadd  | 
| RT   | RA   | RB   | type | vmask ops | 
| RT   | RA   | RB   |      |       | 

3 ops 

* grevlog
* ternlog bitops
* GF mul-add
* bitmask-reverse

TODO: convert all instructions to use RT and not RS

| 0.5|6.10|11.15|16.20 |21..25   | 26....30  |31| name |
| -- | -- | --- | ---  | -----   | --------  |--| ------ |
| NN | RT | RA  | RB   | im0-4   | im5-7  00 |0 |  |
| NN | RT | RA  | RB   | im0-4   | im5-7  00 |1 | grevlog |
| NN | RT | RA  | s0-4 | im0-4   | im5-7  01 |s5| grevlogi |
| NN | RS | RA  | RB   | RC      | 00    011 |0 | gfbmadd |
| NN | RS | RA  | RB   | RC      | 10    011 |0 | gfbmaddsub |
| NN | RS | RA  | RB   | RC      | 00    011 |1 | clmadd |
| NN | RS | RA  | RB   | RC      | 10    011 |1 | clmaddsub |
| NN | RT | RA  | RB   | sh0-4   | sh5 1 011 |Rc| bmrevi |

ops (note that av avg and abs as well as vec scalar mask
are included here)

TODO: convert from RA, RB, and RC to correct field names of RT, RA, and RB, and
double check that instructions didn't need 3 inputs.

| 0.5|6.10|11.15|16.20| 21 | 22.23 | 24....30 |31| name |
| -- | -- | --- | --- | -- | ----- | -------- |--| ---- |
| NN | RA | RB  |     | 0  |       | 0000 110 |Rc| rsvd   |
| NN | RA | RB  | RC  | 1  | itype | 0000 110 |Rc| xperm |
| NN | RA | RB  | RC  | 0  | itype | 0100 110 |Rc| minmax |
| NN | RA | RB  | RC  | 1  |   00  | 0100 110 |Rc| av avgadd |
| NN | RA | RB  | RC  | 1  |   01  | 0100 110 |Rc| av abs |
| NN | RA | RB  |     | 1  |   10  | 0100 110 |Rc| rsvd |
| NN | RA | RB  |     | 1  |   11  | 0100 110 |Rc| rsvd |
| NN | RA | RB  | sh  | SH | itype | 1000 110 |Rc| bmopsi |
| NN | RA | RB  |     |    |       | 1100 110 |Rc| rsvd |
| NN | RT | RA  | RB  | 1  |  00   | 0001 110 |Rc| cldiv |
| NN | RT | RA  | RB  | 1  |  01   | 0001 110 |Rc| clmod |
| NN | RT | RA  | RB  | 1  |  10   | 0001 110 |Rc|       |
| NN | RT | RB  | RB  | 1  |  11   | 0001 110 |Rc| clinv |
| NN | RA | RB  | RC  | 0  |   00  | 0001 110 |Rc| vec sbfm |
| NN | RA | RB  | RC  | 0  |   01  | 0001 110 |Rc| vec sofm |
| NN | RA | RB  | RC  | 0  |   10  | 0001 110 |Rc| vec sifm |
| NN | RA | RB  | RC  | 0  |   11  | 0001 110 |Rc| vec cprop |
| NN | RA | RB  |     | 0  |       | 0101 110 |Rc| rsvd |
| NN | RA | RB  | RC  | 0  | 00    | 0010 110 |Rc| gorc |
| NN | RA | RB  | sh  | SH | 00    | 1010 110 |Rc| gorci |
| NN | RA | RB  | RC  | 0  | 00    | 0110 110 |Rc| gorcw |
| NN | RA | RB  | sh  | 0  | 00    | 1110 110 |Rc| gorcwi |
| NN | RA | RB  | RC  | 1  | 00    | 1110 110 |Rc| bmator  |
| NN | RA | RB  | RC  | 0  | 01    | 0010 110 |Rc| grev |
| NN | RA | RB  | RC  | 1  | 01    | 0010 110 |Rc| clmul |
| NN | RA | RB  | sh  | SH | 01    | 1010 110 |Rc| grevi |
| NN | RA | RB  | RC  | 0  | 01    | 0110 110 |Rc| grevw |
| NN | RA | RB  | sh  | 0  | 01    | 1110 110 |Rc| grevwi |
| NN | RA | RB  | RC  | 1  | 01    | 1110 110 |Rc| bmatxor   |
| NN | RA | RB  | RC  | 0  | 10    | 0010 110 |Rc| shfl |
| NN | RA | RB  | sh  | SH | 10    | 1010 110 |Rc| shfli |
| NN | RA | RB  | RC  | 0  | 10    | 0110 110 |Rc| shflw |
| NN | RA | RB  | RC  |    | 10    | 1110 110 |Rc| rsvd    |
| NN | RA | RB  | RC  | 0  | 11    | 1110 110 |Rc| clmulr  |
| NN | RA | RB  | RC  | 1  | 11    | 1110 110 |Rc| clmulh  |
| NN |    |     |     |    |       | --11 110 |Rc| setvl  |

# bit to byte permute

similar to matrix permute in RV bitmanip, which has XOR and OR variants

    do j = 0 to 7
      do k = 0 to 7
         b = VSR[VRB+32].dword[i].byte[k].bit[j]
         VSR[VRT+32].dword[i].byte[j].bit[k] = b

# int min/max

signed and unsigned min/max for integer.  this is sort-of partly synthesiseable in [[sv/svp64]] with pred-result as long as the dest reg is one of the sources, but not both signed and unsigned.  when the dest is also one of the srces and the mv fails due to the CR bittest failing this will only overwrite the dest where the src is greater (or less).

signed/unsigned min/max gives more flexibility.

```
uint_xlen_t min(uint_xlen_t rs1, uint_xlen_t rs2)
{ return (int_xlen_t)rs1 < (int_xlen_t)rs2 ? rs1 : rs2;
}
uint_xlen_t max(uint_xlen_t rs1, uint_xlen_t rs2)
{ return (int_xlen_t)rs1 > (int_xlen_t)rs2 ? rs1 : rs2;
}
uint_xlen_t minu(uint_xlen_t rs1, uint_xlen_t rs2)
{ return rs1 < rs2 ? rs1 : rs2;
}
uint_xlen_t maxu(uint_xlen_t rs1, uint_xlen_t rs2)
{ return rs1 > rs2 ? rs1 : rs2;
}
```


# ternlog bitops

Similar to FPGA LUTs: for every bit perform a lookup into a table using an 8bit immediate, or in another register.

Like the x86 AVX512F [vpternlogd/vpternlogq](https://www.felixcloutier.com/x86/vpternlogd:vpternlogq) instructions.

## ternlogi

TODO: if/when we get more encoding space, add Rc=1 option back to ternlogi, for consistency with OpenPower base logical instructions (and./xor./or./etc.). <https://bugs.libre-soc.org/show_bug.cgi?id=745#c56>

| 0.5|6.10|11.15|16.20| 21..25| 26..30   |31|
| -- | -- | --- | --- | ----- | -------- |--|
| NN | RT | RA  | RB  | im0-4 | im5-7 00 |Rc|

    lut3(imm, a, b, c):
        idx = c << 2 | b << 1 | a
        return imm[idx] # idx by LSB0 order

    for i in range(64): 
        RT[i] = lut3(imm, RB[i], RA[i], RT[i]) 

bits 21..22 may be used to specify a mode, such as treating the whole integer zero/nonzero and putting 1/0 in the result, rather than bitwise test.

## ternlog

a 4 operand variant which becomes more along the lines of an FPGA:

| 0.5|6.10|11.15|16.20|21.25| 26...30  |31|
| -- | -- | --- | --- | --- | -------- |--|
| NN | RT | RA  | RB  | RC  | mode  01 |1 |

    for i in range(64):
        idx = RT[i] << 2 | RA[i] << 1 | RB[i]
        RT[i] = (RC & (1<<idx)) != 0

mode (3 bit) may be used to do inversion of ordering, similar to carryless mul,
3 modes.

## ternlogv

also, another possible variant involving swizzle and vec4:

| 0.5|6.10|11.15| 16.23 |24.27 | 28.30 |31|
| -- | -- | --- | ----- | ---- | ----- |--|
| NN | RT | RA  | imm   | mask | -01   |0 |

    for i in range(8):
        idx = RA.x[i] << 2 | RA.y[i] << 1 | RA.z[i]   
        res = (imm & (1<<idx)) != 0
        for j in range(3):
             if mask[j]: RT[i+j*8] = res

## ternlogcr

another mode selection would be CRs not Ints. 

| 0.5|6.8 | 9.11|12.14|15.17|18.20|21.28 | 29.30|31|
| -- | -- | --- | --- | --- |-----|----- | -----|--|
| NN | BT | BA  | BB  | BC  |m0-3 | imm  |  10  |m4|

    mask = m0-3,m4
    for i in range(4):
        if not mask[i] continue
        crregs[BT][i] = lut3(imm,
                             crregs[BA][i],
                             crregs[BB][i],
                             crregs[BC][i])

## cmix

based on RV bitmanip, covered by ternlog bitops

```
uint_xlen_t cmix(uint_xlen_t RA, uint_xlen_t RB, uint_xlen_t RC) {
    return (RA & RB) | (RC & ~RB);
}
```


# bitmask set

based on RV bitmanip singlebit set, instruction format similar to shift
[[isa/fixedshift]].  bmext is actually covered already (shift-with-mask rldicl but only immediate version).
however bitmask-invert is not, and set/clr are not covered, although they can use the same Shift ALU.

bmext (RB) version is not the same as rldicl because bmext is a right shift by RC, where rldicl is a left rotate.  for the immediate version this does not matter, so a bmexti is not required.
bmrev however there is no direct equivalent and consequently a bmrevi is required.

bmset (register for mask amount) is particularly useful for creating
predicate masks where the length is a dynamic runtime quantity.
bmset(RA=0, RB=0, RC=mask) will produce a run of ones of length "mask" in a single instruction without needing to initialise or depend on any other registers.

| 0.5|6.10|11.15|16.20|21.25| 26..30  |31| name  |
| -- | -- | --- | --- | --- | ------- |--| ----- |
| NN | RT | RA  | RB  | RC  | mode 010 |Rc| bm*   |


```
uint_xlen_t bmset(RA, RB, sh)
{
    int shamt = RB & (XLEN - 1);
    mask = (2<<sh)-1;
    return RA | (mask << shamt);
}

uint_xlen_t bmclr(RA, RB, sh)
{
    int shamt = RB & (XLEN - 1);
    mask = (2<<sh)-1;
    return RA & ~(mask << shamt);
}

uint_xlen_t bminv(RA, RB, sh)
{
    int shamt = RB & (XLEN - 1);
    mask = (2<<sh)-1;
    return RA ^ (mask << shamt);
}

uint_xlen_t bmext(RA, RB, sh)
{
    int shamt = RB & (XLEN - 1);
    mask = (2<<sh)-1;
    return mask & (RA >> shamt);
}
```

bitmask extract with reverse.  can be done by bitinverting all of RA and getting bits of RA from the opposite end.

```
msb = rb[5:0];
rev[0:msb] = ra[msb:0];
rt = ZE(rev[msb:0]);

uint_xlen_t bmextrev(RA, RB, sh)
{
    int shamt = (RB & (XLEN - 1));
    shamt = (XLEN-1)-shamt;  # shift other end
    bra = bitreverse(RA)     # swap LSB-MSB
    mask = (2<<sh)-1;
    return mask & (bra >> shamt);
}
```

| 0.5|6.10|11.15|16.20|21.26| 27..30  |31| name   |
| -- | -- | --- | --- | --- | ------- |--| ------ |
| NN | RT | RA  | RB  | sh  | 1   011 |Rc| bmrevi |


# grevlut

generalised reverse combined with a pair of LUT2s and allowing
zero when RA=0 provides a wide range of instructions
and a means to set regular 64 bit patterns in one
32 bit instruction.

the two LUT2s are applied left-half (when not swapping)
and right-half (when swapping) so as to allow a wider
range of options

grevlut should be arranged so as to produce the constants
needed to put into bext (bitextract) so as in turn to
be able to emulate x86 pmovmask instructions <https://www.felixcloutier.com/x86/pmovmskb>

<img src="/openpower/sv/grevlut2x2.jpg" width=700 />

```
lut2(imm, a, b):
    idx = b << 1 | a
    return imm[idx] # idx by LSB0 order

dorow(imm8, step_i, chunksize):
    for j in 0 to 63:
        if (j&chunk_size) == 0
           imm = imm8[0..3]
        else
           imm = imm8[4..7]
        step_o[j] = lut2(imm, step_i[j], step_i[j ^ chunk_size])
    return step_o

uint64_t grevlut64(uint64_t RA, uint64_t RB, uint8 imm)
{
    uint64_t x = RA;
    int shamt = RB & 63;
    for i in 0 to 6
        step = 1<<i
        if (shamt & step) x = dorow(imm, x, step)
    return x;
}

```

# grev

based on RV bitmanip, this is also known as a butterfly network. however
where a butterfly network allows setting of every crossbar setting in
every row and every column, generalised-reverse (grev) only allows
a per-row decision: every entry in the same row must either switch or
not-switch.

<img src="https://upload.wikimedia.org/wikipedia/commons/thumb/8/8c/Butterfly_Network.jpg/474px-Butterfly_Network.jpg" />

```
uint64_t grev64(uint64_t RA, uint64_t RB)
{
    uint64_t x = RA;
    int shamt = RB & 63;
    if (shamt & 1) x = ((x &  0x5555555555555555LL) <<  1) |
                        ((x & 0xAAAAAAAAAAAAAAAALL) >>  1);
    if (shamt & 2) x = ((x &  0x3333333333333333LL) <<  2) |
                        ((x & 0xCCCCCCCCCCCCCCCCLL) >>  2);
    if (shamt & 4) x = ((x &  0x0F0F0F0F0F0F0F0FLL) <<  4) |
                        ((x & 0xF0F0F0F0F0F0F0F0LL) >>  4);
    if (shamt & 8) x = ((x &  0x00FF00FF00FF00FFLL) <<  8) |
                        ((x & 0xFF00FF00FF00FF00LL) >>  8);
    if (shamt & 16) x = ((x & 0x0000FFFF0000FFFFLL) << 16) |
                        ((x & 0xFFFF0000FFFF0000LL) >> 16);
    if (shamt & 32) x = ((x & 0x00000000FFFFFFFFLL) << 32) |
                        ((x & 0xFFFFFFFF00000000LL) >> 32);
    return x;
}

```

# shuffle / unshuffle

based on RV bitmanip

```
uint32_t shfl32(uint32_t RA, uint32_t RB)
{
    uint32_t x = RA;
    int shamt = RB & 15;
    if (shamt & 8) x  = shuffle32_stage(x, 0x00ff0000, 0x0000ff00, 8);
    if (shamt & 4) x  = shuffle32_stage(x, 0x0f000f00, 0x00f000f0, 4);
    if (shamt & 2) x  = shuffle32_stage(x, 0x30303030, 0x0c0c0c0c, 2);
    if (shamt & 1) x  = shuffle32_stage(x, 0x44444444, 0x22222222, 1);
    return x;
}
uint32_t unshfl32(uint32_t RA, uint32_t RB)
{
    uint32_t x = RA;
    int shamt = RB & 15;
    if (shamt & 1) x  = shuffle32_stage(x, 0x44444444, 0x22222222, 1);
    if (shamt & 2) x  = shuffle32_stage(x, 0x30303030, 0x0c0c0c0c, 2);
    if (shamt & 4) x  = shuffle32_stage(x, 0x0f000f00, 0x00f000f0, 4);
    if (shamt & 8) x  = shuffle32_stage(x, 0x00ff0000, 0x0000ff00, 8);
    return x;
}

uint64_t shuffle64_stage(uint64_t src, uint64_t maskL, uint64_t maskR, int N)
{
    uint64_t x = src & ~(maskL | maskR);
    x |= ((src << N) & maskL) | ((src >> N) & maskR);
    return x;
}
uint64_t shfl64(uint64_t RA, uint64_t RB)
{
    uint64_t x = RA;
    int shamt = RB & 31;
    if (shamt & 16) x = shuffle64_stage(x, 0x0000ffff00000000LL,
                                           0x00000000ffff0000LL, 16);
    if (shamt & 8) x = shuffle64_stage(x, 0x00ff000000ff0000LL,
                                           0x0000ff000000ff00LL, 8);
    if (shamt & 4) x = shuffle64_stage(x, 0x0f000f000f000f00LL,
                                           0x00f000f000f000f0LL, 4);
    if (shamt & 2) x = shuffle64_stage(x, 0x3030303030303030LL,
                                           0x0c0c0c0c0c0c0c0cLL, 2);
    if (shamt & 1) x = shuffle64_stage(x, 0x4444444444444444LL,
                                           0x2222222222222222LL, 1);
    return x;
}
uint64_t unshfl64(uint64_t RA, uint64_t RB)
{
    uint64_t x = RA;
    int shamt = RB & 31;
    if (shamt &  1) x = shuffle64_stage(x, 0x4444444444444444LL,
                                           0x2222222222222222LL, 1);
    if (shamt &  2) x = shuffle64_stage(x, 0x3030303030303030LL,
                                           0x0c0c0c0c0c0c0c0cLL, 2);
    if (shamt &  4) x = shuffle64_stage(x, 0x0f000f000f000f00LL,
                                           0x00f000f000f000f0LL, 4);
    if (shamt &  8) x = shuffle64_stage(x, 0x00ff000000ff0000LL,
                                           0x0000ff000000ff00LL, 8);
    if (shamt & 16) x = shuffle64_stage(x, 0x0000ffff00000000LL,
                                           0x00000000ffff0000LL, 16);
    return x;
}
```

# xperm

based on RV bitmanip

```
uint_xlen_t xperm(uint_xlen_t RA, uint_xlen_t RB, int sz_log2)
{
    uint_xlen_t r = 0;
    uint_xlen_t sz = 1LL << sz_log2;
    uint_xlen_t mask = (1LL << sz) - 1;
    for (int i = 0; i < XLEN; i += sz) {
        uint_xlen_t pos = ((RB >> i) & mask) << sz_log2;
        if (pos < XLEN)
            r |= ((RA >> pos) & mask) << i;
    }
    return r;
}
uint_xlen_t xperm_n (uint_xlen_t RA, uint_xlen_t RB)
{  return xperm(RA, RB, 2); }
uint_xlen_t xperm_b (uint_xlen_t RA, uint_xlen_t RB)
{  return xperm(RA, RB, 3); }
uint_xlen_t xperm_h (uint_xlen_t RA, uint_xlen_t RB)
{  return xperm(RA, RB, 4); }
uint_xlen_t xperm_w (uint_xlen_t RA, uint_xlen_t RB)
{  return xperm(RA, RB, 5); }
```

# gorc

based on RV bitmanip

```
uint32_t gorc32(uint32_t RA, uint32_t RB)
{
    uint32_t x = RA;
    int shamt = RB & 31;
    if (shamt & 1) x |= ((x & 0x55555555) << 1)   |  ((x &  0xAAAAAAAA) >> 1);
    if (shamt & 2) x |= ((x & 0x33333333) << 2)   |  ((x &  0xCCCCCCCC) >> 2);
    if (shamt & 4) x |= ((x & 0x0F0F0F0F) << 4)   |  ((x &  0xF0F0F0F0) >> 4);
    if (shamt & 8) x |= ((x & 0x00FF00FF) << 8)   |  ((x &  0xFF00FF00) >> 8);
    if (shamt & 16) x |= ((x & 0x0000FFFF) << 16) |  ((x &  0xFFFF0000) >> 16);
    return x;
}
uint64_t gorc64(uint64_t RA, uint64_t RB)
{
    uint64_t x = RA;
    int shamt = RB & 63;
    if (shamt & 1) x |= ((x & 0x5555555555555555LL)   <<   1) |
                         ((x & 0xAAAAAAAAAAAAAAAALL)  >>  1);
    if (shamt & 2) x |= ((x & 0x3333333333333333LL)   <<   2) |
                         ((x & 0xCCCCCCCCCCCCCCCCLL)  >>  2);
    if (shamt & 4) x |= ((x & 0x0F0F0F0F0F0F0F0FLL)   <<   4) |
                         ((x & 0xF0F0F0F0F0F0F0F0LL)  >>  4);
    if (shamt & 8) x |= ((x & 0x00FF00FF00FF00FFLL)   <<   8) |
                         ((x & 0xFF00FF00FF00FF00LL)  >>  8);
    if (shamt & 16) x |= ((x & 0x0000FFFF0000FFFFLL)  << 16) |
                         ((x & 0xFFFF0000FFFF0000LL)  >> 16);
    if (shamt & 32) x |= ((x & 0x00000000FFFFFFFFLL)  << 32) |
                         ((x & 0xFFFFFFFF00000000LL)  >> 32);
    return x;
}

```

# Instructions for Carry-less Operations aka. Polynomials with coefficients in `GF(2)`

Carry-less addition/subtraction is simply XOR, so a `cladd`
instruction is not provided since the `xor[i]` instruction can be used instead.

These are operations on polynomials with coefficients in `GF(2)`, with the
polynomial's coefficients packed into integers with the following algorithm:

```python
def pack_poly(poly):
    """`poly` is a list where `poly[i]` is the coefficient for `x ** i`"""
    retval = 0
    for i, v in enumerate(poly):
        retval |= v << i
    return retval

def unpack_poly(v):
    """returns a list `poly`, where `poly[i]` is the coefficient for `x ** i`.
    """
    poly = []
    while v != 0:
        poly.append(v & 1)
        v >>= 1
    return poly
```

## Carry-less Multiply Instructions

based on RV bitmanip
see <https://en.wikipedia.org/wiki/CLMUL_instruction_set> and
<https://www.felixcloutier.com/x86/pclmulqdq> and
<https://en.m.wikipedia.org/wiki/Carry-less_product>

They are worth adding as their own non-overwrite operations
(in the same pipeline).

### `clmul` Carry-less Multiply

```c
uint_xlen_t clmul(uint_xlen_t RA, uint_xlen_t RB)
{
    uint_xlen_t x = 0;
    for (int i = 0; i < XLEN; i++)
        if ((RB >> i) & 1)
            x ^= RA << i;
    return x;
}
```

### `clmulh` Carry-less Multiply High

```c
uint_xlen_t clmulh(uint_xlen_t RA, uint_xlen_t RB)
{
    uint_xlen_t x = 0;
    for (int i = 1; i < XLEN; i++)
        if ((RB >> i) & 1)
            x ^= RA >> (XLEN-i);
    return x;
}
```

### `clmulr` Carry-less Multiply (Reversed)

Useful for CRCs. Equivalent to bit-reversing the result of `clmul` on
bit-reversed inputs.

```c
uint_xlen_t clmulr(uint_xlen_t RA, uint_xlen_t RB)
{
    uint_xlen_t x = 0;
    for (int i = 0; i < XLEN; i++)
        if ((RB >> i) & 1)
            x ^= RA >> (XLEN-i-1);
    return x;
}
```

## `clmadd` Carry-less Multiply-Add

```
clmadd RT, RA, RB, RC
```

```
(RT) = clmul((RA), (RB)) ^ (RC)
```

## `cltmadd` Twin Carry-less Multiply-Add (for FFTs)

```
cltmadd RT, RA, RB, RC
```

TODO: add link to explanation for where `RS` comes from.

```
temp = clmul((RA), (RB)) ^ (RC)
(RT) = temp
(RS) = temp
```

## `cldiv` Carry-less Division

```
cldiv RT, RA, RB
```

TODO: decide what happens on division by zero

```
(RT) = cldiv((RA), (RB))
```

## `clrem` Carry-less Remainder

```
clrem RT, RA, RB
```

TODO: decide what happens on division by zero

```
(RT) = clrem((RA), (RB))
```

# Instructions for Binary Galois Fields `GF(2^m)`

see:

* <https://courses.csail.mit.edu/6.857/2016/files/ffield.py>
* <https://engineering.purdue.edu/kak/compsec/NewLectures/Lecture7.pdf>
* <https://foss.heptapod.net/math/libgf2/-/blob/branch/default/src/libgf2/gf2.py>

Binary Galois Field addition/subtraction is simply XOR, so a `gfbadd`
instruction is not provided since the `xor[i]` instruction can be used instead.

## `GFBREDPOLY` SPR -- Reducing Polynomial

In order to save registers and to make operations orthogonal with standard
arithmetic, the reducing polynomial is stored in a dedicated SPR `GFBREDPOLY`.
This also allows hardware to pre-compute useful parameters (such as the
degree, or look-up tables) based on the reducing polynomial, and store them
alongside the SPR in hidden registers, only recomputing them whenever the SPR
is written to, rather than having to recompute those values for every
instruction.

Because Galois Fields require the reducing polynomial to be an irreducible
polynomial, that guarantees that any polynomial of `degree > 1` must have
the LSB set, since otherwise it would be divisible by the polynomial `x`,
making it reducible, making whatever we're working on no longer a Field.
Therefore, we can reuse the LSB to indicate `degree == XLEN`.

```python
def decode_reducing_polynomial(GFBREDPOLY, XLEN):
    """returns the decoded coefficient list in LSB to MSB order,
        len(retval) == degree + 1"""
    v = GFBREDPOLY & ((1 << XLEN) - 1) # mask to XLEN bits
    if v == 0 or v == 2: # GF(2)
        return [0, 1] # degree = 1, poly = x
    if v & 1:
        degree = floor_log2(v)
    else:
        # all reducing polynomials of degree > 1 must have the LSB set,
        # because they must be irreducible polynomials (meaning they
        # can't be factored), if the LSB was clear, then they would
        # have `x` as a factor. Therefore, we can reuse the LSB clear
        # to instead mean the polynomial has degree XLEN.
        degree = XLEN
        v |= 1 << XLEN
        v |= 1 # LSB must be set
    return [(v >> i) & 1 for i in range(1 + degree)]
```

## `gfbredpoly` -- Set the Reducing Polynomial SPR `GFBREDPOLY`

unless this is an immediate op, `mtspr` is completely sufficient.

## `gfbmul` -- Binary Galois Field `GF(2^m)` Multiplication

```
gfbmul RT, RA, RB
```

```
(RT) = gfbmul((RA), (RB))
```

## `gfbmadd` -- Binary Galois Field `GF(2^m)` Multiply-Add

```
gfbmadd RT, RA, RB, RC
```

```
(RT) = gfbadd(gfbmul((RA), (RB)), (RC))
```

## `gfbtmadd` -- Binary Galois Field `GF(2^m)` Twin Multiply-Add (for FFT)

```
gfbtmadd RT, RA, RB, RC
```

TODO: add link to explanation for where `RS` comes from.

```
temp = gfbadd(gfbmul((RA), (RB)), (RC))
(RT) = temp
(RS) = temp
```

## `gfbinv` -- Binary Galois Field `GF(2^m)` Inverse

```
gfbinv RT, RA
```

```
(RT) = gfbinv((RA))
```

# Instructions for Prime Galois Fields `GF(p)`

## Helper algorithms

```python
def int_to_gfp(int_value, prime):
    return int_value % prime # follows Python remainder semantics
```

## `GFPRIME` SPR -- Prime Modulus For `gfp*` Instructions

## `gfpadd` Prime Galois Field `GF(p)` Addition

```
gfpadd RT, RA, RB
```

```
(RT) = int_to_gfp((RA) + (RB), GFPRIME)
```

the addition happens on infinite-precision integers

## `gfpsub` Prime Galois Field `GF(p)` Subtraction

```
gfpsub RT, RA, RB
```

```
(RT) = int_to_gfp((RA) - (RB), GFPRIME)
```

the subtraction happens on infinite-precision integers

## `gfpmul` Prime Galois Field `GF(p)` Multiplication

```
gfpmul RT, RA, RB
```

```
(RT) = int_to_gfp((RA) * (RB), GFPRIME)
```

the multiplication happens on infinite-precision integers

## `gfpinv` Prime Galois Field `GF(p)` Invert

```
gfpinv RT, RA
```

Some potential hardware implementations are found in:
<https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.5233&rep=rep1&type=pdf>

```
(RT) = gfpinv((RA), GFPRIME)
```

the multiplication happens on infinite-precision integers

## `gfpmadd` Prime Galois Field `GF(p)` Multiply-Add

```
gfpmadd RT, RA, RB, RC
```

```
(RT) = int_to_gfp((RA) * (RB) + (RC), GFPRIME)
```

the multiplication and addition happens on infinite-precision integers

## `gfpmsub` Prime Galois Field `GF(p)` Multiply-Subtract

```
gfpmsub RT, RA, RB, RC
```

```
(RT) = int_to_gfp((RA) * (RB) - (RC), GFPRIME)
```

the multiplication and subtraction happens on infinite-precision integers

## `gfpmsubr` Prime Galois Field `GF(p)` Multiply-Subtract-Reversed

```
gfpmsubr RT, RA, RB, RC
```

```
(RT) = int_to_gfp((RC) - (RA) * (RB), GFPRIME)
```

the multiplication and subtraction happens on infinite-precision integers

## `gfpmaddsubr` Prime Galois Field `GF(p)` Multiply-Add and Multiply-Sub-Reversed (for FFT)

```
gfpmaddsubr RT, RA, RB, RC
```

TODO: add link to explanation for where `RS` comes from.

```
product = (RA) * (RB)
term = (RC)
(RT) = int_to_gfp(product + term, GFPRIME)
(RS) = int_to_gfp(term - product, GFPRIME)
```

the multiplication, addition, and subtraction happens on infinite-precision integers

## Twin Butterfly (Tukey-Cooley) Mul-add-sub

used in combination with SV FFT REMAP to perform
a full NTT in-place. possible by having 3-in 2-out,
to avoid the need for a temp register.  RS is written
to as well as RT.

    gffmadd  RT,RA,RC,RB (Rc=0)
    gffmadd. RT,RA,RC,RB (Rc=1)

Pseudo-code:

    RT <- GFADD(GFMUL(RA, RC), RB))
    RS <- GFADD(GFMUL(RA, RC), RB))


## Multiply

with the modulo and degree being in an SPR, multiply can be identical
equivalent to standard integer add

    RS = GFMUL(RA, RB)

| 0.5|6.10|11.15|16.20|21.25| 26..30 |31|
| -- | -- | --- | --- | --- | ------ |--|
| NN | RT | RA  | RB  |11000|  01110 |Rc|



```
from functools import reduce

def gf_degree(a) :
  res = 0
  a >>= 1
  while (a != 0) :
    a >>= 1;
    res += 1;
  return res

# constants used in the multGF2 function
mask1 = mask2 = polyred = None

def setGF2(irPoly):
    """Define parameters of binary finite field GF(2^m)/g(x)
       - irPoly: coefficients of irreducible polynomial g(x)
    """
    # degree: extension degree of binary field
    degree = gf_degree(irPoly)

    def i2P(sInt):
        """Convert an integer into a polynomial"""
        return [(sInt >> i) & 1
                for i in reversed(range(sInt.bit_length()))]    
    
    global mask1, mask2, polyred
    mask1 = mask2 = 1 << degree
    mask2 -= 1
    polyred = reduce(lambda x, y: (x << 1) + y, i2P(irPoly)[1:])
        
def multGF2(p1, p2):
    """Multiply two polynomials in GF(2^m)/g(x)"""
    p = 0
    while p2:
        # standard long-multiplication: check LSB and add
        if p2 & 1:
            p ^= p1
        p1 <<= 1
        # standard modulo: check MSB and add polynomial
        if p1 & mask1:
            p1 ^= polyred
        p2 >>= 1
    return p & mask2

if __name__ == "__main__":
  
    # Define binary field GF(2^3)/x^3 + x + 1
    setGF2(0b1011) # degree 3

    # Evaluate the product (x^2 + x + 1)(x^2 + 1)
    print("{:02x}".format(multGF2(0b111, 0b101)))
    
    # Define binary field GF(2^8)/x^8 + x^4 + x^3 + x + 1
    # (used in the Advanced Encryption Standard-AES)
    setGF2(0b100011011) # degree 8
    
    # Evaluate the product (x^7)(x^7 + x + 1)
    print("{:02x}".format(multGF2(0b10000000, 0b10000011)))
```

## GF(2^M) Inverse

```
# https://bugs.libre-soc.org/show_bug.cgi?id=782#c33
# https://ftp.libre-soc.org/ARITH18_Kobayashi.pdf
def gf_invert(a) :

    s = getGF2() # get the full polynomial (including the MSB)
    r = a
    v = 0
    u = 1
    j = 0

    for i in range(1, 2*degree+1):
        # could use count-trailing-1s here to skip ahead
        if r & mask1:          # test MSB of r
            if s & mask1:      # test MSB of s
                s ^= r
                v ^= u
            s <<= 1            # shift left 1
            if j == 0:
                r, s = s, r    # swap r,s
                u, v = v<<1, u # shift v and swap
                j = 1
            else:
                u >>= 1        # right shift left
                j -= 1
        else:
            r <<= 1            # shift left 1
            u <<= 1            # shift left 1
            j += 1

    return u
```

# GF2 (Carryless)

## GF2 (carryless) div and mod

```
def gf_degree(a) :
  res = 0
  a >>= 1
  while (a != 0) :
    a >>= 1;
    res += 1;
  return res

def FullDivision(self, f, v):
        """
        Takes two arguments, f, v
        fDegree and vDegree are the degrees of the field elements
        f and v represented as a polynomials.
        This method returns the field elements a and b such that

            f(x) = a(x) * v(x) + b(x).  

        That is, a is the divisor and b is the remainder, or in
        other words a is like floor(f/v) and b is like f modulo v.
        """

        fDegree, vDegree = gf_degree(f), gf_degree(v)
        res, rem = 0, f
        for i in reversed(range(vDegree, fDegree+1):
            if ((rem >> i) & 1): # check bit
                res ^= (1 << (i - vDegree))
                rem ^= ( v << (i - vDegree)))
        return (res, rem)
```

| 0.5|6.10|11.15|16.20| 21 | 22.23 | 24....30 |31| name |
| -- | -- | --- | --- | -- | ----- | -------- |--| ---- |
| NN | RT | RA  | RB  | 1  |  00   | 0001 110 |Rc| cldiv |
| NN | RT | RA  | RB  | 1  |  01   | 0001 110 |Rc| clmod |

## GF2 carryless mul

based on RV bitmanip
see <https://en.wikipedia.org/wiki/CLMUL_instruction_set> and
<https://www.felixcloutier.com/x86/pclmulqdq> and
<https://en.m.wikipedia.org/wiki/Carry-less_product>

these are GF2 operations with the modulo set to 2^degree.
they are worth adding as their own non-overwrite operations
(in the same pipeline).

```
uint_xlen_t clmul(uint_xlen_t RA, uint_xlen_t RB)
{
    uint_xlen_t x = 0;
    for (int i = 0; i < XLEN; i++)
        if ((RB >> i) & 1)
            x ^= RA << i;
    return x;
}
uint_xlen_t clmulh(uint_xlen_t RA, uint_xlen_t RB)
{
    uint_xlen_t x = 0;
    for (int i = 1; i < XLEN; i++)
        if ((RB >> i) & 1)
            x ^= RA >> (XLEN-i);
    return x;
}
uint_xlen_t clmulr(uint_xlen_t RA, uint_xlen_t RB)
{
    uint_xlen_t x = 0;
    for (int i = 0; i < XLEN; i++)
        if ((RB >> i) & 1)
            x ^= RA >> (XLEN-i-1);
    return x;
}
```
## carryless Twin Butterfly (Tukey-Cooley) Mul-add-sub

used in combination with SV FFT REMAP to perform
a full NTT in-place. possible by having 3-in 2-out,
to avoid the need for a temp register.  RS is written
to as well as RT.

    clfmadd  RT,RA,RC,RB (Rc=0)
    clfmadd. RT,RA,RC,RB (Rc=1)

Pseudo-code:

    RT <- CLMUL(RA, RC) ^ RB
    RS <- CLMUL(RA, RC) ^ RB


# bitmatrix

```
uint64_t bmatflip(uint64_t RA)
{
    uint64_t x = RA;
    x = shfl64(x, 31);
    x = shfl64(x, 31);
    x = shfl64(x, 31);
    return x;
}
uint64_t bmatxor(uint64_t RA, uint64_t RB)
{
    // transpose of RB
    uint64_t RBt = bmatflip(RB);
    uint8_t u[8]; // rows of RA
    uint8_t v[8]; // cols of RB
    for (int i = 0; i < 8; i++) {
        u[i] = RA >> (i*8);
        v[i] = RBt >> (i*8);
    }
    uint64_t x = 0;
    for (int i = 0; i < 64; i++) {
        if (pcnt(u[i / 8] & v[i % 8]) & 1)
            x |= 1LL << i;
    }
    return x;
}
uint64_t bmator(uint64_t RA, uint64_t RB)
{
    // transpose of RB
    uint64_t RBt = bmatflip(RB);
    uint8_t u[8]; // rows of RA
    uint8_t v[8]; // cols of RB
    for (int i = 0; i < 8; i++) {
        u[i] = RA >> (i*8);
        v[i] = RBt >> (i*8);
    }
    uint64_t x = 0;
    for (int i = 0; i < 64; i++) {
        if ((u[i / 8] & v[i % 8]) != 0)
            x |= 1LL << i;
    }
    return x;
}

```

# Already in POWER ISA

## count leading/trailing zeros with mask

in v3.1 p105

```
count = 0
do i = 0 to 63 if((RB)i=1) then do
if((RS)i=1) then break end end count ← count + 1
RA ← EXTZ64(count)
```

##  bit deposit

vpdepd VRT,VRA,VRB, identical to RV bitmamip bdep, found already in v3.1 p106

    do while(m < 64)
       if VSR[VRB+32].dword[i].bit[63-m]=1 then do
          result = VSR[VRA+32].dword[i].bit[63-k]
          VSR[VRT+32].dword[i].bit[63-m] = result
          k = k + 1
       m = m + 1

```

uint_xlen_t bdep(uint_xlen_t RA, uint_xlen_t RB)
{
    uint_xlen_t r = 0;
    for (int i = 0, j = 0; i < XLEN; i++)
        if ((RB >> i) & 1) {
            if ((RA >> j) & 1)
                r |= uint_xlen_t(1) << i;
            j++;
        }
    return r;
}

```

# bit extract

other way round: identical to RV bext, found in v3.1 p196

```
uint_xlen_t bext(uint_xlen_t RA, uint_xlen_t RB)
{
    uint_xlen_t r = 0;
    for (int i = 0, j = 0; i < XLEN; i++)
        if ((RB >> i) & 1) {
            if ((RA >> i) & 1)
                r |= uint_xlen_t(1) << j;
            j++;
        }
    return r;
}
```

# centrifuge

found in v3.1 p106 so not to be added here

```
ptr0 = 0
ptr1 = 0
do i = 0 to 63
    if((RB)i=0) then do
       resultptr0 = (RS)i
    end 
    ptr0 = ptr0 + 1
    if((RB)63-i==1) then do
        result63-ptr1 = (RS)63-i
    end
    ptr1 = ptr1 + 1
RA = result
```